Email: 676384 Autolearn: 0 AvgScore: 2.91 AvgScanTime: 3.86 sec Spam: 178803 Autolearn: 0 AvgScore: 12.64 AvgScanTime: 4.35 sec Ham: 497581 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 3.68 sec Time Spent Running SA: 724.98 hours Time Spent Processing Spam: 216.19 hours Time Spent Processing Ham: 508.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156007 86.54 87.25 86.29 2 DCC_CHECK 131974 48.74 73.81 39.74 3 DKIM_SIGNED 130934 72.94 73.23 72.84 4 XM_DK_Pass 126367 71.27 70.67 71.48 5 DKIM_VALID 118019 66.80 66.01 67.09 6 XMListUnsubscribeExists 116483 53.75 65.15 49.66 7 DKIM_VALID_AU 93044 48.12 52.04 46.72 8 BAYES_50 88655 55.80 49.58 58.04 9 XM_H_QuotedFrom 84304 40.42 47.15 38.00 10 HTML_FONT_LOW_CONTRAST 64041 29.30 35.82 26.96 11 STYLE_GIBBERISH 60097 28.31 33.61 26.40 12 MIME_HTML_ONLY 60008 22.79 33.56 18.92 13 LOC_TINY_FONT_1 58834 23.28 32.90 19.82 14 XM_DK_Undo_02 56496 13.17 31.60 6.55 15 XMSubLong 46425 22.92 25.96 21.82 16 BAYES_99 45498 10.27 25.45 4.81 17 FVGT_m_MULTI_ODD 44900 21.55 25.11 20.27 18 DCC_CHECK_NEGATIVE 43660 49.14 24.42 58.03 19 BOTNET 42558 8.49 23.80 2.99 20 RELAYCOUNTRY_META 38536 9.61 21.55 5.32 21 TR_DCC_Bayes_99 37540 7.49 21.00 2.64 22 LOTS_OF_MONEY 36461 13.02 20.39 10.37 23 BAYES_999 35807 8.27 20.03 4.05 24 DKIM_VALID_EF 33437 23.78 18.70 25.60 25 T_KAM_HTML_FONT_INVALID 33171 17.05 18.55 16.51 26 XM_Evil_Numbers_Gen 32761 10.79 18.32 8.08 27 XM_Body_Dirty_Words 32734 13.77 18.31 12.14 28 T_TM2_M_HEADER_IN_MSG 30600 27.20 17.11 30.82 29 UNTRUSTED_Relay 29147 5.19 16.30 1.20 30 XM_Multi_Part_URI 28647 12.86 16.02 11.72 31 BOTNET_IPINHOSTNAME 27456 7.44 15.36 4.59 32 HTML_IMAGE_RATIO_02 25586 9.77 14.31 8.14 33 MultiRelay 24936 16.65 13.95 17.62 34 RCVD_IN_RP_RNBL 21344 4.03 11.94 1.19 35 FSL_BULK_SIG 21239 7.94 11.88 6.53 36 FROM_EXCESS_BASE64 18460 5.47 10.32 3.73 37 XMSexyCombo_05 18310 5.54 10.24 3.85 38 BOUNCE_MESSAGE 16281 5.53 9.11 4.25 39 ANY_BOUNCE_MESSAGE 16281 5.53 9.11 4.25 40 XM_UncommonTLD01 15654 4.55 8.75 3.04 41 MPART_ALT_DIFF 15158 4.63 8.48 3.24 42 T_XMDrugObfuBody_14 15047 7.88 8.42 7.69 43 XM_UB50 13459 2.54 7.53 0.75 44 HTML_IMAGE_RATIO_04 13349 5.59 7.47 4.92 45 XM_H_Long_From01 12981 6.48 7.26 6.20 46 DKIM_INVALID 12915 6.14 7.22 5.75 47 XM_B_Phish_Phrases 12737 5.85 7.12 5.39 48 XMSubMetaSx_00 12724 4.67 7.12 3.80 49 BAYES_80 12623 3.86 7.06 2.71 50 BAYES_60 12259 5.45 6.86 4.95 51 TR_LOTS_OF_MONEY3 12200 2.10 6.82 0.41 52 TooManyTo_001 12174 8.01 6.81 8.44 53 SpammyFromTLD_02 11803 1.97 6.60 0.31 54 HTML_IMAGE_RATIO_06 10981 3.99 6.14 3.22 55 HTML_MIME_NO_HTML_TAG 10578 3.16 5.92 2.17 56 LotsOfNums_01 10162 8.17 5.68 9.06 57 XMNumbers 9089 4.11 5.08 3.76 58 MIME_HTML_ONLY_MULTI 8075 2.30 4.52 1.51 59 XMStrtUSub 7849 5.01 4.39 5.24 60 XM_DIRTYINTL 7689 2.41 4.30 1.73 61 XM_URI_RBL 7344 1.36 4.11 0.37 62 XM_SPF_SoftFail 7182 2.48 4.02 1.92 63 TM2_M_URI_OPT_OUT 7080 2.56 3.96 2.05 64 MIME_HTML_MOSTLY 6853 2.57 3.83 2.12 65 BAYES_95 6769 2.20 3.79 1.64 66 MISSING_HEADERS 6705 1.30 3.75 0.42 67 XM_BadFromFormat 6554 1.08 3.67 0.15 68 MultiRelay_CC 6525 1.09 3.65 0.17 69 MultiRelay_Combo 6525 1.09 3.65 0.17 70 BODY_URI_ONLY 6167 0.96 3.45 0.06 71 HTML_SHORT_LINK_IMG_1 6099 0.92 3.41 0.03 72 BOTNET_NORDNS 5964 0.89 3.34 0.01 73 URI_HEX 5929 2.07 3.32 1.62 74 RELAYCOUNTRY_DE 5754 1.12 3.22 0.37 75 MIME_HEADER_CTYPE_ONLY 5715 0.92 3.20 0.10 76 XM_UB60 5712 0.90 3.19 0.08 77 HTML_IMAGE_RATIO_08 5472 2.35 3.06 2.09 78 SHORTENER_SHORT_IMG 5430 0.80 3.04 0.00 79 RELAYCOUNTRY_CN 5425 0.85 3.03 0.07 80 XM_OfRef6 5304 1.85 2.97 1.45 81 XM_CamelCaseFrm001 5202 2.19 2.91 1.93 82 XM_SendGrid 5153 4.88 2.88 5.59 83 RCVD_IN_MSPIKE_H2 5074 4.04 2.84 4.47 84 T_XMDrugObfuBody_08 5040 1.81 2.82 1.44 85 HTML_IMAGE_ONLY_08 4884 0.80 2.73 0.10 86 RELAYCOUNTRY_CA 4878 1.88 2.73 1.58 87 RCVD_IN_RP_SAFE 4832 6.76 2.70 8.22 88 HTML_FONT_SIZE_HUGE 4750 0.80 2.66 0.14 89 T_REMOTE_IMAGE 4749 3.83 2.66 4.25 90 URI_BUFFLY 4673 0.69 2.61 0.00 91 SUBJ_ALL_CAPS 4483 1.76 2.51 1.49 92 T_TooManySym_01 4468 4.52 2.50 5.24 93 XMDiploma_00 4433 2.20 2.48 2.09 94 RELAYCOUNTRY_FR 4353 0.78 2.43 0.19 95 RCVD_IN_BL_SPAMCOP_NET 4229 0.99 2.37 0.50 96 MIME_QP_LONG_LINE 4148 5.40 2.32 6.51 97 BAYES_40 4090 4.26 2.29 4.96 98 RCVD_IN_RP_CERTIFIED 4018 5.88 2.25 7.19 99 XM_S_JOY_D 3815 0.93 2.13 0.49 100 DIET_1 3631 0.81 2.03 0.37 101 UNPARSEABLE_RELAY 3603 2.45 2.02 2.60 102 BAYES_20 3514 3.09 1.97 3.49 103 T_XMDrugObfuBody_00 3442 1.15 1.93 0.87 104 XMBdyGiftCard01 3224 1.21 1.80 0.99 105 BAYES_00 3109 12.99 1.74 17.03 106 XM_UB99 3108 0.48 1.74 0.02 107 XMSexyCombo_01 3077 0.99 1.72 0.73 108 XM_H_Long_From02 3066 1.27 1.71 1.11 109 XM_UB80 3012 0.47 1.68 0.04 110 T_FILL_THIS_FORM_SHORT 2983 0.98 1.67 0.74 111 RELAYCOUNTRY_IN 2916 0.52 1.63 0.12 112 XMPhish11 2827 1.15 1.58 1.00 113 XMSlimDrugH 2754 0.65 1.54 0.33 114 XMSubMetaI_00 2731 0.76 1.53 0.48 115 XM_ProductURIs 2715 1.28 1.52 1.20 116 RELAYCOUNTRY_AT 2689 0.55 1.50 0.21 117 DKIM_ADSP_CUSTOM_MED 2616 1.13 1.46 1.01 118 RCVD_IN_IADB_LISTED 2580 4.74 1.44 5.93 119 DKIM_ADSP_NXDOMAIN 2577 0.75 1.44 0.50 120 MAILING_LIST_MULTI 2566 2.28 1.44 2.59 121 NML_ADSP_CUSTOM_MED 2559 0.89 1.43 0.70 122 TVD_SPACE_RATIO_MINFP 2536 0.38 1.42 0.01 123 ALL_TRUSTED 2534 13.22 1.42 17.47 124 TM2_M_VERY_LONG_WORD 2518 0.99 1.41 0.84 125 SpammyFromTLD_01 2485 0.94 1.39 0.77 126 XMGenDplmaNmb 2396 1.34 1.34 1.34 127 TR_Mismatch_TLD_02 2380 0.39 1.33 0.06 128 FORGED_GMAIL_RCVD 2371 0.77 1.33 0.57 129 TR_XM_DK_Bayes 2336 10.15 1.31 13.33 130 URI_TRY_3LD 2285 1.25 1.28 1.24 131 BAYES_05 2285 2.07 1.28 2.36 132 XMPhish30 2269 0.65 1.27 0.43 133 XMBrknScrpt_02 2235 0.79 1.25 0.63 134 TR_XM_RelayPhish 2215 0.98 1.24 0.88 135 RCVD_IN_IADB_SPF 2205 4.19 1.23 5.25 136 FILL_THIS_FORM 2156 0.66 1.21 0.46 137 TR_XM_DK_Bayes1 2140 9.53 1.20 12.52 138 BODY_ENHANCEMENT 2121 0.35 1.19 0.05 139 LONG_JUNK_URI 2116 0.36 1.18 0.06 140 TR_Symld_Words 2077 1.46 1.16 1.57 141 RCVD_IN_IADB_SENDERID 2073 3.72 1.16 4.64 142 TO_NO_BRKTS_FROM_MSSP 2065 0.33 1.15 0.03 143 XMHTML_After_End 2058 0.65 1.15 0.47 144 RELAYCOUNTRY_GB 2055 1.08 1.15 1.06 145 FILL_THIS_FORM_LONG 2038 0.56 1.14 0.35 146 SUBJ_DOLLARS 2038 0.60 1.14 0.41 147 FROM_MISSP_EH_MATCH 2032 0.32 1.14 0.03 148 RCVD_IN_IADB_DK 2021 3.68 1.13 4.59 149 T_XMHurry_00 2020 0.73 1.13 0.58 150 T_MONEY_PERCENT 2014 0.49 1.13 0.26 151 TR_LOTS_OF_MONEY2 2014 0.49 1.13 0.26 152 URIBL_DBL_SPAM 1987 0.34 1.11 0.06 153 XM_B_REG_HTML 1965 0.79 1.10 0.68 154 URIBL_BLACK 1960 0.34 1.10 0.07 155 XM_DK_Undo_01 1881 1.68 1.05 1.91 156 XMStockSpam_06 1875 1.04 1.05 1.04 157 TR_XM_DK_Bayes2 1872 7.93 1.05 10.40 158 HTML_FONT_FACE_BAD 1862 0.78 1.04 0.69 159 FROM_MISSP_REPLYTO 1810 0.28 1.01 0.02 160 FSL_THIS_IS_ADV 1774 0.48 0.99 0.29 161 NO_DNS_FOR_FROM 1764 0.46 0.99 0.27 162 XMSubMetaSSx_00 1761 0.37 0.98 0.14 163 HTML_FONT_SIZE_LARGE 1758 0.51 0.98 0.34 164 XM_HighProb1 1758 0.27 0.98 0.02 165 T_Symld_Words_02 1749 0.69 0.98 0.58 166 LOW_PRICE 1735 0.39 0.97 0.18 167 XM_H_PHPOS 1709 1.11 0.96 1.16 168 XMBody_78 1668 0.53 0.93 0.38 169 XM_UB95 1648 0.26 0.92 0.02 170 XMMoneyMeta_00 1645 0.65 0.92 0.55 171 MPART_ALT_DIFF_COUNT 1632 0.40 0.91 0.21 172 XMPhish14 1631 0.58 0.91 0.46 173 PLING_QUERY 1616 0.57 0.90 0.46 174 FROM_SUSPICIOUS_NTLD 1615 0.28 0.90 0.06 175 LongTLD 1609 0.35 0.90 0.16 176 HTML_TAG_BALANCE_BODY 1588 0.57 0.89 0.45 177 RCVD_IN_IADB_VOUCHED 1580 2.94 0.88 3.67 178 XMBody_17 1561 0.71 0.87 0.65 179 XMSubNoVowel 1559 0.48 0.87 0.34 180 RDNS_DYNAMIC 1546 0.51 0.86 0.38 181 LONG_JUNK_URI3 1520 0.24 0.85 0.02 182 DATE_IN_PAST_03_06 1504 0.31 0.84 0.12 183 RELAYCOUNTRY_NG 1502 0.22 0.84 0.00 184 RELAYCOUNTRY_PL 1477 0.23 0.83 0.01 185 XMGappySubj_01 1477 0.81 0.83 0.81 186 HTTPS_HTTP_MISMATCH 1458 0.60 0.82 0.53 187 XM_UB999 1447 0.23 0.81 0.02 188 T_TooManySym_02 1442 1.52 0.81 1.78 189 DEAR_FRIEND 1419 0.27 0.79 0.08 190 TooManyTo_002 1413 1.99 0.79 2.42 191 DATE_IN_PAST_06_12 1411 0.23 0.79 0.03 192 SUBJECT_DIET 1381 0.21 0.77 0.00 193 REMOVE_BEFORE_LINK 1378 0.42 0.77 0.30 194 URI_NOVOWEL 1344 0.56 0.75 0.50 195 XMGppyBdWords 1336 0.30 0.75 0.13 196 XM_B_COPY_HTML 1326 0.72 0.74 0.71 197 REPLYTO_WITHOUT_TO_CC 1306 0.22 0.73 0.03 198 TRACKER_ID 1291 0.35 0.72 0.22 199 HELO_NODOT 1284 1.46 0.72 1.72 200 NORDNS_LOW_CONTRAST 1279 0.30 0.72 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 429350 86.54 87.25 86.29 2 DKIM_SIGNED 362442 72.94 73.23 72.84 3 XM_DK_Pass 355687 71.27 70.67 71.48 4 DKIM_VALID 333821 66.80 66.01 67.09 5 BAYES_50 288801 55.80 49.58 58.04 6 DCC_CHECK_NEGATIVE 288724 49.14 24.42 58.03 7 XMListUnsubscribeExists 247103 53.75 65.15 49.66 8 DKIM_VALID_AU 232446 48.12 52.04 46.72 9 DCC_CHECK 197727 48.74 73.81 39.74 10 XM_H_QuotedFrom 189090 40.42 47.15 38.00 11 T_TM2_M_HEADER_IN_MSG 153369 27.20 17.11 30.82 12 HTML_FONT_LOW_CONTRAST 134158 29.30 35.82 26.96 13 STYLE_GIBBERISH 131383 28.31 33.61 26.40 14 DKIM_VALID_EF 127379 23.78 18.70 25.60 15 XMSubLong 108597 22.92 25.96 21.82 16 FVGT_m_MULTI_ODD 100865 21.55 25.11 20.27 17 LOC_TINY_FONT_1 98634 23.28 32.90 19.82 18 MIME_HTML_ONLY 94132 22.79 33.56 18.92 19 MultiRelay 87664 16.65 13.95 17.62 20 ALL_TRUSTED 86910 13.22 1.42 17.47 21 BAYES_00 84745 12.99 1.74 17.03 22 T_KAM_HTML_FONT_INVALID 82159 17.05 18.55 16.51 23 TR_XM_DK_Bayes 66347 10.15 1.31 13.33 24 TR_XM_DK_Bayes1 62317 9.53 1.20 12.52 25 XM_Body_Dirty_Words 60431 13.77 18.31 12.14 26 XM_DKIMWhitelistDomains 58585 8.74 0.30 11.77 27 XM_Multi_Part_URI 58316 12.86 16.02 11.72 28 TR_XM_DK_Bayes2 51762 7.93 1.05 10.40 29 LOTS_OF_MONEY 51614 13.02 20.39 10.37 30 LotsOfNums_01 45101 8.17 5.68 9.06 31 TooManyTo_001 41979 8.01 6.81 8.44 32 RCVD_IN_RP_SAFE 40892 6.76 2.70 8.22 33 HTML_IMAGE_RATIO_02 40519 9.77 14.31 8.14 34 XM_Evil_Numbers_Gen 40218 10.79 18.32 8.08 35 T_XMDrugObfuBody_14 38244 7.88 8.42 7.69 36 RCVD_IN_RP_CERTIFIED 35767 5.88 2.25 7.19 37 XM_DK_Undo_02 32570 13.17 31.60 6.55 38 FSL_BULK_SIG 32491 7.94 11.88 6.53 39 MIME_QP_LONG_LINE 32405 5.40 2.32 6.51 40 XM_H_Long_From01 30868 6.48 7.26 6.20 41 RCVD_IN_IADB_LISTED 29483 4.74 1.44 5.93 42 DKIM_INVALID 28621 6.14 7.22 5.75 43 XM_SendGrid 27836 4.88 2.88 5.59 44 XM_B_Phish_Phrases 26814 5.85 7.12 5.39 45 RELAYCOUNTRY_META 26451 9.61 21.55 5.32 46 RCVD_IN_IADB_SPF 26132 4.19 1.23 5.25 47 T_TooManySym_01 26089 4.52 2.50 5.24 48 XMStrtUSub 26052 5.01 4.39 5.24 49 BAYES_40 24704 4.26 2.29 4.96 50 BAYES_60 24636 5.45 6.86 4.95 51 HTML_IMAGE_RATIO_04 24458 5.59 7.47 4.92 52 BAYES_99 23954 10.27 25.45 4.81 53 RCVD_IN_IADB_SENDERID 23079 3.72 1.16 4.64 54 BOTNET_IPINHOSTNAME 22854 7.44 15.36 4.59 55 RCVD_IN_IADB_DK 22849 3.68 1.13 4.59 56 RCVD_IN_MSPIKE_H2 22250 4.04 2.84 4.47 57 XM_PDF 22148 3.44 0.63 4.45 58 T_REMOTE_IMAGE 21172 3.83 2.66 4.25 59 ANY_BOUNCE_MESSAGE 21137 5.53 9.11 4.25 60 BOUNCE_MESSAGE 21129 5.53 9.11 4.25 61 BAYES_999 20153 8.27 20.03 4.05 62 XMSexyCombo_05 19167 5.54 10.24 3.85 63 XMSubMetaSx_00 18884 4.67 7.12 3.80 64 IN_ZIMBRA_NJ_WHITELIST 18730 2.78 0.02 3.76 65 XMNumbers 18692 4.11 5.08 3.76 66 FROM_EXCESS_BASE64 18549 5.47 10.32 3.73 67 RCVD_IN_IADB_VOUCHED 18279 2.94 0.88 3.67 68 BAYES_20 17364 3.09 1.97 3.49 69 MPART_ALT_DIFF 16146 4.63 8.48 3.24 70 HTML_IMAGE_RATIO_06 16010 3.99 6.14 3.22 71 XM_UncommonTLD01 15138 4.55 8.75 3.04 72 BOTNET 14892 8.49 23.80 2.99 73 TO_MALFORMED 13816 2.06 0.06 2.78 74 BAYES_80 13496 3.86 7.06 2.71 75 TR_DCC_Bayes_99 13153 7.49 21.00 2.64 76 UNPARSEABLE_RELAY 12944 2.45 2.02 2.60 77 MAILING_LIST_MULTI 12888 2.28 1.44 2.59 78 TooManyTo_002 12039 1.99 0.79 2.42 79 BAYES_05 11739 2.07 1.28 2.36 80 RCVD_IN_IADB_OPTIN 11192 1.83 0.66 2.25 81 TVD_RCVD_IP 10867 1.67 0.22 2.18 82 HTML_MIME_NO_HTML_TAG 10794 3.16 5.92 2.17 83 MIME_HTML_MOSTLY 10528 2.57 3.83 2.12 84 HTML_IMAGE_RATIO_08 10417 2.35 3.06 2.09 85 XMDiploma_00 10417 2.20 2.48 2.09 86 TM2_M_URI_OPT_OUT 10221 2.56 3.96 2.05 87 XM_CamelCaseFrm001 9622 2.19 2.91 1.93 88 RCVD_IN_MSPIKE_WL 9568 1.52 0.39 1.92 89 XM_SPF_SoftFail 9565 2.48 4.02 1.92 90 RCVD_IN_MSPIKE_H3 9552 1.51 0.38 1.92 91 XM_DK_Undo_01 9515 1.68 1.05 1.91 92 T_TooManySym_02 8839 1.52 0.81 1.78 93 XM_DIRTYINTL 8620 2.41 4.30 1.73 94 HELO_NODOT 8568 1.46 0.72 1.72 95 TooManyTo_003 8318 1.41 0.69 1.67 96 IN_HORDE_ADDRESS_BOOK 8201 1.22 0.04 1.65 97 BAYES_95 8142 2.20 3.79 1.64 98 URI_HEX 8045 2.07 3.32 1.62 99 RELAYCOUNTRY_CA 7857 1.88 2.73 1.58 100 TR_Symld_Words 7815 1.46 1.16 1.57 101 MIME_HTML_ONLY_MULTI 7500 2.30 4.52 1.51 102 SUBJ_ALL_CAPS 7406 1.76 2.51 1.49 103 TR_MetaPhish_Combo_01 7284 1.23 0.59 1.46 104 XM_OfRef6 7200 1.85 2.97 1.45 105 T_XMDrugObfuBody_08 7189 1.81 2.82 1.44 106 INVALID_MSGID 6891 1.04 0.07 1.38 107 XMCapTrack 6700 1.04 0.20 1.35 108 XMGenDplmaNmb 6648 1.34 1.34 1.34 109 XM_GoogleGroups 6424 1.05 0.40 1.29 110 URI_TRY_3LD 6168 1.25 1.28 1.24 111 TooManyTo_004 6085 1.06 0.60 1.22 112 UNTRUSTED_Relay 5958 5.19 16.30 1.20 113 XM_ProductURIs 5955 1.28 1.52 1.20 114 RCVD_IN_RP_RNBL 5943 4.03 11.94 1.19 115 XM_H_PHPOS 5789 1.11 0.96 1.16 116 USER_IN_DEF_DKIM_WL 5648 0.84 0.02 1.14 117 XM_H_Long_From02 5504 1.27 1.71 1.11 118 RELAYCOUNTRY_GB 5250 1.08 1.15 1.06 119 XMStockSpam_06 5168 1.04 1.05 1.04 120 DKIM_ADSP_CUSTOM_MED 5002 1.13 1.46 1.01 121 XMPhish11 4979 1.15 1.58 1.00 122 XMBdyGiftCard01 4950 1.21 1.80 0.99 123 TooManyTo_005 4937 0.88 0.55 0.99 124 TR_XM_RelayPhish 4383 0.98 1.24 0.88 125 T_XMDrugObfuBody_00 4312 1.15 1.93 0.87 126 TM2_M_VERY_LONG_WORD 4186 0.99 1.41 0.84 127 XMGappySubj_01 4012 0.81 0.83 0.81 128 SpammyFromTLD_01 3843 0.94 1.39 0.77 129 XM_UB50 3745 2.54 7.53 0.75 130 T_FILL_THIS_FORM_SHORT 3679 0.98 1.67 0.74 131 XMSexyCombo_01 3622 0.99 1.72 0.73 132 XMNoVowels 3607 0.64 0.42 0.72 133 XM_B_COPY_HTML 3515 0.72 0.74 0.71 134 NML_ADSP_CUSTOM_MED 3471 0.89 1.43 0.70 135 HTML_FONT_FACE_BAD 3435 0.78 1.04 0.69 136 XM_B_REG_HTML 3388 0.79 1.10 0.68 137 TM2_M_A_HREF_HREF 3326 0.62 0.48 0.67 138 XM_H_PHPMailer 3319 0.64 0.57 0.67 139 XMBody_17 3254 0.71 0.87 0.65 140 XMBrknScrpt_02 3134 0.79 1.25 0.63 141 XMLngstWrd_00 3123 0.59 0.48 0.63 142 T_OBFU_PDF_ATTACH 3095 0.51 0.22 0.62 143 RELAYCOUNTRY_AU 2981 0.61 0.65 0.60 144 XMLngstWrd_01 2932 0.55 0.44 0.59 145 T_Symld_Words_02 2904 0.69 0.98 0.58 146 T_XMHurry_00 2902 0.73 1.13 0.58 147 FORGED_GMAIL_RCVD 2822 0.77 1.33 0.57 148 FROM_GOV_SPOOF 2770 0.45 0.14 0.56 149 XMMoneyMeta_00 2735 0.65 0.92 0.55 150 T_TooManySym_03 2708 0.43 0.09 0.54 151 XMBody_95 2655 0.42 0.09 0.53 152 HTTPS_HTTP_MISMATCH 2631 0.60 0.82 0.53 153 USER_IN_WHITELIST 2619 0.39 0.00 0.53 154 XMSubMetaSxObfu_03 2550 0.56 0.71 0.51 155 RCVD_IN_BL_SPAMCOP_NET 2501 0.99 2.37 0.50 156 URI_NOVOWEL 2468 0.56 0.75 0.50 157 DKIM_ADSP_NXDOMAIN 2466 0.75 1.44 0.50 158 XM_S_JOY_D 2443 0.93 2.13 0.49 159 XMSubMetaI_00 2408 0.76 1.53 0.48 160 XM_Body_Obfu01 2408 0.47 0.43 0.48 161 XMSubMetaSxObfu_02 2385 0.47 0.46 0.48 162 XMHTMLBadTable_001 2377 0.53 0.69 0.48 163 XMHTML_After_End 2361 0.65 1.15 0.47 164 XMGappySubj_02 2359 0.42 0.28 0.47 165 XMPhish14 2313 0.58 0.91 0.46 166 FILL_THIS_FORM 2313 0.66 1.21 0.46 167 PLING_QUERY 2265 0.57 0.90 0.46 168 HTML_TAG_BALANCE_BODY 2254 0.57 0.89 0.45 169 SHORT_HELO_AND_INLINE_IMAGE 2164 0.34 0.07 0.43 170 TM2_M_BODY_EMPTY 2164 0.35 0.11 0.43 171 XM_B_TRADE_HTML 2144 0.47 0.57 0.43 172 XMPhish30 2124 0.65 1.27 0.43 173 MISSING_HEADERS 2111 1.30 3.75 0.42 174 SUBJ_DOLLARS 2045 0.60 1.14 0.41 175 XM_ShortIntro_01 2039 0.48 0.66 0.41 176 TR_LOTS_OF_MONEY3 2024 2.10 6.82 0.41 177 XMLKML 1999 0.30 0.00 0.40 178 HTML_IMAGE_ONLY_32 1965 0.36 0.25 0.39 179 XM_USANA_RCVD 1928 0.29 0.00 0.39 180 XMBody_78 1896 0.53 0.93 0.38 181 XM_H_PHPOS_M 1896 0.37 0.34 0.38 182 RDNS_DYNAMIC 1879 0.51 0.86 0.38 183 XMDateMe_00 1864 0.36 0.33 0.37 184 RELAYCOUNTRY_DE 1839 1.12 3.22 0.37 185 AC_DIV_BONANZA 1837 0.31 0.15 0.37 186 XM_D_tchamptons_WL 1831 0.27 0.00 0.37 187 XM_URI_RBL 1826 1.36 4.11 0.37 188 HTML_IMAGE_ONLY_28 1824 0.42 0.56 0.37 189 DIET_1 1817 0.81 2.03 0.37 190 RCVD_IN_SORBS_DUL 1808 0.32 0.20 0.36 191 FILL_THIS_FORM_LONG 1729 0.56 1.14 0.35 192 HTML_FONT_SIZE_LARGE 1714 0.51 0.98 0.34 193 XMSubNoVowel 1706 0.48 0.87 0.34 194 XMSlimDrugH 1666 0.65 1.54 0.33 195 XMSubPhish11 1642 0.30 0.20 0.33 196 TVD_SPACE_RATIO 1606 0.32 0.30 0.32 197 T_FROM_GOV_DKIM_AU 1598 0.26 0.08 0.32 198 RELAYCOUNTRY_NL 1551 0.41 0.67 0.31 199 FILL_THIS_FORM_LOAN 1539 0.37 0.55 0.31 200 HTML_IMAGE_ONLY_24 1532 0.33 0.40 0.31 ----------------------------------------------------------------------