Email: 663630 Autolearn: 0 AvgScore: 0.89 AvgScanTime: 2.15 sec Spam: 94343 Autolearn: 0 AvgScore: 11.60 AvgScanTime: 3.00 sec Ham: 569287 Autolearn: 0 AvgScore: -0.88 AvgScanTime: 2.01 sec Time Spent Running SA: 396.57 hours Time Spent Processing Spam: 78.66 hours Time Spent Processing Ham: 317.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86983 83.15 92.20 81.65 2 DCC_CHECK 70622 46.41 74.86 41.70 3 DKIM_SIGNED 69334 72.55 73.49 72.39 4 XM_DK_Pass 66297 71.08 70.27 71.22 5 XM_B_Unicode 65344 66.06 69.26 65.53 6 DKIM_VALID 62374 67.71 66.11 67.97 7 XMListUnsubscribeExists 61374 52.14 65.05 50.00 8 DKIM_VALID_AU 48261 49.97 51.15 49.77 9 BAYES_50 45940 50.09 48.69 50.32 10 XM_B_Unicode3 45667 40.76 48.41 39.49 11 MIME_HTML_ONLY 35138 22.38 37.24 19.91 12 LOC_TINY_FONT_1 31651 24.88 33.55 23.45 13 XM_DK_Undo_02 29259 9.25 31.01 5.64 14 HTML_FONT_LOW_CONTRAST 28679 28.24 30.40 27.88 15 FVGT_m_MULTI_ODD 25505 21.52 27.03 20.60 16 XMSubLong 24625 21.32 26.10 20.52 17 DCC_CHECK_NEGATIVE 22284 51.91 23.62 56.60 18 RELAYCOUNTRY_META 21793 7.44 23.10 4.85 19 XM_Body_Dirty_Words 21735 14.41 23.04 12.98 20 XM_Multi_Part_URI 20353 13.96 21.57 12.70 21 BAYES_99 20174 5.57 21.38 2.95 22 DKIM_VALID_EF 18887 23.86 20.02 24.50 23 MultiRelay 17986 17.82 19.06 17.61 24 T_TM2_M_HEADER_IN_MSG 17511 25.00 18.56 26.07 25 BOTNET_IPINHOSTNAME 17456 6.64 18.50 4.68 26 T_KAM_HTML_FONT_INVALID 17216 17.51 18.25 17.39 27 BOTNET 16802 4.54 17.81 2.34 28 FSL_BULK_SIG 15837 8.26 16.79 6.85 29 BAYES_999 15627 4.41 16.56 2.40 30 TR_DCC_Bayes_99 15539 3.59 16.47 1.46 31 LOTS_OF_MONEY 15447 10.12 16.37 9.08 32 XM_Evil_Numbers_Gen 13898 10.36 14.73 9.64 33 XMSexyCombo_05 12678 5.24 13.44 3.89 34 HTML_IMAGE_RATIO_02 12462 9.70 13.21 9.11 35 UNTRUSTED_Relay 12371 3.29 13.11 1.67 36 XM_B_Phish_Phrases 11577 6.81 12.27 5.91 37 XM_UncommonTLD01 10975 4.37 11.63 3.17 38 XMSubMetaSx_00 10496 4.97 11.13 3.95 39 T_REMOTE_IMAGE 10277 4.81 10.89 3.80 40 T_XMDrugObfuBody_14 8857 7.96 9.39 7.72 41 HTML_IMAGE_RATIO_04 8544 5.73 9.06 5.18 42 MIME_QP_LONG_LINE 8279 6.03 8.78 5.57 43 XM_DIRTYINTL 8033 3.38 8.51 2.53 44 TooManyTo_001 7690 8.49 8.15 8.54 45 ALL_TRUSTED 7624 18.51 8.08 20.24 46 MPART_ALT_DIFF 7352 3.97 7.79 3.33 47 HTML_MIME_NO_HTML_TAG 7176 3.07 7.61 2.31 48 XM_SPF_SoftFail 7173 2.59 7.60 1.76 49 LotsOfNums_01 7044 8.01 7.47 8.10 50 DKIM_INVALID 6960 4.84 7.38 4.42 51 XMNumbers 6792 4.74 7.20 4.33 52 SpammyFromTLD_02 6570 1.41 6.96 0.49 53 XM_UB50 6409 1.57 6.79 0.70 54 XM_H_Long_From01 6366 6.34 6.75 6.27 55 KHOP_HELO_FCRDNS 6319 2.63 6.70 1.96 56 RCVD_IN_MSPIKE_H2 6102 7.43 6.47 7.59 57 BAYES_40 5783 6.52 6.13 6.58 58 BAYES_80 5248 2.43 5.56 1.92 59 XMSexyCombo_01 5146 1.32 5.45 0.64 60 MIME_HTML_ONLY_MULTI 4932 2.30 5.23 1.81 61 T_XMDrugObfuBody_08 4843 2.09 5.13 1.58 62 HTML_IMAGE_ONLY_12 4646 0.87 4.92 0.20 63 MIME_HTML_MOSTLY 4614 2.43 4.89 2.03 64 REPLYTO_WITHOUT_TO_CC 4576 0.72 4.85 0.04 65 RELAYCOUNTRY_GB 4372 1.47 4.63 0.94 66 HTML_IMAGE_RATIO_06 4344 4.12 4.60 4.04 67 XM_SendGrid 4315 5.81 4.57 6.01 68 BAYES_20 4280 5.23 4.54 5.35 69 XMPhish14 4156 1.04 4.41 0.49 70 XMStrtUSub 3895 4.61 4.13 4.69 71 TM2_M_URI_OPT_OUT 3817 4.10 4.05 4.11 72 BAYES_60 3801 3.90 4.03 3.88 73 MIME_HEADER_CTYPE_ONLY 3788 0.65 4.02 0.09 74 TR_XM_RelayPhish 3786 1.36 4.01 0.92 75 HTML_SHORT_LINK_IMG_1 3785 0.59 4.01 0.02 76 HDRS_LCASE_IMGONLY 3742 0.60 3.97 0.04 77 TO_EQ_FM_DOM_HTML_IMG 3682 0.56 3.90 0.00 78 XM_URI_RBL 3658 0.81 3.88 0.30 79 XMSubMetaSxObfu_03 3603 1.24 3.82 0.81 80 XMSexyCombo_04 3598 0.66 3.81 0.14 81 XM_B_SpammyTLD 3592 3.67 3.81 3.65 82 RELAYCOUNTRY_FR 3564 0.77 3.78 0.28 83 XMStockSpam_06 3542 1.38 3.75 0.98 84 RCVD_IN_BL_SPAMCOP_NET 3490 1.27 3.70 0.87 85 BAYES_00 3377 21.12 3.58 24.02 86 HTML_IMAGE_ONLY_08 3375 0.69 3.58 0.22 87 RELAYCOUNTRY_CA 3285 1.66 3.48 1.35 88 TR_MetaPhish_Sub_02 3277 0.61 3.47 0.14 89 URI_HEX 3200 2.15 3.39 1.94 90 FROM_EXCESS_BASE64 3080 3.42 3.26 3.45 91 XM_CamelCaseFrm001 2983 1.98 3.16 1.79 92 BAYES_95 2918 1.42 3.09 1.15 93 XMSubMetaSx_01 2855 0.52 3.03 0.11 94 SpammyFromTLD_01 2824 1.05 2.99 0.73 95 XMDiploma_00 2726 1.72 2.89 1.53 96 TR_XM_PHPDW 2691 0.86 2.85 0.53 97 TR_XM_PHPForged 2665 0.85 2.82 0.52 98 TR_XM_FormFill2 2650 0.84 2.81 0.51 99 XM_H_PHPOS 2641 0.83 2.80 0.51 100 T_TooManySym_01 2637 4.96 2.80 5.32 101 XM_OfRef6 2606 1.53 2.76 1.32 102 BAYES_05 2520 3.43 2.67 3.56 103 XMSolicitRefs_0 2480 0.76 2.63 0.45 104 HTML_IMAGE_RATIO_08 2449 2.24 2.60 2.19 105 RCVD_IN_RP_RNBL 2390 0.41 2.53 0.06 106 XMSexyCombo_02 2380 0.40 2.52 0.05 107 XM_RXBody 2380 0.65 2.52 0.35 108 MultiRelay_CC 2351 0.52 2.49 0.19 109 MultiRelay_Combo 2351 0.52 2.49 0.19 110 NO_DNS_FOR_FROM 2262 1.52 2.40 1.38 111 XMSubMetaI_00 2178 1.06 2.31 0.86 112 XM_DKIMWhitelistDomains 2142 6.29 2.27 6.95 113 BOTNET_NORDNS 2131 0.35 2.26 0.04 114 XM_B_Crypto 2033 0.36 2.15 0.06 115 RCVD_IN_PSBL 1993 0.31 2.11 0.01 116 TM2_M_VERY_LONG_WORD 1972 1.42 2.09 1.31 117 XMMoneyMeta_00 1964 0.65 2.08 0.42 118 PDS_BTC_ID 1955 0.34 2.07 0.05 119 XMGenDplmaNmb 1945 1.12 2.06 0.97 120 SUBJ_ALL_CAPS 1943 2.11 2.06 2.11 121 XMPhish11 1920 1.10 2.04 0.95 122 BITCOIN_EXTORT_01 1868 0.30 1.98 0.02 123 TR_XM_INV_DKIM 1865 0.42 1.98 0.16 124 GB_BITCOIN_NH 1862 0.30 1.97 0.02 125 T_XMDrugObfuBody_00 1839 1.17 1.95 1.04 126 T_Symld_Words_02 1837 0.80 1.95 0.61 127 RELAYCOUNTRY_DE 1769 0.50 1.88 0.27 128 RCVD_IN_IADB_LISTED 1763 4.80 1.87 5.28 129 DKIM_ADSP_NXDOMAIN 1753 0.97 1.86 0.83 130 DKIM_ADSP_CUSTOM_MED 1751 1.02 1.86 0.88 131 FROM_SUSPICIOUS_NTLD 1740 0.28 1.84 0.03 132 TR_XM_DK_SendGrid 1722 2.76 1.83 2.91 133 FROM_SUSPICIOUS_NTLD_FP 1707 0.27 1.81 0.02 134 HTML_FONT_FACE_BAD 1692 0.80 1.79 0.63 135 XM_H_PHPMailer 1691 0.67 1.79 0.48 136 RCVD_IN_IADB_SPF 1682 4.13 1.78 4.52 137 RCVD_IN_RP_SAFE 1652 8.70 1.75 9.85 138 RCVD_IN_IADB_SENDERID 1647 3.62 1.75 3.93 139 RCVD_IN_IADB_DK 1644 3.53 1.74 3.82 140 SUBJ_DOLLARS 1629 0.73 1.73 0.56 141 XMBdyGiftCard01 1622 1.77 1.72 1.77 142 NML_ADSP_CUSTOM_MED 1594 0.79 1.69 0.64 143 XM_H_PHPOS_M 1522 0.42 1.61 0.22 144 MAILING_LIST_MULTI 1498 1.86 1.59 1.91 145 XMBody_17 1366 0.82 1.45 0.71 146 TR_Symld_Words 1310 1.67 1.39 1.71 147 LOADSA_MONEY_COMBO 1301 0.22 1.38 0.03 148 HK_RANDOM_REPLYTO 1299 0.39 1.38 0.23 149 TR_XM_DK_Bayes 1280 15.52 1.36 17.86 150 XMBrknScrpt_02 1257 0.67 1.33 0.56 151 RDNS_DYNAMIC 1248 0.49 1.32 0.35 152 TM2_M_A_HREF_HREF 1194 0.87 1.27 0.80 153 LONG_HEX_URI 1178 0.34 1.25 0.18 154 XM_DK_Undo_01 1172 1.41 1.24 1.44 155 RELAYCOUNTRY_AT 1168 0.36 1.24 0.22 156 T_XMHurry_00 1141 0.66 1.21 0.57 157 XM_H_Long_From02 1128 1.10 1.20 1.08 158 RCVD_IN_MSPIKE_WL 1109 4.43 1.18 4.97 159 TR_XM_DK_Bayes1 1074 14.81 1.14 17.07 160 THIS_AD 1071 0.52 1.14 0.42 161 TooManyTo_002 1063 2.66 1.13 2.92 162 XMHTML_After_End 1060 0.49 1.12 0.39 163 DIET_1 1059 0.48 1.12 0.37 164 UNPARSEABLE_RELAY 1057 1.91 1.12 2.05 165 FORGED_GMAIL_RCVD 1036 0.53 1.10 0.43 166 T_MONEY_PERCENT 1027 0.37 1.09 0.26 167 TR_LOTS_OF_MONEY2 1027 0.37 1.09 0.26 168 XM_UB80 1017 0.16 1.08 0.01 169 TR_Mismatch_TLD_02 1009 0.21 1.07 0.07 170 XMPhish30 990 0.60 1.05 0.53 171 XM_UB99 968 0.16 1.03 0.01 172 URIBL_DBL_ABUSE_REDIR 968 0.15 1.03 0.01 173 MPART_ALT_DIFF_COUNT 947 0.42 1.00 0.33 174 XMSubMetaSxObfu_02 938 0.53 0.99 0.45 175 XM_B_COPY_HTML 936 0.47 0.99 0.38 176 XM_OfRef7 935 0.27 0.99 0.14 177 URIBL_SBL_A 926 0.47 0.98 0.38 178 T_TooManySym_02 925 1.97 0.98 2.13 179 XM_PDF 922 4.71 0.98 5.33 180 RCVD_IN_MSPIKE_H3 913 3.96 0.97 4.46 181 TooManyTo_003 884 1.91 0.94 2.07 182 XM_ProductURIs 867 0.71 0.92 0.68 183 URI_TRY_3LD 862 1.28 0.91 1.34 184 XM_UB60 835 0.16 0.89 0.04 185 TR_LOTS_OF_MONEY3 814 0.46 0.86 0.40 186 T_FILL_THIS_FORM_SHORT 805 0.89 0.85 0.89 187 RELAYCOUNTRY_IN 792 0.21 0.84 0.10 188 TR_XM_DK_Bayes2 786 12.76 0.83 14.73 189 TR_MetaPhish_Combo_01b 777 0.29 0.82 0.20 190 LongTLD 767 0.25 0.81 0.15 191 PLING_QUERY 764 0.60 0.81 0.57 192 T_HTML_TAG_BALANCE_CENTER 748 0.20 0.79 0.10 193 XMSubNoVowel 739 0.34 0.78 0.26 194 HELO_NODOT 738 1.16 0.78 1.22 195 XMBody_78 738 0.66 0.78 0.64 196 TooManyTo_004 736 1.42 0.78 1.53 197 HELO_NO_DOMAIN 736 1.16 0.78 1.22 198 XM_XX_Yahoo 735 0.29 0.78 0.21 199 DATE_IN_PAST_06_12 735 0.18 0.78 0.08 200 XMHTMLBadTable_001 728 0.59 0.77 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 464808 83.15 92.20 81.65 2 DKIM_SIGNED 412107 72.55 73.49 72.39 3 XM_DK_Pass 405423 71.08 70.27 71.22 4 DKIM_VALID 386950 67.71 66.11 67.97 5 XM_B_Unicode 373070 66.06 69.26 65.53 6 DCC_CHECK_NEGATIVE 322200 51.91 23.62 56.60 7 BAYES_50 286485 50.09 48.69 50.32 8 XMListUnsubscribeExists 284664 52.14 65.05 50.00 9 DKIM_VALID_AU 283348 49.97 51.15 49.77 10 DCC_CHECK 237396 46.41 74.86 41.70 11 XM_B_Unicode3 224815 40.76 48.41 39.49 12 HTML_FONT_LOW_CONTRAST 158723 28.24 30.40 27.88 13 T_TM2_M_HEADER_IN_MSG 148427 25.00 18.56 26.07 14 DKIM_VALID_EF 139472 23.86 20.02 24.50 15 BAYES_00 136759 21.12 3.58 24.02 16 LOC_TINY_FONT_1 133492 24.88 33.55 23.45 17 FVGT_m_MULTI_ODD 117276 21.52 27.03 20.60 18 XMSubLong 116833 21.32 26.10 20.52 19 ALL_TRUSTED 115227 18.51 8.08 20.24 20 MIME_HTML_ONLY 113353 22.38 37.24 19.91 21 TR_XM_DK_Bayes 101698 15.52 1.36 17.86 22 MultiRelay 100252 17.82 19.06 17.61 23 T_KAM_HTML_FONT_INVALID 98972 17.51 18.25 17.39 24 TR_XM_DK_Bayes1 97190 14.81 1.14 17.07 25 TR_XM_DK_Bayes2 83862 12.76 0.83 14.73 26 XM_Body_Dirty_Words 73872 14.41 23.04 12.98 27 XM_Multi_Part_URI 72287 13.96 21.57 12.70 28 RCVD_IN_RP_SAFE 56062 8.70 1.75 9.85 29 XM_Evil_Numbers_Gen 54856 10.36 14.73 9.64 30 HTML_IMAGE_RATIO_02 51880 9.70 13.21 9.11 31 LOTS_OF_MONEY 51692 10.12 16.37 9.08 32 TooManyTo_001 48638 8.49 8.15 8.54 33 RCVD_IN_RP_CERTIFIED 47813 7.30 0.68 8.40 34 LotsOfNums_01 46124 8.01 7.47 8.10 35 T_XMDrugObfuBody_14 43976 7.96 9.39 7.72 36 RCVD_IN_MSPIKE_H2 43235 7.43 6.47 7.59 37 XM_DKIMWhitelistDomains 39581 6.29 2.27 6.95 38 FSL_BULK_SIG 38973 8.26 16.79 6.85 39 ANY_BOUNCE_MESSAGE 38258 5.86 0.66 6.72 40 BOUNCE_MESSAGE 38255 5.86 0.66 6.72 41 BAYES_40 37462 6.52 6.13 6.58 42 XM_H_Long_From01 35681 6.34 6.75 6.27 43 XM_SendGrid 34211 5.81 4.57 6.01 44 XM_B_Phish_Phrases 33628 6.81 12.27 5.91 45 XM_DK_Undo_02 32120 9.25 31.01 5.64 46 MIME_QP_LONG_LINE 31709 6.03 8.78 5.57 47 BAYES_20 30452 5.23 4.54 5.35 48 XM_PDF 30318 4.71 0.98 5.33 49 T_TooManySym_01 30292 4.96 2.80 5.32 50 RCVD_IN_IADB_LISTED 30064 4.80 1.87 5.28 51 HTML_IMAGE_RATIO_04 29503 5.73 9.06 5.18 52 RCVD_IN_MSPIKE_WL 28271 4.43 1.18 4.97 53 RELAYCOUNTRY_META 27610 7.44 23.10 4.85 54 XMStrtUSub 26728 4.61 4.13 4.69 55 BOTNET_IPINHOSTNAME 26641 6.64 18.50 4.68 56 RCVD_IN_IADB_SPF 25707 4.13 1.78 4.52 57 RCVD_IN_MSPIKE_H3 25362 3.96 0.97 4.46 58 DKIM_INVALID 25157 4.84 7.38 4.42 59 XMNumbers 24661 4.74 7.20 4.33 60 TM2_M_URI_OPT_OUT 23420 4.10 4.05 4.11 61 HTML_IMAGE_RATIO_06 23005 4.12 4.60 4.04 62 XMSubMetaSx_00 22484 4.97 11.13 3.95 63 RCVD_IN_IADB_SENDERID 22380 3.62 1.75 3.93 64 XMSexyCombo_05 22117 5.24 13.44 3.89 65 BAYES_60 22071 3.90 4.03 3.88 66 RCVD_IN_IADB_DK 21762 3.53 1.74 3.82 67 T_REMOTE_IMAGE 21637 4.81 10.89 3.80 68 XM_B_SpammyTLD 20793 3.67 3.81 3.65 69 RCVD_IN_IADB_VOUCHED 20480 3.17 0.57 3.60 70 BAYES_05 20242 3.43 2.67 3.56 71 FROM_EXCESS_BASE64 19631 3.42 3.26 3.45 72 MPART_ALT_DIFF 18980 3.97 7.79 3.33 73 IN_ZIMBRA_NJ_WHITELIST 18640 2.81 0.02 3.27 74 XM_UncommonTLD01 18054 4.37 11.63 3.17 75 BAYES_99 16772 5.57 21.38 2.95 76 TooManyTo_002 16602 2.66 1.13 2.92 77 TR_XM_DK_SendGrid 16592 2.76 1.83 2.91 78 XM_DIRTYINTL 14415 3.38 8.51 2.53 79 TO_MALFORMED 14224 2.15 0.04 2.50 80 BAYES_999 13638 4.41 16.56 2.40 81 BOTNET 13313 4.54 17.81 2.34 82 HTML_MIME_NO_HTML_TAG 13178 3.07 7.61 2.31 83 RCVD_IN_IADB_OPTIN 13138 2.03 0.36 2.31 84 HTML_IMAGE_RATIO_08 12445 2.24 2.60 2.19 85 T_TooManySym_02 12117 1.97 0.98 2.13 86 SUBJ_ALL_CAPS 12032 2.11 2.06 2.11 87 TooManyTo_003 11781 1.91 0.94 2.07 88 UNPARSEABLE_RELAY 11649 1.91 1.12 2.05 89 MIME_HTML_MOSTLY 11529 2.43 4.89 2.03 90 KHOP_HELO_FCRDNS 11150 2.63 6.70 1.96 91 URI_HEX 11046 2.15 3.39 1.94 92 BAYES_80 10911 2.43 5.56 1.92 93 MAILING_LIST_MULTI 10848 1.86 1.59 1.91 94 TR_MetaPhish_Combo_01 10677 1.71 0.70 1.88 95 MIME_HTML_ONLY_MULTI 10312 2.30 5.23 1.81 96 XM_CamelCaseFrm001 10166 1.98 3.16 1.79 97 XMBdyGiftCard01 10099 1.77 1.72 1.77 98 XM_SPF_SoftFail 10031 2.59 7.60 1.76 99 TR_Symld_Words 9759 1.67 1.39 1.71 100 UNTRUSTED_Relay 9486 3.29 13.11 1.67 101 TVD_RCVD_IP 9445 1.51 0.58 1.66 102 T_XMDrugObfuBody_08 9020 2.09 5.13 1.58 103 TooManyTo_004 8714 1.42 0.78 1.53 104 XMDiploma_00 8684 1.72 2.89 1.53 105 TR_DCC_Bayes_99 8289 3.59 16.47 1.46 106 XM_DK_Undo_01 8214 1.41 1.24 1.44 107 CK_HELO_DYNAMIC_SPLIT_IP 8128 1.30 0.56 1.43 108 HELO_DYNAMIC_IPADDR2 8097 1.24 0.11 1.42 109 IN_HORDE_ADDRESS_BOOK 7928 1.20 0.05 1.39 110 NO_DNS_FOR_FROM 7857 1.52 2.40 1.38 111 RELAYCOUNTRY_CA 7709 1.66 3.48 1.35 112 URI_TRY_3LD 7621 1.28 0.91 1.34 113 INVALID_MSGID 7568 1.20 0.41 1.33 114 USER_IN_DEF_DKIM_WL 7560 1.14 0.02 1.33 115 XM_OfRef6 7516 1.53 2.76 1.32 116 TM2_M_VERY_LONG_WORD 7469 1.42 2.09 1.31 117 HELO_NODOT 6930 1.16 0.78 1.22 118 HELO_NO_DOMAIN 6929 1.16 0.78 1.22 119 TooManyTo_005 6534 1.08 0.68 1.15 120 BAYES_95 6531 1.42 3.09 1.15 121 URI_OPTOUT_3LD 6478 0.99 0.11 1.14 122 XMCapTrack 6313 1.00 0.31 1.11 123 XMGappySubj_01 6198 1.00 0.43 1.09 124 XM_H_Long_From02 6156 1.10 1.20 1.08 125 T_XMDrugObfuBody_00 5911 1.17 1.95 1.04 126 XMStockSpam_06 5605 1.38 3.75 0.98 127 XM_GoogleGroups 5552 0.92 0.59 0.98 128 XMGenDplmaNmb 5514 1.12 2.06 0.97 129 XMPhish11 5408 1.10 2.04 0.95 130 RELAYCOUNTRY_GB 5362 1.47 4.63 0.94 131 T_OBFU_PDF_ATTACH 5265 0.84 0.32 0.92 132 TR_XM_RelayPhish 5230 1.36 4.01 0.92 133 T_FILL_THIS_FORM_SHORT 5094 0.89 0.85 0.89 134 DKIM_ADSP_CUSTOM_MED 5038 1.02 1.86 0.88 135 RCVD_IN_BL_SPAMCOP_NET 4969 1.27 3.70 0.87 136 XMSubMetaI_00 4882 1.06 2.31 0.86 137 DKIM_ADSP_NXDOMAIN 4705 0.97 1.86 0.83 138 XMSubMetaSxObfu_03 4611 1.24 3.82 0.81 139 TM2_M_A_HREF_HREF 4581 0.87 1.27 0.80 140 SpammyFromTLD_01 4144 1.05 2.99 0.73 141 XMBody_17 4046 0.82 1.45 0.71 142 XM_UB50 3999 1.57 6.79 0.70 143 XM_ProductURIs 3856 0.71 0.92 0.68 144 NML_ADSP_CUSTOM_MED 3669 0.79 1.69 0.64 145 XMBody_78 3654 0.66 0.78 0.64 146 XMSexyCombo_01 3631 1.32 5.45 0.64 147 HTML_FONT_FACE_BAD 3589 0.80 1.79 0.63 148 T_Symld_Words_02 3466 0.80 1.95 0.61 149 XM_ShortIntro_01 3363 0.56 0.40 0.59 150 T_XMHurry_00 3259 0.66 1.21 0.57 151 PLING_QUERY 3248 0.60 0.81 0.57 152 XMBrknScrpt_02 3216 0.67 1.33 0.56 153 SUBJ_DOLLARS 3192 0.73 1.73 0.56 154 FROM_GOV_DKIM_AU 3184 0.51 0.21 0.56 155 XMHTMLBadTable_001 3175 0.59 0.77 0.56 156 TR_XM_PHPDW 2995 0.86 2.85 0.53 157 XMPhish30 2994 0.60 1.05 0.53 158 TR_XM_PHPForged 2948 0.85 2.82 0.52 159 TR_XM_FormFill2 2903 0.84 2.81 0.51 160 XM_H_PHPOS 2880 0.83 2.80 0.51 161 MISSING_HEADERS 2848 0.53 0.69 0.50 162 FROM_GOV_SPOOF 2829 0.50 0.51 0.50 163 XMBody_95 2816 0.43 0.07 0.49 164 SpammyFromTLD_02 2814 1.41 6.96 0.49 165 FILL_THIS_FORM 2804 0.51 0.60 0.49 166 HTTPS_HTTP_MISMATCH 2798 0.52 0.66 0.49 167 XMPhish14 2768 1.04 4.41 0.49 168 XMOemUri 2768 0.45 0.24 0.49 169 XM_H_PHPMailer 2751 0.67 1.79 0.48 170 HTML_TAG_BALANCE_BODY 2653 0.48 0.59 0.47 171 XM_B_REG_HTML 2607 0.44 0.32 0.46 172 XMSubMetaSxObfu_02 2584 0.53 0.99 0.45 173 USER_IN_WHITELIST 2578 0.39 0.00 0.45 174 T_TooManySym_03 2561 0.42 0.24 0.45 175 XMSolicitRefs_0 2536 0.76 2.63 0.45 176 HTML_FONT_SIZE_LARGE 2504 0.43 0.36 0.44 177 NUMERIC_HTTP_ADDR 2495 0.47 0.68 0.44 178 RELAYCOUNTRY_AU 2473 0.43 0.42 0.43 179 FORGED_GMAIL_RCVD 2463 0.53 1.10 0.43 180 HTML_IMAGE_ONLY_32 2441 0.41 0.28 0.43 181 THIS_AD 2409 0.52 1.14 0.42 182 FILL_THIS_FORM_LONG 2381 0.43 0.50 0.42 183 XMNoVowels 2377 0.43 0.47 0.42 184 XMMoneyMeta_00 2367 0.65 2.08 0.42 185 AC_DIV_BONANZA 2276 0.37 0.16 0.40 186 TM2_M_BODY_EMPTY 2276 0.36 0.14 0.40 187 TR_LOTS_OF_MONEY3 2257 0.46 0.86 0.40 188 HTML_IMAGE_ONLY_28 2236 0.39 0.36 0.39 189 URI_NOVOWEL 2233 0.39 0.36 0.39 190 XMHTML_After_End 2218 0.49 1.12 0.39 191 XM_B_COPY_HTML 2191 0.47 0.99 0.38 192 URIBL_SBL_A 2170 0.47 0.98 0.38 193 RELAYCOUNTRY_IE 2159 0.36 0.27 0.38 194 FILL_THIS_FORM_LOAN 2153 0.37 0.31 0.38 195 DIET_1 2107 0.48 1.12 0.37 196 REMOVE_BEFORE_LINK 2073 0.41 0.66 0.36 197 XMBSHREFv2 2069 0.38 0.47 0.36 198 RDNS_DYNAMIC 2000 0.49 1.32 0.35 199 XM_D_tchamptons_WL 1981 0.30 0.00 0.35 200 SHORT_HELO_AND_INLINE_IMAGE 1975 0.30 0.05 0.35 ----------------------------------------------------------------------