Email: 464240 Autolearn: 0 AvgScore: 2.70 AvgScanTime: 2.21 sec Spam: 130167 Autolearn: 0 AvgScore: 12.31 AvgScanTime: 2.69 sec Ham: 334073 Autolearn: 0 AvgScore: -1.05 AvgScanTime: 2.03 sec Time Spent Running SA: 285.56 hours Time Spent Processing Spam: 97.12 hours Time Spent Processing Ham: 188.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125365 88.08 96.31 84.87 2 DKIM_SIGNED 113751 73.82 87.39 68.53 3 XM_DK_Pass 110900 72.26 85.20 67.22 4 DKIM_VALID 109539 70.47 84.15 65.15 5 DCC_CHECK 103430 45.35 79.46 32.06 6 XMListUnsubscribeExists 97966 50.77 75.26 41.23 7 DKIM_VALID_AU 85354 50.79 65.57 45.03 8 XM_H_QuotedFrom 71481 39.27 54.91 33.18 9 XM_DK_Undo_02 67275 24.04 51.68 13.27 10 BAYES_99 60628 22.05 46.58 12.49 11 BAYES_999 51726 19.12 39.74 11.09 12 TR_DCC_Bayes_99 47809 14.42 36.73 5.73 13 HTML_FONT_LOW_CONTRAST 47417 26.51 36.43 22.64 14 LOC_TINY_FONT_1 47171 23.90 36.24 19.09 15 BAYES_50 40713 49.88 31.28 57.13 16 MIME_HTML_ONLY 38838 22.92 29.84 20.22 17 FVGT_m_MULTI_ODD 37377 21.75 28.71 19.03 18 XMSubLong 35348 22.26 27.16 20.36 19 T_TM2_M_HEADER_IN_MSG 29927 30.16 22.99 32.96 20 DKIM_VALID_EF 27861 22.70 21.40 23.21 21 XM_Body_Dirty_Words 27353 13.21 21.01 10.17 22 T_KAM_HTML_FONT_INVALID 25753 15.11 19.78 13.29 23 DCC_CHECK_NEGATIVE 23929 52.29 18.38 65.51 24 XM_Multi_Part_URI 23716 12.97 18.22 10.92 25 HTML_IMAGE_RATIO_02 22882 9.46 17.58 6.29 26 MultiRelay 21574 19.16 16.57 20.17 27 RELAYCOUNTRY_META 20576 8.36 15.81 5.46 28 XM_Evil_Numbers_Gen 19188 9.22 14.74 7.06 29 LOTS_OF_MONEY 18154 10.94 13.95 9.77 30 BOTNET_IPINHOSTNAME 17868 6.98 13.73 4.34 31 BOTNET 17255 4.62 13.26 1.25 32 T_XMDrugObfuBody_14 14735 9.48 11.32 8.76 33 XMSexyCombo_05 13997 5.35 10.75 3.24 34 FSL_BULK_SIG 13881 8.49 10.66 7.64 35 UNTRUSTED_Relay 12888 3.74 9.90 1.34 36 HTML_IMAGE_RATIO_04 12817 6.00 9.85 4.50 37 LotsOfNums_01 11724 7.77 9.01 7.28 38 XM_B_Phish_Phrases 11670 5.33 8.97 3.91 39 MPART_ALT_DIFF 10684 5.53 8.21 4.49 40 XM_H_Long_From01 10424 6.68 8.01 6.17 41 TooManyTo_001 9762 8.58 7.50 9.00 42 TR_XM_DocInvoice 9420 5.10 7.24 4.27 43 BAYES_80 9322 4.73 7.16 3.78 44 XM_UncommonTLD01 9222 4.79 7.08 3.89 45 XMSubMetaSx_00 9213 4.64 7.08 3.69 46 RCVD_IN_RP_SAFE 8691 8.12 6.68 8.68 47 FROM_EXCESS_BASE64 7785 3.74 5.98 2.86 48 BAYES_60 7584 5.94 5.83 5.99 49 RCVD_IN_RP_CERTIFIED 7552 7.45 5.80 8.09 50 MIME_HTML_MOSTLY 7211 3.15 5.54 2.22 51 HTML_IMAGE_RATIO_06 7032 3.96 5.40 3.40 52 MIME_QP_LONG_LINE 6280 4.89 4.82 4.91 53 TM2_M_URI_OPT_OUT 6242 2.53 4.80 1.64 54 XMNumbers 6234 3.73 4.79 3.31 55 XM_SendGrid 6157 4.89 4.73 4.95 56 XMStrtUSub 5995 5.15 4.61 5.37 57 BAYES_95 5953 3.13 4.57 2.57 58 T_REMOTE_IMAGE 5629 4.64 4.32 4.77 59 RCVD_IN_MSPIKE_H2 5550 4.72 4.26 4.90 60 XM_DIRTYINTL 5439 2.53 4.18 1.89 61 XM_UB50 5060 1.70 3.89 0.85 62 XM_SPF_SoftFail 4523 2.88 3.47 2.65 63 URI_HEX 4489 1.74 3.45 1.07 64 XM_CamelCaseFrm001 4423 2.13 3.40 1.64 65 DKIM_INVALID 4212 3.34 3.24 3.39 66 RELAYCOUNTRY_CA 4055 1.79 3.12 1.28 67 RCVD_IN_BL_SPAMCOP_NET 4020 1.33 3.09 0.65 68 MIME_HTML_ONLY_MULTI 3982 3.13 3.06 3.16 69 HTML_IMAGE_RATIO_08 3844 2.70 2.95 2.60 70 T_TooManySym_01 3756 4.13 2.89 4.62 71 XM_OfRef6 3611 2.00 2.77 1.70 72 BOTNET_NORDNS 3468 0.96 2.66 0.30 73 HTML_MIME_NO_HTML_TAG 3456 2.54 2.66 2.49 74 XM_URI_RBL 3395 0.82 2.61 0.13 75 RCVD_IN_IADB_LISTED 3241 4.83 2.49 5.74 76 TM2_M_VERY_LONG_WORD 3208 1.21 2.46 0.73 77 XMDiploma_00 3184 1.84 2.45 1.60 78 XMSubMetaI_00 3168 1.22 2.43 0.75 79 MultiRelay_CC 2920 0.79 2.24 0.22 80 MultiRelay_Combo 2920 0.79 2.24 0.22 81 RCVD_IN_IADB_SPF 2875 4.16 2.21 4.92 82 XM_H_Long_From02 2841 1.28 2.18 0.93 83 RCVD_IN_IADB_SENDERID 2707 3.67 2.08 4.30 84 T_XMDrugObfuBody_08 2687 1.54 2.06 1.33 85 RCVD_IN_IADB_DK 2634 3.56 2.02 4.16 86 XMHTML_After_End 2573 0.79 1.98 0.33 87 SUBJ_ALL_CAPS 2565 1.81 1.97 1.75 88 XM_UB99 2459 0.54 1.89 0.01 89 XMSexyCombo_01 2428 0.82 1.87 0.42 90 RELAYCOUNTRY_FR 2416 0.71 1.86 0.26 91 XMStockSpam_06 2375 1.39 1.82 1.22 92 SpammyFromTLD_01 2349 1.12 1.80 0.86 93 T_XMHurry_00 2260 1.00 1.74 0.72 94 XM_DK_Undo_01 2228 1.89 1.71 1.97 95 UNPARSEABLE_RELAY 2225 3.08 1.71 3.61 96 RCVD_IN_RP_RNBL 2222 0.50 1.71 0.04 97 SpammyFromTLD_02 2182 0.87 1.68 0.55 98 T_XMDrugObfuBody_00 2134 1.02 1.64 0.78 99 XMPhish30 2131 0.80 1.64 0.47 100 BAYES_00 2127 6.60 1.63 8.54 101 MAILING_LIST_MULTI 2076 2.54 1.59 2.90 102 XM_ProductURIs 2070 1.15 1.59 0.98 103 TR_XM_RelayPhish 2005 0.79 1.54 0.50 104 URIBL_BLACK 2003 0.46 1.54 0.03 105 RELAYCOUNTRY_CN 1973 0.46 1.52 0.05 106 XMHTMLBadTable_001 1962 0.82 1.51 0.55 107 XMGenDplmaNmb 1958 1.20 1.50 1.08 108 XMBdyGiftCard01 1900 0.84 1.46 0.60 109 XM_UB999 1865 0.41 1.43 0.01 110 TR_Symld_Words 1784 2.10 1.37 2.38 111 ALL_TRUSTED 1779 13.10 1.37 17.68 112 URIBL_DBL_SPAM 1743 0.39 1.34 0.01 113 BAYES_40 1733 3.60 1.33 4.48 114 DIET_1 1724 0.61 1.32 0.33 115 TR_XM_DK_Bayes 1721 4.18 1.32 5.29 116 TR_XM_DK_Bayes1 1702 4.03 1.31 5.09 117 RCVD_IN_PSBL 1694 0.47 1.30 0.15 118 XM_HighProb1 1677 0.38 1.29 0.02 119 RELAYCOUNTRY_DE 1670 0.76 1.28 0.55 120 SUBJ_DOLLARS 1662 0.51 1.28 0.21 121 XM_UB60 1659 0.41 1.27 0.08 122 XM_B_REG_HTML 1635 0.78 1.26 0.60 123 XMBody_17 1623 0.66 1.25 0.44 124 URI_TRY_3LD 1609 1.28 1.24 1.30 125 XM_H_PHPOS 1588 1.37 1.22 1.43 126 RELAYCOUNTRY_GB 1546 1.14 1.19 1.12 127 HTML_FONT_SIZE_HUGE 1540 0.45 1.18 0.17 128 T_FILL_THIS_FORM_SHORT 1492 0.98 1.15 0.91 129 RCVD_IN_IADB_VOUCHED 1481 3.20 1.14 4.00 130 XMMoneyMeta_00 1472 0.67 1.13 0.49 131 TR_XM_DK_Bayes2 1466 3.14 1.13 3.93 132 LONG_JUNK_URI 1445 0.41 1.11 0.13 133 XM_B_COPY_HTML 1441 0.79 1.11 0.67 134 TR_LOTS_OF_MONEY2 1416 0.55 1.09 0.34 135 T_MONEY_PERCENT 1416 0.55 1.09 0.34 136 HTML_FONT_FACE_BAD 1392 1.95 1.07 2.29 137 XM_BadFromFormat 1383 0.49 1.06 0.26 138 BAYES_20 1366 2.53 1.05 3.10 139 XMSlimDrugH 1341 0.54 1.03 0.35 140 XMPhish11 1331 1.14 1.02 1.18 141 BODY_URI_ONLY 1329 0.40 1.02 0.16 142 T_HTML_TAG_BALANCE_CENTER 1314 0.42 1.01 0.19 143 RELAYCOUNTRY_AT 1295 0.37 0.99 0.13 144 PLING_QUERY 1280 0.66 0.98 0.53 145 XMBody_78 1280 0.63 0.98 0.49 146 MPART_ALT_DIFF_COUNT 1275 0.48 0.98 0.29 147 XM_PDF 1251 3.93 0.96 5.09 148 DKIM_ADSP_CUSTOM_MED 1248 1.15 0.96 1.22 149 TooManyTo_002 1206 2.24 0.93 2.75 150 XM_UB80 1201 0.28 0.92 0.03 151 LONG_JUNK_URI3 1197 0.33 0.92 0.10 152 FSL_THIS_IS_ADV 1195 0.30 0.92 0.06 153 RDNS_DYNAMIC 1187 0.54 0.91 0.40 154 LOW_PRICE 1169 0.33 0.90 0.11 155 HTML_SHORT_LINK_IMG_1 1164 0.27 0.89 0.03 156 HTML_IMAGE_ONLY_24 1149 0.55 0.88 0.43 157 REMOVE_BEFORE_LINK 1147 0.39 0.88 0.20 158 HTML_IMAGE_ONLY_28 1130 0.59 0.87 0.48 159 RELAYCOUNTRY_AU 1128 0.59 0.87 0.48 160 HTML_FONT_SIZE_LARGE 1125 0.35 0.86 0.15 161 HTML_IMAGE_ONLY_08 1114 0.37 0.86 0.17 162 XMBrknScrpt_02 1093 0.59 0.84 0.49 163 XM_H_PHPMailer 1073 0.79 0.82 0.78 164 TR_MetaPhish_Combo_01 1070 0.79 0.82 0.78 165 HTML_TAG_BALANCE_BODY 1068 0.52 0.82 0.41 166 XM_RXBody 1064 0.32 0.82 0.13 167 BOUNCE_MESSAGE 1064 2.31 0.82 2.89 168 ANY_BOUNCE_MESSAGE 1064 2.31 0.82 2.89 169 XMSubMetaSxObfu_03 1059 0.47 0.81 0.33 170 TR_Caps_n_Bayes_99 1055 0.27 0.81 0.06 171 XMClaimOffer 1016 0.29 0.78 0.10 172 NML_ADSP_CUSTOM_MED 1000 0.89 0.77 0.94 173 XMLongAddy 993 0.31 0.76 0.13 174 XM_H_Long_From03 981 0.31 0.75 0.13 175 XMSexyCombo_04 975 0.29 0.75 0.11 176 HTTPS_HTTP_MISMATCH 966 0.51 0.74 0.42 177 TooManyTo_003 961 1.48 0.74 1.77 178 BASE64_LENGTH_79_INF 956 0.30 0.73 0.14 179 XMSolicitRefs_0 929 0.67 0.71 0.66 180 FORGED_GMAIL_RCVD 919 0.47 0.71 0.38 181 TR_LOTS_OF_MONEY3 913 0.33 0.70 0.18 182 XM_UB95 882 0.21 0.68 0.02 183 XMBSHREFv2 876 0.26 0.67 0.10 184 T_Symld_Words_02 870 0.46 0.67 0.38 185 LongTLD 869 0.28 0.67 0.13 186 RELAYCOUNTRY_IT 865 0.22 0.66 0.05 187 RCVD_IN_IADB_OPTIN 864 1.55 0.66 1.90 188 BODY_ENHANCEMENT 856 0.20 0.66 0.02 189 XMPhish14 848 0.40 0.65 0.30 190 T_TooManySym_02 847 1.64 0.65 2.03 191 LONG_HEX_URI 830 0.33 0.64 0.21 192 TRACKER_ID 819 0.29 0.63 0.15 193 XMSubMetaSSx_00 814 0.26 0.63 0.12 194 XM_Body_Obfu01 808 0.40 0.62 0.31 195 PHOTO_EDITING_DIRECT 798 0.18 0.61 0.00 196 TR_Mismatch_TLD_02 797 0.21 0.61 0.06 197 XM_GoogleGroups 787 1.21 0.60 1.44 198 DATE_IN_PAST_03_06 781 0.23 0.60 0.09 199 XM_Hitman 773 0.18 0.59 0.02 200 RELAYCOUNTRY_NL 771 0.56 0.59 0.55 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 283526 88.08 96.31 84.87 2 DKIM_SIGNED 228948 73.82 87.39 68.53 3 XM_DK_Pass 224557 72.26 85.20 67.22 4 DCC_CHECK_NEGATIVE 218840 52.29 18.38 65.51 5 DKIM_VALID 217633 70.47 84.15 65.15 6 BAYES_50 190842 49.88 31.28 57.13 7 DKIM_VALID_AU 150445 50.79 65.57 45.03 8 XMListUnsubscribeExists 137733 50.77 75.26 41.23 9 XM_H_QuotedFrom 110839 39.27 54.91 33.18 10 T_TM2_M_HEADER_IN_MSG 110110 30.16 22.99 32.96 11 DCC_CHECK 107115 45.35 79.46 32.06 12 DKIM_VALID_EF 77533 22.70 21.40 23.21 13 HTML_FONT_LOW_CONTRAST 75645 26.51 36.43 22.64 14 XMSubLong 68009 22.26 27.16 20.36 15 MIME_HTML_ONLY 67564 22.92 29.84 20.22 16 MultiRelay 67377 19.16 16.57 20.17 17 LOC_TINY_FONT_1 63774 23.90 36.24 19.09 18 FVGT_m_MULTI_ODD 63582 21.75 28.71 19.03 19 ALL_TRUSTED 59052 13.10 1.37 17.68 20 T_KAM_HTML_FONT_INVALID 44409 15.11 19.78 13.29 21 XM_DK_Undo_02 44322 24.04 51.68 13.27 22 BAYES_99 41715 22.05 46.58 12.49 23 BAYES_999 37053 19.12 39.74 11.09 24 XM_Multi_Part_URI 36473 12.97 18.22 10.92 25 XM_Body_Dirty_Words 33975 13.21 21.01 10.17 26 LOTS_OF_MONEY 32647 10.94 13.95 9.77 27 XM_DKIMWhitelistDomains 31008 6.81 0.46 9.28 28 TooManyTo_001 30067 8.58 7.50 9.00 29 T_XMDrugObfuBody_14 29273 9.48 11.32 8.76 30 RCVD_IN_RP_SAFE 29007 8.12 6.68 8.68 31 BAYES_00 28531 6.60 1.63 8.54 32 RCVD_IN_RP_CERTIFIED 27015 7.45 5.80 8.09 33 IN_ZIMBRA_NJ_WHITELIST 26711 5.76 0.03 8.00 34 FSL_BULK_SIG 25524 8.49 10.66 7.64 35 LotsOfNums_01 24330 7.77 9.01 7.28 36 XM_Evil_Numbers_Gen 23597 9.22 14.74 7.06 37 HTML_IMAGE_RATIO_02 21013 9.46 17.58 6.29 38 XM_H_Long_From01 20608 6.68 8.01 6.17 39 BAYES_60 19999 5.94 5.83 5.99 40 RCVD_IN_IADB_LISTED 19170 4.83 2.49 5.74 41 TR_DCC_Bayes_99 19143 14.42 36.73 5.73 42 RELAYCOUNTRY_META 18249 8.36 15.81 5.46 43 XMStrtUSub 17927 5.15 4.61 5.37 44 TR_XM_DK_Bayes 17668 4.18 1.32 5.29 45 TR_XM_DK_Bayes1 17002 4.03 1.31 5.09 46 XM_PDF 17001 3.93 0.96 5.09 47 XM_SendGrid 16543 4.89 4.73 4.95 48 RCVD_IN_IADB_SPF 16433 4.16 2.21 4.92 49 MIME_QP_LONG_LINE 16401 4.89 4.82 4.91 50 RCVD_IN_MSPIKE_H2 16354 4.72 4.26 4.90 51 T_REMOTE_IMAGE 15920 4.64 4.32 4.77 52 T_TooManySym_01 15434 4.13 2.89 4.62 53 HTML_IMAGE_RATIO_04 15031 6.00 9.85 4.50 54 MPART_ALT_DIFF 14989 5.53 8.21 4.49 55 BAYES_40 14957 3.60 1.33 4.48 56 BOTNET_IPINHOSTNAME 14513 6.98 13.73 4.34 57 RCVD_IN_IADB_SENDERID 14352 3.67 2.08 4.30 58 TR_XM_DocInvoice 14259 5.10 7.24 4.27 59 RCVD_IN_IADB_DK 13914 3.56 2.02 4.16 60 RCVD_IN_IADB_VOUCHED 13376 3.20 1.14 4.00 61 TR_XM_DK_Bayes2 13126 3.14 1.13 3.93 62 XM_B_Phish_Phrases 13073 5.33 8.97 3.91 63 XM_UncommonTLD01 13003 4.79 7.08 3.89 64 BAYES_80 12639 4.73 7.16 3.78 65 XMSubMetaSx_00 12325 4.64 7.08 3.69 66 UNPARSEABLE_RELAY 12054 3.08 1.71 3.61 67 HTML_IMAGE_RATIO_06 11345 3.96 5.40 3.40 68 DKIM_INVALID 11315 3.34 3.24 3.39 69 XMNumbers 11064 3.73 4.79 3.31 70 XMSexyCombo_05 10821 5.35 10.75 3.24 71 MIME_HTML_ONLY_MULTI 10558 3.13 3.06 3.16 72 TVD_RCVD_IP 10428 2.31 0.21 3.12 73 BAYES_20 10368 2.53 1.05 3.10 74 MAILING_LIST_MULTI 9702 2.54 1.59 2.90 75 ANY_BOUNCE_MESSAGE 9654 2.31 0.82 2.89 76 BOUNCE_MESSAGE 9653 2.31 0.82 2.89 77 FROM_EXCESS_BASE64 9564 3.74 5.98 2.86 78 TooManyTo_002 9203 2.24 0.93 2.75 79 XM_SPF_SoftFail 8860 2.88 3.47 2.65 80 HELO_NODOT 8721 1.98 0.37 2.61 81 HTML_IMAGE_RATIO_08 8694 2.70 2.95 2.60 82 BAYES_95 8578 3.13 4.57 2.57 83 HTML_MIME_NO_HTML_TAG 8325 2.54 2.66 2.49 84 TR_Symld_Words 7959 2.10 1.37 2.38 85 IN_HORDE_ADDRESS_BOOK 7843 1.71 0.07 2.35 86 HTML_FONT_FACE_BAD 7661 1.95 1.07 2.29 87 MIME_HTML_MOSTLY 7414 3.15 5.54 2.22 88 INVALID_MSGID 6926 1.55 0.21 2.07 89 T_TooManySym_02 6773 1.64 0.65 2.03 90 TO_MALFORMED 6685 1.44 0.02 2.00 91 XM_DK_Undo_01 6569 1.89 1.71 1.97 92 BAYES_05 6444 1.55 0.57 1.93 93 RCVD_IN_IADB_OPTIN 6339 1.55 0.66 1.90 94 XM_DIRTYINTL 6329 2.53 4.18 1.89 95 TooManyTo_003 5921 1.48 0.74 1.77 96 SUBJ_ALL_CAPS 5842 1.81 1.97 1.75 97 XM_OfRef6 5693 2.00 2.77 1.70 98 TM2_M_URI_OPT_OUT 5488 2.53 4.80 1.64 99 XM_CamelCaseFrm001 5480 2.13 3.40 1.64 100 XMDiploma_00 5353 1.84 2.45 1.60 101 RCVD_IN_MSPIKE_H3 5260 1.29 0.54 1.57 102 RCVD_IN_MSPIKE_WL 5260 1.29 0.54 1.57 103 XM_GoogleGroups 4814 1.21 0.60 1.44 104 XM_H_PHPOS 4787 1.37 1.22 1.43 105 USER_IN_DEF_DKIM_WL 4640 1.03 0.09 1.39 106 XMCapTrack 4634 1.15 0.53 1.39 107 UNTRUSTED_Relay 4491 3.74 9.90 1.34 108 T_XMDrugObfuBody_08 4455 1.54 2.06 1.33 109 URI_TRY_3LD 4346 1.28 1.24 1.30 110 RELAYCOUNTRY_CA 4268 1.79 3.12 1.28 111 TooManyTo_004 4242 1.08 0.59 1.27 112 BOTNET 4170 4.62 13.26 1.25 113 DKIM_ADSP_CUSTOM_MED 4089 1.15 0.96 1.22 114 XMStockSpam_06 4070 1.39 1.82 1.22 115 XMPhish11 3946 1.14 1.02 1.18 116 RELAYCOUNTRY_GB 3734 1.14 1.19 1.12 117 XMGenDplmaNmb 3604 1.20 1.50 1.08 118 URI_HEX 3568 1.74 3.45 1.07 119 TooManyTo_005 3429 0.88 0.52 1.03 120 XMNoVowels 3288 0.82 0.41 0.98 121 XM_ProductURIs 3285 1.15 1.59 0.98 122 NML_ADSP_CUSTOM_MED 3124 0.89 0.77 0.94 123 XM_H_Long_From02 3096 1.28 2.18 0.93 124 T_FILL_THIS_FORM_SHORT 3055 0.98 1.15 0.91 125 SpammyFromTLD_01 2863 1.12 1.80 0.86 126 T_TooManySym_03 2835 0.65 0.15 0.85 127 XM_UB50 2829 1.70 3.89 0.85 128 XMSubNoVowel 2812 0.68 0.26 0.84 129 XMGappySubj_01 2772 0.70 0.38 0.83 130 FILL_THIS_FORM 2758 0.68 0.31 0.83 131 USER_IN_WHITELIST 2695 0.58 0.00 0.81 132 XM_ShortIntro_01 2666 0.66 0.31 0.80 133 TR_MetaPhish_Combo_01 2606 0.79 0.82 0.78 134 T_XMDrugObfuBody_00 2602 1.02 1.64 0.78 135 XM_H_PHPMailer 2600 0.79 0.82 0.78 136 RCVD_IN_IADB_DOPTIN 2530 0.57 0.08 0.76 137 XMSubMetaI_00 2492 1.22 2.43 0.75 138 TM2_M_VERY_LONG_WORD 2431 1.21 2.46 0.73 139 TM2_M_A_HREF_HREF 2415 0.67 0.52 0.72 140 T_XMHurry_00 2404 1.00 1.74 0.72 141 T_OBFU_PDF_ATTACH 2400 0.60 0.29 0.72 142 T_FILL_THIS_FORM_LOAN 2243 0.52 0.15 0.67 143 XM_B_COPY_HTML 2231 0.79 1.11 0.67 144 T_FILL_THIS_FORM_LONG 2213 0.53 0.18 0.66 145 XMSolicitRefs_0 2189 0.67 0.71 0.66 146 RCVD_IN_BL_SPAMCOP_NET 2161 1.33 3.09 0.65 147 SHORT_HELO_AND_INLINE_IMAGE 2130 0.48 0.07 0.64 148 XMBdyGiftCard01 2009 0.84 1.46 0.60 149 XM_B_REG_HTML 2004 0.78 1.26 0.60 150 MISSING_HEADERS 1928 0.55 0.49 0.58 151 RCVD_IN_SORBS_DUL 1902 0.48 0.26 0.57 152 XM_D_tchamptons_WL 1872 0.40 0.00 0.56 153 RELAYCOUNTRY_DE 1848 0.76 1.28 0.55 154 RELAYCOUNTRY_NL 1835 0.56 0.59 0.55 155 SpammyFromTLD_02 1834 0.87 1.68 0.55 156 XMHTMLBadTable_001 1833 0.82 1.51 0.55 157 PLING_QUERY 1780 0.66 0.98 0.53 158 AC_DIV_BONANZA 1673 0.39 0.12 0.50 159 TR_XM_RelayPhish 1660 0.79 1.54 0.50 160 XMBody_78 1647 0.63 0.98 0.49 161 HTML_IMAGE_ONLY_32 1645 0.49 0.50 0.49 162 XMMoneyMeta_00 1635 0.67 1.13 0.49 163 XMBrknScrpt_02 1633 0.59 0.84 0.49 164 HTML_IMAGE_ONLY_28 1614 0.59 0.87 0.48 165 XMDateMe_00 1614 0.47 0.43 0.48 166 RELAYCOUNTRY_AU 1604 0.59 0.87 0.48 167 XMPhish30 1567 0.80 1.64 0.47 168 TM2_M_BODY_EMPTY 1548 0.41 0.28 0.46 169 XMBody_95 1505 0.38 0.20 0.45 170 XMBody_17 1462 0.66 1.25 0.44 171 XMLKML 1435 0.31 0.00 0.43 172 T_TooManySym_04 1426 0.31 0.02 0.43 173 HTML_IMAGE_ONLY_24 1423 0.55 0.88 0.43 174 XMRcvdHeader_15 1421 0.31 0.00 0.43 175 UPPERCASE_50_75 1417 0.34 0.12 0.42 176 HTTPS_HTTP_MISMATCH 1409 0.51 0.74 0.42 177 XMSexyCombo_01 1400 0.82 1.87 0.42 178 HTML_TAG_BALANCE_BODY 1363 0.52 0.82 0.41 179 XMSubMetaSxObfu_02 1343 0.39 0.35 0.40 180 RDNS_DYNAMIC 1336 0.54 0.91 0.40 181 T_Symld_Words_02 1275 0.46 0.67 0.38 182 FORGED_GMAIL_RCVD 1254 0.47 0.71 0.38 183 XM_H_PHPOS_M 1253 0.43 0.57 0.38 184 URI_NOVOWEL 1234 0.41 0.53 0.37 185 TVD_SPACE_RATIO 1196 0.33 0.27 0.36 186 XMLngstWrd_00 1191 0.38 0.45 0.36 187 XMSlimDrugH 1179 0.54 1.03 0.35 188 HTML_IMAGE_ONLY_20 1173 0.36 0.39 0.35 189 XM_B_TRADE_HTML 1171 0.39 0.50 0.35 190 DKIM_ADSP_NXDOMAIN 1163 0.34 0.31 0.35 191 MSGID_FROM_MTA_HEADER 1122 0.31 0.25 0.34 192 T_MONEY_PERCENT 1121 0.55 1.09 0.34 193 TR_LOTS_OF_MONEY2 1121 0.55 1.09 0.34 194 XMSubMetaSxObfu_03 1102 0.47 0.81 0.33 195 XMHTML_After_End 1102 0.79 1.98 0.33 196 DIET_1 1094 0.61 1.32 0.33 197 TR_MetaPhish_Combo_01b 1061 0.27 0.14 0.32 198 XMSubEmpty 1055 0.28 0.18 0.32 199 XM_H_SpoofStaff4 1052 0.23 0.03 0.31 200 XMSUPPORT 1041 0.22 0.00 0.31 ----------------------------------------------------------------------