Email: 259451 Autolearn: 0 AvgScore: 3.94 AvgScanTime: 3.66 sec Spam: 93549 Autolearn: 0 AvgScore: 13.43 AvgScanTime: 4.19 sec Ham: 165902 Autolearn: 0 AvgScore: -1.41 AvgScanTime: 3.36 sec Time Spent Running SA: 263.76 hours Time Spent Processing Spam: 108.79 hours Time Spent Processing Ham: 154.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88336 87.37 94.43 83.40 2 DKIM_SIGNED 79408 80.56 84.88 78.12 3 XM_DK_Pass 77595 79.23 82.95 77.13 4 DCC_CHECK 75752 57.94 80.98 44.95 5 DKIM_VALID 73999 75.59 79.10 73.60 6 XMListUnsubscribeExists 69178 60.15 73.95 52.37 7 DKIM_VALID_AU 63304 62.61 67.67 59.76 8 XM_H_QuotedFrom 54550 45.24 58.31 37.86 9 XM_DK_Undo_02 48675 33.99 52.03 23.81 10 BAYES_99 44259 31.38 47.31 22.40 11 BAYES_999 38776 27.96 41.45 20.35 12 LOC_TINY_FONT_1 36901 32.94 39.45 29.28 13 TR_DCC_Bayes_99 35603 21.34 38.06 11.91 14 HTML_FONT_LOW_CONTRAST 35398 35.76 37.84 34.58 15 MIME_HTML_ONLY 28875 24.39 30.87 20.73 16 BAYES_50 27966 43.76 29.89 51.59 17 FVGT_m_MULTI_ODD 24838 23.17 26.55 21.27 18 XMSubLong 24532 23.30 26.22 21.66 19 HTML_IMAGE_RATIO_02 20405 13.58 21.81 8.93 20 XM_Body_Dirty_Words 20163 16.31 21.55 13.36 21 DKIM_VALID_EF 19232 28.83 20.56 33.49 22 T_TM2_M_HEADER_IN_MSG 17964 22.64 19.20 24.59 23 RELAYCOUNTRY_META 17000 9.62 18.17 4.80 24 T_KAM_HTML_FONT_INVALID 16386 14.54 17.52 12.86 25 MultiRelay 16368 15.66 17.50 14.62 26 DCC_CHECK_NEGATIVE 15923 40.27 17.02 53.38 27 XM_Multi_Part_URI 15069 14.67 16.11 13.85 28 XM_Evil_Numbers_Gen 13287 9.99 14.20 7.61 29 FSL_BULK_SIG 12952 11.39 13.85 10.01 30 BOTNET 12655 6.28 13.53 2.19 31 UNTRUSTED_Relay 11933 5.57 12.76 1.52 32 XM_B_Phish_Phrases 11361 7.81 12.14 5.37 33 BOTNET_IPINHOSTNAME 11274 9.72 12.05 8.41 34 XMSexyCombo_05 10361 6.83 11.08 4.44 35 LOTS_OF_MONEY 10073 8.49 10.77 7.20 36 XM_UncommonTLD01 9146 7.04 9.78 5.50 37 T_XMDrugObfuBody_14 9008 7.57 9.63 6.41 38 LotsOfNums_01 8978 7.96 9.60 7.04 39 HTML_IMAGE_RATIO_04 8807 7.40 9.41 6.26 40 TR_XM_DocInvoice 8171 6.46 8.73 5.18 41 XMSubMetaSx_00 8071 6.67 8.63 5.57 42 FROM_EXCESS_BASE64 7923 5.76 8.47 4.24 43 TooManyTo_001 7459 7.38 7.97 7.04 44 XM_H_Long_From01 7291 6.39 7.79 5.59 45 RCVD_IN_RP_SAFE 6860 12.24 7.33 15.01 46 BAYES_80 6547 5.43 7.00 4.55 47 MPART_ALT_DIFF 6070 4.42 6.49 3.26 48 BAYES_60 5962 6.56 6.37 6.67 49 RCVD_IN_RP_CERTIFIED 5718 11.40 6.11 14.38 50 XM_UB50 5559 2.71 5.94 0.89 51 XMStrtUSub 5529 5.56 5.91 5.36 52 T_REMOTE_IMAGE 5502 4.46 5.88 3.65 53 DKIM_INVALID 5409 4.97 5.78 4.51 54 XMNumbers 5092 4.68 5.44 4.25 55 MultiRelay_Combo 5075 2.08 5.42 0.20 56 MultiRelay_CC 5075 2.08 5.42 0.20 57 HTML_IMAGE_RATIO_06 5028 4.74 5.37 4.38 58 MIME_HTML_MOSTLY 4823 4.16 5.16 3.59 59 MIME_QP_LONG_LINE 4335 4.17 4.63 3.91 60 RCVD_IN_BL_SPAMCOP_NET 4266 1.88 4.56 0.37 61 BAYES_95 4154 3.59 4.44 3.11 62 XM_SendGrid 4136 4.96 4.42 5.26 63 XM_CamelCaseFrm001 3900 2.71 4.17 1.89 64 RCVD_IN_MSPIKE_H2 3541 4.48 3.79 4.88 65 XM_DIRTYINTL 3493 2.34 3.73 1.55 66 TR_Mismatch_TLD_02 3384 1.34 3.62 0.05 67 TM2_M_URI_OPT_OUT 3370 2.41 3.60 1.73 68 RCVD_IN_RP_RNBL 3271 1.27 3.50 0.02 69 XM_H_Long_From02 2958 1.66 3.16 0.81 70 XM_SPF_SoftFail 2839 1.96 3.03 1.35 71 XMSubMetaI_00 2818 1.70 3.01 0.95 72 URI_HEX 2797 1.77 2.99 1.07 73 T_TooManySym_01 2732 5.03 2.92 6.22 74 RELAYCOUNTRY_CA 2676 1.96 2.86 1.45 75 SpammyFromTLD_02 2640 1.15 2.82 0.21 76 NO_DNS_FOR_FROM 2624 2.35 2.80 2.10 77 HTML_MIME_NO_HTML_TAG 2592 2.18 2.77 1.84 78 RCVD_IN_PSBL 2573 1.19 2.75 0.31 79 SpammyFromTLD_01 2402 1.21 2.57 0.44 80 MIME_HTML_ONLY_MULTI 2378 1.62 2.54 1.10 81 XMHTML_After_End 2330 1.12 2.49 0.34 82 UNPARSEABLE_RELAY 2270 5.43 2.43 7.12 83 HTML_IMAGE_RATIO_08 2200 2.08 2.35 1.93 84 XMBdyGiftCard01 2192 1.49 2.34 1.01 85 XMLongAddy 2178 0.94 2.33 0.15 86 XMPhish30 2095 1.52 2.24 1.11 87 XMBody_17 1971 1.05 2.11 0.46 88 BOTNET_NORDNS 1961 1.23 2.10 0.74 89 BODY_URI_ONLY 1920 0.77 2.05 0.04 90 XM_UB99 1905 0.74 2.04 0.01 91 HTML_SHORT_LINK_IMG_1 1885 0.75 2.01 0.03 92 XMSubMetaSxObfu_03 1871 0.98 2.00 0.40 93 XM_UB60 1867 0.77 2.00 0.08 94 XMSexyCombo_01 1867 1.64 2.00 1.44 95 T_XMHurry_00 1849 1.13 1.98 0.66 96 TooManyTo_002 1843 1.87 1.97 1.82 97 XM_URI_RBL 1824 0.78 1.95 0.12 98 HTML_IMAGE_ONLY_08 1821 0.80 1.95 0.15 99 XM_OfRef6 1820 1.80 1.95 1.73 100 XMPhish11 1775 1.75 1.90 1.67 101 RELAYCOUNTRY_FR 1763 0.90 1.88 0.35 102 HTML_FONT_SIZE_LARGE 1721 0.73 1.84 0.10 103 TooManyTo_003 1688 1.48 1.80 1.29 104 URIBL_BLACK 1687 0.67 1.80 0.03 105 SUBJ_ALL_CAPS 1681 1.30 1.80 1.01 106 RELAYCOUNTRY_CN 1667 0.68 1.78 0.05 107 TM2_M_VERY_LONG_WORD 1615 1.21 1.73 0.92 108 XMDiploma_00 1594 1.41 1.70 1.25 109 XMSubMetaSSx_00 1564 0.74 1.67 0.21 110 T_XMDrugObfuBody_08 1546 1.29 1.65 1.09 111 MPART_ALT_DIFF_COUNT 1543 0.80 1.65 0.32 112 XMMoneyMeta_00 1521 0.73 1.63 0.22 113 BODY_ENHANCEMENT 1500 0.66 1.60 0.13 114 RCVD_IN_IADB_LISTED 1493 2.95 1.60 3.72 115 TR_LOTS_OF_MONEY2 1486 0.71 1.59 0.22 116 T_MONEY_PERCENT 1486 0.71 1.59 0.22 117 RELAYCOUNTRY_NG 1474 0.57 1.58 0.00 118 MAILING_LIST_MULTI 1473 2.00 1.57 2.24 119 XM_UB999 1460 0.57 1.56 0.01 120 DKIM_ADSP_CUSTOM_MED 1432 1.24 1.53 1.08 121 BAYES_00 1417 4.31 1.51 5.88 122 XM_B_REG_HTML 1414 1.43 1.51 1.38 123 TooManyTo_004 1407 1.20 1.50 1.02 124 BAYES_40 1378 2.09 1.47 2.44 125 PHOTO_EDITING_DIRECT 1376 0.53 1.47 0.00 126 SUBJ_DOLLARS 1369 0.68 1.46 0.24 127 DATE_IN_PAST_06_12 1310 0.54 1.40 0.05 128 URIBL_DBL_SPAM 1296 0.53 1.39 0.04 129 NML_ADSP_CUSTOM_MED 1286 0.99 1.37 0.78 130 RELAYCOUNTRY_AT 1271 0.63 1.36 0.21 131 RCVD_IN_IADB_SPF 1260 2.62 1.35 3.34 132 RCVD_IN_IADB_SENDERID 1204 2.41 1.29 3.04 133 XMStockSpam_06 1179 1.47 1.26 1.59 134 RCVD_IN_IADB_DK 1172 2.37 1.25 3.00 135 MISSING_HEADERS 1166 0.69 1.25 0.38 136 RELAYCOUNTRY_RU 1164 0.46 1.24 0.02 137 XMHTMLBadTable_001 1163 0.97 1.24 0.82 138 XM_ProductURIs 1156 1.22 1.24 1.22 139 XMBrknScrpt_02 1142 0.83 1.22 0.61 140 T_Symld_Words_02 1141 0.71 1.22 0.42 141 URI_TRY_3LD 1139 1.09 1.22 1.02 142 T_XMDrugObfuBody_00 1139 0.84 1.22 0.62 143 BAYES_20 1129 1.66 1.21 1.91 144 XM_B_COPY_HTML 1128 1.02 1.21 0.91 145 PLING_QUERY 1123 0.72 1.20 0.45 146 XM_DK_Undo_01 1120 1.63 1.20 1.88 147 DIET_1 1116 0.67 1.19 0.38 148 RDNS_DYNAMIC 1113 0.92 1.19 0.77 149 REPLYTO_WITHOUT_TO_CC 1090 0.46 1.17 0.06 150 LONG_JUNK_URI3 1089 0.51 1.16 0.14 151 TR_XM_DK_Bayes 1083 3.01 1.16 4.05 152 XM_BadFromFormat 1081 0.64 1.16 0.35 153 ALL_TRUSTED 1068 10.93 1.14 16.44 154 TR_XM_RelayPhish 1060 0.66 1.13 0.39 155 RELAYCOUNTRY_DE 1050 0.66 1.12 0.40 156 TR_XM_DK_Bayes1 1035 2.87 1.11 3.86 157 FSL_THIS_IS_ADV 1033 0.77 1.10 0.58 158 TR_LOTS_OF_MONEY1 1030 0.40 1.10 0.01 159 T_DEAR_BENEFICIARY 1025 0.40 1.10 0.00 160 T_FILL_THIS_FORM_SHORT 1010 0.78 1.08 0.61 161 FVGT_m_MULTI_ODD_EMAIL 999 0.46 1.07 0.12 162 T_TooManySym_02 997 1.81 1.07 2.23 163 TR_XM_DK_Bayes2 994 2.73 1.06 3.67 164 MILLION_USD 992 0.38 1.06 0.00 165 XM_H_PHPOS 969 1.27 1.04 1.40 166 XM_HighProb1 966 0.39 1.03 0.02 167 T_HTML_TAG_BALANCE_CENTER 965 0.48 1.03 0.17 168 MONEY_FRAUD_3 944 0.36 1.01 0.00 169 HTML_FONT_SIZE_HUGE 926 0.48 0.99 0.20 170 FORGED_OUTLOOK_HTML 923 0.36 0.99 0.00 171 FORGED_OUTLOOK_TAGS 907 0.36 0.97 0.02 172 XM_UB80 905 0.38 0.97 0.05 173 FORGED_MUA_OUTLOOK 903 0.38 0.97 0.04 174 TooManyTo_005 902 0.91 0.96 0.88 175 FSL_NEW_HELO_USER 893 0.34 0.95 0.00 176 PP_MIME_FAKE_ASCII_TEXT 870 0.50 0.93 0.25 177 XMBody_78 851 0.78 0.91 0.71 178 XMGenDplmaNmb 850 0.87 0.91 0.85 179 XM_Body_Obfu01 850 0.48 0.91 0.24 180 XM_RXBody 846 0.43 0.90 0.16 181 FORGED_YAHOO_RCVD 836 0.36 0.89 0.06 182 TR_MetaPhish_Combo_01 792 0.74 0.85 0.68 183 HTML_TAG_BALANCE_BODY 780 0.53 0.83 0.36 184 XMPhish14 778 0.42 0.83 0.18 185 RELAYCOUNTRY_GB 772 0.71 0.83 0.65 186 TR_Symld_Words 769 1.27 0.82 1.52 187 HTML_FONT_FACE_BAD 764 0.83 0.82 0.84 188 URIBL_SBL_A 750 0.35 0.80 0.10 189 XM_ShortIntro_01 748 0.56 0.80 0.42 190 DATE_IN_PAST_03_06 718 0.33 0.77 0.09 191 XMSubMetaSx_01 718 0.46 0.77 0.28 192 BAYES_05 700 1.16 0.75 1.40 193 XM_H_PHPMailer 696 0.85 0.74 0.91 194 XMSlimDrugH 694 0.44 0.74 0.27 195 XMClaimOffer 693 0.32 0.74 0.09 196 URI_NOVOWEL 667 0.41 0.71 0.25 197 RCVD_IN_IADB_VOUCHED 656 1.69 0.70 2.25 198 XMGppyBdWords 655 0.30 0.70 0.08 199 RCVD_IN_MSPIKE_H3 639 1.61 0.68 2.13 200 RCVD_IN_MSPIKE_WL 639 1.61 0.68 2.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138358 87.37 94.43 83.40 2 DKIM_SIGNED 129595 80.56 84.88 78.12 3 XM_DK_Pass 127964 79.23 82.95 77.13 4 DKIM_VALID 122108 75.59 79.10 73.60 5 DKIM_VALID_AU 99146 62.61 67.67 59.76 6 DCC_CHECK_NEGATIVE 88565 40.27 17.02 53.38 7 XMListUnsubscribeExists 86882 60.15 73.95 52.37 8 BAYES_50 85581 43.76 29.89 51.59 9 DCC_CHECK 74571 57.94 80.98 44.95 10 XM_H_QuotedFrom 62816 45.24 58.31 37.86 11 HTML_FONT_LOW_CONTRAST 57377 35.76 37.84 34.58 12 DKIM_VALID_EF 55560 28.83 20.56 33.49 13 LOC_TINY_FONT_1 48571 32.94 39.45 29.28 14 T_TM2_M_HEADER_IN_MSG 40788 22.64 19.20 24.59 15 XM_DK_Undo_02 39503 33.99 52.03 23.81 16 BAYES_99 37165 31.38 47.31 22.40 17 XMSubLong 35930 23.30 26.22 21.66 18 FVGT_m_MULTI_ODD 35280 23.17 26.55 21.27 19 MIME_HTML_ONLY 34396 24.39 30.87 20.73 20 BAYES_999 33765 27.96 41.45 20.35 21 XM_DKIMWhitelistDomains 30328 11.71 0.06 18.28 22 ALL_TRUSTED 27281 10.93 1.14 16.44 23 RCVD_IN_RP_SAFE 24898 12.24 7.33 15.01 24 MultiRelay 24252 15.66 17.50 14.62 25 RCVD_IN_RP_CERTIFIED 23865 11.40 6.11 14.38 26 XM_Multi_Part_URI 22982 14.67 16.11 13.85 27 XM_Body_Dirty_Words 22164 16.31 21.55 13.36 28 T_KAM_HTML_FONT_INVALID 21335 14.54 17.52 12.86 29 TR_DCC_Bayes_99 19760 21.34 38.06 11.91 30 FSL_BULK_SIG 16610 11.39 13.85 10.01 31 HTML_IMAGE_RATIO_02 14821 13.58 21.81 8.93 32 BOTNET_IPINHOSTNAME 13946 9.72 12.05 8.41 33 XM_Evil_Numbers_Gen 12624 9.99 14.20 7.61 34 LOTS_OF_MONEY 11942 8.49 10.77 7.20 35 UNPARSEABLE_RELAY 11810 5.43 2.43 7.12 36 TooManyTo_001 11678 7.38 7.97 7.04 37 LotsOfNums_01 11676 7.96 9.60 7.04 38 BAYES_60 11067 6.56 6.37 6.67 39 TVD_RCVD_IP 10936 4.39 0.49 6.59 40 T_XMDrugObfuBody_14 10631 7.57 9.63 6.41 41 HTML_IMAGE_RATIO_04 10387 7.40 9.41 6.26 42 T_TooManySym_01 10318 5.03 2.92 6.22 43 BAYES_00 9763 4.31 1.51 5.88 44 XM_H_Long_From01 9278 6.39 7.79 5.59 45 XMSubMetaSx_00 9243 6.67 8.63 5.57 46 IN_ZIMBRA_NJ_WHITELIST 9230 3.57 0.03 5.56 47 XM_UncommonTLD01 9126 7.04 9.78 5.50 48 XM_B_Phish_Phrases 8909 7.81 12.14 5.37 49 XMStrtUSub 8900 5.56 5.91 5.36 50 XM_SendGrid 8725 4.96 4.42 5.26 51 TR_XM_DocInvoice 8586 6.46 8.73 5.18 52 RCVD_IN_MSPIKE_H2 8092 4.48 3.79 4.88 53 RELAYCOUNTRY_META 7968 9.62 18.17 4.80 54 BAYES_80 7542 5.43 7.00 4.55 55 DKIM_INVALID 7487 4.97 5.78 4.51 56 XMSexyCombo_05 7359 6.83 11.08 4.44 57 HTML_IMAGE_RATIO_06 7274 4.74 5.37 4.38 58 XMNumbers 7056 4.68 5.44 4.25 59 FROM_EXCESS_BASE64 7033 5.76 8.47 4.24 60 INVALID_MSGID 6758 2.68 0.22 4.07 61 TR_XM_DK_Bayes 6723 3.01 1.16 4.05 62 TO_MALFORMED 6659 2.57 0.02 4.01 63 MIME_QP_LONG_LINE 6489 4.17 4.63 3.91 64 TR_XM_DK_Bayes1 6408 2.87 1.11 3.86 65 RCVD_IN_IADB_LISTED 6167 2.95 1.60 3.72 66 TR_XM_DK_Bayes2 6086 2.73 1.06 3.67 67 T_REMOTE_IMAGE 6063 4.46 5.88 3.65 68 MIME_HTML_MOSTLY 5958 4.16 5.16 3.59 69 BOUNCE_MESSAGE 5956 2.41 0.33 3.59 70 ANY_BOUNCE_MESSAGE 5956 2.41 0.33 3.59 71 RCVD_IN_IADB_SPF 5541 2.62 1.35 3.34 72 MPART_ALT_DIFF 5403 4.42 6.49 3.26 73 BAYES_95 5158 3.59 4.44 3.11 74 RCVD_IN_IADB_SENDERID 5041 2.41 1.29 3.04 75 RCVD_IN_IADB_DK 4971 2.37 1.25 3.00 76 IN_HORDE_ADDRESS_BOOK 4846 1.90 0.09 2.92 77 USER_IN_DEF_DKIM_WL 4253 1.64 0.01 2.56 78 BAYES_40 4041 2.09 1.47 2.44 79 RCVD_IN_IADB_VOUCHED 3733 1.69 0.70 2.25 80 MAILING_LIST_MULTI 3718 2.00 1.57 2.24 81 T_TooManySym_02 3703 1.81 1.07 2.23 82 BOTNET 3632 6.28 13.53 2.19 83 RCVD_IN_MSPIKE_WL 3534 1.61 0.68 2.13 84 RCVD_IN_MSPIKE_H3 3527 1.61 0.68 2.13 85 NO_DNS_FOR_FROM 3477 2.35 2.80 2.10 86 HTML_IMAGE_RATIO_08 3194 2.08 2.35 1.93 87 BAYES_20 3166 1.66 1.21 1.91 88 XM_CamelCaseFrm001 3130 2.71 4.17 1.89 89 XM_DK_Undo_01 3117 1.63 1.20 1.88 90 HTML_MIME_NO_HTML_TAG 3056 2.18 2.77 1.84 91 XM_PDF 3040 1.32 0.40 1.83 92 TooManyTo_002 3017 1.87 1.97 1.82 93 TM2_M_URI_OPT_OUT 2870 2.41 3.60 1.73 94 XM_OfRef6 2863 1.80 1.95 1.73 95 XMPhish11 2766 1.75 1.90 1.67 96 XMStockSpam_06 2637 1.47 1.26 1.59 97 XM_GoogleGroups 2607 1.24 0.64 1.57 98 XM_DIRTYINTL 2569 2.34 3.73 1.55 99 UNTRUSTED_Relay 2530 5.57 12.76 1.52 100 TR_Symld_Words 2518 1.27 0.82 1.52 101 RELAYCOUNTRY_CA 2402 1.96 2.86 1.45 102 XMSexyCombo_01 2384 1.64 2.00 1.44 103 USER_IN_WHITELIST 2342 0.90 0.00 1.41 104 XM_H_PHPOS 2320 1.27 1.04 1.40 105 BAYES_05 2315 1.16 0.75 1.40 106 XM_B_REG_HTML 2295 1.43 1.51 1.38 107 XM_SPF_SoftFail 2234 1.96 3.03 1.35 108 TooManyTo_003 2140 1.48 1.80 1.29 109 XMDiploma_00 2066 1.41 1.70 1.25 110 XM_ProductURIs 2019 1.22 1.24 1.22 111 T_TooManySym_03 1935 0.79 0.12 1.17 112 XMPhish30 1844 1.52 2.24 1.11 113 XMSexyCombo_04 1844 0.94 0.63 1.11 114 MIME_HTML_ONLY_MULTI 1827 1.62 2.54 1.10 115 T_XMDrugObfuBody_08 1811 1.29 1.65 1.09 116 DKIM_ADSP_CUSTOM_MED 1784 1.24 1.53 1.08 117 URI_HEX 1783 1.77 2.99 1.07 118 FILL_THIS_FORM 1723 0.77 0.29 1.04 119 TooManyTo_004 1699 1.20 1.50 1.02 120 URI_TRY_3LD 1694 1.09 1.22 1.02 121 XMSubMetaSxObfu_02 1683 0.74 0.27 1.01 122 SUBJ_ALL_CAPS 1681 1.30 1.80 1.01 123 XMBdyGiftCard01 1677 1.49 2.34 1.01 124 RCVD_IN_IADB_OPTIN 1642 0.78 0.42 0.99 125 XMSubMetaI_00 1582 1.70 3.01 0.95 126 XMBody_95 1582 0.67 0.17 0.95 127 T_FILL_THIS_FORM_LOAN 1574 0.67 0.18 0.95 128 TM2_M_VERY_LONG_WORD 1525 1.21 1.73 0.92 129 XM_B_COPY_HTML 1515 1.02 1.21 0.91 130 XM_H_PHPMailer 1505 0.85 0.74 0.91 131 XM_UB50 1474 2.71 5.94 0.89 132 TooManyTo_005 1467 0.91 0.96 0.88 133 XMGenDplmaNmb 1417 0.87 0.91 0.85 134 T_FILL_THIS_FORM_LONG 1413 0.57 0.06 0.85 135 HTML_FONT_FACE_BAD 1395 0.83 0.82 0.84 136 HELO_NODOT 1366 0.64 0.31 0.82 137 XMHTMLBadTable_001 1358 0.97 1.24 0.82 138 XM_H_Long_From02 1339 1.66 3.16 0.81 139 NML_ADSP_CUSTOM_MED 1286 0.99 1.37 0.78 140 RDNS_DYNAMIC 1282 0.92 1.19 0.77 141 BOTNET_NORDNS 1223 1.23 2.10 0.74 142 XMBody_78 1185 0.78 0.91 0.71 143 TR_MetaPhish_Combo_01 1121 0.74 0.85 0.68 144 T_TooManySym_04 1097 0.43 0.01 0.66 145 T_XMHurry_00 1093 1.13 1.98 0.66 146 RELAYCOUNTRY_GB 1082 0.71 0.83 0.65 147 T_XMDrugObfuBody_00 1033 0.84 1.22 0.62 148 T_FILL_THIS_FORM_SHORT 1017 0.78 1.08 0.61 149 XMBrknScrpt_02 1014 0.83 1.22 0.61 150 FSL_THIS_IS_ADV 962 0.77 1.10 0.58 151 XM_H_PHPOS_M 957 0.54 0.47 0.58 152 XMCapTrack 950 0.54 0.49 0.57 153 XMNoVowels 918 0.48 0.34 0.55 154 DKIM_ADSP_NXDOMAIN 897 0.50 0.41 0.54 155 ADMITS_SPAM 828 0.46 0.38 0.50 156 FORGED_GMAIL_RCVD 770 0.51 0.58 0.46 157 XMBody_17 765 1.05 2.11 0.46 158 XMRcvdHeader_15 754 0.29 0.00 0.45 159 PLING_QUERY 747 0.72 1.20 0.45 160 XM_Walgreens_Forge 739 0.33 0.11 0.45 161 SpammyFromTLD_01 731 1.21 2.57 0.44 162 TM2_M_A_HREF_HREF 716 0.43 0.41 0.43 163 XM_ShortIntro_01 705 0.56 0.80 0.42 164 T_Symld_Words_02 689 0.71 1.22 0.42 165 XMSubMetaSxObfu_03 670 0.98 2.00 0.40 166 XMGappySubj_01 669 0.39 0.38 0.40 167 RELAYCOUNTRY_DE 661 0.66 1.12 0.40 168 HTML_IMAGE_ONLY_32 661 0.31 0.16 0.40 169 TR_XM_RelayPhish 646 0.66 1.13 0.39 170 RELAYCOUNTRY_AU 641 0.40 0.42 0.39 171 RCVD_IN_IADB_DOPTIN 634 0.27 0.08 0.38 172 MISSING_HEADERS 631 0.69 1.25 0.38 173 XMSUPPORT 631 0.24 0.00 0.38 174 DIET_1 627 0.67 1.19 0.38 175 XM_H_SpoofStaff4 625 0.27 0.08 0.38 176 XM_D_tchamptons_WL 625 0.24 0.01 0.38 177 RCVD_IN_BL_SPAMCOP_NET 613 1.88 4.56 0.37 178 HTML_TAG_BALANCE_BODY 604 0.53 0.83 0.36 179 FROM_EGROUPS 592 0.23 0.01 0.36 180 XM_BadFromFormat 582 0.64 1.16 0.35 181 RELAYCOUNTRY_FR 576 0.90 1.88 0.35 182 T_TooManySym_05 571 0.22 0.00 0.34 183 XMHTML_After_End 570 1.12 2.49 0.34 184 XMSubNoVowel 570 0.32 0.27 0.34 185 XMBody_29 551 0.24 0.07 0.33 186 MPART_ALT_DIFF_COUNT 536 0.80 1.65 0.32 187 TR_LOTS_OF_MONEY3 532 0.39 0.52 0.32 188 TR_MetaPhish_Combo_01b 527 0.23 0.08 0.32 189 XM_B_TRADE_HTML 526 0.41 0.58 0.32 190 XM_H_XFINITY 513 0.20 0.00 0.31 191 RCVD_IN_PSBL 511 1.19 2.75 0.31 192 HTML_IMAGE_ONLY_28 505 0.31 0.32 0.30 193 HTTPS_HTTP_MISMATCH 504 0.38 0.52 0.30 194 XMDateMe_00 491 0.31 0.33 0.30 195 TVD_SPACE_RATIO 485 0.30 0.32 0.29 196 HTML_IMAGE_ONLY_24 481 0.37 0.51 0.29 197 RELAYCOUNTRY_NL 469 0.41 0.64 0.28 198 XMSubMetaSx_01 468 0.46 0.77 0.28 199 XMSlimDrugH 456 0.44 0.74 0.27 200 T_OBFU_PDF_ATTACH 453 0.22 0.13 0.27 ----------------------------------------------------------------------