Email: 287302 Autolearn: 0 AvgScore: 3.48 AvgScanTime: 1.79 sec Spam: 91521 Autolearn: 0 AvgScore: 12.25 AvgScanTime: 2.12 sec Ham: 195781 Autolearn: 0 AvgScore: -0.62 AvgScanTime: 1.63 sec Time Spent Running SA: 142.49 hours Time Spent Processing Spam: 53.89 hours Time Spent Processing Ham: 88.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 76984 76.72 84.12 73.26 2 DKIM_SIGNED 70205 70.47 76.71 67.56 3 XM_DK_Pass 68498 69.26 74.84 66.65 4 DKIM_VALID 67723 68.14 74.00 65.40 5 DCC_CHECK 65526 49.68 71.60 39.43 6 XMListUnsubscribeExists 59687 51.53 65.22 45.14 7 DKIM_VALID_AU 57641 56.42 62.98 53.35 8 XM_H_QuotedFrom 54959 48.67 60.05 43.34 9 XM_DK_Undo_02 43702 28.63 47.75 19.69 10 BAYES_99 38264 26.42 41.81 19.22 11 BAYES_999 33367 23.51 36.46 17.46 12 LOC_TINY_FONT_1 33046 27.15 36.11 22.97 13 HTML_FONT_LOW_CONTRAST 31173 29.56 34.06 27.46 14 BAYES_50 31028 48.21 33.90 54.89 15 TR_DCC_Bayes_99 30813 17.89 33.67 10.51 16 XMSubLong 28029 27.90 30.63 26.62 17 MIME_HTML_ONLY 27022 21.08 29.53 17.13 18 DCC_CHECK_NEGATIVE 24433 48.93 26.70 59.32 19 FVGT_m_MULTI_ODD 22838 21.38 24.95 19.70 20 XM_Body_Dirty_Words 19546 13.53 21.36 9.87 21 HTML_IMAGE_RATIO_02 17827 12.34 19.48 9.00 22 T_TM2_M_HEADER_IN_MSG 17032 22.33 18.61 24.07 23 DKIM_VALID_EF 14143 21.22 15.45 23.91 24 XM_Evil_Numbers_Gen 14133 10.02 15.44 7.48 25 RELAYCOUNTRY_META 14052 7.81 15.35 4.28 26 XM_Multi_Part_URI 13715 12.63 14.99 11.53 27 T_KAM_HTML_FONT_INVALID 13260 11.65 14.49 10.33 28 XMSubMetaSx_00 12784 9.71 13.97 7.71 29 MultiRelay 12141 13.65 13.27 13.83 30 BOTNET 12095 4.90 13.22 1.01 31 ALL_TRUSTED 12086 22.61 13.21 27.01 32 XMSexyCombo_05 11312 5.70 12.36 2.59 33 BOTNET_IPINHOSTNAME 10808 8.18 11.81 6.48 34 UNTRUSTED_Relay 9767 4.25 10.67 1.25 35 FSL_BULK_SIG 9665 9.07 10.56 8.37 36 LOTS_OF_MONEY 9594 7.93 10.48 6.74 37 HTML_IMAGE_RATIO_04 8710 6.12 9.52 4.54 38 T_XMDrugObfuBody_14 8515 7.39 9.30 6.50 39 URI_WP_HACKED_2 8302 7.13 9.07 6.22 40 RCVD_IN_RP_SAFE 8169 12.61 8.93 14.33 41 XM_B_Phish_Phrases 7969 5.75 8.71 4.37 42 BAYES_60 7829 8.11 8.55 7.90 43 SUSPICIOUS_RECIPS 7599 4.17 8.30 2.23 44 RCVD_IN_RP_CERTIFIED 7124 11.85 7.78 13.75 45 BAYES_80 6813 4.92 7.44 3.73 46 FROM_EXCESS_BASE64 6788 5.38 7.42 4.43 47 LotsOfNums_01 6768 7.19 7.40 7.09 48 MPART_ALT_DIFF 6507 4.17 7.11 2.79 49 TooManyTo_001 6347 6.71 6.94 6.60 50 TR_XM_DocInvoice 6033 4.97 6.59 4.22 51 XM_H_Long_From01 5954 5.46 6.51 4.97 52 XM_UncommonTLD01 5577 5.11 6.09 4.66 53 IMPOTENCE 5563 4.49 6.08 3.75 54 XMStrtUSub 5306 5.27 5.80 5.02 55 MIME_HTML_MOSTLY 4512 3.59 4.93 2.97 56 SORTED_RECIPS 4377 1.83 4.78 0.45 57 XMNumbers 4369 4.17 4.77 3.89 58 HTML_IMAGE_RATIO_06 4171 3.02 4.56 2.30 59 XM_UB50 3981 1.89 4.35 0.75 60 SUBJ_ALL_CAPS 3928 2.67 4.29 1.91 61 XMSubMetaSSx_00 3733 1.97 4.08 0.98 62 BOTNET_NORDNS 3722 1.34 4.07 0.07 63 XM_SendGrid 3423 4.31 3.74 4.57 64 BAYES_95 3423 2.97 3.74 2.61 65 MIME_QP_LONG_LINE 3391 3.55 3.71 3.48 66 XM_DIRTYINTL 3332 2.07 3.64 1.33 67 ONLINE_PHARMACY 3328 2.63 3.64 2.16 68 T_REMOTE_IMAGE 3216 3.45 3.51 3.41 69 RCVD_IN_MSPIKE_H2 3157 3.82 3.45 3.99 70 XMSexyCombo_01 3105 1.58 3.39 0.74 71 TM2_M_URI_OPT_OUT 2970 2.14 3.25 1.63 72 TVD_VISIT_PHARMA 2957 2.15 3.23 1.65 73 XMStockSpam_06 2956 1.60 3.23 0.84 74 XM_CamelCaseFrm001 2874 2.08 3.14 1.59 75 URI_HEX 2752 1.62 3.01 0.98 76 XMSlimDrugH 2698 1.46 2.95 0.77 77 T_TooManySym_01 2606 4.65 2.85 5.49 78 MIME_HTML_ONLY_MULTI 2550 1.49 2.79 0.88 79 HTML_IMAGE_RATIO_08 2539 2.20 2.77 1.93 80 RELAYCOUNTRY_CA 2530 1.71 2.76 1.22 81 MultiRelay_Combo 2508 1.03 2.74 0.23 82 MultiRelay_CC 2508 1.03 2.74 0.23 83 DKIM_INVALID 2482 2.33 2.71 2.16 84 RCVD_IN_BL_SPAMCOP_NET 2469 1.04 2.70 0.26 85 HTML_MIME_NO_HTML_TAG 2454 1.88 2.68 1.50 86 XM_SPF_SoftFail 2441 1.68 2.67 1.22 87 XM_RXBody 2250 1.09 2.46 0.44 88 XMSubMetaSxObfu_03 2235 1.16 2.44 0.57 89 XMSlimDrugs 2216 1.13 2.42 0.53 90 XMSubMetaI_00 2213 1.16 2.42 0.57 91 XM_UB99 2163 0.77 2.36 0.02 92 RCVD_IN_RP_RNBL 2079 0.75 2.27 0.03 93 UNPARSEABLE_RELAY 1949 4.65 2.13 5.83 94 XM_URI_RBL 1940 0.76 2.12 0.13 95 XMSexyCombo_04 1914 0.85 2.09 0.27 96 RELAYCOUNTRY_FR 1841 0.82 2.01 0.26 97 XM_UB999 1803 0.64 1.97 0.02 98 XMPhish30 1756 0.86 1.92 0.37 99 XMBody_17 1749 0.88 1.91 0.40 100 XM_OfRef6 1702 1.68 1.86 1.59 101 TM2_M_VERY_LONG_WORD 1693 1.16 1.85 0.84 102 NO_PRESCRIPTION 1679 0.78 1.83 0.29 103 T_XMDrugObfuBody_08 1654 1.22 1.81 0.94 104 URIBL_BLACK 1630 0.58 1.78 0.03 105 XM_B_REG_HTML 1581 1.24 1.73 1.02 106 XM_DKIMWhitelistDomains 1580 10.16 1.73 14.10 107 BAYES_00 1571 4.40 1.72 5.65 108 RELAYCOUNTRY_CN 1541 0.58 1.68 0.06 109 XMBdyGiftCard01 1483 1.39 1.62 1.28 110 XM_ProductURIs 1435 1.46 1.57 1.41 111 MAILING_LIST_MULTI 1420 1.94 1.55 2.12 112 RCVD_IN_IADB_LISTED 1407 2.67 1.54 3.20 113 T_XMHurry_00 1371 0.84 1.50 0.53 114 XMDiploma_00 1366 1.22 1.49 1.09 115 XM_BadFromFormat 1350 0.67 1.48 0.29 116 XM_H_Long_From02 1319 0.99 1.44 0.77 117 TR_Caps_n_Bayes_99 1301 0.50 1.42 0.06 118 SUBJ_DOLLARS 1296 0.69 1.42 0.35 119 URI_TRY_3LD 1284 1.06 1.40 0.90 120 RELAYCOUNTRY_AT 1281 0.53 1.40 0.12 121 TR_XM_DK_Bayes 1256 3.11 1.37 3.92 122 HTML_FONT_SIZE_HUGE 1229 0.53 1.34 0.15 123 TR_XM_DK_Bayes1 1227 3.03 1.34 3.82 124 T_HTML_TAG_BALANCE_CENTER 1227 0.56 1.34 0.19 125 LONG_JUNK_URI3 1221 0.50 1.33 0.11 126 RCVD_IN_PSBL 1219 0.60 1.33 0.25 127 MPART_ALT_DIFF_COUNT 1203 0.62 1.31 0.29 128 RCVD_IN_IADB_SPF 1190 2.34 1.30 2.82 129 TR_XM_DK_Bayes2 1170 2.78 1.28 3.48 130 URIBL_DBL_SPAM 1152 0.41 1.26 0.01 131 DIET_1 1141 0.65 1.25 0.37 132 SpammyFromTLD_01 1137 0.63 1.24 0.34 133 XM_B_COPY_HTML 1132 0.87 1.24 0.70 134 RCVD_IN_IADB_SENDERID 1130 2.14 1.23 2.57 135 XM_HighProb1 1125 0.41 1.23 0.03 136 XMHTML_After_End 1118 0.58 1.22 0.27 137 XMSubMetaSx_01 1117 0.72 1.22 0.48 138 RCVD_IN_IADB_DK 1113 2.09 1.22 2.50 139 PLING_QUERY 1112 0.57 1.22 0.26 140 XMBrknScrpt_02 1098 0.81 1.20 0.63 141 XM_DK_Undo_01 1075 1.55 1.17 1.73 142 BAYES_40 1044 2.23 1.14 2.75 143 T_XMDrugObfuBody_00 1019 0.64 1.11 0.42 144 XM_UB60 996 0.39 1.09 0.06 145 SpammyFromTLD_02 994 0.45 1.09 0.16 146 LONG_JUNK_URI 984 0.41 1.08 0.09 147 XM_H_Long_From03 961 0.43 1.05 0.15 148 TR_XM_RelayPhish 961 0.53 1.05 0.29 149 XMLongAddy 959 0.42 1.05 0.12 150 BAYES_20 958 1.62 1.05 1.89 151 FSL_THIS_IS_ADV 951 0.36 1.04 0.05 152 BASE64_LENGTH_79_INF 950 0.48 1.04 0.21 153 RELAYCOUNTRY_DE 915 0.61 1.00 0.42 154 T_FILL_THIS_FORM_SHORT 897 0.63 0.98 0.47 155 XM_S_JOY_D 891 0.54 0.97 0.33 156 XMSubMetaD_00 869 0.36 0.95 0.09 157 XMHTMLBadTable_001 855 0.81 0.93 0.75 158 XM_H_PHPOS 824 1.11 0.90 1.21 159 DRUGS_ERECTILE 794 0.31 0.87 0.05 160 XM_UB80 786 0.29 0.86 0.02 161 RELAYCOUNTRY_NL 776 0.46 0.85 0.28 162 BODY_URI_ONLY 769 0.29 0.84 0.03 163 XMGenDplmaNmb 767 0.68 0.84 0.60 164 TR_LOTS_OF_MONEY2 758 0.41 0.83 0.21 165 T_MONEY_PERCENT 758 0.41 0.83 0.21 166 XM_Body_Obfu01 748 0.38 0.82 0.17 167 URIBL_CSS 728 0.58 0.80 0.47 168 URIBL_CSS_A 728 0.58 0.80 0.47 169 DRUG_ED_CAPS 723 0.28 0.79 0.04 170 URIBL_SBL_A 717 0.55 0.78 0.44 171 HTML_SHORT_LINK_IMG_1 694 0.26 0.76 0.03 172 RCVD_IN_IADB_VOUCHED 691 1.54 0.76 1.91 173 HTML_IMAGE_ONLY_08 688 0.33 0.75 0.13 174 HTML_FONT_SIZE_LARGE 680 0.29 0.74 0.08 175 DRUG_ED_ONLINE 678 0.26 0.74 0.04 176 HTML_FONT_FACE_BAD 674 0.62 0.74 0.56 177 LOW_PRICE 667 0.29 0.73 0.09 178 TooManyTo_002 664 1.39 0.73 1.70 179 MISSING_HEADERS 662 0.45 0.72 0.33 180 XMPhish11 647 0.92 0.71 1.02 181 BODY_ENHANCEMENT 640 0.29 0.70 0.10 182 XM_H_PHPMailer 630 1.18 0.69 1.41 183 TR_Symld_Words 629 1.11 0.69 1.31 184 BOUNCE_MESSAGE 619 2.43 0.68 3.25 185 ANY_BOUNCE_MESSAGE 619 2.43 0.68 3.26 186 XM_OfRef7 616 0.36 0.67 0.21 187 XMClaimOffer 616 0.28 0.67 0.10 188 REPLYTO_WITHOUT_TO_CC 615 0.25 0.67 0.05 189 TR_Mismatch_TLD_02 597 0.25 0.65 0.06 190 TR_MetaPhish_Combo_01 595 0.50 0.65 0.42 191 BAYES_05 591 1.12 0.65 1.35 192 PP_MIME_FAKE_ASCII_TEXT 581 0.34 0.63 0.20 193 URIBL_DBL_ABUSE_SPAM 577 0.34 0.63 0.21 194 RELAYCOUNTRY_GB 573 0.63 0.63 0.64 195 LONG_JUNK_URI2 551 0.20 0.60 0.01 196 RCVD_IN_MSPIKE_WL 551 1.44 0.60 1.83 197 RCVD_IN_MSPIKE_H3 551 1.44 0.60 1.83 198 TR_LOTS_OF_MONEY3 550 0.35 0.60 0.24 199 XMGppyBdWords 550 0.25 0.60 0.09 200 RDNS_DYNAMIC 549 0.56 0.60 0.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143434 76.72 84.12 73.26 2 DKIM_SIGNED 132271 70.47 76.71 67.56 3 XM_DK_Pass 130480 69.26 74.84 66.65 4 DKIM_VALID 128047 68.14 74.00 65.40 5 DCC_CHECK_NEGATIVE 116143 48.93 26.70 59.32 6 BAYES_50 107472 48.21 33.90 54.89 7 DKIM_VALID_AU 104449 56.42 62.98 53.35 8 XMListUnsubscribeExists 88366 51.53 65.22 45.14 9 XM_H_QuotedFrom 84859 48.67 60.05 43.34 10 DCC_CHECK 77194 49.68 71.60 39.43 11 HTML_FONT_LOW_CONTRAST 53756 29.56 34.06 27.46 12 ALL_TRUSTED 52873 22.61 13.21 27.01 13 XMSubLong 52118 27.90 30.63 26.62 14 T_TM2_M_HEADER_IN_MSG 47119 22.33 18.61 24.07 15 DKIM_VALID_EF 46816 21.22 15.45 23.91 16 LOC_TINY_FONT_1 44964 27.15 36.11 22.97 17 FVGT_m_MULTI_ODD 38574 21.38 24.95 19.70 18 XM_DK_Undo_02 38549 28.63 47.75 19.69 19 BAYES_99 37635 26.42 41.81 19.22 20 BAYES_999 34189 23.51 36.46 17.46 21 MIME_HTML_ONLY 33538 21.08 29.53 17.13 22 RCVD_IN_RP_SAFE 28056 12.61 8.93 14.33 23 XM_DKIMWhitelistDomains 27600 10.16 1.73 14.10 24 MultiRelay 27084 13.65 13.27 13.83 25 RCVD_IN_RP_CERTIFIED 26916 11.85 7.78 13.75 26 XM_Multi_Part_URI 22574 12.63 14.99 11.53 27 TR_DCC_Bayes_99 20577 17.89 33.67 10.51 28 T_KAM_HTML_FONT_INVALID 20219 11.65 14.49 10.33 29 XM_Body_Dirty_Words 19316 13.53 21.36 9.87 30 HTML_IMAGE_RATIO_02 17623 12.34 19.48 9.00 31 FSL_BULK_SIG 16385 9.07 10.56 8.37 32 BAYES_60 15472 8.11 8.55 7.90 33 XMSubMetaSx_00 15104 9.71 13.97 7.71 34 XM_Evil_Numbers_Gen 14641 10.02 15.44 7.48 35 LotsOfNums_01 13884 7.19 7.40 7.09 36 LOTS_OF_MONEY 13192 7.93 10.48 6.74 37 TooManyTo_001 12924 6.71 6.94 6.60 38 T_XMDrugObfuBody_14 12719 7.39 9.30 6.50 39 BOTNET_IPINHOSTNAME 12696 8.18 11.81 6.48 40 URI_WP_HACKED_2 12182 7.13 9.07 6.22 41 UNPARSEABLE_RELAY 11414 4.65 2.13 5.83 42 BAYES_00 11065 4.40 1.72 5.65 43 T_TooManySym_01 10742 4.65 2.85 5.49 44 XMStrtUSub 9829 5.27 5.80 5.02 45 XM_H_Long_From01 9733 5.46 6.51 4.97 46 TVD_RCVD_IP 9593 3.40 0.21 4.90 47 XM_UncommonTLD01 9115 5.11 6.09 4.66 48 IN_ZIMBRA_NJ_WHITELIST 9110 3.18 0.03 4.65 49 XM_SendGrid 8955 4.31 3.74 4.57 50 HTML_IMAGE_RATIO_04 8884 6.12 9.52 4.54 51 FROM_EXCESS_BASE64 8665 5.38 7.42 4.43 52 XM_B_Phish_Phrases 8553 5.75 8.71 4.37 53 RELAYCOUNTRY_META 8378 7.81 15.35 4.28 54 TR_XM_DocInvoice 8255 4.97 6.59 4.22 55 RCVD_IN_MSPIKE_H2 7813 3.82 3.45 3.99 56 TR_XM_DK_Bayes 7674 3.11 1.37 3.92 57 XMNumbers 7611 4.17 4.77 3.89 58 TO_MALFORMED 7488 2.61 0.01 3.82 59 TR_XM_DK_Bayes1 7485 3.03 1.34 3.82 60 IMPOTENCE 7351 4.49 6.08 3.75 61 BAYES_80 7311 4.92 7.44 3.73 62 INVALID_MSGID 6856 2.45 0.20 3.50 63 TR_XM_DK_Bayes2 6806 2.78 1.28 3.48 64 MIME_QP_LONG_LINE 6805 3.55 3.71 3.48 65 T_REMOTE_IMAGE 6685 3.45 3.51 3.41 66 ANY_BOUNCE_MESSAGE 6373 2.43 0.68 3.26 67 BOUNCE_MESSAGE 6371 2.43 0.68 3.25 68 RCVD_IN_IADB_LISTED 6271 2.67 1.54 3.20 69 MIME_HTML_MOSTLY 5807 3.59 4.93 2.97 70 RCVD_IN_IADB_SPF 5519 2.34 1.30 2.82 71 MPART_ALT_DIFF 5469 4.17 7.11 2.79 72 BAYES_40 5377 2.23 1.14 2.75 73 BAYES_95 5104 2.97 3.74 2.61 74 XMSexyCombo_05 5062 5.70 12.36 2.59 75 RCVD_IN_IADB_SENDERID 5026 2.14 1.23 2.57 76 RCVD_IN_IADB_DK 4904 2.09 1.22 2.50 77 IN_HORDE_ADDRESS_BOOK 4862 1.71 0.06 2.48 78 T_TooManySym_02 4575 1.74 0.47 2.34 79 USER_IN_DEF_DKIM_WL 4573 1.61 0.05 2.34 80 HTML_IMAGE_RATIO_06 4512 3.02 4.56 2.30 81 SUSPICIOUS_RECIPS 4368 4.17 8.30 2.23 82 ONLINE_PHARMACY 4233 2.63 3.64 2.16 83 DKIM_INVALID 4224 2.33 2.71 2.16 84 MAILING_LIST_MULTI 4154 1.94 1.55 2.12 85 HTML_IMAGE_RATIO_08 3784 2.20 2.77 1.93 86 RCVD_IN_IADB_VOUCHED 3742 1.54 0.76 1.91 87 SUBJ_ALL_CAPS 3734 2.67 4.29 1.91 88 BAYES_20 3708 1.62 1.05 1.89 89 RCVD_IN_MSPIKE_H3 3585 1.44 0.60 1.83 90 RCVD_IN_MSPIKE_WL 3585 1.44 0.60 1.83 91 XM_DK_Undo_01 3378 1.55 1.17 1.73 92 XM_PDF 3376 1.27 0.31 1.72 93 TooManyTo_002 3327 1.39 0.73 1.70 94 TVD_VISIT_PHARMA 3225 2.15 3.23 1.65 95 TM2_M_URI_OPT_OUT 3192 2.14 3.25 1.63 96 XM_OfRef6 3120 1.68 1.86 1.59 97 XM_CamelCaseFrm001 3111 2.08 3.14 1.59 98 HTML_MIME_NO_HTML_TAG 2944 1.88 2.68 1.50 99 XM_GoogleGroups 2890 1.18 0.55 1.48 100 XM_H_PHPMailer 2762 1.18 0.69 1.41 101 XM_ProductURIs 2753 1.46 1.57 1.41 102 BAYES_05 2637 1.12 0.65 1.35 103 T_TooManySym_03 2616 0.95 0.12 1.34 104 XM_DIRTYINTL 2607 2.07 3.64 1.33 105 TR_Symld_Words 2569 1.11 0.69 1.31 106 XMBdyGiftCard01 2503 1.39 1.62 1.28 107 UNTRUSTED_Relay 2445 4.25 10.67 1.25 108 XM_SPF_SoftFail 2380 1.68 2.67 1.22 109 RELAYCOUNTRY_CA 2379 1.71 2.76 1.22 110 XM_H_PHPOS 2367 1.11 0.90 1.21 111 USER_IN_WHITELIST 2339 0.81 0.00 1.19 112 TooManyTo_003 2308 0.99 0.57 1.18 113 XMDiploma_00 2135 1.22 1.49 1.09 114 XMPhish11 1996 0.92 0.71 1.02 115 XM_B_REG_HTML 1992 1.24 1.73 1.02 116 BOTNET 1982 4.90 13.22 1.01 117 DKIM_ADSP_CUSTOM_MED 1970 0.86 0.54 1.01 118 XMSubMetaSSx_00 1924 1.97 4.08 0.98 119 URI_HEX 1914 1.62 3.01 0.98 120 T_XMDrugObfuBody_08 1849 1.22 1.81 0.94 121 FILL_THIS_FORM 1804 0.72 0.28 0.92 122 TooManyTo_004 1786 0.76 0.43 0.91 123 URI_TRY_3LD 1756 1.06 1.40 0.90 124 MIME_HTML_ONLY_MULTI 1728 1.49 2.79 0.88 125 RCVD_IN_IADB_OPTIN 1714 0.73 0.41 0.88 126 T_FILL_THIS_FORM_LOAN 1642 0.63 0.19 0.84 127 XMStockSpam_06 1638 1.60 3.23 0.84 128 TM2_M_VERY_LONG_WORD 1635 1.16 1.85 0.84 129 XMBody_95 1583 0.59 0.12 0.81 130 T_FILL_THIS_FORM_LONG 1577 0.57 0.07 0.81 131 XM_H_Long_From02 1515 0.99 1.44 0.77 132 TooManyTo_005 1513 0.64 0.36 0.77 133 XMSlimDrugH 1502 1.46 2.95 0.77 134 XMSubMetaSxObfu_02 1492 0.62 0.31 0.76 135 HELO_NODOT 1473 0.58 0.20 0.75 136 XMHTMLBadTable_001 1473 0.81 0.93 0.75 137 XM_UB50 1461 1.89 4.35 0.75 138 XMSexyCombo_01 1444 1.58 3.39 0.74 139 NML_ADSP_CUSTOM_MED 1399 0.62 0.41 0.71 140 XM_B_COPY_HTML 1368 0.87 1.24 0.70 141 RELAYCOUNTRY_GB 1251 0.63 0.63 0.64 142 XMBrknScrpt_02 1241 0.81 1.20 0.63 143 T_TooManySym_04 1194 0.43 0.04 0.61 144 XMGenDplmaNmb 1181 0.68 0.84 0.60 145 XMSubject_48 1160 0.43 0.10 0.59 146 XMBody_78 1125 0.55 0.48 0.57 147 ADMITS_SPAM 1116 0.51 0.39 0.57 148 XMSubMetaI_00 1114 1.16 2.42 0.57 149 XMSubMetaSxObfu_03 1107 1.16 2.44 0.57 150 HTML_FONT_FACE_BAD 1095 0.62 0.74 0.56 151 RDNS_DYNAMIC 1055 0.56 0.60 0.54 152 T_XMHurry_00 1041 0.84 1.50 0.53 153 XMSlimDrugs 1028 1.13 2.42 0.53 154 XMSubMetaSx_01 949 0.72 1.22 0.48 155 XM_ShortIntro_01 935 0.43 0.34 0.48 156 XM_H_PHPOS_M 932 0.46 0.41 0.48 157 URIBL_CSS_A 929 0.58 0.80 0.47 158 URIBL_CSS 929 0.58 0.80 0.47 159 XMNoVowels 919 0.43 0.35 0.47 160 T_FILL_THIS_FORM_SHORT 916 0.63 0.98 0.47 161 TM2_M_A_HREF_HREF 893 0.41 0.30 0.46 162 XMCapTrack 887 0.42 0.36 0.45 163 SORTED_RECIPS 885 1.83 4.78 0.45 164 NO_DNS_FOR_FROM 877 0.36 0.16 0.45 165 XM_RXBody 870 1.09 2.46 0.44 166 URIBL_SBL_A 866 0.55 0.78 0.44 167 DKIM_ADSP_NXDOMAIN 862 0.38 0.26 0.44 168 TR_MetaPhish_Combo_01 828 0.50 0.65 0.42 169 RELAYCOUNTRY_DE 826 0.61 1.00 0.42 170 T_XMDrugObfuBody_00 816 0.64 1.11 0.42 171 XMBody_17 790 0.88 1.91 0.40 172 REMOVE_BEFORE_LINK 779 0.42 0.47 0.40 173 FROM_EGROUPS 771 0.27 0.00 0.39 174 XM_Walgreens_Forge 768 0.30 0.10 0.39 175 XMBody_29 754 0.33 0.20 0.39 176 DIET_1 726 0.65 1.25 0.37 177 URI_NOVOWEL 724 0.43 0.55 0.37 178 XMPhish30 716 0.86 1.92 0.37 179 XMRcvdHeader_15 704 0.25 0.00 0.36 180 XM_H_SpoofStaff4 689 0.25 0.03 0.35 181 HTML_TAG_BALANCE_BODY 683 0.42 0.57 0.35 182 SUBJ_DOLLARS 680 0.69 1.42 0.35 183 SpammyFromTLD_01 674 0.63 1.24 0.34 184 XMDateMe_00 672 0.31 0.24 0.34 185 XM_D_tchamptons_WL 672 0.23 0.00 0.34 186 RELAYCOUNTRY_AU 657 0.36 0.43 0.34 187 XM_S_JOY_D 649 0.54 0.97 0.33 188 RCVD_IN_IADB_DOPTIN 647 0.24 0.05 0.33 189 MISSING_HEADERS 638 0.45 0.72 0.33 190 XMLngstWrd_00 627 0.37 0.47 0.32 191 FORGED_GMAIL_RCVD 623 0.34 0.38 0.32 192 XMSUPPORT 582 0.20 0.00 0.30 193 NO_PRESCRIPTION 576 0.78 1.83 0.29 194 XMPhish14 575 0.28 0.24 0.29 195 MPART_ALT_DIFF_COUNT 575 0.62 1.31 0.29 196 T_TooManySym_05 572 0.20 0.00 0.29 197 TR_XM_RelayPhish 566 0.53 1.05 0.29 198 XM_BadFromFormat 563 0.67 1.48 0.29 199 RCVD_IN_SORBS_DUL 560 0.30 0.33 0.29 200 XMLngstWrd_01 548 0.33 0.45 0.28 ----------------------------------------------------------------------