Email: 624835 Autolearn: 0 AvgScore: 1.95 AvgScanTime: 1.98 sec Spam: 129106 Autolearn: 0 AvgScore: 12.86 AvgScanTime: 2.42 sec Ham: 495729 Autolearn: 0 AvgScore: -0.89 AvgScanTime: 1.86 sec Time Spent Running SA: 342.89 hours Time Spent Processing Spam: 86.79 hours Time Spent Processing Ham: 256.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 122344 90.62 94.76 89.54 2 DCC_CHECK 99097 48.92 76.76 41.67 3 DKIM_SIGNED 95290 75.65 73.81 76.13 4 XM_DK_Pass 92831 74.12 71.90 74.70 5 DKIM_VALID 87825 70.42 68.03 71.05 6 XMListUnsubscribeExists 86385 55.29 66.91 52.26 7 DKIM_VALID_AU 72235 51.88 55.95 50.82 8 XM_H_QuotedFrom 64487 41.72 49.95 39.58 9 BAYES_50 56852 54.78 44.04 57.58 10 MIME_HTML_ONLY 50508 25.07 39.12 21.41 11 HTML_FONT_LOW_CONTRAST 48490 30.68 37.56 28.89 12 LOC_TINY_FONT_1 43204 25.30 33.46 23.17 13 XM_DK_Undo_02 41610 12.15 32.23 6.92 14 BAYES_99 39652 10.24 30.71 4.91 15 XMSubLong 37124 23.71 28.75 22.40 16 RELAYCOUNTRY_META 33720 10.35 26.12 6.24 17 BAYES_999 32445 8.52 25.13 4.19 18 FVGT_m_MULTI_ODD 30784 21.32 23.84 20.67 19 DCC_CHECK_NEGATIVE 27685 49.08 21.44 56.28 20 TR_DCC_Bayes_99 26765 6.33 20.73 2.58 21 DKIM_VALID_EF 26276 26.38 20.35 27.95 22 T_TM2_M_HEADER_IN_MSG 24363 27.45 18.87 29.68 23 XM_Body_Dirty_Words 22963 13.68 17.79 12.61 24 UNTRUSTED_Relay 22774 5.54 17.64 2.39 25 T_KAM_HTML_FONT_INVALID 22513 16.95 17.44 16.83 26 BOTNET_IPINHOSTNAME 21193 7.28 16.42 4.91 27 FROM_EXCESS_BASE64 19768 6.29 15.31 3.94 28 MultiRelay 19269 17.57 14.92 18.25 29 BOTNET 19159 4.73 14.84 2.09 30 FSL_BULK_SIG 18911 8.33 14.65 6.69 31 XM_Multi_Part_URI 18734 13.11 14.51 12.75 32 HTML_IMAGE_RATIO_02 16140 9.56 12.50 8.80 33 XM_Evil_Numbers_Gen 16035 9.41 12.42 8.63 34 LOTS_OF_MONEY 15864 10.16 12.29 9.61 35 T_REMOTE_IMAGE 14600 5.58 11.31 4.09 36 HTML_MIME_NO_HTML_TAG 14299 4.11 11.08 2.29 37 XMSexyCombo_05 13851 5.61 10.73 4.27 38 XM_UncommonTLD01 13473 4.69 10.44 3.19 39 T_XMDrugObfuBody_14 11987 7.99 9.28 7.65 40 MISSING_HEADERS 11669 2.20 9.04 0.41 41 TooManyTo_001 11400 8.76 8.83 8.75 42 BODY_URI_ONLY 11314 1.88 8.76 0.09 43 HTML_SHORT_LINK_IMG_1 11252 1.83 8.72 0.04 44 RELAYCOUNTRY_FR 11040 2.00 8.55 0.30 45 MIME_HEADER_CTYPE_ONLY 10960 1.84 8.49 0.11 46 XMSubMetaSx_00 10765 5.04 8.34 4.18 47 HTML_IMAGE_RATIO_04 10661 6.68 8.26 6.27 48 HTML_IMAGE_ONLY_04 10052 1.65 7.79 0.06 49 HTML_SHORT_CENTER 9993 1.60 7.74 0.00 50 XM_H_Long_From01 9655 6.30 7.48 5.99 51 XMNumbers 9522 3.36 7.38 2.32 52 MPART_ALT_DIFF 9394 4.20 7.28 3.40 53 BAYES_80 9239 3.58 7.16 2.65 54 XM_JunkDunk 9094 1.46 7.04 0.00 55 XM_UB99 8951 1.44 6.93 0.01 56 LotsOfNums_01 8734 8.30 6.76 8.70 57 BAYES_60 8183 5.16 6.34 4.86 58 XM_B_Phish_Phrases 8174 5.63 6.33 5.45 59 DKIM_INVALID 7465 5.23 5.78 5.09 60 XM_UB999 7198 1.16 5.58 0.01 61 XM_UB50 7166 2.50 5.55 1.71 62 XM_DIRTYINTL 6655 2.69 5.15 2.05 63 HTML_IMAGE_RATIO_06 6353 3.82 4.92 3.54 64 XM_SPF_SoftFail 6192 2.65 4.80 2.09 65 FROM_SUSPICIOUS_NTLD 6094 1.20 4.72 0.28 66 MIME_HTML_ONLY_MULTI 5982 2.33 4.63 1.73 67 RCVD_IN_PSBL 5634 0.90 4.36 0.00 68 XM_URI_RBL 5546 1.27 4.30 0.48 69 TM2_M_URI_OPT_OUT 5509 2.35 4.27 1.85 70 RELAYCOUNTRY_CA 5494 2.17 4.26 1.62 71 BAYES_95 5308 2.04 4.11 1.50 72 XMStrtUSub 5228 4.81 4.05 5.00 73 RCVD_IN_RP_RNBL 5117 0.89 3.96 0.09 74 MIME_HTML_MOSTLY 5002 2.86 3.87 2.60 75 DIET_1 4654 1.14 3.60 0.49 76 XM_CamelCaseFrm001 4512 2.38 3.49 2.10 77 HTML_IMAGE_RATIO_08 4428 2.59 3.43 2.37 78 SpammyFromTLD_02 4273 0.94 3.31 0.32 79 NORDNS_LOW_CONTRAST 4084 0.66 3.16 0.01 80 T_TooManySym_01 3994 4.59 3.09 4.98 81 URI_HEX 3762 2.03 2.91 1.80 82 T_XMDrugObfuBody_08 3750 1.97 2.90 1.73 83 XM_OfRef6 3718 1.82 2.88 1.55 84 MultiRelay_Combo 3629 0.70 2.81 0.15 85 MultiRelay_CC 3629 0.70 2.81 0.15 86 RCVD_IN_MSPIKE_H2 3619 3.95 2.80 4.25 87 RELAYCOUNTRY_GB 3516 1.33 2.72 0.97 88 TR_LOTS_OF_MONEY2 3454 0.76 2.68 0.27 89 T_MONEY_PERCENT 3454 0.76 2.68 0.27 90 XM_H_Long_From02 3360 2.21 2.60 2.11 91 BAYES_40 3236 4.24 2.51 4.70 92 XMSexyCombo_01 3210 1.09 2.49 0.72 93 RCVD_IN_BL_SPAMCOP_NET 3179 0.81 2.46 0.38 94 XMDiploma_00 3157 1.92 2.45 1.78 95 XM_SendGrid 3141 5.20 2.43 5.92 96 XMSubMetaI_00 3137 1.28 2.43 0.99 97 MIME_QP_LONG_LINE 2980 5.30 2.31 6.08 98 LongTLD 2971 0.58 2.30 0.13 99 XMBody_17 2926 1.11 2.27 0.81 100 NO_DNS_FOR_FROM 2864 1.36 2.22 1.14 101 XMSlimDrugH 2759 0.69 2.14 0.31 102 SUBJ_ALL_CAPS 2757 1.86 2.14 1.79 103 BAYES_20 2728 3.38 2.11 3.71 104 RCVD_IN_RP_SAFE 2696 8.46 2.09 10.12 105 T_XMDrugObfuBody_00 2675 1.02 2.07 0.74 106 BOTNET_NORDNS 2577 0.42 2.00 0.01 107 XMGenDplmaNmb 2429 1.28 1.88 1.12 108 MAILING_LIST_MULTI 2412 2.17 1.87 2.25 109 SpammyFromTLD_01 2369 0.95 1.83 0.72 110 XM_UB60 2232 0.42 1.73 0.08 111 TR_XM_RelayPhish 2206 0.84 1.71 0.61 112 UNPARSEABLE_RELAY 2199 2.42 1.70 2.61 113 XMBrknScrpt_02 2150 0.77 1.67 0.54 114 RCVD_IN_RP_CERTIFIED 2140 7.33 1.66 8.80 115 TM2_M_VERY_LONG_WORD 2121 1.01 1.64 0.85 116 XMWghtMeta_00 2117 0.35 1.64 0.02 117 XMPhish30 2036 0.68 1.58 0.44 118 XMBdyGiftCard01 1931 1.08 1.50 0.97 119 DKIM_ADSP_CUSTOM_MED 1904 1.08 1.47 0.98 120 URIBL_BLACK 1901 0.34 1.47 0.05 121 HEXHASH_WORD 1894 0.32 1.47 0.02 122 RCVD_IN_IADB_LISTED 1869 4.86 1.45 5.75 123 XMSexyCombo_04 1860 0.47 1.44 0.22 124 BAYES_05 1852 2.27 1.43 2.49 125 XMPhish11 1845 1.13 1.43 1.06 126 NML_ADSP_CUSTOM_MED 1839 0.81 1.42 0.65 127 BAYES_00 1829 14.11 1.42 17.41 128 XM_ShortIntro_01 1827 0.71 1.42 0.53 129 HTML_OFF_PAGE 1814 0.29 1.41 0.00 130 XMHTML_After_End 1814 0.67 1.41 0.48 131 XM_S_JOY_D 1717 0.54 1.33 0.33 132 RELAYCOUNTRY_CN 1708 0.32 1.32 0.06 133 TR_Mismatch_TLD_02 1702 0.31 1.32 0.05 134 XMBody_78 1691 0.80 1.31 0.66 135 FILL_THIS_FORM 1690 0.63 1.31 0.46 136 T_XMHurry_00 1684 0.74 1.30 0.60 137 T_Symld_Words_02 1684 0.73 1.30 0.58 138 FORGED_GMAIL_RCVD 1673 0.65 1.30 0.49 139 DATE_IN_PAST_03_06 1643 0.32 1.27 0.07 140 XMSubject_48 1633 0.31 1.26 0.06 141 XMStockSpam_06 1593 1.17 1.23 1.16 142 XMSubMetaSxObfu_03 1562 0.62 1.21 0.47 143 RELAYCOUNTRY_NL 1550 0.39 1.20 0.18 144 TR_Symld_Words 1531 1.62 1.19 1.73 145 BODY_ENHANCEMENT 1528 0.26 1.18 0.02 146 RCVD_IN_IADB_SPF 1522 4.23 1.18 5.02 147 XM_salutation2 1515 0.82 1.17 0.72 148 XM_H_TOP 1464 0.24 1.13 0.01 149 XM_UB95 1424 0.24 1.10 0.01 150 RCVD_IN_IADB_SENDERID 1411 3.74 1.09 4.43 151 RELAYCOUNTRY_AT 1401 0.43 1.09 0.27 152 ALL_TRUSTED 1383 11.81 1.07 14.61 153 RCVD_IN_IADB_DK 1380 3.68 1.07 4.36 154 XM_UB80 1372 0.23 1.06 0.02 155 LONG_HEX_URI 1343 0.34 1.04 0.16 156 FSL_THIS_IS_ADV 1312 0.36 1.02 0.18 157 XMPhish14 1278 0.50 0.99 0.37 158 LONG_JUNK_URI 1274 0.27 0.99 0.08 159 TR_XM_DK_Bayes 1251 11.70 0.97 14.49 160 FILL_THIS_FORM_LONG 1226 0.50 0.95 0.38 161 TVD_SPACE_RATIO_MINFP 1209 0.20 0.94 0.01 162 XM_ProductURIs 1208 1.37 0.94 1.48 163 HK_RANDOM_FROM 1201 0.31 0.93 0.15 164 HTML_FONT_FACE_BAD 1174 0.65 0.91 0.58 165 TooManyTo_002 1174 1.91 0.91 2.17 166 XM_DK_Undo_01 1172 1.53 0.91 1.69 167 RCVD_IN_IADB_VOUCHED 1125 3.07 0.87 3.64 168 SUBJ_DOLLARS 1102 0.86 0.85 0.86 169 XM_H_PHPOS 1081 0.88 0.84 0.89 170 TR_XM_DK_Bayes1 1077 11.14 0.83 13.83 171 HTML_FONT_SIZE_LARGE 1073 0.30 0.83 0.16 172 DKIM_ADSP_NXDOMAIN 1065 0.53 0.82 0.46 173 TR_MetaPhish_Combo_01 1064 1.50 0.82 1.68 174 DATE_IN_PAST_06_12 1063 0.20 0.82 0.04 175 PLING_QUERY 1055 0.64 0.82 0.59 176 T_FILL_THIS_FORM_SHORT 1053 0.93 0.82 0.95 177 REMOVE_BEFORE_LINK 1040 0.65 0.81 0.61 178 RDNS_DYNAMIC 1035 0.52 0.80 0.44 179 URI_TRY_3LD 1030 1.17 0.80 1.26 180 HTTPS_HTTP_MISMATCH 1023 0.62 0.79 0.57 181 XM_Body_Obfu01 1013 0.52 0.78 0.46 182 XMMoneyMeta_00 997 0.65 0.77 0.62 183 XM_OfRef7 993 0.33 0.77 0.22 184 TooManyTo_003 987 1.29 0.76 1.43 185 XMSubMetaSSx_00 984 0.36 0.76 0.26 186 TR_Caps_n_Bayes_99 982 0.18 0.76 0.03 187 TR_XM_DK_Bayes2 977 9.11 0.76 11.28 188 T_TooManySym_02 968 1.52 0.75 1.72 189 MONEY_FRAUD_8 959 0.15 0.74 0.00 190 RELAYCOUNTRY_AU 953 0.65 0.74 0.63 191 XM_HighProb1 950 0.16 0.74 0.01 192 RELAYCOUNTRY_DE 945 0.45 0.73 0.38 193 XM_B_COPY_HTML 931 0.78 0.72 0.80 194 XMSubMetaD_03 921 0.21 0.71 0.07 195 XM_PDF 911 3.77 0.71 4.57 196 URIBL_DBL_SPAM 908 0.17 0.70 0.03 197 URI_NOVOWEL 886 0.63 0.69 0.62 198 XMSubGiftCard1 867 0.20 0.67 0.08 199 XMSubMetaI_01 842 0.19 0.65 0.06 200 RELAYCOUNTRY_IN 839 0.24 0.65 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 443860 90.62 94.76 89.54 2 DKIM_SIGNED 377419 75.65 73.81 76.13 3 XM_DK_Pass 370294 74.12 71.90 74.70 4 DKIM_VALID 352199 70.42 68.03 71.05 5 BAYES_50 285420 54.78 44.04 57.58 6 DCC_CHECK_NEGATIVE 278975 49.08 21.44 56.28 7 XMListUnsubscribeExists 259075 55.29 66.91 52.26 8 DKIM_VALID_AU 251925 51.88 55.95 50.82 9 DCC_CHECK 206567 48.92 76.76 41.67 10 XM_H_QuotedFrom 196219 41.72 49.95 39.58 11 T_TM2_M_HEADER_IN_MSG 147123 27.45 18.87 29.68 12 HTML_FONT_LOW_CONTRAST 143204 30.68 37.56 28.89 13 DKIM_VALID_EF 138542 26.38 20.35 27.95 14 LOC_TINY_FONT_1 114864 25.30 33.46 23.17 15 XMSubLong 111050 23.71 28.75 22.40 16 MIME_HTML_ONLY 106135 25.07 39.12 21.41 17 FVGT_m_MULTI_ODD 102455 21.32 23.84 20.67 18 MultiRelay 90491 17.57 14.92 18.25 19 BAYES_00 86317 14.11 1.42 17.41 20 T_KAM_HTML_FONT_INVALID 83423 16.95 17.44 16.83 21 ALL_TRUSTED 72404 11.81 1.07 14.61 22 TR_XM_DK_Bayes 71833 11.70 0.97 14.49 23 TR_XM_DK_Bayes1 68537 11.14 0.83 13.83 24 XM_Multi_Part_URI 63194 13.11 14.51 12.75 25 XM_Body_Dirty_Words 62513 13.68 17.79 12.61 26 XM_DKIMWhitelistDomains 56149 8.99 0.01 11.33 27 TR_XM_DK_Bayes2 55922 9.11 0.76 11.28 28 RCVD_IN_RP_SAFE 50184 8.46 2.09 10.12 29 LOTS_OF_MONEY 47618 10.16 12.29 9.61 30 RCVD_IN_RP_CERTIFIED 43639 7.33 1.66 8.80 31 HTML_IMAGE_RATIO_02 43603 9.56 12.50 8.80 32 TooManyTo_001 43352 8.76 8.83 8.75 33 LotsOfNums_01 43110 8.30 6.76 8.70 34 XM_Evil_Numbers_Gen 42771 9.41 12.42 8.63 35 T_XMDrugObfuBody_14 37918 7.99 9.28 7.65 36 XM_DK_Undo_02 34286 12.15 32.23 6.92 37 FSL_BULK_SIG 33167 8.33 14.65 6.69 38 HTML_IMAGE_RATIO_04 31066 6.68 8.26 6.27 39 RELAYCOUNTRY_META 30935 10.35 26.12 6.24 40 MIME_QP_LONG_LINE 30161 5.30 2.31 6.08 41 XM_H_Long_From01 29709 6.30 7.48 5.99 42 XM_SendGrid 29353 5.20 2.43 5.92 43 RCVD_IN_IADB_LISTED 28496 4.86 1.45 5.75 44 XM_B_Phish_Phrases 27008 5.63 6.33 5.45 45 DKIM_INVALID 25220 5.23 5.78 5.09 46 RCVD_IN_IADB_SPF 24907 4.23 1.18 5.02 47 XMStrtUSub 24811 4.81 4.05 5.00 48 T_TooManySym_01 24680 4.59 3.09 4.98 49 BAYES_99 24360 10.24 30.71 4.91 50 BOTNET_IPINHOSTNAME 24322 7.28 16.42 4.91 51 BAYES_60 24070 5.16 6.34 4.86 52 BAYES_40 23281 4.24 2.51 4.70 53 XM_PDF 22648 3.77 0.71 4.57 54 RCVD_IN_IADB_SENDERID 21947 3.74 1.09 4.43 55 RCVD_IN_IADB_DK 21615 3.68 1.07 4.36 56 XMSexyCombo_05 21177 5.61 10.73 4.27 57 RCVD_IN_MSPIKE_H2 21063 3.95 2.80 4.25 58 BAYES_999 20765 8.52 25.13 4.19 59 XMSubMetaSx_00 20736 5.04 8.34 4.18 60 T_REMOTE_IMAGE 20272 5.58 11.31 4.09 61 FROM_EXCESS_BASE64 19510 6.29 15.31 3.94 62 IN_ZIMBRA_NJ_WHITELIST 18976 3.04 0.03 3.83 63 BAYES_20 18402 3.38 2.11 3.71 64 RCVD_IN_IADB_VOUCHED 18051 3.07 0.87 3.64 65 HTML_IMAGE_RATIO_06 17546 3.82 4.92 3.54 66 MPART_ALT_DIFF 16856 4.20 7.28 3.40 67 XM_UncommonTLD01 15826 4.69 10.44 3.19 68 BAYES_80 13124 3.58 7.16 2.65 69 UNPARSEABLE_RELAY 12949 2.42 1.70 2.61 70 MIME_HTML_MOSTLY 12865 2.86 3.87 2.60 71 TR_DCC_Bayes_99 12809 6.33 20.73 2.58 72 BAYES_05 12347 2.27 1.43 2.49 73 TO_MALFORMED 12034 1.95 0.10 2.43 74 UNTRUSTED_Relay 11826 5.54 17.64 2.39 75 HTML_IMAGE_RATIO_08 11747 2.59 3.43 2.37 76 XMNumbers 11480 3.36 7.38 2.32 77 RCVD_IN_IADB_OPTIN 11451 1.95 0.59 2.31 78 HTML_MIME_NO_HTML_TAG 11357 4.11 11.08 2.29 79 MAILING_LIST_MULTI 11161 2.17 1.87 2.25 80 TVD_RCVD_IP 11134 1.82 0.20 2.25 81 TooManyTo_002 10740 1.91 0.91 2.17 82 XM_H_Long_From02 10468 2.21 2.60 2.11 83 XM_CamelCaseFrm001 10388 2.38 3.49 2.10 84 BOTNET 10381 4.73 14.84 2.09 85 XM_SPF_SoftFail 10365 2.65 4.80 2.09 86 XM_DIRTYINTL 10164 2.69 5.15 2.05 87 RCVD_IN_MSPIKE_H3 9279 1.59 0.51 1.87 88 RCVD_IN_MSPIKE_WL 9279 1.59 0.51 1.87 89 TM2_M_URI_OPT_OUT 9191 2.35 4.27 1.85 90 ANY_BOUNCE_MESSAGE 9152 1.57 0.49 1.85 91 BOUNCE_MESSAGE 9151 1.57 0.49 1.85 92 URI_HEX 8928 2.03 2.91 1.80 93 SUBJ_ALL_CAPS 8886 1.86 2.14 1.79 94 XMDiploma_00 8831 1.92 2.45 1.78 95 TR_Symld_Words 8565 1.62 1.19 1.73 96 T_XMDrugObfuBody_08 8562 1.97 2.90 1.73 97 MIME_HTML_ONLY_MULTI 8557 2.33 4.63 1.73 98 T_TooManySym_02 8524 1.52 0.75 1.72 99 XM_UB50 8486 2.50 5.55 1.71 100 XM_DK_Undo_01 8369 1.53 0.91 1.69 101 TR_MetaPhish_Combo_01 8308 1.50 0.82 1.68 102 HELO_NODOT 8252 1.45 0.63 1.66 103 RELAYCOUNTRY_CA 8055 2.17 4.26 1.62 104 IN_HORDE_ADDRESS_BOOK 8022 1.29 0.04 1.62 105 XM_OfRef6 7683 1.82 2.88 1.55 106 BAYES_95 7417 2.04 4.11 1.50 107 INVALID_MSGID 7325 1.21 0.16 1.48 108 XM_ProductURIs 7322 1.37 0.94 1.48 109 TooManyTo_003 7068 1.29 0.76 1.43 110 XMCapTrack 6555 1.10 0.26 1.32 111 URI_TRY_3LD 6254 1.17 0.80 1.26 112 USER_IN_DEF_DKIM_WL 5813 0.93 0.00 1.17 113 XMStockSpam_06 5743 1.17 1.23 1.16 114 NO_DNS_FOR_FROM 5634 1.36 2.22 1.14 115 XMGenDplmaNmb 5552 1.28 1.88 1.12 116 XM_GoogleGroups 5517 0.98 0.49 1.11 117 XMPhish11 5245 1.13 1.43 1.06 118 TooManyTo_004 5173 0.96 0.65 1.04 119 XMGappySubj_01 5122 0.89 0.36 1.03 120 XMSubMetaI_00 4883 1.28 2.43 0.99 121 DKIM_ADSP_CUSTOM_MED 4873 1.08 1.47 0.98 122 XM_B_REG_HTML 4821 0.85 0.39 0.97 123 RELAYCOUNTRY_GB 4804 1.33 2.72 0.97 124 XMBdyGiftCard01 4790 1.08 1.50 0.97 125 T_FILL_THIS_FORM_SHORT 4734 0.93 0.82 0.95 126 XM_H_PHPOS 4399 0.88 0.84 0.89 127 SUBJ_DOLLARS 4271 0.86 0.85 0.86 128 TM2_M_VERY_LONG_WORD 4206 1.01 1.64 0.85 129 RELAYCOUNTRY_PH 4186 0.67 0.02 0.84 130 TooManyTo_005 4155 0.78 0.58 0.84 131 XMBody_17 4033 1.11 2.27 0.81 132 XM_B_COPY_HTML 3973 0.78 0.72 0.80 133 T_XMDrugObfuBody_00 3686 1.02 2.07 0.74 134 XMSexyCombo_01 3589 1.09 2.49 0.72 135 XM_salutation2 3579 0.82 1.17 0.72 136 SpammyFromTLD_01 3566 0.95 1.83 0.72 137 TM2_M_A_HREF_HREF 3427 0.65 0.51 0.69 138 T_TooManySym_03 3361 0.57 0.16 0.68 139 XMBody_78 3281 0.80 1.31 0.66 140 NML_ADSP_CUSTOM_MED 3204 0.81 1.42 0.65 141 RELAYCOUNTRY_AU 3114 0.65 0.74 0.63 142 T_OBFU_PDF_ATTACH 3066 0.53 0.20 0.62 143 XMMoneyMeta_00 3053 0.65 0.77 0.62 144 URI_NOVOWEL 3050 0.63 0.69 0.62 145 REMOVE_BEFORE_LINK 3039 0.65 0.81 0.61 146 TR_XM_RelayPhish 3014 0.84 1.71 0.61 147 XM_H_PHPMailer 3006 0.61 0.62 0.61 148 T_XMHurry_00 2963 0.74 1.30 0.60 149 XMHTMLBadTable_001 2963 0.58 0.52 0.60 150 PLING_QUERY 2919 0.64 0.82 0.59 151 HTML_FONT_FACE_BAD 2892 0.65 0.91 0.58 152 T_Symld_Words_02 2885 0.73 1.30 0.58 153 HTTPS_HTTP_MISMATCH 2845 0.62 0.79 0.57 154 HTML_TAG_BALANCE_BODY 2701 0.53 0.48 0.54 155 XMBrknScrpt_02 2659 0.77 1.67 0.54 156 XM_ShortIntro_01 2634 0.71 1.42 0.53 157 XMLngstWrd_00 2624 0.52 0.46 0.53 158 XMBody_95 2623 0.44 0.08 0.53 159 FROM_GOV_SPOOF 2616 0.46 0.20 0.53 160 DIET_1 2441 1.14 3.60 0.49 161 XMLngstWrd_01 2417 0.48 0.43 0.49 162 FORGED_GMAIL_RCVD 2412 0.65 1.30 0.49 163 XM_URI_RBL 2375 1.27 4.30 0.48 164 XMGappySubj_02 2371 0.40 0.11 0.48 165 XMHTML_After_End 2360 0.67 1.41 0.48 166 USER_IN_WHITELIST 2349 0.38 0.00 0.47 167 XMSubMetaSxObfu_03 2306 0.62 1.21 0.47 168 DKIM_ADSP_NXDOMAIN 2269 0.53 0.82 0.46 169 XM_Body_Obfu01 2263 0.52 0.78 0.46 170 FILL_THIS_FORM 2260 0.63 1.31 0.46 171 RDNS_DYNAMIC 2205 0.52 0.80 0.44 172 SHORT_HELO_AND_INLINE_IMAGE 2198 0.36 0.05 0.44 173 XMPhish30 2184 0.68 1.58 0.44 174 XMSubMetaSxObfu_02 2183 0.41 0.31 0.44 175 XMNoVowels 2172 0.42 0.34 0.44 176 MISSING_HEADERS 2049 2.20 9.04 0.41 177 FROM_GOV_DKIM_AU 2007 0.36 0.20 0.40 178 RCVD_IN_BL_SPAMCOP_NET 1883 0.81 2.46 0.38 179 RELAYCOUNTRY_DE 1879 0.45 0.73 0.38 180 TM2_M_BODY_EMPTY 1874 0.33 0.13 0.38 181 HTML_IMAGE_ONLY_32 1870 0.36 0.28 0.38 182 FILL_THIS_FORM_LONG 1870 0.50 0.95 0.38 183 XMDateMe_00 1868 0.35 0.24 0.38 184 XMPhish14 1854 0.50 0.99 0.37 185 XM_B_TRADE_HTML 1773 0.34 0.28 0.36 186 RCVD_IN_SORBS_DUL 1764 0.34 0.27 0.36 187 XMSubPhish11 1711 0.34 0.31 0.35 188 TVD_SPACE_RATIO 1693 0.35 0.41 0.34 189 FILL_THIS_FORM_LOAN 1638 0.39 0.63 0.33 190 HTML_IMAGE_ONLY_28 1638 0.37 0.53 0.33 191 XM_S_JOY_D 1628 0.54 1.33 0.33 192 BASE64_LENGTH_79_INF 1624 0.29 0.15 0.33 193 SpammyFromTLD_02 1608 0.94 3.31 0.32 194 LOW_PRICE 1600 0.39 0.65 0.32 195 XMSubNoVowel 1595 0.37 0.56 0.32 196 HTML_IMAGE_ONLY_24 1563 0.32 0.36 0.32 197 AC_DIV_BONANZA 1559 0.27 0.09 0.31 198 TR_LOTS_OF_MONEY3 1533 0.37 0.61 0.31 199 XMSlimDrugH 1525 0.69 2.14 0.31 200 RELAYCOUNTRY_FR 1465 2.00 8.55 0.30 ----------------------------------------------------------------------