Email: 564462 Autolearn: 0 AvgScore: 2.52 AvgScanTime: 1.94 sec Spam: 149159 Autolearn: 0 AvgScore: 12.63 AvgScanTime: 2.40 sec Ham: 415303 Autolearn: 0 AvgScore: -1.11 AvgScanTime: 1.78 sec Time Spent Running SA: 304.87 hours Time Spent Processing Spam: 99.52 hours Time Spent Processing Ham: 205.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141757 89.40 95.04 87.37 2 DKIM_SIGNED 123717 76.99 82.94 74.85 3 DCC_CHECK 121501 50.94 81.46 39.98 4 XM_DK_Pass 120734 75.46 80.94 73.49 5 DKIM_VALID 113719 71.45 76.24 69.73 6 XMListUnsubscribeExists 110072 55.79 73.80 49.32 7 DKIM_VALID_AU 93565 53.58 62.73 50.30 8 XM_H_QuotedFrom 80311 41.26 53.84 36.74 9 XM_DK_Undo_02 74803 25.42 50.15 16.54 10 BAYES_99 66414 22.87 44.53 15.09 11 HTML_FONT_LOW_CONTRAST 57542 30.13 38.58 27.09 12 BAYES_999 56529 19.95 37.90 13.51 13 TR_DCC_Bayes_99 54404 15.76 36.47 8.33 14 LOC_TINY_FONT_1 52517 25.55 35.21 22.08 15 MIME_HTML_ONLY 51812 25.94 34.74 22.78 16 BAYES_50 48380 45.56 32.44 50.27 17 FVGT_m_MULTI_ODD 39706 21.67 26.62 19.89 18 XMSubLong 38135 23.03 25.57 22.12 19 DKIM_VALID_EF 32549 26.19 21.82 27.76 20 XM_Body_Dirty_Words 29528 14.01 19.80 11.93 21 T_KAM_HTML_FONT_INVALID 29341 17.07 19.67 16.13 22 RELAYCOUNTRY_META 29204 8.80 19.58 4.92 23 T_TM2_M_HEADER_IN_MSG 27371 26.38 18.35 29.27 24 HTML_IMAGE_RATIO_02 25671 11.07 17.21 8.86 25 DCC_CHECK_NEGATIVE 25283 47.26 16.95 58.14 26 XM_Multi_Part_URI 23468 13.95 15.73 13.31 27 LOTS_OF_MONEY 23065 11.64 15.46 10.27 28 MultiRelay 21616 17.23 14.49 18.21 29 FSL_BULK_SIG 21392 8.97 14.34 7.04 30 BOTNET 21179 5.08 14.20 1.81 31 XM_Evil_Numbers_Gen 20309 9.94 13.62 8.63 32 BOTNET_IPINHOSTNAME 19625 7.06 13.16 4.88 33 UNTRUSTED_Relay 18706 4.30 12.54 1.34 34 XMSexyCombo_05 15929 5.84 10.68 4.10 35 T_XMDrugObfuBody_14 14035 8.20 9.41 7.76 36 XM_B_Phish_Phrases 12078 6.69 8.10 6.18 37 TooManyTo_001 11861 7.97 7.95 7.98 38 MPART_ALT_DIFF 11780 4.45 7.90 3.21 39 HTML_IMAGE_RATIO_04 11661 6.21 7.82 5.63 40 BAYES_80 11499 4.99 7.71 4.02 41 XM_UncommonTLD01 11276 4.37 7.56 3.23 42 XMSubMetaSx_00 10995 4.80 7.37 3.88 43 FROM_EXCESS_BASE64 10949 5.13 7.34 4.33 44 XM_H_Long_From01 10698 6.50 7.17 6.26 45 LotsOfNums_01 10370 8.33 6.95 8.82 46 DKIM_INVALID 9998 5.54 6.70 5.12 47 BAYES_60 8972 6.09 6.02 6.12 48 HTML_IMAGE_RATIO_06 8691 4.03 5.83 3.39 49 XM_UB50 8580 2.17 5.75 0.88 50 T_REMOTE_IMAGE 8447 4.44 5.66 4.00 51 XMStrtUSub 7708 4.46 5.17 4.21 52 MIME_HTML_MOSTLY 7097 3.09 4.76 2.49 53 RCVD_IN_RP_SAFE 6942 9.45 4.65 11.17 54 XM_DIRTYINTL 6823 2.60 4.57 1.89 55 NUMERIC_HTTP_ADDR 6818 1.42 4.57 0.29 56 XMNumbers 6240 3.06 4.18 2.66 57 BAYES_95 6197 3.23 4.15 2.89 58 NORMAL_HTTP_TO_IP 6158 1.12 4.13 0.05 59 XM_SendGrid 6100 5.24 4.09 5.65 60 SpammyFromTLD_02 6038 1.39 4.05 0.44 61 TM2_M_URI_OPT_OUT 5807 2.26 3.89 1.68 62 MIME_HTML_ONLY_MULTI 5701 2.16 3.82 1.57 63 HTML_IMAGE_RATIO_08 5620 2.35 3.77 1.85 64 XM_OfRef6 5593 2.10 3.75 1.50 65 RCVD_IN_RP_RNBL 5507 1.00 3.69 0.03 66 RCVD_IN_RP_CERTIFIED 5408 8.07 3.63 9.66 67 XM_CamelCaseFrm001 5373 2.13 3.60 1.60 68 URI_HEX 5359 2.08 3.59 1.53 69 RELAYCOUNTRY_CA 5253 1.91 3.52 1.33 70 XM_SPF_SoftFail 5129 2.41 3.44 2.05 71 XM_URI_RBL 5033 1.30 3.37 0.55 72 HTML_FONT_SIZE_LARGE 4985 1.00 3.34 0.16 73 HTML_IMAGE_ONLY_12 4792 1.03 3.21 0.25 74 BODY_URI_ONLY 4718 0.92 3.16 0.11 75 MIME_QP_LONG_LINE 4513 5.20 3.03 5.98 76 HTML_MIME_NO_HTML_TAG 4423 2.71 2.97 2.62 77 RCVD_IN_MSPIKE_H2 4230 4.18 2.84 4.66 78 XMBdyGiftCard01 4210 1.41 2.82 0.90 79 HTML_SHORT_LINK_IMG_1 4189 0.77 2.81 0.04 80 SpammyFromTLD_01 4095 1.24 2.75 0.69 81 T_TooManySym_01 4073 5.27 2.73 6.18 82 RCVD_IN_BL_SPAMCOP_NET 4052 1.10 2.72 0.52 83 RELAYCOUNTRY_DE 3843 1.07 2.58 0.53 84 XMLongAddy 3791 0.70 2.54 0.03 85 URI_HEX_IP 3746 0.66 2.51 0.00 86 TVD_IP_SING_HEX 3746 0.66 2.51 0.00 87 TVD_IP_HEX 3746 0.66 2.51 0.00 88 XMDiploma_00 3720 1.81 2.49 1.56 89 DKIM_ADSP_NXDOMAIN 3661 1.00 2.45 0.48 90 T_XMDrugObfuBody_08 3576 1.67 2.40 1.41 91 TR_Mismatch_TLD_02 3365 0.65 2.26 0.08 92 XMBody_17 3363 0.94 2.25 0.46 93 MultiRelay_Combo 3289 0.68 2.21 0.14 94 MultiRelay_CC 3289 0.68 2.21 0.14 95 XM_UB99 3289 0.61 2.21 0.04 96 RELAYCOUNTRY_FR 3089 0.70 2.07 0.20 97 HTML_TAG_BALANCE_BODY 2891 0.88 1.94 0.50 98 BAYES_40 2878 3.34 1.93 3.85 99 NO_DNS_FOR_FROM 2823 1.43 1.89 1.27 100 RCVD_IN_IADB_LISTED 2812 4.88 1.89 5.96 101 RCVD_IN_PSBL 2799 0.50 1.88 0.00 102 ALL_TRUSTED 2797 13.06 1.88 17.08 103 UNPARSEABLE_RELAY 2746 2.55 1.84 2.80 104 T_XMDrugObfuBody_00 2733 1.13 1.83 0.88 105 RELAYCOUNTRY_CN 2681 0.52 1.80 0.06 106 XM_UB999 2645 0.49 1.77 0.03 107 XMStockSpam_06 2642 1.55 1.77 1.47 108 SUBJ_ALL_CAPS 2638 2.05 1.77 2.15 109 XMSexyCombo_01 2613 0.84 1.75 0.51 110 RELAYCOUNTRY_GB 2610 1.16 1.75 0.95 111 TM2_M_VERY_LONG_WORD 2589 1.10 1.74 0.87 112 XM_UB60 2486 0.51 1.67 0.10 113 XMGenDplmaNmb 2479 1.06 1.66 0.84 114 TR_LOTS_OF_MONEY3 2473 0.75 1.66 0.42 115 XM_OfRef7 2464 0.60 1.65 0.22 116 T_FILL_THIS_FORM_SHORT 2430 1.08 1.63 0.89 117 XM_salutation2 2324 1.03 1.56 0.84 118 TR_XM_RelayPhish 2317 0.85 1.55 0.59 119 XM_UB80 2281 0.42 1.53 0.02 120 RCVD_IN_IADB_SPF 2272 4.23 1.52 5.21 121 BOTNET_NORDNS 2268 0.42 1.52 0.02 122 FSL_THIS_IS_ADV 2222 0.49 1.49 0.14 123 MAILING_LIST_MULTI 2219 2.12 1.49 2.35 124 BAYES_20 2209 2.54 1.48 2.92 125 XMSubMetaI_00 2208 0.73 1.48 0.46 126 XMPhish30 2149 0.68 1.44 0.40 127 XM_RXBody 2148 0.58 1.44 0.27 128 HK_SCAM 2112 0.39 1.42 0.02 129 XMPhish11 2085 1.30 1.40 1.26 130 XM_H_Long_From02 2054 1.05 1.38 0.93 131 RCVD_IN_IADB_SENDERID 2049 3.75 1.37 4.60 132 FVGT_m_MULTI_ODD_EMAIL 2046 0.39 1.37 0.04 133 XM_ProductURIs 2034 0.89 1.36 0.72 134 XMSubMetaSxObfu_03 2014 0.73 1.35 0.50 135 RCVD_IN_IADB_DK 1990 3.65 1.33 4.48 136 TR_Symld_Words 1962 1.74 1.32 1.89 137 T_XMHurry_00 1948 0.85 1.31 0.69 138 PLING_QUERY 1933 0.65 1.30 0.41 139 URI_TRY_3LD 1925 1.61 1.29 1.72 140 XM_H_PHPOS 1874 1.13 1.26 1.09 141 XM_H_Undi_Recip 1819 0.48 1.22 0.21 142 T_Symld_Words_02 1795 0.78 1.20 0.63 143 MONEY_FORM_SHORT 1756 0.32 1.18 0.01 144 XM_B_REG_HTML 1728 0.60 1.16 0.41 145 XMHTML_After_End 1725 0.57 1.16 0.36 146 ADVANCE_FEE_5_NEW_MONEY 1712 0.30 1.15 0.00 147 SUBJ_DOLLARS 1704 0.67 1.14 0.50 148 TR_XM_Undi_Recip5 1690 0.31 1.13 0.01 149 RCVD_IN_IADB_VOUCHED 1686 3.10 1.13 3.81 150 HTML_IMAGE_ONLY_20 1683 0.50 1.13 0.27 151 TR_LOTS_OF_MONEY2 1681 0.68 1.13 0.52 152 T_MONEY_PERCENT 1681 0.68 1.13 0.52 153 XMSubNoVowel 1674 0.53 1.12 0.32 154 DIET_1 1665 0.52 1.12 0.30 155 RELAYCOUNTRY_IN 1656 0.37 1.11 0.10 156 MIME_HEADER_CTYPE_ONLY 1642 0.39 1.10 0.13 157 FILL_THIS_FORM 1616 0.61 1.08 0.44 158 DATE_IN_PAST_03_06 1593 0.35 1.07 0.10 159 T_HTML_TAG_BALANCE_CENTER 1591 0.35 1.07 0.09 160 XMHTMLBadTable_001 1585 0.78 1.06 0.67 161 XM_HighProb1 1569 0.29 1.05 0.01 162 HTML_SHORT_LINK_IMG_3 1536 0.32 1.03 0.06 163 FROM_SUSPICIOUS_NTLD 1484 0.29 0.99 0.04 164 HDRS_LCASE_IMGONLY 1477 0.29 0.99 0.04 165 RDNS_DYNAMIC 1477 0.61 0.99 0.48 166 XM_OfRef8 1458 0.28 0.98 0.02 167 RELAYCOUNTRY_AT 1445 0.38 0.97 0.16 168 XMBody_78 1443 0.62 0.97 0.50 169 XM_DK_Undo_01 1435 1.59 0.96 1.82 170 MILLION_USD 1409 0.25 0.94 0.00 171 XMSubEmpty 1409 0.44 0.94 0.26 172 DATE_IN_PAST_06_12 1401 0.28 0.94 0.04 173 URIBL_BLACK 1391 0.29 0.93 0.05 174 THIS_AD 1386 0.48 0.93 0.32 175 HTML_FONT_FACE_BAD 1366 0.62 0.92 0.52 176 BAYES_05 1347 1.62 0.90 1.87 177 TooManyTo_002 1312 1.74 0.88 2.05 178 XM_Combo_Sbj 1296 0.34 0.87 0.15 179 RELAYCOUNTRY_UA 1277 0.23 0.86 0.00 180 FILL_THIS_FORM_LONG 1241 0.47 0.83 0.34 181 UNCLAIMED_MONEY 1225 0.22 0.82 0.01 182 XMSubMetaSSx_00 1213 0.32 0.81 0.14 183 LONG_JUNK_URI 1207 0.26 0.81 0.06 184 XMSlimDrugH 1165 0.51 0.78 0.41 185 HELO_NODOT 1163 1.29 0.78 1.47 186 T_TooManySym_02 1146 1.59 0.77 1.89 187 HELO_NO_DOMAIN 1130 1.27 0.76 1.46 188 URI_NOVOWEL 1126 0.59 0.75 0.53 189 FILL_THIS_FORM_LOAN 1116 0.44 0.75 0.32 190 XMSexyCombo_04 1115 0.27 0.75 0.10 191 XM_PDF 1104 3.68 0.74 4.74 192 BAYES_00 1104 9.61 0.74 12.79 193 RCVD_IN_IADB_OPTIN 1096 1.98 0.73 2.42 194 TooManyTo_003 1092 1.18 0.73 1.35 195 BASE64_LENGTH_79_INF 1084 0.42 0.73 0.31 196 RCVD_IN_MSPIKE_WL 1082 1.77 0.73 2.14 197 RCVD_IN_MSPIKE_H3 1082 1.77 0.73 2.14 198 XM_H_PHPMailer 1078 0.61 0.72 0.57 199 TVD_SPACE_RATIO_MINFP 1056 0.19 0.71 0.00 200 TO_EQ_FM_DIRECT_MX 1056 0.21 0.71 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 362846 89.40 95.04 87.37 2 DKIM_SIGNED 310856 76.99 82.94 74.85 3 XM_DK_Pass 305219 75.46 80.94 73.49 4 DKIM_VALID 289574 71.45 76.24 69.73 5 DCC_CHECK_NEGATIVE 241455 47.26 16.95 58.14 6 DKIM_VALID_AU 208881 53.58 62.73 50.30 7 BAYES_50 208785 45.56 32.44 50.27 8 XMListUnsubscribeExists 204839 55.79 73.80 49.32 9 DCC_CHECK 166039 50.94 81.46 39.98 10 XM_H_QuotedFrom 152590 41.26 53.84 36.74 11 T_TM2_M_HEADER_IN_MSG 121561 26.38 18.35 29.27 12 DKIM_VALID_EF 115283 26.19 21.82 27.76 13 HTML_FONT_LOW_CONTRAST 112515 30.13 38.58 27.09 14 MIME_HTML_ONLY 94590 25.94 34.74 22.78 15 XMSubLong 91883 23.03 25.57 22.12 16 LOC_TINY_FONT_1 91711 25.55 35.21 22.08 17 FVGT_m_MULTI_ODD 82614 21.67 26.62 19.89 18 MultiRelay 75638 17.23 14.49 18.21 19 ALL_TRUSTED 70915 13.06 1.88 17.08 20 XM_DK_Undo_02 68699 25.42 50.15 16.54 21 T_KAM_HTML_FONT_INVALID 66999 17.07 19.67 16.13 22 BAYES_99 62672 22.87 44.53 15.09 23 XM_DKIMWhitelistDomains 56926 10.11 0.08 13.71 24 BAYES_999 56098 19.95 37.90 13.51 25 XM_Multi_Part_URI 55277 13.95 15.73 13.31 26 BAYES_00 53120 9.61 0.74 12.79 27 XM_Body_Dirty_Words 49556 14.01 19.80 11.93 28 RCVD_IN_RP_SAFE 46394 9.45 4.65 11.17 29 LOTS_OF_MONEY 42650 11.64 15.46 10.27 30 RCVD_IN_RP_CERTIFIED 40128 8.07 3.63 9.66 31 HTML_IMAGE_RATIO_02 36815 11.07 17.21 8.86 32 LotsOfNums_01 36628 8.33 6.95 8.82 33 TR_XM_DK_Bayes 35887 6.46 0.38 8.64 34 XM_Evil_Numbers_Gen 35826 9.94 13.62 8.63 35 TR_DCC_Bayes_99 34581 15.76 36.47 8.33 36 TR_XM_DK_Bayes1 34012 6.11 0.33 8.19 37 TooManyTo_001 33136 7.97 7.95 7.98 38 T_XMDrugObfuBody_14 32233 8.20 9.41 7.76 39 FSL_BULK_SIG 29217 8.97 14.34 7.04 40 TR_XM_DK_Bayes2 29194 5.24 0.26 7.03 41 XM_H_Long_From01 25989 6.50 7.17 6.26 42 T_TooManySym_01 25663 5.27 2.73 6.18 43 XM_B_Phish_Phrases 25661 6.69 8.10 6.18 44 BAYES_60 25421 6.09 6.02 6.12 45 MIME_QP_LONG_LINE 24827 5.20 3.03 5.98 46 RCVD_IN_IADB_LISTED 24733 4.88 1.89 5.96 47 XM_SendGrid 23475 5.24 4.09 5.65 48 HTML_IMAGE_RATIO_04 23391 6.21 7.82 5.63 49 RCVD_IN_IADB_SPF 21618 4.23 1.52 5.21 50 DKIM_INVALID 21282 5.54 6.70 5.12 51 RELAYCOUNTRY_META 20453 8.80 19.58 4.92 52 BOTNET_IPINHOSTNAME 20253 7.06 13.16 4.88 53 XM_PDF 19666 3.68 0.74 4.74 54 RCVD_IN_MSPIKE_H2 19367 4.18 2.84 4.66 55 RCVD_IN_IADB_SENDERID 19124 3.75 1.37 4.60 56 RCVD_IN_IADB_DK 18621 3.65 1.33 4.48 57 FROM_EXCESS_BASE64 18000 5.13 7.34 4.33 58 XMStrtUSub 17489 4.46 5.17 4.21 59 IN_ZIMBRA_NJ_WHITELIST 17044 3.02 0.02 4.10 60 XMSexyCombo_05 17020 5.84 10.68 4.10 61 BAYES_80 16693 4.99 7.71 4.02 62 T_REMOTE_IMAGE 16621 4.44 5.66 4.00 63 XMSubMetaSx_00 16122 4.80 7.37 3.88 64 BAYES_40 15982 3.34 1.93 3.85 65 RCVD_IN_IADB_VOUCHED 15835 3.10 1.13 3.81 66 HTML_IMAGE_RATIO_06 14063 4.03 5.83 3.39 67 XM_UncommonTLD01 13400 4.37 7.56 3.23 68 MPART_ALT_DIFF 13334 4.45 7.90 3.21 69 TO_MALFORMED 12283 2.18 0.01 2.96 70 BAYES_20 12114 2.54 1.48 2.92 71 BAYES_95 12013 3.23 4.15 2.89 72 UNPARSEABLE_RELAY 11639 2.55 1.84 2.80 73 TVD_RCVD_IP 11324 2.09 0.31 2.73 74 XMNumbers 11050 3.06 4.18 2.66 75 HTML_MIME_NO_HTML_TAG 10863 2.71 2.97 2.62 76 MIME_HTML_MOSTLY 10358 3.09 4.76 2.49 77 RCVD_IN_IADB_OPTIN 10053 1.98 0.73 2.42 78 MAILING_LIST_MULTI 9768 2.12 1.49 2.35 79 SUBJ_ALL_CAPS 8916 2.05 1.77 2.15 80 RCVD_IN_MSPIKE_H3 8888 1.77 0.73 2.14 81 RCVD_IN_MSPIKE_WL 8888 1.77 0.73 2.14 82 XM_SPF_SoftFail 8501 2.41 3.44 2.05 83 TooManyTo_002 8497 1.74 0.88 2.05 84 ANY_BOUNCE_MESSAGE 8296 1.59 0.44 2.00 85 BOUNCE_MESSAGE 8282 1.58 0.44 1.99 86 TO_NO_BRKTS_FROM_MSSP 8086 1.50 0.25 1.95 87 XM_DIRTYINTL 7867 2.60 4.57 1.89 88 TR_Symld_Words 7842 1.74 1.32 1.89 89 T_TooManySym_02 7840 1.59 0.77 1.89 90 BAYES_05 7771 1.62 0.90 1.87 91 HTML_IMAGE_RATIO_08 7664 2.35 3.77 1.85 92 XM_DK_Undo_01 7550 1.59 0.96 1.82 93 BOTNET 7509 5.08 14.20 1.81 94 INVALID_MSGID 7289 1.40 0.40 1.76 95 IN_HORDE_ADDRESS_BOOK 7189 1.28 0.03 1.73 96 URI_TRY_3LD 7138 1.61 1.29 1.72 97 TM2_M_URI_OPT_OUT 6962 2.26 3.89 1.68 98 XM_CamelCaseFrm001 6638 2.13 3.60 1.60 99 MIME_HTML_ONLY_MULTI 6517 2.16 3.82 1.57 100 XMDiploma_00 6478 1.81 2.49 1.56 101 URI_HEX 6359 2.08 3.59 1.53 102 TR_MetaPhish_Combo_01 6349 1.25 0.46 1.53 103 XM_OfRef6 6250 2.10 3.75 1.50 104 HELO_NODOT 6108 1.29 0.78 1.47 105 XMStockSpam_06 6092 1.55 1.77 1.47 106 HELO_NO_DOMAIN 6059 1.27 0.76 1.46 107 T_XMDrugObfuBody_08 5844 1.67 2.40 1.41 108 TooManyTo_003 5591 1.18 0.73 1.35 109 UNTRUSTED_Relay 5555 4.30 12.54 1.34 110 RELAYCOUNTRY_CA 5517 1.91 3.52 1.33 111 USER_IN_DEF_DKIM_WL 5331 0.96 0.05 1.28 112 NO_DNS_FOR_FROM 5258 1.43 1.89 1.27 113 XMCapTrack 5246 0.99 0.23 1.26 114 XMPhish11 5246 1.30 1.40 1.26 115 XM_GoogleGroups 5146 1.03 0.45 1.24 116 DKIM_ADSP_CUSTOM_MED 4810 1.03 0.67 1.16 117 XM_H_PHPOS 4519 1.13 1.26 1.09 118 TooManyTo_004 4109 0.90 0.64 0.99 119 RELAYCOUNTRY_GB 3944 1.16 1.75 0.95 120 XM_H_Long_From02 3861 1.05 1.38 0.93 121 XMBdyGiftCard01 3737 1.41 2.82 0.90 122 T_FILL_THIS_FORM_SHORT 3687 1.08 1.63 0.89 123 T_XMDrugObfuBody_00 3648 1.13 1.83 0.88 124 XM_UB50 3647 2.17 5.75 0.88 125 TM2_M_VERY_LONG_WORD 3618 1.10 1.74 0.87 126 XM_salutation2 3507 1.03 1.56 0.84 127 XMGenDplmaNmb 3494 1.06 1.66 0.84 128 TooManyTo_005 3392 0.75 0.57 0.82 129 NML_ADSP_CUSTOM_MED 3231 0.74 0.64 0.78 130 XM_ProductURIs 2971 0.89 1.36 0.72 131 XMNoVowels 2910 0.67 0.59 0.70 132 SpammyFromTLD_01 2879 1.24 2.75 0.69 133 T_XMHurry_00 2865 0.85 1.31 0.69 134 XMHTMLBadTable_001 2800 0.78 1.06 0.67 135 T_OBFU_PDF_ATTACH 2794 0.54 0.18 0.67 136 XMBody_95 2785 0.52 0.09 0.67 137 USER_IN_WHITELIST 2774 0.49 0.00 0.67 138 TM2_M_A_HREF_HREF 2713 0.62 0.53 0.65 139 XMBrknScrpt_02 2624 0.62 0.58 0.63 140 T_Symld_Words_02 2607 0.78 1.20 0.63 141 XM_D_tchamptons_WL 2562 0.45 0.00 0.62 142 FROM_GOV_SPOOF 2534 0.49 0.17 0.61 143 T_TooManySym_03 2510 0.50 0.21 0.60 144 TR_XM_RelayPhish 2471 0.85 1.55 0.59 145 XM_B_COPY_HTML 2436 0.62 0.70 0.59 146 XMGappySubj_01 2421 0.51 0.31 0.58 147 HTTPS_HTTP_MISMATCH 2379 0.56 0.54 0.57 148 XM_H_PHPMailer 2356 0.61 0.72 0.57 149 XM_URI_RBL 2278 1.30 3.37 0.55 150 XMLngstWrd_00 2273 0.49 0.32 0.55 151 URI_NOVOWEL 2188 0.59 0.75 0.53 152 XM_ShortIntro_01 2186 0.46 0.26 0.53 153 MISSING_HEADERS 2185 0.52 0.49 0.53 154 RELAYCOUNTRY_DE 2181 1.07 2.58 0.53 155 RCVD_IN_BL_SPAMCOP_NET 2180 1.10 2.72 0.52 156 T_MONEY_PERCENT 2172 0.68 1.13 0.52 157 TR_LOTS_OF_MONEY2 2172 0.68 1.13 0.52 158 HTML_FONT_FACE_BAD 2145 0.62 0.92 0.52 159 XMSexyCombo_01 2132 0.84 1.75 0.51 160 XMLngstWrd_01 2107 0.45 0.30 0.51 161 XMSubMetaSxObfu_03 2085 0.73 1.35 0.50 162 SUBJ_DOLLARS 2078 0.67 1.14 0.50 163 FORGED_GMAIL_RCVD 2071 0.51 0.54 0.50 164 HTML_TAG_BALANCE_BODY 2064 0.88 1.94 0.50 165 XMBody_78 2059 0.62 0.97 0.50 166 DKIM_ADSP_NXDOMAIN 2010 1.00 2.45 0.48 167 RDNS_DYNAMIC 1984 0.61 0.99 0.48 168 XMMoneyMeta_00 1936 0.49 0.54 0.47 169 XMBody_17 1924 0.94 2.25 0.46 170 HTML_IMAGE_ONLY_32 1914 0.49 0.56 0.46 171 XMSubMetaI_00 1914 0.73 1.48 0.46 172 RELAYCOUNTRY_AU 1909 0.47 0.51 0.46 173 TM2_M_BODY_EMPTY 1872 0.37 0.15 0.45 174 SpammyFromTLD_02 1833 1.39 4.05 0.44 175 FILL_THIS_FORM 1809 0.61 1.08 0.44 176 AC_DIV_BONANZA 1786 0.34 0.10 0.43 177 SHORT_HELO_AND_INLINE_IMAGE 1784 0.35 0.14 0.43 178 XMSubMetaSxObfu_02 1756 0.41 0.38 0.42 179 TR_LOTS_OF_MONEY3 1755 0.75 1.66 0.42 180 PLING_QUERY 1718 0.65 1.30 0.41 181 XMSlimDrugH 1697 0.51 0.78 0.41 182 XM_B_REG_HTML 1682 0.60 1.16 0.41 183 XMPhish30 1664 0.68 1.44 0.40 184 LOW_PRICE 1641 0.41 0.44 0.40 185 HTML_IMAGE_ONLY_28 1629 0.44 0.58 0.39 186 XMHTML_After_End 1503 0.57 1.16 0.36 187 XMDateMe_00 1503 0.39 0.46 0.36 188 FROM_GOV_DKIM_AU 1498 0.30 0.14 0.36 189 XMLKML 1472 0.26 0.00 0.35 190 XM_shorewaves_Whitelist 1414 0.25 0.00 0.34 191 FILL_THIS_FORM_LONG 1402 0.47 0.83 0.34 192 XMSolicitRefs_0 1394 0.32 0.28 0.34 193 XMRcvdHeader_15 1382 0.24 0.00 0.33 194 REMOVE_BEFORE_LINK 1369 0.40 0.60 0.33 195 XMBSHREFv2 1347 0.35 0.43 0.32 196 FILL_THIS_FORM_LOAN 1345 0.44 0.75 0.32 197 HTML_IMAGE_ONLY_24 1342 0.36 0.44 0.32 198 XMOemUri 1340 0.29 0.18 0.32 199 XMPhish14 1332 0.41 0.66 0.32 200 THIS_AD 1329 0.48 0.93 0.32 ----------------------------------------------------------------------