Email: 639266 Autolearn: 0 AvgScore: 2.26 AvgScanTime: 3.83 sec Spam: 141685 Autolearn: 0 AvgScore: 12.11 AvgScanTime: 4.86 sec Ham: 497581 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 3.54 sec Time Spent Running SA: 680.03 hours Time Spent Processing Spam: 191.26 hours Time Spent Processing Ham: 488.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133406 83.45 94.16 80.40 2 DKIM_SIGNED 119590 73.13 84.41 69.92 3 XM_DK_Pass 116233 71.75 82.04 68.82 4 DCC_CHECK 115836 47.46 81.76 37.70 5 DKIM_VALID 110075 67.79 77.69 64.97 6 XMListUnsubscribeExists 104414 53.46 73.69 47.70 7 DKIM_VALID_AU 88395 48.51 62.39 44.55 8 XM_H_QuotedFrom 78893 38.76 55.68 33.94 9 BAYES_50 68260 57.62 48.18 60.31 10 HTML_FONT_LOW_CONTRAST 57177 29.23 40.36 26.07 11 LOC_TINY_FONT_1 54334 24.33 38.35 20.33 12 XM_DK_Undo_02 49565 13.40 34.98 7.25 13 MIME_HTML_ONLY 47502 22.36 33.53 19.17 14 XMSubLong 39790 22.57 28.08 21.00 15 BAYES_99 39460 10.56 27.85 5.63 16 FVGT_m_MULTI_ODD 38979 21.45 27.51 19.73 17 XM_Body_Dirty_Words 32934 13.87 23.24 11.20 18 BAYES_999 32330 8.69 22.82 4.67 19 TR_DCC_Bayes_99 31688 7.48 22.37 3.24 20 T_TM2_M_HEADER_IN_MSG 29989 25.68 21.17 26.96 21 DKIM_VALID_EF 28579 24.92 20.17 26.28 22 T_KAM_HTML_FONT_INVALID 27489 16.18 19.40 15.26 23 HTML_IMAGE_RATIO_02 27100 10.45 19.13 7.99 24 RELAYCOUNTRY_META 24907 7.62 17.58 4.78 25 XM_Multi_Part_URI 24727 13.31 17.45 12.14 26 XM_Evil_Numbers_Gen 23991 9.41 16.93 7.27 27 DCC_CHECK_NEGATIVE 23697 50.74 16.73 60.42 28 BOTNET_IPINHOSTNAME 22186 7.42 15.66 5.08 29 MultiRelay 21462 16.56 15.15 16.96 30 BOTNET 20115 4.34 14.20 1.53 31 LOTS_OF_MONEY 18753 10.50 13.24 9.72 32 XMSexyCombo_05 18093 5.84 12.77 3.87 33 FSL_BULK_SIG 17141 7.66 12.10 6.39 34 UNTRUSTED_Relay 15836 3.51 11.18 1.32 35 HTML_IMAGE_RATIO_04 15727 6.68 11.10 5.43 36 T_XMDrugObfuBody_14 15053 7.77 10.62 6.96 37 XM_B_Phish_Phrases 12826 5.94 9.05 5.05 38 FROM_EXCESS_BASE64 12705 4.71 8.97 3.50 39 TR_XM_DocInvoice 12325 4.70 8.70 3.56 40 XMSubMetaSx_00 12162 5.47 8.58 4.59 41 MPART_ALT_DIFF 12142 4.16 8.57 2.90 42 TooManyTo_001 11527 6.96 8.14 6.62 43 XM_H_Long_From01 10082 6.12 7.12 5.84 44 DKIM_INVALID 9515 5.34 6.72 4.95 45 BAYES_80 9396 3.66 6.63 2.81 46 XM_UncommonTLD01 9128 4.03 6.44 3.34 47 XM_UB50 8770 1.93 6.19 0.72 48 BAYES_60 8403 5.13 5.93 4.90 49 HTML_IMAGE_RATIO_06 8368 3.65 5.91 3.00 50 LotsOfNums_01 8222 7.81 5.80 8.38 51 MIME_HTML_MOSTLY 7720 3.05 5.45 2.37 52 XMNumbers 6615 4.15 4.67 4.00 53 MIME_HTML_ONLY_MULTI 6318 2.21 4.46 1.57 54 XM_DIRTYINTL 5982 2.39 4.22 1.87 55 TM2_M_URI_OPT_OUT 5831 2.28 4.12 1.76 56 BAYES_95 5578 2.17 3.94 1.67 57 URI_HEX 5525 2.10 3.90 1.59 58 MultiRelay_Combo 5176 0.91 3.65 0.13 59 MultiRelay_CC 5176 0.91 3.65 0.13 60 XM_SPF_SoftFail 5018 1.99 3.54 1.55 61 T_XMDrugObfuBody_08 4982 1.93 3.52 1.48 62 XM_CamelCaseFrm001 4956 1.97 3.50 1.54 63 XM_SendGrid 4937 5.19 3.48 5.67 64 RELAYCOUNTRY_CA 4920 1.86 3.47 1.40 65 RCVD_IN_RP_SAFE 4854 6.99 3.43 8.00 66 T_TooManySym_01 4819 4.73 3.40 5.11 67 SpammyFromTLD_02 4534 1.09 3.20 0.49 68 ALL_TRUSTED 4391 18.39 3.10 22.75 69 RCVD_IN_MSPIKE_H2 4374 4.27 3.09 4.60 70 RCVD_IN_RP_RNBL 4323 0.70 3.05 0.03 71 XMStrtUSub 4299 3.99 3.03 4.27 72 HTML_MIME_NO_HTML_TAG 4223 2.48 2.98 2.34 73 TM2_M_VERY_LONG_WORD 4194 1.38 2.96 0.93 74 XMDiploma_00 4165 1.68 2.94 1.32 75 XM_URI_RBL 4054 0.91 2.86 0.35 76 T_REMOTE_IMAGE 4032 3.84 2.85 4.12 77 XM_OfRef6 3836 1.70 2.71 1.41 78 SUBJ_ALL_CAPS 3621 2.02 2.56 1.87 79 MIME_QP_LONG_LINE 3614 4.88 2.55 5.54 80 RCVD_IN_BL_SPAMCOP_NET 3592 0.96 2.54 0.51 81 HTML_IMAGE_RATIO_08 3553 2.21 2.51 2.13 82 XMSexyCombo_01 3552 1.37 2.51 1.04 83 RCVD_IN_RP_CERTIFIED 3485 6.06 2.46 7.09 84 BAYES_00 3316 12.42 2.34 15.30 85 US_DOLLARS_3 3312 2.61 2.34 2.69 86 BAYES_40 3311 3.76 2.34 4.17 87 XMSubMetaI_00 3148 1.30 2.22 1.04 88 XMBody_17 3073 0.87 2.17 0.50 89 RELAYCOUNTRY_IN 3036 0.64 2.14 0.21 90 SpammyFromTLD_01 2880 1.04 2.03 0.76 91 BOTNET_NORDNS 2739 0.44 1.93 0.02 92 XMGenDplmaNmb 2712 1.06 1.91 0.81 93 BAYES_20 2538 2.88 1.79 3.19 94 UNPARSEABLE_RELAY 2421 2.92 1.71 3.26 95 XMStockSpam_06 2415 1.27 1.70 1.14 96 TR_Symld_Words 2411 2.50 1.70 2.72 97 XM_H_PHPOS 2400 1.24 1.69 1.11 98 TR_XM_DK_Bayes 2374 9.58 1.68 11.84 99 XMBdyGiftCard01 2280 1.12 1.61 0.98 100 RELAYCOUNTRY_DE 2240 0.56 1.58 0.26 101 TR_XM_DK_Bayes1 2177 8.97 1.54 11.09 102 XMPhish11 2126 1.14 1.50 1.04 103 URIBL_BLACK 2126 0.39 1.50 0.07 104 RELAYCOUNTRY_CN 2018 0.34 1.42 0.04 105 XMSubMetaSxObfu_03 2015 1.06 1.42 0.96 106 URIBL_DBL_SPAM 1977 0.36 1.40 0.06 107 TR_XM_RelayPhish 1967 0.80 1.39 0.64 108 RCVD_IN_IADB_LISTED 1960 4.96 1.38 5.97 109 XMSubMetaSSx_00 1938 0.50 1.37 0.25 110 XMPhish30 1917 0.58 1.35 0.35 111 TR_Mismatch_TLD_02 1913 0.34 1.35 0.05 112 MAILING_LIST_MULTI 1841 1.88 1.30 2.05 113 XM_H_Long_From02 1831 0.95 1.29 0.85 114 BODY_ENHANCEMENT 1765 0.31 1.25 0.04 115 XMClaimOffer 1738 0.34 1.23 0.09 116 RELAYCOUNTRY_GB 1733 1.02 1.22 0.97 117 RCVD_IN_IADB_SPF 1711 4.31 1.21 5.20 118 XMHTMLBadTable_001 1688 0.70 1.19 0.56 119 URI_TRY_3LD 1684 1.20 1.19 1.20 120 XMMoneyMeta_00 1677 0.54 1.18 0.36 121 XM_UB60 1670 0.30 1.18 0.05 122 T_XMHurry_00 1664 0.72 1.17 0.59 123 FROM_SUSPICIOUS_NTLD 1663 0.30 1.17 0.05 124 XMBody_78 1659 0.56 1.17 0.38 125 XMLngstWrd_00 1656 0.66 1.17 0.52 126 RELAYCOUNTRY_AT 1653 0.52 1.17 0.34 127 TR_XM_DK_Bayes2 1643 6.87 1.16 8.50 128 RCVD_IN_IADB_SENDERID 1640 3.81 1.16 4.57 129 DIET_1 1632 0.49 1.15 0.30 130 XMLngstWrd_01 1626 0.63 1.15 0.49 131 RCVD_IN_IADB_DK 1603 3.72 1.13 4.45 132 T_XMDrugObfuBody_00 1599 0.85 1.13 0.77 133 T_TooManySym_02 1585 1.37 1.12 1.44 134 XM_ProductURIs 1583 0.70 1.12 0.58 135 XM_Body_Obfu01 1564 0.48 1.10 0.30 136 XMHTML_After_End 1559 0.59 1.10 0.45 137 XMLngstWrd_02 1549 0.43 1.09 0.24 138 SUBJ_DOLLARS 1543 0.49 1.09 0.31 139 XM_DK_Undo_01 1529 1.54 1.08 1.68 140 XMGppyBdWords 1523 0.40 1.07 0.21 141 XMSlimDrugH 1520 0.52 1.07 0.36 142 XM_OfRef7 1520 0.35 1.07 0.14 143 T_HTML_TAG_BALANCE_CENTER 1520 0.34 1.07 0.13 144 RDNS_DYNAMIC 1515 0.57 1.07 0.43 145 XM_B_COPY_HTML 1485 0.55 1.05 0.40 146 XMPhish14 1449 0.51 1.02 0.36 147 RELAYCOUNTRY_NL 1446 0.35 1.02 0.16 148 XM_RXBody 1427 0.56 1.01 0.43 149 BAYES_05 1422 1.79 1.00 2.02 150 TR_LOTS_OF_MONEY2 1391 0.38 0.98 0.21 151 LongTLD 1391 0.32 0.98 0.14 152 T_MONEY_PERCENT 1391 0.38 0.98 0.21 153 XMLngstWrd_03 1390 0.32 0.98 0.13 154 HTML_FONT_FACE_BAD 1363 0.61 0.96 0.51 155 LONG_HEX_URI 1340 0.31 0.95 0.13 156 DATE_IN_PAST_03_06 1326 0.32 0.94 0.15 157 XM_UB99 1323 0.21 0.93 0.01 158 XM_S_JOY_D 1317 0.38 0.93 0.22 159 RCVD_IN_IADB_VOUCHED 1315 3.27 0.93 3.93 160 DKIM_ADSP_CUSTOM_MED 1313 0.96 0.93 0.97 161 HTML_TAG_BALANCE_BODY 1308 0.55 0.92 0.44 162 XM_BadFromFormat 1295 0.35 0.91 0.19 163 T_FILL_THIS_FORM_SHORT 1294 0.70 0.91 0.64 164 XM_XX_Yahoo 1283 0.28 0.91 0.10 165 MPART_ALT_DIFF_COUNT 1264 0.36 0.89 0.21 166 INVALID_DATE 1247 0.25 0.88 0.07 167 TM2_M_A_HREF_HREF 1244 0.71 0.88 0.67 168 XMSexyCombo_04 1239 0.59 0.87 0.51 169 TooManyTo_002 1230 1.54 0.87 1.74 170 NML_ADSP_CUSTOM_MED 1220 0.70 0.86 0.65 171 T_XMDrugObfuBody_01 1212 0.21 0.86 0.03 172 RCVD_IN_MSPIKE_WL 1208 1.66 0.85 1.89 173 ANY_BOUNCE_MESSAGE 1206 6.47 0.85 8.07 174 BOUNCE_MESSAGE 1206 6.47 0.85 8.07 175 XM_UB80 1203 0.20 0.85 0.01 176 RCVD_IN_MSPIKE_H3 1202 1.65 0.85 1.88 177 HTTPS_HTTP_MISMATCH 1185 0.57 0.84 0.50 178 RELAYCOUNTRY_FR 1180 0.33 0.83 0.19 179 RELAYCOUNTRY_IT 1167 0.22 0.82 0.04 180 DATE_IN_PAST_06_12 1145 0.25 0.81 0.09 181 FORGED_GMAIL_RCVD 1143 0.57 0.81 0.50 182 FUZZY_MILLION 1127 0.18 0.80 0.00 183 RELAYCOUNTRY_AU 1109 0.53 0.78 0.45 184 URI_WP_HACKED_2 1078 0.52 0.76 0.45 185 XM_HighProb1 1058 0.17 0.75 0.01 186 PLING_QUERY 1056 0.52 0.75 0.46 187 T_Symld_Words_02 1048 0.60 0.74 0.56 188 HTML_IMAGE_ONLY_16 1048 0.36 0.74 0.25 189 REMOVE_BEFORE_LINK 1039 0.38 0.73 0.28 190 LOW_PRICE 1035 0.67 0.73 0.66 191 XMBrknScrpt_02 1032 0.55 0.73 0.51 192 XM_B_REG_HTML 1021 0.55 0.72 0.50 193 URI_NOVOWEL 1007 0.52 0.71 0.46 194 NUMERIC_HTTP_ADDR 1007 0.23 0.71 0.10 195 TooManyTo_003 998 1.07 0.70 1.17 196 RCVD_IN_IADB_OPTIN 983 2.15 0.69 2.57 197 THIS_AD 960 0.35 0.68 0.26 198 XM_UB999 960 0.15 0.68 0.01 199 XM_PDF 942 3.50 0.66 4.31 200 FILL_THIS_FORM 939 0.60 0.66 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 400033 83.45 94.16 80.40 2 DKIM_SIGNED 347915 73.13 84.41 69.92 3 XM_DK_Pass 342450 71.75 82.04 68.82 4 DKIM_VALID 323265 67.79 77.69 64.97 5 DCC_CHECK_NEGATIVE 300654 50.74 16.73 60.42 6 BAYES_50 300077 57.62 48.18 60.31 7 XMListUnsubscribeExists 237329 53.46 73.69 47.70 8 DKIM_VALID_AU 221690 48.51 62.39 44.55 9 DCC_CHECK 187566 47.46 81.76 37.70 10 XM_H_QuotedFrom 168882 38.76 55.68 33.94 11 T_TM2_M_HEADER_IN_MSG 134154 25.68 21.17 26.96 12 DKIM_VALID_EF 130749 24.92 20.17 26.28 13 HTML_FONT_LOW_CONTRAST 129698 29.23 40.36 26.07 14 ALL_TRUSTED 113199 18.39 3.10 22.75 15 XMSubLong 104509 22.57 28.08 21.00 16 LOC_TINY_FONT_1 101180 24.33 38.35 20.33 17 FVGT_m_MULTI_ODD 98157 21.45 27.51 19.73 18 MIME_HTML_ONLY 95410 22.36 33.53 19.17 19 MultiRelay 84376 16.56 15.15 16.96 20 BAYES_00 76112 12.42 2.34 15.30 21 T_KAM_HTML_FONT_INVALID 75944 16.18 19.40 15.26 22 XM_DKIMWhitelistDomains 65435 10.25 0.08 13.15 23 XM_Multi_Part_URI 60388 13.31 17.45 12.14 24 TR_XM_DK_Bayes 58891 9.58 1.68 11.84 25 XM_Body_Dirty_Words 55711 13.87 23.24 11.20 26 TR_XM_DK_Bayes1 55182 8.97 1.54 11.09 27 LOTS_OF_MONEY 48378 10.50 13.24 9.72 28 TR_XM_DK_Bayes2 42270 6.87 1.16 8.50 29 LotsOfNums_01 41715 7.81 5.80 8.38 30 ANY_BOUNCE_MESSAGE 40144 6.47 0.85 8.07 31 BOUNCE_MESSAGE 40143 6.47 0.85 8.07 32 RCVD_IN_RP_SAFE 39822 6.99 3.43 8.00 33 HTML_IMAGE_RATIO_02 39734 10.45 19.13 7.99 34 XM_Evil_Numbers_Gen 36176 9.41 16.93 7.27 35 XM_DK_Undo_02 36085 13.40 34.98 7.25 36 RCVD_IN_RP_CERTIFIED 35275 6.06 2.46 7.09 37 T_XMDrugObfuBody_14 34620 7.77 10.62 6.96 38 TooManyTo_001 32945 6.96 8.14 6.62 39 FSL_BULK_SIG 31809 7.66 12.10 6.39 40 RCVD_IN_IADB_LISTED 29716 4.96 1.38 5.97 41 XM_H_Long_From01 29036 6.12 7.12 5.84 42 XM_SendGrid 28227 5.19 3.48 5.67 43 BAYES_99 28035 10.56 27.85 5.63 44 MIME_QP_LONG_LINE 27560 4.88 2.55 5.54 45 HTML_IMAGE_RATIO_04 26996 6.68 11.10 5.43 46 RCVD_IN_IADB_SPF 25858 4.31 1.21 5.20 47 T_TooManySym_01 25420 4.73 3.40 5.11 48 BOTNET_IPINHOSTNAME 25258 7.42 15.66 5.08 49 XM_B_Phish_Phrases 25142 5.94 9.05 5.05 50 DKIM_INVALID 24650 5.34 6.72 4.95 51 BAYES_60 24399 5.13 5.93 4.90 52 RELAYCOUNTRY_META 23796 7.62 17.58 4.78 53 BAYES_999 23220 8.69 22.82 4.67 54 RCVD_IN_MSPIKE_H2 22906 4.27 3.09 4.60 55 XMSubMetaSx_00 22816 5.47 8.58 4.59 56 RCVD_IN_IADB_SENDERID 22723 3.81 1.16 4.57 57 RCVD_IN_IADB_DK 22150 3.72 1.13 4.45 58 XM_PDF 21422 3.50 0.66 4.31 59 XMStrtUSub 21238 3.99 3.03 4.27 60 BAYES_40 20749 3.76 2.34 4.17 61 T_REMOTE_IMAGE 20524 3.84 2.85 4.12 62 XMNumbers 19906 4.15 4.67 4.00 63 RCVD_IN_IADB_VOUCHED 19575 3.27 0.93 3.93 64 XMSexyCombo_05 19254 5.84 12.77 3.87 65 TR_XM_DocInvoice 17690 4.70 8.70 3.56 66 FROM_EXCESS_BASE64 17406 4.71 8.97 3.50 67 IN_ZIMBRA_NJ_WHITELIST 17107 2.68 0.02 3.44 68 XM_UncommonTLD01 16618 4.03 6.44 3.34 69 UNPARSEABLE_RELAY 16239 2.92 1.71 3.26 70 TR_DCC_Bayes_99 16141 7.48 22.37 3.24 71 BAYES_20 15879 2.88 1.79 3.19 72 HTML_IMAGE_RATIO_06 14946 3.65 5.91 3.00 73 MPART_ALT_DIFF 14431 4.16 8.57 2.90 74 BAYES_80 13984 3.66 6.63 2.81 75 TVD_RCVD_IP 13969 2.22 0.14 2.81 76 TR_Symld_Words 13542 2.50 1.70 2.72 77 US_DOLLARS_3 13397 2.61 2.34 2.69 78 TO_MALFORMED 13137 2.06 0.04 2.64 79 RCVD_IN_IADB_OPTIN 12776 2.15 0.69 2.57 80 MIME_HTML_MOSTLY 11796 3.05 5.45 2.37 81 HTML_MIME_NO_HTML_TAG 11628 2.48 2.98 2.34 82 HTML_IMAGE_RATIO_08 10605 2.21 2.51 2.13 83 MAILING_LIST_MULTI 10194 1.88 1.30 2.05 84 BAYES_05 10031 1.79 1.00 2.02 85 RCVD_IN_MSPIKE_WL 9396 1.66 0.85 1.89 86 RCVD_IN_MSPIKE_H3 9369 1.65 0.85 1.88 87 XM_DIRTYINTL 9321 2.39 4.22 1.87 88 SUBJ_ALL_CAPS 9284 2.02 2.56 1.87 89 TM2_M_URI_OPT_OUT 8736 2.28 4.12 1.76 90 TooManyTo_002 8644 1.54 0.87 1.74 91 XM_DK_Undo_01 8344 1.54 1.08 1.68 92 BAYES_95 8314 2.17 3.94 1.67 93 URI_HEX 7904 2.10 3.90 1.59 94 MIME_HTML_ONLY_MULTI 7800 2.21 4.46 1.57 95 XM_SPF_SoftFail 7694 1.99 3.54 1.55 96 XM_CamelCaseFrm001 7642 1.97 3.50 1.54 97 BOTNET 7622 4.34 14.20 1.53 98 IN_HORDE_ADDRESS_BOOK 7563 1.20 0.07 1.52 99 HELO_NODOT 7382 1.25 0.41 1.48 100 T_XMDrugObfuBody_08 7368 1.93 3.52 1.48 101 INVALID_MSGID 7287 1.17 0.12 1.46 102 T_TooManySym_02 7159 1.37 1.12 1.44 103 XM_OfRef6 7002 1.70 2.71 1.41 104 RELAYCOUNTRY_CA 6948 1.86 3.47 1.40 105 UNTRUSTED_Relay 6580 3.51 11.18 1.32 106 XMDiploma_00 6573 1.68 2.94 1.32 107 TR_MetaPhish_Combo_01 6348 1.11 0.54 1.28 108 URI_TRY_3LD 5993 1.20 1.19 1.20 109 TooManyTo_003 5840 1.07 0.70 1.17 110 XM_GoogleGroups 5823 1.02 0.49 1.17 111 XMCapTrack 5703 0.95 0.26 1.15 112 XMStockSpam_06 5693 1.27 1.70 1.14 113 USER_IN_DEF_DKIM_WL 5563 0.89 0.07 1.12 114 XM_H_PHPOS 5513 1.24 1.69 1.11 115 DKIM_ADSP_NXDOMAIN 5236 0.89 0.32 1.05 116 XMSexyCombo_01 5199 1.37 2.51 1.04 117 XMSubMetaI_00 5187 1.30 2.22 1.04 118 XMPhish11 5173 1.14 1.50 1.04 119 XMGappySubj_01 4952 0.88 0.47 1.00 120 XMBdyGiftCard01 4884 1.12 1.61 0.98 121 RELAYCOUNTRY_GB 4811 1.02 1.22 0.97 122 DKIM_ADSP_CUSTOM_MED 4809 0.96 0.93 0.97 123 XMSubMetaSxObfu_03 4779 1.06 1.42 0.96 124 TM2_M_VERY_LONG_WORD 4630 1.38 2.96 0.93 125 TooManyTo_004 4327 0.79 0.50 0.87 126 XM_H_Long_From02 4251 0.95 1.29 0.85 127 XMGenDplmaNmb 4036 1.06 1.91 0.81 128 T_XMDrugObfuBody_00 3817 0.85 1.13 0.77 129 SpammyFromTLD_01 3771 1.04 2.03 0.76 130 XM_UB50 3580 1.93 6.19 0.72 131 TooManyTo_005 3495 0.65 0.45 0.70 132 TM2_M_A_HREF_HREF 3322 0.71 0.88 0.67 133 LOW_PRICE 3264 0.67 0.73 0.66 134 NML_ADSP_CUSTOM_MED 3254 0.70 0.86 0.65 135 T_FILL_THIS_FORM_SHORT 3200 0.70 0.91 0.64 136 TR_XM_RelayPhish 3178 0.80 1.39 0.64 137 FROM_GOV_SPOOF 3034 0.53 0.25 0.61 138 T_XMHurry_00 2912 0.72 1.17 0.59 139 XM_ProductURIs 2873 0.70 1.12 0.58 140 FILL_THIS_FORM 2867 0.60 0.66 0.58 141 T_OBFU_PDF_ATTACH 2811 0.48 0.17 0.56 142 XMHTMLBadTable_001 2802 0.70 1.19 0.56 143 T_Symld_Words_02 2784 0.60 0.74 0.56 144 XM_H_PHPMailer 2741 0.56 0.60 0.55 145 XMSubMetaSxObfu_02 2659 0.50 0.36 0.53 146 XMNoVowels 2620 0.52 0.48 0.53 147 XMLngstWrd_00 2594 0.66 1.17 0.52 148 USER_IN_WHITELIST 2584 0.40 0.00 0.52 149 HTML_FONT_FACE_BAD 2555 0.61 0.96 0.51 150 RCVD_IN_BL_SPAMCOP_NET 2546 0.96 2.54 0.51 151 XMSexyCombo_04 2531 0.59 0.87 0.51 152 XMBrknScrpt_02 2515 0.55 0.73 0.51 153 XM_B_REG_HTML 2507 0.55 0.72 0.50 154 XMBody_17 2502 0.87 2.17 0.50 155 T_FILL_THIS_FORM_LONG 2494 0.43 0.18 0.50 156 HTTPS_HTTP_MISMATCH 2489 0.57 0.84 0.50 157 FORGED_GMAIL_RCVD 2478 0.57 0.81 0.50 158 SpammyFromTLD_02 2455 1.09 3.20 0.49 159 XMGappySubj_02 2437 0.39 0.05 0.49 160 XMLngstWrd_01 2416 0.63 1.15 0.49 161 T_TooManySym_03 2329 0.40 0.16 0.47 162 URI_NOVOWEL 2286 0.52 0.71 0.46 163 PLING_QUERY 2282 0.52 0.75 0.46 164 RELAYCOUNTRY_AU 2259 0.53 0.78 0.45 165 T_FILL_THIS_FORM_LOAN 2257 0.46 0.48 0.45 166 XMBody_95 2227 0.38 0.15 0.45 167 XMHTML_After_End 2226 0.59 1.10 0.45 168 URI_WP_HACKED_2 2217 0.52 0.76 0.45 169 HTML_TAG_BALANCE_BODY 2191 0.55 0.92 0.44 170 RDNS_DYNAMIC 2154 0.57 1.07 0.43 171 XM_RXBody 2145 0.56 1.01 0.43 172 T_MANY_PILL_PRICE 2136 0.35 0.05 0.43 173 MISSING_HEADERS 2093 0.42 0.41 0.42 174 XM_B_COPY_HTML 2012 0.55 1.05 0.40 175 SHORT_HELO_AND_INLINE_IMAGE 2009 0.33 0.08 0.40 176 T_FROM_GOV_DKIM_AU 1934 0.33 0.12 0.39 177 XM_D_tchamptons_WL 1918 0.30 0.00 0.39 178 XMBody_78 1903 0.56 1.17 0.38 179 TM2_M_BODY_EMPTY 1897 0.32 0.10 0.38 180 HTML_IMAGE_ONLY_32 1851 0.33 0.20 0.37 181 XM_ShortIntro_01 1834 0.40 0.51 0.37 182 RCVD_IN_SORBS_DUL 1827 0.33 0.21 0.37 183 TR_LOTS_OF_MONEY3 1819 0.40 0.53 0.37 184 XMPhish14 1803 0.51 1.02 0.36 185 XMSlimDrugH 1797 0.52 1.07 0.36 186 XMMoneyMeta_00 1771 0.54 1.18 0.36 187 XMPhish30 1760 0.58 1.35 0.35 188 XM_URI_RBL 1754 0.91 2.86 0.35 189 HTML_IMAGE_ONLY_28 1734 0.40 0.57 0.35 190 XMDateMe_00 1710 0.33 0.27 0.34 191 NO_DNS_FOR_FROM 1692 0.39 0.56 0.34 192 IMPOTENCE 1683 0.41 0.65 0.34 193 RELAYCOUNTRY_AT 1670 0.52 1.17 0.34 194 SUBJ_DOLLARS 1559 0.49 1.09 0.31 195 UPPERCASE_50_75 1540 0.25 0.06 0.31 196 AC_DIV_BONANZA 1513 0.25 0.08 0.30 197 DIET_1 1485 0.49 1.15 0.30 198 XM_Body_Obfu01 1484 0.48 1.10 0.30 199 XMSubNoVowel 1445 0.36 0.62 0.29 200 XM_H_PHPOS_M 1444 0.30 0.35 0.29 ----------------------------------------------------------------------