Email: 337967 Autolearn: 0 AvgScore: 3.38 AvgScanTime: 2.07 sec Spam: 98866 Autolearn: 0 AvgScore: 13.15 AvgScanTime: 2.52 sec Ham: 239101 Autolearn: 0 AvgScore: -0.66 AvgScanTime: 1.88 sec Time Spent Running SA: 194.07 hours Time Spent Processing Spam: 69.20 hours Time Spent Processing Ham: 124.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 92280 86.32 93.34 83.42 2 DCC_CHECK 79688 59.47 80.60 50.73 3 DKIM_SIGNED 77945 79.81 78.84 80.21 4 XM_DK_Pass 73881 77.66 74.73 78.88 5 XMListUnsubscribeExists 73020 61.95 73.86 57.03 6 DKIM_VALID 72601 75.87 73.43 76.88 7 XM_B_Unicode 71681 71.10 72.50 70.52 8 DKIM_VALID_AU 59743 62.01 60.43 62.66 9 XM_DK_Undo_02 47905 28.14 48.45 19.75 10 BAYES_99 41874 24.90 42.35 17.69 11 BAYES_999 35835 21.94 36.25 16.03 12 HTML_FONT_LOW_CONTRAST 34994 34.60 35.40 34.27 13 TR_DCC_Bayes_99 34006 16.90 34.40 9.66 14 BAYES_50 33606 44.56 33.99 48.92 15 LOC_TINY_FONT_1 32673 30.27 33.05 29.13 16 MIME_HTML_ONLY 32312 25.28 32.68 22.22 17 FVGT_m_MULTI_ODD 26876 23.44 27.18 21.90 18 RELAYCOUNTRY_META 25366 10.59 25.66 4.37 19 XMSubLong 22639 23.42 22.90 23.63 20 XM_Body_Dirty_Words 21597 16.55 21.84 14.36 21 BOTNET 19773 7.55 20.00 2.40 22 T_TM2_M_HEADER_IN_MSG 19622 22.40 19.85 23.45 23 UNTRUSTED_Relay 17938 6.31 18.14 1.42 24 HTML_IMAGE_RATIO_02 17863 13.66 18.07 11.84 25 DCC_CHECK_NEGATIVE 17465 39.21 17.67 48.12 26 MultiRelay 17307 16.22 17.51 15.69 27 T_KAM_HTML_FONT_INVALID 17040 16.32 17.24 15.94 28 DKIM_VALID_EF 17010 26.93 17.21 30.95 29 BOTNET_IPINHOSTNAME 16372 9.52 16.56 6.61 30 XM_Multi_Part_URI 16352 15.78 16.54 15.47 31 XM_Evil_Numbers_Gen 12888 10.46 13.04 9.39 32 XMSexyCombo_05 10778 6.21 10.90 4.26 33 XM_UB50 10583 3.72 10.70 0.83 34 LOTS_OF_MONEY 10474 8.61 10.59 7.80 35 FSL_BULK_SIG 10045 9.94 10.16 9.84 36 HTML_IMAGE_RATIO_04 9336 7.58 9.44 6.81 37 XMSubMetaSx_00 8717 5.63 8.82 4.32 38 XM_UncommonTLD01 8587 6.57 8.69 5.70 39 RCVD_IN_PSBL 8408 2.55 8.50 0.09 40 XM_H_Long_From01 8153 7.11 8.25 6.64 41 BAYES_80 8099 5.16 8.19 3.91 42 RCVD_IN_MSPIKE_H2 7687 9.17 7.78 9.75 43 TooManyTo_001 7598 7.36 7.69 7.23 44 MPART_ALT_DIFF 7123 4.55 7.20 3.45 45 BAYES_60 6847 6.34 6.93 6.10 46 RCVD_IN_BL_SPAMCOP_NET 6842 2.42 6.92 0.55 47 LotsOfNums_01 6656 7.37 6.73 7.64 48 DKIM_ADSP_NXDOMAIN 6331 2.35 6.40 0.67 49 XM_DIRTYINTL 6308 3.71 6.38 2.61 50 NUMERIC_HTTP_ADDR 6127 2.05 6.20 0.34 51 T_XMDrugObfuBody_14 6099 7.54 6.17 8.11 52 FROM_EXCESS_BASE64 6052 5.60 6.12 5.38 53 NORMAL_HTTP_TO_IP 5923 1.78 5.99 0.04 54 XM_B_Phish_Phrases 5814 7.61 5.88 8.32 55 HTML_MIME_NO_HTML_TAG 5665 3.20 5.73 2.16 56 MIME_HEADER_CTYPE_ONLY 5615 1.80 5.68 0.19 57 RCVD_IN_RP_SAFE 5550 12.31 5.61 15.07 58 RCVD_IN_MSPIKE_BL 5450 2.46 5.51 1.20 59 HDRS_LCASE_IMGONLY 5431 1.63 5.49 0.04 60 DKIM_INVALID 5344 3.94 5.41 3.33 61 XMStrtUSub 5272 6.02 5.33 6.30 62 RELAYCOUNTRY_FR 5206 1.71 5.27 0.24 63 SpammyFromTLD_02 5198 1.67 5.26 0.19 64 XMBdyGiftCard01 5110 2.85 5.17 1.88 65 XM_B_SpammyTLD 4673 4.96 4.73 5.05 66 MIME_HTML_MOSTLY 4546 3.74 4.60 3.39 67 RCVD_IN_MSPIKE_L5 4460 1.73 4.51 0.58 68 MultiRelay_Combo 4121 1.34 4.17 0.18 69 MultiRelay_CC 4121 1.34 4.17 0.18 70 BAYES_95 3990 3.13 4.04 2.75 71 RELAYCOUNTRY_CA 3944 2.29 3.99 1.59 72 RCVD_IN_RP_CERTIFIED 3909 10.73 3.95 13.53 73 RELAYCOUNTRY_IN 3897 1.19 3.94 0.05 74 XM_SPF_SoftFail 3897 1.78 3.94 0.89 75 HTML_IMAGE_RATIO_08 3706 2.49 3.75 1.97 76 HTML_FONT_SIZE_LARGE 3692 1.20 3.73 0.15 77 XM_SendGrid 3627 6.03 3.67 7.01 78 XMNumbers 3582 3.56 3.62 3.53 79 T_TooManySym_01 3530 7.24 3.57 8.75 80 BOTNET_NORDNS 3522 1.05 3.56 0.01 81 XMSexyCombo_01 3512 1.44 3.55 0.57 82 T_REMOTE_IMAGE 3462 3.43 3.50 3.41 83 MIME_HTML_ONLY_MULTI 3420 2.17 3.46 1.63 84 MIME_QP_LONG_LINE 3413 3.89 3.45 4.07 85 T_HTML_TAG_BALANCE_CENTER 3339 1.06 3.38 0.10 86 URI_HEX 3267 2.22 3.30 1.77 87 XM_CamelCaseFrm001 3160 2.29 3.20 1.92 88 RCVD_IN_RP_RNBL 3084 0.97 3.12 0.08 89 SUBJ_ALL_CAPS 3073 2.11 3.11 1.69 90 XMDiploma_00 2914 2.05 2.95 1.68 91 XM_UB99 2766 0.85 2.80 0.05 92 HTML_IMAGE_RATIO_06 2624 3.39 2.65 3.69 93 US_DOLLARS_3 2564 2.01 2.59 1.77 94 NO_DNS_FOR_FROM 2547 1.67 2.58 1.30 95 TM2_M_URI_OPT_OUT 2481 2.04 2.51 1.85 96 XM_ProductURIs 2421 1.37 2.45 0.92 97 XMSubMetaI_00 2396 1.11 2.42 0.57 98 XM_OfRef6 2369 2.42 2.40 2.43 99 XMSexyCombo_04 2288 0.81 2.31 0.18 100 TR_XM_PHPDW 2277 1.15 2.30 0.67 101 XM_UB999 2269 0.70 2.30 0.04 102 TR_XM_PHPForged 2260 1.12 2.29 0.64 103 TR_XM_FormFill2 2233 1.07 2.26 0.58 104 XM_H_PHPOS 2221 1.06 2.25 0.58 105 XMPhish11 2044 1.56 2.07 1.35 106 ALL_TRUSTED 2035 11.79 2.06 15.82 107 DKIM_ADSP_CUSTOM_MED 2013 1.24 2.04 0.90 108 BAYES_40 1937 3.20 1.96 3.71 109 NML_ADSP_CUSTOM_MED 1912 1.03 1.93 0.66 110 XM_URI_RBL 1886 0.90 1.91 0.49 111 URI_TRY_3LD 1883 1.70 1.90 1.61 112 RELAYCOUNTRY_FI 1854 0.56 1.88 0.02 113 RCVD_IN_MSPIKE_WL 1853 5.01 1.87 6.30 114 TR_Caps_n_Bayes_99 1844 0.93 1.87 0.54 115 THIS_AD 1804 0.64 1.82 0.16 116 KHOP_HELO_FCRDNS 1794 1.22 1.81 0.97 117 SpammyFromTLD_01 1761 0.75 1.78 0.32 118 PDS_TO_EQ_FROM_NAME 1750 0.55 1.77 0.05 119 RCVD_IN_MSPIKE_H3 1729 4.53 1.75 5.67 120 XM_UB60 1716 0.55 1.74 0.07 121 HTML_IMAGE_ONLY_12 1708 0.62 1.73 0.16 122 TR_Symld_Words 1705 1.57 1.72 1.51 123 HTML_IMAGE_ONLY_16 1687 0.63 1.71 0.19 124 TR_XM_DK_SendGrid 1687 3.24 1.71 3.88 125 XM_B_REG_HTML 1686 0.99 1.71 0.70 126 RELAYCOUNTRY_JP 1670 0.51 1.69 0.03 127 RCVD_IN_IADB_LISTED 1669 2.98 1.69 3.51 128 HTML_IMAGE_ONLY_20 1633 0.62 1.65 0.20 129 XMGenDplmaNmb 1629 1.19 1.65 1.01 130 DIET_1 1606 0.92 1.62 0.63 131 XM_H_Long_From02 1594 1.13 1.61 0.93 132 T_XMDrugObfuBody_00 1581 0.93 1.60 0.65 133 RELAYCOUNTRY_DE 1578 0.70 1.60 0.33 134 XMBody_17 1564 0.97 1.58 0.71 135 T_XMHurry_00 1546 1.13 1.56 0.96 136 T_XMDrugObfuBody_08 1527 1.28 1.54 1.18 137 FORGED_GMAIL_RCVD 1514 0.76 1.53 0.44 138 MAILING_LIST_MULTI 1489 2.26 1.51 2.58 139 HTML_TAG_BALANCE_BODY 1483 0.96 1.50 0.74 140 HTML_EXTRA_CLOSE 1458 0.44 1.47 0.01 141 XM_H_PHPMailer 1417 0.90 1.43 0.68 142 BAD_ENC_HEADER 1389 0.42 1.40 0.01 143 RCVD_IN_IADB_SPF 1386 2.58 1.40 3.07 144 TM2_M_VERY_LONG_WORD 1346 1.23 1.36 1.18 145 URIBL_DBL_ABUSE_REDIR 1320 0.41 1.34 0.03 146 RCVD_IN_IADB_SENDERID 1308 2.30 1.32 2.71 147 RCVD_IN_IADB_DK 1300 2.24 1.31 2.62 148 HTML_OFF_PAGE 1262 0.38 1.28 0.01 149 RELAYCOUNTRY_AT 1256 0.53 1.27 0.22 150 XMSexyCombo_03 1254 0.37 1.27 0.00 151 RELAYCOUNTRY_NG 1210 0.36 1.22 0.00 152 XMSlimDrugH 1196 0.72 1.21 0.51 153 XMSubMetaSxObfu_03 1194 0.77 1.21 0.59 154 XMStockSpam_06 1193 0.91 1.21 0.79 155 HTML_IMAGE_ONLY_24 1174 0.50 1.19 0.22 156 XM_UB80 1170 0.37 1.18 0.03 157 MONEY_FROM_41 1161 0.34 1.17 0.00 158 URIBL_BLACK 1161 0.40 1.17 0.07 159 RELAYCOUNTRY_CL 1150 0.34 1.16 0.00 160 XM_RXBody 1138 0.52 1.15 0.26 161 T_Symld_Words_02 1120 0.66 1.13 0.46 162 XMBrknScrpt_02 1118 0.98 1.13 0.92 163 BAYES_20 1114 2.41 1.13 2.94 164 XM_H_PHPOS_M 1073 0.47 1.09 0.22 165 T_FILL_THIS_FORM_SHORT 1072 0.68 1.08 0.51 166 HK_RANDOM_FROM 1047 0.40 1.06 0.12 167 SUBJ_DOLLARS 1046 0.66 1.06 0.50 168 RDNS_DYNAMIC 1042 0.72 1.05 0.59 169 XMPhish30 1031 0.73 1.04 0.60 170 RELAYCOUNTRY_RU 1029 0.31 1.04 0.01 171 UNPARSEABLE_RELAY 1003 3.45 1.01 4.46 172 DATE_IN_PAST_06_12 983 0.34 0.99 0.07 173 HTML_IMAGE_ONLY_28 962 0.46 0.97 0.25 174 TR_XM_RelayPhish 961 0.82 0.97 0.76 175 HTML_IMAGE_ONLY_32 942 0.46 0.95 0.26 176 T_MONEY_PERCENT 934 0.53 0.94 0.36 177 TR_LOTS_OF_MONEY2 934 0.53 0.94 0.36 178 XMHTML_After_End 932 0.52 0.94 0.34 179 XM_DK_Undo_01 901 1.38 0.91 1.57 180 HTML_SHORT_LINK_IMG_1 893 0.30 0.90 0.05 181 DATE_IN_PAST_03_06 880 0.33 0.89 0.10 182 RCVD_IN_IADB_VOUCHED 867 1.87 0.88 2.29 183 XMBody_78 857 0.58 0.87 0.46 184 TO_NO_BRKTS_PCNT 849 0.25 0.86 0.00 185 FROM_SUSPICIOUS_NTLD 848 0.27 0.86 0.03 186 MONEY_FRAUD_8 847 0.25 0.86 0.00 187 PLING_QUERY 821 0.89 0.83 0.91 188 T_TooManySym_02 817 2.16 0.83 2.71 189 XM_HighProb1 813 0.25 0.82 0.02 190 NORDNS_LOW_CONTRAST 811 0.26 0.82 0.02 191 FROM_SUSPICIOUS_NTLD_FP 807 0.26 0.82 0.02 192 LOW_PRICE 805 0.38 0.81 0.20 193 DATE_IN_PAST_24_48 802 0.25 0.81 0.01 194 TR_Mismatch_TLD_02 801 0.28 0.81 0.06 195 FVGT_m_MULTI_ODD_EMAIL 797 0.27 0.81 0.05 196 BODY_URI_ONLY 780 0.26 0.79 0.04 197 BODY_ENHANCEMENT 777 0.26 0.79 0.04 198 XMGppyBdWords 776 0.30 0.78 0.10 199 FORM_FRAUD_5 774 0.23 0.78 0.00 200 XM_B_COPY_HTML 761 0.68 0.77 0.64 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 199454 86.32 93.34 83.42 2 DKIM_SIGNED 191788 79.81 78.84 80.21 3 XM_DK_Pass 188599 77.66 74.73 78.88 4 DKIM_VALID 183824 75.87 73.43 76.88 5 XM_B_Unicode 168610 71.10 72.50 70.52 6 DKIM_VALID_AU 149825 62.01 60.43 62.66 7 XMListUnsubscribeExists 136363 61.95 73.86 57.03 8 DCC_CHECK 121296 59.47 80.60 50.73 9 BAYES_50 116977 44.56 33.99 48.92 10 DCC_CHECK_NEGATIVE 115061 39.21 17.67 48.12 11 HTML_FONT_LOW_CONTRAST 81947 34.60 35.40 34.27 12 DKIM_VALID_EF 74005 26.93 17.21 30.95 13 LOC_TINY_FONT_1 69639 30.27 33.05 29.13 14 XMSubLong 56508 23.42 22.90 23.63 15 T_TM2_M_HEADER_IN_MSG 56066 22.40 19.85 23.45 16 MIME_HTML_ONLY 53119 25.28 32.68 22.22 17 FVGT_m_MULTI_ODD 52359 23.44 27.18 21.90 18 XM_DK_Undo_02 47212 28.14 48.45 19.75 19 BAYES_99 42289 24.90 42.35 17.69 20 BAYES_999 38319 21.94 36.25 16.03 21 T_KAM_HTML_FONT_INVALID 38122 16.32 17.24 15.94 22 ALL_TRUSTED 37820 11.79 2.06 15.82 23 MultiRelay 37512 16.22 17.51 15.69 24 XM_Multi_Part_URI 36992 15.78 16.54 15.47 25 RCVD_IN_RP_SAFE 36043 12.31 5.61 15.07 26 XM_Body_Dirty_Words 34338 16.55 21.84 14.36 27 RCVD_IN_RP_CERTIFIED 32339 10.73 3.95 13.53 28 XM_DKIMWhitelistDomains 31049 9.20 0.06 12.99 29 HTML_IMAGE_RATIO_02 28312 13.66 18.07 11.84 30 BAYES_00 28098 8.48 0.58 11.75 31 TR_XM_DK_Bayes 25827 7.71 0.24 10.80 32 TR_XM_DK_Bayes1 25324 7.56 0.23 10.59 33 TO_MALFORMED 24589 7.31 0.11 10.28 34 FSL_BULK_SIG 23535 9.94 10.16 9.84 35 RCVD_IN_MSPIKE_H2 23315 9.17 7.78 9.75 36 TR_DCC_Bayes_99 23098 16.90 34.40 9.66 37 TR_XM_DK_Bayes2 22992 6.87 0.22 9.62 38 XM_Evil_Numbers_Gen 22458 10.46 13.04 9.39 39 T_TooManySym_01 20925 7.24 3.57 8.75 40 XM_B_Phish_Phrases 19905 7.61 5.88 8.32 41 T_XMDrugObfuBody_14 19394 7.54 6.17 8.11 42 LOTS_OF_MONEY 18640 8.61 10.59 7.80 43 LotsOfNums_01 18268 7.37 6.73 7.64 44 TooManyTo_001 17285 7.36 7.69 7.23 45 XM_SendGrid 16756 6.03 3.67 7.01 46 HTML_IMAGE_RATIO_04 16279 7.58 9.44 6.81 47 XM_H_Long_From01 15881 7.11 8.25 6.64 48 BOTNET_IPINHOSTNAME 15795 9.52 16.56 6.61 49 RCVD_IN_MSPIKE_WL 15071 5.01 1.87 6.30 50 XMStrtUSub 15063 6.02 5.33 6.30 51 BAYES_60 14587 6.34 6.93 6.10 52 XM_UncommonTLD01 13631 6.57 8.69 5.70 53 RCVD_IN_MSPIKE_H3 13567 4.53 1.75 5.67 54 FROM_EXCESS_BASE64 12868 5.60 6.12 5.38 55 XM_B_SpammyTLD 12076 4.96 4.73 5.05 56 INVALID_MSGID 10770 3.23 0.14 4.50 57 UNPARSEABLE_RELAY 10667 3.45 1.01 4.46 58 RELAYCOUNTRY_META 10439 10.59 25.66 4.37 59 XMSubMetaSx_00 10319 5.63 8.82 4.32 60 XMSexyCombo_05 10197 6.21 10.90 4.26 61 MIME_QP_LONG_LINE 9743 3.89 3.45 4.07 62 BAYES_80 9340 5.16 8.19 3.91 63 TR_XM_DK_SendGrid 9272 3.24 1.71 3.88 64 TVD_RCVD_IP 9149 2.84 0.47 3.83 65 BAYES_40 8880 3.20 1.96 3.71 66 HTML_IMAGE_RATIO_06 8833 3.39 2.65 3.69 67 IN_ZIMBRA_NJ_WHITELIST 8694 2.58 0.02 3.64 68 XMNumbers 8447 3.56 3.62 3.53 69 RCVD_IN_IADB_LISTED 8401 2.98 1.69 3.51 70 MPART_ALT_DIFF 8250 4.55 7.20 3.45 71 T_REMOTE_IMAGE 8143 3.43 3.50 3.41 72 MIME_HTML_MOSTLY 8096 3.74 4.60 3.39 73 DKIM_INVALID 7964 3.94 5.41 3.33 74 RCVD_IN_IADB_SPF 7333 2.58 1.40 3.07 75 BAYES_20 7034 2.41 1.13 2.94 76 BAYES_95 6587 3.13 4.04 2.75 77 T_TooManySym_02 6487 2.16 0.83 2.71 78 RCVD_IN_IADB_SENDERID 6468 2.30 1.32 2.71 79 RCVD_IN_IADB_DK 6260 2.24 1.31 2.62 80 XM_DIRTYINTL 6234 3.71 6.38 2.61 81 MAILING_LIST_MULTI 6160 2.26 1.51 2.58 82 TR_MetaPhish_Combo_01 6117 1.98 0.57 2.56 83 XM_PDF 5939 1.82 0.22 2.48 84 XM_OfRef6 5803 2.42 2.40 2.43 85 BOTNET 5728 7.55 20.00 2.40 86 RCVD_IN_IADB_VOUCHED 5468 1.87 0.88 2.29 87 USER_IN_DEF_DKIM_WL 5435 1.61 0.01 2.27 88 HTML_MIME_NO_HTML_TAG 5165 3.20 5.73 2.16 89 IN_HORDE_ADDRESS_BOOK 4849 1.45 0.04 2.03 90 HTML_IMAGE_RATIO_08 4700 2.49 3.75 1.97 91 XM_CamelCaseFrm001 4580 2.29 3.20 1.92 92 BAYES_05 4554 1.53 0.64 1.90 93 XMBdyGiftCard01 4507 2.85 5.17 1.88 94 TM2_M_URI_OPT_OUT 4428 2.04 2.51 1.85 95 US_DOLLARS_3 4229 2.01 2.59 1.77 96 URI_HEX 4228 2.22 3.30 1.77 97 SUBJ_ALL_CAPS 4050 2.11 3.11 1.69 98 XMDiploma_00 4017 2.05 2.95 1.68 99 MIME_HTML_ONLY_MULTI 3901 2.17 3.46 1.63 100 URI_TRY_3LD 3860 1.70 1.90 1.61 101 RELAYCOUNTRY_CA 3806 2.29 3.99 1.59 102 XM_DK_Undo_01 3751 1.38 0.91 1.57 103 TR_Symld_Words 3611 1.57 1.72 1.51 104 RCVD_IN_IADB_OPTIN 3593 1.19 0.42 1.50 105 ANY_BOUNCE_MESSAGE 3570 1.10 0.16 1.49 106 BOUNCE_MESSAGE 3568 1.10 0.16 1.49 107 UNTRUSTED_Relay 3399 6.31 18.14 1.42 108 XMPhish11 3217 1.56 2.07 1.35 109 TooManyTo_002 3173 1.16 0.77 1.33 110 FILL_THIS_FORM 3166 1.07 0.45 1.32 111 XM_GoogleGroups 3124 1.06 0.46 1.31 112 NO_DNS_FOR_FROM 3107 1.67 2.58 1.30 113 RCVD_IN_MSPIKE_BL 2875 2.46 5.51 1.20 114 TM2_M_VERY_LONG_WORD 2820 1.23 1.36 1.18 115 T_XMDrugObfuBody_08 2814 1.28 1.54 1.18 116 T_FILL_THIS_FORM_LONG 2805 0.92 0.31 1.17 117 T_FILL_THIS_FORM_LOAN 2770 0.84 0.06 1.16 118 XMBody_95 2550 0.79 0.12 1.07 119 XMGenDplmaNmb 2403 1.19 1.65 1.01 120 KHOP_HELO_FCRDNS 2315 1.22 1.81 0.97 121 TooManyTo_003 2313 0.88 0.66 0.97 122 T_XMHurry_00 2285 1.13 1.56 0.96 123 XM_H_Long_From02 2226 1.13 1.61 0.93 124 XM_ProductURIs 2198 1.37 2.45 0.92 125 XMBrknScrpt_02 2196 0.98 1.13 0.92 126 PLING_QUERY 2178 0.89 0.83 0.91 127 DKIM_ADSP_CUSTOM_MED 2162 1.24 2.04 0.90 128 XM_SPF_SoftFail 2124 1.78 3.94 0.89 129 USER_IN_WHITELIST 2046 0.61 0.00 0.86 130 T_TooManySym_03 1998 0.65 0.20 0.84 131 XM_UB50 1977 3.72 10.70 0.83 132 XMStockSpam_06 1898 0.91 1.21 0.79 133 TooManyTo_004 1895 0.72 0.55 0.79 134 XMSubMetaSxObfu_02 1875 0.65 0.34 0.78 135 TR_XM_RelayPhish 1818 0.82 0.97 0.76 136 HTML_TAG_BALANCE_BODY 1770 0.96 1.50 0.74 137 XMBody_17 1706 0.97 1.58 0.71 138 XMGappySubj_01 1703 0.64 0.48 0.71 139 TM2_M_A_HREF_HREF 1689 0.67 0.57 0.71 140 XM_B_REG_HTML 1666 0.99 1.71 0.70 141 TooManyTo_005 1629 0.62 0.46 0.68 142 XM_H_PHPMailer 1625 0.90 1.43 0.68 143 TR_XM_PHPDW 1613 1.15 2.30 0.67 144 DKIM_ADSP_NXDOMAIN 1597 2.35 6.40 0.67 145 NML_ADSP_CUSTOM_MED 1573 1.03 1.93 0.66 146 T_XMDrugObfuBody_00 1565 0.93 1.60 0.65 147 TR_XM_PHPForged 1542 1.12 2.29 0.64 148 XM_B_COPY_HTML 1536 0.68 0.77 0.64 149 DIET_1 1512 0.92 1.62 0.63 150 HTML_FONT_FACE_BAD 1454 0.61 0.63 0.61 151 XMPhish30 1438 0.73 1.04 0.60 152 XMLngstWrd_00 1422 0.58 0.53 0.59 153 XMSubMetaSxObfu_03 1411 0.77 1.21 0.59 154 RDNS_DYNAMIC 1399 0.72 1.05 0.59 155 RCVD_IN_MSPIKE_L5 1393 1.73 4.51 0.58 156 TR_XM_FormFill2 1382 1.07 2.26 0.58 157 HELO_NODOT 1379 0.53 0.42 0.58 158 BODY_QUOTE_MALF_MSGID 1378 0.59 0.61 0.58 159 XM_H_PHPOS 1378 1.06 2.25 0.58 160 XMSexyCombo_01 1365 1.44 3.55 0.57 161 XMSubMetaI_00 1351 1.11 2.42 0.57 162 RCVD_IN_BL_SPAMCOP_NET 1324 2.42 6.92 0.55 163 XMLngstWrd_01 1295 0.53 0.52 0.54 164 TR_Caps_n_Bayes_99 1287 0.93 1.87 0.54 165 HELO_NO_DOMAIN 1286 0.50 0.42 0.54 166 XMBSHREFv2 1243 0.45 0.29 0.52 167 XMSlimDrugH 1227 0.72 1.21 0.51 168 XMHTMLBadTable_001 1216 0.56 0.69 0.51 169 T_FILL_THIS_FORM_SHORT 1213 0.68 1.08 0.51 170 SUBJ_DOLLARS 1200 0.66 1.06 0.50 171 HTTPS_HTTP_MISMATCH 1178 0.47 0.42 0.49 172 RELAYCOUNTRY_GB 1177 0.54 0.65 0.49 173 XM_URI_RBL 1171 0.90 1.91 0.49 174 XMBody_78 1109 0.58 0.87 0.46 175 RCVD_IN_MSPIKE_H5 1103 0.35 0.09 0.46 176 T_Symld_Words_02 1099 0.66 1.13 0.46 177 XMCapTrack 1081 0.37 0.17 0.45 178 XM_Body_Obfu01 1062 0.47 0.54 0.44 179 FORGED_GMAIL_RCVD 1062 0.76 1.53 0.44 180 T_TooManySym_04 1038 0.31 0.03 0.43 181 XMSubject_48 1023 0.32 0.07 0.43 182 XMGappySubj_02 986 0.36 0.25 0.41 183 XMLKML 957 0.28 0.00 0.40 184 XMNoVowels 956 0.34 0.20 0.40 185 RCVD_IN_MSPIKE_L4 951 0.50 0.74 0.40 186 RELAYCOUNTRY_AU 928 0.43 0.52 0.39 187 XM_Akamai 896 0.27 0.01 0.37 188 TR_LOTS_OF_MONEY2 871 0.53 0.94 0.36 189 T_MONEY_PERCENT 871 0.53 0.94 0.36 190 XM_ShortIntro_01 862 0.34 0.28 0.36 191 TM2_M_BODY_EMPTY 851 0.27 0.07 0.36 192 GAPPY_SUBJECT 848 0.36 0.38 0.35 193 REMOVE_BEFORE_LINK 837 0.34 0.31 0.35 194 XM_D_tchamptons_WL 836 0.25 0.00 0.35 195 XMHTML_After_End 822 0.52 0.94 0.34 196 NUMERIC_HTTP_ADDR 802 2.05 6.20 0.34 197 URI_NOVOWEL 789 0.43 0.68 0.33 198 XMPhish14 786 0.41 0.60 0.33 199 RELAYCOUNTRY_DE 779 0.70 1.60 0.33 200 SpammyFromTLD_01 777 0.75 1.78 0.32 ----------------------------------------------------------------------