Email: 299450 Autolearn: 0 AvgScore: 3.04 AvgScanTime: 3.46 sec Spam: 93372 Autolearn: 0 AvgScore: 12.67 AvgScanTime: 4.53 sec Ham: 206078 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 2.98 sec Time Spent Running SA: 287.95 hours Time Spent Processing Spam: 117.36 hours Time Spent Processing Ham: 170.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88158 80.89 94.42 74.77 2 DKIM_SIGNED 78714 72.69 84.30 67.43 3 XM_DK_Pass 76752 71.40 82.20 66.50 4 DCC_CHECK 75987 50.72 81.38 36.83 5 DKIM_VALID 72442 67.62 77.58 63.10 6 XMListUnsubscribeExists 67989 52.42 72.82 43.17 7 DKIM_VALID_AU 59438 52.28 63.66 47.12 8 XM_H_QuotedFrom 50995 39.48 54.61 32.63 9 XM_DK_Undo_02 46854 26.94 50.18 16.41 10 BAYES_99 41832 24.63 44.80 15.49 11 LOC_TINY_FONT_1 36310 26.03 38.89 20.21 12 BAYES_999 36299 21.68 38.88 13.89 13 HTML_FONT_LOW_CONTRAST 34666 29.71 37.13 26.35 14 TR_DCC_Bayes_99 33191 16.26 35.55 7.52 15 MIME_HTML_ONLY 31412 23.63 33.64 19.09 16 BAYES_50 28987 47.58 31.04 55.07 17 FVGT_m_MULTI_ODD 26056 21.94 27.91 19.24 18 XMSubLong 22522 19.38 24.12 17.23 19 XM_Body_Dirty_Words 19626 12.72 21.02 8.96 20 DKIM_VALID_EF 19027 24.09 20.38 25.78 21 T_KAM_HTML_FONT_INVALID 18593 14.60 19.91 12.19 22 HTML_IMAGE_RATIO_02 18194 11.58 19.49 8.00 23 XM_Multi_Part_URI 17190 13.67 18.41 11.52 24 T_TM2_M_HEADER_IN_MSG 16722 26.78 17.91 30.80 25 RELAYCOUNTRY_META 16536 8.13 17.71 3.79 26 DCC_CHECK_NEGATIVE 15890 47.87 17.02 61.85 27 XM_Evil_Numbers_Gen 15681 10.42 16.79 7.53 28 BOTNET 14692 6.08 15.73 1.71 29 MultiRelay 14462 15.69 15.49 15.78 30 FSL_BULK_SIG 13219 10.97 14.16 9.52 31 BOTNET_IPINHOSTNAME 11894 7.63 12.74 5.31 32 LOTS_OF_MONEY 11737 11.72 12.57 11.33 33 UNTRUSTED_Relay 11567 4.66 12.39 1.16 34 XMSexyCombo_05 11168 5.85 11.96 3.08 35 HTML_IMAGE_RATIO_04 9510 5.47 10.19 3.33 36 T_XMDrugObfuBody_14 8977 7.34 9.61 6.32 37 XM_B_Phish_Phrases 8445 5.97 9.04 4.58 38 XM_H_Long_From01 8197 12.84 8.78 14.68 39 XMSubMetaSx_00 8055 5.47 8.63 4.04 40 FROM_EXCESS_BASE64 7802 4.97 8.36 3.43 41 LotsOfNums_01 7462 7.02 7.99 6.58 42 TooManyTo_001 7077 6.40 7.58 5.87 43 RCVD_IN_RP_SAFE 7070 9.77 7.57 10.77 44 MPART_ALT_DIFF 6959 4.73 7.45 3.49 45 BAYES_80 6416 4.58 6.87 3.54 46 DKIM_INVALID 6272 5.07 6.72 4.33 47 TR_XM_DocInvoice 6135 4.90 6.57 4.14 48 HTML_IMAGE_RATIO_06 6020 4.05 6.45 2.96 49 RCVD_IN_RP_CERTIFIED 5923 8.76 6.34 9.85 50 XMStrtUSub 5832 5.24 6.25 4.79 51 BAYES_60 5288 6.29 5.66 6.57 52 XM_UncommonTLD01 5137 4.81 5.50 4.50 53 NO_DNS_FOR_FROM 4782 3.75 5.12 3.13 54 XMNumbers 4701 4.15 5.03 3.75 55 RCVD_IN_BL_SPAMCOP_NET 4423 1.73 4.74 0.37 56 MIME_HTML_MOSTLY 4423 3.48 4.74 2.91 57 XM_SendGrid 4415 4.76 4.73 4.78 58 BAYES_95 4370 3.12 4.68 2.42 59 XM_UB50 4254 1.95 4.56 0.77 60 XM_DIRTYINTL 4106 2.61 4.40 1.79 61 T_TooManySym_01 4065 4.30 4.35 4.27 62 URI_HEX 3946 2.35 4.23 1.50 63 XM_CamelCaseFrm001 3646 2.52 3.90 1.89 64 RCVD_IN_PSBL 3562 1.26 3.81 0.10 65 MIME_QP_LONG_LINE 3528 4.15 3.78 4.32 66 RCVD_IN_RP_RNBL 3332 1.13 3.57 0.03 67 HTML_MIME_NO_HTML_TAG 3232 2.51 3.46 2.08 68 TM2_M_URI_OPT_OUT 3198 2.06 3.43 1.45 69 T_REMOTE_IMAGE 3185 3.90 3.41 4.12 70 MIME_HTML_ONLY_MULTI 3041 1.70 3.26 1.00 71 HTML_IMAGE_RATIO_08 3019 2.58 3.23 2.28 72 XMBody_17 2972 1.26 3.18 0.40 73 MultiRelay_CC 2794 1.03 2.99 0.14 74 MultiRelay_Combo 2794 1.03 2.99 0.14 75 BAYES_00 2726 5.49 2.92 6.65 76 XM_SPF_SoftFail 2655 1.79 2.84 1.31 77 XM_OfRef6 2513 1.78 2.69 1.36 78 RELAYCOUNTRY_CA 2471 1.71 2.65 1.29 79 SUBJ_ALL_CAPS 2462 8.45 2.64 11.09 80 RCVD_IN_MSPIKE_H2 2403 2.96 2.57 3.13 81 XMSubMetaI_00 2194 1.10 2.35 0.53 82 BOTNET_NORDNS 2150 0.73 2.30 0.02 83 RELAYCOUNTRY_DE 2060 0.90 2.21 0.30 84 RELAYCOUNTRY_FR 2048 0.87 2.19 0.27 85 UNPARSEABLE_RELAY 1982 3.56 2.12 4.21 86 XMSexyCombo_01 1975 1.03 2.12 0.54 87 PHOTO_EDITING_DIRECT 1877 0.64 2.01 0.02 88 XMPhish30 1817 0.91 1.95 0.44 89 T_XMDrugObfuBody_08 1805 1.26 1.93 0.96 90 TM2_M_VERY_LONG_WORD 1800 1.15 1.93 0.80 91 SUBJ_DOLLARS 1757 0.73 1.88 0.20 92 XMBdyGiftCard01 1754 1.21 1.88 0.91 93 TR_XM_DK_Bayes 1741 3.91 1.86 4.83 94 SpammyFromTLD_01 1705 0.88 1.83 0.45 95 XM_BadFromFormat 1681 0.75 1.80 0.27 96 XM_UB99 1679 0.57 1.80 0.01 97 TR_XM_DK_Bayes1 1651 3.65 1.77 4.50 98 XM_DK_Undo_01 1623 1.82 1.74 1.85 99 BAYES_40 1606 5.18 1.72 6.75 100 XM_URI_RBL 1604 0.62 1.72 0.13 101 XM_H_Long_From02 1586 1.17 1.70 0.93 102 RCVD_IN_IADB_LISTED 1584 3.84 1.70 4.82 103 MAILING_LIST_MULTI 1566 1.89 1.68 1.98 104 XMHTMLBadTable_001 1510 0.83 1.62 0.47 105 TooManyTo_002 1491 1.61 1.60 1.61 106 SpammyFromTLD_02 1402 0.57 1.50 0.15 107 DKIM_ADSP_CUSTOM_MED 1371 1.13 1.47 0.98 108 TR_XM_DK_Bayes2 1361 3.11 1.46 3.86 109 TooManyTo_003 1356 1.20 1.45 1.09 110 RCVD_IN_IADB_SPF 1353 3.31 1.45 4.16 111 BAYES_20 1349 1.73 1.44 1.86 112 DIET_1 1337 0.71 1.43 0.39 113 URIBL_DBL_SPAM 1287 0.45 1.38 0.02 114 XMBody_78 1285 0.85 1.38 0.61 115 MPART_ALT_DIFF_COUNT 1281 0.60 1.37 0.25 116 URI_TRY_3LD 1278 1.37 1.37 1.37 117 NML_ADSP_CUSTOM_MED 1278 0.88 1.37 0.66 118 XM_B_REG_HTML 1274 0.89 1.36 0.67 119 RCVD_IN_IADB_SENDERID 1270 2.96 1.36 3.68 120 XMDiploma_00 1266 1.07 1.36 0.95 121 LONG_JUNK_URI3 1266 0.48 1.36 0.08 122 RCVD_IN_IADB_DK 1259 2.87 1.35 3.57 123 RELAYCOUNTRY_AT 1256 0.48 1.35 0.09 124 RELAYCOUNTRY_CN 1252 0.44 1.34 0.04 125 T_TooManySym_02 1247 1.70 1.34 1.86 126 HTML_FONT_SIZE_HUGE 1246 0.49 1.33 0.11 127 XM_ProductURIs 1244 1.10 1.33 1.00 128 TR_XM_RelayPhish 1242 0.83 1.33 0.61 129 T_XMDrugObfuBody_00 1226 0.81 1.31 0.59 130 XMPhish14 1219 0.56 1.31 0.22 131 URIBL_BLACK 1211 0.42 1.30 0.02 132 ALL_TRUSTED 1202 19.04 1.29 27.08 133 BASE64_LENGTH_79_INF 1193 0.51 1.28 0.16 134 XMLongAddy 1189 0.46 1.27 0.10 135 T_HTML_TAG_BALANCE_CENTER 1174 0.49 1.26 0.14 136 INVALID_MSGID 1169 2.77 1.25 3.46 137 XMClaimOffer 1165 0.46 1.25 0.11 138 XM_UB60 1164 0.45 1.25 0.08 139 T_XMHurry_00 1158 0.60 1.24 0.31 140 XMStockSpam_06 1157 0.92 1.24 0.77 141 XM_UB999 1152 0.39 1.23 0.01 142 TooManyTo_004 1146 0.95 1.23 0.83 143 FILL_THIS_FORM 1137 0.81 1.22 0.62 144 XM_RXBody 1093 0.47 1.17 0.16 145 T_FILL_THIS_FORM_SHORT 1089 0.80 1.17 0.63 146 RELAYCOUNTRY_IT 1078 0.38 1.15 0.03 147 RCVD_IN_MSPIKE_H3 1061 2.18 1.14 2.65 148 RCVD_IN_MSPIKE_WL 1061 2.18 1.14 2.65 149 TR_Symld_Words 1049 1.95 1.12 2.32 150 XMHTML_After_End 1030 0.53 1.10 0.28 151 TM2_M_A_HREF_HREF 1004 0.91 1.08 0.83 152 XM_H_Long_From03 1002 0.41 1.07 0.11 153 XM_UB95 985 0.34 1.05 0.01 154 URG_BIZ 967 0.33 1.04 0.01 155 XM_UB80 962 0.34 1.03 0.03 156 XM_H_PHPOS 934 1.16 1.00 1.23 157 PLING_QUERY 933 0.60 1.00 0.41 158 FSL_THIS_IS_ADV 914 0.33 0.98 0.03 159 XM_H_PHPMailer 906 0.85 0.97 0.80 160 RELAYCOUNTRY_GB 896 0.69 0.96 0.57 161 XMSubMetaSxObfu_02 896 0.88 0.96 0.84 162 XM_HighProb1 877 0.31 0.94 0.02 163 FORGED_GMAIL_RCVD 870 0.64 0.93 0.51 164 XM_B_COPY_HTML 859 0.73 0.92 0.64 165 TooManyTo_005 854 0.77 0.91 0.70 166 XMPhish11 844 0.93 0.90 0.94 167 T_FILL_THIS_FORM_LONG 837 0.60 0.90 0.47 168 XMSexyCombo_04 832 0.31 0.89 0.05 169 URI_NOVOWEL 827 0.50 0.89 0.33 170 DATE_IN_PAST_12_24 819 0.32 0.88 0.07 171 RDNS_DYNAMIC 812 0.66 0.87 0.56 172 BODY_ENHANCEMENT 798 0.28 0.85 0.01 173 HTML_FONT_FACE_BAD 785 0.59 0.84 0.47 174 TR_LOTS_OF_MONEY2 779 0.52 0.83 0.38 175 T_MONEY_PERCENT 779 0.52 0.83 0.38 176 XMBrknScrpt_02 765 0.56 0.82 0.44 177 XMSlimDrugH 754 0.43 0.81 0.25 178 HTML_SHORT_LINK_IMG_1 746 0.27 0.80 0.03 179 TR_Mismatch_TLD_02 745 0.29 0.80 0.06 180 BAYES_05 737 1.28 0.79 1.51 181 RCVD_IN_IADB_VOUCHED 734 2.49 0.79 3.26 182 BODY_URI_ONLY 717 0.27 0.77 0.05 183 XM_Body_Obfu01 709 0.33 0.76 0.14 184 XMGenDplmaNmb 675 0.59 0.72 0.53 185 URI_WP_HACKED 666 0.23 0.71 0.00 186 XMBSHREFv2 664 0.29 0.71 0.09 187 HTML_IMAGE_ONLY_08 647 0.32 0.69 0.16 188 REMOVE_BEFORE_LINK 627 0.45 0.67 0.35 189 XM_Lotto 611 0.35 0.65 0.21 190 XMSubMetaSSx_00 597 0.28 0.64 0.12 191 LongTLD 597 0.29 0.64 0.13 192 TR_Caps_n_Bayes_99 597 0.33 0.64 0.20 193 LOADSA_MONEY_COMBO 580 0.22 0.62 0.04 194 XM_GoogleGroups 577 1.15 0.62 1.39 195 XMSubMetaSxObfu_03 569 0.36 0.61 0.25 196 RELAYCOUNTRY_IN 565 0.24 0.61 0.07 197 MONEY_BACK 534 0.23 0.57 0.07 198 MISSING_HEADERS 534 0.41 0.57 0.33 199 DATE_IN_PAST_06_12 533 0.30 0.57 0.17 200 HTML_IMAGE_ONLY_24 526 0.35 0.56 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154082 80.89 94.42 74.77 2 DKIM_SIGNED 138957 72.69 84.30 67.43 3 XM_DK_Pass 137046 71.40 82.20 66.50 4 DKIM_VALID 130041 67.62 77.58 63.10 5 DCC_CHECK_NEGATIVE 127455 47.87 17.02 61.85 6 BAYES_50 113488 47.58 31.04 55.07 7 DKIM_VALID_AU 97104 52.28 63.66 47.12 8 XMListUnsubscribeExists 88974 52.42 72.82 43.17 9 DCC_CHECK 75892 50.72 81.38 36.83 10 XM_H_QuotedFrom 67233 39.48 54.61 32.63 11 T_TM2_M_HEADER_IN_MSG 63475 26.78 17.91 30.80 12 ALL_TRUSTED 55815 19.04 1.29 27.08 13 HTML_FONT_LOW_CONTRAST 54311 29.71 37.13 26.35 14 DKIM_VALID_EF 53120 24.09 20.38 25.78 15 LOC_TINY_FONT_1 41648 26.03 38.89 20.21 16 FVGT_m_MULTI_ODD 39644 21.94 27.91 19.24 17 MIME_HTML_ONLY 39334 23.63 33.64 19.09 18 XMSubLong 35502 19.38 24.12 17.23 19 XM_DK_Undo_02 33817 26.94 50.18 16.41 20 MultiRelay 32522 15.69 15.49 15.78 21 BAYES_99 31923 24.63 44.80 15.49 22 XM_H_Long_From01 30244 12.84 8.78 14.68 23 BAYES_999 28626 21.68 38.88 13.89 24 T_KAM_HTML_FONT_INVALID 25117 14.60 19.91 12.19 25 XM_DKIMWhitelistDomains 24347 8.14 0.03 11.81 26 XM_Multi_Part_URI 23732 13.67 18.41 11.52 27 LOTS_OF_MONEY 23358 11.72 12.57 11.33 28 SUBJ_ALL_CAPS 22847 8.45 2.64 11.09 29 RCVD_IN_RP_SAFE 22185 9.77 7.57 10.77 30 RCVD_IN_RP_CERTIFIED 20301 8.76 6.34 9.85 31 FSL_BULK_SIG 19627 10.97 14.16 9.52 32 XM_Body_Dirty_Words 18455 12.72 21.02 8.96 33 HTML_IMAGE_RATIO_02 16496 11.58 19.49 8.00 34 XM_Evil_Numbers_Gen 15520 10.42 16.79 7.53 35 TR_DCC_Bayes_99 15505 16.26 35.55 7.52 36 BAYES_40 13912 5.18 1.72 6.75 37 BAYES_00 13702 5.49 2.92 6.65 38 LotsOfNums_01 13563 7.02 7.99 6.58 39 BAYES_60 13538 6.29 5.66 6.57 40 T_XMDrugObfuBody_14 13016 7.34 9.61 6.32 41 TooManyTo_001 12100 6.40 7.58 5.87 42 BOTNET_IPINHOSTNAME 10943 7.63 12.74 5.31 43 IN_ZIMBRA_NJ_WHITELIST 9985 3.34 0.03 4.85 44 TR_XM_DK_Bayes 9959 3.91 1.86 4.83 45 RCVD_IN_IADB_LISTED 9928 3.84 1.70 4.82 46 XMStrtUSub 9865 5.24 6.25 4.79 47 XM_SendGrid 9849 4.76 4.73 4.78 48 XM_B_Phish_Phrases 9429 5.97 9.04 4.58 49 TR_XM_DK_Bayes1 9281 3.65 1.77 4.50 50 XM_UncommonTLD01 9272 4.81 5.50 4.50 51 DKIM_INVALID 8916 5.07 6.72 4.33 52 MIME_QP_LONG_LINE 8898 4.15 3.78 4.32 53 T_TooManySym_01 8809 4.30 4.35 4.27 54 UNPARSEABLE_RELAY 8674 3.56 2.12 4.21 55 RCVD_IN_IADB_SPF 8572 3.31 1.45 4.16 56 TR_XM_DocInvoice 8529 4.90 6.57 4.14 57 T_REMOTE_IMAGE 8494 3.90 3.41 4.12 58 XMSubMetaSx_00 8319 5.47 8.63 4.04 59 TR_XM_DK_Bayes2 7956 3.11 1.46 3.86 60 TVD_RCVD_IP 7903 2.73 0.30 3.83 61 RELAYCOUNTRY_META 7810 8.13 17.71 3.79 62 XMNumbers 7733 4.15 5.03 3.75 63 RCVD_IN_IADB_SENDERID 7588 2.96 1.36 3.68 64 TO_MALFORMED 7357 2.46 0.02 3.57 65 RCVD_IN_IADB_DK 7348 2.87 1.35 3.57 66 BAYES_80 7300 4.58 6.87 3.54 67 MPART_ALT_DIFF 7200 4.73 7.45 3.49 68 INVALID_MSGID 7134 2.77 1.25 3.46 69 ANY_BOUNCE_MESSAGE 7122 2.50 0.40 3.46 70 BOUNCE_MESSAGE 7121 2.50 0.40 3.46 71 FROM_EXCESS_BASE64 7073 4.97 8.36 3.43 72 HTML_IMAGE_RATIO_04 6865 5.47 10.19 3.33 73 RCVD_IN_IADB_VOUCHED 6728 2.49 0.79 3.26 74 RCVD_IN_MSPIKE_H2 6449 2.96 2.57 3.13 75 NO_DNS_FOR_FROM 6448 3.75 5.12 3.13 76 XMSexyCombo_05 6354 5.85 11.96 3.08 77 HTML_IMAGE_RATIO_06 6104 4.05 6.45 2.96 78 MIME_HTML_MOSTLY 5991 3.48 4.74 2.91 79 IN_HORDE_ADDRESS_BOOK 5468 1.86 0.11 2.65 80 RCVD_IN_MSPIKE_WL 5461 2.18 1.14 2.65 81 RCVD_IN_MSPIKE_H3 5461 2.18 1.14 2.65 82 XMSubNoVowel 5103 1.86 0.50 2.48 83 BAYES_95 4982 3.12 4.68 2.42 84 XM_PDF 4807 1.76 0.49 2.33 85 TR_Symld_Words 4787 1.95 1.12 2.32 86 HTML_IMAGE_RATIO_08 4699 2.58 3.23 2.28 87 XMSubEmpty 4496 1.62 0.37 2.18 88 HTML_MIME_NO_HTML_TAG 4291 2.51 3.46 2.08 89 RCVD_IN_IADB_OPTIN 4217 1.57 0.52 2.05 90 MAILING_LIST_MULTI 4087 1.89 1.68 1.98 91 USER_IN_DEF_DKIM_WL 4050 1.38 0.08 1.97 92 XM_CamelCaseFrm001 3900 2.52 3.90 1.89 93 T_TooManySym_02 3836 1.70 1.34 1.86 94 BAYES_20 3823 1.73 1.44 1.86 95 XM_DK_Undo_01 3819 1.82 1.74 1.85 96 XM_DIRTYINTL 3697 2.61 4.40 1.79 97 BOTNET 3528 6.08 15.73 1.71 98 TooManyTo_002 3317 1.61 1.60 1.61 99 BAYES_05 3108 1.28 0.79 1.51 100 URI_HEX 3098 2.35 4.23 1.50 101 TM2_M_URI_OPT_OUT 2985 2.06 3.43 1.45 102 XM_GoogleGroups 2869 1.15 0.62 1.39 103 URI_TRY_3LD 2833 1.37 1.37 1.37 104 XM_OfRef6 2810 1.78 2.69 1.36 105 XM_SPF_SoftFail 2700 1.79 2.84 1.31 106 RELAYCOUNTRY_CA 2649 1.71 2.65 1.29 107 XM_H_PHPOS 2545 1.16 1.00 1.23 108 TR_Mismatch_TLD_01 2530 0.96 0.37 1.23 109 USER_IN_WHITELIST 2511 0.84 0.00 1.22 110 UNTRUSTED_Relay 2400 4.66 12.39 1.16 111 TooManyTo_003 2237 1.20 1.45 1.09 112 MIME_HTML_ONLY_MULTI 2055 1.70 3.26 1.00 113 XM_ProductURIs 2051 1.10 1.33 1.00 114 DKIM_ADSP_CUSTOM_MED 2027 1.13 1.47 0.98 115 XMBody_95 2025 0.70 0.08 0.98 116 HELO_NODOT 2010 0.73 0.19 0.98 117 T_XMDrugObfuBody_08 1972 1.26 1.93 0.96 118 XMDiploma_00 1950 1.07 1.36 0.95 119 XMPhish11 1932 0.93 0.90 0.94 120 XM_H_Long_From02 1918 1.17 1.70 0.93 121 T_TooManySym_03 1879 0.68 0.16 0.91 122 XMBdyGiftCard01 1876 1.21 1.88 0.91 123 XMSubMetaSxObfu_02 1730 0.88 0.96 0.84 124 TooManyTo_004 1709 0.95 1.23 0.83 125 TM2_M_A_HREF_HREF 1709 0.91 1.08 0.83 126 XM_H_PHPMailer 1644 0.85 0.97 0.80 127 TM2_M_VERY_LONG_WORD 1639 1.15 1.93 0.80 128 XMStockSpam_06 1592 0.92 1.24 0.77 129 XM_UB50 1586 1.95 4.56 0.77 130 TooManyTo_005 1450 0.77 0.91 0.70 131 XM_D_tchamptons_WL 1394 0.47 0.00 0.68 132 XM_B_REG_HTML 1378 0.89 1.36 0.67 133 NML_ADSP_CUSTOM_MED 1361 0.88 1.37 0.66 134 XM_B_COPY_HTML 1327 0.73 0.92 0.64 135 T_FILL_THIS_FORM_SHORT 1302 0.80 1.17 0.63 136 FILL_THIS_FORM 1286 0.81 1.22 0.62 137 XMBody_78 1266 0.85 1.38 0.61 138 TR_XM_RelayPhish 1252 0.83 1.33 0.61 139 T_XMDrugObfuBody_00 1206 0.81 1.31 0.59 140 TVD_SPACE_RATIO 1204 0.48 0.25 0.58 141 RELAYCOUNTRY_GB 1168 0.69 0.96 0.57 142 RDNS_DYNAMIC 1157 0.66 0.87 0.56 143 XMNoVowels 1152 0.52 0.45 0.56 144 XMCapTrack 1121 0.52 0.46 0.54 145 XMSexyCombo_01 1113 1.03 2.12 0.54 146 XMGenDplmaNmb 1101 0.59 0.72 0.53 147 XMSubMetaI_00 1097 1.10 2.35 0.53 148 TR_MetaPhish_Combo_01 1085 0.50 0.44 0.53 149 T_FILL_THIS_FORM_LOAN 1076 0.41 0.15 0.52 150 FORGED_GMAIL_RCVD 1051 0.64 0.93 0.51 151 T_TooManySym_04 1032 0.37 0.08 0.50 152 UPPERCASE_50_75 1020 0.40 0.18 0.49 153 PP_MIME_FAKE_ASCII_TEXT 991 0.43 0.32 0.48 154 XMEmptySub 977 0.34 0.05 0.47 155 T_FILL_THIS_FORM_LONG 974 0.60 0.90 0.47 156 HTML_FONT_FACE_BAD 973 0.59 0.84 0.47 157 XMHTMLBadTable_001 970 0.83 1.62 0.47 158 XM_H_PHPOS_M 969 0.48 0.51 0.47 159 TR_MetaPhish_Combo_01b 936 0.37 0.18 0.45 160 DKIM_ADSP_NXDOMAIN 932 0.42 0.34 0.45 161 SpammyFromTLD_01 918 0.88 1.83 0.45 162 HTML_TAG_BALANCE_BODY 913 0.47 0.52 0.44 163 XMPhish30 911 0.91 1.95 0.44 164 XMBrknScrpt_02 910 0.56 0.82 0.44 165 XMRcvdHeader_15 885 0.30 0.00 0.43 166 T_Symld_Words_02 884 0.47 0.55 0.43 167 XM_ShortIntro_01 864 0.36 0.22 0.42 168 PLING_QUERY 853 0.60 1.00 0.41 169 XM_D_ioffer_Whitelist 821 0.27 0.00 0.40 170 T_OBFU_PDF_ATTACH 816 0.30 0.10 0.40 171 XMBody_17 815 1.26 3.18 0.40 172 DIET_1 794 0.71 1.43 0.39 173 TR_LOTS_OF_MONEY2 778 0.52 0.83 0.38 174 T_MONEY_PERCENT 778 0.52 0.83 0.38 175 RCVD_IN_BL_SPAMCOP_NET 765 1.73 4.74 0.37 176 XM_H_SpoofStaff4 761 0.26 0.03 0.37 177 AC_DIV_BONANZA 731 0.27 0.08 0.35 178 REMOVE_BEFORE_LINK 730 0.45 0.67 0.35 179 XMSUPPORT 714 0.24 0.00 0.35 180 TO_IN_SUBJ 712 0.26 0.08 0.35 181 XMDateMe_00 708 0.31 0.23 0.34 182 XM_B_TRADE_HTML 690 0.39 0.52 0.33 183 MISSING_HEADERS 688 0.41 0.57 0.33 184 URI_NOVOWEL 680 0.50 0.89 0.33 185 T_XMHurry_00 646 0.60 1.24 0.31 186 HTTPS_HTTP_MISMATCH 643 0.35 0.45 0.31 187 XMSolicitRefs_0 633 0.34 0.40 0.31 188 RELAYCOUNTRY_DE 622 0.90 2.21 0.30 189 XMLngstWrd_00 616 0.29 0.28 0.30 190 XMBody_29 613 0.26 0.19 0.30 191 TR_LOTS_OF_MONEY3 600 0.37 0.54 0.29 192 XMGappySubj_01 597 0.28 0.26 0.29 193 RELAYCOUNTRY_AU 596 0.33 0.43 0.29 194 FROM_EGROUPS 593 0.20 0.01 0.29 195 HTML_FONT_SIZE_LARGE 593 0.29 0.29 0.29 196 HTML_IMAGE_ONLY_28 574 0.27 0.25 0.28 197 XMHTML_After_End 567 0.53 1.10 0.28 198 RELAYCOUNTRY_FR 562 0.87 2.19 0.27 199 XM_BadFromFormat 552 0.75 1.80 0.27 200 RCVD_IN_SORBS_DUL 551 0.29 0.35 0.27 ----------------------------------------------------------------------