Email: 276322 Autolearn: 0 AvgScore: 3.18 AvgScanTime: 1.87 sec Spam: 88282 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 2.28 sec Ham: 188040 Autolearn: 0 AvgScore: -1.40 AvgScanTime: 1.68 sec Time Spent Running SA: 143.69 hours Time Spent Processing Spam: 55.93 hours Time Spent Processing Ham: 87.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 81341 82.52 92.14 78.00 2 DKIM_SIGNED 73910 76.46 83.72 73.05 3 XM_DK_Pass 72459 75.35 82.08 72.20 4 DKIM_VALID 71904 74.26 81.45 70.89 5 DCC_CHECK 71063 53.00 80.50 40.09 6 XMListUnsubscribeExists 65566 56.44 74.27 48.07 7 DKIM_VALID_AU 59715 59.69 67.64 55.96 8 XM_H_QuotedFrom 47966 39.83 54.33 33.03 9 XM_DK_Undo_02 43891 28.87 49.72 19.08 10 BAYES_99 41353 28.59 46.84 20.02 11 BAYES_999 35513 24.90 40.23 17.70 12 HTML_FONT_LOW_CONTRAST 34093 31.69 38.62 28.44 13 LOC_TINY_FONT_1 32903 27.44 37.27 22.83 14 TR_DCC_Bayes_99 32347 18.41 36.64 9.85 15 MIME_HTML_ONLY 29123 24.34 32.99 20.27 16 BAYES_50 27518 44.17 31.17 50.28 17 FVGT_m_MULTI_ODD 23045 21.63 26.10 19.54 18 XM_Body_Dirty_Words 20149 14.73 22.82 10.93 19 XMSubLong 19950 20.49 22.60 19.50 20 HTML_IMAGE_RATIO_02 17073 11.66 19.34 8.05 21 T_TM2_M_HEADER_IN_MSG 16559 21.78 18.76 23.20 22 XM_Multi_Part_URI 16347 14.21 18.52 12.19 23 DCC_CHECK_NEGATIVE 15734 45.57 17.82 58.60 24 DKIM_VALID_EF 15583 23.12 17.65 25.69 25 T_KAM_HTML_FONT_INVALID 15524 13.84 17.58 12.08 26 RELAYCOUNTRY_META 13553 7.75 15.35 4.18 27 BOTNET 13147 5.38 14.89 0.91 28 XM_Evil_Numbers_Gen 12922 9.30 14.64 6.80 29 MultiRelay 12629 15.46 14.31 16.01 30 XMSexyCombo_05 11193 6.45 12.68 3.52 31 T_XMDrugObfuBody_14 10848 8.35 12.29 6.50 32 FSL_BULK_SIG 10608 9.86 12.02 8.85 33 BOTNET_IPINHOSTNAME 10034 8.33 11.37 6.91 34 LOTS_OF_MONEY 9810 10.30 11.11 9.92 35 UNTRUSTED_Relay 9217 4.24 10.44 1.33 36 XMSubMetaSx_00 8609 6.41 9.75 4.84 37 HTML_IMAGE_RATIO_04 8469 5.97 9.59 4.27 38 LotsOfNums_01 7712 7.58 8.74 7.04 39 XM_B_Phish_Phrases 7628 5.78 8.64 4.44 40 TooManyTo_001 7548 10.21 8.55 10.99 41 FROM_EXCESS_BASE64 7129 5.28 8.08 3.96 42 RCVD_IN_RP_SAFE 6616 11.71 7.49 13.69 43 MPART_ALT_DIFF 6604 4.31 7.48 2.82 44 TR_XM_DocInvoice 6530 5.17 7.40 4.12 45 BAYES_80 6481 5.98 7.34 5.34 46 XM_UncommonTLD01 6339 5.86 7.18 5.24 47 XM_H_Long_From01 6255 6.14 7.09 5.69 48 RCVD_IN_RP_CERTIFIED 5725 10.75 6.48 12.76 49 BAYES_60 5237 6.84 5.93 7.26 50 HTML_IMAGE_RATIO_06 4788 4.28 5.42 3.75 51 XMNumbers 4703 4.48 5.33 4.08 52 XMStrtUSub 4580 4.85 5.19 4.70 53 BAYES_95 4161 3.99 4.71 3.65 54 MIME_QP_LONG_LINE 4044 4.25 4.58 4.10 55 MIME_HTML_MOSTLY 3921 3.23 4.44 2.66 56 XM_DIRTYINTL 3906 2.47 4.42 1.55 57 XM_UB50 3801 2.01 4.31 0.94 58 XM_SendGrid 3791 4.78 4.29 5.01 59 BOTNET_NORDNS 3615 1.32 4.09 0.02 60 RCVD_IN_BL_SPAMCOP_NET 3574 1.68 4.05 0.57 61 RCVD_IN_RP_RNBL 3545 1.31 4.02 0.03 62 T_REMOTE_IMAGE 3529 4.30 4.00 4.44 63 HTML_IMAGE_RATIO_08 3466 2.41 3.93 1.69 64 XM_H_Long_From02 3350 1.72 3.79 0.74 65 URI_HEX 3265 2.17 3.70 1.46 66 T_TooManySym_01 3244 5.00 3.67 5.63 67 RCVD_IN_MSPIKE_H2 3224 4.26 3.65 4.55 68 MIME_HTML_ONLY_MULTI 3180 1.88 3.60 1.07 69 RCVD_IN_PSBL 3133 1.31 3.55 0.25 70 XM_CamelCaseFrm001 3029 2.27 3.43 1.73 71 XMSexyCombo_01 3013 1.64 3.41 0.81 72 XMSubMetaI_00 2946 1.42 3.34 0.52 73 TM2_M_URI_OPT_OUT 2936 2.13 3.33 1.56 74 RELAYCOUNTRY_CA 2747 1.95 3.11 1.40 75 SUBJ_ALL_CAPS 2709 2.44 3.07 2.15 76 TM2_M_VERY_LONG_WORD 2689 1.52 3.05 0.80 77 XM_OfRef6 2444 1.79 2.77 1.33 78 XM_SPF_SoftFail 2407 1.95 2.73 1.58 79 HTML_MIME_NO_HTML_TAG 2305 1.97 2.61 1.67 80 XMBody_17 2148 1.06 2.43 0.41 81 XM_URI_RBL 2076 0.85 2.35 0.15 82 RELAYCOUNTRY_FR 2062 0.99 2.34 0.36 83 ALL_TRUSTED 2037 15.12 2.31 21.13 84 UNPARSEABLE_RELAY 2020 5.04 2.29 6.33 85 DKIM_INVALID 2006 2.20 2.27 2.16 86 PHOTO_EDITING_DIRECT 1968 0.71 2.23 0.00 87 DIET_1 1931 1.02 2.19 0.47 88 XMHTML_After_End 1903 0.83 2.16 0.20 89 T_XMDrugObfuBody_08 1877 1.34 2.13 0.97 90 SUBJ_DOLLARS 1876 0.97 2.13 0.42 91 RELAYCOUNTRY_AT 1859 0.77 2.11 0.14 92 XM_ProductURIs 1855 1.52 2.10 1.25 93 MultiRelay_Combo 1854 0.79 2.10 0.17 94 MultiRelay_CC 1854 0.79 2.10 0.17 95 SpammyFromTLD_02 1837 0.77 2.08 0.15 96 XMBdyGiftCard01 1772 1.35 2.01 1.03 97 XMDiploma_00 1762 1.35 2.00 1.05 98 RCVD_IN_IADB_LISTED 1747 3.54 1.98 4.27 99 XMPhish30 1745 1.11 1.98 0.71 100 URIBL_BLACK 1721 0.65 1.95 0.04 101 T_XMHurry_00 1695 0.88 1.92 0.39 102 XM_UB99 1653 0.62 1.87 0.03 103 RCVD_IN_IADB_SPF 1563 3.05 1.77 3.64 104 MAILING_LIST_MULTI 1534 2.12 1.74 2.30 105 TooManyTo_002 1532 4.28 1.74 5.47 106 T_Symld_Words_02 1522 0.78 1.72 0.34 107 BODY_URI_ONLY 1484 0.57 1.68 0.05 108 RCVD_IN_IADB_SENDERID 1466 2.70 1.66 3.19 109 RCVD_IN_IADB_DK 1455 2.62 1.65 3.08 110 URI_TRY_3LD 1395 1.26 1.58 1.11 111 HTML_SHORT_LINK_IMG_1 1377 0.51 1.56 0.02 112 FSL_THIS_IS_ADV 1372 0.57 1.55 0.10 113 XM_B_REG_HTML 1364 1.34 1.55 1.24 114 TooManyTo_003 1350 3.25 1.53 4.05 115 XM_UB999 1322 0.49 1.50 0.02 116 BAYES_00 1319 5.08 1.49 6.76 117 HTML_IMAGE_ONLY_08 1306 0.56 1.48 0.12 118 DATE_IN_PAST_12_24 1278 0.49 1.45 0.03 119 XM_BadFromFormat 1263 0.66 1.43 0.30 120 XM_B_COPY_HTML 1263 1.05 1.43 0.88 121 XM_H_PHPOS 1236 1.67 1.40 1.80 122 XM_UB60 1226 0.49 1.39 0.07 123 XM_DK_Undo_01 1225 1.62 1.39 1.73 124 RELAYCOUNTRY_CN 1213 0.46 1.37 0.04 125 URIBL_DBL_SPAM 1212 0.45 1.37 0.02 126 XMStockSpam_06 1161 0.89 1.32 0.70 127 MPART_ALT_DIFF_COUNT 1158 0.58 1.31 0.24 128 TooManyTo_004 1155 2.45 1.31 2.99 129 XM_HighProb1 1136 0.43 1.29 0.03 130 XM_RXBody 1120 0.56 1.27 0.23 131 XM_Body_Obfu01 1115 0.52 1.26 0.17 132 SpammyFromTLD_01 1090 0.96 1.23 0.82 133 HTML_FONT_SIZE_HUGE 1086 0.51 1.23 0.17 134 XM_OfRef7 1075 0.51 1.22 0.18 135 XMBrknScrpt_02 1063 0.85 1.20 0.68 136 T_FILL_THIS_FORM_SHORT 1060 1.12 1.20 1.08 137 NORDNS_LOW_CONTRAST 1060 0.39 1.20 0.01 138 TR_XM_RelayPhish 1060 0.64 1.20 0.38 139 T_XMDrugObfuBody_00 1049 0.97 1.19 0.87 140 TR_XM_DK_Bayes 1044 3.75 1.18 4.95 141 T_HTML_TAG_BALANCE_CENTER 1041 0.52 1.18 0.21 142 TR_XM_DK_Bayes1 1036 3.68 1.17 4.86 143 BAYES_40 1022 2.43 1.16 3.02 144 XM_UB80 1011 0.38 1.15 0.02 145 LONG_JUNK_URI 992 0.44 1.12 0.12 146 FILL_THIS_FORM 992 0.85 1.12 0.72 147 T_TooManySym_02 988 2.08 1.12 2.54 148 XMSexyCombo_04 981 0.43 1.11 0.12 149 REMOVE_BEFORE_LINK 976 0.73 1.11 0.56 150 XMSubMetaSSx_00 960 0.50 1.09 0.22 151 XMSubMetaSxObfu_03 960 0.53 1.09 0.27 152 MONEY_FRAUD_5 952 0.35 1.08 0.00 153 T_MONEY_PERCENT 933 0.67 1.06 0.49 154 TR_LOTS_OF_MONEY2 933 0.67 1.06 0.49 155 XM_Lotto 919 0.39 1.04 0.08 156 LONG_JUNK_URI3 916 0.41 1.04 0.12 157 XM_H_PHPMailer 915 0.89 1.04 0.82 158 TR_Symld_Words 901 1.77 1.02 2.12 159 TR_XM_DK_Bayes2 890 3.02 1.01 3.97 160 T_FILL_THIS_FORM_LOAN 890 0.76 1.01 0.64 161 TooManyTo_005 881 1.78 1.00 2.15 162 HTML_FONT_SIZE_LARGE 878 0.40 0.99 0.12 163 FORM_FRAUD_5 869 0.31 0.98 0.00 164 RDNS_DYNAMIC 862 0.71 0.98 0.58 165 XM_OfRef8 861 0.33 0.98 0.02 166 XMBody_78 852 0.76 0.97 0.66 167 RELAYCOUNTRY_GB 836 0.70 0.95 0.58 168 RCVD_IN_IADB_VOUCHED 835 2.32 0.95 2.96 169 XMLongAddy 827 0.39 0.94 0.14 170 XMGenDplmaNmb 817 0.72 0.93 0.62 171 BAYES_20 812 1.74 0.92 2.12 172 RCVD_IN_MSPIKE_WL 793 1.70 0.90 2.08 173 RCVD_IN_MSPIKE_H3 793 1.70 0.90 2.08 174 TR_Caps_n_Bayes_99 784 0.32 0.89 0.06 175 XMClaimOffer 776 0.38 0.88 0.15 176 BODY_ENHANCEMENT 771 0.30 0.87 0.03 177 URI_NOVOWEL 765 0.49 0.87 0.32 178 BASE64_LENGTH_79_INF 758 0.40 0.86 0.18 179 XM_H_Long_From03 755 0.37 0.86 0.15 180 XMHTMLBadTable_001 745 0.60 0.84 0.48 181 FROM_ADDR_WS 743 0.27 0.84 0.00 182 TRACKER_ID 731 0.40 0.83 0.20 183 FROM_MISSP_EH_MATCH 731 0.27 0.83 0.00 184 HTML_TAG_BALANCE_BODY 668 0.59 0.76 0.51 185 XMPhish14 664 0.45 0.75 0.30 186 XMPhish11 660 0.99 0.75 1.10 187 DKIM_ADSP_CUSTOM_MED 658 0.85 0.75 0.90 188 PLING_QUERY 657 0.54 0.74 0.44 189 GAPPY_SUBJECT 651 0.33 0.74 0.13 190 XMMoneyMeta_00 643 0.38 0.73 0.21 191 DATE_IN_PAST_06_12 642 0.28 0.73 0.07 192 XM_S_JOY_D 635 0.37 0.72 0.20 193 XM_H_PHPOS_M 622 0.67 0.70 0.65 194 XMGappySubj_01 617 0.43 0.70 0.30 195 XMBSHREFv2 610 0.35 0.69 0.19 196 HTML_FONT_FACE_BAD 602 0.53 0.68 0.46 197 XMSlimDrugH 599 0.37 0.68 0.23 198 TR_LOTS_OF_MONEY3 566 0.40 0.64 0.28 199 TM2_M_A_HREF_HREF 566 0.76 0.64 0.82 200 LongTLD 564 0.28 0.64 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146668 82.52 92.14 78.00 2 DKIM_SIGNED 137367 76.46 83.72 73.05 3 XM_DK_Pass 135763 75.35 82.08 72.20 4 DKIM_VALID 133306 74.26 81.45 70.89 5 DCC_CHECK_NEGATIVE 110184 45.57 17.82 58.60 6 DKIM_VALID_AU 105233 59.69 67.64 55.96 7 BAYES_50 94540 44.17 31.17 50.28 8 XMListUnsubscribeExists 90396 56.44 74.27 48.07 9 DCC_CHECK 75383 53.00 80.50 40.09 10 XM_H_QuotedFrom 62103 39.83 54.33 33.03 11 HTML_FONT_LOW_CONTRAST 53471 31.69 38.62 28.44 12 DKIM_VALID_EF 48312 23.12 17.65 25.69 13 T_TM2_M_HEADER_IN_MSG 43618 21.78 18.76 23.20 14 LOC_TINY_FONT_1 42925 27.44 37.27 22.83 15 ALL_TRUSTED 39731 15.12 2.31 21.13 16 MIME_HTML_ONLY 38123 24.34 32.99 20.27 17 BAYES_99 37654 28.59 46.84 20.02 18 FVGT_m_MULTI_ODD 36736 21.63 26.10 19.54 19 XMSubLong 36671 20.49 22.60 19.50 20 XM_DK_Undo_02 35887 28.87 49.72 19.08 21 BAYES_999 33280 24.90 40.23 17.70 22 MultiRelay 30101 15.46 14.31 16.01 23 XM_DKIMWhitelistDomains 26659 9.66 0.03 14.18 24 RCVD_IN_RP_SAFE 25747 11.71 7.49 13.69 25 RCVD_IN_RP_CERTIFIED 23990 10.75 6.48 12.76 26 XM_Multi_Part_URI 22918 14.21 18.52 12.19 27 T_KAM_HTML_FONT_INVALID 22719 13.84 17.58 12.08 28 TooManyTo_001 20661 10.21 8.55 10.99 29 XM_Body_Dirty_Words 20559 14.73 22.82 10.93 30 LOTS_OF_MONEY 18653 10.30 11.11 9.92 31 TR_DCC_Bayes_99 18531 18.41 36.64 9.85 32 FSL_BULK_SIG 16644 9.86 12.02 8.85 33 HTML_IMAGE_RATIO_02 15140 11.66 19.34 8.05 34 BAYES_60 13661 6.84 5.93 7.26 35 LotsOfNums_01 13243 7.58 8.74 7.04 36 BOTNET_IPINHOSTNAME 12985 8.33 11.37 6.91 37 XM_Evil_Numbers_Gen 12783 9.30 14.64 6.80 38 BAYES_00 12714 5.08 1.49 6.76 39 T_XMDrugObfuBody_14 12214 8.35 12.29 6.50 40 UNPARSEABLE_RELAY 11899 5.04 2.29 6.33 41 XM_H_Long_From01 10704 6.14 7.09 5.69 42 T_TooManySym_01 10582 5.00 3.67 5.63 43 TooManyTo_002 10288 4.28 1.74 5.47 44 BAYES_80 10033 5.98 7.34 5.34 45 TVD_RCVD_IP 9933 3.66 0.20 5.28 46 XM_UncommonTLD01 9851 5.86 7.18 5.24 47 IN_ZIMBRA_NJ_WHITELIST 9619 3.49 0.03 5.12 48 XM_SendGrid 9416 4.78 4.29 5.01 49 TR_XM_DK_Bayes 9315 3.75 1.18 4.95 50 TR_XM_DK_Bayes1 9144 3.68 1.17 4.86 51 XMSubMetaSx_00 9092 6.41 9.75 4.84 52 XMStrtUSub 8831 4.85 5.19 4.70 53 RCVD_IN_MSPIKE_H2 8550 4.26 3.65 4.55 54 XM_B_Phish_Phrases 8355 5.78 8.64 4.44 55 T_REMOTE_IMAGE 8345 4.30 4.00 4.44 56 RCVD_IN_IADB_LISTED 8035 3.54 1.98 4.27 57 HTML_IMAGE_RATIO_04 8030 5.97 9.59 4.27 58 RELAYCOUNTRY_META 7859 7.75 15.35 4.18 59 TR_XM_DocInvoice 7749 5.17 7.40 4.12 60 MIME_QP_LONG_LINE 7709 4.25 4.58 4.10 61 XMNumbers 7667 4.48 5.33 4.08 62 TooManyTo_003 7622 3.25 1.53 4.05 63 TR_XM_DK_Bayes2 7457 3.02 1.01 3.97 64 FROM_EXCESS_BASE64 7452 5.28 8.08 3.96 65 TO_MALFORMED 7365 2.67 0.02 3.92 66 HTML_IMAGE_RATIO_06 7046 4.28 5.42 3.75 67 BAYES_95 6871 3.99 4.71 3.65 68 RCVD_IN_IADB_SPF 6852 3.05 1.77 3.64 69 INVALID_MSGID 6759 2.54 0.30 3.59 70 XMSexyCombo_05 6619 6.45 12.68 3.52 71 RCVD_IN_IADB_SENDERID 6002 2.70 1.66 3.19 72 ANY_BOUNCE_MESSAGE 5889 2.32 0.60 3.13 73 BOUNCE_MESSAGE 5887 2.32 0.60 3.13 74 RCVD_IN_IADB_DK 5785 2.62 1.65 3.08 75 BAYES_40 5683 2.43 1.16 3.02 76 TooManyTo_004 5621 2.45 1.31 2.99 77 RCVD_IN_IADB_VOUCHED 5562 2.32 0.95 2.96 78 MPART_ALT_DIFF 5306 4.31 7.48 2.82 79 MIME_HTML_MOSTLY 5004 3.23 4.44 2.66 80 IN_HORDE_ADDRESS_BOOK 4953 1.82 0.09 2.63 81 T_TooManySym_02 4768 2.08 1.12 2.54 82 USER_IN_DEF_DKIM_WL 4738 1.74 0.08 2.52 83 MAILING_LIST_MULTI 4331 2.12 1.74 2.30 84 DKIM_INVALID 4061 2.20 2.27 2.16 85 TooManyTo_005 4046 1.78 1.00 2.15 86 SUBJ_ALL_CAPS 4040 2.44 3.07 2.15 87 BAYES_20 3985 1.74 0.92 2.12 88 TR_Symld_Words 3978 1.77 1.02 2.12 89 XM_PDF 3920 1.52 0.32 2.08 90 RCVD_IN_MSPIKE_WL 3911 1.70 0.90 2.08 91 RCVD_IN_MSPIKE_H3 3911 1.70 0.90 2.08 92 XM_H_PHPOS 3388 1.67 1.40 1.80 93 XM_DK_Undo_01 3250 1.62 1.39 1.73 94 XM_CamelCaseFrm001 3245 2.27 3.43 1.73 95 HTML_IMAGE_RATIO_08 3187 2.41 3.93 1.69 96 HTML_MIME_NO_HTML_TAG 3136 1.97 2.61 1.67 97 XM_SPF_SoftFail 2980 1.95 2.73 1.58 98 TM2_M_URI_OPT_OUT 2942 2.13 3.33 1.56 99 XM_DIRTYINTL 2911 2.47 4.42 1.55 100 BAYES_05 2898 1.19 0.43 1.54 101 URI_HEX 2745 2.17 3.70 1.46 102 RCVD_IN_IADB_OPTIN 2708 1.18 0.61 1.44 103 RELAYCOUNTRY_CA 2637 1.95 3.11 1.40 104 USER_IN_WHITELIST 2599 0.94 0.00 1.38 105 UNTRUSTED_Relay 2507 4.24 10.44 1.33 106 XM_OfRef6 2502 1.79 2.77 1.33 107 XM_GoogleGroups 2485 1.09 0.60 1.32 108 XM_ProductURIs 2351 1.52 2.10 1.25 109 XM_B_REG_HTML 2327 1.34 1.55 1.24 110 T_TooManySym_03 2247 0.86 0.14 1.19 111 URI_TRY_3LD 2091 1.26 1.58 1.11 112 XMPhish11 2063 0.99 0.75 1.10 113 T_FILL_THIS_FORM_SHORT 2032 1.12 1.20 1.08 114 MIME_HTML_ONLY_MULTI 2014 1.88 3.60 1.07 115 XMDiploma_00 1977 1.35 2.00 1.05 116 XMBdyGiftCard01 1946 1.35 2.01 1.03 117 T_XMDrugObfuBody_08 1817 1.34 2.13 0.97 118 HELO_NODOT 1795 0.74 0.27 0.95 119 XM_UB50 1760 2.01 4.31 0.94 120 XMBody_95 1742 0.66 0.10 0.93 121 BOTNET 1717 5.38 14.89 0.91 122 DKIM_ADSP_CUSTOM_MED 1700 0.85 0.75 0.90 123 XM_ShortIntro_01 1679 0.77 0.49 0.89 124 XM_B_COPY_HTML 1651 1.05 1.43 0.88 125 T_XMDrugObfuBody_00 1645 0.97 1.19 0.87 126 SpammyFromTLD_01 1550 0.96 1.23 0.82 127 XM_H_PHPMailer 1542 0.89 1.04 0.82 128 XM_D_tchamptons_WL 1539 0.56 0.00 0.82 129 TM2_M_A_HREF_HREF 1533 0.76 0.64 0.82 130 XMSexyCombo_01 1532 1.64 3.41 0.81 131 TM2_M_VERY_LONG_WORD 1503 1.52 3.05 0.80 132 XMSubMetaSxObfu_02 1456 0.62 0.29 0.77 133 XM_H_Long_From02 1397 1.72 3.79 0.74 134 FILL_THIS_FORM 1359 0.85 1.12 0.72 135 XMPhish30 1331 1.11 1.98 0.71 136 XMStockSpam_06 1308 0.89 1.32 0.70 137 XMBrknScrpt_02 1282 0.85 1.20 0.68 138 T_TooManySym_04 1275 0.47 0.02 0.68 139 NML_ADSP_CUSTOM_MED 1268 0.66 0.64 0.67 140 XMBody_78 1244 0.76 0.97 0.66 141 TR_MetaPhish_Combo_01 1234 0.64 0.60 0.66 142 XM_H_PHPOS_M 1221 0.67 0.70 0.65 143 T_FILL_THIS_FORM_LOAN 1203 0.76 1.01 0.64 144 XMGenDplmaNmb 1168 0.72 0.93 0.62 145 RCVD_IN_IADB_DOPTIN 1107 0.43 0.10 0.59 146 RDNS_DYNAMIC 1098 0.71 0.98 0.58 147 RELAYCOUNTRY_GB 1091 0.70 0.95 0.58 148 RCVD_IN_BL_SPAMCOP_NET 1075 1.68 4.05 0.57 149 T_FILL_THIS_FORM_LONG 1069 0.41 0.09 0.57 150 REMOVE_BEFORE_LINK 1049 0.73 1.11 0.56 151 RELAYCOUNTRY_DE 1025 0.57 0.63 0.55 152 XMSubMetaI_00 982 1.42 3.34 0.52 153 HTML_TAG_BALANCE_BODY 960 0.59 0.76 0.51 154 XMCapTrack 926 0.45 0.35 0.49 155 T_MONEY_PERCENT 924 0.67 1.06 0.49 156 TR_LOTS_OF_MONEY2 924 0.67 1.06 0.49 157 XMHTMLBadTable_001 902 0.60 0.84 0.48 158 DIET_1 882 1.02 2.19 0.47 159 NO_DNS_FOR_FROM 882 0.40 0.24 0.47 160 DKIM_ADSP_NXDOMAIN 881 0.43 0.34 0.47 161 HTML_FONT_FACE_BAD 873 0.53 0.68 0.46 162 XMNoVowels 863 0.45 0.42 0.46 163 XMRcvdHeader_15 844 0.31 0.00 0.45 164 PLING_QUERY 828 0.54 0.74 0.44 165 URIBL_SBL_A 819 0.39 0.29 0.44 166 SUBJ_DOLLARS 797 0.97 2.13 0.42 167 XMBody_17 778 1.06 2.43 0.41 168 T_XMHurry_00 724 0.88 1.92 0.39 169 XMDateMe_00 717 0.36 0.32 0.38 170 XMSUPPORT 713 0.26 0.00 0.38 171 TR_XM_RelayPhish 707 0.64 1.20 0.38 172 XM_H_SpoofStaff4 684 0.26 0.02 0.36 173 TR_XM_FormFill 669 0.37 0.40 0.36 174 RELAYCOUNTRY_FR 668 0.99 2.34 0.36 175 TVD_SPACE_RATIO 654 0.30 0.20 0.35 176 T_Symld_Words_02 646 0.78 1.72 0.34 177 TR_MetaPhish_Combo_01b 644 0.26 0.08 0.34 178 T_OBFU_PDF_ATTACH 630 0.25 0.06 0.34 179 XM_B_TRADE_HTML 627 0.39 0.50 0.33 180 FORGED_GMAIL_RCVD 621 0.40 0.54 0.33 181 HTML_IMAGE_ONLY_28 611 0.40 0.56 0.32 182 FROM_EGROUPS 602 0.22 0.00 0.32 183 URI_NOVOWEL 595 0.49 0.87 0.32 184 XM_BadFromFormat 573 0.66 1.43 0.30 185 URIBL_DBL_ABUSE_SPAM 572 0.30 0.28 0.30 186 XMPhish14 568 0.45 0.75 0.30 187 XMGappySubj_01 564 0.43 0.70 0.30 188 HTML_IMAGE_ONLY_24 562 0.27 0.22 0.30 189 XMBody_29 539 0.23 0.11 0.29 190 XMSolicitRefs_0 536 0.30 0.34 0.29 191 XM_Combo_Sbj 533 0.35 0.50 0.28 192 XMLngstWrd_00 530 0.34 0.48 0.28 193 MISSING_HEADERS 530 0.32 0.40 0.28 194 TR_LOTS_OF_MONEY3 528 0.40 0.64 0.28 195 HTTPS_HTTP_MISMATCH 516 0.32 0.41 0.27 196 MSGID_FROM_MTA_HEADER 516 0.23 0.15 0.27 197 XMSubMetaSxObfu_03 511 0.53 1.09 0.27 198 XMSubNoVowel 502 0.26 0.23 0.27 199 RELAYCOUNTRY_AU 493 0.29 0.35 0.26 200 RCVD_IN_SORBS_DUL 492 0.26 0.26 0.26 ----------------------------------------------------------------------