Email: 582667 Autolearn: 0 AvgScore: 2.07 AvgScanTime: 2.10 sec Spam: 129879 Autolearn: 0 AvgScore: 13.68 AvgScanTime: 2.47 sec Ham: 452788 Autolearn: 0 AvgScore: -1.26 AvgScanTime: 1.99 sec Time Spent Running SA: 339.53 hours Time Spent Processing Spam: 88.99 hours Time Spent Processing Ham: 250.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126079 91.26 97.07 89.59 2 DCC_CHECK 106205 57.83 81.77 50.96 3 XM_B_Unicode 87078 72.44 67.05 73.99 4 DKIM_SIGNED 80944 69.76 62.32 71.89 5 XM_DK_Pass 77406 68.20 59.60 70.66 6 DKIM_VALID 72962 65.08 56.18 67.64 7 XMListUnsubscribeExists 67794 51.26 52.20 50.99 8 BAYES_50 60506 55.11 46.59 57.55 9 MIME_HTML_ONLY 59479 26.52 45.80 20.99 10 DKIM_VALID_AU 56467 50.98 43.48 53.13 11 XM_B_Unicode3 51660 40.67 39.78 40.92 12 HTML_FONT_LOW_CONTRAST 39739 28.54 30.60 27.95 13 XM_DK_Undo_02 39296 12.35 30.26 7.21 14 FSL_BULK_SIG 36634 11.72 28.21 6.99 15 LOC_TINY_FONT_1 34575 25.26 26.62 24.87 16 XM_Body_Dirty_Words 32471 22.82 25.00 22.20 17 XM_UncommonTLD01 31270 8.39 24.08 3.90 18 BAYES_99 30765 8.75 23.69 4.47 19 XM_B_Unsub 29055 19.15 22.37 18.23 20 XMSubLong 28179 19.98 21.70 19.49 21 RELAYCOUNTRY_META 27782 8.37 21.39 4.64 22 T_KAM_HTML_FONT_INVALID 27416 23.62 21.11 24.34 23 FVGT_m_MULTI_ODD 27043 19.72 20.82 19.40 24 BAYES_999 24216 7.01 18.65 3.68 25 TR_DCC_Bayes_99 24033 5.87 18.50 2.24 26 HTML_MIME_NO_HTML_TAG 23381 5.53 18.00 1.95 27 DKIM_VALID_EF 23314 23.46 17.95 25.04 28 SpammyFromTLD_02 21874 4.05 16.84 0.38 29 BOTNET 21692 5.19 16.70 1.88 30 DCC_CHECK_NEGATIVE 21228 40.57 16.34 47.52 31 T_REMOTE_IMAGE 20066 6.48 15.45 3.91 32 HTML_IMAGE_ONLY_08 19916 3.50 15.33 0.10 33 BOTNET_IPINHOSTNAME 19170 7.05 14.76 4.83 34 UNTRUSTED_Relay 18943 4.27 14.59 1.31 35 MultiRelay 18568 15.26 14.30 15.53 36 XMSexyCombo_05 17868 6.61 13.76 4.56 37 T_HTML_TAG_BALANCE_CENTER 17704 3.14 13.63 0.13 38 T_TM2_M_HEADER_IN_MSG 17690 20.84 13.62 22.92 39 HTML_IMAGE_RATIO_02 17489 9.74 13.47 8.67 40 BODY_URI_ONLY 17396 3.04 13.39 0.06 41 FROM_SUSPICIOUS_NTLD 17317 2.99 13.33 0.03 42 FROM_SUSPICIOUS_NTLD_FP 17291 2.99 13.31 0.02 43 DKIM_ADSP_NXDOMAIN 16882 4.05 13.00 1.49 44 HTML_SHORT_LINK_IMG_1 16851 2.91 12.97 0.02 45 KHOP_HELO_FCRDNS 15437 3.79 11.89 1.47 46 XM_Multi_Part_URI 14783 11.71 11.38 11.81 47 RDNS_DYNAMIC 14346 2.74 11.05 0.36 48 XM_BadFromFormat 14288 2.54 11.00 0.12 49 LOTS_OF_MONEY 14277 9.76 10.99 9.41 50 XM_Evil_Numbers_Gen 12820 9.49 9.87 9.39 51 TooManyTo_001 12301 12.86 9.47 13.83 52 XM_SPF_SoftFail 12208 3.10 9.40 1.30 53 BAYES_60 12045 6.05 9.27 5.12 54 XMSubMetaSx_00 11837 4.93 9.11 3.73 55 RCVD_IN_MSPIKE_H2 11494 12.62 8.85 13.71 56 XM_UB50 10825 2.38 8.33 0.67 57 XM_H_Long_From01 10626 6.54 8.18 6.07 58 SHORT_IMG_SUSP_NTLD 10472 1.80 8.06 0.00 59 MPART_ALT_DIFF 10300 5.11 7.93 4.30 60 BAYES_80 9943 3.75 7.66 2.63 61 TO_MALFORMED 9753 2.80 7.51 1.45 62 T_XMDrugObfuBody_14 9646 7.51 7.43 7.54 63 XM_B_Unsub2 8746 9.65 6.73 10.49 64 ALL_TRUSTED 8399 16.90 6.47 19.89 65 HTML_IMAGE_RATIO_04 8354 6.15 6.43 6.06 66 XMNumbers 8202 3.94 6.32 3.26 67 RCVD_IN_MSPIKE_BL 8097 1.93 6.23 0.70 68 DKIM_INVALID 7982 4.67 6.15 4.25 69 HDRS_LCASE_IMGONLY 7956 1.38 6.13 0.02 70 XMHTML_After_End 7754 2.16 5.97 1.07 71 TO_NO_BRKTS_DYNIP 7695 1.32 5.92 0.00 72 XM_DIRTYINTL 7432 3.54 5.72 2.92 73 FROM_MISSP_REPLYTO 7247 1.25 5.58 0.00 74 TooManyTo_002 6996 6.99 5.39 7.45 75 LotsOfNums_01 6943 6.96 5.35 7.43 76 RCVD_IN_MSPIKE_L5 6916 1.43 5.32 0.31 77 XM_B_Phish_Phrases 6873 5.92 5.29 6.09 78 MIME_HTML_MOSTLY 6612 2.86 5.09 2.23 79 MIME_HEADER_CTYPE_ONLY 6379 1.14 4.91 0.06 80 XMStrtUSub 6222 4.90 4.79 4.93 81 TooManyTo_003 6148 5.44 4.73 5.65 82 RCVD_IN_MSPIKE_WL 5978 8.70 4.60 9.87 83 XM_B_SpammyTLD 5929 3.71 4.57 3.46 84 RCVD_IN_MSPIKE_H3 5848 8.65 4.50 9.84 85 FROM_EXCESS_BASE64 5813 3.81 4.48 3.62 86 RELAYCOUNTRY_DE 5759 1.24 4.43 0.32 87 XM_CamelCaseFrm001 5403 2.59 4.16 2.14 88 TM2_M_URI_OPT_OUT 5311 2.40 4.09 1.92 89 MISSING_HEADERS 5301 1.18 4.08 0.34 90 TooManyTo_004 5272 4.14 4.06 4.17 91 TR_Mismatch_TLD_02 5158 0.93 3.97 0.05 92 XMSexyCombo_01 5051 1.69 3.89 1.06 93 RELAYCOUNTRY_CA 5025 2.12 3.87 1.62 94 BAYES_95 4921 2.11 3.79 1.62 95 MIME_HTML_ONLY_MULTI 4739 3.08 3.65 2.91 96 HDRS_MISSP 4706 0.82 3.62 0.02 97 HTML_IMAGE_RATIO_06 4701 3.85 3.62 3.91 98 XM_SendGrid 4601 5.56 3.54 6.14 99 FROM_MISSP_DYNIP 4419 0.76 3.40 0.00 100 HK_RANDOM_FROM 4334 0.83 3.34 0.11 101 DATE_IN_PAST_03_06 4304 0.81 3.31 0.09 102 DIET_1 4281 1.18 3.30 0.57 103 BAYES_40 4166 4.29 3.21 4.60 104 RELAYCOUNTRY_FR 3905 0.87 3.01 0.26 105 TooManyTo_005 3878 2.93 2.99 2.91 106 MIME_QP_LONG_LINE 3772 4.52 2.90 4.98 107 RCVD_IN_BL_SPAMCOP_NET 3652 1.38 2.81 0.97 108 XM_URI_RBL 3547 0.83 2.73 0.28 109 BAYES_20 3442 3.47 2.65 3.70 110 HTML_FONT_SIZE_HUGE 3315 0.64 2.55 0.09 111 URI_HEX 3293 1.54 2.54 1.25 112 NO_DNS_FOR_FROM 3293 2.19 2.54 2.09 113 T_TooManySym_01 3284 4.17 2.53 4.64 114 NORDNS_LOW_CONTRAST 3029 0.52 2.33 0.00 115 TR_XM_INV_DKIM 2917 0.64 2.25 0.18 116 XMDiploma_00 2884 1.62 2.22 1.45 117 RELAYCOUNTRY_GB 2829 1.07 2.18 0.75 118 TR_LOTS_OF_MONEY3 2822 1.41 2.17 1.20 119 XMSexyCombo_04 2773 0.87 2.14 0.51 120 SHORTENER_SHORT_IMG 2668 0.46 2.05 0.00 121 XM_OfRef6 2644 1.75 2.04 1.67 122 RCVD_IN_RP_SAFE 2614 9.16 2.01 11.21 123 XMMoneyMeta_00 2590 0.74 1.99 0.38 124 MultiRelay_Combo 2551 0.59 1.96 0.20 125 MultiRelay_CC 2551 0.59 1.96 0.20 126 SpammyFromTLD_01 2550 0.88 1.96 0.56 127 FSL_THIS_IS_ADV 2495 0.60 1.92 0.22 128 HTML_IMAGE_RATIO_08 2348 2.37 1.81 2.53 129 XM_Combo_Sbj 2337 0.73 1.80 0.42 130 RCVD_IN_RP_RNBL 2324 0.44 1.79 0.05 131 XMSubMetaI_00 2305 0.90 1.77 0.65 132 XM_UB60 2253 0.43 1.73 0.05 133 XMBdyGiftCard01 2162 1.35 1.66 1.26 134 SUBJ_ALL_CAPS 2149 1.85 1.65 1.90 135 TR_XM_DK_SendGrid 2141 3.13 1.65 3.55 136 XM_H_Long_From02 2137 1.48 1.65 1.44 137 SUBJECT_NEEDS_ENCODING 2119 0.37 1.63 0.01 138 SUBJ_ILLEGAL_CHARS 2113 0.37 1.63 0.01 139 BAYES_00 2051 14.14 1.58 17.74 140 XMPhish11 2046 1.15 1.58 1.03 141 T_XMDrugObfuBody_08 2043 1.35 1.57 1.28 142 SUSPICIOUS_RECIPS 2029 0.35 1.56 0.01 143 TR_XM_PHPDW 2025 0.77 1.56 0.54 144 HTML_IMAGE_ONLY_12 1986 0.46 1.53 0.15 145 FVGT_m_MULTI_ODD_EMAIL 1983 0.36 1.53 0.02 146 TR_XM_PHPForged 1966 0.75 1.51 0.53 147 TM2_M_VERY_LONG_WORD 1962 1.48 1.51 1.47 148 TR_XM_FormFill2 1957 0.75 1.51 0.53 149 XM_H_PHPOS 1952 0.74 1.50 0.52 150 XMStockSpam_06 1939 1.35 1.49 1.31 151 RCVD_IN_IADB_LISTED 1917 3.73 1.48 4.38 152 XMGenDplmaNmb 1906 0.99 1.47 0.85 153 T_XMDrugObfuBody_00 1901 0.78 1.46 0.58 154 BOTNET_NORDNS 1852 0.35 1.43 0.04 155 XM_H_PHPMailer 1812 0.59 1.40 0.36 156 XMBody_17 1800 0.95 1.39 0.82 157 RCVD_IN_RP_CERTIFIED 1790 8.16 1.38 10.11 158 DATE_IN_PAST_06_12 1762 0.33 1.36 0.04 159 XMSlimDrugH 1737 0.50 1.34 0.26 160 RCVD_IN_IADB_SPF 1733 3.24 1.33 3.79 161 T_XMHurry_00 1728 1.03 1.33 0.94 162 FROM_LOCAL_NOVOWEL 1722 0.31 1.33 0.02 163 RCVD_IN_IADB_DK 1701 2.82 1.31 3.25 164 XM_ProductURIs 1697 0.87 1.31 0.74 165 RCVD_IN_IADB_SENDERID 1669 2.88 1.29 3.33 166 XM_UB99 1667 0.29 1.28 0.01 167 URI_TRY_3LD 1659 1.42 1.28 1.47 168 XM_SPF_Unknown 1648 0.76 1.27 0.62 169 BAYES_05 1646 2.03 1.27 2.25 170 UNPARSEABLE_RELAY 1622 2.09 1.25 2.33 171 XMSubMetaSSx_00 1579 0.73 1.22 0.59 172 T_MONEY_PERCENT 1532 0.61 1.18 0.44 173 TR_LOTS_OF_MONEY2 1532 0.61 1.18 0.44 174 LongTLD 1511 0.35 1.16 0.12 175 BODY_SINGLE_WORD 1501 0.27 1.16 0.01 176 BODY_SINGLE_URI 1498 0.26 1.15 0.01 177 TR_XM_RelayPhish 1483 1.18 1.14 1.19 178 MSGID_RANDY 1424 0.34 1.10 0.12 179 TR_Symld_Words 1419 1.27 1.09 1.32 180 TR_XM_DK_Bayes 1404 10.52 1.08 13.23 181 REPLYTO_WITHOUT_TO_CC 1370 0.26 1.05 0.03 182 ADMITS_SPAM 1360 0.27 1.05 0.04 183 RCVD_IN_PSBL 1292 0.26 0.99 0.04 184 MAILING_LIST_MULTI 1281 1.67 0.99 1.86 185 TR_XM_DK_Bayes1 1264 10.04 0.97 12.65 186 URIBL_CSS_A 1248 0.51 0.96 0.38 187 URIBL_CSS 1248 0.51 0.96 0.38 188 URIBL_DBL_SPAM 1246 0.23 0.96 0.02 189 RELAYCOUNTRY_GR 1234 0.21 0.95 0.00 190 RELAYCOUNTRY_IN 1224 0.27 0.94 0.07 191 PLING_QUERY 1216 0.70 0.94 0.63 192 RCVD_IN_SORBS_DUL 1211 0.38 0.93 0.22 193 XMSubMetaSxObfu_03 1209 0.90 0.93 0.90 194 XMSubMetaSx_01 1187 0.28 0.91 0.10 195 TO_EQ_FM_DOM_HTML_IMG 1179 0.20 0.91 0.00 196 XMWghtMeta_00 1173 0.22 0.90 0.02 197 XM_UB999 1129 0.20 0.87 0.01 198 URI_NO_WWW_INFO_CGI 1116 0.21 0.86 0.03 199 XM_UB80 1110 0.20 0.85 0.01 200 XMBrknScrpt_02 1088 0.64 0.84 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 405672 91.26 97.07 89.59 2 XM_B_Unicode 335017 72.44 67.05 73.99 3 DKIM_SIGNED 325515 69.76 62.32 71.89 4 XM_DK_Pass 319946 68.20 59.60 70.66 5 DKIM_VALID 306261 65.08 56.18 67.64 6 BAYES_50 260581 55.11 46.59 57.55 7 DKIM_VALID_AU 240558 50.98 43.48 53.13 8 XMListUnsubscribeExists 230870 51.26 52.20 50.99 9 DCC_CHECK 230734 57.83 81.77 50.96 10 DCC_CHECK_NEGATIVE 215167 40.57 16.34 47.52 11 XM_B_Unicode3 185283 40.67 39.78 40.92 12 HTML_FONT_LOW_CONTRAST 126552 28.54 30.60 27.95 13 DKIM_VALID_EF 113362 23.46 17.95 25.04 14 LOC_TINY_FONT_1 112598 25.26 26.62 24.87 15 T_KAM_HTML_FONT_INVALID 110206 23.62 21.11 24.34 16 T_TM2_M_HEADER_IN_MSG 103759 20.84 13.62 22.92 17 XM_Body_Dirty_Words 100514 22.82 25.00 22.20 18 MIME_HTML_ONLY 95056 26.52 45.80 20.99 19 ALL_TRUSTED 90073 16.90 6.47 19.89 20 XMSubLong 88265 19.98 21.70 19.49 21 FVGT_m_MULTI_ODD 87850 19.72 20.82 19.40 22 XM_B_Unsub 82549 19.15 22.37 18.23 23 BAYES_00 80342 14.14 1.58 17.74 24 MultiRelay 70327 15.26 14.30 15.53 25 TooManyTo_001 62617 12.86 9.47 13.83 26 RCVD_IN_MSPIKE_H2 62064 12.62 8.85 13.71 27 TR_XM_DK_Bayes 59906 10.52 1.08 13.23 28 TR_XM_DK_Bayes1 57256 10.04 0.97 12.65 29 XM_Multi_Part_URI 53470 11.71 11.38 11.81 30 TR_XM_DK_Bayes2 52502 9.16 0.66 11.60 31 RCVD_IN_RP_SAFE 50752 9.16 2.01 11.21 32 XM_B_Unsub2 47488 9.65 6.73 10.49 33 RCVD_IN_RP_CERTIFIED 45762 8.16 1.38 10.11 34 RCVD_IN_MSPIKE_WL 44712 8.70 4.60 9.87 35 RCVD_IN_MSPIKE_H3 44543 8.65 4.50 9.84 36 LOTS_OF_MONEY 42589 9.76 10.99 9.41 37 XM_Evil_Numbers_Gen 42500 9.49 9.87 9.39 38 HTML_IMAGE_RATIO_02 39236 9.74 13.47 8.67 39 XM_DKIMWhitelistDomains 38391 6.62 0.16 8.48 40 T_XMDrugObfuBody_14 34121 7.51 7.43 7.54 41 TooManyTo_002 33749 6.99 5.39 7.45 42 LotsOfNums_01 33621 6.96 5.35 7.43 43 XM_DK_Undo_02 32667 12.35 30.26 7.21 44 FSL_BULK_SIG 31629 11.72 28.21 6.99 45 XM_SendGrid 27819 5.56 3.54 6.14 46 XM_B_Phish_Phrases 27597 5.92 5.29 6.09 47 XM_H_Long_From01 27489 6.54 8.18 6.07 48 HTML_IMAGE_RATIO_04 27456 6.15 6.43 6.06 49 TooManyTo_003 25576 5.44 4.73 5.65 50 BAYES_60 23178 6.05 9.27 5.12 51 MIME_QP_LONG_LINE 22541 4.52 2.90 4.98 52 XMStrtUSub 22308 4.90 4.79 4.93 53 BOTNET_IPINHOSTNAME 21891 7.05 14.76 4.83 54 T_TooManySym_01 21023 4.17 2.53 4.64 55 RELAYCOUNTRY_META 21008 8.37 21.39 4.64 56 BAYES_40 20850 4.29 3.21 4.60 57 XMSexyCombo_05 20665 6.61 13.76 4.56 58 BAYES_99 20236 8.75 23.69 4.47 59 RCVD_IN_IADB_LISTED 19818 3.73 1.48 4.38 60 MPART_ALT_DIFF 19484 5.11 7.93 4.30 61 DKIM_INVALID 19254 4.67 6.15 4.25 62 TooManyTo_004 18875 4.14 4.06 4.17 63 HTML_IMAGE_RATIO_06 17706 3.85 3.62 3.91 64 T_REMOTE_IMAGE 17685 6.48 15.45 3.91 65 XM_UncommonTLD01 17637 8.39 24.08 3.90 66 RCVD_IN_IADB_SPF 17155 3.24 1.33 3.79 67 XMSubMetaSx_00 16873 4.93 9.11 3.73 68 BAYES_20 16775 3.47 2.65 3.70 69 BAYES_999 16652 7.01 18.65 3.68 70 XM_PDF 16451 2.91 0.38 3.63 71 FROM_EXCESS_BASE64 16405 3.81 4.48 3.62 72 TR_XM_DK_SendGrid 16078 3.13 1.65 3.55 73 XM_B_SpammyTLD 15687 3.71 4.57 3.46 74 RCVD_IN_IADB_SENDERID 15089 2.88 1.29 3.33 75 XMNumbers 14746 3.94 6.32 3.26 76 RCVD_IN_IADB_DK 14736 2.82 1.31 3.25 77 IN_ZIMBRA_NJ_WHITELIST 13978 2.40 0.01 3.09 78 XM_DIRTYINTL 13210 3.54 5.72 2.92 79 MIME_HTML_ONLY_MULTI 13185 3.08 3.65 2.91 80 TooManyTo_005 13184 2.93 2.99 2.91 81 XM_H_Trusted_IP 12789 2.19 0.00 2.82 82 RCVD_IN_IADB_VOUCHED 12474 2.24 0.44 2.75 83 BAYES_80 11898 3.75 7.66 2.63 84 HTML_IMAGE_RATIO_08 11461 2.37 1.81 2.53 85 UNPARSEABLE_RELAY 10570 2.09 1.25 2.33 86 T_TooManySym_02 10178 1.90 0.71 2.25 87 BAYES_05 10176 2.03 1.27 2.25 88 TR_DCC_Bayes_99 10148 5.87 18.50 2.24 89 MIME_HTML_MOSTLY 10075 2.86 5.09 2.23 90 XM_CamelCaseFrm001 9693 2.59 4.16 2.14 91 NO_DNS_FOR_FROM 9459 2.19 2.54 2.09 92 TVD_RCVD_IP 8915 1.59 0.28 1.97 93 HTML_MIME_NO_HTML_TAG 8835 5.53 18.00 1.95 94 TM2_M_URI_OPT_OUT 8685 2.40 4.09 1.92 95 SUBJ_ALL_CAPS 8621 1.85 1.65 1.90 96 BOTNET 8526 5.19 16.70 1.88 97 MAILING_LIST_MULTI 8441 1.67 0.99 1.86 98 RCVD_IN_IADB_OPTIN 7924 1.43 0.31 1.75 99 ANY_BOUNCE_MESSAGE 7637 1.43 0.54 1.69 100 BOUNCE_MESSAGE 7632 1.43 0.54 1.69 101 XM_OfRef6 7556 1.75 2.04 1.67 102 CK_HELO_DYNAMIC_SPLIT_IP 7483 1.40 0.51 1.65 103 HELO_DYNAMIC_IPADDR2 7480 1.33 0.21 1.65 104 INVALID_MSGID 7375 1.33 0.27 1.63 105 BAYES_95 7348 2.11 3.79 1.62 106 RELAYCOUNTRY_CA 7340 2.12 3.87 1.62 107 IN_HORDE_ADDRESS_BOOK 7305 1.26 0.02 1.61 108 XMGappySubj_01 7198 1.30 0.28 1.59 109 DKIM_ADSP_NXDOMAIN 6724 4.05 13.00 1.49 110 TM2_M_VERY_LONG_WORD 6667 1.48 1.51 1.47 111 KHOP_HELO_FCRDNS 6661 3.79 11.89 1.47 112 URI_TRY_3LD 6644 1.42 1.28 1.47 113 TO_MALFORMED 6585 2.80 7.51 1.45 114 XMDiploma_00 6584 1.62 2.22 1.45 115 XM_H_Long_From02 6514 1.48 1.65 1.44 116 TR_Symld_Words 5990 1.27 1.09 1.32 117 USER_IN_DEF_DKIM_WL 5985 1.03 0.01 1.32 118 UNTRUSTED_Relay 5952 4.27 14.59 1.31 119 XMStockSpam_06 5951 1.35 1.49 1.31 120 XM_SPF_SoftFail 5875 3.10 9.40 1.30 121 T_XMDrugObfuBody_08 5818 1.35 1.57 1.28 122 T_FILL_THIS_FORM_SHORT 5694 1.09 0.49 1.26 123 XMBdyGiftCard01 5691 1.35 1.66 1.26 124 URI_HEX 5669 1.54 2.54 1.25 125 HTML_FONT_FACE_BAD 5597 1.12 0.70 1.24 126 TR_LOTS_OF_MONEY3 5420 1.41 2.17 1.20 127 XMSubNoVowel 5384 1.00 0.36 1.19 128 TR_XM_RelayPhish 5384 1.18 1.14 1.19 129 XM_DK_Undo_01 5196 1.06 0.74 1.15 130 AC_FROM_MANY_DOTS 4954 0.85 0.01 1.09 131 XMHTML_After_End 4835 2.16 5.97 1.07 132 XMSexyCombo_01 4817 1.69 3.89 1.06 133 XMPhish11 4650 1.15 1.58 1.03 134 DKIM_ADSP_CUSTOM_MED 4467 0.91 0.64 0.99 135 RCVD_IN_BL_SPAMCOP_NET 4404 1.38 2.81 0.97 136 T_XMHurry_00 4262 1.03 1.33 0.94 137 HELO_NODOT 4240 0.80 0.31 0.94 138 HELO_NO_DOMAIN 4239 0.80 0.31 0.94 139 XMSubMetaSxObfu_03 4060 0.90 0.93 0.90 140 XMCapTrack 3895 0.75 0.37 0.86 141 XMGenDplmaNmb 3859 0.99 1.47 0.85 142 XMBody_95 3840 0.68 0.10 0.85 143 XM_GoogleGroups 3745 0.71 0.29 0.83 144 XMBody_17 3707 0.95 1.39 0.82 145 XM_RXBody 3677 0.78 0.67 0.81 146 RELAYCOUNTRY_GB 3402 1.07 2.18 0.75 147 XM_ProductURIs 3367 0.87 1.31 0.74 148 TR_MetaPhish_Combo_01 3288 0.64 0.36 0.73 149 NML_ADSP_CUSTOM_MED 3248 0.67 0.52 0.72 150 XMGappySubj_02 3210 0.57 0.10 0.71 151 RCVD_IN_MSPIKE_BL 3150 1.93 6.23 0.70 152 FILL_THIS_FORM 3080 0.60 0.33 0.68 153 XMSolicitRefs_0 3075 0.64 0.53 0.68 154 XM_UB50 3032 2.38 8.33 0.67 155 XMSubMetaI_00 2948 0.90 1.77 0.65 156 PLING_QUERY 2851 0.70 0.94 0.63 157 XM_SPF_Unknown 2807 0.76 1.27 0.62 158 XMRcvdHeader_15 2775 0.48 0.00 0.61 159 XMSubMetaSSx_00 2660 0.73 1.22 0.59 160 T_XMDrugObfuBody_00 2648 0.78 1.46 0.58 161 XMBrknScrpt_02 2646 0.64 0.84 0.58 162 T_TooManySym_03 2613 0.49 0.18 0.58 163 DIET_1 2583 1.18 3.30 0.57 164 SpammyFromTLD_01 2552 0.88 1.96 0.56 165 XMPhish30 2498 0.60 0.76 0.55 166 FILL_THIS_FORM_LONG 2489 0.50 0.31 0.55 167 TR_XM_PHPDW 2467 0.77 1.56 0.54 168 HTML_IMAGE_ONLY_20 2460 0.48 0.28 0.54 169 FILL_THIS_FORM_LOAN 2415 0.45 0.15 0.53 170 XM_B_REG_HTML 2398 0.48 0.30 0.53 171 TR_XM_PHPForged 2386 0.75 1.51 0.53 172 TR_XM_FormFill2 2384 0.75 1.51 0.53 173 XM_B_COPY_HTML 2372 0.58 0.76 0.52 174 XM_H_PHPOS 2359 0.74 1.50 0.52 175 FROM_GOV_SPOOF 2350 0.49 0.37 0.52 176 T_OBFU_PDF_ATTACH 2333 0.43 0.12 0.52 177 XMSexyCombo_04 2290 0.87 2.14 0.51 178 USER_IN_WHITELIST 2272 0.39 0.00 0.50 179 XMHTMLBadTable_001 2218 0.53 0.69 0.49 180 XMNoVowels 2192 0.45 0.32 0.48 181 THIS_AD 2165 0.49 0.55 0.48 182 FORGED_GMAIL_RCVD 2137 0.49 0.55 0.47 183 XM_D_tchamptons_WL 2130 0.37 0.00 0.47 184 XMBSHREFv2 2117 0.42 0.28 0.47 185 XMLngstWrd_00 2081 0.44 0.36 0.46 186 XM_ShortIntro_01 2021 0.41 0.29 0.45 187 T_MONEY_PERCENT 1995 0.61 1.18 0.44 188 TR_LOTS_OF_MONEY2 1995 0.61 1.18 0.44 189 HTML_TAG_BALANCE_BODY 1975 0.46 0.53 0.44 190 XMSubMetaSxObfu_02 1966 0.40 0.27 0.43 191 XMLngstWrd_01 1947 0.41 0.36 0.43 192 HTTPS_HTTP_MISMATCH 1947 0.45 0.52 0.43 193 XMSUPPORT 1907 0.33 0.00 0.42 194 XM_Combo_Sbj 1907 0.73 1.80 0.42 195 TM2_M_A_HREF_HREF 1899 0.46 0.61 0.42 196 XM_H_SpoofStaff4 1899 0.33 0.01 0.42 197 XMBody_78 1795 0.47 0.75 0.40 198 RELAYCOUNTRY_AU 1785 0.38 0.32 0.39 199 XMOemUri 1781 0.34 0.14 0.39 200 XMMoneyMeta_00 1731 0.74 1.99 0.38 ----------------------------------------------------------------------