Email: 483191 Autolearn: 0 AvgScore: 2.91 AvgScanTime: 2.01 sec Spam: 138112 Autolearn: 0 AvgScore: 12.38 AvgScanTime: 2.40 sec Ham: 345079 Autolearn: 0 AvgScore: -0.88 AvgScanTime: 1.86 sec Time Spent Running SA: 270.45 hours Time Spent Processing Spam: 92.20 hours Time Spent Processing Ham: 178.24 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133348 82.16 96.55 76.40 2 DKIM_SIGNED 118908 69.38 86.10 62.69 3 XM_DK_Pass 115504 67.84 83.63 61.51 4 DKIM_VALID 114326 66.43 82.78 59.89 5 DCC_CHECK 112267 46.06 81.29 31.96 6 XMListUnsubscribeExists 109096 51.76 78.99 40.86 7 DKIM_VALID_AU 91075 50.18 65.94 43.88 8 XM_H_QuotedFrom 74989 38.45 54.30 32.10 9 XM_DK_Undo_02 70514 24.51 51.06 13.89 10 BAYES_99 64624 22.86 46.79 13.28 11 BAYES_999 56038 20.03 40.57 11.80 12 HTML_FONT_LOW_CONTRAST 54376 27.30 39.37 22.47 13 TR_DCC_Bayes_99 51131 15.01 37.02 6.20 14 LOC_TINY_FONT_1 49137 22.75 35.58 17.62 15 BAYES_50 43759 51.51 31.68 59.45 16 FVGT_m_MULTI_ODD 40778 20.98 29.53 17.56 17 MIME_HTML_ONLY 36946 20.85 26.75 18.49 18 XMSubLong 35822 19.57 25.94 17.02 19 T_TM2_M_HEADER_IN_MSG 27753 24.89 20.09 26.81 20 HTML_IMAGE_RATIO_02 26163 9.77 18.94 6.10 21 DKIM_VALID_EF 25833 20.17 18.70 20.75 22 XM_Body_Dirty_Words 25710 12.04 18.62 9.41 23 DCC_CHECK_NEGATIVE 23099 52.06 16.72 66.20 24 XM_Multi_Part_URI 22800 11.73 16.51 9.82 25 RELAYCOUNTRY_META 22784 7.94 16.50 4.51 26 BOTNET_IPINHOSTNAME 21739 7.76 15.74 4.56 27 XM_Evil_Numbers_Gen 20467 9.59 14.82 7.50 28 MultiRelay 19829 15.98 14.36 16.63 29 BOTNET 19735 4.77 14.29 0.96 30 T_KAM_HTML_FONT_INVALID 19021 10.69 13.77 9.45 31 LOTS_OF_MONEY 15123 7.26 10.95 5.78 32 T_XMDrugObfuBody_14 14120 8.01 10.22 7.12 33 XM_B_Phish_Phrases 13732 5.76 9.94 4.09 34 HTML_IMAGE_RATIO_04 13642 6.03 9.88 4.48 35 UNTRUSTED_Relay 13489 3.66 9.77 1.22 36 XMSexyCombo_05 13249 4.65 9.59 2.67 37 XM_UncommonTLD01 12699 5.72 9.19 4.33 38 LotsOfNums_01 12269 7.39 8.88 6.80 39 XM_H_Long_From01 11084 6.31 8.03 5.62 40 XMSubMetaSx_00 10903 4.54 7.89 3.20 41 TR_XM_DocInvoice 10482 4.76 7.59 3.63 42 TooManyTo_001 10344 7.10 7.49 6.94 43 RCVD_IN_RP_SAFE 9818 8.72 7.11 9.36 44 FROM_EXCESS_BASE64 9504 4.65 6.88 3.76 45 FSL_BULK_SIG 9383 6.04 6.79 5.74 46 BAYES_80 9286 5.00 6.72 4.32 47 MPART_ALT_DIFF 8917 3.70 6.46 2.60 48 BAYES_60 8070 6.02 5.84 6.09 49 RCVD_IN_RP_CERTIFIED 7885 7.41 5.71 8.09 50 RCVD_IN_RP_RNBL 7295 1.63 5.28 0.16 51 MIME_HTML_MOSTLY 7168 3.04 5.19 2.19 52 RCVD_IN_MSPIKE_H2 7024 4.95 5.09 4.90 53 XMStrtUSub 6271 4.73 4.54 4.81 54 XM_UB50 6095 1.78 4.41 0.73 55 XMNumbers 5987 4.18 4.33 4.11 56 HTML_IMAGE_RATIO_06 5947 3.38 4.31 3.01 57 XM_SPF_SoftFail 5604 2.64 4.06 2.08 58 MIME_QP_LONG_LINE 5484 4.10 3.97 4.15 59 TM2_M_URI_OPT_OUT 5472 2.21 3.96 1.51 60 BAYES_95 5458 2.98 3.95 2.59 61 XM_SendGrid 5278 4.37 3.82 4.59 62 XM_DIRTYINTL 5041 2.05 3.65 1.41 63 URI_HEX 4868 1.75 3.52 1.03 64 RELAYCOUNTRY_CA 4778 1.95 3.46 1.34 65 XM_CamelCaseFrm001 4720 2.03 3.42 1.47 66 HTML_IMAGE_RATIO_08 4649 2.15 3.37 1.66 67 DKIM_INVALID 4582 2.95 3.32 2.80 68 RCVD_IN_BL_SPAMCOP_NET 4281 1.28 3.10 0.55 69 T_TooManySym_01 4064 3.91 2.94 4.29 70 XMSubMetaI_00 3984 1.39 2.88 0.80 71 MIME_HTML_ONLY_MULTI 3833 1.55 2.78 1.06 72 XMDiploma_00 3437 1.71 2.49 1.39 73 XM_XX_Yahoo 3306 0.78 2.39 0.14 74 XM_URI_RBL 3220 0.76 2.33 0.13 75 T_REMOTE_IMAGE 3178 2.96 2.30 3.23 76 XM_OfRef6 3147 1.35 2.28 0.98 77 T_XMDrugObfuBody_08 3070 1.47 2.22 1.16 78 SpammyFromTLD_01 3051 1.86 2.21 1.72 79 MultiRelay_Combo 2998 0.73 2.17 0.16 80 MultiRelay_CC 2998 0.73 2.17 0.16 81 SpammyFromTLD_02 2986 0.89 2.16 0.38 82 XM_ProductURIs 2946 1.16 2.13 0.78 83 XMSexyCombo_01 2917 1.08 2.11 0.67 84 SUBJ_ALL_CAPS 2748 2.21 1.99 2.30 85 T_XMHurry_00 2698 0.95 1.95 0.55 86 T_MIXED_ES 2623 1.23 1.90 0.96 87 BOTNET_NORDNS 2544 0.55 1.84 0.03 88 HTML_MIME_NO_HTML_TAG 2514 2.59 1.82 2.89 89 XMBody_17 2439 0.72 1.77 0.30 90 XM_UB99 2424 0.51 1.76 0.01 91 XMPhish30 2392 0.85 1.73 0.50 92 URIBL_BLACK 2354 0.52 1.70 0.04 93 TR_LOTS_OF_MONEY3 2245 0.82 1.63 0.50 94 TR_XM_RelayPhish 2239 0.77 1.62 0.43 95 RCVD_IN_IADB_LISTED 2212 3.05 1.60 3.63 96 XM_H_Long_From02 2206 1.10 1.60 0.90 97 XM_B_COPY_HTML 2201 0.92 1.59 0.65 98 BAYES_00 2165 5.77 1.57 7.46 99 TM2_M_VERY_LONG_WORD 2084 0.91 1.51 0.67 100 T_Symld_Words_02 2078 0.65 1.50 0.31 101 BAYES_40 2039 2.70 1.48 3.19 102 XMStockSpam_06 2020 1.20 1.46 1.09 103 RCVD_IN_IADB_SPF 1991 2.66 1.44 3.15 104 T_XMDrugObfuBody_00 1904 1.21 1.38 1.14 105 XM_B_REG_HTML 1902 0.80 1.38 0.56 106 RCVD_IN_IADB_SENDERID 1895 2.38 1.37 2.79 107 TR_XM_DK_Bayes 1867 4.31 1.35 5.49 108 RCVD_IN_IADB_DK 1859 2.33 1.35 2.72 109 TR_XM_DK_Bayes1 1849 4.16 1.34 5.29 110 RELAYCOUNTRY_FR 1818 0.60 1.32 0.32 111 UNPARSEABLE_RELAY 1787 3.21 1.29 3.97 112 XM_S_JOY_D 1785 0.61 1.29 0.33 113 BAYES_20 1776 1.96 1.29 2.22 114 URIBL_DBL_SPAM 1764 0.37 1.28 0.01 115 XM_UB999 1760 0.37 1.27 0.01 116 XMGenDplmaNmb 1752 0.95 1.27 0.82 117 RELAYCOUNTRY_AT 1749 0.44 1.27 0.11 118 XM_HighProb1 1734 0.37 1.26 0.02 119 XMBdyGiftCard01 1734 0.85 1.26 0.69 120 LONG_JUNK_URI 1717 0.44 1.24 0.12 121 TR_XM_DK_Bayes2 1694 3.65 1.23 4.62 122 XMSubMetaSSx_00 1682 0.42 1.22 0.10 123 XMHTMLBadTable_001 1666 0.66 1.21 0.44 124 XM_DK_Undo_01 1662 1.51 1.20 1.63 125 RELAYCOUNTRY_DE 1657 0.54 1.20 0.28 126 DIET_1 1651 0.99 1.20 0.91 127 RELAYCOUNTRY_IN 1638 0.38 1.19 0.06 128 XM_RXBody 1590 0.83 1.15 0.70 129 FSL_THIS_IS_ADV 1540 0.39 1.12 0.11 130 RDNS_DYNAMIC 1505 0.59 1.09 0.39 131 MAILING_LIST_MULTI 1497 1.49 1.08 1.66 132 DKIM_ADSP_CUSTOM_MED 1495 1.10 1.08 1.11 133 URI_TRY_3LD 1454 0.70 1.05 0.56 134 RCVD_IN_IADB_VOUCHED 1430 2.56 1.04 3.17 135 REMOVE_BEFORE_LINK 1422 0.46 1.03 0.23 136 HTML_TAG_BALANCE_BODY 1408 0.61 1.02 0.45 137 ALL_TRUSTED 1406 20.31 1.02 28.03 138 XM_UB60 1400 0.35 1.01 0.08 139 ANY_BOUNCE_MESSAGE 1376 8.75 1.00 11.86 140 BOUNCE_MESSAGE 1374 8.75 0.99 11.85 141 NML_ADSP_CUSTOM_MED 1355 0.88 0.98 0.85 142 TR_Caps_n_Bayes_99 1316 0.32 0.95 0.06 143 TooManyTo_002 1311 1.67 0.95 1.95 144 XM_H_PHPOS 1306 1.24 0.95 1.36 145 T_FILL_THIS_FORM_SHORT 1292 0.64 0.94 0.53 146 RELAYCOUNTRY_CN 1288 0.39 0.93 0.17 147 DATE_IN_PAST_03_06 1276 0.31 0.92 0.06 148 HTML_FONT_FACE_BAD 1244 0.64 0.90 0.53 149 XM_Body_Obfu01 1243 0.45 0.90 0.26 150 FILL_THIS_FORM 1209 0.43 0.88 0.25 151 XMSubMetaSxObfu_04 1193 0.30 0.86 0.08 152 XMPhish11 1178 1.06 0.85 1.14 153 RELAYCOUNTRY_GB 1172 0.85 0.85 0.85 154 XMHTML_After_End 1151 0.41 0.83 0.25 155 MPART_ALT_DIFF_COUNT 1150 0.48 0.83 0.34 156 RELAYCOUNTRY_AU 1143 0.52 0.83 0.39 157 SUBJ_DOLLARS 1141 0.34 0.83 0.15 158 TR_LOTS_OF_MONEY2 1140 0.41 0.83 0.25 159 T_MONEY_PERCENT 1140 0.41 0.83 0.25 160 XMSubMetaSxObfu_03 1139 0.42 0.82 0.26 161 TooManyTo_003 1133 1.10 0.82 1.21 162 XMBrknScrpt_02 1114 0.60 0.81 0.51 163 XMBody_78 1100 0.63 0.80 0.57 164 XM_UB80 1099 0.24 0.80 0.02 165 DATE_IN_PAST_06_12 1089 0.24 0.79 0.03 166 FORGED_GMAIL_RCVD 1084 0.50 0.78 0.39 167 TR_Symld_Words 1082 2.62 0.78 3.36 168 PLING_QUERY 1079 0.39 0.78 0.24 169 ACT_NOW_CAPS 1072 0.26 0.78 0.06 170 RCVD_IN_PSBL 1070 0.34 0.77 0.16 171 XMMoneyMeta_00 1041 0.49 0.75 0.38 172 T_TooManySym_02 1006 1.42 0.73 1.69 173 XMClaimOffer 1005 0.30 0.73 0.13 174 NORDNS_LOW_CONTRAST 996 0.21 0.72 0.01 175 LongTLD 983 0.27 0.71 0.10 176 XM_PDF 957 3.68 0.69 4.87 177 BAYES_05 935 1.19 0.68 1.40 178 TooManyTo_004 929 0.81 0.67 0.87 179 XM_BadFromFormat 925 0.43 0.67 0.34 180 XMPhish14 923 0.41 0.67 0.30 181 TR_Mismatch_TLD_02 921 0.23 0.67 0.06 182 XM_H_PHPMailer 920 0.66 0.67 0.65 183 FROM_OFFERS 899 0.27 0.65 0.11 184 LOW_PRICE 898 0.30 0.65 0.16 185 TR_MetaPhish_Combo_01 882 0.70 0.64 0.73 186 HTML_IMAGE_ONLY_32 882 0.44 0.64 0.37 187 URI_NOVOWEL 871 0.49 0.63 0.43 188 XMSubNoVowel 854 0.47 0.62 0.42 189 FILL_THIS_FORM_LONG 851 0.30 0.62 0.18 190 XMSexyCombo_04 847 0.23 0.61 0.08 191 RELAYCOUNTRY_NL 821 0.36 0.59 0.26 192 TooManyTo_005 806 0.63 0.58 0.65 193 FILL_THIS_FORM_LOAN 801 0.28 0.58 0.16 194 RELAYCOUNTRY_IT 792 0.19 0.57 0.03 195 HTML_FONT_SIZE_HUGE 790 0.32 0.57 0.22 196 REPLYTO_WITHOUT_TO_CC 783 0.18 0.57 0.02 197 BODY_ENHANCEMENT 775 0.19 0.56 0.05 198 LONG_JUNK_URI2 766 0.19 0.55 0.05 199 HTTPS_HTTP_MISMATCH 762 0.32 0.55 0.23 200 XMGppyBdWords 748 0.23 0.54 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 263641 82.16 96.55 76.40 2 DCC_CHECK_NEGATIVE 228435 52.06 16.72 66.20 3 DKIM_SIGNED 216320 69.38 86.10 62.69 4 XM_DK_Pass 212274 67.84 83.63 61.51 5 DKIM_VALID 206666 66.43 82.78 59.89 6 BAYES_50 205138 51.51 31.68 59.45 7 DKIM_VALID_AU 151405 50.18 65.94 43.88 8 XMListUnsubscribeExists 140994 51.76 78.99 40.86 9 XM_H_QuotedFrom 110776 38.45 54.30 32.10 10 DCC_CHECK 110291 46.06 81.29 31.96 11 ALL_TRUSTED 96728 20.31 1.02 28.03 12 T_TM2_M_HEADER_IN_MSG 92530 24.89 20.09 26.81 13 HTML_FONT_LOW_CONTRAST 77548 27.30 39.37 22.47 14 DKIM_VALID_EF 71613 20.17 18.70 20.75 15 MIME_HTML_ONLY 63802 20.85 26.75 18.49 16 LOC_TINY_FONT_1 60806 22.75 35.58 17.62 17 FVGT_m_MULTI_ODD 60608 20.98 29.53 17.56 18 XMSubLong 58737 19.57 25.94 17.02 19 MultiRelay 57400 15.98 14.36 16.63 20 XM_DK_Undo_02 47916 24.51 51.06 13.89 21 BAYES_99 45827 22.86 46.79 13.28 22 ANY_BOUNCE_MESSAGE 40913 8.75 1.00 11.86 23 BOUNCE_MESSAGE 40908 8.75 0.99 11.85 24 BAYES_999 40725 20.03 40.57 11.80 25 XM_DKIMWhitelistDomains 36504 7.60 0.14 10.58 26 XM_Multi_Part_URI 33888 11.73 16.51 9.82 27 T_KAM_HTML_FONT_INVALID 32616 10.69 13.77 9.45 28 XM_Body_Dirty_Words 32471 12.04 18.62 9.41 29 RCVD_IN_RP_SAFE 32308 8.72 7.11 9.36 30 RCVD_IN_RP_CERTIFIED 27909 7.41 5.71 8.09 31 XM_Evil_Numbers_Gen 25866 9.59 14.82 7.50 32 BAYES_00 25738 5.77 1.57 7.46 33 T_XMDrugObfuBody_14 24574 8.01 10.22 7.12 34 TooManyTo_001 23956 7.10 7.49 6.94 35 LotsOfNums_01 23453 7.39 8.88 6.80 36 TR_DCC_Bayes_99 21409 15.01 37.02 6.20 37 HTML_IMAGE_RATIO_02 21046 9.77 18.94 6.10 38 BAYES_60 21029 6.02 5.84 6.09 39 LOTS_OF_MONEY 19954 7.26 10.95 5.78 40 FSL_BULK_SIG 19802 6.04 6.79 5.74 41 XM_H_Long_From01 19400 6.31 8.03 5.62 42 TR_XM_DK_Bayes 18962 4.31 1.35 5.49 43 IN_ZIMBRA_NJ_WHITELIST 18693 3.88 0.04 5.42 44 TR_XM_DK_Bayes1 18249 4.16 1.34 5.29 45 RCVD_IN_MSPIKE_H2 16911 4.95 5.09 4.90 46 XM_PDF 16816 3.68 0.69 4.87 47 XMStrtUSub 16586 4.73 4.54 4.81 48 TR_XM_DK_Bayes2 15929 3.65 1.23 4.62 49 XM_SendGrid 15833 4.37 3.82 4.59 50 BOTNET_IPINHOSTNAME 15740 7.76 15.74 4.56 51 RELAYCOUNTRY_META 15568 7.94 16.50 4.51 52 HTML_IMAGE_RATIO_04 15474 6.03 9.88 4.48 53 XM_UncommonTLD01 14931 5.72 9.19 4.33 54 BAYES_80 14893 5.00 6.72 4.32 55 T_TooManySym_01 14821 3.91 2.94 4.29 56 MIME_QP_LONG_LINE 14321 4.10 3.97 4.15 57 XMNumbers 14191 4.18 4.33 4.11 58 XM_B_Phish_Phrases 14119 5.76 9.94 4.09 59 UNPARSEABLE_RELAY 13705 3.21 1.29 3.97 60 FROM_EXCESS_BASE64 12958 4.65 6.88 3.76 61 TR_XM_DocInvoice 12530 4.76 7.59 3.63 62 RCVD_IN_IADB_LISTED 12511 3.05 1.60 3.63 63 TR_Symld_Words 11584 2.62 0.78 3.36 64 T_REMOTE_IMAGE 11136 2.96 2.30 3.23 65 XMSubMetaSx_00 11045 4.54 7.89 3.20 66 BAYES_40 11011 2.70 1.48 3.19 67 RCVD_IN_IADB_VOUCHED 10938 2.56 1.04 3.17 68 RCVD_IN_IADB_SPF 10868 2.66 1.44 3.15 69 HTML_IMAGE_RATIO_06 10377 3.38 4.31 3.01 70 HTML_MIME_NO_HTML_TAG 9982 2.59 1.82 2.89 71 DKIM_INVALID 9654 2.95 3.32 2.80 72 RCVD_IN_IADB_SENDERID 9619 2.38 1.37 2.79 73 RCVD_IN_IADB_DK 9388 2.33 1.35 2.72 74 XMSexyCombo_05 9225 4.65 9.59 2.67 75 MPART_ALT_DIFF 8983 3.70 6.46 2.60 76 BAYES_95 8936 2.98 3.95 2.59 77 TVD_RCVD_IP 8184 1.74 0.16 2.37 78 SUBJ_ALL_CAPS 7953 2.21 1.99 2.30 79 BAYES_20 7675 1.96 1.29 2.22 80 IN_HORDE_ADDRESS_BOOK 7594 1.59 0.08 2.20 81 MIME_HTML_MOSTLY 7543 3.04 5.19 2.19 82 XM_SPF_SoftFail 7173 2.64 4.06 2.08 83 TooManyTo_002 6737 1.67 0.95 1.95 84 INVALID_MSGID 6688 1.51 0.42 1.94 85 TO_MALFORMED 6143 1.27 0.01 1.78 86 SpammyFromTLD_01 5929 1.86 2.21 1.72 87 T_TooManySym_02 5848 1.42 0.73 1.69 88 HTML_IMAGE_RATIO_08 5739 2.15 3.37 1.66 89 MAILING_LIST_MULTI 5713 1.49 1.08 1.66 90 HELO_NODOT 5691 1.25 0.26 1.65 91 XM_DK_Undo_01 5639 1.51 1.20 1.63 92 TM2_M_URI_OPT_OUT 5198 2.21 3.96 1.51 93 XM_CamelCaseFrm001 5075 2.03 3.42 1.47 94 XM_DIRTYINTL 4871 2.05 3.65 1.41 95 BAYES_05 4831 1.19 0.68 1.40 96 XMDiploma_00 4802 1.71 2.49 1.39 97 RCVD_IN_MSPIKE_WL 4695 1.11 0.49 1.36 98 RCVD_IN_MSPIKE_H3 4695 1.11 0.49 1.36 99 XM_H_PHPOS 4677 1.24 0.95 1.36 100 RELAYCOUNTRY_CA 4631 1.95 3.46 1.34 101 USER_IN_DEF_DKIM_WL 4598 0.99 0.13 1.33 102 UNTRUSTED_Relay 4210 3.66 9.77 1.22 103 TooManyTo_003 4187 1.10 0.82 1.21 104 T_XMDrugObfuBody_08 4016 1.47 2.22 1.16 105 XMPhish11 3940 1.06 0.85 1.14 106 T_XMDrugObfuBody_00 3921 1.21 1.38 1.14 107 RCVD_IN_IADB_OPTIN 3843 0.90 0.38 1.11 108 DKIM_ADSP_CUSTOM_MED 3824 1.10 1.08 1.11 109 XMStockSpam_06 3760 1.20 1.46 1.09 110 MIME_HTML_ONLY_MULTI 3653 1.55 2.78 1.06 111 URI_HEX 3568 1.75 3.52 1.03 112 USER_IN_WHITELIST 3464 0.72 0.00 1.00 113 XM_GoogleGroups 3426 0.85 0.49 0.99 114 XM_OfRef6 3374 1.35 2.28 0.98 115 T_MIXED_ES 3310 1.23 1.90 0.96 116 BOTNET 3303 4.77 14.29 0.96 117 DIET_1 3143 0.99 1.20 0.91 118 XMCapTrack 3138 0.77 0.41 0.91 119 XM_H_Long_From02 3115 1.10 1.60 0.90 120 TooManyTo_004 2999 0.81 0.67 0.87 121 RELAYCOUNTRY_GB 2923 0.85 0.85 0.85 122 NML_ADSP_CUSTOM_MED 2917 0.88 0.98 0.85 123 XMGenDplmaNmb 2846 0.95 1.27 0.82 124 XMSubMetaI_00 2751 1.39 2.88 0.80 125 XMSolicitRefs_0 2736 0.69 0.44 0.79 126 XM_ProductURIs 2682 1.16 2.13 0.78 127 TR_MetaPhish_Combo_01 2509 0.70 0.64 0.73 128 XM_UB50 2503 1.78 4.41 0.73 129 T_TooManySym_03 2455 0.55 0.15 0.71 130 XM_RXBody 2429 0.83 1.15 0.70 131 T_OBFU_PDF_ATTACH 2401 0.53 0.13 0.70 132 XMBdyGiftCard01 2366 0.85 1.26 0.69 133 XMSexyCombo_01 2321 1.08 2.11 0.67 134 TM2_M_VERY_LONG_WORD 2308 0.91 1.51 0.67 135 XM_B_COPY_HTML 2257 0.92 1.59 0.65 136 XM_ShortIntro_01 2254 0.58 0.39 0.65 137 XM_H_PHPMailer 2245 0.66 0.67 0.65 138 TooManyTo_005 2228 0.63 0.58 0.65 139 T_XMDrugObfuBody_12 2092 0.56 0.45 0.61 140 XMBody_78 1967 0.63 0.80 0.57 141 XMGappySubj_01 1964 0.54 0.48 0.57 142 XM_B_REG_HTML 1948 0.80 1.38 0.56 143 URI_TRY_3LD 1945 0.70 1.05 0.56 144 XMSubMetaSxObfu_02 1924 0.48 0.30 0.56 145 XMNoVowels 1917 0.50 0.36 0.56 146 T_XMHurry_00 1907 0.95 1.95 0.55 147 RCVD_IN_BL_SPAMCOP_NET 1904 1.28 3.10 0.55 148 XMBody_95 1869 0.41 0.10 0.54 149 HTML_FONT_FACE_BAD 1834 0.64 0.90 0.53 150 T_FILL_THIS_FORM_SHORT 1817 0.64 0.94 0.53 151 XM_B_TRADE_HTML 1817 0.50 0.44 0.53 152 XMBrknScrpt_02 1766 0.60 0.81 0.51 153 TR_LOTS_OF_MONEY3 1733 0.82 1.63 0.50 154 XMPhish30 1724 0.85 1.73 0.50 155 RCVD_IN_SORBS_DUL 1614 0.38 0.18 0.47 156 MISSING_HEADERS 1586 0.40 0.24 0.46 157 TM2_M_BODY_EMPTY 1558 0.39 0.24 0.45 158 HTML_TAG_BALANCE_BODY 1547 0.61 1.02 0.45 159 XMHTMLBadTable_001 1531 0.66 1.21 0.44 160 RCVD_IN_IADB_DOPTIN 1499 0.33 0.06 0.43 161 TM2_M_A_HREF_HREF 1493 0.46 0.52 0.43 162 URI_NOVOWEL 1493 0.49 0.63 0.43 163 TR_XM_RelayPhish 1479 0.77 1.62 0.43 164 XMSubNoVowel 1434 0.47 0.62 0.42 165 XM_H_PHPOS_M 1409 0.42 0.45 0.41 166 SHORT_HELO_AND_INLINE_IMAGE 1362 0.30 0.05 0.39 167 RELAYCOUNTRY_AU 1351 0.52 0.83 0.39 168 T_MANY_PILL_PRICE 1348 0.28 0.00 0.39 169 FORGED_GMAIL_RCVD 1346 0.50 0.78 0.39 170 RDNS_DYNAMIC 1338 0.59 1.09 0.39 171 XMMoneyMeta_00 1318 0.49 0.75 0.38 172 SpammyFromTLD_02 1297 0.89 2.16 0.38 173 T_TooManySym_04 1293 0.27 0.02 0.37 174 XMSubEmpty 1291 0.30 0.12 0.37 175 HTML_IMAGE_ONLY_32 1263 0.44 0.64 0.37 176 HTML_IMAGE_ONLY_28 1253 0.37 0.39 0.36 177 AC_DIV_BONANZA 1182 0.29 0.16 0.34 178 XMRcvdHeader_15 1178 0.24 0.00 0.34 179 MPART_ALT_DIFF_COUNT 1169 0.48 0.83 0.34 180 XM_D_tchamptons_WL 1167 0.24 0.00 0.34 181 XM_BadFromFormat 1164 0.43 0.67 0.34 182 HTML_IMAGE_ONLY_24 1163 0.33 0.31 0.34 183 XM_S_JOY_D 1151 0.61 1.29 0.33 184 UPPERCASE_50_75 1137 0.29 0.20 0.33 185 MSGID_FROM_MTA_HEADER 1124 0.29 0.21 0.33 186 TVD_SPACE_RATIO 1100 0.26 0.11 0.32 187 RELAYCOUNTRY_FR 1099 0.60 1.32 0.32 188 T_Symld_Words_02 1078 0.65 1.50 0.31 189 DKIM_ADSP_NXDOMAIN 1066 0.30 0.29 0.31 190 NO_DNS_FOR_FROM 1064 0.33 0.38 0.31 191 XMPhish14 1036 0.41 0.67 0.30 192 XMBody_17 1032 0.72 1.77 0.30 193 RELAYCOUNTRY_DE 964 0.54 1.20 0.28 194 XMLngstWrd_00 910 0.28 0.34 0.26 195 XM_Body_Obfu01 909 0.45 0.90 0.26 196 TR_MetaPhish_Combo_01b 904 0.22 0.11 0.26 197 RELAYCOUNTRY_NL 904 0.36 0.59 0.26 198 XMSubMetaSxObfu_03 898 0.42 0.82 0.26 199 TR_LOTS_OF_MONEY2 864 0.41 0.83 0.25 200 T_MONEY_PERCENT 864 0.41 0.83 0.25 ----------------------------------------------------------------------