Email: 298103 Autolearn: 0 AvgScore: 3.58 AvgScanTime: 3.06 sec Spam: 100601 Autolearn: 0 AvgScore: 12.80 AvgScanTime: 4.01 sec Ham: 197502 Autolearn: 0 AvgScore: -1.11 AvgScanTime: 2.58 sec Time Spent Running SA: 253.52 hours Time Spent Processing Spam: 112.19 hours Time Spent Processing Ham: 141.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 95052 80.22 94.48 72.95 2 DKIM_SIGNED 87164 72.37 86.64 65.10 3 XM_DK_Pass 84475 70.87 83.97 64.20 4 DCC_CHECK 82540 52.97 82.05 38.16 5 DKIM_VALID 78780 66.32 78.31 60.22 6 XMListUnsubscribeExists 75403 53.01 74.95 41.84 7 DKIM_VALID_AU 67050 53.84 66.65 47.32 8 XM_H_QuotedFrom 56519 41.22 56.18 33.59 9 XM_DK_Undo_02 52176 29.17 51.86 17.62 10 BAYES_99 47030 26.85 46.75 16.72 11 BAYES_999 40930 23.73 40.69 15.10 12 HTML_FONT_LOW_CONTRAST 39370 30.83 39.13 26.59 13 TR_DCC_Bayes_99 38202 18.87 37.97 9.13 14 LOC_TINY_FONT_1 38168 27.09 37.94 21.56 15 MIME_HTML_ONLY 30873 21.82 30.69 17.30 16 BAYES_50 30852 46.37 30.67 54.36 17 FVGT_m_MULTI_ODD 25292 20.55 25.14 18.21 18 HTML_IMAGE_RATIO_02 23238 12.95 23.10 7.79 19 XMSubLong 23205 20.80 23.07 19.65 20 XM_Body_Dirty_Words 21885 14.21 21.75 10.36 21 DKIM_VALID_EF 20506 23.80 20.38 25.55 22 RELAYCOUNTRY_META 19689 9.40 19.57 4.22 23 T_KAM_HTML_FONT_INVALID 18585 13.72 18.47 11.30 24 XM_Multi_Part_URI 17191 12.86 17.09 10.70 25 T_TM2_M_HEADER_IN_MSG 16916 26.23 16.81 31.03 26 DCC_CHECK_NEGATIVE 16461 45.67 16.36 60.61 27 MultiRelay 16314 14.77 16.22 14.04 28 XM_Evil_Numbers_Gen 15043 9.92 14.95 7.36 29 FSL_BULK_SIG 14110 11.40 14.03 10.06 30 BOTNET_IPINHOSTNAME 13109 7.87 13.03 5.25 31 XMSexyCombo_05 12463 6.54 12.39 3.56 32 BOTNET 12261 5.09 12.19 1.47 33 UNTRUSTED_Relay 11657 4.79 11.59 1.33 34 LOTS_OF_MONEY 10508 8.94 10.45 8.18 35 T_XMDrugObfuBody_14 9778 6.97 9.72 5.57 36 TooManyTo_001 9450 7.43 9.39 6.43 37 HTML_IMAGE_RATIO_04 9109 5.90 9.05 4.29 38 XM_B_Phish_Phrases 8983 5.87 8.93 4.30 39 LotsOfNums_01 8618 6.94 8.57 6.11 40 RCVD_IN_RP_SAFE 8429 10.30 8.38 11.27 41 DKIM_INVALID 8384 6.05 8.33 4.89 42 TR_XM_DocInvoice 8033 5.02 7.99 3.51 43 XMSubMetaSx_00 7856 5.41 7.81 4.18 44 MPART_ALT_DIFF 7806 4.39 7.76 2.67 45 XM_H_Long_From01 7784 12.77 7.74 15.33 46 RCVD_IN_RP_CERTIFIED 7498 9.39 7.45 10.38 47 XM_UncommonTLD01 7378 5.56 7.33 4.65 48 FROM_EXCESS_BASE64 7283 4.76 7.24 3.49 49 BAYES_80 7228 4.87 7.18 3.70 50 XMStrtUSub 6593 5.16 6.55 4.45 51 BAYES_60 6395 6.63 6.36 6.77 52 MIME_HTML_MOSTLY 5968 3.80 5.93 2.71 53 XMNumbers 5960 4.76 5.92 4.17 54 HTML_IMAGE_RATIO_06 5340 3.73 5.31 2.93 55 NO_DNS_FOR_FROM 4913 3.75 4.88 3.17 56 XM_UB50 4745 2.16 4.72 0.86 57 T_REMOTE_IMAGE 4727 3.86 4.70 3.44 58 XM_SendGrid 4544 4.60 4.52 4.64 59 RCVD_IN_MSPIKE_H2 4362 4.35 4.34 4.36 60 BAYES_95 4290 3.10 4.26 2.51 61 MIME_QP_LONG_LINE 4172 3.59 4.15 3.31 62 RELAYCOUNTRY_CA 4037 2.17 4.01 1.24 63 RCVD_IN_BL_SPAMCOP_NET 3948 1.51 3.92 0.28 64 XM_DIRTYINTL 3903 2.14 3.88 1.25 65 TM2_M_URI_OPT_OUT 3859 2.43 3.84 1.72 66 T_TooManySym_01 3856 4.36 3.83 4.63 67 RCVD_IN_RP_RNBL 3633 1.24 3.61 0.04 68 SpammyFromTLD_02 3415 1.25 3.39 0.16 69 XMBody_17 3285 1.43 3.27 0.50 70 RELAYCOUNTRY_FR 3143 1.24 3.12 0.28 71 SUBJ_ALL_CAPS 3001 8.56 2.98 11.40 72 URI_HEX 2994 1.82 2.98 1.23 73 MultiRelay_Combo 2953 1.11 2.94 0.17 74 MultiRelay_CC 2953 1.11 2.94 0.17 75 XM_CamelCaseFrm001 2928 2.07 2.91 1.64 76 ALL_TRUSTED 2914 20.91 2.90 30.08 77 SpammyFromTLD_01 2897 1.22 2.88 0.37 78 MIME_HTML_ONLY_MULTI 2781 1.58 2.76 0.98 79 XM_BadFromFormat 2777 1.13 2.76 0.29 80 XMBdyGiftCard01 2645 1.49 2.63 0.91 81 XM_OfRef6 2602 1.67 2.59 1.20 82 XM_ProductURIs 2563 1.73 2.55 1.32 83 BODY_URI_ONLY 2473 0.86 2.46 0.04 84 XM_UB99 2444 0.83 2.43 0.01 85 HTML_IMAGE_RATIO_08 2443 2.07 2.43 1.89 86 XM_SPF_SoftFail 2360 1.54 2.35 1.13 87 XMLongAddy 2339 0.86 2.33 0.12 88 HTML_IMAGE_ONLY_08 2317 0.86 2.30 0.13 89 HTML_SHORT_LINK_IMG_1 2274 0.78 2.26 0.02 90 XMSubMetaI_00 2220 1.13 2.21 0.59 91 XM_B_REG_HTML 2124 1.07 2.11 0.54 92 TooManyTo_002 1998 1.91 1.99 1.87 93 XMDiploma_00 1980 1.34 1.97 1.02 94 T_XMDrugObfuBody_08 1978 1.38 1.97 1.09 95 XMPhish30 1946 0.88 1.93 0.34 96 DKIM_ADSP_CUSTOM_MED 1941 1.34 1.93 1.04 97 XMSubNoVowel 1910 3.15 1.90 3.78 98 URIBL_DBL_SPAM 1881 0.66 1.87 0.04 99 SUBJ_DOLLARS 1878 0.74 1.87 0.16 100 TR_Mismatch_TLD_01 1867 1.58 1.86 1.44 101 HDRS_LCASE_IMGONLY 1863 0.65 1.85 0.04 102 TooManyTo_003 1842 1.49 1.83 1.31 103 HTML_MIME_NO_HTML_TAG 1819 1.63 1.81 1.54 104 NML_ADSP_CUSTOM_MED 1818 1.13 1.81 0.78 105 XM_URI_RBL 1816 0.67 1.81 0.10 106 XM_UB999 1781 0.60 1.77 0.01 107 XM_H_Long_From03 1763 0.68 1.75 0.13 108 UNPARSEABLE_RELAY 1724 3.45 1.71 4.33 109 URIBL_BLACK 1713 0.59 1.70 0.02 110 RCVD_IN_IADB_LISTED 1683 3.18 1.67 3.95 111 XM_H_Long_From02 1650 0.99 1.64 0.66 112 TM2_M_VERY_LONG_WORD 1648 1.06 1.64 0.76 113 TooManyTo_004 1627 1.20 1.62 0.99 114 DATE_IN_PAST_06_12 1596 0.66 1.59 0.19 115 XMSexyCombo_01 1544 1.02 1.53 0.76 116 RCVD_IN_IADB_SPF 1502 2.75 1.49 3.40 117 TooManyTo_005 1490 1.05 1.48 0.83 118 RDNS_DYNAMIC 1482 0.83 1.47 0.50 119 RCVD_IN_PSBL 1476 0.59 1.47 0.15 120 XMSubEmpty 1464 2.62 1.46 3.21 121 T_MONEY_PERCENT 1456 0.61 1.45 0.18 122 TR_LOTS_OF_MONEY2 1456 0.61 1.45 0.18 123 TR_XM_RelayPhish 1435 0.67 1.43 0.28 124 RCVD_IN_IADB_SENDERID 1433 2.45 1.42 2.97 125 XM_UB60 1420 0.54 1.41 0.10 126 BAYES_40 1419 5.15 1.41 7.06 127 MAILING_LIST_MULTI 1404 1.72 1.40 1.89 128 RCVD_IN_IADB_DK 1404 2.35 1.40 2.84 129 XM_DK_Undo_01 1371 1.59 1.36 1.70 130 TR_Caps_n_Bayes_99 1361 0.63 1.35 0.26 131 FROM_LOCAL_HEX 1342 0.51 1.33 0.09 132 BAYES_20 1341 1.61 1.33 1.76 133 XMBrknScrpt_02 1326 0.84 1.32 0.60 134 T_XMDrugObfuBody_00 1312 0.84 1.30 0.61 135 FILL_THIS_FORM 1296 0.85 1.29 0.63 136 FROM_LOCAL_DIGITS 1277 0.44 1.27 0.02 137 RELAYCOUNTRY_AT 1263 0.49 1.26 0.09 138 DIET_1 1256 0.62 1.25 0.30 139 BAYES_00 1251 4.16 1.24 5.65 140 XMStockSpam_06 1241 1.34 1.23 1.40 141 URI_TRY_3LD 1222 1.11 1.21 1.06 142 XM_UB80 1214 0.42 1.21 0.02 143 T_XMHurry_00 1210 0.72 1.20 0.48 144 XMBody_78 1195 0.60 1.19 0.30 145 XM_H_PHPMailer 1193 0.93 1.19 0.80 146 FILL_THIS_FORM_LONG 1182 0.75 1.17 0.54 147 XM_B_COPY_HTML 1177 0.84 1.17 0.67 148 BOTNET_NORDNS 1169 0.41 1.16 0.02 149 T_HTML_TAG_BALANCE_CENTER 1163 0.52 1.16 0.19 150 FORGED_YAHOO_RCVD 1162 0.42 1.16 0.05 151 T_FILL_THIS_FORM_LOAN 1148 0.74 1.14 0.53 152 XMPhish14 1093 0.48 1.09 0.17 153 XMPhish11 1071 0.99 1.06 0.95 154 PLING_QUERY 1067 0.52 1.06 0.24 155 TR_XM_DK_Bayes 1056 2.92 1.05 3.87 156 TR_Mismatch_TLD_02 1044 0.38 1.04 0.05 157 FSL_THIS_IS_ADV 1020 0.38 1.01 0.05 158 XMHTML_After_End 1020 0.54 1.01 0.29 159 XM_HighProb1 1007 0.35 1.00 0.01 160 XM_Nigeria_01 1006 0.36 1.00 0.03 161 XMGenDplmaNmb 993 0.70 0.99 0.56 162 DATE_IN_PAST_03_06 977 0.37 0.97 0.07 163 TR_XM_DK_Bayes1 973 2.62 0.97 3.46 164 XMHTMLBadTable_001 955 0.73 0.95 0.63 165 XM_RXBody 955 0.40 0.95 0.12 166 TR_MetaPhish_Combo_01 953 0.66 0.95 0.52 167 RCVD_IN_MSPIKE_H3 950 1.89 0.94 2.37 168 RCVD_IN_MSPIKE_WL 950 1.89 0.94 2.37 169 RELAYCOUNTRY_SG 931 0.37 0.93 0.08 170 TR_XM_DK_Bayes2 911 2.34 0.91 3.08 171 XMSubMetaSSx_00 910 0.41 0.90 0.16 172 TVD_RCVD_IP 910 2.99 0.90 4.05 173 RELAYCOUNTRY_NL 894 0.47 0.89 0.26 174 XM_H_PHPOS 884 0.99 0.88 1.04 175 RELAYCOUNTRY_TW 878 0.39 0.87 0.14 176 XMMoneyMeta_00 876 0.41 0.87 0.17 177 RELAYCOUNTRY_CN 874 0.31 0.87 0.03 178 LONG_JUNK_URI3 870 0.36 0.86 0.10 179 MPART_ALT_DIFF_COUNT 845 0.47 0.84 0.28 180 XM_Hitman 834 0.29 0.83 0.02 181 TR_Symld_Words 804 1.51 0.80 1.88 182 RELAYCOUNTRY_DE 782 0.58 0.78 0.48 183 TVD_APPROVED 776 0.27 0.77 0.02 184 BODY_ENHANCEMENT 769 0.27 0.76 0.01 185 LongTLD 760 0.35 0.76 0.14 186 BAYES_05 760 1.18 0.76 1.40 187 RELAYCOUNTRY_GB 758 0.64 0.75 0.58 188 HTML_FONT_SIZE_HUGE 758 0.37 0.75 0.18 189 MONEY_FRAUD_8 752 0.26 0.75 0.00 190 TVD_SPACE_RATIO 745 0.79 0.74 0.81 191 XM_Body_Obfu01 739 0.33 0.73 0.13 192 RCVD_IN_IADB_VOUCHED 726 2.13 0.72 2.84 193 XM_UB95 712 0.25 0.71 0.01 194 FORGED_GMAIL_RCVD 712 0.52 0.71 0.42 195 HTML_TITLE_SUBJ_DIFF 708 0.26 0.70 0.03 196 T_FILL_THIS_FORM_SHORT 707 0.54 0.70 0.46 197 XM_Nigeria_02 703 0.24 0.70 0.00 198 SHORT_URI_2 700 0.52 0.70 0.44 199 XMSlimDrugH 697 0.48 0.69 0.37 200 T_Symld_Words_02 690 0.34 0.69 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144073 80.22 94.48 72.95 2 DKIM_SIGNED 128583 72.37 86.64 65.10 3 XM_DK_Pass 126795 70.87 83.97 64.20 4 DCC_CHECK_NEGATIVE 119697 45.67 16.36 60.61 5 DKIM_VALID 118931 66.32 78.31 60.22 6 BAYES_50 107366 46.37 30.67 54.36 7 DKIM_VALID_AU 93449 53.84 66.65 47.32 8 XMListUnsubscribeExists 82629 53.01 74.95 41.84 9 DCC_CHECK 75360 52.97 82.05 38.16 10 XM_H_QuotedFrom 66350 41.22 56.18 33.59 11 T_TM2_M_HEADER_IN_MSG 61277 26.23 16.81 31.03 12 ALL_TRUSTED 59414 20.91 2.90 30.08 13 HTML_FONT_LOW_CONTRAST 52521 30.83 39.13 26.59 14 DKIM_VALID_EF 50454 23.80 20.38 25.55 15 LOC_TINY_FONT_1 42586 27.09 37.94 21.56 16 XMSubLong 38814 20.80 23.07 19.65 17 FVGT_m_MULTI_ODD 35972 20.55 25.14 18.21 18 XM_DK_Undo_02 34794 29.17 51.86 17.62 19 MIME_HTML_ONLY 34161 21.82 30.69 17.30 20 BAYES_99 33017 26.85 46.75 16.72 21 XM_H_Long_From01 30285 12.77 7.74 15.33 22 BAYES_999 29818 23.73 40.69 15.10 23 MultiRelay 27729 14.77 16.22 14.04 24 XM_DKIMWhitelistDomains 25229 8.48 0.04 12.77 25 SUBJ_ALL_CAPS 22512 8.56 2.98 11.40 26 T_KAM_HTML_FONT_INVALID 22308 13.72 18.47 11.30 27 RCVD_IN_RP_SAFE 22268 10.30 8.38 11.27 28 XM_Multi_Part_URI 21135 12.86 17.09 10.70 29 RCVD_IN_RP_CERTIFIED 20503 9.39 7.45 10.38 30 XM_Body_Dirty_Words 20463 14.21 21.75 10.36 31 FSL_BULK_SIG 19863 11.40 14.03 10.06 32 TR_DCC_Bayes_99 18039 18.87 37.97 9.13 33 LOTS_OF_MONEY 16150 8.94 10.45 8.18 34 HTML_IMAGE_RATIO_02 15379 12.95 23.10 7.79 35 XM_Evil_Numbers_Gen 14539 9.92 14.95 7.36 36 BAYES_40 13934 5.15 1.41 7.06 37 BAYES_60 13379 6.63 6.36 6.77 38 TooManyTo_001 12690 7.43 9.39 6.43 39 LotsOfNums_01 12058 6.94 8.57 6.11 40 BAYES_00 11150 4.16 1.24 5.65 41 T_XMDrugObfuBody_14 11003 6.97 9.72 5.57 42 BOTNET_IPINHOSTNAME 10362 7.87 13.03 5.25 43 DKIM_INVALID 9652 6.05 8.33 4.89 44 IN_ZIMBRA_NJ_WHITELIST 9467 3.19 0.04 4.79 45 XM_UncommonTLD01 9191 5.56 7.33 4.65 46 XM_SendGrid 9168 4.60 4.52 4.64 47 T_TooManySym_01 9150 4.36 3.83 4.63 48 XMStrtUSub 8789 5.16 6.55 4.45 49 RCVD_IN_MSPIKE_H2 8613 4.35 4.34 4.36 50 UNPARSEABLE_RELAY 8551 3.45 1.71 4.33 51 XM_B_Phish_Phrases 8502 5.87 8.93 4.30 52 HTML_IMAGE_RATIO_04 8479 5.90 9.05 4.29 53 RELAYCOUNTRY_META 8343 9.40 19.57 4.22 54 XMSubMetaSx_00 8261 5.41 7.81 4.18 55 XMNumbers 8242 4.76 5.92 4.17 56 TVD_RCVD_IP 7989 2.99 0.90 4.05 57 RCVD_IN_IADB_LISTED 7804 3.18 1.67 3.95 58 TR_XM_DK_Bayes 7652 2.92 1.05 3.87 59 TO_MALFORMED 7631 2.57 0.02 3.86 60 XMSubNoVowel 7474 3.15 1.90 3.78 61 BAYES_80 7298 4.87 7.18 3.70 62 XMSexyCombo_05 7030 6.54 12.39 3.56 63 TR_XM_DocInvoice 6938 5.02 7.99 3.51 64 BOUNCE_MESSAGE 6925 2.47 0.45 3.51 65 ANY_BOUNCE_MESSAGE 6925 2.47 0.45 3.51 66 FROM_EXCESS_BASE64 6893 4.76 7.24 3.49 67 TR_XM_DK_Bayes1 6834 2.62 0.97 3.46 68 T_REMOTE_IMAGE 6788 3.86 4.70 3.44 69 INVALID_MSGID 6773 2.33 0.18 3.43 70 RCVD_IN_IADB_SPF 6707 2.75 1.49 3.40 71 MSGID_NOFQDN1 6629 2.23 0.02 3.36 72 MIME_QP_LONG_LINE 6543 3.59 4.15 3.31 73 XMSubEmpty 6338 2.62 1.46 3.21 74 NO_DNS_FOR_FROM 6255 3.75 4.88 3.17 75 TR_XM_DK_Bayes2 6078 2.34 0.91 3.08 76 RCVD_IN_IADB_SENDERID 5871 2.45 1.42 2.97 77 HTML_IMAGE_RATIO_06 5791 3.73 5.31 2.93 78 RCVD_IN_IADB_DK 5616 2.35 1.40 2.84 79 RCVD_IN_IADB_VOUCHED 5614 2.13 0.72 2.84 80 MIME_HTML_MOSTLY 5362 3.80 5.93 2.71 81 MPART_ALT_DIFF 5278 4.39 7.76 2.67 82 BAYES_95 4954 3.10 4.26 2.51 83 IN_HORDE_ADDRESS_BOOK 4904 1.68 0.09 2.48 84 RCVD_IN_MSPIKE_H3 4688 1.89 0.94 2.37 85 RCVD_IN_MSPIKE_WL 4688 1.89 0.94 2.37 86 USER_IN_DEF_DKIM_WL 4163 1.44 0.13 2.11 87 XM_PDF 3768 1.41 0.43 1.91 88 MAILING_LIST_MULTI 3738 1.72 1.40 1.89 89 HTML_IMAGE_RATIO_08 3724 2.07 2.43 1.89 90 T_TooManySym_02 3717 1.45 0.62 1.88 91 RCVD_IN_IADB_OPTIN 3716 1.43 0.54 1.88 92 TR_Symld_Words 3705 1.51 0.80 1.88 93 TooManyTo_002 3698 1.91 1.99 1.87 94 BAYES_20 3470 1.61 1.33 1.76 95 TM2_M_URI_OPT_OUT 3391 2.43 3.84 1.72 96 XM_DK_Undo_01 3367 1.59 1.36 1.70 97 XM_CamelCaseFrm001 3242 2.07 2.91 1.64 98 HTML_MIME_NO_HTML_TAG 3043 1.63 1.81 1.54 99 BOTNET 2903 5.09 12.19 1.47 100 TR_Mismatch_TLD_01 2844 1.58 1.86 1.44 101 BAYES_05 2766 1.18 0.76 1.40 102 XMStockSpam_06 2764 1.34 1.23 1.40 103 UNTRUSTED_Relay 2619 4.79 11.59 1.33 104 XM_ProductURIs 2609 1.73 2.55 1.32 105 XM_GoogleGroups 2594 1.03 0.49 1.31 106 TooManyTo_003 2591 1.49 1.83 1.31 107 XM_DIRTYINTL 2470 2.14 3.88 1.25 108 RELAYCOUNTRY_CA 2440 2.17 4.01 1.24 109 URI_HEX 2421 1.82 2.98 1.23 110 XM_OfRef6 2362 1.67 2.59 1.20 111 USER_IN_WHITELIST 2302 0.77 0.00 1.17 112 XM_SPF_SoftFail 2228 1.54 2.35 1.13 113 T_XMDrugObfuBody_08 2144 1.38 1.97 1.09 114 URI_TRY_3LD 2099 1.11 1.21 1.06 115 XM_H_PHPOS 2059 0.99 0.88 1.04 116 DKIM_ADSP_CUSTOM_MED 2052 1.34 1.93 1.04 117 XMDiploma_00 2020 1.34 1.97 1.02 118 T_TooManySym_03 1968 0.69 0.09 1.00 119 TooManyTo_004 1963 1.20 1.62 0.99 120 MIME_HTML_ONLY_MULTI 1942 1.58 2.76 0.98 121 XMPhish11 1874 0.99 1.06 0.95 122 XMBdyGiftCard01 1800 1.49 2.63 0.91 123 XM_UB50 1707 2.16 4.72 0.86 124 XMBody_95 1662 0.62 0.18 0.84 125 TooManyTo_005 1643 1.05 1.48 0.83 126 TVD_SPACE_RATIO 1605 0.79 0.74 0.81 127 XMEmptySub 1605 0.73 0.57 0.81 128 XM_H_PHPMailer 1588 0.93 1.19 0.80 129 NML_ADSP_CUSTOM_MED 1539 1.13 1.81 0.78 130 HELO_NODOT 1535 0.57 0.16 0.78 131 TM2_M_VERY_LONG_WORD 1510 1.06 1.64 0.76 132 XMSexyCombo_01 1504 1.02 1.53 0.76 133 XM_D_tchamptons_WL 1447 0.49 0.00 0.73 134 XMSubMetaSxObfu_02 1384 0.60 0.40 0.70 135 XMNoVowels 1367 0.58 0.36 0.69 136 XM_B_COPY_HTML 1325 0.84 1.17 0.67 137 XM_H_Long_From02 1295 0.99 1.64 0.66 138 FILL_THIS_FORM 1245 0.85 1.29 0.63 139 XMHTMLBadTable_001 1235 0.73 0.95 0.63 140 T_XMDrugObfuBody_00 1206 0.84 1.30 0.61 141 XMBrknScrpt_02 1179 0.84 1.32 0.60 142 XMSubMetaI_00 1156 1.13 2.21 0.59 143 XMCapTrack 1155 0.57 0.53 0.58 144 PP_MIME_FAKE_ASCII_TEXT 1142 0.57 0.56 0.58 145 RELAYCOUNTRY_GB 1137 0.64 0.75 0.58 146 T_TooManySym_04 1118 0.39 0.03 0.57 147 XMGenDplmaNmb 1108 0.70 0.99 0.56 148 XM_B_REG_HTML 1070 1.07 2.11 0.54 149 FILL_THIS_FORM_LONG 1060 0.75 1.17 0.54 150 T_FILL_THIS_FORM_LOAN 1050 0.74 1.14 0.53 151 TM2_M_A_HREF_HREF 1049 0.54 0.56 0.53 152 TR_MetaPhish_Combo_01 1024 0.66 0.95 0.52 153 HTML_FONT_FACE_BAD 1002 0.56 0.67 0.51 154 XMBody_17 991 1.43 3.27 0.50 155 RDNS_DYNAMIC 979 0.83 1.47 0.50 156 XM_H_PHPOS_M 958 0.49 0.49 0.49 157 T_XMHurry_00 951 0.72 1.20 0.48 158 RELAYCOUNTRY_DE 942 0.58 0.78 0.48 159 XMSubject_48 924 0.42 0.33 0.47 160 T_FILL_THIS_FORM_SHORT 912 0.54 0.70 0.46 161 TO_IN_SUBJ 880 0.44 0.44 0.45 162 ADMITS_SPAM 870 0.50 0.61 0.44 163 DKIM_ADSP_NXDOMAIN 865 0.41 0.36 0.44 164 XM_ShortIntro_01 865 0.40 0.31 0.44 165 SHORT_URI_2 860 0.52 0.70 0.44 166 FORGED_GMAIL_RCVD 838 0.52 0.71 0.42 167 XM_B_TRADE_HTML 822 0.50 0.67 0.42 168 HTML_TAG_BALANCE_BODY 792 0.48 0.62 0.40 169 XMRcvdHeader_15 767 0.26 0.00 0.39 170 XMSlimDrugH 740 0.48 0.69 0.37 171 SpammyFromTLD_01 735 1.22 2.88 0.37 172 XM_D_ioffer_Whitelist 720 0.24 0.00 0.36 173 XM_H_SpoofStaff4 702 0.24 0.02 0.36 174 FROM_EGROUPS 679 0.23 0.01 0.34 175 MISSING_HEADERS 674 0.33 0.30 0.34 176 XM_Walgreens_Forge 674 0.28 0.16 0.34 177 XMPhish30 670 0.88 1.93 0.34 178 XMDateMe_00 669 0.28 0.18 0.34 179 T_OBFU_PDF_ATTACH 668 0.25 0.08 0.34 180 XMSUPPORT 668 0.22 0.00 0.34 181 UPPERCASE_50_75 663 0.28 0.17 0.34 182 DATE_IN_FUTURE_06_12 663 0.24 0.06 0.34 183 XMBody_29 644 0.36 0.44 0.33 184 XMGappySubj_01 600 0.33 0.39 0.30 185 URI_WP_HACKED_2 594 0.27 0.22 0.30 186 DIET_1 593 0.62 1.25 0.30 187 XMBody_78 590 0.60 1.19 0.30 188 XM_H_Undi_Recip 589 0.34 0.43 0.30 189 XM_BadFromFormat 582 1.13 2.76 0.29 190 XMLngstWrd_00 579 0.37 0.52 0.29 191 XMHTML_After_End 578 0.54 1.01 0.29 192 HTML_IMAGE_ONLY_28 574 0.30 0.31 0.29 193 URI_NOVOWEL 573 0.42 0.68 0.29 194 T_TooManySym_05 572 0.19 0.00 0.29 195 HTML_IMAGE_ONLY_32 571 0.26 0.20 0.29 196 TR_XM_RelayPhish 552 0.67 1.43 0.28 197 MPART_ALT_DIFF_COUNT 548 0.47 0.84 0.28 198 RCVD_IN_BL_SPAMCOP_NET 547 1.51 3.92 0.28 199 RELAYCOUNTRY_FR 545 1.24 3.12 0.28 200 RELAYCOUNTRY_AU 542 0.30 0.36 0.27 ----------------------------------------------------------------------