Email: 274958 Autolearn: 0 AvgScore: 3.37 AvgScanTime: 3.08 sec Spam: 90376 Autolearn: 0 AvgScore: 12.97 AvgScanTime: 3.65 sec Ham: 184582 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 2.80 sec Time Spent Running SA: 234.88 hours Time Spent Processing Spam: 91.54 hours Time Spent Processing Ham: 143.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 85291 87.75 94.37 84.51 2 DKIM_SIGNED 76816 78.87 85.00 75.87 3 XM_DK_Pass 73763 77.05 81.62 74.82 4 DCC_CHECK 73411 54.02 81.23 40.70 5 DKIM_VALID 70533 73.90 78.04 71.88 6 XMListUnsubscribeExists 67113 58.30 74.26 50.49 7 DKIM_VALID_AU 57866 57.94 64.03 54.95 8 XM_H_QuotedFrom 51949 42.18 57.48 34.68 9 XM_DK_Undo_02 45469 29.79 50.31 19.74 10 BAYES_99 40923 27.35 45.28 18.57 11 BAYES_999 35392 24.08 39.16 16.69 12 LOC_TINY_FONT_1 34042 29.29 37.67 25.19 13 TR_DCC_Bayes_99 32585 17.70 36.05 8.72 14 HTML_FONT_LOW_CONTRAST 31840 31.98 35.23 30.39 15 MIME_HTML_ONLY 29612 26.65 32.77 23.66 16 BAYES_50 27665 46.53 30.61 54.33 17 FVGT_m_MULTI_ODD 23029 21.40 25.48 19.40 18 XMSubLong 20713 22.30 22.92 21.99 19 DKIM_VALID_EF 19771 27.78 21.88 30.67 20 XM_Body_Dirty_Words 18421 14.63 20.38 11.81 21 T_TM2_M_HEADER_IN_MSG 18082 23.73 20.01 25.55 22 T_KAM_HTML_FONT_INVALID 18020 16.14 19.94 14.28 23 HTML_IMAGE_RATIO_02 16172 11.60 17.89 8.52 24 MultiRelay 15847 16.72 17.53 16.32 25 RELAYCOUNTRY_META 15644 8.51 17.31 4.19 26 DCC_CHECK_NEGATIVE 15565 44.50 17.22 57.85 27 XM_Multi_Part_URI 15558 14.67 17.21 13.43 28 BOTNET 13108 5.99 14.50 1.82 29 XM_Evil_Numbers_Gen 12467 10.43 13.79 8.78 30 FSL_BULK_SIG 11315 10.59 12.52 9.65 31 BOTNET_IPINHOSTNAME 10706 8.76 11.85 7.24 32 XMSexyCombo_05 10515 6.65 11.63 4.21 33 LOTS_OF_MONEY 10270 12.17 11.36 12.57 34 UNTRUSTED_Relay 10241 4.55 11.33 1.22 35 XM_UncommonTLD01 9021 6.64 9.98 5.01 36 HTML_IMAGE_RATIO_04 8963 6.69 9.92 5.10 37 XM_B_Phish_Phrases 8663 6.56 9.59 5.08 38 T_XMDrugObfuBody_14 8468 7.31 9.37 6.30 39 XM_H_Long_From01 8268 7.22 9.15 6.28 40 LotsOfNums_01 8050 8.15 8.91 7.78 41 TooManyTo_001 7694 6.92 8.51 6.14 42 BAYES_80 7255 5.52 8.03 4.29 43 RCVD_IN_RP_SAFE 7091 11.18 7.85 12.81 44 FROM_EXCESS_BASE64 6583 5.25 7.28 4.26 45 XMSubMetaSx_00 6423 5.61 7.11 4.87 46 MPART_ALT_DIFF 6298 4.36 6.97 3.08 47 DKIM_INVALID 6283 4.97 6.95 4.00 48 RCVD_IN_RP_CERTIFIED 6043 10.16 6.69 11.86 49 BAYES_60 6003 6.53 6.64 6.48 50 TR_XM_DocInvoice 5420 4.83 6.00 4.26 51 MIME_QP_LONG_LINE 5045 4.74 5.58 4.32 52 XMNumbers 4691 4.47 5.19 4.11 53 RCVD_IN_RP_RNBL 4634 1.70 5.13 0.02 54 T_REMOTE_IMAGE 4277 4.55 4.73 4.46 55 BAYES_95 4234 3.51 4.68 2.93 56 XM_UB50 4196 2.07 4.64 0.82 57 MIME_HTML_MOSTLY 4135 3.51 4.58 2.99 58 HTML_IMAGE_RATIO_06 4122 3.62 4.56 3.16 59 XM_CamelCaseFrm001 3881 2.49 4.29 1.61 60 XM_DIRTYINTL 3834 2.50 4.24 1.65 61 XM_SendGrid 3800 4.97 4.20 5.35 62 RCVD_IN_MSPIKE_H2 3714 4.73 4.11 5.03 63 XMStrtUSub 3709 4.82 4.10 5.17 64 RCVD_IN_PSBL 3617 1.50 4.00 0.27 65 MultiRelay_CC 3535 1.39 3.91 0.16 66 MultiRelay_Combo 3535 1.39 3.91 0.16 67 RCVD_IN_BL_SPAMCOP_NET 3380 1.60 3.74 0.56 68 XM_H_Long_From02 3137 1.70 3.47 0.84 69 BOTNET_NORDNS 3016 1.55 3.34 0.67 70 RELAYCOUNTRY_CA 2954 1.97 3.27 1.33 71 URI_HEX 2903 1.93 3.21 1.30 72 XMHTML_After_End 2821 1.22 3.12 0.28 73 MIME_HTML_ONLY_MULTI 2776 1.73 3.07 1.07 74 T_TooManySym_01 2744 4.52 3.04 5.25 75 HTML_IMAGE_RATIO_08 2728 2.28 3.02 1.92 76 TM2_M_URI_OPT_OUT 2721 3.42 3.01 3.63 77 SpammyFromTLD_02 2718 1.10 3.01 0.17 78 XM_SPF_SoftFail 2460 1.85 2.72 1.42 79 DKIM_ADSP_CUSTOM_MED 2381 1.55 2.63 1.02 80 TR_Mismatch_TLD_02 2325 0.89 2.57 0.06 81 NO_DNS_FOR_FROM 2280 2.15 2.52 1.96 82 NML_ADSP_CUSTOM_MED 2273 1.35 2.52 0.78 83 HTML_MIME_NO_HTML_TAG 2214 1.99 2.45 1.77 84 XMLongAddy 2212 0.90 2.45 0.13 85 XMBody_17 2140 1.06 2.37 0.42 86 RCVD_IN_IADB_LISTED 1926 4.39 2.13 5.50 87 UNPARSEABLE_RELAY 1920 4.79 2.12 6.09 88 XMPhish30 1895 1.01 2.10 0.48 89 BODY_URI_ONLY 1894 0.73 2.10 0.05 90 TooManyTo_002 1884 1.88 2.08 1.78 91 XM_UB99 1882 0.69 2.08 0.01 92 DIET_1 1859 0.96 2.06 0.42 93 SUBJ_ALL_CAPS 1848 2.36 2.04 2.51 94 URIBL_DBL_SPAM 1847 0.70 2.04 0.04 95 RELAYCOUNTRY_FR 1824 0.85 2.02 0.27 96 PHOTO_EDITING_DIRECT 1779 0.65 1.97 0.00 97 HTML_IMAGE_ONLY_08 1778 0.74 1.97 0.13 98 XM_DK_Undo_01 1774 1.96 1.96 1.96 99 HTML_SHORT_LINK_IMG_1 1769 0.66 1.96 0.02 100 XMSubMetaI_00 1753 1.16 1.94 0.78 101 URIBL_BLACK 1742 0.66 1.93 0.03 102 HTML_FONT_SIZE_LARGE 1737 0.77 1.92 0.20 103 RELAYCOUNTRY_CN 1732 0.65 1.92 0.04 104 TooManyTo_003 1729 1.41 1.91 1.17 105 XMDiploma_00 1718 1.36 1.90 1.09 106 RCVD_IN_IADB_SPF 1704 3.78 1.89 4.70 107 XM_URI_RBL 1689 0.69 1.87 0.11 108 BAYES_00 1646 5.45 1.82 7.23 109 RCVD_IN_IADB_SENDERID 1630 3.33 1.80 4.08 110 RCVD_IN_IADB_DK 1614 3.22 1.79 3.92 111 FORGED_GMAIL_RCVD 1613 0.95 1.78 0.54 112 XM_B_REG_HTML 1587 1.30 1.76 1.07 113 SpammyFromTLD_01 1586 0.89 1.75 0.47 114 T_XMHurry_00 1568 0.84 1.73 0.41 115 XM_ProductURIs 1548 1.46 1.71 1.34 116 XMSlimDrugH 1544 0.74 1.71 0.27 117 MAILING_LIST_MULTI 1522 2.13 1.68 2.35 118 XM_OfRef6 1498 1.89 1.66 2.00 119 XM_UB60 1478 0.58 1.64 0.07 120 TooManyTo_004 1422 1.13 1.57 0.91 121 XM_UB999 1415 0.52 1.57 0.01 122 T_XMDrugObfuBody_08 1410 1.31 1.56 1.19 123 RELAYCOUNTRY_AT 1403 0.59 1.55 0.13 124 XMPhish11 1392 1.31 1.54 1.20 125 SUBJ_DOLLARS 1372 0.70 1.52 0.30 126 XMSexyCombo_01 1363 1.42 1.51 1.37 127 XM_RXBody 1348 0.66 1.49 0.25 128 TR_XM_RelayPhish 1314 0.80 1.45 0.47 129 XMHTMLBadTable_001 1271 0.82 1.41 0.53 130 DATE_IN_PAST_03_06 1268 0.51 1.40 0.07 131 FSL_THIS_IS_ADV 1215 0.51 1.34 0.10 132 HTML_IMAGE_ONLY_16 1195 0.57 1.32 0.20 133 TR_XM_DK_Bayes 1173 4.14 1.30 5.53 134 XMStockSpam_06 1167 1.54 1.29 1.66 135 FVGT_m_MULTI_ODD_EMAIL 1158 0.48 1.28 0.09 136 DATE_IN_PAST_24_48 1142 0.44 1.26 0.04 137 BAYES_40 1135 2.17 1.26 2.62 138 XM_Body_Obfu01 1122 0.49 1.24 0.12 139 XMBdyGiftCard01 1121 1.26 1.24 1.26 140 XM_H_PHPOS 1120 2.91 1.24 3.73 141 TR_XM_DK_Bayes1 1104 4.00 1.22 5.35 142 TM2_M_VERY_LONG_WORD 1093 0.88 1.21 0.73 143 ALL_TRUSTED 1068 12.78 1.18 18.46 144 URI_NOVOWEL 1056 0.62 1.17 0.35 145 T_FILL_THIS_FORM_SHORT 1001 0.70 1.11 0.50 146 TooManyTo_005 991 0.85 1.10 0.73 147 XM_HighProb1 989 0.37 1.09 0.02 148 XM_UB80 987 0.37 1.09 0.02 149 RDNS_DYNAMIC 983 0.79 1.09 0.64 150 XM_BadFromFormat 981 0.58 1.09 0.34 151 BAYES_20 970 1.67 1.07 1.96 152 XMPhish14 963 0.53 1.07 0.26 153 RELAYCOUNTRY_GB 963 0.77 1.07 0.63 154 TR_XM_DK_Bayes2 941 3.38 1.04 4.53 155 LONG_JUNK_URI3 939 0.43 1.04 0.12 156 XMBrknScrpt_02 936 0.83 1.04 0.73 157 URI_TRY_3LD 932 1.17 1.03 1.23 158 TR_Symld_Words 920 1.93 1.02 2.38 159 XMGenDplmaNmb 901 0.77 1.00 0.65 160 HTML_FONT_FACE_BAD 885 0.59 0.98 0.40 161 XM_S_JOY_D 878 0.48 0.97 0.24 162 HTML_FONT_SIZE_HUGE 846 0.42 0.94 0.17 163 TR_LOTS_OF_MONEY2 816 0.60 0.90 0.46 164 T_MONEY_PERCENT 816 0.60 0.90 0.46 165 T_HTML_TAG_BALANCE_CENTER 815 0.43 0.90 0.20 166 PLING_QUERY 802 0.46 0.89 0.25 167 DATE_IN_PAST_06_12 793 0.34 0.88 0.07 168 T_TooManySym_02 783 1.78 0.87 2.23 169 XM_H_PHPMailer 779 1.08 0.86 1.19 170 TM2_M_A_HREF_HREF 773 1.01 0.86 1.08 171 RELAYCOUNTRY_DE 773 0.59 0.86 0.46 172 BODY_ENHANCEMENT 768 0.31 0.85 0.04 173 XMSubMetaSx_01 764 0.38 0.85 0.15 174 XMMoneyMeta_00 759 0.50 0.84 0.33 175 XM_B_COPY_HTML 756 0.89 0.84 0.92 176 URIBL_ABUSE_SURBL 755 0.31 0.84 0.06 177 RCVD_IN_MSPIKE_WL 744 1.97 0.82 2.53 178 RCVD_IN_MSPIKE_H3 744 1.97 0.82 2.53 179 FORGED_YAHOO_RCVD 729 0.31 0.81 0.07 180 XMSubMetaSSx_00 727 0.40 0.80 0.20 181 T_XMDrugObfuBody_00 716 0.97 0.79 1.06 182 XMBody_78 713 0.81 0.79 0.83 183 RELAYCOUNTRY_NL 711 0.36 0.79 0.15 184 RCVD_IN_IADB_VOUCHED 704 2.85 0.78 3.86 185 MPART_ALT_DIFF_COUNT 702 0.39 0.78 0.19 186 XMClaimOffer 698 0.54 0.77 0.42 187 DEAR_FRIEND 693 0.28 0.77 0.04 188 REMOVE_BEFORE_LINK 638 0.51 0.71 0.41 189 DKIM_ADSP_NXDOMAIN 637 0.54 0.70 0.46 190 LOADSA_MONEY_COMBO 625 0.31 0.69 0.12 191 XM_UB95 622 0.23 0.69 0.01 192 HTML_TAG_BALANCE_BODY 621 0.63 0.69 0.59 193 XMSubMetaD_03 601 0.30 0.66 0.12 194 XM_H_Long_From03 600 0.32 0.66 0.15 195 BASE64_LENGTH_79_INF 598 0.32 0.66 0.15 196 URI_WP_HACKED 597 0.22 0.66 0.00 197 TR_Caps_n_Bayes_99 586 0.52 0.65 0.46 198 XM_OfRef7 583 0.76 0.65 0.82 199 FROM_LOCAL_NOVOWEL 568 0.26 0.63 0.08 200 TRACKER_ID 567 0.32 0.63 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155991 87.75 94.37 84.51 2 DKIM_SIGNED 140050 78.87 85.00 75.87 3 XM_DK_Pass 138104 77.05 81.62 74.82 4 DKIM_VALID 132673 73.90 78.04 71.88 5 DCC_CHECK_NEGATIVE 106787 44.50 17.22 57.85 6 DKIM_VALID_AU 101434 57.94 64.03 54.95 7 BAYES_50 100281 46.53 30.61 54.33 8 XMListUnsubscribeExists 93198 58.30 74.26 50.49 9 DCC_CHECK 75117 54.02 81.23 40.70 10 XM_H_QuotedFrom 64018 42.18 57.48 34.68 11 DKIM_VALID_EF 56615 27.78 21.88 30.67 12 HTML_FONT_LOW_CONTRAST 56094 31.98 35.23 30.39 13 T_TM2_M_HEADER_IN_MSG 47153 23.73 20.01 25.55 14 LOC_TINY_FONT_1 46489 29.29 37.67 25.19 15 MIME_HTML_ONLY 43665 26.65 32.77 23.66 16 XMSubLong 40592 22.30 22.92 21.99 17 XM_DK_Undo_02 36430 29.79 50.31 19.74 18 FVGT_m_MULTI_ODD 35807 21.40 25.48 19.40 19 BAYES_99 34280 27.35 45.28 18.57 20 ALL_TRUSTED 34068 12.78 1.18 18.46 21 BAYES_999 30808 24.08 39.16 16.69 22 MultiRelay 30132 16.72 17.53 16.32 23 XM_DKIMWhitelistDomains 28362 10.33 0.04 15.37 24 T_KAM_HTML_FONT_INVALID 26360 16.14 19.94 14.28 25 XM_Multi_Part_URI 24783 14.67 17.21 13.43 26 RCVD_IN_RP_SAFE 23646 11.18 7.85 12.81 27 LOTS_OF_MONEY 23204 12.17 11.36 12.57 28 RCVD_IN_RP_CERTIFIED 21890 10.16 6.69 11.86 29 XM_Body_Dirty_Words 21803 14.63 20.38 11.81 30 FSL_BULK_SIG 17812 10.59 12.52 9.65 31 XM_Evil_Numbers_Gen 16213 10.43 13.79 8.78 32 TR_DCC_Bayes_99 16089 17.70 36.05 8.72 33 HTML_IMAGE_RATIO_02 15735 11.60 17.89 8.52 34 LotsOfNums_01 14362 8.15 8.91 7.78 35 BOTNET_IPINHOSTNAME 13371 8.76 11.85 7.24 36 BAYES_00 13348 5.45 1.82 7.23 37 BAYES_60 11956 6.53 6.64 6.48 38 T_XMDrugObfuBody_14 11636 7.31 9.37 6.30 39 XM_H_Long_From01 11583 7.22 9.15 6.28 40 TooManyTo_001 11342 6.92 8.51 6.14 41 UNPARSEABLE_RELAY 11250 4.79 2.12 6.09 42 TVD_RCVD_IP 10354 3.88 0.34 5.61 43 TR_XM_DK_Bayes 10211 4.14 1.30 5.53 44 RCVD_IN_IADB_LISTED 10151 4.39 2.13 5.50 45 TR_XM_DK_Bayes1 9883 4.00 1.22 5.35 46 XM_SendGrid 9877 4.97 4.20 5.35 47 IN_ZIMBRA_NJ_WHITELIST 9832 3.58 0.03 5.33 48 T_TooManySym_01 9691 4.52 3.04 5.25 49 XMStrtUSub 9544 4.82 4.10 5.17 50 HTML_IMAGE_RATIO_04 9422 6.69 9.92 5.10 51 XM_B_Phish_Phrases 9383 6.56 9.59 5.08 52 RCVD_IN_MSPIKE_H2 9278 4.73 4.11 5.03 53 XM_UncommonTLD01 9249 6.64 9.98 5.01 54 XMSubMetaSx_00 8992 5.61 7.11 4.87 55 RCVD_IN_IADB_SPF 8677 3.78 1.89 4.70 56 TR_XM_DK_Bayes2 8366 3.38 1.04 4.53 57 T_REMOTE_IMAGE 8239 4.55 4.73 4.46 58 MIME_QP_LONG_LINE 7977 4.74 5.58 4.32 59 BAYES_80 7919 5.52 8.03 4.29 60 TR_XM_DocInvoice 7866 4.83 6.00 4.26 61 FROM_EXCESS_BASE64 7860 5.25 7.28 4.26 62 XMSexyCombo_05 7768 6.65 11.63 4.21 63 RELAYCOUNTRY_META 7743 8.51 17.31 4.19 64 XMNumbers 7589 4.47 5.19 4.11 65 RCVD_IN_IADB_SENDERID 7527 3.33 1.80 4.08 66 DKIM_INVALID 7377 4.97 6.95 4.00 67 RCVD_IN_IADB_DK 7229 3.22 1.79 3.92 68 RCVD_IN_IADB_VOUCHED 7128 2.85 0.78 3.86 69 XM_H_PHPOS 6876 2.91 1.24 3.73 70 INVALID_MSGID 6776 2.57 0.33 3.67 71 TM2_M_URI_OPT_OUT 6695 3.42 3.01 3.63 72 TO_MALFORMED 6355 2.32 0.02 3.44 73 ANY_BOUNCE_MESSAGE 6162 2.38 0.43 3.34 74 BOUNCE_MESSAGE 6158 2.38 0.43 3.34 75 HTML_IMAGE_RATIO_06 5830 3.62 4.56 3.16 76 MPART_ALT_DIFF 5688 4.36 6.97 3.08 77 MIME_HTML_MOSTLY 5512 3.51 4.58 2.99 78 BAYES_95 5411 3.51 4.68 2.93 79 IN_HORDE_ADDRESS_BOOK 4948 1.83 0.08 2.68 80 BAYES_40 4830 2.17 1.26 2.62 81 RCVD_IN_MSPIKE_WL 4675 1.97 0.82 2.53 82 RCVD_IN_MSPIKE_H3 4675 1.97 0.82 2.53 83 SUBJ_ALL_CAPS 4630 2.36 2.04 2.51 84 MIME_HEADER_CTYPE_ONLY 4437 1.65 0.12 2.40 85 TR_Symld_Words 4389 1.93 1.02 2.38 86 MAILING_LIST_MULTI 4344 2.13 1.68 2.35 87 XM_PDF 4266 1.70 0.46 2.31 88 T_TooManySym_02 4118 1.78 0.87 2.23 89 XM_OfRef6 3693 1.89 1.66 2.00 90 USER_IN_DEF_DKIM_WL 3692 1.38 0.10 2.00 91 NO_DNS_FOR_FROM 3620 2.15 2.52 1.96 92 XM_DK_Undo_01 3618 1.96 1.96 1.96 93 BAYES_20 3609 1.67 1.07 1.96 94 RCVD_IN_IADB_OPTIN 3599 1.46 0.46 1.95 95 HTML_IMAGE_RATIO_08 3541 2.28 3.02 1.92 96 BOTNET 3357 5.99 14.50 1.82 97 TooManyTo_002 3292 1.88 2.08 1.78 98 HTML_MIME_NO_HTML_TAG 3271 1.99 2.45 1.77 99 XMStockSpam_06 3072 1.54 1.29 1.66 100 XM_DIRTYINTL 3040 2.50 4.24 1.65 101 XM_CamelCaseFrm001 2973 2.49 4.29 1.61 102 XM_GoogleGroups 2937 1.27 0.62 1.59 103 BAYES_05 2837 1.22 0.57 1.54 104 XM_SPF_SoftFail 2626 1.85 2.72 1.42 105 XMSexyCombo_01 2530 1.42 1.51 1.37 106 XM_ProductURIs 2474 1.46 1.71 1.34 107 USER_IN_WHITELIST 2466 0.90 0.00 1.34 108 RELAYCOUNTRY_CA 2459 1.97 3.27 1.33 109 URI_HEX 2394 1.93 3.21 1.30 110 XMBdyGiftCard01 2331 1.26 1.24 1.26 111 XM_D_tchamptons_WL 2300 0.84 0.00 1.25 112 URI_TRY_3LD 2278 1.17 1.03 1.23 113 UNTRUSTED_Relay 2260 4.55 11.33 1.22 114 XMPhish11 2215 1.31 1.54 1.20 115 XM_H_PHPMailer 2192 1.08 0.86 1.19 116 T_XMDrugObfuBody_08 2190 1.31 1.56 1.19 117 TooManyTo_003 2152 1.41 1.91 1.17 118 XMDiploma_00 2017 1.36 1.90 1.09 119 TM2_M_A_HREF_HREF 1995 1.01 0.86 1.08 120 MIME_HTML_ONLY_MULTI 1983 1.73 3.07 1.07 121 XM_B_REG_HTML 1978 1.30 1.76 1.07 122 T_TooManySym_03 1965 0.77 0.18 1.06 123 T_XMDrugObfuBody_00 1961 0.97 0.79 1.06 124 DKIM_ADSP_CUSTOM_MED 1881 1.55 2.63 1.02 125 XMSexyCombo_04 1842 0.81 0.42 1.00 126 XMBody_95 1774 0.69 0.14 0.96 127 HELO_NODOT 1740 0.70 0.19 0.94 128 XM_B_COPY_HTML 1693 0.89 0.84 0.92 129 TooManyTo_004 1672 1.13 1.57 0.91 130 XMSubMetaSxObfu_02 1648 0.72 0.35 0.89 131 XM_H_Long_From02 1551 1.70 3.47 0.84 132 XMBody_78 1525 0.81 0.79 0.83 133 XM_OfRef7 1511 0.76 0.65 0.82 134 XM_UB50 1509 2.07 4.64 0.82 135 NML_ADSP_CUSTOM_MED 1436 1.35 2.52 0.78 136 XMSubMetaI_00 1434 1.16 1.94 0.78 137 RCVD_IN_IADB_DOPTIN 1413 0.54 0.08 0.77 138 TooManyTo_005 1355 0.85 1.10 0.73 139 XMBrknScrpt_02 1349 0.83 1.04 0.73 140 TM2_M_VERY_LONG_WORD 1339 0.88 1.21 0.73 141 TR_MetaPhish_Combo_01 1281 0.67 0.62 0.69 142 BOTNET_NORDNS 1240 1.55 3.34 0.67 143 FILL_THIS_FORM 1238 0.53 0.25 0.67 144 XMGenDplmaNmb 1206 0.77 1.00 0.65 145 XMNoVowels 1198 0.55 0.34 0.65 146 RDNS_DYNAMIC 1186 0.79 1.09 0.64 147 RELAYCOUNTRY_GB 1163 0.77 1.07 0.63 148 HTML_TAG_BALANCE_BODY 1098 0.63 0.69 0.59 149 XMCapTrack 1065 0.51 0.39 0.58 150 T_FILL_THIS_FORM_LOAN 1062 0.43 0.14 0.58 151 XM_H_PHPOS_M 1055 0.56 0.54 0.57 152 RCVD_IN_BL_SPAMCOP_NET 1033 1.60 3.74 0.56 153 FORGED_GMAIL_RCVD 994 0.95 1.78 0.54 154 T_TooManySym_04 983 0.37 0.04 0.53 155 XMHTMLBadTable_001 978 0.82 1.41 0.53 156 T_FILL_THIS_FORM_SHORT 917 0.70 1.11 0.50 157 T_FILL_THIS_FORM_LONG 907 0.35 0.06 0.49 158 XMPhish30 895 1.01 2.10 0.48 159 TR_XM_RelayPhish 874 0.80 1.45 0.47 160 SpammyFromTLD_01 870 0.89 1.75 0.47 161 TR_Caps_n_Bayes_99 853 0.52 0.65 0.46 162 RELAYCOUNTRY_DE 848 0.59 0.86 0.46 163 DKIM_ADSP_NXDOMAIN 846 0.54 0.70 0.46 164 T_MONEY_PERCENT 842 0.60 0.90 0.46 165 TR_LOTS_OF_MONEY2 842 0.60 0.90 0.46 166 UPPERCASE_50_75 840 0.34 0.11 0.46 167 XM_B_TRADE_HTML 807 0.45 0.47 0.44 168 XMRcvdHeader_15 802 0.29 0.00 0.43 169 XMClaimOffer 781 0.54 0.77 0.42 170 DIET_1 778 0.96 2.06 0.42 171 XMBody_17 771 1.06 2.37 0.42 172 REMOVE_BEFORE_LINK 757 0.51 0.71 0.41 173 T_XMHurry_00 750 0.84 1.73 0.41 174 XM_ShortIntro_01 749 0.37 0.30 0.41 175 XMBody_29 747 0.42 0.45 0.40 176 T_OBFU_PDF_ATTACH 739 0.30 0.10 0.40 177 HTML_FONT_FACE_BAD 732 0.59 0.98 0.40 178 XMSUPPORT 677 0.25 0.00 0.37 179 TR_MetaPhish_Combo_01b 676 0.27 0.08 0.37 180 FROM_EGROUPS 660 0.24 0.00 0.36 181 XM_H_SpoofStaff4 649 0.25 0.05 0.35 182 URI_NOVOWEL 647 0.62 1.17 0.35 183 XM_BadFromFormat 619 0.58 1.09 0.34 184 XMMoneyMeta_00 603 0.50 0.84 0.33 185 HTML_IMAGE_ONLY_24 588 0.34 0.39 0.32 186 HTML_IMAGE_ONLY_28 588 0.32 0.33 0.32 187 T_Symld_Words_02 586 0.41 0.61 0.32 188 RELAYCOUNTRY_AU 575 0.38 0.52 0.31 189 TR_Sbj_FN_Bdy 575 0.29 0.25 0.31 190 AC_DIV_BONANZA 573 0.25 0.11 0.31 191 HTTPS_HTTP_MISMATCH 571 0.33 0.38 0.31 192 MISSING_HEADERS 559 0.37 0.51 0.30 193 SUBJ_DOLLARS 555 0.70 1.52 0.30 194 MSGID_FROM_MTA_HEADER 554 0.26 0.17 0.30 195 HTML_IMAGE_ONLY_32 546 0.25 0.16 0.30 196 XMSubEmpty 539 0.26 0.21 0.29 197 XMDateMe_00 537 0.26 0.19 0.29 198 XM_E_Blogspot 535 0.35 0.47 0.29 199 XMSubNoVowel 528 0.27 0.23 0.29 200 XMHTML_After_End 520 1.22 3.12 0.28 ----------------------------------------------------------------------