Email: 555552 Autolearn: 0 AvgScore: 3.01 AvgScanTime: 3.82 sec Spam: 155199 Autolearn: 0 AvgScore: 13.50 AvgScanTime: 4.84 sec Ham: 400353 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 3.42 sec Time Spent Running SA: 588.75 hours Time Spent Processing Spam: 208.80 hours Time Spent Processing Ham: 379.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146288 85.30 94.26 81.83 2 DKIM_SIGNED 127117 67.75 81.91 62.26 3 XM_DK_Pass 123797 66.18 79.77 60.91 4 DCC_CHECK 121957 43.71 78.58 30.19 5 DKIM_VALID 116342 61.91 74.96 56.86 6 XMListUnsubscribeExists 108006 46.28 69.59 37.25 7 DKIM_VALID_AU 88009 43.80 56.71 38.80 8 XM_H_QuotedFrom 87670 38.22 56.49 31.14 9 XM_DK_Undo_02 75791 21.84 48.83 11.37 10 BAYES_99 67977 19.84 43.80 10.55 11 BAYES_999 57858 17.08 37.28 9.25 12 HTML_FONT_LOW_CONTRAST 55872 25.03 36.00 20.78 13 LOC_TINY_FONT_1 55378 25.69 35.68 21.81 14 TR_DCC_Bayes_99 52441 12.96 33.79 4.89 15 BAYES_50 51115 51.98 32.94 59.37 16 MIME_HTML_ONLY 50907 25.26 32.80 22.33 17 FVGT_m_MULTI_ODD 40663 19.72 26.20 17.21 18 XMSubLong 40247 19.72 25.93 17.32 19 T_TM2_M_HEADER_IN_MSG 38067 30.01 24.53 32.14 20 DKIM_VALID_EF 35033 22.02 22.57 21.80 21 T_KAM_HTML_FONT_INVALID 31143 14.90 20.07 12.89 22 MultiRelay 31023 19.06 19.99 18.71 23 XM_Body_Dirty_Words 30769 12.45 19.83 9.60 24 DCC_CHECK_NEGATIVE 29839 54.23 19.23 67.80 25 RELAYCOUNTRY_META 29515 8.62 19.02 4.59 26 LOTS_OF_MONEY 28013 11.37 18.05 8.78 27 XM_Multi_Part_URI 26318 11.46 16.96 9.33 28 HTML_IMAGE_RATIO_02 24556 8.46 15.82 5.60 29 FSL_BULK_SIG 24459 10.11 15.76 7.92 30 BOTNET 22333 5.10 14.39 1.49 31 XM_Evil_Numbers_Gen 21987 9.14 14.17 7.19 32 UNTRUSTED_Relay 20918 4.61 13.48 1.17 33 BOTNET_IPINHOSTNAME 19021 5.81 12.26 3.31 34 T_XMDrugObfuBody_14 16279 8.17 10.49 7.27 35 XMSexyCombo_05 15364 5.03 9.90 3.14 36 LotsOfNums_01 14394 7.36 9.27 6.61 37 HTML_IMAGE_RATIO_04 14066 5.11 9.06 3.58 38 XMStrtUSub 13510 7.52 8.70 7.06 39 XM_B_Phish_Phrases 13454 5.72 8.67 4.57 40 XM_H_Long_From01 13020 9.29 8.39 9.64 41 TR_XM_DocInvoice 12847 5.37 8.28 4.25 42 BAYES_80 11762 4.49 7.58 3.30 43 TooManyTo_001 11701 7.78 7.54 7.88 44 XMSubMetaSx_00 10933 4.72 7.04 3.82 45 DKIM_INVALID 10775 5.83 6.94 5.40 46 T_REMOTE_IMAGE 10720 4.99 6.91 4.25 47 BAYES_60 10595 6.25 6.83 6.03 48 MPART_ALT_DIFF 10257 7.81 6.61 8.28 49 MultiRelay_Combo 9438 1.82 6.08 0.17 50 MultiRelay_CC 9438 1.82 6.08 0.17 51 XM_UB50 9371 2.26 6.04 0.79 52 FROM_EXCESS_BASE64 9322 3.78 6.01 2.92 53 RCVD_IN_BL_SPAMCOP_NET 9077 2.06 5.85 0.59 54 XM_UncommonTLD01 8883 4.29 5.72 3.73 55 XM_OfRef6 8627 2.69 5.56 1.58 56 RCVD_IN_RP_RNBL 8175 1.49 5.27 0.03 57 HTML_IMAGE_RATIO_06 8064 3.43 5.20 2.75 58 FILL_THIS_FORM 7984 1.93 5.14 0.68 59 XM_SPF_SoftFail 7683 2.86 4.95 2.05 60 MIME_QP_LONG_LINE 7479 4.74 4.82 4.71 61 RCVD_IN_RP_SAFE 7449 6.16 4.80 6.69 62 XMNumbers 7441 3.36 4.79 2.80 63 BAYES_95 7159 2.91 4.61 2.26 64 TM2_M_URI_OPT_OUT 7148 2.49 4.61 1.67 65 XM_SendGrid 7140 4.57 4.60 4.56 66 XM_DIRTYINTL 6742 2.42 4.34 1.67 67 MIME_HTML_MOSTLY 6554 2.61 4.22 1.99 68 RCVD_IN_RP_CERTIFIED 6304 5.56 4.06 6.14 69 URI_HEX 6298 2.05 4.06 1.27 70 XM_OfRef7 6102 1.23 3.93 0.18 71 MISSING_HEADERS 5901 1.45 3.80 0.54 72 HTML_IMAGE_ONLY_32 5898 1.42 3.80 0.50 73 REPLYTO_WITHOUT_TO_CC 5729 1.06 3.69 0.05 74 TR_LOTS_OF_MONEY1 5659 1.04 3.65 0.03 75 RELAYCOUNTRY_TW 5631 1.06 3.63 0.06 76 RELAYCOUNTRY_NG 5621 1.01 3.62 0.00 77 FORGED_MUA_OUTLOOK 5482 1.01 3.53 0.03 78 FORGED_OUTLOOK_HTML 5464 0.98 3.52 0.00 79 FORGED_OUTLOOK_TAGS 5457 1.02 3.52 0.05 80 FSL_NEW_HELO_USER 5455 0.98 3.51 0.00 81 SUBJ_ALL_CAPS 5301 5.17 3.42 5.86 82 HTML_IMAGE_RATIO_08 5265 3.28 3.39 3.23 83 XM_CamelCaseFrm001 5179 1.92 3.34 1.37 84 RCVD_IN_MSPIKE_H2 4679 3.38 3.01 3.51 85 FROM_MISSP_EH_MATCH 4652 0.85 3.00 0.01 86 HK_SCAM_N2 4637 0.84 2.99 0.00 87 BOTNET_NORDNS 4566 0.84 2.94 0.03 88 T_TooManySym_01 4544 3.41 2.93 3.60 89 RCVD_IN_PSBL 4505 0.86 2.90 0.06 90 MIME_HTML_ONLY_MULTI 4416 5.72 2.85 6.84 91 HTML_MIME_NO_HTML_TAG 4396 2.43 2.83 2.27 92 RELAYCOUNTRY_CA 4248 1.61 2.74 1.17 93 NO_DNS_FOR_FROM 3846 1.92 2.48 1.70 94 XM_UB60 3779 0.73 2.43 0.07 95 XMDiploma_00 3766 1.72 2.43 1.44 96 RCVD_IN_IADB_LISTED 3620 4.81 2.33 5.76 97 T_XMDrugObfuBody_08 3615 1.65 2.33 1.39 98 RCVD_IN_IADB_SPF 3224 4.12 2.08 4.91 99 XMBody_17 3206 0.82 2.07 0.33 100 RCVD_IN_IADB_DK 3064 3.52 1.97 4.11 101 RCVD_IN_IADB_SENDERID 3049 3.62 1.96 4.26 102 XM_URI_RBL 2888 0.60 1.86 0.11 103 TM2_M_VERY_LONG_WORD 2867 1.07 1.85 0.77 104 XMSexyCombo_01 2838 1.10 1.83 0.82 105 XMGenDplmaNmb 2791 1.21 1.80 0.98 106 XMSubMetaI_00 2753 0.75 1.77 0.35 107 RELAYCOUNTRY_FR 2721 0.69 1.75 0.28 108 SpammyFromTLD_02 2690 0.75 1.73 0.36 109 XM_DK_Undo_01 2671 1.99 1.72 2.09 110 TooManyTo_002 2616 2.19 1.69 2.39 111 MAILING_LIST_MULTI 2603 2.13 1.68 2.30 112 RELAYCOUNTRY_BR 2583 0.47 1.66 0.01 113 XM_UB99 2538 0.46 1.64 0.01 114 XMStockSpam_06 2434 1.32 1.57 1.22 115 UNPARSEABLE_RELAY 2392 2.21 1.54 2.47 116 XM_H_Long_From02 2392 1.02 1.54 0.81 117 ALL_TRUSTED 2318 16.37 1.49 22.14 118 TooManyTo_003 2292 1.54 1.48 1.56 119 XMPhish30 2275 0.71 1.47 0.41 120 TR_XM_RelayPhish 2265 0.86 1.46 0.62 121 XM_UB80 2261 0.42 1.46 0.02 122 SpammyFromTLD_01 2130 0.91 1.37 0.72 123 T_FILL_THIS_FORM_SHORT 2100 1.11 1.35 1.02 124 RCVD_IN_MSPIKE_WL 2088 2.38 1.35 2.78 125 RCVD_IN_MSPIKE_H3 2088 2.38 1.35 2.78 126 TR_LOTS_OF_MONEY2 2085 0.57 1.34 0.27 127 T_MONEY_PERCENT 2085 0.57 1.34 0.27 128 XMBody_78 2084 0.61 1.34 0.33 129 MONEY_FRAUD_8 2068 0.37 1.33 0.00 130 XMPhish11 2064 1.16 1.33 1.09 131 T_XMDrugObfuBody_00 2058 1.14 1.33 1.07 132 BAYES_00 2042 5.68 1.32 7.37 133 T_DEAR_BENEFICIARY 2014 0.36 1.30 0.00 134 DKIM_ADSP_CUSTOM_MED 2002 1.07 1.29 0.99 135 XMBdyGiftCard01 1967 0.73 1.27 0.53 136 SUBJ_DOLLARS 1957 0.52 1.26 0.23 137 URI_TRY_3LD 1951 1.04 1.26 0.96 138 TooManyTo_004 1928 1.17 1.24 1.14 139 URIBL_BLACK 1920 0.37 1.24 0.03 140 XM_PDF 1909 4.75 1.23 6.12 141 XM_ProductURIs 1898 0.90 1.22 0.77 142 BAYES_40 1851 4.88 1.19 6.31 143 XM_UB999 1831 0.33 1.18 0.01 144 T_FILL_THIS_FORM_LONG 1818 0.70 1.17 0.52 145 XM_B_COPY_HTML 1812 0.72 1.17 0.54 146 MILLION_USD 1790 0.32 1.15 0.00 147 XMHTMLBadTable_001 1783 0.61 1.15 0.41 148 XMHTML_After_End 1747 0.52 1.13 0.28 149 TR_Symld_Words 1731 1.70 1.12 1.92 150 T_HTML_TAG_BALANCE_CENTER 1722 0.43 1.11 0.16 151 XM_B_REG_HTML 1719 0.56 1.11 0.35 152 RELAYCOUNTRY_CN 1699 0.33 1.09 0.04 153 DIET_1 1691 0.47 1.09 0.23 154 TR_XM_DK_Bayes 1662 3.71 1.07 4.74 155 T_XMHurry_00 1659 0.59 1.07 0.41 156 URIBL_DBL_SPAM 1625 0.31 1.05 0.03 157 XMSubMetaSSx_00 1618 0.42 1.04 0.17 158 RELAYCOUNTRY_GB 1598 1.01 1.03 1.00 159 BAYES_20 1594 2.35 1.03 2.86 160 NML_ADSP_CUSTOM_MED 1582 0.80 1.02 0.72 161 RCVD_IN_IADB_VOUCHED 1539 3.27 0.99 4.15 162 XM_BadFromFormat 1529 0.44 0.99 0.23 163 REMOVE_BEFORE_LINK 1526 0.42 0.98 0.20 164 XMBrknScrpt_02 1514 0.76 0.98 0.68 165 TooManyTo_005 1504 0.93 0.97 0.91 166 TR_XM_DK_Bayes1 1492 3.35 0.96 4.28 167 XM_HighProb1 1460 0.27 0.94 0.01 168 FSL_THIS_IS_ADV 1460 0.32 0.94 0.09 169 LONG_JUNK_URI3 1410 0.31 0.91 0.08 170 RELAYCOUNTRY_AT 1400 0.33 0.90 0.10 171 LongTLD 1398 0.36 0.90 0.15 172 XMMoneyMeta_00 1385 0.54 0.89 0.41 173 FORGED_GMAIL_RCVD 1376 0.57 0.89 0.45 174 ANY_BOUNCE_MESSAGE 1370 2.39 0.88 2.97 175 BOUNCE_MESSAGE 1370 2.39 0.88 2.97 176 TR_XM_DK_Bayes2 1366 2.78 0.88 3.51 177 XM_UB95 1366 0.25 0.88 0.01 178 PLING_QUERY 1358 0.45 0.88 0.28 179 TR_Caps_n_Bayes_99 1352 0.29 0.87 0.06 180 HTML_FONT_SIZE_HUGE 1348 0.33 0.87 0.12 181 MPART_ALT_DIFF_COUNT 1337 0.42 0.86 0.25 182 XMLongAddy 1328 0.31 0.86 0.10 183 RDNS_DYNAMIC 1319 0.48 0.85 0.34 184 XMGappySubj_01 1286 0.65 0.83 0.58 185 HTTPS_HTTP_MISMATCH 1262 0.56 0.81 0.46 186 RELAYCOUNTRY_AU 1241 0.48 0.80 0.36 187 TR_Mismatch_TLD_02 1237 0.28 0.80 0.07 188 XM_H_PHPOS 1234 1.04 0.80 1.14 189 TR_MetaPhish_Combo_01 1224 0.68 0.79 0.64 190 HTML_FONT_FACE_BAD 1214 4.67 0.78 6.18 191 HTML_TAG_BALANCE_BODY 1201 0.52 0.77 0.43 192 XMPhish14 1138 0.38 0.73 0.24 193 XMBSHREFv2 1130 0.28 0.73 0.10 194 TR_Caps_n_Bayes_80 1124 0.26 0.72 0.08 195 RELAYCOUNTRY_DE 1107 0.53 0.71 0.46 196 HTML_IMAGE_ONLY_28 1086 0.48 0.70 0.40 197 XM_H_Long_From03 1075 0.27 0.69 0.11 198 XMSexyCombo_04 1064 0.55 0.69 0.50 199 PHOTO_EDITING_DIRECT 1062 0.20 0.68 0.01 200 T_Symld_Words_02 1038 0.45 0.67 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 327622 85.30 94.26 81.83 2 DCC_CHECK_NEGATIVE 271436 54.23 19.23 67.80 3 DKIM_SIGNED 249249 67.75 81.91 62.26 4 XM_DK_Pass 243858 66.18 79.77 60.91 5 BAYES_50 237679 51.98 32.94 59.37 6 DKIM_VALID 227623 61.91 74.96 56.86 7 DKIM_VALID_AU 155342 43.80 56.71 38.80 8 XMListUnsubscribeExists 149126 46.28 69.59 37.25 9 T_TM2_M_HEADER_IN_MSG 128664 30.01 24.53 32.14 10 XM_H_QuotedFrom 124667 38.22 56.49 31.14 11 DCC_CHECK 120854 43.71 78.58 30.19 12 MIME_HTML_ONLY 89413 25.26 32.80 22.33 13 ALL_TRUSTED 88635 16.37 1.49 22.14 14 LOC_TINY_FONT_1 87320 25.69 35.68 21.81 15 DKIM_VALID_EF 87273 22.02 22.57 21.80 16 HTML_FONT_LOW_CONTRAST 83205 25.03 36.00 20.78 17 MultiRelay 74889 19.06 19.99 18.71 18 XMSubLong 69335 19.72 25.93 17.32 19 FVGT_m_MULTI_ODD 68915 19.72 26.20 17.21 20 T_KAM_HTML_FONT_INVALID 51608 14.90 20.07 12.89 21 IN_ZIMBRA_NJ_WHITELIST 45535 8.21 0.05 11.37 22 XM_DK_Undo_02 45517 21.84 48.83 11.37 23 BAYES_99 42257 19.84 43.80 10.55 24 XM_H_Long_From01 38611 9.29 8.39 9.64 25 XM_Body_Dirty_Words 38420 12.45 19.83 9.60 26 XM_Multi_Part_URI 37352 11.46 16.96 9.33 27 BAYES_999 37037 17.08 37.28 9.25 28 LOTS_OF_MONEY 35170 11.37 18.05 8.78 29 MPART_ALT_DIFF 33151 7.81 6.61 8.28 30 XM_DKIMWhitelistDomains 33046 5.95 0.01 8.25 31 FSL_BULK_SIG 31695 10.11 15.76 7.92 32 TooManyTo_001 31541 7.78 7.54 7.88 33 BAYES_00 29503 5.68 1.32 7.37 34 T_XMDrugObfuBody_14 29123 8.17 10.49 7.27 35 XM_Evil_Numbers_Gen 28790 9.14 14.17 7.19 36 XMStrtUSub 28257 7.52 8.70 7.06 37 MIME_HTML_ONLY_MULTI 27383 5.72 2.85 6.84 38 RCVD_IN_RP_SAFE 26776 6.16 4.80 6.69 39 LotsOfNums_01 26467 7.36 9.27 6.61 40 BAYES_40 25266 4.88 1.19 6.31 41 HTML_FONT_FACE_BAD 24750 4.67 0.78 6.18 42 RCVD_IN_RP_CERTIFIED 24577 5.56 4.06 6.14 43 XM_PDF 24485 4.75 1.23 6.12 44 BAYES_60 24124 6.25 6.83 6.03 45 SUBJ_ALL_CAPS 23443 5.17 3.42 5.86 46 RCVD_IN_IADB_LISTED 23079 4.81 2.33 5.76 47 HTML_IMAGE_RATIO_02 22439 8.46 15.82 5.60 48 DKIM_INVALID 21626 5.83 6.94 5.40 49 RCVD_IN_IADB_SPF 19652 4.12 2.08 4.91 50 TR_DCC_Bayes_99 19571 12.96 33.79 4.89 51 TR_XM_DK_Bayes 18963 3.71 1.07 4.74 52 MIME_QP_LONG_LINE 18856 4.74 4.82 4.71 53 RELAYCOUNTRY_META 18390 8.62 19.02 4.59 54 XM_B_Phish_Phrases 18296 5.72 8.67 4.57 55 XM_SendGrid 18254 4.57 4.60 4.56 56 TR_XM_DK_Bayes1 17135 3.35 0.96 4.28 57 RCVD_IN_IADB_SENDERID 17047 3.62 1.96 4.26 58 T_REMOTE_IMAGE 17013 4.99 6.91 4.25 59 TR_XM_DocInvoice 17009 5.37 8.28 4.25 60 RCVD_IN_IADB_VOUCHED 16623 3.27 0.99 4.15 61 RCVD_IN_IADB_DK 16467 3.52 1.97 4.11 62 XMSubMetaSx_00 15312 4.72 7.04 3.82 63 XM_UncommonTLD01 14924 4.29 5.72 3.73 64 T_TooManySym_01 14409 3.41 2.93 3.60 65 HTML_IMAGE_RATIO_04 14313 5.11 9.06 3.58 66 RCVD_IN_MSPIKE_H2 14071 3.38 3.01 3.51 67 TR_XM_DK_Bayes2 14063 2.78 0.88 3.51 68 BOTNET_IPINHOSTNAME 13249 5.81 12.26 3.31 69 BAYES_80 13203 4.49 7.58 3.30 70 HTML_IMAGE_RATIO_08 12942 3.28 3.39 3.23 71 XMSexyCombo_05 12563 5.03 9.90 3.14 72 ANY_BOUNCE_MESSAGE 11885 2.39 0.88 2.97 73 BOUNCE_MESSAGE 11881 2.39 0.88 2.97 74 FROM_EXCESS_BASE64 11694 3.78 6.01 2.92 75 BAYES_20 11434 2.35 1.03 2.86 76 XMNumbers 11226 3.36 4.79 2.80 77 RCVD_IN_MSPIKE_WL 11137 2.38 1.35 2.78 78 RCVD_IN_MSPIKE_H3 11137 2.38 1.35 2.78 79 HTML_IMAGE_RATIO_06 11011 3.43 5.20 2.75 80 XMSubNoVowel 10573 2.04 0.47 2.64 81 RCVD_IN_IADB_OPTIN 10534 2.06 0.60 2.63 82 UNPARSEABLE_RELAY 9894 2.21 1.54 2.47 83 TooManyTo_002 9558 2.19 1.69 2.39 84 MAILING_LIST_MULTI 9207 2.13 1.68 2.30 85 TVD_RCVD_IP 9104 1.71 0.24 2.27 86 HTML_MIME_NO_HTML_TAG 9080 2.43 2.83 2.27 87 BAYES_95 9033 2.91 4.61 2.26 88 IN_HORDE_ADDRESS_BOOK 8560 1.57 0.09 2.14 89 XM_DK_Undo_01 8387 1.99 1.72 2.09 90 HELO_NODOT 8384 1.61 0.35 2.09 91 XM_SPF_SoftFail 8201 2.86 4.95 2.05 92 MIME_HTML_MOSTLY 7966 2.61 4.22 1.99 93 TR_Symld_Words 7698 1.70 1.12 1.92 94 BAYES_05 7128 1.45 0.61 1.78 95 INVALID_MSGID 6952 1.34 0.30 1.74 96 NO_DNS_FOR_FROM 6806 1.92 2.48 1.70 97 TO_MALFORMED 6779 1.23 0.03 1.69 98 XM_DIRTYINTL 6700 2.42 4.34 1.67 99 TM2_M_URI_OPT_OUT 6686 2.49 4.61 1.67 100 XM_OfRef6 6309 2.69 5.56 1.58 101 TooManyTo_003 6239 1.54 1.48 1.56 102 USER_IN_DEF_DKIM_WL 6033 1.11 0.08 1.51 103 BOTNET 5979 5.10 14.39 1.49 104 T_TooManySym_02 5788 1.21 0.60 1.45 105 XMDiploma_00 5783 1.72 2.43 1.44 106 XMCapTrack 5731 1.21 0.64 1.43 107 T_XMDrugObfuBody_08 5546 1.65 2.33 1.39 108 XM_CamelCaseFrm001 5473 1.92 3.34 1.37 109 URI_HEX 5066 2.05 4.06 1.27 110 T_OBFU_PDF_ATTACH 5028 1.02 0.41 1.26 111 XMStockSpam_06 4893 1.32 1.57 1.22 112 XMSubEmpty 4716 0.93 0.28 1.18 113 RELAYCOUNTRY_CA 4686 1.61 2.74 1.17 114 UNTRUSTED_Relay 4673 4.61 13.48 1.17 115 XM_GoogleGroups 4652 0.99 0.55 1.16 116 TooManyTo_004 4549 1.17 1.24 1.14 117 XM_H_PHPOS 4545 1.04 0.80 1.14 118 XMPhish11 4372 1.16 1.33 1.09 119 T_XMDrugObfuBody_00 4286 1.14 1.33 1.07 120 T_FILL_THIS_FORM_SHORT 4090 1.11 1.35 1.02 121 RELAYCOUNTRY_GB 4014 1.01 1.03 1.00 122 DKIM_ADSP_CUSTOM_MED 3961 1.07 1.29 0.99 123 XMGenDplmaNmb 3911 1.21 1.80 0.98 124 URI_TRY_3LD 3837 1.04 1.26 0.96 125 TooManyTo_005 3660 0.93 0.97 0.91 126 XMSexyCombo_01 3271 1.10 1.83 0.82 127 XM_H_Long_From02 3254 1.02 1.54 0.81 128 XM_UB50 3176 2.26 6.04 0.79 129 XM_ProductURIs 3079 0.90 1.22 0.77 130 TM2_M_VERY_LONG_WORD 3064 1.07 1.85 0.77 131 SpammyFromTLD_01 2898 0.91 1.37 0.72 132 NML_ADSP_CUSTOM_MED 2875 0.80 1.02 0.72 133 FILL_THIS_FORM 2739 1.93 5.14 0.68 134 XMBrknScrpt_02 2715 0.76 0.98 0.68 135 USER_IN_WHITELIST 2707 0.49 0.00 0.68 136 XMNoVowels 2687 0.62 0.51 0.67 137 XM_H_PHPMailer 2672 0.66 0.64 0.67 138 T_TooManySym_03 2629 0.53 0.22 0.66 139 TR_Mismatch_TLD_01 2616 0.56 0.32 0.65 140 TR_MetaPhish_Combo_01 2563 0.68 0.79 0.64 141 HTML_FONT_SIZE_LARGE 2539 0.55 0.32 0.63 142 TR_XM_RelayPhish 2498 0.86 1.46 0.62 143 RCVD_IN_BL_SPAMCOP_NET 2348 2.06 5.85 0.59 144 XMGappySubj_01 2323 0.65 0.83 0.58 145 TM2_M_A_HREF_HREF 2198 0.55 0.57 0.55 146 XM_B_COPY_HTML 2167 0.72 1.17 0.54 147 MISSING_HEADERS 2165 1.45 3.80 0.54 148 XMBdyGiftCard01 2115 0.73 1.27 0.53 149 T_FILL_THIS_FORM_LOAN 2104 0.44 0.20 0.53 150 RCVD_IN_SORBS_DUL 2099 0.48 0.38 0.52 151 T_FILL_THIS_FORM_LONG 2082 0.70 1.17 0.52 152 XM_B_TRADE_HTML 2026 0.51 0.51 0.51 153 XMSexyCombo_04 2002 0.55 0.69 0.50 154 HTML_IMAGE_ONLY_32 1996 1.42 3.80 0.50 155 SHORT_HELO_AND_INLINE_IMAGE 1973 0.38 0.08 0.49 156 AC_DIV_BONANZA 1968 0.39 0.13 0.49 157 XM_ShortIntro_01 1948 0.42 0.26 0.49 158 XM_D_tchamptons_WL 1855 0.33 0.00 0.46 159 RELAYCOUNTRY_DE 1850 0.53 0.71 0.46 160 HTTPS_HTTP_MISMATCH 1850 0.56 0.81 0.46 161 TVD_SPACE_RATIO 1819 0.38 0.21 0.45 162 UPPERCASE_50_75 1810 0.37 0.14 0.45 163 FORGED_GMAIL_RCVD 1785 0.57 0.89 0.45 164 XMSubMetaSxObfu_02 1756 0.44 0.45 0.44 165 XMBody_95 1739 0.37 0.21 0.43 166 T_MANY_PILL_PRICE 1735 0.31 0.00 0.43 167 HTML_TAG_BALANCE_BODY 1707 0.52 0.77 0.43 168 XMPhish30 1652 0.71 1.47 0.41 169 FUZZY_CREDIT 1642 0.32 0.10 0.41 170 XMHTMLBadTable_001 1630 0.61 1.15 0.41 171 XMMoneyMeta_00 1623 0.54 0.89 0.41 172 T_XMHurry_00 1623 0.59 1.07 0.41 173 HTML_IMAGE_ONLY_28 1604 0.48 0.70 0.40 174 TM2_M_BODY_EMPTY 1604 0.38 0.33 0.40 175 XMDateMe_00 1497 0.36 0.32 0.37 176 SpammyFromTLD_02 1458 0.75 1.73 0.36 177 T_Symld_Words_02 1450 0.45 0.67 0.36 178 XMRcvdHeader_15 1438 0.26 0.00 0.36 179 RELAYCOUNTRY_AU 1437 0.48 0.80 0.36 180 XMEmptySub 1426 0.27 0.04 0.36 181 XMSubMetaI_00 1412 0.75 1.77 0.35 182 XM_B_REG_HTML 1392 0.56 1.11 0.35 183 HTML_IMAGE_ONLY_24 1373 0.34 0.35 0.34 184 RDNS_DYNAMIC 1357 0.48 0.85 0.34 185 XMBody_17 1334 0.82 2.07 0.33 186 XMBody_78 1305 0.61 1.34 0.33 187 XM_H_PHPOS_M 1242 0.32 0.35 0.31 188 GMD_PDF_HORIZ 1231 0.24 0.08 0.31 189 URI_NOVOWEL 1209 0.38 0.59 0.30 190 HTML_IMAGE_ONLY_20 1202 0.38 0.57 0.30 191 PP_MIME_FAKE_ASCII_TEXT 1193 0.36 0.51 0.30 192 MSGID_FROM_MTA_HEADER 1193 0.28 0.23 0.30 193 XMSubMetaSxObfu_03 1185 0.38 0.61 0.30 194 XMLngstWrd_00 1176 0.34 0.47 0.29 195 TRACKER_ID 1171 0.32 0.37 0.29 196 XMHTML_After_End 1141 0.52 1.13 0.28 197 TR_MetaPhish_Combo_01b 1138 0.25 0.16 0.28 198 PLING_QUERY 1116 0.45 0.88 0.28 199 RELAYCOUNTRY_FR 1115 0.69 1.75 0.28 200 TO_NO_BRKTS_HTML_ONLY 1101 0.27 0.24 0.28 ----------------------------------------------------------------------