Email: 415503 Autolearn: 0 AvgScore: 6.96 AvgScanTime: 3.82 sec Spam: 184575 Autolearn: 0 AvgScore: 16.38 AvgScanTime: 4.51 sec Ham: 230928 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 3.26 sec Time Spent Running SA: 440.54 hours Time Spent Processing Spam: 231.15 hours Time Spent Processing Ham: 209.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 178745 89.37 96.84 83.40 2 BAYES_50 105156 55.48 56.97 54.29 3 DKIM_SIGNED 104428 68.90 56.58 78.74 4 XM_DK_Pass 102048 67.64 55.29 77.52 5 DKIM_VALID 96148 64.06 52.09 73.62 6 DCC_CHECK 95936 48.04 51.98 44.89 7 XMListUnsubscribeExists 93988 53.55 50.92 55.65 8 DCC_CHECK_NEGATIVE 87490 51.08 47.40 54.02 9 BOTNET 85774 21.53 46.47 1.59 10 DKIM_VALID_AU 83290 52.12 45.13 57.72 11 URI_HEX 70862 18.55 38.39 2.70 12 NUMERIC_HTTP_ADDR 67844 16.39 36.76 0.12 13 ANY_BOUNCE_MESSAGE 67432 18.51 36.53 4.11 14 BOUNCE_MESSAGE 67431 18.51 36.53 4.11 15 XMCapTrack 67423 16.46 36.53 0.41 16 XM_H_QuotedFrom 66778 36.13 36.18 36.08 17 RCVD_IN_RP_RNBL 66231 15.96 35.88 0.03 18 XM_DK_Undo_02 60308 24.89 32.67 18.66 19 XM_URI_RBL 52954 12.81 28.69 0.12 20 URIBL_BLACK 52284 12.61 28.33 0.06 21 BAYES_99 51278 22.16 27.78 17.67 22 LOC_TINY_FONT_1 49267 27.14 26.69 27.50 23 BAYES_999 43670 19.06 23.66 15.39 24 HTML_FONT_LOW_CONTRAST 42572 28.58 23.06 32.98 25 TR_DCC_Bayes_99 41740 15.61 22.61 10.00 26 FVGT_m_MULTI_ODD 37544 21.20 20.34 21.89 27 MIME_HTML_ONLY 36598 19.98 19.83 20.10 28 DATE_IN_PAST_96_XX 30249 7.28 16.39 0.00 29 HTML_IMAGE_RATIO_02 29254 13.95 15.85 12.44 30 XMSubLong 25442 18.74 13.78 22.70 31 XM_Multi_Part_URI 24794 13.65 13.43 13.81 32 XM_Body_Dirty_Words 24094 12.16 13.05 11.45 33 DKIM_VALID_EF 22887 22.01 12.40 29.69 34 T_KAM_HTML_FONT_INVALID 21911 12.67 11.87 13.31 35 XM_Evil_Numbers_Gen 21210 9.38 11.49 7.69 36 T_TM2_M_HEADER_IN_MSG 19961 18.57 10.81 24.77 37 RELAYCOUNTRY_META 19339 7.22 10.48 4.61 38 BOTNET_IPINHOSTNAME 18078 8.39 9.79 7.27 39 MultiRelay 15211 11.60 8.24 14.28 40 XMSexyCombo_05 12554 5.12 6.80 3.78 41 HTML_IMAGE_RATIO_04 12294 5.91 6.66 5.30 42 UNTRUSTED_Relay 12234 3.63 6.63 1.23 43 FROM_EXCESS_BASE64 12187 6.05 6.60 5.60 44 XM_B_Phish_Phrases 11920 6.25 6.46 6.09 45 T_XMDrugObfuBody_14 11618 6.67 6.29 6.96 46 FSL_BULK_SIG 10793 6.95 5.85 7.83 47 TR_XM_DocInvoice 10497 4.62 5.69 3.77 48 RCVD_IN_RP_SAFE 10447 10.52 5.66 14.41 49 MPART_ALT_DIFF 10385 4.67 5.63 3.90 50 LOTS_OF_MONEY 10046 6.97 5.44 8.19 51 TooManyTo_001 9811 5.55 5.32 5.74 52 XM_H_Long_From01 9743 5.48 5.28 5.65 53 BAYES_80 8657 4.55 4.69 4.43 54 DKIM_INVALID 8280 4.84 4.49 5.12 55 RCVD_IN_RP_CERTIFIED 8113 9.65 4.40 13.85 56 LotsOfNums_01 8065 6.50 4.37 8.20 57 XMStrtUSub 8049 5.06 4.36 5.62 58 DATE_IN_PAST_24_48 8041 1.94 4.36 0.01 59 XMSubMetaSx_00 7557 4.45 4.09 4.74 60 MIME_HTML_MOSTLY 6643 3.74 3.60 3.85 61 BAYES_60 6531 5.38 3.54 6.85 62 XMBdyGiftCard01 6455 2.42 3.50 1.56 63 XM_UncommonTLD01 5470 3.63 2.96 4.16 64 XM_UB50 5396 1.70 2.92 0.71 65 BAYES_95 5233 3.14 2.84 3.39 66 HTML_IMAGE_RATIO_06 5104 3.36 2.77 3.84 67 MIME_HTML_ONLY_MULTI 4679 1.89 2.54 1.37 68 XMNumbers 4606 3.81 2.50 4.85 69 BOTNET_NORDNS 4383 1.06 2.37 0.01 70 NO_DNS_FOR_FROM 4340 2.61 2.35 2.81 71 XM_CamelCaseFrm001 4340 2.22 2.35 2.11 72 RELAYCOUNTRY_CA 4257 1.95 2.31 1.67 73 XM_DIRTYINTL 4151 1.97 2.25 1.74 74 RCVD_IN_MSPIKE_H2 3785 4.02 2.05 5.60 75 MultiRelay_CC 3753 1.01 2.03 0.19 76 MultiRelay_Combo 3753 1.01 2.03 0.19 77 TM2_M_URI_OPT_OUT 3698 1.99 2.00 1.98 78 T_TooManySym_01 3653 5.16 1.98 7.71 79 XM_SendGrid 3520 3.82 1.91 5.34 80 XM_OfRef6 3387 1.60 1.84 1.41 81 XM_SPF_SoftFail 3211 1.26 1.74 0.87 82 DATE_IN_PAST_12_24 3189 0.79 1.73 0.04 83 XMSubMetaI_00 3141 1.05 1.70 0.53 84 MIME_QP_LONG_LINE 2941 3.10 1.59 4.31 85 SUBJ_ALL_CAPS 2893 1.28 1.57 1.05 86 T_REMOTE_IMAGE 2681 3.12 1.45 4.45 87 HTML_MIME_NO_HTML_TAG 2646 1.47 1.43 1.51 88 HTML_IMAGE_RATIO_08 2520 1.96 1.37 2.43 89 UNPARSEABLE_RELAY 2506 3.95 1.36 6.03 90 T_XMDrugObfuBody_08 2502 1.27 1.36 1.20 91 RCVD_IN_BL_SPAMCOP_NET 2409 0.71 1.31 0.24 92 RELAYCOUNTRY_AT 2406 0.64 1.30 0.12 93 BAYES_00 2396 4.22 1.30 6.56 94 RELAYCOUNTRY_CN 2365 0.61 1.28 0.08 95 BAYES_40 2170 2.15 1.18 2.92 96 XMDiploma_00 2070 1.17 1.12 1.21 97 XMHTMLBadTable_001 2031 1.00 1.10 0.91 98 XM_H_Long_From02 1977 0.91 1.07 0.78 99 TR_XM_DK_Bayes 1975 3.34 1.07 5.15 100 URI_TRY_3LD 1951 1.39 1.06 1.66 101 XM_ProductURIs 1925 0.95 1.04 0.87 102 SpammyFromTLD_02 1866 0.55 1.01 0.18 103 BAYES_20 1864 1.69 1.01 2.23 104 TR_XM_DK_Bayes1 1862 3.11 1.01 4.79 105 XMBody_17 1851 0.73 1.00 0.52 106 XMPhish30 1849 0.66 1.00 0.39 107 XM_UB60 1843 0.48 1.00 0.07 108 TR_XM_DK_Bayes2 1765 2.78 0.96 4.24 109 XMStockSpam_06 1707 0.90 0.92 0.87 110 XM_DK_Undo_01 1696 1.33 0.92 1.67 111 XMPhish14 1688 0.76 0.91 0.63 112 RELAYCOUNTRY_FR 1687 0.50 0.91 0.17 113 XM_RXBody 1614 0.55 0.87 0.29 114 XM_UB99 1612 0.42 0.87 0.05 115 XMPhish11 1606 1.11 0.87 1.30 116 XM_HighProb1 1589 0.39 0.86 0.02 117 PLING_QUERY 1569 0.57 0.85 0.35 118 SpammyFromTLD_01 1560 0.58 0.85 0.37 119 ALL_TRUSTED 1554 9.80 0.84 16.96 120 T_XMHurry_00 1552 0.63 0.84 0.47 121 TR_Caps_n_Bayes_99 1550 0.40 0.84 0.05 122 XMGenDplmaNmb 1549 0.74 0.84 0.67 123 TM2_M_VERY_LONG_WORD 1531 0.82 0.83 0.81 124 DIET_1 1530 0.61 0.83 0.43 125 TVD_SPACE_RATIO_MINFP 1456 0.36 0.79 0.02 126 FILL_THIS_FORM 1443 0.71 0.78 0.65 127 MAILING_LIST_MULTI 1439 1.35 0.78 1.80 128 T_FILL_THIS_FORM_SHORT 1428 0.60 0.77 0.46 129 XMSexyCombo_01 1418 0.67 0.77 0.60 130 XM_B_REG_HTML 1406 0.77 0.76 0.77 131 SUBJ_DOLLARS 1406 0.56 0.76 0.40 132 T_FILL_THIS_FORM_LONG 1340 0.65 0.73 0.58 133 FILL_THIS_FORM_LOAN 1316 0.60 0.71 0.52 134 XMClaimOffer 1292 0.46 0.70 0.27 135 TR_XM_RelayPhish 1236 0.46 0.67 0.29 136 RCVD_IN_PSBL 1226 0.39 0.66 0.16 137 XMBody_78 1198 0.51 0.65 0.40 138 DATE_IN_PAST_06_12 1191 0.31 0.65 0.04 139 BAYES_05 1162 1.16 0.63 1.58 140 XMHTML_After_End 1161 0.45 0.63 0.30 141 XM_UB80 1148 0.30 0.62 0.05 142 T_HTML_TAG_BALANCE_CENTER 1141 0.37 0.62 0.18 143 DKIM_ADSP_NXDOMAIN 1140 0.58 0.62 0.55 144 URIBL_DBL_SPAM 1118 0.28 0.61 0.02 145 XM_H_PHPOS 1117 0.88 0.61 1.10 146 XMGppyBdWords 1113 0.39 0.60 0.22 147 TR_MetaPhish_Combo_01 1104 1.58 0.60 2.37 148 TR_Mismatch_TLD_02 1083 0.30 0.59 0.07 149 XMBrknScrpt_02 1074 0.63 0.58 0.66 150 TR_Symld_Words 1066 1.10 0.58 1.51 151 RELAYCOUNTRY_DE 1054 0.51 0.57 0.46 152 RCVD_IN_IADB_LISTED 1052 3.13 0.57 5.17 153 RELAYCOUNTRY_IN 1033 0.29 0.56 0.07 154 TR_LOTS_OF_MONEY3 1033 0.34 0.56 0.17 155 LOW_PRICE 1031 0.32 0.56 0.14 156 XMBSHREFv2 1012 0.30 0.55 0.09 157 XM_Body_Obfu01 1011 0.33 0.55 0.15 158 XM_UB999 1010 0.26 0.55 0.02 159 T_MONEY_PERCENT 996 0.47 0.54 0.42 160 TR_LOTS_OF_MONEY2 996 0.47 0.54 0.42 161 XMSubMetaSx_01 970 0.33 0.53 0.18 162 HTML_TAG_BALANCE_BODY 968 0.49 0.52 0.46 163 XMSubNoVowel 960 0.37 0.52 0.24 164 HTML_FONT_FACE_BAD 950 0.52 0.51 0.53 165 XM_B_COPY_HTML 934 0.60 0.51 0.68 166 RCVD_IN_IADB_SPF 931 2.71 0.50 4.47 167 RELAYCOUNTRY_GB 931 0.51 0.50 0.51 168 RCVD_IN_MSPIKE_WL 928 1.68 0.50 2.61 169 RCVD_IN_MSPIKE_H3 920 1.67 0.50 2.61 170 RCVD_IN_IADB_SENDERID 916 2.42 0.50 3.95 171 RCVD_IN_IADB_DK 905 2.35 0.49 3.83 172 T_XMDrugObfuBody_00 900 0.69 0.49 0.85 173 DKIM_ADSP_CUSTOM_MED 884 0.78 0.48 1.02 174 RDNS_DYNAMIC 879 0.50 0.48 0.53 175 T_TooManySym_02 879 1.72 0.48 2.72 176 HTML_FONT_SIZE_HUGE 852 0.31 0.46 0.18 177 XM_H_PHPMailer 824 0.66 0.45 0.83 178 URI_NOVOWEL 823 0.37 0.45 0.32 179 LongTLD 821 0.29 0.44 0.17 180 MPART_ALT_DIFF_COUNT 814 0.35 0.44 0.29 181 T_FROM_SUSPICIOUS_NTLD 798 0.21 0.43 0.04 182 XMSubMetaSSx_00 779 0.31 0.42 0.22 183 NML_ADSP_CUSTOM_MED 767 0.54 0.42 0.65 184 XM_OfRef7 758 0.24 0.41 0.10 185 FORGED_GMAIL_RCVD 749 0.48 0.41 0.53 186 BODY_URI_ONLY 748 0.22 0.41 0.07 187 BODY_ENHANCEMENT 735 0.18 0.40 0.01 188 XMMoneyMeta_00 712 0.29 0.39 0.21 189 TVD_SPACE_RATIO 710 0.33 0.38 0.29 190 XM_UB95 702 0.23 0.38 0.11 191 XM_BadFromFormat 698 0.30 0.38 0.24 192 MIME_CHARSET_FARAWAY 698 0.22 0.38 0.09 193 T_Symld_Words_02 695 0.32 0.38 0.27 194 XMSlimDrugH 682 0.35 0.37 0.34 195 RELAYCOUNTRY_VN 656 0.16 0.36 0.00 196 CHARSET_FARAWAY_HEADER 655 0.19 0.35 0.06 197 RELAYCOUNTRY_NL 639 0.26 0.35 0.19 198 HTML_IMAGE_ONLY_04 635 0.18 0.34 0.04 199 HTML_TITLE_SUBJ_DIFF 632 0.18 0.34 0.05 200 TM2_M_A_HREF_HREF 626 0.52 0.34 0.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 192589 89.37 96.84 83.40 2 DKIM_SIGNED 181839 68.90 56.58 78.74 3 XM_DK_Pass 179008 67.64 55.29 77.52 4 DKIM_VALID 170009 64.06 52.09 73.62 5 DKIM_VALID_AU 133283 52.12 45.13 57.72 6 XMListUnsubscribeExists 128501 53.55 50.92 55.65 7 BAYES_50 125364 55.48 56.97 54.29 8 DCC_CHECK_NEGATIVE 124744 51.08 47.40 54.02 9 DCC_CHECK 103670 48.04 51.98 44.89 10 XM_H_QuotedFrom 83324 36.13 36.18 36.08 11 HTML_FONT_LOW_CONTRAST 76167 28.58 23.06 32.98 12 DKIM_VALID_EF 68561 22.01 12.40 29.69 13 LOC_TINY_FONT_1 63501 27.14 26.69 27.50 14 T_TM2_M_HEADER_IN_MSG 57190 18.57 10.81 24.77 15 XMSubLong 52431 18.74 13.78 22.70 16 FVGT_m_MULTI_ODD 50556 21.20 20.34 21.89 17 MIME_HTML_ONLY 46414 19.98 19.83 20.10 18 XM_DK_Undo_02 43098 24.89 32.67 18.66 19 XM_DKIMWhitelistDomains 40987 9.87 0.02 17.75 20 BAYES_99 40795 22.16 27.78 17.67 21 ALL_TRUSTED 39159 9.80 0.84 16.96 22 BAYES_999 35532 19.06 23.66 15.39 23 RCVD_IN_RP_SAFE 33278 10.52 5.66 14.41 24 MultiRelay 32988 11.60 8.24 14.28 25 RCVD_IN_RP_CERTIFIED 31986 9.65 4.40 13.85 26 XM_Multi_Part_URI 31902 13.65 13.43 13.81 27 T_KAM_HTML_FONT_INVALID 30735 12.67 11.87 13.31 28 HTML_IMAGE_RATIO_02 28722 13.95 15.85 12.44 29 XM_Body_Dirty_Words 26446 12.16 13.05 11.45 30 TR_DCC_Bayes_99 23101 15.61 22.61 10.00 31 LotsOfNums_01 18947 6.50 4.37 8.20 32 LOTS_OF_MONEY 18918 6.97 5.44 8.19 33 FSL_BULK_SIG 18085 6.95 5.85 7.83 34 T_TooManySym_01 17796 5.16 1.98 7.71 35 XM_Evil_Numbers_Gen 17762 9.38 11.49 7.69 36 BOTNET_IPINHOSTNAME 16777 8.39 9.79 7.27 37 T_XMDrugObfuBody_14 16076 6.67 6.29 6.96 38 BAYES_60 15827 5.38 3.54 6.85 39 BAYES_00 15140 4.22 1.30 6.56 40 XM_B_Phish_Phrases 14061 6.25 6.46 6.09 41 UNPARSEABLE_RELAY 13922 3.95 1.36 6.03 42 TooManyTo_001 13262 5.55 5.32 5.74 43 XM_H_Long_From01 13039 5.48 5.28 5.65 44 XMStrtUSub 12970 5.06 4.36 5.62 45 FROM_EXCESS_BASE64 12943 6.05 6.60 5.60 46 RCVD_IN_MSPIKE_H2 12934 4.02 2.05 5.60 47 TVD_RCVD_IP 12607 3.11 0.17 5.46 48 TO_MALFORMED 12415 3.00 0.03 5.38 49 XM_SendGrid 12337 3.82 1.91 5.34 50 HTML_IMAGE_RATIO_04 12242 5.91 6.66 5.30 51 RCVD_IN_IADB_LISTED 11935 3.13 0.57 5.17 52 TR_XM_DK_Bayes 11896 3.34 1.07 5.15 53 DKIM_INVALID 11830 4.84 4.49 5.12 54 XMNumbers 11211 3.81 2.50 4.85 55 TR_XM_DK_Bayes1 11059 3.11 1.01 4.79 56 XMSubMetaSx_00 10938 4.45 4.09 4.74 57 RELAYCOUNTRY_META 10649 7.22 10.48 4.61 58 RCVD_IN_IADB_SPF 10315 2.71 0.50 4.47 59 T_REMOTE_IMAGE 10273 3.12 1.45 4.45 60 BAYES_80 10240 4.55 4.69 4.43 61 MIME_QP_LONG_LINE 9952 3.10 1.59 4.31 62 TR_XM_DK_Bayes2 9786 2.78 0.96 4.24 63 XM_UncommonTLD01 9608 3.63 2.96 4.16 64 ANY_BOUNCE_MESSAGE 9481 18.51 36.53 4.11 65 BOUNCE_MESSAGE 9480 18.51 36.53 4.11 66 RCVD_IN_IADB_SENDERID 9120 2.42 0.50 3.95 67 MPART_ALT_DIFF 9002 4.67 5.63 3.90 68 MIME_HTML_MOSTLY 8902 3.74 3.60 3.85 69 HTML_IMAGE_RATIO_06 8857 3.36 2.77 3.84 70 RCVD_IN_IADB_DK 8841 2.35 0.49 3.83 71 XMSexyCombo_05 8719 5.12 6.80 3.78 72 TR_XM_DocInvoice 8711 4.62 5.69 3.77 73 IN_ZIMBRA_NJ_WHITELIST 8341 2.01 0.01 3.61 74 RCVD_IN_IADB_VOUCHED 7999 2.07 0.32 3.46 75 BAYES_95 7820 3.14 2.84 3.39 76 INVALID_MSGID 6845 1.69 0.10 2.96 77 BAYES_40 6750 2.15 1.18 2.92 78 NO_DNS_FOR_FROM 6495 2.61 2.35 2.81 79 T_TooManySym_02 6270 1.72 0.48 2.72 80 URI_HEX 6224 18.55 38.39 2.70 81 RCVD_IN_MSPIKE_WL 6034 1.68 0.50 2.61 82 RCVD_IN_MSPIKE_H3 6028 1.67 0.50 2.61 83 HTML_IMAGE_RATIO_08 5613 1.96 1.37 2.43 84 TR_MetaPhish_Combo_01 5472 1.58 0.60 2.37 85 BAYES_20 5146 1.69 1.01 2.23 86 RCVD_IN_IADB_OPTIN 4913 1.28 0.22 2.13 87 XM_CamelCaseFrm001 4873 2.22 2.35 2.11 88 USER_IN_DEF_DKIM_WL 4694 1.14 0.01 2.03 89 IN_HORDE_ADDRESS_BOOK 4645 1.14 0.04 2.01 90 TM2_M_URI_OPT_OUT 4573 1.99 2.00 1.98 91 MAILING_LIST_MULTI 4155 1.35 0.78 1.80 92 XM_DIRTYINTL 4025 1.97 2.25 1.74 93 RELAYCOUNTRY_CA 3852 1.95 2.31 1.67 94 XM_DK_Undo_01 3849 1.33 0.92 1.67 95 URI_TRY_3LD 3824 1.39 1.06 1.66 96 XM_PDF 3801 1.00 0.19 1.65 97 BOTNET 3677 21.53 46.47 1.59 98 BAYES_05 3642 1.16 0.63 1.58 99 XMBdyGiftCard01 3607 2.42 3.50 1.56 100 TR_Symld_Words 3487 1.10 0.58 1.51 101 HTML_MIME_NO_HTML_TAG 3481 1.47 1.43 1.51 102 XM_OfRef6 3262 1.60 1.84 1.41 103 TooManyTo_002 3249 0.93 0.33 1.41 104 MIME_HTML_ONLY_MULTI 3175 1.89 2.54 1.37 105 XM_GoogleGroups 3140 0.89 0.30 1.36 106 XMPhish11 2997 1.11 0.87 1.30 107 UNTRUSTED_Relay 2838 3.63 6.63 1.23 108 XMDiploma_00 2785 1.17 1.12 1.21 109 T_XMDrugObfuBody_08 2773 1.27 1.36 1.20 110 XM_H_PHPOS 2546 0.88 0.61 1.10 111 XMSubMetaSxObfu_02 2500 0.73 0.30 1.08 112 SUBJ_ALL_CAPS 2425 1.28 1.57 1.05 113 TooManyTo_003 2389 0.70 0.29 1.03 114 DKIM_ADSP_CUSTOM_MED 2351 0.78 0.48 1.02 115 USER_IN_WHITELIST 2293 0.55 0.00 0.99 116 XMBody_95 2195 0.58 0.11 0.95 117 XMHTMLBadTable_001 2112 1.00 1.10 0.91 118 XM_ProductURIs 2019 0.95 1.04 0.87 119 XMStockSpam_06 2017 0.90 0.92 0.87 120 XM_SPF_SoftFail 2011 1.26 1.74 0.87 121 T_XMDrugObfuBody_00 1960 0.69 0.49 0.85 122 TooManyTo_004 1948 0.55 0.18 0.84 123 T_TooManySym_03 1941 0.49 0.04 0.84 124 XM_H_PHPMailer 1927 0.66 0.45 0.83 125 TM2_M_VERY_LONG_WORD 1874 0.82 0.83 0.81 126 XM_H_Long_From02 1796 0.91 1.07 0.78 127 XM_B_REG_HTML 1779 0.77 0.76 0.77 128 TooManyTo_005 1713 0.48 0.15 0.74 129 XM_UB50 1647 1.70 2.92 0.71 130 XM_B_COPY_HTML 1562 0.60 0.51 0.68 131 MISSING_HEADERS 1557 0.47 0.21 0.67 132 XMGenDplmaNmb 1541 0.74 0.84 0.67 133 XMBrknScrpt_02 1534 0.63 0.58 0.66 134 TM2_M_A_HREF_HREF 1529 0.52 0.34 0.66 135 FILL_THIS_FORM 1499 0.71 0.78 0.65 136 NML_ADSP_CUSTOM_MED 1490 0.54 0.42 0.65 137 XMPhish14 1458 0.76 0.91 0.63 138 XMSexyCombo_01 1383 0.67 0.77 0.60 139 T_FILL_THIS_FORM_LONG 1347 0.65 0.73 0.58 140 DKIM_ADSP_NXDOMAIN 1281 0.58 0.62 0.55 141 XMSolicitRefs_0 1255 0.43 0.28 0.54 142 HELO_NODOT 1250 0.34 0.10 0.54 143 FORGED_GMAIL_RCVD 1231 0.48 0.41 0.53 144 HTML_FONT_FACE_BAD 1230 0.52 0.51 0.53 145 XMSubMetaI_00 1220 1.05 1.70 0.53 146 RDNS_DYNAMIC 1217 0.50 0.48 0.53 147 XMBody_17 1202 0.73 1.00 0.52 148 FILL_THIS_FORM_LOAN 1196 0.60 0.71 0.52 149 RELAYCOUNTRY_GB 1169 0.51 0.50 0.51 150 XM_H_PHPOS_M 1165 0.42 0.31 0.50 151 T_TooManySym_04 1082 0.26 0.01 0.47 152 T_XMHurry_00 1080 0.63 0.84 0.47 153 T_FILL_THIS_FORM_SHORT 1070 0.60 0.77 0.46 154 RELAYCOUNTRY_DE 1060 0.51 0.57 0.46 155 HTML_TAG_BALANCE_BODY 1059 0.49 0.52 0.46 156 XM_D_tchamptons_WL 1046 0.25 0.00 0.45 157 XMNoVowels 1013 0.33 0.20 0.44 158 DIET_1 1002 0.61 0.83 0.43 159 RELAYCOUNTRY_AU 990 0.33 0.20 0.43 160 XMLngstWrd_00 980 0.29 0.13 0.42 161 TR_LOTS_OF_MONEY2 963 0.47 0.54 0.42 162 T_MONEY_PERCENT 963 0.47 0.54 0.42 163 XMCapTrack 954 16.46 36.53 0.41 164 SUBJ_DOLLARS 935 0.56 0.76 0.40 165 XMBody_78 930 0.51 0.65 0.40 166 XMPhish30 902 0.66 1.00 0.39 167 XMLngstWrd_01 884 0.27 0.12 0.38 168 SpammyFromTLD_01 845 0.58 0.85 0.37 169 XMSubMetaSxObfu_03 819 0.29 0.21 0.35 170 PLING_QUERY 813 0.57 0.85 0.35 171 XMBody_29 800 0.23 0.08 0.35 172 XMSlimDrugH 791 0.35 0.37 0.34 173 XMRcvdHeader_15 785 0.19 0.00 0.34 174 HTML_IMAGE_ONLY_32 768 0.25 0.14 0.33 175 XM_Combo_Sbj 757 0.27 0.21 0.33 176 XM_Walgreens_Forge 755 0.28 0.22 0.33 177 THIS_AD 743 0.28 0.23 0.32 178 XM_ShortIntro_01 732 0.27 0.22 0.32 179 URI_NOVOWEL 730 0.37 0.45 0.32 180 XMHTML_After_End 699 0.45 0.63 0.30 181 XMSUPPORT 684 0.16 0.00 0.30 182 TR_XM_RelayPhish 679 0.46 0.67 0.29 183 XM_RXBody 678 0.55 0.87 0.29 184 TVD_SPACE_RATIO 676 0.33 0.38 0.29 185 HTTPS_HTTP_MISMATCH 669 0.26 0.23 0.29 186 MPART_ALT_DIFF_COUNT 661 0.35 0.44 0.29 187 FROM_EGROUPS 656 0.16 0.01 0.28 188 XMDateMe_00 647 0.21 0.13 0.28 189 REMOVE_BEFORE_LINK 632 0.26 0.24 0.27 190 TM2_M_BODY_EMPTY 624 0.16 0.03 0.27 191 T_Symld_Words_02 619 0.32 0.38 0.27 192 XMClaimOffer 612 0.46 0.70 0.27 193 XM_H_SpoofStaff4 610 0.15 0.01 0.26 194 T_TooManySym_05 568 0.14 0.00 0.25 195 XM_S_JOY_D 562 0.25 0.25 0.24 196 XMSubNoVowel 562 0.37 0.52 0.24 197 XM_BadFromFormat 548 0.30 0.38 0.24 198 T_OBFU_PDF_ATTACH 546 0.15 0.05 0.24 199 RCVD_IN_BL_SPAMCOP_NET 546 0.71 1.31 0.24 200 XMGappySubj_01 521 0.27 0.33 0.23 ----------------------------------------------------------------------