Email: 366360 Autolearn: 0 AvgScore: 3.19 AvgScanTime: 2.08 sec Spam: 101398 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 2.49 sec Ham: 264962 Autolearn: 0 AvgScore: -0.38 AvgScanTime: 1.93 sec Time Spent Running SA: 211.78 hours Time Spent Processing Spam: 70.07 hours Time Spent Processing Ham: 141.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 90670 86.47 89.42 85.34 2 DKIM_SIGNED 78285 77.86 77.21 78.12 3 DCC_CHECK 77993 54.86 76.92 46.43 4 XMListUnsubscribeExists 75439 59.42 74.40 53.69 5 XM_DK_Pass 74086 75.89 73.06 76.97 6 DKIM_VALID 69936 72.54 68.97 73.90 7 DKIM_VALID_AU 56046 57.23 55.27 57.98 8 XM_DK_Undo_02 47221 25.25 46.57 17.09 9 BAYES_99 42464 22.74 41.88 15.41 10 HTML_FONT_LOW_CONTRAST 36175 35.15 35.68 34.94 11 BAYES_999 35434 19.58 34.95 13.71 12 TR_DCC_Bayes_99 34008 14.34 33.54 6.99 13 MIME_HTML_ONLY 33714 28.86 33.25 27.18 14 BAYES_50 32143 44.48 31.70 49.37 15 LOC_TINY_FONT_1 31949 26.88 31.51 25.11 16 FVGT_m_MULTI_ODD 26518 23.30 26.15 22.21 17 XMSubLong 25955 22.62 25.60 21.49 18 RELAYCOUNTRY_META 22703 9.20 22.39 4.16 19 DCC_CHECK_NEGATIVE 22188 43.94 21.88 52.38 20 XM_Body_Dirty_Words 21600 16.28 21.30 14.36 21 BOTNET 20342 7.12 20.06 2.17 22 DKIM_VALID_EF 18192 26.15 17.94 29.30 23 MultiRelay 17981 16.90 17.73 16.58 24 T_KAM_HTML_FONT_INVALID 17386 15.60 17.15 15.01 25 UNTRUSTED_Relay 17287 5.80 17.05 1.49 26 BOTNET_IPINHOSTNAME 17239 9.37 17.00 6.46 27 T_TM2_M_HEADER_IN_MSG 16616 21.17 16.39 23.00 28 XM_Multi_Part_URI 15488 14.17 15.27 13.74 29 LOTS_OF_MONEY 14861 11.79 14.66 10.69 30 FSL_BULK_SIG 14119 11.22 13.92 10.19 31 HTML_IMAGE_RATIO_02 13751 11.32 13.56 10.47 32 XM_UncommonTLD01 12402 6.61 12.23 4.46 33 XM_Evil_Numbers_Gen 11313 9.35 11.16 8.66 34 XMSexyCombo_05 9965 6.04 9.83 4.59 35 HTML_IMAGE_RATIO_04 9552 7.93 9.42 7.37 36 BAYES_80 9165 6.44 9.04 5.45 37 TooManyTo_001 8787 6.58 8.67 5.79 38 XM_UB50 8450 2.99 8.33 0.94 39 DKIM_INVALID 8349 5.33 8.23 4.21 40 XMSubMetaSx_00 8281 5.92 8.17 5.06 41 T_XMDrugObfuBody_14 8224 7.14 8.11 6.77 42 BAYES_60 7555 6.58 7.45 6.24 43 XM_H_Long_From01 6945 6.25 6.85 6.02 44 LotsOfNums_01 6812 8.43 6.72 9.08 45 HTML_MIME_NO_HTML_TAG 6575 4.64 6.48 3.94 46 RELAYCOUNTRY_FR 6359 1.91 6.27 0.25 47 MPART_ALT_DIFF 6228 5.25 6.14 4.91 48 FROM_EXCESS_BASE64 5852 5.03 5.77 4.74 49 XM_B_Phish_Phrases 5839 5.99 5.76 6.08 50 SUBJ_ALL_CAPS 5676 3.29 5.60 2.40 51 DKIM_ADSP_NXDOMAIN 5615 2.03 5.54 0.68 52 RCVD_IN_RP_SAFE 5496 12.07 5.42 14.61 53 XM_OfRef6 5482 2.31 5.41 1.12 54 XMStrtUSub 5328 6.97 5.25 7.63 55 MultiRelay_CC 5095 1.52 5.02 0.18 56 MultiRelay_Combo 5095 1.52 5.02 0.18 57 XM_B_SpammyTLD 5074 4.53 5.00 4.35 58 XM_SPF_SoftFail 4917 4.18 4.85 3.92 59 XMNumbers 4874 3.75 4.81 3.35 60 XM_DIRTYINTL 4792 3.39 4.73 2.87 61 T_REMOTE_IMAGE 4738 3.89 4.67 3.59 62 MIME_HTML_MOSTLY 4510 3.26 4.45 2.80 63 RCVD_IN_RP_CERTIFIED 4294 10.44 4.23 12.81 64 BOTNET_NORDNS 4293 1.18 4.23 0.02 65 FILL_THIS_FORM 4277 1.43 4.22 0.37 66 FILL_THIS_FORM_LOAN 4233 1.38 4.17 0.32 67 ALL_TRUSTED 4133 13.87 4.08 17.62 68 HTML_IMAGE_RATIO_06 3923 3.55 3.87 3.43 69 TR_XM_PHPDW 3921 1.94 3.87 1.20 70 XM_OfRef7 3903 1.14 3.85 0.10 71 RELAYCOUNTRY_CA 3882 2.10 3.83 1.43 72 XM_CamelCaseFrm001 3881 2.33 3.83 1.76 73 TR_XM_PHPForged 3867 1.91 3.81 1.18 74 TR_XM_FormFill2 3843 1.90 3.79 1.17 75 HTML_IMAGE_RATIO_08 3837 2.45 3.78 1.93 76 XM_H_PHPOS 3831 1.89 3.78 1.17 77 MONEY_FORM 3799 1.05 3.75 0.01 78 XMBdyGiftCard01 3792 2.14 3.74 1.53 79 PDS_TO_EQ_FROM_NAME 3789 1.08 3.74 0.06 80 XMSexyCombo_01 3760 2.00 3.71 1.34 81 URI_HEX 3753 2.34 3.70 1.82 82 MIME_QP_LONG_LINE 3741 3.95 3.69 4.04 83 MIME_HTML_ONLY_MULTI 3703 2.40 3.65 1.92 84 FILL_THIS_FORM_FRAUD_PHISH 3621 1.02 3.57 0.04 85 URIBL_DBL_ABUSE_REDIR 3557 1.00 3.51 0.04 86 SpammyFromTLD_02 3542 1.08 3.49 0.16 87 XM_OfRef8 3539 0.97 3.49 0.01 88 BAYES_95 3533 3.52 3.48 3.54 89 XM_SendGrid 3501 6.16 3.45 7.20 90 XM_UB80 3438 0.97 3.39 0.05 91 FORM_FRAUD 3390 0.93 3.34 0.00 92 ADVANCE_FEE_3_NEW_FRM_MNY 3388 0.93 3.34 0.00 93 RELAYCOUNTRY_AM 3368 0.92 3.32 0.00 94 SpammyFromTLD_01 3260 1.59 3.22 0.96 95 FROM_SUSPICIOUS_NTLD 3105 0.87 3.06 0.03 96 TR_Caps_n_Bayes_80 3047 0.91 3.00 0.11 97 T_TooManySym_01 2890 6.10 2.85 7.35 98 RELAYCOUNTRY_SC 2820 0.77 2.78 0.00 99 XMDiploma_00 2589 1.78 2.55 1.48 100 XMBody_17 2554 1.20 2.52 0.70 101 DATE_IN_PAST_12_24 2513 0.78 2.48 0.13 102 TM2_M_URI_OPT_OUT 2449 1.67 2.42 1.38 103 RCVD_IN_MSPIKE_H2 2425 3.65 2.39 4.13 104 T_XMDrugObfuBody_08 2398 2.72 2.36 2.86 105 XM_URI_RBL 2342 1.02 2.31 0.53 106 KHOP_HELO_FCRDNS 2340 1.46 2.31 1.13 107 BAYES_40 2224 2.87 2.19 3.14 108 NO_DNS_FOR_FROM 2147 1.50 2.12 1.26 109 DIET_1 2132 0.94 2.10 0.50 110 XM_B_REG_HTML 2098 0.93 2.07 0.49 111 RCVD_IN_BL_SPAMCOP_NET 2070 0.79 2.04 0.31 112 RELAYCOUNTRY_DE 2008 0.83 1.98 0.39 113 URI_TRY_3LD 1983 1.97 1.96 1.98 114 XM_UB60 1932 0.59 1.91 0.09 115 RCVD_IN_PSBL 1839 0.60 1.81 0.14 116 XM_ProductURIs 1829 1.16 1.80 0.91 117 TM2_M_BODY_EMPTY 1819 1.09 1.79 0.82 118 XMEmptyBody_01 1793 0.97 1.77 0.66 119 BAYES_20 1788 2.19 1.76 2.35 120 RCVD_IN_IADB_LISTED 1752 3.53 1.73 4.22 121 MAILING_LIST_MULTI 1712 1.78 1.69 1.82 122 UNPARSEABLE_RELAY 1712 3.33 1.69 3.95 123 XM_H_PHPMailer 1642 0.85 1.62 0.56 124 XM_H_TOP 1631 0.45 1.61 0.00 125 TR_XM_DK_SendGrid 1546 3.06 1.52 3.65 126 TR_XM_RelayPhish 1522 1.24 1.50 1.13 127 TR_M_TOP_BAYES 1502 0.41 1.48 0.00 128 BAYES_05 1498 1.51 1.48 1.52 129 RELAYCOUNTRY_NL 1483 0.53 1.46 0.17 130 XM_UB99 1468 0.41 1.45 0.01 131 BODY_URI_ONLY 1429 0.42 1.41 0.04 132 RCVD_IN_IADB_SPF 1404 2.98 1.38 3.59 133 HTML_IMAGE_ONLY_24 1386 0.58 1.37 0.28 134 RCVD_IN_RP_RNBL 1385 0.41 1.37 0.04 135 XM_H_PHPOS_M 1378 0.59 1.36 0.29 136 URIBL_BLACK 1358 0.42 1.34 0.07 137 XMGenDplmaNmb 1334 0.95 1.32 0.81 138 NORDNS_LOW_CONTRAST 1329 0.42 1.31 0.07 139 HK_RANDOM_FROM 1328 0.55 1.31 0.26 140 TM2_M_VERY_LONG_WORD 1317 1.46 1.30 1.52 141 RCVD_IN_IADB_SENDERID 1310 2.58 1.29 3.07 142 XMMoneyMeta_00 1302 0.57 1.28 0.30 143 RCVD_IN_IADB_DK 1297 2.48 1.28 2.95 144 XMBody_78 1289 0.86 1.27 0.70 145 XMSlimDrugH 1277 0.63 1.26 0.39 146 XMPhish30 1250 0.93 1.23 0.82 147 XMBrknScrpt_02 1214 0.82 1.20 0.68 148 T_MONEY_PERCENT 1205 0.64 1.19 0.42 149 TR_LOTS_OF_MONEY2 1205 0.64 1.19 0.42 150 XMSubMetaI_00 1203 0.60 1.19 0.38 151 XMStockSpam_06 1186 0.88 1.17 0.78 152 MIME_HEADER_CTYPE_ONLY 1174 0.41 1.16 0.13 153 XM_UB999 1145 0.32 1.13 0.01 154 T_XMHurry_00 1143 1.18 1.13 1.20 155 HTML_SHORT_LINK_IMG_1 1136 0.32 1.12 0.02 156 XMSexyCombo_04 1129 0.42 1.11 0.16 157 HTML_IMAGE_ONLY_08 1129 0.41 1.11 0.14 158 HDRS_LCASE_IMGONLY 1119 0.32 1.10 0.03 159 TR_Symld_Words 1108 2.05 1.09 2.41 160 FROM_DOMAIN_NOVOWEL 1074 0.32 1.06 0.04 161 HK_RANDOM_ENVFROM 1064 0.49 1.05 0.27 162 XMSubMetaSxObfu_03 1037 0.69 1.02 0.56 163 XM_H_Long_From02 1024 0.89 1.01 0.85 164 URI_NOVOWEL 991 0.55 0.98 0.39 165 TR_MetaPhish_Combo_01 988 2.10 0.97 2.53 166 SHORT_URI_3 984 0.38 0.97 0.16 167 XMGppyBdWords 981 0.43 0.97 0.22 168 RELAYCOUNTRY_AT 959 0.45 0.95 0.26 169 XMPhish11 940 0.89 0.93 0.87 170 T_XMDrugObfuBody_00 936 1.12 0.92 1.19 171 RDNS_DYNAMIC 931 0.60 0.92 0.48 172 DKIM_ADSP_CUSTOM_MED 926 0.74 0.91 0.67 173 TM2_M_A_HREF_HREF 916 1.55 0.90 1.79 174 DATE_IN_PAST_03_06 911 0.32 0.90 0.10 175 DATE_IN_PAST_06_12 906 0.29 0.89 0.06 176 TooManyTo_002 905 1.17 0.89 1.28 177 XM_B_COPY_HTML 903 0.79 0.89 0.75 178 XMSubMetaSSx_00 888 0.48 0.88 0.33 179 T_Symld_Words_02 878 0.63 0.87 0.53 180 XMHTMLBadTable_001 868 0.51 0.86 0.38 181 RCVD_IN_IADB_VOUCHED 865 2.37 0.85 2.96 182 LONG_JUNK_URI 832 0.32 0.82 0.12 183 XM_RXBody 831 0.52 0.82 0.41 184 URI_PHP_REDIR 824 0.23 0.81 0.00 185 XM_HighProb1 824 0.23 0.81 0.01 186 NML_ADSP_CUSTOM_MED 815 0.57 0.80 0.48 187 BAYES_00 811 9.38 0.80 12.66 188 XMSubMetaSx_01 777 0.53 0.77 0.44 189 SUBJ_DOLLARS 776 0.73 0.77 0.72 190 FORGED_GMAIL_RCVD 776 0.46 0.77 0.34 191 T_FILL_THIS_FORM_SHORT 772 1.10 0.76 1.22 192 TooManyTo_003 770 0.87 0.76 0.91 193 FILL_THIS_FORM_LONG 768 0.43 0.76 0.31 194 TR_Caps_n_Bayes_99 766 0.48 0.76 0.37 195 URIBL_DBL_SPAM 751 0.21 0.74 0.01 196 T_TooManySym_02 738 2.08 0.73 2.60 197 URIBL_ABUSE_SURBL 700 0.26 0.69 0.10 198 XMWghtMeta_00 694 0.21 0.68 0.03 199 TR_Mismatch_TLD_02 692 0.24 0.68 0.07 200 RELAYCOUNTRY_GB 672 0.54 0.66 0.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 226114 86.47 89.42 85.34 2 DKIM_SIGNED 206979 77.86 77.21 78.12 3 XM_DK_Pass 203931 75.89 73.06 76.97 4 DKIM_VALID 195813 72.54 68.97 73.90 5 DKIM_VALID_AU 153617 57.23 55.27 57.98 6 XMListUnsubscribeExists 142255 59.42 74.40 53.69 7 DCC_CHECK_NEGATIVE 138777 43.94 21.88 52.38 8 BAYES_50 130801 44.48 31.70 49.37 9 DCC_CHECK 123009 54.86 76.92 46.43 10 HTML_FONT_LOW_CONTRAST 92587 35.15 35.68 34.94 11 DKIM_VALID_EF 77625 26.15 17.94 29.30 12 MIME_HTML_ONLY 72013 28.86 33.25 27.18 13 LOC_TINY_FONT_1 66540 26.88 31.51 25.11 14 T_TM2_M_HEADER_IN_MSG 60944 21.17 16.39 23.00 15 FVGT_m_MULTI_ODD 58850 23.30 26.15 22.21 16 XMSubLong 56929 22.62 25.60 21.49 17 ALL_TRUSTED 46675 13.87 4.08 17.62 18 XM_DK_Undo_02 45292 25.25 46.57 17.09 19 MultiRelay 43940 16.90 17.73 16.58 20 BAYES_99 40832 22.74 41.88 15.41 21 T_KAM_HTML_FONT_INVALID 39783 15.60 17.15 15.01 22 RCVD_IN_RP_SAFE 38710 12.07 5.42 14.61 23 XM_Body_Dirty_Words 38058 16.28 21.30 14.36 24 XM_Multi_Part_URI 36410 14.17 15.27 13.74 25 BAYES_999 36314 19.58 34.95 13.71 26 RCVD_IN_RP_CERTIFIED 33944 10.44 4.23 12.81 27 BAYES_00 33556 9.38 0.80 12.66 28 TR_XM_DK_Bayes 31007 8.58 0.42 11.70 29 XM_DKIMWhitelistDomains 30241 8.26 0.03 11.41 30 TR_XM_DK_Bayes1 29909 8.25 0.33 11.29 31 LOTS_OF_MONEY 28334 11.79 14.66 10.69 32 HTML_IMAGE_RATIO_02 27729 11.32 13.56 10.47 33 FSL_BULK_SIG 26992 11.22 13.92 10.19 34 TR_XM_DK_Bayes2 25281 6.96 0.20 9.54 35 LotsOfNums_01 24062 8.43 6.72 9.08 36 XM_Evil_Numbers_Gen 22943 9.35 11.16 8.66 37 TO_MALFORMED 20595 5.64 0.08 7.77 38 XMStrtUSub 20220 6.97 5.25 7.63 39 HTML_IMAGE_RATIO_04 19518 7.93 9.42 7.37 40 T_TooManySym_01 19463 6.10 2.85 7.35 41 XM_SendGrid 19065 6.16 3.45 7.20 42 TR_DCC_Bayes_99 18520 14.34 33.54 6.99 43 T_XMDrugObfuBody_14 17944 7.14 8.11 6.77 44 BOTNET_IPINHOSTNAME 17104 9.37 17.00 6.46 45 BAYES_60 16539 6.58 7.45 6.24 46 XM_B_Phish_Phrases 16102 5.99 5.76 6.08 47 XM_H_Long_From01 15949 6.25 6.85 6.02 48 TooManyTo_001 15330 6.58 8.67 5.79 49 BAYES_80 14437 6.44 9.04 5.45 50 XMSubMetaSx_00 13398 5.92 8.17 5.06 51 MPART_ALT_DIFF 13008 5.25 6.14 4.91 52 FROM_EXCESS_BASE64 12570 5.03 5.77 4.74 53 XMSexyCombo_05 12163 6.04 9.83 4.59 54 XM_UncommonTLD01 11815 6.61 12.23 4.46 55 XM_B_SpammyTLD 11531 4.53 5.00 4.35 56 RCVD_IN_IADB_LISTED 11188 3.53 1.73 4.22 57 DKIM_INVALID 11166 5.33 8.23 4.21 58 RELAYCOUNTRY_META 11018 9.20 22.39 4.16 59 RCVD_IN_MSPIKE_H2 10941 3.65 2.39 4.13 60 MIME_QP_LONG_LINE 10717 3.95 3.69 4.04 61 UNPARSEABLE_RELAY 10475 3.33 1.69 3.95 62 HTML_MIME_NO_HTML_TAG 10438 4.64 6.48 3.94 63 XM_SPF_SoftFail 10390 4.18 4.85 3.92 64 TR_XM_DK_SendGrid 9673 3.06 1.52 3.65 65 T_REMOTE_IMAGE 9520 3.89 4.67 3.59 66 RCVD_IN_IADB_SPF 9506 2.98 1.38 3.59 67 IN_ZIMBRA_NJ_WHITELIST 9444 2.58 0.01 3.56 68 BAYES_95 9372 3.52 3.48 3.54 69 TVD_RCVD_IP 9209 2.62 0.40 3.48 70 HTML_IMAGE_RATIO_06 9094 3.55 3.87 3.43 71 XMNumbers 8876 3.75 4.81 3.35 72 BAYES_40 8308 2.87 2.19 3.14 73 RCVD_IN_IADB_SENDERID 8137 2.58 1.29 3.07 74 RCVD_IN_IADB_VOUCHED 7832 2.37 0.85 2.96 75 RCVD_IN_IADB_DK 7807 2.48 1.28 2.95 76 XM_DIRTYINTL 7613 3.39 4.73 2.87 77 T_XMDrugObfuBody_08 7572 2.72 2.36 2.86 78 MIME_HTML_MOSTLY 7425 3.26 4.45 2.80 79 INVALID_MSGID 7331 2.04 0.13 2.77 80 RCVD_IN_MSPIKE_WL 6922 1.98 0.33 2.61 81 RCVD_IN_MSPIKE_H3 6922 1.98 0.33 2.61 82 T_TooManySym_02 6878 2.08 0.73 2.60 83 TR_MetaPhish_Combo_01 6710 2.10 0.97 2.53 84 TR_Symld_Words 6386 2.05 1.09 2.41 85 SUBJ_ALL_CAPS 6364 3.29 5.60 2.40 86 BAYES_20 6235 2.19 1.76 2.35 87 BOTNET 5740 7.12 20.06 2.17 88 URI_TRY_3LD 5240 1.97 1.96 1.98 89 HTML_IMAGE_RATIO_08 5125 2.45 3.78 1.93 90 RCVD_IN_IADB_OPTIN 5106 1.54 0.52 1.93 91 XM_PDF 5102 1.51 0.43 1.93 92 MIME_HTML_ONLY_MULTI 5094 2.40 3.65 1.92 93 URI_HEX 4826 2.34 3.70 1.82 94 MAILING_LIST_MULTI 4817 1.78 1.69 1.82 95 TM2_M_A_HREF_HREF 4751 1.55 0.90 1.79 96 PP_MIME_FAKE_ASCII_TEXT 4740 1.41 0.41 1.79 97 IN_HORDE_ADDRESS_BOOK 4726 1.30 0.05 1.78 98 XM_CamelCaseFrm001 4660 2.33 3.83 1.76 99 USER_IN_DEF_DKIM_WL 4466 1.22 0.01 1.69 100 XMBdyGiftCard01 4059 2.14 3.74 1.53 101 TM2_M_VERY_LONG_WORD 4022 1.46 1.30 1.52 102 BAYES_05 4016 1.51 1.48 1.52 103 UNTRUSTED_Relay 3951 5.80 17.05 1.49 104 XMDiploma_00 3934 1.78 2.55 1.48 105 RELAYCOUNTRY_CA 3797 2.10 3.83 1.43 106 TM2_M_URI_OPT_OUT 3666 1.67 2.42 1.38 107 XM_DK_Undo_01 3648 1.17 0.63 1.38 108 ANY_BOUNCE_MESSAGE 3626 1.05 0.21 1.37 109 BOUNCE_MESSAGE 3626 1.05 0.21 1.37 110 XMSexyCombo_01 3553 2.00 3.71 1.34 111 TooManyTo_002 3393 1.17 0.89 1.28 112 NO_DNS_FOR_FROM 3350 1.50 2.12 1.26 113 T_FILL_THIS_FORM_SHORT 3241 1.10 0.76 1.22 114 T_XMHurry_00 3189 1.18 1.13 1.20 115 XM_GoogleGroups 3183 1.00 0.46 1.20 116 TR_XM_PHPDW 3170 1.94 3.87 1.20 117 T_XMDrugObfuBody_00 3152 1.12 0.92 1.19 118 TR_XM_PHPForged 3132 1.91 3.81 1.18 119 TR_XM_FormFill2 3104 1.90 3.79 1.17 120 XM_H_PHPOS 3099 1.89 3.78 1.17 121 TR_XM_RelayPhish 3007 1.24 1.50 1.13 122 KHOP_HELO_FCRDNS 2996 1.46 2.31 1.13 123 XM_OfRef6 2973 2.31 5.41 1.12 124 XMBody_95 2762 0.78 0.10 1.04 125 XMSubMetaSxObfu_02 2575 0.79 0.30 0.97 126 SpammyFromTLD_01 2556 1.59 3.22 0.96 127 XM_UB50 2495 2.99 8.33 0.94 128 TooManyTo_003 2423 0.87 0.76 0.91 129 XM_ProductURIs 2408 1.16 1.80 0.91 130 XM_D_tchamptons_WL 2325 0.63 0.00 0.88 131 PLING_QUERY 2320 0.78 0.53 0.88 132 XMPhish11 2315 0.89 0.93 0.87 133 XM_H_Long_From02 2245 0.89 1.01 0.85 134 USER_IN_WHITELIST 2180 0.60 0.00 0.82 135 TM2_M_BODY_EMPTY 2173 1.09 1.79 0.82 136 XMPhish30 2167 0.93 1.23 0.82 137 XMGenDplmaNmb 2136 0.95 1.32 0.81 138 XMStockSpam_06 2054 0.88 1.17 0.78 139 TooManyTo_004 2005 0.72 0.62 0.76 140 XM_B_COPY_HTML 1985 0.79 0.89 0.75 141 SUBJ_DOLLARS 1905 0.73 0.77 0.72 142 HELO_NODOT 1875 0.62 0.38 0.71 143 HELO_NO_DOMAIN 1873 0.62 0.38 0.71 144 XMBody_78 1849 0.86 1.27 0.70 145 XMBody_17 1844 1.20 2.52 0.70 146 T_TooManySym_03 1838 0.53 0.09 0.69 147 DKIM_ADSP_NXDOMAIN 1810 2.03 5.54 0.68 148 XMBrknScrpt_02 1798 0.82 1.20 0.68 149 TooManyTo_005 1786 0.63 0.53 0.67 150 DKIM_ADSP_CUSTOM_MED 1771 0.74 0.91 0.67 151 XMEmptyBody_01 1750 0.97 1.77 0.66 152 XMSubMetaSxObfu_03 1497 0.69 1.02 0.56 153 XM_H_PHPMailer 1471 0.85 1.62 0.56 154 T_Symld_Words_02 1414 0.63 0.87 0.53 155 XM_URI_RBL 1404 1.02 2.31 0.53 156 HTML_FONT_FACE_BAD 1338 0.54 0.64 0.50 157 DIET_1 1327 0.94 2.10 0.50 158 RELAYCOUNTRY_GB 1323 0.54 0.66 0.50 159 XM_B_REG_HTML 1298 0.93 2.07 0.49 160 NML_ADSP_CUSTOM_MED 1282 0.57 0.80 0.48 161 RDNS_DYNAMIC 1277 0.60 0.92 0.48 162 HTML_TAG_BALANCE_BODY 1270 0.52 0.63 0.48 163 XMBSHREFv2 1180 0.37 0.17 0.45 164 XMSubMetaSx_01 1174 0.53 0.77 0.44 165 XMRcvdHeader_15 1129 0.31 0.00 0.43 166 TR_LOTS_OF_MONEY2 1126 0.64 1.19 0.42 167 T_MONEY_PERCENT 1126 0.64 1.19 0.42 168 XMSubMetaSxObfu_04 1093 0.47 0.60 0.41 169 XM_RXBody 1075 0.52 0.82 0.41 170 RELAYCOUNTRY_AU 1067 0.39 0.34 0.40 171 TR_LOTS_OF_MONEY3 1052 0.37 0.31 0.40 172 RELAYCOUNTRY_DE 1042 0.83 1.98 0.39 173 URI_NOVOWEL 1040 0.55 0.98 0.39 174 XMSexyCombo_02 1029 0.43 0.53 0.39 175 XMNoVowels 1023 0.35 0.27 0.39 176 XMSlimDrugH 1023 0.63 1.26 0.39 177 XMHTMLBadTable_001 1017 0.51 0.86 0.38 178 HTTPS_HTTP_MISMATCH 1014 0.40 0.44 0.38 179 XMSubMetaI_00 1003 0.60 1.19 0.38 180 XMCapTrack 987 0.31 0.16 0.37 181 TR_Caps_n_Bayes_99 984 0.48 0.76 0.37 182 FILL_THIS_FORM 978 1.43 4.22 0.37 183 XM_ShortIntro_01 911 0.34 0.32 0.34 184 FORGED_GMAIL_RCVD 893 0.46 0.77 0.34 185 XMSubMetaSSx_00 881 0.48 0.88 0.33 186 REMOVE_BEFORE_LINK 869 0.34 0.36 0.33 187 BASE64_LENGTH_79_INF 860 0.35 0.41 0.32 188 T_TooManySym_04 851 0.24 0.02 0.32 189 FILL_THIS_FORM_LOAN 836 1.38 4.17 0.32 190 XMHTML_After_End 835 0.41 0.65 0.32 191 XM_Akamai 819 0.23 0.01 0.31 192 T_OBFU_PDF_ATTACH 817 0.23 0.04 0.31 193 RCVD_IN_BL_SPAMCOP_NET 816 0.79 2.04 0.31 194 XMLngstWrd_00 815 0.27 0.18 0.31 195 FILL_THIS_FORM_LONG 814 0.43 0.76 0.31 196 XMMoneyMeta_00 804 0.57 1.28 0.30 197 XM_H_PHPOS_M 771 0.59 1.36 0.29 198 XM_Body_Obfu01 763 0.29 0.31 0.29 199 XMSolicitRefs_0 755 0.31 0.39 0.28 200 XMSUPPORT 745 0.20 0.00 0.28 ----------------------------------------------------------------------