Email: 359793 Autolearn: 0 AvgScore: 3.41 AvgScanTime: 2.12 sec Spam: 100614 Autolearn: 0 AvgScore: 12.59 AvgScanTime: 2.53 sec Ham: 259179 Autolearn: 0 AvgScore: -0.15 AvgScanTime: 1.96 sec Time Spent Running SA: 212.21 hours Time Spent Processing Spam: 70.84 hours Time Spent Processing Ham: 141.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 90915 86.95 90.36 85.62 2 DKIM_SIGNED 80527 79.80 80.04 79.71 3 XM_B_Unicode 79646 74.10 79.16 72.13 4 XM_DK_Pass 78835 78.48 78.35 78.53 5 DCC_CHECK 78179 56.30 77.70 47.99 6 DKIM_VALID 77499 76.70 77.03 76.57 7 XMListUnsubscribeExists 73048 61.29 72.60 56.90 8 DKIM_VALID_AU 60090 59.51 59.72 59.43 9 XM_DK_Undo_02 50487 26.66 50.18 17.53 10 BAYES_99 43964 23.36 43.70 15.47 11 BAYES_999 37072 20.18 36.85 13.71 12 HTML_FONT_LOW_CONTRAST 36770 33.82 36.55 32.76 13 BAYES_50 35003 46.04 34.79 50.41 14 TR_DCC_Bayes_99 34578 14.84 34.37 7.26 15 LOC_TINY_FONT_1 33230 28.92 33.03 27.32 16 MIME_HTML_ONLY 30236 25.94 30.05 24.34 17 RCVD_IN_MSPIKE_H2 29601 31.01 29.42 31.63 18 FVGT_m_MULTI_ODD 28877 24.06 28.70 22.25 19 XM_Body_Dirty_Words 25625 16.70 25.47 13.29 20 RELAYCOUNTRY_META 24083 9.76 23.94 4.26 21 T_KAM_HTML_FONT_INVALID 21735 18.92 21.60 17.87 22 XMSubLong 21089 22.28 20.96 22.79 23 DCC_CHECK_NEGATIVE 20942 42.50 20.81 50.92 24 DKIM_VALID_EF 19865 28.11 19.74 31.36 25 T_TM2_M_HEADER_IN_MSG 18449 23.40 18.34 25.36 26 UNTRUSTED_Relay 17417 5.84 17.31 1.38 27 XM_Multi_Part_URI 16868 15.36 16.77 14.81 28 BOTNET 16749 6.34 16.65 2.33 29 MultiRelay 16368 16.37 16.27 16.41 30 HTML_IMAGE_RATIO_02 16190 11.77 16.09 10.09 31 FSL_BULK_SIG 14392 10.82 14.30 9.46 32 BOTNET_IPINHOSTNAME 14359 8.60 14.27 6.39 33 XMSexyCombo_05 12326 6.64 12.25 4.46 34 XM_Evil_Numbers_Gen 11657 10.31 11.59 9.81 35 LOTS_OF_MONEY 11508 11.05 11.44 10.90 36 XM_UB50 10583 3.58 10.52 0.89 37 HTML_IMAGE_RATIO_04 9518 6.91 9.46 5.92 38 T_XMDrugObfuBody_14 8766 7.95 8.71 7.66 39 XM_UncommonTLD01 8368 6.22 8.32 5.40 40 TooManyTo_001 7788 6.60 7.74 6.16 41 XM_DIRTYINTL 7401 3.87 7.36 2.52 42 BAYES_80 7258 5.21 7.21 4.43 43 XMSubMetaSx_00 7196 4.98 7.15 4.14 44 MPART_ALT_DIFF 7091 4.84 7.05 3.98 45 XM_B_Phish_Phrases 6996 6.58 6.95 6.44 46 RCVD_IN_BL_SPAMCOP_NET 6842 2.32 6.80 0.58 47 XM_H_Long_From01 6776 6.85 6.73 6.90 48 LotsOfNums_01 6591 7.18 6.55 7.42 49 XM_SPF_SoftFail 6532 2.55 6.49 1.02 50 BAYES_60 6061 6.45 6.02 6.62 51 KHOP_HELO_FCRDNS 5578 2.29 5.54 1.02 52 SpammyFromTLD_02 5444 1.70 5.41 0.26 53 T_XMHurry_00 5339 2.10 5.31 0.85 54 FROM_EXCESS_BASE64 4913 4.58 4.88 4.46 55 RCVD_IN_PSBL 4887 1.41 4.86 0.07 56 RELAYCOUNTRY_FR 4613 1.45 4.58 0.23 57 MIME_HTML_ONLY_MULTI 4552 2.70 4.52 1.99 58 HTML_MIME_NO_HTML_TAG 4545 2.47 4.52 1.68 59 HTML_IMAGE_RATIO_06 4523 4.01 4.50 3.82 60 DKIM_ADSP_NXDOMAIN 4523 1.88 4.50 0.87 61 T_FILL_THIS_FORM_SHORT 4478 1.78 4.45 0.75 62 MIME_QP_LONG_LINE 4474 4.46 4.45 4.47 63 XM_B_SpammyTLD 4355 4.40 4.33 4.43 64 RCVD_IN_RP_SAFE 4246 11.50 4.22 14.33 65 XMBdyGiftCard01 4189 2.29 4.16 1.56 66 MIME_HTML_MOSTLY 4104 2.96 4.08 2.53 67 US_DOLLARS_3 4072 3.23 4.05 2.91 68 RELAYCOUNTRY_CA 4002 2.24 3.98 1.56 69 XMStrtUSub 3973 4.92 3.95 5.29 70 XMSubject_48 3883 1.12 3.86 0.06 71 FORM_FRAUD_3 3849 1.07 3.83 0.00 72 ADVANCE_FEE_3_NEW 3835 1.07 3.81 0.00 73 RELAYCOUNTRY_PY 3831 1.06 3.81 0.00 74 URI_HEX 3787 2.56 3.76 2.09 75 BAYES_95 3654 3.24 3.63 3.09 76 XM_SendGrid 3567 6.39 3.55 7.50 77 NO_DNS_FOR_FROM 3392 1.84 3.37 1.25 78 RCVD_IN_RP_CERTIFIED 3391 10.27 3.37 12.95 79 T_TooManySym_01 3330 5.86 3.31 6.85 80 HTML_IMAGE_RATIO_08 3132 2.25 3.11 1.91 81 DIET_1 3056 1.19 3.04 0.48 82 BOTNET_NORDNS 3049 0.86 3.03 0.01 83 DKIM_INVALID 3028 3.11 3.01 3.14 84 XMSexyCombo_01 2993 1.59 2.97 1.06 85 XMNumbers 2974 2.93 2.96 2.92 86 XMDiploma_00 2835 1.60 2.82 1.12 87 T_REMOTE_IMAGE 2819 3.18 2.80 3.33 88 XMBody_17 2811 1.50 2.79 1.00 89 MultiRelay_Combo 2724 0.87 2.71 0.16 90 MultiRelay_CC 2724 0.87 2.71 0.16 91 TM2_M_URI_OPT_OUT 2642 2.92 2.63 3.03 92 NORDNS_LOW_CONTRAST 2596 0.73 2.58 0.01 93 TR_XM_PHPDW 2586 2.42 2.57 2.36 94 XM_CamelCaseFrm001 2535 2.28 2.52 2.19 95 TR_XM_PHPForged 2425 2.36 2.41 2.33 96 TR_XM_FormFill2 2375 2.32 2.36 2.31 97 T_XMDrugObfuBody_08 2368 1.71 2.35 1.46 98 XM_H_PHPOS 2360 2.32 2.35 2.30 99 RCVD_IN_IADB_LISTED 2348 3.81 2.33 4.38 100 URI_TRY_3LD 2325 2.06 2.31 1.96 101 TR_Symld_Words 2245 1.89 2.23 1.75 102 XMSubMetaI_00 2178 1.18 2.16 0.80 103 SUBJ_ALL_CAPS 2145 2.30 2.13 2.36 104 RELAYCOUNTRY_RO 2144 0.60 2.13 0.01 105 XM_ProductURIs 2033 1.31 2.02 1.03 106 TM2_M_VERY_LONG_WORD 2018 1.70 2.01 1.57 107 XM_UB60 1965 0.59 1.95 0.07 108 URIBL_DBL_ABUSE_REDIR 1942 0.57 1.93 0.04 109 XM_URI_RBL 1919 0.90 1.91 0.52 110 XMGenDplmaNmb 1906 0.96 1.89 0.59 111 XM_UB99 1894 0.54 1.88 0.01 112 HDRS_LCASE_IMGONLY 1857 0.63 1.85 0.16 113 RCVD_IN_IADB_SPF 1815 3.25 1.80 3.81 114 SpammyFromTLD_01 1760 0.79 1.75 0.42 115 XMBrknScrpt_02 1759 0.95 1.75 0.64 116 XMSexyCombo_04 1758 0.61 1.75 0.18 117 TR_LOTS_OF_MONEY3 1734 1.04 1.72 0.78 118 ALL_TRUSTED 1731 12.03 1.72 16.03 119 MIME_HEADER_CTYPE_ONLY 1718 1.82 1.71 1.86 120 XM_H_PHPMailer 1680 0.96 1.67 0.68 121 RCVD_IN_IADB_SENDERID 1651 2.85 1.64 3.32 122 RCVD_IN_RP_RNBL 1627 0.50 1.62 0.06 123 RCVD_IN_IADB_DK 1618 2.76 1.61 3.21 124 XM_OfRef6 1614 1.70 1.60 1.74 125 DKIM_ADSP_CUSTOM_MED 1601 0.99 1.59 0.75 126 TR_XM_DK_SendGrid 1600 3.27 1.59 3.92 127 XMSlimDrugH 1594 0.70 1.58 0.35 128 PDS_TO_EQ_FROM_NAME 1591 0.46 1.58 0.02 129 XM_B_REG_HTML 1570 0.84 1.56 0.56 130 XMHTML_After_End 1560 0.70 1.55 0.37 131 BAYES_20 1552 2.25 1.54 2.53 132 TooManyTo_002 1538 1.32 1.53 1.25 133 NML_ADSP_CUSTOM_MED 1527 0.79 1.52 0.50 134 HTML_SHORT_LINK_IMG_1 1504 0.44 1.49 0.03 135 BAYES_40 1491 3.05 1.48 3.66 136 XM_UB999 1445 0.41 1.44 0.01 137 HTML_EXTRA_CLOSE 1433 0.41 1.42 0.02 138 RCVD_IN_IADB_VOUCHED 1411 2.60 1.40 3.06 139 HTML_IMAGE_ONLY_08 1408 0.48 1.40 0.13 140 RELAYCOUNTRY_AT 1394 0.54 1.39 0.21 141 XM_H_PHPOS_M 1377 0.55 1.37 0.24 142 TR_XM_RelayPhish 1371 1.03 1.36 0.90 143 XM_H_Long_From02 1349 1.03 1.34 0.91 144 FROM_SUSPICIOUS_NTLD 1331 0.40 1.32 0.04 145 FROM_SUSPICIOUS_NTLD_FP 1295 0.39 1.29 0.04 146 TooManyTo_003 1283 0.95 1.28 0.83 147 BODY_ENHANCEMENT 1268 0.39 1.26 0.06 148 XMHTMLBadTable_001 1217 0.72 1.21 0.53 149 HTML_TAG_BALANCE_BODY 1196 0.92 1.19 0.81 150 URIBL_BLACK 1185 0.40 1.18 0.10 151 THIS_AD 1171 0.43 1.16 0.14 152 MAILING_LIST_MULTI 1166 1.53 1.16 1.68 153 XMPhish30 1151 0.81 1.14 0.68 154 T_XMDrugObfuBody_00 1149 2.08 1.14 2.44 155 XMStockSpam_06 1141 0.93 1.13 0.84 156 TooManyTo_004 1130 0.79 1.12 0.67 157 XMPhish11 1109 1.10 1.10 1.10 158 DATE_IN_PAST_03_06 1079 0.39 1.07 0.12 159 XMSubGiftCard1 1062 0.43 1.06 0.19 160 XMMoneyMeta_00 1049 0.50 1.04 0.29 161 NUMERIC_HTTP_ADDR 1036 0.45 1.03 0.22 162 REMOVE_BEFORE_LINK 1031 0.50 1.02 0.30 163 XMSubGiftCard2 1018 0.41 1.01 0.17 164 XMWghtMeta_00 1010 0.33 1.00 0.06 165 TR_Mismatch_TLD_02 1004 0.33 1.00 0.07 166 XM_UB80 997 0.29 0.99 0.02 167 XM_Lotto 979 0.33 0.97 0.08 168 UNPARSEABLE_RELAY 978 3.18 0.97 4.03 169 T_MONEY_PERCENT 958 0.57 0.95 0.42 170 TR_LOTS_OF_MONEY2 958 0.57 0.95 0.42 171 URIBL_DBL_SPAM 955 0.27 0.95 0.01 172 URI_WP_HACKED 947 0.27 0.94 0.01 173 XMBody_78 934 0.71 0.93 0.63 174 TooManyTo_005 931 0.68 0.93 0.58 175 HTML_FONT_FACE_BAD 920 0.73 0.91 0.67 176 RDNS_DYNAMIC 909 0.68 0.90 0.60 177 XMSubMetaSxObfu_03 895 0.47 0.89 0.31 178 RELAYCOUNTRY_DE 868 0.43 0.86 0.26 179 T_Symld_Words_02 851 0.74 0.85 0.70 180 TR_Caps_n_Bayes_99 844 0.52 0.84 0.39 181 XMPhish14 822 0.58 0.82 0.49 182 XMSubMetaSSx_00 821 0.42 0.82 0.26 183 BODY_QUOTE_MALF_MSGID 808 0.70 0.80 0.66 184 PLING_QUERY 805 0.64 0.80 0.58 185 RCVD_IN_IADB_OPTIN 787 1.62 0.78 1.94 186 NORMAL_HTTP_TO_IP 787 0.24 0.78 0.03 187 TM2_M_A_HREF_HREF 787 1.17 0.78 1.32 188 XMSubject_09 769 0.24 0.76 0.03 189 XM_B_COPY_HTML 767 0.73 0.76 0.72 190 URI_NOVOWEL 756 0.48 0.75 0.37 191 FORGED_GMAIL_RCVD 730 0.50 0.73 0.41 192 T_TooManySym_02 721 1.83 0.72 2.27 193 TR_MetaPhish_Combo_01 717 1.84 0.71 2.27 194 EXCUSE_4 714 0.20 0.71 0.00 195 BAYES_05 686 1.42 0.68 1.70 196 XM_XX_Yahoo 682 0.31 0.68 0.17 197 XMLngstWrd_00 679 0.44 0.67 0.34 198 HK_RANDOM_REPLYTO 670 0.36 0.67 0.24 199 DATE_IN_PAST_12_24 667 0.24 0.66 0.07 200 BAYES_00 667 8.59 0.66 11.67 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 221911 86.95 90.36 85.62 2 DKIM_SIGNED 206594 79.80 80.04 79.71 3 XM_DK_Pass 203525 78.48 78.35 78.53 4 DKIM_VALID 198446 76.70 77.03 76.57 5 XM_B_Unicode 186946 74.10 79.16 72.13 6 DKIM_VALID_AU 154029 59.51 59.72 59.43 7 XMListUnsubscribeExists 147468 61.29 72.60 56.90 8 DCC_CHECK_NEGATIVE 131984 42.50 20.81 50.92 9 BAYES_50 130644 46.04 34.79 50.41 10 DCC_CHECK 124373 56.30 77.70 47.99 11 HTML_FONT_LOW_CONTRAST 84898 33.82 36.55 32.76 12 RCVD_IN_MSPIKE_H2 81974 31.01 29.42 31.63 13 DKIM_VALID_EF 81287 28.11 19.74 31.36 14 LOC_TINY_FONT_1 70810 28.92 33.03 27.32 15 T_TM2_M_HEADER_IN_MSG 65730 23.40 18.34 25.36 16 MIME_HTML_ONLY 63087 25.94 30.05 24.34 17 XMSubLong 59063 22.28 20.96 22.79 18 FVGT_m_MULTI_ODD 57676 24.06 28.70 22.25 19 T_KAM_HTML_FONT_INVALID 46321 18.92 21.60 17.87 20 XM_DK_Undo_02 45438 26.66 50.18 17.53 21 MultiRelay 42540 16.37 16.27 16.41 22 ALL_TRUSTED 41535 12.03 1.72 16.03 23 BAYES_99 40088 23.36 43.70 15.47 24 XM_Multi_Part_URI 38391 15.36 16.77 14.81 25 RCVD_IN_RP_SAFE 37142 11.50 4.22 14.33 26 BAYES_999 35526 20.18 36.85 13.71 27 XM_Body_Dirty_Words 34450 16.70 25.47 13.29 28 RCVD_IN_RP_CERTIFIED 33574 10.27 3.37 12.95 29 BAYES_00 30247 8.59 0.66 11.67 30 XM_DKIMWhitelistDomains 29755 8.28 0.03 11.48 31 LOTS_OF_MONEY 28248 11.05 11.44 10.90 32 TR_XM_DK_Bayes 27800 7.85 0.44 10.73 33 TR_XM_DK_Bayes1 27304 7.71 0.44 10.53 34 HTML_IMAGE_RATIO_02 26141 11.77 16.09 10.09 35 XM_Evil_Numbers_Gen 25420 10.31 11.59 9.81 36 FSL_BULK_SIG 24526 10.82 14.30 9.46 37 TO_MALFORMED 24092 6.73 0.11 9.30 38 TR_XM_DK_Bayes2 24009 6.75 0.29 9.26 39 T_XMDrugObfuBody_14 19851 7.95 8.71 7.66 40 XM_SendGrid 19440 6.39 3.55 7.50 41 LotsOfNums_01 19240 7.18 6.55 7.42 42 TR_DCC_Bayes_99 18828 14.84 34.37 7.26 43 XM_H_Long_From01 17875 6.85 6.73 6.90 44 T_TooManySym_01 17754 5.86 3.31 6.85 45 BAYES_60 17154 6.45 6.02 6.62 46 XM_B_Phish_Phrases 16696 6.58 6.95 6.44 47 BOTNET_IPINHOSTNAME 16568 8.60 14.27 6.39 48 TooManyTo_001 15967 6.60 7.74 6.16 49 HTML_IMAGE_RATIO_04 15337 6.91 9.46 5.92 50 XM_UncommonTLD01 13995 6.22 8.32 5.40 51 XMStrtUSub 13714 4.92 3.95 5.29 52 MIME_QP_LONG_LINE 11573 4.46 4.45 4.47 53 FROM_EXCESS_BASE64 11570 4.58 4.88 4.46 54 XMSexyCombo_05 11559 6.64 12.25 4.46 55 XM_B_SpammyTLD 11490 4.40 4.33 4.43 56 BAYES_80 11486 5.21 7.21 4.43 57 RCVD_IN_IADB_LISTED 11363 3.81 2.33 4.38 58 RELAYCOUNTRY_META 11030 9.76 23.94 4.26 59 XMSubMetaSx_00 10733 4.98 7.15 4.14 60 INVALID_MSGID 10678 3.00 0.12 4.12 61 UNPARSEABLE_RELAY 10447 3.18 0.97 4.03 62 MPART_ALT_DIFF 10319 4.84 7.05 3.98 63 TR_XM_DK_SendGrid 10157 3.27 1.59 3.92 64 HTML_IMAGE_RATIO_06 9891 4.01 4.50 3.82 65 RCVD_IN_IADB_SPF 9870 3.25 1.80 3.81 66 IN_ZIMBRA_NJ_WHITELIST 9781 2.72 0.02 3.77 67 BAYES_40 9491 3.05 1.48 3.66 68 TVD_RCVD_IP 8886 2.62 0.53 3.43 69 T_REMOTE_IMAGE 8635 3.18 2.80 3.33 70 RCVD_IN_IADB_SENDERID 8593 2.85 1.64 3.32 71 RCVD_IN_IADB_DK 8315 2.76 1.61 3.21 72 DKIM_INVALID 8148 3.11 3.01 3.14 73 BAYES_95 8001 3.24 3.63 3.09 74 RCVD_IN_IADB_VOUCHED 7940 2.60 1.40 3.06 75 TM2_M_URI_OPT_OUT 7864 2.92 2.63 3.03 76 XMNumbers 7572 2.93 2.96 2.92 77 US_DOLLARS_3 7532 3.23 4.05 2.91 78 MIME_HTML_MOSTLY 6561 2.96 4.08 2.53 79 BAYES_20 6555 2.25 1.54 2.53 80 XM_DIRTYINTL 6536 3.87 7.36 2.52 81 T_XMDrugObfuBody_00 6330 2.08 1.14 2.44 82 SUBJ_ALL_CAPS 6122 2.30 2.13 2.36 83 TR_XM_PHPDW 6108 2.42 2.57 2.36 84 XM_PDF 6058 1.76 0.29 2.34 85 TR_XM_PHPForged 6051 2.36 2.41 2.33 86 BOTNET 6048 6.34 16.65 2.33 87 TR_XM_FormFill2 5980 2.32 2.36 2.31 88 XM_H_PHPOS 5974 2.32 2.35 2.30 89 TR_MetaPhish_Combo_01 5894 1.84 0.71 2.27 90 T_TooManySym_02 5871 1.83 0.72 2.27 91 XM_CamelCaseFrm001 5681 2.28 2.52 2.19 92 URI_HEX 5417 2.56 3.76 2.09 93 MIME_HTML_ONLY_MULTI 5165 2.70 4.52 1.99 94 URI_TRY_3LD 5089 2.06 2.31 1.96 95 RCVD_IN_IADB_OPTIN 5025 1.62 0.78 1.94 96 HTML_IMAGE_RATIO_08 4954 2.25 3.11 1.91 97 IN_HORDE_ADDRESS_BOOK 4953 1.39 0.03 1.91 98 MIME_HEADER_CTYPE_ONLY 4831 1.82 1.71 1.86 99 USER_IN_DEF_DKIM_WL 4701 1.31 0.02 1.81 100 TR_Symld_Words 4546 1.89 2.23 1.75 101 XM_OfRef6 4516 1.70 1.60 1.74 102 BAYES_05 4418 1.42 0.68 1.70 103 HTML_MIME_NO_HTML_TAG 4358 2.47 4.52 1.68 104 MAILING_LIST_MULTI 4347 1.53 1.16 1.68 105 TM2_M_VERY_LONG_WORD 4082 1.70 2.01 1.57 106 RELAYCOUNTRY_CA 4048 2.24 3.98 1.56 107 XMBdyGiftCard01 4043 2.29 4.16 1.56 108 T_XMDrugObfuBody_08 3782 1.71 2.35 1.46 109 XM_DK_Undo_01 3745 1.21 0.62 1.44 110 UNTRUSTED_Relay 3580 5.84 17.31 1.38 111 ANY_BOUNCE_MESSAGE 3516 1.07 0.32 1.36 112 BOUNCE_MESSAGE 3515 1.07 0.32 1.36 113 TM2_M_A_HREF_HREF 3434 1.17 0.78 1.32 114 NO_DNS_FOR_FROM 3240 1.84 3.37 1.25 115 TooManyTo_002 3227 1.32 1.53 1.25 116 XMDiploma_00 2915 1.60 2.82 1.12 117 XMPhish11 2861 1.10 1.10 1.10 118 XM_GoogleGroups 2817 0.91 0.44 1.09 119 XMSexyCombo_01 2742 1.59 2.97 1.06 120 XM_ProductURIs 2667 1.31 2.02 1.03 121 XM_SPF_SoftFail 2648 2.55 6.49 1.02 122 KHOP_HELO_FCRDNS 2647 2.29 5.54 1.02 123 LOW_PRICE 2584 0.83 0.40 1.00 124 XMBody_17 2582 1.50 2.79 1.00 125 FILL_THIS_FORM 2580 0.88 0.60 1.00 126 SUBJ_DOLLARS 2504 0.87 0.61 0.97 127 XM_H_Long_From02 2348 1.03 1.34 0.91 128 TR_XM_RelayPhish 2339 1.03 1.36 0.90 129 XM_UB50 2300 3.58 10.52 0.89 130 XMBody_95 2269 0.67 0.14 0.88 131 USER_IN_WHITELIST 2268 0.63 0.00 0.88 132 DKIM_ADSP_NXDOMAIN 2259 1.88 4.50 0.87 133 T_XMHurry_00 2209 2.10 5.31 0.85 134 XMStockSpam_06 2189 0.93 1.13 0.84 135 TooManyTo_003 2147 0.95 1.28 0.83 136 HTML_TAG_BALANCE_BODY 2107 0.92 1.19 0.81 137 XMSubMetaI_00 2068 1.18 2.16 0.80 138 T_TooManySym_03 2053 0.62 0.19 0.79 139 TR_LOTS_OF_MONEY3 2016 1.04 1.72 0.78 140 DKIM_ADSP_CUSTOM_MED 1946 0.99 1.59 0.75 141 T_FILL_THIS_FORM_SHORT 1942 1.78 4.45 0.75 142 HELO_NODOT 1878 0.62 0.35 0.72 143 HELO_NO_DOMAIN 1877 0.62 0.35 0.72 144 XM_B_COPY_HTML 1866 0.73 0.76 0.72 145 T_Symld_Words_02 1826 0.74 0.85 0.70 146 XMPhish30 1774 0.81 1.14 0.68 147 XM_H_PHPMailer 1762 0.96 1.67 0.68 148 XMSubMetaSxObfu_02 1747 0.67 0.65 0.67 149 TooManyTo_004 1729 0.79 1.12 0.67 150 HTML_FONT_FACE_BAD 1724 0.73 0.91 0.67 151 BODY_QUOTE_MALF_MSGID 1721 0.70 0.80 0.66 152 XM_D_tchamptons_WL 1708 0.47 0.00 0.66 153 XMBrknScrpt_02 1646 0.95 1.75 0.64 154 XMBody_78 1634 0.71 0.93 0.63 155 RDNS_DYNAMIC 1543 0.68 0.90 0.60 156 XMGenDplmaNmb 1537 0.96 1.89 0.59 157 TooManyTo_005 1516 0.68 0.93 0.58 158 PLING_QUERY 1512 0.64 0.80 0.58 159 RCVD_IN_BL_SPAMCOP_NET 1506 2.32 6.80 0.58 160 HTTPS_HTTP_MISMATCH 1502 0.56 0.51 0.58 161 XM_B_REG_HTML 1457 0.84 1.56 0.56 162 RELAYCOUNTRY_GB 1370 0.56 0.64 0.53 163 XMHTMLBadTable_001 1369 0.72 1.21 0.53 164 XM_URI_RBL 1337 0.90 1.91 0.52 165 NML_ADSP_CUSTOM_MED 1305 0.79 1.52 0.50 166 RELAYCOUNTRY_AU 1281 0.50 0.50 0.49 167 T_FILL_THIS_FORM_LONG 1278 0.44 0.29 0.49 168 T_FILL_THIS_FORM_LOAN 1271 0.42 0.25 0.49 169 XMPhish14 1258 0.58 0.82 0.49 170 DIET_1 1232 1.19 3.04 0.48 171 SpammyFromTLD_01 1100 0.79 1.75 0.42 172 T_MONEY_PERCENT 1089 0.57 0.95 0.42 173 TR_LOTS_OF_MONEY2 1089 0.57 0.95 0.42 174 XMCapTrack 1066 0.34 0.17 0.41 175 FORGED_GMAIL_RCVD 1062 0.50 0.73 0.41 176 TR_Caps_n_Bayes_99 1014 0.52 0.84 0.39 177 XMNoVowels 1007 0.38 0.37 0.39 178 XMBSHREFv2 978 0.34 0.25 0.38 179 URI_NOVOWEL 956 0.48 0.75 0.37 180 XMHTML_After_End 954 0.70 1.55 0.37 181 XM_Akamai 940 0.26 0.00 0.36 182 XM_Body_Obfu01 926 0.35 0.32 0.36 183 XMSlimDrugH 915 0.70 1.58 0.35 184 T_OBFU_PDF_ATTACH 913 0.28 0.11 0.35 185 HTML_IMAGE_ONLY_24 908 0.35 0.36 0.35 186 TM2_M_BODY_EMPTY 892 0.27 0.10 0.34 187 XMLngstWrd_00 890 0.44 0.67 0.34 188 TR_MetaPhish_Combo_01b 886 0.28 0.13 0.34 189 UPPERCASE_50_75 858 0.30 0.21 0.33 190 T_TooManySym_04 857 0.24 0.02 0.33 191 MPART_ALT_DIFF_COUNT 845 0.38 0.50 0.33 192 XM_ShortIntro_01 839 0.38 0.51 0.32 193 TVD_APPROVED 820 0.25 0.09 0.32 194 XM_OfRef7 816 0.34 0.41 0.31 195 XMSubMetaSxObfu_03 807 0.47 0.89 0.31 196 XMLngstWrd_01 803 0.40 0.65 0.31 197 XMSolicitRefs_0 787 0.40 0.66 0.30 198 REMOVE_BEFORE_LINK 778 0.50 1.02 0.30 199 XMMoneyMeta_00 756 0.50 1.04 0.29 200 GAPPY_SUBJECT 749 0.22 0.04 0.29 ----------------------------------------------------------------------