Email: 613883 Autolearn: 0 AvgScore: 2.43 AvgScanTime: 1.98 sec Spam: 151851 Autolearn: 0 AvgScore: 12.00 AvgScanTime: 2.33 sec Ham: 462032 Autolearn: 0 AvgScore: -0.72 AvgScanTime: 1.86 sec Time Spent Running SA: 337.13 hours Time Spent Processing Spam: 98.24 hours Time Spent Processing Ham: 238.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143656 89.61 94.60 87.97 2 DKIM_SIGNED 125814 76.80 82.85 74.80 3 XM_DK_Pass 119425 74.84 78.65 73.59 4 XMListUnsubscribeExists 117968 57.40 77.69 50.73 5 DCC_CHECK 117853 48.51 77.61 38.94 6 DKIM_VALID 112837 70.98 74.31 69.88 7 DKIM_VALID_AU 89839 52.69 59.16 50.57 8 XM_H_QuotedFrom 71309 38.73 46.96 36.03 9 XM_DK_Undo_02 69096 21.74 45.50 13.93 10 BAYES_99 60167 19.05 39.62 12.29 11 HTML_FONT_LOW_CONTRAST 54764 29.28 36.06 27.06 12 LOC_TINY_FONT_1 54594 25.66 35.95 22.28 13 BAYES_50 53758 48.25 35.40 52.47 14 BAYES_999 50416 16.42 33.20 10.91 15 TR_DCC_Bayes_99 47543 12.22 31.31 5.95 16 MIME_HTML_ONLY 46129 22.13 30.38 19.42 17 XMSubLong 41415 23.78 27.27 22.64 18 FVGT_m_MULTI_ODD 40496 22.19 26.67 20.72 19 DKIM_VALID_EF 31488 25.64 20.74 27.25 20 T_KAM_HTML_FONT_INVALID 31362 17.87 20.65 16.96 21 XM_Body_Dirty_Words 31326 15.09 20.63 13.27 22 DCC_CHECK_NEGATIVE 31192 49.47 20.54 58.98 23 T_TM2_M_HEADER_IN_MSG 28511 28.94 18.78 32.28 24 MultiRelay 27232 18.77 17.93 19.04 25 RELAYCOUNTRY_META 27033 8.19 17.80 5.03 26 BOTNET_IPINHOSTNAME 26628 8.41 17.54 5.41 27 BOTNET 25881 5.57 17.04 1.80 28 XM_Multi_Part_URI 24611 12.53 16.21 11.32 29 HTML_IMAGE_RATIO_02 21634 9.28 14.25 7.65 30 XM_Evil_Numbers_Gen 19226 10.24 12.66 9.45 31 LOTS_OF_MONEY 16665 8.90 10.97 8.22 32 XMSexyCombo_05 16646 5.47 10.96 3.67 33 FSL_BULK_SIG 15403 7.40 10.14 6.50 34 XM_UncommonTLD01 14876 5.15 9.80 3.62 35 UNTRUSTED_Relay 14098 3.34 9.28 1.38 36 T_XMDrugObfuBody_14 13954 8.35 9.19 8.08 37 DKIM_INVALID 12977 5.82 8.55 4.92 38 TooManyTo_001 12671 8.62 8.34 8.71 39 HTML_IMAGE_RATIO_04 12276 6.27 8.08 5.68 40 BAYES_80 11265 4.64 7.42 3.72 41 XM_H_Long_From01 10776 6.81 7.10 6.72 42 XMSubMetaSx_00 10638 4.49 7.01 3.66 43 MPART_ALT_DIFF 10573 4.23 6.96 3.33 44 LotsOfNums_01 10045 8.28 6.62 8.83 45 XM_B_Phish_Phrases 9868 6.22 6.50 6.13 46 BAYES_60 9826 6.01 6.47 5.86 47 XM_SPF_SoftFail 9424 3.03 6.21 1.99 48 XM_DIRTYINTL 9095 3.29 5.99 2.40 49 XMNumbers 8908 3.50 5.87 2.72 50 MIME_HTML_MOSTLY 7396 2.92 4.87 2.28 51 FROM_EXCESS_BASE64 7016 4.54 4.62 4.51 52 XM_CamelCaseFrm001 6592 2.57 4.34 1.98 53 BAYES_95 6552 2.91 4.31 2.45 54 HTML_IMAGE_RATIO_06 6486 3.57 4.27 3.34 55 XM_SendGrid 6186 5.41 4.07 5.85 56 URI_HEX 6127 2.07 4.03 1.42 57 RELAYCOUNTRY_CA 6046 2.08 3.98 1.45 58 HTML_MIME_NO_HTML_TAG 6029 2.60 3.97 2.14 59 TM2_M_URI_OPT_OUT 5984 2.26 3.94 1.70 60 XMStrtUSub 5621 4.34 3.70 4.54 61 MIME_HTML_ONLY_MULTI 5486 2.11 3.61 1.62 62 RELAYCOUNTRY_FR 5389 1.08 3.55 0.27 63 MIME_QP_LONG_LINE 5381 5.50 3.54 6.14 64 XM_UB50 5336 1.49 3.51 0.82 65 XM_URI_RBL 5280 1.27 3.48 0.55 66 TR_XM_PHPDW 5272 2.13 3.47 1.68 67 TR_XM_PHPForged 5265 2.13 3.47 1.68 68 TR_XM_FormFill2 5243 2.12 3.45 1.68 69 XM_H_PHPOS 5188 2.10 3.42 1.67 70 RCVD_IN_RP_SAFE 4920 8.39 3.24 10.09 71 XM_H_PHPMailer 4745 1.19 3.12 0.56 72 XMSubMetaI_00 4676 1.37 3.08 0.81 73 FROM_SUSPICIOUS_NTLD 4675 0.93 3.08 0.22 74 T_REMOTE_IMAGE 4662 3.85 3.07 4.10 75 XMDiploma_00 4488 2.10 2.96 1.82 76 HTML_IMAGE_RATIO_08 4448 2.25 2.93 2.03 77 XMBdyGiftCard01 4423 1.56 2.91 1.12 78 DKIM_ADSP_NXDOMAIN 4198 1.02 2.76 0.45 79 RCVD_IN_BL_SPAMCOP_NET 4163 1.15 2.74 0.63 80 T_TooManySym_01 4096 4.77 2.70 5.45 81 SpammyFromTLD_02 4045 0.92 2.66 0.34 82 RCVD_IN_MSPIKE_H2 3987 3.96 2.63 4.39 83 RELAYCOUNTRY_DE 3876 0.84 2.55 0.28 84 SpammyFromTLD_01 3853 1.32 2.54 0.92 85 XM_OfRef6 3845 1.65 2.53 1.36 86 SUBJ_ALL_CAPS 3831 2.00 2.52 1.83 87 NUMERIC_HTTP_ADDR 3672 0.82 2.42 0.29 88 RCVD_IN_RP_CERTIFIED 3652 7.51 2.40 9.19 89 RCVD_IN_RP_RNBL 3528 0.60 2.32 0.04 90 NORMAL_HTTP_TO_IP 3297 0.60 2.17 0.08 91 XMGenDplmaNmb 3256 1.37 2.14 1.12 92 T_XMDrugObfuBody_08 3200 1.57 2.11 1.40 93 BAD_ENC_HEADER 3109 0.54 2.05 0.04 94 RCVD_IN_IADB_LISTED 3025 4.98 1.99 5.96 95 NO_DNS_FOR_FROM 3014 1.34 1.98 1.13 96 XMSexyCombo_01 2989 0.87 1.97 0.51 97 ALL_TRUSTED 2910 12.86 1.92 16.46 98 BAYES_40 2850 3.88 1.88 4.54 99 MultiRelay_CC 2809 0.58 1.85 0.16 100 MultiRelay_Combo 2809 0.58 1.85 0.16 101 TR_XM_DK_SendGrid 2804 2.66 1.85 2.93 102 XMBody_78 2742 0.75 1.81 0.41 103 XMStockSpam_06 2631 1.37 1.73 1.26 104 TM2_M_VERY_LONG_WORD 2604 1.20 1.71 1.04 105 MAILING_LIST_MULTI 2601 2.48 1.71 2.73 106 BAYES_05 2528 1.95 1.66 2.04 107 RCVD_IN_IADB_SPF 2525 4.37 1.66 5.26 108 XMSubMetaSxObfu_03 2485 0.70 1.64 0.39 109 XMSubMetaI_01 2445 0.48 1.61 0.11 110 XMMoneyMeta_00 2378 0.87 1.57 0.64 111 RCVD_IN_IADB_SENDERID 2332 3.87 1.54 4.64 112 BAYES_20 2318 2.88 1.53 3.32 113 RCVD_IN_IADB_DK 2267 3.81 1.49 4.58 114 BAYES_00 2266 10.12 1.49 12.95 115 XMBody_17 2251 0.76 1.48 0.52 116 TR_XM_RelayPhish 2177 0.88 1.43 0.70 117 XMHTML_After_End 2167 0.66 1.43 0.41 118 BOTNET_NORDNS 2145 0.36 1.41 0.01 119 T_XMHurry_00 2056 0.90 1.35 0.75 120 XMBrknScrpt_02 2001 0.75 1.32 0.57 121 UNPARSEABLE_RELAY 1993 2.76 1.31 3.23 122 XM_UB99 1986 0.35 1.31 0.04 123 XMPhish30 1972 0.65 1.30 0.44 124 XMGetyour 1959 0.33 1.29 0.02 125 RELAYCOUNTRY_GB 1943 1.09 1.28 1.03 126 XMHTMLBadTable_001 1903 0.69 1.25 0.51 127 URI_TRY_3LD 1881 1.31 1.24 1.33 128 XM_H_Long_From02 1865 0.99 1.23 0.91 129 XMGppyBdWords 1856 0.54 1.22 0.32 130 XM_UB60 1802 0.36 1.19 0.09 131 T_XMDrugObfuBody_00 1788 0.79 1.18 0.66 132 URIBL_BLACK 1765 0.33 1.16 0.06 133 XMPhish11 1736 1.12 1.14 1.12 134 TR_LOTS_OF_MONEY2 1729 0.49 1.14 0.28 135 T_MONEY_PERCENT 1729 0.49 1.14 0.28 136 PLING_QUERY 1728 0.72 1.14 0.58 137 RCVD_IN_IADB_VOUCHED 1724 3.13 1.14 3.78 138 XMPhish14 1703 0.52 1.12 0.32 139 TR_Symld_Words 1669 1.54 1.10 1.69 140 T_FILL_THIS_FORM_SHORT 1633 1.05 1.08 1.04 141 XM_UB999 1596 0.28 1.05 0.03 142 XM_HighProb1 1579 0.30 1.04 0.06 143 NORDNS_LOW_CONTRAST 1558 0.26 1.03 0.01 144 T_Symld_Words_02 1475 0.57 0.97 0.43 145 XM_H_PHPOS_M 1417 0.39 0.93 0.21 146 DIET_1 1412 0.47 0.93 0.31 147 SUBJ_DOLLARS 1409 0.48 0.93 0.33 148 THIS_AD 1396 0.41 0.92 0.25 149 FILL_THIS_FORM 1351 0.49 0.89 0.36 150 XM_B_REG_HTML 1305 0.60 0.86 0.51 151 XMSexyCombo_04 1298 0.26 0.85 0.06 152 XM_ProductURIs 1287 0.69 0.85 0.63 153 XM_XX_Yahoo 1277 0.36 0.84 0.20 154 URI_NOVOWEL 1257 0.50 0.83 0.39 155 HELO_NODOT 1249 1.58 0.82 1.82 156 XM_S_JOY_D 1248 0.45 0.82 0.33 157 XMSlimDrugH 1247 0.45 0.82 0.33 158 FILL_THIS_FORM_LONG 1245 0.42 0.82 0.29 159 LONG_JUNK_URI 1224 0.24 0.81 0.06 160 HELO_NO_DOMAIN 1209 1.57 0.80 1.82 161 TR_Mismatch_TLD_02 1203 0.25 0.79 0.07 162 XM_DK_Undo_01 1202 1.61 0.79 1.88 163 XM_UB80 1185 0.22 0.78 0.03 164 XM_B_COPY_HTML 1180 0.61 0.78 0.56 165 RCVD_IN_IADB_OPTIN 1177 2.00 0.78 2.40 166 RDNS_DYNAMIC 1168 0.50 0.77 0.41 167 T_TooManySym_02 1155 1.56 0.76 1.82 168 HTML_FONT_FACE_BAD 1152 0.57 0.76 0.51 169 TR_Caps_n_Bayes_99 1151 0.29 0.76 0.14 170 TooManyTo_002 1148 1.94 0.76 2.34 171 XM_PDF 1127 3.65 0.74 4.61 172 RELAYCOUNTRY_AT 1125 0.35 0.74 0.23 173 MPART_ALT_DIFF_COUNT 1122 0.38 0.74 0.26 174 TR_LOTS_OF_MONEY3 1096 0.40 0.72 0.29 175 XMSubMetaD_03 1060 0.31 0.70 0.19 176 URIBL_DBL_SPAM 1059 0.18 0.70 0.01 177 XM_RXBody 1031 0.34 0.68 0.23 178 DATE_IN_PAST_03_06 1030 0.28 0.68 0.15 179 DKIM_ADSP_CUSTOM_MED 1025 0.98 0.68 1.08 180 FILL_THIS_FORM_LOAN 1022 0.38 0.67 0.29 181 HTML_IMAGE_ONLY_28 1016 0.45 0.67 0.38 182 FROM_DOMAIN_NOVOWEL 1012 0.18 0.67 0.02 183 TM2_M_A_HREF_HREF 1011 0.46 0.67 0.40 184 XM_Combo_Sbj 1007 0.38 0.66 0.29 185 HTTPS_HTTP_MISMATCH 990 0.62 0.65 0.61 186 NML_ADSP_CUSTOM_MED 970 0.68 0.64 0.69 187 XM_OfRef7 969 0.32 0.64 0.22 188 RELAYCOUNTRY_AU 963 0.54 0.63 0.51 189 RELAYCOUNTRY_CN 932 0.20 0.61 0.06 190 TR_MetaPhish_Combo_01 908 1.48 0.60 1.77 191 URIBL_ABUSE_SURBL 906 0.20 0.60 0.07 192 XM_Lotto 904 0.21 0.60 0.09 193 HTML_IMAGE_ONLY_32 900 0.45 0.59 0.41 194 XMGappySubj_01 881 0.54 0.58 0.52 195 BODY_ENHANCEMENT 876 0.17 0.58 0.04 196 TR_XM_DK_Bayes 876 7.89 0.58 10.30 197 XM_BadFromFormat 863 0.23 0.57 0.12 198 TooManyTo_003 856 1.29 0.56 1.52 199 RELAYCOUNTRY_NL 848 0.28 0.56 0.19 200 FORGED_GMAIL_RCVD 830 0.53 0.55 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 406453 89.61 94.60 87.97 2 DKIM_SIGNED 345620 76.80 82.85 74.80 3 XM_DK_Pass 339997 74.84 78.65 73.59 4 DKIM_VALID 322886 70.98 74.31 69.88 5 DCC_CHECK_NEGATIVE 272497 49.47 20.54 58.98 6 BAYES_50 242444 48.25 35.40 52.47 7 XMListUnsubscribeExists 234388 57.40 77.69 50.73 8 DKIM_VALID_AU 233632 52.69 59.16 50.57 9 DCC_CHECK 179926 48.51 77.61 38.94 10 XM_H_QuotedFrom 166463 38.73 46.96 36.03 11 T_TM2_M_HEADER_IN_MSG 149140 28.94 18.78 32.28 12 DKIM_VALID_EF 125896 25.64 20.74 27.25 13 HTML_FONT_LOW_CONTRAST 125006 29.28 36.06 27.06 14 XMSubLong 104589 23.78 27.27 22.64 15 LOC_TINY_FONT_1 102934 25.66 35.95 22.28 16 FVGT_m_MULTI_ODD 95736 22.19 26.67 20.72 17 MIME_HTML_ONLY 89716 22.13 30.38 19.42 18 MultiRelay 87969 18.77 17.93 19.04 19 T_KAM_HTML_FONT_INVALID 78349 17.87 20.65 16.96 20 ALL_TRUSTED 76065 12.86 1.92 16.46 21 XM_DK_Undo_02 64347 21.74 45.50 13.93 22 XM_Body_Dirty_Words 61300 15.09 20.63 13.27 23 BAYES_00 59845 10.12 1.49 12.95 24 XM_DKIMWhitelistDomains 57828 9.43 0.02 12.52 25 BAYES_99 56782 19.05 39.62 12.29 26 XM_Multi_Part_URI 52305 12.53 16.21 11.32 27 BAYES_999 50399 16.42 33.20 10.91 28 TR_XM_DK_Bayes 47585 7.89 0.58 10.30 29 RCVD_IN_RP_SAFE 46612 8.39 3.24 10.09 30 TR_XM_DK_Bayes1 45233 7.49 0.48 9.79 31 XM_Evil_Numbers_Gen 43647 10.24 12.66 9.45 32 RCVD_IN_RP_CERTIFIED 42453 7.51 2.40 9.19 33 LotsOfNums_01 40808 8.28 6.62 8.83 34 TooManyTo_001 40230 8.62 8.34 8.71 35 TR_XM_DK_Bayes2 39527 6.54 0.42 8.56 36 LOTS_OF_MONEY 37994 8.90 10.97 8.22 37 T_XMDrugObfuBody_14 37324 8.35 9.19 8.08 38 HTML_IMAGE_RATIO_02 35363 9.28 14.25 7.65 39 XM_H_Long_From01 31027 6.81 7.10 6.72 40 FSL_BULK_SIG 30024 7.40 10.14 6.50 41 MIME_QP_LONG_LINE 28381 5.50 3.54 6.14 42 XM_B_Phish_Phrases 28343 6.22 6.50 6.13 43 RCVD_IN_IADB_LISTED 27550 4.98 1.99 5.96 44 TR_DCC_Bayes_99 27481 12.22 31.31 5.95 45 BAYES_60 27094 6.01 6.47 5.86 46 XM_SendGrid 27040 5.41 4.07 5.85 47 HTML_IMAGE_RATIO_04 26233 6.27 8.08 5.68 48 T_TooManySym_01 25192 4.77 2.70 5.45 49 BOTNET_IPINHOSTNAME 25002 8.41 17.54 5.41 50 RCVD_IN_IADB_SPF 24317 4.37 1.66 5.26 51 RELAYCOUNTRY_META 23237 8.19 17.80 5.03 52 DKIM_INVALID 22734 5.82 8.55 4.92 53 RCVD_IN_IADB_SENDERID 21432 3.87 1.54 4.64 54 XM_PDF 21277 3.65 0.74 4.61 55 RCVD_IN_IADB_DK 21146 3.81 1.49 4.58 56 XMStrtUSub 20992 4.34 3.70 4.54 57 BAYES_40 20978 3.88 1.88 4.54 58 FROM_EXCESS_BASE64 20852 4.54 4.62 4.51 59 RCVD_IN_MSPIKE_H2 20305 3.96 2.63 4.39 60 T_REMOTE_IMAGE 18965 3.85 3.07 4.10 61 IN_ZIMBRA_NJ_WHITELIST 18858 3.08 0.02 4.08 62 RCVD_IN_IADB_VOUCHED 17471 3.13 1.14 3.78 63 BAYES_80 17195 4.64 7.42 3.72 64 XMSexyCombo_05 16954 5.47 10.96 3.67 65 XMSubMetaSx_00 16899 4.49 7.01 3.66 66 XM_UncommonTLD01 16748 5.15 9.80 3.62 67 HTML_IMAGE_RATIO_06 15409 3.57 4.27 3.34 68 MPART_ALT_DIFF 15404 4.23 6.96 3.33 69 BAYES_20 15346 2.88 1.53 3.32 70 UNPARSEABLE_RELAY 14941 2.76 1.31 3.23 71 TO_MALFORMED 14858 2.42 0.01 3.22 72 TVD_RCVD_IP 13856 2.34 0.34 3.00 73 TR_XM_DK_SendGrid 13530 2.66 1.85 2.93 74 RCVD_IN_MSPIKE_WL 12841 2.21 0.46 2.78 75 RCVD_IN_MSPIKE_H3 12836 2.21 0.46 2.78 76 MAILING_LIST_MULTI 12618 2.48 1.71 2.73 77 XMNumbers 12574 3.50 5.87 2.72 78 BAYES_95 11319 2.91 4.31 2.45 79 XM_DIRTYINTL 11100 3.29 5.99 2.40 80 RCVD_IN_IADB_OPTIN 11084 2.00 0.78 2.40 81 TooManyTo_002 10792 1.94 0.76 2.34 82 MIME_HTML_MOSTLY 10524 2.92 4.87 2.28 83 HTML_MIME_NO_HTML_TAG 9902 2.60 3.97 2.14 84 BAYES_05 9424 1.95 1.66 2.04 85 HTML_IMAGE_RATIO_08 9383 2.25 2.93 2.03 86 XM_SPF_SoftFail 9173 3.03 6.21 1.99 87 XM_CamelCaseFrm001 9160 2.57 4.34 1.98 88 XM_DK_Undo_01 8686 1.61 0.79 1.88 89 SUBJ_ALL_CAPS 8450 2.00 2.52 1.83 90 ANY_BOUNCE_MESSAGE 8444 1.46 0.36 1.83 91 BOUNCE_MESSAGE 8443 1.46 0.36 1.83 92 HELO_NODOT 8424 1.58 0.82 1.82 93 HELO_NO_DOMAIN 8421 1.57 0.80 1.82 94 T_TooManySym_02 8417 1.56 0.76 1.82 95 XMDiploma_00 8390 2.10 2.96 1.82 96 BOTNET 8298 5.57 17.04 1.80 97 IN_HORDE_ADDRESS_BOOK 8197 1.34 0.03 1.77 98 TR_MetaPhish_Combo_01 8191 1.48 0.60 1.77 99 TM2_M_URI_OPT_OUT 7868 2.26 3.94 1.70 100 TR_Symld_Words 7810 1.54 1.10 1.69 101 TR_XM_PHPForged 7784 2.13 3.47 1.68 102 TR_XM_PHPDW 7777 2.13 3.47 1.68 103 TR_XM_FormFill2 7765 2.12 3.45 1.68 104 XM_H_PHPOS 7699 2.10 3.42 1.67 105 MIME_HTML_ONLY_MULTI 7492 2.11 3.61 1.62 106 INVALID_MSGID 7378 1.23 0.11 1.60 107 XMCapTrack 7082 1.23 0.29 1.53 108 TooManyTo_003 7034 1.29 0.56 1.52 109 RELAYCOUNTRY_CA 6717 2.08 3.98 1.45 110 URI_HEX 6571 2.07 4.03 1.42 111 T_XMDrugObfuBody_08 6449 1.57 2.11 1.40 112 UNTRUSTED_Relay 6399 3.34 9.28 1.38 113 XM_OfRef6 6302 1.65 2.53 1.36 114 URI_TRY_3LD 6149 1.31 1.24 1.33 115 XMStockSpam_06 5802 1.37 1.73 1.26 116 XM_GoogleGroups 5658 1.03 0.44 1.22 117 TooManyTo_004 5238 0.96 0.43 1.13 118 NO_DNS_FOR_FROM 5231 1.34 1.98 1.13 119 XMGenDplmaNmb 5162 1.37 2.14 1.12 120 XMPhish11 5156 1.12 1.14 1.12 121 XMBdyGiftCard01 5152 1.56 2.91 1.12 122 DKIM_ADSP_CUSTOM_MED 4971 0.98 0.68 1.08 123 USER_IN_DEF_DKIM_WL 4849 0.79 0.01 1.05 124 T_FILL_THIS_FORM_SHORT 4800 1.05 1.08 1.04 125 TM2_M_VERY_LONG_WORD 4793 1.20 1.71 1.04 126 RELAYCOUNTRY_GB 4776 1.09 1.28 1.03 127 TooManyTo_005 4423 0.81 0.36 0.96 128 SpammyFromTLD_01 4268 1.32 2.54 0.92 129 XM_H_Long_From02 4217 0.99 1.23 0.91 130 XM_UB50 3802 1.49 3.51 0.82 131 XMSubMetaI_00 3730 1.37 3.08 0.81 132 T_XMHurry_00 3461 0.90 1.35 0.75 133 TO_NO_BRKTS_HTML_ONLY 3445 0.63 0.27 0.75 134 TR_XM_RelayPhish 3231 0.88 1.43 0.70 135 NML_ADSP_CUSTOM_MED 3208 0.68 0.64 0.69 136 USER_IN_WHITELIST 3200 0.52 0.00 0.69 137 T_XMDrugObfuBody_00 3071 0.79 1.18 0.66 138 XMLngstWrd_00 2964 0.57 0.35 0.64 139 XMMoneyMeta_00 2936 0.87 1.57 0.64 140 XM_ProductURIs 2927 0.69 0.85 0.63 141 RCVD_IN_BL_SPAMCOP_NET 2892 1.15 2.74 0.63 142 HTTPS_HTTP_MISMATCH 2829 0.62 0.65 0.61 143 T_OBFU_PDF_ATTACH 2774 0.50 0.18 0.60 144 XMLngstWrd_01 2740 0.53 0.33 0.59 145 PLING_QUERY 2684 0.72 1.14 0.58 146 T_TooManySym_03 2654 0.49 0.22 0.57 147 XMNoVowels 2638 0.55 0.50 0.57 148 XMBrknScrpt_02 2629 0.75 1.32 0.57 149 XM_B_COPY_HTML 2589 0.61 0.78 0.56 150 XM_H_PHPMailer 2576 1.19 3.12 0.56 151 XM_ShortIntro_01 2572 0.49 0.29 0.56 152 XM_URI_RBL 2547 1.27 3.48 0.55 153 XMBody_95 2537 0.44 0.11 0.55 154 FORGED_GMAIL_RCVD 2427 0.53 0.55 0.53 155 XMGappySubj_01 2410 0.54 0.58 0.52 156 XMBody_17 2408 0.76 1.48 0.52 157 HTML_FONT_FACE_BAD 2368 0.57 0.76 0.51 158 XM_B_REG_HTML 2364 0.60 0.86 0.51 159 RELAYCOUNTRY_AU 2361 0.54 0.63 0.51 160 SHORT_HELO_AND_INLINE_IMAGE 2358 0.39 0.03 0.51 161 XMSexyCombo_01 2356 0.87 1.97 0.51 162 XMHTMLBadTable_001 2338 0.69 1.25 0.51 163 FROM_GOV_SPOOF 2330 0.44 0.24 0.50 164 MISSING_HEADERS 2286 0.45 0.31 0.49 165 XMSubMetaSxObfu_02 2247 0.43 0.28 0.49 166 HTML_TAG_BALANCE_BODY 2201 0.49 0.52 0.48 167 DKIM_ADSP_NXDOMAIN 2093 1.02 2.76 0.45 168 XMPhish30 2017 0.65 1.30 0.44 169 XMDateMe_00 2011 0.40 0.29 0.44 170 T_Symld_Words_02 2002 0.57 0.97 0.43 171 RCVD_IN_SORBS_DUL 1901 0.39 0.32 0.41 172 XMHTML_After_End 1896 0.66 1.43 0.41 173 RDNS_DYNAMIC 1892 0.50 0.77 0.41 174 HTML_IMAGE_ONLY_32 1891 0.45 0.59 0.41 175 XMBody_78 1882 0.75 1.81 0.41 176 TM2_M_BODY_EMPTY 1849 0.35 0.19 0.40 177 TM2_M_A_HREF_HREF 1837 0.46 0.67 0.40 178 XMSubMetaSxObfu_03 1825 0.70 1.64 0.39 179 URI_NOVOWEL 1815 0.50 0.83 0.39 180 XM_Body_Obfu01 1808 0.39 0.39 0.39 181 XMSubNoVowel 1806 0.41 0.48 0.39 182 HTML_IMAGE_ONLY_28 1756 0.45 0.67 0.38 183 AC_DIV_BONANZA 1696 0.32 0.17 0.37 184 FROM_GOV_DKIM_AU 1685 0.30 0.10 0.36 185 REMOVE_BEFORE_LINK 1680 0.40 0.52 0.36 186 FILL_THIS_FORM 1661 0.49 0.89 0.36 187 HTML_IMAGE_ONLY_24 1593 0.33 0.30 0.34 188 SpammyFromTLD_02 1590 0.92 2.66 0.34 189 XMLKML 1582 0.26 0.00 0.34 190 FSL_THIS_IS_ADV 1578 0.33 0.31 0.34 191 XM_S_JOY_D 1538 0.45 0.82 0.33 192 SUBJ_DOLLARS 1537 0.48 0.93 0.33 193 XMSlimDrugH 1522 0.45 0.82 0.33 194 XM_USANA_RCVD 1508 0.25 0.00 0.33 195 XMPhish14 1490 0.52 1.12 0.32 196 XMGppyBdWords 1477 0.54 1.22 0.32 197 DIET_1 1448 0.47 0.93 0.31 198 BASE64_LENGTH_79_INF 1437 0.25 0.08 0.31 199 XMLngstWrd_02 1395 0.30 0.28 0.30 200 XM_B_TRADE_HTML 1373 0.30 0.30 0.30 ----------------------------------------------------------------------