Email: 537924 Autolearn: 0 AvgScore: 3.01 AvgScanTime: 2.24 sec Spam: 151317 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 2.71 sec Ham: 386607 Autolearn: 0 AvgScore: -0.65 AvgScanTime: 2.06 sec Time Spent Running SA: 335.06 hours Time Spent Processing Spam: 114.01 hours Time Spent Processing Ham: 221.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144946 89.20 95.79 86.62 2 DKIM_SIGNED 129468 71.85 85.56 66.49 3 XM_DK_Pass 125553 70.17 82.97 65.16 4 DKIM_VALID 123563 68.31 81.66 63.08 5 DCC_CHECK 118342 45.48 78.21 32.68 6 XMListUnsubscribeExists 111222 50.34 73.50 41.28 7 DKIM_VALID_AU 94171 48.66 62.23 43.35 8 XM_H_QuotedFrom 84962 41.86 56.15 36.27 9 XM_DK_Undo_02 75646 22.59 49.99 11.87 10 BAYES_99 68996 20.79 45.60 11.09 11 BAYES_999 57903 17.77 38.27 9.75 12 TR_DCC_Bayes_99 53904 13.55 35.62 4.90 13 HTML_FONT_LOW_CONTRAST 53430 25.67 35.31 21.89 14 LOC_TINY_FONT_1 51521 22.20 34.05 17.56 15 BAYES_50 46576 49.24 30.78 56.47 16 MIME_HTML_ONLY 46026 24.77 30.42 22.56 17 FVGT_m_MULTI_ODD 43503 21.41 28.75 18.53 18 XMSubLong 40584 22.45 26.82 20.74 19 DKIM_VALID_EF 33195 21.97 21.94 21.98 20 T_TM2_M_HEADER_IN_MSG 31246 29.23 20.65 32.59 21 T_KAM_HTML_FONT_INVALID 30412 14.76 20.10 12.66 22 DCC_CHECK_NEGATIVE 29562 52.09 19.54 64.83 23 XM_Body_Dirty_Words 28903 11.85 19.10 9.02 24 MultiRelay 26361 19.15 17.42 19.83 25 RELAYCOUNTRY_META 26103 8.59 17.25 5.20 26 XM_Multi_Part_URI 25268 11.54 16.70 9.52 27 HTML_IMAGE_RATIO_02 21973 8.35 14.52 5.94 28 XM_Evil_Numbers_Gen 20550 8.84 13.58 6.99 29 BOTNET_IPINHOSTNAME 20360 6.91 13.46 4.35 30 BOTNET 19821 4.36 13.10 0.94 31 LOTS_OF_MONEY 19155 9.41 12.66 8.13 32 T_XMDrugObfuBody_14 17404 9.18 11.50 8.28 33 UNTRUSTED_Relay 16268 3.98 10.75 1.34 34 FSL_BULK_SIG 16248 8.98 10.74 8.29 35 XM_B_Phish_Phrases 14648 7.15 9.68 6.16 36 XMSexyCombo_05 14332 4.19 9.47 2.12 37 HTML_IMAGE_RATIO_04 13561 5.01 8.96 3.47 38 LotsOfNums_01 12892 7.91 8.52 7.67 39 XM_H_Long_From01 12589 6.54 8.32 5.84 40 BAYES_80 12056 5.04 7.97 3.90 41 TooManyTo_001 11518 8.58 7.61 8.96 42 TR_XM_DocInvoice 11490 6.51 7.59 6.09 43 MPART_ALT_DIFF 10710 6.90 7.08 6.84 44 XM_UncommonTLD01 10469 4.56 6.92 3.64 45 XMSubMetaSx_00 10042 4.01 6.64 2.98 46 BAYES_60 9887 6.41 6.53 6.36 47 RCVD_IN_RP_SAFE 8990 7.69 5.94 8.38 48 FROM_EXCESS_BASE64 8430 3.70 5.57 2.96 49 HTML_IMAGE_RATIO_06 7907 3.52 5.23 2.85 50 RCVD_IN_RP_CERTIFIED 7671 7.14 5.07 7.95 51 MIME_QP_LONG_LINE 7649 5.25 5.05 5.33 52 XMNumbers 7637 3.70 5.05 3.18 53 XM_SendGrid 7430 5.05 4.91 5.11 54 MIME_HTML_MOSTLY 7370 2.85 4.87 2.06 55 BAYES_95 7186 3.55 4.75 3.09 56 TM2_M_URI_OPT_OUT 6826 4.70 4.51 4.77 57 XM_UB50 6550 1.84 4.33 0.87 58 HTML_IMAGE_RATIO_08 6370 2.61 4.21 1.98 59 T_REMOTE_IMAGE 6074 4.47 4.01 4.65 60 XM_SPF_SoftFail 6020 2.87 3.98 2.44 61 DKIM_INVALID 5905 3.55 3.90 3.41 62 XM_DIRTYINTL 5860 2.19 3.87 1.54 63 XMStrtUSub 5806 3.92 3.84 3.95 64 RCVD_IN_MSPIKE_H2 5776 4.12 3.82 4.24 65 RCVD_IN_BL_SPAMCOP_NET 5477 1.56 3.62 0.76 66 HTML_MIME_NO_HTML_TAG 5407 3.39 3.57 3.32 67 URI_HEX 5355 1.97 3.54 1.36 68 RELAYCOUNTRY_CA 5120 1.81 3.38 1.19 69 XM_CamelCaseFrm001 4842 2.09 3.20 1.65 70 T_TooManySym_01 4799 4.20 3.17 4.60 71 MIME_HTML_ONLY_MULTI 4528 4.71 2.99 5.38 72 MultiRelay_Combo 4387 0.99 2.90 0.24 73 MultiRelay_CC 4387 0.99 2.90 0.24 74 XM_OfRef6 4347 1.84 2.87 1.44 75 SUBJ_ALL_CAPS 4224 1.91 2.79 1.56 76 XMDiploma_00 4175 1.94 2.76 1.62 77 XM_URI_RBL 3913 0.84 2.59 0.16 78 RCVD_IN_IADB_LISTED 3859 4.87 2.55 5.78 79 T_XMDrugObfuBody_08 3772 1.68 2.49 1.36 80 BOTNET_NORDNS 3482 0.70 2.30 0.07 81 RCVD_IN_IADB_SPF 3286 4.23 2.17 5.03 82 XM_UB99 3176 0.61 2.10 0.03 83 SpammyFromTLD_02 3150 0.85 2.08 0.37 84 RCVD_IN_IADB_SENDERID 3110 3.74 2.06 4.41 85 XM_DK_Undo_01 3100 2.08 2.05 2.10 86 RCVD_IN_IADB_DK 3056 3.66 2.02 4.31 87 XMBody_17 2894 0.82 1.91 0.39 88 UNPARSEABLE_RELAY 2879 3.08 1.90 3.54 89 XMHTML_After_End 2878 0.79 1.90 0.36 90 TM2_M_VERY_LONG_WORD 2852 1.07 1.88 0.75 91 XMGenDplmaNmb 2851 1.32 1.88 1.11 92 RCVD_IN_RP_RNBL 2843 0.55 1.88 0.04 93 ALL_TRUSTED 2744 13.39 1.81 17.92 94 TR_XM_RelayPhish 2651 0.95 1.75 0.64 95 MAILING_LIST_MULTI 2614 2.52 1.73 2.83 96 BAYES_00 2528 7.84 1.67 10.26 97 RELAYCOUNTRY_FR 2518 0.75 1.66 0.39 98 SpammyFromTLD_01 2482 1.05 1.64 0.82 99 XM_UB999 2474 0.47 1.63 0.02 100 DIET_1 2449 0.63 1.62 0.25 101 XMSexyCombo_01 2448 0.66 1.62 0.29 102 XM_UB60 2405 0.51 1.59 0.08 103 XM_ProductURIs 2335 1.13 1.54 0.97 104 RELAYCOUNTRY_CN 2326 0.48 1.54 0.06 105 T_XMDrugObfuBody_00 2309 0.93 1.53 0.70 106 URIBL_BLACK 2280 0.45 1.51 0.04 107 XMSubMetaI_00 2269 0.80 1.50 0.53 108 XMStockSpam_06 2253 1.00 1.49 0.81 109 T_HTML_TAG_BALANCE_CENTER 2238 0.56 1.48 0.20 110 TR_XM_DK_Bayes 2213 3.76 1.46 4.66 111 TR_XM_DK_Bayes1 2167 3.62 1.43 4.48 112 RELAYCOUNTRY_GB 2153 1.17 1.42 1.06 113 T_XMHurry_00 2142 0.75 1.42 0.49 114 TR_XM_DK_Bayes2 2080 2.84 1.37 3.42 115 T_MONEY_PERCENT 2079 0.62 1.37 0.32 116 TR_LOTS_OF_MONEY2 2079 0.62 1.37 0.32 117 XMPhish11 2063 1.27 1.36 1.24 118 XM_H_Long_From02 2046 0.97 1.35 0.83 119 SUBJ_DOLLARS 2028 0.56 1.34 0.25 120 XM_HighProb1 1969 0.38 1.30 0.02 121 T_TooManySym_02 1954 1.59 1.29 1.71 122 XMPhish30 1937 0.65 1.28 0.40 123 RELAYCOUNTRY_DE 1902 0.66 1.26 0.42 124 RELAYCOUNTRY_IN 1884 0.43 1.25 0.11 125 TR_Caps_n_Bayes_99 1838 0.38 1.21 0.06 126 RDNS_DYNAMIC 1781 0.63 1.18 0.41 127 URI_TRY_3LD 1777 0.92 1.17 0.82 128 BAYES_40 1776 3.28 1.17 4.11 129 XM_UB80 1753 0.34 1.16 0.03 130 ANY_BOUNCE_MESSAGE 1752 2.47 1.16 2.98 131 BOUNCE_MESSAGE 1752 2.47 1.16 2.98 132 MPART_ALT_DIFF_COUNT 1748 0.50 1.16 0.25 133 T_FILL_THIS_FORM_SHORT 1747 0.92 1.15 0.83 134 HTML_TAG_BALANCE_BODY 1745 0.62 1.15 0.41 135 RCVD_IN_IADB_VOUCHED 1740 3.15 1.15 3.93 136 XMMoneyMeta_00 1714 0.70 1.13 0.53 137 TooManyTo_002 1660 2.31 1.10 2.79 138 XM_B_REG_HTML 1660 0.62 1.10 0.43 139 XM_H_PHPOS 1654 1.74 1.09 2.00 140 TR_Symld_Words 1648 1.76 1.09 2.02 141 XMHTMLBadTable_001 1608 0.66 1.06 0.51 142 XM_BadFromFormat 1593 0.46 1.05 0.23 143 RELAYCOUNTRY_AT 1541 0.40 1.02 0.16 144 BAYES_20 1537 2.39 1.02 2.93 145 XMBrknScrpt_02 1525 0.67 1.01 0.53 146 LONG_JUNK_URI 1498 0.36 0.99 0.11 147 XMBody_78 1479 0.60 0.98 0.45 148 URI_NOVOWEL 1457 0.52 0.96 0.34 149 DKIM_ADSP_CUSTOM_MED 1428 1.07 0.94 1.13 150 HTML_IMAGE_ONLY_08 1420 0.37 0.94 0.14 151 XM_RXBody 1412 0.42 0.93 0.22 152 URIBL_DBL_SPAM 1393 0.27 0.92 0.01 153 HTML_FONT_SIZE_HUGE 1382 0.36 0.91 0.14 154 XMSlimDrugH 1378 0.52 0.91 0.37 155 XM_Body_Obfu01 1371 0.46 0.91 0.29 156 BODY_URI_ONLY 1365 0.31 0.90 0.08 157 XM_PDF 1360 3.86 0.90 5.01 158 TooManyTo_003 1353 1.49 0.89 1.72 159 XM_B_COPY_HTML 1328 0.55 0.88 0.42 160 HTML_IMAGE_ONLY_16 1320 1.13 0.87 1.23 161 XMPhish14 1315 0.58 0.87 0.47 162 HTML_FONT_FACE_BAD 1301 1.16 0.86 1.28 163 XMBdyGiftCard01 1288 0.65 0.85 0.58 164 RCVD_IN_PSBL 1286 0.30 0.85 0.09 165 RELAYCOUNTRY_AU 1265 0.59 0.84 0.50 166 HTML_SHORT_LINK_IMG_1 1255 0.25 0.83 0.02 167 LONG_JUNK_URI3 1238 0.29 0.82 0.09 168 PHOTO_EDITING_DIRECT 1234 0.23 0.82 0.01 169 XMWinner 1227 0.26 0.81 0.05 170 HTML_FONT_SIZE_LARGE 1226 0.35 0.81 0.17 171 PLING_QUERY 1212 0.49 0.80 0.37 172 XMSubMetaSSx_00 1195 0.34 0.79 0.17 173 REMOVE_BEFORE_LINK 1187 0.43 0.78 0.30 174 T_Symld_Words_02 1185 0.51 0.78 0.41 175 DATE_IN_PAST_12_24 1181 0.24 0.78 0.03 176 NML_ADSP_CUSTOM_MED 1180 0.80 0.78 0.81 177 REPLYTO_WITHOUT_TO_CC 1163 0.26 0.77 0.06 178 RCVD_IN_MSPIKE_H3 1148 1.56 0.76 1.87 179 RCVD_IN_MSPIKE_WL 1148 1.56 0.76 1.87 180 HTTPS_HTTP_MISMATCH 1130 0.55 0.75 0.48 181 XMGppyBdWords 1101 0.28 0.73 0.10 182 TR_MetaPhish_Combo_01 1090 0.89 0.72 0.95 183 MISSING_HEADERS 1075 0.61 0.71 0.58 184 TooManyTo_004 1068 1.11 0.71 1.26 185 FSL_THIS_IS_ADV 1068 0.23 0.71 0.05 186 DEAR_FRIEND 1064 0.23 0.70 0.05 187 TR_LOTS_OF_MONEY3 1060 0.31 0.70 0.16 188 HTML_IMAGE_ONLY_28 1056 0.53 0.70 0.47 189 XMClaimOffer 1053 0.30 0.70 0.15 190 FORGED_GMAIL_RCVD 1034 0.48 0.68 0.40 191 TM2_M_A_HREF_HREF 1029 0.52 0.68 0.46 192 XM_UB95 1022 0.20 0.68 0.02 193 LongTLD 1019 0.31 0.67 0.16 194 BASE64_LENGTH_79_INF 1019 0.28 0.67 0.13 195 XM_OfRef7 1005 0.30 0.66 0.16 196 XM_H_PHPMailer 957 0.63 0.63 0.62 197 XMNoVowels 949 0.90 0.63 1.00 198 TooManyTo_005 936 0.92 0.62 1.04 199 LONG_JUNK_URI2 907 0.18 0.60 0.01 200 XMSubMetaSxObfu_03 896 0.35 0.59 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 334864 89.20 95.79 86.62 2 DKIM_SIGNED 257055 71.85 85.56 66.49 3 XM_DK_Pass 251897 70.17 82.97 65.16 4 DCC_CHECK_NEGATIVE 250622 52.09 19.54 64.83 5 DKIM_VALID 243890 68.31 81.66 63.08 6 BAYES_50 218301 49.24 30.78 56.47 7 DKIM_VALID_AU 167593 48.66 62.23 43.35 8 XMListUnsubscribeExists 159582 50.34 73.50 41.28 9 XM_H_QuotedFrom 140236 41.86 56.15 36.27 10 DCC_CHECK 126330 45.48 78.21 32.68 11 T_TM2_M_HEADER_IN_MSG 125993 29.23 20.65 32.59 12 MIME_HTML_ONLY 87222 24.77 30.42 22.56 13 DKIM_VALID_EF 84983 21.97 21.94 21.98 14 HTML_FONT_LOW_CONTRAST 84645 25.67 35.31 21.89 15 XMSubLong 80189 22.45 26.82 20.74 16 MultiRelay 76667 19.15 17.42 19.83 17 FVGT_m_MULTI_ODD 71646 21.41 28.75 18.53 18 ALL_TRUSTED 69272 13.39 1.81 17.92 19 LOC_TINY_FONT_1 67891 22.20 34.05 17.56 20 T_KAM_HTML_FONT_INVALID 48961 14.76 20.10 12.66 21 XM_DK_Undo_02 45890 22.59 49.99 11.87 22 BAYES_99 42859 20.79 45.60 11.09 23 BAYES_00 39647 7.84 1.67 10.26 24 IN_ZIMBRA_NJ_WHITELIST 39427 7.34 0.03 10.20 25 BAYES_999 37690 17.77 38.27 9.75 26 XM_Multi_Part_URI 36789 11.54 16.70 9.52 27 XM_Body_Dirty_Words 34854 11.85 19.10 9.02 28 TooManyTo_001 34624 8.58 7.61 8.96 29 RCVD_IN_RP_SAFE 32387 7.69 5.94 8.38 30 FSL_BULK_SIG 32054 8.98 10.74 8.29 31 T_XMDrugObfuBody_14 32003 9.18 11.50 8.28 32 LOTS_OF_MONEY 31449 9.41 12.66 8.13 33 XM_DKIMWhitelistDomains 31270 5.82 0.02 8.09 34 RCVD_IN_RP_CERTIFIED 30727 7.14 5.07 7.95 35 LotsOfNums_01 29663 7.91 8.52 7.67 36 XM_Evil_Numbers_Gen 27018 8.84 13.58 6.99 37 MPART_ALT_DIFF 26433 6.90 7.08 6.84 38 BAYES_60 24605 6.41 6.53 6.36 39 XM_B_Phish_Phrases 23800 7.15 9.68 6.16 40 TR_XM_DocInvoice 23526 6.51 7.59 6.09 41 HTML_IMAGE_RATIO_02 22963 8.35 14.52 5.94 42 XM_H_Long_From01 22582 6.54 8.32 5.84 43 RCVD_IN_IADB_LISTED 22347 4.87 2.55 5.78 44 MIME_HTML_ONLY_MULTI 20793 4.71 2.99 5.38 45 MIME_QP_LONG_LINE 20587 5.25 5.05 5.33 46 RELAYCOUNTRY_META 20101 8.59 17.25 5.20 47 XM_SendGrid 19743 5.05 4.91 5.11 48 RCVD_IN_IADB_SPF 19447 4.23 2.17 5.03 49 XM_PDF 19382 3.86 0.90 5.01 50 TR_DCC_Bayes_99 18960 13.55 35.62 4.90 51 TM2_M_URI_OPT_OUT 18446 4.70 4.51 4.77 52 TR_XM_DK_Bayes 18006 3.76 1.46 4.66 53 T_REMOTE_IMAGE 17965 4.47 4.01 4.65 54 T_TooManySym_01 17776 4.20 3.17 4.60 55 TR_XM_DK_Bayes1 17330 3.62 1.43 4.48 56 RCVD_IN_IADB_SENDERID 17034 3.74 2.06 4.41 57 BOTNET_IPINHOSTNAME 16814 6.91 13.46 4.35 58 RCVD_IN_IADB_DK 16657 3.66 2.02 4.31 59 RCVD_IN_MSPIKE_H2 16408 4.12 3.82 4.24 60 BAYES_40 15888 3.28 1.17 4.11 61 XMStrtUSub 15277 3.92 3.84 3.95 62 RCVD_IN_IADB_VOUCHED 15180 3.15 1.15 3.93 63 BAYES_80 15068 5.04 7.97 3.90 64 XM_UncommonTLD01 14069 4.56 6.92 3.64 65 UNPARSEABLE_RELAY 13688 3.08 1.90 3.54 66 HTML_IMAGE_RATIO_04 13406 5.01 8.96 3.47 67 TR_XM_DK_Bayes2 13212 2.84 1.37 3.42 68 DKIM_INVALID 13165 3.55 3.90 3.41 69 HTML_MIME_NO_HTML_TAG 12828 3.39 3.57 3.32 70 XMNumbers 12282 3.70 5.05 3.18 71 BAYES_95 11936 3.55 4.75 3.09 72 TVD_RCVD_IP 11776 2.25 0.23 3.05 73 XMSubMetaSx_00 11534 4.01 6.64 2.98 74 ANY_BOUNCE_MESSAGE 11520 2.47 1.16 2.98 75 BOUNCE_MESSAGE 11519 2.47 1.16 2.98 76 FROM_EXCESS_BASE64 11459 3.70 5.57 2.96 77 BAYES_20 11331 2.39 1.02 2.93 78 HTML_IMAGE_RATIO_06 11009 3.52 5.23 2.85 79 MAILING_LIST_MULTI 10932 2.52 1.73 2.83 80 TooManyTo_002 10770 2.31 1.10 2.79 81 HELO_NODOT 10124 2.00 0.40 2.62 82 XM_SPF_SoftFail 9445 2.87 3.98 2.44 83 IN_HORDE_ADDRESS_BOOK 8219 1.55 0.07 2.13 84 XMSexyCombo_05 8186 4.19 9.47 2.12 85 XM_DK_Undo_01 8113 2.08 2.05 2.10 86 MIME_HTML_MOSTLY 7972 2.85 4.87 2.06 87 TR_Symld_Words 7810 1.76 1.09 2.02 88 XM_H_PHPOS 7730 1.74 1.09 2.00 89 HTML_IMAGE_RATIO_08 7673 2.61 4.21 1.98 90 RCVD_IN_IADB_OPTIN 7349 1.52 0.56 1.90 91 RCVD_IN_MSPIKE_H3 7237 1.56 0.76 1.87 92 RCVD_IN_MSPIKE_WL 7237 1.56 0.76 1.87 93 INVALID_MSGID 7030 1.36 0.20 1.82 94 BAYES_05 6971 1.44 0.51 1.80 95 TooManyTo_003 6643 1.49 0.89 1.72 96 T_TooManySym_02 6599 1.59 1.29 1.71 97 TO_MALFORMED 6543 1.23 0.03 1.69 98 XM_CamelCaseFrm001 6393 2.09 3.20 1.65 99 XMDiploma_00 6269 1.94 2.76 1.62 100 XMSubNoVowel 6259 1.26 0.34 1.62 101 SUBJ_ALL_CAPS 6031 1.91 2.79 1.56 102 XM_DIRTYINTL 5942 2.19 3.87 1.54 103 XM_OfRef6 5569 1.84 2.87 1.44 104 XMCapTrack 5544 1.19 0.58 1.43 105 XM_GoogleGroups 5253 1.14 0.57 1.36 106 T_XMDrugObfuBody_08 5248 1.68 2.49 1.36 107 URI_HEX 5247 1.97 3.54 1.36 108 UNTRUSTED_Relay 5163 3.98 10.75 1.34 109 HTML_FONT_FACE_BAD 4934 1.16 0.86 1.28 110 TooManyTo_004 4889 1.11 0.71 1.26 111 XMPhish11 4785 1.27 1.36 1.24 112 HTML_IMAGE_ONLY_16 4758 1.13 0.87 1.23 113 USER_IN_DEF_DKIM_WL 4637 0.91 0.16 1.20 114 RELAYCOUNTRY_CA 4613 1.81 3.38 1.19 115 DKIM_ADSP_CUSTOM_MED 4354 1.07 0.94 1.13 116 XMGenDplmaNmb 4276 1.32 1.88 1.11 117 RELAYCOUNTRY_GB 4114 1.17 1.42 1.06 118 TooManyTo_005 4021 0.92 0.62 1.04 119 XMNoVowels 3883 0.90 0.63 1.00 120 XM_ProductURIs 3750 1.13 1.54 0.97 121 TR_MetaPhish_Combo_01 3683 0.89 0.72 0.95 122 BOTNET 3620 4.36 13.10 0.94 123 TO_NO_BRKTS_HTML_ONLY 3412 0.71 0.27 0.88 124 XM_UB50 3361 1.84 4.33 0.87 125 T_FILL_THIS_FORM_SHORT 3225 0.92 1.15 0.83 126 XM_H_Long_From02 3196 0.97 1.35 0.83 127 URI_TRY_3LD 3181 0.92 1.17 0.82 128 SpammyFromTLD_01 3162 1.05 1.64 0.82 129 XMStockSpam_06 3128 1.00 1.49 0.81 130 NML_ADSP_CUSTOM_MED 3127 0.80 0.78 0.81 131 T_TooManySym_03 3013 0.62 0.21 0.78 132 RCVD_IN_BL_SPAMCOP_NET 2919 1.56 3.62 0.76 133 TM2_M_VERY_LONG_WORD 2915 1.07 1.88 0.75 134 XM_ShortIntro_01 2863 0.64 0.39 0.74 135 RCVD_IN_IADB_DOPTIN 2814 0.54 0.08 0.73 136 USER_IN_WHITELIST 2764 0.51 0.00 0.71 137 T_XMDrugObfuBody_00 2719 0.93 1.53 0.70 138 T_OBFU_PDF_ATTACH 2667 0.55 0.20 0.69 139 XMGappySubj_01 2611 0.58 0.33 0.68 140 TR_XM_RelayPhish 2468 0.95 1.75 0.64 141 SHORT_HELO_AND_INLINE_IMAGE 2420 0.47 0.07 0.63 142 XM_H_PHPMailer 2407 0.63 0.63 0.62 143 RCVD_IN_SORBS_DUL 2271 0.48 0.21 0.59 144 XMBdyGiftCard01 2231 0.65 0.85 0.58 145 MISSING_HEADERS 2231 0.61 0.71 0.58 146 HTML_IMAGE_ONLY_32 2130 0.48 0.30 0.55 147 FILL_THIS_FORM 2123 0.48 0.30 0.55 148 AC_DIV_BONANZA 2078 0.44 0.20 0.54 149 XMBody_95 2076 0.44 0.19 0.54 150 XMMoneyMeta_00 2068 0.70 1.13 0.53 151 XMBrknScrpt_02 2060 0.67 1.01 0.53 152 XMSubMetaI_00 2054 0.80 1.50 0.53 153 XMDateMe_00 1976 0.49 0.44 0.51 154 XMHTMLBadTable_001 1958 0.66 1.06 0.51 155 RELAYCOUNTRY_AU 1935 0.59 0.84 0.50 156 T_XMHurry_00 1903 0.75 1.42 0.49 157 HTTPS_HTTP_MISMATCH 1849 0.55 0.75 0.48 158 HTML_IMAGE_ONLY_28 1807 0.53 0.70 0.47 159 XMPhish14 1799 0.58 0.87 0.47 160 TM2_M_A_HREF_HREF 1777 0.52 0.68 0.46 161 XMSubMetaSxObfu_02 1729 0.40 0.29 0.45 162 XMBody_78 1726 0.60 0.98 0.45 163 T_FILL_THIS_FORM_LONG 1706 0.37 0.20 0.44 164 XM_E_Blogspot 1695 0.33 0.06 0.44 165 FUZZY_CREDIT 1677 0.35 0.15 0.43 166 XM_B_REG_HTML 1650 0.62 1.10 0.43 167 XM_B_COPY_HTML 1631 0.55 0.88 0.42 168 RELAYCOUNTRY_DE 1623 0.66 1.26 0.42 169 TM2_M_BODY_EMPTY 1603 0.43 0.47 0.41 170 RDNS_DYNAMIC 1596 0.63 1.18 0.41 171 T_Symld_Words_02 1581 0.51 0.78 0.41 172 HTML_TAG_BALANCE_BODY 1577 0.62 1.15 0.41 173 FORGED_GMAIL_RCVD 1563 0.48 0.68 0.40 174 HTML_IMAGE_ONLY_24 1562 0.41 0.41 0.40 175 XMPhish30 1540 0.65 1.28 0.40 176 XMBody_17 1517 0.82 1.91 0.39 177 RELAYCOUNTRY_FR 1499 0.75 1.66 0.39 178 T_FILL_THIS_FORM_LOAN 1480 0.29 0.04 0.38 179 XMSlimDrugH 1442 0.52 0.91 0.37 180 TVD_SPACE_RATIO 1436 0.31 0.16 0.37 181 PLING_QUERY 1434 0.49 0.80 0.37 182 UPPERCASE_50_75 1430 0.32 0.20 0.37 183 SpammyFromTLD_02 1426 0.85 2.08 0.37 184 XM_B_TRADE_HTML 1419 0.38 0.41 0.37 185 XM_H_PHPOS_M 1414 0.36 0.36 0.37 186 XMHTML_After_End 1385 0.79 1.90 0.36 187 T_TooManySym_04 1378 0.26 0.02 0.36 188 FROM_EGROUPS 1367 0.26 0.00 0.35 189 PRESENTAMOS_ES 1320 0.25 0.03 0.34 190 URI_NOVOWEL 1317 0.52 0.96 0.34 191 XMLngstWrd_00 1279 0.39 0.54 0.33 192 XMBody_29 1272 0.27 0.11 0.33 193 T_MONEY_PERCENT 1249 0.62 1.37 0.32 194 TR_LOTS_OF_MONEY2 1249 0.62 1.37 0.32 195 HTML_IMAGE_ONLY_20 1234 0.35 0.44 0.32 196 RELAYCOUNTRY_NL 1211 0.38 0.55 0.31 197 XMSubEmpty 1189 0.28 0.20 0.31 198 DKIM_ADSP_NXDOMAIN 1169 0.35 0.47 0.30 199 XMLKML 1161 0.22 0.00 0.30 200 DOS_OUTLOOK_TO_MX 1147 0.25 0.11 0.30 ----------------------------------------------------------------------