Email: 588930 Autolearn: 0 AvgScore: 1.13 AvgScanTime: 2.03 sec Spam: 91027 Autolearn: 0 AvgScore: 12.50 AvgScanTime: 2.81 sec Ham: 497903 Autolearn: 0 AvgScore: -0.95 AvgScanTime: 1.89 sec Time Spent Running SA: 331.84 hours Time Spent Processing Spam: 70.99 hours Time Spent Processing Ham: 260.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84076 87.59 92.36 86.72 2 DCC_CHECK 71011 49.01 78.01 43.70 3 DKIM_SIGNED 67828 75.72 74.51 75.95 4 XM_B_Unicode 66902 69.91 73.50 69.25 5 XM_DK_Pass 62595 73.83 68.77 74.75 6 XMListUnsubscribeExists 61923 55.17 68.03 52.82 7 DKIM_VALID 58639 70.05 64.42 71.08 8 BAYES_50 47556 51.48 52.24 51.34 9 DKIM_VALID_AU 43985 51.38 48.32 51.94 10 XM_B_Unicode3 43286 42.25 47.55 41.27 11 MIME_HTML_ONLY 33667 25.64 36.99 23.57 12 HTML_FONT_LOW_CONTRAST 33476 30.07 36.78 28.85 13 LOC_TINY_FONT_1 29757 25.45 32.69 24.12 14 XM_DK_Undo_02 26881 8.97 29.53 5.21 15 RELAYCOUNTRY_META 25653 9.11 28.18 5.63 16 XM_Body_Dirty_Words 24014 16.11 26.38 14.23 17 XMSubLong 23153 24.40 25.44 24.20 18 FVGT_m_MULTI_ODD 22236 21.64 24.43 21.13 19 BOTNET_IPINHOSTNAME 19326 7.35 21.23 4.81 20 BOTNET 18764 5.03 20.61 2.18 21 MultiRelay 18594 18.89 20.43 18.61 22 T_KAM_HTML_FONT_INVALID 18504 17.71 20.33 17.23 23 DKIM_VALID_EF 18409 25.93 20.22 26.97 24 DCC_CHECK_NEGATIVE 17943 49.25 19.71 54.65 25 UNTRUSTED_Relay 17064 4.39 18.75 1.77 26 BAYES_99 16737 5.17 18.39 2.76 27 T_TM2_M_HEADER_IN_MSG 16558 26.46 18.19 27.98 28 XM_Multi_Part_URI 16435 13.23 18.06 12.35 29 FSL_BULK_SIG 14380 9.22 15.80 8.02 30 TR_DCC_Bayes_99 12921 3.31 14.19 1.32 31 XMSexyCombo_05 12801 6.16 14.06 4.72 32 BAYES_999 12602 4.06 13.84 2.27 33 HTML_IMAGE_RATIO_02 12423 9.44 13.65 8.67 34 LOTS_OF_MONEY 11926 10.47 13.10 9.99 35 XM_UncommonTLD01 11809 5.37 12.97 3.99 36 XM_Evil_Numbers_Gen 11800 9.62 12.96 9.01 37 XM_UB50 9718 2.41 10.68 0.90 38 XM_DIRTYINTL 9542 4.48 10.48 3.38 39 T_XMDrugObfuBody_14 9283 8.12 10.20 7.74 40 DKIM_INVALID 9189 5.67 10.09 4.87 41 XMSubMetaSx_00 8376 4.34 9.20 3.45 42 XM_B_Phish_Phrases 7575 6.74 8.32 6.45 43 SpammyFromTLD_02 7575 1.78 8.32 0.59 44 MPART_ALT_DIFF 7260 5.19 7.98 4.68 45 XM_B_SpammyTLD 7256 4.29 7.97 3.62 46 HTML_IMAGE_RATIO_04 6997 6.32 7.69 6.07 47 TooManyTo_001 6827 7.47 7.50 7.46 48 XM_H_Long_From01 6761 6.22 7.43 5.99 49 LotsOfNums_01 6576 8.12 7.22 8.29 50 RCVD_IN_MSPIKE_H2 6238 6.96 6.85 6.98 51 XMNumbers 5665 3.76 6.22 3.30 52 MIME_QP_LONG_LINE 5664 5.83 6.22 5.76 53 T_REMOTE_IMAGE 5616 4.07 6.17 3.69 54 HTML_MIME_NO_HTML_TAG 5298 3.51 5.82 3.08 55 RCVD_IN_BL_SPAMCOP_NET 4839 1.46 5.32 0.75 56 BAYES_40 4793 6.12 5.27 6.28 57 MIME_HTML_ONLY_MULTI 4549 3.34 5.00 3.04 58 XM_SPF_SoftFail 4543 2.22 4.99 1.72 59 RCVD_IN_PSBL 4434 0.79 4.87 0.05 60 BAYES_80 4370 2.42 4.80 1.99 61 BAYES_00 4307 21.09 4.73 24.07 62 XMSexyCombo_01 4279 1.29 4.70 0.66 63 DKIM_ADSP_NXDOMAIN 4216 1.14 4.63 0.50 64 FSL_THIS_IS_ADV 4114 0.98 4.52 0.33 65 BAYES_20 4100 4.93 4.50 5.01 66 HDRS_LCASE_IMGONLY 4044 0.72 4.44 0.04 67 RELAYCOUNTRY_FR 4025 0.96 4.42 0.33 68 TM2_M_URI_OPT_OUT 4014 4.43 4.41 4.44 69 BAYES_60 3931 3.97 4.32 3.91 70 MultiRelay_CC 3883 0.85 4.27 0.23 71 MultiRelay_Combo 3883 0.85 4.27 0.23 72 BOTNET_NORDNS 3866 0.69 4.25 0.04 73 XM_SendGrid 3858 6.10 4.24 6.44 74 HTML_SHORT_LINK_IMG_1 3851 0.69 4.23 0.04 75 XM_URI_RBL 3843 0.99 4.22 0.39 76 XM_CamelCaseFrm001 3645 2.23 4.00 1.90 77 RCVD_IN_RP_RNBL 3579 0.64 3.93 0.04 78 RELAYCOUNTRY_CA 3566 2.02 3.92 1.67 79 TR_XM_PHPDW 3557 1.07 3.91 0.55 80 NUMERIC_HTTP_ADDR 3544 0.88 3.89 0.32 81 TR_XM_PHPForged 3480 1.04 3.82 0.53 82 MIME_HTML_MOSTLY 3469 2.50 3.81 2.26 83 TR_XM_FormFill2 3442 1.03 3.78 0.53 84 XM_H_PHPOS 3439 1.02 3.78 0.52 85 FROM_EXCESS_BASE64 3332 3.26 3.66 3.18 86 THIS_AD 3312 0.83 3.64 0.32 87 XMBdyGiftCard01 3282 1.67 3.61 1.31 88 HTML_IMAGE_RATIO_06 3272 3.56 3.59 3.55 89 KHOP_HELO_FCRDNS 3090 2.15 3.39 1.92 90 MIME_HEADER_CTYPE_ONLY 2990 0.57 3.28 0.07 91 REPLYTO_WITHOUT_TO_CC 2972 0.55 3.26 0.05 92 NORDNS_LOW_CONTRAST 2950 0.51 3.24 0.01 93 URI_HEX 2946 2.21 3.24 2.02 94 XMStrtUSub 2927 3.93 3.22 4.06 95 SpammyFromTLD_01 2837 1.12 3.12 0.76 96 NO_DNS_FOR_FROM 2655 1.43 2.92 1.16 97 T_XMDrugObfuBody_08 2610 2.10 2.87 1.96 98 NORMAL_HTTP_TO_IP 2607 0.48 2.86 0.04 99 XM_BadFromFormat 2585 0.55 2.84 0.13 100 BODY_URI_ONLY 2571 0.54 2.82 0.13 101 BAYES_95 2528 1.35 2.78 1.09 102 SUBJ_ALL_CAPS 2482 2.30 2.73 2.22 103 BAYES_05 2456 3.22 2.70 3.31 104 ALL_TRUSTED 2416 13.18 2.65 15.10 105 T_TooManySym_01 2402 5.77 2.64 6.34 106 T_XMHurry_00 2389 0.84 2.62 0.51 107 T_XMDrugObfuBody_00 2378 1.10 2.61 0.83 108 XMDiploma_00 2309 1.83 2.54 1.70 109 TR_XM_RelayPhish 2282 1.13 2.51 0.88 110 HTML_IMAGE_ONLY_12 2280 0.53 2.50 0.17 111 HTML_IMAGE_RATIO_08 2268 2.28 2.49 2.24 112 EXCUSE_4 2246 0.39 2.47 0.01 113 XM_OfRef6 2204 1.74 2.42 1.62 114 TR_XM_DK_SendGrid 2087 3.15 2.29 3.31 115 HTML_IMAGE_ONLY_08 2070 0.44 2.27 0.10 116 TR_XM_DK_Bayes 2063 16.27 2.27 18.83 117 TM2_M_VERY_LONG_WORD 2047 1.39 2.25 1.23 118 RELAYCOUNTRY_DE 2023 0.63 2.22 0.34 119 TR_LOTS_OF_MONEY2 1961 0.55 2.15 0.26 120 T_MONEY_PERCENT 1961 0.55 2.15 0.26 121 XMMoneyMeta_00 1899 0.72 2.09 0.47 122 TO_EQ_FM_DOM_HTML_IMG 1877 0.32 2.06 0.00 123 RELAYCOUNTRY_FI 1875 0.34 2.06 0.03 124 TR_XM_DK_Bayes1 1852 15.45 2.03 17.91 125 RELAYCOUNTRY_NL 1797 0.46 1.97 0.18 126 XM_GoogleGroups 1720 1.25 1.89 1.13 127 DIET_1 1719 0.55 1.89 0.31 128 XMStockSpam_06 1684 1.38 1.85 1.30 129 XMGenDplmaNmb 1653 1.14 1.82 1.02 130 RCVD_IN_MSPIKE_BL 1651 0.32 1.81 0.05 131 RCVD_IN_RP_SAFE 1605 8.45 1.76 9.67 132 RCVD_IN_MSPIKE_L5 1577 0.28 1.73 0.02 133 XM_H_Long_From02 1576 1.18 1.73 1.08 134 XMClaimOffer 1567 0.41 1.72 0.17 135 RELAYCOUNTRY_GB 1557 1.20 1.71 1.11 136 XMSubGiftCard1 1532 0.41 1.68 0.18 137 RCVD_IN_IADB_LISTED 1531 4.67 1.68 5.22 138 XM_H_PHPMailer 1497 0.66 1.64 0.48 139 XM_ShortIntro_01 1488 0.67 1.63 0.49 140 RDNS_DYNAMIC 1488 0.61 1.63 0.43 141 RCVD_IN_IADB_SPF 1453 4.02 1.60 4.46 142 XMSubject_48 1444 0.28 1.59 0.04 143 RCVD_IN_IADB_SENDERID 1421 3.51 1.56 3.86 144 RCVD_IN_IADB_DK 1421 3.46 1.56 3.80 145 XMSubMetaSxObfu_03 1388 0.62 1.52 0.46 146 XMBody_78 1384 0.66 1.52 0.50 147 XMPhish11 1373 1.15 1.51 1.08 148 SUBJECT_NEEDS_ENCODING 1339 0.24 1.47 0.02 149 SUBJ_ILLEGAL_CHARS 1339 0.24 1.47 0.02 150 DKIM_ADSP_CUSTOM_MED 1334 1.13 1.47 1.07 151 DATE_IN_PAST_03_06 1309 0.39 1.44 0.20 152 TR_XM_INV_DKIM 1301 0.33 1.43 0.13 153 XM_H_PHPOS_M 1288 0.35 1.41 0.16 154 TR_Symld_Words 1283 1.82 1.41 1.89 155 HK_SCAM 1278 0.23 1.40 0.02 156 MISSING_HEADERS 1264 0.55 1.39 0.39 157 URIBL_DBL_ABUSE_REDIR 1255 0.22 1.38 0.01 158 FILL_THIS_FORM 1253 0.87 1.38 0.77 159 XMBody_17 1228 0.88 1.35 0.79 160 XMBrknScrpt_02 1225 0.80 1.35 0.71 161 FORGED_GMAIL_RCVD 1217 0.65 1.34 0.53 162 XMSubMetaI_00 1213 0.92 1.33 0.84 163 URI_TRY_3LD 1200 1.38 1.32 1.40 164 DATE_IN_PAST_06_12 1197 0.31 1.31 0.13 165 RCVD_IN_SORBS_DUL 1184 0.48 1.30 0.33 166 XM_DK_Undo_01 1178 1.55 1.29 1.59 167 MAILING_LIST_MULTI 1151 2.05 1.26 2.19 168 XMSubMetaSx_01 1125 0.25 1.24 0.07 169 XM_UB60 1117 0.24 1.23 0.06 170 XMSexyCombo_04 1099 0.25 1.21 0.08 171 NML_ADSP_CUSTOM_MED 1089 0.87 1.20 0.81 172 FROM_ADDR_WS 1081 0.21 1.19 0.03 173 RELAYCOUNTRY_GR 1077 0.18 1.18 0.00 174 XM_UB99 1050 0.19 1.15 0.01 175 XMPhish30 1050 0.69 1.15 0.60 176 HELO_NODOT 1050 1.34 1.15 1.37 177 XMGppyBdWords 1046 0.41 1.15 0.28 178 HELO_NO_DOMAIN 1040 1.34 1.14 1.37 179 RCVD_IN_MSPIKE_WL 1035 4.40 1.14 5.00 180 XMSexyCombo_02 1028 0.20 1.13 0.03 181 RELAYCOUNTRY_NG 1009 0.17 1.11 0.00 182 TooManyTo_002 995 1.71 1.09 1.83 183 FROM_SUSPICIOUS_NTLD 975 0.19 1.07 0.03 184 RELAYCOUNTRY_AT 954 0.38 1.05 0.26 185 HK_RANDOM_REPLYTO 941 0.37 1.03 0.24 186 URIBL_BLACK 936 0.18 1.03 0.02 187 RELAYCOUNTRY_BG 932 0.18 1.02 0.03 188 RCVD_IN_MSPIKE_H3 918 4.04 1.01 4.59 189 TR_Mismatch_TLD_02 895 0.23 0.98 0.09 190 BASE64_LENGTH_79_INF 890 0.32 0.98 0.20 191 RELAYCOUNTRY_RU 888 0.17 0.98 0.03 192 TR_XM_DK_Bayes2 887 12.70 0.97 14.84 193 RELAYCOUNTRY_IN 871 0.30 0.96 0.18 194 UNPARSEABLE_RELAY 869 2.26 0.95 2.50 195 FROM_SUSPICIOUS_NTLD_FP 857 0.17 0.94 0.03 196 XM_XX_Yahoo 833 0.33 0.92 0.23 197 HTML_TEXT_INVISIBLE_STYLE 830 0.20 0.91 0.07 198 TVD_RCVD_IP 821 1.84 0.90 2.01 199 TR_LOTS_OF_MONEY3 818 0.49 0.90 0.42 200 TR_Mismatch_TLD_01 810 0.31 0.89 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 431778 87.59 92.36 86.72 2 DKIM_SIGNED 378135 75.72 74.51 75.95 3 XM_DK_Pass 372202 73.83 68.77 74.75 4 DKIM_VALID 353909 70.05 64.42 71.08 5 XM_B_Unicode 344793 69.91 73.50 69.25 6 DCC_CHECK_NEGATIVE 272090 49.25 19.71 54.65 7 XMListUnsubscribeExists 262989 55.17 68.03 52.82 8 DKIM_VALID_AU 258598 51.38 48.32 51.94 9 BAYES_50 255618 51.48 52.24 51.34 10 DCC_CHECK 217600 49.01 78.01 43.70 11 XM_B_Unicode3 205508 42.25 47.55 41.27 12 HTML_FONT_LOW_CONTRAST 143630 30.07 36.78 28.85 13 T_TM2_M_HEADER_IN_MSG 139298 26.46 18.19 27.98 14 DKIM_VALID_EF 134275 25.93 20.22 26.97 15 XMSubLong 120517 24.40 25.44 24.20 16 LOC_TINY_FONT_1 120106 25.45 32.69 24.12 17 BAYES_00 119870 21.09 4.73 24.07 18 MIME_HTML_ONLY 117352 25.64 36.99 23.57 19 FVGT_m_MULTI_ODD 105209 21.64 24.43 21.13 20 TR_XM_DK_Bayes 93775 16.27 2.27 18.83 21 MultiRelay 92660 18.89 20.43 18.61 22 TR_XM_DK_Bayes1 89154 15.45 2.03 17.91 23 T_KAM_HTML_FONT_INVALID 85799 17.71 20.33 17.23 24 ALL_TRUSTED 75180 13.18 2.65 15.10 25 TR_XM_DK_Bayes2 73882 12.70 0.97 14.84 26 XM_Body_Dirty_Words 70862 16.11 26.38 14.23 27 XM_Multi_Part_URI 61485 13.23 18.06 12.35 28 LOTS_OF_MONEY 49734 10.47 13.10 9.99 29 RCVD_IN_RP_SAFE 48168 8.45 1.76 9.67 30 XM_Evil_Numbers_Gen 44879 9.62 12.96 9.01 31 HTML_IMAGE_RATIO_02 43162 9.44 13.65 8.67 32 LotsOfNums_01 41262 8.12 7.22 8.29 33 RCVD_IN_RP_CERTIFIED 40269 6.96 0.81 8.09 34 FSL_BULK_SIG 39925 9.22 15.80 8.02 35 T_XMDrugObfuBody_14 38513 8.12 10.20 7.74 36 XM_DKIMWhitelistDomains 38117 6.48 0.04 7.66 37 TooManyTo_001 37156 7.47 7.50 7.46 38 RCVD_IN_MSPIKE_H2 34763 6.96 6.85 6.98 39 XM_B_Phish_Phrases 32102 6.74 8.32 6.45 40 XM_SendGrid 32069 6.10 4.24 6.44 41 T_TooManySym_01 31577 5.77 2.64 6.34 42 BAYES_40 31265 6.12 5.27 6.28 43 HTML_IMAGE_RATIO_04 30234 6.32 7.69 6.07 44 XM_H_Long_From01 29843 6.22 7.43 5.99 45 MIME_QP_LONG_LINE 28694 5.83 6.22 5.76 46 RELAYCOUNTRY_META 28011 9.11 28.18 5.63 47 RCVD_IN_IADB_LISTED 25988 4.67 1.68 5.22 48 XM_DK_Undo_02 25939 8.97 29.53 5.21 49 XM_PDF 25387 4.43 0.79 5.10 50 BAYES_20 24933 4.93 4.50 5.01 51 RCVD_IN_MSPIKE_WL 24894 4.40 1.14 5.00 52 DKIM_INVALID 24226 5.67 10.09 4.87 53 BOTNET_IPINHOSTNAME 23956 7.35 21.23 4.81 54 XMSexyCombo_05 23504 6.16 14.06 4.72 55 MPART_ALT_DIFF 23319 5.19 7.98 4.68 56 RCVD_IN_MSPIKE_H3 22852 4.04 1.01 4.59 57 RCVD_IN_IADB_SPF 22229 4.02 1.60 4.46 58 TM2_M_URI_OPT_OUT 22087 4.43 4.41 4.44 59 IN_ZIMBRA_NJ_WHITELIST 21652 3.68 0.03 4.35 60 XMStrtUSub 20219 3.93 3.22 4.06 61 XM_UncommonTLD01 19844 5.37 12.97 3.99 62 BAYES_60 19448 3.97 4.32 3.91 63 RCVD_IN_IADB_SENDERID 19235 3.51 1.56 3.86 64 RCVD_IN_IADB_DK 18933 3.46 1.56 3.80 65 T_REMOTE_IMAGE 18348 4.07 6.17 3.69 66 XM_B_SpammyTLD 18038 4.29 7.97 3.62 67 RCVD_IN_IADB_VOUCHED 17753 3.11 0.61 3.57 68 HTML_IMAGE_RATIO_06 17688 3.56 3.59 3.55 69 XMSubMetaSx_00 17187 4.34 9.20 3.45 70 TO_MALFORMED 17053 2.90 0.02 3.42 71 XM_DIRTYINTL 16819 4.48 10.48 3.38 72 TR_XM_DK_SendGrid 16493 3.15 2.29 3.31 73 BAYES_05 16489 3.22 2.70 3.31 74 XMNumbers 16454 3.76 6.22 3.30 75 FROM_EXCESS_BASE64 15850 3.26 3.66 3.18 76 HTML_MIME_NO_HTML_TAG 15349 3.51 5.82 3.08 77 MIME_HTML_ONLY_MULTI 15124 3.34 5.00 3.04 78 ANY_BOUNCE_MESSAGE 15085 2.64 0.54 3.03 79 BOUNCE_MESSAGE 15081 2.64 0.54 3.03 80 BAYES_99 13738 5.17 18.39 2.76 81 UNPARSEABLE_RELAY 12449 2.26 0.95 2.50 82 BAYES_999 11305 4.06 13.84 2.27 83 MIME_HTML_MOSTLY 11257 2.50 3.81 2.26 84 HTML_IMAGE_RATIO_08 11134 2.28 2.49 2.24 85 SUBJ_ALL_CAPS 11060 2.30 2.73 2.22 86 RCVD_IN_IADB_OPTIN 11038 1.93 0.37 2.22 87 MAILING_LIST_MULTI 10927 2.05 1.26 2.19 88 BOTNET 10867 5.03 20.61 2.18 89 INVALID_MSGID 10807 1.87 0.23 2.17 90 T_TooManySym_02 10362 1.88 0.80 2.08 91 URI_HEX 10077 2.21 3.24 2.02 92 TVD_RCVD_IP 10003 1.84 0.90 2.01 93 BAYES_80 9896 2.42 4.80 1.99 94 T_XMDrugObfuBody_08 9763 2.10 2.87 1.96 95 KHOP_HELO_FCRDNS 9561 2.15 3.39 1.92 96 XM_CamelCaseFrm001 9464 2.23 4.00 1.90 97 TR_Symld_Words 9420 1.82 1.41 1.89 98 TooManyTo_002 9093 1.71 1.09 1.83 99 UNTRUSTED_Relay 8811 4.39 18.75 1.77 100 CK_HELO_DYNAMIC_SPLIT_IP 8598 1.53 0.48 1.73 101 HELO_DYNAMIC_IPADDR2 8556 1.47 0.14 1.72 102 XM_SPF_SoftFail 8545 2.22 4.99 1.72 103 XMDiploma_00 8452 1.83 2.54 1.70 104 RELAYCOUNTRY_CA 8305 2.02 3.92 1.67 105 XM_OfRef6 8064 1.74 2.42 1.62 106 XM_DK_Undo_01 7929 1.55 1.29 1.59 107 TR_MetaPhish_Combo_01 7830 1.42 0.58 1.57 108 IN_HORDE_ADDRESS_BOOK 7453 1.27 0.06 1.50 109 URI_TRY_3LD 6952 1.38 1.32 1.40 110 HELO_NODOT 6842 1.34 1.15 1.37 111 HELO_NO_DOMAIN 6840 1.34 1.14 1.37 112 TR_DCC_Bayes_99 6579 3.31 14.19 1.32 113 XMBdyGiftCard01 6528 1.67 3.61 1.31 114 XMStockSpam_06 6463 1.38 1.85 1.30 115 XMGappySubj_01 6454 1.18 0.51 1.30 116 TM2_M_VERY_LONG_WORD 6141 1.39 2.25 1.23 117 TooManyTo_003 6084 1.16 0.85 1.22 118 NO_DNS_FOR_FROM 5770 1.43 2.92 1.16 119 XM_GoogleGroups 5625 1.25 1.89 1.13 120 XMCapTrack 5618 0.99 0.25 1.13 121 RELAYCOUNTRY_GB 5521 1.20 1.71 1.11 122 BAYES_95 5431 1.35 2.78 1.09 123 XMPhish11 5377 1.15 1.51 1.08 124 XM_H_Long_From02 5363 1.18 1.73 1.08 125 DKIM_ADSP_CUSTOM_MED 5306 1.13 1.47 1.07 126 TM2_M_A_HREF_HREF 5077 1.00 0.88 1.02 127 XMGenDplmaNmb 5074 1.14 1.82 1.02 128 USER_IN_DEF_DKIM_WL 4760 0.81 0.01 0.96 129 XM_UB50 4460 2.41 10.68 0.90 130 TooManyTo_004 4443 0.85 0.65 0.89 131 PLING_QUERY 4421 0.89 0.89 0.89 132 T_FILL_THIS_FORM_SHORT 4401 0.88 0.87 0.88 133 TR_XM_RelayPhish 4396 1.13 2.51 0.88 134 XMSubMetaI_00 4183 0.92 1.33 0.84 135 T_XMDrugObfuBody_00 4127 1.10 2.61 0.83 136 NML_ADSP_CUSTOM_MED 4016 0.87 1.20 0.81 137 XM_RXBody 3976 0.72 0.30 0.80 138 XMBody_17 3945 0.88 1.35 0.79 139 FILL_THIS_FORM 3844 0.87 1.38 0.77 140 SpammyFromTLD_01 3772 1.12 3.12 0.76 141 RCVD_IN_BL_SPAMCOP_NET 3749 1.46 5.32 0.75 142 XM_ProductURIs 3683 0.74 0.73 0.74 143 TooManyTo_005 3663 0.70 0.53 0.74 144 XMSubNoVowel 3593 0.68 0.48 0.72 145 URI_OPTOUT_3LD 3524 0.62 0.13 0.71 146 XMBrknScrpt_02 3513 0.80 1.35 0.71 147 XMSexyCombo_01 3294 1.29 4.70 0.66 148 XMPhish30 3012 0.69 1.15 0.60 149 HTML_FONT_FACE_BAD 2982 0.64 0.88 0.60 150 FILL_THIS_FORM_LONG 2930 0.59 0.62 0.59 151 SpammyFromTLD_02 2925 1.78 8.32 0.59 152 HTTPS_HTTP_MISMATCH 2917 0.61 0.76 0.59 153 XM_B_COPY_HTML 2851 0.61 0.82 0.57 154 HTML_TAG_BALANCE_BODY 2841 0.58 0.63 0.57 155 T_OBFU_PDF_ATTACH 2839 0.52 0.24 0.57 156 FILL_THIS_FORM_LOAN 2825 0.51 0.20 0.57 157 XM_B_REG_HTML 2766 0.52 0.34 0.56 158 USER_IN_WHITELIST 2733 0.46 0.00 0.55 159 XMHTMLBadTable_001 2732 0.58 0.77 0.55 160 TR_XM_PHPDW 2731 1.07 3.91 0.55 161 T_TooManySym_03 2662 0.50 0.34 0.53 162 TR_XM_PHPForged 2631 1.04 3.82 0.53 163 FORGED_GMAIL_RCVD 2614 0.65 1.34 0.53 164 TR_XM_FormFill2 2614 1.03 3.78 0.53 165 XM_H_PHPOS 2584 1.02 3.78 0.52 166 T_XMHurry_00 2561 0.84 2.62 0.51 167 XMBody_95 2548 0.45 0.12 0.51 168 T_Symld_Words_02 2515 0.56 0.84 0.51 169 DKIM_ADSP_NXDOMAIN 2511 1.14 4.63 0.50 170 XMBody_78 2508 0.66 1.52 0.50 171 XMNoVowels 2497 0.51 0.57 0.50 172 FROM_GOV_SPOOF 2495 0.50 0.50 0.50 173 XM_ShortIntro_01 2454 0.67 1.63 0.49 174 XMHTML_After_End 2401 0.53 0.77 0.48 175 XM_H_PHPMailer 2389 0.66 1.64 0.48 176 HTML_IMAGE_ONLY_32 2385 0.44 0.25 0.48 177 RELAYCOUNTRY_AU 2369 0.51 0.72 0.48 178 SUBJ_DOLLARS 2363 0.48 0.51 0.47 179 TM2_M_BODY_EMPTY 2335 0.41 0.09 0.47 180 XMMoneyMeta_00 2330 0.72 2.09 0.47 181 URI_NOVOWEL 2282 0.46 0.45 0.46 182 XMSubMetaSxObfu_03 2270 0.62 1.52 0.46 183 XM_Body_Obfu01 2197 0.46 0.54 0.44 184 RDNS_DYNAMIC 2128 0.61 1.63 0.43 185 XM_D_tchamptons_WL 2127 0.36 0.00 0.43 186 TR_LOTS_OF_MONEY3 2096 0.49 0.90 0.42 187 XM_URI_RBL 1964 0.99 4.22 0.39 188 MISSING_HEADERS 1958 0.55 1.39 0.39 189 XMOemUri 1920 0.34 0.12 0.39 190 XMPhish14 1902 0.44 0.74 0.38 191 XMSubMetaSxObfu_02 1888 0.42 0.61 0.38 192 REMOVE_BEFORE_LINK 1879 0.35 0.23 0.38 193 SHORT_HELO_AND_INLINE_IMAGE 1864 0.32 0.05 0.37 194 HTML_IMAGE_ONLY_28 1825 0.43 0.79 0.37 195 XMSlimDrugH 1819 0.39 0.51 0.37 196 XMLngstWrd_00 1802 0.40 0.61 0.36 197 XMGappySubj_02 1773 0.33 0.21 0.36 198 XMBSHREFv2 1770 0.39 0.56 0.36 199 RELAYCOUNTRY_DE 1713 0.63 2.22 0.34 200 XMLngstWrd_01 1692 0.38 0.57 0.34 ----------------------------------------------------------------------