Email: 656780 Autolearn: 0 AvgScore: 1.66 AvgScanTime: 2.07 sec Spam: 102613 Autolearn: 0 AvgScore: 12.68 AvgScanTime: 2.89 sec Ham: 554167 Autolearn: 0 AvgScore: -0.38 AvgScanTime: 1.92 sec Time Spent Running SA: 377.71 hours Time Spent Processing Spam: 82.30 hours Time Spent Processing Ham: 295.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 95492 87.77 93.06 86.80 2 DCC_CHECK 81285 47.33 79.22 41.42 3 DKIM_SIGNED 75159 73.12 73.25 73.10 4 XM_DK_Pass 71459 71.47 69.64 71.81 5 XM_B_Unicode 67804 65.81 66.08 65.76 6 XMListUnsubscribeExists 67254 53.58 65.54 51.36 7 DKIM_VALID 66968 67.94 65.26 68.44 8 DKIM_VALID_AU 50196 50.45 48.92 50.73 9 BAYES_50 46844 51.30 45.65 52.35 10 XM_B_Unicode3 42302 37.93 41.22 37.32 11 MIME_HTML_ONLY 37587 21.72 36.63 18.96 12 LOC_TINY_FONT_1 33142 24.18 32.30 22.68 13 HTML_FONT_LOW_CONTRAST 32900 28.74 32.06 28.12 14 XM_DK_Undo_02 32228 8.64 31.41 4.43 15 RELAYCOUNTRY_META 30522 9.27 29.74 5.48 16 XMSubLong 25706 22.39 25.05 21.89 17 FVGT_m_MULTI_ODD 24725 21.39 24.10 20.89 18 BOTNET 23385 5.39 22.79 2.17 19 DKIM_VALID_EF 22836 24.98 22.25 25.49 20 XM_Body_Dirty_Words 21560 15.67 21.01 14.68 21 BAYES_99 21266 5.13 20.72 2.25 22 XM_Multi_Part_URI 20833 12.71 20.30 11.30 23 BOTNET_IPINHOSTNAME 19540 6.98 19.04 4.75 24 DCC_CHECK_NEGATIVE 19532 50.74 19.03 56.61 25 MultiRelay 19384 17.58 18.89 17.34 26 UNTRUSTED_Relay 18834 4.30 18.35 1.69 27 FSL_BULK_SIG 18617 8.10 18.14 6.24 28 T_TM2_M_HEADER_IN_MSG 18237 27.00 17.77 28.71 29 T_KAM_HTML_FONT_INVALID 17210 17.45 16.77 17.57 30 TR_DCC_Bayes_99 16952 3.40 16.52 0.97 31 BAYES_999 16546 4.02 16.12 1.78 32 XM_UncommonTLD01 15656 5.33 15.26 3.49 33 HTML_IMAGE_RATIO_02 14989 9.39 14.61 8.42 34 LOTS_OF_MONEY 14751 8.68 14.38 7.62 35 XMSexyCombo_05 11531 4.94 11.24 3.77 36 XM_Evil_Numbers_Gen 11377 9.29 11.09 8.96 37 T_REMOTE_IMAGE 10800 4.64 10.52 3.54 38 XMSubMetaSx_00 10199 5.61 9.94 4.81 39 SpammyFromTLD_02 9657 1.92 9.41 0.53 40 XM_UB50 9179 2.13 8.95 0.87 41 TooManyTo_001 9044 7.81 8.81 7.63 42 T_XMDrugObfuBody_14 8466 7.61 8.25 7.50 43 XM_H_Long_From01 8319 6.71 8.11 6.45 44 LotsOfNums_01 8279 8.10 8.07 8.11 45 MPART_ALT_DIFF 8216 4.21 8.01 3.50 46 DKIM_INVALID 8191 5.18 7.98 4.66 47 HTML_SHORT_LINK_IMG_1 7924 1.25 7.72 0.05 48 BAYES_00 7066 19.93 6.89 22.35 49 HTML_MIME_NO_HTML_TAG 6711 2.77 6.54 2.07 50 XM_DIRTYINTL 6543 3.03 6.38 2.41 51 XM_B_Phish_Phrases 6519 5.75 6.35 5.63 52 RCVD_IN_MSPIKE_H2 6316 7.23 6.16 7.42 53 KHOP_HELO_FCRDNS 6309 2.54 6.15 1.88 54 BAYES_80 5974 2.49 5.82 1.88 55 HTML_IMAGE_RATIO_04 5817 5.04 5.67 4.92 56 RELAYCOUNTRY_GB 5613 1.74 5.47 1.05 57 MIME_HTML_MOSTLY 5563 2.83 5.42 2.35 58 XM_B_SpammyTLD 5559 3.68 5.42 3.35 59 BODY_URI_ONLY 5375 0.94 5.24 0.14 60 HDRS_LCASE_IMGONLY 5257 0.85 5.12 0.06 61 BAYES_40 5240 6.50 5.11 6.76 62 XM_SPF_SoftFail 5224 2.81 5.09 2.39 63 REPLYTO_WITHOUT_TO_CC 5071 0.80 4.94 0.04 64 BAYES_20 4954 5.37 4.83 5.48 65 HTML_IMAGE_ONLY_12 4688 0.86 4.57 0.18 66 MIME_QP_LONG_LINE 4568 5.69 4.45 5.92 67 BAYES_60 4556 4.02 4.44 3.95 68 XMNumbers 4435 3.26 4.32 3.07 69 BOTNET_NORDNS 4409 0.70 4.30 0.03 70 RCVD_IN_BL_SPAMCOP_NET 4378 1.06 4.27 0.46 71 RCVD_IN_PSBL 4212 0.67 4.10 0.04 72 MIME_HTML_ONLY_MULTI 4185 2.15 4.08 1.80 73 RELAYCOUNTRY_NL 4180 0.82 4.07 0.22 74 TM2_M_URI_OPT_OUT 4124 3.94 4.02 3.92 75 HTML_IMAGE_RATIO_06 4121 3.33 4.02 3.20 76 XM_OfRef6 4013 1.80 3.91 1.41 77 URIBL_CSS 4010 0.63 3.91 0.03 78 URIBL_CSS_A 4010 0.63 3.91 0.03 79 RELAYCOUNTRY_CA 4001 1.94 3.90 1.58 80 XM_URI_RBL 3979 0.89 3.88 0.34 81 MIME_HEADER_CTYPE_ONLY 3961 0.68 3.86 0.09 82 RCVD_IN_RP_RNBL 3848 0.62 3.75 0.04 83 XMSexyCombo_01 3805 1.31 3.71 0.86 84 HTML_IMAGE_ONLY_08 3683 0.68 3.59 0.14 85 T_XMDrugObfuBody_08 3431 2.04 3.34 1.80 86 SpammyFromTLD_01 3404 1.34 3.32 0.97 87 XM_SendGrid 3359 5.50 3.27 5.91 88 XMDiploma_00 3302 1.91 3.22 1.67 89 BAYES_95 3249 1.40 3.17 1.08 90 BAYES_05 3144 3.54 3.06 3.63 91 URI_HEX 3108 1.96 3.03 1.76 92 T_TooManySym_01 3051 4.97 2.97 5.34 93 HTML_IMAGE_ONLY_20 2994 0.70 2.92 0.28 94 TO_EQ_FM_DOM_HTML_IMG 2983 0.47 2.91 0.01 95 FROM_SUSPICIOUS_NTLD 2921 0.47 2.85 0.03 96 XMStrtUSub 2902 3.82 2.83 4.00 97 MultiRelay_CC 2856 0.65 2.78 0.25 98 MultiRelay_Combo 2856 0.65 2.78 0.25 99 FROM_SUSPICIOUS_NTLD_FP 2848 0.45 2.78 0.02 100 TR_LOTS_OF_MONEY3 2805 0.88 2.73 0.54 101 XM_CamelCaseFrm001 2765 2.18 2.69 2.09 102 DIET_1 2765 0.68 2.69 0.31 103 TR_Mismatch_TLD_02 2735 0.49 2.67 0.08 104 AMAZON_IMG_NOT_RCVD_AMZN 2722 0.45 2.65 0.04 105 T_HTML_TAG_BALANCE_CENTER 2718 0.60 2.65 0.21 106 DATE_IN_PAST_96_XX 2706 0.42 2.64 0.01 107 XM_DrugUnitList 2665 0.41 2.60 0.00 108 HOSTED_IMG_MULTI 2663 0.41 2.60 0.00 109 XMGenDplmaNmb 2640 1.27 2.57 1.03 110 HTML_IMAGE_RATIO_08 2615 2.33 2.55 2.29 111 NO_DNS_FOR_FROM 2614 1.25 2.55 1.01 112 TR_XM_DK_Bayes 2578 15.12 2.51 17.46 113 FROM_EXCESS_BASE64 2576 3.18 2.51 3.31 114 TR_XM_PHPDW 2472 1.24 2.41 1.03 115 RELAYCOUNTRY_FR 2459 0.68 2.40 0.36 116 TR_XM_PHPForged 2434 1.22 2.37 1.01 117 TR_XM_FormFill2 2409 1.22 2.35 1.01 118 XM_H_PHPOS 2402 1.21 2.34 1.00 119 XMSubMetaI_00 2368 0.92 2.31 0.66 120 HTML_EXTRA_CLOSE 2329 0.38 2.27 0.03 121 ALL_TRUSTED 2325 16.57 2.27 19.22 122 DATE_IN_PAST_03_06 2322 0.45 2.26 0.11 123 FROM_MISSP_REPLYTO 2315 0.36 2.26 0.01 124 XM_OfRef7 2309 0.50 2.25 0.18 125 TR_XM_DK_Bayes1 2277 14.44 2.22 16.70 126 HDRS_MISSP 2255 0.35 2.20 0.01 127 HOSTED_IMG_DIRECT_MX 2227 0.34 2.17 0.00 128 XMBody_17 2180 1.10 2.12 0.91 129 XMMoneyMeta_00 2140 0.81 2.09 0.57 130 PLING_QUERY 2118 0.81 2.06 0.58 131 T_Symld_Words_02 2096 0.72 2.04 0.47 132 DKIM_ADSP_NXDOMAIN 2084 0.70 2.03 0.45 133 TR_XM_INV_DKIM 2075 0.45 2.02 0.16 134 FILL_THIS_FORM 2071 0.83 2.02 0.61 135 RCVD_IN_IADB_LISTED 2051 4.59 2.00 5.06 136 XM_BadFromFormat 2022 0.42 1.97 0.13 137 TR_Symld_Words 1938 3.40 1.89 3.68 138 SUBJ_ALL_CAPS 1937 1.57 1.89 1.51 139 TM2_M_VERY_LONG_WORD 1936 1.29 1.89 1.18 140 RCVD_IN_IADB_SPF 1927 4.00 1.88 4.40 141 RCVD_IN_MSPIKE_WL 1905 4.48 1.86 4.97 142 RCVD_IN_IADB_SENDERID 1896 3.54 1.85 3.86 143 FILL_THIS_FORM_LONG 1893 0.56 1.84 0.32 144 RCVD_IN_IADB_DK 1892 3.49 1.84 3.80 145 XM_H_TOP 1870 0.30 1.82 0.02 146 FILL_THIS_FORM_LOAN 1763 0.52 1.72 0.29 147 TR_XM_RelayPhish 1660 0.96 1.62 0.84 148 XM_OfRef8 1654 0.27 1.61 0.02 149 XMStockSpam_06 1647 0.91 1.61 0.78 150 RELAYCOUNTRY_DE 1624 0.53 1.58 0.34 151 TR_XM_SEO3 1581 0.43 1.54 0.23 152 URIBL_DBL_SPAM 1572 0.27 1.53 0.04 153 XM_H_Undi_Recip 1559 0.43 1.52 0.23 154 MPART_ALT_DIFF_COUNT 1547 0.44 1.51 0.24 155 MONEY_FRAUD_8 1532 0.23 1.49 0.00 156 ADVANCE_FEE_5_NEW_FRM_MNY 1525 0.23 1.49 0.00 157 TR_XM_DK_SendGrid 1517 2.92 1.48 3.19 158 RCVD_IN_RP_SAFE 1511 7.91 1.47 9.10 159 URIBL_SBL_A 1495 0.59 1.46 0.42 160 UNPARSEABLE_RELAY 1473 2.06 1.44 2.17 161 T_XMHurry_00 1469 0.88 1.43 0.77 162 URI_TRY_3LD 1450 1.35 1.41 1.33 163 XMBdyGiftCard01 1443 1.11 1.41 1.05 164 XM_H_PHPMailer 1411 0.60 1.38 0.46 165 TR_Mismatch_TLD_01 1402 0.38 1.37 0.20 166 TR_M_TOP_BAYES 1393 0.21 1.36 0.00 167 SUBJ_DOLLARS 1390 0.50 1.35 0.34 168 MAILING_LIST_MULTI 1387 2.08 1.35 2.22 169 T_XMDrugObfuBody_00 1375 0.75 1.34 0.64 170 MISSING_HEADERS 1361 0.53 1.33 0.39 171 DEAR_WINNER 1361 0.21 1.33 0.00 172 XM_Combo_Sbj 1358 0.44 1.32 0.27 173 TR_XM_Undi_Recip5 1356 0.22 1.32 0.01 174 RELAYCOUNTRY_AT 1336 0.36 1.30 0.18 175 XMPhish11 1325 1.10 1.29 1.06 176 EBAY_IMG_NOT_RCVD_EBAY 1324 0.20 1.29 0.00 177 T_MONEY_PERCENT 1301 0.44 1.27 0.28 178 TR_LOTS_OF_MONEY2 1301 0.44 1.27 0.28 179 HELO_NODOT 1294 1.61 1.26 1.68 180 HELO_NO_DOMAIN 1285 1.61 1.25 1.68 181 ANY_BOUNCE_MESSAGE 1265 3.39 1.23 3.79 182 BOUNCE_MESSAGE 1246 3.39 1.21 3.79 183 XM_H_PHPOS_M 1245 0.33 1.21 0.17 184 XM_H_Long_From02 1235 1.01 1.20 0.98 185 XMBrknScrpt_02 1221 0.66 1.19 0.57 186 XMHTML_After_End 1206 0.56 1.18 0.45 187 RELAYCOUNTRY_UA 1169 0.18 1.14 0.00 188 RDNS_DYNAMIC 1164 0.48 1.13 0.36 189 DKIM_ADSP_CUSTOM_MED 1158 0.98 1.13 0.95 190 TR_MetaPhish_Combo_01 1144 1.47 1.11 1.53 191 XMSexyCombo_04 1138 0.25 1.11 0.09 192 XMPhish30 1137 0.63 1.11 0.55 193 RELAYCOUNTRY_IN 1126 0.27 1.10 0.12 194 XM_DK_Undo_01 1109 1.42 1.08 1.48 195 XMSubMetaSxObfu_03 1094 0.71 1.07 0.65 196 HK_SCAM 1083 0.20 1.06 0.04 197 HTML_IMAGE_ONLY_28 1081 0.50 1.05 0.40 198 T_FILL_THIS_FORM_SHORT 1074 0.81 1.05 0.77 199 XM_UB60 1068 0.22 1.04 0.06 200 INVALID_DATE 1053 0.19 1.03 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 480996 87.77 93.06 86.80 2 DKIM_SIGNED 405069 73.12 73.25 73.10 3 XM_DK_Pass 397948 71.47 69.64 71.81 4 DKIM_VALID 379263 67.94 65.26 68.44 5 XM_B_Unicode 364441 65.81 66.08 65.76 6 DCC_CHECK_NEGATIVE 313715 50.74 19.03 56.61 7 BAYES_50 290099 51.30 45.65 52.35 8 XMListUnsubscribeExists 284631 53.58 65.54 51.36 9 DKIM_VALID_AU 281125 50.45 48.92 50.73 10 DCC_CHECK 229549 47.33 79.22 41.42 11 XM_B_Unicode3 206803 37.93 41.22 37.32 12 T_TM2_M_HEADER_IN_MSG 159113 27.00 17.77 28.71 13 HTML_FONT_LOW_CONTRAST 155829 28.74 32.06 28.12 14 DKIM_VALID_EF 141234 24.98 22.25 25.49 15 LOC_TINY_FONT_1 125692 24.18 32.30 22.68 16 BAYES_00 123843 19.93 6.89 22.35 17 XMSubLong 121330 22.39 25.05 21.89 18 FVGT_m_MULTI_ODD 115760 21.39 24.10 20.89 19 ALL_TRUSTED 106502 16.57 2.27 19.22 20 MIME_HTML_ONLY 105046 21.72 36.63 18.96 21 T_KAM_HTML_FONT_INVALID 97378 17.45 16.77 17.57 22 TR_XM_DK_Bayes 96758 15.12 2.51 17.46 23 MultiRelay 96065 17.58 18.89 17.34 24 TR_XM_DK_Bayes1 92571 14.44 2.22 16.70 25 XM_Body_Dirty_Words 81370 15.67 21.01 14.68 26 TR_XM_DK_Bayes2 78739 12.14 0.97 14.21 27 XM_Multi_Part_URI 62619 12.71 20.30 11.30 28 RCVD_IN_RP_SAFE 50430 7.91 1.47 9.10 29 XM_Evil_Numbers_Gen 49657 9.29 11.09 8.96 30 HTML_IMAGE_RATIO_02 46650 9.39 14.61 8.42 31 LotsOfNums_01 44916 8.10 8.07 8.11 32 TooManyTo_001 42263 7.81 8.81 7.63 33 LOTS_OF_MONEY 42239 8.68 14.38 7.62 34 RCVD_IN_RP_CERTIFIED 42048 6.49 0.59 7.59 35 T_XMDrugObfuBody_14 41544 7.61 8.25 7.50 36 RCVD_IN_MSPIKE_H2 41144 7.23 6.16 7.42 37 BAYES_40 37466 6.50 5.11 6.76 38 XM_DKIMWhitelistDomains 36264 5.53 0.03 6.54 39 XM_H_Long_From01 35756 6.71 8.11 6.45 40 FSL_BULK_SIG 34589 8.10 18.14 6.24 41 MIME_QP_LONG_LINE 32813 5.69 4.45 5.92 42 XM_SendGrid 32755 5.50 3.27 5.91 43 XM_B_Phish_Phrases 31225 5.75 6.35 5.63 44 RELAYCOUNTRY_META 30382 9.27 29.74 5.48 45 BAYES_20 30342 5.37 4.83 5.48 46 T_TooManySym_01 29617 4.97 2.97 5.34 47 RCVD_IN_IADB_LISTED 28063 4.59 2.00 5.06 48 RCVD_IN_MSPIKE_WL 27532 4.48 1.86 4.97 49 HTML_IMAGE_RATIO_04 27288 5.04 5.67 4.92 50 XMSubMetaSx_00 26640 5.61 9.94 4.81 51 BOTNET_IPINHOSTNAME 26308 6.98 19.04 4.75 52 DKIM_INVALID 25806 5.18 7.98 4.66 53 XM_PDF 25801 4.07 0.89 4.66 54 XM_DK_Undo_02 24544 8.64 31.41 4.43 55 RCVD_IN_IADB_SPF 24366 4.00 1.88 4.40 56 RCVD_IN_MSPIKE_H3 23857 3.78 0.95 4.31 57 XMStrtUSub 22163 3.82 2.83 4.00 58 BAYES_60 21866 4.02 4.44 3.95 59 TM2_M_URI_OPT_OUT 21744 3.94 4.02 3.92 60 RCVD_IN_IADB_SENDERID 21375 3.54 1.85 3.86 61 RCVD_IN_IADB_DK 21042 3.49 1.84 3.80 62 ANY_BOUNCE_MESSAGE 21013 3.39 1.23 3.79 63 BOUNCE_MESSAGE 21010 3.39 1.21 3.79 64 XMSexyCombo_05 20915 4.94 11.24 3.77 65 TR_Symld_Words 20402 3.40 1.89 3.68 66 BAYES_05 20134 3.54 3.06 3.63 67 T_REMOTE_IMAGE 19644 4.64 10.52 3.54 68 MPART_ALT_DIFF 19414 4.21 8.01 3.50 69 XM_UncommonTLD01 19321 5.33 15.26 3.49 70 XM_B_SpammyTLD 18588 3.68 5.42 3.35 71 FROM_EXCESS_BASE64 18340 3.18 2.51 3.31 72 IN_ZIMBRA_NJ_WHITELIST 18192 2.77 0.02 3.28 73 RCVD_IN_IADB_VOUCHED 17998 2.85 0.68 3.25 74 HTML_IMAGE_RATIO_06 17734 3.33 4.02 3.20 75 TR_XM_DK_SendGrid 17672 2.92 1.48 3.19 76 XMNumbers 16990 3.26 4.32 3.07 77 TO_MALFORMED 13780 2.11 0.07 2.49 78 XM_DIRTYINTL 13352 3.03 6.38 2.41 79 XM_SPF_SoftFail 13231 2.81 5.09 2.39 80 MIME_HTML_MOSTLY 13033 2.83 5.42 2.35 81 HTML_IMAGE_RATIO_08 12696 2.33 2.55 2.29 82 BAYES_99 12450 5.13 20.72 2.25 83 MAILING_LIST_MULTI 12303 2.08 1.35 2.22 84 BOTNET 12044 5.39 22.79 2.17 85 UNPARSEABLE_RELAY 12042 2.06 1.44 2.17 86 T_TooManySym_02 11600 1.89 0.81 2.09 87 XM_CamelCaseFrm001 11571 2.18 2.69 2.09 88 HTML_MIME_NO_HTML_TAG 11469 2.77 6.54 2.07 89 RCVD_IN_IADB_OPTIN 11051 1.75 0.42 1.99 90 KHOP_HELO_FCRDNS 10404 2.54 6.15 1.88 91 BAYES_80 10404 2.49 5.82 1.88 92 TooManyTo_002 10402 1.74 0.98 1.88 93 T_XMDrugObfuBody_08 9998 2.04 3.34 1.80 94 MIME_HTML_ONLY_MULTI 9964 2.15 4.08 1.80 95 TVD_RCVD_IP 9919 1.60 0.57 1.79 96 BAYES_999 9881 4.02 16.12 1.78 97 URI_HEX 9736 1.96 3.03 1.76 98 UNTRUSTED_Relay 9380 4.30 18.35 1.69 99 HELO_NODOT 9302 1.61 1.26 1.68 100 HELO_NO_DOMAIN 9299 1.61 1.25 1.68 101 XMDiploma_00 9275 1.91 3.22 1.67 102 RELAYCOUNTRY_CA 8748 1.94 3.90 1.58 103 TR_MetaPhish_Combo_01 8503 1.47 1.11 1.53 104 SUBJ_ALL_CAPS 8342 1.57 1.89 1.51 105 CK_HELO_DYNAMIC_SPLIT_IP 8225 1.32 0.44 1.48 106 XM_DK_Undo_01 8185 1.42 1.08 1.48 107 HELO_DYNAMIC_IPADDR2 8178 1.26 0.10 1.48 108 IN_HORDE_ADDRESS_BOOK 7971 1.22 0.04 1.44 109 XM_OfRef6 7821 1.80 3.91 1.41 110 INVALID_MSGID 7637 1.22 0.40 1.38 111 URI_TRY_3LD 7394 1.35 1.41 1.33 112 XMCapTrack 7331 1.17 0.37 1.32 113 TooManyTo_003 7086 1.20 0.76 1.28 114 TM2_M_VERY_LONG_WORD 6560 1.29 1.89 1.18 115 URI_OPTOUT_3LD 6056 0.94 0.15 1.09 116 BAYES_95 5970 1.40 3.17 1.08 117 XMPhish11 5867 1.10 1.29 1.06 118 XMBdyGiftCard01 5833 1.11 1.41 1.05 119 RELAYCOUNTRY_GB 5819 1.74 5.47 1.05 120 TR_XM_PHPDW 5697 1.24 2.41 1.03 121 XMGenDplmaNmb 5697 1.27 2.57 1.03 122 TR_XM_PHPForged 5607 1.22 2.37 1.01 123 NO_DNS_FOR_FROM 5579 1.25 2.55 1.01 124 TR_XM_FormFill2 5573 1.22 2.35 1.01 125 XM_H_PHPOS 5553 1.21 2.34 1.00 126 XM_H_Long_From02 5419 1.01 1.20 0.98 127 SpammyFromTLD_01 5388 1.34 3.32 0.97 128 TR_DCC_Bayes_99 5352 3.40 16.52 0.97 129 XMGappySubj_01 5333 0.87 0.34 0.96 130 XM_GoogleGroups 5316 0.88 0.43 0.96 131 DKIM_ADSP_CUSTOM_MED 5254 0.98 1.13 0.95 132 TooManyTo_004 5251 0.90 0.62 0.95 133 USER_IN_DEF_DKIM_WL 5056 0.77 0.00 0.91 134 XMBody_17 5018 1.10 2.12 0.91 135 XM_UB50 4830 2.13 8.95 0.87 136 XMSexyCombo_01 4780 1.31 3.71 0.86 137 XM_ProductURIs 4669 0.86 0.95 0.84 138 TR_XM_RelayPhish 4637 0.96 1.62 0.84 139 TooManyTo_005 4426 0.75 0.49 0.80 140 XMStockSpam_06 4334 0.91 1.61 0.78 141 T_XMHurry_00 4286 0.88 1.43 0.77 142 T_FILL_THIS_FORM_SHORT 4266 0.81 1.05 0.77 143 NML_ADSP_CUSTOM_MED 3731 0.69 0.77 0.67 144 XMSubMetaI_00 3648 0.92 2.31 0.66 145 XMSubMetaSxObfu_03 3578 0.71 1.07 0.65 146 TO_NO_BRKTS_HTML_ONLY 3572 0.59 0.27 0.64 147 T_XMDrugObfuBody_00 3554 0.75 1.34 0.64 148 XMHTMLBadTable_001 3523 0.61 0.46 0.64 149 URI_NOVOWEL 3402 0.60 0.51 0.61 150 FILL_THIS_FORM 3358 0.83 2.02 0.61 151 HTTPS_HTTP_MISMATCH 3315 0.66 1.01 0.60 152 PLING_QUERY 3214 0.81 2.06 0.58 153 RELAYCOUNTRY_AU 3207 0.55 0.40 0.58 154 T_OBFU_PDF_ATTACH 3206 0.53 0.26 0.58 155 FROM_GOV_DKIM_AU 3206 0.50 0.10 0.58 156 XMNoVowels 3171 0.56 0.47 0.57 157 XMMoneyMeta_00 3162 0.81 2.09 0.57 158 XMBrknScrpt_02 3142 0.66 1.19 0.57 159 T_TooManySym_03 3116 0.51 0.20 0.56 160 HTML_TAG_BALANCE_BODY 3096 0.57 0.63 0.56 161 HTML_FONT_FACE_BAD 3057 0.62 0.98 0.55 162 XMPhish30 3030 0.63 1.11 0.55 163 XM_B_REG_HTML 3020 0.49 0.18 0.54 164 TR_LOTS_OF_MONEY3 2988 0.88 2.73 0.54 165 SpammyFromTLD_02 2955 1.92 9.41 0.53 166 XM_ShortIntro_01 2899 0.60 0.98 0.52 167 FORGED_GMAIL_RCVD 2851 0.59 1.00 0.51 168 RCVD_IN_MSPIKE_H5 2747 0.54 0.79 0.50 169 XMPhish14 2734 0.57 0.96 0.49 170 SHORT_HELO_AND_INLINE_IMAGE 2724 0.43 0.07 0.49 171 T_Symld_Words_02 2614 0.72 2.04 0.47 172 FROM_GOV_SPOOF 2605 0.48 0.52 0.47 173 XMSlimDrugH 2561 0.52 0.83 0.46 174 XMClaimOffer 2557 0.47 0.50 0.46 175 RCVD_IN_BL_SPAMCOP_NET 2555 1.06 4.27 0.46 176 XM_H_PHPMailer 2529 0.60 1.38 0.46 177 DKIM_ADSP_NXDOMAIN 2519 0.70 2.03 0.45 178 XMOemUri 2483 0.40 0.16 0.45 179 XMHTML_After_End 2483 0.56 1.18 0.45 180 XMBody_95 2473 0.40 0.15 0.45 181 TM2_M_A_HREF_HREF 2434 0.46 0.54 0.44 182 NUMERIC_HTTP_ADDR 2418 0.44 0.47 0.44 183 HTML_IMAGE_ONLY_32 2404 0.41 0.25 0.43 184 URIBL_SBL_A 2352 0.59 1.46 0.42 185 XMBody_78 2347 0.51 0.96 0.42 186 USER_IN_WHITELIST 2309 0.35 0.00 0.42 187 TM2_M_BODY_EMPTY 2274 0.36 0.12 0.41 188 HTML_IMAGE_ONLY_28 2230 0.50 1.05 0.40 189 XMLngstWrd_00 2221 0.45 0.74 0.40 190 RCVD_IN_SORBS_DUL 2184 0.42 0.54 0.39 191 MISSING_HEADERS 2149 0.53 1.33 0.39 192 XMDateMe_00 2131 0.38 0.38 0.38 193 REMOVE_BEFORE_LINK 2083 0.39 0.46 0.38 194 XMLngstWrd_01 2050 0.41 0.65 0.37 195 XM_Body_Obfu01 2015 0.40 0.61 0.36 196 XMSubMetaSxObfu_02 1981 0.36 0.35 0.36 197 RELAYCOUNTRY_FR 1979 0.68 2.40 0.36 198 RDNS_DYNAMIC 1975 0.48 1.13 0.36 199 BASE64_LENGTH_79_INF 1929 0.35 0.35 0.35 200 FSL_THIS_IS_ADV 1920 0.40 0.66 0.35 ----------------------------------------------------------------------