Email: 594317 Autolearn: 0 AvgScore: 2.29 AvgScanTime: 2.01 sec Spam: 144574 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 2.39 sec Ham: 449743 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 1.89 sec Time Spent Running SA: 331.90 hours Time Spent Processing Spam: 95.88 hours Time Spent Processing Ham: 236.02 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135698 88.90 93.86 87.30 2 DKIM_SIGNED 113741 74.69 78.67 73.41 3 XM_DK_Pass 110335 73.06 76.32 72.02 4 DCC_CHECK 110051 46.53 76.12 37.02 5 XMListUnsubscribeExists 108218 53.96 74.85 47.24 6 DKIM_VALID 105071 69.34 72.68 68.27 7 DKIM_VALID_AU 83962 52.19 58.08 50.30 8 XM_H_QuotedFrom 68153 38.29 47.14 35.44 9 XM_DK_Undo_02 64276 21.22 44.46 13.74 10 BAYES_99 56854 18.74 39.33 12.13 11 HTML_FONT_LOW_CONTRAST 53847 29.17 37.25 26.57 12 BAYES_50 51415 47.74 35.56 51.65 13 LOC_TINY_FONT_1 48544 23.74 33.58 20.57 14 BAYES_999 47586 16.20 32.91 10.82 15 TR_DCC_Bayes_99 44226 11.78 30.59 5.73 16 MIME_HTML_ONLY 44143 22.73 30.53 20.22 17 FVGT_m_MULTI_ODD 41273 22.78 28.55 20.93 18 XMSubLong 38929 23.04 26.93 21.79 19 DCC_CHECK_NEGATIVE 31671 51.30 21.91 60.74 20 DKIM_VALID_EF 31521 26.15 21.80 27.55 21 T_KAM_HTML_FONT_INVALID 30942 17.39 21.40 16.10 22 XM_Body_Dirty_Words 30564 14.67 21.14 12.59 23 RELAYCOUNTRY_META 29595 9.03 20.47 5.35 24 T_TM2_M_HEADER_IN_MSG 29202 29.53 20.20 32.53 25 BOTNET_IPINHOSTNAME 27258 8.32 18.85 4.93 26 MultiRelay 24448 19.31 16.91 20.08 27 BOTNET 24257 5.43 16.78 1.79 28 XM_Multi_Part_URI 22492 12.26 15.56 11.19 29 HTML_IMAGE_RATIO_02 19271 9.00 13.33 7.61 30 XM_Evil_Numbers_Gen 18478 9.67 12.78 8.67 31 LOTS_OF_MONEY 17989 9.80 12.44 8.95 32 XM_UncommonTLD01 16132 5.46 11.16 3.62 33 UNTRUSTED_Relay 15870 3.94 10.98 1.67 34 XMSexyCombo_05 15110 5.45 10.45 3.84 35 FSL_BULK_SIG 13660 7.76 9.45 7.22 36 XM_B_Phish_Phrases 13399 6.52 9.27 5.64 37 TooManyTo_001 12023 8.83 8.32 9.00 38 BAYES_80 11534 5.02 7.98 4.07 39 HTML_IMAGE_RATIO_04 10774 5.44 7.45 4.80 40 T_XMDrugObfuBody_14 10746 7.82 7.43 7.94 41 LotsOfNums_01 10577 8.06 7.32 8.30 42 XM_H_Long_From01 10345 6.34 7.16 6.08 43 XMSubMetaSx_00 9813 4.93 6.79 4.33 44 BAYES_60 9291 6.34 6.43 6.31 45 MPART_ALT_DIFF 9253 3.66 6.40 2.77 46 DKIM_INVALID 8670 5.35 6.00 5.15 47 XM_SPF_SoftFail 8545 3.63 5.91 2.90 48 XM_DIRTYINTL 8019 3.51 5.55 2.86 49 FROM_SUSPICIOUS_NTLD 7680 1.41 5.31 0.16 50 XM_UB50 7436 1.82 5.14 0.75 51 MIME_QP_LONG_LINE 7380 5.67 5.10 5.85 52 FROM_EXCESS_BASE64 6958 4.34 4.81 4.19 53 BAYES_95 6696 3.04 4.63 2.53 54 XMStrtUSub 6559 4.27 4.54 4.18 55 MIME_HTML_MOSTLY 6349 2.83 4.39 2.33 56 HTML_MIME_NO_HTML_TAG 6132 3.29 4.24 2.98 57 RELAYCOUNTRY_CA 5769 1.96 3.99 1.31 58 RCVD_IN_RP_SAFE 5679 8.59 3.93 10.09 59 DKIM_ADSP_NXDOMAIN 5605 1.31 3.88 0.48 60 HTML_IMAGE_RATIO_06 5509 3.73 3.81 3.71 61 XM_URI_RBL 5501 1.26 3.80 0.44 62 XM_OfRef6 5368 1.92 3.71 1.34 63 ALL_TRUSTED 5268 13.67 3.64 16.89 64 URI_HEX 5189 2.03 3.59 1.53 65 XMNumbers 5125 2.88 3.54 2.67 66 XM_CamelCaseFrm001 5110 2.17 3.53 1.74 67 TM2_M_URI_OPT_OUT 4980 2.18 3.44 1.77 68 RELAYCOUNTRY_FR 4863 1.00 3.36 0.23 69 SpammyFromTLD_02 4795 1.00 3.32 0.26 70 XM_SendGrid 4665 5.83 3.23 6.67 71 MIME_HTML_ONLY_MULTI 4618 1.76 3.19 1.30 72 TR_XM_RelayPhish 4486 1.50 3.10 0.98 73 T_REMOTE_IMAGE 4443 4.50 3.07 4.95 74 RCVD_IN_RP_CERTIFIED 4443 7.70 3.07 9.19 75 SUBJ_ALL_CAPS 4194 2.24 2.90 2.03 76 RCVD_IN_BL_SPAMCOP_NET 4181 1.19 2.89 0.65 77 XMSubMetaI_00 4156 1.22 2.87 0.69 78 TR_XM_PHPForged 3965 1.37 2.74 0.93 79 TR_XM_PHPDW 3959 1.38 2.74 0.95 80 TR_XM_FormFill2 3915 1.36 2.71 0.92 81 RCVD_IN_RP_RNBL 3911 0.68 2.71 0.02 82 HTML_IMAGE_RATIO_08 3893 2.23 2.69 2.08 83 XM_H_PHPOS 3892 1.35 2.69 0.92 84 T_TooManySym_01 3828 5.23 2.65 6.06 85 XMSexyCombo_01 3699 1.47 2.56 1.12 86 XMBdyGiftCard01 3572 1.25 2.47 0.86 87 BAYES_40 3514 3.77 2.43 4.20 88 XMDiploma_00 3397 2.06 2.35 1.97 89 RCVD_IN_MSPIKE_H2 3377 4.04 2.34 4.59 90 T_XMDrugObfuBody_08 3291 1.59 2.28 1.37 91 RELAYCOUNTRY_DE 3150 0.77 2.18 0.32 92 MultiRelay_Combo 3144 0.67 2.17 0.18 93 MultiRelay_CC 3144 0.67 2.17 0.18 94 T_XMHurry_00 3027 1.14 2.09 0.84 95 XMMoneyMeta_00 2970 0.90 2.05 0.53 96 HTML_TAG_BALANCE_BODY 2967 0.94 2.05 0.58 97 NUMERIC_HTTP_ADDR 2840 0.73 1.96 0.34 98 TR_Symld_Words 2824 1.76 1.95 1.69 99 T_FILL_THIS_FORM_SHORT 2815 1.16 1.95 0.91 100 XMBody_78 2797 0.74 1.93 0.36 101 BAYES_20 2753 2.88 1.90 3.19 102 PDS_TO_EQ_FROM_NAME 2631 0.46 1.82 0.02 103 REMOVE_BEFORE_LINK 2620 0.68 1.81 0.32 104 TR_Mismatch_TLD_02 2610 0.52 1.81 0.11 105 NO_DNS_FOR_FROM 2609 1.25 1.80 1.07 106 URIBL_DBL_ABUSE_REDIR 2601 0.45 1.80 0.02 107 T_HTML_TAG_BALANCE_CENTER 2592 0.51 1.79 0.10 108 UNPARSEABLE_RELAY 2550 2.68 1.76 2.97 109 MAILING_LIST_MULTI 2518 2.14 1.74 2.26 110 SpammyFromTLD_01 2490 1.09 1.72 0.88 111 XMBody_17 2482 0.88 1.72 0.62 112 XMPhish11 2432 1.34 1.68 1.24 113 DIET_1 2422 0.72 1.68 0.41 114 TM2_M_VERY_LONG_WORD 2381 1.51 1.65 1.46 115 RCVD_IN_IADB_LISTED 2378 4.20 1.64 5.03 116 NORMAL_HTTP_TO_IP 2323 0.46 1.61 0.08 117 XM_ProductURIs 2287 1.00 1.58 0.82 118 DATE_IN_PAST_03_06 2283 0.49 1.58 0.14 119 RELAYCOUNTRY_GB 2278 1.23 1.58 1.12 120 XMGenDplmaNmb 2255 1.36 1.56 1.29 121 XM_UB99 2237 0.38 1.55 0.01 122 TR_XM_DK_SendGrid 2167 3.00 1.50 3.48 123 XMPhish30 2063 0.75 1.43 0.54 124 RCVD_IN_IADB_SPF 2014 3.68 1.39 4.42 125 T_XMDrugObfuBody_00 2006 0.92 1.39 0.77 126 MONEY_FORM_SHORT 2000 0.37 1.38 0.04 127 XMStockSpam_06 1998 1.51 1.38 1.55 128 URIBL_BLACK 1981 0.37 1.37 0.05 129 XMBrknScrpt_02 1950 0.80 1.35 0.62 130 TR_LOTS_OF_MONEY2 1947 0.67 1.35 0.45 131 T_MONEY_PERCENT 1947 0.67 1.35 0.45 132 XM_H_Long_From02 1930 1.26 1.33 1.24 133 XM_B_REG_HTML 1928 0.62 1.33 0.39 134 XM_UB60 1919 0.38 1.33 0.07 135 XM_HighProb1 1891 0.36 1.31 0.06 136 RCVD_IN_IADB_SENDERID 1860 3.25 1.29 3.88 137 RCVD_IN_IADB_DK 1842 3.21 1.27 3.84 138 BOTNET_NORDNS 1840 0.34 1.27 0.04 139 TR_LOTS_OF_MONEY3 1820 0.80 1.26 0.65 140 RELAYCOUNTRY_IN 1808 0.39 1.25 0.12 141 XM_H_PHPMailer 1801 0.73 1.25 0.57 142 XMHTML_After_End 1755 0.57 1.21 0.37 143 DKIM_ADSP_CUSTOM_MED 1721 1.07 1.19 1.03 144 RELAYCOUNTRY_AU 1711 0.69 1.18 0.52 145 XM_UB999 1705 0.29 1.18 0.01 146 XM_OfRef7 1596 0.39 1.10 0.16 147 RELAYCOUNTRY_AT 1595 0.42 1.10 0.20 148 NML_ADSP_CUSTOM_MED 1590 0.82 1.10 0.73 149 XM_H_TOP 1561 0.26 1.08 0.00 150 RCVD_IN_IADB_VOUCHED 1557 2.66 1.08 3.16 151 XM_PDF 1547 4.25 1.07 5.28 152 URIBL_DBL_SPAM 1532 0.27 1.06 0.01 153 FORGED_GMAIL_RCVD 1520 0.61 1.05 0.46 154 XMPhish14 1503 0.58 1.04 0.43 155 HTML_FONT_FACE_BAD 1496 0.63 1.03 0.50 156 THIS_AD 1488 0.45 1.03 0.26 157 MISSING_HEADERS 1474 1.01 1.02 1.00 158 URI_TRY_3LD 1471 1.18 1.02 1.23 159 FILL_THIS_FORM 1471 0.91 1.02 0.87 160 LongTLD 1459 0.38 1.01 0.18 161 XM_BadFromFormat 1439 0.83 1.00 0.77 162 XMSexyCombo_04 1421 0.76 0.98 0.69 163 HTML_IMAGE_ONLY_32 1403 0.57 0.97 0.44 164 RELAYCOUNTRY_NL 1376 0.39 0.95 0.22 165 XM_H_PHPOS_M 1376 0.41 0.95 0.23 166 ANY_BOUNCE_MESSAGE 1372 1.80 0.95 2.07 167 BOUNCE_MESSAGE 1372 1.80 0.95 2.07 168 BAYES_05 1344 1.84 0.93 2.13 169 XMHTMLBadTable_001 1337 0.58 0.92 0.48 170 TR_MetaPhish_Combo_01 1277 1.47 0.88 1.66 171 FILL_THIS_FORM_LONG 1261 0.52 0.87 0.41 172 XM_RXBody 1247 0.45 0.86 0.31 173 HELO_NODOT 1244 2.07 0.86 2.46 174 HELO_NO_DOMAIN 1242 2.07 0.86 2.46 175 XM_B_COPY_HTML 1200 0.58 0.83 0.50 176 TO_NO_BRKTS_HTML_ONLY 1198 0.40 0.83 0.26 177 XMSubMetaSxObfu_03 1192 0.54 0.82 0.45 178 RDNS_DYNAMIC 1173 0.48 0.81 0.37 179 TR_Mismatch_TLD_01 1161 0.31 0.80 0.15 180 TO_MALFORMED 1136 3.17 0.79 3.93 181 REPLYTO_WITHOUT_TO_CC 1136 0.56 0.79 0.49 182 XM_DK_Undo_01 1134 1.50 0.78 1.73 183 RCVD_IN_IADB_OPTIN 1111 1.73 0.77 2.03 184 XM_UB80 1090 0.20 0.75 0.03 185 TooManyTo_002 1089 2.21 0.75 2.68 186 SUBJ_DOLLARS 1088 0.39 0.75 0.27 187 XMSubMetaSSx_00 1086 0.34 0.75 0.21 188 URI_NOVOWEL 1083 0.49 0.75 0.41 189 HTTPS_HTTP_MISMATCH 1082 0.59 0.75 0.54 190 FORM_FRAUD_5 1079 0.18 0.75 0.00 191 XMSlimDrugH 1073 0.42 0.74 0.31 192 MONEY_FRAUD_5 1069 0.18 0.74 0.00 193 HK_RANDOM_REPLYTO 1064 0.32 0.74 0.19 194 TR_M_TOP_BAYES 1010 0.17 0.70 0.00 195 XMSolicitRefs_0 1008 0.44 0.70 0.35 196 DATE_IN_PAST_06_12 992 0.21 0.69 0.06 197 LONG_JUNK_URI 979 0.21 0.68 0.06 198 FILL_THIS_FORM_LOAN 976 0.42 0.68 0.33 199 FSL_THIS_IS_ADV 959 0.43 0.66 0.35 200 XMLngstWrd_00 956 0.68 0.66 0.69 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 392621 88.90 93.86 87.30 2 DKIM_SIGNED 330170 74.69 78.67 73.41 3 XM_DK_Pass 323889 73.06 76.32 72.02 4 DKIM_VALID 307029 69.34 72.68 68.27 5 DCC_CHECK_NEGATIVE 273186 51.30 21.91 60.74 6 BAYES_50 232302 47.74 35.56 51.65 7 DKIM_VALID_AU 226207 52.19 58.08 50.30 8 XMListUnsubscribeExists 212470 53.96 74.85 47.24 9 DCC_CHECK 166478 46.53 76.12 37.02 10 XM_H_QuotedFrom 159392 38.29 47.14 35.44 11 T_TM2_M_HEADER_IN_MSG 146315 29.53 20.20 32.53 12 DKIM_VALID_EF 123917 26.15 21.80 27.55 13 HTML_FONT_LOW_CONTRAST 119517 29.17 37.25 26.57 14 XMSubLong 98020 23.04 26.93 21.79 15 FVGT_m_MULTI_ODD 94123 22.78 28.55 20.93 16 LOC_TINY_FONT_1 92520 23.74 33.58 20.57 17 MIME_HTML_ONLY 90949 22.73 30.53 20.22 18 MultiRelay 90297 19.31 16.91 20.08 19 ALL_TRUSTED 75948 13.67 3.64 16.89 20 T_KAM_HTML_FONT_INVALID 72387 17.39 21.40 16.10 21 XM_DK_Undo_02 61813 21.22 44.46 13.74 22 BAYES_00 60776 10.38 0.65 13.51 23 XM_Body_Dirty_Words 56608 14.67 21.14 12.59 24 BAYES_99 54545 18.74 39.33 12.13 25 XM_DKIMWhitelistDomains 51629 8.71 0.09 11.48 26 XM_Multi_Part_URI 50347 12.26 15.56 11.19 27 BAYES_999 48677 16.20 32.91 10.82 28 TR_XM_DK_Bayes 45789 7.81 0.43 10.18 29 RCVD_IN_RP_SAFE 45400 8.59 3.93 10.09 30 TR_XM_DK_Bayes1 43497 7.40 0.34 9.67 31 RCVD_IN_RP_CERTIFIED 41347 7.70 3.07 9.19 32 TooManyTo_001 40458 8.83 8.32 9.00 33 LOTS_OF_MONEY 40254 9.80 12.44 8.95 34 XM_Evil_Numbers_Gen 38988 9.67 12.78 8.67 35 LotsOfNums_01 37315 8.06 7.32 8.30 36 TR_XM_DK_Bayes2 36701 6.25 0.31 8.16 37 T_XMDrugObfuBody_14 35716 7.82 7.43 7.94 38 HTML_IMAGE_RATIO_02 34237 9.00 13.33 7.61 39 FSL_BULK_SIG 32484 7.76 9.45 7.22 40 XM_SendGrid 29977 5.83 3.23 6.67 41 BAYES_60 28372 6.34 6.43 6.31 42 XM_H_Long_From01 27336 6.34 7.16 6.08 43 T_TooManySym_01 27270 5.23 2.65 6.06 44 MIME_QP_LONG_LINE 26327 5.67 5.10 5.85 45 TR_DCC_Bayes_99 25773 11.78 30.59 5.73 46 XM_B_Phish_Phrases 25358 6.52 9.27 5.64 47 RELAYCOUNTRY_META 24080 9.03 20.47 5.35 48 XM_PDF 23736 4.25 1.07 5.28 49 DKIM_INVALID 23141 5.35 6.00 5.15 50 RCVD_IN_IADB_LISTED 22605 4.20 1.64 5.03 51 T_REMOTE_IMAGE 22283 4.50 3.07 4.95 52 BOTNET_IPINHOSTNAME 22192 8.32 18.85 4.93 53 HTML_IMAGE_RATIO_04 21566 5.44 7.45 4.80 54 RCVD_IN_MSPIKE_H2 20658 4.04 2.34 4.59 55 RCVD_IN_IADB_SPF 19884 3.68 1.39 4.42 56 XMSubMetaSx_00 19496 4.93 6.79 4.33 57 BAYES_40 18872 3.77 2.43 4.20 58 FROM_EXCESS_BASE64 18832 4.34 4.81 4.19 59 XMStrtUSub 18793 4.27 4.54 4.18 60 IN_ZIMBRA_NJ_WHITELIST 18390 3.10 0.03 4.09 61 BAYES_80 18313 5.02 7.98 4.07 62 TO_MALFORMED 17679 3.17 0.79 3.93 63 RCVD_IN_IADB_SENDERID 17466 3.25 1.29 3.88 64 XMSexyCombo_05 17279 5.45 10.45 3.84 65 RCVD_IN_IADB_DK 17260 3.21 1.27 3.84 66 HTML_IMAGE_RATIO_06 16679 3.73 3.81 3.71 67 XM_UncommonTLD01 16289 5.46 11.16 3.62 68 TR_XM_DK_SendGrid 15651 3.00 1.50 3.48 69 BAYES_20 14335 2.88 1.90 3.19 70 RCVD_IN_IADB_VOUCHED 14225 2.66 1.08 3.16 71 HTML_MIME_NO_HTML_TAG 13418 3.29 4.24 2.98 72 UNPARSEABLE_RELAY 13355 2.68 1.76 2.97 73 XM_SPF_SoftFail 13045 3.63 5.91 2.90 74 XM_DIRTYINTL 12845 3.51 5.55 2.86 75 TVD_RCVD_IP 12777 2.25 0.42 2.84 76 MPART_ALT_DIFF 12471 3.66 6.40 2.77 77 TooManyTo_002 12052 2.21 0.75 2.68 78 XMNumbers 11988 2.88 3.54 2.67 79 BAYES_95 11390 3.04 4.63 2.53 80 HELO_NODOT 11056 2.07 0.86 2.46 81 HELO_NO_DOMAIN 11054 2.07 0.86 2.46 82 MIME_HTML_MOSTLY 10480 2.83 4.39 2.33 83 MAILING_LIST_MULTI 10176 2.14 1.74 2.26 84 RCVD_IN_MSPIKE_WL 9851 1.77 0.48 2.19 85 RCVD_IN_MSPIKE_H3 9839 1.77 0.48 2.19 86 BAYES_05 9562 1.84 0.93 2.13 87 HTML_IMAGE_RATIO_08 9367 2.23 2.69 2.08 88 ANY_BOUNCE_MESSAGE 9331 1.80 0.95 2.07 89 BOUNCE_MESSAGE 9329 1.80 0.95 2.07 90 RCVD_IN_IADB_OPTIN 9144 1.73 0.77 2.03 91 SUBJ_ALL_CAPS 9122 2.24 2.90 2.03 92 XMDiploma_00 8850 2.06 2.35 1.97 93 TooManyTo_003 8360 1.54 0.56 1.86 94 BOTNET 8032 5.43 16.78 1.79 95 TM2_M_URI_OPT_OUT 7962 2.18 3.44 1.77 96 IN_HORDE_ADDRESS_BOOK 7953 1.35 0.04 1.77 97 T_TooManySym_02 7923 1.49 0.63 1.76 98 XM_CamelCaseFrm001 7810 2.17 3.53 1.74 99 XM_DK_Undo_01 7791 1.50 0.78 1.73 100 TR_Symld_Words 7623 1.76 1.95 1.69 101 UNTRUSTED_Relay 7522 3.94 10.98 1.67 102 TR_MetaPhish_Combo_01 7465 1.47 0.88 1.66 103 INVALID_MSGID 7303 1.26 0.12 1.62 104 XMCapTrack 7183 1.28 0.30 1.60 105 XMStockSpam_06 6952 1.51 1.38 1.55 106 URI_HEX 6891 2.03 3.59 1.53 107 TM2_M_VERY_LONG_WORD 6579 1.51 1.65 1.46 108 TooManyTo_004 6226 1.15 0.44 1.38 109 T_XMDrugObfuBody_08 6172 1.59 2.28 1.37 110 XM_OfRef6 6038 1.92 3.71 1.34 111 RELAYCOUNTRY_CA 5872 1.96 3.99 1.31 112 MIME_HTML_ONLY_MULTI 5866 1.76 3.19 1.30 113 USER_IN_DEF_DKIM_WL 5812 0.98 0.03 1.29 114 XMGenDplmaNmb 5809 1.36 1.56 1.29 115 XM_H_Long_From02 5559 1.26 1.33 1.24 116 XMPhish11 5556 1.34 1.68 1.24 117 URI_TRY_3LD 5549 1.18 1.02 1.23 118 XM_GoogleGroups 5267 0.99 0.43 1.17 119 TooManyTo_005 5241 0.97 0.35 1.17 120 RELAYCOUNTRY_GB 5055 1.23 1.58 1.12 121 XMSexyCombo_01 5036 1.47 2.56 1.12 122 NO_DNS_FOR_FROM 4808 1.25 1.80 1.07 123 DKIM_ADSP_CUSTOM_MED 4644 1.07 1.19 1.03 124 MISSING_HEADERS 4503 1.01 1.02 1.00 125 TR_XM_RelayPhish 4424 1.50 3.10 0.98 126 TR_XM_PHPDW 4268 1.38 2.74 0.95 127 TR_XM_PHPForged 4179 1.37 2.74 0.93 128 TR_XM_FormFill2 4150 1.36 2.71 0.92 129 HK_SCAM 4150 0.86 0.65 0.92 130 XM_H_PHPOS 4142 1.35 2.69 0.92 131 T_FILL_THIS_FORM_SHORT 4108 1.16 1.95 0.91 132 XM_ShortIntro_01 4086 0.81 0.50 0.91 133 SpammyFromTLD_01 3975 1.09 1.72 0.88 134 FILL_THIS_FORM 3917 0.91 1.02 0.87 135 XMBdyGiftCard01 3876 1.25 2.47 0.86 136 T_XMHurry_00 3762 1.14 2.09 0.84 137 XM_ProductURIs 3682 1.00 1.58 0.82 138 XM_BadFromFormat 3469 0.83 1.00 0.77 139 T_XMDrugObfuBody_00 3463 0.92 1.39 0.77 140 XM_UB50 3384 1.82 5.14 0.75 141 XMSubNoVowel 3322 0.65 0.38 0.74 142 NML_ADSP_CUSTOM_MED 3274 0.82 1.10 0.73 143 HTML_IMAGE_ONLY_16 3184 0.67 0.54 0.71 144 XMBody_95 3129 0.55 0.09 0.70 145 XMSubMetaI_00 3115 1.22 2.87 0.69 146 XMSexyCombo_04 3100 0.76 0.98 0.69 147 XMLngstWrd_00 3095 0.68 0.66 0.69 148 XMLngstWrd_01 2937 0.64 0.59 0.65 149 TR_LOTS_OF_MONEY3 2932 0.80 1.26 0.65 150 RCVD_IN_BL_SPAMCOP_NET 2917 1.19 2.89 0.65 151 XMBrknScrpt_02 2802 0.80 1.35 0.62 152 T_OBFU_PDF_ATTACH 2791 0.53 0.25 0.62 153 XMBody_17 2766 0.88 1.72 0.62 154 USER_IN_WHITELIST 2766 0.47 0.00 0.62 155 HTML_IMAGE_ONLY_20 2741 0.62 0.65 0.61 156 AC_DIV_BONANZA 2740 0.49 0.13 0.61 157 T_Symld_Words_02 2727 0.62 0.66 0.61 158 TM2_M_A_HREF_HREF 2683 0.58 0.54 0.60 159 HTML_TAG_BALANCE_BODY 2620 0.94 2.05 0.58 160 SHORT_HELO_AND_INLINE_IMAGE 2586 0.45 0.06 0.57 161 XM_H_PHPMailer 2543 0.73 1.25 0.57 162 HTTPS_HTTP_MISMATCH 2447 0.59 0.75 0.54 163 XMPhish30 2413 0.75 1.43 0.54 164 XMMoneyMeta_00 2374 0.90 2.05 0.53 165 RELAYCOUNTRY_AU 2361 0.69 1.18 0.52 166 XMGappySubj_01 2355 0.46 0.28 0.52 167 T_TooManySym_03 2320 0.43 0.16 0.52 168 XM_B_COPY_HTML 2266 0.58 0.83 0.50 169 HTML_FONT_FACE_BAD 2246 0.63 1.03 0.50 170 XMNoVowels 2209 0.48 0.44 0.49 171 XMSubMetaSxObfu_02 2193 0.45 0.32 0.49 172 FROM_GOV_SPOOF 2192 0.40 0.13 0.49 173 REPLYTO_WITHOUT_TO_CC 2189 0.56 0.79 0.49 174 T_MANY_PILL_PRICE 2187 0.38 0.06 0.49 175 RCVD_IN_SORBS_DUL 2169 0.45 0.33 0.48 176 DKIM_ADSP_NXDOMAIN 2163 1.31 3.88 0.48 177 XMHTMLBadTable_001 2139 0.58 0.92 0.48 178 FORGED_GMAIL_RCVD 2091 0.61 1.05 0.46 179 TM2_M_BODY_EMPTY 2072 0.41 0.24 0.46 180 HTML_SHORT_LINK_IMG_2 2041 0.43 0.37 0.45 181 XMSubMetaSxObfu_03 2029 0.54 0.82 0.45 182 XMUrgent 2024 0.36 0.07 0.45 183 XM_USANA_RCVD 2015 0.34 0.00 0.45 184 T_MONEY_PERCENT 2007 0.67 1.35 0.45 185 TR_LOTS_OF_MONEY2 2007 0.67 1.35 0.45 186 XM_URI_RBL 1998 1.26 3.80 0.44 187 HTML_IMAGE_ONLY_32 1971 0.57 0.97 0.44 188 XMPhish14 1919 0.58 1.04 0.43 189 PLING_QUERY 1887 0.47 0.63 0.42 190 XM_H_Undi_Recip 1862 0.41 0.42 0.41 191 DIET_1 1860 0.72 1.68 0.41 192 URI_NOVOWEL 1858 0.49 0.75 0.41 193 XMDateMe_00 1844 0.42 0.46 0.41 194 FILL_THIS_FORM_LONG 1831 0.52 0.87 0.41 195 HTML_IMAGE_ONLY_28 1829 0.46 0.62 0.41 196 RELAYCOUNTRY_JP 1824 0.46 0.62 0.41 197 FROM_GOV_DKIM_AU 1781 0.33 0.11 0.40 198 XM_B_REG_HTML 1773 0.62 1.33 0.39 199 HTML_IMAGE_ONLY_24 1757 0.37 0.32 0.39 200 XM_S_JOY_D 1693 0.44 0.62 0.38 ----------------------------------------------------------------------