Email: 633306 Autolearn: 0 AvgScore: 1.53 AvgScanTime: 2.12 sec Spam: 98027 Autolearn: 0 AvgScore: 12.69 AvgScanTime: 2.62 sec Ham: 535279 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 2.03 sec Time Spent Running SA: 373.40 hours Time Spent Processing Spam: 71.44 hours Time Spent Processing Ham: 301.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87366 83.34 89.12 82.28 2 DCC_CHECK 75517 47.81 77.04 42.45 3 XM_B_Unicode 69294 67.53 70.69 66.96 4 DKIM_SIGNED 66120 72.12 67.45 72.98 5 XM_DK_Pass 63041 70.49 64.31 71.62 6 XMListUnsubscribeExists 62081 52.70 63.33 50.75 7 DKIM_VALID 59416 67.04 60.61 68.22 8 BAYES_50 46950 48.60 47.89 48.73 9 DKIM_VALID_AU 44658 50.61 45.56 51.54 10 XM_B_Unicode3 41640 39.70 42.48 39.19 11 MIME_HTML_ONLY 36389 22.24 37.12 19.51 12 HTML_FONT_LOW_CONTRAST 28527 28.06 29.10 27.87 13 XM_DK_Undo_02 28319 8.44 28.89 4.70 14 RELAYCOUNTRY_META 27630 9.02 28.19 5.51 15 LOC_TINY_FONT_1 26923 24.38 27.46 23.82 16 XMSubLong 25503 23.13 26.02 22.61 17 BOTNET 22147 5.50 22.59 2.37 18 FVGT_m_MULTI_ODD 22141 21.64 22.59 21.47 19 BAYES_99 22078 6.33 22.52 3.37 20 MultiRelay 20798 18.02 21.22 17.43 21 DCC_CHECK_NEGATIVE 20599 50.30 21.01 55.66 22 XM_Body_Dirty_Words 20486 15.73 20.90 14.79 23 DKIM_VALID_EF 19606 24.88 20.00 25.78 24 FSL_BULK_SIG 18461 9.34 18.83 7.61 25 T_TM2_M_HEADER_IN_MSG 17917 26.22 18.28 27.67 26 BOTNET_IPINHOSTNAME 17854 6.83 18.21 4.74 27 T_KAM_HTML_FONT_INVALID 17771 17.13 18.13 16.95 28 BAYES_999 17462 4.67 17.81 2.26 29 TR_DCC_Bayes_99 17331 3.57 17.68 0.98 30 UNTRUSTED_Relay 15927 3.97 16.25 1.72 31 XM_Multi_Part_URI 14741 12.32 15.04 11.83 32 LOTS_OF_MONEY 13381 9.25 13.65 8.45 33 HTML_IMAGE_RATIO_02 12909 8.96 13.17 8.19 34 XM_Evil_Numbers_Gen 12574 9.38 12.83 8.75 35 XM_UncommonTLD01 11059 4.97 11.28 3.81 36 XMSexyCombo_05 10626 5.35 10.84 4.35 37 T_REMOTE_IMAGE 10190 4.77 10.40 3.74 38 XM_UB50 8944 2.08 9.12 0.79 39 XM_H_Long_From01 8924 6.42 9.10 5.93 40 TooManyTo_001 8072 11.08 8.23 11.60 41 T_XMDrugObfuBody_14 7957 8.22 8.12 8.24 42 MPART_ALT_DIFF 7676 4.08 7.83 3.39 43 LotsOfNums_01 7503 8.50 7.65 8.65 44 XMSubMetaSx_00 7466 4.33 7.62 3.73 45 XM_SPF_SoftFail 7244 2.65 7.39 1.78 46 XM_B_Phish_Phrases 6973 5.40 7.11 5.09 47 DKIM_INVALID 6704 5.08 6.84 4.76 48 XM_DIRTYINTL 6632 3.60 6.77 3.02 49 HTML_IMAGE_RATIO_04 6322 6.00 6.45 5.91 50 RCVD_IN_MSPIKE_H2 6038 7.17 6.16 7.35 51 KHOP_HELO_FCRDNS 6005 2.48 6.13 1.81 52 BODY_URI_ONLY 5995 1.02 6.12 0.08 53 SpammyFromTLD_02 5853 1.34 5.97 0.49 54 BAYES_40 5825 5.97 5.94 5.98 55 HTML_SHORT_LINK_IMG_1 5573 0.90 5.69 0.03 56 BAYES_80 5452 3.61 5.56 3.25 57 HTML_MIME_NO_HTML_TAG 5410 2.61 5.52 2.08 58 RELAYCOUNTRY_FR 4936 1.23 5.04 0.53 59 BAYES_60 4856 4.38 4.95 4.28 60 MIME_QP_LONG_LINE 4839 5.66 4.94 5.80 61 XM_URI_RBL 4687 0.99 4.78 0.29 62 XMNumbers 4679 3.50 4.77 3.26 63 RELAYCOUNTRY_CA 4503 1.99 4.59 1.51 64 T_XMHurry_00 4328 1.30 4.42 0.73 65 RCVD_IN_BL_SPAMCOP_NET 4274 1.27 4.36 0.71 66 MIME_HTML_MOSTLY 4236 2.43 4.32 2.08 67 BAYES_20 4213 4.90 4.30 5.01 68 MIME_HTML_ONLY_MULTI 4196 2.31 4.28 1.95 69 XM_B_SpammyTLD 4071 4.03 4.15 4.00 70 FROM_MISSP_REPLYTO 4013 0.64 4.09 0.01 71 DKIM_ADSP_NXDOMAIN 3983 1.20 4.06 0.68 72 REPLYTO_WITHOUT_TO_CC 3962 0.66 4.04 0.04 73 T_FILL_THIS_FORM_SHORT 3899 1.65 3.98 1.23 74 ALL_TRUSTED 3894 16.90 3.97 19.27 75 BAYES_00 3851 20.74 3.93 23.82 76 RCVD_IN_PSBL 3693 0.62 3.77 0.04 77 TM2_M_URI_OPT_OUT 3669 3.38 3.74 3.32 78 HTML_IMAGE_RATIO_06 3651 3.21 3.72 3.11 79 HTML_IMAGE_ONLY_12 3613 0.71 3.69 0.16 80 XM_H_Long_From03 3443 0.63 3.51 0.10 81 XMLongAddy 3438 0.58 3.51 0.04 82 MIME_HEADER_CTYPE_ONLY 3380 0.63 3.45 0.11 83 RELAYCOUNTRY_JP 3320 0.55 3.39 0.03 84 TR_XM_PHPDW 3250 1.04 3.32 0.63 85 BOTNET_NORDNS 3216 0.59 3.28 0.09 86 XM_CamelCaseFrm001 3194 2.08 3.26 1.86 87 TR_XM_PHPForged 3190 1.02 3.25 0.61 88 XMDiploma_00 3181 1.93 3.25 1.69 89 TR_XM_FormFill2 3167 1.01 3.23 0.60 90 XM_OfRef6 3163 1.78 3.23 1.52 91 XM_H_PHPOS 3153 1.00 3.22 0.60 92 SUBJ_ALL_CAPS 3133 2.13 3.20 1.94 93 XMSubject_48 3102 0.52 3.16 0.04 94 US_DOLLARS_3 3100 1.44 3.16 1.12 95 XM_BadFromFormat 3085 0.57 3.15 0.10 96 TR_XM_FormFill 3073 0.52 3.13 0.04 97 FROM_EXCESS_BASE64 3052 3.23 3.11 3.25 98 ADVANCE_FEE_3_NEW 3013 0.48 3.07 0.00 99 XMStrtUSub 3012 3.59 3.07 3.69 100 FORM_FRAUD_3 3011 0.48 3.07 0.00 101 MultiRelay_CC 3009 0.69 3.07 0.26 102 MultiRelay_Combo 3009 0.69 3.07 0.26 103 URI_HEX 2988 2.05 3.05 1.86 104 RCVD_IN_RP_RNBL 2921 0.50 2.98 0.04 105 BAYES_95 2789 2.10 2.85 1.96 106 XM_SendGrid 2774 5.19 2.83 5.62 107 XMSexyCombo_01 2598 0.99 2.65 0.68 108 HTML_IMAGE_ONLY_24 2593 0.69 2.65 0.33 109 HTML_IMAGE_RATIO_08 2593 2.40 2.65 2.36 110 T_XMDrugObfuBody_08 2574 1.65 2.63 1.47 111 XMGenDplmaNmb 2529 1.24 2.58 1.00 112 TooManyTo_002 2494 5.02 2.54 5.47 113 T_TooManySym_01 2383 5.22 2.43 5.73 114 HTML_IMAGE_ONLY_08 2352 0.45 2.40 0.09 115 NO_DNS_FOR_FROM 2322 1.31 2.37 1.11 116 DATE_IN_PAST_96_XX 2322 0.37 2.37 0.01 117 HDRS_LCASE_IMGONLY 2302 0.39 2.35 0.04 118 XM_DrugUnitList 2282 0.36 2.33 0.00 119 ALIBABA_IMG_NOT_RCVD_ALI 2280 0.36 2.33 0.00 120 TooManyTo_003 2225 3.83 2.27 4.12 121 SpammyFromTLD_01 2191 1.10 2.24 0.90 122 TR_XM_DK_Bayes 2182 16.86 2.23 19.54 123 URIBL_DBL_ABUSE_REDIR 2152 0.35 2.20 0.01 124 TR_Symld_Words 2030 1.74 2.07 1.68 125 RELAYCOUNTRY_NL 2003 0.44 2.04 0.15 126 TR_XM_DK_Bayes1 1967 16.08 2.01 18.65 127 TR_XM_RelayPhish 1937 1.03 1.98 0.85 128 HOSTED_IMG_DIRECT_MX 1935 0.31 1.97 0.00 129 TR_Mismatch_TLD_01 1934 0.46 1.97 0.19 130 TooManyTo_004 1922 2.86 1.96 3.02 131 RCVD_IN_IADB_LISTED 1877 4.20 1.91 4.61 132 XMBody_78 1791 0.67 1.83 0.46 133 BAYES_05 1755 3.10 1.79 3.34 134 RCVD_IN_IADB_SPF 1726 3.69 1.76 4.04 135 T_HTML_TAG_BALANCE_CENTER 1703 0.35 1.74 0.10 136 T_XMDrugObfuBody_00 1695 0.85 1.73 0.69 137 RCVD_IN_IADB_DK 1685 3.24 1.72 3.52 138 RCVD_IN_IADB_SENDERID 1679 3.27 1.71 3.56 139 UNPARSEABLE_RELAY 1666 2.24 1.70 2.34 140 RELAYCOUNTRY_DE 1645 0.60 1.68 0.40 141 TM2_M_VERY_LONG_WORD 1644 1.31 1.68 1.24 142 RELAYCOUNTRY_GB 1633 1.19 1.67 1.11 143 XMBody_17 1622 0.80 1.65 0.65 144 XMPhish11 1596 1.28 1.63 1.21 145 XMBrknScrpt_02 1594 0.84 1.63 0.70 146 FVGT_m_MULTI_ODD_EMAIL 1556 0.27 1.59 0.03 147 RCVD_IN_RP_SAFE 1547 8.56 1.58 9.84 148 RDNS_DYNAMIC 1524 0.57 1.55 0.38 149 XM_H_PHPMailer 1509 0.70 1.54 0.55 150 TooManyTo_005 1506 2.06 1.54 2.15 151 NORDNS_LOW_CONTRAST 1503 0.24 1.53 0.01 152 XMSubMetaI_00 1488 1.00 1.52 0.91 153 T_MONEY_PERCENT 1483 0.67 1.51 0.52 154 TR_LOTS_OF_MONEY2 1483 0.67 1.51 0.52 155 RELAYCOUNTRY_AT 1473 0.40 1.50 0.20 156 NUMERIC_HTTP_ADDR 1451 0.50 1.48 0.32 157 XMBdyGiftCard01 1418 1.38 1.45 1.37 158 MAILING_LIST_MULTI 1398 2.19 1.43 2.33 159 TR_XM_DK_SendGrid 1347 2.84 1.37 3.11 160 TR_XM_DK_Bayes2 1335 13.72 1.36 15.98 161 XM_UB60 1324 0.26 1.35 0.06 162 XM_H_PHPOS_M 1324 0.37 1.35 0.19 163 XM_Combo_Sbj 1293 0.49 1.32 0.33 164 XM_H_Long_From02 1281 1.14 1.31 1.11 165 DATE_IN_PAST_03_06 1229 0.34 1.25 0.18 166 FROM_SUSPICIOUS_NTLD 1221 0.23 1.25 0.04 167 XMPhish30 1219 0.67 1.24 0.57 168 URIBL_BLACK 1192 0.21 1.22 0.02 169 HK_SCAM 1181 0.21 1.20 0.03 170 HELO_NODOT 1178 1.48 1.20 1.54 171 HELO_NO_DOMAIN 1176 1.48 1.20 1.54 172 DIET_1 1167 0.52 1.19 0.40 173 TR_Mismatch_TLD_02 1166 0.25 1.19 0.07 174 FSL_THIS_IS_ADV 1146 0.44 1.17 0.31 175 URIBL_CSS 1136 0.79 1.16 0.72 176 URIBL_CSS_A 1136 0.79 1.16 0.72 177 THIS_AD 1129 0.47 1.15 0.35 178 FROM_SUSPICIOUS_NTLD_FP 1125 0.21 1.15 0.04 179 FILL_THIS_FORM 1108 0.61 1.13 0.52 180 XM_OfRef7 1104 0.33 1.13 0.18 181 XMStockSpam_06 1104 1.19 1.13 1.20 182 PLING_QUERY 1099 0.52 1.12 0.41 183 DKIM_ADSP_CUSTOM_MED 1099 1.02 1.12 1.00 184 XMHTML_After_End 1096 0.52 1.12 0.41 185 TR_LOTS_OF_MONEY3 1090 0.48 1.11 0.37 186 NORMAL_HTTP_TO_IP 1089 0.21 1.11 0.04 187 RCVD_IN_MSPIKE_WL 1077 4.37 1.10 4.97 188 XMSexyCombo_04 1075 0.35 1.10 0.21 189 SUBJ_OBFU_PUNCT_FEW 1012 0.24 1.03 0.09 190 URIBL_SBL_A 1008 0.32 1.03 0.19 191 URI_TRY_3LD 1003 1.15 1.02 1.17 192 RCVD_IN_MSPIKE_H3 992 3.89 1.01 4.42 193 SHORT_URI 977 0.19 1.00 0.04 194 RELAYCOUNTRY_RO 972 0.17 0.99 0.02 195 TR_Caps_n_Bayes_99 938 0.17 0.96 0.03 196 XMSlimDrugH 934 0.45 0.95 0.35 197 HTML_FONT_FACE_BAD 928 0.63 0.95 0.57 198 FSL_HELO_NON_FQDN_1 925 0.15 0.94 0.01 199 XMMoneyMeta_00 908 0.62 0.93 0.57 200 URIBL_DBL_SPAM 894 0.17 0.91 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 440419 83.34 89.12 82.28 2 DKIM_SIGNED 390632 72.12 67.45 72.98 3 XM_DK_Pass 383363 70.49 64.31 71.62 4 DKIM_VALID 365161 67.04 60.61 68.22 5 XM_B_Unicode 358407 67.53 70.69 66.96 6 DCC_CHECK_NEGATIVE 297939 50.30 21.01 55.66 7 DKIM_VALID_AU 275881 50.61 45.56 51.54 8 XMListUnsubscribeExists 271646 52.70 63.33 50.75 9 BAYES_50 260844 48.60 47.89 48.73 10 DCC_CHECK 227239 47.81 77.04 42.45 11 XM_B_Unicode3 209790 39.70 42.48 39.19 12 HTML_FONT_LOW_CONTRAST 149196 28.06 29.10 27.87 13 T_TM2_M_HEADER_IN_MSG 148138 26.22 18.28 27.67 14 DKIM_VALID_EF 137985 24.88 20.00 25.78 15 BAYES_00 127525 20.74 3.93 23.82 16 LOC_TINY_FONT_1 127507 24.38 27.46 23.82 17 XMSubLong 121004 23.13 26.02 22.61 18 FVGT_m_MULTI_ODD 114931 21.64 22.59 21.47 19 TR_XM_DK_Bayes 104610 16.86 2.23 19.54 20 MIME_HTML_ONLY 104445 22.24 37.12 19.51 21 ALL_TRUSTED 103166 16.90 3.97 19.27 22 TR_XM_DK_Bayes1 99850 16.08 2.01 18.65 23 MultiRelay 93299 18.02 21.22 17.43 24 T_KAM_HTML_FONT_INVALID 90728 17.13 18.13 16.95 25 TR_XM_DK_Bayes2 85531 13.72 1.36 15.98 26 XM_Body_Dirty_Words 79160 15.73 20.90 14.79 27 XM_Multi_Part_URI 63305 12.32 15.04 11.83 28 TooManyTo_001 62101 11.08 8.23 11.60 29 RCVD_IN_RP_SAFE 52646 8.56 1.58 9.84 30 XM_Evil_Numbers_Gen 46828 9.38 12.83 8.75 31 LotsOfNums_01 46325 8.50 7.65 8.65 32 LOTS_OF_MONEY 45207 9.25 13.65 8.45 33 RCVD_IN_RP_CERTIFIED 44836 7.20 0.79 8.38 34 T_XMDrugObfuBody_14 44116 8.22 8.12 8.24 35 HTML_IMAGE_RATIO_02 43831 8.96 13.17 8.19 36 FSL_BULK_SIG 40714 9.34 18.83 7.61 37 RCVD_IN_MSPIKE_H2 39361 7.17 6.16 7.35 38 XM_DKIMWhitelistDomains 33867 5.35 0.03 6.33 39 BAYES_40 31997 5.97 5.94 5.98 40 XM_H_Long_From01 31716 6.42 9.10 5.93 41 HTML_IMAGE_RATIO_04 31647 6.00 6.45 5.91 42 MIME_QP_LONG_LINE 31034 5.66 4.94 5.80 43 T_TooManySym_01 30694 5.22 2.43 5.73 44 XM_SendGrid 30070 5.19 2.83 5.62 45 RELAYCOUNTRY_META 29503 9.02 28.19 5.51 46 TooManyTo_002 29294 5.02 2.54 5.47 47 XM_B_Phish_Phrases 27241 5.40 7.11 5.09 48 BAYES_20 26803 4.90 4.30 5.01 49 RCVD_IN_MSPIKE_WL 26622 4.37 1.10 4.97 50 DKIM_INVALID 25471 5.08 6.84 4.76 51 BOTNET_IPINHOSTNAME 25376 6.83 18.21 4.74 52 XM_DK_Undo_02 25142 8.44 28.89 4.70 53 RCVD_IN_IADB_LISTED 24696 4.20 1.91 4.61 54 RCVD_IN_MSPIKE_H3 23654 3.89 1.01 4.42 55 XMSexyCombo_05 23271 5.35 10.84 4.35 56 BAYES_60 22893 4.38 4.95 4.28 57 TooManyTo_003 22033 3.83 2.27 4.12 58 RCVD_IN_IADB_SPF 21637 3.69 1.76 4.04 59 XM_PDF 21533 3.54 0.88 4.02 60 XM_B_SpammyTLD 21436 4.03 4.15 4.00 61 XM_UncommonTLD01 20402 4.97 11.28 3.81 62 T_REMOTE_IMAGE 19995 4.77 10.40 3.74 63 XMSubMetaSx_00 19946 4.33 7.62 3.73 64 XMStrtUSub 19735 3.59 3.07 3.69 65 RCVD_IN_IADB_SENDERID 19060 3.27 1.71 3.56 66 RCVD_IN_IADB_DK 18833 3.24 1.72 3.52 67 IN_ZIMBRA_NJ_WHITELIST 18199 2.88 0.02 3.40 68 MPART_ALT_DIFF 18134 4.08 7.83 3.39 69 BAYES_99 18023 6.33 22.52 3.37 70 BAYES_05 17873 3.10 1.79 3.34 71 TM2_M_URI_OPT_OUT 17746 3.38 3.74 3.32 72 XMNumbers 17456 3.50 4.77 3.26 73 FROM_EXCESS_BASE64 17409 3.23 3.11 3.25 74 BAYES_80 17406 3.61 5.56 3.25 75 TO_MALFORMED 17150 2.71 0.01 3.20 76 TR_XM_DK_SendGrid 16668 2.84 1.37 3.11 77 HTML_IMAGE_RATIO_06 16648 3.21 3.72 3.11 78 XM_DIRTYINTL 16188 3.60 6.77 3.02 79 TooManyTo_004 16167 2.86 1.96 3.02 80 RCVD_IN_IADB_VOUCHED 15383 2.52 0.60 2.87 81 ANY_BOUNCE_MESSAGE 14839 2.43 0.57 2.77 82 BOUNCE_MESSAGE 14837 2.43 0.55 2.77 83 BOTNET 12678 5.50 22.59 2.37 84 HTML_IMAGE_RATIO_08 12610 2.40 2.65 2.36 85 UNPARSEABLE_RELAY 12514 2.24 1.70 2.34 86 MAILING_LIST_MULTI 12456 2.19 1.43 2.33 87 BAYES_999 12117 4.67 17.81 2.26 88 TooManyTo_005 11511 2.06 1.54 2.15 89 T_TooManySym_02 11478 1.93 0.76 2.14 90 MIME_HTML_MOSTLY 11135 2.43 4.32 2.08 91 HTML_MIME_NO_HTML_TAG 11125 2.61 5.52 2.08 92 INVALID_MSGID 10842 1.74 0.16 2.03 93 BAYES_95 10491 2.10 2.85 1.96 94 MIME_HTML_ONLY_MULTI 10440 2.31 4.28 1.95 95 SUBJ_ALL_CAPS 10384 2.13 3.20 1.94 96 XM_CamelCaseFrm001 9981 2.08 3.26 1.86 97 URI_HEX 9964 2.05 3.05 1.86 98 TVD_RCVD_IP 9897 1.69 0.79 1.85 99 KHOP_HELO_FCRDNS 9692 2.48 6.13 1.81 100 RCVD_IN_IADB_OPTIN 9634 1.58 0.41 1.80 101 XM_SPF_SoftFail 9549 2.65 7.39 1.78 102 UNTRUSTED_Relay 9203 3.97 16.25 1.72 103 XMDiploma_00 9066 1.93 3.25 1.69 104 TR_Symld_Words 8966 1.74 2.07 1.68 105 XM_DK_Undo_01 8557 1.49 0.89 1.60 106 CK_HELO_DYNAMIC_SPLIT_IP 8553 1.41 0.40 1.60 107 HELO_DYNAMIC_IPADDR2 8503 1.36 0.09 1.59 108 TR_MetaPhish_Combo_01 8285 1.43 0.80 1.55 109 HELO_NODOT 8219 1.48 1.20 1.54 110 HELO_NO_DOMAIN 8218 1.48 1.20 1.54 111 XM_OfRef6 8112 1.78 3.23 1.52 112 RELAYCOUNTRY_CA 8072 1.99 4.59 1.51 113 T_XMDrugObfuBody_08 7894 1.65 2.63 1.47 114 IN_HORDE_ADDRESS_BOOK 7704 1.22 0.03 1.44 115 XMBdyGiftCard01 7352 1.38 1.45 1.37 116 XMCapTrack 6860 1.13 0.30 1.28 117 TM2_M_VERY_LONG_WORD 6659 1.31 1.68 1.24 118 T_FILL_THIS_FORM_SHORT 6573 1.65 3.98 1.23 119 XMPhish11 6485 1.28 1.63 1.21 120 XMStockSpam_06 6425 1.19 1.13 1.20 121 URI_TRY_3LD 6259 1.15 1.02 1.17 122 USER_IN_DEF_DKIM_WL 6023 0.95 0.02 1.13 123 US_DOLLARS_3 6011 1.44 3.16 1.12 124 NO_DNS_FOR_FROM 5961 1.31 2.37 1.11 125 RELAYCOUNTRY_GB 5926 1.19 1.67 1.11 126 XM_H_Long_From02 5918 1.14 1.31 1.11 127 XM_GoogleGroups 5872 1.00 0.45 1.10 128 XMGappySubj_01 5421 0.91 0.33 1.01 129 XMGenDplmaNmb 5340 1.24 2.58 1.00 130 DKIM_ADSP_CUSTOM_MED 5334 1.02 1.12 1.00 131 TR_DCC_Bayes_99 5247 3.57 17.68 0.98 132 XMSubMetaI_00 4866 1.00 1.52 0.91 133 SpammyFromTLD_01 4803 1.10 2.24 0.90 134 TR_XM_RelayPhish 4557 1.03 1.98 0.85 135 XM_ShortIntro_01 4351 0.81 0.81 0.81 136 XM_UB50 4240 2.08 9.12 0.79 137 NML_ADSP_CUSTOM_MED 4048 0.76 0.78 0.76 138 T_XMHurry_00 3912 1.30 4.42 0.73 139 XM_ProductURIs 3877 0.74 0.81 0.72 140 URIBL_CSS 3846 0.79 1.16 0.72 141 URIBL_CSS_A 3846 0.79 1.16 0.72 142 T_Symld_Words_02 3810 0.74 0.87 0.71 143 RCVD_IN_BL_SPAMCOP_NET 3788 1.27 4.36 0.71 144 XM_B_REG_HTML 3770 0.66 0.44 0.70 145 XMBrknScrpt_02 3721 0.84 1.63 0.70 146 T_XMDrugObfuBody_00 3697 0.85 1.73 0.69 147 XMSexyCombo_01 3659 0.99 2.65 0.68 148 DKIM_ADSP_NXDOMAIN 3639 1.20 4.06 0.68 149 URI_OPTOUT_3LD 3573 0.58 0.07 0.67 150 XMBody_17 3454 0.80 1.65 0.65 151 T_TooManySym_03 3397 0.57 0.22 0.63 152 TR_XM_PHPDW 3352 1.04 3.32 0.63 153 TR_XM_PHPForged 3253 1.02 3.25 0.61 154 TR_XM_FormFill2 3215 1.01 3.23 0.60 155 XM_H_PHPOS 3186 1.00 3.22 0.60 156 T_OBFU_PDF_ATTACH 3113 0.54 0.28 0.58 157 HTML_FONT_FACE_BAD 3048 0.63 0.95 0.57 158 XMPhish30 3047 0.67 1.24 0.57 159 XMMoneyMeta_00 3026 0.62 0.93 0.57 160 HTTPS_HTTP_MISMATCH 3014 0.60 0.79 0.56 161 XM_H_PHPMailer 2952 0.70 1.54 0.55 162 RELAYCOUNTRY_AU 2905 0.53 0.43 0.54 163 RELAYCOUNTRY_FR 2859 1.23 5.04 0.53 164 XMNoVowels 2850 0.52 0.43 0.53 165 FILL_THIS_FORM 2783 0.61 1.13 0.52 166 TR_LOTS_OF_MONEY2 2759 0.67 1.51 0.52 167 T_MONEY_PERCENT 2759 0.67 1.51 0.52 168 FROM_GOV_DKIM_AU 2752 0.46 0.15 0.51 169 TM2_M_A_HREF_HREF 2682 0.55 0.79 0.50 170 HTML_TAG_BALANCE_BODY 2677 0.55 0.80 0.50 171 USER_IN_WHITELIST 2636 0.42 0.00 0.49 172 XMBody_95 2611 0.43 0.12 0.49 173 SpammyFromTLD_02 2610 1.34 5.97 0.49 174 FORGED_GMAIL_RCVD 2604 0.54 0.85 0.49 175 AC_DIV_BONANZA 2569 0.42 0.12 0.48 176 URI_NOVOWEL 2480 0.44 0.31 0.46 177 XMBody_78 2473 0.67 1.83 0.46 178 XM_B_COPY_HTML 2432 0.50 0.72 0.45 179 XMSubMetaSxObfu_03 2417 0.48 0.62 0.45 180 FILL_THIS_FORM_LONG 2370 0.49 0.76 0.44 181 TM2_M_BODY_EMPTY 2337 0.39 0.11 0.44 182 FROM_GOV_SPOOF 2310 0.43 0.44 0.43 183 RCVD_IN_MSPIKE_H5 2307 0.37 0.06 0.43 184 T_MANY_PILL_PRICE 2281 0.36 0.00 0.43 185 XMLngstWrd_00 2270 0.43 0.43 0.42 186 SHORT_HELO_AND_INLINE_IMAGE 2256 0.36 0.04 0.42 187 TVD_SPACE_RATIO 2255 0.40 0.27 0.42 188 XMHTMLBadTable_001 2253 0.43 0.47 0.42 189 FILL_THIS_FORM_LOAN 2209 0.42 0.46 0.41 190 MISSING_HEADERS 2197 0.48 0.87 0.41 191 PLING_QUERY 2196 0.52 1.12 0.41 192 XMHTML_After_End 2194 0.52 1.12 0.41 193 RELAYCOUNTRY_DE 2149 0.60 1.68 0.40 194 XM_RXBody 2132 0.39 0.37 0.40 195 DIET_1 2129 0.52 1.19 0.40 196 HTML_IMAGE_ONLY_28 2122 0.42 0.56 0.40 197 XMLngstWrd_01 2100 0.39 0.35 0.39 198 RDNS_DYNAMIC 2059 0.57 1.55 0.38 199 XMPhish14 2037 0.43 0.73 0.38 200 HTML_IMAGE_ONLY_32 2032 0.36 0.28 0.38 ----------------------------------------------------------------------