Email: 465021 Autolearn: 0 AvgScore: 3.28 AvgScanTime: 2.35 sec Spam: 142406 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 2.64 sec Ham: 322615 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 2.22 sec Time Spent Running SA: 303.19 hours Time Spent Processing Spam: 104.61 hours Time Spent Processing Ham: 198.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137349 82.20 96.45 75.91 2 DKIM_SIGNED 124157 71.83 87.19 65.06 3 XM_DK_Pass 121137 70.47 85.06 64.03 4 DKIM_VALID 119612 68.99 83.99 62.37 5 DCC_CHECK 115252 49.23 80.93 35.24 6 XMListUnsubscribeExists 111707 53.82 78.44 42.95 7 DKIM_VALID_AU 95742 53.79 67.23 47.85 8 XM_H_QuotedFrom 78494 39.09 55.12 32.02 9 XM_DK_Undo_02 73761 26.08 51.80 14.73 10 BAYES_99 67042 24.23 47.08 14.15 11 BAYES_999 58006 21.13 40.73 12.48 12 HTML_FONT_LOW_CONTRAST 54033 28.40 37.94 24.19 13 TR_DCC_Bayes_99 54002 16.21 37.92 6.63 14 LOC_TINY_FONT_1 49870 24.30 35.02 19.57 15 BAYES_50 42957 50.56 30.17 59.56 16 FVGT_m_MULTI_ODD 40675 21.74 28.56 18.73 17 MIME_HTML_ONLY 38837 20.53 27.27 17.56 18 XMSubLong 37509 19.63 26.34 16.67 19 DKIM_VALID_EF 27917 20.66 19.60 21.12 20 XM_Body_Dirty_Words 27054 12.99 19.00 10.34 21 HTML_IMAGE_RATIO_02 26854 10.61 18.86 6.98 22 T_TM2_M_HEADER_IN_MSG 26422 24.03 18.55 26.45 23 DCC_CHECK_NEGATIVE 24563 48.89 17.25 62.86 24 XM_Multi_Part_URI 22853 12.02 16.05 10.25 25 BOTNET_IPINHOSTNAME 22370 8.02 15.71 4.62 26 RELAYCOUNTRY_META 21935 7.70 15.40 4.31 27 XM_Evil_Numbers_Gen 21691 9.95 15.23 7.62 28 MultiRelay 20711 14.94 14.54 15.12 29 T_KAM_HTML_FONT_INVALID 20276 11.37 14.24 10.10 30 URIBL_RHS_DOB 20137 7.48 14.14 4.54 31 BOTNET 20046 4.98 14.08 0.97 32 UNTRUSTED_Relay 13982 3.82 9.82 1.18 33 T_XMDrugObfuBody_14 13977 7.28 9.81 6.16 34 XMSexyCombo_05 13516 5.51 9.49 3.76 35 HTML_IMAGE_RATIO_04 13351 6.14 9.38 4.71 36 LOTS_OF_MONEY 13325 6.28 9.36 4.93 37 MPART_ALT_DIFF 13222 4.56 9.28 2.48 38 XM_UncommonTLD01 13000 5.08 9.13 3.29 39 LotsOfNums_01 12599 7.70 8.85 7.19 40 XM_B_Phish_Phrases 12360 6.34 8.68 5.30 41 XM_H_Long_From01 11589 6.27 8.14 5.44 42 TR_XM_DocInvoice 11051 5.35 7.76 4.28 43 RCVD_IN_RP_SAFE 10759 10.35 7.56 11.58 44 BAYES_80 10612 5.14 7.45 4.12 45 TooManyTo_001 10465 7.26 7.35 7.22 46 FROM_EXCESS_BASE64 10115 5.25 7.10 4.44 47 FSL_BULK_SIG 9196 5.90 6.46 5.65 48 XMSubMetaSx_00 9012 4.30 6.33 3.41 49 RCVD_IN_MSPIKE_H2 8785 5.75 6.17 5.57 50 MIME_HTML_MOSTLY 8640 3.70 6.07 2.65 51 RCVD_IN_RP_CERTIFIED 8526 8.61 5.99 9.77 52 BAYES_60 8502 6.26 5.97 6.39 53 RCVD_IN_BL_SPAMCOP_NET 8471 2.11 5.95 0.42 54 HTML_IMAGE_RATIO_06 7817 3.88 5.49 3.16 55 XM_SendGrid 6758 4.42 4.75 4.27 56 XMNumbers 6520 4.32 4.58 4.21 57 BAYES_95 6505 3.26 4.57 2.68 58 RCVD_IN_RP_RNBL 6254 1.39 4.39 0.07 59 TM2_M_URI_OPT_OUT 6093 2.42 4.28 1.60 60 HTML_IMAGE_RATIO_08 5685 2.51 3.99 1.85 61 XM_DIRTYINTL 5478 2.12 3.85 1.36 62 XMSubMetaI_00 5462 2.02 3.84 1.21 63 MIME_QP_LONG_LINE 5320 3.95 3.74 4.05 64 XM_CamelCaseFrm001 5269 2.41 3.70 1.84 65 XM_UB50 5248 1.63 3.69 0.72 66 XMStrtUSub 5161 3.78 3.62 3.85 67 MIME_HTML_ONLY_MULTI 4963 1.77 3.49 1.02 68 DKIM_INVALID 4545 2.84 3.19 2.68 69 RELAYCOUNTRY_FR 4412 1.10 3.10 0.22 70 RELAYCOUNTRY_CA 4397 1.80 3.09 1.23 71 T_TooManySym_01 4185 3.87 2.94 4.28 72 XM_SPF_SoftFail 4172 2.09 2.93 1.72 73 SpammyFromTLD_02 3909 0.94 2.74 0.15 74 URI_HEX 3775 1.48 2.65 0.97 75 XM_URI_RBL 3628 1.26 2.55 0.69 76 XM_H_Long_From02 3501 1.35 2.46 0.85 77 XM_UB99 3251 0.71 2.28 0.01 78 T_XMDrugObfuBody_08 3197 1.58 2.24 1.29 79 XM_OfRef6 3169 1.45 2.23 1.11 80 T_REMOTE_IMAGE 3149 2.62 2.21 2.80 81 XM_XX_Yahoo 3017 0.72 2.12 0.10 82 SUBJ_ALL_CAPS 2915 1.93 2.05 1.88 83 XMSexyCombo_01 2798 1.01 1.96 0.59 84 MultiRelay_Combo 2772 0.70 1.95 0.15 85 MultiRelay_CC 2772 0.70 1.95 0.15 86 T_MIXED_ES 2750 1.35 1.93 1.09 87 BAYES_00 2674 5.06 1.88 6.47 88 XMBdyGiftCard01 2671 1.24 1.88 0.96 89 HTML_MIME_NO_HTML_TAG 2654 1.82 1.86 1.81 90 URIBL_BLACK 2570 0.58 1.80 0.04 91 XMBody_17 2565 0.86 1.80 0.44 92 T_XMDrugObfuBody_00 2525 0.83 1.77 0.41 93 XMDiploma_00 2525 1.27 1.77 1.05 94 TM2_M_VERY_LONG_WORD 2504 1.05 1.76 0.73 95 XMPhish30 2457 0.84 1.73 0.45 96 XM_UB999 2429 0.53 1.71 0.01 97 RCVD_IN_IADB_LISTED 2391 3.06 1.68 3.67 98 XM_ProductURIs 2368 1.69 1.66 1.70 99 TR_XM_DK_Bayes 2317 3.63 1.63 4.51 100 TR_XM_DK_Bayes1 2294 3.50 1.61 4.33 101 TR_XM_DK_Bayes2 2201 3.15 1.55 3.85 102 URIBL_DBL_SPAM 2199 0.48 1.54 0.01 103 TR_XM_RelayPhish 2178 0.77 1.53 0.43 104 XMStockSpam_06 2167 1.35 1.52 1.28 105 T_XMHurry_00 2126 0.82 1.49 0.53 106 SpammyFromTLD_01 2082 0.85 1.46 0.58 107 RCVD_IN_IADB_SPF 2046 2.67 1.44 3.21 108 DIET_1 2039 0.87 1.43 0.63 109 MAILING_LIST_MULTI 2014 1.69 1.41 1.81 110 XM_DK_Undo_01 2000 1.50 1.40 1.54 111 T_Symld_Words_02 1997 0.76 1.40 0.47 112 XM_HighProb1 1940 0.57 1.36 0.22 113 RCVD_IN_IADB_SENDERID 1938 2.40 1.36 2.86 114 RCVD_IN_IADB_DK 1898 2.34 1.33 2.78 115 XMBody_78 1842 0.78 1.29 0.56 116 ALL_TRUSTED 1805 18.88 1.27 26.66 117 RELAYCOUNTRY_AT 1790 0.50 1.26 0.16 118 LongTLD 1785 0.45 1.25 0.09 119 XM_B_COPY_HTML 1782 0.78 1.25 0.57 120 BAYES_40 1781 2.51 1.25 3.07 121 DATE_IN_PAST_06_12 1774 0.41 1.25 0.04 122 PLING_QUERY 1719 0.62 1.21 0.36 123 HTML_TAG_BALANCE_BODY 1641 0.68 1.15 0.46 124 XMGenDplmaNmb 1641 0.80 1.15 0.65 125 UNPARSEABLE_RELAY 1627 2.95 1.14 3.74 126 TR_LOTS_OF_MONEY3 1608 0.60 1.13 0.37 127 XM_H_PHPOS 1604 1.27 1.13 1.33 128 LONG_JUNK_URI 1581 0.40 1.11 0.09 129 RDNS_DYNAMIC 1570 0.63 1.10 0.41 130 BOTNET_NORDNS 1563 0.35 1.10 0.02 131 RCVD_IN_IADB_VOUCHED 1551 2.64 1.09 3.33 132 XM_UB80 1529 0.35 1.07 0.03 133 XM_B_REG_HTML 1491 0.85 1.05 0.76 134 BAYES_20 1472 1.85 1.03 2.21 135 HTML_FONT_FACE_BAD 1469 0.77 1.03 0.65 136 DATE_IN_PAST_03_06 1435 0.36 1.01 0.08 137 TR_Symld_Words 1382 2.68 0.97 3.43 138 SUBJ_DOLLARS 1369 0.54 0.96 0.35 139 TR_LOTS_OF_MONEY2 1345 0.40 0.94 0.15 140 T_MONEY_PERCENT 1345 0.40 0.94 0.15 141 XMMoneyMeta_00 1333 0.60 0.94 0.46 142 XM_UB60 1329 0.33 0.93 0.07 143 XMPhish14 1301 0.44 0.91 0.22 144 RELAYCOUNTRY_DE 1296 0.50 0.91 0.32 145 DKIM_ADSP_NXDOMAIN 1287 0.51 0.90 0.33 146 RELAYCOUNTRY_PL 1279 0.28 0.90 0.01 147 RELAYCOUNTRY_GB 1274 0.95 0.89 0.98 148 FILL_THIS_FORM 1268 0.49 0.89 0.31 149 URI_TRY_3LD 1257 1.00 0.88 1.06 150 RELAYCOUNTRY_CN 1254 0.30 0.88 0.05 151 XMBrknScrpt_02 1248 0.89 0.88 0.89 152 LONG_JUNK_URI3 1246 0.31 0.87 0.06 153 TR_Caps_n_Bayes_99 1218 0.43 0.86 0.24 154 RCVD_IN_PSBL 1204 0.37 0.85 0.16 155 XMSubMetaD_03 1202 0.28 0.84 0.04 156 MPART_ALT_DIFF_COUNT 1195 0.39 0.84 0.19 157 XM_BadFromFormat 1186 0.41 0.83 0.22 158 HTML_FONT_SIZE_HUGE 1144 0.31 0.80 0.10 159 XM_RXBody 1137 0.36 0.80 0.16 160 TooManyTo_002 1126 1.61 0.79 1.97 161 XM_H_PHPMailer 1126 0.73 0.79 0.71 162 XMSubMetaI_01 1120 0.27 0.79 0.04 163 XMClaimOffer 1109 0.33 0.78 0.14 164 XMPhish11 1103 1.03 0.77 1.14 165 XMSubMetaSxObfu_03 1098 0.41 0.77 0.25 166 TR_Mismatch_TLD_02 1094 0.27 0.77 0.05 167 XMHTML_After_End 1079 0.41 0.76 0.26 168 LONG_JUNK_URI2 1075 0.25 0.75 0.02 169 RCVD_IN_MSPIKE_WL 1074 1.09 0.75 1.24 170 RCVD_IN_MSPIKE_H3 1074 1.09 0.75 1.24 171 T_FILL_THIS_FORM_SHORT 1052 0.68 0.74 0.65 172 HTML_TITLE_SUBJ_DIFF 1037 0.28 0.73 0.08 173 XMGppyBdWords 1031 0.29 0.72 0.09 174 XMHTMLBadTable_001 1018 0.59 0.71 0.54 175 XM_S_JOY_D 1017 0.40 0.71 0.26 176 DKIM_ADSP_CUSTOM_MED 994 0.93 0.70 1.03 177 TooManyTo_003 971 1.06 0.68 1.22 178 REMOVE_BEFORE_LINK 970 0.34 0.68 0.19 179 XMSlimDrugH 950 0.40 0.67 0.28 180 XM_PDF 944 2.98 0.66 4.00 181 HTML_IMAGE_ONLY_32 932 0.47 0.65 0.39 182 FILL_THIS_FORM_LONG 917 0.34 0.64 0.21 183 TR_MetaPhish_Combo_01 896 0.71 0.63 0.74 184 BODY_ENHANCEMENT 889 0.21 0.62 0.02 185 T_HTML_TAG_BALANCE_CENTER 884 0.30 0.62 0.16 186 XM_Body_Obfu01 872 0.31 0.61 0.17 187 XM_UB95 870 0.20 0.61 0.01 188 URI_NOVOWEL 865 0.50 0.61 0.45 189 XMSexyCombo_04 864 0.25 0.61 0.10 190 RELAYCOUNTRY_AU 861 0.42 0.60 0.33 191 BAYES_05 860 1.12 0.60 1.35 192 LOW_PRICE 843 0.27 0.59 0.13 193 XMSubNoVowel 843 0.42 0.59 0.34 194 TooManyTo_004 787 0.77 0.55 0.86 195 FILL_THIS_FORM_LOAN 785 0.30 0.55 0.19 196 T_TooManySym_02 774 1.37 0.54 1.73 197 XMSubMetaSSx_00 768 0.30 0.54 0.19 198 INVALID_DATE 751 0.21 0.53 0.08 199 RELAYCOUNTRY_BR 741 0.17 0.52 0.02 200 XM_H_PHPOS_M 739 0.46 0.52 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 244908 82.20 96.45 75.91 2 DKIM_SIGNED 209884 71.83 87.19 65.06 3 XM_DK_Pass 206579 70.47 85.06 64.03 4 DCC_CHECK_NEGATIVE 202797 48.89 17.25 62.86 5 DKIM_VALID 201227 68.99 83.99 62.37 6 BAYES_50 192136 50.56 30.17 59.56 7 DKIM_VALID_AU 154381 53.79 67.23 47.85 8 XMListUnsubscribeExists 138560 53.82 78.44 42.95 9 DCC_CHECK 113688 49.23 80.93 35.24 10 XM_H_QuotedFrom 103291 39.09 55.12 32.02 11 ALL_TRUSTED 85995 18.88 1.27 26.66 12 T_TM2_M_HEADER_IN_MSG 85342 24.03 18.55 26.45 13 HTML_FONT_LOW_CONTRAST 78056 28.40 37.94 24.19 14 DKIM_VALID_EF 68140 20.66 19.60 21.12 15 LOC_TINY_FONT_1 63129 24.30 35.02 19.57 16 FVGT_m_MULTI_ODD 60428 21.74 28.56 18.73 17 MIME_HTML_ONLY 56651 20.53 27.27 17.56 18 XMSubLong 53783 19.63 26.34 16.67 19 MultiRelay 48775 14.94 14.54 15.12 20 XM_DK_Undo_02 47534 26.08 51.80 14.73 21 BAYES_99 45649 24.23 47.08 14.15 22 ANY_BOUNCE_MESSAGE 40845 8.94 0.50 12.66 23 BOUNCE_MESSAGE 40841 8.94 0.50 12.66 24 BAYES_999 40266 21.13 40.73 12.48 25 RCVD_IN_RP_SAFE 37351 10.35 7.56 11.58 26 XM_DKIMWhitelistDomains 36829 7.97 0.16 11.42 27 XM_Body_Dirty_Words 33349 12.99 19.00 10.34 28 XM_Multi_Part_URI 33065 12.02 16.05 10.25 29 T_KAM_HTML_FONT_INVALID 32600 11.37 14.24 10.10 30 RCVD_IN_RP_CERTIFIED 31530 8.61 5.99 9.77 31 XM_Evil_Numbers_Gen 24586 9.95 15.23 7.62 32 TooManyTo_001 23277 7.26 7.35 7.22 33 LotsOfNums_01 23197 7.70 8.85 7.19 34 HTML_IMAGE_RATIO_02 22506 10.61 18.86 6.98 35 TR_DCC_Bayes_99 21396 16.21 37.92 6.63 36 BAYES_00 20876 5.06 1.88 6.47 37 BAYES_60 20610 6.26 5.97 6.39 38 T_XMDrugObfuBody_14 19867 7.28 9.81 6.16 39 FSL_BULK_SIG 18223 5.90 6.46 5.65 40 RCVD_IN_MSPIKE_H2 17968 5.75 6.17 5.57 41 XM_H_Long_From01 17547 6.27 8.14 5.44 42 XM_B_Phish_Phrases 17105 6.34 8.68 5.30 43 IN_ZIMBRA_NJ_WHITELIST 16983 3.66 0.04 5.26 44 LOTS_OF_MONEY 15891 6.28 9.36 4.93 45 HTML_IMAGE_RATIO_04 15205 6.14 9.38 4.71 46 BOTNET_IPINHOSTNAME 14903 8.02 15.71 4.62 47 URIBL_RHS_DOB 14652 7.48 14.14 4.54 48 TR_XM_DK_Bayes 14559 3.63 1.63 4.51 49 FROM_EXCESS_BASE64 14317 5.25 7.10 4.44 50 TR_XM_DK_Bayes1 13984 3.50 1.61 4.33 51 RELAYCOUNTRY_META 13891 7.70 15.40 4.31 52 TR_XM_DocInvoice 13814 5.35 7.76 4.28 53 T_TooManySym_01 13800 3.87 2.94 4.28 54 XM_SendGrid 13790 4.42 4.75 4.27 55 XMNumbers 13581 4.32 4.58 4.21 56 BAYES_80 13302 5.14 7.45 4.12 57 MIME_QP_LONG_LINE 13059 3.95 3.74 4.05 58 XM_PDF 12905 2.98 0.66 4.00 59 TR_XM_DK_Bayes2 12436 3.15 1.55 3.85 60 XMStrtUSub 12421 3.78 3.62 3.85 61 XMSexyCombo_05 12128 5.51 9.49 3.76 62 UNPARSEABLE_RELAY 12075 2.95 1.14 3.74 63 RCVD_IN_IADB_LISTED 11851 3.06 1.68 3.67 64 TR_Symld_Words 11060 2.68 0.97 3.43 65 XMSubMetaSx_00 10992 4.30 6.33 3.41 66 RCVD_IN_IADB_VOUCHED 10729 2.64 1.09 3.33 67 XM_UncommonTLD01 10608 5.08 9.13 3.29 68 RCVD_IN_IADB_SPF 10354 2.67 1.44 3.21 69 HTML_IMAGE_RATIO_06 10204 3.88 5.49 3.16 70 BAYES_40 9914 2.51 1.25 3.07 71 RCVD_IN_IADB_SENDERID 9224 2.40 1.36 2.86 72 T_REMOTE_IMAGE 9048 2.62 2.21 2.80 73 RCVD_IN_IADB_DK 8975 2.34 1.33 2.78 74 DKIM_INVALID 8657 2.84 3.19 2.68 75 BAYES_95 8637 3.26 4.57 2.68 76 MIME_HTML_MOSTLY 8556 3.70 6.07 2.65 77 MPART_ALT_DIFF 7993 4.56 9.28 2.48 78 TVD_RCVD_IP 7431 1.68 0.28 2.30 79 IN_HORDE_ADDRESS_BOOK 7279 1.60 0.10 2.26 80 BAYES_20 7143 1.85 1.03 2.21 81 TooManyTo_002 6344 1.61 0.79 1.97 82 INVALID_MSGID 6320 1.42 0.21 1.96 83 SUBJ_ALL_CAPS 6052 1.93 2.05 1.88 84 TO_MALFORMED 6005 1.29 0.00 1.86 85 HTML_IMAGE_RATIO_08 5973 2.51 3.99 1.85 86 XM_CamelCaseFrm001 5944 2.41 3.70 1.84 87 MAILING_LIST_MULTI 5850 1.69 1.41 1.81 88 HTML_MIME_NO_HTML_TAG 5831 1.82 1.86 1.81 89 T_TooManySym_02 5590 1.37 0.54 1.73 90 XM_SPF_SoftFail 5560 2.09 2.93 1.72 91 XM_ProductURIs 5482 1.69 1.66 1.70 92 HELO_NODOT 5339 1.21 0.22 1.65 93 TM2_M_URI_OPT_OUT 5170 2.42 4.28 1.60 94 XM_DK_Undo_01 4962 1.50 1.40 1.54 95 USER_IN_DEF_DKIM_WL 4579 1.03 0.16 1.42 96 XM_DIRTYINTL 4383 2.12 3.85 1.36 97 BAYES_05 4348 1.12 0.60 1.35 98 XM_H_PHPOS 4285 1.27 1.13 1.33 99 T_XMDrugObfuBody_08 4157 1.58 2.24 1.29 100 XMStockSpam_06 4124 1.35 1.52 1.28 101 RCVD_IN_MSPIKE_H3 4005 1.09 0.75 1.24 102 RCVD_IN_MSPIKE_WL 4005 1.09 0.75 1.24 103 RELAYCOUNTRY_CA 3957 1.80 3.09 1.23 104 TooManyTo_003 3942 1.06 0.68 1.22 105 XMSubMetaI_00 3913 2.02 3.84 1.21 106 UNTRUSTED_Relay 3803 3.82 9.82 1.18 107 RCVD_IN_IADB_OPTIN 3694 0.91 0.37 1.15 108 XMPhish11 3680 1.03 0.77 1.14 109 XM_OfRef6 3588 1.45 2.23 1.11 110 T_MIXED_ES 3505 1.35 1.93 1.09 111 URI_TRY_3LD 3412 1.00 0.88 1.06 112 XMDiploma_00 3374 1.27 1.77 1.05 113 DKIM_ADSP_CUSTOM_MED 3315 0.93 0.70 1.03 114 MIME_HTML_ONLY_MULTI 3288 1.77 3.49 1.02 115 RELAYCOUNTRY_GB 3154 0.95 0.89 0.98 116 BOTNET 3133 4.98 14.08 0.97 117 URI_HEX 3120 1.48 2.65 0.97 118 XMBdyGiftCard01 3112 1.24 1.88 0.96 119 XM_GoogleGroups 2944 0.79 0.50 0.91 120 XMBrknScrpt_02 2883 0.89 0.88 0.89 121 TooManyTo_004 2786 0.77 0.55 0.86 122 USER_IN_WHITELIST 2768 0.60 0.00 0.86 123 XM_H_Long_From02 2755 1.35 2.46 0.85 124 XMCapTrack 2669 0.70 0.42 0.83 125 XMBody_95 2588 0.59 0.12 0.80 126 NML_ADSP_CUSTOM_MED 2545 0.68 0.44 0.79 127 XM_B_REG_HTML 2466 0.85 1.05 0.76 128 TR_MetaPhish_Combo_01 2394 0.71 0.63 0.74 129 TM2_M_VERY_LONG_WORD 2368 1.05 1.76 0.73 130 T_TooManySym_03 2319 0.52 0.08 0.72 131 XM_UB50 2317 1.63 3.69 0.72 132 XM_H_PHPMailer 2283 0.73 0.79 0.71 133 TooManyTo_005 2238 0.62 0.44 0.69 134 XM_URI_RBL 2222 1.26 2.55 0.69 135 XM_ShortIntro_01 2118 0.60 0.48 0.66 136 XMGenDplmaNmb 2093 0.80 1.15 0.65 137 T_FILL_THIS_FORM_SHORT 2093 0.68 0.74 0.65 138 HTML_FONT_FACE_BAD 2090 0.77 1.03 0.65 139 DIET_1 2017 0.87 1.43 0.63 140 XMSexyCombo_01 1902 1.01 1.96 0.59 141 SpammyFromTLD_01 1870 0.85 1.46 0.58 142 XM_B_COPY_HTML 1838 0.78 1.25 0.57 143 XMBody_78 1794 0.78 1.29 0.56 144 XMSubMetaSxObfu_02 1759 0.46 0.26 0.55 145 XM_B_TRADE_HTML 1753 0.51 0.44 0.54 146 XMHTMLBadTable_001 1743 0.59 0.71 0.54 147 T_XMHurry_00 1710 0.82 1.49 0.53 148 T_Symld_Words_02 1532 0.76 1.40 0.47 149 XM_USANA_RCVD 1518 0.33 0.00 0.47 150 HTML_TAG_BALANCE_BODY 1499 0.68 1.15 0.46 151 RCVD_IN_IADB_DOPTIN 1488 0.34 0.06 0.46 152 XMMoneyMeta_00 1479 0.60 0.94 0.46 153 URI_NOVOWEL 1445 0.50 0.61 0.45 154 XMPhish30 1436 0.84 1.73 0.45 155 XMRcvdHeader_15 1423 0.31 0.00 0.44 156 T_OBFU_PDF_ATTACH 1421 0.36 0.17 0.44 157 XMBody_17 1417 0.86 1.80 0.44 158 XM_H_PHPOS_M 1399 0.46 0.52 0.43 159 TR_XM_RelayPhish 1399 0.77 1.53 0.43 160 FORGED_GMAIL_RCVD 1358 0.45 0.51 0.42 161 RCVD_IN_BL_SPAMCOP_NET 1355 2.11 5.95 0.42 162 XMNoVowels 1352 0.41 0.38 0.42 163 RDNS_DYNAMIC 1338 0.63 1.10 0.41 164 T_XMDrugObfuBody_00 1313 0.83 1.77 0.41 165 XMSolicitRefs_0 1292 0.38 0.33 0.40 166 SHORT_HELO_AND_INLINE_IMAGE 1278 0.29 0.04 0.40 167 HTML_IMAGE_ONLY_32 1256 0.47 0.65 0.39 168 T_TooManySym_04 1238 0.27 0.02 0.38 169 MISSING_HEADERS 1208 0.35 0.30 0.37 170 RCVD_IN_SORBS_DUL 1193 0.31 0.17 0.37 171 TR_LOTS_OF_MONEY3 1178 0.60 1.13 0.37 172 PLING_QUERY 1154 0.62 1.21 0.36 173 HTML_IMAGE_ONLY_28 1133 0.33 0.29 0.35 174 SUBJ_DOLLARS 1127 0.54 0.96 0.35 175 XMSubNoVowel 1108 0.42 0.59 0.34 176 XMGappySubj_01 1105 0.34 0.34 0.34 177 RELAYCOUNTRY_AU 1079 0.42 0.60 0.33 178 DKIM_ADSP_NXDOMAIN 1074 0.51 0.90 0.33 179 TM2_M_BODY_EMPTY 1069 0.28 0.15 0.33 180 RELAYCOUNTRY_DE 1048 0.50 0.91 0.32 181 XM_H_SpoofStaff4 1046 0.26 0.12 0.32 182 XMSUPPORT 1027 0.22 0.00 0.32 183 TVD_SPACE_RATIO 1021 0.27 0.17 0.32 184 MSGID_FROM_MTA_HEADER 1019 0.28 0.21 0.32 185 HTML_IMAGE_ONLY_24 1013 0.31 0.30 0.31 186 FILL_THIS_FORM 1006 0.49 0.89 0.31 187 XMSubEmpty 1000 0.28 0.21 0.31 188 NO_DNS_FOR_FROM 995 0.36 0.46 0.31 189 TR_Sbj_FN_Bdy 973 0.25 0.14 0.30 190 AC_DIV_BONANZA 942 0.24 0.13 0.29 191 XMSlimDrugH 913 0.40 0.67 0.28 192 XMDateMe_00 888 0.27 0.27 0.28 193 XMLngstWrd_00 866 0.32 0.44 0.27 194 BAD_ENC_HEADER 851 0.19 0.01 0.26 195 XM_S_JOY_D 850 0.40 0.71 0.26 196 XMHTML_After_End 831 0.41 0.76 0.26 197 XMSubMetaSxObfu_03 822 0.41 0.77 0.25 198 HTML_FONT_SIZE_LARGE 791 0.25 0.26 0.25 199 TR_Caps_n_Bayes_99 785 0.43 0.86 0.24 200 GMD_PDF_EMPTY_BODY 781 0.19 0.07 0.24 ----------------------------------------------------------------------