Email: 395190 Autolearn: 0 AvgScore: 4.34 AvgScanTime: 3.47 sec Spam: 140441 Autolearn: 0 AvgScore: 12.54 AvgScanTime: 4.22 sec Ham: 254749 Autolearn: 0 AvgScore: -0.18 AvgScanTime: 3.06 sec Time Spent Running SA: 381.27 hours Time Spent Processing Spam: 164.74 hours Time Spent Processing Ham: 216.52 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134381 89.78 95.69 86.52 2 DCC_CHECK 113618 59.07 80.90 47.03 3 DKIM_SIGNED 110465 73.73 78.66 71.01 4 XM_DK_Pass 108638 72.48 77.35 69.79 5 DKIM_VALID 104469 70.00 74.39 67.59 6 XMListUnsubscribeExists 98625 58.03 70.23 51.30 7 DKIM_VALID_AU 85779 55.73 61.08 52.78 8 XM_H_QuotedFrom 80007 46.56 56.97 40.82 9 XM_DK_Undo_02 65898 29.38 46.92 19.71 10 BAYES_99 59991 27.70 42.72 19.42 11 LOC_TINY_FONT_1 52738 31.18 37.55 27.67 12 BAYES_999 50904 23.87 36.25 17.05 13 HTML_FONT_LOW_CONTRAST 49028 33.04 34.91 32.01 14 TR_DCC_Bayes_99 46313 18.13 32.98 9.94 15 MIME_HTML_ONLY 46067 24.38 32.80 19.74 16 BAYES_50 43999 46.69 31.33 55.16 17 FVGT_m_MULTI_ODD 34583 22.67 24.62 21.59 18 XMSubLong 32049 20.29 22.82 18.89 19 DKIM_VALID_EF 30151 26.36 21.47 29.06 20 XM_Body_Dirty_Words 27940 14.13 19.89 10.96 21 HTML_IMAGE_RATIO_02 27764 13.05 19.77 9.35 22 T_KAM_HTML_FONT_INVALID 27571 15.73 19.63 13.57 23 DCC_CHECK_NEGATIVE 25270 39.86 17.99 51.92 24 XM_Multi_Part_URI 24663 14.37 17.56 12.62 25 RELAYCOUNTRY_META 24167 8.75 17.21 4.09 26 T_TM2_M_HEADER_IN_MSG 22911 18.79 16.31 20.16 27 FSL_BULK_SIG 22028 14.43 15.68 13.74 28 BOTNET 20167 5.81 14.36 1.10 29 MultiRelay 20023 13.12 14.26 12.50 30 XM_Evil_Numbers_Gen 19103 9.30 13.60 6.94 31 UNTRUSTED_Relay 17249 5.11 12.28 1.16 32 BOTNET_IPINHOSTNAME 16951 9.33 12.07 7.82 33 XMSexyCombo_05 16589 6.42 11.81 3.44 34 BAYES_80 13995 6.57 9.97 4.70 35 HTML_IMAGE_RATIO_04 13932 7.48 9.92 6.13 36 LOTS_OF_MONEY 12363 8.57 8.80 8.44 37 XM_H_Long_From01 12259 6.43 8.73 5.17 38 MPART_ALT_DIFF 11738 5.57 8.36 4.03 39 T_XMDrugObfuBody_14 11642 7.11 8.29 6.45 40 XM_B_Phish_Phrases 11209 6.29 7.98 5.36 41 ALL_TRUSTED 10979 18.74 7.82 24.76 42 FROM_EXCESS_BASE64 10371 5.32 7.38 4.18 43 TooManyTo_001 10318 5.61 7.35 4.65 44 RCVD_IN_RP_SAFE 10221 10.81 7.28 12.76 45 XMSubMetaSx_00 9764 5.66 6.95 4.95 46 XM_UB50 9633 2.91 6.86 0.73 47 XM_UncommonTLD01 8936 4.82 6.36 3.97 48 MISSING_HEADERS 8524 6.55 6.07 6.82 49 RCVD_IN_RP_CERTIFIED 8440 10.01 6.01 12.21 50 REPLYTO_WITHOUT_TO_CC 8396 6.41 5.98 6.65 51 MIME_HTML_MOSTLY 8241 4.39 5.87 3.58 52 TR_XM_DocInvoice 7976 3.88 5.68 2.89 53 BAYES_60 7950 7.27 5.66 8.15 54 XM_SPF_SoftFail 7887 2.50 5.62 0.79 55 XM_DIRTYINTL 7851 3.00 5.59 1.56 56 BAYES_95 7818 4.18 5.57 3.41 57 LotsOfNums_01 7479 7.33 5.33 8.44 58 HTML_IMAGE_RATIO_06 6822 4.15 4.86 3.76 59 T_REMOTE_IMAGE 6580 3.93 4.69 3.52 60 MIME_HTML_ONLY_MULTI 6385 2.72 4.55 1.71 61 XM_SendGrid 6269 4.54 4.46 4.58 62 DKIM_INVALID 5996 3.72 4.27 3.42 63 XMNumbers 5814 3.71 4.14 3.48 64 XM_CamelCaseFrm001 5491 2.67 3.91 1.99 65 XMStrtUSub 5406 4.37 3.85 4.66 66 RCVD_IN_MSPIKE_H2 4502 4.23 3.21 4.79 67 DKIM_ADSP_NXDOMAIN 4402 1.42 3.13 0.48 68 RCVD_IN_BL_SPAMCOP_NET 4307 1.26 3.07 0.26 69 RELAYCOUNTRY_CA 4239 2.05 3.02 1.52 70 BOTNET_NORDNS 4206 1.07 2.99 0.01 71 XMBdyGiftCard01 4157 1.95 2.96 1.39 72 RCVD_IN_RP_RNBL 3971 1.04 2.83 0.06 73 MIME_QP_LONG_LINE 3868 3.81 2.75 4.39 74 MultiRelay_CC 3864 1.07 2.75 0.14 75 MultiRelay_Combo 3864 1.07 2.75 0.14 76 RELAYCOUNTRY_RU 3830 0.97 2.73 0.01 77 TM2_M_URI_OPT_OUT 3794 1.92 2.70 1.49 78 URIBL_RHS_DOB 3740 1.42 2.66 0.73 79 MIME_HEADER_CTYPE_ONLY 3681 1.02 2.62 0.14 80 URI_HEX 3653 1.98 2.60 1.64 81 HTTP_ESCAPED_HOST 3612 0.96 2.57 0.07 82 HTML_IMAGE_RATIO_08 3551 1.89 2.53 1.54 83 AC_BR_BONANZA 3541 0.94 2.52 0.07 84 URI_TRY_3LD 3503 1.89 2.49 1.56 85 XM_OfRef6 3280 1.68 2.34 1.32 86 T_TooManySym_01 3254 3.57 2.32 4.27 87 XM_URI_RBL 3041 0.85 2.17 0.13 88 XMSubMetaI_00 2831 0.99 2.02 0.43 89 HTML_MIME_NO_HTML_TAG 2799 2.04 1.99 2.06 90 XMBody_17 2729 1.04 1.94 0.54 91 URIBL_ABUSE_SURBL 2721 0.76 1.94 0.11 92 BODY_URI_ONLY 2707 0.72 1.93 0.06 93 UNPARSEABLE_RELAY 2611 5.13 1.86 6.93 94 XM_DK_Undo_01 2587 1.91 1.84 1.95 95 SUBJ_ALL_CAPS 2572 1.62 1.83 1.51 96 HTML_TEXT_INVISIBLE_STYLE 2517 0.65 1.79 0.03 97 URIBL_DBL_ABUSE_SPAM 2501 0.66 1.78 0.05 98 URIBL_BLACK 2471 0.65 1.76 0.03 99 XM_UB99 2408 0.63 1.71 0.02 100 URIBL_DBL_ABUSE_REDIR 2342 2.23 1.67 2.55 101 XMSexyCombo_01 2335 0.93 1.66 0.53 102 NO_DNS_FOR_FROM 2290 1.28 1.63 1.08 103 RCVD_IN_IADB_LISTED 2262 3.50 1.61 4.54 104 URIBL_DBL_SPAM 2166 0.57 1.54 0.04 105 DIET_1 2157 0.80 1.54 0.39 106 XM_H_PHPOS 2145 1.23 1.53 1.06 107 NORDNS_LOW_CONTRAST 2117 0.54 1.51 0.00 108 MAILING_LIST_MULTI 2080 1.73 1.48 1.87 109 T_XMDrugObfuBody_08 2074 1.40 1.48 1.36 110 XM_UB60 2073 0.55 1.48 0.05 111 XMDiploma_00 1998 1.18 1.42 1.05 112 XM_RXBody 1992 0.59 1.42 0.14 113 BAYES_00 1968 3.52 1.40 4.69 114 TM2_M_VERY_LONG_WORD 1965 1.04 1.40 0.84 115 SpammyFromTLD_02 1956 0.59 1.39 0.14 116 XM_H_Long_From02 1947 1.05 1.39 0.87 117 RCVD_IN_PSBL 1945 0.55 1.38 0.09 118 SpammyFromTLD_01 1886 0.73 1.34 0.40 119 RELAYCOUNTRY_CN 1883 0.49 1.34 0.03 120 BAYES_40 1869 1.77 1.33 2.01 121 XMStockSpam_06 1856 0.89 1.32 0.66 122 RCVD_IN_IADB_SPF 1829 3.06 1.30 4.03 123 XM_ProductURIs 1811 1.32 1.29 1.34 124 XM_UB999 1806 0.47 1.29 0.02 125 XM_HighProb1 1791 0.47 1.28 0.02 126 BAYES_20 1784 1.36 1.27 1.41 127 XMHTMLBadTable_001 1727 0.77 1.23 0.51 128 XMPhish30 1707 0.76 1.22 0.51 129 TR_XM_RelayPhish 1696 0.64 1.21 0.33 130 RELAYCOUNTRY_AT 1682 0.49 1.20 0.09 131 RELAYCOUNTRY_FR 1609 0.60 1.15 0.30 132 RCVD_IN_IADB_SENDERID 1609 2.75 1.15 3.63 133 XM_OverStock_LProb 1604 0.42 1.14 0.03 134 XM_H_PHPMailer 1597 0.81 1.14 0.63 135 XMPhish11 1580 1.05 1.13 1.01 136 RCVD_IN_IADB_VOUCHED 1562 2.12 1.11 2.68 137 HTML_FONT_FACE_BAD 1560 0.85 1.11 0.71 138 T_XMHurry_00 1554 0.77 1.11 0.58 139 T_MONEY_PERCENT 1544 0.78 1.10 0.61 140 TR_LOTS_OF_MONEY2 1544 0.78 1.10 0.61 141 RCVD_IN_IADB_DK 1536 2.67 1.09 3.53 142 SUBJ_DOLLARS 1526 0.64 1.09 0.40 143 RELAYCOUNTRY_NL 1483 0.45 1.06 0.12 144 TR_Mismatch_TLD_02 1469 0.47 1.05 0.15 145 MPART_ALT_DIFF_COUNT 1446 0.66 1.03 0.46 146 XM_B_REG_HTML 1443 0.88 1.03 0.80 147 TooManyTo_002 1431 1.02 1.02 1.03 148 TR_XM_DK_Bayes 1418 2.56 1.01 3.41 149 TVD_SPACE_RATIO 1416 0.55 1.01 0.29 150 XMHTML_After_End 1405 0.51 1.00 0.24 151 TR_Symld_Words 1399 1.13 1.00 1.20 152 T_HTML_TAG_BALANCE_CENTER 1395 0.50 0.99 0.22 153 XMSlimDrugH 1380 0.58 0.98 0.36 154 TR_XM_DK_Bayes1 1370 2.47 0.98 3.29 155 HTML_IMAGE_ONLY_28 1356 0.49 0.97 0.22 156 XM_BadFromFormat 1323 0.47 0.94 0.22 157 TooManyTo_003 1305 0.78 0.93 0.69 158 XM_H_PHPOS_M 1295 0.59 0.92 0.41 159 HTML_SHORT_LINK_IMG_1 1278 0.37 0.91 0.07 160 TVD_SPACE_RATIO_MINFP 1265 0.32 0.90 0.00 161 XMClaimOffer 1252 0.55 0.89 0.37 162 TR_XM_DK_Bayes2 1252 2.21 0.89 2.93 163 RELAYCOUNTRY_DE 1233 0.65 0.88 0.53 164 RELAYCOUNTRY_IN 1213 0.34 0.86 0.06 165 URI_NOVOWEL 1204 0.53 0.86 0.35 166 NORMAL_HTTP_TO_IP 1194 0.35 0.85 0.07 167 XMGenDplmaNmb 1192 0.66 0.85 0.56 168 T_TooManySym_02 1188 1.40 0.85 1.71 169 BOUNCE_MESSAGE 1169 4.95 0.83 7.23 170 ANY_BOUNCE_MESSAGE 1169 4.95 0.83 7.23 171 XM_UB80 1134 0.31 0.81 0.04 172 XMSubMetaSSx_00 1132 0.46 0.81 0.27 173 REMOVE_BEFORE_LINK 1124 0.57 0.80 0.45 174 RCVD_IN_IADB_OPTIN 1122 1.36 0.80 1.66 175 XM_B_COPY_HTML 1110 0.69 0.79 0.64 176 RDNS_DYNAMIC 1098 0.64 0.78 0.56 177 XMSubMetaSxObfu_03 1086 0.82 0.77 0.85 178 LongTLD 1042 0.34 0.74 0.12 179 TooManyTo_004 1041 0.62 0.74 0.56 180 BAYES_05 1037 0.90 0.74 1.00 181 T_XMDrugObfuBody_00 1034 0.74 0.74 0.74 182 TRACKER_ID 1013 0.37 0.72 0.17 183 URI_DQ_UNSUB 1008 0.27 0.72 0.02 184 XMBody_78 998 0.50 0.71 0.39 185 XM_S_JOY_D 976 0.41 0.69 0.26 186 RCVD_IN_MSPIKE_WL 967 1.90 0.69 2.56 187 XMGppyBdWords 967 0.30 0.69 0.08 188 T_FILL_THIS_FORM_SHORT 960 0.68 0.68 0.67 189 RCVD_IN_MSPIKE_H3 960 1.89 0.68 2.56 190 HTML_TAG_BALANCE_BODY 950 0.54 0.68 0.46 191 TooManyTo_005 950 0.55 0.68 0.49 192 PP_MIME_FAKE_ASCII_TEXT 943 0.37 0.67 0.21 193 XM_H_Long_From03 941 0.35 0.67 0.17 194 XM_XX_Yahoo 937 0.28 0.67 0.07 195 XMPhish14 934 0.38 0.67 0.23 196 XMLongAddy 927 0.34 0.66 0.16 197 XMSubNoVowel 914 0.37 0.65 0.21 198 HTML_IMAGE_ONLY_08 883 0.33 0.63 0.16 199 XM_Body_Obfu01 874 0.29 0.62 0.11 200 RELAYCOUNTRY_GB 870 0.59 0.62 0.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 220412 89.78 95.69 86.52 2 DKIM_SIGNED 180894 73.73 78.66 71.01 3 XM_DK_Pass 177792 72.48 77.35 69.79 4 DKIM_VALID 172175 70.00 74.39 67.59 5 BAYES_50 140513 46.69 31.33 55.16 6 DKIM_VALID_AU 134465 55.73 61.08 52.78 7 DCC_CHECK_NEGATIVE 132267 39.86 17.99 51.92 8 XMListUnsubscribeExists 130697 58.03 70.23 51.30 9 DCC_CHECK 119812 59.07 80.90 47.03 10 XM_H_QuotedFrom 103982 46.56 56.97 40.82 11 HTML_FONT_LOW_CONTRAST 81548 33.04 34.91 32.01 12 DKIM_VALID_EF 74028 26.36 21.47 29.06 13 LOC_TINY_FONT_1 70479 31.18 37.55 27.67 14 ALL_TRUSTED 63066 18.74 7.82 24.76 15 FVGT_m_MULTI_ODD 54993 22.67 24.62 21.59 16 T_TM2_M_HEADER_IN_MSG 51354 18.79 16.31 20.16 17 MIME_HTML_ONLY 50280 24.38 32.80 19.74 18 XM_DK_Undo_02 50208 29.38 46.92 19.71 19 BAYES_99 49481 27.70 42.72 19.42 20 XMSubLong 48134 20.29 22.82 18.89 21 XM_DKIMWhitelistDomains 45795 11.64 0.14 17.98 22 BAYES_999 43427 23.87 36.25 17.05 23 FSL_BULK_SIG 34997 14.43 15.68 13.74 24 T_KAM_HTML_FONT_INVALID 34577 15.73 19.63 13.57 25 RCVD_IN_RP_SAFE 32500 10.81 7.28 12.76 26 XM_Multi_Part_URI 32137 14.37 17.56 12.62 27 MultiRelay 31842 13.12 14.26 12.50 28 RCVD_IN_RP_CERTIFIED 31103 10.01 6.01 12.21 29 XM_Body_Dirty_Words 27914 14.13 19.89 10.96 30 TR_DCC_Bayes_99 25316 18.13 32.98 9.94 31 HTML_IMAGE_RATIO_02 23824 13.05 19.77 9.35 32 LotsOfNums_01 21492 7.33 5.33 8.44 33 LOTS_OF_MONEY 21489 8.57 8.80 8.44 34 BAYES_60 20767 7.27 5.66 8.15 35 BOTNET_IPINHOSTNAME 19912 9.33 12.07 7.82 36 ANY_BOUNCE_MESSAGE 18409 4.95 0.83 7.23 37 BOUNCE_MESSAGE 18408 4.95 0.83 7.23 38 XM_Evil_Numbers_Gen 17667 9.30 13.60 6.94 39 UNPARSEABLE_RELAY 17644 5.13 1.86 6.93 40 MISSING_HEADERS 17365 6.55 6.07 6.82 41 REPLYTO_WITHOUT_TO_CC 16942 6.41 5.98 6.65 42 T_XMDrugObfuBody_14 16439 7.11 8.29 6.45 43 TVD_RCVD_IP 15982 4.17 0.35 6.27 44 HTML_IMAGE_RATIO_04 15620 7.48 9.92 6.13 45 XM_B_Phish_Phrases 13664 6.29 7.98 5.36 46 XM_H_Long_From01 13159 6.43 8.73 5.17 47 XMSubMetaSx_00 12608 5.66 6.95 4.95 48 RCVD_IN_MSPIKE_H2 12205 4.23 3.21 4.79 49 BAYES_80 11985 6.57 9.97 4.70 50 BAYES_00 11952 3.52 1.40 4.69 51 XMStrtUSub 11873 4.37 3.85 4.66 52 TooManyTo_001 11844 5.61 7.35 4.65 53 XM_SendGrid 11668 4.54 4.46 4.58 54 RCVD_IN_IADB_LISTED 11566 3.50 1.61 4.54 55 MIME_QP_LONG_LINE 11181 3.81 2.75 4.39 56 T_TooManySym_01 10869 3.57 2.32 4.27 57 FROM_EXCESS_BASE64 10644 5.32 7.38 4.18 58 RELAYCOUNTRY_META 10431 8.75 17.21 4.09 59 MPART_ALT_DIFF 10278 5.57 8.36 4.03 60 RCVD_IN_IADB_SPF 10264 3.06 1.30 4.03 61 XM_UncommonTLD01 10120 4.82 6.36 3.97 62 HTML_IMAGE_RATIO_06 9574 4.15 4.86 3.76 63 RCVD_IN_IADB_SENDERID 9258 2.75 1.15 3.63 64 MIME_HTML_MOSTLY 9109 4.39 5.87 3.58 65 RCVD_IN_IADB_DK 9001 2.67 1.09 3.53 66 T_REMOTE_IMAGE 8960 3.93 4.69 3.52 67 XMNumbers 8854 3.71 4.14 3.48 68 XMSexyCombo_05 8767 6.42 11.81 3.44 69 DKIM_INVALID 8719 3.72 4.27 3.42 70 TR_XM_DK_Bayes 8687 2.56 1.01 3.41 71 BAYES_95 8685 4.18 5.57 3.41 72 TR_XM_DK_Bayes1 8389 2.47 0.98 3.29 73 IN_ZIMBRA_NJ_WHITELIST 7945 2.02 0.01 3.12 74 TR_XM_DK_Bayes2 7464 2.21 0.89 2.93 75 TR_XM_DocInvoice 7373 3.88 5.68 2.89 76 RCVD_IN_IADB_VOUCHED 6829 2.12 1.11 2.68 77 INVALID_MSGID 6725 1.79 0.25 2.64 78 RCVD_IN_MSPIKE_WL 6524 1.90 0.69 2.56 79 RCVD_IN_MSPIKE_H3 6514 1.89 0.68 2.56 80 URIBL_DBL_ABUSE_REDIR 6489 2.23 1.67 2.55 81 TO_MALFORMED 6335 1.61 0.01 2.49 82 XM_PDF 6133 1.65 0.26 2.41 83 HTML_MIME_NO_HTML_TAG 5247 2.04 1.99 2.06 84 BAYES_40 5118 1.77 1.33 2.01 85 XM_CamelCaseFrm001 5064 2.67 3.91 1.99 86 XM_DK_Undo_01 4976 1.91 1.84 1.95 87 USER_IN_DEF_DKIM_WL 4932 1.26 0.04 1.94 88 IN_HORDE_ADDRESS_BOOK 4863 1.26 0.08 1.91 89 MAILING_LIST_MULTI 4759 1.73 1.48 1.87 90 T_TooManySym_02 4350 1.40 0.85 1.71 91 MIME_HTML_ONLY_MULTI 4347 2.72 4.55 1.71 92 RCVD_IN_IADB_OPTIN 4234 1.36 0.80 1.66 93 URI_HEX 4186 1.98 2.60 1.64 94 XM_DIRTYINTL 3985 3.00 5.59 1.56 95 URI_TRY_3LD 3973 1.89 2.49 1.56 96 HTML_IMAGE_RATIO_08 3922 1.89 2.53 1.54 97 RELAYCOUNTRY_CA 3877 2.05 3.02 1.52 98 SUBJ_ALL_CAPS 3842 1.62 1.83 1.51 99 TM2_M_URI_OPT_OUT 3796 1.92 2.70 1.49 100 BAYES_20 3590 1.36 1.27 1.41 101 XMBdyGiftCard01 3538 1.95 2.96 1.39 102 T_XMDrugObfuBody_08 3476 1.40 1.48 1.36 103 XM_ProductURIs 3411 1.32 1.29 1.34 104 XM_OfRef6 3358 1.68 2.34 1.32 105 TR_Symld_Words 3067 1.13 1.00 1.20 106 UNTRUSTED_Relay 2960 5.11 12.28 1.16 107 XM_GoogleGroups 2947 0.89 0.39 1.16 108 BOTNET 2812 5.81 14.36 1.10 109 NO_DNS_FOR_FROM 2762 1.28 1.63 1.08 110 XM_H_PHPOS 2703 1.23 1.53 1.06 111 XMSubMetaSxObfu_02 2678 0.83 0.42 1.05 112 XMDiploma_00 2668 1.18 1.42 1.05 113 USER_IN_WHITELIST 2632 0.67 0.00 1.03 114 TooManyTo_002 2613 1.02 1.02 1.03 115 XMPhish11 2574 1.05 1.13 1.01 116 XMBody_95 2566 0.68 0.08 1.01 117 XMLngstWrd_00 2545 0.76 0.31 1.00 118 BAYES_05 2538 0.90 0.74 1.00 119 XMLngstWrd_01 2245 0.67 0.29 0.88 120 XM_H_Long_From02 2218 1.05 1.39 0.87 121 XMSubMetaSxObfu_03 2165 0.82 0.77 0.85 122 TM2_M_VERY_LONG_WORD 2152 1.04 1.40 0.84 123 XM_B_REG_HTML 2031 0.88 1.03 0.80 124 XM_SPF_SoftFail 2003 2.50 5.62 0.79 125 DKIM_ADSP_CUSTOM_MED 1917 0.64 0.43 0.75 126 T_XMDrugObfuBody_00 1897 0.74 0.74 0.74 127 URIBL_RHS_DOB 1864 1.42 2.66 0.73 128 XM_UB50 1858 2.91 6.86 0.73 129 HTML_FONT_FACE_BAD 1798 0.85 1.11 0.71 130 T_TooManySym_03 1786 0.48 0.07 0.70 131 TooManyTo_003 1762 0.78 0.93 0.69 132 T_FILL_THIS_FORM_SHORT 1718 0.68 0.68 0.67 133 XMStockSpam_06 1675 0.89 1.32 0.66 134 XM_B_COPY_HTML 1619 0.69 0.79 0.64 135 XM_H_PHPMailer 1611 0.81 1.14 0.63 136 TR_LOTS_OF_MONEY2 1557 0.78 1.10 0.61 137 T_MONEY_PERCENT 1557 0.78 1.10 0.61 138 XM_D_tchamptons_WL 1554 0.39 0.00 0.61 139 XMNoVowels 1486 0.51 0.38 0.58 140 T_XMHurry_00 1485 0.77 1.11 0.58 141 RELAYCOUNTRY_GB 1444 0.59 0.62 0.57 142 XMGenDplmaNmb 1427 0.66 0.85 0.56 143 RDNS_DYNAMIC 1425 0.64 0.78 0.56 144 TR_MetaPhish_Combo_01 1424 0.53 0.48 0.56 145 TooManyTo_004 1419 0.62 0.74 0.56 146 XMBody_17 1384 1.04 1.94 0.54 147 HELO_NODOT 1366 0.41 0.18 0.54 148 XMSexyCombo_01 1357 0.93 1.66 0.53 149 RELAYCOUNTRY_DE 1342 0.65 0.88 0.53 150 XMHTMLBadTable_001 1304 0.77 1.23 0.51 151 XMPhish30 1302 0.76 1.22 0.51 152 XMLngstWrd_02 1266 0.39 0.19 0.50 153 TooManyTo_005 1239 0.55 0.68 0.49 154 DKIM_ADSP_NXDOMAIN 1229 1.42 3.13 0.48 155 TM2_M_A_HREF_HREF 1193 0.51 0.59 0.47 156 NML_ADSP_CUSTOM_MED 1182 0.44 0.38 0.46 157 HTML_TAG_BALANCE_BODY 1168 0.54 0.68 0.46 158 MPART_ALT_DIFF_COUNT 1164 0.66 1.03 0.46 159 URIBL_SBL_A 1151 0.43 0.40 0.45 160 REMOVE_BEFORE_LINK 1141 0.57 0.80 0.45 161 T_Symld_Words_02 1124 0.47 0.52 0.44 162 XMSubMetaI_00 1096 0.99 2.02 0.43 163 URI_WP_HACKED_2 1061 0.38 0.31 0.42 164 XMBrknScrpt_02 1042 0.41 0.42 0.41 165 XM_H_PHPOS_M 1033 0.59 0.92 0.41 166 SUBJ_DOLLARS 1021 0.64 1.09 0.40 167 SpammyFromTLD_01 1013 0.73 1.34 0.40 168 DIET_1 996 0.80 1.54 0.39 169 FORGED_GMAIL_RCVD 994 0.36 0.31 0.39 170 XMBody_78 993 0.50 0.71 0.39 171 T_TooManySym_04 987 0.25 0.01 0.39 172 XMSolicitRefs_0 970 0.34 0.27 0.38 173 FILL_THIS_FORM 964 0.43 0.52 0.38 174 XMClaimOffer 932 0.55 0.89 0.37 175 XMCapTrack 915 0.32 0.26 0.36 176 XMSlimDrugH 909 0.58 0.98 0.36 177 URI_NOVOWEL 893 0.53 0.86 0.35 178 HTML_IMAGE_ONLY_32 873 0.35 0.37 0.34 179 XMMoneyMeta_00 842 0.37 0.45 0.33 180 TR_XM_RelayPhish 828 0.64 1.21 0.33 181 XMLngstWrd_03 816 0.25 0.13 0.32 182 T_FILL_THIS_FORM_LONG 807 0.37 0.48 0.32 183 RELAYCOUNTRY_AU 790 0.33 0.37 0.31 184 XMRcvdHeader_15 779 0.20 0.00 0.31 185 FILL_THIS_FORM_LOAN 769 0.34 0.41 0.30 186 RELAYCOUNTRY_FR 768 0.60 1.15 0.30 187 TVD_SPACE_RATIO 750 0.55 1.01 0.29 188 IMPOTENCE 746 0.24 0.13 0.29 189 XM_ShortIntro_01 743 0.30 0.32 0.29 190 HTTPS_HTTP_MISMATCH 732 0.33 0.42 0.29 191 TR_LOTS_OF_MONEY3 730 0.37 0.51 0.29 192 XM_H_Trusted_IP 719 0.18 0.00 0.28 193 XMSubMetaSSx_00 681 0.46 0.81 0.27 194 PLING_QUERY 681 0.35 0.49 0.27 195 RCVD_IN_BL_SPAMCOP_NET 669 1.26 3.07 0.26 196 XMSUPPORT 667 0.17 0.00 0.26 197 XM_S_JOY_D 662 0.41 0.69 0.26 198 KHOP_DYNAMIC 660 0.32 0.43 0.26 199 TR_Orig_Subnet 658 0.26 0.26 0.26 200 XMBody_29 657 0.24 0.20 0.26 ----------------------------------------------------------------------