Email: 632395 Autolearn: 0 AvgScore: 2.83 AvgScanTime: 2.09 sec Spam: 167412 Autolearn: 0 AvgScore: 12.36 AvgScanTime: 2.49 sec Ham: 464983 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.94 sec Time Spent Running SA: 366.71 hours Time Spent Processing Spam: 115.71 hours Time Spent Processing Ham: 251.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160367 89.90 95.79 87.78 2 DKIM_SIGNED 139180 75.80 83.14 73.17 3 DCC_CHECK 135452 49.06 80.91 37.59 4 XM_DK_Pass 132680 73.74 79.25 71.76 5 XMListUnsubscribeExists 127639 56.17 76.24 48.95 6 DKIM_VALID 126268 70.11 75.42 68.19 7 DKIM_VALID_AU 97600 51.84 58.30 49.52 8 XM_DK_Undo_02 81817 22.67 48.87 13.24 9 BAYES_99 75667 20.55 45.20 11.68 10 XM_H_QuotedFrom 68587 32.79 40.97 29.85 11 HTML_FONT_LOW_CONTRAST 64165 29.65 38.33 26.53 12 BAYES_999 63648 17.63 38.02 10.30 13 TR_DCC_Bayes_99 61119 13.87 36.51 5.72 14 LOC_TINY_FONT_1 56616 24.04 33.82 20.52 15 BAYES_50 53367 47.77 31.88 53.49 16 MIME_HTML_ONLY 51941 23.25 31.03 20.45 17 FVGT_m_MULTI_ODD 44497 22.22 26.58 20.66 18 XMSubLong 41682 22.49 24.90 21.62 19 DKIM_VALID_EF 37975 25.46 22.68 26.46 20 XM_Body_Dirty_Words 36476 14.25 21.79 11.54 21 T_KAM_HTML_FONT_INVALID 36198 17.82 21.62 16.45 22 T_TM2_M_HEADER_IN_MSG 33215 27.99 19.84 30.92 23 DCC_CHECK_NEGATIVE 28691 48.96 17.14 60.42 24 BOTNET 27610 5.66 16.49 1.76 25 RELAYCOUNTRY_META 27465 8.35 16.41 5.44 26 MultiRelay 27348 18.47 16.34 19.24 27 XM_Multi_Part_URI 26823 12.58 16.02 11.34 28 BOTNET_IPINHOSTNAME 25320 7.48 15.12 4.73 29 XM_Evil_Numbers_Gen 22086 9.59 13.19 8.30 30 LOTS_OF_MONEY 21116 9.72 12.61 8.68 31 HTML_IMAGE_RATIO_02 20656 8.74 12.34 7.44 32 FSL_BULK_SIG 20035 8.03 11.97 6.62 33 XMSexyCombo_05 18995 5.00 11.35 2.71 34 XM_UncommonTLD01 18708 5.40 11.17 3.32 35 T_XMDrugObfuBody_14 15141 8.23 9.04 7.93 36 XMSubMetaSx_00 14975 4.76 8.94 3.26 37 LotsOfNums_01 14850 8.16 8.87 7.91 38 UNTRUSTED_Relay 14273 3.35 8.53 1.48 39 XM_H_Long_From01 13559 6.60 8.10 6.06 40 HTML_IMAGE_RATIO_04 13269 5.85 7.93 5.10 41 TooManyTo_001 12926 8.38 7.72 8.62 42 DKIM_INVALID 12912 5.70 7.71 4.97 43 BAYES_80 12703 4.71 7.59 3.68 44 MPART_ALT_DIFF 12468 4.29 7.45 3.15 45 XM_B_Phish_Phrases 11679 5.74 6.98 5.30 46 BAYES_60 10760 6.05 6.43 5.91 47 MIME_QP_LONG_LINE 9695 5.80 5.79 5.80 48 FROM_EXCESS_BASE64 9256 4.40 5.53 3.99 49 MIME_HTML_MOSTLY 9136 3.20 5.46 2.39 50 HTML_IMAGE_RATIO_06 8955 3.80 5.35 3.24 51 XM_DIRTYINTL 8129 2.95 4.86 2.26 52 XM_B_SpammyTLD 7859 3.63 4.69 3.25 53 T_REMOTE_IMAGE 7770 4.69 4.64 4.70 54 XMStrtUSub 7424 4.44 4.43 4.45 55 XM_CamelCaseFrm001 7224 2.51 4.32 1.86 56 BAYES_95 7111 2.98 4.25 2.52 57 FROM_SUSPICIOUS_NTLD 7105 1.18 4.24 0.07 58 XM_SendGrid 6804 5.73 4.06 6.32 59 XMNumbers 6460 3.16 3.86 2.91 60 RCVD_IN_RP_SAFE 6427 8.59 3.84 10.30 61 XMDiploma_00 6205 2.51 3.71 2.08 62 RCVD_IN_BL_SPAMCOP_NET 6071 1.36 3.63 0.55 63 RELAYCOUNTRY_CA 5949 1.99 3.55 1.42 64 XM_SPF_SoftFail 5946 2.36 3.55 1.93 65 XM_UB50 5894 1.64 3.52 0.96 66 URI_HEX 5786 2.18 3.46 1.72 67 SpammyFromTLD_02 5756 1.16 3.44 0.34 68 XM_URI_RBL 5714 1.17 3.41 0.37 69 T_TooManySym_01 5694 5.06 3.40 5.65 70 TM2_M_URI_OPT_OUT 5672 2.13 3.39 1.68 71 HTML_IMAGE_RATIO_08 5629 2.70 3.36 2.46 72 MIME_HTML_ONLY_MULTI 5552 1.91 3.32 1.41 73 RCVD_IN_RP_CERTIFIED 5503 7.63 3.29 9.20 74 RCVD_IN_IADB_LISTED 5178 5.22 3.09 5.99 75 NO_DNS_FOR_FROM 5015 1.59 3.00 1.08 76 XMSexyCombo_01 4775 1.12 2.85 0.49 77 BOTNET_NORDNS 4765 0.77 2.85 0.02 78 HTML_MIME_NO_HTML_TAG 4672 3.40 2.79 3.61 79 RCVD_IN_IADB_SPF 4572 4.56 2.73 5.22 80 XM_OfRef6 4536 1.82 2.71 1.50 81 RCVD_IN_MSPIKE_H2 4514 4.00 2.70 4.46 82 RCVD_IN_IADB_SENDERID 4424 4.06 2.64 4.58 83 RCVD_IN_IADB_DK 4397 3.98 2.63 4.47 84 NUMERIC_HTTP_ADDR 4228 0.94 2.53 0.37 85 TR_XM_PHPDW 4213 1.72 2.52 1.43 86 TR_XM_PHPForged 4193 1.70 2.50 1.41 87 TR_XM_FormFill2 4125 1.69 2.46 1.41 88 XM_H_PHPOS 4099 1.68 2.45 1.40 89 XMBdyGiftCard01 3905 1.26 2.33 0.87 90 RELAYCOUNTRY_DE 3876 0.98 2.32 0.49 91 XMSubMetaI_00 3868 1.27 2.31 0.89 92 MultiRelay_CC 3781 0.73 2.26 0.18 93 MultiRelay_Combo 3781 0.73 2.26 0.18 94 NORMAL_HTTP_TO_IP 3743 0.64 2.24 0.07 95 ALL_TRUSTED 3589 13.90 2.14 18.13 96 T_XMDrugObfuBody_08 3571 1.70 2.13 1.54 97 XMGenDplmaNmb 3560 1.48 2.13 1.24 98 XM_UB99 3516 0.57 2.10 0.02 99 DKIM_ADSP_CUSTOM_MED 3405 1.33 2.03 1.08 100 TR_Mismatch_TLD_01 3284 0.61 1.96 0.13 101 URI_TRY_3LD 3143 1.21 1.88 0.97 102 XMBody_17 3094 0.97 1.85 0.66 103 NML_ADSP_CUSTOM_MED 3078 1.04 1.84 0.76 104 RCVD_IN_RP_RNBL 3061 0.50 1.83 0.03 105 XMHTML_After_End 3027 0.81 1.81 0.45 106 URI_NOVOWEL 2939 0.79 1.76 0.44 107 T_XMHurry_00 2928 0.93 1.75 0.64 108 UNPARSEABLE_RELAY 2870 2.31 1.71 2.53 109 SUBJ_ALL_CAPS 2866 1.58 1.71 1.53 110 T_FILL_THIS_FORM_SHORT 2830 1.21 1.69 1.03 111 XM_UB999 2779 0.45 1.66 0.01 112 TR_XM_DK_SendGrid 2753 2.84 1.64 3.27 113 TM2_M_VERY_LONG_WORD 2751 1.17 1.64 1.00 114 DKIM_ADSP_NXDOMAIN 2707 0.79 1.62 0.49 115 SUBJ_DOLLARS 2670 0.63 1.59 0.28 116 XMBody_78 2639 0.70 1.58 0.39 117 MAILING_LIST_MULTI 2601 2.21 1.55 2.44 118 SpammyFromTLD_01 2576 0.97 1.54 0.76 119 XMStockSpam_06 2556 0.91 1.53 0.69 120 RELAYCOUNTRY_GB 2428 1.20 1.45 1.11 121 BAYES_40 2426 3.53 1.45 4.28 122 BODY_URI_ONLY 2423 0.46 1.45 0.11 123 XMSubMetaSxObfu_03 2396 0.70 1.43 0.44 124 HTML_FONT_FACE_BAD 2346 0.76 1.40 0.53 125 XM_H_Long_From02 2327 1.32 1.39 1.29 126 DATE_IN_PAST_03_06 2261 0.44 1.35 0.11 127 TR_XM_RelayPhish 2184 0.91 1.30 0.77 128 XM_H_PHPMailer 2173 0.77 1.30 0.59 129 XMBrknScrpt_02 2151 0.76 1.28 0.57 130 XMSexyCombo_04 2119 0.43 1.27 0.13 131 RCVD_IN_IADB_VOUCHED 2114 3.21 1.26 3.92 132 BAYES_00 2114 9.58 1.26 12.58 133 FSL_THIS_IS_ADV 2103 0.40 1.26 0.09 134 RELAYCOUNTRY_FR 2090 0.50 1.25 0.22 135 XM_HighProb1 2083 0.34 1.24 0.01 136 TR_Symld_Words 2060 1.53 1.23 1.64 137 XMPhish30 2018 0.66 1.21 0.46 138 T_XMDrugObfuBody_00 2007 0.82 1.20 0.68 139 DATE_IN_PAST_24_48 1997 0.32 1.19 0.01 140 XM_H_TOP 1981 0.32 1.18 0.00 141 XM_ProductURIs 1975 0.77 1.18 0.62 142 DATE_IN_PAST_06_12 1956 0.35 1.17 0.06 143 TR_LOTS_OF_MONEY2 1935 0.58 1.16 0.37 144 T_MONEY_PERCENT 1935 0.58 1.16 0.37 145 RDNS_DYNAMIC 1932 0.60 1.15 0.40 146 XMPhish11 1921 1.15 1.15 1.15 147 TR_M_TOP_BAYES 1907 0.30 1.14 0.00 148 HTML_SHORT_LINK_IMG_1 1887 0.32 1.13 0.03 149 BAYES_20 1884 2.68 1.13 3.24 150 LongTLD 1874 0.40 1.12 0.14 151 NORDNS_LOW_CONTRAST 1838 0.30 1.10 0.01 152 XM_DrugUnitList 1834 0.29 1.10 0.00 153 DIET_1 1823 0.50 1.09 0.29 154 XMHTMLBadTable_001 1768 0.75 1.06 0.65 155 XM_H_PHPOS_M 1757 0.42 1.05 0.19 156 XM_UB60 1746 0.34 1.04 0.09 157 TR_XM_DK_Bayes 1727 7.61 1.03 9.97 158 HTML_IMAGE_ONLY_24 1666 0.51 1.00 0.34 159 T_Symld_Words_02 1666 0.75 1.00 0.67 160 RELAYCOUNTRY_IN 1655 0.35 0.99 0.12 161 URIBL_BLACK 1641 0.30 0.98 0.05 162 XMMoneyMeta_00 1639 0.70 0.98 0.60 163 XMSubMetaSSx_00 1623 0.36 0.97 0.15 164 TR_XM_DK_Bayes1 1601 7.23 0.96 9.48 165 T_TooManySym_02 1570 1.63 0.94 1.88 166 XMSlimDrugH 1529 0.51 0.91 0.37 167 HTML_IMAGE_ONLY_20 1519 0.46 0.91 0.31 168 TR_LOTS_OF_MONEY3 1510 0.58 0.90 0.46 169 TR_XM_DK_Bayes2 1507 6.27 0.90 8.20 170 URIBL_DBL_SPAM 1501 0.25 0.90 0.01 171 XMPhish14 1462 0.53 0.87 0.41 172 XM_B_REG_HTML 1461 0.47 0.87 0.32 173 FORGED_GMAIL_RCVD 1452 0.60 0.87 0.50 174 TR_MetaPhish_Combo_01 1447 1.64 0.86 1.93 175 LONG_HEX_URI 1435 0.37 0.86 0.20 176 BODY_ENHANCEMENT 1418 0.24 0.85 0.03 177 HTML_FONT_SIZE_HUGE 1400 0.29 0.84 0.10 178 RELAYCOUNTRY_AT 1391 0.35 0.83 0.18 179 XM_UB80 1381 0.24 0.82 0.03 180 XM_DK_Undo_01 1372 1.45 0.82 1.67 181 MPART_ALT_DIFF_COUNT 1334 0.39 0.80 0.25 182 XM_RXBody 1314 0.37 0.78 0.22 183 HTML_IMAGE_ONLY_08 1279 0.31 0.76 0.15 184 FILL_THIS_FORM 1277 0.69 0.76 0.67 185 RCVD_IN_IADB_OPTIN 1254 2.06 0.75 2.53 186 TR_Mismatch_TLD_02 1173 0.24 0.70 0.07 187 TR_Caps_n_Bayes_99 1142 0.22 0.68 0.06 188 T_HTML_TAG_BALANCE_CENTER 1129 0.23 0.67 0.07 189 RELAYCOUNTRY_AU 1125 0.58 0.67 0.55 190 XM_XX_Yahoo 1118 0.25 0.67 0.10 191 HTML_TAG_BALANCE_BODY 1086 0.59 0.65 0.57 192 PLING_QUERY 1085 0.46 0.65 0.40 193 XMGppyBdWords 1081 0.29 0.65 0.16 194 THIS_AD 1065 0.24 0.64 0.10 195 XM_Dr_From 1063 0.24 0.63 0.10 196 XMBSHREFv2 1032 0.37 0.62 0.29 197 SUBJECT_NEEDS_ENCODING 1030 0.17 0.62 0.01 198 SUBJ_ILLEGAL_CHARS 1030 0.17 0.62 0.01 199 SHORT_IMG_SUSP_NTLD 1017 0.16 0.61 0.00 200 HTTPS_HTTP_MISMATCH 1013 0.60 0.61 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 408177 89.90 95.79 87.78 2 DKIM_SIGNED 340205 75.80 83.14 73.17 3 XM_DK_Pass 333659 73.74 79.25 71.76 4 DKIM_VALID 317087 70.11 75.42 68.19 5 DCC_CHECK_NEGATIVE 280926 48.96 17.14 60.42 6 BAYES_50 248733 47.77 31.88 53.49 7 DKIM_VALID_AU 230244 51.84 58.30 49.52 8 XMListUnsubscribeExists 227587 56.17 76.24 48.95 9 DCC_CHECK 174793 49.06 80.91 37.59 10 T_TM2_M_HEADER_IN_MSG 143792 27.99 19.84 30.92 11 XM_H_QuotedFrom 138791 32.79 40.97 29.85 12 HTML_FONT_LOW_CONTRAST 123345 29.65 38.33 26.53 13 DKIM_VALID_EF 123034 25.46 22.68 26.46 14 XMSubLong 100538 22.49 24.90 21.62 15 FVGT_m_MULTI_ODD 96051 22.22 26.58 20.66 16 LOC_TINY_FONT_1 95422 24.04 33.82 20.52 17 MIME_HTML_ONLY 95078 23.25 31.03 20.45 18 MultiRelay 89478 18.47 16.34 19.24 19 ALL_TRUSTED 84291 13.90 2.14 18.13 20 T_KAM_HTML_FONT_INVALID 76487 17.82 21.62 16.45 21 XM_DK_Undo_02 61574 22.67 48.87 13.24 22 BAYES_00 58482 9.58 1.26 12.58 23 BAYES_99 54318 20.55 45.20 11.68 24 XM_Body_Dirty_Words 53652 14.25 21.79 11.54 25 XM_Multi_Part_URI 52717 12.58 16.02 11.34 26 RCVD_IN_RP_SAFE 47904 8.59 3.84 10.30 27 BAYES_999 47874 17.63 38.02 10.30 28 TR_XM_DK_Bayes 46367 7.61 1.03 9.97 29 TR_XM_DK_Bayes1 44095 7.23 0.96 9.48 30 RCVD_IN_RP_CERTIFIED 42773 7.63 3.29 9.20 31 LOTS_OF_MONEY 40350 9.72 12.61 8.68 32 TooManyTo_001 40072 8.38 7.72 8.62 33 XM_Evil_Numbers_Gen 38592 9.59 13.19 8.30 34 TR_XM_DK_Bayes2 38134 6.27 0.90 8.20 35 T_XMDrugObfuBody_14 36894 8.23 9.04 7.93 36 LotsOfNums_01 36765 8.16 8.87 7.91 37 XM_DKIMWhitelistDomains 35689 5.65 0.01 7.68 38 HTML_IMAGE_RATIO_02 34587 8.74 12.34 7.44 39 FSL_BULK_SIG 30767 8.03 11.97 6.62 40 XM_SendGrid 29405 5.73 4.06 6.32 41 XM_H_Long_From01 28166 6.60 8.10 6.06 42 RCVD_IN_IADB_LISTED 27841 5.22 3.09 5.99 43 BAYES_60 27472 6.05 6.43 5.91 44 MIME_QP_LONG_LINE 26992 5.80 5.79 5.80 45 TR_DCC_Bayes_99 26578 13.87 36.51 5.72 46 T_TooManySym_01 26276 5.06 3.40 5.65 47 RELAYCOUNTRY_META 25309 8.35 16.41 5.44 48 XM_PDF 25194 4.12 0.53 5.42 49 XM_B_Phish_Phrases 24636 5.74 6.98 5.30 50 RCVD_IN_IADB_SPF 24269 4.56 2.73 5.22 51 HTML_IMAGE_RATIO_04 23695 5.85 7.93 5.10 52 DKIM_INVALID 23118 5.70 7.71 4.97 53 BOTNET_IPINHOSTNAME 21980 7.48 15.12 4.73 54 T_REMOTE_IMAGE 21874 4.69 4.64 4.70 55 RCVD_IN_IADB_SENDERID 21273 4.06 2.64 4.58 56 RCVD_IN_IADB_DK 20782 3.98 2.63 4.47 57 RCVD_IN_MSPIKE_H2 20758 4.00 2.70 4.46 58 XMStrtUSub 20671 4.44 4.43 4.45 59 BAYES_40 19893 3.53 1.45 4.28 60 IN_ZIMBRA_NJ_WHITELIST 19076 3.02 0.02 4.10 61 FROM_EXCESS_BASE64 18560 4.40 5.53 3.99 62 RCVD_IN_IADB_VOUCHED 18217 3.21 1.26 3.92 63 TO_MALFORMED 17714 2.82 0.06 3.81 64 BAYES_80 17105 4.71 7.59 3.68 65 HTML_MIME_NO_HTML_TAG 16809 3.40 2.79 3.61 66 XM_UncommonTLD01 15447 5.40 11.17 3.32 67 TR_XM_DK_SendGrid 15207 2.84 1.64 3.27 68 XMSubMetaSx_00 15140 4.76 8.94 3.26 69 XM_B_SpammyTLD 15089 3.63 4.69 3.25 70 HTML_IMAGE_RATIO_06 15068 3.80 5.35 3.24 71 BAYES_20 15055 2.68 1.13 3.24 72 MPART_ALT_DIFF 14662 4.29 7.45 3.15 73 XMNumbers 13532 3.16 3.86 2.91 74 XMSexyCombo_05 12603 5.00 11.35 2.71 75 RCVD_IN_IADB_OPTIN 11779 2.06 0.75 2.53 76 UNPARSEABLE_RELAY 11765 2.31 1.71 2.53 77 BAYES_95 11707 2.98 4.25 2.52 78 HTML_IMAGE_RATIO_08 11417 2.70 3.36 2.46 79 MAILING_LIST_MULTI 11348 2.21 1.55 2.44 80 TooManyTo_002 11138 1.92 0.58 2.40 81 MIME_HTML_MOSTLY 11120 3.20 5.46 2.39 82 TVD_RCVD_IP 10727 1.81 0.41 2.31 83 XM_DIRTYINTL 10505 2.95 4.86 2.26 84 BAYES_05 10124 1.75 0.57 2.18 85 XMDiploma_00 9693 2.51 3.71 2.08 86 RCVD_IN_MSPIKE_WL 9590 1.63 0.44 2.06 87 RCVD_IN_MSPIKE_H3 9579 1.63 0.44 2.06 88 HELO_NODOT 9123 1.57 0.49 1.96 89 HELO_NO_DOMAIN 9120 1.56 0.45 1.96 90 ANY_BOUNCE_MESSAGE 9037 1.55 0.45 1.94 91 BOUNCE_MESSAGE 9035 1.55 0.45 1.94 92 XM_SPF_SoftFail 8994 2.36 3.55 1.93 93 TR_MetaPhish_Combo_01 8954 1.64 0.86 1.93 94 IN_HORDE_ADDRESS_BOOK 8844 1.41 0.04 1.90 95 T_TooManySym_02 8728 1.63 0.94 1.88 96 XM_CamelCaseFrm001 8628 2.51 4.32 1.86 97 BOTNET 8198 5.66 16.49 1.76 98 URI_HEX 8007 2.18 3.46 1.72 99 TM2_M_URI_OPT_OUT 7794 2.13 3.39 1.68 100 XM_DK_Undo_01 7774 1.45 0.82 1.67 101 INVALID_MSGID 7706 1.27 0.18 1.66 102 TR_Symld_Words 7615 1.53 1.23 1.64 103 TooManyTo_003 7493 1.30 0.44 1.61 104 T_XMDrugObfuBody_08 7181 1.70 2.13 1.54 105 XMCapTrack 7127 1.19 0.25 1.53 106 SUBJ_ALL_CAPS 7111 1.58 1.71 1.53 107 XM_OfRef6 6980 1.82 2.71 1.50 108 UNTRUSTED_Relay 6900 3.35 8.53 1.48 109 TR_XM_PHPDW 6653 1.72 2.52 1.43 110 RELAYCOUNTRY_CA 6608 1.99 3.55 1.42 111 TR_XM_PHPForged 6575 1.70 2.50 1.41 112 MIME_HTML_ONLY_MULTI 6556 1.91 3.32 1.41 113 TR_XM_FormFill2 6538 1.69 2.46 1.41 114 XM_H_PHPOS 6523 1.68 2.45 1.40 115 XM_H_Long_From02 6001 1.32 1.39 1.29 116 XMGenDplmaNmb 5768 1.48 2.13 1.24 117 XM_GoogleGroups 5449 0.98 0.45 1.17 118 XMPhish11 5364 1.15 1.15 1.15 119 TooManyTo_004 5250 0.92 0.35 1.13 120 RELAYCOUNTRY_GB 5157 1.20 1.45 1.11 121 USER_IN_DEF_DKIM_WL 5105 0.81 0.01 1.10 122 NO_DNS_FOR_FROM 5043 1.59 3.00 1.08 123 DKIM_ADSP_CUSTOM_MED 5003 1.33 2.03 1.08 124 T_FILL_THIS_FORM_SHORT 4802 1.21 1.69 1.03 125 TM2_M_VERY_LONG_WORD 4642 1.17 1.64 1.00 126 URI_TRY_3LD 4507 1.21 1.88 0.97 127 XM_UB50 4458 1.64 3.52 0.96 128 TooManyTo_005 4366 0.76 0.28 0.94 129 XMSubMetaI_00 4161 1.27 2.31 0.89 130 XMBdyGiftCard01 4068 1.26 2.33 0.87 131 TO_NO_BRKTS_HTML_ONLY 3782 0.69 0.35 0.81 132 TR_XM_RelayPhish 3568 0.91 1.30 0.77 133 SpammyFromTLD_01 3555 0.97 1.54 0.76 134 NML_ADSP_CUSTOM_MED 3514 1.04 1.84 0.76 135 XMNoVowels 3248 0.63 0.46 0.70 136 XMStockSpam_06 3190 0.91 1.53 0.69 137 T_XMDrugObfuBody_00 3175 0.82 1.20 0.68 138 FILL_THIS_FORM 3112 0.69 0.76 0.67 139 T_Symld_Words_02 3108 0.75 1.00 0.67 140 XMBody_17 3071 0.97 1.85 0.66 141 XMHTMLBadTable_001 3002 0.75 1.06 0.65 142 T_OBFU_PDF_ATTACH 2986 0.51 0.14 0.64 143 T_XMHurry_00 2975 0.93 1.75 0.64 144 XM_ProductURIs 2898 0.77 1.18 0.62 145 MISSING_HEADERS 2878 0.55 0.35 0.62 146 XM_ShortIntro_01 2808 0.53 0.31 0.60 147 HTTPS_HTTP_MISMATCH 2788 0.60 0.61 0.60 148 XMMoneyMeta_00 2773 0.70 0.98 0.60 149 XMLngstWrd_00 2735 0.51 0.30 0.59 150 T_TooManySym_03 2732 0.51 0.30 0.59 151 XM_H_PHPMailer 2727 0.77 1.30 0.59 152 XMBrknScrpt_02 2668 0.76 1.28 0.57 153 HTML_TAG_BALANCE_BODY 2643 0.59 0.65 0.57 154 USER_IN_WHITELIST 2622 0.41 0.00 0.56 155 XMLngstWrd_01 2584 0.48 0.28 0.56 156 XMBody_95 2557 0.44 0.15 0.55 157 RELAYCOUNTRY_AU 2552 0.58 0.67 0.55 158 RCVD_IN_BL_SPAMCOP_NET 2539 1.36 3.63 0.55 159 XMRcvdHeader_15 2494 0.39 0.00 0.54 160 HTML_FONT_FACE_BAD 2477 0.76 1.40 0.53 161 FORGED_GMAIL_RCVD 2343 0.60 0.87 0.50 162 XM_B_COPY_HTML 2313 0.50 0.51 0.50 163 SHORT_HELO_AND_INLINE_IMAGE 2313 0.37 0.03 0.50 164 RELAYCOUNTRY_DE 2296 0.98 2.32 0.49 165 XMSexyCombo_01 2289 1.12 2.85 0.49 166 DKIM_ADSP_NXDOMAIN 2283 0.79 1.62 0.49 167 HTML_IMAGE_ONLY_32 2226 0.44 0.34 0.48 168 XMGappySubj_01 2217 0.43 0.31 0.48 169 TM2_M_BODY_EMPTY 2217 0.38 0.12 0.48 170 XMDateMe_00 2214 0.45 0.40 0.48 171 FROM_GOV_SPOOF 2205 0.39 0.17 0.47 172 TM2_M_A_HREF_HREF 2167 0.50 0.61 0.47 173 TR_LOTS_OF_MONEY3 2157 0.58 0.90 0.46 174 XMPhish30 2152 0.66 1.21 0.46 175 FILL_THIS_FORM_LONG 2137 0.47 0.50 0.46 176 XMHTML_After_End 2098 0.81 1.81 0.45 177 FILL_THIS_FORM_LOAN 2084 0.47 0.52 0.45 178 XMSubNoVowel 2060 0.43 0.40 0.44 179 XMSubMetaSxObfu_03 2052 0.70 1.43 0.44 180 URI_NOVOWEL 2027 0.79 1.76 0.44 181 XMPhish14 1910 0.53 0.87 0.41 182 RCVD_IN_SORBS_DUL 1894 0.37 0.25 0.41 183 XMSubMetaSxObfu_02 1883 0.37 0.27 0.40 184 HTML_IMAGE_ONLY_28 1881 0.40 0.40 0.40 185 RDNS_DYNAMIC 1874 0.60 1.15 0.40 186 PLING_QUERY 1853 0.46 0.65 0.40 187 XMBody_78 1801 0.70 1.58 0.39 188 FROM_GOV_DKIM_AU 1777 0.30 0.07 0.38 189 XM_USANA_RCVD 1766 0.28 0.00 0.38 190 REMOVE_BEFORE_LINK 1740 0.40 0.47 0.37 191 T_MONEY_PERCENT 1739 0.58 1.16 0.37 192 TR_LOTS_OF_MONEY2 1739 0.58 1.16 0.37 193 XMSUPPORT 1723 0.27 0.00 0.37 194 XM_URI_RBL 1716 1.17 3.41 0.37 195 XMSlimDrugH 1709 0.51 0.91 0.37 196 NUMERIC_HTTP_ADDR 1708 0.94 2.53 0.37 197 AC_DIV_BONANZA 1706 0.30 0.12 0.37 198 XMLKML 1705 0.27 0.00 0.37 199 XM_H_SpoofStaff4 1696 0.28 0.04 0.36 200 HTML_IMAGE_ONLY_24 1586 0.51 1.00 0.34 ----------------------------------------------------------------------