Email: 490590 Autolearn: 0 AvgScore: 3.17 AvgScanTime: 3.70 sec Spam: 149263 Autolearn: 0 AvgScore: 12.61 AvgScanTime: 4.47 sec Ham: 341327 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 3.36 sec Time Spent Running SA: 503.71 hours Time Spent Processing Spam: 185.35 hours Time Spent Processing Ham: 318.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141991 88.01 95.13 84.89 2 DKIM_SIGNED 127905 73.93 85.69 68.79 3 XM_DK_Pass 124680 72.41 83.53 67.54 4 DKIM_VALID 119663 68.88 80.17 63.94 5 DCC_CHECK 119241 47.25 79.89 32.98 6 XMListUnsubscribeExists 108449 52.14 72.66 43.17 7 DKIM_VALID_AU 93180 49.86 62.43 44.36 8 XM_H_QuotedFrom 83015 39.37 55.62 32.27 9 XM_DK_Undo_02 75941 25.30 50.88 14.11 10 BAYES_99 68149 23.21 45.66 13.39 11 BAYES_999 58893 20.27 39.46 11.88 12 HTML_FONT_LOW_CONTRAST 56609 29.14 37.93 25.29 13 LOC_TINY_FONT_1 54497 24.69 36.51 19.52 14 TR_DCC_Bayes_99 53446 15.13 35.81 6.09 15 BAYES_50 47826 51.31 32.04 59.73 16 MIME_HTML_ONLY 45011 23.52 30.16 20.62 17 XMSubLong 41630 22.43 27.89 20.04 18 FVGT_m_MULTI_ODD 40392 21.69 27.06 19.34 19 DKIM_VALID_EF 37438 26.18 25.08 26.67 20 T_KAM_HTML_FONT_INVALID 32134 16.08 21.53 13.69 21 T_TM2_M_HEADER_IN_MSG 30315 30.29 20.31 34.66 22 XM_Body_Dirty_Words 30235 13.14 20.26 10.03 23 RELAYCOUNTRY_META 29329 9.83 19.65 5.54 24 DCC_CHECK_NEGATIVE 26930 50.46 18.04 64.63 25 MultiRelay 26172 18.66 17.53 19.16 26 XM_Multi_Part_URI 24950 12.58 16.72 10.78 27 HTML_IMAGE_RATIO_02 24634 9.55 16.50 6.51 28 XM_Evil_Numbers_Gen 23386 9.76 15.67 7.17 29 BOTNET 21102 5.01 14.14 1.02 30 FSL_BULK_SIG 19277 8.93 12.91 7.19 31 BOTNET_IPINHOSTNAME 19225 7.35 12.88 4.94 32 LOTS_OF_MONEY 18685 10.15 12.52 9.11 33 UNTRUSTED_Relay 18430 4.81 12.35 1.51 34 T_XMDrugObfuBody_14 16154 8.24 10.82 7.12 35 XM_B_Phish_Phrases 15765 6.28 10.56 4.41 36 XMSexyCombo_05 15430 5.13 10.34 2.85 37 LotsOfNums_01 13548 7.84 9.08 7.30 38 TooManyTo_001 12939 8.84 8.67 8.92 39 HTML_IMAGE_RATIO_04 12601 5.52 8.44 4.24 40 XM_UncommonTLD01 12326 5.14 8.26 3.77 41 TR_XM_DocInvoice 12014 5.25 8.05 4.02 42 XM_H_Long_From01 11671 6.93 7.82 6.54 43 XMSubMetaSx_00 11455 4.63 7.67 3.29 44 MPART_ALT_DIFF 10985 5.26 7.36 4.34 45 BAYES_80 10597 4.86 7.10 3.89 46 BAYES_60 10407 6.40 6.97 6.15 47 RCVD_IN_RP_SAFE 8776 7.55 5.88 8.28 48 XM_UB50 8670 2.46 5.81 1.00 49 FROM_EXCESS_BASE64 8447 4.02 5.66 3.31 50 DKIM_INVALID 8242 5.06 5.52 4.85 51 MIME_QP_LONG_LINE 7673 5.04 5.14 4.99 52 HTML_IMAGE_RATIO_06 7206 3.95 4.83 3.57 53 RCVD_IN_RP_CERTIFIED 7185 6.84 4.81 7.72 54 XM_DIRTYINTL 7160 2.73 4.80 1.83 55 MIME_HTML_MOSTLY 7158 2.96 4.80 2.16 56 TM2_M_URI_OPT_OUT 7100 2.54 4.76 1.57 57 XMNumbers 6791 3.64 4.55 3.24 58 XM_SendGrid 6745 4.67 4.52 4.73 59 RCVD_IN_MSPIKE_H2 6598 4.78 4.42 4.93 60 XMStrtUSub 6539 4.47 4.38 4.51 61 RCVD_IN_BL_SPAMCOP_NET 6496 1.84 4.35 0.74 62 BAYES_95 6349 2.99 4.25 2.43 63 T_REMOTE_IMAGE 6142 4.85 4.11 5.17 64 HTML_IMAGE_RATIO_08 5902 2.72 3.95 2.18 65 XM_CamelCaseFrm001 5743 2.20 3.85 1.47 66 RELAYCOUNTRY_CA 5682 2.09 3.81 1.34 67 URI_HEX 5206 1.86 3.49 1.14 68 BOTNET_NORDNS 5147 1.09 3.45 0.06 69 T_TooManySym_01 4985 4.27 3.34 4.68 70 XM_SPF_SoftFail 4767 2.45 3.19 2.13 71 MultiRelay_Combo 4727 1.15 3.17 0.26 72 MultiRelay_CC 4727 1.15 3.17 0.26 73 MIME_HTML_ONLY_MULTI 4674 2.88 3.13 2.77 74 XM_H_Long_From02 4532 1.58 3.04 0.95 75 SUBJ_ALL_CAPS 3948 3.01 2.64 3.16 76 HTML_MIME_NO_HTML_TAG 3882 3.60 2.60 4.03 77 SpammyFromTLD_02 3807 1.08 2.55 0.44 78 SpammyFromTLD_01 3791 1.38 2.54 0.87 79 XMStockSpam_06 3622 1.32 2.43 0.83 80 RELAYCOUNTRY_FR 3599 0.95 2.41 0.32 81 RCVD_IN_IADB_LISTED 3393 4.95 2.27 6.12 82 T_XMDrugObfuBody_08 3334 1.78 2.23 1.58 83 XM_UB99 3253 0.67 2.18 0.02 84 XMDiploma_00 3185 1.48 2.13 1.19 85 XM_ProductURIs 3174 1.31 2.13 0.96 86 RELAYCOUNTRY_CN 3146 0.68 2.11 0.06 87 XM_UB60 3071 0.68 2.06 0.08 88 TooManyTo_002 3060 2.47 2.05 2.65 89 XMSexyCombo_01 3054 0.92 2.05 0.42 90 XMBdyGiftCard01 3031 1.02 2.03 0.57 91 RCVD_IN_IADB_SPF 2986 4.26 2.00 5.24 92 MAILING_LIST_MULTI 2978 2.60 2.00 2.87 93 XMSubMetaI_00 2925 1.12 1.96 0.75 94 XM_OfRef6 2905 1.75 1.95 1.67 95 XM_URI_RBL 2845 0.65 1.91 0.10 96 RCVD_IN_PSBL 2825 0.68 1.89 0.16 97 RCVD_IN_IADB_DK 2825 3.67 1.89 4.44 98 RCVD_IN_RP_RNBL 2824 0.59 1.89 0.02 99 RCVD_IN_IADB_SENDERID 2803 3.76 1.88 4.58 100 TooManyTo_003 2759 1.74 1.85 1.70 101 XMHTML_After_End 2738 0.81 1.83 0.36 102 XM_UB999 2596 0.54 1.74 0.01 103 XM_RXBody 2570 0.75 1.72 0.32 104 TM2_M_VERY_LONG_WORD 2455 1.03 1.64 0.76 105 PHOTO_EDITING_FREEM 2435 0.50 1.63 0.00 106 PHOTO_EDITING_DIRECT 2421 0.50 1.62 0.00 107 RELAYCOUNTRY_NL 2330 0.65 1.56 0.25 108 T_XMHurry_00 2310 0.72 1.55 0.36 109 TooManyTo_004 2296 1.30 1.54 1.20 110 URIBL_DBL_SPAM 2254 0.47 1.51 0.02 111 T_XMDrugObfuBody_00 2246 0.88 1.50 0.61 112 TR_XM_RelayPhish 2236 0.77 1.50 0.45 113 URI_TRY_3LD 2231 1.35 1.49 1.28 114 XMPhish30 2151 0.72 1.44 0.41 115 XM_DK_Undo_01 2129 1.80 1.43 1.96 116 UNPARSEABLE_RELAY 2119 3.11 1.42 3.86 117 URIBL_BLACK 2052 0.44 1.37 0.03 118 T_FILL_THIS_FORM_SHORT 2042 1.02 1.37 0.87 119 XMGenDplmaNmb 2041 0.98 1.37 0.80 120 XMPhish11 2024 1.25 1.36 1.20 121 ALL_TRUSTED 2014 13.64 1.35 19.02 122 DATE_IN_PAST_03_06 2013 0.47 1.35 0.08 123 RELAYCOUNTRY_GB 2001 1.11 1.34 1.01 124 BAYES_00 1954 5.04 1.31 6.66 125 XM_B_REG_HTML 1935 0.69 1.30 0.43 126 XMBody_17 1917 0.60 1.28 0.30 127 TR_Caps_n_Bayes_99 1897 0.49 1.27 0.15 128 XMHTMLBadTable_001 1882 0.83 1.26 0.64 129 REMOVE_BEFORE_LINK 1838 0.55 1.23 0.26 130 DKIM_ADSP_CUSTOM_MED 1819 1.19 1.22 1.17 131 TR_Symld_Words 1800 2.00 1.21 2.35 132 TR_MetaPhish_Combo_01 1700 1.02 1.14 0.97 133 HTML_FONT_SIZE_LARGE 1648 0.46 1.10 0.18 134 BAYES_40 1645 2.72 1.10 3.43 135 DIET_1 1641 0.53 1.10 0.28 136 TR_XM_DK_Bayes 1613 3.18 1.08 4.09 137 NML_ADSP_CUSTOM_MED 1600 0.93 1.07 0.87 138 LONG_JUNK_URI3 1594 0.40 1.07 0.11 139 XMLongAddy 1582 0.41 1.06 0.12 140 XMPhish14 1566 0.54 1.05 0.32 141 XMSubNoVowel 1565 0.82 1.05 0.72 142 XMMoneyMeta_00 1551 0.65 1.04 0.49 143 TR_XM_DK_Bayes1 1537 3.00 1.03 3.87 144 RELAYCOUNTRY_DE 1515 0.85 1.01 0.78 145 HTTPS_HTTP_MISMATCH 1483 0.66 0.99 0.52 146 TR_XM_DK_Bayes2 1442 2.55 0.97 3.25 147 XM_H_PHPOS 1442 2.14 0.97 2.66 148 TooManyTo_005 1427 0.96 0.96 0.96 149 XM_UB80 1418 0.31 0.95 0.04 150 BAYES_20 1410 2.11 0.94 2.62 151 HTML_TAG_BALANCE_BODY 1405 0.60 0.94 0.46 152 DATE_IN_PAST_06_12 1384 0.31 0.93 0.04 153 RCVD_IN_IADB_VOUCHED 1379 3.31 0.92 4.35 154 RDNS_DYNAMIC 1379 0.55 0.92 0.39 155 HTML_SHORT_LINK_IMG_1 1373 0.30 0.92 0.03 156 XM_B_COPY_HTML 1367 0.74 0.92 0.67 157 RELAYCOUNTRY_AT 1363 0.38 0.91 0.15 158 PLING_QUERY 1363 0.50 0.91 0.31 159 HTML_FONT_FACE_BAD 1357 1.54 0.91 1.81 160 XM_HighProb1 1351 0.28 0.91 0.01 161 BODY_URI_ONLY 1324 0.30 0.89 0.04 162 XM_PDF 1318 3.75 0.88 5.01 163 NO_DNS_FOR_FROM 1311 0.82 0.88 0.80 164 XMClaimOffer 1286 0.33 0.86 0.10 165 LOW_PRICE 1277 0.32 0.86 0.09 166 RCVD_IN_MSPIKE_H3 1267 1.70 0.85 2.07 167 RCVD_IN_MSPIKE_WL 1267 1.70 0.85 2.07 168 XMSexyCombo_04 1264 0.32 0.85 0.09 169 XMNoVowels 1264 0.72 0.85 0.67 170 XM_H_PHPMailer 1263 0.98 0.85 1.04 171 T_MONEY_PERCENT 1260 0.45 0.84 0.27 172 TR_LOTS_OF_MONEY2 1260 0.45 0.84 0.27 173 T_Symld_Words_02 1245 0.53 0.83 0.40 174 XMSubMetaSSx_00 1204 0.34 0.81 0.14 175 FSL_THIS_IS_ADV 1201 0.36 0.80 0.17 176 RELAYCOUNTRY_AU 1198 0.59 0.80 0.50 177 HTML_IMAGE_ONLY_08 1191 0.34 0.80 0.14 178 URI_NOVOWEL 1185 0.51 0.79 0.38 179 XMSubMetaSxObfu_03 1175 0.44 0.79 0.29 180 XMBody_78 1162 0.54 0.78 0.43 181 XMBrknScrpt_02 1155 0.58 0.77 0.49 182 XM_DKIMWhitelistDomains 1143 7.22 0.77 10.04 183 SUBJ_DOLLARS 1127 0.33 0.76 0.14 184 T_MANY_PILL_PRICE 1104 0.36 0.74 0.19 185 XM_S_JOY_D 1097 0.37 0.73 0.21 186 LONG_JUNK_URI2 1075 0.23 0.72 0.02 187 ANY_BOUNCE_MESSAGE 1063 2.26 0.71 2.94 188 BOUNCE_MESSAGE 1062 2.26 0.71 2.93 189 T_TooManySym_02 1045 1.43 0.70 1.75 190 TR_LOTS_OF_MONEY3 1031 0.36 0.69 0.22 191 RELAYCOUNTRY_RO 990 0.21 0.66 0.01 192 PP_MIME_FAKE_ASCII_TEXT 964 0.43 0.65 0.34 193 XM_GoogleGroups 954 1.16 0.64 1.38 194 XMCapTrack 952 1.28 0.64 1.56 195 RELAYCOUNTRY_IN 952 0.28 0.64 0.12 196 TVD_SPACE_RATIO 950 0.43 0.64 0.35 197 XMSubEmpty 947 0.41 0.63 0.31 198 HTML_IMAGE_ONLY_28 931 0.52 0.62 0.48 199 T_HTML_TAG_BALANCE_CENTER 918 0.31 0.62 0.18 200 LONG_HEX_URI 917 0.30 0.61 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 289760 88.01 95.13 84.89 2 DKIM_SIGNED 234808 73.93 85.69 68.79 3 XM_DK_Pass 230532 72.41 83.53 67.54 4 DCC_CHECK_NEGATIVE 220604 50.46 18.04 64.63 5 DKIM_VALID 218238 68.88 80.17 63.94 6 BAYES_50 203876 51.31 32.04 59.73 7 DKIM_VALID_AU 151415 49.86 62.43 44.36 8 XMListUnsubscribeExists 147335 52.14 72.66 43.17 9 T_TM2_M_HEADER_IN_MSG 118303 30.29 20.31 34.66 10 DCC_CHECK 112575 47.25 79.89 32.98 11 XM_H_QuotedFrom 110154 39.37 55.62 32.27 12 DKIM_VALID_EF 91019 26.18 25.08 26.67 13 HTML_FONT_LOW_CONTRAST 86327 29.14 37.93 25.29 14 MIME_HTML_ONLY 70365 23.52 30.16 20.62 15 XMSubLong 68414 22.43 27.89 20.04 16 LOC_TINY_FONT_1 66641 24.69 36.51 19.52 17 FVGT_m_MULTI_ODD 66022 21.69 27.06 19.34 18 MultiRelay 65394 18.66 17.53 19.16 19 ALL_TRUSTED 64913 13.64 1.35 19.02 20 XM_DK_Undo_02 48168 25.30 50.88 14.11 21 T_KAM_HTML_FONT_INVALID 46739 16.08 21.53 13.69 22 BAYES_99 45696 23.21 45.66 13.39 23 BAYES_999 40557 20.27 39.46 11.88 24 XM_Multi_Part_URI 36785 12.58 16.72 10.78 25 XM_DKIMWhitelistDomains 34277 7.22 0.77 10.04 26 XM_Body_Dirty_Words 34225 13.14 20.26 10.03 27 LOTS_OF_MONEY 31088 10.15 12.52 9.11 28 TooManyTo_001 30451 8.84 8.67 8.92 29 RCVD_IN_RP_SAFE 28266 7.55 5.88 8.28 30 RCVD_IN_RP_CERTIFIED 26348 6.84 4.81 7.72 31 IN_ZIMBRA_NJ_WHITELIST 25884 5.29 0.04 7.58 32 LotsOfNums_01 24913 7.84 9.08 7.30 33 FSL_BULK_SIG 24529 8.93 12.91 7.19 34 XM_Evil_Numbers_Gen 24485 9.76 15.67 7.17 35 T_XMDrugObfuBody_14 24295 8.24 10.82 7.12 36 BAYES_00 22749 5.04 1.31 6.66 37 XM_H_Long_From01 22321 6.93 7.82 6.54 38 HTML_IMAGE_RATIO_02 22209 9.55 16.50 6.51 39 BAYES_60 21006 6.40 6.97 6.15 40 RCVD_IN_IADB_LISTED 20878 4.95 2.27 6.12 41 TR_DCC_Bayes_99 20780 15.13 35.81 6.09 42 RELAYCOUNTRY_META 18900 9.83 19.65 5.54 43 RCVD_IN_IADB_SPF 17897 4.26 2.00 5.24 44 T_REMOTE_IMAGE 17645 4.85 4.11 5.17 45 XM_PDF 17084 3.75 0.88 5.01 46 MIME_QP_LONG_LINE 17038 5.04 5.14 4.99 47 BOTNET_IPINHOSTNAME 16852 7.35 12.88 4.94 48 RCVD_IN_MSPIKE_H2 16841 4.78 4.42 4.93 49 DKIM_INVALID 16570 5.06 5.52 4.85 50 XM_SendGrid 16144 4.67 4.52 4.73 51 T_TooManySym_01 15985 4.27 3.34 4.68 52 RCVD_IN_IADB_SENDERID 15633 3.76 1.88 4.58 53 XMStrtUSub 15377 4.47 4.38 4.51 54 RCVD_IN_IADB_DK 15167 3.67 1.89 4.44 55 XM_B_Phish_Phrases 15064 6.28 10.56 4.41 56 RCVD_IN_IADB_VOUCHED 14840 3.31 0.92 4.35 57 MPART_ALT_DIFF 14819 5.26 7.36 4.34 58 HTML_IMAGE_RATIO_04 14457 5.52 8.44 4.24 59 TR_XM_DK_Bayes 13977 3.18 1.08 4.09 60 HTML_MIME_NO_HTML_TAG 13761 3.60 2.60 4.03 61 TR_XM_DocInvoice 13730 5.25 8.05 4.02 62 BAYES_80 13261 4.86 7.10 3.89 63 TR_XM_DK_Bayes1 13193 3.00 1.03 3.87 64 UNPARSEABLE_RELAY 13160 3.11 1.42 3.86 65 XM_UncommonTLD01 12884 5.14 8.26 3.77 66 TVD_RCVD_IP 12266 2.62 0.40 3.59 67 HTML_IMAGE_RATIO_06 12176 3.95 4.83 3.57 68 BAYES_40 11704 2.72 1.10 3.43 69 FROM_EXCESS_BASE64 11282 4.02 5.66 3.31 70 XMSubMetaSx_00 11245 4.63 7.67 3.29 71 TR_XM_DK_Bayes2 11082 2.55 0.97 3.25 72 XMNumbers 11062 3.64 4.55 3.24 73 SUBJ_ALL_CAPS 10799 3.01 2.64 3.16 74 ANY_BOUNCE_MESSAGE 10020 2.26 0.71 2.94 75 BOUNCE_MESSAGE 10017 2.26 0.71 2.93 76 MAILING_LIST_MULTI 9783 2.60 2.00 2.87 77 XMSexyCombo_05 9737 5.13 10.34 2.85 78 MIME_HTML_ONLY_MULTI 9466 2.88 3.13 2.77 79 XM_H_PHPOS 9076 2.14 0.97 2.66 80 TooManyTo_002 9040 2.47 2.05 2.65 81 BAYES_20 8954 2.11 0.94 2.62 82 HELO_NODOT 8375 1.82 0.38 2.45 83 BAYES_95 8300 2.99 4.25 2.43 84 IN_HORDE_ADDRESS_BOOK 8038 1.67 0.11 2.35 85 TR_Symld_Words 8028 2.00 1.21 2.35 86 HTML_IMAGE_RATIO_08 7426 2.72 3.95 2.18 87 MIME_HTML_MOSTLY 7384 2.96 4.80 2.16 88 RCVD_IN_IADB_OPTIN 7311 1.63 0.46 2.14 89 XM_SPF_SoftFail 7273 2.45 3.19 2.13 90 RCVD_IN_MSPIKE_H3 7073 1.70 0.85 2.07 91 RCVD_IN_MSPIKE_WL 7073 1.70 0.85 2.07 92 INVALID_MSGID 6891 1.46 0.19 2.02 93 XM_DK_Undo_01 6683 1.80 1.43 1.96 94 TO_MALFORMED 6409 1.31 0.01 1.88 95 XM_DIRTYINTL 6240 2.73 4.80 1.83 96 HTML_FONT_FACE_BAD 6177 1.54 0.91 1.81 97 T_TooManySym_02 5958 1.43 0.70 1.75 98 TooManyTo_003 5797 1.74 1.85 1.70 99 BAYES_05 5696 1.35 0.61 1.67 100 XM_OfRef6 5684 1.75 1.95 1.67 101 T_XMDrugObfuBody_08 5392 1.78 2.23 1.58 102 TM2_M_URI_OPT_OUT 5369 2.54 4.76 1.57 103 XMCapTrack 5308 1.28 0.64 1.56 104 UNTRUSTED_Relay 5162 4.81 12.35 1.51 105 XM_CamelCaseFrm001 5032 2.20 3.85 1.47 106 XM_GoogleGroups 4721 1.16 0.64 1.38 107 RELAYCOUNTRY_CA 4582 2.09 3.81 1.34 108 URI_TRY_3LD 4377 1.35 1.49 1.28 109 USER_IN_DEF_DKIM_WL 4121 0.86 0.06 1.21 110 XMPhish11 4094 1.25 1.36 1.20 111 TooManyTo_004 4092 1.30 1.54 1.20 112 XMDiploma_00 4060 1.48 2.13 1.19 113 DKIM_ADSP_CUSTOM_MED 4006 1.19 1.22 1.17 114 URI_HEX 3897 1.86 3.49 1.14 115 XM_H_PHPMailer 3536 0.98 0.85 1.04 116 BOTNET 3498 5.01 14.14 1.02 117 RELAYCOUNTRY_GB 3445 1.11 1.34 1.01 118 XM_UB50 3403 2.46 5.81 1.00 119 TR_MetaPhish_Combo_01 3319 1.02 1.14 0.97 120 TooManyTo_005 3284 0.96 0.96 0.96 121 XM_ProductURIs 3267 1.31 2.13 0.96 122 XM_H_Long_From02 3235 1.58 3.04 0.95 123 T_FILL_THIS_FORM_SHORT 2977 1.02 1.37 0.87 124 SpammyFromTLD_01 2959 1.38 2.54 0.87 125 NML_ADSP_CUSTOM_MED 2957 0.93 1.07 0.87 126 RCVD_IN_IADB_DOPTIN 2914 0.62 0.07 0.85 127 USER_IN_WHITELIST 2860 0.58 0.00 0.84 128 XMStockSpam_06 2833 1.32 2.43 0.83 129 XMGenDplmaNmb 2743 0.98 1.37 0.80 130 NO_DNS_FOR_FROM 2729 0.82 0.88 0.80 131 T_TooManySym_03 2670 0.57 0.10 0.78 132 RELAYCOUNTRY_DE 2656 0.85 1.01 0.78 133 TM2_M_VERY_LONG_WORD 2590 1.03 1.64 0.76 134 FILL_THIS_FORM 2569 0.61 0.29 0.75 135 XMSubMetaI_00 2555 1.12 1.96 0.75 136 RCVD_IN_BL_SPAMCOP_NET 2520 1.84 4.35 0.74 137 T_OBFU_PDF_ATTACH 2520 0.58 0.21 0.74 138 XMGappySubj_01 2511 0.65 0.46 0.74 139 XMSubNoVowel 2461 0.82 1.05 0.72 140 XM_B_COPY_HTML 2287 0.74 0.92 0.67 141 XMNoVowels 2285 0.72 0.85 0.67 142 XMHTMLBadTable_001 2192 0.83 1.26 0.64 143 SHORT_HELO_AND_INLINE_IMAGE 2127 0.46 0.08 0.62 144 RCVD_IN_SORBS_DUL 2089 0.52 0.30 0.61 145 T_XMDrugObfuBody_00 2082 0.88 1.50 0.61 146 T_FILL_THIS_FORM_LOAN 2054 0.48 0.20 0.60 147 XM_ShortIntro_01 1965 0.47 0.22 0.58 148 XMBdyGiftCard01 1958 1.02 2.03 0.57 149 XMBody_95 1946 0.45 0.19 0.57 150 T_FILL_THIS_FORM_LONG 1915 0.43 0.11 0.56 151 TM2_M_A_HREF_HREF 1899 0.56 0.56 0.56 152 MISSING_HEADERS 1885 0.50 0.39 0.55 153 XMRcvdHeader_15 1866 0.38 0.00 0.55 154 FORGED_GMAIL_RCVD 1812 0.55 0.60 0.53 155 XMSubMetaSxObfu_02 1767 0.54 0.60 0.52 156 HTTPS_HTTP_MISMATCH 1760 0.66 0.99 0.52 157 RELAYCOUNTRY_AU 1691 0.59 0.80 0.50 158 XMBrknScrpt_02 1671 0.58 0.77 0.49 159 XMMoneyMeta_00 1656 0.65 1.04 0.49 160 AC_DIV_BONANZA 1649 0.37 0.11 0.48 161 HTML_IMAGE_ONLY_28 1641 0.52 0.62 0.48 162 HTML_IMAGE_ONLY_32 1634 0.44 0.36 0.48 163 XMDateMe_00 1610 0.48 0.49 0.47 164 HTML_TAG_BALANCE_BODY 1560 0.60 0.94 0.46 165 TR_XM_RelayPhish 1544 0.77 1.50 0.45 166 SpammyFromTLD_02 1507 1.08 2.55 0.44 167 XMBody_78 1467 0.54 0.78 0.43 168 XM_B_REG_HTML 1464 0.69 1.30 0.43 169 XM_B_TRADE_HTML 1457 0.43 0.45 0.43 170 XMSexyCombo_01 1445 0.92 2.05 0.42 171 XMPhish30 1404 0.72 1.44 0.41 172 T_Symld_Words_02 1355 0.53 0.83 0.40 173 XM_H_PHPOS_M 1341 0.37 0.33 0.39 174 RDNS_DYNAMIC 1326 0.55 0.92 0.39 175 T_TooManySym_04 1323 0.28 0.02 0.39 176 TM2_M_BODY_EMPTY 1319 0.32 0.18 0.39 177 XM_H_Trusted_IP 1316 0.27 0.00 0.39 178 XM_D_tchamptons_WL 1296 0.27 0.02 0.38 179 UPPERCASE_50_75 1294 0.33 0.20 0.38 180 URI_NOVOWEL 1294 0.51 0.79 0.38 181 HTML_IMAGE_ONLY_24 1261 0.34 0.28 0.37 182 T_XMHurry_00 1227 0.72 1.55 0.36 183 XMHTML_After_End 1219 0.81 1.83 0.36 184 XMSlimDrugH 1195 0.43 0.60 0.35 185 TVD_SPACE_RATIO 1181 0.43 0.64 0.35 186 PP_MIME_FAKE_ASCII_TEXT 1145 0.43 0.65 0.34 187 HTML_IMAGE_ONLY_20 1116 0.37 0.48 0.33 188 XMLngstWrd_00 1102 0.37 0.48 0.32 189 XM_RXBody 1088 0.75 1.72 0.32 190 XMPhish14 1083 0.54 1.05 0.32 191 RELAYCOUNTRY_FR 1077 0.95 2.41 0.32 192 PLING_QUERY 1075 0.50 0.91 0.31 193 XMSubEmpty 1074 0.41 0.63 0.31 194 FROM_EGROUPS 1052 0.22 0.01 0.31 195 DKIM_ADSP_NXDOMAIN 1047 0.37 0.51 0.31 196 XMLKML 1036 0.21 0.00 0.30 197 XMBody_17 1033 0.60 1.28 0.30 198 MSGID_FROM_MTA_HEADER 1033 0.28 0.23 0.30 199 XMBody_29 1011 0.28 0.25 0.30 200 TR_MetaPhish_Combo_01b 987 0.27 0.23 0.29 ----------------------------------------------------------------------