Email: 305606 Autolearn: 0 AvgScore: 3.91 AvgScanTime: 3.59 sec Spam: 108918 Autolearn: 0 AvgScore: 12.95 AvgScanTime: 4.62 sec Ham: 196688 Autolearn: 0 AvgScore: -1.10 AvgScanTime: 3.01 sec Time Spent Running SA: 304.38 hours Time Spent Processing Spam: 139.83 hours Time Spent Processing Ham: 164.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102602 82.16 94.20 75.49 2 DKIM_SIGNED 89352 71.10 82.04 65.05 3 DCC_CHECK 89073 54.08 81.78 38.74 4 XM_DK_Pass 86748 69.68 79.65 64.16 5 DKIM_VALID 79409 64.32 72.91 59.57 6 XMListUnsubscribeExists 77333 52.62 71.00 42.44 7 DKIM_VALID_AU 66362 51.01 60.93 45.52 8 XM_H_QuotedFrom 62809 42.58 57.67 34.22 9 XM_DK_Undo_02 54020 29.38 49.60 18.18 10 BAYES_99 48052 27.04 44.12 17.58 11 BAYES_999 42238 24.11 38.78 15.99 12 LOC_TINY_FONT_1 41244 26.94 37.87 20.89 13 HTML_FONT_LOW_CONTRAST 40615 30.57 37.29 26.85 14 TR_DCC_Bayes_99 38731 19.03 35.56 9.88 15 MIME_HTML_ONLY 34368 22.44 31.55 17.39 16 BAYES_50 33942 44.75 31.16 52.28 17 FVGT_m_MULTI_ODD 28083 21.31 25.78 18.84 18 XMSubLong 26124 20.66 23.99 18.81 19 XM_Body_Dirty_Words 23846 14.29 21.89 10.09 20 HTML_IMAGE_RATIO_02 20485 11.82 18.81 7.95 21 RELAYCOUNTRY_META 20328 9.46 18.66 4.36 22 T_TM2_M_HEADER_IN_MSG 19998 26.67 18.36 31.27 23 T_KAM_HTML_FONT_INVALID 19898 13.97 18.27 11.59 24 DKIM_VALID_EF 19332 22.74 17.75 25.50 25 FSL_BULK_SIG 18277 12.49 16.78 10.11 26 DCC_CHECK_NEGATIVE 17867 44.54 16.40 60.12 27 MultiRelay 16882 14.35 15.50 13.71 28 BOTNET 16817 6.48 15.44 1.52 29 XM_Multi_Part_URI 16721 12.73 15.35 11.28 30 XM_Evil_Numbers_Gen 14366 8.72 13.19 6.25 31 BOTNET_IPINHOSTNAME 13971 7.70 12.83 4.86 32 UNTRUSTED_Relay 13421 5.30 12.32 1.41 33 XMSexyCombo_05 12611 6.02 11.58 2.94 34 HTML_IMAGE_RATIO_04 11426 7.90 10.49 6.46 35 LOTS_OF_MONEY 10860 8.98 9.97 8.44 36 XM_B_Phish_Phrases 10479 6.47 9.62 4.73 37 DKIM_INVALID 9943 6.78 9.13 5.48 38 LotsOfNums_01 9129 6.86 8.38 6.02 39 BAYES_60 9031 7.19 8.29 6.57 40 FROM_EXCESS_BASE64 8740 5.14 8.02 3.55 41 TooManyTo_001 8673 6.96 7.96 6.41 42 T_XMDrugObfuBody_14 8632 6.40 7.93 5.56 43 XM_H_Long_From01 8631 11.96 7.92 14.20 44 BAYES_80 8021 4.98 7.36 3.67 45 XMSubMetaSx_00 7811 5.30 7.17 4.27 46 XM_UncommonTLD01 7806 5.56 7.17 4.67 47 TR_XM_DocInvoice 7678 4.66 7.05 3.34 48 MPART_ALT_DIFF 7391 4.13 6.79 2.65 49 NO_DNS_FOR_FROM 7285 5.13 6.69 4.27 50 RCVD_IN_RP_SAFE 7187 9.57 6.60 11.22 51 ALL_TRUSTED 5928 20.14 5.44 28.28 52 XM_UB50 5759 2.49 5.29 0.93 53 XMStrtUSub 5654 5.46 5.19 5.61 54 RCVD_IN_RP_CERTIFIED 5505 8.26 5.05 10.04 55 XM_DIRTYINTL 5403 2.84 4.96 1.66 56 T_TooManySym_01 5071 4.55 4.66 4.49 57 HTML_IMAGE_RATIO_06 5012 3.43 4.60 2.78 58 MIME_HTML_MOSTLY 4963 3.52 4.56 2.95 59 XM_SendGrid 4936 4.62 4.53 4.67 60 XMNumbers 4772 4.05 4.38 3.87 61 XMSubNoVowel 4690 4.12 4.31 4.02 62 BAYES_95 4481 3.00 4.11 2.39 63 T_REMOTE_IMAGE 4099 3.93 3.76 4.03 64 MultiRelay_Combo 4062 1.44 3.73 0.18 65 MultiRelay_CC 4062 1.44 3.73 0.18 66 TR_Mismatch_TLD_01 3992 1.73 3.67 0.65 67 TM2_M_URI_OPT_OUT 3972 2.28 3.65 1.52 68 RCVD_IN_RP_RNBL 3868 1.28 3.55 0.02 69 XMSubEmpty 3732 3.12 3.43 2.94 70 MIME_QP_LONG_LINE 3657 3.27 3.36 3.22 71 XM_CamelCaseFrm001 3422 2.16 3.14 1.62 72 RELAYCOUNTRY_CA 3410 1.93 3.13 1.27 73 HTML_MIME_NO_HTML_TAG 3356 2.16 3.08 1.65 74 RCVD_IN_MSPIKE_H2 3109 3.24 2.85 3.45 75 URI_HEX 3093 2.01 2.84 1.55 76 SpammyFromTLD_01 3062 1.24 2.81 0.38 77 MIME_HTML_ONLY_MULTI 3061 1.57 2.81 0.88 78 RCVD_IN_BL_SPAMCOP_NET 2994 1.19 2.75 0.33 79 XM_OfRef6 2983 2.15 2.74 1.83 80 XM_SPF_SoftFail 2970 1.65 2.73 1.05 81 XM_BadFromFormat 2940 1.10 2.70 0.22 82 SUBJ_ALL_CAPS 2899 7.80 2.66 10.64 83 BOTNET_NORDNS 2754 0.92 2.53 0.03 84 BODY_URI_ONLY 2707 0.92 2.49 0.06 85 XMBdyGiftCard01 2688 1.58 2.47 1.09 86 RCVD_IN_PSBL 2466 0.91 2.26 0.16 87 XMSexyCombo_01 2429 1.06 2.23 0.41 88 TVD_SPACE_RATIO 2339 1.30 2.15 0.83 89 SHORT_URI_2 2307 1.41 2.12 1.02 90 HTML_IMAGE_RATIO_08 2291 2.03 2.10 1.99 91 XM_ProductURIs 2246 1.70 2.06 1.50 92 XM_UB60 2216 0.80 2.03 0.12 93 URIBL_BLACK 2178 0.74 2.00 0.04 94 UNPARSEABLE_RELAY 2171 3.31 1.99 4.04 95 XMPhish30 2113 0.82 1.94 0.19 96 XM_UB99 2064 0.69 1.90 0.02 97 XM_B_REG_HTML 1986 1.22 1.82 0.89 98 SUBJ_DOLLARS 1939 0.82 1.78 0.29 99 XM_H_Long_From02 1938 1.14 1.78 0.79 100 RELAYCOUNTRY_FR 1927 0.78 1.77 0.23 101 XMBody_17 1919 0.87 1.76 0.38 102 T_XMHurry_00 1911 1.05 1.75 0.65 103 TM2_M_VERY_LONG_WORD 1877 1.15 1.72 0.83 104 RCVD_IN_IADB_LISTED 1872 3.38 1.72 4.29 105 XMSubMetaI_00 1849 0.89 1.70 0.44 106 TR_Mismatch_TLD_02 1846 0.63 1.69 0.05 107 MPART_ALT_DIFF_COUNT 1830 0.86 1.68 0.40 108 SpammyFromTLD_02 1792 0.69 1.65 0.17 109 T_XMDrugObfuBody_08 1783 1.12 1.64 0.83 110 XMDiploma_00 1782 1.23 1.64 1.01 111 FSL_THIS_IS_ADV 1744 0.62 1.60 0.07 112 XMLongAddy 1737 0.61 1.59 0.06 113 RCVD_IN_IADB_SPF 1721 2.92 1.58 3.66 114 MAILING_LIST_MULTI 1669 1.83 1.53 1.99 115 BAYES_40 1642 4.99 1.51 6.92 116 RCVD_IN_IADB_SENDERID 1628 2.59 1.49 3.19 117 RCVD_IN_IADB_DK 1617 2.48 1.48 3.04 118 XM_URI_RBL 1609 0.58 1.48 0.08 119 TR_XM_RelayPhish 1573 0.81 1.44 0.46 120 XM_UB999 1545 0.51 1.42 0.01 121 BODY_ENHANCEMENT 1542 0.52 1.42 0.03 122 XM_UB80 1531 0.52 1.41 0.03 123 RELAYCOUNTRY_PL 1524 0.51 1.40 0.02 124 URIBL_DBL_SPAM 1499 0.51 1.38 0.03 125 XM_H_Long_From03 1477 0.53 1.36 0.08 126 XMSexyCombo_04 1472 0.56 1.35 0.13 127 URI_TRY_3LD 1460 1.24 1.34 1.18 128 TooManyTo_002 1456 1.67 1.34 1.86 129 XMPhish11 1439 1.17 1.32 1.09 130 BAYES_00 1417 4.85 1.30 6.82 131 HTML_IMAGE_ONLY_04 1416 0.49 1.30 0.04 132 BAYES_20 1408 1.73 1.29 1.98 133 XMBrknScrpt_02 1383 0.79 1.27 0.52 134 RELAYCOUNTRY_CN 1374 0.50 1.26 0.07 135 RELAYCOUNTRY_AT 1340 0.52 1.23 0.13 136 TooManyTo_003 1318 1.20 1.21 1.20 137 XMHTMLBadTable_001 1282 0.78 1.18 0.56 138 FROM_MISSP_EH_MATCH 1277 0.43 1.17 0.01 139 DKIM_ADSP_CUSTOM_MED 1274 1.06 1.17 1.00 140 FILL_THIS_FORM 1259 0.81 1.16 0.61 141 XM_B_COPY_HTML 1248 0.82 1.15 0.63 142 RCVD_IN_MSPIKE_WL 1229 2.16 1.13 2.73 143 RCVD_IN_MSPIKE_H3 1229 2.16 1.13 2.73 144 XMGppyBdWords 1219 0.45 1.12 0.09 145 XMEmptySub 1211 0.82 1.11 0.66 146 RDNS_DYNAMIC 1190 0.71 1.09 0.50 147 FILL_THIS_FORM_LONG 1180 0.73 1.08 0.54 148 HTML_IMAGE_ONLY_08 1166 0.48 1.07 0.15 149 XM_RXBody 1160 0.44 1.07 0.09 150 HTML_SHORT_LINK_IMG_1 1152 0.39 1.06 0.03 151 XMStockSpam_06 1146 0.77 1.05 0.61 152 XM_DK_Undo_01 1144 1.55 1.05 1.83 153 DEAR_FRIEND 1133 0.39 1.04 0.03 154 ADVANCE_FEE_4_NEW_MONEY 1125 0.37 1.03 0.00 155 NML_ADSP_CUSTOM_MED 1114 0.85 1.02 0.75 156 TR_XM_DK_Bayes 1107 2.85 1.02 3.87 157 T_FILL_THIS_FORM_LOAN 1090 0.70 1.00 0.53 158 RELAYCOUNTRY_IN 1070 0.39 0.98 0.06 159 T_XMDrugObfuBody_00 1065 0.79 0.98 0.68 160 TR_Symld_Words 1060 1.69 0.97 2.08 161 ADMITS_SPAM 1045 0.36 0.96 0.02 162 TooManyTo_004 1044 0.94 0.96 0.92 163 HTML_FONT_SIZE_HUGE 1032 0.40 0.95 0.10 164 RELAYCOUNTRY_JP 1032 0.37 0.95 0.05 165 XM_Lotto 1029 0.40 0.94 0.10 166 DIET_1 1011 0.49 0.93 0.24 167 TR_XM_DK_Bayes1 1010 2.58 0.93 3.49 168 XMBody_78 1008 0.66 0.93 0.52 169 XMHTML_After_End 996 0.50 0.91 0.27 170 FORGED_GMAIL_RCVD 982 0.60 0.90 0.43 171 SHORT_URI 982 0.68 0.90 0.55 172 RELAYCOUNTRY_DE 974 0.66 0.89 0.53 173 T_Symld_Words_02 971 0.49 0.89 0.26 174 FROM_LOCAL_HEX 965 0.36 0.89 0.07 175 TR_XM_DK_Bayes2 941 2.22 0.86 2.97 176 XM_HighProb1 938 0.32 0.86 0.02 177 XM_Body_Obfu01 937 0.40 0.86 0.14 178 HDRS_LCASE_IMGONLY 929 0.34 0.85 0.05 179 TooManyTo_005 924 0.80 0.85 0.78 180 RELAYCOUNTRY_NL 906 0.42 0.83 0.19 181 FROM_LOCAL_DIGITS 905 0.32 0.83 0.03 182 XM_H_PHPOS 882 1.04 0.81 1.17 183 LONG_JUNK_URI3 880 0.33 0.81 0.06 184 T_TooManySym_02 878 1.61 0.81 2.06 185 RELAYCOUNTRY_GB 866 0.67 0.80 0.61 186 PP_MIME_FAKE_ASCII_TEXT 854 0.65 0.78 0.57 187 RELAYCOUNTRY_RU 846 0.29 0.78 0.03 188 BAYES_05 838 1.34 0.77 1.66 189 XM_S_JOY_D 837 0.45 0.77 0.28 190 SUBJECT_NEEDS_ENCODING 835 0.28 0.77 0.02 191 SUBJ_ILLEGAL_CHARS 831 0.28 0.76 0.02 192 XM_OverStock_LProb 828 0.28 0.76 0.02 193 BAD_CREDIT 827 0.29 0.76 0.02 194 XMSubMetaSx_01 823 0.34 0.76 0.11 195 TO_IN_SUBJ 819 0.56 0.75 0.46 196 T_FILL_THIS_FORM_SHORT 819 0.54 0.75 0.42 197 CK_HELO_DYNAMIC_SPLIT_IP 809 0.27 0.74 0.00 198 THIS_AD 776 0.33 0.71 0.12 199 XMSubMetaSxObfu_03 774 0.54 0.71 0.45 200 XMGenDplmaNmb 769 0.57 0.71 0.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148486 82.16 94.20 75.49 2 DKIM_SIGNED 127936 71.10 82.04 65.05 3 XM_DK_Pass 126200 69.68 79.65 64.16 4 DCC_CHECK_NEGATIVE 118245 44.54 16.40 60.12 5 DKIM_VALID 117162 64.32 72.91 59.57 6 BAYES_50 102819 44.75 31.16 52.28 7 DKIM_VALID_AU 89541 51.01 60.93 45.52 8 XMListUnsubscribeExists 83479 52.62 71.00 42.44 9 DCC_CHECK 76205 54.08 81.78 38.74 10 XM_H_QuotedFrom 67314 42.58 57.67 34.22 11 T_TM2_M_HEADER_IN_MSG 61497 26.67 18.36 31.27 12 ALL_TRUSTED 55632 20.14 5.44 28.28 13 HTML_FONT_LOW_CONTRAST 52810 30.57 37.29 26.85 14 DKIM_VALID_EF 50165 22.74 17.75 25.50 15 LOC_TINY_FONT_1 41088 26.94 37.87 20.89 16 FVGT_m_MULTI_ODD 37052 21.31 25.78 18.84 17 XMSubLong 36999 20.66 23.99 18.81 18 XM_DK_Undo_02 35766 29.38 49.60 18.18 19 BAYES_99 34577 27.04 44.12 17.58 20 MIME_HTML_ONLY 34210 22.44 31.55 17.39 21 BAYES_999 31443 24.11 38.78 15.99 22 XM_H_Long_From01 27929 11.96 7.92 14.20 23 MultiRelay 26966 14.35 15.50 13.71 24 XM_DKIMWhitelistDomains 24514 8.03 0.04 12.46 25 T_KAM_HTML_FONT_INVALID 22795 13.97 18.27 11.59 26 XM_Multi_Part_URI 22177 12.73 15.35 11.28 27 RCVD_IN_RP_SAFE 22074 9.57 6.60 11.22 28 SUBJ_ALL_CAPS 20931 7.80 2.66 10.64 29 FSL_BULK_SIG 19894 12.49 16.78 10.11 30 XM_Body_Dirty_Words 19838 14.29 21.89 10.09 31 RCVD_IN_RP_CERTIFIED 19742 8.26 5.05 10.04 32 TR_DCC_Bayes_99 19439 19.03 35.56 9.88 33 LOTS_OF_MONEY 16596 8.98 9.97 8.44 34 HTML_IMAGE_RATIO_02 15630 11.82 18.81 7.95 35 BAYES_40 13606 4.99 1.51 6.92 36 BAYES_00 13408 4.85 1.30 6.82 37 IN_ZIMBRA_NJ_WHITELIST 12936 4.24 0.03 6.58 38 BAYES_60 12932 7.19 8.29 6.57 39 HTML_IMAGE_RATIO_04 12704 7.90 10.49 6.46 40 TooManyTo_001 12612 6.96 7.96 6.41 41 XM_Evil_Numbers_Gen 12287 8.72 13.19 6.25 42 LotsOfNums_01 11842 6.86 8.38 6.02 43 XMStrtUSub 11031 5.46 5.19 5.61 44 T_XMDrugObfuBody_14 10929 6.40 7.93 5.56 45 DKIM_INVALID 10774 6.78 9.13 5.48 46 BOTNET_IPINHOSTNAME 9560 7.70 12.83 4.86 47 XM_B_Phish_Phrases 9298 6.47 9.62 4.73 48 XM_UncommonTLD01 9186 5.56 7.17 4.67 49 XM_SendGrid 9182 4.62 4.53 4.67 50 T_TooManySym_01 8823 4.55 4.66 4.49 51 RELAYCOUNTRY_META 8569 9.46 18.66 4.36 52 RCVD_IN_IADB_LISTED 8445 3.38 1.72 4.29 53 XMSubMetaSx_00 8392 5.30 7.17 4.27 54 NO_DNS_FOR_FROM 8391 5.13 6.69 4.27 55 UNPARSEABLE_RELAY 7937 3.31 1.99 4.04 56 T_REMOTE_IMAGE 7922 3.93 3.76 4.03 57 XMSubNoVowel 7901 4.12 4.31 4.02 58 TR_XM_DK_Bayes 7617 2.85 1.02 3.87 59 XMNumbers 7610 4.05 4.38 3.87 60 BAYES_80 7209 4.98 7.36 3.67 61 RCVD_IN_IADB_SPF 7207 2.92 1.58 3.66 62 TVD_RCVD_IP 7194 2.53 0.51 3.66 63 ANY_BOUNCE_MESSAGE 7187 2.49 0.40 3.65 64 BOUNCE_MESSAGE 7184 2.49 0.40 3.65 65 FROM_EXCESS_BASE64 6976 5.14 8.02 3.55 66 TR_XM_DK_Bayes1 6874 2.58 0.93 3.49 67 RCVD_IN_MSPIKE_H2 6785 3.24 2.85 3.45 68 INVALID_MSGID 6719 2.31 0.31 3.42 69 MSGID_NOFQDN1 6576 2.16 0.03 3.34 70 TR_XM_DocInvoice 6564 4.66 7.05 3.34 71 TO_MALFORMED 6507 2.16 0.09 3.31 72 MIME_QP_LONG_LINE 6329 3.27 3.36 3.22 73 RCVD_IN_IADB_SENDERID 6281 2.59 1.49 3.19 74 RCVD_IN_IADB_VOUCHED 6243 2.29 0.70 3.17 75 RCVD_IN_IADB_DK 5974 2.48 1.48 3.04 76 TR_XM_DK_Bayes2 5844 2.22 0.86 2.97 77 MIME_HTML_MOSTLY 5800 3.52 4.56 2.95 78 XMSubEmpty 5789 3.12 3.43 2.94 79 XMSexyCombo_05 5773 6.02 11.58 2.94 80 HTML_IMAGE_RATIO_06 5473 3.43 4.60 2.78 81 RCVD_IN_MSPIKE_WL 5369 2.16 1.13 2.73 82 RCVD_IN_MSPIKE_H3 5369 2.16 1.13 2.73 83 MPART_ALT_DIFF 5217 4.13 6.79 2.65 84 IN_HORDE_ADDRESS_BOOK 4717 1.57 0.07 2.40 85 BAYES_95 4697 3.00 4.11 2.39 86 HTML_FONT_FACE_BAD 4537 1.74 0.71 2.31 87 TR_Symld_Words 4094 1.69 0.97 2.08 88 T_TooManySym_02 4057 1.61 0.81 2.06 89 RCVD_IN_IADB_OPTIN 4042 1.50 0.50 2.06 90 MAILING_LIST_MULTI 3919 1.83 1.53 1.99 91 HTML_IMAGE_RATIO_08 3918 2.03 2.10 1.99 92 BAYES_20 3886 1.73 1.29 1.98 93 TooManyTo_002 3661 1.67 1.34 1.86 94 USER_IN_DEF_DKIM_WL 3644 1.20 0.02 1.85 95 XM_OfRef6 3600 2.15 2.74 1.83 96 XM_DK_Undo_01 3598 1.55 1.05 1.83 97 XM_PDF 3312 1.19 0.28 1.68 98 XM_DIRTYINTL 3267 2.84 4.96 1.66 99 BAYES_05 3258 1.34 0.77 1.66 100 HTML_MIME_NO_HTML_TAG 3244 2.16 3.08 1.65 101 XM_CamelCaseFrm001 3181 2.16 3.14 1.62 102 URI_HEX 3042 2.01 2.84 1.55 103 TM2_M_URI_OPT_OUT 2992 2.28 3.65 1.52 104 BOTNET 2986 6.48 15.44 1.52 105 XM_ProductURIs 2953 1.70 2.06 1.50 106 UNTRUSTED_Relay 2767 5.30 12.32 1.41 107 XM_GoogleGroups 2547 1.03 0.56 1.29 108 RELAYCOUNTRY_CA 2502 1.93 3.13 1.27 109 TooManyTo_003 2360 1.20 1.21 1.20 110 URI_TRY_3LD 2315 1.24 1.34 1.18 111 XM_H_PHPOS 2306 1.04 0.81 1.17 112 USER_IN_WHITELIST 2303 0.75 0.00 1.17 113 XMBdyGiftCard01 2137 1.58 2.47 1.09 114 XMPhish11 2136 1.17 1.32 1.09 115 XM_SPF_SoftFail 2058 1.65 2.73 1.05 116 T_TooManySym_03 2009 0.73 0.21 1.02 117 SHORT_URI_2 2001 1.41 2.12 1.02 118 XMDiploma_00 1978 1.23 1.64 1.01 119 DKIM_ADSP_CUSTOM_MED 1970 1.06 1.17 1.00 120 XMSubMetaSxObfu_02 1951 0.74 0.28 0.99 121 XM_UB50 1838 2.49 5.29 0.93 122 TooManyTo_004 1815 0.94 0.96 0.92 123 XM_B_REG_HTML 1741 1.22 1.82 0.89 124 MIME_HTML_ONLY_MULTI 1727 1.57 2.81 0.88 125 XM_D_tchamptons_WL 1727 0.57 0.00 0.88 126 XMBody_95 1705 0.64 0.23 0.87 127 XM_H_PHPMailer 1686 0.80 0.71 0.86 128 T_XMDrugObfuBody_08 1638 1.12 1.64 0.83 129 TM2_M_VERY_LONG_WORD 1636 1.15 1.72 0.83 130 TVD_SPACE_RATIO 1633 1.30 2.15 0.83 131 XM_H_Long_From02 1560 1.14 1.78 0.79 132 TooManyTo_005 1530 0.80 0.85 0.78 133 NML_ADSP_CUSTOM_MED 1477 0.85 1.02 0.75 134 T_XMDrugObfuBody_00 1338 0.79 0.98 0.68 135 XMEmptySub 1298 0.82 1.11 0.66 136 TR_Mismatch_TLD_01 1287 1.73 3.67 0.65 137 HELO_NODOT 1286 0.48 0.18 0.65 138 T_XMHurry_00 1286 1.05 1.75 0.65 139 XM_B_COPY_HTML 1245 0.82 1.15 0.63 140 XMNoVowels 1217 0.49 0.26 0.62 141 FILL_THIS_FORM 1208 0.81 1.16 0.61 142 TM2_M_A_HREF_HREF 1196 0.54 0.43 0.61 143 RELAYCOUNTRY_GB 1194 0.67 0.80 0.61 144 XMStockSpam_06 1193 0.77 1.05 0.61 145 T_TooManySym_04 1137 0.38 0.02 0.58 146 PP_MIME_FAKE_ASCII_TEXT 1128 0.65 0.78 0.57 147 TR_MetaPhish_Combo_01 1127 0.55 0.50 0.57 148 XMHTMLBadTable_001 1099 0.78 1.18 0.56 149 SHORT_URI 1090 0.68 0.90 0.55 150 FILL_THIS_FORM_LONG 1054 0.73 1.08 0.54 151 T_FILL_THIS_FORM_LOAN 1048 0.70 1.00 0.53 152 RELAYCOUNTRY_DE 1033 0.66 0.89 0.53 153 XMBrknScrpt_02 1025 0.79 1.27 0.52 154 XMBody_78 1021 0.66 0.93 0.52 155 XMCapTrack 1009 0.46 0.38 0.51 156 RDNS_DYNAMIC 990 0.71 1.09 0.50 157 XMGenDplmaNmb 988 0.57 0.71 0.50 158 MISSING_HEADERS 966 0.49 0.49 0.49 159 TR_XM_RelayPhish 905 0.81 1.44 0.46 160 XM_H_PHPOS_M 905 0.44 0.41 0.46 161 TO_IN_SUBJ 901 0.56 0.75 0.46 162 XM_Walgreens_Forge 897 0.40 0.31 0.46 163 XM_E_Blogspot 886 0.31 0.05 0.45 164 XMSubMetaSxObfu_03 885 0.54 0.71 0.45 165 DKIM_ADSP_NXDOMAIN 868 0.53 0.70 0.44 166 XMSubMetaI_00 859 0.89 1.70 0.44 167 FORGED_GMAIL_RCVD 849 0.60 0.90 0.43 168 T_FILL_THIS_FORM_SHORT 823 0.54 0.75 0.42 169 XMLngstWrd_00 818 0.52 0.70 0.42 170 XMSlimDrugH 802 0.45 0.53 0.41 171 XMSexyCombo_01 802 1.06 2.23 0.41 172 T_MONEY_PERCENT 797 0.47 0.58 0.41 173 TR_LOTS_OF_MONEY2 797 0.47 0.58 0.41 174 URI_NOVOWEL 789 0.48 0.62 0.40 175 MPART_ALT_DIFF_COUNT 785 0.86 1.68 0.40 176 XMRcvdHeader_15 773 0.25 0.00 0.39 177 XM_ShortIntro_01 756 0.34 0.25 0.38 178 XMGappySubj_01 752 0.43 0.50 0.38 179 XMLngstWrd_01 746 0.49 0.68 0.38 180 XMBody_17 745 0.87 1.76 0.38 181 SpammyFromTLD_01 742 1.24 2.81 0.38 182 HTML_TAG_BALANCE_BODY 725 0.47 0.65 0.37 183 XM_H_SpoofStaff4 696 0.24 0.03 0.35 184 XMDateMe_00 657 0.26 0.12 0.33 185 HTTPS_HTTP_MISMATCH 654 0.40 0.54 0.33 186 RCVD_IN_BL_SPAMCOP_NET 652 1.19 2.75 0.33 187 MIME_BASE64_TEXT 645 0.38 0.47 0.33 188 URIBL_RHS_DOB 608 0.22 0.06 0.31 189 T_TooManySym_05 598 0.20 0.01 0.30 190 XMSUPPORT 588 0.19 0.00 0.30 191 SUBJ_DOLLARS 577 0.82 1.78 0.29 192 UPPERCASE_50_75 560 0.24 0.15 0.28 193 T_OBFU_PDF_ATTACH 554 0.20 0.05 0.28 194 XM_S_JOY_D 553 0.45 0.77 0.28 195 HTML_IMAGE_ONLY_32 544 0.24 0.18 0.28 196 RELAYCOUNTRY_AU 541 0.28 0.30 0.28 197 XMHTML_After_End 525 0.50 0.91 0.27 198 XM_H_Trusted_IP 524 0.17 0.00 0.27 199 FROM_EGROUPS 520 0.17 0.00 0.26 200 T_Symld_Words_02 520 0.49 0.89 0.26 ----------------------------------------------------------------------