Email: 596013 Autolearn: 0 AvgScore: 2.96 AvgScanTime: 2.12 sec Spam: 143446 Autolearn: 0 AvgScore: 12.09 AvgScanTime: 2.64 sec Ham: 452567 Autolearn: 0 AvgScore: 0.07 AvgScanTime: 1.96 sec Time Spent Running SA: 351.20 hours Time Spent Processing Spam: 105.12 hours Time Spent Processing Ham: 246.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136201 86.89 94.95 84.33 2 DKIM_SIGNED 122457 76.79 85.37 74.07 3 XM_DK_Pass 117029 74.70 81.58 72.52 4 DCC_CHECK 113498 48.94 79.12 39.37 5 XMListUnsubscribeExists 111057 56.08 77.42 49.32 6 DKIM_VALID 111016 71.08 77.39 69.08 7 DKIM_VALID_AU 83847 51.22 58.45 48.93 8 XM_DK_Undo_02 72953 22.45 50.86 13.44 9 BAYES_99 64687 19.98 45.10 12.02 10 BAYES_999 53827 17.11 37.52 10.63 11 HTML_FONT_LOW_CONTRAST 52298 29.77 36.46 27.65 12 TR_DCC_Bayes_99 51381 12.90 35.82 5.64 13 LOC_TINY_FONT_1 48867 25.16 34.07 22.34 14 BAYES_50 47153 49.30 32.87 54.50 15 FVGT_m_MULTI_ODD 44116 23.29 30.75 20.92 16 MIME_HTML_ONLY 41783 22.24 29.13 20.06 17 XMSubLong 37459 22.78 26.11 21.72 18 XM_Body_Dirty_Words 33306 18.05 23.22 16.41 19 DKIM_VALID_EF 31106 25.86 21.68 27.19 20 T_KAM_HTML_FONT_INVALID 30838 17.40 21.50 16.10 21 T_TM2_M_HEADER_IN_MSG 28363 27.05 19.77 29.36 22 DCC_CHECK_NEGATIVE 27361 49.03 19.07 58.52 23 XM_Multi_Part_URI 25443 13.80 17.74 12.55 24 MultiRelay 23443 18.59 16.34 19.31 25 BOTNET_IPINHOSTNAME 23028 7.37 16.05 4.61 26 RELAYCOUNTRY_META 21989 7.86 15.33 5.50 27 HTML_IMAGE_RATIO_02 21702 9.50 15.13 7.71 28 BOTNET 21327 4.94 14.87 1.79 29 LOTS_OF_MONEY 20704 11.59 14.43 10.69 30 XM_Evil_Numbers_Gen 18531 10.15 12.92 9.27 31 XMSexyCombo_05 15522 5.50 10.82 3.82 32 XM_UncommonTLD01 15017 5.36 10.47 3.73 33 LotsOfNums_01 14374 8.37 10.02 7.85 34 T_XMDrugObfuBody_14 13500 8.28 9.41 7.93 35 XM_B_Phish_Phrases 12721 6.65 8.87 5.95 36 FSL_BULK_SIG 12698 7.86 8.85 7.55 37 UNTRUSTED_Relay 11795 3.02 8.22 1.37 38 DKIM_INVALID 11441 5.70 7.98 4.98 39 XMSubMetaSx_00 11241 4.88 7.84 3.94 40 HTML_IMAGE_RATIO_04 10750 6.29 7.49 5.91 41 TooManyTo_001 10709 7.71 7.47 7.79 42 MPART_ALT_DIFF 10694 3.96 7.46 2.86 43 BAYES_80 10521 4.83 7.33 4.04 44 RCVD_IN_MSPIKE_BL 10357 3.54 7.22 2.38 45 XM_H_Long_From01 10227 7.02 7.13 6.98 46 MIME_QP_LONG_LINE 8967 5.74 6.25 5.57 47 RCVD_IN_MSPIKE_L5 8920 2.22 6.22 0.95 48 BAYES_60 8572 6.22 5.98 6.30 49 XM_DIRTYINTL 8142 3.22 5.68 2.44 50 HTML_IMAGE_RATIO_06 6814 3.39 4.75 2.96 51 XM_URI_RBL 6648 1.70 4.63 0.78 52 FROM_EXCESS_BASE64 6598 4.10 4.60 3.94 53 RELAYCOUNTRY_CA 6303 2.10 4.39 1.37 54 BAYES_95 6157 3.27 4.29 2.94 55 RCVD_IN_MSPIKE_H2 6133 6.37 4.28 7.03 56 XM_SendGrid 6059 5.79 4.22 6.29 57 XM_CamelCaseFrm001 6007 2.28 4.19 1.67 58 MIME_HTML_MOSTLY 5873 2.51 4.09 2.01 59 TM2_M_URI_OPT_OUT 5614 2.26 3.91 1.73 60 FROM_SUSPICIOUS_NTLD 5588 0.96 3.90 0.03 61 FROM_SUSPICIOUS_NTLD_FP 5572 0.95 3.88 0.02 62 MIME_HTML_ONLY_MULTI 5508 2.01 3.84 1.43 63 URI_HEX 5502 2.29 3.84 1.81 64 XMNumbers 5312 3.20 3.70 3.04 65 US_DOLLARS_3 5292 3.10 3.69 2.92 66 RCVD_IN_PSBL 5236 0.93 3.65 0.07 67 XM_SPF_SoftFail 5194 2.14 3.62 1.67 68 XMStrtUSub 5125 4.11 3.57 4.28 69 RCVD_IN_RP_SAFE 5102 8.32 3.56 9.83 70 T_REMOTE_IMAGE 5080 4.15 3.54 4.34 71 XMDiploma_00 5073 2.31 3.54 1.93 72 XM_UB50 4973 1.45 3.47 0.81 73 T_TooManySym_01 4929 5.29 3.44 5.88 74 RCVD_IN_IADB_LISTED 4686 5.31 3.27 5.96 75 XMSexyCombo_01 4432 1.52 3.09 1.03 76 HTML_IMAGE_RATIO_08 4391 2.83 3.06 2.76 77 XM_B_SpammyTLD 4370 3.32 3.05 3.40 78 XM_OfRef6 4325 1.85 3.02 1.49 79 XM_ProductURIs 4319 2.16 3.01 1.89 80 RCVD_IN_IADB_SPF 4110 4.55 2.87 5.08 81 T_XMDrugObfuBody_08 3991 2.05 2.78 1.82 82 RCVD_IN_RP_CERTIFIED 3926 7.21 2.74 8.63 83 RCVD_IN_IADB_DK 3902 3.91 2.72 4.28 84 RCVD_IN_IADB_SENDERID 3885 3.98 2.71 4.38 85 BOTNET_NORDNS 3821 0.66 2.66 0.02 86 TR_XM_PHPDW 3650 3.72 2.54 4.09 87 RCVD_IN_MSPIKE_WL 3640 5.65 2.54 6.64 88 TR_XM_PHPForged 3562 3.32 2.48 3.59 89 TR_XM_FormFill2 3518 1.16 2.45 0.75 90 XM_H_PHPOS 3504 1.16 2.44 0.75 91 RCVD_IN_MSPIKE_H3 3436 5.19 2.40 6.07 92 SpammyFromTLD_02 3430 0.91 2.39 0.44 93 XMBody_78 3352 1.00 2.34 0.57 94 SUBJ_ALL_CAPS 3181 2.24 2.22 2.25 95 RCVD_IN_BL_SPAMCOP_NET 3146 0.94 2.19 0.54 96 DIET_1 3133 0.75 2.18 0.29 97 XMBdyGiftCard01 3034 1.28 2.12 1.01 98 URI_TRY_3LD 3010 1.69 2.10 1.56 99 RELAYCOUNTRY_FR 2999 0.66 2.09 0.20 100 KHOP_HELO_FCRDNS 2994 2.15 2.09 2.17 101 XM_H_Long_From02 2956 1.31 2.06 1.07 102 XMGenDplmaNmb 2951 1.31 2.06 1.07 103 XM_UB99 2897 0.50 2.02 0.02 104 NO_DNS_FOR_FROM 2887 1.29 2.01 1.07 105 ALL_TRUSTED 2817 13.81 1.96 17.56 106 MultiRelay_CC 2806 0.62 1.96 0.19 107 MultiRelay_Combo 2806 0.62 1.96 0.19 108 HTML_MIME_NO_HTML_TAG 2798 2.03 1.95 2.05 109 T_XMDrugObfuBody_00 2702 1.29 1.88 1.11 110 XMBody_17 2614 0.82 1.82 0.50 111 TM2_M_VERY_LONG_WORD 2529 1.23 1.76 1.06 112 SpammyFromTLD_01 2468 1.14 1.72 0.96 113 TR_Symld_Words 2451 2.09 1.71 2.21 114 URIBL_DBL_SPAM 2398 0.41 1.67 0.01 115 XM_HighProb1 2328 0.71 1.62 0.42 116 XM_UB999 2296 0.40 1.60 0.02 117 RCVD_IN_RP_RNBL 2293 0.40 1.60 0.02 118 MAILING_LIST_MULTI 2283 2.02 1.59 2.16 119 TR_XM_DK_SendGrid 2271 2.57 1.58 2.88 120 XMPhish11 2238 1.29 1.56 1.21 121 BAYES_40 2238 3.40 1.56 3.98 122 XM_DK_Undo_01 2159 1.82 1.51 1.91 123 TR_XM_RelayPhish 2141 0.95 1.49 0.77 124 XMStockSpam_06 2086 1.37 1.45 1.35 125 XMSubMetaI_00 2077 0.66 1.45 0.42 126 T_MONEY_PERCENT 2067 0.57 1.44 0.29 127 TR_LOTS_OF_MONEY2 2067 0.57 1.44 0.29 128 RCVD_IN_IADB_VOUCHED 1987 3.46 1.39 4.12 129 LOW_PRICE 1908 0.52 1.33 0.26 130 BAYES_20 1854 2.48 1.29 2.86 131 UNPARSEABLE_RELAY 1814 2.27 1.26 2.58 132 T_XMHurry_00 1802 0.67 1.26 0.49 133 XMHTML_After_End 1771 0.63 1.23 0.44 134 HTML_IMAGE_ONLY_28 1743 0.55 1.22 0.34 135 SUBJ_DOLLARS 1738 0.61 1.21 0.42 136 XMPhish30 1720 0.56 1.20 0.36 137 XM_H_PHPMailer 1710 3.19 1.19 3.82 138 XM_B_REG_HTML 1700 0.60 1.19 0.41 139 DKIM_ADSP_CUSTOM_MED 1672 2.92 1.17 3.48 140 XMBrknScrpt_02 1651 0.68 1.15 0.53 141 TM2_M_A_HREF_HREF 1643 1.18 1.15 1.19 142 XMSexyCombo_04 1599 0.67 1.11 0.53 143 FILL_THIS_FORM 1594 0.73 1.11 0.61 144 MISSING_HEADERS 1592 0.60 1.11 0.44 145 RELAYCOUNTRY_GB 1581 1.23 1.10 1.27 146 URIBL_BLACK 1521 0.29 1.06 0.05 147 XMSubMetaSSx_00 1517 0.42 1.06 0.22 148 XM_UB60 1500 0.32 1.05 0.09 149 TR_MetaPhish_Combo_01 1499 1.64 1.04 1.83 150 T_Symld_Words_02 1470 0.77 1.02 0.70 151 DKIM_ADSP_NXDOMAIN 1462 0.74 1.02 0.66 152 SHORT_URI_3 1454 0.34 1.01 0.13 153 RDNS_DYNAMIC 1453 0.54 1.01 0.39 154 XM_B_COPY_HTML 1414 0.65 0.99 0.54 155 DATE_IN_PAST_03_06 1410 0.29 0.98 0.07 156 XM_H_PHPOS_M 1397 0.35 0.97 0.15 157 DATE_IN_PAST_06_12 1359 0.26 0.95 0.05 158 FORGED_GMAIL_RCVD 1341 2.11 0.93 2.48 159 REPLYTO_WITHOUT_TO_CC 1332 0.30 0.93 0.10 160 XMHTMLBadTable_001 1318 0.51 0.92 0.38 161 FILL_THIS_FORM_LONG 1313 0.53 0.92 0.40 162 TooManyTo_002 1299 1.75 0.91 2.02 163 HTML_FONT_FACE_BAD 1289 0.59 0.90 0.49 164 XMSubMetaSxObfu_02 1287 0.52 0.90 0.40 165 RELAYCOUNTRY_AT 1278 0.35 0.89 0.17 166 XM_PDF 1275 3.56 0.89 4.41 167 NML_ADSP_CUSTOM_MED 1271 2.65 0.89 3.21 168 XM_DKIMWhitelistDomains 1249 6.86 0.87 8.76 169 LONG_JUNK_URI 1245 0.34 0.87 0.17 170 HTML_TAG_BALANCE_BODY 1215 0.56 0.85 0.47 171 BAYES_00 1207 8.75 0.84 11.26 172 URIBL_ABUSE_SURBL 1187 0.26 0.83 0.08 173 RELAYCOUNTRY_IE 1170 0.33 0.82 0.17 174 TR_LOTS_OF_MONEY3 1144 0.68 0.80 0.65 175 XMSlimDrugH 1137 0.59 0.79 0.53 176 XM_Body_Obfu01 1135 0.55 0.79 0.48 177 XMSubMetaSxObfu_03 1107 0.49 0.77 0.40 178 MPART_ALT_DIFF_COUNT 1102 0.36 0.77 0.23 179 XMSolicitRefs_0 1099 0.99 0.77 1.06 180 T_FILL_THIS_FORM_SHORT 1088 1.04 0.76 1.13 181 LongTLD 1075 0.27 0.75 0.12 182 TooManyTo_003 1075 1.22 0.75 1.36 183 TR_Caps_n_Bayes_99 1073 0.42 0.75 0.31 184 RCVD_IN_IADB_OPTIN 1068 2.23 0.74 2.70 185 XM_UB80 1027 0.19 0.72 0.02 186 PLING_QUERY 1006 0.47 0.70 0.39 187 NUMERIC_HTTP_ADDR 991 0.44 0.69 0.37 188 HK_RANDOM_REPLYTO 983 0.30 0.69 0.18 189 XM_Combo_Sbj 983 0.38 0.69 0.28 190 RELAYCOUNTRY_IN 982 0.24 0.68 0.11 191 RCVD_IN_MSPIKE_L3 982 0.69 0.68 0.69 192 TooManyTo_004 954 0.93 0.67 1.01 193 RELAYCOUNTRY_AU 943 0.59 0.66 0.56 194 RELAYCOUNTRY_DE 940 0.40 0.66 0.32 195 XMSubNoVowel 931 0.40 0.65 0.33 196 XMBSHREFv2 927 0.37 0.65 0.28 197 XM_OfRef7 925 0.31 0.64 0.21 198 FILL_THIS_FORM_LOAN 921 0.46 0.64 0.40 199 XM_Walgreens_Forge 916 0.24 0.64 0.12 200 BODY_ENHANCEMENT 900 0.17 0.63 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 381660 86.89 94.95 84.33 2 DKIM_SIGNED 335204 76.79 85.37 74.07 3 XM_DK_Pass 328186 74.70 81.58 72.52 4 DKIM_VALID 312646 71.08 77.39 69.08 5 DCC_CHECK_NEGATIVE 264843 49.03 19.07 58.52 6 BAYES_50 246656 49.30 32.87 54.50 7 XMListUnsubscribeExists 223211 56.08 77.42 49.32 8 DKIM_VALID_AU 221432 51.22 58.45 48.93 9 DCC_CHECK 178197 48.94 79.12 39.37 10 T_TM2_M_HEADER_IN_MSG 132872 27.05 19.77 29.36 11 HTML_FONT_LOW_CONTRAST 125146 29.77 36.46 27.65 12 DKIM_VALID_EF 123043 25.86 21.68 27.19 13 LOC_TINY_FONT_1 101096 25.16 34.07 22.34 14 XMSubLong 98296 22.78 26.11 21.72 15 FVGT_m_MULTI_ODD 94671 23.29 30.75 20.92 16 MIME_HTML_ONLY 90763 22.24 29.13 20.06 17 MultiRelay 87369 18.59 16.34 19.31 18 ALL_TRUSTED 79483 13.81 1.96 17.56 19 XM_Body_Dirty_Words 74268 18.05 23.22 16.41 20 T_KAM_HTML_FONT_INVALID 72874 17.40 21.50 16.10 21 XM_DK_Undo_02 60836 22.45 50.86 13.44 22 XM_Multi_Part_URI 56785 13.80 17.74 12.55 23 BAYES_99 54390 19.98 45.10 12.02 24 BAYES_00 50972 8.75 0.84 11.26 25 LOTS_OF_MONEY 48371 11.59 14.43 10.69 26 BAYES_999 48127 17.11 37.52 10.63 27 RCVD_IN_RP_SAFE 44497 8.32 3.56 9.83 28 XM_Evil_Numbers_Gen 41968 10.15 12.92 9.27 29 TR_XM_DK_Bayes 41309 7.05 0.51 9.13 30 XM_DKIMWhitelistDomains 39661 6.86 0.87 8.76 31 TR_XM_DK_Bayes1 39560 6.74 0.43 8.74 32 RCVD_IN_RP_CERTIFIED 39068 7.21 2.74 8.63 33 T_XMDrugObfuBody_14 35866 8.28 9.41 7.93 34 LotsOfNums_01 35504 8.37 10.02 7.85 35 TooManyTo_001 35235 7.71 7.47 7.79 36 HTML_IMAGE_RATIO_02 34895 9.50 15.13 7.71 37 FSL_BULK_SIG 34148 7.86 8.85 7.55 38 TR_XM_DK_Bayes2 32193 5.47 0.27 7.11 39 RCVD_IN_MSPIKE_H2 31831 6.37 4.28 7.03 40 XM_H_Long_From01 31592 7.02 7.13 6.98 41 RCVD_IN_MSPIKE_WL 30029 5.65 2.54 6.64 42 BAYES_60 28518 6.22 5.98 6.30 43 XM_SendGrid 28462 5.79 4.22 6.29 44 RCVD_IN_MSPIKE_H3 27481 5.19 2.40 6.07 45 RCVD_IN_IADB_LISTED 26984 5.31 3.27 5.96 46 XM_B_Phish_Phrases 26921 6.65 8.87 5.95 47 HTML_IMAGE_RATIO_04 26760 6.29 7.49 5.91 48 T_TooManySym_01 26595 5.29 3.44 5.88 49 TR_DCC_Bayes_99 25527 12.90 35.82 5.64 50 MIME_QP_LONG_LINE 25221 5.74 6.25 5.57 51 RELAYCOUNTRY_META 24885 7.86 15.33 5.50 52 RCVD_IN_IADB_SPF 23003 4.55 2.87 5.08 53 DKIM_INVALID 22558 5.70 7.98 4.98 54 TO_MALFORMED 22368 3.77 0.07 4.94 55 BOTNET_IPINHOSTNAME 20875 7.37 16.05 4.61 56 XM_PDF 19964 3.56 0.89 4.41 57 RCVD_IN_IADB_SENDERID 19831 3.98 2.71 4.38 58 T_REMOTE_IMAGE 19634 4.15 3.54 4.34 59 RCVD_IN_IADB_DK 19381 3.91 2.72 4.28 60 XMStrtUSub 19373 4.11 3.57 4.28 61 RCVD_IN_IADB_VOUCHED 18653 3.46 1.39 4.12 62 TR_XM_PHPDW 18531 3.72 2.54 4.09 63 BAYES_80 18285 4.83 7.33 4.04 64 BAYES_40 18009 3.40 1.56 3.98 65 XMSubMetaSx_00 17828 4.88 7.84 3.94 66 IN_ZIMBRA_NJ_WHITELIST 17826 2.99 0.02 3.94 67 FROM_EXCESS_BASE64 17815 4.10 4.60 3.94 68 XM_H_PHPMailer 17298 3.19 1.19 3.82 69 XMSexyCombo_05 17271 5.50 10.82 3.82 70 XM_UncommonTLD01 16901 5.36 10.47 3.73 71 TR_XM_PHPForged 16234 3.32 2.48 3.59 72 DKIM_ADSP_CUSTOM_MED 15740 2.92 1.17 3.48 73 XM_B_SpammyTLD 15408 3.32 3.05 3.40 74 NML_ADSP_CUSTOM_MED 14537 2.65 0.89 3.21 75 XMNumbers 13769 3.20 3.70 3.04 76 HTML_IMAGE_RATIO_06 13381 3.39 4.75 2.96 77 BAYES_95 13314 3.27 4.29 2.94 78 US_DOLLARS_3 13209 3.10 3.69 2.92 79 TR_XM_DK_SendGrid 13049 2.57 1.58 2.88 80 BAYES_20 12944 2.48 1.29 2.86 81 MPART_ALT_DIFF 12930 3.96 7.46 2.86 82 HTML_IMAGE_RATIO_08 12502 2.83 3.06 2.76 83 RCVD_IN_IADB_OPTIN 12234 2.23 0.74 2.70 84 UNPARSEABLE_RELAY 11690 2.27 1.26 2.58 85 FORGED_GMAIL_RCVD 11220 2.11 0.93 2.48 86 XM_DIRTYINTL 11065 3.22 5.68 2.44 87 RCVD_IN_MSPIKE_BL 10762 3.54 7.22 2.38 88 SUBJ_ALL_CAPS 10192 2.24 2.22 2.25 89 TR_Symld_Words 10019 2.09 1.71 2.21 90 TVD_RCVD_IP 9855 1.74 0.35 2.18 91 KHOP_HELO_FCRDNS 9816 2.15 2.09 2.17 92 MAILING_LIST_MULTI 9762 2.02 1.59 2.16 93 HTML_MIME_NO_HTML_TAG 9294 2.03 1.95 2.05 94 TooManyTo_002 9144 1.75 0.91 2.02 95 MIME_HTML_MOSTLY 9091 2.51 4.09 2.01 96 INVALID_MSGID 8830 1.53 0.19 1.95 97 XMDiploma_00 8724 2.31 3.54 1.93 98 XM_DK_Undo_01 8666 1.82 1.51 1.91 99 XM_ProductURIs 8570 2.16 3.01 1.89 100 TR_MetaPhish_Combo_01 8263 1.64 1.04 1.83 101 T_XMDrugObfuBody_08 8226 2.05 2.78 1.82 102 URI_HEX 8175 2.29 3.84 1.81 103 BAYES_05 8169 1.50 0.54 1.81 104 BOTNET 8092 4.94 14.87 1.79 105 T_TooManySym_02 7904 1.46 0.55 1.75 106 TM2_M_URI_OPT_OUT 7844 2.26 3.91 1.73 107 IN_HORDE_ADDRESS_BOOK 7641 1.29 0.03 1.69 108 ANY_BOUNCE_MESSAGE 7634 1.39 0.44 1.69 109 BOUNCE_MESSAGE 7632 1.39 0.44 1.69 110 XM_CamelCaseFrm001 7570 2.28 4.19 1.67 111 XM_SPF_SoftFail 7539 2.14 3.62 1.67 112 HELO_NODOT 7344 1.33 0.42 1.62 113 HELO_NO_DOMAIN 7343 1.33 0.41 1.62 114 URI_TRY_3LD 7055 1.69 2.10 1.56 115 XM_OfRef6 6731 1.85 3.02 1.49 116 MIME_HTML_ONLY_MULTI 6492 2.01 3.84 1.43 117 RELAYCOUNTRY_CA 6217 2.10 4.39 1.37 118 UNTRUSTED_Relay 6204 3.02 8.22 1.37 119 TooManyTo_003 6174 1.22 0.75 1.36 120 XMStockSpam_06 6090 1.37 1.45 1.35 121 XMCapTrack 6057 1.10 0.34 1.34 122 RELAYCOUNTRY_GB 5759 1.23 1.10 1.27 123 XMPhish11 5470 1.29 1.56 1.21 124 TM2_M_A_HREF_HREF 5370 1.18 1.15 1.19 125 T_FILL_THIS_FORM_SHORT 5114 1.04 0.76 1.13 126 XM_GoogleGroups 5021 0.96 0.51 1.11 127 T_XMDrugObfuBody_00 5011 1.29 1.88 1.11 128 XMGenDplmaNmb 4862 1.31 2.06 1.07 129 XM_H_Long_From02 4831 1.31 2.06 1.07 130 NO_DNS_FOR_FROM 4827 1.29 2.01 1.07 131 XMSolicitRefs_0 4807 0.99 0.77 1.06 132 TM2_M_VERY_LONG_WORD 4806 1.23 1.76 1.06 133 USER_IN_DEF_DKIM_WL 4795 0.81 0.01 1.06 134 XMSexyCombo_01 4651 1.52 3.09 1.03 135 TooManyTo_004 4585 0.93 0.67 1.01 136 XMBdyGiftCard01 4583 1.28 2.12 1.01 137 SpammyFromTLD_01 4342 1.14 1.72 0.96 138 RCVD_IN_MSPIKE_L5 4303 2.22 6.22 0.95 139 TooManyTo_005 3823 0.78 0.59 0.84 140 XM_UB50 3648 1.45 3.47 0.81 141 XM_URI_RBL 3512 1.70 4.63 0.78 142 TR_XM_RelayPhish 3495 0.95 1.49 0.77 143 TR_XM_FormFill2 3396 1.16 2.45 0.75 144 XM_H_PHPOS 3388 1.16 2.44 0.75 145 RCVD_IN_MSPIKE_L4 3339 0.64 0.32 0.74 146 XMNoVowels 3315 0.69 0.57 0.73 147 T_OBFU_PDF_ATTACH 3193 0.58 0.20 0.71 148 T_Symld_Words_02 3148 0.77 1.02 0.70 149 RCVD_IN_MSPIKE_L3 3121 0.69 0.68 0.69 150 XMGappySubj_01 3069 0.59 0.32 0.68 151 XM_D_tchamptons_WL 3004 0.50 0.00 0.66 152 DKIM_ADSP_NXDOMAIN 2971 0.74 1.02 0.66 153 TR_LOTS_OF_MONEY3 2931 0.68 0.80 0.65 154 T_TooManySym_03 2760 0.50 0.14 0.61 155 FILL_THIS_FORM 2741 0.73 1.11 0.61 156 FROM_GOV_SPOOF 2686 0.57 0.52 0.59 157 XMBody_78 2584 1.00 2.34 0.57 158 RELAYCOUNTRY_AU 2554 0.59 0.66 0.56 159 HTTPS_HTTP_MISMATCH 2526 0.57 0.60 0.56 160 XMBody_95 2513 0.55 0.52 0.56 161 XM_B_COPY_HTML 2457 0.65 0.99 0.54 162 RCVD_IN_BL_SPAMCOP_NET 2452 0.94 2.19 0.54 163 USER_IN_WHITELIST 2424 0.41 0.00 0.54 164 XMSexyCombo_04 2403 0.67 1.11 0.53 165 XMSlimDrugH 2397 0.59 0.79 0.53 166 XMBrknScrpt_02 2392 0.68 1.15 0.53 167 XMLngstWrd_00 2369 0.50 0.43 0.52 168 XMMoneyMeta_00 2320 0.53 0.58 0.51 169 XM_ShortIntro_01 2266 0.49 0.48 0.50 170 XMBody_17 2262 0.82 1.82 0.50 171 HTML_FONT_FACE_BAD 2221 0.59 0.90 0.49 172 T_XMHurry_00 2199 0.67 1.26 0.49 173 FORGED_YAHOO_RCVD 2195 0.40 0.13 0.49 174 XMLngstWrd_01 2179 0.46 0.40 0.48 175 XM_Body_Obfu01 2156 0.55 0.79 0.48 176 HTML_TAG_BALANCE_BODY 2132 0.56 0.85 0.47 177 XMhairloss01 2127 0.41 0.20 0.47 178 T_MANY_PILL_PRICE 2064 0.38 0.14 0.46 179 SHORT_HELO_AND_INLINE_IMAGE 2059 0.35 0.04 0.45 180 TM2_M_BODY_EMPTY 2035 0.40 0.26 0.45 181 XMDateMe_00 2005 0.40 0.27 0.44 182 XMHTML_After_End 1980 0.63 1.23 0.44 183 SpammyFromTLD_02 1975 0.91 2.39 0.44 184 MISSING_HEADERS 1975 0.60 1.11 0.44 185 SUBJ_DOLLARS 1915 0.61 1.21 0.42 186 XM_HighProb1 1887 0.71 1.62 0.42 187 XMSubMetaI_00 1879 0.66 1.45 0.42 188 URIBL_CSS 1861 0.40 0.36 0.41 189 URIBL_CSS_A 1861 0.40 0.36 0.41 190 RELAYCOUNTRY_TW 1857 0.34 0.10 0.41 191 XM_B_REG_HTML 1852 0.60 1.19 0.41 192 FILL_THIS_FORM_LONG 1831 0.53 0.92 0.40 193 XM_RXBody 1831 0.44 0.57 0.40 194 XMSubMetaSxObfu_02 1808 0.52 0.90 0.40 195 FILL_THIS_FORM_LOAN 1803 0.46 0.64 0.40 196 XMSubMetaSxObfu_03 1793 0.49 0.77 0.40 197 RDNS_DYNAMIC 1784 0.54 1.01 0.39 198 PLING_QUERY 1778 0.47 0.70 0.39 199 URI_NOVOWEL 1759 0.45 0.63 0.39 200 RCVD_IN_MSPIKE_H5 1723 0.32 0.12 0.38 ----------------------------------------------------------------------