Email: 378452 Autolearn: 0 AvgScore: 2.03 AvgScanTime: 1.85 sec Spam: 95017 Autolearn: 0 AvgScore: 12.72 AvgScanTime: 2.16 sec Ham: 283435 Autolearn: 0 AvgScore: -1.55 AvgScanTime: 1.75 sec Time Spent Running SA: 194.76 hours Time Spent Processing Spam: 57.10 hours Time Spent Processing Ham: 137.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84529 86.76 88.96 86.03 2 DKIM_SIGNED 63577 77.54 66.91 81.11 3 DCC_CHECK 62583 53.45 65.87 49.29 4 XM_DK_Pass 62116 76.01 65.37 79.58 5 DKIM_VALID 58891 72.83 61.98 76.47 6 XMListUnsubscribeExists 55018 58.48 57.90 58.68 7 DKIM_VALID_AU 49115 57.45 51.69 59.38 8 BAYES_50 38952 51.05 40.99 54.42 9 XM_H_QuotedFrom 38774 39.99 40.81 39.71 10 MIME_HTML_ONLY 36758 27.10 38.69 23.22 11 BAYES_99 34988 14.64 36.82 7.21 12 HTML_FONT_LOW_CONTRAST 32696 34.11 34.41 34.01 13 DCC_CHECK_NEGATIVE 31456 45.44 33.11 49.58 14 BAYES_999 31077 12.66 32.71 5.93 15 XM_DK_Undo_02 29650 14.83 31.20 9.35 16 LOC_TINY_FONT_1 29356 28.59 30.90 27.82 17 RELAYCOUNTRY_META 24414 9.64 25.69 4.26 18 FVGT_m_MULTI_ODD 21549 21.85 22.68 21.57 19 XMSubLong 20179 20.87 21.24 20.75 20 BOTNET 20138 6.94 21.19 2.17 21 TR_DCC_Bayes_99 19858 7.96 20.90 3.63 22 FROM_EXCESS_BASE64 18802 8.99 19.79 5.37 23 UNTRUSTED_Relay 18668 5.79 19.65 1.15 24 LOTS_OF_MONEY 16072 13.40 16.91 12.22 25 XM_Body_Dirty_Words 15765 13.42 16.59 12.36 26 HTML_MIME_NO_HTML_TAG 15747 5.29 16.57 1.51 27 DKIM_VALID_EF 15743 27.07 16.57 30.60 28 T_REMOTE_IMAGE 15701 6.64 16.52 3.33 29 T_KAM_HTML_FONT_INVALID 14516 16.52 15.28 16.93 30 XM_Multi_Part_URI 14029 14.10 14.76 13.87 31 T_TM2_M_HEADER_IN_MSG 13928 20.87 14.66 22.95 32 MISSING_HEADERS 13921 3.84 14.65 0.22 33 BODY_URI_ONLY 13696 3.66 14.41 0.05 34 MIME_HEADER_CTYPE_ONLY 13327 3.62 14.03 0.13 35 XM_JunkDunk 12154 3.21 12.79 0.00 36 BOTNET_IPINHOSTNAME 11655 7.77 12.27 6.27 37 FSL_BULK_SIG 11108 8.63 11.69 7.60 38 RELAYCOUNTRY_FR 10949 3.08 11.52 0.26 39 XM_UB99 10873 2.88 11.44 0.01 40 XM_UB999 10635 2.82 11.19 0.01 41 RCVD_IN_RP_RNBL 10572 2.91 11.13 0.15 42 HTML_IMAGE_RATIO_02 10497 11.17 11.05 11.21 43 XM_UncommonTLD01 10454 5.47 11.00 3.61 44 XM_Evil_Numbers_Gen 9698 10.01 10.21 9.94 45 MultiRelay 9430 13.70 9.92 14.96 46 T_HTML_TAG_BALANCE_CENTER 9243 2.62 9.73 0.24 47 NORMAL_HTTP_TO_IP 9186 2.47 9.67 0.06 48 HTML_IMAGE_ONLY_16 8923 2.53 9.39 0.23 49 XMNumbers 8917 4.87 9.38 3.36 50 HTML_SHORT_LINK_IMG_2 8782 2.37 9.24 0.06 51 XMSexyCombo_05 8768 5.70 9.23 4.52 52 TooManyTo_001 8364 6.20 8.80 5.33 53 BOUNCE_MESSAGE 8272 3.96 8.71 2.37 54 ANY_BOUNCE_MESSAGE 8272 3.96 8.71 2.37 55 XM_OfRef6 7894 3.49 8.31 1.88 56 HTML_IMAGE_RATIO_04 7879 6.86 8.29 6.38 57 XMSubMetaSx_00 7840 5.81 8.25 4.99 58 T_FILL_THIS_FORM_SHORT 6657 2.23 7.01 0.63 59 XM_OfRef7 6645 1.99 6.99 0.31 60 MONEY_FORM_SHORT 6315 1.68 6.65 0.02 61 T_XMDrugObfuBody_14 6251 7.54 6.58 7.86 62 BAYES_80 6125 4.38 6.45 3.69 63 HK_SCAM_N2 5973 1.60 6.29 0.02 64 XM_H_Long_From01 5717 6.14 6.02 6.19 65 BAYES_60 5694 5.63 5.99 5.51 66 XM_B_Phish_Phrases 5557 6.42 5.85 6.62 67 MPART_ALT_DIFF 5399 4.53 5.68 4.14 68 HTML_SHORT_LINK_IMG_1 4957 1.34 5.22 0.04 69 DKIM_INVALID 4686 4.71 4.93 4.64 70 FROM_SUSPICIOUS_NTLD 4608 1.30 4.85 0.11 71 HTML_IMAGE_ONLY_04 4545 1.24 4.78 0.05 72 LotsOfNums_01 4345 7.25 4.57 8.15 73 HTML_IMAGE_RATIO_08 4220 2.86 4.44 2.33 74 HTML_IMAGE_RATIO_06 4154 3.86 4.37 3.69 75 XM_UB50 4132 1.55 4.35 0.61 76 SpammyFromTLD_02 4044 1.21 4.26 0.19 77 XMStrtUSub 3966 4.64 4.17 4.79 78 XM_DIRTYINTL 3909 2.62 4.11 2.11 79 DIET_1 3603 1.38 3.79 0.57 80 MIME_HTML_MOSTLY 3254 3.37 3.42 3.35 81 MIME_HTML_ONLY_MULTI 3225 2.16 3.39 1.75 82 URI_HEX 3071 2.20 3.23 1.85 83 BAYES_95 2962 2.44 3.12 2.21 84 XM_URI_RBL 2932 1.35 3.09 0.77 85 RCVD_IN_BL_SPAMCOP_NET 2907 1.21 3.06 0.60 86 HTML_SHORT_CENTER 2900 0.77 3.05 0.01 87 RCVD_IN_RP_SAFE 2771 11.58 2.92 14.48 88 RELAYCOUNTRY_GB 2655 1.08 2.79 0.50 89 XM_SPF_SoftFail 2624 1.82 2.76 1.51 90 RELAYCOUNTRY_CA 2596 2.06 2.73 1.84 91 BOTNET_NORDNS 2485 0.66 2.62 0.01 92 XM_H_TOP 2454 0.65 2.58 0.00 93 XM_H_Long_From02 2398 1.31 2.52 0.91 94 UNPARSEABLE_RELAY 2394 3.72 2.52 4.12 95 XMPhish14 2367 1.01 2.49 0.52 96 XMBody_17 2338 1.37 2.46 1.01 97 TM2_M_URI_OPT_OUT 2338 1.87 2.46 1.67 98 XMSubMetaI_00 2306 1.57 2.43 1.28 99 XM_CamelCaseFrm001 2290 2.07 2.41 1.96 100 BAYES_40 2258 3.37 2.38 3.71 101 XMBdyGiftCard01 2216 1.64 2.33 1.41 102 MultiRelay_Combo 2183 0.65 2.30 0.10 103 MultiRelay_CC 2183 0.65 2.30 0.10 104 RELAYCOUNTRY_CN 2149 0.59 2.26 0.02 105 XMSexyCombo_01 2121 1.03 2.23 0.63 106 NORDNS_LOW_CONTRAST 2110 0.67 2.22 0.15 107 XM_XX_Yahoo 2087 0.62 2.20 0.09 108 RCVD_IN_RP_CERTIFIED 2084 10.22 2.19 12.91 109 LongTLD 2055 0.64 2.16 0.13 110 NO_DNS_FOR_FROM 2006 1.58 2.11 1.40 111 BODY_ENHANCEMENT 1916 0.59 2.02 0.12 112 T_TooManySym_01 1827 4.88 1.92 5.88 113 XM_SendGrid 1826 5.02 1.92 6.06 114 URI_TRY_3LD 1789 2.00 1.88 2.04 115 XM_PDF 1781 3.09 1.87 3.49 116 XM_UB60 1717 0.50 1.81 0.06 117 REPLYTO_WITHOUT_TO_CC 1711 0.49 1.80 0.05 118 BAYES_20 1707 2.50 1.80 2.74 119 RCVD_IN_MSPIKE_H2 1699 3.78 1.79 4.45 120 MIME_QP_LONG_LINE 1666 3.91 1.75 4.63 121 URIBL_BLACK 1623 0.50 1.71 0.09 122 TVD_SPACE_RATIO_MINFP 1601 0.43 1.68 0.01 123 T_XMDrugObfuBody_08 1570 1.55 1.65 1.51 124 XMDiploma_00 1538 1.23 1.62 1.09 125 DATE_IN_PAST_06_12 1466 0.42 1.54 0.05 126 TM2_M_VERY_LONG_WORD 1458 1.17 1.53 1.05 127 XMPhish30 1434 0.86 1.51 0.64 128 FSL_THIS_IS_ADV 1411 0.55 1.48 0.23 129 RELAYCOUNTRY_AT 1356 0.59 1.43 0.30 130 XMSexyCombo_04 1331 0.49 1.40 0.18 131 XMSlimDrugH 1303 0.68 1.37 0.44 132 XM_HighProb1 1282 0.40 1.35 0.09 133 TR_LOTS_OF_MONEY3 1270 1.15 1.34 1.09 134 HK_RANDOM_FROM 1259 0.43 1.33 0.14 135 XM_salutation2 1243 0.97 1.31 0.85 136 PLING_QUERY 1235 0.80 1.30 0.64 137 XM_RXBody 1203 0.79 1.27 0.63 138 XMStockSpam_06 1195 0.94 1.26 0.84 139 TR_Symld_Words 1191 2.72 1.25 3.21 140 SpammyFromTLD_01 1171 0.56 1.23 0.33 141 T_XMHurry_00 1160 1.08 1.22 1.03 142 T_Symld_Words_02 1159 0.65 1.22 0.45 143 BAYES_00 1154 14.09 1.21 18.41 144 XMBrknScrpt_02 1149 0.74 1.21 0.59 145 MAILING_LIST_MULTI 1147 1.51 1.21 1.62 146 XMPhish11 1108 0.95 1.17 0.87 147 XMGenDplmaNmb 1097 0.76 1.15 0.63 148 LONG_JUNK_URI 1077 0.36 1.13 0.10 149 ALL_TRUSTED 1072 10.70 1.13 13.91 150 SHORTENER_SHORT_IMG 1070 0.28 1.13 0.00 151 T_InherDCC 1053 0.28 1.11 0.00 152 SUBJ_ALL_CAPS 1028 2.97 1.08 3.61 153 BAYES_05 1016 1.66 1.07 1.86 154 NUMERIC_HTTP_ADDR 1004 0.51 1.06 0.33 155 XM_H_PHPOS 1000 1.05 1.05 1.05 156 RCVD_IN_IADB_LISTED 993 3.67 1.05 4.55 157 SUBJ_DOLLARS 991 0.61 1.04 0.47 158 XM_ProductURIs 990 1.10 1.04 1.12 159 XMReplyNow 979 0.32 1.03 0.08 160 TR_XM_RelayPhish 977 0.63 1.03 0.50 161 XMBody_78 968 0.65 1.02 0.53 162 TR_XM_DK_Bayes 955 12.54 1.01 16.40 163 DATE_IN_PAST_12_24 935 0.29 0.98 0.06 164 XMBSHREFv2 929 0.51 0.98 0.35 165 XMSubMetaSxObfu_03 916 0.60 0.96 0.48 166 T_XMDrugObfuBody_00 880 0.79 0.93 0.75 167 TR_Mismatch_TLD_02 879 0.29 0.93 0.08 168 XMSubMetaSSx_00 877 0.49 0.92 0.34 169 TR_XM_DK_Bayes1 863 12.09 0.91 15.84 170 RCVD_IN_IADB_SPF 856 3.19 0.90 3.96 171 T_MONEY_PERCENT 849 0.36 0.89 0.19 172 TR_LOTS_OF_MONEY2 849 0.36 0.89 0.19 173 THIS_AD 847 0.28 0.89 0.07 174 RCVD_IN_IADB_SENDERID 818 2.87 0.86 3.54 175 DATE_IN_PAST_03_06 816 0.26 0.86 0.06 176 TR_XM_DK_Bayes2 811 10.06 0.85 13.14 177 RCVD_IN_IADB_DK 811 2.80 0.85 3.46 178 MIME_CHARSET_FARAWAY 807 0.27 0.85 0.08 179 LONG_HEX_URI 791 0.29 0.83 0.11 180 XM_DKIMWhitelistDomains 760 10.64 0.80 13.94 181 XM_H_PHPMailer 744 0.76 0.78 0.76 182 XMHTML_After_End 744 0.49 0.78 0.39 183 HTML_FONT_FACE_BAD 699 0.68 0.74 0.67 184 URIBL_DBL_SPAM 689 0.19 0.73 0.01 185 XM_B_COPY_HTML 686 0.77 0.72 0.79 186 XMSubject_70 686 0.22 0.72 0.05 187 FVGT_m_MULTI_ODD_EMAIL 683 0.20 0.72 0.02 188 XMGappySubj_01 678 0.32 0.71 0.19 189 URI_NOVOWEL 660 0.53 0.69 0.48 190 MPART_ALT_DIFF_COUNT 655 0.36 0.69 0.25 191 XM_S_JOY_D 645 0.46 0.68 0.38 192 DKIM_ADSP_CUSTOM_MED 641 0.74 0.67 0.76 193 RCVD_IN_IADB_VOUCHED 640 2.23 0.67 2.75 194 FILL_THIS_FORM 628 0.44 0.66 0.37 195 NML_ADSP_CUSTOM_MED 620 0.54 0.65 0.50 196 TR_MetaPhish_Combo_01 610 1.63 0.64 1.96 197 XMSubNoVowel 603 0.29 0.63 0.17 198 RELAYCOUNTRY_DE 602 0.34 0.63 0.24 199 FILL_THIS_FORM_LONG 589 0.39 0.62 0.32 200 HTML_IMAGE_ONLY_12 586 0.28 0.62 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243834 86.76 88.96 86.03 2 DKIM_SIGNED 229887 77.54 66.91 81.11 3 XM_DK_Pass 225551 76.01 65.37 79.58 4 DKIM_VALID 216737 72.83 61.98 76.47 5 DKIM_VALID_AU 168302 57.45 51.69 59.38 6 XMListUnsubscribeExists 166308 58.48 57.90 58.68 7 BAYES_50 154256 51.05 40.99 54.42 8 DCC_CHECK_NEGATIVE 140527 45.44 33.11 49.58 9 DCC_CHECK 139695 53.45 65.87 49.29 10 XM_H_QuotedFrom 112561 39.99 40.81 39.71 11 HTML_FONT_LOW_CONTRAST 96409 34.11 34.41 34.01 12 DKIM_VALID_EF 86717 27.07 16.57 30.60 13 LOC_TINY_FONT_1 78844 28.59 30.90 27.82 14 MIME_HTML_ONLY 65821 27.10 38.69 23.22 15 T_TM2_M_HEADER_IN_MSG 65051 20.87 14.66 22.95 16 FVGT_m_MULTI_ODD 61147 21.85 22.68 21.57 17 XMSubLong 58808 20.87 21.24 20.75 18 BAYES_00 52171 14.09 1.21 18.41 19 T_KAM_HTML_FONT_INVALID 47995 16.52 15.28 16.93 20 TR_XM_DK_Bayes 46491 12.54 1.01 16.40 21 TR_XM_DK_Bayes1 44892 12.09 0.91 15.84 22 MultiRelay 42411 13.70 9.92 14.96 23 RCVD_IN_RP_SAFE 41039 11.58 2.92 14.48 24 XM_DKIMWhitelistDomains 39523 10.64 0.80 13.94 25 ALL_TRUSTED 39431 10.70 1.13 13.91 26 XM_Multi_Part_URI 39316 14.10 14.76 13.87 27 TR_XM_DK_Bayes2 37247 10.06 0.85 13.14 28 RCVD_IN_RP_CERTIFIED 36602 10.22 2.19 12.91 29 XM_Body_Dirty_Words 35030 13.42 16.59 12.36 30 LOTS_OF_MONEY 34623 13.40 16.91 12.22 31 HTML_IMAGE_RATIO_02 31769 11.17 11.05 11.21 32 XM_Evil_Numbers_Gen 28172 10.01 10.21 9.94 33 XM_DK_Undo_02 26491 14.83 31.20 9.35 34 LotsOfNums_01 23089 7.25 4.57 8.15 35 T_XMDrugObfuBody_14 22288 7.54 6.58 7.86 36 FSL_BULK_SIG 21550 8.63 11.69 7.60 37 BAYES_99 20435 14.64 36.82 7.21 38 XM_B_Phish_Phrases 18754 6.42 5.85 6.62 39 HTML_IMAGE_RATIO_04 18094 6.86 8.29 6.38 40 BOTNET_IPINHOSTNAME 17760 7.77 12.27 6.27 41 XM_H_Long_From01 17532 6.14 6.02 6.19 42 XM_SendGrid 17180 5.02 1.92 6.06 43 BAYES_999 16817 12.66 32.71 5.93 44 T_TooManySym_01 16658 4.88 1.92 5.88 45 BAYES_60 15626 5.63 5.99 5.51 46 FROM_EXCESS_BASE64 15230 8.99 19.79 5.37 47 TooManyTo_001 15097 6.20 8.80 5.33 48 XMSubMetaSx_00 14151 5.81 8.25 4.99 49 XMStrtUSub 13586 4.64 4.17 4.79 50 DKIM_INVALID 13150 4.71 4.93 4.64 51 MIME_QP_LONG_LINE 13127 3.91 1.75 4.63 52 RCVD_IN_IADB_LISTED 12886 3.67 1.05 4.55 53 XMSexyCombo_05 12815 5.70 9.23 4.52 54 RCVD_IN_MSPIKE_H2 12602 3.78 1.79 4.45 55 RELAYCOUNTRY_META 12079 9.64 25.69 4.26 56 MPART_ALT_DIFF 11738 4.53 5.68 4.14 57 UNPARSEABLE_RELAY 11677 3.72 2.52 4.12 58 TO_MALFORMED 11543 3.06 0.06 4.07 59 RCVD_IN_IADB_SPF 11219 3.19 0.90 3.96 60 TVD_RCVD_IP 10776 2.91 0.24 3.80 61 BAYES_40 10503 3.37 2.38 3.71 62 BAYES_80 10460 4.38 6.45 3.69 63 HTML_IMAGE_RATIO_06 10453 3.86 4.37 3.69 64 TR_DCC_Bayes_99 10285 7.96 20.90 3.63 65 XM_UncommonTLD01 10242 5.47 11.00 3.61 66 SUBJ_ALL_CAPS 10224 2.97 1.08 3.61 67 RCVD_IN_IADB_SENDERID 10031 2.87 0.86 3.54 68 XM_PDF 9896 3.09 1.87 3.49 69 IN_ZIMBRA_NJ_WHITELIST 9809 2.60 0.01 3.46 70 RCVD_IN_IADB_DK 9796 2.80 0.85 3.46 71 XMNumbers 9515 4.87 9.38 3.36 72 MIME_HTML_MOSTLY 9503 3.37 3.42 3.35 73 T_REMOTE_IMAGE 9438 6.64 16.52 3.33 74 TR_Symld_Words 9095 2.72 1.25 3.21 75 RCVD_IN_IADB_VOUCHED 7783 2.23 0.67 2.75 76 BAYES_20 7772 2.50 1.80 2.74 77 INVALID_MSGID 7042 1.92 0.24 2.48 78 ANY_BOUNCE_MESSAGE 6707 3.96 8.71 2.37 79 BOUNCE_MESSAGE 6705 3.96 8.71 2.37 80 HTML_IMAGE_RATIO_08 6591 2.86 4.44 2.33 81 RCVD_IN_MSPIKE_WL 6571 1.83 0.37 2.32 82 RCVD_IN_MSPIKE_H3 6560 1.83 0.37 2.31 83 BAYES_95 6269 2.44 3.12 2.21 84 BOTNET 6138 6.94 21.19 2.17 85 XM_DIRTYINTL 5993 2.62 4.11 2.11 86 URI_TRY_3LD 5777 2.00 1.88 2.04 87 TR_MetaPhish_Combo_01 5564 1.63 0.64 1.96 88 XM_CamelCaseFrm001 5562 2.07 2.41 1.96 89 T_OBFU_PDF_ATTACH 5395 1.45 0.11 1.90 90 XM_OfRef6 5326 3.49 8.31 1.88 91 BAYES_05 5267 1.66 1.07 1.86 92 URI_HEX 5241 2.20 3.23 1.85 93 RELAYCOUNTRY_CA 5204 2.06 2.73 1.84 94 T_TooManySym_02 5174 1.52 0.61 1.83 95 MIME_HTML_ONLY_MULTI 4966 2.16 3.39 1.75 96 IN_HORDE_ADDRESS_BOOK 4914 1.30 0.02 1.73 97 RCVD_IN_IADB_OPTIN 4910 1.45 0.59 1.73 98 TM2_M_URI_OPT_OUT 4747 1.87 2.46 1.67 99 XM_DK_Undo_01 4616 1.35 0.51 1.63 100 MAILING_LIST_MULTI 4580 1.51 1.21 1.62 101 HTML_MIME_NO_HTML_TAG 4279 5.29 16.57 1.51 102 T_XMDrugObfuBody_08 4278 1.55 1.65 1.51 103 XM_SPF_SoftFail 4271 1.82 2.76 1.51 104 UPPERCASE_75_100 4183 1.12 0.07 1.48 105 USER_IN_DEF_DKIM_WL 4044 1.07 0.00 1.43 106 XMBdyGiftCard01 3996 1.64 2.33 1.41 107 NO_DNS_FOR_FROM 3970 1.58 2.11 1.40 108 XMSubMetaI_00 3619 1.57 2.43 1.28 109 UNTRUSTED_Relay 3254 5.79 19.65 1.15 110 XM_ProductURIs 3170 1.10 1.04 1.12 111 XMDiploma_00 3100 1.23 1.62 1.09 112 TR_LOTS_OF_MONEY3 3087 1.15 1.34 1.09 113 TM2_M_VERY_LONG_WORD 2985 1.17 1.53 1.05 114 XM_H_PHPOS 2969 1.05 1.05 1.05 115 XM_GoogleGroups 2961 0.88 0.38 1.04 116 XM_B_REG_HTML 2944 0.92 0.57 1.04 117 T_XMHurry_00 2933 1.08 1.22 1.03 118 XMBody_17 2859 1.37 2.46 1.01 119 XMBody_95 2757 0.74 0.06 0.97 120 TooManyTo_002 2749 0.85 0.47 0.97 121 XM_H_Long_From02 2574 1.31 2.52 0.91 122 TM2_M_A_HREF_HREF 2536 0.76 0.36 0.89 123 USER_IN_WHITELIST 2524 0.67 0.00 0.89 124 XMPhish11 2477 0.95 1.17 0.87 125 XM_salutation2 2414 0.97 1.31 0.85 126 XMStockSpam_06 2373 0.94 1.26 0.84 127 XM_B_COPY_HTML 2244 0.77 0.72 0.79 128 XM_URI_RBL 2183 1.35 3.09 0.77 129 DKIM_ADSP_CUSTOM_MED 2156 0.74 0.67 0.76 130 XM_H_PHPMailer 2140 0.76 0.78 0.76 131 T_XMDrugObfuBody_00 2112 0.79 0.93 0.75 132 XM_D_tchamptons_WL 2087 0.55 0.00 0.74 133 XMHTMLBadTable_001 2061 0.69 0.56 0.73 134 TooManyTo_003 1900 0.60 0.38 0.67 135 DKIM_ADSP_NXDOMAIN 1887 0.62 0.49 0.67 136 HTML_FONT_FACE_BAD 1886 0.68 0.74 0.67 137 T_TooManySym_03 1873 0.52 0.10 0.66 138 XMPhish30 1810 0.86 1.51 0.64 139 PLING_QUERY 1808 0.80 1.30 0.64 140 XM_RXBody 1792 0.79 1.27 0.63 141 XMSexyCombo_01 1787 1.03 2.23 0.63 142 T_FILL_THIS_FORM_SHORT 1787 2.23 7.01 0.63 143 XMSubMetaSxObfu_02 1779 0.54 0.29 0.63 144 XMGenDplmaNmb 1774 0.76 1.15 0.63 145 RDNS_DYNAMIC 1746 0.61 0.61 0.62 146 XM_UB50 1722 1.55 4.35 0.61 147 RCVD_IN_BL_SPAMCOP_NET 1688 1.21 3.06 0.60 148 XMBrknScrpt_02 1662 0.74 1.21 0.59 149 XMLngstWrd_00 1635 0.51 0.33 0.58 150 HELO_NODOT 1631 0.50 0.28 0.58 151 DIET_1 1615 1.38 3.79 0.57 152 XM_H_PHPOS_M 1597 0.56 0.55 0.56 153 XMBody_78 1510 0.65 1.02 0.53 154 XMLngstWrd_01 1505 0.48 0.32 0.53 155 TooManyTo_004 1486 0.47 0.30 0.52 156 XMPhish14 1468 1.01 2.49 0.52 157 NML_ADSP_CUSTOM_MED 1425 0.54 0.65 0.50 158 TR_XM_RelayPhish 1424 0.63 1.03 0.50 159 RELAYCOUNTRY_GB 1419 1.08 2.79 0.50 160 HTML_TAG_BALANCE_BODY 1359 0.46 0.41 0.48 161 URI_NOVOWEL 1358 0.53 0.69 0.48 162 XMSubMetaSxObfu_03 1347 0.60 0.96 0.48 163 XMNoVowels 1341 0.43 0.29 0.47 164 SUBJ_DOLLARS 1324 0.61 1.04 0.47 165 REMOVE_BEFORE_LINK 1309 0.48 0.53 0.46 166 TooManyTo_005 1301 0.41 0.26 0.46 167 T_Symld_Words_02 1283 0.65 1.22 0.45 168 XMSlimDrugH 1260 0.68 1.37 0.44 169 FORGED_GMAIL_RCVD 1260 0.48 0.60 0.44 170 XM_shorewaves_Whitelist 1258 0.33 0.00 0.44 171 HTTPS_HTTP_MISMATCH 1192 0.39 0.31 0.42 172 XMSolicitRefs_0 1168 0.45 0.55 0.41 173 XMHTML_After_End 1093 0.49 0.78 0.39 174 XM_S_JOY_D 1087 0.46 0.68 0.38 175 RELAYCOUNTRY_AU 1072 0.35 0.25 0.38 176 XMCapTrack 1058 0.33 0.21 0.37 177 FILL_THIS_FORM 1041 0.44 0.66 0.37 178 XMBSHREFv2 1000 0.51 0.98 0.35 179 XMSubMetaSSx_00 972 0.49 0.92 0.34 180 XM_Body_Obfu01 971 0.35 0.39 0.34 181 TRACKER_ID 960 0.33 0.32 0.34 182 T_TooManySym_04 946 0.25 0.01 0.33 183 NUMERIC_HTTP_ADDR 939 0.51 1.06 0.33 184 SpammyFromTLD_01 934 0.56 1.23 0.33 185 XM_H_Undi_Recip 914 0.35 0.41 0.32 186 XMMoneyMeta_00 902 0.37 0.52 0.32 187 FILL_THIS_FORM_LONG 899 0.39 0.62 0.32 188 XM_OfRef7 881 1.99 6.99 0.31 189 RELAYCOUNTRY_AT 861 0.59 1.43 0.30 190 XMGppyBdWords 855 0.32 0.37 0.30 191 XM_Akamai 835 0.22 0.00 0.29 192 FILL_THIS_FORM_LOAN 834 0.36 0.56 0.29 193 UPPERCASE_50_75 786 0.23 0.10 0.28 194 LOW_PRICE 779 0.30 0.37 0.27 195 XM_ShortIntro_01 770 0.27 0.27 0.27 196 TM2_M_BODY_EMPTY 740 0.22 0.11 0.26 197 HTML_IMAGE_ONLY_32 736 0.23 0.15 0.26 198 RELAYCOUNTRY_FR 725 3.08 11.52 0.26 199 MPART_ALT_DIFF_COUNT 718 0.36 0.69 0.25 200 HTML_IMAGE_ONLY_20 712 0.26 0.27 0.25 ----------------------------------------------------------------------