Email: 492582 Autolearn: 0 AvgScore: 3.78 AvgScanTime: 2.95 sec Spam: 138366 Autolearn: 0 AvgScore: 13.28 AvgScanTime: 3.51 sec Ham: 354216 Autolearn: 0 AvgScore: 0.07 AvgScanTime: 2.73 sec Time Spent Running SA: 403.55 hours Time Spent Processing Spam: 135.07 hours Time Spent Processing Ham: 268.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129832 70.19 93.83 60.95 2 DKIM_SIGNED 90925 62.23 65.71 60.87 3 XM_DK_Pass 87589 60.86 63.30 59.91 4 DCC_CHECK 86957 42.70 62.85 34.83 5 DKIM_VALID 84434 58.82 61.02 57.96 6 XMListUnsubscribeExists 78739 47.84 56.91 44.29 7 DKIM_VALID_AU 69275 46.39 50.07 44.96 8 MIME_HTML_ONLY 57373 23.90 41.46 17.04 9 XM_H_QuotedFrom 57271 30.35 41.39 26.03 10 BAYES_50 51267 43.06 37.05 45.41 11 DCC_CHECK_NEGATIVE 50290 56.54 36.35 64.43 12 XM_DK_Undo_02 43091 15.57 31.14 9.49 13 LOC_TINY_FONT_1 42064 23.17 30.40 20.35 14 BAYES_99 38916 15.32 28.13 10.31 15 BOTNET 38700 8.81 27.97 1.33 16 HTML_FONT_LOW_CONTRAST 38105 24.72 27.54 23.62 17 FROM_EXCESS_BASE64 32905 8.79 23.78 2.94 18 XMSubLong 32549 17.32 23.52 14.90 19 BAYES_999 32122 11.96 23.22 7.56 20 TR_DCC_Bayes_99 31208 9.31 22.55 4.14 21 FVGT_m_MULTI_ODD 29623 17.81 21.41 16.41 22 RCVD_IN_RP_RNBL 28482 5.83 20.58 0.06 23 T_REMOTE_IMAGE 27796 7.72 20.09 2.88 24 HTML_MIME_NO_HTML_TAG 27297 6.44 19.73 1.25 25 MISSING_HEADERS 25391 5.27 18.35 0.16 26 BODY_URI_ONLY 25311 5.16 18.29 0.03 27 MIME_HEADER_CTYPE_ONLY 25281 5.24 18.27 0.15 28 HTML_SHORT_LINK_IMG_1 25089 5.12 18.13 0.04 29 DKIM_VALID_EF 24867 21.14 17.97 22.38 30 HTML_IMAGE_ONLY_04 22853 4.67 16.52 0.04 31 T_KAM_HTML_FONT_INVALID 22120 12.89 15.99 11.68 32 T_TM2_M_HEADER_IN_MSG 22097 17.93 15.97 18.70 33 HTML_IMAGE_RATIO_02 21866 9.88 15.80 7.56 34 XM_Body_Dirty_Words 20811 14.51 15.04 14.31 35 HTML_SHORT_CENTER 19458 3.96 14.06 0.01 36 XM_Multi_Part_URI 18194 11.98 13.15 11.52 37 BAYES_80 17387 9.81 12.57 8.74 38 XM_Evil_Numbers_Gen 16575 7.71 11.98 6.04 39 MultiRelay 16217 13.43 11.72 14.10 40 BAYES_60 16147 11.18 11.67 10.99 41 RELAYCOUNTRY_META 15217 5.28 11.00 3.05 42 FSL_BULK_SIG 13404 8.05 9.69 7.41 43 XMSexyCombo_05 13249 5.96 9.58 4.54 44 BOTNET_IPINHOSTNAME 12806 6.71 9.26 5.71 45 LOTS_OF_MONEY 12351 8.68 8.93 8.58 46 XMSubMetaSx_00 11528 4.96 8.33 3.65 47 URI_HEX 11293 3.43 8.16 1.58 48 TooManyTo_001 10934 19.06 7.90 23.42 49 XMNumbers 10711 6.80 7.74 6.43 50 T_XMDrugObfuBody_14 9842 5.97 7.11 5.53 51 MPART_ALT_DIFF 9658 3.53 6.98 2.19 52 XM_H_Long_From01 9054 4.99 6.54 4.38 53 BAYES_95 8978 5.46 6.49 5.06 54 HTML_IMAGE_RATIO_04 8853 5.62 6.40 5.31 55 TR_XM_DocInvoice 8537 3.66 6.17 2.68 56 NUMERIC_HTTP_ADDR 8472 1.78 6.12 0.08 57 UNTRUSTED_Relay 8443 2.33 6.10 0.86 58 ANY_BOUNCE_MESSAGE 8400 3.56 6.07 2.58 59 BOUNCE_MESSAGE 8399 3.56 6.07 2.58 60 XM_URI_RBL 8318 1.94 6.01 0.35 61 XMCapTrack 8289 1.89 5.99 0.29 62 URIBL_BLACK 7914 1.65 5.72 0.06 63 DATE_IN_PAST_06_12 7850 1.66 5.67 0.09 64 XMStrtUSub 7409 3.82 5.35 3.22 65 DKIM_INVALID 6491 3.41 4.69 2.91 66 XM_UncommonTLD01 6365 5.74 4.60 6.19 67 XM_B_Phish_Phrases 6250 4.96 4.52 5.13 68 LotsOfNums_01 5463 5.31 3.95 5.84 69 ALL_TRUSTED 5454 27.10 3.94 36.14 70 MIME_HTML_MOSTLY 5326 2.45 3.85 1.90 71 XM_DIRTYINTL 5321 2.26 3.85 1.64 72 MIME_HTML_ONLY_MULTI 5273 1.92 3.81 1.18 73 HTML_IMAGE_RATIO_06 4906 2.72 3.55 2.40 74 XM_SendGrid 4251 3.98 3.07 4.33 75 DIET_1 3982 1.07 2.88 0.36 76 XM_UB50 3802 1.10 2.75 0.46 77 RELAYCOUNTRY_CA 3642 1.66 2.63 1.28 78 RCVD_IN_RP_SAFE 3629 8.13 2.62 10.28 79 TM2_M_URI_OPT_OUT 3576 1.60 2.58 1.21 80 MIME_QP_LONG_LINE 3501 3.28 2.53 3.58 81 HTML_IMAGE_RATIO_08 3481 1.92 2.52 1.69 82 TooManyTo_002 3421 12.87 2.47 16.94 83 RCVD_IN_MSPIKE_H2 3402 3.35 2.46 3.70 84 T_TooManySym_01 3361 4.37 2.43 5.13 85 XM_CamelCaseFrm001 3247 1.64 2.35 1.36 86 XMBdyGiftCard01 3182 1.71 2.30 1.47 87 XMSubMetaI_00 3076 0.98 2.22 0.50 88 RCVD_IN_RP_CERTIFIED 3072 7.46 2.22 9.51 89 XMBody_17 2997 0.99 2.17 0.53 90 TooManyTo_003 2974 10.19 2.15 13.33 91 XM_SPF_SoftFail 2922 2.37 2.11 2.48 92 XM_OfRef6 2834 1.15 2.05 0.80 93 URI_TRY_3LD 2724 1.19 1.97 0.89 94 MultiRelay_Combo 2649 0.60 1.91 0.09 95 MultiRelay_CC 2649 0.60 1.91 0.09 96 XMSlimDrugH 2623 0.73 1.90 0.27 97 XM_BadFromFormat 2622 0.66 1.89 0.18 98 URIBL_DBL_SPAM 2621 0.61 1.89 0.11 99 XMSexyCombo_01 2621 0.84 1.89 0.43 100 RCVD_IN_BL_SPAMCOP_NET 2552 0.71 1.84 0.27 101 HTML_IMAGE_ONLY_08 2421 0.54 1.75 0.07 102 PLING_QUERY 2409 0.85 1.74 0.50 103 T_XMDrugObfuBody_00 2333 1.08 1.69 0.85 104 TooManyTo_004 2322 7.66 1.68 9.99 105 T_XMDrugObfuBody_08 2296 1.10 1.66 0.88 106 UNPARSEABLE_RELAY 2216 3.61 1.60 4.40 107 SHORT_URI 2074 0.58 1.50 0.22 108 XMDiploma_00 2000 0.94 1.45 0.74 109 SUBJ_ALL_CAPS 1998 4.47 1.44 5.65 110 XM_salutation 1940 0.53 1.40 0.19 111 TR_MetaPhish_Combo_01 1765 1.39 1.28 1.43 112 MPART_ALT_DIFF_COUNT 1740 0.56 1.26 0.29 113 BAYES_00 1720 7.84 1.24 10.41 114 TooManyTo_005 1690 5.19 1.22 6.74 115 BAYES_40 1676 2.49 1.21 2.99 116 HTML_FONT_SIZE_LARGE 1669 0.43 1.21 0.13 117 BOTNET_NORDNS 1658 0.34 1.20 0.01 118 TM2_M_VERY_LONG_WORD 1620 0.91 1.17 0.81 119 XMBody_78 1611 0.61 1.16 0.40 120 SUBJ_DOLLARS 1564 0.75 1.13 0.60 121 MAILING_LIST_MULTI 1564 1.14 1.13 1.14 122 XMPhish30 1507 0.49 1.09 0.25 123 SpammyFromTLD_02 1500 0.39 1.08 0.12 124 BAYES_20 1477 2.62 1.07 3.23 125 TR_LOTS_OF_MONEY3 1472 0.41 1.06 0.16 126 XMMoneyMeta_00 1464 0.39 1.06 0.13 127 XM_H_PHPOS 1434 3.37 1.04 4.28 128 TR_LOTS_OF_MONEY1 1425 0.29 1.03 0.01 129 T_HTML_TAG_BALANCE_CENTER 1423 0.38 1.03 0.13 130 RELAYCOUNTRY_AT 1413 0.40 1.02 0.16 131 NO_PRESCRIPTION 1402 0.29 1.01 0.00 132 RCVD_IN_IADB_LISTED 1395 3.07 1.01 3.87 133 XM_GoogleGroups 1348 0.86 0.97 0.81 134 TR_XM_RelayPhish 1346 0.46 0.97 0.27 135 RELAYCOUNTRY_CN 1342 0.28 0.97 0.01 136 SpammyFromTLD_01 1333 2.93 0.96 3.70 137 XMLngstWrd_00 1305 0.56 0.94 0.41 138 XMLngstWrd_01 1293 0.53 0.93 0.38 139 XMSubMetaI_01 1290 0.29 0.93 0.05 140 XMWghtMeta_00 1283 0.27 0.93 0.01 141 XM_UB60 1275 0.32 0.92 0.08 142 T_TooManySym_02 1235 1.47 0.89 1.70 143 T_XMHurry_00 1227 0.60 0.89 0.48 144 XMStockSpam_06 1221 1.29 0.88 1.45 145 TR_Mismatch_TLD_02 1214 0.27 0.88 0.04 146 TM2_M_A_HREF_HREF 1213 0.98 0.88 1.02 147 XM_S_JOY_D 1212 0.45 0.88 0.28 148 XM_H_PHPMailer 1205 0.67 0.87 0.59 149 TR_Symld_Words 1204 1.32 0.87 1.50 150 GUARANTEED_100_PERCENT 1201 0.25 0.87 0.01 151 DATE_IN_PAST_03_06 1200 0.28 0.87 0.05 152 XMSubject_09 1198 0.27 0.87 0.03 153 RELAYCOUNTRY_GB 1187 0.46 0.86 0.31 154 XM_UB99 1187 0.27 0.86 0.04 155 RELAYCOUNTRY_FR 1182 0.33 0.85 0.12 156 URI_NOVOWEL 1170 0.56 0.85 0.44 157 TR_XM_DK_Bayes 1161 6.34 0.84 8.49 158 XM_ProductURIs 1156 1.44 0.84 1.68 159 RCVD_IN_IADB_SPF 1146 2.66 0.83 3.38 160 BANG_GUAR 1137 0.24 0.82 0.02 161 XMSubPhish11 1135 0.31 0.82 0.12 162 XMGenDplmaNmb 1135 0.51 0.82 0.39 163 FVGT_m_MULTI_ODD_EMAIL 1113 0.29 0.80 0.09 164 XMSexyCombo_04 1101 0.29 0.80 0.10 165 XMLngstWrd_02 1095 0.38 0.79 0.21 166 RCVD_IN_IADB_SENDERID 1093 2.40 0.79 3.02 167 MALE_ENHANCE 1091 0.22 0.79 0.00 168 TR_XM_DK_Bayes1 1090 6.15 0.79 8.25 169 HTML_FONT_FACE_BAD 1088 0.48 0.79 0.36 170 RCVD_IN_IADB_DK 1087 2.33 0.79 2.94 171 XMSubMetaI_02 1083 0.22 0.78 0.00 172 XMSubject_47 1081 0.22 0.78 0.00 173 XMWarranty1 1075 0.22 0.78 0.00 174 XMLngstWrd_03 1057 0.33 0.76 0.16 175 XM_GoogleGroups2 1052 0.25 0.76 0.05 176 XMPhish11 1043 0.64 0.75 0.60 177 XMHTML_After_End 1017 0.42 0.74 0.30 178 XM_H_Long_From02 1015 0.74 0.73 0.75 179 XMSubPhish8 1010 0.24 0.73 0.05 180 XMLngstWrd_04 1000 0.29 0.72 0.12 181 XM_RXBody 987 0.34 0.71 0.20 182 HTML_TAG_BALANCE_BODY 962 0.47 0.70 0.38 183 T_FILL_THIS_FORM_SHORT 959 0.46 0.69 0.36 184 XM_B_COPY_HTML 957 0.58 0.69 0.53 185 XM_UB80 945 0.21 0.68 0.03 186 XMSubMetaSSx_00 933 0.30 0.67 0.15 187 RCVD_IN_IADB_VOUCHED 925 1.90 0.67 2.39 188 XM_DK_Undo_01 913 1.01 0.66 1.15 189 XMHTMLBadTable_001 901 0.56 0.65 0.53 190 DKIM_ADSP_NXDOMAIN 900 0.45 0.65 0.37 191 REMOVE_BEFORE_LINK 890 0.39 0.64 0.28 192 HTTPS_HTTP_MISMATCH 876 0.40 0.63 0.30 193 RELAYCOUNTRY_IE 868 0.23 0.63 0.07 194 XMPhish14 866 0.33 0.63 0.22 195 XM_UB999 865 0.20 0.63 0.04 196 RCVD_IN_MSPIKE_WL 855 1.53 0.62 1.89 197 XM_ShortIntro_01 853 1.42 0.62 1.73 198 RCVD_IN_MSPIKE_H3 851 1.53 0.62 1.89 199 TR_XM_DK_Bayes2 828 5.31 0.60 7.15 200 RDNS_DYNAMIC 819 0.48 0.59 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 228231 56.54 36.35 64.43 2 HTML_MESSAGE 215894 70.19 93.83 60.95 3 DKIM_SIGNED 215605 62.23 65.71 60.87 4 XM_DK_Pass 212220 60.86 63.30 59.91 5 DKIM_VALID 205290 58.82 61.02 57.96 6 BAYES_50 160847 43.06 37.05 45.41 7 DKIM_VALID_AU 159241 46.39 50.07 44.96 8 XMListUnsubscribeExists 156898 47.84 56.91 44.29 9 ALL_TRUSTED 128027 27.10 3.94 36.14 10 DCC_CHECK 123385 42.70 62.85 34.83 11 XM_H_QuotedFrom 92206 30.35 41.39 26.03 12 HTML_FONT_LOW_CONTRAST 83651 24.72 27.54 23.62 13 TooManyTo_001 82962 19.06 7.90 23.42 14 DKIM_VALID_EF 79258 21.14 17.97 22.38 15 LOC_TINY_FONT_1 72082 23.17 30.40 20.35 16 T_TM2_M_HEADER_IN_MSG 66222 17.93 15.97 18.70 17 MIME_HTML_ONLY 60343 23.90 41.46 17.04 18 TooManyTo_002 59993 12.87 2.47 16.94 19 FVGT_m_MULTI_ODD 58125 17.81 21.41 16.41 20 XMSubLong 52769 17.32 23.52 14.90 21 XM_Body_Dirty_Words 50674 14.51 15.04 14.31 22 MultiRelay 49948 13.43 11.72 14.10 23 XM_DKIMWhitelistDomains 47648 9.71 0.13 13.45 24 TooManyTo_003 47222 10.19 2.15 13.33 25 T_KAM_HTML_FONT_INVALID 41379 12.89 15.99 11.68 26 XM_Multi_Part_URI 40795 11.98 13.15 11.52 27 BAYES_60 38915 11.18 11.67 10.99 28 BAYES_00 36875 7.84 1.24 10.41 29 BAYES_99 36534 15.32 28.13 10.31 30 RCVD_IN_RP_SAFE 36425 8.13 2.62 10.28 31 TooManyTo_004 35398 7.66 1.68 9.99 32 RCVD_IN_RP_CERTIFIED 33699 7.46 2.22 9.51 33 XM_DK_Undo_02 33615 15.57 31.14 9.49 34 BAYES_80 30956 9.81 12.57 8.74 35 LOTS_OF_MONEY 30381 8.68 8.93 8.58 36 TR_XM_DK_Bayes 30077 6.34 0.84 8.49 37 TR_XM_DK_Bayes1 29226 6.15 0.79 8.25 38 BAYES_999 26784 11.96 23.22 7.56 39 HTML_IMAGE_RATIO_02 26783 9.88 15.80 7.56 40 FSL_BULK_SIG 26246 8.05 9.69 7.41 41 TR_XM_DK_Bayes2 25314 5.31 0.60 7.15 42 TooManyTo_005 23861 5.19 1.22 6.74 43 XMNumbers 22789 6.80 7.74 6.43 44 XM_UncommonTLD01 21915 5.74 4.60 6.19 45 XM_Evil_Numbers_Gen 21382 7.71 11.98 6.04 46 LotsOfNums_01 20698 5.31 3.95 5.84 47 BOTNET_IPINHOSTNAME 20240 6.71 9.26 5.71 48 SUBJ_ALL_CAPS 20002 4.47 1.44 5.65 49 T_XMDrugObfuBody_14 19582 5.97 7.11 5.53 50 HTML_IMAGE_RATIO_04 18818 5.62 6.40 5.31 51 T_TooManySym_01 18170 4.37 2.43 5.13 52 XM_B_Phish_Phrases 18163 4.96 4.52 5.13 53 BAYES_95 17925 5.46 6.49 5.06 54 XMSexyCombo_05 16098 5.96 9.58 4.54 55 UNPARSEABLE_RELAY 15574 3.61 1.60 4.40 56 XM_H_Long_From01 15515 4.99 6.54 4.38 57 XM_SendGrid 15342 3.98 3.07 4.33 58 XM_H_PHPOS 15167 3.37 1.04 4.28 59 TR_DCC_Bayes_99 14661 9.31 22.55 4.14 60 RCVD_IN_IADB_LISTED 13712 3.07 1.01 3.87 61 TVD_RCVD_IP 13620 2.81 0.17 3.85 62 SpammyFromTLD_01 13119 2.93 0.96 3.70 63 RCVD_IN_MSPIKE_H2 13111 3.35 2.46 3.70 64 TO_MALFORMED 12926 2.64 0.06 3.65 65 XMSubMetaSx_00 12918 4.96 8.33 3.65 66 MIME_QP_LONG_LINE 12664 3.28 2.53 3.58 67 RCVD_IN_IADB_SPF 11972 2.66 0.83 3.38 68 BAYES_20 11439 2.62 1.07 3.23 69 XMStrtUSub 11397 3.82 5.35 3.22 70 RELAYCOUNTRY_META 10800 5.28 11.00 3.05 71 RCVD_IN_IADB_SENDERID 10712 2.40 0.79 3.02 72 BAYES_40 10592 2.49 1.21 2.99 73 FROM_EXCESS_BASE64 10411 8.79 23.78 2.94 74 RCVD_IN_IADB_DK 10398 2.33 0.79 2.94 75 DKIM_INVALID 10315 3.41 4.69 2.91 76 T_REMOTE_IMAGE 10214 7.72 20.09 2.88 77 BAYES_05 10133 2.22 0.57 2.86 78 TR_XM_DocInvoice 9481 3.66 6.17 2.68 79 IN_ZIMBRA_NJ_WHITELIST 9355 1.90 0.01 2.64 80 ANY_BOUNCE_MESSAGE 9145 3.56 6.07 2.58 81 BOUNCE_MESSAGE 9145 3.56 6.07 2.58 82 XM_SPF_SoftFail 8772 2.37 2.11 2.48 83 HTML_IMAGE_RATIO_06 8492 2.72 3.55 2.40 84 RCVD_IN_IADB_VOUCHED 8455 1.90 0.67 2.39 85 MPART_ALT_DIFF 7747 3.53 6.98 2.19 86 MSGID_RANDY 7661 1.65 0.32 2.16 87 INVALID_MSGID 6748 1.39 0.06 1.91 88 MIME_HTML_MOSTLY 6744 2.45 3.85 1.90 89 RCVD_IN_MSPIKE_WL 6685 1.53 0.62 1.89 90 RCVD_IN_MSPIKE_H3 6683 1.53 0.62 1.89 91 XM_ShortIntro_01 6133 1.42 0.62 1.73 92 T_TooManySym_02 6009 1.47 0.89 1.70 93 HTML_IMAGE_RATIO_08 5972 1.92 2.52 1.69 94 XM_ProductURIs 5937 1.44 0.84 1.68 95 XM_DIRTYINTL 5795 2.26 3.85 1.64 96 URI_HEX 5591 3.43 8.16 1.58 97 RCVD_IN_IADB_OPTIN 5387 1.23 0.50 1.52 98 TR_Symld_Words 5307 1.32 0.87 1.50 99 XMBdyGiftCard01 5219 1.71 2.30 1.47 100 XMStockSpam_06 5128 1.29 0.88 1.45 101 TR_MetaPhish_Combo_01 5069 1.39 1.28 1.43 102 XM_PDF 5028 1.11 0.32 1.42 103 XM_CamelCaseFrm001 4835 1.64 2.35 1.36 104 URIBL_RHS_DOB 4802 1.13 0.57 1.36 105 IN_HORDE_ADDRESS_BOOK 4763 0.98 0.04 1.34 106 USER_IN_DEF_DKIM_WL 4761 0.99 0.07 1.34 107 BOTNET 4712 8.81 27.97 1.33 108 RELAYCOUNTRY_CA 4548 1.66 2.63 1.28 109 HTML_MIME_NO_HTML_TAG 4424 6.44 19.73 1.25 110 TM2_M_URI_OPT_OUT 4285 1.60 2.58 1.21 111 MIME_HTML_ONLY_MULTI 4195 1.92 3.81 1.18 112 XM_DK_Undo_01 4077 1.01 0.66 1.15 113 MAILING_LIST_MULTI 4040 1.14 1.13 1.14 114 TM2_M_A_HREF_HREF 3619 0.98 0.88 1.02 115 URI_TRY_3LD 3149 1.19 1.97 0.89 116 T_XMDrugObfuBody_08 3109 1.10 1.66 0.88 117 URIBL_DBL_ABUSE_SPAM 3108 0.72 0.30 0.88 118 UNTRUSTED_Relay 3050 2.33 6.10 0.86 119 T_XMDrugObfuBody_00 3002 1.08 1.69 0.85 120 XM_Combo_Sbj 2977 0.74 0.49 0.84 121 XM_GoogleGroups 2875 0.86 0.97 0.81 122 TM2_M_VERY_LONG_WORD 2863 0.91 1.17 0.81 123 XM_OfRef6 2818 1.15 2.05 0.80 124 XM_B_REG_HTML 2794 0.67 0.37 0.79 125 XM_H_Long_From02 2646 0.74 0.73 0.75 126 XMDiploma_00 2617 0.94 1.45 0.74 127 XMSubMetaSxObfu_02 2587 0.61 0.31 0.73 128 XM_D_tchamptons_WL 2495 0.51 0.02 0.70 129 XMBody_95 2345 0.49 0.06 0.66 130 USER_IN_WHITELIST 2289 0.46 0.00 0.65 131 SUBJ_DOLLARS 2138 0.75 1.13 0.60 132 XMPhish11 2125 0.64 0.75 0.60 133 XM_H_PHPMailer 2088 0.67 0.87 0.59 134 URIBL_SBL_A 2034 0.57 0.57 0.57 135 T_TooManySym_03 1963 0.42 0.06 0.55 136 XMBody_17 1888 0.99 2.17 0.53 137 XMHTMLBadTable_001 1878 0.56 0.65 0.53 138 XM_B_COPY_HTML 1878 0.58 0.69 0.53 139 DKIM_ADSP_CUSTOM_MED 1803 0.52 0.54 0.51 140 TVD_SPACE_RATIO 1797 0.45 0.32 0.51 141 XM_Sams_Club_Forge 1789 0.38 0.05 0.51 142 XMRcvdHeader_S01 1788 0.36 0.01 0.50 143 XMSubMetaI_00 1764 0.98 2.22 0.50 144 PLING_QUERY 1762 0.85 1.74 0.50 145 T_XMHurry_00 1710 0.60 0.89 0.48 146 XMSubject_40 1705 0.35 0.03 0.48 147 XM_UB50 1616 1.10 2.75 0.46 148 URI_NOVOWEL 1576 0.56 0.85 0.44 149 RDNS_DYNAMIC 1555 0.48 0.59 0.44 150 XMGppyBdWords 1555 0.46 0.53 0.44 151 XMSexyCombo_01 1515 0.84 1.89 0.43 152 XM_H_PHPOS_M 1486 0.46 0.56 0.42 153 XMLngstWrd_00 1459 0.56 0.94 0.41 154 XMClaimOffer 1419 0.39 0.38 0.40 155 XMBody_78 1403 0.61 1.16 0.40 156 XMGenDplmaNmb 1383 0.51 0.82 0.39 157 NO_DNS_FOR_FROM 1383 0.40 0.43 0.39 158 HTML_TAG_BALANCE_BODY 1335 0.47 0.70 0.38 159 XMLngstWrd_01 1331 0.53 0.93 0.38 160 FILL_THIS_FORM 1322 0.43 0.56 0.37 161 HELO_NODOT 1320 0.32 0.18 0.37 162 DKIM_ADSP_NXDOMAIN 1297 0.45 0.65 0.37 163 T_FILL_THIS_FORM_SHORT 1290 0.46 0.69 0.36 164 XMSubMetaSxObfu_03 1283 0.38 0.41 0.36 165 DIET_1 1280 1.07 2.88 0.36 166 HTML_FONT_FACE_BAD 1262 0.48 0.79 0.36 167 XM_URI_RBL 1239 1.94 6.01 0.35 168 T_Symld_Words_02 1219 0.41 0.58 0.34 169 NML_ADSP_CUSTOM_MED 1186 0.39 0.52 0.33 170 T_TooManySym_04 1164 0.24 0.03 0.33 171 T_FILL_THIS_FORM_LONG 1115 0.38 0.53 0.31 172 RELAYCOUNTRY_DE 1112 0.36 0.48 0.31 173 RELAYCOUNTRY_GB 1091 0.46 0.86 0.31 174 HTTPS_HTTP_MISMATCH 1075 0.40 0.63 0.30 175 XMSolicitRefs_0 1074 0.28 0.21 0.30 176 XMDateMe_00 1065 0.26 0.17 0.30 177 XMHTML_After_End 1049 0.42 0.74 0.30 178 T_FILL_THIS_FORM_LOAN 1048 0.34 0.45 0.30 179 XMBrknScrpt_02 1044 0.37 0.56 0.29 180 XMCapTrack 1039 1.89 5.99 0.29 181 XMNoVowels 1034 0.31 0.34 0.29 182 MPART_ALT_DIFF_COUNT 1015 0.56 1.26 0.29 183 FORGED_GMAIL_RCVD 1012 0.34 0.47 0.29 184 REMOVE_BEFORE_LINK 1009 0.39 0.64 0.28 185 FORGED_MUA_MOZILLA 1005 0.24 0.13 0.28 186 XM_S_JOY_D 1004 0.45 0.88 0.28 187 XMUrgent 983 0.23 0.12 0.28 188 XMSlimDrugH 962 0.73 1.90 0.27 189 RCVD_IN_BL_SPAMCOP_NET 954 0.71 1.84 0.27 190 TR_XM_RelayPhish 944 0.46 0.97 0.27 191 GAPPY_SUBJECT 924 0.21 0.07 0.26 192 RELAYCOUNTRY_AU 916 0.28 0.32 0.26 193 URIBL_CR_SURBL 904 0.23 0.18 0.26 194 XMPhish30 888 0.49 1.09 0.25 195 XMGappySubj_01 858 0.28 0.37 0.24 196 XM_Akamai 820 0.17 0.01 0.23 197 TM2_M_BODY_EMPTY 804 0.19 0.11 0.23 198 XMPhish14 775 0.33 0.63 0.22 199 SHORT_URI 769 0.58 1.50 0.22 200 XMRcvdHeader_15 763 0.15 0.00 0.22 ----------------------------------------------------------------------