Email: 389080 Autolearn: 0 AvgScore: 2.55 AvgScanTime: 3.07 sec Spam: 116760 Autolearn: 0 AvgScore: 12.23 AvgScanTime: 3.37 sec Ham: 272320 Autolearn: 0 AvgScore: -1.60 AvgScanTime: 2.94 sec Time Spent Running SA: 331.42 hours Time Spent Processing Spam: 109.31 hours Time Spent Processing Ham: 222.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93152 81.23 79.78 81.86 2 DCC_CHECK 78318 52.55 67.08 46.32 3 DKIM_SIGNED 73238 73.08 62.73 77.52 4 XM_DK_Pass 71507 71.97 61.24 76.56 5 DKIM_VALID 67910 68.90 58.16 73.50 6 XMListUnsubscribeExists 65341 55.95 55.96 55.95 7 BAYES_50 61249 53.39 52.46 53.79 8 DKIM_VALID_AU 58411 54.54 50.03 56.48 9 XM_H_QuotedFrom 52436 39.05 44.91 36.54 10 DCC_CHECK_NEGATIVE 37398 46.45 32.03 52.63 11 MIME_HTML_ONLY 35557 24.66 30.45 22.18 12 STYLE_GIBBERISH 34551 32.28 29.59 33.43 13 LOC_TINY_FONT_1 34426 26.75 29.48 25.58 14 HTML_FONT_LOW_CONTRAST 33218 30.28 28.45 31.06 15 LOTS_OF_MONEY 32491 17.32 27.83 12.82 16 XM_DK_Undo_02 32485 14.85 27.82 9.28 17 BOTNET 31153 11.62 26.68 5.16 18 XM_Evil_Numbers_Gen 28529 13.31 24.43 8.53 19 XM_Multi_Part_URI 27711 17.06 23.73 14.19 20 FVGT_m_MULTI_ODD 26328 21.70 22.55 21.34 21 BAYES_99 26130 11.92 22.38 7.43 22 RELAYCOUNTRY_META 25745 9.74 22.05 4.46 23 UNTRUSTED_Relay 25621 7.51 21.94 1.32 24 XMSubLong 25257 20.63 21.63 20.19 25 RCVD_IN_RP_RNBL 21793 7.34 18.66 2.49 26 TR_DCC_Bayes_99 21616 8.43 18.51 4.11 27 BAYES_999 21511 9.93 18.42 6.29 28 TR_LOTS_OF_MONEY3 20885 5.63 17.89 0.38 29 HTML_IMAGE_RATIO_02 20139 12.47 17.25 10.42 30 ANY_BOUNCE_MESSAGE 18298 9.12 15.67 6.31 31 BOUNCE_MESSAGE 18297 9.12 15.67 6.31 32 XM_Body_Dirty_Words 18249 13.28 15.63 12.27 33 DKIM_VALID_EF 17876 25.30 15.31 29.59 34 FSL_BULK_SIG 17691 9.83 15.15 7.55 35 T_KAM_HTML_FONT_INVALID 16699 14.95 14.30 15.23 36 FROM_EXCESS_BASE64 16213 7.68 13.89 5.02 37 T_TM2_M_HEADER_IN_MSG 16012 21.13 13.71 24.31 38 XM_UB50 13389 3.97 11.47 0.76 39 MultiRelay 12810 14.15 10.97 15.51 40 BOTNET_IPINHOSTNAME 12611 8.40 10.80 7.37 41 MISSING_HEADERS 11898 3.19 10.19 0.19 42 HTML_MIME_NO_HTML_TAG 10474 3.64 8.97 1.36 43 T_XMDrugObfuBody_14 10203 7.17 8.74 6.50 44 XMSexyCombo_05 9803 5.70 8.40 4.55 45 HTML_IMAGE_RATIO_04 9654 7.11 8.27 6.61 46 T_REMOTE_IMAGE 9341 5.18 8.00 3.98 47 BAYES_60 9068 6.01 7.77 5.26 48 XM_UncommonTLD01 8681 5.25 7.43 4.32 49 MPART_ALT_DIFF 8670 4.72 7.43 3.56 50 XMNumbers 7779 5.49 6.66 4.99 51 BAYES_80 7718 4.24 6.61 3.22 52 TooManyTo_001 7206 5.68 6.17 5.47 53 BODY_URI_ONLY 7191 1.87 6.16 0.03 54 RELAYCOUNTRY_DE 7065 2.01 6.05 0.28 55 HTML_SHORT_LINK_IMG_1 6986 1.82 5.98 0.04 56 XMSubMetaSx_00 6847 4.78 5.86 4.31 57 XM_H_Long_From01 6750 5.82 5.78 5.83 58 SpammyFromTLD_02 6604 1.81 5.66 0.15 59 MIME_HEADER_CTYPE_ONLY 6535 1.77 5.60 0.13 60 HTML_IMAGE_ONLY_04 6317 1.65 5.41 0.03 61 XM_S_JOY_D 5886 1.82 5.04 0.44 62 XM_B_Phish_Phrases 5531 5.90 4.74 6.40 63 HTML_SHORT_CENTER 5522 1.42 4.73 0.00 64 REPLYTO_WITHOUT_TO_CC 5374 1.40 4.60 0.02 65 DKIM_INVALID 5328 4.19 4.56 4.03 66 HELO_NODOT 5263 1.73 4.51 0.53 67 TR_LOTS_OF_MONEY1 5218 1.35 4.47 0.01 68 XM_UB60 5134 1.36 4.40 0.05 69 RELAYCOUNTRY_NG_I 5103 1.31 4.37 0.00 70 LotsOfNums_01 5018 6.60 4.30 7.59 71 MIME_HTML_MOSTLY 4402 3.09 3.77 2.79 72 MIME_HTML_ONLY_MULTI 4321 2.21 3.70 1.58 73 UNPARSEABLE_RELAY 4116 4.09 3.53 4.33 74 XM_DIRTYINTL 4115 2.43 3.52 1.95 75 BAYES_40 3919 4.35 3.36 4.77 76 HTML_IMAGE_RATIO_06 3682 3.72 3.15 3.96 77 BAYES_95 3672 2.45 3.14 2.15 78 URI_HEX 3530 2.22 3.02 1.88 79 XMStrtUSub 3491 4.02 2.99 4.46 80 RCVD_IN_RP_SAFE 3482 9.73 2.98 12.62 81 RELAYCOUNTRY_FR 3380 1.04 2.89 0.24 82 RELAYCOUNTRY_CN 3308 0.86 2.83 0.02 83 BOTNET_NORDNS 3294 0.86 2.82 0.02 84 RELAYCOUNTRY_CA 3292 2.06 2.82 1.73 85 XM_UB80 3251 0.84 2.78 0.01 86 MultiRelay_CC 3210 0.96 2.75 0.20 87 MultiRelay_Combo 3210 0.96 2.75 0.20 88 XM_CamelCaseFrm001 3128 2.17 2.68 1.95 89 XM_SPF_SoftFail 3017 2.16 2.58 1.98 90 SHORTENER_SHORT_IMG 2902 0.75 2.49 0.00 91 URI_BUFFLY 2893 0.74 2.48 0.00 92 SUBJ_DOLLARS 2873 1.14 2.46 0.58 93 XM_SendGrid 2658 4.79 2.28 5.87 94 TM2_M_URI_OPT_OUT 2621 1.93 2.24 1.79 95 RCVD_IN_RP_CERTIFIED 2513 8.25 2.15 10.87 96 BAYES_20 2395 2.65 2.05 2.91 97 RCVD_IN_MSPIKE_H2 2379 3.97 2.04 4.80 98 XM_OfRef6 2351 1.49 2.01 1.26 99 XMSexyCombo_01 2338 1.23 2.00 0.90 100 HTML_IMAGE_RATIO_08 2328 1.97 1.99 1.96 101 TVD_SPACE_RATIO_MINFP 2237 0.58 1.92 0.00 102 T_TooManySym_01 2175 5.53 1.86 7.10 103 SpammyFromTLD_01 2174 1.14 1.86 0.83 104 RCVD_IN_BL_SPAMCOP_NET 2122 0.86 1.82 0.45 105 T_XMDrugObfuBody_08 2093 1.29 1.79 1.07 106 XMBdyGiftCard01 2057 1.71 1.76 1.69 107 DIET_1 1952 0.83 1.67 0.47 108 T_XMDrugObfuBody_00 1929 1.00 1.65 0.72 109 XMReplyNow 1919 0.56 1.64 0.09 110 XMSubMetaI_00 1879 1.01 1.61 0.75 111 XM_URI_RBL 1856 0.87 1.59 0.56 112 XM_UB99 1735 0.45 1.49 0.01 113 XMBody_17 1685 0.97 1.44 0.77 114 XMStockSpam_06 1658 1.00 1.42 0.83 115 MIME_QP_LONG_LINE 1619 3.61 1.39 4.56 116 XMPhish30 1594 0.74 1.37 0.47 117 XMSlimDrugH 1593 0.75 1.36 0.48 118 XMDiploma_00 1589 1.30 1.36 1.27 119 URIBL_BLACK 1565 0.46 1.34 0.08 120 MAILING_LIST_MULTI 1513 1.64 1.30 1.79 121 XM_XX_Yahoo 1481 0.45 1.27 0.09 122 T_XMHurry_00 1473 0.84 1.26 0.65 123 BAYES_00 1455 13.31 1.25 18.48 124 BODY_ENHANCEMENT 1425 0.39 1.22 0.03 125 SUBJ_ALL_CAPS 1422 2.00 1.22 2.33 126 FSL_THIS_IS_ADV 1404 0.41 1.20 0.08 127 XM_B_REG_HTML 1380 1.05 1.18 1.00 128 RELAYCOUNTRY_AT 1365 0.54 1.17 0.27 129 TM2_M_VERY_LONG_WORD 1338 0.95 1.15 0.87 130 RCVD_IN_IADB_LISTED 1322 3.74 1.13 4.85 131 XMPhish11 1271 0.88 1.09 0.79 132 URIBL_DBL_SPAM 1241 0.40 1.06 0.11 133 ALL_TRUSTED 1229 10.89 1.05 15.11 134 PLING_QUERY 1215 0.60 1.04 0.42 135 RCVD_IN_PSBL 1190 0.37 1.02 0.08 136 LOW_PRICE 1185 0.42 1.01 0.17 137 XMHTMLBadTable_001 1168 0.78 1.00 0.68 138 XM_H_PHPOS 1165 1.32 1.00 1.46 139 XM_UB95 1155 0.30 0.99 0.01 140 BAYES_05 1154 1.68 0.99 1.97 141 TR_XM_DK_Bayes 1128 11.03 0.97 15.35 142 T_HTML_TAG_BALANCE_CENTER 1109 0.37 0.95 0.12 143 XM_RXBody 1095 0.59 0.94 0.44 144 TR_XM_DK_Bayes1 1083 10.73 0.93 14.93 145 DATE_IN_PAST_03_06 1069 0.34 0.92 0.09 146 RELAYCOUNTRY_BR 1060 0.30 0.91 0.03 147 XMSubMetaSSx_00 1046 0.45 0.90 0.26 148 XM_H_Long_From02 1045 1.00 0.89 1.05 149 RDNS_DYNAMIC 1043 0.63 0.89 0.52 150 DATE_IN_PAST_06_12 1013 0.30 0.87 0.06 151 RCVD_IN_IADB_SPF 1011 3.20 0.87 4.20 152 XMBody_78 991 0.59 0.85 0.47 153 RCVD_IN_MSPIKE_WL 990 1.80 0.85 2.20 154 TR_XM_RelayPhish 986 0.55 0.84 0.43 155 RCVD_IN_MSPIKE_H3 980 1.79 0.84 2.20 156 RELAYCOUNTRY_IN 970 0.31 0.83 0.09 157 XM_ProductURIs 970 1.00 0.83 1.07 158 XM_UB999 954 0.25 0.82 0.01 159 RCVD_IN_IADB_SENDERID 950 2.84 0.81 3.71 160 XMGenDplmaNmb 943 0.72 0.81 0.68 161 FILL_THIS_FORM 938 0.57 0.80 0.47 162 RCVD_IN_IADB_DK 923 2.75 0.79 3.60 163 URI_NOVOWEL 897 0.50 0.77 0.38 164 URI_TRY_3LD 895 1.50 0.77 1.82 165 FILL_THIS_FORM_LONG 892 0.51 0.76 0.41 166 XMSexyCombo_04 886 0.49 0.76 0.38 167 XM_Body_Obfu01 880 0.28 0.75 0.08 168 TR_XM_DK_Bayes2 878 8.94 0.75 12.46 169 HTML_TEXT_INVISIBLE_STYLE 868 0.27 0.74 0.06 170 MPART_ALT_DIFF_COUNT 866 0.42 0.74 0.28 171 HTML_FONT_FACE_BAD 865 0.64 0.74 0.60 172 RCVD_IN_IADB_VOUCHED 861 2.46 0.74 3.20 173 XM_B_COPY_HTML 853 0.75 0.73 0.76 174 TR_Mismatch_TLD_02 844 0.26 0.72 0.06 175 TR_Symld_Words 843 1.70 0.72 2.12 176 XM_DK_Undo_01 796 1.19 0.68 1.41 177 T_TooManySym_02 792 1.87 0.68 2.38 178 XMManySubDom_06 778 0.29 0.67 0.12 179 HK_RANDOM_FROM 771 0.30 0.66 0.15 180 T_MONEY_PERCENT 762 0.30 0.65 0.14 181 TR_LOTS_OF_MONEY2 762 0.30 0.65 0.14 182 XMHTML_After_End 738 0.40 0.63 0.30 183 XMNoVowels 711 0.50 0.61 0.46 184 DKIM_ADSP_CUSTOM_MED 710 0.68 0.61 0.71 185 RELAYCOUNTRY_GB 704 0.53 0.60 0.50 186 HTML_IMAGE_ONLY_08 698 0.24 0.60 0.09 187 NML_ADSP_CUSTOM_MED 677 0.51 0.58 0.48 188 XM_H_PHPMailer 669 0.75 0.57 0.83 189 RELAYCOUNTRY_TW 658 0.24 0.56 0.10 190 XMSubMetaSxObfu_03 652 0.57 0.56 0.58 191 HTML_TAG_BALANCE_BODY 652 0.50 0.56 0.47 192 FROM_SUSPICIOUS_NTLD 643 0.21 0.55 0.07 193 XMSubject_48 642 0.18 0.55 0.02 194 DKIM_ADSP_NXDOMAIN 639 0.62 0.55 0.65 195 FILL_THIS_FORM_LOAN 636 0.44 0.54 0.39 196 SPOOF_COM2COM 629 0.19 0.54 0.04 197 LongTLD 629 0.27 0.54 0.16 198 NO_DNS_FOR_FROM 629 0.55 0.54 0.56 199 T_XMDrugObfuBody_01 629 0.40 0.54 0.35 200 FORGED_GMAIL_RCVD 626 0.42 0.54 0.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 222917 81.23 79.78 81.86 2 DKIM_SIGNED 211111 73.08 62.73 77.52 3 XM_DK_Pass 208495 71.97 61.24 76.56 4 DKIM_VALID 200148 68.90 58.16 73.50 5 DKIM_VALID_AU 153800 54.54 50.03 56.48 6 XMListUnsubscribeExists 152355 55.95 55.96 55.95 7 BAYES_50 146469 53.39 52.46 53.79 8 DCC_CHECK_NEGATIVE 143327 46.45 32.03 52.63 9 DCC_CHECK 126144 52.55 67.08 46.32 10 XM_H_QuotedFrom 99517 39.05 44.91 36.54 11 STYLE_GIBBERISH 91042 32.28 29.59 33.43 12 HTML_FONT_LOW_CONTRAST 84584 30.28 28.45 31.06 13 DKIM_VALID_EF 80566 25.30 15.31 29.59 14 LOC_TINY_FONT_1 69653 26.75 29.48 25.58 15 T_TM2_M_HEADER_IN_MSG 66192 21.13 13.71 24.31 16 MIME_HTML_ONLY 60390 24.66 30.45 22.18 17 FVGT_m_MULTI_ODD 58117 21.70 22.55 21.34 18 XMSubLong 54995 20.63 21.63 20.19 19 BAYES_00 50336 13.31 1.25 18.48 20 MultiRelay 42249 14.15 10.97 15.51 21 TR_XM_DK_Bayes 41790 11.03 0.97 15.35 22 T_KAM_HTML_FONT_INVALID 41475 14.95 14.30 15.23 23 ALL_TRUSTED 41160 10.89 1.05 15.11 24 TR_XM_DK_Bayes1 40660 10.73 0.93 14.93 25 XM_DKIMWhitelistDomains 38738 10.00 0.13 14.23 26 XM_Multi_Part_URI 38650 17.06 23.73 14.19 27 LOTS_OF_MONEY 34899 17.32 27.83 12.82 28 RCVD_IN_RP_SAFE 34369 9.73 2.98 12.62 29 TR_XM_DK_Bayes2 33919 8.94 0.75 12.46 30 XM_Body_Dirty_Words 33411 13.28 15.63 12.27 31 RCVD_IN_RP_CERTIFIED 29605 8.25 2.15 10.87 32 HTML_IMAGE_RATIO_02 28381 12.47 17.25 10.42 33 XM_DK_Undo_02 25284 14.85 27.82 9.28 34 XM_Evil_Numbers_Gen 23241 13.31 24.43 8.53 35 LotsOfNums_01 20657 6.60 4.30 7.59 36 FSL_BULK_SIG 20555 9.83 15.15 7.55 37 BAYES_99 20237 11.92 22.38 7.43 38 BOTNET_IPINHOSTNAME 20066 8.40 10.80 7.37 39 T_TooManySym_01 19335 5.53 1.86 7.10 40 HTML_IMAGE_RATIO_04 17998 7.11 8.27 6.61 41 T_XMDrugObfuBody_14 17702 7.17 8.74 6.50 42 XM_B_Phish_Phrases 17435 5.90 4.74 6.40 43 ANY_BOUNCE_MESSAGE 17185 9.12 15.67 6.31 44 BOUNCE_MESSAGE 17184 9.12 15.67 6.31 45 BAYES_999 17124 9.93 18.42 6.29 46 XM_SendGrid 15992 4.79 2.28 5.87 47 XM_H_Long_From01 15876 5.82 5.78 5.83 48 TooManyTo_001 14898 5.68 6.17 5.47 49 BAYES_60 14326 6.01 7.77 5.26 50 BOTNET 14058 11.62 26.68 5.16 51 TO_MALFORMED 14023 3.62 0.06 5.15 52 FROM_EXCESS_BASE64 13659 7.68 13.89 5.02 53 XMNumbers 13576 5.49 6.66 4.99 54 RCVD_IN_IADB_LISTED 13220 3.74 1.13 4.85 55 RCVD_IN_MSPIKE_H2 13081 3.97 2.04 4.80 56 BAYES_40 13001 4.35 3.36 4.77 57 MIME_QP_LONG_LINE 12416 3.61 1.39 4.56 58 XMSexyCombo_05 12392 5.70 8.40 4.55 59 RELAYCOUNTRY_META 12145 9.74 22.05 4.46 60 XMStrtUSub 12132 4.02 2.99 4.46 61 UNPARSEABLE_RELAY 11800 4.09 3.53 4.33 62 TVD_RCVD_IP 11779 3.11 0.27 4.33 63 XM_UncommonTLD01 11762 5.25 7.43 4.32 64 XMSubMetaSx_00 11750 4.78 5.86 4.31 65 RCVD_IN_IADB_SPF 11441 3.20 0.87 4.20 66 TR_DCC_Bayes_99 11201 8.43 18.51 4.11 67 DKIM_INVALID 10963 4.19 4.56 4.03 68 T_REMOTE_IMAGE 10827 5.18 8.00 3.98 69 HTML_IMAGE_RATIO_06 10776 3.72 3.15 3.96 70 RCVD_IN_IADB_SENDERID 10102 2.84 0.81 3.71 71 RCVD_IN_IADB_DK 9796 2.75 0.79 3.60 72 MPART_ALT_DIFF 9703 4.72 7.43 3.56 73 IN_ZIMBRA_NJ_WHITELIST 9354 2.41 0.01 3.43 74 BAYES_80 8779 4.24 6.61 3.22 75 RCVD_IN_IADB_VOUCHED 8717 2.46 0.74 3.20 76 BAYES_20 7931 2.65 2.05 2.91 77 MIME_HTML_MOSTLY 7605 3.09 3.77 2.79 78 INVALID_MSGID 7020 1.83 0.08 2.58 79 RCVD_IN_RP_RNBL 6782 7.34 18.66 2.49 80 T_TooManySym_02 6494 1.87 0.68 2.38 81 SUBJ_ALL_CAPS 6351 2.00 1.22 2.33 82 RCVD_IN_MSPIKE_WL 5999 1.80 0.85 2.20 83 RCVD_IN_MSPIKE_H3 5991 1.79 0.84 2.20 84 BAYES_95 5866 2.45 3.14 2.15 85 TR_Symld_Words 5762 1.70 0.72 2.12 86 RCVD_IN_IADB_OPTIN 5707 1.62 0.52 2.10 87 XM_SPF_SoftFail 5393 2.16 2.58 1.98 88 BAYES_05 5375 1.68 0.99 1.97 89 HTML_IMAGE_RATIO_08 5349 1.97 1.99 1.96 90 XM_DIRTYINTL 5323 2.43 3.52 1.95 91 XM_CamelCaseFrm001 5311 2.17 2.68 1.95 92 TR_MetaPhish_Combo_01 5307 1.44 0.27 1.95 93 XM_PDF 5200 1.40 0.20 1.91 94 URI_HEX 5106 2.22 3.02 1.88 95 URI_TRY_3LD 4946 1.50 0.77 1.82 96 TM2_M_URI_OPT_OUT 4882 1.93 2.24 1.79 97 MAILING_LIST_MULTI 4873 1.64 1.30 1.79 98 IN_HORDE_ADDRESS_BOOK 4828 1.25 0.04 1.77 99 RELAYCOUNTRY_CA 4704 2.06 2.82 1.73 100 USER_IN_DEF_DKIM_WL 4623 1.21 0.07 1.70 101 XMBdyGiftCard01 4602 1.71 1.76 1.69 102 MIME_HTML_ONLY_MULTI 4297 2.21 3.70 1.58 103 XM_H_PHPOS 3969 1.32 1.00 1.46 104 XM_DK_Undo_01 3846 1.19 0.68 1.41 105 HTML_MIME_NO_HTML_TAG 3705 3.64 8.97 1.36 106 UNTRUSTED_Relay 3585 7.51 21.94 1.32 107 XMDiploma_00 3455 1.30 1.36 1.27 108 XM_OfRef6 3427 1.49 2.01 1.26 109 XM_GoogleGroups 3312 0.97 0.39 1.22 110 TooManyTo_002 2940 0.89 0.45 1.08 111 T_XMDrugObfuBody_08 2911 1.29 1.79 1.07 112 XM_ProductURIs 2904 1.00 0.83 1.07 113 XM_H_Long_From02 2849 1.00 0.89 1.05 114 XM_B_REG_HTML 2710 1.05 1.18 1.00 115 XMBody_95 2501 0.66 0.06 0.92 116 XMSexyCombo_01 2446 1.23 2.00 0.90 117 TM2_M_VERY_LONG_WORD 2371 0.95 1.15 0.87 118 TM2_M_A_HREF_HREF 2336 0.74 0.46 0.86 119 USER_IN_WHITELIST 2309 0.59 0.00 0.85 120 XM_H_PHPMailer 2262 0.75 0.57 0.83 121 SpammyFromTLD_01 2260 1.14 1.86 0.83 122 XMStockSpam_06 2250 1.00 1.42 0.83 123 XMPhish11 2151 0.88 1.09 0.79 124 TooManyTo_003 2132 0.66 0.37 0.78 125 XM_shorewaves_Whitelist 2117 0.54 0.00 0.78 126 XMBody_17 2098 0.97 1.44 0.77 127 XM_B_COPY_HTML 2068 0.75 0.73 0.76 128 XM_UB50 2058 3.97 11.47 0.76 129 XMSubMetaI_00 2039 1.01 1.61 0.75 130 T_XMDrugObfuBody_00 1957 1.00 1.65 0.72 131 DKIM_ADSP_CUSTOM_MED 1931 0.68 0.61 0.71 132 T_TooManySym_03 1906 0.52 0.10 0.70 133 XMGenDplmaNmb 1855 0.72 0.81 0.68 134 XMHTMLBadTable_001 1854 0.78 1.00 0.68 135 T_XMHurry_00 1780 0.84 1.26 0.65 136 DKIM_ADSP_NXDOMAIN 1761 0.62 0.55 0.65 137 XMSubMetaSxObfu_02 1721 0.49 0.14 0.63 138 TooManyTo_004 1720 0.53 0.29 0.63 139 HTML_FONT_FACE_BAD 1631 0.64 0.74 0.60 140 XMSubMetaSxObfu_03 1572 0.57 0.56 0.58 141 SUBJ_DOLLARS 1568 1.14 2.46 0.58 142 NO_DNS_FOR_FROM 1524 0.55 0.54 0.56 143 XM_URI_RBL 1519 0.87 1.59 0.56 144 T_FILL_THIS_FORM_SHORT 1497 0.54 0.52 0.55 145 TooManyTo_005 1466 0.45 0.24 0.54 146 HELO_NODOT 1451 1.73 4.51 0.53 147 XM_H_PHPOS_M 1425 0.49 0.42 0.52 148 RDNS_DYNAMIC 1413 0.63 0.89 0.52 149 XMBrknScrpt_02 1401 0.44 0.27 0.51 150 RELAYCOUNTRY_GB 1356 0.53 0.60 0.50 151 XMSlimDrugH 1310 0.75 1.36 0.48 152 NML_ADSP_CUSTOM_MED 1302 0.51 0.58 0.48 153 XMBody_78 1292 0.59 0.85 0.47 154 XMPhish30 1284 0.74 1.37 0.47 155 HTML_TAG_BALANCE_BODY 1277 0.50 0.56 0.47 156 FILL_THIS_FORM 1272 0.57 0.80 0.47 157 DIET_1 1271 0.83 1.67 0.47 158 XM_D_tchamptons_WL 1270 0.33 0.01 0.47 159 XMNoVowels 1247 0.50 0.61 0.46 160 RCVD_IN_BL_SPAMCOP_NET 1235 0.86 1.82 0.45 161 XM_S_JOY_D 1198 1.82 5.04 0.44 162 XM_RXBody 1197 0.59 0.94 0.44 163 T_Symld_Words_02 1179 0.46 0.52 0.43 164 REMOVE_BEFORE_LINK 1175 0.43 0.43 0.43 165 TR_XM_RelayPhish 1170 0.55 0.84 0.43 166 PLING_QUERY 1131 0.60 1.04 0.42 167 XMLngstWrd_00 1129 0.35 0.20 0.41 168 FILL_THIS_FORM_LONG 1108 0.51 0.76 0.41 169 XMCapTrack 1097 0.34 0.18 0.40 170 T_TooManySym_04 1090 0.28 0.01 0.40 171 RELAYCOUNTRY_AU 1067 0.38 0.35 0.39 172 FILL_THIS_FORM_LOAN 1058 0.44 0.54 0.39 173 URI_NOVOWEL 1046 0.50 0.77 0.38 174 TR_LOTS_OF_MONEY3 1032 5.63 17.89 0.38 175 XMSexyCombo_04 1028 0.49 0.76 0.38 176 T_OBFU_PDF_ATTACH 1028 0.27 0.03 0.38 177 FORGED_GMAIL_RCVD 1019 0.42 0.54 0.37 178 XMLngstWrd_01 979 0.31 0.18 0.36 179 T_XMDrugObfuBody_01 942 0.40 0.54 0.35 180 XM_Akamai 925 0.24 0.01 0.34 181 XMRcvdHeader_15 834 0.21 0.00 0.31 182 XMHTML_After_End 827 0.40 0.63 0.30 183 XMPhish14 800 0.34 0.46 0.29 184 RELAYCOUNTRY_DE 765 2.01 6.05 0.28 185 MPART_ALT_DIFF_COUNT 753 0.42 0.74 0.28 186 RELAYCOUNTRY_AT 740 0.54 1.17 0.27 187 XMSUPPORT 739 0.19 0.00 0.27 188 XMMoneyMeta_00 737 0.34 0.52 0.27 189 AC_DIV_BONANZA 734 0.24 0.17 0.27 190 XMSolicitRefs_0 730 0.25 0.20 0.27 191 XMOemUri 712 0.27 0.29 0.26 192 XMSubMetaSSx_00 698 0.45 0.90 0.26 193 XM_ShortIntro_01 689 0.32 0.46 0.25 194 HTTPS_HTTP_MISMATCH 685 0.27 0.31 0.25 195 UPPERCASE_50_75 683 0.20 0.09 0.25 196 XM_H_SpoofStaff4 677 0.18 0.03 0.25 197 RELAYCOUNTRY_FR 660 1.04 2.89 0.24 198 TVD_SPACE_RATIO 656 0.21 0.15 0.24 199 TR_MetaPhish_Combo_01b 642 0.19 0.07 0.24 200 TM2_M_BODY_EMPTY 639 0.19 0.08 0.23 ----------------------------------------------------------------------