Email: 684304 Autolearn: 0 AvgScore: 2.57 AvgScanTime: 3.81 sec Spam: 161616 Autolearn: 0 AvgScore: 12.18 AvgScanTime: 4.45 sec Ham: 522688 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 3.61 sec Time Spent Running SA: 724.14 hours Time Spent Processing Spam: 199.96 hours Time Spent Processing Ham: 524.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144500 87.24 89.41 86.56 2 DKIM_SIGNED 120858 71.16 74.78 70.05 3 DCC_CHECK 120407 46.84 74.50 38.28 4 XM_DK_Pass 116364 69.56 72.00 68.81 5 DKIM_VALID 108359 65.14 67.05 64.56 6 XMListUnsubscribeExists 105698 52.08 65.40 47.96 7 DKIM_VALID_AU 86856 47.32 53.74 45.33 8 BAYES_50 81982 57.99 50.73 60.24 9 XM_H_QuotedFrom 78976 42.35 48.87 40.33 10 LOC_TINY_FONT_1 56827 23.35 35.16 19.70 11 HTML_FONT_LOW_CONTRAST 55620 26.99 34.41 24.69 12 STYLE_GIBBERISH 54382 27.47 33.65 25.55 13 MIME_HTML_ONLY 53264 21.65 32.96 18.15 14 XM_DK_Undo_02 49926 12.19 30.89 6.41 15 XMSubLong 45039 21.92 27.87 20.08 16 FVGT_m_MULTI_ODD 39847 20.82 24.66 19.64 17 BAYES_99 39234 9.33 24.28 4.71 18 DCC_CHECK_NEGATIVE 39134 51.37 24.21 59.76 19 RELAYCOUNTRY_META 36552 9.25 22.62 5.12 20 TR_DCC_Bayes_99 32101 6.66 19.86 2.58 21 BAYES_999 31571 7.70 19.53 4.04 22 BOTNET 31401 7.32 19.43 3.58 23 DKIM_VALID_EF 31080 23.06 19.23 24.25 24 XM_Body_Dirty_Words 28251 12.20 17.48 10.56 25 T_KAM_HTML_FONT_INVALID 28092 16.28 17.38 15.93 26 UNTRUSTED_Relay 27449 4.96 16.98 1.24 27 T_TM2_M_HEADER_IN_MSG 26013 28.12 16.10 31.84 28 LOTS_OF_MONEY 25853 12.06 16.00 10.85 29 XM_Multi_Part_URI 25770 12.10 15.95 10.91 30 MultiRelay 24111 16.83 14.92 17.43 31 BOTNET_IPINHOSTNAME 23657 6.86 14.64 4.45 32 HTML_IMAGE_RATIO_02 22882 8.72 14.16 7.04 33 XM_Evil_Numbers_Gen 22645 9.46 14.01 8.06 34 FSL_BULK_SIG 20432 7.67 12.64 6.13 35 FROM_EXCESS_BASE64 16860 5.41 10.43 3.86 36 XMSexyCombo_05 15701 4.45 9.72 2.82 37 XM_UncommonTLD01 14632 4.50 9.05 3.10 38 T_XMDrugObfuBody_14 14270 7.45 8.83 7.03 39 RCVD_IN_RP_RNBL 13689 3.40 8.47 1.84 40 HTML_IMAGE_RATIO_04 13523 5.58 8.37 4.72 41 XM_UB50 13048 2.51 8.07 0.79 42 TooManyTo_001 13015 9.23 8.05 9.59 43 BAYES_60 12499 5.52 7.73 4.84 44 DKIM_INVALID 12499 6.02 7.73 5.49 45 XMSubMetaSx_00 12369 4.68 7.65 3.77 46 XM_H_Long_From01 12211 6.22 7.56 5.81 47 XM_B_Phish_Phrases 12041 5.78 7.45 5.26 48 MPART_ALT_DIFF 11989 4.02 7.42 2.97 49 HTML_MIME_NO_HTML_TAG 11684 3.18 7.23 1.93 50 BAYES_80 11607 3.55 7.18 2.43 51 T_REMOTE_IMAGE 11144 4.73 6.90 4.06 52 ANY_BOUNCE_MESSAGE 10428 5.13 6.45 4.72 53 BOUNCE_MESSAGE 10428 5.13 6.45 4.72 54 XM_URI_RBL 9793 1.70 6.06 0.36 55 XMNumbers 9406 3.98 5.82 3.42 56 LotsOfNums_01 9005 7.71 5.57 8.37 57 HTML_IMAGE_RATIO_06 8032 3.75 4.97 3.38 58 SpammyFromTLD_02 7693 1.35 4.76 0.29 59 MISSING_HEADERS 7618 1.43 4.71 0.41 60 RELAYCOUNTRY_DE 7444 1.37 4.61 0.37 61 HTML_SHORT_LINK_IMG_1 7353 1.09 4.55 0.03 62 BODY_URI_ONLY 7279 1.13 4.50 0.08 63 TM2_M_URI_OPT_OUT 7118 2.54 4.40 1.97 64 MIME_HTML_MOSTLY 6945 2.99 4.30 2.58 65 XM_DIRTYINTL 6870 2.28 4.25 1.67 66 MIME_HEADER_CTYPE_ONLY 6427 1.03 3.98 0.11 67 MIME_HTML_ONLY_MULTI 6270 1.92 3.88 1.31 68 HTML_IMAGE_ONLY_04 6269 0.95 3.88 0.04 69 XM_UB60 6260 0.96 3.87 0.06 70 URI_HEX 6100 2.11 3.77 1.60 71 BAYES_95 5923 1.97 3.66 1.45 72 MultiRelay_CC 5734 0.98 3.55 0.18 73 MultiRelay_Combo 5734 0.98 3.55 0.18 74 XM_SPF_SoftFail 5688 2.27 3.52 1.88 75 XMStrtUSub 5631 4.33 3.48 4.59 76 XM_CamelCaseFrm001 5494 2.17 3.40 1.79 77 HTML_SHORT_CENTER 5346 0.78 3.31 0.00 78 RELAYCOUNTRY_CA 5147 1.98 3.18 1.60 79 T_TooManySym_01 4783 4.70 2.96 5.23 80 HTML_IMAGE_RATIO_08 4753 2.50 2.94 2.37 81 XM_SendGrid 4744 4.96 2.94 5.59 82 RCVD_IN_RP_SAFE 4495 6.74 2.78 7.96 83 RCVD_IN_MSPIKE_H2 4399 3.96 2.72 4.34 84 BOTNET_NORDNS 4339 0.65 2.68 0.02 85 T_XMDrugObfuBody_08 4148 1.85 2.57 1.63 86 MIME_QP_LONG_LINE 4140 5.19 2.56 6.01 87 XM_OfRef6 3879 1.57 2.40 1.31 88 UNPARSEABLE_RELAY 3722 2.33 2.30 2.34 89 RCVD_IN_RP_CERTIFIED 3613 5.78 2.24 6.88 90 XMSexyCombo_01 3559 1.01 2.20 0.65 91 XMSubMetaI_00 3444 1.10 2.13 0.78 92 XMDiploma_00 3419 1.80 2.12 1.71 93 RELAYCOUNTRY_CN 3371 0.54 2.09 0.06 94 XMBdyGiftCard01 3366 1.16 2.08 0.88 95 XM_UB80 3153 0.50 1.95 0.05 96 RELAYCOUNTRY_IN 3123 0.58 1.93 0.16 97 BAYES_40 3091 4.57 1.91 5.39 98 TR_XM_RelayPhish 3072 0.88 1.90 0.57 99 RCVD_IN_BL_SPAMCOP_NET 3037 0.89 1.88 0.58 100 BAYES_00 3012 12.23 1.86 15.43 101 XMReplyNow 2873 0.53 1.78 0.15 102 SUBJ_ALL_CAPS 2672 1.48 1.65 1.43 103 BAYES_20 2655 2.99 1.64 3.40 104 XMGenDplmaNmb 2649 1.18 1.64 1.04 105 RELAYCOUNTRY_FR 2602 0.54 1.61 0.20 106 SpammyFromTLD_01 2585 0.94 1.60 0.74 107 T_XMHurry_00 2536 1.01 1.57 0.84 108 TVD_SPACE_RATIO_MINFP 2499 0.37 1.55 0.00 109 SUBJ_DOLLARS 2490 0.71 1.54 0.45 110 DIET_1 2480 0.57 1.53 0.27 111 RELAYCOUNTRY_AT 2479 0.53 1.53 0.22 112 URIBL_DBL_SPAM 2407 0.38 1.49 0.03 113 RCVD_IN_IADB_LISTED 2359 4.64 1.46 5.63 114 TM2_M_VERY_LONG_WORD 2291 0.93 1.42 0.79 115 FROM_SUSPICIOUS_NTLD 2286 0.38 1.41 0.06 116 MAILING_LIST_MULTI 2265 1.99 1.40 2.17 117 TooManyTo_002 2213 1.90 1.37 2.07 118 XMPhish30 2158 0.60 1.34 0.37 119 XMSlimDrugH 2156 0.58 1.33 0.35 120 URIBL_BLACK 2076 0.35 1.28 0.06 121 T_Symld_Words_02 2063 0.70 1.28 0.52 122 XMPhish11 2062 1.18 1.28 1.15 123 TR_XM_DK_Bayes 2059 9.40 1.27 11.91 124 XMBody_17 2030 0.82 1.26 0.68 125 LOW_PRICE 2026 0.44 1.25 0.19 126 TM2_M_A_HREF_HREF 2016 0.58 1.25 0.37 127 TooManyTo_003 2009 1.37 1.24 1.41 128 XM_H_Long_From02 1998 1.16 1.24 1.13 129 SHORTENER_SHORT_IMG 1993 0.29 1.23 0.00 130 URI_BUFFLY 1983 0.29 1.23 0.00 131 XM_ProductURIs 1981 0.86 1.23 0.74 132 RCVD_IN_IADB_SPF 1966 4.06 1.22 4.94 133 HTML_TAG_BALANCE_BODY 1956 0.66 1.21 0.49 134 TR_Symld_Words 1924 1.39 1.19 1.45 135 T_XMDrugObfuBody_00 1906 0.84 1.18 0.74 136 DATE_IN_PAST_03_06 1905 0.37 1.18 0.12 137 XMStockSpam_06 1902 0.77 1.18 0.65 138 XM_B_REG_HTML 1875 0.58 1.16 0.41 139 RDNS_DYNAMIC 1870 0.58 1.16 0.40 140 TooManyTo_004 1862 1.08 1.15 1.06 141 TR_LOTS_OF_MONEY2 1846 0.40 1.14 0.17 142 T_MONEY_PERCENT 1846 0.40 1.14 0.17 143 TR_XM_DK_Bayes1 1841 8.85 1.14 11.23 144 RELAYCOUNTRY_GB 1839 1.02 1.14 0.98 145 RCVD_IN_IADB_SENDERID 1829 3.60 1.13 4.37 146 RCVD_IN_IADB_DK 1801 3.54 1.11 4.29 147 XM_DK_Undo_01 1793 1.66 1.11 1.82 148 TR_MetaPhish_Combo_01 1771 1.37 1.10 1.45 149 URI_TRY_3LD 1759 1.15 1.09 1.17 150 XMHTML_After_End 1757 0.60 1.09 0.45 151 TooManyTo_005 1751 0.93 1.08 0.88 152 T_HTML_TAG_BALANCE_CENTER 1743 0.41 1.08 0.20 153 ALL_TRUSTED 1735 15.38 1.07 19.80 154 TR_Mismatch_TLD_02 1725 0.30 1.07 0.07 155 XMSubNoVowel 1690 0.49 1.05 0.32 156 XM_UB99 1689 0.25 1.05 0.01 157 XM_H_PHPOS 1685 1.49 1.04 1.62 158 DKIM_ADSP_NXDOMAIN 1652 0.63 1.02 0.51 159 HELO_NODOT 1626 1.63 1.01 1.83 160 TR_LOTS_OF_MONEY3 1615 0.49 1.00 0.34 161 BAYES_05 1613 1.84 1.00 2.10 162 XMSexyCombo_04 1597 0.33 0.99 0.12 163 XMHTMLBadTable_001 1596 0.62 0.99 0.50 164 XM_S_JOY_D 1544 0.60 0.96 0.49 165 NO_DNS_FOR_FROM 1527 0.46 0.94 0.31 166 TR_XM_DK_Bayes2 1520 7.47 0.94 9.49 167 LongTLD 1518 0.36 0.94 0.18 168 XMGppyBdWords 1511 0.35 0.93 0.17 169 XM_UB95 1500 0.23 0.93 0.02 170 RCVD_IN_IADB_VOUCHED 1495 2.90 0.93 3.52 171 HTML_FONT_FACE_BAD 1495 0.58 0.93 0.47 172 PLING_QUERY 1468 0.56 0.91 0.45 173 XM_HighProb1 1462 0.23 0.90 0.02 174 T_TooManySym_02 1461 1.56 0.90 1.76 175 XMMoneyMeta_00 1398 2.14 0.87 2.53 176 XMSubMetaSSx_00 1390 0.39 0.86 0.25 177 BODY_ENHANCEMENT 1377 0.21 0.85 0.02 178 XMBody_78 1353 0.51 0.84 0.41 179 XMSubEmpty 1344 0.40 0.83 0.27 180 HTML_OFF_PAGE 1333 0.20 0.82 0.01 181 HTTPS_HTTP_MISMATCH 1286 0.52 0.80 0.44 182 URI_NOVOWEL 1258 0.53 0.78 0.45 183 NORDNS_LOW_CONTRAST 1250 0.19 0.77 0.00 184 FSL_THIS_IS_ADV 1243 0.31 0.77 0.16 185 XMPhish14 1238 0.43 0.77 0.32 186 XM_PDF 1228 3.51 0.76 4.36 187 T_FILL_THIS_FORM_SHORT 1210 0.78 0.75 0.78 188 HTML_FONT_SIZE_LARGE 1190 0.29 0.74 0.16 189 DKIM_ADSP_CUSTOM_MED 1155 0.88 0.71 0.93 190 XM_RXBody 1132 0.30 0.70 0.18 191 FILL_THIS_FORM 1113 0.47 0.69 0.40 192 XMSubMetaSxObfu_03 1096 0.42 0.68 0.34 193 NML_ADSP_CUSTOM_MED 1094 0.63 0.68 0.62 194 RCVD_IN_IADB_OPTIN 1083 1.89 0.67 2.27 195 HTML_IMAGE_ONLY_24 1047 0.44 0.65 0.38 196 HTML_IMAGE_ONLY_28 1035 0.44 0.64 0.38 197 DATE_IN_PAST_06_12 1031 0.18 0.64 0.04 198 FILL_THIS_FORM_LONG 1021 0.40 0.63 0.33 199 REMOVE_BEFORE_LINK 1008 0.38 0.62 0.31 200 URI_PHISH 1003 0.15 0.62 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 452458 87.24 89.41 86.56 2 DKIM_SIGNED 366126 71.16 74.78 70.05 3 XM_DK_Pass 359637 69.56 72.00 68.81 4 DKIM_VALID 337423 65.14 67.05 64.56 5 BAYES_50 314871 57.99 50.73 60.24 6 DCC_CHECK_NEGATIVE 312383 51.37 24.21 59.76 7 XMListUnsubscribeExists 250702 52.08 65.40 47.96 8 DKIM_VALID_AU 236938 47.32 53.74 45.33 9 XM_H_QuotedFrom 210800 42.35 48.87 40.33 10 DCC_CHECK 200090 46.84 74.50 38.28 11 T_TM2_M_HEADER_IN_MSG 166403 28.12 16.10 31.84 12 STYLE_GIBBERISH 133566 27.47 33.65 25.55 13 HTML_FONT_LOW_CONTRAST 129063 26.99 34.41 24.69 14 DKIM_VALID_EF 126748 23.06 19.23 24.25 15 XMSubLong 104942 21.92 27.87 20.08 16 ALL_TRUSTED 103508 15.38 1.07 19.80 17 LOC_TINY_FONT_1 102977 23.35 35.16 19.70 18 FVGT_m_MULTI_ODD 102650 20.82 24.66 19.64 19 MIME_HTML_ONLY 94882 21.65 32.96 18.15 20 MultiRelay 91091 16.83 14.92 17.43 21 T_KAM_HTML_FONT_INVALID 83289 16.28 17.38 15.93 22 BAYES_00 80652 12.23 1.86 15.43 23 TR_XM_DK_Bayes 62247 9.40 1.27 11.91 24 TR_XM_DK_Bayes1 58705 8.85 1.14 11.23 25 XM_Multi_Part_URI 57019 12.10 15.95 10.91 26 LOTS_OF_MONEY 56706 12.06 16.00 10.85 27 XM_DKIMWhitelistDomains 56569 8.34 0.32 10.82 28 XM_Body_Dirty_Words 55215 12.20 17.48 10.56 29 TooManyTo_001 50134 9.23 8.05 9.59 30 TR_XM_DK_Bayes2 49579 7.47 0.94 9.49 31 LotsOfNums_01 43757 7.71 5.57 8.37 32 XM_Evil_Numbers_Gen 42122 9.46 14.01 8.06 33 RCVD_IN_RP_SAFE 41603 6.74 2.78 7.96 34 HTML_IMAGE_RATIO_02 36814 8.72 14.16 7.04 35 T_XMDrugObfuBody_14 36722 7.45 8.83 7.03 36 RCVD_IN_RP_CERTIFIED 35942 5.78 2.24 6.88 37 XM_DK_Undo_02 33497 12.19 30.89 6.41 38 FSL_BULK_SIG 32045 7.67 12.64 6.13 39 MIME_QP_LONG_LINE 31400 5.19 2.56 6.01 40 XM_H_Long_From01 30354 6.22 7.56 5.81 41 RCVD_IN_IADB_LISTED 29402 4.64 1.46 5.63 42 XM_SendGrid 29217 4.96 2.94 5.59 43 DKIM_INVALID 28703 6.02 7.73 5.49 44 BAYES_40 28188 4.57 1.91 5.39 45 XM_B_Phish_Phrases 27486 5.78 7.45 5.26 46 T_TooManySym_01 27349 4.70 2.96 5.23 47 RELAYCOUNTRY_META 26771 9.25 22.62 5.12 48 RCVD_IN_IADB_SPF 25830 4.06 1.22 4.94 49 BAYES_60 25297 5.52 7.73 4.84 50 ANY_BOUNCE_MESSAGE 24688 5.13 6.45 4.72 51 BOUNCE_MESSAGE 24687 5.13 6.45 4.72 52 HTML_IMAGE_RATIO_04 24683 5.58 8.37 4.72 53 BAYES_99 24642 9.33 24.28 4.71 54 XMStrtUSub 23975 4.33 3.48 4.59 55 BOTNET_IPINHOSTNAME 23262 6.86 14.64 4.45 56 RCVD_IN_IADB_SENDERID 22824 3.60 1.13 4.37 57 XM_PDF 22778 3.51 0.76 4.36 58 RCVD_IN_MSPIKE_H2 22703 3.96 2.72 4.34 59 RCVD_IN_IADB_DK 22437 3.54 1.11 4.29 60 T_REMOTE_IMAGE 21244 4.73 6.90 4.06 61 BAYES_999 21117 7.70 19.53 4.04 62 FROM_EXCESS_BASE64 20194 5.41 10.43 3.86 63 XMSubMetaSx_00 19689 4.68 7.65 3.77 64 IN_ZIMBRA_NJ_WHITELIST 19229 2.82 0.03 3.68 65 BOTNET 18688 7.32 19.43 3.58 66 RCVD_IN_IADB_VOUCHED 18376 2.90 0.93 3.52 67 XMNumbers 17850 3.98 5.82 3.42 68 BAYES_20 17772 2.99 1.64 3.40 69 HTML_IMAGE_RATIO_06 17650 3.75 4.97 3.38 70 XM_UncommonTLD01 16184 4.50 9.05 3.10 71 MPART_ALT_DIFF 15502 4.02 7.42 2.97 72 XMSexyCombo_05 14720 4.45 9.72 2.82 73 TO_MALFORMED 13870 2.08 0.22 2.65 74 MIME_HTML_MOSTLY 13487 2.99 4.30 2.58 75 TR_DCC_Bayes_99 13484 6.66 19.86 2.58 76 XMMoneyMeta_00 13246 2.14 0.87 2.53 77 BAYES_80 12705 3.55 7.18 2.43 78 HTML_IMAGE_RATIO_08 12373 2.50 2.94 2.37 79 UNPARSEABLE_RELAY 12251 2.33 2.30 2.34 80 RCVD_IN_IADB_OPTIN 11868 1.89 0.67 2.27 81 MAILING_LIST_MULTI 11358 1.99 1.40 2.17 82 BAYES_05 10973 1.84 1.00 2.10 83 TooManyTo_002 10816 1.90 1.37 2.07 84 TVD_RCVD_IP 10647 1.64 0.38 2.04 85 TM2_M_URI_OPT_OUT 10275 2.54 4.40 1.97 86 HTML_MIME_NO_HTML_TAG 10102 3.18 7.23 1.93 87 XM_SPF_SoftFail 9834 2.27 3.52 1.88 88 RCVD_IN_RP_RNBL 9607 3.40 8.47 1.84 89 HELO_NODOT 9546 1.63 1.01 1.83 90 XM_DK_Undo_01 9537 1.66 1.11 1.82 91 XM_CamelCaseFrm001 9378 2.17 3.40 1.79 92 RCVD_IN_MSPIKE_WL 9222 1.43 0.36 1.76 93 RCVD_IN_MSPIKE_H3 9220 1.43 0.35 1.76 94 T_TooManySym_02 9192 1.56 0.90 1.76 95 XMDiploma_00 8918 1.80 2.12 1.71 96 XM_DIRTYINTL 8719 2.28 4.25 1.67 97 T_XMDrugObfuBody_08 8513 1.85 2.57 1.63 98 XM_H_PHPOS 8482 1.49 1.04 1.62 99 RELAYCOUNTRY_CA 8373 1.98 3.18 1.60 100 URI_HEX 8339 2.11 3.77 1.60 101 IN_HORDE_ADDRESS_BOOK 8191 1.22 0.08 1.57 102 BAYES_95 7588 1.97 3.66 1.45 103 TR_Symld_Words 7585 1.39 1.19 1.45 104 TR_MetaPhish_Combo_01 7580 1.37 1.10 1.45 105 SUBJ_ALL_CAPS 7468 1.48 1.65 1.43 106 XMCapTrack 7424 1.15 0.27 1.42 107 TooManyTo_003 7384 1.37 1.24 1.41 108 INVALID_MSGID 7147 1.07 0.11 1.37 109 MIME_HTML_ONLY_MULTI 6867 1.92 3.88 1.31 110 XM_OfRef6 6849 1.57 2.40 1.31 111 UNTRUSTED_Relay 6480 4.96 16.98 1.24 112 URI_TRY_3LD 6133 1.15 1.09 1.17 113 XMPhish11 5990 1.18 1.28 1.15 114 XM_H_Long_From02 5924 1.16 1.24 1.13 115 XM_GoogleGroups 5897 1.01 0.61 1.13 116 USER_IN_DEF_DKIM_WL 5836 0.86 0.02 1.12 117 TooManyTo_004 5544 1.08 1.15 1.06 118 XMGenDplmaNmb 5454 1.18 1.64 1.04 119 RELAYCOUNTRY_GB 5112 1.02 1.14 0.98 120 DKIM_ADSP_CUSTOM_MED 4872 0.88 0.71 0.93 121 TooManyTo_005 4610 0.93 1.08 0.88 122 XMBdyGiftCard01 4597 1.16 2.08 0.88 123 T_XMHurry_00 4388 1.01 1.57 0.84 124 XM_UB50 4140 2.51 8.07 0.79 125 TM2_M_VERY_LONG_WORD 4104 0.93 1.42 0.79 126 T_FILL_THIS_FORM_SHORT 4098 0.78 0.75 0.78 127 XMSubMetaI_00 4053 1.10 2.13 0.78 128 XM_ProductURIs 3878 0.86 1.23 0.74 129 SpammyFromTLD_01 3868 0.94 1.60 0.74 130 T_XMDrugObfuBody_00 3860 0.84 1.18 0.74 131 T_OBFU_PDF_ATTACH 3600 0.59 0.25 0.69 132 XMBody_17 3578 0.82 1.26 0.68 133 TO_NO_BRKTS_HTML_ONLY 3506 0.54 0.11 0.67 134 XMSexyCombo_01 3386 1.01 2.20 0.65 135 XMStockSpam_06 3378 0.77 1.18 0.65 136 XMLngstWrd_00 3264 0.56 0.35 0.62 137 NML_ADSP_CUSTOM_MED 3228 0.63 0.68 0.62 138 XMBrknScrpt_02 3143 0.59 0.53 0.60 139 XM_H_PHPMailer 3068 0.57 0.51 0.59 140 XMLngstWrd_01 3034 0.52 0.32 0.58 141 RCVD_IN_BL_SPAMCOP_NET 3028 0.89 1.88 0.58 142 TR_XM_RelayPhish 2955 0.88 1.90 0.57 143 T_TooManySym_03 2886 0.47 0.20 0.55 144 FORGED_GMAIL_RCVD 2798 0.55 0.61 0.54 145 T_Symld_Words_02 2730 0.70 1.28 0.52 146 DKIM_ADSP_NXDOMAIN 2687 0.63 1.02 0.51 147 USER_IN_WHITELIST 2658 0.39 0.00 0.51 148 RELAYCOUNTRY_AU 2635 0.50 0.50 0.50 149 XMHTMLBadTable_001 2635 0.62 0.99 0.50 150 XMGappySubj_01 2631 0.47 0.36 0.50 151 HTML_TAG_BALANCE_BODY 2587 0.66 1.21 0.49 152 XM_B_COPY_HTML 2567 0.52 0.61 0.49 153 FROM_GOV_SPOOF 2541 0.42 0.20 0.49 154 XM_S_JOY_D 2536 0.60 0.96 0.49 155 XMNoVowels 2535 0.50 0.54 0.48 156 XMBody_95 2535 0.40 0.14 0.48 157 HTML_FONT_FACE_BAD 2456 0.58 0.93 0.47 158 XMDateMe_00 2432 0.45 0.38 0.47 159 PLING_QUERY 2373 0.56 0.91 0.45 160 URI_NOVOWEL 2371 0.53 0.78 0.45 161 XMHTML_After_End 2361 0.60 1.09 0.45 162 SUBJ_DOLLARS 2352 0.71 1.54 0.45 163 HTML_IMAGE_ONLY_32 2324 0.42 0.33 0.44 164 SHORT_HELO_AND_INLINE_IMAGE 2297 0.35 0.06 0.44 165 HTTPS_HTTP_MISMATCH 2280 0.52 0.80 0.44 166 XM_ShortIntro_01 2199 0.45 0.56 0.42 167 XMBody_78 2159 0.51 0.84 0.41 168 MISSING_HEADERS 2156 1.43 4.71 0.41 169 XM_B_REG_HTML 2126 0.58 1.16 0.41 170 FILL_THIS_FORM 2100 0.47 0.69 0.40 171 RDNS_DYNAMIC 2078 0.58 1.16 0.40 172 RCVD_IN_SORBS_DUL 2055 0.39 0.38 0.39 173 TM2_M_BODY_EMPTY 2054 0.33 0.11 0.39 174 HTML_IMAGE_ONLY_28 1975 0.44 0.64 0.38 175 HTML_IMAGE_ONLY_24 1969 0.44 0.65 0.38 176 XM_Body_Obfu01 1965 0.38 0.39 0.38 177 RELAYCOUNTRY_DE 1960 1.37 4.61 0.37 178 TM2_M_A_HREF_HREF 1934 0.58 1.25 0.37 179 XMPhish30 1926 0.60 1.34 0.37 180 XMSubMetaSxObfu_02 1873 0.34 0.28 0.36 181 XM_URI_RBL 1866 1.70 6.06 0.36 182 XMSlimDrugH 1837 0.58 1.33 0.35 183 AC_DIV_BONANZA 1808 0.29 0.11 0.35 184 XMSubMetaSxObfu_03 1792 0.42 0.68 0.34 185 XM_H_PHPOS_M 1776 0.34 0.35 0.34 186 TR_LOTS_OF_MONEY3 1752 0.49 1.00 0.34 187 FILL_THIS_FORM_LONG 1746 0.40 0.63 0.33 188 XMSubNoVowel 1697 0.49 1.05 0.32 189 XMPhish14 1681 0.43 0.77 0.32 190 XMSolicitRefs_0 1668 0.35 0.46 0.32 191 T_FROM_GOV_DKIM_AU 1626 0.26 0.10 0.31 192 NO_DNS_FOR_FROM 1625 0.46 0.94 0.31 193 REMOVE_BEFORE_LINK 1596 0.38 0.62 0.31 194 UPPERCASE_50_75 1588 0.25 0.08 0.30 195 XM_USANA_RCVD 1581 0.23 0.00 0.30 196 SpammyFromTLD_02 1537 1.35 4.76 0.29 197 FILL_THIS_FORM_LOAN 1508 0.33 0.44 0.29 198 TVD_SPACE_RATIO 1494 0.29 0.32 0.29 199 T_TooManySym_04 1432 0.23 0.08 0.27 200 XMLKML 1421 0.21 0.00 0.27 ----------------------------------------------------------------------