Email: 277841 Autolearn: 0 AvgScore: 2.66 AvgScanTime: 3.34 sec Spam: 90003 Autolearn: 0 AvgScore: 12.65 AvgScanTime: 4.39 sec Ham: 187838 Autolearn: 0 AvgScore: -2.13 AvgScanTime: 2.83 sec Time Spent Running SA: 257.39 hours Time Spent Processing Spam: 109.73 hours Time Spent Processing Ham: 147.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 85890 80.89 95.43 73.92 2 DKIM_SIGNED 78689 75.24 87.43 69.40 3 XM_DK_Pass 76867 73.95 85.40 68.46 4 DKIM_VALID 72322 69.90 80.36 64.90 5 DCC_CHECK 72205 52.46 80.23 39.16 6 XMListUnsubscribeExists 69007 54.65 76.67 44.10 7 DKIM_VALID_AU 60157 56.31 66.84 51.26 8 XM_H_QuotedFrom 50677 39.45 56.31 31.37 9 XM_DK_Undo_02 48041 30.16 53.38 19.03 10 BAYES_99 42892 27.68 47.66 18.11 11 BAYES_999 37534 24.68 41.70 16.52 12 LOC_TINY_FONT_1 36619 29.09 40.69 23.53 13 HTML_FONT_LOW_CONTRAST 35072 32.09 38.97 28.80 14 TR_DCC_Bayes_99 33966 18.86 37.74 9.81 15 MIME_HTML_ONLY 28241 22.43 31.38 18.15 16 BAYES_50 26598 45.84 29.55 53.64 17 FVGT_m_MULTI_ODD 24836 21.55 27.59 18.65 18 XMSubLong 22611 21.96 25.12 20.45 19 DKIM_VALID_EF 19506 25.66 21.67 27.56 20 HTML_IMAGE_RATIO_02 19374 13.20 21.53 9.20 21 XM_Body_Dirty_Words 18513 13.57 20.57 10.22 22 T_KAM_HTML_FONT_INVALID 18343 14.55 20.38 11.76 23 T_TM2_M_HEADER_IN_MSG 16838 27.42 18.71 31.59 24 DCC_CHECK_NEGATIVE 16229 46.05 18.03 59.48 25 XM_Multi_Part_URI 15817 13.47 17.57 11.51 26 RELAYCOUNTRY_META 15395 8.53 17.10 4.42 27 XM_Evil_Numbers_Gen 14014 9.97 15.57 7.29 28 MultiRelay 13529 14.59 15.03 14.37 29 BOTNET 12830 5.80 14.26 1.75 30 BOTNET_IPINHOSTNAME 11681 8.04 12.98 5.68 31 FSL_BULK_SIG 10459 10.21 11.62 9.53 32 UNTRUSTED_Relay 10383 4.63 11.54 1.33 33 XMSexyCombo_05 10380 6.27 11.53 3.74 34 LOTS_OF_MONEY 9713 9.54 10.79 8.95 35 XM_B_Phish_Phrases 9461 5.91 10.51 3.70 36 HTML_IMAGE_RATIO_04 9011 6.76 10.01 5.20 37 T_XMDrugObfuBody_14 8566 6.96 9.52 5.73 38 FROM_EXCESS_BASE64 8407 5.90 9.34 4.25 39 XMSubMetaSx_00 8079 6.13 8.98 4.76 40 TR_XM_DocInvoice 7595 6.07 8.44 4.93 41 LotsOfNums_01 7463 7.16 8.29 6.62 42 TooManyTo_001 7402 7.01 8.22 6.42 43 MPART_ALT_DIFF 6804 4.45 7.56 2.96 44 XM_H_Long_From01 6748 12.64 7.50 15.10 45 RCVD_IN_RP_SAFE 6696 11.18 7.44 12.97 46 BAYES_80 6566 4.90 7.30 3.75 47 XM_UncommonTLD01 6518 5.66 7.24 4.90 48 DKIM_INVALID 6367 5.33 7.07 4.50 49 RCVD_IN_RP_CERTIFIED 5830 10.30 6.48 12.12 50 BAYES_60 5461 5.96 6.07 5.90 51 HTML_IMAGE_RATIO_06 5316 3.73 5.91 2.68 52 XMStrtUSub 5058 5.21 5.62 5.01 53 NO_DNS_FOR_FROM 5030 4.10 5.59 3.39 54 MIME_HTML_MOSTLY 4855 4.13 5.39 3.53 55 XM_SendGrid 4533 4.92 5.04 4.86 56 XMNumbers 4386 4.05 4.87 3.66 57 XM_UB50 4357 2.15 4.84 0.86 58 RCVD_IN_MSPIKE_H2 4356 5.07 4.84 5.18 59 T_REMOTE_IMAGE 3951 3.89 4.39 3.65 60 BAYES_95 3889 3.11 4.32 2.53 61 XM_CamelCaseFrm001 3770 2.53 4.19 1.73 62 MIME_QP_LONG_LINE 3269 3.74 3.63 3.80 63 XM_DIRTYINTL 3241 2.22 3.60 1.55 64 TM2_M_URI_OPT_OUT 3231 2.22 3.59 1.56 65 URI_HEX 3046 1.94 3.38 1.25 66 T_TooManySym_01 2894 4.18 3.22 4.64 67 XM_SPF_SoftFail 2594 1.70 2.88 1.13 68 XMBody_17 2588 1.24 2.88 0.46 69 XM_OfRef6 2563 2.25 2.85 1.96 70 MIME_HTML_ONLY_MULTI 2508 1.47 2.79 0.84 71 RELAYCOUNTRY_CA 2402 1.74 2.67 1.30 72 HTML_IMAGE_RATIO_08 2337 2.23 2.60 2.06 73 SUBJ_ALL_CAPS 2271 8.23 2.52 10.96 74 RELAYCOUNTRY_FR 2234 0.93 2.48 0.19 75 XM_URI_RBL 2205 0.87 2.45 0.11 76 HTML_MIME_NO_HTML_TAG 2125 1.76 2.36 1.47 77 RCVD_IN_BL_SPAMCOP_NET 2110 0.95 2.34 0.29 78 MultiRelay_CC 1976 0.84 2.20 0.18 79 MultiRelay_Combo 1976 0.84 2.20 0.18 80 UNPARSEABLE_RELAY 1957 3.82 2.17 4.61 81 XMSubMetaI_00 1947 1.02 2.16 0.47 82 XMSexyCombo_01 1929 1.27 2.14 0.85 83 SpammyFromTLD_01 1875 0.91 2.08 0.34 84 BAYES_00 1847 4.56 2.05 5.77 85 XMBdyGiftCard01 1835 1.36 2.04 1.04 86 TM2_M_VERY_LONG_WORD 1828 1.20 2.03 0.81 87 SpammyFromTLD_02 1819 0.78 2.02 0.18 88 RCVD_IN_RP_RNBL 1810 0.68 2.01 0.04 89 XMLongAddy 1739 0.67 1.93 0.07 90 XMPhish30 1701 0.86 1.89 0.37 91 DIET_1 1697 0.97 1.89 0.54 92 T_XMDrugObfuBody_08 1695 1.21 1.88 0.89 93 XM_UB99 1676 0.61 1.86 0.01 94 BOTNET_NORDNS 1665 0.61 1.85 0.02 95 RCVD_IN_IADB_LISTED 1657 3.20 1.84 3.85 96 URIBL_BLACK 1630 0.60 1.81 0.02 97 TR_Mismatch_TLD_02 1574 0.63 1.75 0.09 98 T_HTML_TAG_BALANCE_CENTER 1538 0.61 1.71 0.08 99 MPART_ALT_DIFF_COUNT 1499 0.69 1.67 0.23 100 XMDiploma_00 1498 1.30 1.66 1.13 101 XM_BadFromFormat 1474 0.68 1.64 0.22 102 XM_ProductURIs 1453 1.31 1.61 1.17 103 RCVD_IN_IADB_SPF 1444 2.86 1.60 3.47 104 XM_B_COPY_HTML 1432 0.99 1.59 0.70 105 T_XMHurry_00 1417 0.88 1.57 0.55 106 URI_TRY_3LD 1412 1.12 1.57 0.90 107 URIBL_DBL_SPAM 1409 0.53 1.57 0.03 108 XM_UB60 1394 0.55 1.55 0.08 109 RCVD_IN_IADB_SENDERID 1393 2.63 1.55 3.15 110 XM_B_REG_HTML 1391 1.28 1.55 1.16 111 RCVD_IN_IADB_DK 1389 2.58 1.54 3.08 112 TR_XM_DK_Bayes 1368 3.17 1.52 3.95 113 XM_UB999 1354 0.49 1.50 0.01 114 XMStockSpam_06 1341 1.45 1.49 1.44 115 XMHTMLBadTable_001 1302 0.85 1.45 0.57 116 RELAYCOUNTRY_DE 1301 0.75 1.45 0.42 117 TR_XM_DK_Bayes1 1301 3.01 1.45 3.76 118 XM_H_Long_From03 1300 0.52 1.44 0.07 119 T_XMDrugObfuBody_00 1284 0.76 1.43 0.45 120 MAILING_LIST_MULTI 1268 1.89 1.41 2.13 121 XM_DK_Undo_01 1250 1.66 1.39 1.80 122 RELAYCOUNTRY_CN 1250 0.49 1.39 0.05 123 XM_H_Long_From02 1243 0.90 1.38 0.67 124 ALL_TRUSTED 1206 17.81 1.34 25.70 125 SUBJ_DOLLARS 1143 0.59 1.27 0.26 126 XM_UB80 1134 0.43 1.26 0.03 127 BAYES_40 1112 4.94 1.24 6.72 128 XMHTML_After_End 1107 0.56 1.23 0.24 129 BODY_URI_ONLY 1101 0.45 1.22 0.08 130 TR_XM_DK_Bayes2 1084 2.50 1.20 3.12 131 LONG_JUNK_URI3 1077 0.42 1.20 0.04 132 PLING_QUERY 1072 0.75 1.19 0.54 133 RELAYCOUNTRY_AT 1071 0.47 1.19 0.13 134 BOUNCE_MESSAGE 1059 2.89 1.18 3.71 135 ANY_BOUNCE_MESSAGE 1059 2.89 1.18 3.71 136 HTML_FONT_SIZE_HUGE 1058 0.43 1.18 0.07 137 XMBrknScrpt_02 1051 0.72 1.17 0.51 138 HTML_TAG_BALANCE_BODY 1039 0.58 1.15 0.30 139 HTML_IMAGE_ONLY_08 1016 0.45 1.13 0.13 140 XM_H_PHPOS 1004 1.14 1.12 1.16 141 XMSubMetaSSx_00 1000 0.61 1.11 0.37 142 TR_XM_RelayPhish 992 0.51 1.10 0.22 143 XMPhish14 989 0.52 1.10 0.24 144 HTML_SHORT_LINK_IMG_1 980 0.37 1.09 0.03 145 XMPhish11 974 0.95 1.08 0.89 146 XMSexyCombo_04 958 0.44 1.06 0.14 147 RDNS_DYNAMIC 957 0.71 1.06 0.55 148 XM_HighProb1 938 0.35 1.04 0.02 149 BAYES_20 936 1.72 1.04 2.05 150 FSL_THIS_IS_ADV 908 0.36 1.01 0.05 151 T_FILL_THIS_FORM_SHORT 893 0.65 0.99 0.48 152 TR_LOTS_OF_MONEY3 886 0.51 0.98 0.29 153 XMBody_78 883 0.74 0.98 0.63 154 XM_RXBody 843 0.39 0.94 0.13 155 T_Symld_Words_02 825 0.47 0.92 0.26 156 RCVD_IN_PSBL 823 0.49 0.91 0.29 157 BASE64_LENGTH_79_INF 815 0.43 0.91 0.19 158 XM_Body_Obfu01 814 0.41 0.90 0.17 159 PP_MIME_FAKE_ASCII_TEXT 812 0.44 0.90 0.22 160 XMGenDplmaNmb 810 0.70 0.90 0.60 161 RCVD_IN_MSPIKE_WL 762 1.39 0.85 1.65 162 XMSlimDrugH 757 0.42 0.84 0.22 163 BODY_ENHANCEMENT 757 0.29 0.84 0.02 164 RELAYCOUNTRY_GB 752 0.77 0.84 0.74 165 HTML_IMAGE_ONLY_24 750 0.45 0.83 0.27 166 XM_H_PHPMailer 722 0.75 0.80 0.73 167 TR_Symld_Words 700 1.41 0.78 1.71 168 XMClaimOffer 695 0.32 0.77 0.10 169 RELAYCOUNTRY_UA 687 0.25 0.76 0.01 170 URI_NOVOWEL 686 0.41 0.76 0.24 171 XMBounce_01 683 0.28 0.76 0.04 172 HTML_FONT_FACE_BAD 678 0.52 0.75 0.41 173 TR_MetaPhish_Combo_01 671 0.60 0.75 0.53 174 TR_Caps_n_Bayes_99 668 0.27 0.74 0.05 175 XMSolicitRefs_0 666 0.49 0.74 0.36 176 TooManyTo_002 653 1.43 0.73 1.76 177 DKIM_ADSP_CUSTOM_MED 650 0.85 0.72 0.91 178 RCVD_IN_MSPIKE_H3 648 1.34 0.72 1.64 179 REMOVE_BEFORE_LINK 646 0.38 0.72 0.22 180 T_TooManySym_02 644 1.69 0.72 2.15 181 XMBSHREFv2 638 0.33 0.71 0.15 182 BAYES_05 626 1.17 0.70 1.39 183 RELAYCOUNTRY_NL 622 0.44 0.69 0.32 184 RELAYCOUNTRY_AU 616 0.42 0.68 0.30 185 ADVANCE_FEE_3_NEW_MONEY 614 0.23 0.68 0.01 186 XM_OfRef7 609 0.32 0.68 0.14 187 TO_MALFORMED 608 2.55 0.68 3.44 188 RCVD_IN_IADB_VOUCHED 602 1.76 0.67 2.28 189 MISSING_HEADERS 600 0.54 0.67 0.47 190 TooManyTo_003 590 1.04 0.66 1.23 191 T_MONEY_PERCENT 586 0.35 0.65 0.21 192 TR_LOTS_OF_MONEY2 586 0.35 0.65 0.21 193 XMGappySubj_01 578 0.41 0.64 0.29 194 LongTLD 577 0.30 0.64 0.14 195 FROM_LOCAL_HEX 568 0.26 0.63 0.08 196 DKIM_ADSP_NXDOMAIN 559 0.52 0.62 0.47 197 FVGT_m_MULTI_ODD_EMAIL 554 0.25 0.62 0.08 198 NML_ADSP_CUSTOM_MED 551 0.64 0.61 0.66 199 TM2_M_A_HREF_HREF 542 0.61 0.60 0.61 200 FORGED_GMAIL_RCVD 537 0.44 0.60 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138859 80.89 95.43 73.92 2 DKIM_SIGNED 130352 75.24 87.43 69.40 3 XM_DK_Pass 128597 73.95 85.40 68.46 4 DKIM_VALID 121898 69.90 80.36 64.90 5 DCC_CHECK_NEGATIVE 111717 46.05 18.03 59.48 6 BAYES_50 100751 45.84 29.55 53.64 7 DKIM_VALID_AU 96289 56.31 66.84 51.26 8 XMListUnsubscribeExists 82833 54.65 76.67 44.10 9 DCC_CHECK 73561 52.46 80.23 39.16 10 T_TM2_M_HEADER_IN_MSG 59333 27.42 18.71 31.59 11 XM_H_QuotedFrom 58920 39.45 56.31 31.37 12 HTML_FONT_LOW_CONTRAST 54099 32.09 38.97 28.80 13 DKIM_VALID_EF 51777 25.66 21.67 27.56 14 ALL_TRUSTED 48279 17.81 1.34 25.70 15 LOC_TINY_FONT_1 44202 29.09 40.69 23.53 16 XMSubLong 38412 21.96 25.12 20.45 17 XM_DK_Undo_02 35751 30.16 53.38 19.03 18 FVGT_m_MULTI_ODD 35033 21.55 27.59 18.65 19 MIME_HTML_ONLY 34086 22.43 31.38 18.15 20 BAYES_99 34014 27.68 47.66 18.11 21 BAYES_999 31037 24.68 41.70 16.52 22 XM_H_Long_From01 28358 12.64 7.50 15.10 23 MultiRelay 27000 14.59 15.03 14.37 24 XM_DKIMWhitelistDomains 26710 9.63 0.04 14.22 25 RCVD_IN_RP_SAFE 24355 11.18 7.44 12.97 26 RCVD_IN_RP_CERTIFIED 22775 10.30 6.48 12.12 27 T_KAM_HTML_FONT_INVALID 22082 14.55 20.38 11.76 28 XM_Multi_Part_URI 21618 13.47 17.57 11.51 29 SUBJ_ALL_CAPS 20595 8.23 2.52 10.96 30 XM_Body_Dirty_Words 19199 13.57 20.57 10.22 31 TR_DCC_Bayes_99 18427 18.86 37.74 9.81 32 FSL_BULK_SIG 17906 10.21 11.62 9.53 33 HTML_IMAGE_RATIO_02 17289 13.20 21.53 9.20 34 LOTS_OF_MONEY 16804 9.54 10.79 8.95 35 XM_Evil_Numbers_Gen 13691 9.97 15.57 7.29 36 BAYES_40 12625 4.94 1.24 6.72 37 LotsOfNums_01 12429 7.16 8.29 6.62 38 TooManyTo_001 12066 7.01 8.22 6.42 39 BAYES_60 11087 5.96 6.07 5.90 40 BAYES_00 10836 4.56 2.05 5.77 41 T_XMDrugObfuBody_14 10761 6.96 9.52 5.73 42 BOTNET_IPINHOSTNAME 10660 8.04 12.98 5.68 43 HTML_IMAGE_RATIO_04 9769 6.76 10.01 5.20 44 RCVD_IN_MSPIKE_H2 9722 5.07 4.84 5.18 45 XMStrtUSub 9417 5.21 5.62 5.01 46 TR_XM_DocInvoice 9267 6.07 8.44 4.93 47 XM_UncommonTLD01 9198 5.66 7.24 4.90 48 XM_SendGrid 9131 4.92 5.04 4.86 49 IN_ZIMBRA_NJ_WHITELIST 9052 3.27 0.03 4.82 50 XMSubMetaSx_00 8948 6.13 8.98 4.76 51 T_TooManySym_01 8717 4.18 3.22 4.64 52 UNPARSEABLE_RELAY 8653 3.82 2.17 4.61 53 DKIM_INVALID 8454 5.33 7.07 4.50 54 RELAYCOUNTRY_META 8302 8.53 17.10 4.42 55 TVD_RCVD_IP 8099 3.04 0.39 4.31 56 FROM_EXCESS_BASE64 7980 5.90 9.34 4.25 57 TR_XM_DK_Bayes 7427 3.17 1.52 3.95 58 RCVD_IN_IADB_LISTED 7233 3.20 1.84 3.85 59 MIME_QP_LONG_LINE 7132 3.74 3.63 3.80 60 TR_XM_DK_Bayes1 7058 3.01 1.45 3.76 61 BAYES_80 7041 4.90 7.30 3.75 62 XMSexyCombo_05 7034 6.27 11.53 3.74 63 ANY_BOUNCE_MESSAGE 6977 2.89 1.18 3.71 64 BOUNCE_MESSAGE 6977 2.89 1.18 3.71 65 XM_B_Phish_Phrases 6950 5.91 10.51 3.70 66 XMNumbers 6876 4.05 4.87 3.66 67 T_REMOTE_IMAGE 6857 3.89 4.39 3.65 68 INVALID_MSGID 6730 2.47 0.16 3.58 69 MIME_HTML_MOSTLY 6632 4.13 5.39 3.53 70 RCVD_IN_IADB_SPF 6511 2.86 1.60 3.47 71 TO_MALFORMED 6468 2.55 0.68 3.44 72 NO_DNS_FOR_FROM 6367 4.10 5.59 3.39 73 RCVD_IN_IADB_SENDERID 5918 2.63 1.55 3.15 74 TR_XM_DK_Bayes2 5862 2.50 1.20 3.12 75 RCVD_IN_IADB_DK 5785 2.58 1.54 3.08 76 MPART_ALT_DIFF 5562 4.45 7.56 2.96 77 HTML_IMAGE_RATIO_06 5035 3.73 5.91 2.68 78 IN_HORDE_ADDRESS_BOOK 4960 1.82 0.10 2.64 79 BAYES_95 4744 3.11 4.32 2.53 80 RCVD_IN_IADB_VOUCHED 4286 1.76 0.67 2.28 81 USER_IN_DEF_DKIM_WL 4102 1.49 0.04 2.18 82 T_TooManySym_02 4043 1.69 0.72 2.15 83 MAILING_LIST_MULTI 3995 1.89 1.41 2.13 84 HTML_IMAGE_RATIO_08 3865 2.23 2.60 2.06 85 BAYES_20 3852 1.72 1.04 2.05 86 XM_OfRef6 3681 2.25 2.85 1.96 87 XM_DK_Undo_01 3374 1.66 1.39 1.80 88 TooManyTo_002 3309 1.43 0.73 1.76 89 BOTNET 3293 5.80 14.26 1.75 90 XM_CamelCaseFrm001 3249 2.53 4.19 1.73 91 TR_Symld_Words 3220 1.41 0.78 1.71 92 XM_PDF 3146 1.26 0.39 1.67 93 RCVD_IN_MSPIKE_WL 3099 1.39 0.85 1.65 94 RCVD_IN_MSPIKE_H3 3078 1.34 0.72 1.64 95 TM2_M_URI_OPT_OUT 2936 2.22 3.59 1.56 96 XM_DIRTYINTL 2914 2.22 3.60 1.55 97 HTML_MIME_NO_HTML_TAG 2755 1.76 2.36 1.47 98 XMStockSpam_06 2698 1.45 1.49 1.44 99 FILL_THIS_FORM 2623 1.08 0.42 1.40 100 BAYES_05 2620 1.17 0.70 1.39 101 UNTRUSTED_Relay 2492 4.63 11.54 1.33 102 T_FILL_THIS_FORM_LOAN 2443 0.97 0.28 1.30 103 RELAYCOUNTRY_CA 2433 1.74 2.67 1.30 104 URI_HEX 2352 1.94 3.38 1.25 105 USER_IN_WHITELIST 2338 0.84 0.00 1.24 106 TooManyTo_003 2306 1.04 0.66 1.23 107 XM_GoogleGroups 2271 1.00 0.57 1.21 108 T_FILL_THIS_FORM_LONG 2208 0.84 0.14 1.18 109 XM_ProductURIs 2195 1.31 1.61 1.17 110 XM_H_PHPOS 2175 1.14 1.12 1.16 111 XM_B_REG_HTML 2170 1.28 1.55 1.16 112 T_TooManySym_03 2156 0.82 0.15 1.15 113 XM_SPF_SoftFail 2131 1.70 2.88 1.13 114 XMDiploma_00 2126 1.30 1.66 1.13 115 RCVD_IN_IADB_OPTIN 2032 0.88 0.46 1.08 116 XMBdyGiftCard01 1954 1.36 2.04 1.04 117 XMSubMetaSxObfu_02 1933 0.79 0.28 1.03 118 TooManyTo_004 1896 0.82 0.41 1.01 119 XMBody_95 1817 0.71 0.17 0.97 120 DKIM_ADSP_CUSTOM_MED 1709 0.85 0.72 0.91 121 URI_TRY_3LD 1698 1.12 1.57 0.90 122 T_XMDrugObfuBody_08 1669 1.21 1.88 0.89 123 XMPhish11 1666 0.95 1.08 0.89 124 TooManyTo_005 1617 0.69 0.34 0.86 125 XM_UB50 1614 2.15 4.84 0.86 126 XMSexyCombo_01 1590 1.27 2.14 0.85 127 MIME_HTML_ONLY_MULTI 1582 1.47 2.79 0.84 128 HELO_NODOT 1559 0.64 0.24 0.83 129 TM2_M_VERY_LONG_WORD 1514 1.20 2.03 0.81 130 XMRcvdHeader_15 1430 0.51 0.00 0.76 131 RELAYCOUNTRY_GB 1385 0.77 0.84 0.74 132 XM_H_SpoofStaff4 1370 0.50 0.03 0.73 133 XM_H_PHPMailer 1365 0.75 0.80 0.73 134 XM_B_COPY_HTML 1308 0.99 1.59 0.70 135 XMSUPPORT 1289 0.46 0.00 0.69 136 XM_H_Long_From02 1257 0.90 1.38 0.67 137 NML_ADSP_CUSTOM_MED 1241 0.64 0.61 0.66 138 XMBody_78 1183 0.74 0.98 0.63 139 TM2_M_A_HREF_HREF 1154 0.61 0.60 0.61 140 T_TooManySym_04 1150 0.42 0.03 0.61 141 XMSubject_48 1124 0.46 0.16 0.60 142 XMGenDplmaNmb 1123 0.70 0.90 0.60 143 XMHTMLBadTable_001 1062 0.85 1.45 0.57 144 XMCapTrack 1043 0.52 0.44 0.56 145 T_XMHurry_00 1034 0.88 1.57 0.55 146 ADMITS_SPAM 1030 0.52 0.46 0.55 147 RDNS_DYNAMIC 1029 0.71 1.06 0.55 148 DIET_1 1010 0.97 1.89 0.54 149 PLING_QUERY 1006 0.75 1.19 0.54 150 TR_MetaPhish_Combo_01 994 0.60 0.75 0.53 151 XMBrknScrpt_02 951 0.72 1.17 0.51 152 XMNoVowels 941 0.45 0.33 0.50 153 XM_D_tchamptons_WL 925 0.33 0.00 0.49 154 T_FILL_THIS_FORM_SHORT 905 0.65 0.99 0.48 155 DKIM_ADSP_NXDOMAIN 889 0.52 0.62 0.47 156 MISSING_HEADERS 887 0.54 0.67 0.47 157 XMSubMetaI_00 881 1.02 2.16 0.47 158 XM_H_PHPOS_M 880 0.48 0.52 0.47 159 XMBody_17 857 1.24 2.88 0.46 160 XM_Walgreens_Forge 844 0.41 0.31 0.45 161 T_XMDrugObfuBody_00 839 0.76 1.43 0.45 162 RELAYCOUNTRY_DE 796 0.75 1.45 0.42 163 HTML_FONT_FACE_BAD 764 0.52 0.75 0.41 164 RCVD_IN_IADB_DOPTIN 743 0.29 0.06 0.40 165 XMLngstWrd_00 708 0.43 0.55 0.38 166 XMSubMetaSSx_00 704 0.61 1.11 0.37 167 XMPhish30 700 0.86 1.89 0.37 168 FORGED_GMAIL_RCVD 684 0.44 0.60 0.36 169 XMSolicitRefs_0 684 0.49 0.74 0.36 170 XM_Lotto 662 0.43 0.58 0.35 171 FROM_EGROUPS 658 0.24 0.00 0.35 172 SpammyFromTLD_01 648 0.91 2.08 0.34 173 XMLngstWrd_01 642 0.40 0.53 0.34 174 XMSubNoVowel 633 0.34 0.33 0.34 175 XM_ShortIntro_01 622 0.33 0.31 0.33 176 T_TooManySym_05 600 0.22 0.02 0.32 177 RELAYCOUNTRY_NL 600 0.44 0.69 0.32 178 XMDateMe_00 577 0.31 0.31 0.31 179 XM_D_ioffer_Whitelist 576 0.21 0.00 0.31 180 HTML_TAG_BALANCE_BODY 567 0.58 1.15 0.30 181 T_OBFU_PDF_ATTACH 566 0.25 0.15 0.30 182 RELAYCOUNTRY_AU 562 0.42 0.68 0.30 183 XMGappySubj_01 553 0.41 0.64 0.29 184 XMSubEmpty 551 0.25 0.17 0.29 185 RCVD_IN_PSBL 547 0.49 0.91 0.29 186 TR_LOTS_OF_MONEY3 543 0.51 0.98 0.29 187 TR_Sbj_FN_Bdy 542 0.29 0.30 0.29 188 HTML_IMAGE_ONLY_28 542 0.33 0.42 0.29 189 TR_MetaPhish_Combo_01b 540 0.25 0.16 0.29 190 RCVD_IN_BL_SPAMCOP_NET 537 0.95 2.34 0.29 191 XM_S_JOY_D 535 0.36 0.50 0.28 192 XMBody_29 533 0.30 0.33 0.28 193 HTML_IMAGE_ONLY_24 511 0.45 0.83 0.27 194 XM_H_Undi_Recip 495 0.25 0.21 0.26 195 SUBJ_DOLLARS 491 0.59 1.27 0.26 196 UPPERCASE_50_75 482 0.25 0.23 0.26 197 T_Symld_Words_02 480 0.47 0.92 0.26 198 HTTPS_HTTP_MISMATCH 480 0.31 0.42 0.26 199 XM_B_TRADE_HTML 477 0.34 0.51 0.25 200 TVD_SPACE_RATIO 466 0.22 0.18 0.25 ----------------------------------------------------------------------