Email: 602607 Autolearn: 0 AvgScore: 1.75 AvgScanTime: 3.56 sec Spam: 127503 Autolearn: 0 AvgScore: 12.11 AvgScanTime: 4.25 sec Ham: 475104 Autolearn: 0 AvgScore: -1.03 AvgScanTime: 3.38 sec Time Spent Running SA: 596.69 hours Time Spent Processing Spam: 150.51 hours Time Spent Processing Ham: 446.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 120426 89.66 94.45 88.38 2 DKIM_SIGNED 107650 76.11 84.43 73.88 3 DCC_CHECK 105014 49.44 82.36 40.60 4 XM_DK_Pass 103591 74.45 81.25 72.63 5 DKIM_VALID 96720 70.08 75.86 68.53 6 XMListUnsubscribeExists 93721 55.67 73.50 50.89 7 DKIM_VALID_AU 76108 50.84 59.69 48.46 8 XM_H_QuotedFrom 69261 43.86 54.32 41.05 9 BAYES_50 59478 54.95 46.65 57.18 10 HTML_FONT_LOW_CONTRAST 48902 30.32 38.35 28.17 11 XM_DK_Undo_02 46606 13.57 36.55 7.40 12 LOC_TINY_FONT_1 45660 25.33 35.81 22.52 13 MIME_HTML_ONLY 40314 22.87 31.62 20.52 14 FVGT_m_MULTI_ODD 38355 22.90 30.08 20.98 15 BAYES_99 37063 10.74 29.07 5.82 16 XMSubLong 36636 22.99 28.73 21.44 17 TR_DCC_Bayes_99 31006 7.82 24.32 3.39 18 BAYES_999 30913 8.99 24.24 4.90 19 DKIM_VALID_EF 27397 25.58 21.49 26.68 20 XM_Body_Dirty_Words 26272 14.50 20.61 12.86 21 RELAYCOUNTRY_META 24644 8.03 19.33 5.00 22 BOTNET_IPINHOSTNAME 24221 7.80 19.00 4.80 23 T_KAM_HTML_FONT_INVALID 23293 16.35 18.27 15.83 24 T_TM2_M_HEADER_IN_MSG 22528 27.20 17.67 29.76 25 LOTS_OF_MONEY 21326 11.45 16.73 10.04 26 XM_Multi_Part_URI 20658 13.14 16.20 12.32 27 DCC_CHECK_NEGATIVE 20189 48.68 15.83 57.49 28 XM_Evil_Numbers_Gen 19160 9.98 15.03 8.63 29 MultiRelay 18838 17.28 14.77 17.95 30 BOTNET 18574 4.39 14.57 1.65 31 HTML_IMAGE_RATIO_02 17751 9.74 13.92 8.62 32 UNTRUSTED_Relay 17491 3.91 13.72 1.28 33 FSL_BULK_SIG 17318 7.65 13.58 6.06 34 XM_UncommonTLD01 15432 5.10 12.10 3.22 35 XMSexyCombo_05 14624 5.36 11.47 3.72 36 XMSubMetaSx_00 13770 5.45 10.80 4.02 37 HTML_IMAGE_RATIO_04 13290 6.32 10.42 5.22 38 T_XMDrugObfuBody_14 12232 8.10 9.59 7.69 39 DKIM_INVALID 10930 6.03 8.57 5.35 40 TooManyTo_001 10665 7.83 8.36 7.69 41 XM_B_Phish_Phrases 10290 6.50 8.07 6.08 42 MPART_ALT_DIFF 10118 4.42 7.94 3.48 43 XM_H_Long_From01 10090 6.20 7.91 5.73 44 BAYES_60 9587 5.49 7.52 4.94 45 XM_UB50 9180 2.16 7.20 0.81 46 RCVD_IN_RP_RNBL 8407 1.45 6.59 0.07 47 SpammyFromTLD_02 8250 1.72 6.47 0.44 48 FROM_EXCESS_BASE64 8216 4.70 6.44 4.23 49 BAYES_80 7498 3.40 5.88 2.74 50 LotsOfNums_01 7052 7.74 5.53 8.33 51 XMNumbers 6437 3.71 5.05 3.36 52 XM_SPF_SoftFail 6343 2.56 4.97 1.91 53 XM_DIRTYINTL 6287 2.57 4.93 1.94 54 XM_salutation2 6196 1.66 4.86 0.80 55 XMSexyCombo_01 5802 1.49 4.55 0.67 56 T_TooManySym_01 5593 4.85 4.39 4.97 57 MIME_HTML_ONLY_MULTI 5420 2.01 4.25 1.41 58 HTML_IMAGE_RATIO_06 5231 3.51 4.10 3.36 59 MIME_HTML_MOSTLY 4909 3.11 3.85 2.91 60 HTML_MIME_NO_HTML_TAG 4798 2.85 3.76 2.60 61 XMStrtUSub 4725 5.16 3.71 5.55 62 TM2_M_URI_OPT_OUT 4587 2.32 3.60 1.98 63 XM_SendGrid 4573 5.69 3.59 6.26 64 XMStockSpam_06 4537 1.48 3.56 0.93 65 URI_HEX 4376 2.20 3.43 1.88 66 T_REMOTE_IMAGE 4350 3.88 3.41 4.01 67 RCVD_IN_MSPIKE_H2 4263 4.00 3.34 4.17 68 RELAYCOUNTRY_CA 4158 1.93 3.26 1.57 69 XM_URI_RBL 4081 1.03 3.20 0.45 70 XM_OfRef6 4003 1.75 3.14 1.37 71 RCVD_IN_RP_SAFE 4003 7.38 3.14 8.52 72 XM_CamelCaseFrm001 3934 2.18 3.09 1.94 73 BAYES_95 3785 2.00 2.97 1.74 74 XMBdyGiftCard01 3755 1.28 2.95 0.83 75 URIBL_DBL_SPAM 3676 0.69 2.88 0.11 76 SUBJ_ALL_CAPS 3506 2.35 2.75 2.24 77 MultiRelay_CC 3411 0.69 2.68 0.16 78 MultiRelay_Combo 3411 0.69 2.68 0.16 79 MIME_QP_LONG_LINE 3340 4.72 2.62 5.29 80 BAYES_40 3299 4.19 2.59 4.62 81 XM_UB60 3242 0.58 2.54 0.06 82 HTML_IMAGE_RATIO_08 3230 2.25 2.53 2.18 83 XMDiploma_00 3160 1.81 2.48 1.62 84 T_XMDrugObfuBody_08 3138 1.80 2.46 1.62 85 RELAYCOUNTRY_IN 3134 0.60 2.46 0.11 86 XMSubMetaI_00 3132 1.05 2.46 0.67 87 XMSexyCombo_04 3089 0.63 2.42 0.15 88 T_TooManySym_02 3053 1.84 2.39 1.69 89 BOTNET_NORDNS 3035 0.52 2.38 0.02 90 SpammyFromTLD_01 2977 1.06 2.33 0.72 91 RELAYCOUNTRY_FR 2930 0.65 2.30 0.21 92 RCVD_IN_BL_SPAMCOP_NET 2920 0.73 2.29 0.31 93 BAYES_20 2898 3.16 2.27 3.40 94 FROM_SUSPICIOUS_NTLD 2894 0.53 2.27 0.06 95 XM_RXBody 2784 0.64 2.18 0.23 96 DKIM_ADSP_NXDOMAIN 2771 0.83 2.17 0.47 97 LONG_HEX_URI 2709 0.62 2.12 0.22 98 XMGenDplmaNmb 2545 1.23 2.00 1.03 99 UNPARSEABLE_RELAY 2407 2.47 1.89 2.63 100 XMBody_17 2311 0.80 1.81 0.52 101 RCVD_IN_RP_CERTIFIED 2303 5.89 1.81 6.98 102 XMSolicitRefs_0 2277 0.60 1.79 0.29 103 BAYES_00 2276 14.09 1.79 17.39 104 RELAYCOUNTRY_CN 2274 0.43 1.78 0.07 105 NO_DNS_FOR_FROM 2178 0.55 1.71 0.24 106 DATE_IN_PAST_03_06 2097 0.42 1.64 0.10 107 TR_Symld_Words 2072 1.72 1.63 1.74 108 T_XMDrugObfuBody_00 2043 1.02 1.60 0.87 109 XMAntiAgingB 2025 0.37 1.59 0.04 110 XM_DKIMWhitelistDomains 1981 9.53 1.55 11.67 111 T_MANY_PILL_PRICE 1970 0.35 1.55 0.03 112 T_XMHurry_00 1959 0.82 1.54 0.63 113 SUBJ_DOLLARS 1910 0.79 1.50 0.60 114 TR_LOTS_OF_MONEY2 1885 0.49 1.48 0.22 115 T_MONEY_PERCENT 1885 0.49 1.48 0.22 116 TM2_M_VERY_LONG_WORD 1882 0.94 1.48 0.80 117 XM_ProductURIs 1811 0.90 1.42 0.76 118 XMPhish30 1792 0.61 1.41 0.40 119 MAILING_LIST_MULTI 1786 2.43 1.40 2.70 120 RCVD_IN_IADB_LISTED 1767 4.57 1.39 5.42 121 TR_XM_DK_Bayes 1707 11.16 1.34 13.79 122 XM_DK_Undo_01 1698 1.71 1.33 1.81 123 T_Symld_Words_02 1686 0.82 1.32 0.69 124 XM_H_PHPOS 1682 1.04 1.32 0.97 125 RELAYCOUNTRY_AT 1680 0.42 1.32 0.18 126 URIBL_ABUSE_SURBL 1677 0.32 1.32 0.05 127 URIBL_BLACK 1653 0.31 1.30 0.05 128 XM_XX_Yahoo 1640 0.33 1.29 0.07 129 BAYES_05 1619 1.99 1.27 2.18 130 RDNS_DYNAMIC 1594 0.59 1.25 0.41 131 XMBody_78 1593 0.63 1.25 0.46 132 TR_XM_DK_Bayes1 1588 10.50 1.25 12.98 133 XMSubMetaSxObfu_03 1575 0.74 1.24 0.61 134 HTML_FONT_FACE_BAD 1571 0.61 1.23 0.45 135 ANY_BOUNCE_MESSAGE 1570 2.48 1.23 2.82 136 BOUNCE_MESSAGE 1568 2.48 1.23 2.82 137 XM_H_Long_From02 1563 0.98 1.23 0.92 138 TR_LOTS_OF_MONEY3 1548 0.61 1.21 0.44 139 XMHTML_After_End 1536 0.62 1.20 0.46 140 DKIM_ADSP_CUSTOM_MED 1524 1.00 1.20 0.95 141 TR_XM_RelayPhish 1513 0.76 1.19 0.64 142 BODY_URI_ONLY 1506 0.33 1.18 0.10 143 RCVD_IN_IADB_SPF 1487 3.96 1.17 4.71 144 FILL_THIS_FORM 1476 0.60 1.16 0.45 145 XMPhish14 1470 0.60 1.15 0.46 146 DATE_IN_PAST_06_12 1462 0.27 1.15 0.03 147 TVD_SPACE_RATIO_MINFP 1446 0.24 1.13 0.01 148 ALL_TRUSTED 1442 14.57 1.13 18.17 149 NML_ADSP_CUSTOM_MED 1432 0.78 1.12 0.69 150 RCVD_IN_IADB_SENDERID 1425 3.50 1.12 4.14 151 XM_UB80 1411 0.25 1.11 0.02 152 FILL_THIS_FORM_LONG 1405 0.53 1.10 0.38 153 RCVD_IN_IADB_DK 1396 3.45 1.09 4.08 154 URI_TRY_3LD 1381 1.33 1.08 1.40 155 TR_Caps_n_Bayes_99 1379 0.27 1.08 0.05 156 XM_OfRef7 1342 0.38 1.05 0.20 157 FORGED_GMAIL_RCVD 1335 0.58 1.05 0.45 158 TR_Mismatch_TLD_02 1328 0.28 1.04 0.08 159 XM_B_REG_HTML 1315 0.59 1.03 0.47 160 LONG_JUNK_URI 1313 0.28 1.03 0.08 161 XMPhish11 1312 1.01 1.03 1.00 162 XM_UB99 1300 0.22 1.02 0.01 163 T_FILL_THIS_FORM_SHORT 1297 0.85 1.02 0.81 164 NORDNS_LOW_CONTRAST 1295 0.22 1.02 0.00 165 TR_XM_DK_Bayes2 1266 8.29 0.99 10.25 166 RELAYCOUNTRY_GB 1255 0.93 0.98 0.92 167 HTML_SHORT_LINK_IMG_1 1225 0.23 0.96 0.03 168 DIET_1 1224 0.42 0.96 0.28 169 MPART_ALT_DIFF_COUNT 1214 0.40 0.95 0.25 170 BODY_ENHANCEMENT 1172 0.26 0.92 0.08 171 XMSubMetaI_01 1126 0.23 0.88 0.05 172 FILL_THIS_FORM_LOAN 1121 0.46 0.88 0.34 173 MONEY_FORM 1119 0.19 0.88 0.00 174 XMClaimOffer 1067 0.26 0.84 0.11 175 T_HTML_TAG_BALANCE_CENTER 1032 0.26 0.81 0.11 176 LongTLD 1020 0.33 0.80 0.20 177 LOW_PRICE 1019 0.27 0.80 0.13 178 XMBrknScrpt_02 1018 0.61 0.80 0.55 179 XMNoVowels 1017 0.59 0.80 0.53 180 XMSubMetaSxObfu_04 1007 0.25 0.79 0.11 181 RELAYCOUNTRY_DE 1007 0.40 0.79 0.29 182 XM_HighProb1 988 0.20 0.77 0.04 183 THIS_AD 988 0.34 0.77 0.23 184 HTML_TAG_BALANCE_BODY 978 0.62 0.77 0.59 185 RCVD_IN_IADB_VOUCHED 973 2.94 0.76 3.52 186 MONEY_FRAUD_5 972 0.16 0.76 0.00 187 XM_H_TOP 970 0.16 0.76 0.00 188 XM_Lotto 958 0.21 0.75 0.06 189 XM_UB999 937 0.16 0.73 0.00 190 XM_PDF 934 3.79 0.73 4.61 191 RELAYCOUNTRY_JP 931 0.18 0.73 0.03 192 XMHTMLBadTable_001 929 0.73 0.73 0.73 193 XM_BadFromFormat 929 0.24 0.73 0.11 194 XM_H_PHPMailer 901 0.63 0.71 0.61 195 XMGppyBdWords 884 0.29 0.69 0.18 196 TEQF_USR_POLITE 870 0.15 0.68 0.00 197 XMSubMetaSSx_00 870 0.26 0.68 0.14 198 REMOVE_BEFORE_LINK 857 0.48 0.67 0.43 199 XM_B_COPY_HTML 857 0.55 0.67 0.51 200 MIME_HEADER_CTYPE_ONLY 832 0.23 0.65 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 419888 89.66 94.45 88.38 2 DKIM_SIGNED 351011 76.11 84.43 73.88 3 XM_DK_Pass 345075 74.45 81.25 72.63 4 DKIM_VALID 325600 70.08 75.86 68.53 5 DCC_CHECK_NEGATIVE 273149 48.68 15.83 57.49 6 BAYES_50 271653 54.95 46.65 57.18 7 XMListUnsubscribeExists 241775 55.67 73.50 50.89 8 DKIM_VALID_AU 230234 50.84 59.69 48.46 9 XM_H_QuotedFrom 195033 43.86 54.32 41.05 10 DCC_CHECK 192894 49.44 82.36 40.60 11 T_TM2_M_HEADER_IN_MSG 141387 27.20 17.67 29.76 12 HTML_FONT_LOW_CONTRAST 133821 30.32 38.35 28.17 13 DKIM_VALID_EF 126755 25.58 21.49 26.68 14 LOC_TINY_FONT_1 107004 25.33 35.81 22.52 15 XMSubLong 101882 22.99 28.73 21.44 16 FVGT_m_MULTI_ODD 99665 22.90 30.08 20.98 17 MIME_HTML_ONLY 97506 22.87 31.62 20.52 18 ALL_TRUSTED 86347 14.57 1.13 18.17 19 MultiRelay 85297 17.28 14.77 17.95 20 BAYES_00 82616 14.09 1.79 17.39 21 T_KAM_HTML_FONT_INVALID 75227 16.35 18.27 15.83 22 TR_XM_DK_Bayes 65517 11.16 1.34 13.79 23 TR_XM_DK_Bayes1 61688 10.50 1.25 12.98 24 XM_Body_Dirty_Words 61111 14.50 20.61 12.86 25 XM_Multi_Part_URI 58533 13.14 16.20 12.32 26 XM_DKIMWhitelistDomains 55447 9.53 1.55 11.67 27 TR_XM_DK_Bayes2 48694 8.29 0.99 10.25 28 LOTS_OF_MONEY 47694 11.45 16.73 10.04 29 XM_Evil_Numbers_Gen 40982 9.98 15.03 8.63 30 HTML_IMAGE_RATIO_02 40971 9.74 13.92 8.62 31 RCVD_IN_RP_SAFE 40470 7.38 3.14 8.52 32 LotsOfNums_01 39598 7.74 5.53 8.33 33 T_XMDrugObfuBody_14 36554 8.10 9.59 7.69 34 TooManyTo_001 36539 7.83 8.36 7.69 35 XM_DK_Undo_02 35158 13.57 36.55 7.40 36 RCVD_IN_RP_CERTIFIED 33184 5.89 1.81 6.98 37 XM_SendGrid 29724 5.69 3.59 6.26 38 XM_B_Phish_Phrases 28879 6.50 8.07 6.08 39 FSL_BULK_SIG 28810 7.65 13.58 6.06 40 BAYES_99 27638 10.74 29.07 5.82 41 XM_H_Long_From01 27243 6.20 7.91 5.73 42 XMStrtUSub 26384 5.16 3.71 5.55 43 RCVD_IN_IADB_LISTED 25755 4.57 1.39 5.42 44 DKIM_INVALID 25411 6.03 8.57 5.35 45 MIME_QP_LONG_LINE 25130 4.72 2.62 5.29 46 HTML_IMAGE_RATIO_04 24812 6.32 10.42 5.22 47 RELAYCOUNTRY_META 23755 8.03 19.33 5.00 48 T_TooManySym_01 23618 4.85 4.39 4.97 49 BAYES_60 23483 5.49 7.52 4.94 50 BAYES_999 23284 8.99 24.24 4.90 51 BOTNET_IPINHOSTNAME 22804 7.80 19.00 4.80 52 RCVD_IN_IADB_SPF 22379 3.96 1.17 4.71 53 BAYES_40 21941 4.19 2.59 4.62 54 XM_PDF 21892 3.79 0.73 4.61 55 FROM_EXCESS_BASE64 20078 4.70 6.44 4.23 56 RCVD_IN_MSPIKE_H2 19822 4.00 3.34 4.17 57 RCVD_IN_IADB_SENDERID 19692 3.50 1.12 4.14 58 RCVD_IN_IADB_DK 19396 3.45 1.09 4.08 59 XMSubMetaSx_00 19078 5.45 10.80 4.02 60 T_REMOTE_IMAGE 19040 3.88 3.41 4.01 61 XMSexyCombo_05 17674 5.36 11.47 3.72 62 IN_ZIMBRA_NJ_WHITELIST 17171 2.85 0.02 3.61 63 RCVD_IN_IADB_VOUCHED 16733 2.94 0.76 3.52 64 MPART_ALT_DIFF 16522 4.42 7.94 3.48 65 BAYES_20 16150 3.16 2.27 3.40 66 TR_DCC_Bayes_99 16098 7.82 24.32 3.39 67 XMNumbers 15945 3.71 5.05 3.36 68 HTML_IMAGE_RATIO_06 15943 3.51 4.10 3.36 69 XM_UncommonTLD01 15304 5.10 12.10 3.22 70 MIME_HTML_MOSTLY 13812 3.11 3.85 2.91 71 ANY_BOUNCE_MESSAGE 13380 2.48 1.23 2.82 72 BOUNCE_MESSAGE 13380 2.48 1.23 2.82 73 BAYES_80 13016 3.40 5.88 2.74 74 MAILING_LIST_MULTI 12828 2.43 1.40 2.70 75 UNPARSEABLE_RELAY 12473 2.47 1.89 2.63 76 HTML_MIME_NO_HTML_TAG 12351 2.85 3.76 2.60 77 TO_MALFORMED 11199 1.87 0.06 2.36 78 TVD_RCVD_IP 10785 1.85 0.30 2.27 79 RCVD_IN_IADB_OPTIN 10659 1.88 0.54 2.24 80 SUBJ_ALL_CAPS 10659 2.35 2.75 2.24 81 HTML_IMAGE_RATIO_08 10358 2.25 2.53 2.18 82 BAYES_05 10346 1.99 1.27 2.18 83 TM2_M_URI_OPT_OUT 9385 2.32 3.60 1.98 84 XM_CamelCaseFrm001 9230 2.18 3.09 1.94 85 XM_DIRTYINTL 9204 2.57 4.93 1.94 86 RCVD_IN_MSPIKE_WL 9103 1.59 0.38 1.92 87 RCVD_IN_MSPIKE_H3 9097 1.59 0.38 1.91 88 XM_SPF_SoftFail 9054 2.56 4.97 1.91 89 TooManyTo_002 8919 1.61 0.60 1.88 90 URI_HEX 8909 2.20 3.43 1.88 91 XM_DK_Undo_01 8578 1.71 1.33 1.81 92 TR_Symld_Words 8278 1.72 1.63 1.74 93 BAYES_95 8261 2.00 2.97 1.74 94 T_TooManySym_02 8006 1.84 2.39 1.69 95 BOTNET 7861 4.39 14.57 1.65 96 T_XMDrugObfuBody_08 7720 1.80 2.46 1.62 97 XMDiploma_00 7718 1.81 2.48 1.62 98 IN_HORDE_ADDRESS_BOOK 7519 1.26 0.05 1.58 99 RELAYCOUNTRY_CA 7464 1.93 3.26 1.57 100 INVALID_MSGID 7255 1.23 0.14 1.53 101 TR_MetaPhish_Combo_01 7228 1.31 0.55 1.52 102 HELO_NODOT 6987 1.26 0.47 1.47 103 MIME_HTML_ONLY_MULTI 6701 2.01 4.25 1.41 104 URI_TRY_3LD 6628 1.33 1.08 1.40 105 XM_OfRef6 6532 1.75 3.14 1.37 106 UNTRUSTED_Relay 6082 3.91 13.72 1.28 107 TooManyTo_003 6065 1.11 0.48 1.28 108 USER_IN_DEF_DKIM_WL 5537 0.93 0.07 1.17 109 XMCapTrack 5418 0.95 0.24 1.14 110 XM_GoogleGroups 5356 0.99 0.48 1.13 111 XMGenDplmaNmb 4884 1.23 2.00 1.03 112 XMPhish11 4753 1.01 1.03 1.00 113 XM_H_PHPOS 4604 1.04 1.32 0.97 114 DKIM_ADSP_CUSTOM_MED 4508 1.00 1.20 0.95 115 XMStockSpam_06 4397 1.48 3.56 0.93 116 XM_H_Long_From02 4371 0.98 1.23 0.92 117 RELAYCOUNTRY_GB 4357 0.93 0.98 0.92 118 TooManyTo_004 4355 0.81 0.39 0.92 119 TM2_M_A_HREF_HREF 4198 0.82 0.56 0.88 120 T_XMDrugObfuBody_00 4125 1.02 1.60 0.87 121 XMBdyGiftCard01 3930 1.28 2.95 0.83 122 XM_UB50 3852 2.16 7.20 0.81 123 T_FILL_THIS_FORM_SHORT 3827 0.85 1.02 0.81 124 TM2_M_VERY_LONG_WORD 3795 0.94 1.48 0.80 125 XM_salutation2 3793 1.66 4.86 0.80 126 XM_ProductURIs 3623 0.90 1.42 0.76 127 TooManyTo_005 3605 0.66 0.31 0.76 128 XMHTMLBadTable_001 3470 0.73 0.73 0.73 129 SpammyFromTLD_01 3410 1.06 2.33 0.72 130 T_Symld_Words_02 3276 0.82 1.32 0.69 131 NML_ADSP_CUSTOM_MED 3268 0.78 1.12 0.69 132 XMSubMetaI_00 3183 1.05 2.46 0.67 133 XMSexyCombo_01 3177 1.49 4.55 0.67 134 FROM_GOV_SPOOF 3108 0.57 0.27 0.65 135 XMGappySubj_01 3077 0.58 0.35 0.65 136 TR_XM_RelayPhish 3056 0.76 1.19 0.64 137 T_XMHurry_00 2985 0.82 1.54 0.63 138 XMSubMetaSxObfu_03 2913 0.74 1.24 0.61 139 XM_H_PHPMailer 2899 0.63 0.71 0.61 140 HTTPS_HTTP_MISMATCH 2885 0.60 0.56 0.61 141 SUBJ_DOLLARS 2836 0.79 1.50 0.60 142 HTML_TAG_BALANCE_BODY 2780 0.62 0.77 0.59 143 XMBody_95 2753 0.48 0.13 0.58 144 T_OBFU_PDF_ATTACH 2663 0.48 0.20 0.56 145 T_TooManySym_03 2632 0.49 0.25 0.55 146 XMBrknScrpt_02 2630 0.61 0.80 0.55 147 USER_IN_WHITELIST 2565 0.43 0.00 0.54 148 XMNoVowels 2540 0.59 0.80 0.53 149 XMMoneyMeta_00 2539 0.55 0.60 0.53 150 XMBody_17 2491 0.80 1.81 0.52 151 XM_B_COPY_HTML 2436 0.55 0.67 0.51 152 XMLngstWrd_00 2346 0.46 0.35 0.49 153 XM_D_tchamptons_WL 2262 0.38 0.00 0.48 154 XM_B_REG_HTML 2247 0.59 1.03 0.47 155 RELAYCOUNTRY_AU 2244 0.49 0.57 0.47 156 DKIM_ADSP_NXDOMAIN 2217 0.83 2.17 0.47 157 XMBody_78 2206 0.63 1.25 0.46 158 URI_NOVOWEL 2191 0.47 0.48 0.46 159 XMHTML_After_End 2189 0.62 1.20 0.46 160 AC_DIV_BONANZA 2166 0.39 0.13 0.46 161 XMPhish14 2165 0.60 1.15 0.46 162 XMLngstWrd_01 2164 0.43 0.32 0.46 163 T_HTML_ATTACH 2164 0.44 0.37 0.46 164 PLING_QUERY 2143 0.43 0.34 0.45 165 FORGED_GMAIL_RCVD 2141 0.58 1.05 0.45 166 HTML_FONT_FACE_BAD 2131 0.61 1.23 0.45 167 XM_URI_RBL 2130 1.03 3.20 0.45 168 FILL_THIS_FORM 2119 0.60 1.16 0.45 169 TR_LOTS_OF_MONEY3 2105 0.61 1.21 0.44 170 SpammyFromTLD_02 2104 1.72 6.47 0.44 171 REMOVE_BEFORE_LINK 2059 0.48 0.67 0.43 172 XMSubMetaSxObfu_02 2039 0.47 0.60 0.43 173 XMSlimDrugH 1961 0.44 0.55 0.41 174 RDNS_DYNAMIC 1951 0.59 1.25 0.41 175 XMPhish30 1901 0.61 1.41 0.40 176 SHORT_HELO_AND_INLINE_IMAGE 1863 0.31 0.03 0.39 177 HTML_IMAGE_ONLY_32 1815 0.36 0.27 0.38 178 FILL_THIS_FORM_LONG 1801 0.53 1.10 0.38 179 MISSING_HEADERS 1748 0.42 0.63 0.37 180 TM2_M_BODY_EMPTY 1740 0.33 0.19 0.37 181 XMDateMe_00 1735 0.36 0.32 0.37 182 XM_ShortIntro_01 1715 0.36 0.35 0.36 183 XMSubNoVowel 1678 0.39 0.51 0.35 184 FROM_GOV_DKIM_AU 1655 0.31 0.17 0.35 185 FILL_THIS_FORM_LOAN 1638 0.46 0.88 0.34 186 HTML_IMAGE_ONLY_28 1622 0.37 0.47 0.34 187 UPPERCASE_50_75 1599 0.28 0.07 0.34 188 TVD_SPACE_RATIO 1487 0.28 0.17 0.31 189 XM_S_JOY_D 1477 0.37 0.57 0.31 190 RCVD_IN_BL_SPAMCOP_NET 1457 0.73 2.29 0.31 191 RCVD_IN_SORBS_DUL 1456 0.33 0.40 0.31 192 HTML_IMAGE_ONLY_24 1445 0.36 0.58 0.30 193 XMRcvdHeader_15 1444 0.24 0.00 0.30 194 XM_H_PHPOS_M 1393 0.34 0.51 0.29 195 RELAYCOUNTRY_DE 1378 0.40 0.79 0.29 196 XMSolicitRefs_0 1361 0.60 1.79 0.29 197 DIET_1 1320 0.42 0.96 0.28 198 HK_RANDOM_FROM 1306 0.34 0.56 0.27 199 XMSubEmpty 1304 0.27 0.24 0.27 200 NUMERIC_HTTP_ADDR 1281 0.24 0.13 0.27 ----------------------------------------------------------------------