Email: 315675 Autolearn: 0 AvgScore: 3.10 AvgScanTime: 1.65 sec Spam: 95782 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 2.04 sec Ham: 219893 Autolearn: 0 AvgScore: -1.09 AvgScanTime: 1.48 sec Time Spent Running SA: 144.54 hours Time Spent Processing Spam: 54.29 hours Time Spent Processing Ham: 90.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 91513 78.71 95.54 71.38 2 DKIM_SIGNED 86110 73.86 89.90 66.88 3 XM_DK_Pass 82132 72.05 85.75 66.09 4 DKIM_VALID 81486 70.99 85.07 64.86 5 DCC_CHECK 77728 50.35 81.15 36.94 6 XMListUnsubscribeExists 73691 54.21 76.94 44.32 7 DKIM_VALID_AU 65512 56.12 68.40 50.78 8 XM_H_QuotedFrom 55637 39.49 58.09 31.39 9 XM_DK_Undo_02 52205 28.49 54.50 17.16 10 BAYES_99 46928 26.51 48.99 16.72 11 BAYES_999 40358 23.29 42.14 15.09 12 TR_DCC_Bayes_99 36642 17.26 38.26 8.11 13 LOC_TINY_FONT_1 36537 26.34 38.15 21.19 14 HTML_FONT_LOW_CONTRAST 35135 29.34 36.68 26.14 15 FVGT_m_MULTI_ODD 27678 22.00 28.90 19.00 16 BAYES_50 27229 49.82 28.43 59.14 17 MIME_HTML_ONLY 26872 21.38 28.06 18.47 18 XMSubLong 21903 19.50 22.87 18.03 19 T_TM2_M_HEADER_IN_MSG 20762 22.37 21.68 22.67 20 HTML_IMAGE_RATIO_02 20319 11.58 21.21 7.39 21 XM_Body_Dirty_Words 19596 12.63 20.46 9.22 22 XM_Multi_Part_URI 17526 13.82 18.30 11.87 23 DKIM_VALID_EF 16596 20.87 17.33 22.42 24 DCC_CHECK_NEGATIVE 16387 48.30 17.11 61.88 25 RELAYCOUNTRY_META 16307 8.66 17.03 5.02 26 XM_Evil_Numbers_Gen 14297 9.94 14.93 7.77 27 BOTNET 14186 5.11 14.81 0.88 28 T_KAM_HTML_FONT_INVALID 14059 10.84 14.68 9.17 29 MultiRelay 13457 13.04 14.05 12.60 30 BOTNET_IPINHOSTNAME 13276 8.58 13.86 6.28 31 XMSexyCombo_05 10212 5.56 10.66 3.34 32 UNTRUSTED_Relay 10124 4.90 10.57 2.43 33 LOTS_OF_MONEY 9760 7.69 10.19 6.60 34 XM_B_Phish_Phrases 9028 6.19 9.43 4.79 35 XM_H_Long_From01 8394 6.16 8.76 5.02 36 LotsOfNums_01 8229 7.57 8.59 7.12 37 HTML_IMAGE_RATIO_04 8073 5.36 8.43 4.02 38 T_XMDrugObfuBody_14 7905 6.38 8.25 5.56 39 RCVD_IN_RP_SAFE 7819 11.03 8.16 12.28 40 FSL_BULK_SIG 7519 6.54 7.85 5.98 41 MPART_ALT_DIFF 7169 5.36 7.48 4.44 42 TooManyTo_001 6869 6.73 7.17 6.54 43 FROM_EXCESS_BASE64 6680 4.86 6.97 3.94 44 TR_XM_DocInvoice 6547 4.75 6.84 3.84 45 BAYES_80 6511 4.70 6.80 3.79 46 RCVD_IN_RP_CERTIFIED 6465 9.71 6.75 11.00 47 XMSubMetaSx_00 5776 4.29 6.03 3.54 48 RCVD_IN_MSPIKE_H2 5715 5.08 5.97 4.70 49 XM_UncommonTLD01 5527 4.66 5.77 4.17 50 BAYES_60 5438 5.76 5.68 5.79 51 MIME_HTML_MOSTLY 4771 3.61 4.98 3.01 52 RCVD_IN_BL_SPAMCOP_NET 4663 1.73 4.87 0.36 53 DKIM_INVALID 4624 2.87 4.83 2.01 54 XM_SendGrid 4460 4.53 4.66 4.48 55 BAYES_95 4403 3.21 4.60 2.61 56 XMStrtUSub 4271 4.10 4.46 3.94 57 URI_HEX 4188 2.16 4.37 1.20 58 XM_DIRTYINTL 4116 2.27 4.30 1.39 59 HTML_IMAGE_RATIO_06 4112 3.17 4.29 2.67 60 XMNumbers 4074 5.12 4.25 5.50 61 XM_UB50 4063 2.14 4.24 1.22 62 BOTNET_NORDNS 4008 1.28 4.18 0.01 63 TM2_M_URI_OPT_OUT 3625 2.14 3.78 1.42 64 XM_SPF_SoftFail 3501 1.88 3.66 1.11 65 RELAYCOUNTRY_CA 3346 2.04 3.49 1.41 66 XMSubMetaI_00 3277 1.60 3.42 0.81 67 TR_LOTS_OF_MONEY3 3216 1.53 3.36 0.73 68 XM_OfRef6 3188 1.73 3.33 1.03 69 T_TooManySym_01 3127 4.08 3.26 4.43 70 MIME_HTML_ONLY_MULTI 3110 1.58 3.25 0.85 71 XM_CamelCaseFrm001 3066 2.05 3.20 1.55 72 RCVD_IN_RP_RNBL 3040 0.99 3.17 0.04 73 MIME_QP_LONG_LINE 3039 3.52 3.17 3.67 74 T_REMOTE_IMAGE 3027 3.15 3.16 3.14 75 DKIM_ADSP_CUSTOM_MED 2907 1.46 3.04 0.77 76 T_XMHurry_00 2745 1.36 2.87 0.71 77 HTML_IMAGE_RATIO_08 2691 1.96 2.81 1.59 78 NML_ADSP_CUSTOM_MED 2683 1.23 2.80 0.55 79 FORGED_GMAIL_RCVD 2405 1.02 2.51 0.37 80 T_MIXED_ES 2354 1.46 2.46 1.03 81 XM_ProductURIs 2294 1.73 2.40 1.44 82 XM_URI_RBL 2219 0.78 2.32 0.11 83 RCVD_IN_PSBL 2196 0.82 2.29 0.18 84 XM_UB99 2153 0.69 2.25 0.01 85 RELAYCOUNTRY_CN 2045 0.67 2.14 0.03 86 XMPhish30 1918 0.98 2.00 0.53 87 MultiRelay_CC 1897 0.69 1.98 0.13 88 MultiRelay_Combo 1897 0.69 1.98 0.13 89 BAYES_00 1875 4.75 1.96 5.97 90 HTML_IMAGE_ONLY_12 1849 0.69 1.93 0.15 91 XMBdyGiftCard01 1849 1.32 1.93 1.06 92 DIET_1 1829 1.03 1.91 0.64 93 SUBJ_ALL_CAPS 1818 1.70 1.90 1.62 94 DATE_IN_PAST_24_48 1806 0.58 1.89 0.01 95 T_XMDrugObfuBody_08 1721 1.20 1.80 0.94 96 XMBody_17 1711 0.87 1.79 0.47 97 XM_UB999 1684 0.54 1.76 0.01 98 XM_H_Long_From02 1676 1.14 1.75 0.87 99 XMDiploma_00 1657 1.34 1.73 1.17 100 BAYES_40 1621 2.39 1.69 2.69 101 RELAYCOUNTRY_FR 1620 0.74 1.69 0.33 102 LONG_JUNK_URI 1585 0.59 1.65 0.13 103 URIBL_BLACK 1582 0.53 1.65 0.04 104 XM_B_REG_HTML 1528 1.19 1.60 1.02 105 RDNS_DYNAMIC 1519 0.84 1.59 0.52 106 RELAYCOUNTRY_AT 1513 0.56 1.58 0.11 107 XMSexyCombo_01 1504 0.77 1.57 0.42 108 TM2_M_VERY_LONG_WORD 1499 1.06 1.57 0.84 109 XM_B_COPY_HTML 1473 1.05 1.54 0.83 110 HTML_MIME_NO_HTML_TAG 1470 2.41 1.53 2.80 111 XM_DK_Undo_01 1438 1.39 1.50 1.34 112 TR_XM_DK_Bayes 1424 3.65 1.49 4.59 113 TR_XM_DK_Bayes1 1421 3.58 1.48 4.50 114 SpammyFromTLD_01 1378 0.70 1.44 0.38 115 PLING_QUERY 1371 0.84 1.43 0.58 116 URIBL_DBL_SPAM 1351 0.45 1.41 0.04 117 XM_HighProb1 1315 0.43 1.37 0.02 118 UNPARSEABLE_RELAY 1307 4.41 1.36 5.74 119 TR_XM_DK_Bayes2 1288 3.03 1.34 3.76 120 RCVD_IN_IADB_LISTED 1206 2.78 1.26 3.44 121 XM_UB60 1167 0.40 1.22 0.05 122 XMHTML_After_End 1158 0.53 1.21 0.24 123 BAYES_20 1152 1.73 1.20 1.95 124 XM_BadFromFormat 1120 0.61 1.17 0.36 125 SpammyFromTLD_02 1105 0.44 1.15 0.13 126 XMStockSpam_06 1101 0.70 1.15 0.51 127 TR_XM_RelayPhish 1099 0.63 1.15 0.41 128 MAILING_LIST_MULTI 1088 1.43 1.14 1.55 129 XM_XX_Yahoo 1071 0.48 1.12 0.21 130 XMBody_78 1060 0.82 1.11 0.70 131 RCVD_IN_IADB_SPF 1028 2.38 1.07 2.95 132 SUBJ_DOLLARS 1024 0.48 1.07 0.23 133 XM_H_PHPOS 1019 1.20 1.06 1.26 134 BOUNCE_MESSAGE 1010 11.29 1.05 15.75 135 ANY_BOUNCE_MESSAGE 1010 11.29 1.05 15.75 136 HTML_FONT_FACE_BAD 1005 0.65 1.05 0.48 137 XM_RXBody 1000 0.44 1.04 0.18 138 RELAYCOUNTRY_JP 988 0.33 1.03 0.03 139 ALL_TRUSTED 966 19.71 1.01 27.86 140 RCVD_IN_IADB_SENDERID 965 2.12 1.01 2.60 141 RCVD_IN_IADB_DK 948 2.06 0.99 2.52 142 MPART_ALT_DIFF_COUNT 947 0.52 0.99 0.32 143 URI_NOVOWEL 941 0.52 0.98 0.32 144 XM_S_JOY_D 920 0.56 0.96 0.39 145 XMSlimDrugH 919 0.44 0.96 0.21 146 XMClaimOffer 899 0.42 0.94 0.19 147 XM_OfRef7 892 0.39 0.93 0.16 148 TR_Symld_Words 885 3.01 0.92 3.92 149 T_TooManySym_02 882 1.56 0.92 1.84 150 XM_Body_Obfu01 879 0.38 0.92 0.15 151 XMSubMetaI_01 866 0.35 0.90 0.11 152 XMSubMetaD_03 863 0.35 0.90 0.11 153 FILL_THIS_FORM 861 0.46 0.90 0.26 154 XM_UB80 833 0.28 0.87 0.02 155 XMHTMLBadTable_001 830 0.70 0.87 0.63 156 FSL_THIS_IS_ADV 815 0.44 0.85 0.26 157 XMPhish14 799 0.44 0.83 0.26 158 XM_ShortIntro_01 793 0.55 0.83 0.43 159 XMGenDplmaNmb 785 0.60 0.82 0.50 160 T_XMDrugObfuBody_00 783 0.68 0.82 0.63 161 XMBrknScrpt_02 782 0.53 0.82 0.41 162 LONG_JUNK_URI2 779 0.30 0.81 0.07 163 FILL_THIS_FORM_LONG 777 0.38 0.81 0.20 164 URI_TRY_3LD 769 1.06 0.80 1.17 165 TR_Mismatch_TLD_01 764 0.34 0.80 0.15 166 XM_H_PHPMailer 757 0.77 0.79 0.76 167 XMPhish11 750 0.76 0.78 0.75 168 FILL_THIS_FORM_LOAN 745 0.38 0.78 0.20 169 RCVD_IN_IADB_VOUCHED 738 2.35 0.77 3.04 170 LOW_PRICE 732 0.31 0.76 0.12 171 BODY_ENHANCEMENT 729 0.26 0.76 0.05 172 HTML_SHORT_LINK_IMG_1 726 0.25 0.76 0.03 173 XMSubNoVowel 714 0.39 0.75 0.23 174 T_MONEY_PERCENT 707 0.35 0.74 0.19 175 TR_LOTS_OF_MONEY2 707 0.35 0.74 0.19 176 HTML_FONT_SIZE_HUGE 704 0.39 0.74 0.24 177 MISSING_HEADERS 676 0.51 0.71 0.42 178 LONG_JUNK_URI3 676 0.22 0.71 0.01 179 RELAYCOUNTRY_GB 674 0.54 0.70 0.47 180 TR_Caps_n_Bayes_99 668 0.23 0.70 0.02 181 RELAYCOUNTRY_IT 653 0.23 0.68 0.03 182 RELAYCOUNTRY_DE 632 1.44 0.66 1.78 183 BAYES_05 624 1.12 0.65 1.33 184 XMSexyCombo_04 624 0.33 0.65 0.19 185 XMSubMetaSSx_00 618 0.32 0.65 0.18 186 HTML_TAG_BALANCE_BODY 613 0.48 0.64 0.41 187 XMWghtMeta_00 608 0.21 0.63 0.02 188 TR_MetaPhish_Combo_01 607 0.62 0.63 0.62 189 RCVD_IN_MSPIKE_H3 606 1.27 0.63 1.54 190 RCVD_IN_MSPIKE_WL 606 1.27 0.63 1.54 191 LongTLD 604 0.25 0.63 0.08 192 BODY_URI_ONLY 593 0.21 0.62 0.03 193 MIME_CHARSET_FARAWAY 580 0.23 0.61 0.06 194 XM_Doc_Oz_Body 563 0.24 0.59 0.09 195 XM_UB95 561 0.19 0.59 0.01 196 CHARSET_FARAWAY_HEADER 558 0.21 0.58 0.04 197 XM_H_PHPOS_M 554 0.57 0.58 0.57 198 XMMoneyMeta_00 553 0.31 0.58 0.19 199 RELAYCOUNTRY_TR 553 0.18 0.58 0.01 200 HTML_IMAGE_ONLY_08 547 0.25 0.57 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156960 78.71 95.54 71.38 2 DKIM_SIGNED 147057 73.86 89.90 66.88 3 XM_DK_Pass 145320 72.05 85.75 66.09 4 DKIM_VALID 142627 70.99 85.07 64.86 5 DCC_CHECK_NEGATIVE 136079 48.30 17.11 61.88 6 BAYES_50 130053 49.82 28.43 59.14 7 DKIM_VALID_AU 111658 56.12 68.40 50.78 8 XMListUnsubscribeExists 97452 54.21 76.94 44.32 9 DCC_CHECK 81224 50.35 81.15 36.94 10 XM_H_QuotedFrom 69019 39.49 58.09 31.39 11 ALL_TRUSTED 61256 19.71 1.01 27.86 12 HTML_FONT_LOW_CONTRAST 57489 29.34 36.68 26.14 13 T_TM2_M_HEADER_IN_MSG 49843 22.37 21.68 22.67 14 DKIM_VALID_EF 49293 20.87 17.33 22.42 15 LOC_TINY_FONT_1 46598 26.34 38.15 21.19 16 FVGT_m_MULTI_ODD 41784 22.00 28.90 19.00 17 MIME_HTML_ONLY 40622 21.38 28.06 18.47 18 XMSubLong 39639 19.50 22.87 18.03 19 XM_DK_Undo_02 37737 28.49 54.50 17.16 20 BAYES_99 36772 26.51 48.99 16.72 21 ANY_BOUNCE_MESSAGE 34628 11.29 1.05 15.75 22 BOUNCE_MESSAGE 34627 11.29 1.05 15.75 23 BAYES_999 33175 23.29 42.14 15.09 24 XM_DKIMWhitelistDomains 29618 9.44 0.18 13.47 25 MultiRelay 27713 13.04 14.05 12.60 26 RCVD_IN_RP_SAFE 26992 11.03 8.16 12.28 27 XM_Multi_Part_URI 26092 13.82 18.30 11.87 28 RCVD_IN_RP_CERTIFIED 24186 9.71 6.75 11.00 29 XM_Body_Dirty_Words 20270 12.63 20.46 9.22 30 T_KAM_HTML_FONT_INVALID 20175 10.84 14.68 9.17 31 TR_DCC_Bayes_99 17832 17.26 38.26 8.11 32 XM_Evil_Numbers_Gen 17084 9.94 14.93 7.77 33 HTML_IMAGE_RATIO_02 16240 11.58 21.21 7.39 34 LotsOfNums_01 15662 7.57 8.59 7.12 35 LOTS_OF_MONEY 14519 7.69 10.19 6.60 36 TooManyTo_001 14381 6.73 7.17 6.54 37 BOTNET_IPINHOSTNAME 13804 8.58 13.86 6.28 38 FSL_BULK_SIG 13140 6.54 7.85 5.98 39 BAYES_00 13128 4.75 1.96 5.97 40 BAYES_60 12739 5.76 5.68 5.79 41 UNPARSEABLE_RELAY 12620 4.41 1.36 5.74 42 T_XMDrugObfuBody_14 12222 6.38 8.25 5.56 43 XMNumbers 12094 5.12 4.25 5.50 44 XM_H_Long_From01 11038 6.16 8.76 5.02 45 RELAYCOUNTRY_META 11030 8.66 17.03 5.02 46 XM_B_Phish_Phrases 10527 6.19 9.43 4.79 47 RCVD_IN_MSPIKE_H2 10332 5.08 5.97 4.70 48 IN_ZIMBRA_NJ_WHITELIST 10258 3.26 0.03 4.66 49 TR_XM_DK_Bayes 10099 3.65 1.49 4.59 50 TR_XM_DK_Bayes1 9895 3.58 1.48 4.50 51 XM_SendGrid 9850 4.53 4.66 4.48 52 MPART_ALT_DIFF 9754 5.36 7.48 4.44 53 T_TooManySym_01 9741 4.08 3.26 4.43 54 XM_UncommonTLD01 9179 4.66 5.77 4.17 55 HTML_IMAGE_RATIO_04 8836 5.36 8.43 4.02 56 XMStrtUSub 8673 4.10 4.46 3.94 57 FROM_EXCESS_BASE64 8666 4.86 6.97 3.94 58 TR_Symld_Words 8619 3.01 0.92 3.92 59 TR_XM_DocInvoice 8447 4.75 6.84 3.84 60 BAYES_80 8323 4.70 6.80 3.79 61 TR_XM_DK_Bayes2 8272 3.03 1.34 3.76 62 TVD_RCVD_IP 8188 2.66 0.23 3.72 63 MIME_QP_LONG_LINE 8073 3.52 3.17 3.67 64 XMSubMetaSx_00 7780 4.29 6.03 3.54 65 RCVD_IN_IADB_LISTED 7571 2.78 1.26 3.44 66 XMSexyCombo_05 7341 5.56 10.66 3.34 67 T_REMOTE_IMAGE 6914 3.15 3.16 3.14 68 RCVD_IN_IADB_VOUCHED 6680 2.35 0.77 3.04 69 INVALID_MSGID 6656 2.17 0.21 3.03 70 MIME_HTML_MOSTLY 6627 3.61 4.98 3.01 71 RCVD_IN_IADB_SPF 6480 2.38 1.07 2.95 72 TO_MALFORMED 6341 2.01 0.00 2.88 73 HTML_MIME_NO_HTML_TAG 6151 2.41 1.53 2.80 74 BAYES_40 5914 2.39 1.69 2.69 75 HTML_IMAGE_RATIO_06 5880 3.17 4.29 2.67 76 BAYES_95 5745 3.21 4.60 2.61 77 RCVD_IN_IADB_SENDERID 5722 2.12 1.01 2.60 78 RCVD_IN_IADB_DK 5550 2.06 0.99 2.52 79 IN_HORDE_ADDRESS_BOOK 5338 1.71 0.08 2.43 80 UNTRUSTED_Relay 5335 4.90 10.57 2.43 81 DKIM_INVALID 4430 2.87 4.83 2.01 82 BAYES_20 4298 1.73 1.20 1.95 83 T_TooManySym_02 4046 1.56 0.92 1.84 84 XM_PDF 4002 1.37 0.35 1.82 85 RELAYCOUNTRY_DE 3913 1.44 0.66 1.78 86 USER_IN_DEF_DKIM_WL 3644 1.21 0.18 1.66 87 SUBJ_ALL_CAPS 3556 1.70 1.90 1.62 88 HTML_IMAGE_RATIO_08 3504 1.96 2.81 1.59 89 XM_H_Trusted_IP 3441 1.09 0.00 1.56 90 MAILING_LIST_MULTI 3418 1.43 1.14 1.55 91 XM_CamelCaseFrm001 3403 2.05 3.20 1.55 92 RCVD_IN_MSPIKE_WL 3397 1.27 0.63 1.54 93 RCVD_IN_MSPIKE_H3 3397 1.27 0.63 1.54 94 XM_ProductURIs 3175 1.73 2.40 1.44 95 TM2_M_URI_OPT_OUT 3119 2.14 3.78 1.42 96 RELAYCOUNTRY_CA 3104 2.04 3.49 1.41 97 XM_DIRTYINTL 3050 2.27 4.30 1.39 98 XM_DK_Undo_01 2953 1.39 1.50 1.34 99 BAYES_05 2920 1.12 0.65 1.33 100 TooManyTo_002 2906 1.08 0.54 1.32 101 XM_H_PHPOS 2760 1.20 1.06 1.26 102 XM_UB50 2692 2.14 4.24 1.22 103 URI_HEX 2637 2.16 4.37 1.20 104 XMDiploma_00 2580 1.34 1.73 1.17 105 USER_IN_WHITELIST 2579 0.82 0.00 1.17 106 URI_TRY_3LD 2571 1.06 0.80 1.17 107 XM_SPF_SoftFail 2440 1.88 3.66 1.11 108 RCVD_IN_IADB_OPTIN 2413 0.85 0.29 1.10 109 XMBody_95 2391 0.78 0.07 1.09 110 XMBdyGiftCard01 2326 1.32 1.93 1.06 111 T_MIXED_ES 2266 1.46 2.46 1.03 112 XM_OfRef6 2266 1.73 3.33 1.03 113 XM_B_REG_HTML 2241 1.19 1.60 1.02 114 T_TooManySym_03 2159 0.73 0.16 0.98 115 XM_GoogleGroups 2128 0.83 0.53 0.97 116 T_XMDrugObfuBody_08 2067 1.20 1.80 0.94 117 BOTNET 1935 5.11 14.81 0.88 118 XM_H_Long_From02 1912 1.14 1.75 0.87 119 TM2_M_A_HREF_HREF 1903 0.73 0.43 0.87 120 TooManyTo_003 1888 0.74 0.46 0.86 121 XMSubMetaSxObfu_02 1865 0.71 0.39 0.85 122 MIME_HTML_ONLY_MULTI 1862 1.58 3.25 0.85 123 TM2_M_VERY_LONG_WORD 1837 1.06 1.57 0.84 124 XM_B_COPY_HTML 1835 1.05 1.54 0.83 125 XMSubMetaI_00 1782 1.60 3.42 0.81 126 DKIM_ADSP_CUSTOM_MED 1703 1.46 3.04 0.77 127 HELO_NODOT 1676 0.64 0.36 0.76 128 XM_H_PHPMailer 1667 0.77 0.79 0.76 129 XMPhish11 1649 0.76 0.78 0.75 130 TR_LOTS_OF_MONEY3 1600 1.53 3.36 0.73 131 T_XMHurry_00 1552 1.36 2.87 0.71 132 XMBody_78 1533 0.82 1.11 0.70 133 TooManyTo_004 1451 0.57 0.37 0.66 134 DIET_1 1407 1.03 1.91 0.64 135 XMHTMLBadTable_001 1377 0.70 0.87 0.63 136 T_XMDrugObfuBody_00 1376 0.68 0.82 0.63 137 TR_MetaPhish_Combo_01 1362 0.62 0.63 0.62 138 T_TooManySym_04 1277 0.41 0.01 0.58 139 PLING_QUERY 1271 0.84 1.43 0.58 140 XM_H_PHPOS_M 1243 0.57 0.58 0.57 141 XM_D_tchamptons_WL 1229 0.39 0.01 0.56 142 NML_ADSP_CUSTOM_MED 1215 1.23 2.80 0.55 143 XMPhish30 1176 0.98 2.00 0.53 144 RDNS_DYNAMIC 1147 0.84 1.59 0.52 145 XMStockSpam_06 1115 0.70 1.15 0.51 146 XMGenDplmaNmb 1100 0.60 0.82 0.50 147 TooManyTo_005 1090 0.45 0.33 0.50 148 HTML_FONT_FACE_BAD 1061 0.65 1.05 0.48 149 XMBody_17 1038 0.87 1.79 0.47 150 RELAYCOUNTRY_GB 1024 0.54 0.70 0.47 151 XMSolicitRefs_0 1004 0.39 0.23 0.46 152 DKIM_ADSP_NXDOMAIN 994 0.49 0.57 0.45 153 T_FILL_THIS_FORM_SHORT 980 0.48 0.56 0.45 154 XM_ShortIntro_01 956 0.55 0.83 0.43 155 MISSING_HEADERS 928 0.51 0.71 0.42 156 XMSexyCombo_01 921 0.77 1.57 0.42 157 XMBrknScrpt_02 899 0.53 0.82 0.41 158 HTML_TAG_BALANCE_BODY 892 0.48 0.64 0.41 159 TR_XM_RelayPhish 892 0.63 1.15 0.41 160 RCVD_IN_IADB_DOPTIN 888 0.30 0.06 0.40 161 XMNoVowels 866 0.35 0.26 0.39 162 XM_S_JOY_D 854 0.56 0.96 0.39 163 NO_DNS_FOR_FROM 845 0.40 0.44 0.38 164 SpammyFromTLD_01 837 0.70 1.44 0.38 165 REMOVE_BEFORE_LINK 818 0.39 0.44 0.37 166 FORGED_GMAIL_RCVD 809 1.02 2.51 0.37 167 XM_BadFromFormat 800 0.61 1.17 0.36 168 XM_B_TRADE_HTML 792 0.36 0.35 0.36 169 RCVD_IN_BL_SPAMCOP_NET 784 1.73 4.87 0.36 170 T_Symld_Words_02 754 0.38 0.48 0.34 171 RELAYCOUNTRY_FR 730 0.74 1.69 0.33 172 XMSubMetaSxObfu_03 713 0.37 0.48 0.32 173 URI_NOVOWEL 703 0.52 0.98 0.32 174 XMCapTrack 703 0.31 0.27 0.32 175 MPART_ALT_DIFF_COUNT 702 0.52 0.99 0.32 176 TR_MetaPhish_Combo_01b 674 0.25 0.11 0.31 177 XM_Walgreens_Forge 595 0.19 0.01 0.27 178 XMPhish14 580 0.44 0.83 0.26 179 FILL_THIS_FORM 579 0.46 0.90 0.26 180 HTML_IMAGE_ONLY_28 570 0.30 0.40 0.26 181 FSL_THIS_IS_ADV 567 0.44 0.85 0.26 182 XMSubEmpty 556 0.21 0.12 0.25 183 HTML_IMAGE_ONLY_24 553 0.28 0.34 0.25 184 XMLngstWrd_00 552 0.29 0.37 0.25 185 XMSolicitRefs_4 550 0.19 0.04 0.25 186 T_HTML_TAG_BALANCE_CENTER 546 0.33 0.52 0.25 187 T_OBFU_PDF_ATTACH 544 0.19 0.07 0.25 188 UPPERCASE_50_75 541 0.22 0.17 0.25 189 TVD_SPACE_RATIO 533 0.22 0.15 0.24 190 HTML_FONT_SIZE_HUGE 530 0.39 0.74 0.24 191 MSGID_FROM_MTA_HEADER 529 0.21 0.14 0.24 192 XMHTML_After_End 527 0.53 1.21 0.24 193 XMRcvdHeader_15 523 0.17 0.00 0.24 194 XMSubNoVowel 515 0.39 0.75 0.23 195 XM_RedBox 513 0.16 0.00 0.23 196 SUBJ_DOLLARS 500 0.48 1.07 0.23 197 BASE64_LENGTH_79_INF 486 0.28 0.41 0.22 198 XMLngstWrd_01 484 0.26 0.35 0.22 199 RELAYCOUNTRY_AU 479 0.26 0.36 0.22 200 HTML_IMAGE_ONLY_32 478 0.24 0.30 0.22 ----------------------------------------------------------------------