Email: 683091 Autolearn: 0 AvgScore: 1.94 AvgScanTime: 3.71 sec Spam: 152410 Autolearn: 0 AvgScore: 12.18 AvgScanTime: 4.10 sec Ham: 530681 Autolearn: 0 AvgScore: -1.01 AvgScanTime: 3.60 sec Time Spent Running SA: 704.11 hours Time Spent Processing Spam: 173.41 hours Time Spent Processing Ham: 530.70 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137579 88.54 90.27 88.04 2 DCC_CHECK 112744 48.69 73.97 41.42 3 DKIM_SIGNED 107852 72.27 70.76 72.71 4 XM_DK_Pass 104928 70.71 68.85 71.25 5 DKIM_VALID 96498 66.05 63.31 66.83 6 XMListUnsubscribeExists 89062 51.84 58.44 49.95 7 DKIM_VALID_AU 74034 48.23 48.58 48.13 8 BAYES_50 71862 54.91 47.15 57.13 9 XM_H_QuotedFrom 70487 40.97 46.25 39.45 10 MIME_HTML_ONLY 54484 24.20 35.75 20.89 11 HTML_FONT_LOW_CONTRAST 47886 28.26 31.42 27.35 12 XM_DK_Undo_02 45786 11.98 30.04 6.79 13 LOC_TINY_FONT_1 43775 22.86 28.72 21.18 14 XMSubLong 43609 22.66 28.61 20.96 15 RELAYCOUNTRY_META 43239 11.81 28.37 7.06 16 BAYES_99 38151 9.56 25.03 5.12 17 FVGT_m_MULTI_ODD 37899 21.74 24.87 20.84 18 DCC_CHECK_NEGATIVE 37233 49.36 24.43 56.52 19 UNTRUSTED_Relay 32258 6.75 21.17 2.61 20 TR_DCC_Bayes_99 31211 6.83 20.48 2.91 21 BAYES_999 30855 7.81 20.24 4.24 22 BOTNET_IPINHOSTNAME 30491 8.22 20.01 4.84 23 DKIM_VALID_EF 29593 24.36 19.42 25.77 24 T_TM2_M_HEADER_IN_MSG 28734 28.60 18.85 31.40 25 XM_Body_Dirty_Words 25520 13.44 16.74 12.49 26 FSL_BULK_SIG 25148 8.43 16.50 6.11 27 T_KAM_HTML_FONT_INVALID 24654 16.11 16.18 16.09 28 XM_UncommonTLD01 24409 6.33 16.02 3.55 29 MultiRelay 24253 17.28 15.91 17.67 30 BOTNET 22599 4.77 14.83 1.88 31 LOTS_OF_MONEY 21191 10.39 13.90 9.39 32 FROM_EXCESS_BASE64 20419 6.87 13.40 5.00 33 XM_Multi_Part_URI 19493 11.50 12.79 11.13 34 HTML_MIME_NO_HTML_TAG 18496 5.96 12.14 4.18 35 T_REMOTE_IMAGE 17930 6.59 11.76 5.11 36 XM_Evil_Numbers_Gen 17877 8.98 11.73 8.19 37 HTML_IMAGE_RATIO_02 16474 8.80 10.81 8.22 38 XM_UB50 15817 3.38 10.38 1.37 39 XMSubMetaSx_00 15075 5.07 9.89 3.69 40 BODY_URI_ONLY 14715 3.19 9.65 1.33 41 BAYES_60 14218 5.79 9.33 4.77 42 XMSexyCombo_05 14089 4.85 9.24 3.59 43 MISSING_HEADERS 13633 3.24 8.94 1.60 44 MIME_HEADER_CTYPE_ONLY 13462 2.98 8.83 1.30 45 RELAYCOUNTRY_FR 13105 2.82 8.60 1.16 46 XMNumbers 12911 5.25 8.47 4.32 47 XM_H_Long_From01 12344 6.49 8.10 6.02 48 T_XMDrugObfuBody_14 11964 7.41 7.85 7.29 49 DKIM_INVALID 11354 6.22 7.45 5.87 50 BAYES_80 10618 3.65 6.97 2.69 51 TooManyTo_001 10464 7.77 6.87 8.03 52 MPART_ALT_DIFF 10091 3.88 6.62 3.09 53 HTML_IMAGE_RATIO_04 10057 5.81 6.60 5.59 54 XM_B_Phish_Phrases 8976 6.26 5.89 6.37 55 XM_SPF_SoftFail 8631 3.17 5.66 2.45 56 HTML_SHORT_LINK_IMG_1 7462 1.33 4.90 0.30 57 T_HTML_TAG_BALANCE_CENTER 7278 1.87 4.78 1.03 58 MultiRelay_Combo 7178 1.25 4.71 0.25 59 MultiRelay_CC 7178 1.25 4.71 0.25 60 NORMAL_HTTP_TO_IP 7167 1.84 4.70 1.01 61 XM_DIRTYINTL 7052 2.47 4.63 1.86 62 HTML_IMAGE_ONLY_16 6964 1.93 4.57 1.17 63 XM_UB60 6942 1.12 4.55 0.14 64 XMStrtUSub 6875 4.45 4.51 4.44 65 LotsOfNums_01 6769 7.46 4.44 8.33 66 HTML_IMAGE_RATIO_06 6705 3.61 4.40 3.38 67 HTML_SHORT_LINK_IMG_2 6643 1.74 4.36 0.99 68 XM_salutation2 6544 1.59 4.29 0.82 69 XM_OfRef6 6264 2.06 4.11 1.48 70 XM_H_PHPOS 5758 2.67 3.78 2.35 71 HTML_IMAGE_ONLY_04 5746 1.02 3.77 0.23 72 MIME_HTML_ONLY_MULTI 5739 2.03 3.77 1.53 73 SpammyFromTLD_02 5693 1.07 3.74 0.31 74 RCVD_IN_RP_RNBL 5681 0.86 3.73 0.04 75 XM_H_PHPMailer 5562 1.67 3.65 1.11 76 TM2_M_URI_OPT_OUT 5476 2.50 3.59 2.18 77 XM_CamelCaseFrm001 5113 2.20 3.35 1.86 78 MIME_QP_LONG_LINE 4917 5.08 3.23 5.61 79 BAYES_95 4855 2.04 3.19 1.71 80 FROM_SUSPICIOUS_NTLD 4811 0.78 3.16 0.10 81 HTML_SHORT_CENTER 4765 0.73 3.13 0.04 82 MIME_HTML_MOSTLY 4646 2.71 3.05 2.61 83 SpammyFromTLD_01 4482 1.24 2.94 0.75 84 RCVD_IN_MSPIKE_H2 4437 3.83 2.91 4.10 85 RELAYCOUNTRY_CA 4417 2.00 2.90 1.74 86 XM_H_Long_From02 4231 1.36 2.78 0.96 87 URI_HEX 4231 2.02 2.78 1.80 88 RELAYCOUNTRY_GB 4213 1.73 2.76 1.44 89 XMSexyCombo_01 4174 0.94 2.74 0.43 90 HTML_IMAGE_RATIO_08 4171 2.18 2.74 2.01 91 T_TooManySym_01 4141 4.49 2.72 4.99 92 XMSubMetaI_00 4000 1.10 2.62 0.66 93 XM_URI_RBL 3936 0.87 2.58 0.37 94 T_XMDrugObfuBody_08 3920 2.06 2.57 1.91 95 RCVD_IN_BL_SPAMCOP_NET 3830 0.80 2.51 0.31 96 XM_SendGrid 3793 4.81 2.49 5.47 97 BAYES_40 3790 4.22 2.49 4.71 98 DIET_1 3627 0.84 2.38 0.40 99 URIBL_DBL_SPAM 3617 0.57 2.37 0.05 100 BAYES_20 3566 3.25 2.34 3.51 101 BOTNET_NORDNS 3509 0.54 2.30 0.04 102 XMPhish11 3502 1.47 2.30 1.23 103 XMBdyGiftCard01 3409 1.10 2.24 0.77 104 RELAYCOUNTRY_CN 3404 0.55 2.23 0.06 105 NORDNS_LOW_CONTRAST 3301 0.49 2.17 0.01 106 XMDiploma_00 3202 1.94 2.10 1.89 107 XM_UB80 3132 0.50 2.05 0.06 108 XM_H_PHPOS_M 3095 0.92 2.03 0.61 109 BAYES_00 3052 14.33 2.00 17.86 110 XMStockSpam_06 2965 1.46 1.95 1.32 111 RELAYCOUNTRY_DE 2949 0.93 1.93 0.64 112 XMSlimDrugH 2811 0.64 1.84 0.30 113 XMMoneyMeta_00 2805 0.94 1.84 0.68 114 DKIM_ADSP_CUSTOM_MED 2739 1.13 1.80 0.93 115 MAILING_LIST_MULTI 2717 2.74 1.78 3.01 116 FILL_THIS_FORM 2707 0.67 1.78 0.35 117 TR_Symld_Words 2700 1.73 1.77 1.72 118 UNPARSEABLE_RELAY 2654 2.30 1.74 2.46 119 FILL_THIS_FORM_LONG 2621 0.60 1.72 0.28 120 NML_ADSP_CUSTOM_MED 2521 0.88 1.65 0.65 121 MONEY_FORM 2490 0.37 1.63 0.01 122 XM_UB99 2468 0.37 1.62 0.01 123 T_MONEY_PERCENT 2413 0.63 1.58 0.36 124 TR_LOTS_OF_MONEY2 2413 0.63 1.58 0.36 125 XMBody_17 2411 0.89 1.58 0.69 126 ADVANCE_FEE_5_NEW_FRM_MNY 2396 0.35 1.57 0.00 127 TR_XM_DK_Bayes 2390 10.98 1.57 13.68 128 TM2_M_VERY_LONG_WORD 2386 1.00 1.57 0.84 129 RCVD_IN_RP_SAFE 2363 7.02 1.55 8.59 130 XM_OfRef7 2355 0.50 1.55 0.19 131 XMGenDplmaNmb 2345 1.36 1.54 1.31 132 TVD_SPACE_RATIO_MINFP 2312 0.35 1.52 0.02 133 URI_TRY_3LD 2279 1.43 1.50 1.41 134 XMSubMetaSxObfu_03 2186 0.65 1.43 0.42 135 T_Symld_Words_02 2181 1.11 1.43 1.02 136 BAYES_05 2143 2.21 1.41 2.44 137 TR_XM_DK_Bayes1 2139 10.26 1.40 12.81 138 XMSexyCombo_04 2137 0.38 1.40 0.08 139 BODY_ENHANCEMENT 2111 0.35 1.39 0.06 140 T_XMDrugObfuBody_00 2109 0.89 1.38 0.75 141 SUBJ_ALL_CAPS 2086 1.66 1.37 1.75 142 FILL_THIS_FORM_LOAN 2063 0.52 1.35 0.27 143 URIBL_BLACK 2052 0.36 1.35 0.08 144 RELAYCOUNTRY_IN 2049 0.38 1.34 0.10 145 XM_DK_Undo_01 1957 1.59 1.28 1.68 146 TR_XM_DK_Bayes2 1950 8.55 1.28 10.64 147 TR_LOTS_OF_MONEY1 1939 0.30 1.27 0.02 148 URIBL_ABUSE_SURBL 1938 0.33 1.27 0.06 149 FORGED_GMAIL_RCVD 1921 0.67 1.26 0.50 150 T_XMHurry_00 1903 0.77 1.25 0.64 151 TR_XM_RelayPhish 1842 0.71 1.21 0.57 152 HK_RANDOM_FROM 1806 0.44 1.18 0.22 153 SHORTENER_SHORT_IMG 1785 0.26 1.17 0.00 154 RCVD_IN_IADB_LISTED 1771 4.22 1.16 5.09 155 XMSubNoVowel 1745 0.52 1.14 0.34 156 XMSubMetaSSx_00 1735 0.41 1.14 0.20 157 DATE_IN_PAST_06_12 1703 0.29 1.12 0.05 158 XMSubMetaI_01 1697 0.27 1.11 0.03 159 PLING_QUERY 1633 0.56 1.07 0.42 160 RELAYCOUNTRY_AT 1632 0.42 1.07 0.23 161 XMBody_78 1623 0.58 1.06 0.44 162 RCVD_IN_RP_CERTIFIED 1606 6.08 1.05 7.52 163 MONEY_FRAUD_8 1606 0.24 1.05 0.00 164 XMHTML_After_End 1586 0.59 1.04 0.46 165 XM_ShortIntro_01 1570 0.56 1.03 0.42 166 XM_UB999 1568 0.23 1.03 0.00 167 ALL_TRUSTED 1567 13.50 1.03 17.08 168 TR_Mismatch_TLD_02 1560 0.28 1.02 0.07 169 RELAYCOUNTRY_PL 1534 0.25 1.01 0.04 170 RCVD_IN_IADB_SPF 1517 3.71 1.00 4.49 171 FSL_THIS_IS_ADV 1499 0.24 0.98 0.03 172 XM_XX_Yahoo 1482 0.25 0.97 0.05 173 TooManyTo_002 1478 1.69 0.97 1.90 174 T_FILL_THIS_FORM_SHORT 1470 1.16 0.96 1.22 175 RCVD_IN_IADB_SENDERID 1458 3.29 0.96 3.95 176 XM_ProductURIs 1453 1.03 0.95 1.05 177 RCVD_IN_IADB_DK 1445 3.25 0.95 3.91 178 XMPhish30 1435 0.57 0.94 0.46 179 HTML_OFF_PAGE 1409 0.21 0.92 0.00 180 T_TooManySym_02 1403 1.70 0.92 1.93 181 LONG_JUNK_URI 1401 0.26 0.92 0.08 182 REPLYTO_WITHOUT_TO_CC 1389 0.23 0.91 0.04 183 DKIM_ADSP_NXDOMAIN 1382 0.69 0.91 0.63 184 HTML_IMAGE_ONLY_08 1371 0.35 0.90 0.19 185 SUBJ_DOLLARS 1369 0.71 0.90 0.66 186 XM_RXBody 1356 0.35 0.89 0.19 187 TR_LOTS_OF_MONEY3 1342 0.69 0.88 0.64 188 TR_MetaPhish_Combo_01 1329 1.42 0.87 1.58 189 HTML_FONT_FACE_BAD 1310 0.64 0.86 0.57 190 TooManyTo_003 1309 1.17 0.86 1.26 191 RDNS_DYNAMIC 1303 0.52 0.85 0.43 192 MONEY_FRAUD_5 1275 0.19 0.84 0.00 193 ANY_BOUNCE_MESSAGE 1231 2.19 0.81 2.59 194 RELAYCOUNTRY_NL 1230 0.33 0.81 0.19 195 BOUNCE_MESSAGE 1226 2.19 0.80 2.59 196 MPART_ALT_DIFF_COUNT 1190 0.33 0.78 0.20 197 XM_UB95 1165 0.20 0.76 0.04 198 TooManyTo_004 1164 0.86 0.76 0.89 199 DATE_IN_PAST_03_06 1162 0.23 0.76 0.08 200 RELAYCOUNTRY_AU 1147 0.54 0.75 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 467223 88.54 90.27 88.04 2 DKIM_SIGNED 385841 72.27 70.76 72.71 3 XM_DK_Pass 378108 70.71 68.85 71.25 4 DKIM_VALID 354679 66.05 63.31 66.83 5 BAYES_50 303199 54.91 47.15 57.13 6 DCC_CHECK_NEGATIVE 299964 49.36 24.43 56.52 7 XMListUnsubscribeExists 265062 51.84 58.44 49.95 8 DKIM_VALID_AU 255411 48.23 48.58 48.13 9 DCC_CHECK 219832 48.69 73.97 41.42 10 XM_H_QuotedFrom 209350 40.97 46.25 39.45 11 T_TM2_M_HEADER_IN_MSG 166632 28.60 18.85 31.40 12 HTML_FONT_LOW_CONTRAST 145165 28.26 31.42 27.35 13 DKIM_VALID_EF 136779 24.36 19.42 25.77 14 LOC_TINY_FONT_1 112398 22.86 28.72 21.18 15 XMSubLong 111211 22.66 28.61 20.96 16 MIME_HTML_ONLY 110835 24.20 35.75 20.89 17 FVGT_m_MULTI_ODD 110573 21.74 24.87 20.84 18 BAYES_00 94804 14.33 2.00 17.86 19 MultiRelay 93779 17.28 15.91 17.67 20 ALL_TRUSTED 90636 13.50 1.03 17.08 21 T_KAM_HTML_FONT_INVALID 85401 16.11 16.18 16.09 22 TR_XM_DK_Bayes 72609 10.98 1.57 13.68 23 TR_XM_DK_Bayes1 67963 10.26 1.40 12.81 24 XM_Body_Dirty_Words 66266 13.44 16.74 12.49 25 XM_Multi_Part_URI 59086 11.50 12.79 11.13 26 XM_DKIMWhitelistDomains 58693 8.60 0.02 11.06 27 TR_XM_DK_Bayes2 56438 8.55 1.28 10.64 28 LOTS_OF_MONEY 49809 10.39 13.90 9.39 29 RCVD_IN_RP_SAFE 45581 7.02 1.55 8.59 30 LotsOfNums_01 44197 7.46 4.44 8.33 31 HTML_IMAGE_RATIO_02 43616 8.80 10.81 8.22 32 XM_Evil_Numbers_Gen 43472 8.98 11.73 8.19 33 TooManyTo_001 42630 7.77 6.87 8.03 34 RCVD_IN_RP_CERTIFIED 39898 6.08 1.05 7.52 35 T_XMDrugObfuBody_14 38669 7.41 7.85 7.29 36 RELAYCOUNTRY_META 37452 11.81 28.37 7.06 37 XM_DK_Undo_02 36048 11.98 30.04 6.79 38 XM_B_Phish_Phrases 33800 6.26 5.89 6.37 39 FSL_BULK_SIG 32437 8.43 16.50 6.11 40 XM_H_Long_From01 31962 6.49 8.10 6.02 41 DKIM_INVALID 31162 6.22 7.45 5.87 42 MIME_QP_LONG_LINE 29775 5.08 3.23 5.61 43 HTML_IMAGE_RATIO_04 29641 5.81 6.60 5.59 44 XM_SendGrid 29053 4.81 2.49 5.47 45 BAYES_99 27155 9.56 25.03 5.12 46 T_REMOTE_IMAGE 27100 6.59 11.76 5.11 47 RCVD_IN_IADB_LISTED 27032 4.22 1.16 5.09 48 FROM_EXCESS_BASE64 26543 6.87 13.40 5.00 49 T_TooManySym_01 26496 4.49 2.72 4.99 50 BOTNET_IPINHOSTNAME 25676 8.22 20.01 4.84 51 BAYES_60 25327 5.79 9.33 4.77 52 BAYES_40 25015 4.22 2.49 4.71 53 RCVD_IN_IADB_SPF 23822 3.71 1.00 4.49 54 XMStrtUSub 23544 4.45 4.51 4.44 55 XM_PDF 23348 3.57 0.67 4.40 56 XMNumbers 22932 5.25 8.47 4.32 57 BAYES_999 22500 7.81 20.24 4.24 58 HTML_MIME_NO_HTML_TAG 22201 5.96 12.14 4.18 59 RCVD_IN_MSPIKE_H2 21756 3.83 2.91 4.10 60 RCVD_IN_IADB_SENDERID 20983 3.29 0.96 3.95 61 RCVD_IN_IADB_DK 20775 3.25 0.95 3.91 62 XMSubMetaSx_00 19565 5.07 9.89 3.69 63 IN_ZIMBRA_NJ_WHITELIST 19512 2.86 0.02 3.68 64 XMSexyCombo_05 19034 4.85 9.24 3.59 65 XM_UncommonTLD01 18824 6.33 16.02 3.55 66 BAYES_20 18620 3.25 2.34 3.51 67 HTML_IMAGE_RATIO_06 17957 3.61 4.40 3.38 68 RCVD_IN_IADB_VOUCHED 16733 2.61 0.73 3.15 69 MPART_ALT_DIFF 16420 3.88 6.62 3.09 70 MAILING_LIST_MULTI 15973 2.74 1.78 3.01 71 TR_DCC_Bayes_99 15436 6.83 20.48 2.91 72 BAYES_80 14283 3.65 6.97 2.69 73 MIME_HTML_MOSTLY 13856 2.71 3.05 2.61 74 UNTRUSTED_Relay 13827 6.75 21.17 2.61 75 ANY_BOUNCE_MESSAGE 13721 2.19 0.81 2.59 76 BOUNCE_MESSAGE 13719 2.19 0.80 2.59 77 UNPARSEABLE_RELAY 13031 2.30 1.74 2.46 78 XM_SPF_SoftFail 12997 3.17 5.66 2.45 79 BAYES_05 12946 2.21 1.41 2.44 80 XM_H_PHPOS 12460 2.67 3.78 2.35 81 TVD_RCVD_IP 11890 1.79 0.21 2.24 82 TM2_M_URI_OPT_OUT 11573 2.50 3.59 2.18 83 TO_MALFORMED 11243 1.66 0.05 2.12 84 HTML_IMAGE_RATIO_08 10693 2.18 2.74 2.01 85 RCVD_IN_IADB_OPTIN 10620 1.69 0.61 2.00 86 T_TooManySym_02 10238 1.70 0.92 1.93 87 T_XMDrugObfuBody_08 10140 2.06 2.57 1.91 88 TooManyTo_002 10085 1.69 0.97 1.90 89 XMDiploma_00 10048 1.94 2.10 1.89 90 BOTNET 9972 4.77 14.83 1.88 91 XM_CamelCaseFrm001 9883 2.20 3.35 1.86 92 XM_DIRTYINTL 9845 2.47 4.63 1.86 93 URI_HEX 9544 2.02 2.78 1.80 94 SUBJ_ALL_CAPS 9285 1.66 1.37 1.75 95 RELAYCOUNTRY_CA 9243 2.00 2.90 1.74 96 TR_Symld_Words 9151 1.73 1.77 1.72 97 BAYES_95 9082 2.04 3.19 1.71 98 RCVD_IN_MSPIKE_WL 8950 1.41 0.43 1.69 99 RCVD_IN_MSPIKE_H3 8935 1.40 0.43 1.68 100 XM_DK_Undo_01 8899 1.59 1.28 1.68 101 HELO_NODOT 8830 1.41 0.51 1.66 102 MISSING_HEADERS 8484 3.24 8.94 1.60 103 TR_MetaPhish_Combo_01 8384 1.42 0.87 1.58 104 MIME_HTML_ONLY_MULTI 8118 2.03 3.77 1.53 105 IN_HORDE_ADDRESS_BOOK 7961 1.17 0.03 1.50 106 XM_OfRef6 7828 2.06 4.11 1.48 107 RELAYCOUNTRY_GB 7617 1.73 2.76 1.44 108 URI_TRY_3LD 7507 1.43 1.50 1.41 109 XM_UB50 7253 3.38 10.38 1.37 110 INVALID_MSGID 7194 1.07 0.10 1.36 111 BODY_URI_ONLY 7082 3.19 9.65 1.33 112 XMStockSpam_06 6996 1.46 1.95 1.32 113 XMGenDplmaNmb 6931 1.36 1.54 1.31 114 MIME_HEADER_CTYPE_ONLY 6891 2.98 8.83 1.30 115 XMCapTrack 6797 1.06 0.29 1.28 116 TooManyTo_003 6711 1.17 0.86 1.26 117 XMPhish11 6535 1.47 2.30 1.23 118 T_FILL_THIS_FORM_SHORT 6453 1.16 0.96 1.22 119 HTML_IMAGE_ONLY_16 6197 1.93 4.57 1.17 120 RELAYCOUNTRY_FR 6176 2.82 8.60 1.16 121 XM_H_PHPMailer 5874 1.67 3.65 1.11 122 XM_GoogleGroups 5838 0.94 0.38 1.10 123 USER_IN_DEF_DKIM_WL 5741 0.87 0.12 1.08 124 XM_ProductURIs 5564 1.03 0.95 1.05 125 T_HTML_TAG_BALANCE_CENTER 5468 1.87 4.78 1.03 126 T_Symld_Words_02 5414 1.11 1.43 1.02 127 NORMAL_HTTP_TO_IP 5385 1.84 4.70 1.01 128 HTML_SHORT_LINK_IMG_2 5232 1.74 4.36 0.99 129 XM_H_Long_From02 5076 1.36 2.78 0.96 130 DKIM_ADSP_CUSTOM_MED 4959 1.13 1.80 0.93 131 TooManyTo_004 4712 0.86 0.76 0.89 132 TM2_M_VERY_LONG_WORD 4450 1.00 1.57 0.84 133 XM_salutation2 4342 1.59 4.29 0.82 134 XMBdyGiftCard01 4093 1.10 2.24 0.77 135 SpammyFromTLD_01 3988 1.24 2.94 0.75 136 T_XMDrugObfuBody_00 3964 0.89 1.38 0.75 137 TooManyTo_005 3955 0.74 0.71 0.75 138 T_TooManySym_03 3783 0.60 0.23 0.71 139 TM2_M_A_HREF_HREF 3682 0.68 0.63 0.69 140 XMBody_17 3668 0.89 1.58 0.69 141 XMMoneyMeta_00 3611 0.94 1.84 0.68 142 XMSubMetaI_00 3514 1.10 2.62 0.66 143 XMBody_95 3494 0.56 0.22 0.66 144 SUBJ_DOLLARS 3480 0.71 0.90 0.66 145 NML_ADSP_CUSTOM_MED 3462 0.88 1.65 0.65 146 T_OBFU_PDF_ATTACH 3442 0.54 0.17 0.65 147 RELAYCOUNTRY_DE 3413 0.93 1.93 0.64 148 XMSolicitRefs_0 3400 0.58 0.38 0.64 149 TR_LOTS_OF_MONEY3 3390 0.69 0.88 0.64 150 T_XMHurry_00 3374 0.77 1.25 0.64 151 XM_B_REG_HTML 3348 0.62 0.60 0.63 152 DKIM_ADSP_NXDOMAIN 3336 0.69 0.91 0.63 153 HTML_TAG_BALANCE_BODY 3294 0.60 0.52 0.62 154 LOW_PRICE 3234 0.59 0.51 0.61 155 XM_H_PHPOS_M 3212 0.92 2.03 0.61 156 XMNoVowels 3205 0.58 0.50 0.60 157 XMBrknScrpt_02 3164 0.60 0.62 0.60 158 HTML_FONT_FACE_BAD 3045 0.64 0.86 0.57 159 XMPhish14 3008 0.60 0.73 0.57 160 TR_XM_RelayPhish 2999 0.71 1.21 0.57 161 FROM_GOV_SPOOF 2977 0.50 0.30 0.56 162 USER_IN_WHITELIST 2953 0.43 0.00 0.56 163 XMLngstWrd_00 2916 0.51 0.36 0.55 164 HTTPS_HTTP_MISMATCH 2913 0.56 0.60 0.55 165 URI_NOVOWEL 2815 0.54 0.55 0.53 166 XMLngstWrd_01 2688 0.47 0.34 0.51 167 FORGED_GMAIL_RCVD 2634 0.67 1.26 0.50 168 RELAYCOUNTRY_AU 2565 0.54 0.75 0.48 169 REMOVE_BEFORE_LINK 2507 0.45 0.36 0.47 170 XMHTML_After_End 2452 0.59 1.04 0.46 171 AC_DIV_BONANZA 2440 0.40 0.20 0.46 172 XMPhish30 2426 0.57 0.94 0.46 173 XMGappySubj_01 2389 0.41 0.26 0.45 174 XMBody_78 2315 0.58 1.06 0.44 175 FROM_GOV_DKIM_AU 2289 0.36 0.10 0.43 176 RDNS_DYNAMIC 2268 0.52 0.85 0.43 177 SHORT_HELO_AND_INLINE_IMAGE 2265 0.34 0.02 0.43 178 XMHTMLBadTable_001 2258 0.44 0.51 0.43 179 XMSexyCombo_01 2257 0.94 2.74 0.43 180 XM_ShortIntro_01 2250 0.56 1.03 0.42 181 XMSubMetaSxObfu_03 2249 0.65 1.43 0.42 182 PLING_QUERY 2208 0.56 1.07 0.42 183 DIET_1 2104 0.84 2.38 0.40 184 XM_B_COPY_HTML 2065 0.45 0.64 0.39 185 HTML_IMAGE_ONLY_32 2042 0.37 0.30 0.38 186 XMDateMe_00 2038 0.37 0.30 0.38 187 TM2_M_BODY_EMPTY 1988 0.37 0.34 0.37 188 XM_URI_RBL 1981 0.87 2.58 0.37 189 TR_LOTS_OF_MONEY2 1900 0.63 1.58 0.36 190 T_MONEY_PERCENT 1900 0.63 1.58 0.36 191 RCVD_IN_SORBS_DUL 1895 0.33 0.24 0.36 192 XMSubMetaSxObfu_02 1887 0.37 0.40 0.36 193 FILL_THIS_FORM 1877 0.67 1.78 0.35 194 HTML_IMAGE_ONLY_28 1813 0.40 0.62 0.34 195 XMSubNoVowel 1809 0.52 1.14 0.34 196 XM_shorewaves_Whitelist 1802 0.26 0.00 0.34 197 XM_USANA_RCVD 1777 0.26 0.00 0.33 198 HTML_IMAGE_ONLY_24 1682 0.33 0.39 0.32 199 TVD_SPACE_RATIO 1674 0.29 0.22 0.32 200 SpammyFromTLD_02 1650 1.07 3.74 0.31 ----------------------------------------------------------------------