Email: 656303 Autolearn: 0 AvgScore: 3.75 AvgScanTime: 2.12 sec Spam: 204354 Autolearn: 0 AvgScore: 12.80 AvgScanTime: 2.52 sec Ham: 451949 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 1.94 sec Time Spent Running SA: 386.95 hours Time Spent Processing Spam: 142.81 hours Time Spent Processing Ham: 244.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162852 84.26 79.69 86.33 2 DKIM_SIGNED 137720 69.91 67.39 71.05 3 DCC_CHECK 133950 45.45 65.55 36.37 4 XM_DK_Pass 133222 68.37 65.19 69.81 5 DKIM_VALID 126053 64.88 61.68 66.32 6 XMListUnsubscribeExists 121100 50.62 59.26 46.72 7 DKIM_VALID_AU 103179 48.57 50.49 47.70 8 XM_DK_Undo_02 85039 23.94 41.61 15.95 9 BAYES_50 82812 50.82 40.52 55.47 10 XM_H_QuotedFrom 81604 38.49 39.93 37.83 11 BAYES_99 80905 22.44 39.59 14.68 12 DCC_CHECK_NEGATIVE 67694 52.78 33.13 61.67 13 BAYES_999 66933 19.23 32.75 13.12 14 TR_DCC_Bayes_99 63615 14.83 31.13 7.46 15 MIME_HTML_ONLY 61332 22.41 30.01 18.98 16 BOTNET 61163 11.83 29.93 3.64 17 HTML_FONT_LOW_CONTRAST 59892 26.96 29.31 25.90 18 LOC_TINY_FONT_1 52839 21.69 25.86 19.81 19 LOTS_OF_MONEY 51887 15.40 25.39 10.88 20 FVGT_m_MULTI_ODD 49842 21.66 24.39 20.42 21 XMSubLong 46243 22.11 22.63 21.87 22 XM_Multi_Part_URI 40808 14.40 19.97 11.89 23 DKIM_VALID_EF 38464 24.34 18.82 26.83 24 RCVD_IN_RP_RNBL 37696 6.92 18.45 1.71 25 XM_Body_Dirty_Words 36632 13.80 17.93 11.94 26 T_KAM_HTML_FONT_INVALID 33464 15.68 16.38 15.36 27 ANY_BOUNCE_MESSAGE 32879 7.93 16.09 4.24 28 BOUNCE_MESSAGE 32878 7.93 16.09 4.24 29 T_TM2_M_HEADER_IN_MSG 32668 26.18 15.99 30.79 30 RELAYCOUNTRY_META 31333 8.85 15.33 5.92 31 HTML_IMAGE_RATIO_02 29039 9.43 14.21 7.27 32 MultiRelay 28189 16.49 13.79 17.71 33 RCVD_IN_PSBL 27535 4.24 13.47 0.07 34 BOTNET_IPINHOSTNAME 24944 7.02 12.21 4.68 35 XM_Evil_Numbers_Gen 22054 9.12 10.79 8.37 36 XMSexyCombo_05 21415 5.45 10.48 3.18 37 FSL_BULK_SIG 19702 7.41 9.64 6.41 38 XM_UncommonTLD01 17874 5.01 8.75 3.32 39 UNTRUSTED_Relay 17426 4.27 8.53 2.35 40 MPART_ALT_DIFF 16237 4.15 7.95 2.43 41 T_XMDrugObfuBody_14 15938 8.19 7.80 8.37 42 TooManyTo_001 15553 9.33 7.61 10.10 43 HTML_IMAGE_RATIO_04 14349 6.38 7.02 6.09 44 XM_H_Long_From01 12963 6.22 6.34 6.16 45 XMSubMetaSx_00 12923 4.46 6.32 3.62 46 BAYES_80 12660 4.73 6.20 4.07 47 XM_B_Phish_Phrases 12396 5.84 6.07 5.74 48 FROM_EXCESS_BASE64 11957 4.49 5.85 3.88 49 DKIM_INVALID 11667 5.04 5.71 4.73 50 BAYES_60 11329 6.02 5.54 6.23 51 T_REMOTE_IMAGE 10460 4.41 5.12 4.09 52 LotsOfNums_01 10158 7.49 4.97 8.63 53 XM_DIRTYINTL 9738 2.60 4.77 1.61 54 HTML_IMAGE_RATIO_06 8876 3.56 4.34 3.20 55 SpammyFromTLD_02 8766 1.55 4.29 0.32 56 XM_URI_RBL 8467 1.62 4.14 0.48 57 XMNumbers 8373 3.15 4.10 2.73 58 XM_UB50 8328 2.53 4.08 1.83 59 MIME_HTML_MOSTLY 8030 2.65 3.93 2.08 60 BAYES_95 8002 3.09 3.92 2.72 61 DATE_IN_PAST_03_06 7797 1.24 3.82 0.08 62 RCVD_IN_RP_SAFE 7454 8.26 3.65 10.35 63 MIME_HTML_ONLY_MULTI 7319 1.88 3.58 1.11 64 HTML_MIME_NO_HTML_TAG 7154 2.82 3.50 2.52 65 URI_HEX 6786 2.22 3.32 1.72 66 XM_SPF_SoftFail 6758 2.28 3.31 1.81 67 XMStrtUSub 6601 4.26 3.23 4.73 68 TM2_M_URI_OPT_OUT 6577 2.34 3.22 1.95 69 RELAYCOUNTRY_CA 6403 1.92 3.13 1.37 70 FROM_SUSPICIOUS_NTLD 6214 0.99 3.04 0.06 71 XM_OfRef6 6061 1.87 2.97 1.38 72 XM_SendGrid 6026 4.60 2.95 5.34 73 RCVD_IN_RP_CERTIFIED 5690 7.06 2.78 8.99 74 HTML_IMAGE_RATIO_08 5455 2.43 2.67 2.33 75 XMBdyGiftCard01 5305 1.37 2.60 0.82 76 RCVD_IN_MSPIKE_H2 5279 3.79 2.58 4.33 77 MIME_QP_LONG_LINE 5124 4.77 2.51 5.80 78 MultiRelay_Combo 5094 0.90 2.49 0.18 79 MultiRelay_CC 5094 0.90 2.49 0.18 80 HTML_IMAGE_ONLY_28 4981 1.03 2.44 0.39 81 XM_CamelCaseFrm001 4914 1.84 2.40 1.59 82 RELAYCOUNTRY_GB 4817 1.42 2.36 1.00 83 T_TooManySym_01 4740 4.44 2.32 5.40 84 BODY_URI_ONLY 4359 0.73 2.13 0.09 85 RELAYCOUNTRY_IN 4323 0.75 2.12 0.13 86 XMReplyNow 4274 0.75 2.09 0.15 87 MPART_ALT_DIFF_COUNT 4254 0.90 2.08 0.36 88 XMMoneyMeta_00 4243 1.07 2.08 0.62 89 NUMERIC_HTTP_ADDR 4240 0.87 2.07 0.33 90 UNPARSEABLE_RELAY 4219 2.51 2.06 2.71 91 T_XMDrugObfuBody_08 4138 1.68 2.02 1.53 92 SUBJ_ALL_CAPS 4128 1.80 2.02 1.70 93 T_FILL_THIS_FORM_SHORT 4004 1.33 1.96 1.05 94 RCVD_IN_BL_SPAMCOP_NET 3915 0.83 1.92 0.34 95 HTML_SHORT_LINK_IMG_1 3906 0.61 1.91 0.03 96 MISSING_HEADERS 3876 0.89 1.90 0.44 97 ALL_TRUSTED 3829 12.34 1.87 17.07 98 HTML_IMAGE_ONLY_24 3796 0.84 1.86 0.38 99 HTML_IMAGE_ONLY_16 3653 0.79 1.79 0.35 100 XM_salutation2 3647 1.03 1.78 0.68 101 TM2_M_VERY_LONG_WORD 3575 1.10 1.75 0.81 102 TR_Mismatch_TLD_02 3571 0.59 1.75 0.07 103 NORMAL_HTTP_TO_IP 3522 0.60 1.72 0.09 104 XMSexyCombo_01 3508 0.82 1.72 0.42 105 MIME_HEADER_CTYPE_ONLY 3402 0.67 1.66 0.22 106 SpammyFromTLD_01 3385 1.06 1.66 0.79 107 HTML_SHORT_LINK_IMG_2 3330 0.56 1.63 0.08 108 HTML_IMAGE_ONLY_04 3316 0.54 1.62 0.05 109 HTML_SHORT_CENTER 3305 0.53 1.62 0.04 110 BAYES_40 3276 2.69 1.60 3.18 111 SHORTENER_SHORT_IMG 3266 0.50 1.60 0.00 112 XM_H_TOP 3264 0.50 1.60 0.00 113 XMSubMetaI_00 3251 1.00 1.59 0.74 114 XMLngstWrd_00 3220 1.03 1.58 0.78 115 DKIM_ADSP_NXDOMAIN 3201 0.85 1.57 0.53 116 XM_UB99 3174 0.50 1.55 0.02 117 XMLngstWrd_01 3164 0.98 1.55 0.72 118 XMDiploma_00 3135 1.49 1.53 1.47 119 XMSubNoVowel 3112 1.00 1.52 0.76 120 NO_DNS_FOR_FROM 3096 1.23 1.52 1.11 121 XM_UB60 3079 0.53 1.51 0.09 122 MAILING_LIST_MULTI 3053 2.01 1.49 2.25 123 XMLngstWrd_02 3050 0.80 1.49 0.49 124 RCVD_IN_IADB_LISTED 2986 4.17 1.46 5.39 125 XMLngstWrd_03 2964 0.63 1.45 0.26 126 XM_ProductURIs 2959 1.21 1.45 1.10 127 BOTNET_NORDNS 2936 0.47 1.44 0.04 128 XMLngstWrd_04 2892 0.57 1.42 0.18 129 T_XMDrugObfuBody_01 2813 0.47 1.38 0.06 130 T_MONEY_PERCENT 2728 0.70 1.33 0.41 131 TR_LOTS_OF_MONEY2 2728 0.70 1.33 0.41 132 XMStockSpam_06 2672 1.27 1.31 1.25 133 URI_TRY_3LD 2665 1.26 1.30 1.24 134 XMPhish11 2654 1.15 1.30 1.09 135 XM_UB999 2625 0.41 1.28 0.02 136 TR_XM_RelayPhish 2557 0.76 1.25 0.54 137 TR_Symld_Words 2525 1.48 1.24 1.59 138 XM_H_Long_From02 2525 1.68 1.24 1.89 139 XM_DrugUnitList 2516 0.39 1.23 0.00 140 T_XMDrugObfuBody_00 2502 1.25 1.22 1.26 141 XMBody_17 2489 0.66 1.22 0.41 142 RELAYCOUNTRY_CN 2422 0.41 1.19 0.06 143 RCVD_IN_IADB_SPF 2360 3.64 1.15 4.76 144 TM2_M_BODY_EMPTY 2270 0.66 1.11 0.45 145 XM_HighProb1 2250 0.36 1.10 0.02 146 XM_BadFromFormat 2240 0.41 1.10 0.10 147 XMGenDplmaNmb 2216 1.00 1.08 0.96 148 FILL_THIS_FORM 2170 0.60 1.06 0.39 149 TR_XM_FormFill 2170 0.38 1.06 0.08 150 URIBL_BLACK 2156 0.36 1.06 0.05 151 XMEmptyBody_01 2151 0.41 1.05 0.12 152 BASE64_LENGTH_79_INF 2136 0.61 1.05 0.42 153 T_XMHurry_00 2128 0.62 1.04 0.43 154 HOSTED_IMG_DIRECT_MX 2128 0.32 1.04 0.00 155 RCVD_IN_IADB_SENDERID 2127 3.22 1.04 4.20 156 URI_NOVOWEL 2118 0.68 1.04 0.52 157 BAYES_05 2118 1.39 1.04 1.55 158 LONG_JUNK_URI 2091 0.36 1.02 0.06 159 XMSubEmpty 2075 0.52 1.02 0.29 160 XMPhish30 2058 0.59 1.01 0.40 161 RCVD_IN_IADB_DK 2057 3.15 1.01 4.11 162 FILL_THIS_FORM_LONG 2023 0.50 0.99 0.28 163 XM_B_REG_HTML 2009 0.58 0.98 0.39 164 RELAYCOUNTRY_DE 2008 0.60 0.98 0.42 165 DIET_1 1980 0.57 0.97 0.40 166 XM_RXBody 1979 0.47 0.97 0.24 167 RCVD_IN_IADB_VOUCHED 1937 2.66 0.95 3.44 168 HK_SCAM 1926 0.31 0.94 0.02 169 PLING_QUERY 1889 0.60 0.92 0.45 170 TO_NO_BRKTS_HTML_IMG 1885 0.37 0.92 0.12 171 BAYES_20 1845 2.02 0.90 2.52 172 FILL_THIS_FORM_LOAN 1837 0.46 0.90 0.26 173 RELAYCOUNTRY_FR 1822 0.41 0.89 0.20 174 XMHTML_After_End 1821 0.55 0.89 0.39 175 URIBL_RHS_DOB 1817 0.31 0.89 0.05 176 XMGetyour 1772 0.29 0.87 0.03 177 SUBJ_ILLEGAL_CHARS 1750 0.28 0.86 0.01 178 SUBJECT_NEEDS_ENCODING 1750 0.28 0.86 0.01 179 RELAYCOUNTRY_AT 1699 0.40 0.83 0.20 180 MONEY_FORM 1678 0.26 0.82 0.01 181 HELO_NODOT 1643 1.44 0.80 1.73 182 HELO_NO_DOMAIN 1643 1.44 0.80 1.73 183 MONEY_FRAUD_8 1592 0.24 0.78 0.00 184 XM_Nigeria_01 1568 0.28 0.77 0.07 185 ADVANCE_FEE_5_NEW_FRM_MNY 1555 0.24 0.76 0.00 186 HDRS_LCASE_IMGONLY 1549 0.26 0.76 0.04 187 XM_DK_Undo_01 1548 1.65 0.76 2.06 188 XM_PDF 1546 3.55 0.76 4.81 189 XMSexyCombo_04 1505 0.29 0.74 0.08 190 XMSubMetaSSx_00 1499 0.43 0.73 0.29 191 XM_H_PHPOS 1484 1.02 0.73 1.15 192 LOW_PRICE 1467 0.74 0.72 0.75 193 FSL_THIS_IS_ADV 1445 0.24 0.71 0.03 194 XMBody_78 1439 0.52 0.70 0.43 195 TR_Caps_n_Bayes_99 1431 0.31 0.70 0.14 196 HTML_FONT_FACE_BAD 1414 0.59 0.69 0.54 197 XM_UB80 1372 0.24 0.67 0.05 198 DATE_IN_PAST_06_12 1363 0.23 0.67 0.04 199 XMSubMetaSxObfu_03 1336 0.47 0.65 0.39 200 XM_XX_Yahoo 1329 0.25 0.65 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 390160 84.26 79.69 86.33 2 DKIM_SIGNED 321117 69.91 67.39 71.05 3 XM_DK_Pass 315498 68.37 65.19 69.81 4 DKIM_VALID 299734 64.88 61.68 66.32 5 DCC_CHECK_NEGATIVE 278710 52.78 33.13 61.67 6 BAYES_50 250712 50.82 40.52 55.47 7 DKIM_VALID_AU 215587 48.57 50.49 47.70 8 XMListUnsubscribeExists 211134 50.62 59.26 46.72 9 XM_H_QuotedFrom 170992 38.49 39.93 37.83 10 DCC_CHECK 164370 45.45 65.55 36.37 11 T_TM2_M_HEADER_IN_MSG 139152 26.18 15.99 30.79 12 DKIM_VALID_EF 121265 24.34 18.82 26.83 13 HTML_FONT_LOW_CONTRAST 117055 26.96 29.31 25.90 14 XMSubLong 98846 22.11 22.63 21.87 15 FVGT_m_MULTI_ODD 92284 21.66 24.39 20.42 16 LOC_TINY_FONT_1 89531 21.69 25.86 19.81 17 MIME_HTML_ONLY 85759 22.41 30.01 18.98 18 MultiRelay 80060 16.49 13.79 17.71 19 ALL_TRUSTED 77133 12.34 1.87 17.07 20 XM_DK_Undo_02 72086 23.94 41.61 15.95 21 T_KAM_HTML_FONT_INVALID 69432 15.68 16.38 15.36 22 BAYES_99 66360 22.44 39.59 14.68 23 BAYES_999 59284 19.23 32.75 13.12 24 XM_DKIMWhitelistDomains 56017 8.56 0.07 12.39 25 XM_Body_Dirty_Words 53945 13.80 17.93 11.94 26 XM_Multi_Part_URI 53724 14.40 19.97 11.89 27 LOTS_OF_MONEY 49169 15.40 25.39 10.88 28 RCVD_IN_RP_SAFE 46770 8.26 3.65 10.35 29 TooManyTo_001 45669 9.33 7.61 10.10 30 BAYES_00 41931 6.55 0.51 9.28 31 RCVD_IN_RP_CERTIFIED 40613 7.06 2.78 8.99 32 LotsOfNums_01 39012 7.49 4.97 8.63 33 T_XMDrugObfuBody_14 37822 8.19 7.80 8.37 34 XM_Evil_Numbers_Gen 37822 9.12 10.79 8.37 35 TR_DCC_Bayes_99 33714 14.83 31.13 7.46 36 HTML_IMAGE_RATIO_02 32856 9.43 14.21 7.27 37 TR_XM_DK_Bayes 30943 4.80 0.28 6.85 38 TR_XM_DK_Bayes1 29600 4.58 0.23 6.55 39 FSL_BULK_SIG 28953 7.41 9.64 6.41 40 BAYES_60 28161 6.02 5.54 6.23 41 XM_H_Long_From01 27849 6.22 6.34 6.16 42 HTML_IMAGE_RATIO_04 27538 6.38 7.02 6.09 43 RELAYCOUNTRY_META 26770 8.85 15.33 5.92 44 TR_XM_DK_Bayes2 26524 4.11 0.21 5.87 45 MIME_QP_LONG_LINE 26204 4.77 2.51 5.80 46 XM_B_Phish_Phrases 25929 5.84 6.07 5.74 47 T_TooManySym_01 24388 4.44 2.32 5.40 48 RCVD_IN_IADB_LISTED 24355 4.17 1.46 5.39 49 XM_SendGrid 24136 4.60 2.95 5.34 50 XM_PDF 21758 3.55 0.76 4.81 51 RCVD_IN_IADB_SPF 21518 3.64 1.15 4.76 52 DKIM_INVALID 21383 5.04 5.71 4.73 53 XMStrtUSub 21359 4.26 3.23 4.73 54 BOTNET_IPINHOSTNAME 21155 7.02 12.21 4.68 55 IN_ZIMBRA_NJ_WHITELIST 20029 3.06 0.02 4.43 56 RCVD_IN_MSPIKE_H2 19591 3.79 2.58 4.33 57 ANY_BOUNCE_MESSAGE 19167 7.93 16.09 4.24 58 BOUNCE_MESSAGE 19165 7.93 16.09 4.24 59 RCVD_IN_IADB_SENDERID 18989 3.22 1.04 4.20 60 RCVD_IN_IADB_DK 18586 3.15 1.01 4.11 61 T_REMOTE_IMAGE 18491 4.41 5.12 4.09 62 BAYES_80 18401 4.73 6.20 4.07 63 FROM_EXCESS_BASE64 17526 4.49 5.85 3.88 64 BOTNET 16450 11.83 29.93 3.64 65 XMSubMetaSx_00 16362 4.46 6.32 3.62 66 RCVD_IN_IADB_VOUCHED 15541 2.66 0.95 3.44 67 XM_UncommonTLD01 14996 5.01 8.75 3.32 68 HTML_IMAGE_RATIO_06 14480 3.56 4.34 3.20 69 XMSexyCombo_05 14359 5.45 10.48 3.18 70 BAYES_40 14350 2.69 1.60 3.18 71 XMNumbers 12331 3.15 4.10 2.73 72 BAYES_95 12287 3.09 3.92 2.72 73 UNPARSEABLE_RELAY 12254 2.51 2.06 2.71 74 TO_MALFORMED 12106 1.85 0.01 2.68 75 BAYES_20 11409 2.02 0.90 2.52 76 HTML_MIME_NO_HTML_TAG 11372 2.82 3.50 2.52 77 MPART_ALT_DIFF 10982 4.15 7.95 2.43 78 UNTRUSTED_Relay 10629 4.27 8.53 2.35 79 HTML_IMAGE_RATIO_08 10524 2.43 2.67 2.33 80 TVD_RCVD_IP 10409 1.66 0.23 2.30 81 MAILING_LIST_MULTI 10160 2.01 1.49 2.25 82 TooManyTo_002 9997 1.72 0.64 2.21 83 RCVD_IN_IADB_OPTIN 9931 1.70 0.60 2.20 84 MIME_HTML_MOSTLY 9381 2.65 3.93 2.08 85 XM_DK_Undo_01 9298 1.65 0.76 2.06 86 TM2_M_URI_OPT_OUT 8800 2.34 3.22 1.95 87 RCVD_IN_MSPIKE_WL 8611 1.50 0.60 1.91 88 RCVD_IN_MSPIKE_H3 8611 1.50 0.60 1.91 89 XM_H_Long_From02 8526 1.68 1.24 1.89 90 XM_UB50 8256 2.53 4.08 1.83 91 XM_SPF_SoftFail 8200 2.28 3.31 1.81 92 T_TooManySym_02 8070 1.42 0.62 1.79 93 IN_HORDE_ADDRESS_BOOK 8055 1.24 0.03 1.78 94 HELO_NODOT 7807 1.44 0.80 1.73 95 HELO_NO_DOMAIN 7806 1.44 0.80 1.73 96 URI_HEX 7787 2.22 3.32 1.72 97 RCVD_IN_RP_RNBL 7740 6.92 18.45 1.71 98 SUBJ_ALL_CAPS 7667 1.80 2.02 1.70 99 XM_DIRTYINTL 7297 2.60 4.77 1.61 100 INVALID_MSGID 7270 1.13 0.08 1.61 101 TR_MetaPhish_Combo_01 7228 1.23 0.43 1.60 102 XM_CamelCaseFrm001 7182 1.84 2.40 1.59 103 TR_Symld_Words 7169 1.48 1.24 1.59 104 BAYES_05 7012 1.39 1.04 1.55 105 T_XMDrugObfuBody_08 6894 1.68 2.02 1.53 106 XMCapTrack 6845 1.11 0.20 1.51 107 XMDiploma_00 6663 1.49 1.53 1.47 108 TooManyTo_003 6567 1.16 0.51 1.45 109 XM_OfRef6 6230 1.87 2.97 1.38 110 RELAYCOUNTRY_CA 6173 1.92 3.13 1.37 111 USER_IN_DEF_DKIM_WL 5834 0.89 0.01 1.29 112 T_XMDrugObfuBody_00 5707 1.25 1.22 1.26 113 XMStockSpam_06 5668 1.27 1.31 1.25 114 URI_TRY_3LD 5589 1.26 1.30 1.24 115 XM_H_PHPOS 5201 1.02 0.73 1.15 116 NO_DNS_FOR_FROM 4998 1.23 1.52 1.11 117 XM_GoogleGroups 4996 0.88 0.38 1.11 118 MIME_HTML_ONLY_MULTI 4995 1.88 3.58 1.11 119 XM_ProductURIs 4991 1.21 1.45 1.10 120 XMPhish11 4910 1.15 1.30 1.09 121 T_FILL_THIS_FORM_SHORT 4748 1.33 1.96 1.05 122 TooManyTo_004 4659 0.84 0.43 1.03 123 RELAYCOUNTRY_GB 4519 1.42 2.36 1.00 124 DKIM_ADSP_CUSTOM_MED 4478 0.88 0.65 0.99 125 XMGenDplmaNmb 4318 1.00 1.08 0.96 126 RELAYCOUNTRY_PH 4234 0.66 0.04 0.94 127 TooManyTo_005 3778 0.69 0.37 0.84 128 XMBdyGiftCard01 3710 1.37 2.60 0.82 129 TM2_M_VERY_LONG_WORD 3652 1.10 1.75 0.81 130 SpammyFromTLD_01 3555 1.06 1.66 0.79 131 XMLngstWrd_00 3521 1.03 1.58 0.78 132 XMSubNoVowel 3423 1.00 1.52 0.76 133 LOW_PRICE 3402 0.74 0.72 0.75 134 XMSubMetaI_00 3332 1.00 1.59 0.74 135 XMLngstWrd_01 3250 0.98 1.55 0.72 136 XM_salutation2 3095 1.03 1.78 0.68 137 T_Symld_Words_02 3043 0.62 0.50 0.67 138 NML_ADSP_CUSTOM_MED 3037 0.65 0.59 0.67 139 XM_H_PHPMailer 3034 0.62 0.51 0.67 140 T_OBFU_PDF_ATTACH 3014 0.51 0.17 0.67 141 XMBrknScrpt_02 2849 0.64 0.65 0.63 142 USER_IN_WHITELIST 2801 0.43 0.00 0.62 143 XMMoneyMeta_00 2783 1.07 2.08 0.62 144 XMNoVowels 2779 0.56 0.44 0.61 145 HTTPS_HTTP_MISMATCH 2694 0.56 0.49 0.60 146 T_TooManySym_03 2635 0.45 0.15 0.58 147 XMGappySubj_01 2614 0.55 0.48 0.58 148 XMBody_95 2510 0.41 0.10 0.56 149 XM_ShortIntro_01 2471 0.50 0.40 0.55 150 TR_XM_RelayPhish 2451 0.76 1.25 0.54 151 HTML_FONT_FACE_BAD 2434 0.59 0.69 0.54 152 DKIM_ADSP_NXDOMAIN 2400 0.85 1.57 0.53 153 AC_DIV_BONANZA 2367 0.38 0.08 0.52 154 URI_NOVOWEL 2339 0.68 1.04 0.52 155 TM2_M_A_HREF_HREF 2304 0.50 0.49 0.51 156 HTML_TAG_BALANCE_BODY 2276 0.50 0.48 0.50 157 XM_E_Blogspot 2215 0.36 0.07 0.49 158 SHORT_HELO_AND_INLINE_IMAGE 2210 0.37 0.11 0.49 159 XMLngstWrd_02 2192 0.80 1.49 0.49 160 XM_B_COPY_HTML 2171 0.52 0.61 0.48 161 XM_URI_RBL 2169 1.62 4.14 0.48 162 FORGED_GMAIL_RCVD 2154 0.50 0.54 0.48 163 FROM_GOV_SPOOF 2134 0.36 0.12 0.47 164 XMSubMetaSxObfu_02 2095 0.42 0.33 0.46 165 T_MANY_PILL_PRICE 2076 0.33 0.05 0.46 166 TM2_M_BODY_EMPTY 2031 0.66 1.11 0.45 167 PLING_QUERY 2023 0.60 0.92 0.45 168 RELAYCOUNTRY_AU 2003 0.45 0.48 0.44 169 MISSING_HEADERS 1966 0.89 1.90 0.44 170 XMBody_78 1963 0.52 0.70 0.43 171 RDNS_DYNAMIC 1931 0.47 0.56 0.43 172 T_XMHurry_00 1925 0.62 1.04 0.43 173 RELAYCOUNTRY_DE 1901 0.60 0.98 0.42 174 XMSexyCombo_01 1900 0.82 1.72 0.42 175 BASE64_LENGTH_79_INF 1899 0.61 1.05 0.42 176 XMPhish14 1886 0.44 0.48 0.42 177 XMBody_17 1859 0.66 1.22 0.41 178 TR_LOTS_OF_MONEY2 1855 0.70 1.33 0.41 179 T_MONEY_PERCENT 1855 0.70 1.33 0.41 180 XMPhish30 1813 0.59 1.01 0.40 181 HTML_IMAGE_ONLY_32 1789 0.38 0.34 0.40 182 DIET_1 1787 0.57 0.97 0.40 183 XM_B_REG_HTML 1779 0.58 0.98 0.39 184 XMDateMe_00 1774 0.39 0.38 0.39 185 XMHTML_After_End 1766 0.55 0.89 0.39 186 XMHTMLBadTable_001 1761 0.47 0.64 0.39 187 HTML_IMAGE_ONLY_28 1758 1.03 2.44 0.39 188 FILL_THIS_FORM 1755 0.60 1.06 0.39 189 XMSubMetaSxObfu_03 1746 0.47 0.65 0.39 190 XMSolicitRefs_0 1719 0.37 0.36 0.38 191 HTML_IMAGE_ONLY_24 1706 0.84 1.86 0.38 192 RCVD_IN_SORBS_DUL 1700 0.34 0.25 0.38 193 REMOVE_BEFORE_LINK 1667 0.39 0.44 0.37 194 XM_H_PHPOS_M 1661 0.34 0.28 0.37 195 XMSlimDrugH 1659 0.44 0.59 0.37 196 FROM_GOV_DKIM_AU 1637 0.28 0.11 0.36 197 MPART_ALT_DIFF_COUNT 1637 0.90 2.08 0.36 198 HTML_IMAGE_ONLY_16 1562 0.79 1.79 0.35 199 RCVD_IN_BL_SPAMCOP_NET 1557 0.83 1.92 0.34 200 NUMERIC_HTTP_ADDR 1481 0.87 2.07 0.33 ----------------------------------------------------------------------