Email: 657732 Autolearn: 0 AvgScore: 3.37 AvgScanTime: 3.81 sec Spam: 186379 Autolearn: 0 AvgScore: 13.34 AvgScanTime: 4.24 sec Ham: 471353 Autolearn: 0 AvgScore: -0.58 AvgScanTime: 3.64 sec Time Spent Running SA: 696.15 hours Time Spent Processing Spam: 219.74 hours Time Spent Processing Ham: 476.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174710 88.83 93.74 86.88 2 DCC_CHECK 145064 49.27 77.83 37.97 3 DKIM_SIGNED 144517 74.16 77.54 72.83 4 XM_DK_Pass 138149 72.35 74.12 71.65 5 DKIM_VALID 131507 68.21 70.56 67.28 6 XMListUnsubscribeExists 123089 54.10 66.04 49.38 7 DKIM_VALID_AU 103888 49.59 55.74 47.16 8 XM_H_QuotedFrom 98886 40.86 53.06 36.04 9 BAYES_50 72920 53.75 39.12 59.53 10 HTML_FONT_LOW_CONTRAST 66134 28.69 35.48 26.00 11 XM_DK_Undo_02 65302 16.55 35.04 9.24 12 MIME_HTML_ONLY 64998 23.40 34.87 18.87 13 LOC_TINY_FONT_1 64061 24.79 34.37 21.00 14 BAYES_99 57856 14.46 31.04 7.90 15 BAYES_999 47313 11.96 25.39 6.65 16 FVGT_m_MULTI_ODD 47232 22.09 25.34 20.81 17 XMSubLong 46997 21.97 25.22 20.68 18 TR_DCC_Bayes_99 46926 9.85 25.18 3.78 19 DKIM_VALID_EF 42346 24.52 22.72 25.24 20 T_TM2_M_HEADER_IN_MSG 41345 28.52 22.18 31.03 21 DCC_CHECK_NEGATIVE 38744 48.87 20.79 59.97 22 BOTNET 38722 7.11 20.78 1.71 23 T_KAM_HTML_FONT_INVALID 35781 17.24 19.20 16.46 24 XM_Body_Dirty_Words 34306 12.96 18.41 10.80 25 FSL_BULK_SIG 28624 8.92 15.36 6.37 26 LOTS_OF_MONEY 28391 9.88 15.23 7.77 27 XM_Multi_Part_URI 27311 11.83 14.65 10.71 28 FROM_EXCESS_BASE64 27242 6.88 14.62 3.82 29 MultiRelay 27097 17.05 14.54 18.05 30 RELAYCOUNTRY_META 26615 7.55 14.28 4.89 31 XM_Evil_Numbers_Gen 26010 9.55 13.96 7.80 32 HTML_IMAGE_RATIO_02 25211 9.49 13.53 7.89 33 XM_UncommonTLD01 24635 5.98 13.22 3.11 34 BOTNET_IPINHOSTNAME 23417 7.40 12.56 5.36 35 T_REMOTE_IMAGE 21506 6.12 11.54 3.97 36 HTML_MIME_NO_HTML_TAG 20404 4.89 10.95 2.49 37 RCVD_IN_RP_RNBL 19956 3.06 10.71 0.03 38 SpammyFromTLD_02 19900 3.24 10.68 0.30 39 BAYES_80 19338 5.37 10.38 3.38 40 TR_XM_DocInvoice 18185 5.45 9.76 3.75 41 HTML_SHORT_LINK_IMG_1 17602 2.70 9.44 0.03 42 XMSexyCombo_05 17399 4.82 9.34 3.03 43 MISSING_HEADERS 17131 2.96 9.19 0.50 44 BODY_URI_ONLY 17011 2.66 9.13 0.10 45 BAYES_60 16415 7.00 8.81 6.28 46 MIME_HEADER_CTYPE_ONLY 16135 2.55 8.66 0.14 47 SHORTENER_SHORT_IMG 16083 2.45 8.63 0.00 48 URI_BUFFLY 15682 2.38 8.41 0.00 49 T_XMDrugObfuBody_14 15615 8.25 8.38 8.21 50 UNTRUSTED_Relay 15597 3.23 8.37 1.20 51 HTML_IMAGE_ONLY_04 15573 2.41 8.36 0.05 52 MPART_ALT_DIFF 15573 4.31 8.36 2.71 53 HTML_IMAGE_RATIO_04 14905 5.69 8.00 4.77 54 XM_H_Long_From01 14828 6.61 7.96 6.08 55 XMNumbers 14424 4.71 7.74 3.51 56 XM_B_Phish_Phrases 13838 5.81 7.42 5.18 57 HTML_SHORT_CENTER 13791 2.10 7.40 0.00 58 XMSubMetaSx_00 13053 4.72 7.00 3.81 59 DKIM_INVALID 13010 5.95 6.98 5.54 60 TooManyTo_001 12479 8.21 6.70 8.80 61 XM_OfRef6 10605 2.70 5.69 1.52 62 BAYES_95 10474 3.18 5.62 2.22 63 LotsOfNums_01 10241 8.15 5.49 9.21 64 HTML_IMAGE_RATIO_06 9353 3.77 5.02 3.28 65 TM2_M_URI_OPT_OUT 8726 2.88 4.68 2.16 66 XMStrtUSub 8414 4.18 4.51 4.05 67 ALL_TRUSTED 7526 13.70 4.04 17.52 68 XM_DIRTYINTL 7231 2.41 3.88 1.83 69 MIME_HTML_MOSTLY 7158 2.82 3.84 2.41 70 XM_SPF_SoftFail 7037 2.58 3.78 2.11 71 XM_UB50 6761 1.55 3.63 0.73 72 MIME_HTML_ONLY_MULTI 6739 1.94 3.62 1.28 73 XM_OfRef7 6708 1.22 3.60 0.29 74 FILL_THIS_FORM 6220 1.29 3.34 0.49 75 XM_CamelCaseFrm001 6073 2.28 3.26 1.89 76 T_FILL_THIS_FORM_LONG 6070 1.22 3.26 0.41 77 XM_SendGrid 5988 4.71 3.21 5.31 78 RCVD_IN_MSPIKE_H2 5888 4.54 3.16 5.08 79 FILL_THIS_FORM_LOAN 5873 1.02 3.15 0.17 80 RELAYCOUNTRY_CA 5691 1.93 3.05 1.49 81 HTML_IMAGE_RATIO_08 5555 2.24 2.98 1.94 82 XM_URI_RBL 5529 1.06 2.97 0.31 83 URI_HEX 5525 1.81 2.96 1.35 84 T_XMDrugObfuBody_08 5342 1.88 2.87 1.48 85 AC_FROM_MANY_DOTS 5339 0.83 2.86 0.03 86 MIME_QP_LONG_LINE 4997 5.60 2.68 6.76 87 DIET_1 4873 0.96 2.61 0.31 88 T_TooManySym_01 4581 5.06 2.46 6.08 89 XMDiploma_00 4504 1.92 2.42 1.72 90 MultiRelay_Combo 4309 0.77 2.31 0.16 91 MultiRelay_CC 4309 0.77 2.31 0.16 92 XMSubMetaI_00 4242 1.20 2.28 0.77 93 RCVD_IN_RP_SAFE 3938 7.09 2.11 9.05 94 URI_TRY_3LD 3613 1.23 1.94 0.95 95 RCVD_IN_BL_SPAMCOP_NET 3584 0.80 1.92 0.35 96 XMSexyCombo_01 3464 0.91 1.86 0.54 97 XM_BadFromFormat 3399 0.66 1.82 0.21 98 BAYES_40 3336 3.48 1.79 4.14 99 XMHTML_After_End 3242 0.82 1.74 0.46 100 T_Symld_Words_02 3183 0.91 1.71 0.60 101 XMGenDplmaNmb 3174 1.30 1.70 1.14 102 BOTNET_NORDNS 3171 0.49 1.70 0.01 103 XMBody_17 3142 1.03 1.69 0.77 104 XMMoneyMeta_00 3109 0.87 1.67 0.55 105 DKIM_ADSP_CUSTOM_MED 3058 1.18 1.64 1.00 106 XM_UB99 3034 0.48 1.63 0.02 107 XMSlimDrugH 3016 0.73 1.62 0.37 108 NML_ADSP_CUSTOM_MED 2984 0.95 1.60 0.70 109 XMBdyGiftCard01 2979 1.28 1.60 1.15 110 SUBJ_ALL_CAPS 2957 1.62 1.59 1.63 111 XM_H_Long_From02 2936 1.23 1.58 1.09 112 US_DOLLARS_3 2895 1.15 1.55 0.99 113 RELAYCOUNTRY_FR 2891 0.59 1.55 0.21 114 TR_XM_RelayPhish 2759 0.78 1.48 0.50 115 MAILING_LIST_MULTI 2752 2.04 1.48 2.26 116 UNPARSEABLE_RELAY 2747 2.82 1.47 3.36 117 XMLngstWrd_00 2696 0.76 1.45 0.48 118 XMLngstWrd_01 2675 0.72 1.44 0.43 119 RCVD_IN_IADB_LISTED 2646 4.81 1.42 6.15 120 BAYES_20 2644 2.60 1.42 3.07 121 XMLngstWrd_02 2632 0.55 1.41 0.21 122 SUBJ_DOLLARS 2626 0.60 1.41 0.28 123 TM2_M_VERY_LONG_WORD 2617 1.08 1.40 0.95 124 HTML_TAG_BALANCE_BODY 2537 0.76 1.36 0.53 125 T_FILL_THIS_FORM_SHORT 2535 0.99 1.36 0.84 126 XM_HighProb1 2525 0.39 1.35 0.01 127 XMLngstWrd_03 2516 0.46 1.35 0.11 128 SpammyFromTLD_01 2504 0.90 1.34 0.73 129 HTML_FONT_SIZE_LARGE 2429 0.51 1.30 0.20 130 XM_UB999 2386 0.37 1.28 0.01 131 TR_LOTS_OF_MONEY3 2371 0.71 1.27 0.49 132 RCVD_IN_RP_CERTIFIED 2354 6.26 1.26 8.23 133 RELAYCOUNTRY_GB 2272 1.06 1.22 0.99 134 T_TVD_MIME_EPI 2272 0.36 1.22 0.02 135 TR_LOTS_OF_MONEY1 2258 0.36 1.21 0.02 136 RCVD_IN_IADB_SPF 2183 4.27 1.17 5.50 137 XMPhish30 2139 0.63 1.15 0.42 138 XM_DK_Undo_01 2134 1.61 1.14 1.80 139 XM_H_PHPOS 2133 1.48 1.14 1.61 140 XMStockSpam_06 2108 0.77 1.13 0.62 141 XMPhish11 2099 1.19 1.13 1.21 142 DKIM_ADSP_NXDOMAIN 2094 0.77 1.12 0.63 143 RCVD_IN_IADB_SENDERID 2068 3.79 1.11 4.85 144 BAYES_00 2054 8.51 1.10 11.44 145 XM_UB60 2052 0.37 1.10 0.09 146 T_XMDrugObfuBody_00 2041 0.84 1.10 0.73 147 URIBL_BLACK 2040 0.37 1.09 0.09 148 TR_LOTS_OF_MONEY2 2020 0.41 1.08 0.15 149 T_MONEY_PERCENT 2020 0.41 1.08 0.15 150 RCVD_IN_IADB_DK 2015 3.77 1.08 4.84 151 TR_Symld_Words 2008 1.55 1.08 1.73 152 PLING_QUERY 1983 0.49 1.06 0.27 153 URIBL_DBL_SPAM 1974 0.32 1.06 0.03 154 T_XMHurry_00 1928 0.73 1.03 0.61 155 RELAYCOUNTRY_CN 1925 0.33 1.03 0.05 156 DATE_IN_PAST_03_06 1924 0.35 1.03 0.08 157 XMPhish14 1880 0.72 1.01 0.60 158 NORDNS_LOW_CONTRAST 1859 0.29 1.00 0.01 159 XMWghtMeta_00 1859 0.30 1.00 0.02 160 TR_MetaPhish_Combo_01 1820 1.48 0.98 1.68 161 HTML_FONT_FACE_BAD 1764 0.65 0.95 0.54 162 XMSubMetaSxObfu_03 1760 0.68 0.94 0.57 163 RDNS_DYNAMIC 1697 0.60 0.91 0.47 164 XM_UB80 1697 0.30 0.91 0.06 165 FORGED_GMAIL_RCVD 1688 0.66 0.91 0.56 166 RCVD_IN_IADB_VOUCHED 1687 2.85 0.91 3.61 167 T_HTML_TAG_BALANCE_CENTER 1620 0.34 0.87 0.13 168 RELAYCOUNTRY_IN 1608 0.35 0.86 0.15 169 XMBody_78 1580 0.54 0.85 0.42 170 XM_B_COPY_HTML 1571 0.52 0.84 0.40 171 HTTPS_HTTP_MISMATCH 1557 0.60 0.84 0.50 172 HTML_IMAGE_ONLY_08 1551 0.33 0.83 0.13 173 BODY_ENHANCEMENT 1525 0.25 0.82 0.02 174 TR_Mismatch_TLD_02 1517 0.29 0.81 0.08 175 HTML_IMAGE_ONLY_28 1504 0.50 0.81 0.38 176 XMBSHREFv2 1487 0.33 0.80 0.14 177 XM_PDF 1486 3.76 0.80 4.93 178 RELAYCOUNTRY_DE 1470 0.53 0.79 0.43 179 XM_ProductURIs 1460 0.65 0.78 0.60 180 RELAYCOUNTRY_AU 1451 0.55 0.78 0.45 181 URI_NOVOWEL 1426 0.57 0.77 0.49 182 FROM_SUSPICIOUS_NTLD 1396 0.24 0.75 0.04 183 XM_XX_Yahoo 1391 0.30 0.75 0.12 184 XMBrknScrpt_02 1386 0.61 0.74 0.56 185 LongTLD 1377 0.33 0.74 0.16 186 TR_XM_DK_Bayes 1373 5.96 0.74 8.03 187 RELAYCOUNTRY_AT 1357 0.33 0.73 0.18 188 REMOVE_BEFORE_LINK 1349 0.49 0.72 0.40 189 BAYES_05 1342 1.66 0.72 2.03 190 XMHTMLBadTable_001 1290 0.65 0.69 0.64 191 HTML_IMAGE_ONLY_12 1284 0.38 0.69 0.26 192 XM_RXBody 1263 0.47 0.68 0.39 193 T_TooManySym_02 1247 1.76 0.67 2.19 194 XM_H_PHPMailer 1232 0.63 0.66 0.61 195 TR_XM_DK_Bayes1 1222 5.52 0.66 7.44 196 XMSubMetaI_01 1187 0.24 0.64 0.08 197 TR_XM_DK_Bayes2 1180 4.87 0.63 6.54 198 XM_S_JOY_D 1179 0.37 0.63 0.27 199 DEAR_FRIEND 1127 0.26 0.60 0.12 200 RCVD_IN_IADB_OPTIN 1124 1.84 0.60 2.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 409533 88.83 93.74 86.88 2 DKIM_SIGNED 343270 74.16 77.54 72.83 3 XM_DK_Pass 337747 72.35 74.12 71.65 4 DKIM_VALID 317134 68.21 70.56 67.28 5 DCC_CHECK_NEGATIVE 282676 48.87 20.79 59.97 6 BAYES_50 280611 53.75 39.12 59.53 7 XMListUnsubscribeExists 232747 54.10 66.04 49.38 8 DKIM_VALID_AU 222293 49.59 55.74 47.16 9 DCC_CHECK 178973 49.27 77.83 37.97 10 XM_H_QuotedFrom 169857 40.86 53.06 36.04 11 T_TM2_M_HEADER_IN_MSG 146270 28.52 22.18 31.03 12 HTML_FONT_LOW_CONTRAST 122544 28.69 35.48 26.00 13 DKIM_VALID_EF 118960 24.52 22.72 25.24 14 LOC_TINY_FONT_1 98968 24.79 34.37 21.00 15 FVGT_m_MULTI_ODD 98076 22.09 25.34 20.81 16 XMSubLong 97493 21.97 25.22 20.68 17 MIME_HTML_ONLY 88944 23.40 34.87 18.87 18 MultiRelay 85063 17.05 14.54 18.05 19 ALL_TRUSTED 82581 13.70 4.04 17.52 20 T_KAM_HTML_FONT_INVALID 77580 17.24 19.20 16.46 21 XM_DKIMWhitelistDomains 59782 9.25 0.58 12.68 22 BAYES_00 53926 8.51 1.10 11.44 23 XM_Body_Dirty_Words 50916 12.96 18.41 10.80 24 XM_Multi_Part_URI 50484 11.83 14.65 10.71 25 XM_DK_Undo_02 43536 16.55 35.04 9.24 26 LotsOfNums_01 43389 8.15 5.49 9.21 27 RCVD_IN_RP_SAFE 42668 7.09 2.11 9.05 28 TooManyTo_001 41496 8.21 6.70 8.80 29 RCVD_IN_RP_CERTIFIED 38795 6.26 1.26 8.23 30 T_XMDrugObfuBody_14 38680 8.25 8.38 8.21 31 TR_XM_DK_Bayes 37836 5.96 0.74 8.03 32 BAYES_99 37243 14.46 31.04 7.90 33 HTML_IMAGE_RATIO_02 37187 9.49 13.53 7.89 34 XM_Evil_Numbers_Gen 36772 9.55 13.96 7.80 35 LOTS_OF_MONEY 36623 9.88 15.23 7.77 36 TR_XM_DK_Bayes1 35057 5.52 0.66 7.44 37 MIME_QP_LONG_LINE 31845 5.60 2.68 6.76 38 BAYES_999 31352 11.96 25.39 6.65 39 TR_XM_DK_Bayes2 30824 4.87 0.63 6.54 40 FSL_BULK_SIG 30018 8.92 15.36 6.37 41 BAYES_60 29605 7.00 8.81 6.28 42 RCVD_IN_IADB_LISTED 28970 4.81 1.42 6.15 43 T_TooManySym_01 28681 5.06 2.46 6.08 44 XM_H_Long_From01 28653 6.61 7.96 6.08 45 DKIM_INVALID 26136 5.95 6.98 5.54 46 RCVD_IN_IADB_SPF 25912 4.27 1.17 5.50 47 BOTNET_IPINHOSTNAME 25285 7.40 12.56 5.36 48 XM_SendGrid 25024 4.71 3.21 5.31 49 XM_B_Phish_Phrases 24396 5.81 7.42 5.18 50 RCVD_IN_MSPIKE_H2 23966 4.54 3.16 5.08 51 XM_PDF 23254 3.76 0.80 4.93 52 RELAYCOUNTRY_META 23065 7.55 14.28 4.89 53 RCVD_IN_IADB_SENDERID 22875 3.79 1.11 4.85 54 RCVD_IN_IADB_DK 22803 3.77 1.08 4.84 55 HTML_IMAGE_RATIO_04 22500 5.69 8.00 4.77 56 BAYES_40 19533 3.48 1.79 4.14 57 XMStrtUSub 19112 4.18 4.51 4.05 58 IN_ZIMBRA_NJ_WHITELIST 18901 2.88 0.02 4.01 59 T_REMOTE_IMAGE 18716 6.12 11.54 3.97 60 FROM_EXCESS_BASE64 17999 6.88 14.62 3.82 61 XMSubMetaSx_00 17976 4.72 7.00 3.81 62 TR_DCC_Bayes_99 17835 9.85 25.18 3.78 63 TR_XM_DocInvoice 17669 5.45 9.76 3.75 64 RCVD_IN_IADB_VOUCHED 17033 2.85 0.91 3.61 65 XMNumbers 16535 4.71 7.74 3.51 66 BAYES_80 15954 5.37 10.38 3.38 67 UNPARSEABLE_RELAY 15822 2.82 1.47 3.36 68 TVD_RCVD_IP 15649 2.45 0.27 3.32 69 HTML_IMAGE_RATIO_06 15453 3.77 5.02 3.28 70 XM_UncommonTLD01 14679 5.98 13.22 3.11 71 BAYES_20 14462 2.60 1.42 3.07 72 XMSexyCombo_05 14275 4.82 9.34 3.03 73 TO_MALFORMED 13943 2.13 0.05 2.96 74 BOUNCE_MESSAGE 13291 2.15 0.46 2.82 75 ANY_BOUNCE_MESSAGE 13291 2.15 0.46 2.82 76 MPART_ALT_DIFF 12771 4.31 8.36 2.71 77 TooManyTo_002 12517 2.07 0.59 2.66 78 HTML_MIME_NO_HTML_TAG 11740 4.89 10.95 2.49 79 MIME_HTML_MOSTLY 11379 2.82 3.84 2.41 80 RCVD_IN_IADB_OPTIN 10958 1.84 0.60 2.32 81 MAILING_LIST_MULTI 10659 2.04 1.48 2.26 82 BAYES_95 10469 3.18 5.62 2.22 83 T_TooManySym_02 10309 1.76 0.67 2.19 84 TM2_M_URI_OPT_OUT 10198 2.88 4.68 2.16 85 HELO_NODOT 9964 1.66 0.52 2.11 86 XM_SPF_SoftFail 9939 2.58 3.78 2.11 87 BAYES_05 9545 1.66 0.72 2.03 88 RCVD_IN_MSPIKE_WL 9418 1.58 0.54 2.00 89 RCVD_IN_MSPIKE_H3 9403 1.57 0.51 1.99 90 HTML_IMAGE_RATIO_08 9147 2.24 2.98 1.94 91 XM_CamelCaseFrm001 8899 2.28 3.26 1.89 92 XM_DIRTYINTL 8635 2.41 3.88 1.83 93 XM_DK_Undo_01 8475 1.61 1.14 1.80 94 TR_Symld_Words 8172 1.55 1.08 1.73 95 XMDiploma_00 8099 1.92 2.42 1.72 96 BOTNET 8042 7.11 20.78 1.71 97 IN_HORDE_ADDRESS_BOOK 7940 1.22 0.05 1.68 98 TR_MetaPhish_Combo_01 7928 1.48 0.98 1.68 99 SUBJ_ALL_CAPS 7671 1.62 1.59 1.63 100 XM_H_PHPOS 7607 1.48 1.14 1.61 101 XMCapTrack 7572 1.22 0.25 1.61 102 TooManyTo_003 7281 1.24 0.48 1.54 103 XM_OfRef6 7169 2.70 5.69 1.52 104 INVALID_MSGID 7052 1.13 0.20 1.50 105 RELAYCOUNTRY_CA 7034 1.93 3.05 1.49 106 T_XMDrugObfuBody_08 6997 1.88 2.87 1.48 107 URI_HEX 6355 1.81 2.96 1.35 108 MIME_HTML_ONLY_MULTI 6052 1.94 3.62 1.28 109 XM_GoogleGroups 5795 0.99 0.40 1.23 110 USER_IN_DEF_DKIM_WL 5741 0.88 0.01 1.22 111 XMPhish11 5696 1.19 1.13 1.21 112 UNTRUSTED_Relay 5639 3.23 8.37 1.20 113 TooManyTo_004 5496 0.93 0.33 1.17 114 XMBdyGiftCard01 5443 1.28 1.60 1.15 115 XMGenDplmaNmb 5395 1.30 1.70 1.14 116 XM_H_Long_From02 5156 1.23 1.58 1.09 117 DKIM_ADSP_CUSTOM_MED 4692 1.18 1.64 1.00 118 RELAYCOUNTRY_GB 4688 1.06 1.22 0.99 119 US_DOLLARS_3 4646 1.15 1.55 0.99 120 TooManyTo_005 4625 0.78 0.28 0.98 121 TM2_M_VERY_LONG_WORD 4486 1.08 1.40 0.95 122 URI_TRY_3LD 4457 1.23 1.94 0.95 123 T_FILL_THIS_FORM_SHORT 3980 0.99 1.36 0.84 124 XMSubMetaI_00 3648 1.20 2.28 0.77 125 XMBody_17 3613 1.03 1.69 0.77 126 TO_NO_BRKTS_HTML_ONLY 3583 0.60 0.19 0.76 127 T_XMDrugObfuBody_00 3463 0.84 1.10 0.73 128 XM_UB50 3438 1.55 3.63 0.73 129 SpammyFromTLD_01 3423 0.90 1.34 0.73 130 NML_ADSP_CUSTOM_MED 3286 0.95 1.60 0.70 131 T_TooManySym_03 3260 0.53 0.14 0.69 132 XMHTMLBadTable_001 2996 0.65 0.69 0.64 133 DKIM_ADSP_NXDOMAIN 2964 0.77 1.12 0.63 134 T_OBFU_PDF_ATTACH 2941 0.51 0.21 0.62 135 XMStockSpam_06 2930 0.77 1.13 0.62 136 XM_H_PHPMailer 2892 0.63 0.66 0.61 137 XM_B_REG_HTML 2866 0.54 0.36 0.61 138 T_XMHurry_00 2854 0.73 1.03 0.61 139 XMPhish14 2840 0.72 1.01 0.60 140 T_Symld_Words_02 2826 0.91 1.71 0.60 141 XM_ProductURIs 2819 0.65 0.78 0.60 142 XMNoVowels 2796 0.56 0.47 0.59 143 XMSubMetaSxObfu_03 2706 0.68 0.94 0.57 144 FORGED_GMAIL_RCVD 2631 0.66 0.91 0.56 145 XMBrknScrpt_02 2625 0.61 0.74 0.56 146 XMMoneyMeta_00 2595 0.87 1.67 0.55 147 USER_IN_WHITELIST 2587 0.39 0.00 0.55 148 XMSexyCombo_01 2553 0.91 1.86 0.54 149 XMSubMetaSxObfu_02 2547 0.46 0.26 0.54 150 HTML_FONT_FACE_BAD 2544 0.65 0.95 0.54 151 HTML_TAG_BALANCE_BODY 2481 0.76 1.36 0.53 152 FROM_GOV_SPOOF 2481 0.43 0.17 0.53 153 HTML_IMAGE_ONLY_24 2401 0.50 0.46 0.51 154 SHORT_HELO_AND_INLINE_IMAGE 2391 0.38 0.06 0.51 155 XMBody_95 2369 0.39 0.12 0.50 156 TR_XM_RelayPhish 2364 0.78 1.48 0.50 157 HTTPS_HTTP_MISMATCH 2361 0.60 0.84 0.50 158 MISSING_HEADERS 2337 2.96 9.19 0.50 159 URI_NOVOWEL 2314 0.57 0.77 0.49 160 TR_LOTS_OF_MONEY3 2299 0.71 1.27 0.49 161 FILL_THIS_FORM 2295 1.29 3.34 0.49 162 XMLngstWrd_00 2280 0.76 1.45 0.48 163 HTML_IMAGE_ONLY_32 2269 0.41 0.22 0.48 164 XM_USANA_RCVD 2239 0.34 0.00 0.48 165 RDNS_DYNAMIC 2229 0.60 0.91 0.47 166 XMDateMe_00 2204 0.44 0.36 0.47 167 XMHTML_After_End 2181 0.82 1.74 0.46 168 XM_ShortIntro_01 2148 0.43 0.37 0.46 169 RELAYCOUNTRY_AU 2141 0.55 0.78 0.45 170 XMGappySubj_01 2092 0.40 0.30 0.44 171 RCVD_IN_SORBS_DUL 2067 0.44 0.44 0.44 172 XMLngstWrd_01 2041 0.72 1.44 0.43 173 RELAYCOUNTRY_DE 2029 0.53 0.79 0.43 174 XMPhish30 1987 0.63 1.15 0.42 175 XMBody_78 1984 0.54 0.85 0.42 176 T_FILL_THIS_FORM_LONG 1947 1.22 3.26 0.41 177 TM2_M_BODY_EMPTY 1900 0.33 0.14 0.40 178 REMOVE_BEFORE_LINK 1890 0.49 0.72 0.40 179 XM_B_COPY_HTML 1879 0.52 0.84 0.40 180 XM_RXBody 1817 0.47 0.68 0.39 181 NO_DNS_FOR_FROM 1787 0.40 0.46 0.38 182 HTML_IMAGE_ONLY_28 1787 0.50 0.81 0.38 183 XMSlimDrugH 1753 0.73 1.62 0.37 184 TM2_M_A_HREF_HREF 1711 0.42 0.58 0.36 185 RCVD_IN_BL_SPAMCOP_NET 1669 0.80 1.92 0.35 186 AC_DIV_BONANZA 1585 0.26 0.08 0.34 187 HTML_IMAGE_ONLY_16 1556 0.32 0.31 0.33 188 XMSubNoVowel 1547 0.39 0.56 0.33 189 T_FROM_GOV_DKIM_AU 1542 0.26 0.09 0.33 190 TVD_SPACE_RATIO 1474 0.29 0.24 0.31 191 DIET_1 1470 0.96 2.61 0.31 192 HTML_IMAGE_ONLY_20 1458 0.29 0.24 0.31 193 XM_Body_Obfu01 1454 0.39 0.59 0.31 194 XM_URI_RBL 1442 1.06 2.97 0.31 195 XMSolicitRefs_0 1422 0.33 0.41 0.30 196 SpammyFromTLD_02 1422 3.24 10.68 0.30 197 XM_OfRef7 1348 1.22 3.60 0.29 198 XM_H_PHPOS_M 1342 0.33 0.44 0.28 199 SUBJ_DOLLARS 1330 0.60 1.41 0.28 200 T_HTML_ATTACH 1302 0.21 0.05 0.28 ----------------------------------------------------------------------