Email: 643123 Autolearn: 0 AvgScore: 1.73 AvgScanTime: 1.91 sec Spam: 136691 Autolearn: 0 AvgScore: 12.81 AvgScanTime: 2.24 sec Ham: 506432 Autolearn: 0 AvgScore: -1.26 AvgScanTime: 1.82 sec Time Spent Running SA: 340.93 hours Time Spent Processing Spam: 85.24 hours Time Spent Processing Ham: 255.70 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126505 89.58 92.55 88.77 2 DCC_CHECK 102924 48.21 75.30 40.89 3 DKIM_SIGNED 99400 74.28 72.72 74.71 4 XM_DK_Pass 96566 72.76 70.65 73.33 5 DKIM_VALID 91805 69.29 67.16 69.87 6 XMListUnsubscribeExists 88057 54.16 64.42 51.39 7 DKIM_VALID_AU 75405 51.46 55.16 50.45 8 XM_H_QuotedFrom 64905 41.43 47.48 39.79 9 BAYES_50 63270 55.15 46.29 57.54 10 MIME_HTML_ONLY 49866 23.25 36.48 19.67 11 HTML_FONT_LOW_CONTRAST 45217 28.52 33.08 27.29 12 XM_DK_Undo_02 43733 12.20 31.99 6.85 13 XMSubLong 41232 23.15 30.16 21.26 14 BAYES_99 40341 10.26 29.51 5.06 15 LOC_TINY_FONT_1 39711 23.82 29.05 22.41 16 RELAYCOUNTRY_META 36562 10.02 26.75 5.50 17 BAYES_999 32791 8.47 23.99 4.29 18 DKIM_VALID_EF 32730 26.32 23.94 26.96 19 DCC_CHECK_NEGATIVE 30916 49.63 22.62 56.93 20 FVGT_m_MULTI_ODD 30671 21.20 22.44 20.86 21 TR_DCC_Bayes_99 27790 6.30 20.33 2.52 22 XM_Body_Dirty_Words 25249 13.64 18.47 12.34 23 T_TM2_M_HEADER_IN_MSG 24446 28.53 17.88 31.40 24 MultiRelay 23636 17.79 17.29 17.92 25 HTML_IMAGE_RATIO_02 23185 10.53 16.96 8.80 26 UNTRUSTED_Relay 23175 4.87 16.95 1.60 27 T_KAM_HTML_FONT_INVALID 22616 16.93 16.55 17.04 28 BOTNET 21530 4.81 15.75 1.86 29 XM_Multi_Part_URI 20381 12.80 14.91 12.23 30 FSL_BULK_SIG 20273 7.98 14.83 6.13 31 BOTNET_IPINHOSTNAME 18990 6.63 13.89 4.67 32 FROM_EXCESS_BASE64 18740 6.22 13.71 4.20 33 XM_Evil_Numbers_Gen 16488 9.25 12.06 8.49 34 T_REMOTE_IMAGE 16188 5.76 11.84 4.11 35 LOTS_OF_MONEY 16134 9.35 11.80 8.69 36 HTML_MIME_NO_HTML_TAG 15232 4.16 11.14 2.27 37 XM_UncommonTLD01 15161 4.74 11.09 3.03 38 TooManyTo_001 14783 8.78 10.81 8.23 39 XMSexyCombo_05 14416 5.21 10.55 3.76 40 T_XMDrugObfuBody_14 12519 8.46 9.16 8.27 41 MISSING_HEADERS 12167 2.25 8.90 0.46 42 BODY_URI_ONLY 11679 1.88 8.54 0.08 43 HTML_SHORT_LINK_IMG_1 11640 1.83 8.52 0.02 44 MIME_HEADER_CTYPE_ONLY 11552 1.89 8.45 0.11 45 XMSubMetaSx_00 10998 4.82 8.05 3.95 46 HTML_IMAGE_ONLY_04 10766 1.71 7.88 0.05 47 HTML_SHORT_CENTER 10705 1.67 7.83 0.00 48 RELAYCOUNTRY_FR 10675 1.84 7.81 0.23 49 HTML_IMAGE_RATIO_04 10294 5.60 7.53 5.08 50 XM_H_Long_From01 9908 6.53 7.25 6.33 51 XMNumbers 9749 3.39 7.13 2.38 52 SpammyFromTLD_02 9644 1.81 7.06 0.39 53 BAYES_80 9013 3.53 6.59 2.71 54 MPART_ALT_DIFF 8743 4.04 6.40 3.41 55 BAYES_60 8438 5.10 6.17 4.81 56 XM_JunkDunk 8264 1.28 6.05 0.00 57 XM_B_Phish_Phrases 8017 5.54 5.87 5.45 58 RCVD_IN_RP_RNBL 7966 1.29 5.83 0.07 59 XM_UB99 7924 1.27 5.80 0.05 60 XM_UB50 7728 1.89 5.65 0.88 61 DKIM_INVALID 7595 4.99 5.56 4.84 62 LotsOfNums_01 7100 7.91 5.19 8.64 63 XM_URI_RBL 6738 1.42 4.93 0.48 64 XM_DIRTYINTL 6720 2.55 4.92 1.91 65 BAYES_95 6683 2.33 4.89 1.63 66 XM_UB999 6655 1.05 4.87 0.02 67 HTML_IMAGE_RATIO_06 6493 4.07 4.75 3.89 68 SUBJ_ALL_CAPS 5818 2.33 4.26 1.81 69 XM_SPF_SoftFail 5793 2.82 4.24 2.43 70 XM_OfRef6 5242 1.94 3.83 1.43 71 TM2_M_URI_OPT_OUT 5204 2.52 3.81 2.17 72 MIME_HTML_MOSTLY 5201 3.12 3.80 2.93 73 HTML_IMAGE_ONLY_16 5191 1.04 3.80 0.30 74 XMPhish11 5182 1.75 3.79 1.19 75 RELAYCOUNTRY_CA 4883 2.11 3.57 1.72 76 MIME_HTML_ONLY_MULTI 4824 1.98 3.53 1.56 77 MultiRelay_CC 4813 0.88 3.52 0.17 78 MultiRelay_Combo 4813 0.88 3.52 0.17 79 FROM_SUSPICIOUS_NTLD 4663 0.76 3.41 0.05 80 T_TooManySym_01 4556 4.54 3.33 4.87 81 RCVD_IN_MSPIKE_H2 4528 4.09 3.31 4.29 82 MPART_ALT_DIFF_COUNT 4357 0.87 3.19 0.25 83 BOTNET_NORDNS 4178 0.67 3.06 0.02 84 XMStrtUSub 4019 4.50 2.94 4.92 85 URI_HEX 3995 1.98 2.92 1.72 86 RCVD_IN_PSBL 3991 0.62 2.92 0.00 87 HTML_IMAGE_RATIO_08 3932 2.41 2.88 2.28 88 MIME_QP_LONG_LINE 3859 5.37 2.82 6.05 89 DATE_IN_PAST_06_12 3771 0.62 2.76 0.05 90 XM_CamelCaseFrm001 3741 2.18 2.74 2.03 91 RELAYCOUNTRY_GB 3713 1.45 2.72 1.10 92 RCVD_IN_BL_SPAMCOP_NET 3697 0.93 2.70 0.45 93 XM_H_TOP 3621 0.57 2.65 0.00 94 HTML_SHORT_LINK_IMG_2 3469 0.59 2.54 0.06 95 XMBrknScrpt_02 3426 0.97 2.51 0.55 96 XM_SendGrid 3336 5.05 2.44 5.76 97 XMSubMetaI_00 3174 1.15 2.32 0.83 98 XMSexyCombo_01 3148 0.91 2.30 0.54 99 TR_Symld_Words 3100 1.70 2.27 1.55 100 BAYES_40 3095 4.27 2.26 4.81 101 RELAYCOUNTRY_HK 3081 0.49 2.25 0.02 102 RCVD_IN_RP_SAFE 2968 8.32 2.17 9.97 103 NO_DNS_FOR_FROM 2958 1.33 2.16 1.10 104 XMBdyGiftCard01 2849 1.28 2.08 1.06 105 TR_Mismatch_TLD_02 2780 0.49 2.03 0.07 106 T_XMDrugObfuBody_08 2733 1.70 2.00 1.62 107 SpammyFromTLD_01 2603 0.96 1.90 0.70 108 DIET_1 2598 0.68 1.90 0.35 109 XM_H_Long_From02 2463 1.27 1.80 1.12 110 BAYES_20 2411 3.42 1.76 3.87 111 RCVD_IN_RP_CERTIFIED 2401 7.30 1.76 8.80 112 XMSubMetaSxObfu_03 2339 0.67 1.71 0.39 113 XMDiploma_00 2299 2.08 1.68 2.19 114 RELAYCOUNTRY_CN 2295 0.39 1.68 0.05 115 XM_UB60 2246 0.42 1.64 0.09 116 T_FILL_THIS_FORM_SHORT 2244 1.10 1.64 0.95 117 XM_UB95 2219 0.36 1.62 0.02 118 DEAR_BENEFICIARY 2200 0.34 1.61 0.00 119 FILL_THIS_FORM 2186 0.63 1.60 0.37 120 MAILING_LIST_MULTI 2165 2.02 1.58 2.14 121 RELAYCOUNTRY_IN 2104 0.41 1.54 0.10 122 DATE_IN_PAST_03_06 2073 0.39 1.52 0.09 123 FILL_THIS_FORM_LONG 2059 0.54 1.51 0.29 124 TR_XM_RelayPhish 2026 0.73 1.48 0.52 125 XMPhish30 2004 0.65 1.47 0.43 126 BODY_ENHANCEMENT 2002 0.34 1.46 0.04 127 UNPARSEABLE_RELAY 1970 2.31 1.44 2.54 128 TM2_M_VERY_LONG_WORD 1942 1.01 1.42 0.90 129 T_XMDrugObfuBody_00 1879 1.00 1.37 0.90 130 XM_salutation2 1857 0.87 1.36 0.73 131 URIBL_BLACK 1829 0.32 1.34 0.05 132 XMGenDplmaNmb 1815 1.21 1.33 1.18 133 XM_ShortIntro_01 1805 0.73 1.32 0.58 134 XM_H_Undi_Recip 1785 0.46 1.31 0.23 135 XMSlimDrugH 1763 0.63 1.29 0.45 136 RCVD_IN_IADB_LISTED 1759 4.80 1.29 5.74 137 XM_UB80 1742 0.30 1.27 0.04 138 XMSexyCombo_04 1708 0.35 1.25 0.11 139 HTML_IMAGE_ONLY_28 1703 0.60 1.25 0.42 140 XMSubject_48 1681 0.28 1.23 0.03 141 BAYES_00 1681 13.56 1.23 16.89 142 XM_HighProb1 1645 0.26 1.20 0.01 143 XMHTML_After_End 1642 0.61 1.20 0.45 144 XMBody_78 1630 0.63 1.19 0.48 145 XMBody_17 1592 0.83 1.16 0.74 146 AMAZON_IMG_NOT_RCVD_AMZN 1589 0.28 1.16 0.04 147 XMStockSpam_06 1567 0.92 1.15 0.86 148 XMMoneyMeta_00 1544 0.80 1.13 0.72 149 TR_Sbj_FN_Bdy 1541 0.37 1.13 0.17 150 XM_H_PHPOS 1532 1.53 1.12 1.64 151 XM_ProductURIs 1512 0.97 1.11 0.94 152 ALL_TRUSTED 1510 13.37 1.10 16.68 153 XMFrmHeader_21 1505 0.24 1.10 0.00 154 RCVD_IN_IADB_SPF 1496 4.23 1.09 5.07 155 RELAYCOUNTRY_AT 1489 0.41 1.09 0.23 156 MONEY_FORM 1474 0.23 1.08 0.01 157 TR_XM_Undi_Recip5 1468 0.24 1.07 0.01 158 T_Symld_Words_02 1461 0.78 1.07 0.70 159 TR_XM_Undi_Recip2 1416 0.24 1.04 0.02 160 FSL_THIS_IS_ADV 1413 0.38 1.03 0.20 161 BAYES_05 1408 2.06 1.03 2.34 162 DKIM_ADSP_CUSTOM_MED 1407 0.99 1.03 0.97 163 RCVD_IN_IADB_DK 1395 3.70 1.02 4.43 164 RCVD_IN_IADB_SENDERID 1392 3.75 1.02 4.48 165 MONEY_FRAUD_8 1338 0.21 0.98 0.00 166 MONEY_ATM_CARD 1337 0.21 0.98 0.00 167 LONG_JUNK_URI 1326 0.26 0.97 0.07 168 HK_RANDOM_FROM 1324 0.34 0.97 0.17 169 T_XMHurry_00 1321 0.72 0.97 0.66 170 ADVANCE_FEE_5_NEW_FRM_MNY 1292 0.20 0.95 0.00 171 TooManyTo_002 1282 1.85 0.94 2.09 172 TR_LOTS_OF_MONEY2 1277 0.49 0.93 0.37 173 T_MONEY_PERCENT 1277 0.49 0.93 0.37 174 TVD_SPACE_RATIO_MINFP 1269 0.20 0.93 0.01 175 RDNS_DYNAMIC 1268 0.56 0.93 0.46 176 HOSTED_IMG_DIRECT_MX 1261 0.20 0.92 0.00 177 T_TooManySym_02 1257 1.37 0.92 1.49 178 RELAYCOUNTRY_NL 1257 0.35 0.92 0.20 179 NML_ADSP_CUSTOM_MED 1249 0.72 0.91 0.67 180 DKIM_ADSP_NXDOMAIN 1246 0.53 0.91 0.42 181 URG_BIZ 1245 0.25 0.91 0.08 182 HTML_IMAGE_ONLY_24 1242 0.46 0.91 0.34 183 T_FILL_THIS_FORM_FRAUD_PHISH 1238 0.25 0.91 0.07 184 FORGED_GMAIL_RCVD 1230 0.58 0.90 0.50 185 TR_XM_DK_Bayes 1211 10.73 0.89 13.39 186 UPPERCASE_75_100 1209 0.22 0.88 0.04 187 XMPhish14 1200 0.43 0.88 0.31 188 HTML_FONT_FACE_BAD 1198 0.56 0.88 0.47 189 TR_XM_Undi_Recip4 1178 0.18 0.86 0.00 190 TR_XM_Undi_RecipCombo2 1175 0.18 0.86 0.00 191 MSGID_FROM_MTA_HEADER 1169 0.35 0.86 0.21 192 RELAYCOUNTRY_DE 1166 0.51 0.85 0.42 193 XM_PDF 1147 3.77 0.84 4.56 194 XMHTMLBadTable_001 1140 0.59 0.83 0.52 195 URI_TRY_3LD 1137 1.09 0.83 1.16 196 XM_Body_Obfu01 1133 0.46 0.83 0.36 197 XMWghtMeta_00 1128 0.20 0.83 0.03 198 XM_DK_Undo_01 1118 1.56 0.82 1.75 199 TR_XM_DK_Bayes1 1067 10.23 0.78 12.78 200 TooManyTo_003 1067 1.25 0.78 1.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 449577 89.58 92.55 88.77 2 DKIM_SIGNED 378333 74.28 72.72 74.71 3 XM_DK_Pass 371383 72.76 70.65 73.33 4 DKIM_VALID 353832 69.29 67.16 69.87 5 BAYES_50 291417 55.15 46.29 57.54 6 DCC_CHECK_NEGATIVE 288289 49.63 22.62 56.93 7 XMListUnsubscribeExists 260242 54.16 64.42 51.39 8 DKIM_VALID_AU 255520 51.46 55.16 50.45 9 DCC_CHECK 207102 48.21 75.30 40.89 10 XM_H_QuotedFrom 201529 41.43 47.48 39.79 11 T_TM2_M_HEADER_IN_MSG 159042 28.53 17.88 31.40 12 HTML_FONT_LOW_CONTRAST 138199 28.52 33.08 27.29 13 DKIM_VALID_EF 136555 26.32 23.94 26.96 14 LOC_TINY_FONT_1 113481 23.82 29.05 22.41 15 XMSubLong 107673 23.15 30.16 21.26 16 FVGT_m_MULTI_ODD 105641 21.20 22.44 20.86 17 MIME_HTML_ONLY 99637 23.25 36.48 19.67 18 MultiRelay 90747 17.79 17.29 17.92 19 T_KAM_HTML_FONT_INVALID 86277 16.93 16.55 17.04 20 BAYES_00 85524 13.56 1.23 16.89 21 ALL_TRUSTED 84472 13.37 1.10 16.68 22 TR_XM_DK_Bayes 67810 10.73 0.89 13.39 23 TR_XM_DK_Bayes1 64745 10.23 0.78 12.78 24 XM_Body_Dirty_Words 62480 13.64 18.47 12.34 25 XM_Multi_Part_URI 61922 12.80 14.91 12.23 26 XM_DKIMWhitelistDomains 55806 8.68 0.01 11.02 27 TR_XM_DK_Bayes2 53148 8.42 0.74 10.49 28 RCVD_IN_RP_SAFE 50512 8.32 2.17 9.97 29 RCVD_IN_RP_CERTIFIED 44571 7.30 1.76 8.80 30 HTML_IMAGE_RATIO_02 44557 10.53 16.96 8.80 31 LOTS_OF_MONEY 44014 9.35 11.80 8.69 32 LotsOfNums_01 43778 7.91 5.19 8.64 33 XM_Evil_Numbers_Gen 42992 9.25 12.06 8.49 34 T_XMDrugObfuBody_14 41893 8.46 9.16 8.27 35 TooManyTo_001 41683 8.78 10.81 8.23 36 XM_DK_Undo_02 34699 12.20 31.99 6.85 37 XM_H_Long_From01 32063 6.53 7.25 6.33 38 FSL_BULK_SIG 31046 7.98 14.83 6.13 39 MIME_QP_LONG_LINE 30656 5.37 2.82 6.05 40 XM_SendGrid 29153 5.05 2.44 5.76 41 RCVD_IN_IADB_LISTED 29081 4.80 1.29 5.74 42 RELAYCOUNTRY_META 27853 10.02 26.75 5.50 43 XM_B_Phish_Phrases 27613 5.54 5.87 5.45 44 HTML_IMAGE_RATIO_04 25732 5.60 7.53 5.08 45 RCVD_IN_IADB_SPF 25700 4.23 1.09 5.07 46 BAYES_99 25641 10.26 29.51 5.06 47 XMStrtUSub 24910 4.50 2.94 4.92 48 T_TooManySym_01 24639 4.54 3.33 4.87 49 DKIM_INVALID 24501 4.99 5.56 4.84 50 BAYES_40 24382 4.27 2.26 4.81 51 BAYES_60 24340 5.10 6.17 4.81 52 BOTNET_IPINHOSTNAME 23634 6.63 13.89 4.67 53 XM_PDF 23071 3.77 0.84 4.56 54 RCVD_IN_IADB_SENDERID 22712 3.75 1.02 4.48 55 RCVD_IN_IADB_DK 22432 3.70 1.02 4.43 56 RCVD_IN_MSPIKE_H2 21751 4.09 3.31 4.29 57 BAYES_999 21710 8.47 23.99 4.29 58 FROM_EXCESS_BASE64 21253 6.22 13.71 4.20 59 T_REMOTE_IMAGE 20828 5.76 11.84 4.11 60 XMSubMetaSx_00 19994 4.82 8.05 3.95 61 HTML_IMAGE_RATIO_06 19708 4.07 4.75 3.89 62 BAYES_20 19596 3.42 1.76 3.87 63 IN_ZIMBRA_NJ_WHITELIST 19530 3.04 0.02 3.86 64 XMSexyCombo_05 19059 5.21 10.55 3.76 65 RCVD_IN_IADB_VOUCHED 18679 3.07 0.77 3.69 66 MPART_ALT_DIFF 17266 4.04 6.40 3.41 67 XM_UncommonTLD01 15345 4.74 11.09 3.03 68 MIME_HTML_MOSTLY 14852 3.12 3.80 2.93 69 BAYES_80 13704 3.53 6.59 2.71 70 TVD_RCVD_IP 12909 2.07 0.27 2.55 71 UNPARSEABLE_RELAY 12880 2.31 1.44 2.54 72 TR_DCC_Bayes_99 12740 6.30 20.33 2.52 73 XM_SPF_SoftFail 12311 2.82 4.24 2.43 74 XMNumbers 12048 3.39 7.13 2.38 75 TO_MALFORMED 12017 1.88 0.07 2.37 76 BAYES_05 11853 2.06 1.03 2.34 77 HTML_IMAGE_RATIO_08 11561 2.41 2.88 2.28 78 HTML_MIME_NO_HTML_TAG 11506 4.16 11.14 2.27 79 RCVD_IN_IADB_OPTIN 11268 1.87 0.54 2.22 80 XMDiploma_00 11093 2.08 1.68 2.19 81 TM2_M_URI_OPT_OUT 10979 2.52 3.81 2.17 82 MAILING_LIST_MULTI 10822 2.02 1.58 2.14 83 TooManyTo_002 10584 1.85 0.94 2.09 84 XM_CamelCaseFrm001 10279 2.18 2.74 2.03 85 XM_DIRTYINTL 9684 2.55 4.92 1.91 86 BOTNET 9433 4.81 15.75 1.86 87 RCVD_IN_MSPIKE_WL 9216 1.51 0.38 1.82 88 RCVD_IN_MSPIKE_H3 9215 1.51 0.38 1.82 89 SUBJ_ALL_CAPS 9145 2.33 4.26 1.81 90 ANY_BOUNCE_MESSAGE 9045 1.49 0.39 1.79 91 BOUNCE_MESSAGE 9041 1.49 0.39 1.79 92 XM_DK_Undo_01 8884 1.56 0.82 1.75 93 HELO_NODOT 8822 1.52 0.71 1.74 94 URI_HEX 8731 1.98 2.92 1.72 95 RELAYCOUNTRY_CA 8709 2.11 3.57 1.72 96 XM_H_PHPOS 8328 1.53 1.12 1.64 97 BAYES_95 8270 2.33 4.89 1.63 98 TR_MetaPhish_Combo_01 8256 1.44 0.73 1.63 99 T_XMDrugObfuBody_08 8198 1.70 2.00 1.62 100 UNTRUSTED_Relay 8128 4.87 16.95 1.60 101 IN_HORDE_ADDRESS_BOOK 8007 1.25 0.03 1.58 102 MIME_HTML_ONLY_MULTI 7918 1.98 3.53 1.56 103 TR_Symld_Words 7829 1.70 2.27 1.55 104 XMCapTrack 7586 1.23 0.22 1.50 105 T_TooManySym_02 7534 1.37 0.92 1.49 106 XM_OfRef6 7248 1.94 3.83 1.43 107 INVALID_MSGID 7220 1.16 0.19 1.43 108 TooManyTo_003 6972 1.25 0.78 1.38 109 XMPhish11 6051 1.75 3.79 1.19 110 XMGenDplmaNmb 5977 1.21 1.33 1.18 111 URI_TRY_3LD 5876 1.09 0.83 1.16 112 XM_H_Long_From02 5684 1.27 1.80 1.12 113 RELAYCOUNTRY_GB 5593 1.45 2.72 1.10 114 NO_DNS_FOR_FROM 5582 1.33 2.16 1.10 115 XM_GoogleGroups 5559 0.96 0.46 1.10 116 XMBdyGiftCard01 5368 1.28 2.08 1.06 117 TooManyTo_004 5145 0.95 0.68 1.02 118 DKIM_ADSP_CUSTOM_MED 4933 0.99 1.03 0.97 119 USER_IN_DEF_DKIM_WL 4820 0.75 0.00 0.95 120 T_FILL_THIS_FORM_SHORT 4808 1.10 1.64 0.95 121 XM_ProductURIs 4744 0.97 1.11 0.94 122 T_XMDrugObfuBody_00 4579 1.00 1.37 0.90 123 TM2_M_VERY_LONG_WORD 4560 1.01 1.42 0.90 124 XM_UB50 4441 1.89 5.65 0.88 125 XMStockSpam_06 4358 0.92 1.15 0.86 126 TooManyTo_005 4279 0.79 0.61 0.84 127 XMSubMetaI_00 4219 1.15 2.32 0.83 128 XMBody_17 3733 0.83 1.16 0.74 129 XM_salutation2 3715 0.87 1.36 0.73 130 XMMoneyMeta_00 3625 0.80 1.13 0.72 131 T_Symld_Words_02 3555 0.78 1.07 0.70 132 SpammyFromTLD_01 3553 0.96 1.90 0.70 133 TO_NO_BRKTS_HTML_ONLY 3410 0.56 0.16 0.67 134 NML_ADSP_CUSTOM_MED 3391 0.72 0.91 0.67 135 T_XMHurry_00 3339 0.72 0.97 0.66 136 XM_H_PHPMailer 3241 0.63 0.62 0.64 137 XMBody_95 3125 0.50 0.08 0.62 138 T_OBFU_PDF_ATTACH 3089 0.53 0.26 0.61 139 XM_B_REG_HTML 3011 0.58 0.52 0.59 140 TM2_M_A_HREF_HREF 3010 0.60 0.61 0.59 141 XM_ShortIntro_01 2912 0.73 1.32 0.58 142 XMLngstWrd_00 2881 0.50 0.25 0.57 143 URI_NOVOWEL 2821 0.57 0.64 0.56 144 XMBrknScrpt_02 2803 0.97 2.51 0.55 145 HTML_TAG_BALANCE_BODY 2796 0.54 0.50 0.55 146 HTTPS_HTTP_MISMATCH 2790 0.60 0.76 0.55 147 XMSexyCombo_01 2725 0.91 2.30 0.54 148 XMLngstWrd_01 2680 0.47 0.24 0.53 149 TR_XM_RelayPhish 2648 0.73 1.48 0.52 150 XMHTMLBadTable_001 2641 0.59 0.83 0.52 151 XM_B_COPY_HTML 2555 0.50 0.50 0.50 152 USER_IN_WHITELIST 2538 0.39 0.00 0.50 153 FORGED_GMAIL_RCVD 2527 0.58 0.90 0.50 154 XMDateMe_00 2484 0.49 0.51 0.49 155 REMOVE_BEFORE_LINK 2484 0.47 0.40 0.49 156 PLING_QUERY 2458 0.52 0.65 0.49 157 T_TooManySym_03 2437 0.43 0.23 0.48 158 XMBody_78 2429 0.63 1.19 0.48 159 FROM_GOV_SPOOF 2428 0.42 0.20 0.48 160 XM_URI_RBL 2420 1.42 4.93 0.48 161 HTML_FONT_FACE_BAD 2402 0.56 0.88 0.47 162 SHORT_HELO_AND_INLINE_IMAGE 2364 0.38 0.05 0.47 163 RELAYCOUNTRY_AU 2351 0.48 0.53 0.46 164 MISSING_HEADERS 2334 2.25 8.90 0.46 165 RDNS_DYNAMIC 2325 0.56 0.93 0.46 166 XM_shorewaves_Whitelist 2293 0.36 0.00 0.45 167 XMSlimDrugH 2283 0.63 1.29 0.45 168 XMHTML_After_End 2281 0.61 1.20 0.45 169 RCVD_IN_BL_SPAMCOP_NET 2275 0.93 2.70 0.45 170 HTML_IMAGE_ONLY_32 2214 0.40 0.27 0.44 171 XMNoVowels 2195 0.43 0.41 0.43 172 XMPhish30 2184 0.65 1.47 0.43 173 XM_USANA_RCVD 2144 0.33 0.00 0.42 174 HTML_IMAGE_ONLY_28 2143 0.60 1.25 0.42 175 DKIM_ADSP_NXDOMAIN 2131 0.53 0.91 0.42 176 RELAYCOUNTRY_DE 2108 0.51 0.85 0.42 177 XMGappySubj_01 2099 0.39 0.30 0.41 178 SUBJ_DOLLARS 2097 0.49 0.77 0.41 179 SpammyFromTLD_02 1999 1.81 7.06 0.39 180 XMSubMetaSxObfu_03 1993 0.67 1.71 0.39 181 XMSubMetaSxObfu_02 1926 0.35 0.23 0.38 182 RCVD_IN_SORBS_DUL 1918 0.36 0.28 0.38 183 TM2_M_BODY_EMPTY 1891 0.33 0.15 0.37 184 TR_LOTS_OF_MONEY2 1882 0.49 0.93 0.37 185 T_MONEY_PERCENT 1882 0.49 0.93 0.37 186 FILL_THIS_FORM 1869 0.63 1.60 0.37 187 THIS_AD 1857 0.40 0.53 0.37 188 XM_Body_Obfu01 1824 0.46 0.83 0.36 189 TVD_SPACE_RATIO 1821 0.36 0.36 0.36 190 DIET_1 1790 0.68 1.90 0.35 191 AC_DIV_BONANZA 1741 0.29 0.10 0.34 192 FROM_GOV_DKIM_AU 1739 0.30 0.13 0.34 193 XMSolicitRefs_0 1725 0.35 0.38 0.34 194 HTML_IMAGE_ONLY_24 1719 0.46 0.91 0.34 195 XM_H_PHPOS_M 1717 0.34 0.35 0.34 196 XMSubNoVowel 1668 0.40 0.65 0.33 197 XMPhish14 1562 0.43 0.88 0.31 198 BASE64_LENGTH_79_INF 1550 0.25 0.06 0.31 199 XM_Combo_Sbj 1520 0.34 0.47 0.30 200 HTML_IMAGE_ONLY_16 1494 1.04 3.80 0.30 ----------------------------------------------------------------------