Email: 659876 Autolearn: 0 AvgScore: 2.33 AvgScanTime: 3.11 sec Spam: 175624 Autolearn: 0 AvgScore: 11.89 AvgScanTime: 3.86 sec Ham: 484252 Autolearn: 0 AvgScore: -1.14 AvgScanTime: 2.83 sec Time Spent Running SA: 569.40 hours Time Spent Processing Spam: 188.33 hours Time Spent Processing Ham: 381.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 118008 82.87 67.19 88.55 2 BAYES_50 113379 59.46 64.56 57.61 3 DCC_CHECK 101816 46.34 57.97 42.12 4 DKIM_SIGNED 92579 69.07 52.71 75.01 5 XM_DK_Pass 89695 67.44 51.07 73.37 6 DKIM_VALID 82332 63.43 46.88 69.44 7 XMListUnsubscribeExists 81441 50.08 46.37 51.43 8 DCC_CHECK_NEGATIVE 71575 51.87 40.75 55.90 9 BOTNET 69843 12.10 39.77 2.06 10 LOTS_OF_MONEY 68501 18.56 39.00 11.14 11 DKIM_VALID_AU 66194 46.07 37.69 49.10 12 XM_H_QuotedFrom 58858 38.03 33.51 39.66 13 RCVD_IN_RP_RNBL 54516 8.29 31.04 0.04 14 XM_OfRef6 54482 9.58 31.02 1.80 15 T_FILL_THIS_FORM_SHORT 53022 8.79 30.19 1.03 16 ANY_BOUNCE_MESSAGE 52235 9.53 29.74 2.20 17 BOUNCE_MESSAGE 52234 9.53 29.74 2.20 18 XM_OfRef7 51962 8.28 29.59 0.56 19 MONEY_FORM_SHORT 51509 7.86 29.33 0.07 20 HK_SCAM_N2 49877 7.66 28.40 0.14 21 MIME_HTML_ONLY 47848 22.97 27.24 21.42 22 HTML_FONT_LOW_CONTRAST 45315 28.01 25.80 28.81 23 XM_DK_Undo_02 42353 11.74 24.12 7.26 24 LOC_TINY_FONT_1 41765 23.14 23.78 22.91 25 FVGT_m_MULTI_ODD 39387 20.91 22.43 20.36 26 XM_Multi_Part_URI 34684 14.24 19.75 12.24 27 T_KAM_HTML_FONT_INVALID 34257 17.26 19.51 16.45 28 BAYES_99 32622 8.79 18.57 5.24 29 XMSubLong 31549 20.38 17.96 21.25 30 BAYES_999 26812 7.15 15.27 4.21 31 TR_DCC_Bayes_99 26788 6.03 15.25 2.69 32 XM_Body_Dirty_Words 26235 13.69 14.94 13.24 33 DATE_IN_PAST_06_12 26137 3.99 14.88 0.04 34 FSL_BULK_SIG 25749 8.97 14.66 6.91 35 DKIM_VALID_EF 23063 22.69 13.13 26.15 36 T_TM2_M_HEADER_IN_MSG 22522 25.26 12.82 29.77 37 XM_OfRef8 22063 3.41 12.56 0.09 38 RELAYCOUNTRY_META 21221 7.09 12.08 5.28 39 BOTNET_IPINHOSTNAME 20002 6.61 11.39 4.88 40 MultiRelay 19201 16.36 10.93 18.33 41 DATE_IN_PAST_03_06 15930 2.48 9.07 0.09 42 XM_SPF_SoftFail 15354 3.80 8.74 2.00 43 HTML_IMAGE_RATIO_02 15110 8.80 8.60 8.87 44 XM_Evil_Numbers_Gen 14483 8.69 8.25 8.85 45 XMSexyCombo_05 13625 5.44 7.76 4.60 46 UNTRUSTED_Relay 12749 2.88 7.26 1.29 47 XMSubMetaSx_00 12484 4.72 7.11 3.86 48 XM_UncommonTLD01 12427 4.20 7.08 3.16 49 ALL_TRUSTED 11817 14.16 6.73 16.85 50 T_XMDrugObfuBody_14 10980 7.50 6.25 7.96 51 URI_WPADMIN 10414 1.61 5.93 0.04 52 XM_H_Long_From01 10249 6.31 5.84 6.49 53 DKIM_INVALID 10247 5.64 5.83 5.57 54 HTML_IMAGE_RATIO_04 10203 5.66 5.81 5.61 55 TooManyTo_001 9982 7.30 5.68 7.88 56 XM_B_Phish_Phrases 9208 5.76 5.24 5.95 57 BAYES_60 9139 5.11 5.20 5.07 58 FROM_EXCESS_BASE64 8811 4.79 5.02 4.70 59 URI_HEX 8638 2.47 4.92 1.58 60 MPART_ALT_DIFF 8140 3.75 4.63 3.43 61 XMNumbers 7757 3.22 4.42 2.78 62 BAYES_80 7397 3.11 4.21 2.70 63 LotsOfNums_01 7177 7.45 4.09 8.67 64 XM_UB50 7005 1.61 3.99 0.75 65 XM_URI_RBL 6194 1.34 3.53 0.55 66 HTML_IMAGE_RATIO_06 6053 3.53 3.45 3.55 67 T_REMOTE_IMAGE 6013 3.80 3.42 3.94 68 XM_DIRTYINTL 5730 2.39 3.26 2.08 69 HTML_MIME_NO_HTML_TAG 5619 2.52 3.20 2.28 70 XMStrtUSub 5266 4.35 3.00 4.84 71 HTML_IMAGE_RATIO_08 5205 2.63 2.96 2.51 72 TM2_M_URI_OPT_OUT 4813 2.12 2.74 1.89 73 MIME_HTML_MOSTLY 4767 2.87 2.71 2.93 74 MIME_HTML_ONLY_MULTI 4722 1.81 2.69 1.49 75 XM_CamelCaseFrm001 4578 1.99 2.61 1.76 76 RELAYCOUNTRY_CA 4348 1.91 2.48 1.71 77 T_XMDrugObfuBody_01 4151 0.66 2.36 0.04 78 XMSexyCombo_01 4119 0.99 2.35 0.50 79 MultiRelay_Combo 4005 0.72 2.28 0.15 80 MultiRelay_CC 4005 0.72 2.28 0.15 81 BAYES_95 3891 1.93 2.22 1.83 82 XMReplyNow 3789 0.69 2.16 0.15 83 RCVD_IN_BL_SPAMCOP_NET 3738 0.87 2.13 0.41 84 T_TooManySym_01 3570 4.00 2.03 4.72 85 BAYES_40 3525 3.64 2.01 4.23 86 SUBJ_ALL_CAPS 3460 2.03 1.97 2.05 87 T_XMDrugObfuBody_08 3459 1.65 1.97 1.53 88 XM_SendGrid 3315 4.94 1.89 6.05 89 RCVD_IN_MSPIKE_H2 3229 3.63 1.84 4.28 90 XMDiploma_00 3226 2.18 1.84 2.31 91 XM_salutation2 3124 1.09 1.78 0.84 92 SpammyFromTLD_02 3095 0.79 1.76 0.43 93 MIME_QP_LONG_LINE 3079 4.55 1.75 5.57 94 XMBdyGiftCard01 2944 1.02 1.68 0.79 95 XMBody_17 2925 1.15 1.67 0.96 96 XM_H_Long_From02 2844 1.15 1.62 0.98 97 TR_LOTS_OF_MONEY3 2834 1.01 1.61 0.78 98 BOTNET_NORDNS 2784 0.44 1.59 0.02 99 BODY_URI_ONLY 2746 0.46 1.56 0.06 100 HTML_SHORT_LINK_IMG_1 2650 0.42 1.51 0.03 101 XMStockSpam_06 2616 1.34 1.49 1.28 102 T_Symld_Words_02 2611 0.86 1.49 0.64 103 FROM_SUSPICIOUS_NTLD 2610 0.48 1.49 0.12 104 T_XMDrugObfuBody_00 2564 1.35 1.46 1.32 105 RCVD_IN_RP_SAFE 2502 7.27 1.42 9.38 106 BAYES_20 2494 2.82 1.42 3.32 107 UNPARSEABLE_RELAY 2435 2.35 1.39 2.70 108 BODY_ENHANCEMENT 2422 0.39 1.38 0.03 109 XMSubMetaI_00 2388 1.21 1.36 1.15 110 XMGenDplmaNmb 2262 1.37 1.29 1.40 111 XMPhish11 2224 1.18 1.27 1.15 112 RELAYCOUNTRY_CN 2213 0.40 1.26 0.08 113 XM_Hitman 2210 0.36 1.26 0.04 114 MAILING_LIST_MULTI 2155 2.28 1.23 2.66 115 SUBJ_DOLLARS 2155 0.56 1.23 0.31 116 TM2_M_VERY_LONG_WORD 2145 1.02 1.22 0.95 117 T_XMHurry_00 2116 0.87 1.20 0.75 118 XM_UB60 2020 0.34 1.15 0.05 119 MIME_HEADER_CTYPE_ONLY 2001 0.40 1.14 0.13 120 RCVD_IN_RP_CERTIFIED 1995 6.25 1.14 8.11 121 HTML_IMAGE_ONLY_04 1962 0.34 1.12 0.06 122 XM_H_PHPOS 1918 1.01 1.09 0.99 123 URI_TRY_3LD 1903 1.45 1.08 1.58 124 URIBL_BLACK 1902 0.33 1.08 0.05 125 SpammyFromTLD_01 1899 0.83 1.08 0.74 126 XMPhish14 1873 0.72 1.07 0.60 127 TR_Caps_n_Bayes_99 1870 0.33 1.06 0.06 128 URIBL_DBL_SPAM 1866 0.31 1.06 0.03 129 SHORTENER_SHORT_IMG 1863 0.28 1.06 0.00 130 RELAYCOUNTRY_FR 1838 0.44 1.05 0.22 131 XMLngstWrd_00 1806 0.63 1.03 0.49 132 XMLngstWrd_01 1781 0.58 1.01 0.42 133 T_MONEY_PERCENT 1768 0.45 1.01 0.25 134 TR_LOTS_OF_MONEY2 1768 0.45 1.01 0.25 135 HTML_TAG_BALANCE_BODY 1746 0.67 0.99 0.56 136 TR_XM_RelayPhish 1708 0.70 0.97 0.60 137 RELAYCOUNTRY_GB 1706 0.95 0.97 0.94 138 XMSexyCombo_04 1698 0.38 0.97 0.16 139 XMHTML_After_End 1693 0.60 0.96 0.47 140 XMLngstWrd_02 1692 0.43 0.96 0.23 141 XMPhish30 1688 0.62 0.96 0.49 142 BAYES_00 1668 13.12 0.95 17.54 143 TR_Symld_Words 1638 1.48 0.93 1.69 144 TVD_SPACE_RATIO_MINFP 1613 0.25 0.92 0.01 145 XMLngstWrd_03 1611 0.34 0.92 0.13 146 XM_ProductURIs 1595 0.93 0.91 0.94 147 RCVD_IN_IADB_LISTED 1563 4.44 0.89 5.73 148 XMBrknScrpt_02 1529 0.68 0.87 0.60 149 MPART_ALT_DIFF_COUNT 1450 0.35 0.83 0.18 150 XMSubMetaSxObfu_03 1444 0.56 0.82 0.46 151 RELAYCOUNTRY_AT 1422 0.43 0.81 0.29 152 LongTLD 1394 0.35 0.79 0.19 153 NO_DNS_FOR_FROM 1371 0.70 0.78 0.68 154 HTML_SHORT_CENTER 1349 0.21 0.77 0.00 155 BAYES_05 1322 1.88 0.75 2.29 156 RCVD_IN_IADB_SPF 1317 3.84 0.75 4.96 157 XM_UB99 1301 0.21 0.74 0.02 158 XM_DK_Undo_01 1273 1.34 0.72 1.57 159 TooManyTo_002 1263 1.50 0.72 1.79 160 RDNS_DYNAMIC 1257 0.53 0.72 0.46 161 XMSubMetaSSx_00 1233 0.35 0.70 0.23 162 RCVD_IN_IADB_SENDERID 1231 3.38 0.70 4.36 163 FILL_THIS_FORM 1228 0.48 0.70 0.39 164 HTML_OFF_PAGE 1228 0.19 0.70 0.00 165 RCVD_IN_IADB_DK 1220 3.30 0.69 4.25 166 LONG_JUNK_URI 1210 0.23 0.69 0.07 167 URI_NOVOWEL 1186 0.58 0.68 0.54 168 FSL_THIS_IS_ADV 1145 0.32 0.65 0.21 169 XM_PDF 1136 3.72 0.65 4.83 170 HTML_FONT_FACE_BAD 1133 0.79 0.65 0.84 171 TR_XM_DK_Bayes 1115 10.73 0.63 14.39 172 TR_Mismatch_TLD_02 1093 0.22 0.62 0.08 173 DIET_1 1087 0.45 0.62 0.39 174 HTML_IMAGE_ONLY_12 1085 0.33 0.62 0.23 175 XMSubMetaSxObfu_04 1054 0.22 0.60 0.08 176 T_TooManySym_02 1053 1.45 0.60 1.75 177 TooManyTo_003 1050 1.04 0.60 1.20 178 XMBody_78 1036 0.53 0.59 0.51 179 XMHTMLBadTable_001 1029 0.64 0.59 0.66 180 RCVD_IN_IADB_VOUCHED 1008 2.93 0.57 3.78 181 FILL_THIS_FORM_LONG 1005 0.39 0.57 0.32 182 XM_UB999 990 0.16 0.56 0.01 183 LONG_HEX_URI 981 0.27 0.56 0.16 184 HTML_IMAGE_ONLY_28 955 0.41 0.54 0.36 185 XMGppyBdWords 953 0.33 0.54 0.26 186 XMSlimDrugH 952 0.39 0.54 0.34 187 HTML_FONT_SIZE_LARGE 951 0.28 0.54 0.19 188 LOW_PRICE 939 0.29 0.53 0.20 189 URIBL_ABUSE_SURBL 927 0.19 0.53 0.07 190 XM_B_COPY_HTML 924 0.51 0.53 0.51 191 XM_H_PHPMailer 923 0.59 0.53 0.62 192 RELAYCOUNTRY_IN 906 0.20 0.52 0.08 193 URIBL_SBL_A 897 0.18 0.51 0.07 194 TooManyTo_004 894 0.78 0.51 0.88 195 NORMAL_HTTP_TO_IP 883 0.17 0.50 0.05 196 DKIM_ADSP_CUSTOM_MED 882 0.86 0.50 0.99 197 XMLongAddy 876 0.16 0.50 0.04 198 TR_XM_DK_Bayes1 869 10.18 0.49 13.70 199 XMClaimOffer 865 0.21 0.49 0.10 200 T_HTML_TAG_BALANCE_CENTER 865 0.18 0.49 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 428826 82.87 67.19 88.55 2 DKIM_SIGNED 363222 69.07 52.71 75.01 3 XM_DK_Pass 355317 67.44 51.07 73.37 4 DKIM_VALID 336241 63.43 46.88 69.44 5 BAYES_50 278977 59.46 64.56 57.61 6 DCC_CHECK_NEGATIVE 270698 51.87 40.75 55.90 7 XMListUnsubscribeExists 249046 50.08 46.37 51.43 8 DKIM_VALID_AU 237785 46.07 37.69 49.10 9 DCC_CHECK 203989 46.34 57.97 42.12 10 XM_H_QuotedFrom 192077 38.03 33.51 39.66 11 T_TM2_M_HEADER_IN_MSG 144159 25.26 12.82 29.77 12 HTML_FONT_LOW_CONTRAST 139495 28.01 25.80 28.81 13 DKIM_VALID_EF 126633 22.69 13.13 26.15 14 LOC_TINY_FONT_1 110936 23.14 23.78 22.91 15 MIME_HTML_ONLY 103714 22.97 27.24 21.42 16 XMSubLong 102927 20.38 17.96 21.25 17 FVGT_m_MULTI_ODD 98604 20.91 22.43 20.36 18 MultiRelay 88758 16.36 10.93 18.33 19 BAYES_00 84925 13.12 0.95 17.54 20 ALL_TRUSTED 81592 14.16 6.73 16.85 21 T_KAM_HTML_FONT_INVALID 79646 17.26 19.51 16.45 22 TR_XM_DK_Bayes 69673 10.73 0.63 14.39 23 TR_XM_DK_Bayes1 66322 10.18 0.49 13.70 24 XM_Body_Dirty_Words 64134 13.69 14.94 13.24 25 XM_Multi_Part_URI 59293 14.24 19.75 12.24 26 XM_DKIMWhitelistDomains 57881 8.77 0.01 11.95 27 LOTS_OF_MONEY 53958 18.56 39.00 11.14 28 TR_XM_DK_Bayes2 53430 8.20 0.40 11.03 29 RCVD_IN_RP_SAFE 45443 7.27 1.42 9.38 30 HTML_IMAGE_RATIO_02 42957 8.80 8.60 8.87 31 XM_Evil_Numbers_Gen 42853 8.69 8.25 8.85 32 LotsOfNums_01 41973 7.45 4.09 8.67 33 RCVD_IN_RP_CERTIFIED 39267 6.25 1.14 8.11 34 T_XMDrugObfuBody_14 38532 7.50 6.25 7.96 35 TooManyTo_001 38169 7.30 5.68 7.88 36 XM_DK_Undo_02 35138 11.74 24.12 7.26 37 FSL_BULK_SIG 33462 8.97 14.66 6.91 38 XM_H_Long_From01 31419 6.31 5.84 6.49 39 XM_SendGrid 29303 4.94 1.89 6.05 40 XM_B_Phish_Phrases 28805 5.76 5.24 5.95 41 RCVD_IN_IADB_LISTED 27760 4.44 0.89 5.73 42 HTML_IMAGE_RATIO_04 27159 5.66 5.81 5.61 43 DKIM_INVALID 26981 5.64 5.83 5.57 44 MIME_QP_LONG_LINE 26973 4.55 1.75 5.57 45 RELAYCOUNTRY_META 25588 7.09 12.08 5.28 46 BAYES_99 25393 8.79 18.57 5.24 47 BAYES_60 24554 5.11 5.20 5.07 48 RCVD_IN_IADB_SPF 24030 3.84 0.75 4.96 49 BOTNET_IPINHOSTNAME 23625 6.61 11.39 4.88 50 XMStrtUSub 23454 4.35 3.00 4.84 51 XM_PDF 23392 3.72 0.65 4.83 52 T_TooManySym_01 22852 4.00 2.03 4.72 53 FROM_EXCESS_BASE64 22767 4.79 5.02 4.70 54 XMSexyCombo_05 22271 5.44 7.76 4.60 55 RCVD_IN_IADB_SENDERID 21094 3.38 0.70 4.36 56 RCVD_IN_MSPIKE_H2 20709 3.63 1.84 4.28 57 RCVD_IN_IADB_DK 20588 3.30 0.69 4.25 58 BAYES_40 20506 3.64 2.01 4.23 59 BAYES_999 20363 7.15 15.27 4.21 60 T_REMOTE_IMAGE 19091 3.80 3.42 3.94 61 XMSubMetaSx_00 18668 4.72 7.11 3.86 62 IN_ZIMBRA_NJ_WHITELIST 18375 2.79 0.02 3.79 63 RCVD_IN_IADB_VOUCHED 18305 2.93 0.57 3.78 64 HTML_IMAGE_RATIO_06 17214 3.53 3.45 3.55 65 MPART_ALT_DIFF 16621 3.75 4.63 3.43 66 BAYES_20 16091 2.82 1.42 3.32 67 XM_UncommonTLD01 15287 4.20 7.08 3.16 68 MIME_HTML_MOSTLY 14191 2.87 2.71 2.93 69 XMNumbers 13486 3.22 4.42 2.78 70 BAYES_80 13098 3.11 4.21 2.70 71 UNPARSEABLE_RELAY 13073 2.35 1.39 2.70 72 TR_DCC_Bayes_99 13017 6.03 15.25 2.69 73 MAILING_LIST_MULTI 12877 2.28 1.23 2.66 74 HTML_IMAGE_RATIO_08 12164 2.63 2.96 2.51 75 RCVD_IN_IADB_OPTIN 11680 1.89 0.45 2.41 76 TO_MALFORMED 11508 1.75 0.03 2.38 77 XMDiploma_00 11169 2.18 1.84 2.31 78 BAYES_05 11067 1.88 0.75 2.29 79 HTML_MIME_NO_HTML_TAG 11023 2.52 3.20 2.28 80 TVD_RCVD_IP 10842 1.68 0.13 2.24 81 ANY_BOUNCE_MESSAGE 10660 9.53 29.74 2.20 82 BOUNCE_MESSAGE 10658 9.53 29.74 2.20 83 XM_DIRTYINTL 10052 2.39 3.26 2.08 84 BOTNET 9987 12.10 39.77 2.06 85 RCVD_IN_MSPIKE_WL 9922 1.58 0.28 2.05 86 SUBJ_ALL_CAPS 9908 2.03 1.97 2.05 87 RCVD_IN_MSPIKE_H3 9890 1.57 0.28 2.04 88 XM_SPF_SoftFail 9699 3.80 8.74 2.00 89 TM2_M_URI_OPT_OUT 9165 2.12 2.74 1.89 90 BAYES_95 8842 1.93 2.22 1.83 91 XM_OfRef6 8708 9.58 31.02 1.80 92 TooManyTo_002 8657 1.50 0.72 1.79 93 XM_CamelCaseFrm001 8522 1.99 2.61 1.76 94 T_TooManySym_02 8491 1.45 0.60 1.75 95 RELAYCOUNTRY_CA 8284 1.91 2.48 1.71 96 TR_Symld_Words 8161 1.48 0.93 1.69 97 IN_HORDE_ADDRESS_BOOK 7957 1.21 0.02 1.64 98 URI_TRY_3LD 7648 1.45 1.08 1.58 99 URI_HEX 7636 2.47 4.92 1.58 100 XM_DK_Undo_01 7592 1.34 0.72 1.57 101 T_XMDrugObfuBody_08 7397 1.65 1.97 1.53 102 INVALID_MSGID 7265 1.12 0.08 1.50 103 MIME_HTML_ONLY_MULTI 7219 1.81 2.69 1.49 104 HELO_NODOT 7103 1.15 0.29 1.47 105 XMGenDplmaNmb 6782 1.37 1.29 1.40 106 TR_MetaPhish_Combo_01 6638 1.13 0.45 1.37 107 T_XMDrugObfuBody_00 6377 1.35 1.46 1.32 108 UNTRUSTED_Relay 6235 2.88 7.26 1.29 109 XMStockSpam_06 6207 1.34 1.49 1.28 110 TooManyTo_003 5825 1.04 0.60 1.20 111 XMSubMetaI_00 5573 1.21 1.36 1.15 112 XMPhish11 5570 1.18 1.27 1.15 113 XMCapTrack 5479 0.89 0.22 1.13 114 USER_IN_DEF_DKIM_WL 5242 0.80 0.01 1.08 115 T_FILL_THIS_FORM_SHORT 4993 8.79 30.19 1.03 116 XM_GoogleGroups 4980 0.84 0.33 1.03 117 DKIM_ADSP_CUSTOM_MED 4787 0.86 0.50 0.99 118 XM_H_PHPOS 4770 1.01 1.09 0.99 119 XM_H_Long_From02 4725 1.15 1.62 0.98 120 XMBody_17 4648 1.15 1.67 0.96 121 TM2_M_VERY_LONG_WORD 4612 1.02 1.22 0.95 122 RELAYCOUNTRY_GB 4549 0.95 0.97 0.94 123 XM_ProductURIs 4544 0.93 0.91 0.94 124 TooManyTo_004 4269 0.78 0.51 0.88 125 TM2_M_A_HREF_HREF 4114 0.71 0.34 0.85 126 XM_salutation2 4087 1.09 1.78 0.84 127 HTML_FONT_FACE_BAD 4052 0.79 0.65 0.84 128 XMBdyGiftCard01 3810 1.02 1.68 0.79 129 TR_LOTS_OF_MONEY3 3798 1.01 1.61 0.78 130 T_XMHurry_00 3654 0.87 1.20 0.75 131 XM_UB50 3633 1.61 3.99 0.75 132 TooManyTo_005 3568 0.66 0.46 0.74 133 SpammyFromTLD_01 3565 0.83 1.08 0.74 134 NML_ADSP_CUSTOM_MED 3311 0.63 0.48 0.68 135 NO_DNS_FOR_FROM 3279 0.70 0.78 0.68 136 XMHTMLBadTable_001 3215 0.64 0.59 0.66 137 FROM_GOV_SPOOF 3089 0.53 0.24 0.64 138 T_Symld_Words_02 3079 0.86 1.49 0.64 139 XMNoVowels 3056 0.55 0.34 0.63 140 T_OBFU_PDF_ATTACH 3002 0.50 0.17 0.62 141 XM_H_PHPMailer 2986 0.59 0.53 0.62 142 XMBrknScrpt_02 2926 0.68 0.87 0.60 143 TR_XM_RelayPhish 2922 0.70 0.97 0.60 144 REMOVE_BEFORE_LINK 2910 0.52 0.28 0.60 145 XMPhish14 2886 0.72 1.07 0.60 146 USER_IN_WHITELIST 2723 0.41 0.00 0.56 147 HTML_TAG_BALANCE_BODY 2708 0.67 0.99 0.56 148 XM_OfRef7 2692 8.28 29.59 0.56 149 XMGappySubj_01 2678 0.49 0.31 0.55 150 XM_URI_RBL 2668 1.34 3.53 0.55 151 URI_NOVOWEL 2629 0.58 0.68 0.54 152 XMBody_95 2582 0.41 0.08 0.53 153 T_TooManySym_03 2503 0.40 0.09 0.52 154 XMBody_78 2492 0.53 0.59 0.51 155 XM_B_COPY_HTML 2470 0.51 0.53 0.51 156 HTTPS_HTTP_MISMATCH 2436 0.48 0.41 0.50 157 XMSexyCombo_01 2433 0.99 2.35 0.50 158 XMMoneyMeta_00 2427 0.47 0.39 0.50 159 XM_B_REG_HTML 2403 0.46 0.38 0.50 160 XMPhish30 2394 0.62 0.96 0.49 161 XMLngstWrd_00 2364 0.63 1.03 0.49 162 XMHTML_After_End 2277 0.60 0.96 0.47 163 FORGED_GMAIL_RCVD 2263 0.46 0.42 0.47 164 XMSubMetaSxObfu_03 2242 0.56 0.82 0.46 165 RDNS_DYNAMIC 2224 0.53 0.72 0.46 166 T_MANY_PILL_PRICE 2217 0.34 0.00 0.46 167 DKIM_ADSP_NXDOMAIN 2131 0.45 0.49 0.44 168 RELAYCOUNTRY_AU 2104 0.44 0.45 0.43 169 SpammyFromTLD_02 2090 0.79 1.76 0.43 170 MISSING_HEADERS 2065 0.38 0.27 0.43 171 XMLngstWrd_01 2052 0.58 1.01 0.42 172 RCVD_IN_BL_SPAMCOP_NET 1975 0.87 2.13 0.41 173 HTML_IMAGE_ONLY_32 1960 0.36 0.24 0.40 174 XM_S_JOY_D 1952 0.39 0.37 0.40 175 TM2_M_BODY_EMPTY 1935 0.32 0.10 0.40 176 XM_ShortIntro_01 1914 0.35 0.21 0.40 177 FILL_THIS_FORM 1909 0.48 0.70 0.39 178 DIET_1 1902 0.45 0.62 0.39 179 SHORT_HELO_AND_INLINE_IMAGE 1820 0.28 0.03 0.38 180 XM_D_tchamptons_WL 1783 0.27 0.00 0.37 181 XMSolicitRefs_0 1777 0.31 0.16 0.37 182 HTML_IMAGE_ONLY_28 1748 0.41 0.54 0.36 183 XM_Body_Obfu01 1728 0.31 0.17 0.36 184 AC_DIV_BONANZA 1722 0.28 0.08 0.36 185 XMDateMe_00 1720 0.33 0.26 0.36 186 XMSubMetaSxObfu_02 1720 0.34 0.31 0.36 187 XMSubNoVowel 1709 0.32 0.22 0.35 188 UPPERCASE_50_75 1694 0.30 0.16 0.35 189 PLING_QUERY 1688 0.34 0.33 0.35 190 RELAYCOUNTRY_DE 1646 0.37 0.44 0.34 191 RCVD_IN_SORBS_DUL 1632 0.30 0.21 0.34 192 XMSlimDrugH 1632 0.39 0.54 0.34 193 FROM_GOV_DKIM_AU 1562 0.27 0.13 0.32 194 TVD_SPACE_RATIO 1560 0.29 0.20 0.32 195 FILL_THIS_FORM_LONG 1545 0.39 0.57 0.32 196 XM_H_PHPOS_M 1527 0.31 0.31 0.32 197 SUBJ_DOLLARS 1524 0.56 1.23 0.31 198 FILL_THIS_FORM_LOAN 1493 0.35 0.45 0.31 199 HTML_IMAGE_ONLY_24 1480 0.30 0.28 0.31 200 RELAYCOUNTRY_AT 1426 0.43 0.81 0.29 ----------------------------------------------------------------------