Email: 532390 Autolearn: 0 AvgScore: 3.37 AvgScanTime: 2.28 sec Spam: 163236 Autolearn: 0 AvgScore: 13.18 AvgScanTime: 2.70 sec Ham: 369154 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 2.10 sec Time Spent Running SA: 337.68 hours Time Spent Processing Spam: 122.27 hours Time Spent Processing Ham: 215.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136051 84.47 83.35 84.96 2 DCC_CHECK 134864 47.62 82.62 32.15 3 DKIM_SIGNED 124891 70.06 76.51 67.21 4 XM_DK_Pass 121484 68.58 74.42 65.99 5 DKIM_VALID 119865 66.75 73.43 63.80 6 XMListUnsubscribeExists 106473 48.76 65.23 41.49 7 XM_H_QuotedFrom 98367 42.53 60.26 34.69 8 DKIM_VALID_AU 92043 49.15 56.39 45.94 9 XM_DK_Undo_02 75460 23.77 46.23 13.84 10 BAYES_99 66710 21.70 40.87 13.22 11 BAYES_50 62075 51.36 38.03 57.25 12 BAYES_999 58295 19.19 35.71 11.88 13 HTML_FONT_LOW_CONTRAST 54482 25.71 33.38 22.32 14 TR_DCC_Bayes_99 53049 14.12 32.50 5.99 15 LOC_TINY_FONT_1 50653 22.29 31.03 18.42 16 T_TM2_M_HEADER_IN_MSG 50461 33.20 30.91 34.21 17 MIME_HTML_ONLY 40593 20.45 24.87 18.50 18 FVGT_m_MULTI_ODD 39596 20.87 24.26 19.37 19 XMSubLong 37295 21.13 22.85 20.37 20 FSL_BULK_SIG 36761 12.49 22.52 8.06 21 LOTS_OF_MONEY 36362 11.68 22.28 7.00 22 XM_Body_Dirty_Words 30898 12.47 18.93 9.62 23 DKIM_VALID_EF 29164 21.03 17.87 22.42 24 T_KAM_HTML_FONT_INVALID 27912 14.00 17.10 12.63 25 RELAYCOUNTRY_META 27064 8.61 16.58 5.09 26 DCC_CHECK_NEGATIVE 25042 50.17 15.34 65.57 27 XM_Multi_Part_URI 23977 11.46 14.69 10.03 28 SUBJ_ALL_CAPS 23631 5.74 14.48 1.88 29 MultiRelay 23121 18.17 14.16 19.94 30 T_XMDrugObfuBody_14 21859 9.89 13.39 8.35 31 HTML_IMAGE_RATIO_02 21803 8.10 13.36 5.78 32 XM_OfRef6 21371 5.21 13.09 1.72 33 FORM_FRAUD_5 20975 3.94 12.85 0.00 34 BOTNET_IPINHOSTNAME 20613 7.17 12.63 4.76 35 XMBody_17 20154 4.06 12.35 0.39 36 XM_Evil_Numbers_Gen 20132 8.95 12.33 7.45 37 ALL_TRUSTED 19354 17.30 11.86 19.71 38 XM_OfRef7 18703 3.65 11.46 0.20 39 BOTNET 18390 4.17 11.27 1.03 40 UNTRUSTED_Relay 17931 4.26 10.98 1.28 41 XM_Lotto 17841 3.44 10.93 0.13 42 FILL_THIS_FORM 17743 3.79 10.87 0.65 43 XM_OfRef8 17647 3.33 10.81 0.02 44 T_FILL_THIS_FORM_LONG 17598 3.68 10.78 0.54 45 DATE_IN_FUTURE_06_12 17588 3.31 10.77 0.00 46 T_FILL_THIS_FORM_LOAN 17509 3.63 10.73 0.49 47 MONEY_FRAUD_5 17503 3.29 10.72 0.00 48 HK_LOTTO 17458 3.28 10.69 0.00 49 DEAR_WINNER 17451 3.28 10.69 0.00 50 XMSexyCombo_05 16007 4.90 9.81 2.73 51 HTML_IMAGE_RATIO_04 14560 6.07 8.92 4.80 52 LotsOfNums_01 14458 7.74 8.86 7.25 53 XM_UncommonTLD01 14045 5.34 8.60 3.90 54 XM_B_Phish_Phrases 13589 5.41 8.32 4.13 55 TR_XM_DocInvoice 13477 5.79 8.26 4.70 56 XM_H_Long_From01 12239 6.05 7.50 5.41 57 BAYES_60 11858 6.84 7.26 6.65 58 XMSubMetaSx_00 11769 4.96 7.21 3.96 59 MPART_ALT_DIFF 10460 4.17 6.41 3.19 60 TooManyTo_001 10346 8.35 6.34 9.24 61 BAYES_80 10247 4.51 6.28 3.73 62 HTML_IMAGE_RATIO_06 8860 3.32 5.43 2.38 63 RCVD_IN_RP_SAFE 8557 8.15 5.24 9.44 64 FROM_EXCESS_BASE64 8327 3.55 5.10 2.86 65 XM_SPF_SoftFail 7740 3.03 4.74 2.27 66 RCVD_IN_RP_CERTIFIED 7602 7.48 4.66 8.73 67 MIME_HTML_MOSTLY 7376 2.81 4.52 2.06 68 RCVD_IN_MSPIKE_H2 7094 4.36 4.35 4.37 69 TR_Mismatch_TLD_02 7088 1.37 4.34 0.06 70 XM_DIRTYINTL 6869 2.51 4.21 1.76 71 MIME_QP_LONG_LINE 6524 4.81 4.00 5.17 72 SpammyFromTLD_01 6468 2.01 3.96 1.15 73 XMNumbers 6437 3.55 3.94 3.37 74 XMStrtUSub 6280 4.51 3.85 4.80 75 XM_UB50 6155 1.66 3.77 0.72 76 BAYES_95 5989 2.83 3.67 2.45 77 XM_SendGrid 5804 4.38 3.56 4.75 78 XM_UB60 5662 1.10 3.47 0.05 79 TM2_M_URI_OPT_OUT 5583 2.24 3.42 1.72 80 RCVD_IN_RP_RNBL 5392 1.03 3.30 0.02 81 T_FILL_THIS_FORM_SHORT 5150 1.64 3.15 0.97 82 DKIM_INVALID 5026 3.30 3.08 3.40 83 RELAYCOUNTRY_CA 4793 1.86 2.94 1.38 84 XM_CamelCaseFrm001 4784 2.17 2.93 1.83 85 T_REMOTE_IMAGE 4751 4.31 2.91 4.93 86 XM_H_Long_From02 4730 1.60 2.90 1.03 87 XMDiploma_00 4546 1.99 2.78 1.64 88 MIME_HTML_ONLY_MULTI 4448 2.02 2.72 1.71 89 MultiRelay_Combo 4278 0.99 2.62 0.27 90 MultiRelay_CC 4278 0.99 2.62 0.27 91 HTML_IMAGE_RATIO_08 4152 2.16 2.54 1.98 92 URI_HEX 4117 1.43 2.52 0.94 93 RCVD_IN_BL_SPAMCOP_NET 3874 1.12 2.37 0.57 94 T_TooManySym_01 3761 3.75 2.30 4.39 95 XM_URI_RBL 3689 0.78 2.26 0.13 96 RELAYCOUNTRY_FR 3668 0.92 2.25 0.34 97 RELAYCOUNTRY_JP 3645 0.71 2.23 0.03 98 MONEY_FORM_SHORT 3603 0.69 2.21 0.02 99 JM_SOUGHT_FRAUD_3 3583 0.67 2.19 0.00 100 XM_DK_Undo_01 3531 2.06 2.16 2.02 101 DATE_IN_FUTURE_12_24 3481 0.66 2.13 0.00 102 XMGenDplmaNmb 3460 1.39 2.12 1.07 103 RCVD_IN_IADB_LISTED 3384 4.04 2.07 4.92 104 DIET_1 3222 0.89 1.97 0.42 105 T_XMDrugObfuBody_08 3189 1.46 1.95 1.25 106 RCVD_IN_IADB_SPF 3125 3.59 1.91 4.33 107 HTML_MIME_NO_HTML_TAG 3122 2.28 1.91 2.44 108 XMSexyCombo_01 2980 1.20 1.83 0.92 109 RCVD_IN_IADB_SENDERID 2963 3.23 1.82 3.86 110 SpammyFromTLD_02 2961 0.80 1.81 0.35 111 RCVD_IN_IADB_DK 2931 3.16 1.80 3.76 112 TM2_M_VERY_LONG_WORD 2909 1.06 1.78 0.75 113 XMPhish30 2833 0.83 1.74 0.43 114 XMSubMetaI_00 2636 0.85 1.61 0.51 115 BAYES_00 2418 6.11 1.48 8.15 116 BOTNET_NORDNS 2411 0.47 1.48 0.03 117 TR_XM_RelayPhish 2365 0.75 1.45 0.44 118 MAILING_LIST_MULTI 2317 2.10 1.42 2.40 119 XMSubMetaSxObfu_03 2295 0.71 1.41 0.40 120 XM_B_REG_HTML 2189 0.74 1.34 0.48 121 URIBL_BLACK 2174 0.44 1.33 0.04 122 XM_UB99 2151 0.42 1.32 0.02 123 T_XMDrugObfuBody_00 2136 0.86 1.31 0.66 124 XMStockSpam_06 2109 1.14 1.29 1.07 125 TR_XM_DK_Bayes 2105 3.86 1.29 4.99 126 URI_TRY_3LD 2067 1.05 1.27 0.96 127 XMHTML_After_End 2065 0.63 1.27 0.35 128 TR_XM_DK_Bayes1 2049 3.70 1.26 4.78 129 RELAYCOUNTRY_GB 2024 1.24 1.24 1.24 130 DATE_IN_PAST_03_06 1901 0.41 1.16 0.08 131 XM_HighProb1 1866 0.36 1.14 0.02 132 XM_ProductURIs 1855 1.08 1.14 1.06 133 XMPhish11 1840 1.20 1.13 1.23 134 XMBody_78 1840 0.82 1.13 0.68 135 FSL_THIS_IS_ADV 1837 0.39 1.13 0.07 136 TR_XM_DK_Bayes2 1801 3.13 1.10 4.03 137 XM_UB80 1753 0.34 1.07 0.02 138 REMOVE_BEFORE_LINK 1734 0.44 1.06 0.16 139 XM_UB999 1722 0.33 1.05 0.01 140 RELAYCOUNTRY_AT 1693 0.43 1.04 0.16 141 UNPARSEABLE_RELAY 1669 2.92 1.02 3.75 142 URIBL_DBL_SPAM 1661 0.32 1.02 0.01 143 BAYES_40 1655 3.01 1.01 3.89 144 T_Symld_Words_02 1654 0.64 1.01 0.47 145 BODY_ENHANCEMENT 1621 0.32 0.99 0.02 146 XM_Body_Obfu01 1620 0.49 0.99 0.27 147 RCVD_IN_IADB_VOUCHED 1592 2.51 0.98 3.19 148 XMSubNoVowel 1563 0.70 0.96 0.58 149 RELAYCOUNTRY_DE 1559 0.55 0.96 0.38 150 XM_RXBody 1546 0.39 0.95 0.14 151 LONG_JUNK_URI 1520 0.38 0.93 0.14 152 XMMoneyMeta_00 1507 0.74 0.92 0.67 153 TR_Caps_n_Bayes_99 1493 0.38 0.91 0.14 154 TR_Symld_Words 1469 1.62 0.90 1.93 155 RCVD_IN_PSBL 1465 0.38 0.90 0.15 156 XMBrknScrpt_02 1456 0.63 0.89 0.52 157 XM_B_COPY_HTML 1452 0.65 0.89 0.54 158 BAYES_20 1446 2.26 0.89 2.87 159 HTTPS_HTTP_MISMATCH 1436 0.57 0.88 0.43 160 SUBJ_DOLLARS 1431 0.39 0.88 0.17 161 T_XMHurry_00 1430 0.49 0.88 0.32 162 URI_NOVOWEL 1383 0.48 0.85 0.32 163 XM_H_PHPOS 1345 1.29 0.82 1.50 164 HTML_FONT_FACE_BAD 1340 1.09 0.82 1.21 165 XMSubEmpty 1338 0.49 0.82 0.35 166 XM_H_Undi_Recip 1278 0.43 0.78 0.28 167 T_HTML_TAG_BALANCE_CENTER 1264 0.44 0.77 0.29 168 XM_PDF 1261 4.05 0.77 5.50 169 BOUNCE_MESSAGE 1260 2.48 0.77 3.24 170 ANY_BOUNCE_MESSAGE 1260 2.48 0.77 3.24 171 RELAYCOUNTRY_CL 1251 0.24 0.77 0.00 172 TR_LOTS_OF_MONEY2 1233 0.44 0.76 0.30 173 T_MONEY_PERCENT 1233 0.44 0.76 0.30 174 XMSlimDrugH 1229 0.48 0.75 0.35 175 XMSexyCombo_04 1224 0.33 0.75 0.14 176 RELAYCOUNTRY_CN 1197 0.29 0.73 0.09 177 XMBdyGiftCard01 1165 0.65 0.71 0.63 178 RELAYCOUNTRY_IT 1160 0.24 0.71 0.03 179 XMHTMLBadTable_001 1157 0.48 0.71 0.38 180 PLING_QUERY 1119 0.42 0.69 0.31 181 TR_MetaPhish_Combo_01 1097 1.04 0.67 1.20 182 DKIM_ADSP_CUSTOM_MED 1075 0.99 0.66 1.14 183 TooManyTo_002 1067 2.04 0.65 2.66 184 HTML_TAG_BALANCE_BODY 1058 0.50 0.65 0.43 185 RELAYCOUNTRY_AU 1045 0.54 0.64 0.50 186 RDNS_DYNAMIC 987 0.49 0.60 0.44 187 RCVD_IN_IADB_OPTIN 985 1.20 0.60 1.47 188 XMClaimOffer 972 0.26 0.60 0.12 189 LOW_PRICE 958 0.24 0.59 0.09 190 HTML_FONT_SIZE_HUGE 953 0.34 0.58 0.24 191 PHOTO_EDITING_FREEM 944 0.18 0.58 0.00 192 PHOTO_EDITING_DIRECT 935 0.18 0.57 0.00 193 XM_BadFromFormat 931 0.40 0.57 0.33 194 NML_ADSP_CUSTOM_MED 906 0.75 0.56 0.84 195 XM_H_PHPMailer 897 0.73 0.55 0.81 196 XMBSHREFv2 895 0.24 0.55 0.10 197 MPART_ALT_DIFF_COUNT 895 0.42 0.55 0.36 198 NO_DNS_FOR_FROM 893 0.34 0.55 0.25 199 LongTLD 887 0.26 0.54 0.14 200 XMSubMetaSSx_00 859 0.27 0.53 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 313647 84.47 83.35 84.96 2 DKIM_SIGNED 248098 70.06 76.51 67.21 3 XM_DK_Pass 243606 68.58 74.42 65.99 4 DCC_CHECK_NEGATIVE 242063 50.17 15.34 65.57 5 DKIM_VALID 235531 66.75 73.43 63.80 6 BAYES_50 211335 51.36 38.03 57.25 7 DKIM_VALID_AU 169602 49.15 56.39 45.94 8 XMListUnsubscribeExists 153145 48.76 65.23 41.49 9 XM_H_QuotedFrom 128054 42.53 60.26 34.69 10 T_TM2_M_HEADER_IN_MSG 126281 33.20 30.91 34.21 11 DCC_CHECK 118669 47.62 82.62 32.15 12 DKIM_VALID_EF 82776 21.03 17.87 22.42 13 HTML_FONT_LOW_CONTRAST 82392 25.71 33.38 22.32 14 XMSubLong 75194 21.13 22.85 20.37 15 MultiRelay 73627 18.17 14.16 19.94 16 ALL_TRUSTED 72764 17.30 11.86 19.71 17 FVGT_m_MULTI_ODD 71512 20.87 24.26 19.37 18 MIME_HTML_ONLY 68286 20.45 24.87 18.50 19 LOC_TINY_FONT_1 67993 22.29 31.03 18.42 20 XM_DK_Undo_02 51077 23.77 46.23 13.84 21 BAYES_99 48795 21.70 40.87 13.22 22 T_KAM_HTML_FONT_INVALID 46619 14.00 17.10 12.63 23 BAYES_999 43870 19.19 35.71 11.88 24 XM_Multi_Part_URI 37041 11.46 14.69 10.03 25 XM_DKIMWhitelistDomains 36681 6.90 0.02 9.94 26 XM_Body_Dirty_Words 35513 12.47 18.93 9.62 27 RCVD_IN_RP_SAFE 34839 8.15 5.24 9.44 28 TooManyTo_001 34123 8.35 6.34 9.24 29 RCVD_IN_RP_CERTIFIED 32209 7.48 4.66 8.73 30 T_XMDrugObfuBody_14 30812 9.89 13.39 8.35 31 BAYES_00 30087 6.11 1.48 8.15 32 FSL_BULK_SIG 29741 12.49 22.52 8.06 33 XM_Evil_Numbers_Gen 27501 8.95 12.33 7.45 34 LotsOfNums_01 26751 7.74 8.86 7.25 35 IN_ZIMBRA_NJ_WHITELIST 26053 4.91 0.04 7.06 36 LOTS_OF_MONEY 25843 11.68 22.28 7.00 37 BAYES_60 24539 6.84 7.26 6.65 38 TR_DCC_Bayes_99 22122 14.12 32.50 5.99 39 HTML_IMAGE_RATIO_02 21325 8.10 13.36 5.78 40 XM_PDF 20292 4.05 0.77 5.50 41 XM_H_Long_From01 19978 6.05 7.50 5.41 42 MIME_QP_LONG_LINE 19080 4.81 4.00 5.17 43 RELAYCOUNTRY_META 18785 8.61 16.58 5.09 44 TR_XM_DK_Bayes 18430 3.86 1.29 4.99 45 T_REMOTE_IMAGE 18207 4.31 2.91 4.93 46 RCVD_IN_IADB_LISTED 18150 4.04 2.07 4.92 47 HTML_IMAGE_RATIO_04 17735 6.07 8.92 4.80 48 XMStrtUSub 17725 4.51 3.85 4.80 49 TR_XM_DK_Bayes1 17663 3.70 1.26 4.78 50 BOTNET_IPINHOSTNAME 17577 7.17 12.63 4.76 51 XM_SendGrid 17528 4.38 3.56 4.75 52 TR_XM_DocInvoice 17335 5.79 8.26 4.70 53 T_TooManySym_01 16208 3.75 2.30 4.39 54 RCVD_IN_MSPIKE_H2 16141 4.36 4.35 4.37 55 RCVD_IN_IADB_SPF 15975 3.59 1.91 4.33 56 XM_B_Phish_Phrases 15230 5.41 8.32 4.13 57 TR_XM_DK_Bayes2 14872 3.13 1.10 4.03 58 XMSubMetaSx_00 14622 4.96 7.21 3.96 59 XM_UncommonTLD01 14396 5.34 8.60 3.90 60 BAYES_40 14378 3.01 1.01 3.89 61 RCVD_IN_IADB_SENDERID 14245 3.23 1.82 3.86 62 RCVD_IN_IADB_DK 13866 3.16 1.80 3.76 63 UNPARSEABLE_RELAY 13861 2.92 1.02 3.75 64 BAYES_80 13760 4.51 6.28 3.73 65 DKIM_INVALID 12567 3.30 3.08 3.40 66 XMNumbers 12437 3.55 3.94 3.37 67 ANY_BOUNCE_MESSAGE 11949 2.48 0.77 3.24 68 BOUNCE_MESSAGE 11948 2.48 0.77 3.24 69 TVD_RCVD_IP 11817 2.26 0.15 3.20 70 RCVD_IN_IADB_VOUCHED 11770 2.51 0.98 3.19 71 MPART_ALT_DIFF 11766 4.17 6.41 3.19 72 HELO_NODOT 10592 2.09 0.31 2.87 73 BAYES_20 10583 2.26 0.89 2.87 74 FROM_EXCESS_BASE64 10564 3.55 5.10 2.86 75 XMSexyCombo_05 10073 4.90 9.81 2.73 76 TooManyTo_002 9814 2.04 0.65 2.66 77 BAYES_95 9057 2.83 3.67 2.45 78 HTML_MIME_NO_HTML_TAG 9024 2.28 1.91 2.44 79 IN_HORDE_ADDRESS_BOOK 8905 1.69 0.06 2.41 80 MAILING_LIST_MULTI 8872 2.10 1.42 2.40 81 HTML_IMAGE_RATIO_06 8800 3.32 5.43 2.38 82 XM_SPF_SoftFail 8368 3.03 4.74 2.27 83 MIME_HTML_MOSTLY 7596 2.81 4.52 2.06 84 XM_DK_Undo_01 7440 2.06 2.16 2.02 85 HTML_IMAGE_RATIO_08 7323 2.16 2.54 1.98 86 TR_Symld_Words 7136 1.62 0.90 1.93 87 SUBJ_ALL_CAPS 6929 5.74 14.48 1.88 88 INVALID_MSGID 6911 1.35 0.15 1.87 89 XM_CamelCaseFrm001 6766 2.17 2.93 1.83 90 T_TooManySym_02 6710 1.38 0.39 1.82 91 BAYES_05 6619 1.40 0.51 1.79 92 XM_DIRTYINTL 6507 2.51 4.21 1.76 93 TO_MALFORMED 6467 1.28 0.23 1.75 94 XM_OfRef6 6349 5.21 13.09 1.72 95 TM2_M_URI_OPT_OUT 6337 2.24 3.42 1.72 96 MIME_HTML_ONLY_MULTI 6321 2.02 2.72 1.71 97 TooManyTo_003 6311 1.34 0.52 1.71 98 XMDiploma_00 6038 1.99 2.78 1.64 99 XM_H_PHPOS 5546 1.29 0.82 1.50 100 XMCapTrack 5513 1.19 0.49 1.49 101 RCVD_IN_IADB_OPTIN 5414 1.20 0.60 1.47 102 RELAYCOUNTRY_CA 5097 1.86 2.94 1.38 103 USER_IN_DEF_DKIM_WL 4878 0.93 0.03 1.32 104 UNTRUSTED_Relay 4723 4.26 10.98 1.28 105 TooManyTo_004 4686 1.01 0.41 1.27 106 T_XMDrugObfuBody_08 4598 1.46 1.95 1.25 107 RELAYCOUNTRY_GB 4586 1.24 1.24 1.24 108 XMPhish11 4542 1.20 1.13 1.23 109 XM_GoogleGroups 4498 1.00 0.49 1.22 110 HTML_FONT_FACE_BAD 4467 1.09 0.82 1.21 111 TR_MetaPhish_Combo_01 4425 1.04 0.67 1.20 112 SpammyFromTLD_01 4242 2.01 3.96 1.15 113 RCVD_IN_MSPIKE_WL 4221 0.87 0.25 1.14 114 RCVD_IN_MSPIKE_H3 4221 0.87 0.25 1.14 115 DKIM_ADSP_CUSTOM_MED 4193 0.99 0.66 1.14 116 XMStockSpam_06 3955 1.14 1.29 1.07 117 XMGenDplmaNmb 3944 1.39 2.12 1.07 118 XM_ProductURIs 3901 1.08 1.14 1.06 119 BOTNET 3818 4.17 11.27 1.03 120 XM_H_Long_From02 3814 1.60 2.90 1.03 121 TooManyTo_005 3733 0.80 0.33 1.01 122 USER_IN_WHITELIST 3627 0.68 0.00 0.98 123 T_FILL_THIS_FORM_SHORT 3577 1.64 3.15 0.97 124 URI_TRY_3LD 3537 1.05 1.27 0.96 125 URI_HEX 3477 1.43 2.52 0.94 126 XMSexyCombo_01 3392 1.20 1.83 0.92 127 XM_ShortIntro_01 3324 0.74 0.38 0.90 128 NML_ADSP_CUSTOM_MED 3100 0.75 0.56 0.84 129 T_OBFU_PDF_ATTACH 3045 0.62 0.16 0.82 130 XM_H_PHPMailer 3003 0.73 0.55 0.81 131 TM2_M_VERY_LONG_WORD 2759 1.06 1.78 0.75 132 XMGappySubj_01 2698 0.62 0.38 0.73 133 XM_UB50 2657 1.66 3.77 0.72 134 T_TooManySym_03 2653 0.54 0.13 0.72 135 SHORT_HELO_AND_INLINE_IMAGE 2603 0.51 0.08 0.71 136 RCVD_IN_SORBS_DUL 2573 0.53 0.14 0.70 137 XMBody_78 2516 0.82 1.13 0.68 138 XMMoneyMeta_00 2457 0.74 0.92 0.67 139 T_XMDrugObfuBody_00 2449 0.86 1.31 0.66 140 FILL_THIS_FORM 2409 3.79 10.87 0.65 141 XMDateMe_00 2371 0.53 0.28 0.64 142 XMBdyGiftCard01 2317 0.65 0.71 0.63 143 XMSubNoVowel 2147 0.70 0.96 0.58 144 XM_B_TRADE_HTML 2126 0.51 0.35 0.58 145 XMNoVowels 2094 0.54 0.49 0.57 146 RCVD_IN_IADB_DOPTIN 2088 0.41 0.07 0.57 147 RCVD_IN_BL_SPAMCOP_NET 2086 1.12 2.37 0.57 148 MISSING_HEADERS 2051 0.46 0.26 0.56 149 XM_B_COPY_HTML 1996 0.65 0.89 0.54 150 T_FILL_THIS_FORM_LONG 1976 3.68 10.78 0.54 151 XMBrknScrpt_02 1913 0.63 0.89 0.52 152 HTML_IMAGE_ONLY_32 1899 0.43 0.24 0.51 153 XMBody_95 1888 0.39 0.11 0.51 154 XMSubMetaI_00 1872 0.85 1.61 0.51 155 RELAYCOUNTRY_AU 1855 0.54 0.64 0.50 156 T_FILL_THIS_FORM_LOAN 1814 3.63 10.73 0.49 157 TM2_M_BODY_EMPTY 1807 0.44 0.31 0.49 158 XM_B_REG_HTML 1775 0.74 1.34 0.48 159 T_Symld_Words_02 1734 0.64 1.01 0.47 160 XMSubMetaSxObfu_02 1715 0.38 0.19 0.46 161 AC_DIV_BONANZA 1713 0.36 0.11 0.46 162 XM_H_PHPOS_M 1641 0.40 0.31 0.44 163 TR_XM_RelayPhish 1640 0.75 1.45 0.44 164 XMRcvdHeader_15 1638 0.31 0.00 0.44 165 HTML_IMAGE_ONLY_28 1622 0.43 0.42 0.44 166 RDNS_DYNAMIC 1617 0.49 0.60 0.44 167 HTTPS_HTTP_MISMATCH 1601 0.57 0.88 0.43 168 XMPhish30 1596 0.83 1.74 0.43 169 HTML_TAG_BALANCE_BODY 1578 0.50 0.65 0.43 170 XM_Combo_Sbj 1577 0.42 0.40 0.43 171 FORGED_GMAIL_RCVD 1557 0.44 0.48 0.42 172 HTML_IMAGE_ONLY_24 1549 0.44 0.48 0.42 173 DOS_OUTLOOK_TO_MX 1542 0.33 0.12 0.42 174 DIET_1 1533 0.89 1.97 0.42 175 XMSubMetaSxObfu_03 1482 0.71 1.41 0.40 176 XMBody_17 1444 4.06 12.35 0.39 177 XMPhish14 1443 0.42 0.48 0.39 178 TVD_SPACE_RATIO 1419 0.32 0.16 0.38 179 XMHTMLBadTable_001 1416 0.48 0.71 0.38 180 RELAYCOUNTRY_DE 1394 0.55 0.96 0.38 181 MPART_ALT_DIFF_COUNT 1326 0.42 0.55 0.36 182 HTML_IMAGE_ONLY_12 1326 0.28 0.11 0.36 183 HTML_IMAGE_ONLY_20 1325 0.33 0.25 0.36 184 XMSlimDrugH 1300 0.48 0.75 0.35 185 SpammyFromTLD_02 1291 0.80 1.81 0.35 186 XMSubEmpty 1290 0.49 0.82 0.35 187 XMHTML_After_End 1282 0.63 1.27 0.35 188 RELAYCOUNTRY_FR 1243 0.92 2.25 0.34 189 MSGID_FROM_MTA_HEADER 1240 0.30 0.21 0.34 190 XM_BadFromFormat 1214 0.40 0.57 0.33 191 XM_H_SpoofStaff4 1199 0.24 0.04 0.32 192 T_XMHurry_00 1199 0.49 0.88 0.32 193 UPPERCASE_50_75 1190 0.27 0.16 0.32 194 URI_NOVOWEL 1166 0.48 0.85 0.32 195 T_TooManySym_04 1138 0.22 0.02 0.31 196 PLING_QUERY 1130 0.42 0.69 0.31 197 XMSolicitRefs_0 1107 0.36 0.50 0.30 198 T_MONEY_PERCENT 1099 0.44 0.76 0.30 199 TR_LOTS_OF_MONEY2 1099 0.44 0.76 0.30 200 TM2_M_A_HREF_HREF 1094 0.31 0.35 0.30 ----------------------------------------------------------------------