Email: 629637 Autolearn: 0 AvgScore: 1.39 AvgScanTime: 1.98 sec Spam: 114823 Autolearn: 0 AvgScore: 12.41 AvgScanTime: 2.47 sec Ham: 514814 Autolearn: 0 AvgScore: -1.07 AvgScanTime: 1.87 sec Time Spent Running SA: 345.73 hours Time Spent Processing Spam: 78.93 hours Time Spent Processing Ham: 266.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109046 89.87 94.97 88.73 2 DKIM_SIGNED 93351 76.43 81.30 75.34 3 DCC_CHECK 91292 49.56 79.51 42.88 4 XM_DK_Pass 90852 75.05 79.12 74.14 5 DKIM_VALID 85638 71.21 74.58 70.46 6 XMListUnsubscribeExists 80929 53.73 70.48 49.99 7 DKIM_VALID_AU 70355 54.41 61.27 52.88 8 XM_H_QuotedFrom 58118 41.89 50.62 39.95 9 BAYES_50 53165 55.41 46.30 57.44 10 XM_DK_Undo_02 45122 13.55 39.30 7.81 11 HTML_FONT_LOW_CONTRAST 44493 29.15 38.75 27.01 12 LOC_TINY_FONT_1 41002 26.47 35.71 24.41 13 MIME_HTML_ONLY 39946 23.03 34.79 20.41 14 BAYES_99 33149 10.06 28.87 5.86 15 XMSubLong 33062 22.84 28.79 21.51 16 FVGT_m_MULTI_ODD 31434 22.41 27.38 21.31 17 BAYES_999 27187 8.16 23.68 4.70 18 TR_DCC_Bayes_99 27091 7.38 23.59 3.76 19 DKIM_VALID_EF 25724 26.41 22.40 27.31 20 XM_Body_Dirty_Words 24671 14.34 21.49 12.75 21 T_TM2_M_HEADER_IN_MSG 22899 29.60 19.94 31.75 22 BOTNET_IPINHOSTNAME 22853 7.60 19.90 4.86 23 BOTNET 22822 5.45 19.88 2.23 24 RELAYCOUNTRY_META 21969 8.00 19.13 5.52 25 T_KAM_HTML_FONT_INVALID 21840 16.97 19.02 16.51 26 DCC_CHECK_NEGATIVE 21553 48.67 18.77 55.34 27 MultiRelay 18597 17.62 16.20 17.94 28 XM_Multi_Part_URI 18360 13.76 15.99 13.26 29 XM_Evil_Numbers_Gen 17578 10.60 15.31 9.55 30 HTML_IMAGE_RATIO_02 16313 10.61 14.21 9.81 31 FSL_BULK_SIG 15631 7.89 13.61 6.61 32 XMSexyCombo_05 14483 5.77 12.61 4.24 33 UNTRUSTED_Relay 13074 3.71 11.39 2.00 34 LOTS_OF_MONEY 12824 9.35 11.17 8.94 35 XM_UncommonTLD01 11317 4.25 9.86 3.00 36 T_XMDrugObfuBody_14 10574 8.22 9.21 8.00 37 XMSubMetaSx_00 10282 4.69 8.95 3.74 38 TooManyTo_001 9897 9.07 8.62 9.17 39 XM_B_Phish_Phrases 9851 6.53 8.58 6.07 40 HTML_IMAGE_RATIO_04 9283 6.87 8.08 6.60 41 XM_H_Long_From01 8822 6.43 7.68 6.15 42 MPART_ALT_DIFF 8624 4.11 7.51 3.35 43 BAYES_80 8377 3.53 7.30 2.68 44 LotsOfNums_01 7805 8.72 6.80 9.15 45 DKIM_INVALID 7713 5.21 6.72 4.88 46 HTML_IMAGE_RATIO_06 7554 4.07 6.58 3.51 47 XM_UB50 7408 2.25 6.45 1.32 48 BAYES_60 7311 4.99 6.37 4.68 49 FROM_EXCESS_BASE64 7008 4.73 6.10 4.42 50 T_REMOTE_IMAGE 6966 4.35 6.07 3.96 51 XM_DIRTYINTL 6757 2.49 5.88 1.73 52 XMNumbers 6267 3.23 5.46 2.73 53 HTML_MIME_NO_HTML_TAG 6019 2.79 5.24 2.24 54 RCVD_IN_RP_RNBL 5880 0.97 5.12 0.05 55 XM_URI_RBL 5877 1.40 5.12 0.58 56 MIME_HTML_ONLY_MULTI 5296 2.17 4.61 1.62 57 XM_SPF_SoftFail 5047 2.60 4.40 2.20 58 TM2_M_URI_OPT_OUT 4918 2.33 4.28 1.89 59 MIME_HTML_MOSTLY 4834 2.93 4.21 2.65 60 RELAYCOUNTRY_CA 4744 2.03 4.13 1.56 61 URI_HEX 4267 2.01 3.72 1.63 62 BAYES_95 4227 2.11 3.68 1.76 63 SpammyFromTLD_02 4176 0.84 3.64 0.21 64 XMSexyCombo_01 4007 1.09 3.49 0.56 65 HTML_IMAGE_RATIO_08 3996 2.89 3.48 2.76 66 T_TooManySym_01 3814 4.79 3.32 5.12 67 BODY_URI_ONLY 3786 0.68 3.30 0.09 68 RCVD_IN_MSPIKE_H2 3737 4.13 3.25 4.32 69 HTML_SHORT_LINK_IMG_1 3687 0.61 3.21 0.03 70 MIME_QP_LONG_LINE 3631 4.70 3.16 5.04 71 T_XMDrugObfuBody_08 3616 1.72 3.15 1.40 72 XM_CamelCaseFrm001 3552 2.16 3.09 1.96 73 MultiRelay_Combo 3440 0.66 3.00 0.14 74 MultiRelay_CC 3440 0.66 3.00 0.14 75 XMStrtUSub 3430 4.40 2.99 4.72 76 XM_OfRef6 3395 1.69 2.96 1.41 77 XM_SendGrid 3196 5.29 2.78 5.84 78 RCVD_IN_RP_SAFE 3182 9.19 2.77 10.62 79 MISSING_HEADERS 3064 0.83 2.67 0.42 80 MIME_HEADER_CTYPE_ONLY 3059 0.61 2.66 0.15 81 XMBdyGiftCard01 2981 1.70 2.60 1.50 82 BAYES_40 2958 4.43 2.58 4.84 83 XMDiploma_00 2951 1.70 2.57 1.50 84 HTML_IMAGE_ONLY_04 2863 0.49 2.49 0.05 85 XMSubMetaI_00 2821 1.37 2.46 1.13 86 SHORTENER_SHORT_IMG 2818 0.45 2.45 0.00 87 HTML_SHORT_CENTER 2797 0.46 2.44 0.02 88 RCVD_IN_RP_CERTIFIED 2663 7.92 2.32 9.17 89 NO_DNS_FOR_FROM 2577 1.35 2.24 1.15 90 BOTNET_NORDNS 2431 0.40 2.12 0.02 91 MAILING_LIST_MULTI 2430 2.45 2.12 2.52 92 BAYES_20 2420 3.39 2.11 3.68 93 XMSexyCombo_04 2382 0.52 2.07 0.17 94 SUBJ_ALL_CAPS 2365 2.08 2.06 2.08 95 RCVD_IN_BL_SPAMCOP_NET 2331 0.53 2.03 0.20 96 XM_H_Long_From02 2253 1.72 1.96 1.67 97 RELAYCOUNTRY_FR 2135 0.51 1.86 0.21 98 XMBody_17 2122 0.93 1.85 0.72 99 XMStockSpam_06 2053 1.77 1.79 1.77 100 XMPhish30 2027 0.72 1.77 0.49 101 SUBJ_DOLLARS 1994 0.59 1.74 0.34 102 RCVD_IN_IADB_LISTED 1985 4.45 1.73 5.06 103 XMPhish11 1940 1.23 1.69 1.13 104 TM2_M_VERY_LONG_WORD 1939 1.05 1.69 0.91 105 XMGenDplmaNmb 1932 1.08 1.68 0.94 106 SpammyFromTLD_01 1927 0.88 1.68 0.71 107 TR_XM_RelayPhish 1920 0.80 1.67 0.60 108 RELAYCOUNTRY_GB 1885 1.08 1.64 0.96 109 DIET_1 1884 0.72 1.64 0.51 110 T_XMDrugObfuBody_00 1881 0.90 1.64 0.74 111 TR_LOTS_OF_MONEY2 1855 1.18 1.62 1.08 112 T_MONEY_PERCENT 1855 1.18 1.62 1.08 113 URIBL_BLACK 1849 0.32 1.61 0.03 114 RELAYCOUNTRY_CN 1833 0.34 1.60 0.06 115 XM_UB60 1810 0.34 1.58 0.07 116 RELAYCOUNTRY_IN 1800 0.37 1.57 0.10 117 T_XMHurry_00 1785 0.80 1.55 0.63 118 XMPhish14 1780 0.73 1.55 0.54 119 XM_salutation2 1750 0.87 1.52 0.73 120 XMHTML_After_End 1750 0.67 1.52 0.49 121 XM_ProductURIs 1737 1.85 1.51 1.93 122 UNPARSEABLE_RELAY 1717 2.37 1.50 2.57 123 TR_MetaPhish_Combo_01 1711 1.48 1.49 1.47 124 RCVD_IN_IADB_SPF 1701 3.92 1.48 4.47 125 XM_DK_Undo_01 1685 1.58 1.47 1.60 126 FILL_THIS_FORM_LONG 1631 0.52 1.42 0.32 127 BAYES_00 1628 13.65 1.42 16.37 128 BODY_ENHANCEMENT 1613 0.28 1.40 0.03 129 TR_Symld_Words 1606 1.49 1.40 1.51 130 T_TooManySym_02 1579 1.82 1.38 1.92 131 RCVD_IN_IADB_SENDERID 1574 3.48 1.37 3.95 132 XMSlimDrugH 1573 0.51 1.37 0.32 133 RCVD_IN_IADB_DK 1532 3.41 1.33 3.87 134 XM_H_PHPOS 1529 1.07 1.33 1.02 135 RELAYCOUNTRY_AT 1495 0.53 1.30 0.36 136 XMClaimOffer 1440 0.34 1.25 0.14 137 DATE_IN_PAST_03_06 1436 0.30 1.25 0.08 138 RCVD_IN_PSBL 1433 0.27 1.25 0.06 139 LONG_JUNK_URI 1429 0.27 1.24 0.05 140 TooManyTo_002 1426 2.06 1.24 2.25 141 FSL_THIS_IS_ADV 1419 0.49 1.24 0.32 142 DKIM_ADSP_NXDOMAIN 1381 0.56 1.20 0.42 143 FROM_SUSPICIOUS_NTLD 1359 0.28 1.18 0.08 144 ALL_TRUSTED 1354 13.31 1.18 16.01 145 TR_Mismatch_TLD_02 1340 0.26 1.17 0.06 146 REPLYTO_WITHOUT_TO_CC 1336 0.24 1.16 0.03 147 XMBody_78 1332 0.58 1.16 0.45 148 BAYES_05 1315 2.14 1.15 2.36 149 LOW_PRICE 1281 1.03 1.12 1.01 150 TR_XM_DK_Bayes 1259 10.92 1.10 13.12 151 FILL_THIS_FORM 1240 0.54 1.08 0.42 152 HTML_FONT_SIZE_LARGE 1236 0.34 1.08 0.18 153 T_FILL_THIS_FORM_SHORT 1234 0.94 1.07 0.91 154 DKIM_ADSP_CUSTOM_MED 1220 1.01 1.06 1.00 155 TooManyTo_003 1205 1.45 1.05 1.54 156 XM_UB99 1188 0.19 1.03 0.01 157 XM_HighProb1 1179 0.23 1.03 0.05 158 XMSubMetaSSx_00 1173 0.38 1.02 0.24 159 XMSubMetaSxObfu_03 1143 0.69 1.00 0.62 160 HELO_NODOT 1132 1.54 0.99 1.67 161 NML_ADSP_CUSTOM_MED 1104 0.72 0.96 0.67 162 TR_XM_DK_Bayes1 1101 10.44 0.96 12.55 163 TVD_SPACE_RATIO_MINFP 1076 0.19 0.94 0.02 164 URI_TRY_3LD 1067 1.33 0.93 1.42 165 XM_UB80 1053 0.19 0.92 0.02 166 TooManyTo_004 1042 1.11 0.91 1.16 167 XM_PDF 1039 3.83 0.90 4.49 168 NORMAL_HTTP_TO_IP 1018 0.23 0.89 0.08 169 XMMoneyMeta_00 1013 0.66 0.88 0.61 170 XMBrknScrpt_02 1012 0.83 0.88 0.82 171 XM_H_PHPMailer 1003 0.67 0.87 0.62 172 XMSubNoVowel 1002 0.42 0.87 0.32 173 HTML_IMAGE_ONLY_12 997 0.33 0.87 0.21 174 URI_NOVOWEL 981 0.58 0.85 0.52 175 RCVD_IN_IADB_VOUCHED 981 2.79 0.85 3.22 176 XMGppyBdWords 958 0.47 0.83 0.39 177 TR_LOTS_OF_MONEY3 957 0.40 0.83 0.31 178 LongTLD 957 0.27 0.83 0.14 179 HTML_IMAGE_ONLY_28 946 0.44 0.82 0.36 180 TR_XM_DK_Bayes2 944 9.09 0.82 10.93 181 XM_OfRef7 942 0.30 0.82 0.18 182 TooManyTo_005 915 0.92 0.80 0.95 183 URIBL_DBL_SPAM 909 0.17 0.79 0.03 184 XM_XX_Yahoo 908 0.22 0.79 0.10 185 RELAYCOUNTRY_DE 906 0.40 0.79 0.31 186 FILL_THIS_FORM_LOAN 904 0.39 0.79 0.31 187 XM_UB999 893 0.15 0.78 0.01 188 XM_Hitman 884 0.17 0.77 0.04 189 HTML_COMMENT_SAVED_URL 864 0.18 0.75 0.05 190 PP_MIME_FAKE_ASCII_TEXT 859 0.36 0.75 0.27 191 RDNS_DYNAMIC 828 0.47 0.72 0.41 192 RELAYCOUNTRY_NL 796 0.28 0.69 0.18 193 THIS_AD 788 0.27 0.69 0.17 194 HELO_NO_DOMAIN 781 0.82 0.68 0.86 195 ANY_BOUNCE_MESSAGE 774 1.82 0.67 2.08 196 BOUNCE_MESSAGE 770 1.81 0.67 2.07 197 RCVD_IN_IADB_OPTIN 767 1.77 0.67 2.02 198 RELAYCOUNTRY_AU 766 0.44 0.67 0.39 199 ADVANCE_FEE_4_NEW 762 0.12 0.66 0.00 200 XMLongAddy 752 0.15 0.65 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 456808 89.87 94.97 88.73 2 DKIM_SIGNED 387855 76.43 81.30 75.34 3 XM_DK_Pass 381684 75.05 79.12 74.14 4 DKIM_VALID 362733 71.21 74.58 70.46 5 BAYES_50 295730 55.41 46.30 57.44 6 DCC_CHECK_NEGATIVE 284885 48.67 18.77 55.34 7 DKIM_VALID_AU 272214 54.41 61.27 52.88 8 XMListUnsubscribeExists 257345 53.73 70.48 49.99 9 DCC_CHECK 220734 49.56 79.51 42.88 10 XM_H_QuotedFrom 205659 41.89 50.62 39.95 11 T_TM2_M_HEADER_IN_MSG 163463 29.60 19.94 31.75 12 DKIM_VALID_EF 140584 26.41 22.40 27.31 13 HTML_FONT_LOW_CONTRAST 139057 29.15 38.75 27.01 14 LOC_TINY_FONT_1 125641 26.47 35.71 24.41 15 XMSubLong 110717 22.84 28.79 21.51 16 FVGT_m_MULTI_ODD 109697 22.41 27.38 21.31 17 MIME_HTML_ONLY 105048 23.03 34.79 20.41 18 MultiRelay 92357 17.62 16.20 17.94 19 T_KAM_HTML_FONT_INVALID 84981 16.97 19.02 16.51 20 BAYES_00 84291 13.65 1.42 16.37 21 ALL_TRUSTED 82423 13.31 1.18 16.01 22 XM_DKIMWhitelistDomains 68602 10.92 0.11 13.33 23 XM_Multi_Part_URI 68274 13.76 15.99 13.26 24 TR_XM_DK_Bayes 67524 10.92 1.10 13.12 25 XM_Body_Dirty_Words 65638 14.34 21.49 12.75 26 TR_XM_DK_Bayes1 64632 10.44 0.96 12.55 27 TR_XM_DK_Bayes2 56264 9.09 0.82 10.93 28 RCVD_IN_RP_SAFE 54666 9.19 2.77 10.62 29 HTML_IMAGE_RATIO_02 50518 10.61 14.21 9.81 30 XM_Evil_Numbers_Gen 49187 10.60 15.31 9.55 31 TooManyTo_001 47227 9.07 8.62 9.17 32 RCVD_IN_RP_CERTIFIED 47202 7.92 2.32 9.17 33 LotsOfNums_01 47084 8.72 6.80 9.15 34 LOTS_OF_MONEY 46029 9.35 11.17 8.94 35 T_XMDrugObfuBody_14 41172 8.22 9.21 8.00 36 XM_DK_Undo_02 40197 13.55 39.30 7.81 37 FSL_BULK_SIG 34027 7.89 13.61 6.61 38 HTML_IMAGE_RATIO_04 34000 6.87 8.08 6.60 39 XM_H_Long_From01 31650 6.43 7.68 6.15 40 XM_B_Phish_Phrases 31265 6.53 8.58 6.07 41 BAYES_99 30181 10.06 28.87 5.86 42 XM_SendGrid 30083 5.29 2.78 5.84 43 RELAYCOUNTRY_META 28428 8.00 19.13 5.52 44 T_TooManySym_01 26346 4.79 3.32 5.12 45 RCVD_IN_IADB_LISTED 26026 4.45 1.73 5.06 46 MIME_QP_LONG_LINE 25967 4.70 3.16 5.04 47 DKIM_INVALID 25122 5.21 6.72 4.88 48 BOTNET_IPINHOSTNAME 25019 7.60 19.90 4.86 49 BAYES_40 24916 4.43 2.58 4.84 50 XMStrtUSub 24280 4.40 2.99 4.72 51 BAYES_999 24181 8.16 23.68 4.70 52 BAYES_60 24097 4.99 6.37 4.68 53 XM_PDF 23091 3.83 0.90 4.49 54 RCVD_IN_IADB_SPF 23003 3.92 1.48 4.47 55 FROM_EXCESS_BASE64 22744 4.73 6.10 4.42 56 RCVD_IN_MSPIKE_H2 22253 4.13 3.25 4.32 57 XMSexyCombo_05 21836 5.77 12.61 4.24 58 T_REMOTE_IMAGE 20399 4.35 6.07 3.96 59 RCVD_IN_IADB_SENDERID 20356 3.48 1.37 3.95 60 RCVD_IN_IADB_DK 19925 3.41 1.33 3.87 61 TR_DCC_Bayes_99 19362 7.38 23.59 3.76 62 XMSubMetaSx_00 19258 4.69 8.95 3.74 63 IN_ZIMBRA_NJ_WHITELIST 19081 3.03 0.02 3.71 64 BAYES_20 18956 3.39 2.11 3.68 65 HTML_IMAGE_RATIO_06 18094 4.07 6.58 3.51 66 MPART_ALT_DIFF 17247 4.11 7.51 3.35 67 RCVD_IN_IADB_VOUCHED 16570 2.79 0.85 3.22 68 XM_UncommonTLD01 15439 4.25 9.86 3.00 69 HTML_IMAGE_RATIO_08 14224 2.89 3.48 2.76 70 XMNumbers 14048 3.23 5.46 2.73 71 BAYES_80 13822 3.53 7.30 2.68 72 MIME_HTML_MOSTLY 13627 2.93 4.21 2.65 73 UNPARSEABLE_RELAY 13216 2.37 1.50 2.57 74 MAILING_LIST_MULTI 12992 2.45 2.12 2.52 75 BAYES_05 12154 2.14 1.15 2.36 76 TO_MALFORMED 11903 1.90 0.07 2.31 77 TooManyTo_002 11560 2.06 1.24 2.25 78 HTML_MIME_NO_HTML_TAG 11535 2.79 5.24 2.24 79 BOTNET 11473 5.45 19.88 2.23 80 TVD_RCVD_IP 11446 1.86 0.22 2.22 81 XM_SPF_SoftFail 11350 2.60 4.40 2.20 82 SUBJ_ALL_CAPS 10720 2.08 2.06 2.08 83 ANY_BOUNCE_MESSAGE 10686 1.82 0.67 2.08 84 BOUNCE_MESSAGE 10657 1.81 0.67 2.07 85 RCVD_IN_IADB_OPTIN 10391 1.77 0.67 2.02 86 UNTRUSTED_Relay 10276 3.71 11.39 2.00 87 XM_CamelCaseFrm001 10065 2.16 3.09 1.96 88 XM_ProductURIs 9911 1.85 1.51 1.93 89 T_TooManySym_02 9909 1.82 1.38 1.92 90 TM2_M_URI_OPT_OUT 9745 2.33 4.28 1.89 91 RCVD_IN_MSPIKE_H3 9573 1.63 0.59 1.86 92 RCVD_IN_MSPIKE_WL 9573 1.63 0.59 1.86 93 XMBody_95 9234 1.49 0.11 1.79 94 XMStockSpam_06 9122 1.77 1.79 1.77 95 BAYES_95 9059 2.11 3.68 1.76 96 XM_DIRTYINTL 8912 2.49 5.88 1.73 97 HELO_NODOT 8595 1.54 0.99 1.67 98 XM_H_Long_From02 8590 1.72 1.96 1.67 99 IN_HORDE_ADDRESS_BOOK 8389 1.34 0.06 1.63 100 URI_HEX 8381 2.01 3.72 1.63 101 MIME_HTML_ONLY_MULTI 8362 2.17 4.61 1.62 102 XM_DK_Undo_01 8245 1.58 1.47 1.60 103 RELAYCOUNTRY_CA 8043 2.03 4.13 1.56 104 TooManyTo_003 7943 1.45 1.05 1.54 105 TR_Symld_Words 7788 1.49 1.40 1.51 106 XMDiploma_00 7728 1.70 2.57 1.50 107 XMBdyGiftCard01 7714 1.70 2.60 1.50 108 TR_MetaPhish_Combo_01 7586 1.48 1.49 1.47 109 URI_TRY_3LD 7285 1.33 0.93 1.42 110 XM_OfRef6 7268 1.69 2.96 1.41 111 T_XMDrugObfuBody_08 7217 1.72 3.15 1.40 112 XMCapTrack 7211 1.21 0.33 1.40 113 INVALID_MSGID 7204 1.17 0.13 1.40 114 XM_UB50 6776 2.25 6.45 1.32 115 USER_IN_DEF_DKIM_WL 6560 1.04 0.01 1.27 116 TooManyTo_004 5964 1.11 0.91 1.16 117 NO_DNS_FOR_FROM 5932 1.35 2.24 1.15 118 XMSubMetaI_00 5832 1.37 2.46 1.13 119 XMPhish11 5804 1.23 1.69 1.13 120 XM_GoogleGroups 5668 1.01 0.58 1.10 121 TR_LOTS_OF_MONEY2 5551 1.18 1.62 1.08 122 T_MONEY_PERCENT 5551 1.18 1.62 1.08 123 XM_H_PHPOS 5229 1.07 1.33 1.02 124 LOW_PRICE 5222 1.03 1.12 1.01 125 DKIM_ADSP_CUSTOM_MED 5130 1.01 1.06 1.00 126 RELAYCOUNTRY_GB 4938 1.08 1.64 0.96 127 TooManyTo_005 4867 0.92 0.80 0.95 128 XMGenDplmaNmb 4855 1.08 1.68 0.94 129 T_FILL_THIS_FORM_SHORT 4694 0.94 1.07 0.91 130 TM2_M_VERY_LONG_WORD 4660 1.05 1.69 0.91 131 HELO_NO_DOMAIN 4409 0.82 0.68 0.86 132 XMBrknScrpt_02 4205 0.83 0.88 0.82 133 T_Symld_Words_02 3794 0.71 0.61 0.74 134 T_XMDrugObfuBody_00 3784 0.90 1.64 0.74 135 XM_salutation2 3753 0.87 1.52 0.73 136 XMBody_17 3713 0.93 1.85 0.72 137 RELAYCOUNTRY_PH 3668 0.59 0.03 0.71 138 SpammyFromTLD_01 3635 0.88 1.68 0.71 139 NML_ADSP_CUSTOM_MED 3455 0.72 0.96 0.67 140 XMLngstWrd_00 3425 0.61 0.35 0.67 141 HTML_FONT_FACE_BAD 3424 0.65 0.57 0.67 142 DC_GIF_UNO_LARGO 3397 0.54 0.00 0.66 143 XM_RXBody 3383 0.66 0.65 0.66 144 T_XMHurry_00 3243 0.80 1.55 0.63 145 XMLngstWrd_01 3226 0.57 0.33 0.63 146 XM_H_PHPMailer 3210 0.67 0.87 0.62 147 T_TooManySym_03 3202 0.56 0.28 0.62 148 XMSubMetaSxObfu_03 3189 0.69 1.00 0.62 149 XMMoneyMeta_00 3122 0.66 0.88 0.61 150 TR_XM_RelayPhish 3114 0.80 1.67 0.60 151 XM_ShortIntro_01 3007 0.58 0.58 0.58 152 XM_URI_RBL 2962 1.40 5.12 0.58 153 XM_B_REG_HTML 2919 0.58 0.61 0.57 154 T_OBFU_PDF_ATTACH 2894 0.50 0.21 0.56 155 XMSexyCombo_01 2878 1.09 3.49 0.56 156 HTML_TAG_BALANCE_BODY 2851 0.57 0.64 0.55 157 XMPhish14 2787 0.73 1.55 0.54 158 XMGappySubj_01 2746 0.48 0.23 0.53 159 URI_NOVOWEL 2694 0.58 0.85 0.52 160 DIET_1 2640 0.72 1.64 0.51 161 HTTPS_HTTP_MISMATCH 2618 0.52 0.59 0.51 162 XMNoVowels 2534 0.49 0.47 0.49 163 XMPhish30 2501 0.72 1.77 0.49 164 XMHTML_After_End 2499 0.67 1.52 0.49 165 USER_IN_WHITELIST 2498 0.40 0.00 0.49 166 XM_B_COPY_HTML 2427 0.49 0.55 0.47 167 FORGED_GMAIL_RCVD 2421 0.50 0.65 0.47 168 AC_DIV_BONANZA 2389 0.40 0.13 0.46 169 SHORT_HELO_AND_INLINE_IMAGE 2363 0.40 0.11 0.46 170 XMBody_78 2337 0.58 1.16 0.45 171 XMHTMLBadTable_001 2320 0.49 0.65 0.45 172 HTML_IMAGE_ONLY_32 2305 0.42 0.30 0.45 173 XMSubMetaSxObfu_02 2246 0.41 0.27 0.44 174 MISSING_HEADERS 2173 0.83 2.67 0.42 175 DKIM_ADSP_NXDOMAIN 2169 0.56 1.20 0.42 176 XMSolicitRefs_0 2166 0.43 0.44 0.42 177 FILL_THIS_FORM 2156 0.54 1.08 0.42 178 TM2_M_BODY_EMPTY 2144 0.37 0.16 0.42 179 FROM_GOV_SPOOF 2127 0.36 0.11 0.41 180 T_MANY_PILL_PRICE 2120 0.35 0.09 0.41 181 RDNS_DYNAMIC 2118 0.47 0.72 0.41 182 TM2_M_A_HREF_HREF 2059 0.43 0.58 0.40 183 RELAYCOUNTRY_AU 2028 0.44 0.67 0.39 184 XMGppyBdWords 1985 0.47 0.83 0.39 185 RCVD_IN_SORBS_DUL 1963 0.36 0.26 0.38 186 XMDateMe_00 1905 0.40 0.51 0.37 187 XMLngstWrd_02 1898 0.35 0.29 0.37 188 HTML_IMAGE_ONLY_28 1851 0.44 0.82 0.36 189 RELAYCOUNTRY_AT 1844 0.53 1.30 0.36 190 URI_OPTOUT_3LD 1838 0.32 0.17 0.36 191 XM_Body_Obfu01 1823 0.34 0.29 0.35 192 HTML_IMAGE_ONLY_24 1805 0.37 0.45 0.35 193 XMLKML 1785 0.28 0.00 0.35 194 BASE64_LENGTH_79_INF 1741 0.36 0.48 0.34 195 SUBJ_DOLLARS 1740 0.59 1.74 0.34 196 REMOVE_BEFORE_LINK 1737 0.35 0.43 0.34 197 XM_H_PHPOS_M 1732 0.36 0.45 0.34 198 XMGappySubj_02 1702 0.29 0.09 0.33 199 FROM_GOV_DKIM_AU 1687 0.30 0.17 0.33 200 XMSlimDrugH 1667 0.51 1.37 0.32 ----------------------------------------------------------------------