Email: 574433 Autolearn: 0 AvgScore: 2.68 AvgScanTime: 2.06 sec Spam: 160601 Autolearn: 0 AvgScore: 12.43 AvgScanTime: 2.38 sec Ham: 413832 Autolearn: 0 AvgScore: -1.11 AvgScanTime: 1.94 sec Time Spent Running SA: 329.14 hours Time Spent Processing Spam: 106.37 hours Time Spent Processing Ham: 222.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150728 89.31 93.85 87.55 2 DKIM_SIGNED 123593 74.29 76.96 73.25 3 XM_DK_Pass 120601 72.84 75.09 71.96 4 DCC_CHECK 118108 48.18 73.54 38.34 5 DKIM_VALID 114829 69.24 71.50 68.36 6 XMListUnsubscribeExists 110447 53.88 68.77 48.11 7 DKIM_VALID_AU 94658 51.35 58.94 48.40 8 XM_DK_Undo_02 78606 25.83 48.94 16.87 9 XM_H_QuotedFrom 73378 38.90 45.69 36.27 10 BAYES_99 71572 23.65 44.57 15.53 11 HTML_FONT_LOW_CONTRAST 62305 29.75 38.79 26.25 12 BAYES_999 61857 20.82 38.52 13.95 13 TR_DCC_Bayes_99 58740 16.55 36.58 8.78 14 BAYES_50 56164 47.82 34.97 52.80 15 LOC_TINY_FONT_1 53229 24.78 33.14 21.54 16 MIME_HTML_ONLY 49972 23.64 31.12 20.74 17 DCC_CHECK_NEGATIVE 40433 50.08 25.18 59.74 18 FVGT_m_MULTI_ODD 39609 21.10 24.66 19.72 19 XMSubLong 38210 22.51 23.79 22.02 20 DKIM_VALID_EF 35369 26.31 22.02 27.97 21 BOTNET 33208 7.23 20.68 2.02 22 T_TM2_M_HEADER_IN_MSG 31211 28.38 19.43 31.86 23 XM_Body_Dirty_Words 30772 14.47 19.16 12.65 24 T_KAM_HTML_FONT_INVALID 29155 16.97 18.15 16.50 25 HTML_IMAGE_RATIO_02 25770 10.21 16.05 7.94 26 XM_Multi_Part_URI 24301 13.23 15.13 12.50 27 RELAYCOUNTRY_META 24019 9.25 14.96 7.04 28 LOTS_OF_MONEY 21265 10.90 13.24 9.99 29 XM_Evil_Numbers_Gen 20498 9.83 12.76 8.69 30 MultiRelay 20152 16.56 12.55 18.11 31 BOTNET_IPINHOSTNAME 19682 6.95 12.26 4.89 32 XMSexyCombo_05 17272 6.13 10.75 4.34 33 RCVD_IN_RP_RNBL 16445 2.89 10.24 0.04 34 FSL_BULK_SIG 15428 7.62 9.61 6.85 35 RCVD_IN_PSBL 14934 2.65 9.30 0.06 36 MPART_ALT_DIFF 14402 4.67 8.97 3.01 37 UNTRUSTED_Relay 14277 5.01 8.89 3.50 38 HTML_IMAGE_RATIO_04 13847 6.26 8.62 5.35 39 XM_UncommonTLD01 13271 4.71 8.26 3.33 40 T_XMDrugObfuBody_14 13109 8.32 8.16 8.38 41 TooManyTo_001 13055 9.82 8.13 10.47 42 BOUNCE_MESSAGE 12932 3.68 8.05 1.99 43 ANY_BOUNCE_MESSAGE 12932 3.68 8.05 1.99 44 XM_H_Long_From01 12635 6.74 7.87 6.30 45 XMSubMetaSx_00 12611 5.34 7.85 4.36 46 XM_B_Phish_Phrases 11158 6.43 6.95 6.22 47 LotsOfNums_01 10691 8.06 6.66 8.61 48 HTML_TAG_BALANCE_BODY 10593 2.22 6.60 0.53 49 FROM_EXCESS_BASE64 9768 4.70 6.08 4.16 50 T_HTML_ATTACH 9559 1.91 5.95 0.34 51 BAYES_80 9134 4.40 5.69 3.90 52 DKIM_INVALID 8764 5.05 5.46 4.89 53 HTML_IMAGE_RATIO_06 8425 3.98 5.25 3.49 54 HTML_IMAGE_RATIO_08 8401 2.90 5.23 2.00 55 BAYES_60 7544 5.53 4.70 5.85 56 RCVD_IN_RP_SAFE 7439 8.94 4.63 10.61 57 MIME_HTML_MOSTLY 7375 3.00 4.59 2.38 58 XM_DIRTYINTL 6964 2.71 4.34 2.08 59 XM_SPF_SoftFail 6799 2.68 4.23 2.08 60 SpammyFromTLD_02 6684 1.49 4.16 0.46 61 XM_UB50 6376 3.25 3.97 2.97 62 URI_HEX 6238 2.31 3.88 1.70 63 RELAYCOUNTRY_CA 6023 2.06 3.75 1.41 64 TM2_M_URI_OPT_OUT 5732 2.29 3.57 1.79 65 ALL_TRUSTED 5567 12.49 3.47 15.99 66 BAYES_95 5477 2.89 3.41 2.69 67 XM_OfRef6 5417 2.10 3.37 1.60 68 XM_SendGrid 5387 5.06 3.35 5.72 69 XMStrtUSub 5377 4.24 3.35 4.59 70 XM_CamelCaseFrm001 5318 2.18 3.31 1.74 71 SUBJ_ALL_CAPS 5300 2.43 3.30 2.10 72 XM_URI_RBL 5277 1.27 3.29 0.48 73 T_REMOTE_IMAGE 5192 3.79 3.23 4.00 74 MIME_HTML_ONLY_MULTI 5089 1.99 3.17 1.53 75 FROM_SUSPICIOUS_NTLD 4842 0.87 3.01 0.04 76 XMSubNoVowel 4673 1.07 2.91 0.36 77 RCVD_IN_RP_CERTIFIED 4663 7.52 2.90 9.31 78 XMNumbers 4524 2.87 2.82 2.89 79 MIME_QP_LONG_LINE 4380 4.85 2.73 5.68 80 BASE64_LENGTH_79_INF 4362 0.99 2.72 0.31 81 HTML_IMAGE_ONLY_24 4308 0.99 2.68 0.34 82 XMSubEmpty 4261 0.93 2.65 0.27 83 RCVD_IN_MSPIKE_H2 4206 3.89 2.62 4.39 84 URIBL_RHS_DOB 4158 0.77 2.59 0.06 85 BAYES_20 4102 2.67 2.55 2.71 86 TO_NO_BRKTS_HTML_IMG 4101 0.80 2.55 0.12 87 XMDiploma_00 3989 1.82 2.48 1.57 88 XMBdyGiftCard01 3801 1.19 2.37 0.73 89 T_TooManySym_01 3721 4.29 2.32 5.06 90 BAYES_40 3673 3.22 2.29 3.59 91 XMBody_17 3632 1.08 2.26 0.62 92 T_XMDrugObfuBody_08 3544 1.75 2.21 1.58 93 XM_UB99 3514 0.62 2.19 0.02 94 HTML_MIME_NO_HTML_TAG 3133 2.36 1.95 2.52 95 XMSexyCombo_01 3101 1.13 1.93 0.81 96 XM_H_TOP 3096 0.54 1.93 0.00 97 TR_M_TOP_BAYES 2986 0.52 1.86 0.00 98 XMGenDplmaNmb 2952 1.24 1.84 1.01 99 XMSubMetaI_00 2927 1.20 1.82 0.96 100 MultiRelay_Combo 2916 0.63 1.82 0.17 101 MultiRelay_CC 2916 0.63 1.82 0.17 102 XM_UB999 2836 0.50 1.77 0.02 103 DATE_IN_PAST_06_12 2777 0.50 1.73 0.03 104 XM_H_Long_From02 2748 2.68 1.71 3.05 105 NO_DNS_FOR_FROM 2667 1.31 1.66 1.18 106 RCVD_IN_IADB_LISTED 2633 4.75 1.64 5.96 107 XMPhish11 2604 1.40 1.62 1.32 108 DATE_IN_PAST_03_06 2599 0.50 1.62 0.07 109 TR_Symld_Words 2580 1.81 1.61 1.89 110 RCVD_IN_BL_SPAMCOP_NET 2561 0.62 1.59 0.24 111 TR_Caps_n_Bayes_99 2502 0.68 1.56 0.33 112 T_MONEY_PERCENT 2480 0.59 1.54 0.21 113 TR_LOTS_OF_MONEY2 2480 0.59 1.54 0.21 114 T_FILL_THIS_FORM_SHORT 2453 1.08 1.53 0.91 115 SpammyFromTLD_01 2360 0.94 1.47 0.74 116 URI_TRY_3LD 2296 1.35 1.43 1.32 117 TR_XM_RelayPhish 2292 0.82 1.43 0.58 118 FILL_THIS_FORM 2224 0.70 1.38 0.43 119 XMStockSpam_06 2154 1.37 1.34 1.38 120 XM_OfRef7 2154 0.53 1.34 0.22 121 MAILING_LIST_MULTI 2109 1.93 1.31 2.16 122 TM2_M_VERY_LONG_WORD 2103 0.92 1.31 0.76 123 RCVD_IN_IADB_SPF 2100 4.13 1.31 5.23 124 BODY_ENHANCEMENT 2075 0.40 1.29 0.05 125 UNPARSEABLE_RELAY 2067 2.39 1.29 2.81 126 XMSubMetaSxObfu_03 2049 0.73 1.28 0.52 127 TR_Mismatch_TLD_02 2003 0.39 1.25 0.06 128 RELAYCOUNTRY_DE 1980 0.64 1.23 0.41 129 SUBJ_DOLLARS 1974 0.58 1.23 0.32 130 BOTNET_NORDNS 1933 0.36 1.20 0.03 131 XMPhish30 1931 0.62 1.20 0.39 132 RCVD_IN_IADB_SENDERID 1906 3.63 1.19 4.58 133 T_XMDrugObfuBody_00 1854 1.29 1.15 1.35 134 RCVD_IN_IADB_DK 1845 3.55 1.15 4.48 135 DKIM_ADSP_NXDOMAIN 1841 0.68 1.15 0.50 136 MPART_ALT_DIFF_COUNT 1823 0.50 1.14 0.26 137 RELAYCOUNTRY_GB 1802 1.04 1.12 1.00 138 XM_salutation2 1786 0.79 1.11 0.66 139 FSL_THIS_IS_ADV 1768 0.37 1.10 0.09 140 XM_UB60 1723 0.37 1.07 0.09 141 XMHTMLBadTable_001 1721 0.71 1.07 0.57 142 FILL_THIS_FORM_LONG 1654 0.52 1.03 0.33 143 RCVD_IN_IADB_VOUCHED 1646 3.23 1.02 4.09 144 RELAYCOUNTRY_IN 1633 0.35 1.02 0.09 145 FILL_THIS_FORM_LOAN 1628 0.51 1.01 0.31 146 URIBL_BLACK 1628 0.32 1.01 0.05 147 LongTLD 1571 0.36 0.98 0.13 148 RELAYCOUNTRY_AT 1562 0.43 0.97 0.22 149 XM_H_PHPOS 1531 1.03 0.95 1.05 150 RELAYCOUNTRY_FR 1511 0.39 0.94 0.18 151 T_XMHurry_00 1479 0.75 0.92 0.68 152 XMHTML_After_End 1476 0.51 0.92 0.35 153 BODY_URI_ONLY 1427 0.31 0.89 0.09 154 LONG_JUNK_URI 1403 0.29 0.87 0.06 155 XM_B_REG_HTML 1389 0.60 0.86 0.49 156 XMBody_78 1376 0.54 0.86 0.42 157 RCVD_IN_MSPIKE_WL 1368 1.74 0.85 2.08 158 RCVD_IN_MSPIKE_H3 1368 1.74 0.85 2.08 159 XM_HighProb1 1352 0.24 0.84 0.01 160 XMBrknScrpt_02 1326 0.61 0.83 0.53 161 XMMoneyMeta_00 1294 0.57 0.81 0.47 162 BAYES_05 1289 1.45 0.80 1.70 163 RELAYCOUNTRY_NL 1285 0.37 0.80 0.20 164 XM_ProductURIs 1271 0.68 0.79 0.63 165 BAYES_00 1263 7.99 0.79 10.78 166 HTML_IMAGE_ONLY_16 1262 0.43 0.79 0.30 167 HELO_NODOT 1253 1.24 0.78 1.41 168 HELO_NO_DOMAIN 1250 1.24 0.78 1.41 169 XM_H_Undi_Recip 1242 0.35 0.77 0.18 170 XMSubMetaSSx_00 1242 0.32 0.77 0.15 171 XM_DK_Undo_01 1234 1.57 0.77 1.89 172 TR_LOTS_OF_MONEY3 1233 0.41 0.77 0.27 173 RDNS_DYNAMIC 1232 0.52 0.77 0.43 174 DIET_1 1229 0.82 0.77 0.84 175 MONEY_FRAUD_8 1219 0.21 0.76 0.00 176 T_TooManySym_02 1196 1.44 0.74 1.71 177 XM_OfRef8 1188 0.24 0.74 0.04 178 TR_MetaPhish_Combo_01 1161 1.47 0.72 1.76 179 NUMERIC_HTTP_ADDR 1156 0.42 0.72 0.30 180 XM_RXBody 1154 0.36 0.72 0.22 181 TR_XM_Undi_Recip5 1152 0.21 0.72 0.01 182 HK_RANDOM_REPLYTO 1152 0.33 0.72 0.19 183 XM_Lotto 1131 0.25 0.70 0.07 184 RELAYCOUNTRY_CN 1115 0.22 0.69 0.04 185 TooManyTo_002 1112 1.74 0.69 2.15 186 T_Symld_Words_02 1109 0.64 0.69 0.62 187 LONG_JUNK_URI2 1107 0.20 0.69 0.02 188 XMReplyNow 1098 0.27 0.68 0.11 189 TM2_M_A_HREF_HREF 1048 0.75 0.65 0.78 190 RELAYCOUNTRY_LT 1040 0.22 0.65 0.05 191 XM_PDF 1039 3.69 0.65 4.87 192 HTML_FONT_FACE_BAD 1039 0.54 0.65 0.49 193 HK_SCAM 1039 0.20 0.65 0.03 194 RCVD_IN_IADB_OPTIN 1032 1.96 0.64 2.47 195 XMPhish14 1021 0.38 0.64 0.28 196 XM_B_COPY_HTML 1018 0.57 0.63 0.55 197 ADVANCE_FEE_5_NEW_MONEY 1010 0.18 0.63 0.00 198 TVD_SPACE_RATIO_MINFP 988 0.18 0.62 0.01 199 XM_ShortIntro_01 987 0.54 0.61 0.50 200 FORM_FRAUD_5 965 0.17 0.60 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 362315 89.31 93.85 87.55 2 DKIM_SIGNED 303130 74.29 76.96 73.25 3 XM_DK_Pass 297813 72.84 75.09 71.96 4 DKIM_VALID 282904 69.24 71.50 68.36 5 DCC_CHECK_NEGATIVE 247220 50.08 25.18 59.74 6 BAYES_50 218513 47.82 34.97 52.80 7 DKIM_VALID_AU 200309 51.35 58.94 48.40 8 XMListUnsubscribeExists 199079 53.88 68.77 48.11 9 DCC_CHECK 158675 48.18 73.54 38.34 10 XM_H_QuotedFrom 150084 38.90 45.69 36.27 11 T_TM2_M_HEADER_IN_MSG 131829 28.38 19.43 31.86 12 DKIM_VALID_EF 115757 26.31 22.02 27.97 13 HTML_FONT_LOW_CONTRAST 108613 29.75 38.79 26.25 14 XMSubLong 91110 22.51 23.79 22.02 15 LOC_TINY_FONT_1 89130 24.78 33.14 21.54 16 MIME_HTML_ONLY 85820 23.64 31.12 20.74 17 FVGT_m_MULTI_ODD 81600 21.10 24.66 19.72 18 MultiRelay 74953 16.56 12.55 18.11 19 XM_DK_Undo_02 69795 25.83 48.94 16.87 20 T_KAM_HTML_FONT_INVALID 68301 16.97 18.15 16.50 21 ALL_TRUSTED 66171 12.49 3.47 15.99 22 BAYES_99 64268 23.65 44.57 15.53 23 BAYES_999 57732 20.82 38.52 13.95 24 XM_DKIMWhitelistDomains 57481 10.03 0.10 13.89 25 XM_Body_Dirty_Words 52336 14.47 19.16 12.65 26 XM_Multi_Part_URI 51719 13.23 15.13 12.50 27 BAYES_00 44611 7.99 0.79 10.78 28 RCVD_IN_RP_SAFE 43910 8.94 4.63 10.61 29 TooManyTo_001 43326 9.82 8.13 10.47 30 LOTS_OF_MONEY 41350 10.90 13.24 9.99 31 RCVD_IN_RP_CERTIFIED 38530 7.52 2.90 9.31 32 TR_DCC_Bayes_99 36341 16.55 36.58 8.78 33 XM_Evil_Numbers_Gen 35964 9.83 12.76 8.69 34 LotsOfNums_01 35617 8.06 6.66 8.61 35 T_XMDrugObfuBody_14 34661 8.32 8.16 8.38 36 TR_XM_DK_Bayes 33625 5.97 0.40 8.13 37 HTML_IMAGE_RATIO_02 32853 10.21 16.05 7.94 38 TR_XM_DK_Bayes1 31801 5.63 0.35 7.68 39 RELAYCOUNTRY_META 29139 9.25 14.96 7.04 40 FSL_BULK_SIG 28328 7.62 9.61 6.85 41 TR_XM_DK_Bayes2 27451 4.86 0.28 6.63 42 XM_H_Long_From01 26080 6.74 7.87 6.30 43 XM_B_Phish_Phrases 25751 6.43 6.95 6.22 44 RCVD_IN_IADB_LISTED 24671 4.75 1.64 5.96 45 BAYES_60 24223 5.53 4.70 5.85 46 XM_SendGrid 23669 5.06 3.35 5.72 47 MIME_QP_LONG_LINE 23493 4.85 2.73 5.68 48 HTML_IMAGE_RATIO_04 22132 6.26 8.62 5.35 49 RCVD_IN_IADB_SPF 21646 4.13 1.31 5.23 50 T_TooManySym_01 20923 4.29 2.32 5.06 51 BOTNET_IPINHOSTNAME 20250 6.95 12.26 4.89 52 DKIM_INVALID 20226 5.05 5.46 4.89 53 XM_PDF 20152 3.69 0.65 4.87 54 XMStrtUSub 18983 4.24 3.35 4.59 55 RCVD_IN_IADB_SENDERID 18971 3.63 1.19 4.58 56 RCVD_IN_IADB_DK 18548 3.55 1.15 4.48 57 RCVD_IN_MSPIKE_H2 18154 3.89 2.62 4.39 58 XMSubMetaSx_00 18037 5.34 7.85 4.36 59 XMSexyCombo_05 17955 6.13 10.75 4.34 60 IN_ZIMBRA_NJ_WHITELIST 17320 3.02 0.02 4.19 61 FROM_EXCESS_BASE64 17230 4.70 6.08 4.16 62 RCVD_IN_IADB_VOUCHED 16925 3.23 1.02 4.09 63 T_REMOTE_IMAGE 16566 3.79 3.23 4.00 64 BAYES_80 16144 4.40 5.69 3.90 65 BAYES_40 14846 3.22 2.29 3.59 66 UNTRUSTED_Relay 14495 5.01 8.89 3.50 67 HTML_IMAGE_RATIO_06 14445 3.98 5.25 3.49 68 XM_UncommonTLD01 13769 4.71 8.26 3.33 69 XM_H_Long_From02 12630 2.68 1.71 3.05 70 MPART_ALT_DIFF 12442 4.67 8.97 3.01 71 XM_UB50 12290 3.25 3.97 2.97 72 TO_MALFORMED 12260 2.16 0.10 2.96 73 XMNumbers 11948 2.87 2.82 2.89 74 UNPARSEABLE_RELAY 11640 2.39 1.29 2.81 75 BAYES_20 11230 2.67 2.55 2.71 76 BAYES_95 11133 2.89 3.41 2.69 77 TVD_RCVD_IP 10963 1.98 0.26 2.65 78 HTML_MIME_NO_HTML_TAG 10448 2.36 1.95 2.52 79 RCVD_IN_IADB_OPTIN 10215 1.96 0.64 2.47 80 MIME_HTML_MOSTLY 9860 3.00 4.59 2.38 81 RELAYCOUNTRY_PH 9228 1.61 0.03 2.23 82 MAILING_LIST_MULTI 8957 1.93 1.31 2.16 83 TooManyTo_002 8881 1.74 0.69 2.15 84 SUBJ_ALL_CAPS 8683 2.43 3.30 2.10 85 RCVD_IN_MSPIKE_WL 8628 1.74 0.85 2.08 86 RCVD_IN_MSPIKE_H3 8628 1.74 0.85 2.08 87 XM_SPF_SoftFail 8618 2.68 4.23 2.08 88 XM_DIRTYINTL 8606 2.71 4.34 2.08 89 BOTNET 8341 7.23 20.68 2.02 90 HTML_IMAGE_RATIO_08 8278 2.90 5.23 2.00 91 ANY_BOUNCE_MESSAGE 8225 3.68 8.05 1.99 92 BOUNCE_MESSAGE 8221 3.68 8.05 1.99 93 XM_DK_Undo_01 7802 1.57 0.77 1.89 94 TR_Symld_Words 7801 1.81 1.61 1.89 95 TM2_M_URI_OPT_OUT 7411 2.29 3.57 1.79 96 IN_HORDE_ADDRESS_BOOK 7380 1.30 0.05 1.78 97 TR_MetaPhish_Combo_01 7265 1.47 0.72 1.76 98 XM_CamelCaseFrm001 7185 2.18 3.31 1.74 99 INVALID_MSGID 7158 1.27 0.09 1.73 100 T_TooManySym_02 7062 1.44 0.74 1.71 101 BAYES_05 7042 1.45 0.80 1.70 102 URI_HEX 7023 2.31 3.88 1.70 103 XM_OfRef6 6639 2.10 3.37 1.60 104 T_XMDrugObfuBody_08 6521 1.75 2.21 1.58 105 XMDiploma_00 6493 1.82 2.48 1.57 106 MIME_HTML_ONLY_MULTI 6326 1.99 3.17 1.53 107 TooManyTo_003 5935 1.19 0.58 1.43 108 HELO_NODOT 5855 1.24 0.78 1.41 109 HELO_NO_DOMAIN 5854 1.24 0.78 1.41 110 RELAYCOUNTRY_CA 5818 2.06 3.75 1.41 111 XMStockSpam_06 5704 1.37 1.34 1.38 112 T_XMDrugObfuBody_00 5569 1.29 1.15 1.35 113 XMCapTrack 5544 1.03 0.24 1.34 114 URI_TRY_3LD 5482 1.35 1.43 1.32 115 XMPhish11 5458 1.40 1.62 1.32 116 XM_GoogleGroups 4986 0.97 0.37 1.20 117 NO_DNS_FOR_FROM 4881 1.31 1.66 1.18 118 USER_IN_DEF_DKIM_WL 4853 0.85 0.01 1.17 119 DKIM_ADSP_CUSTOM_MED 4544 0.95 0.58 1.10 120 XM_H_PHPOS 4358 1.03 0.95 1.05 121 TooManyTo_004 4339 0.89 0.48 1.05 122 XMGenDplmaNmb 4193 1.24 1.84 1.01 123 RELAYCOUNTRY_GB 4146 1.04 1.12 1.00 124 XMSubMetaI_00 3961 1.20 1.82 0.96 125 XMSolicitRefs_0 3801 0.75 0.32 0.92 126 T_FILL_THIS_FORM_SHORT 3755 1.08 1.53 0.91 127 TooManyTo_005 3565 0.73 0.41 0.86 128 DIET_1 3476 0.82 0.77 0.84 129 XMSexyCombo_01 3366 1.13 1.93 0.81 130 TM2_M_A_HREF_HREF 3244 0.75 0.65 0.78 131 TM2_M_VERY_LONG_WORD 3159 0.92 1.31 0.76 132 NML_ADSP_CUSTOM_MED 3114 0.69 0.51 0.75 133 SpammyFromTLD_01 3042 0.94 1.47 0.74 134 XMBody_95 3031 0.56 0.11 0.73 135 XMBdyGiftCard01 3012 1.19 2.37 0.73 136 T_XMHurry_00 2834 0.75 0.92 0.68 137 T_OBFU_PDF_ATTACH 2808 0.52 0.12 0.68 138 XM_salutation2 2733 0.79 1.11 0.66 139 FROM_GOV_SPOOF 2722 0.52 0.18 0.66 140 XM_ProductURIs 2615 0.68 0.79 0.63 141 USER_IN_WHITELIST 2580 0.45 0.00 0.62 142 XMNoVowels 2567 0.53 0.29 0.62 143 XMBody_17 2559 1.08 2.26 0.62 144 T_Symld_Words_02 2546 0.64 0.69 0.62 145 XM_H_PHPMailer 2464 0.56 0.47 0.60 146 XMGappySubj_01 2452 0.51 0.31 0.59 147 TR_XM_RelayPhish 2419 0.82 1.43 0.58 148 XMHTMLBadTable_001 2375 0.71 1.07 0.57 149 HTTPS_HTTP_MISMATCH 2294 0.53 0.46 0.55 150 T_TooManySym_03 2277 0.43 0.11 0.55 151 XM_B_COPY_HTML 2267 0.57 0.63 0.55 152 XMBrknScrpt_02 2184 0.61 0.83 0.53 153 T_MANY_PILL_PRICE 2180 0.40 0.07 0.53 154 HTML_TAG_BALANCE_BODY 2173 2.22 6.60 0.53 155 XMSubMetaSxObfu_03 2140 0.73 1.28 0.52 156 URI_NOVOWEL 2109 0.53 0.58 0.51 157 XM_ShortIntro_01 2089 0.54 0.61 0.50 158 DKIM_ADSP_NXDOMAIN 2073 0.68 1.15 0.50 159 XM_D_tchamptons_WL 2063 0.36 0.00 0.50 160 HTML_FONT_FACE_BAD 2042 0.54 0.65 0.49 161 XM_B_REG_HTML 2031 0.60 0.86 0.49 162 XMLngstWrd_00 2017 0.42 0.24 0.49 163 MISSING_HEADERS 2005 0.45 0.37 0.48 164 XM_URI_RBL 2002 1.27 3.29 0.48 165 FORGED_GMAIL_RCVD 1996 0.48 0.48 0.48 166 XMMoneyMeta_00 1961 0.57 0.81 0.47 167 SpammyFromTLD_02 1887 1.49 4.16 0.46 168 XMLngstWrd_01 1850 0.38 0.22 0.45 169 PLING_QUERY 1811 0.41 0.34 0.44 170 FILL_THIS_FORM 1789 0.70 1.38 0.43 171 RDNS_DYNAMIC 1782 0.52 0.77 0.43 172 RELAYCOUNTRY_AU 1761 0.45 0.50 0.43 173 XMBody_78 1744 0.54 0.86 0.42 174 XMSlimDrugH 1744 0.45 0.51 0.42 175 RELAYCOUNTRY_DE 1705 0.64 1.23 0.41 176 XMSubMetaSxObfu_02 1702 0.37 0.27 0.41 177 XMRcvdHeader_15 1680 0.29 0.00 0.41 178 XM_shorewaves_Whitelist 1678 0.29 0.00 0.41 179 HTML_IMAGE_ONLY_32 1654 0.37 0.28 0.40 180 XMPhish30 1612 0.62 1.20 0.39 181 SHORT_HELO_AND_INLINE_IMAGE 1600 0.30 0.09 0.39 182 TM2_M_BODY_EMPTY 1568 0.30 0.10 0.38 183 THIS_AD 1543 0.41 0.52 0.37 184 XMSubNoVowel 1484 1.07 2.91 0.36 185 XMOemUri 1463 0.29 0.13 0.35 186 XMHTML_After_End 1444 0.51 0.92 0.35 187 HTML_IMAGE_ONLY_28 1428 0.40 0.54 0.35 188 XMDateMe_00 1402 0.39 0.51 0.34 189 HTML_IMAGE_ONLY_24 1397 0.99 2.68 0.34 190 T_HTML_ATTACH 1394 1.91 5.95 0.34 191 TR_Caps_n_Bayes_99 1383 0.68 1.56 0.33 192 FROM_GOV_DKIM_AU 1378 0.28 0.14 0.33 193 RCVD_IN_SORBS_DUL 1374 0.29 0.17 0.33 194 XM_USANA_RCVD 1357 0.24 0.00 0.33 195 AC_DIV_BONANZA 1350 0.25 0.07 0.33 196 FILL_THIS_FORM_LONG 1347 0.52 1.03 0.33 197 SUBJ_DOLLARS 1344 0.58 1.23 0.32 198 REMOVE_BEFORE_LINK 1311 0.39 0.57 0.32 199 BASE64_LENGTH_79_INF 1301 0.99 2.72 0.31 200 FILL_THIS_FORM_LOAN 1295 0.51 1.01 0.31 ----------------------------------------------------------------------