Email: 635770 Autolearn: 0 AvgScore: 1.42 AvgScanTime: 2.12 sec Spam: 102238 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 2.78 sec Ham: 533532 Autolearn: 0 AvgScore: -0.66 AvgScanTime: 2.00 sec Time Spent Running SA: 374.62 hours Time Spent Processing Spam: 78.95 hours Time Spent Processing Ham: 295.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96326 87.71 94.22 86.47 2 DCC_CHECK 81518 49.10 79.73 43.23 3 DKIM_SIGNED 80888 76.29 79.12 75.75 4 XM_DK_Pass 75348 74.21 73.70 74.30 5 XMListUnsubscribeExists 73091 56.35 71.49 53.44 6 XM_B_Unicode 73063 68.88 71.46 68.38 7 DKIM_VALID 70224 70.47 68.69 70.81 8 DKIM_VALID_AU 53217 52.94 52.05 53.10 9 BAYES_50 50969 50.83 49.85 51.02 10 XM_B_Unicode3 46776 40.78 45.75 39.83 11 HTML_FONT_LOW_CONTRAST 35234 29.43 34.46 28.47 12 MIME_HTML_ONLY 34841 22.29 34.08 20.03 13 LOC_TINY_FONT_1 33742 25.39 33.00 23.94 14 XM_DK_Undo_02 31859 9.38 31.16 5.21 15 RELAYCOUNTRY_META 28287 9.19 27.67 5.65 16 FVGT_m_MULTI_ODD 27657 23.05 27.05 22.28 17 XMSubLong 27315 22.47 26.72 21.65 18 DKIM_VALID_EF 23728 25.90 23.21 26.42 19 XM_Body_Dirty_Words 22426 16.08 21.94 14.96 20 BOTNET 22219 5.60 21.73 2.51 21 BAYES_99 21770 5.49 21.29 2.46 22 MultiRelay 20756 18.74 20.30 18.44 23 XM_Multi_Part_URI 19288 12.93 18.87 11.79 24 T_TM2_M_HEADER_IN_MSG 19184 27.07 18.76 28.66 25 T_KAM_HTML_FONT_INVALID 19107 18.38 18.69 18.32 26 DCC_CHECK_NEGATIVE 18849 49.01 18.44 54.87 27 BOTNET_IPINHOSTNAME 18408 7.25 18.01 5.18 28 UNTRUSTED_Relay 17434 4.29 17.05 1.84 29 TR_DCC_Bayes_99 17389 3.69 17.01 1.13 30 BAYES_999 16832 4.26 16.46 1.92 31 HTML_IMAGE_RATIO_02 14999 9.70 14.67 8.75 32 FSL_BULK_SIG 14130 8.26 13.82 7.19 33 XM_UncommonTLD01 13328 4.76 13.04 3.18 34 XM_Evil_Numbers_Gen 13176 9.79 12.89 9.20 35 LOTS_OF_MONEY 12257 9.17 11.99 8.62 36 DKIM_INVALID 10664 5.83 10.43 4.95 37 XMSexyCombo_05 10386 5.15 10.16 4.19 38 TooManyTo_001 10343 8.20 10.12 7.83 39 LotsOfNums_01 9063 8.78 8.86 8.76 40 XM_UB50 8767 2.08 8.58 0.84 41 SpammyFromTLD_02 8702 1.88 8.51 0.61 42 XMSubMetaSx_00 8519 4.42 8.33 3.67 43 MPART_ALT_DIFF 8367 4.20 8.18 3.43 44 T_XMDrugObfuBody_14 8204 8.27 8.02 8.32 45 XM_B_Phish_Phrases 7600 6.30 7.43 6.08 46 XM_H_Long_From01 7386 6.95 7.22 6.90 47 RCVD_IN_MSPIKE_H2 7172 7.56 7.02 7.67 48 XM_DIRTYINTL 6513 3.68 6.37 3.16 49 XM_B_SpammyTLD 6387 3.72 6.25 3.24 50 XM_SPF_SoftFail 6291 2.71 6.15 2.05 51 HTML_IMAGE_RATIO_04 6073 5.79 5.94 5.77 52 T_REMOTE_IMAGE 6046 4.01 5.91 3.65 53 MIME_HTML_MOSTLY 5993 2.87 5.86 2.29 54 BAYES_80 5877 2.57 5.75 1.96 55 HTML_MIME_NO_HTML_TAG 5663 2.78 5.54 2.25 56 BAYES_40 5640 6.11 5.52 6.22 57 HTML_IMAGE_RATIO_06 4967 4.12 4.86 3.98 58 MultiRelay_Combo 4910 1.00 4.80 0.27 59 MultiRelay_CC 4910 1.00 4.80 0.27 60 MIME_QP_LONG_LINE 4887 5.47 4.78 5.60 61 XM_URI_RBL 4640 1.00 4.54 0.33 62 KHOP_HELO_FCRDNS 4602 2.44 4.50 2.04 63 XMStrtUSub 4555 3.88 4.46 3.77 64 RCVD_IN_BL_SPAMCOP_NET 4545 1.30 4.45 0.69 65 XMNumbers 4501 3.54 4.40 3.38 66 BAYES_60 4428 3.88 4.33 3.79 67 TM2_M_URI_OPT_OUT 4362 4.72 4.27 4.80 68 BOTNET_NORDNS 4324 0.74 4.23 0.07 69 HTML_SHORT_LINK_IMG_1 4248 0.69 4.16 0.03 70 BAYES_20 4228 4.99 4.14 5.15 71 MIME_HTML_ONLY_MULTI 4175 2.20 4.08 1.84 72 BAYES_00 3898 21.10 3.81 24.41 73 RELAYCOUNTRY_CA 3865 1.97 3.78 1.62 74 DKIM_ADSP_NXDOMAIN 3791 1.09 3.71 0.58 75 URI_HEX 3683 2.45 3.60 2.23 76 XMSexyCombo_01 3654 1.04 3.57 0.55 77 RELAYCOUNTRY_FR 3640 0.92 3.56 0.41 78 T_TooManySym_01 3623 5.24 3.54 5.56 79 FROM_SUSPICIOUS_NTLD 3562 0.58 3.48 0.02 80 FROM_SUSPICIOUS_NTLD_FP 3514 0.57 3.44 0.02 81 XMBdyGiftCard01 3467 1.38 3.39 0.99 82 XM_SendGrid 3316 5.88 3.24 6.38 83 XM_CamelCaseFrm001 3289 2.37 3.22 2.20 84 RELAYCOUNTRY_GB 3262 1.42 3.19 1.08 85 XMDiploma_00 3226 2.05 3.16 1.83 86 NO_DNS_FOR_FROM 3098 1.39 3.03 1.07 87 T_HTML_TAG_BALANCE_CENTER 3075 0.55 3.01 0.07 88 FROM_EXCESS_BASE64 2979 3.08 2.91 3.11 89 HTML_IMAGE_RATIO_08 2906 2.29 2.84 2.19 90 BAYES_95 2889 1.43 2.83 1.16 91 BODY_URI_ONLY 2802 0.52 2.74 0.10 92 REPLYTO_WITHOUT_TO_CC 2733 0.46 2.67 0.04 93 URIBL_SBL_A 2723 0.88 2.66 0.54 94 RCVD_IN_PSBL 2655 0.45 2.60 0.03 95 XM_OfRef6 2652 1.66 2.59 1.49 96 RCVD_IN_RP_RNBL 2640 0.46 2.58 0.05 97 SpammyFromTLD_01 2610 1.08 2.55 0.80 98 TR_XM_PHPDW 2598 0.96 2.54 0.65 99 DATE_IN_PAST_06_12 2563 0.54 2.51 0.16 100 T_XMDrugObfuBody_08 2562 1.96 2.51 1.86 101 TR_XM_PHPForged 2544 0.94 2.49 0.65 102 TR_XM_FormFill2 2534 0.93 2.48 0.64 103 UNPARSEABLE_RELAY 2528 2.38 2.47 2.36 104 XM_H_PHPOS 2509 0.93 2.45 0.63 105 HTML_FONT_SIZE_HUGE 2468 0.46 2.41 0.09 106 FVGT_m_MULTI_ODD_EMAIL 2434 0.41 2.38 0.04 107 SUBJ_ALL_CAPS 2423 1.95 2.37 1.87 108 HTML_IMAGE_ONLY_08 2418 0.46 2.37 0.09 109 XMBody_17 2398 0.98 2.35 0.72 110 XMGenDplmaNmb 2341 1.28 2.29 1.09 111 XM_H_TOP 2310 0.37 2.26 0.00 112 BAYES_05 2294 3.34 2.24 3.55 113 HTML_IMAGE_ONLY_12 2289 0.52 2.24 0.19 114 TR_XM_DK_Bayes 2171 16.43 2.12 19.18 115 HDRS_LCASE_IMGONLY 2104 0.36 2.06 0.04 116 TR_XM_INV_DKIM 2103 0.40 2.06 0.08 117 RELAYCOUNTRY_RU 2097 0.35 2.05 0.02 118 XMSubMetaI_00 2088 0.88 2.04 0.66 119 MIME_HEADER_CTYPE_ONLY 2056 0.40 2.01 0.09 120 T_XMHurry_00 2034 0.97 1.99 0.78 121 INVALID_DATE 2029 0.38 1.98 0.08 122 ALL_TRUSTED 2013 13.91 1.97 16.20 123 XMPhish11 1993 1.20 1.95 1.06 124 TR_XM_RelayPhish 1952 1.04 1.91 0.87 125 TR_XM_DK_Bayes1 1938 15.67 1.90 18.31 126 XMStockSpam_06 1927 1.54 1.88 1.47 127 TO_EQ_FM_DOM_HTML_IMG 1926 0.31 1.88 0.01 128 FROM_MISSP_REPLYTO 1906 0.31 1.86 0.01 129 MPART_ALT_DIFF_COUNT 1855 0.51 1.81 0.26 130 TR_LOTS_OF_MONEY3 1824 0.79 1.78 0.60 131 DIET_1 1816 0.63 1.78 0.41 132 TM2_M_VERY_LONG_WORD 1811 1.41 1.77 1.35 133 TR_MetaPhish_Combo_01 1810 1.60 1.77 1.57 134 RELAYCOUNTRY_DE 1740 0.58 1.70 0.37 135 HTML_IMAGE_ONLY_20 1690 0.50 1.65 0.28 136 RCVD_IN_IADB_LISTED 1619 4.40 1.58 4.94 137 HTML_TAG_BALANCE_HEAD 1614 0.31 1.58 0.06 138 URIBL_DBL_SPAM 1581 0.28 1.55 0.04 139 TR_Symld_Words 1564 2.20 1.53 2.33 140 RELAYCOUNTRY_IN 1534 0.49 1.50 0.29 141 XM_H_PHPMailer 1528 0.71 1.49 0.56 142 T_TooManySym_02 1527 2.08 1.49 2.19 143 XMBrknScrpt_02 1522 0.85 1.49 0.73 144 T_XMDrugObfuBody_00 1522 0.94 1.49 0.83 145 RCVD_IN_IADB_SPF 1515 3.84 1.48 4.30 146 HDRS_MISSP 1501 0.24 1.47 0.00 147 XMSubMetaSSx_00 1500 0.46 1.47 0.27 148 RELAYCOUNTRY_AT 1497 0.44 1.46 0.24 149 DATE_IN_PAST_03_06 1494 0.39 1.46 0.18 150 RCVD_IN_RP_SAFE 1490 8.60 1.46 9.97 151 RCVD_IN_IADB_DK 1487 3.33 1.45 3.69 152 RCVD_IN_IADB_SENDERID 1486 3.36 1.45 3.73 153 URI_TRY_3LD 1485 1.29 1.45 1.25 154 RCVD_IN_SORBS_DUL 1423 0.55 1.39 0.39 155 XMSubject_70 1394 0.28 1.36 0.08 156 TooManyTo_002 1390 1.90 1.36 2.00 157 TR_XM_DK_SendGrid 1366 3.18 1.34 3.53 158 LOW_PRICE 1365 0.53 1.34 0.37 159 XM_XX_Yahoo 1364 0.36 1.33 0.18 160 TR_Mismatch_TLD_02 1350 0.28 1.32 0.08 161 XM_UB99 1330 0.21 1.30 0.00 162 DATE_IN_PAST_96_XX 1315 0.21 1.29 0.01 163 XM_DrugUnitList 1275 0.20 1.25 0.00 164 MAILING_LIST_MULTI 1275 2.29 1.25 2.49 165 ALIBABA_IMG_NOT_RCVD_ALI 1275 0.20 1.25 0.00 166 HOSTED_IMG_MULTI 1274 0.20 1.25 0.00 167 EBAY_IMG_NOT_RCVD_EBAY 1266 0.20 1.24 0.00 168 RDNS_DYNAMIC 1263 0.50 1.24 0.36 169 XM_H_PHPOS_M 1259 0.40 1.23 0.24 170 HTML_TAG_BALANCE_BODY 1249 0.67 1.22 0.57 171 T_Symld_Words_02 1249 0.71 1.22 0.62 172 RELAYCOUNTRY_NL 1237 0.32 1.21 0.15 173 RELAYCOUNTRY_GR 1224 0.19 1.20 0.00 174 XMMoneyMeta_00 1200 0.61 1.17 0.50 175 XMHTML_After_End 1191 0.63 1.16 0.53 176 HTML_FONT_FACE_BAD 1167 0.72 1.14 0.64 177 T_MONEY_PERCENT 1135 0.91 1.11 0.87 178 TR_LOTS_OF_MONEY2 1135 0.91 1.11 0.87 179 TooManyTo_003 1128 1.29 1.10 1.32 180 HOSTED_IMG_DIRECT_MX 1115 0.18 1.09 0.00 181 XM_UB60 1112 0.23 1.09 0.06 182 XMSexyCombo_04 1110 0.27 1.09 0.11 183 TR_XM_DK_Bayes2 1096 13.36 1.07 15.72 184 SUBJ_DOLLARS 1090 0.74 1.07 0.67 185 RCVD_IN_MSPIKE_WL 1088 4.72 1.06 5.42 186 XM_ProductURIs 1074 0.81 1.05 0.76 187 URIBL_DBL_ABUSE_REDIR 1062 0.17 1.04 0.01 188 XM_BadFromFormat 1061 0.26 1.04 0.11 189 PLING_QUERY 1053 0.60 1.03 0.52 190 HELO_NODOT 1049 1.50 1.03 1.59 191 HELO_NO_DOMAIN 1041 1.50 1.02 1.59 192 LONG_HEX_URI 1041 0.34 1.02 0.21 193 DKIM_ADSP_CUSTOM_MED 1036 1.00 1.01 1.00 194 XMPhish14 1034 0.55 1.01 0.46 195 XM_DK_Undo_01 1031 1.45 1.01 1.54 196 XMSlimDrugH 1018 0.43 1.00 0.32 197 HTML_EXTRA_CLOSE 1007 0.18 0.98 0.02 198 XMPhish30 990 0.65 0.97 0.59 199 XM_PDF 986 3.78 0.96 4.31 200 XM_UB999 981 0.16 0.96 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 461320 87.71 94.22 86.47 2 DKIM_SIGNED 404171 76.29 79.12 75.75 3 XM_DK_Pass 396435 74.21 73.70 74.30 4 DKIM_VALID 377772 70.47 68.69 70.81 5 XM_B_Unicode 364855 68.88 71.46 68.38 6 DCC_CHECK_NEGATIVE 292725 49.01 18.44 54.87 7 XMListUnsubscribeExists 285141 56.35 71.49 53.44 8 DKIM_VALID_AU 283329 52.94 52.05 53.10 9 BAYES_50 272219 50.83 49.85 51.02 10 DCC_CHECK 230672 49.10 79.73 43.23 11 XM_B_Unicode3 212515 40.78 45.75 39.83 12 T_TM2_M_HEADER_IN_MSG 152917 27.07 18.76 28.66 13 HTML_FONT_LOW_CONTRAST 151898 29.43 34.46 28.47 14 DKIM_VALID_EF 140955 25.90 23.21 26.42 15 BAYES_00 130241 21.10 3.81 24.41 16 LOC_TINY_FONT_1 127707 25.39 33.00 23.94 17 FVGT_m_MULTI_ODD 118894 23.05 27.05 22.28 18 XMSubLong 115513 22.47 26.72 21.65 19 MIME_HTML_ONLY 106881 22.29 34.08 20.03 20 TR_XM_DK_Bayes 102311 16.43 2.12 19.18 21 MultiRelay 98398 18.74 20.30 18.44 22 T_KAM_HTML_FONT_INVALID 97727 18.38 18.69 18.32 23 TR_XM_DK_Bayes1 97695 15.67 1.90 18.31 24 ALL_TRUSTED 86427 13.91 1.97 16.20 25 TR_XM_DK_Bayes2 83846 13.36 1.07 15.72 26 XM_Body_Dirty_Words 79790 16.08 21.94 14.96 27 XM_Multi_Part_URI 62898 12.93 18.87 11.79 28 RCVD_IN_RP_SAFE 53214 8.60 1.46 9.97 29 XM_Evil_Numbers_Gen 49077 9.79 12.89 9.20 30 LotsOfNums_01 46761 8.78 8.86 8.76 31 HTML_IMAGE_RATIO_02 46695 9.70 14.67 8.75 32 LOTS_OF_MONEY 46012 9.17 11.99 8.62 33 RCVD_IN_RP_CERTIFIED 44782 7.16 0.71 8.39 34 T_XMDrugObfuBody_14 44384 8.27 8.02 8.32 35 TooManyTo_001 41802 8.20 10.12 7.83 36 RCVD_IN_MSPIKE_H2 40910 7.56 7.02 7.67 37 FSL_BULK_SIG 38382 8.26 13.82 7.19 38 XM_H_Long_From01 36796 6.95 7.22 6.90 39 XM_DKIMWhitelistDomains 36426 5.75 0.11 6.83 40 XM_SendGrid 34057 5.88 3.24 6.38 41 BAYES_40 33210 6.11 5.52 6.22 42 XM_B_Phish_Phrases 32426 6.30 7.43 6.08 43 HTML_IMAGE_RATIO_04 30766 5.79 5.94 5.77 44 RELAYCOUNTRY_META 30134 9.19 27.67 5.65 45 MIME_QP_LONG_LINE 29888 5.47 4.78 5.60 46 T_TooManySym_01 29690 5.24 3.54 5.56 47 RCVD_IN_MSPIKE_WL 28935 4.72 1.06 5.42 48 XM_DK_Undo_02 27771 9.38 31.16 5.21 49 BOTNET_IPINHOSTNAME 27657 7.25 18.01 5.18 50 BAYES_20 27503 4.99 4.14 5.15 51 DKIM_INVALID 26399 5.83 10.43 4.95 52 RCVD_IN_IADB_LISTED 26337 4.40 1.58 4.94 53 TM2_M_URI_OPT_OUT 25633 4.72 4.27 4.80 54 RCVD_IN_MSPIKE_H3 25420 4.13 0.81 4.76 55 XM_PDF 23015 3.78 0.96 4.31 56 RCVD_IN_IADB_SPF 22922 3.84 1.48 4.30 57 XMSexyCombo_05 22380 5.15 10.16 4.19 58 HTML_IMAGE_RATIO_06 21249 4.12 4.86 3.98 59 ANY_BOUNCE_MESSAGE 21097 3.44 0.77 3.95 60 BOUNCE_MESSAGE 21096 3.44 0.76 3.95 61 BAYES_60 20237 3.88 4.33 3.79 62 XMStrtUSub 20095 3.88 4.46 3.77 63 RCVD_IN_IADB_SENDERID 19877 3.36 1.45 3.73 64 RCVD_IN_IADB_DK 19709 3.33 1.45 3.69 65 XMSubMetaSx_00 19599 4.42 8.33 3.67 66 T_REMOTE_IMAGE 19479 4.01 5.91 3.65 67 BAYES_05 18957 3.34 2.24 3.55 68 TR_XM_DK_SendGrid 18853 3.18 1.34 3.53 69 IN_ZIMBRA_NJ_WHITELIST 18620 2.93 0.02 3.49 70 MPART_ALT_DIFF 18304 4.20 8.18 3.43 71 XMNumbers 18018 3.54 4.40 3.38 72 XM_B_SpammyTLD 17286 3.72 6.25 3.24 73 XM_UncommonTLD01 16945 4.76 13.04 3.18 74 RCVD_IN_IADB_VOUCHED 16934 2.73 0.41 3.17 75 XM_DIRTYINTL 16885 3.68 6.37 3.16 76 FROM_EXCESS_BASE64 16598 3.08 2.91 3.11 77 TO_MALFORMED 13713 2.16 0.05 2.57 78 BOTNET 13367 5.60 21.73 2.51 79 MAILING_LIST_MULTI 13265 2.29 1.25 2.49 80 BAYES_99 13123 5.49 21.29 2.46 81 UNPARSEABLE_RELAY 12617 2.38 2.47 2.36 82 TR_Symld_Words 12405 2.20 1.53 2.33 83 MIME_HTML_MOSTLY 12226 2.87 5.86 2.29 84 HTML_MIME_NO_HTML_TAG 12012 2.78 5.54 2.25 85 URI_HEX 11883 2.45 3.60 2.23 86 XM_CamelCaseFrm001 11763 2.37 3.22 2.20 87 T_TooManySym_02 11706 2.08 1.49 2.19 88 HTML_IMAGE_RATIO_08 11674 2.29 2.84 2.19 89 XM_SPF_SoftFail 10923 2.71 6.15 2.05 90 KHOP_HELO_FCRDNS 10886 2.44 4.50 2.04 91 TVD_RCVD_IP 10862 1.80 0.57 2.04 92 TooManyTo_002 10685 1.90 1.36 2.00 93 RCVD_IN_IADB_OPTIN 10502 1.70 0.29 1.97 94 BAYES_80 10449 2.57 5.75 1.96 95 BAYES_999 10231 4.26 16.46 1.92 96 SUBJ_ALL_CAPS 9972 1.95 2.37 1.87 97 T_XMDrugObfuBody_08 9929 1.96 2.51 1.86 98 UNTRUSTED_Relay 9818 4.29 17.05 1.84 99 MIME_HTML_ONLY_MULTI 9796 2.20 4.08 1.84 100 XMDiploma_00 9780 2.05 3.16 1.83 101 RELAYCOUNTRY_CA 8628 1.97 3.78 1.62 102 CK_HELO_DYNAMIC_SPLIT_IP 8539 1.43 0.55 1.60 103 HELO_NODOT 8504 1.50 1.03 1.59 104 HELO_NO_DOMAIN 8503 1.50 1.02 1.59 105 HELO_DYNAMIC_IPADDR2 8494 1.35 0.10 1.59 106 TR_MetaPhish_Combo_01 8354 1.60 1.77 1.57 107 IN_HORDE_ADDRESS_BOOK 8237 1.30 0.03 1.54 108 XM_DK_Undo_01 8214 1.45 1.01 1.54 109 XM_OfRef6 7924 1.66 2.59 1.49 110 XMStockSpam_06 7860 1.54 1.88 1.47 111 INVALID_MSGID 7340 1.22 0.42 1.38 112 TM2_M_VERY_LONG_WORD 7181 1.41 1.77 1.35 113 TooManyTo_003 7058 1.29 1.10 1.32 114 URI_OPTOUT_3LD 6725 1.07 0.08 1.26 115 XMCapTrack 6707 1.10 0.27 1.26 116 URI_TRY_3LD 6694 1.29 1.45 1.25 117 BAYES_95 6191 1.43 2.83 1.16 118 TR_DCC_Bayes_99 6046 3.69 17.01 1.13 119 XM_GoogleGroups 5888 1.01 0.52 1.10 120 XMGenDplmaNmb 5805 1.28 2.29 1.09 121 RELAYCOUNTRY_GB 5771 1.42 3.19 1.08 122 NO_DNS_FOR_FROM 5711 1.39 3.03 1.07 123 T_FILL_THIS_FORM_SHORT 5639 1.03 0.88 1.06 124 XMPhish11 5631 1.20 1.95 1.06 125 USER_IN_DEF_DKIM_WL 5599 0.88 0.01 1.05 126 XM_H_Long_From02 5352 0.98 0.84 1.00 127 DKIM_ADSP_CUSTOM_MED 5338 1.00 1.01 1.00 128 XMBdyGiftCard01 5308 1.38 3.39 0.99 129 TooManyTo_004 5306 0.98 0.88 0.99 130 XMGappySubj_01 5200 0.88 0.40 0.97 131 TR_LOTS_OF_MONEY2 4648 0.91 1.11 0.87 132 T_MONEY_PERCENT 4648 0.91 1.11 0.87 133 TR_XM_RelayPhish 4639 1.04 1.91 0.87 134 XM_UB50 4479 2.08 8.58 0.84 135 TooManyTo_005 4446 0.82 0.75 0.83 136 T_XMDrugObfuBody_00 4437 0.94 1.49 0.83 137 SpammyFromTLD_01 4248 1.08 2.55 0.80 138 T_XMHurry_00 4137 0.97 1.99 0.78 139 XM_ProductURIs 4055 0.81 1.05 0.76 140 HTTPS_HTTP_MISMATCH 4025 0.76 0.81 0.75 141 XMNoVowels 3927 0.71 0.55 0.74 142 XM_RXBody 3913 0.67 0.32 0.73 143 XMBrknScrpt_02 3911 0.85 1.49 0.73 144 NML_ADSP_CUSTOM_MED 3885 0.75 0.89 0.73 145 XMBody_17 3826 0.98 2.35 0.72 146 XM_B_REG_HTML 3710 0.66 0.45 0.70 147 RCVD_IN_BL_SPAMCOP_NET 3693 1.30 4.45 0.69 148 SUBJ_DOLLARS 3589 0.74 1.07 0.67 149 XMSubMetaI_00 3506 0.88 2.04 0.66 150 TR_XM_PHPDW 3490 0.96 2.54 0.65 151 TR_XM_PHPForged 3452 0.94 2.49 0.65 152 HTML_FONT_FACE_BAD 3422 0.72 1.14 0.64 153 TR_XM_FormFill2 3404 0.93 2.48 0.64 154 XM_H_PHPOS 3384 0.93 2.45 0.63 155 T_Symld_Words_02 3295 0.71 1.22 0.62 156 SpammyFromTLD_02 3271 1.88 8.51 0.61 157 TR_LOTS_OF_MONEY3 3178 0.79 1.78 0.60 158 XMPhish30 3122 0.65 0.97 0.59 159 DKIM_ADSP_NXDOMAIN 3118 1.09 3.71 0.58 160 T_OBFU_PDF_ATTACH 3115 0.53 0.28 0.58 161 XMBody_95 3069 0.51 0.17 0.58 162 HTML_TAG_BALANCE_BODY 3035 0.67 1.22 0.57 163 XM_H_PHPMailer 2975 0.71 1.49 0.56 164 XMSexyCombo_01 2936 1.04 3.57 0.55 165 XMHTMLBadTable_001 2883 0.55 0.61 0.54 166 URIBL_SBL_A 2879 0.88 2.66 0.54 167 XMHTML_After_End 2835 0.63 1.16 0.53 168 FROM_GOV_DKIM_AU 2825 0.46 0.08 0.53 169 FORGED_GMAIL_RCVD 2816 0.56 0.74 0.53 170 XMBody_78 2792 0.54 0.60 0.52 171 T_TooManySym_03 2771 0.48 0.30 0.52 172 PLING_QUERY 2755 0.60 1.03 0.52 173 RELAYCOUNTRY_AU 2733 0.50 0.45 0.51 174 XM_ShortIntro_01 2732 0.57 0.89 0.51 175 XMMoneyMeta_00 2683 0.61 1.17 0.50 176 FILL_THIS_FORM 2669 0.48 0.36 0.50 177 FROM_GOV_SPOOF 2609 0.47 0.37 0.49 178 AC_DIV_BONANZA 2570 0.43 0.15 0.48 179 XMLngstWrd_00 2544 0.46 0.39 0.48 180 USER_IN_WHITELIST 2528 0.40 0.00 0.47 181 XMPhish14 2477 0.55 1.01 0.46 182 TM2_M_BODY_EMPTY 2430 0.41 0.16 0.46 183 SHORT_HELO_AND_INLINE_IMAGE 2417 0.39 0.08 0.45 184 URI_NOVOWEL 2406 0.50 0.78 0.45 185 XMLngstWrd_01 2363 0.43 0.34 0.44 186 RCVD_IN_MSPIKE_H5 2269 0.38 0.12 0.43 187 TM2_M_A_HREF_HREF 2242 0.48 0.79 0.42 188 HTML_IMAGE_ONLY_32 2191 0.38 0.22 0.41 189 XMSubMetaSxObfu_02 2188 0.40 0.37 0.41 190 RELAYCOUNTRY_FR 2184 0.92 3.56 0.41 191 XM_B_COPY_HTML 2180 0.43 0.53 0.41 192 DIET_1 2175 0.63 1.78 0.41 193 NUMERIC_HTTP_ADDR 2163 0.43 0.56 0.41 194 FILL_THIS_FORM_LONG 2161 0.38 0.28 0.41 195 HTML_IMAGE_ONLY_28 2161 0.41 0.46 0.41 196 MISSING_HEADERS 2138 0.48 0.90 0.40 197 RCVD_IN_SORBS_DUL 2070 0.55 1.39 0.39 198 FILL_THIS_FORM_LOAN 2007 0.34 0.13 0.38 199 REMOVE_BEFORE_LINK 1995 0.38 0.44 0.37 200 LOW_PRICE 1991 0.53 1.34 0.37 ----------------------------------------------------------------------