Email: 312515 Autolearn: 0 AvgScore: 3.02 AvgScanTime: 3.02 sec Spam: 103686 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 3.70 sec Ham: 208829 Autolearn: 0 AvgScore: -1.89 AvgScanTime: 2.69 sec Time Spent Running SA: 262.58 hours Time Spent Processing Spam: 106.69 hours Time Spent Processing Ham: 155.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96043 83.35 92.63 78.74 2 DKIM_SIGNED 85526 68.85 82.49 62.09 3 XM_DK_Pass 83757 67.71 80.78 61.23 4 DCC_CHECK 81869 50.68 78.96 36.63 5 DKIM_VALID 79215 64.18 76.40 58.11 6 XMListUnsubscribeExists 74059 51.06 71.43 40.94 7 DKIM_VALID_AU 66238 52.54 63.88 46.90 8 XM_H_QuotedFrom 60163 45.03 58.02 38.57 9 XM_DK_Undo_02 51714 27.51 49.88 16.40 10 BAYES_99 46834 25.76 45.17 16.12 11 BAYES_999 40844 22.74 39.39 14.48 12 LOC_TINY_FONT_1 40079 27.89 38.65 22.54 13 HTML_FONT_LOW_CONTRAST 39261 30.08 37.87 26.21 14 TR_DCC_Bayes_99 37390 18.04 36.06 9.09 15 BAYES_50 33960 45.49 32.75 51.82 16 MIME_HTML_ONLY 30723 24.15 29.63 21.44 17 XMSubLong 29311 24.25 28.27 22.26 18 FVGT_m_MULTI_ODD 25943 19.47 25.02 16.72 19 XM_Body_Dirty_Words 22077 14.25 21.29 10.75 20 DCC_CHECK_NEGATIVE 20446 48.04 19.72 62.11 21 HTML_IMAGE_RATIO_02 20412 11.69 19.69 7.73 22 DKIM_VALID_EF 19187 22.73 18.50 24.83 23 T_KAM_HTML_FONT_INVALID 18557 13.17 17.90 10.82 24 RELAYCOUNTRY_META 17682 8.42 17.05 4.14 25 XM_Multi_Part_URI 17517 13.18 16.89 11.34 26 T_TM2_M_HEADER_IN_MSG 17452 20.38 16.83 22.14 27 MultiRelay 16727 13.70 16.13 12.49 28 XM_Evil_Numbers_Gen 15569 10.20 15.02 7.80 29 BOTNET_IPINHOSTNAME 14443 7.96 13.93 5.00 30 FSL_BULK_SIG 14191 10.18 13.69 8.43 31 BOTNET 13582 5.06 13.10 1.07 32 XMSexyCombo_05 11502 6.38 11.09 4.04 33 UNTRUSTED_Relay 11485 4.49 11.08 1.22 34 HTML_IMAGE_RATIO_04 11066 9.14 10.67 8.38 35 T_XMDrugObfuBody_14 10976 8.00 10.59 6.72 36 LOTS_OF_MONEY 10950 8.34 10.56 7.23 37 TR_XM_DocInvoice 9955 5.24 9.60 3.07 38 XM_H_Long_From01 9364 6.27 9.03 4.89 39 XM_B_Phish_Phrases 8739 6.06 8.43 4.88 40 FROM_EXCESS_BASE64 8734 7.12 8.42 6.47 41 LotsOfNums_01 8375 6.90 8.08 6.31 42 XMSubMetaSx_00 8321 6.73 8.03 6.09 43 RCVD_IN_RP_SAFE 7775 9.37 7.50 10.30 44 TooManyTo_001 7654 7.11 7.38 6.97 45 MPART_ALT_DIFF 7067 6.90 6.82 6.95 46 BAYES_80 6735 4.45 6.50 3.43 47 XMStrtUSub 6480 5.37 6.25 4.94 48 BAYES_60 6426 5.95 6.20 5.83 49 MIME_QP_LONG_LINE 6357 9.12 6.13 10.60 50 DKIM_INVALID 6311 4.68 6.09 3.98 51 XM_UncommonTLD01 6176 4.83 5.96 4.28 52 HTML_IMAGE_RATIO_06 6148 4.73 5.93 4.13 53 TM2_M_URI_OPT_OUT 6080 8.30 5.86 9.51 54 RCVD_IN_RP_CERTIFIED 5911 8.09 5.70 9.28 55 XM_DIRTYINTL 5736 2.78 5.53 1.41 56 MIME_HTML_MOSTLY 5547 3.77 5.35 2.98 57 XM_UB50 5509 2.30 5.31 0.80 58 XMNumbers 4613 4.20 4.45 4.08 59 URI_HEX 4554 2.18 4.39 1.08 60 XM_SPF_SoftFail 4474 2.20 4.31 1.15 61 BAYES_95 4106 2.98 3.96 2.49 62 T_TooManySym_01 4058 4.54 3.91 4.85 63 RCVD_IN_BL_SPAMCOP_NET 3987 1.43 3.85 0.23 64 ALL_TRUSTED 3921 16.49 3.78 22.80 65 XM_SendGrid 3876 4.11 3.74 4.29 66 RCVD_IN_RP_RNBL 3847 1.25 3.71 0.03 67 RCVD_IN_MSPIKE_H2 3521 3.67 3.40 3.81 68 T_REMOTE_IMAGE 3407 3.09 3.29 2.99 69 XMBody_17 3222 1.25 3.11 0.32 70 RELAYCOUNTRY_CA 3144 1.86 3.03 1.28 71 XM_OfRef6 3143 2.41 3.03 2.10 72 XM_CamelCaseFrm001 3125 1.91 3.01 1.37 73 MultiRelay_CC 2861 1.04 2.76 0.18 74 MultiRelay_Combo 2861 1.04 2.76 0.18 75 HTML_IMAGE_RATIO_08 2811 2.49 2.71 2.39 76 DKIM_ADSP_CUSTOM_MED 2760 1.56 2.66 1.02 77 NO_DNS_FOR_FROM 2697 2.10 2.60 1.84 78 MIME_HTML_ONLY_MULTI 2685 4.40 2.59 5.29 79 FORGED_GMAIL_RCVD 2593 1.14 2.50 0.47 80 NML_ADSP_CUSTOM_MED 2469 1.23 2.38 0.66 81 UNPARSEABLE_RELAY 2462 3.60 2.37 4.20 82 XMSubMetaI_00 2350 1.19 2.27 0.66 83 HTML_MIME_NO_HTML_TAG 2346 1.65 2.26 1.35 84 BOTNET_NORDNS 2323 0.75 2.24 0.01 85 XMBdyGiftCard01 2305 1.23 2.22 0.74 86 SpammyFromTLD_02 2297 0.85 2.22 0.17 87 RELAYCOUNTRY_CN 2223 0.74 2.14 0.04 88 T_XMHurry_00 2189 1.04 2.11 0.51 89 SUBJ_ALL_CAPS 2154 1.79 2.08 1.65 90 XM_B_REG_HTML 2100 1.12 2.03 0.67 91 TVD_SPACE_RATIO_MINFP 2095 0.67 2.02 0.01 92 XM_UB99 2045 0.66 1.97 0.01 93 XM_H_Undi_Recip 2039 0.82 1.97 0.25 94 T_TooManySym_02 2031 1.87 1.96 1.83 95 ADVANCE_FEE_5_NEW_MONEY 2003 0.64 1.93 0.00 96 URI_WP_HACKED_2 1916 3.12 1.85 3.75 97 XMPhish30 1911 0.78 1.84 0.25 98 XMSexyCombo_01 1908 0.98 1.84 0.55 99 TR_XM_Undi_Recip5 1884 0.61 1.82 0.01 100 DIET_1 1851 0.87 1.79 0.42 101 TM2_M_VERY_LONG_WORD 1834 1.03 1.77 0.66 102 XM_H_Long_From02 1825 1.06 1.76 0.72 103 TR_XM_Undi_Recip2 1819 0.59 1.75 0.01 104 URIBL_DBL_SPAM 1807 0.59 1.74 0.02 105 XM_RXBody 1806 0.78 1.74 0.30 106 MAILING_LIST_MULTI 1794 1.89 1.73 1.97 107 SUBJ_DOLLARS 1780 0.77 1.72 0.30 108 RCVD_IN_IADB_LISTED 1778 2.67 1.71 3.14 109 RELAYCOUNTRY_FR 1748 0.71 1.69 0.22 110 SpammyFromTLD_01 1720 0.76 1.66 0.31 111 URIBL_BLACK 1715 0.62 1.65 0.10 112 BAYES_40 1683 2.78 1.62 3.35 113 XMDiploma_00 1660 1.28 1.60 1.12 114 IMPOTENCE 1656 2.18 1.60 2.47 115 BAYES_20 1643 2.14 1.58 2.42 116 T_XMDrugObfuBody_08 1631 1.11 1.57 0.89 117 XM_URI_RBL 1630 0.60 1.57 0.11 118 XMLongAddy 1608 0.57 1.55 0.09 119 BODY_ENHANCEMENT 1585 0.55 1.53 0.07 120 XM_UB999 1582 0.51 1.53 0.01 121 UPPERCASE_75_100 1575 0.53 1.52 0.03 122 RCVD_IN_IADB_SPF 1573 2.37 1.52 2.80 123 BILLION_DOLLARS 1568 0.51 1.51 0.01 124 XM_UB60 1523 0.53 1.47 0.06 125 RCVD_IN_IADB_SENDERID 1498 2.17 1.44 2.53 126 RCVD_IN_IADB_DK 1494 2.11 1.44 2.45 127 XM_BadFromFormat 1491 0.64 1.44 0.24 128 T_MONEY_PERCENT 1476 0.78 1.42 0.47 129 TR_LOTS_OF_MONEY2 1476 0.78 1.42 0.47 130 XMSlimDrugH 1459 0.89 1.41 0.63 131 RELAYCOUNTRY_AT 1397 0.52 1.35 0.10 132 DEAR_FRIEND 1383 0.54 1.33 0.15 133 BODY_URI_ONLY 1368 0.47 1.32 0.05 134 URI_TRY_3LD 1357 1.15 1.31 1.08 135 XMNoVowels 1345 1.42 1.30 1.48 136 BAYES_00 1336 8.08 1.29 11.46 137 FILL_THIS_FORM 1332 1.05 1.28 0.93 138 XM_DK_Undo_01 1312 1.43 1.27 1.50 139 XM_ProductURIs 1295 1.37 1.25 1.43 140 XMBrknScrpt_02 1285 0.85 1.24 0.66 141 T_FILL_THIS_FORM_LONG 1284 0.79 1.24 0.57 142 XMHTMLBadTable_001 1192 0.83 1.15 0.67 143 FILL_THIS_FORM_LOAN 1157 0.75 1.12 0.57 144 XMStockSpam_06 1151 1.41 1.11 1.56 145 TR_XM_RelayPhish 1147 0.60 1.11 0.35 146 LONG_JUNK_URI3 1137 0.41 1.10 0.07 147 XM_H_Long_From03 1133 0.42 1.09 0.09 148 XM_B_COPY_HTML 1122 0.73 1.08 0.56 149 MPART_ALT_DIFF_COUNT 1072 1.10 1.03 1.13 150 PP_MIME_FAKE_ASCII_TEXT 1060 0.57 1.02 0.35 151 XMSubMetaSSx_00 1058 0.82 1.02 0.72 152 T_XMDrugObfuBody_00 1056 0.57 1.02 0.35 153 RELAYCOUNTRY_BR 1041 0.38 1.00 0.07 154 T_HTML_TAG_BALANCE_CENTER 1041 0.42 1.00 0.12 155 LongTLD 1041 0.42 1.00 0.12 156 HTML_FONT_SIZE_HUGE 1037 0.43 1.00 0.15 157 RELAYCOUNTRY_GB 1032 0.68 1.00 0.53 158 BASE64_LENGTH_79_INF 1021 0.41 0.98 0.13 159 HTML_IMAGE_ONLY_08 1017 0.39 0.98 0.10 160 XMBody_78 1013 0.62 0.98 0.44 161 HTML_SHORT_LINK_IMG_1 1011 0.34 0.98 0.02 162 TooManyTo_002 1008 2.23 0.97 2.86 163 RDNS_DYNAMIC 957 0.60 0.92 0.43 164 XMHTML_After_End 957 0.53 0.92 0.34 165 XMPhish11 948 0.97 0.91 1.00 166 TooManyTo_003 935 1.88 0.90 2.37 167 XMSexyCombo_04 933 0.37 0.90 0.11 168 BAYES_05 920 2.31 0.89 3.02 169 TR_XM_DK_Bayes 912 2.75 0.88 3.68 170 XMSubNoVowel 903 3.25 0.87 4.44 171 TR_XM_DK_Bayes1 875 2.54 0.84 3.38 172 XMSubMetaD_03 872 0.30 0.84 0.03 173 URIBL_DBL_ABUSE_SPAM 870 0.70 0.84 0.63 174 DKIM_ADSP_NXDOMAIN 867 0.57 0.84 0.44 175 XMSlimDrugs 864 0.55 0.83 0.41 176 TR_MetaPhish_Combo_01 840 0.84 0.81 0.85 177 XM_H_PHPOS 837 1.06 0.81 1.19 178 XM_HighProb1 819 0.27 0.79 0.01 179 TR_XM_DK_Bayes2 816 2.25 0.79 2.98 180 PLING_QUERY 782 0.59 0.75 0.51 181 HTML_FONT_FACE_BAD 779 2.53 0.75 3.42 182 RELAYCOUNTRY_IT 775 0.31 0.75 0.09 183 XM_S_JOY_D 768 0.49 0.74 0.37 184 NO_PRESCRIPTION 764 0.39 0.74 0.22 185 TR_Mismatch_TLD_02 758 0.28 0.73 0.06 186 XM_Body_Obfu01 757 0.34 0.73 0.14 187 TRACKER_ID 754 0.37 0.73 0.19 188 TM2_M_BODY_EMPTY 752 0.49 0.73 0.37 189 RELAYCOUNTRY_NL 751 0.36 0.72 0.18 190 T_FILL_THIS_FORM_SHORT 741 0.57 0.71 0.49 191 RCVD_IN_IADB_VOUCHED 733 1.55 0.71 1.97 192 XMEmptyBody_01 729 0.36 0.70 0.19 193 ONLINE_PHARMACY 727 1.25 0.70 1.52 194 XMSolicitRefs_0 717 0.40 0.69 0.25 195 XM_UB80 703 0.24 0.68 0.02 196 RCVD_IN_MSPIKE_WL 689 1.30 0.66 1.61 197 LOW_PRICE 686 0.27 0.66 0.08 198 HTML_IMAGE_ONLY_24 682 0.38 0.66 0.25 199 TVD_VISIT_PHARMA 680 1.02 0.66 1.20 200 XMGenDplmaNmb 680 0.58 0.66 0.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164431 83.35 92.63 78.74 2 DCC_CHECK_NEGATIVE 129697 48.04 19.72 62.11 3 DKIM_SIGNED 129654 68.85 82.49 62.09 4 XM_DK_Pass 127859 67.71 80.78 61.23 5 DKIM_VALID 121351 64.18 76.40 58.11 6 BAYES_50 108214 45.49 32.75 51.82 7 DKIM_VALID_AU 97943 52.54 63.88 46.90 8 XMListUnsubscribeExists 85505 51.06 71.43 40.94 9 XM_H_QuotedFrom 80553 45.03 58.02 38.57 10 DCC_CHECK 76500 50.68 78.96 36.63 11 HTML_FONT_LOW_CONTRAST 54743 30.08 37.87 26.21 12 DKIM_VALID_EF 51850 22.73 18.50 24.83 13 ALL_TRUSTED 47606 16.49 3.78 22.80 14 LOC_TINY_FONT_1 47070 27.89 38.65 22.54 15 XMSubLong 46484 24.25 28.27 22.26 16 T_TM2_M_HEADER_IN_MSG 46229 20.38 16.83 22.14 17 MIME_HTML_ONLY 44764 24.15 29.63 21.44 18 FVGT_m_MULTI_ODD 34918 19.47 25.02 16.72 19 XM_DK_Undo_02 34256 27.51 49.88 16.40 20 BAYES_99 33655 25.76 45.17 16.12 21 IN_ZIMBRA_NJ_WHITELIST 30496 9.77 0.03 14.60 22 BAYES_999 30234 22.74 39.39 14.48 23 XM_DKIMWhitelistDomains 27337 8.75 0.02 13.09 24 MultiRelay 26090 13.70 16.13 12.49 25 BAYES_00 23924 8.08 1.29 11.46 26 XM_Multi_Part_URI 23686 13.18 16.89 11.34 27 T_KAM_HTML_FONT_INVALID 22593 13.17 17.90 10.82 28 XM_Body_Dirty_Words 22452 14.25 21.29 10.75 29 MIME_QP_LONG_LINE 22132 9.12 6.13 10.60 30 RCVD_IN_RP_SAFE 21508 9.37 7.50 10.30 31 TM2_M_URI_OPT_OUT 19854 8.30 5.86 9.51 32 RCVD_IN_RP_CERTIFIED 19383 8.09 5.70 9.28 33 TR_DCC_Bayes_99 18984 18.04 36.06 9.09 34 FSL_BULK_SIG 17612 10.18 13.69 8.43 35 HTML_IMAGE_RATIO_04 17494 9.14 10.67 8.38 36 XM_Evil_Numbers_Gen 16299 10.20 15.02 7.80 37 HTML_IMAGE_RATIO_02 16133 11.69 19.69 7.73 38 LOTS_OF_MONEY 15101 8.34 10.56 7.23 39 TooManyTo_001 14558 7.11 7.38 6.97 40 MPART_ALT_DIFF 14507 6.90 6.82 6.95 41 T_XMDrugObfuBody_14 14038 8.00 10.59 6.72 42 FROM_EXCESS_BASE64 13504 7.12 8.42 6.47 43 LotsOfNums_01 13177 6.90 8.08 6.31 44 XMSubMetaSx_00 12722 6.73 8.03 6.09 45 BAYES_60 12179 5.95 6.20 5.83 46 MIME_HTML_ONLY_MULTI 11055 4.40 2.59 5.29 47 BOTNET_IPINHOSTNAME 10442 7.96 13.93 5.00 48 XMStrtUSub 10311 5.37 6.25 4.94 49 XM_H_Long_From01 10221 6.27 9.03 4.89 50 XM_B_Phish_Phrases 10189 6.06 8.43 4.88 51 T_TooManySym_01 10129 4.54 3.91 4.85 52 XMSubNoVowel 9262 3.25 0.87 4.44 53 XM_SendGrid 8964 4.11 3.74 4.29 54 XM_UncommonTLD01 8932 4.83 5.96 4.28 55 UNPARSEABLE_RELAY 8779 3.60 2.37 4.20 56 RELAYCOUNTRY_META 8636 8.42 17.05 4.14 57 HTML_IMAGE_RATIO_06 8628 4.73 5.93 4.13 58 XMNumbers 8520 4.20 4.45 4.08 59 XMSexyCombo_05 8447 6.38 11.09 4.04 60 BOUNCE_MESSAGE 8318 2.81 0.44 3.98 61 ANY_BOUNCE_MESSAGE 8318 2.81 0.44 3.98 62 DKIM_INVALID 8303 4.68 6.09 3.98 63 RCVD_IN_MSPIKE_H2 7962 3.67 3.40 3.81 64 URI_WP_HACKED_2 7835 3.12 1.85 3.75 65 TVD_RCVD_IP 7759 2.59 0.32 3.72 66 TR_XM_DK_Bayes 7692 2.75 0.88 3.68 67 BAYES_80 7163 4.45 6.50 3.43 68 HTML_FONT_FACE_BAD 7142 2.53 0.75 3.42 69 TR_XM_DK_Bayes1 7056 2.54 0.84 3.38 70 BAYES_40 7005 2.78 1.62 3.35 71 RCVD_IN_IADB_LISTED 6565 2.67 1.71 3.14 72 INVALID_MSGID 6467 2.16 0.26 3.10 73 TR_XM_DocInvoice 6418 5.24 9.60 3.07 74 BAYES_05 6304 2.31 0.89 3.02 75 T_REMOTE_IMAGE 6236 3.09 3.29 2.99 76 MIME_HTML_MOSTLY 6224 3.77 5.35 2.98 77 TR_XM_DK_Bayes2 6213 2.25 0.79 2.98 78 TO_MALFORMED 6171 2.00 0.07 2.96 79 TooManyTo_002 5976 2.23 0.97 2.86 80 RCVD_IN_IADB_SPF 5844 2.37 1.52 2.80 81 RCVD_IN_IADB_SENDERID 5274 2.17 1.44 2.53 82 BAYES_95 5197 2.98 3.96 2.49 83 IMPOTENCE 5166 2.18 1.60 2.47 84 RCVD_IN_IADB_DK 5114 2.11 1.44 2.45 85 BAYES_20 5044 2.14 1.58 2.42 86 IN_HORDE_ADDRESS_BOOK 5009 1.62 0.06 2.40 87 HTML_IMAGE_RATIO_08 4984 2.49 2.71 2.39 88 TooManyTo_003 4951 1.88 0.90 2.37 89 USER_IN_DEF_DKIM_WL 4617 1.48 0.02 2.21 90 XM_OfRef6 4377 2.41 3.03 2.10 91 RCVD_IN_IADB_VOUCHED 4123 1.55 0.71 1.97 92 MAILING_LIST_MULTI 4117 1.89 1.73 1.97 93 NO_DNS_FOR_FROM 3851 2.10 2.60 1.84 94 T_TooManySym_02 3824 1.87 1.96 1.83 95 SUBJ_ALL_CAPS 3438 1.79 2.08 1.65 96 RCVD_IN_MSPIKE_WL 3371 1.30 0.66 1.61 97 RCVD_IN_MSPIKE_H3 3365 1.27 0.59 1.61 98 XM_PDF 3362 1.22 0.43 1.61 99 XMStockSpam_06 3262 1.41 1.11 1.56 100 ONLINE_PHARMACY 3184 1.25 0.70 1.52 101 TR_Symld_Words 3156 1.22 0.65 1.51 102 XM_DK_Undo_01 3142 1.43 1.27 1.50 103 HTML_IMAGE_ONLY_20 3105 1.13 0.42 1.49 104 XMNoVowels 3092 1.42 1.30 1.48 105 XM_ProductURIs 2990 1.37 1.25 1.43 106 XM_DIRTYINTL 2948 2.78 5.53 1.41 107 XM_CamelCaseFrm001 2858 1.91 3.01 1.37 108 HTML_MIME_NO_HTML_TAG 2811 1.65 2.26 1.35 109 RELAYCOUNTRY_CA 2668 1.86 3.03 1.28 110 RCVD_IN_IADB_OPTIN 2571 0.99 0.50 1.23 111 UNTRUSTED_Relay 2543 4.49 11.08 1.22 112 XM_GoogleGroups 2518 0.98 0.52 1.21 113 TVD_VISIT_PHARMA 2507 1.02 0.66 1.20 114 XM_H_PHPOS 2488 1.06 0.81 1.19 115 XM_SPF_SoftFail 2407 2.20 4.31 1.15 116 MPART_ALT_DIFF_COUNT 2369 1.10 1.03 1.13 117 XMDiploma_00 2338 1.28 1.60 1.12 118 USER_IN_WHITELIST 2321 0.74 0.00 1.11 119 URI_HEX 2257 2.18 4.39 1.08 120 URI_TRY_3LD 2250 1.15 1.31 1.08 121 BOTNET 2234 5.06 13.10 1.07 122 XMSubLongNoVowel 2184 0.73 0.09 1.05 123 DKIM_ADSP_CUSTOM_MED 2122 1.56 2.66 1.02 124 XMBody_95 2109 0.72 0.13 1.01 125 XMPhish11 2095 0.97 0.91 1.00 126 TooManyTo_004 1999 0.80 0.48 0.96 127 T_TooManySym_03 1982 0.76 0.38 0.95 128 FILL_THIS_FORM 1952 1.05 1.28 0.93 129 XMSubGarbage 1889 0.63 0.08 0.90 130 T_XMDrugObfuBody_08 1853 1.11 1.57 0.89 131 XM_E_Blogspot 1813 0.60 0.05 0.87 132 TR_MetaPhish_Combo_01 1773 0.84 0.81 0.85 133 TooManyTo_005 1763 0.70 0.42 0.84 134 XM_UB50 1667 2.30 5.31 0.80 135 XMSubMetaSxObfu_02 1598 0.71 0.60 0.77 136 FUZZY_CREDIT 1565 0.54 0.11 0.75 137 XMBdyGiftCard01 1537 1.23 2.22 0.74 138 XMSubMetaSSx_00 1506 0.82 1.02 0.72 139 XM_H_Long_From02 1495 1.06 1.76 0.72 140 HELO_NODOT 1486 0.54 0.20 0.71 141 XM_H_PHPMailer 1457 0.65 0.56 0.70 142 XMHTMLBadTable_001 1397 0.83 1.15 0.67 143 XM_B_REG_HTML 1391 1.12 2.03 0.67 144 TM2_M_VERY_LONG_WORD 1380 1.03 1.77 0.66 145 XMSubMetaI_00 1378 1.19 2.27 0.66 146 XMBrknScrpt_02 1375 0.85 1.24 0.66 147 NML_ADSP_CUSTOM_MED 1369 1.23 2.38 0.66 148 XMSlimDrugH 1324 0.89 1.41 0.63 149 URIBL_DBL_ABUSE_SPAM 1315 0.70 0.84 0.63 150 XMLngstWrd_00 1240 0.55 0.45 0.59 151 XMSubMetaSx_01 1205 0.60 0.64 0.58 152 T_FILL_THIS_FORM_LONG 1196 0.79 1.24 0.57 153 FILL_THIS_FORM_LOAN 1180 0.75 1.12 0.57 154 XM_B_COPY_HTML 1163 0.73 1.08 0.56 155 XMSexyCombo_01 1155 0.98 1.84 0.55 156 XMGenDplmaNmb 1125 0.58 0.66 0.54 157 T_Symld_Words_02 1124 0.57 0.62 0.54 158 T_TooManySym_04 1110 0.36 0.03 0.53 159 RELAYCOUNTRY_GB 1100 0.68 1.00 0.53 160 XMLngstWrd_01 1096 0.49 0.41 0.52 161 T_XMHurry_00 1061 1.04 2.11 0.51 162 PLING_QUERY 1060 0.59 0.75 0.51 163 XMSubject_48 1057 0.41 0.22 0.51 164 XM_ShortIntro_01 1056 0.47 0.39 0.51 165 T_FILL_THIS_FORM_SHORT 1033 0.57 0.71 0.49 166 FORGED_GMAIL_RCVD 972 1.14 2.50 0.47 167 TR_LOTS_OF_MONEY2 972 0.78 1.42 0.47 168 T_MONEY_PERCENT 972 0.78 1.42 0.47 169 RELAYCOUNTRY_DE 940 0.51 0.63 0.45 170 XMCapTrack 939 0.39 0.28 0.45 171 DKIM_ADSP_NXDOMAIN 919 0.57 0.84 0.44 172 XMBody_78 912 0.62 0.98 0.44 173 RDNS_DYNAMIC 905 0.60 0.92 0.43 174 MISSING_HEADERS 899 0.43 0.44 0.43 175 XM_H_PHPOS_M 881 0.41 0.40 0.42 176 DIET_1 878 0.87 1.79 0.42 177 XMSlimDrugs 863 0.55 0.83 0.41 178 TM2_M_A_HREF_HREF 857 0.40 0.39 0.41 179 XMRcvdHeader_15 778 0.25 0.00 0.37 180 XM_S_JOY_D 777 0.49 0.74 0.37 181 TM2_M_BODY_EMPTY 775 0.49 0.73 0.37 182 XM_Walgreens_Forge 755 0.30 0.17 0.36 183 URIBL_SBL_A 749 0.37 0.41 0.36 184 RELAYCOUNTRY_AU 743 0.40 0.49 0.36 185 PP_MIME_FAKE_ASCII_TEXT 735 0.57 1.02 0.35 186 T_XMDrugObfuBody_00 722 0.57 1.02 0.35 187 TR_XM_RelayPhish 721 0.60 1.11 0.35 188 KHOP_DYNAMIC 712 0.38 0.45 0.34 189 HTML_TAG_BALANCE_BODY 705 0.43 0.60 0.34 190 XMHTML_After_End 700 0.53 0.92 0.34 191 XMDateMe_00 678 0.35 0.39 0.32 192 XMGappySubj_01 671 0.39 0.52 0.32 193 XMBody_17 669 1.25 3.11 0.32 194 XM_H_SpoofStaff4 667 0.23 0.04 0.32 195 XMBody_29 654 0.28 0.21 0.31 196 SpammyFromTLD_01 649 0.76 1.66 0.31 197 XMSubPhish11 648 0.27 0.20 0.31 198 GAPPY_SUBJECT 646 0.25 0.13 0.31 199 FROM_EGROUPS 635 0.20 0.00 0.30 200 XM_RXBody 630 0.78 1.74 0.30 ----------------------------------------------------------------------