Email: 522172 Autolearn: 0 AvgScore: 3.64 AvgScanTime: 3.92 sec Spam: 164159 Autolearn: 0 AvgScore: 12.48 AvgScanTime: 4.87 sec Ham: 358013 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 3.49 sec Time Spent Running SA: 568.77 hours Time Spent Processing Spam: 221.97 hours Time Spent Processing Ham: 346.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155922 87.13 94.98 83.52 2 DKIM_SIGNED 141635 74.55 86.28 69.17 3 XM_DK_Pass 138063 72.93 84.10 67.80 4 DCC_CHECK 132139 48.43 80.49 33.73 5 DKIM_VALID 130749 68.38 79.65 63.21 6 XMListUnsubscribeExists 122233 52.99 74.46 43.14 7 DKIM_VALID_AU 101274 49.34 61.69 43.67 8 XM_H_QuotedFrom 93427 40.03 56.91 32.28 9 XM_DK_Undo_02 84467 24.97 51.45 12.82 10 BAYES_99 74876 22.52 45.61 11.93 11 BAYES_999 64412 19.61 39.24 10.61 12 HTML_FONT_LOW_CONTRAST 63486 28.70 38.67 24.13 13 LOC_TINY_FONT_1 60598 23.71 36.91 17.66 14 TR_DCC_Bayes_99 59552 15.15 36.28 5.47 15 BAYES_50 51947 51.39 31.64 60.44 16 MIME_HTML_ONLY 46248 21.28 28.17 18.12 17 XMSubLong 44786 22.84 27.28 20.81 18 FVGT_m_MULTI_ODD 44098 21.75 26.86 19.40 19 DKIM_VALID_EF 42352 26.25 25.80 26.45 20 T_TM2_M_HEADER_IN_MSG 35947 29.99 21.90 33.70 21 T_KAM_HTML_FONT_INVALID 34844 16.82 21.23 14.80 22 XM_Body_Dirty_Words 30692 11.99 18.70 8.91 23 DCC_CHECK_NEGATIVE 28685 49.27 17.47 63.85 24 RELAYCOUNTRY_META 27571 9.08 16.80 5.54 25 MultiRelay 27338 18.80 16.65 19.78 26 HTML_IMAGE_RATIO_02 27120 9.48 16.52 6.25 27 XM_Multi_Part_URI 25525 11.61 15.55 9.80 28 BOTNET 22961 5.30 13.99 1.32 29 XM_Evil_Numbers_Gen 22105 9.18 13.47 7.21 30 BOTNET_IPINHOSTNAME 20876 6.63 12.72 3.84 31 LOTS_OF_MONEY 20379 9.74 12.41 8.52 32 FSL_BULK_SIG 18860 8.61 11.49 7.29 33 T_XMDrugObfuBody_14 16846 8.23 10.26 7.29 34 HTML_IMAGE_RATIO_04 16174 5.85 9.85 4.02 35 LotsOfNums_01 15453 8.11 9.41 7.51 36 UNTRUSTED_Relay 15386 3.84 9.37 1.30 37 XMSexyCombo_05 15216 4.72 9.27 2.64 38 XM_B_Phish_Phrases 14269 5.60 8.69 4.18 39 XM_H_Long_From01 13611 6.36 8.29 5.48 40 MPART_ALT_DIFF 13122 4.21 7.99 2.48 41 BAYES_80 13047 5.13 7.95 3.83 42 XMSubMetaSx_00 12153 4.44 7.40 3.08 43 TooManyTo_001 11155 8.76 6.80 9.66 44 XM_UncommonTLD01 11142 4.68 6.79 3.71 45 TR_XM_DocInvoice 10966 4.83 6.68 3.98 46 DKIM_INVALID 10886 6.17 6.63 5.95 47 BAYES_60 10799 6.51 6.58 6.47 48 FROM_EXCESS_BASE64 10265 4.52 6.25 3.73 49 XMNumbers 8721 4.01 5.31 3.41 50 MIME_HTML_MOSTLY 8519 3.11 5.19 2.16 51 HTML_IMAGE_RATIO_06 7839 3.31 4.78 2.65 52 MIME_QP_LONG_LINE 7653 5.33 4.66 5.64 53 RCVD_IN_RP_SAFE 7513 7.06 4.58 8.20 54 XM_SendGrid 7375 4.61 4.49 4.66 55 HTML_IMAGE_RATIO_08 7359 2.83 4.48 2.07 56 TM2_M_URI_OPT_OUT 7313 2.59 4.45 1.74 57 BAYES_95 7067 3.09 4.30 2.53 58 XM_UB50 7004 1.96 4.27 0.90 59 RCVD_IN_MSPIKE_H2 6723 4.96 4.10 5.36 60 XM_DIRTYINTL 6554 2.47 3.99 1.77 61 XM_CamelCaseFrm001 6418 2.57 3.91 1.96 62 XMStrtUSub 6382 3.47 3.89 3.29 63 RELAYCOUNTRY_CA 6239 2.08 3.80 1.30 64 RCVD_IN_RP_CERTIFIED 6070 6.23 3.70 7.40 65 XM_SPF_SoftFail 5976 2.69 3.64 2.26 66 RCVD_IN_BL_SPAMCOP_NET 5495 1.53 3.35 0.70 67 T_REMOTE_IMAGE 5244 4.18 3.19 4.63 68 URI_HEX 5021 1.76 3.06 1.17 69 SpammyFromTLD_02 4872 1.19 2.97 0.37 70 NO_DNS_FOR_FROM 4824 1.98 2.94 1.54 71 MIME_HTML_ONLY_MULTI 4822 1.70 2.94 1.14 72 T_XMDrugObfuBody_08 4663 1.94 2.84 1.53 73 SpammyFromTLD_01 4480 1.42 2.73 0.82 74 MultiRelay_CC 4423 1.00 2.69 0.23 75 MultiRelay_Combo 4423 1.00 2.69 0.23 76 T_TooManySym_01 4405 4.03 2.68 4.65 77 SUBJ_ALL_CAPS 4112 3.61 2.50 4.11 78 XM_H_Long_From02 3816 1.45 2.32 1.05 79 HTML_MIME_NO_HTML_TAG 3797 2.47 2.31 2.54 80 XMDiploma_00 3725 1.71 2.27 1.46 81 XM_OfRef6 3655 1.81 2.23 1.62 82 RCVD_IN_RP_RNBL 3600 0.71 2.19 0.03 83 XMSubMetaSxObfu_03 3407 0.90 2.08 0.36 84 RCVD_IN_IADB_LISTED 3348 4.61 2.04 5.79 85 XM_URI_RBL 3247 0.71 1.98 0.13 86 BOTNET_NORDNS 3231 0.64 1.97 0.03 87 T_XMDrugObfuBody_00 3112 1.20 1.90 0.88 88 TM2_M_VERY_LONG_WORD 3054 1.19 1.86 0.88 89 RELAYCOUNTRY_FR 3044 0.77 1.85 0.27 90 RCVD_IN_IADB_SPF 2918 4.03 1.78 5.06 91 XMSubMetaI_00 2894 1.02 1.76 0.67 92 RCVD_IN_IADB_SENDERID 2780 3.59 1.69 4.45 93 RCVD_IN_IADB_DK 2743 3.49 1.67 4.33 94 XMHTML_After_End 2598 0.72 1.58 0.32 95 XMBody_17 2493 0.71 1.52 0.35 96 DATE_IN_PAST_06_12 2484 0.51 1.51 0.05 97 URIBL_DBL_SPAM 2441 0.48 1.49 0.02 98 XMGenDplmaNmb 2422 1.10 1.48 0.93 99 XMPhish30 2408 0.75 1.47 0.43 100 MAILING_LIST_MULTI 2396 2.45 1.46 2.91 101 XM_UB60 2340 0.50 1.43 0.07 102 XM_UB99 2336 0.45 1.42 0.01 103 XM_DK_Undo_01 2280 1.79 1.39 1.97 104 T_XMHurry_00 2265 0.71 1.38 0.41 105 RCVD_IN_PSBL 2261 0.56 1.38 0.18 106 URIBL_BLACK 2249 0.46 1.37 0.04 107 XMMoneyMeta_00 2244 0.78 1.37 0.51 108 BAYES_00 2242 5.36 1.37 7.19 109 UNPARSEABLE_RELAY 2206 2.36 1.34 2.82 110 XMStockSpam_06 2194 0.80 1.34 0.55 111 TooManyTo_002 2191 2.57 1.33 3.13 112 TR_Caps_n_Bayes_99 2137 0.63 1.30 0.31 113 URI_TRY_3LD 2104 1.02 1.28 0.89 114 XMSexyCombo_01 2078 0.59 1.27 0.27 115 XMBrknScrpt_02 2063 0.77 1.26 0.54 116 XMBody_78 2034 0.73 1.24 0.49 117 TR_XM_RelayPhish 2025 0.71 1.23 0.48 118 ALL_TRUSTED 2025 13.87 1.23 19.67 119 XMPhish11 1979 1.24 1.21 1.25 120 PHOTO_EDITING_DIRECT 1975 0.38 1.20 0.01 121 TooManyTo_003 1971 1.77 1.20 2.03 122 DATE_IN_PAST_03_06 1965 0.43 1.20 0.08 123 RELAYCOUNTRY_AU 1962 0.74 1.20 0.53 124 RELAYCOUNTRY_GB 1948 1.25 1.19 1.28 125 XMBdyGiftCard01 1940 0.72 1.18 0.51 126 T_FILL_THIS_FORM_SHORT 1903 1.00 1.16 0.93 127 XM_ProductURIs 1883 1.04 1.15 0.99 128 XM_UB999 1873 0.36 1.14 0.01 129 RELAYCOUNTRY_CN 1845 0.40 1.12 0.06 130 TR_XM_DK_Bayes 1819 3.27 1.11 4.26 131 TR_MetaPhish_Combo_01 1748 1.05 1.06 1.04 132 TR_Symld_Words 1714 3.42 1.04 4.51 133 TR_XM_DK_Bayes1 1702 3.06 1.04 3.98 134 DIET_1 1701 0.46 1.04 0.20 135 SUBJ_DOLLARS 1695 0.47 1.03 0.21 136 XM_RXBody 1690 0.47 1.03 0.21 137 BAYES_40 1690 2.61 1.03 3.33 138 XM_UB80 1679 0.33 1.02 0.02 139 T_MONEY_PERCENT 1650 0.52 1.01 0.30 140 TR_LOTS_OF_MONEY2 1650 0.52 1.01 0.30 141 XM_HighProb1 1635 0.34 1.00 0.04 142 HTML_FONT_FACE_BAD 1635 0.67 1.00 0.52 143 TooManyTo_004 1611 1.30 0.98 1.45 144 TR_XM_DK_Bayes2 1608 2.64 0.98 3.40 145 TR_LOTS_OF_MONEY3 1602 0.51 0.98 0.30 146 URI_NOVOWEL 1596 0.50 0.97 0.28 147 XM_B_REG_HTML 1576 0.70 0.96 0.58 148 XMLongAddy 1564 0.37 0.95 0.11 149 BODY_ENHANCEMENT 1553 0.31 0.95 0.02 150 FILL_THIS_FORM 1551 0.79 0.94 0.72 151 RDNS_DYNAMIC 1533 0.60 0.93 0.44 152 TRACKER_ID 1521 0.38 0.93 0.14 153 FSL_THIS_IS_ADV 1485 0.46 0.90 0.25 154 REMOVE_BEFORE_LINK 1485 0.42 0.90 0.20 155 BAYES_20 1478 1.98 0.90 2.47 156 RCVD_IN_MSPIKE_WL 1466 1.64 0.89 1.99 157 DKIM_ADSP_NXDOMAIN 1461 0.47 0.89 0.28 158 ANY_BOUNCE_MESSAGE 1461 2.45 0.89 3.16 159 XM_H_PHPOS 1460 1.23 0.89 1.39 160 MPART_ALT_DIFF_COUNT 1458 0.45 0.89 0.25 161 RCVD_IN_IADB_VOUCHED 1457 3.02 0.89 3.99 162 BOUNCE_MESSAGE 1449 2.44 0.88 3.16 163 T_Symld_Words_02 1442 0.76 0.88 0.71 164 XM_B_COPY_HTML 1432 0.59 0.87 0.46 165 RCVD_IN_MSPIKE_H3 1423 1.62 0.87 1.96 166 XM_PDF 1416 5.28 0.86 7.30 167 BODY_URI_ONLY 1390 0.30 0.85 0.04 168 XM_BadFromFormat 1386 0.41 0.84 0.22 169 PLING_QUERY 1376 0.45 0.84 0.27 170 T_TooManySym_02 1371 1.71 0.84 2.11 171 HTTPS_HTTP_MISMATCH 1371 0.70 0.84 0.64 172 HTML_FONT_SIZE_HUGE 1327 0.34 0.81 0.12 173 RELAYCOUNTRY_DE 1326 0.60 0.81 0.51 174 RELAYCOUNTRY_IN 1325 0.34 0.81 0.13 175 XMSlimDrugH 1323 0.47 0.81 0.32 176 XM_Body_Obfu01 1323 0.50 0.81 0.36 177 RELAYCOUNTRY_AT 1318 0.33 0.80 0.11 178 TR_Mismatch_TLD_02 1317 0.30 0.80 0.07 179 XMHTMLBadTable_001 1311 0.49 0.80 0.35 180 XMPhish14 1250 0.47 0.76 0.33 181 HTML_IMAGE_ONLY_08 1243 0.33 0.76 0.13 182 T_HTML_TAG_BALANCE_CENTER 1226 0.35 0.75 0.17 183 HTML_IMAGE_ONLY_28 1202 0.56 0.73 0.48 184 HTML_SHORT_LINK_IMG_1 1182 0.24 0.72 0.03 185 XM_XX_Yahoo 1181 0.32 0.72 0.13 186 XMCapTrack 1157 1.43 0.70 1.76 187 TooManyTo_005 1145 0.98 0.70 1.11 188 T_PDS_FROM_2_EMAILS 1135 0.25 0.69 0.04 189 XMSubMetaSSx_00 1134 0.31 0.69 0.14 190 XMClaimOffer 1089 0.38 0.66 0.25 191 LOW_PRICE 1077 0.28 0.66 0.11 192 LONG_JUNK_URI3 1065 0.26 0.65 0.08 193 XM_H_PHPMailer 1062 0.79 0.65 0.85 194 LongTLD 1032 0.34 0.63 0.21 195 XM_GoogleGroups 1028 1.15 0.63 1.38 196 HTML_TAG_BALANCE_BODY 1019 0.50 0.62 0.44 197 PP_MIME_FAKE_ASCII_TEXT 1015 0.29 0.62 0.14 198 TM2_M_A_HREF_HREF 1007 0.49 0.61 0.44 199 HTML_FONT_SIZE_LARGE 983 0.31 0.60 0.18 200 RELAYCOUNTRY_RO 983 0.19 0.60 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 299025 87.13 94.98 83.52 2 DKIM_SIGNED 247623 74.55 86.28 69.17 3 XM_DK_Pass 242737 72.93 84.10 67.80 4 DCC_CHECK_NEGATIVE 228578 49.27 17.47 63.85 5 DKIM_VALID 226305 68.38 79.65 63.21 6 BAYES_50 216395 51.39 31.64 60.44 7 DKIM_VALID_AU 156359 49.34 61.69 43.67 8 XMListUnsubscribeExists 154464 52.99 74.46 43.14 9 DCC_CHECK 120772 48.43 80.49 33.73 10 T_TM2_M_HEADER_IN_MSG 120641 29.99 21.90 33.70 11 XM_H_QuotedFrom 115583 40.03 56.91 32.28 12 DKIM_VALID_EF 94693 26.25 25.80 26.45 13 HTML_FONT_LOW_CONTRAST 86384 28.70 38.67 24.13 14 XMSubLong 74498 22.84 27.28 20.81 15 MultiRelay 70818 18.80 16.65 19.78 16 ALL_TRUSTED 70421 13.87 1.23 19.67 17 FVGT_m_MULTI_ODD 69453 21.75 26.86 19.40 18 MIME_HTML_ONLY 64885 21.28 28.17 18.12 19 LOC_TINY_FONT_1 63211 23.71 36.91 17.66 20 T_KAM_HTML_FONT_INVALID 52970 16.82 21.23 14.80 21 XM_DK_Undo_02 45908 24.97 51.45 12.82 22 BAYES_99 42713 22.52 45.61 11.93 23 BAYES_999 37969 19.61 39.24 10.61 24 XM_Multi_Part_URI 35081 11.61 15.55 9.80 25 TooManyTo_001 34589 8.76 6.80 9.66 26 XM_Body_Dirty_Words 31896 11.99 18.70 8.91 27 XM_DKIMWhitelistDomains 31043 5.96 0.06 8.67 28 LOTS_OF_MONEY 30502 9.74 12.41 8.52 29 RCVD_IN_RP_SAFE 29348 7.06 4.58 8.20 30 LotsOfNums_01 26886 8.11 9.41 7.51 31 RCVD_IN_RP_CERTIFIED 26477 6.23 3.70 7.40 32 XM_PDF 26129 5.28 0.86 7.30 33 T_XMDrugObfuBody_14 26107 8.23 10.26 7.29 34 FSL_BULK_SIG 26082 8.61 11.49 7.29 35 XM_Evil_Numbers_Gen 25823 9.18 13.47 7.21 36 BAYES_00 25730 5.36 1.37 7.19 37 BAYES_60 23176 6.51 6.58 6.47 38 HTML_IMAGE_RATIO_02 22365 9.48 16.52 6.25 39 DKIM_INVALID 21318 6.17 6.63 5.95 40 IN_ZIMBRA_NJ_WHITELIST 21290 4.09 0.04 5.95 41 RCVD_IN_IADB_LISTED 20737 4.61 2.04 5.79 42 MIME_QP_LONG_LINE 20185 5.33 4.66 5.64 43 RELAYCOUNTRY_META 19843 9.08 16.80 5.54 44 XM_H_Long_From01 19611 6.36 8.29 5.48 45 TR_DCC_Bayes_99 19575 15.15 36.28 5.47 46 RCVD_IN_MSPIKE_H2 19199 4.96 4.10 5.36 47 RCVD_IN_IADB_SPF 18105 4.03 1.78 5.06 48 XM_SendGrid 16691 4.61 4.49 4.66 49 T_TooManySym_01 16662 4.03 2.68 4.65 50 T_REMOTE_IMAGE 16560 4.18 3.19 4.63 51 TR_Symld_Words 16142 3.42 1.04 4.51 52 RCVD_IN_IADB_SENDERID 15949 3.59 1.69 4.45 53 RCVD_IN_IADB_DK 15496 3.49 1.67 4.33 54 TR_XM_DK_Bayes 15254 3.27 1.11 4.26 55 XM_B_Phish_Phrases 14982 5.60 8.69 4.18 56 SUBJ_ALL_CAPS 14721 3.61 2.50 4.11 57 HTML_IMAGE_RATIO_04 14381 5.85 9.85 4.02 58 RCVD_IN_IADB_VOUCHED 14297 3.02 0.89 3.99 59 TR_XM_DK_Bayes1 14259 3.06 1.04 3.98 60 TR_XM_DocInvoice 14250 4.83 6.68 3.98 61 BOTNET_IPINHOSTNAME 13753 6.63 12.72 3.84 62 BAYES_80 13727 5.13 7.95 3.83 63 FROM_EXCESS_BASE64 13359 4.52 6.25 3.73 64 XM_UncommonTLD01 13284 4.68 6.79 3.71 65 XMNumbers 12217 4.01 5.31 3.41 66 TR_XM_DK_Bayes2 12188 2.64 0.98 3.40 67 BAYES_40 11918 2.61 1.03 3.33 68 XMStrtUSub 11761 3.47 3.89 3.29 69 ANY_BOUNCE_MESSAGE 11325 2.45 0.89 3.16 70 BOUNCE_MESSAGE 11316 2.44 0.88 3.16 71 TooManyTo_002 11206 2.57 1.33 3.13 72 XMSubMetaSx_00 11032 4.44 7.40 3.08 73 MAILING_LIST_MULTI 10419 2.45 1.46 2.91 74 T_OBFU_PDF_ATTACH 10301 2.03 0.18 2.88 75 UNPARSEABLE_RELAY 10112 2.36 1.34 2.82 76 HTML_IMAGE_RATIO_06 9471 3.31 4.78 2.65 77 XMSexyCombo_05 9456 4.72 9.27 2.64 78 TVD_RCVD_IP 9369 1.91 0.36 2.62 79 HELO_NODOT 9158 1.90 0.46 2.56 80 HTML_MIME_NO_HTML_TAG 9093 2.47 2.31 2.54 81 BAYES_95 9056 3.09 4.30 2.53 82 MPART_ALT_DIFF 8871 4.21 7.99 2.48 83 BAYES_20 8858 1.98 0.90 2.47 84 IN_HORDE_ADDRESS_BOOK 8297 1.61 0.08 2.32 85 XM_SPF_SoftFail 8095 2.69 3.64 2.26 86 UPPERCASE_75_100 8074 1.56 0.03 2.26 87 MIME_HTML_MOSTLY 7729 3.11 5.19 2.16 88 T_TooManySym_02 7546 1.71 0.84 2.11 89 HTML_IMAGE_RATIO_08 7411 2.83 4.48 2.07 90 TooManyTo_003 7263 1.77 1.20 2.03 91 RCVD_IN_MSPIKE_WL 7108 1.64 0.89 1.99 92 XM_DK_Undo_01 7052 1.79 1.39 1.97 93 INVALID_MSGID 7023 1.39 0.14 1.96 94 RCVD_IN_MSPIKE_H3 7018 1.62 0.87 1.96 95 XM_CamelCaseFrm001 7001 2.57 3.91 1.96 96 RCVD_IN_IADB_OPTIN 6791 1.45 0.47 1.90 97 TO_MALFORMED 6510 1.25 0.01 1.82 98 XM_DIRTYINTL 6347 2.47 3.99 1.77 99 XMCapTrack 6300 1.43 0.70 1.76 100 TM2_M_URI_OPT_OUT 6220 2.59 4.45 1.74 101 BAYES_05 5921 1.30 0.53 1.65 102 XM_OfRef6 5783 1.81 2.23 1.62 103 NO_DNS_FOR_FROM 5524 1.98 2.94 1.54 104 T_XMDrugObfuBody_08 5473 1.94 2.84 1.53 105 XMDiploma_00 5230 1.71 2.27 1.46 106 TooManyTo_004 5177 1.30 0.98 1.45 107 XM_H_PHPOS 4984 1.23 0.89 1.39 108 XM_GoogleGroups 4951 1.15 0.63 1.38 109 BOTNET 4721 5.30 13.99 1.32 110 UNTRUSTED_Relay 4652 3.84 9.37 1.30 111 RELAYCOUNTRY_CA 4645 2.08 3.80 1.30 112 RELAYCOUNTRY_GB 4588 1.25 1.19 1.28 113 XMPhish11 4489 1.24 1.21 1.25 114 URI_HEX 4180 1.76 3.06 1.17 115 MIME_HTML_ONLY_MULTI 4080 1.70 2.94 1.14 116 TooManyTo_005 3976 0.98 0.70 1.11 117 DKIM_ADSP_CUSTOM_MED 3866 0.92 0.57 1.08 118 USER_IN_DEF_DKIM_WL 3837 0.74 0.03 1.07 119 XM_H_Long_From02 3742 1.45 2.32 1.05 120 TR_MetaPhish_Combo_01 3722 1.05 1.06 1.04 121 XM_ProductURIs 3531 1.04 1.15 0.99 122 T_FILL_THIS_FORM_SHORT 3344 1.00 1.16 0.93 123 XMGenDplmaNmb 3341 1.10 1.48 0.93 124 USER_IN_WHITELIST 3281 0.63 0.00 0.92 125 XMGappySubj_01 3245 0.77 0.47 0.91 126 XM_UB50 3224 1.96 4.27 0.90 127 XMNoVowels 3206 0.78 0.53 0.90 128 URI_TRY_3LD 3202 1.02 1.28 0.89 129 T_XMDrugObfuBody_00 3162 1.20 1.90 0.88 130 TM2_M_VERY_LONG_WORD 3144 1.19 1.86 0.88 131 XM_H_PHPMailer 3048 0.79 0.65 0.85 132 T_TooManySym_03 2999 0.63 0.16 0.84 133 SpammyFromTLD_01 2928 1.42 2.73 0.82 134 NML_ADSP_CUSTOM_MED 2897 0.70 0.45 0.81 135 FILL_THIS_FORM 2591 0.79 0.94 0.72 136 T_Symld_Words_02 2538 0.76 0.88 0.71 137 RCVD_IN_BL_SPAMCOP_NET 2513 1.53 3.35 0.70 138 RCVD_IN_IADB_DOPTIN 2494 0.50 0.07 0.70 139 XMSubMetaI_00 2408 1.02 1.76 0.67 140 SHORT_HELO_AND_INLINE_IMAGE 2360 0.48 0.08 0.66 141 HTTPS_HTTP_MISMATCH 2290 0.70 0.84 0.64 142 MISSING_HEADERS 2120 0.53 0.38 0.59 143 T_FILL_THIS_FORM_LOAN 2102 0.45 0.14 0.59 144 TVD_PH_BODY_ACCOUNTS_PRE 2099 0.47 0.23 0.59 145 XM_B_REG_HTML 2092 0.70 0.96 0.58 146 T_FILL_THIS_FORM_LONG 2033 0.41 0.07 0.57 147 XM_ShortIntro_01 2007 0.50 0.38 0.56 148 XMDateMe_00 1963 0.49 0.35 0.55 149 XMStockSpam_06 1962 0.80 1.34 0.55 150 RCVD_IN_SORBS_DUL 1949 0.45 0.23 0.54 151 XMBrknScrpt_02 1935 0.77 1.26 0.54 152 XMGappySubj_02 1913 0.42 0.16 0.53 153 RELAYCOUNTRY_AU 1905 0.74 1.20 0.53 154 HTML_FONT_FACE_BAD 1846 0.67 1.00 0.52 155 RELAYCOUNTRY_DE 1826 0.60 0.81 0.51 156 XMBdyGiftCard01 1824 0.72 1.18 0.51 157 XMMoneyMeta_00 1813 0.78 1.37 0.51 158 XMBody_78 1771 0.73 1.24 0.49 159 HTML_IMAGE_ONLY_32 1765 0.44 0.32 0.49 160 FORGED_GMAIL_RCVD 1726 0.48 0.46 0.48 161 HTML_IMAGE_ONLY_28 1707 0.56 0.73 0.48 162 TR_XM_RelayPhish 1706 0.71 1.23 0.48 163 AC_DIV_BONANZA 1701 0.36 0.12 0.48 164 XM_B_TRADE_HTML 1691 0.45 0.40 0.47 165 RELAYCOUNTRY_NL 1648 0.49 0.55 0.46 166 XM_B_COPY_HTML 1643 0.59 0.87 0.46 167 XMSubMetaSxObfu_02 1637 0.45 0.43 0.46 168 XMBody_95 1621 0.37 0.19 0.45 169 RDNS_DYNAMIC 1588 0.60 0.93 0.44 170 HTML_TAG_BALANCE_BODY 1575 0.50 0.62 0.44 171 TM2_M_A_HREF_HREF 1565 0.49 0.61 0.44 172 TM2_M_BODY_EMPTY 1554 0.42 0.38 0.43 173 XMPhish30 1533 0.75 1.47 0.43 174 T_XMHurry_00 1468 0.71 1.38 0.41 175 XMLKML 1463 0.28 0.00 0.41 176 HTML_IMAGE_ONLY_24 1440 0.43 0.49 0.40 177 TVD_SPACE_RATIO 1414 0.36 0.30 0.39 178 T_TooManySym_04 1343 0.26 0.02 0.38 179 SpammyFromTLD_02 1317 1.19 2.97 0.37 180 XM_Body_Obfu01 1304 0.50 0.81 0.36 181 XMSubNoVowel 1290 0.35 0.34 0.36 182 UPPERCASE_50_75 1287 0.30 0.17 0.36 183 XMSubMetaSxObfu_03 1272 0.90 2.08 0.36 184 XM_H_PHPOS_M 1267 0.34 0.32 0.35 185 XMHTMLBadTable_001 1248 0.49 0.80 0.35 186 XMBody_17 1239 0.71 1.52 0.35 187 HTML_IMAGE_ONLY_20 1202 0.35 0.40 0.34 188 XMPhish14 1182 0.47 0.76 0.33 189 XMSlimDrugH 1138 0.47 0.81 0.32 190 XMHTML_After_End 1137 0.72 1.58 0.32 191 MSGID_FROM_MTA_HEADER 1136 0.29 0.22 0.32 192 TR_Caps_n_Bayes_99 1127 0.63 1.30 0.31 193 XMSubEmpty 1099 0.29 0.24 0.31 194 TR_LOTS_OF_MONEY3 1074 0.51 0.98 0.30 195 TR_LOTS_OF_MONEY2 1062 0.52 1.01 0.30 196 T_MONEY_PERCENT 1062 0.52 1.01 0.30 197 TR_MetaPhish_Combo_01b 1035 0.25 0.17 0.29 198 GMD_PDF_EMPTY_BODY 1034 0.22 0.09 0.29 199 XMRcvdHeader_15 1034 0.20 0.00 0.29 200 XM_D_tchamptons_WL 1001 0.19 0.00 0.28 ----------------------------------------------------------------------