Email: 308453 Autolearn: 0 AvgScore: 3.80 AvgScanTime: 3.69 sec Spam: 106792 Autolearn: 0 AvgScore: 12.60 AvgScanTime: 4.77 sec Ham: 201661 Autolearn: 0 AvgScore: -0.86 AvgScanTime: 3.11 sec Time Spent Running SA: 315.75 hours Time Spent Processing Spam: 141.54 hours Time Spent Processing Ham: 174.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101309 82.40 94.87 75.79 2 DKIM_SIGNED 91534 73.84 85.71 67.55 3 XM_DK_Pass 89128 72.52 83.46 66.72 4 DCC_CHECK 87180 53.13 81.64 38.04 5 DKIM_VALID 81971 67.18 76.76 62.10 6 XMListUnsubscribeExists 79775 53.83 74.70 42.78 7 DKIM_VALID_AU 66211 50.80 62.00 44.87 8 XM_H_QuotedFrom 58533 39.98 54.81 32.13 9 XM_DK_Undo_02 54474 27.94 51.01 15.72 10 BAYES_99 48120 25.36 45.06 14.93 11 LOC_TINY_FONT_1 41702 26.52 39.05 19.89 12 BAYES_999 41377 22.12 38.75 13.31 13 HTML_FONT_LOW_CONTRAST 39875 30.12 37.34 26.30 14 TR_DCC_Bayes_99 38027 17.07 35.61 7.25 15 BAYES_50 32333 46.74 30.28 55.45 16 MIME_HTML_ONLY 31563 23.11 29.56 19.70 17 FVGT_m_MULTI_ODD 26981 21.28 25.27 19.17 18 XMSubLong 25900 20.64 24.25 18.73 19 T_KAM_HTML_FONT_INVALID 22698 15.43 21.25 12.34 20 DKIM_VALID_EF 21335 23.60 19.98 25.52 21 XM_Body_Dirty_Words 21161 13.16 19.82 9.63 22 XM_Multi_Part_URI 19211 13.65 17.99 11.35 23 T_TM2_M_HEADER_IN_MSG 18820 26.21 17.62 30.76 24 HTML_IMAGE_RATIO_02 18134 10.55 16.98 7.14 25 DCC_CHECK_NEGATIVE 17816 45.48 16.68 60.73 26 RELAYCOUNTRY_META 17719 8.39 16.59 4.05 27 XM_Evil_Numbers_Gen 15583 9.56 14.59 6.89 28 MultiRelay 15533 16.13 14.55 16.98 29 FSL_BULK_SIG 14852 11.89 13.91 10.82 30 BOTNET 14252 5.62 13.35 1.53 31 BOTNET_IPINHOSTNAME 13265 7.43 12.42 4.79 32 LOTS_OF_MONEY 11439 11.58 10.71 12.04 33 UNTRUSTED_Relay 10979 4.31 10.28 1.14 34 HTML_IMAGE_RATIO_04 10917 6.84 10.22 5.04 35 XMSexyCombo_05 10850 5.39 10.16 2.86 36 LotsOfNums_01 10646 7.55 9.97 6.27 37 DKIM_INVALID 9563 6.66 8.95 5.45 38 XM_B_Phish_Phrases 9178 5.81 8.59 4.34 39 T_XMDrugObfuBody_14 8862 6.90 8.30 6.16 40 XM_H_Long_From01 8627 12.59 8.08 14.97 41 BAYES_80 8105 5.11 7.59 3.79 42 XMSubMetaSx_00 8082 5.07 7.57 3.75 43 BAYES_60 7961 6.83 7.45 6.50 44 TooManyTo_001 7801 6.43 7.30 5.97 45 TR_XM_DocInvoice 7606 4.44 7.12 3.01 46 XM_UncommonTLD01 7308 5.38 6.84 4.61 47 MPART_ALT_DIFF 7158 4.27 6.70 2.98 48 FROM_EXCESS_BASE64 7106 4.94 6.65 4.03 49 NO_DNS_FOR_FROM 6978 4.85 6.53 3.95 50 RCVD_IN_RP_SAFE 6281 8.21 5.88 9.45 51 HTML_IMAGE_RATIO_06 5792 3.82 5.42 2.97 52 ALL_TRUSTED 5459 19.65 5.11 27.35 53 RCVD_IN_RP_CERTIFIED 5375 7.41 5.03 8.66 54 BAYES_95 5257 3.35 4.92 2.52 55 MIME_HTML_MOSTLY 4860 3.33 4.55 2.68 56 XM_SendGrid 4693 5.42 4.39 5.96 57 XMStrtUSub 4644 4.01 4.35 3.83 58 XMNumbers 4523 4.10 4.24 4.03 59 MIME_QP_LONG_LINE 4487 3.81 4.20 3.60 60 XM_DIRTYINTL 4467 2.71 4.18 1.93 61 T_REMOTE_IMAGE 4352 4.36 4.08 4.51 62 XM_UB50 4217 1.83 3.95 0.71 63 XMSubNoVowel 3795 3.26 3.55 3.11 64 RCVD_IN_MSPIKE_H2 3747 3.75 3.51 3.88 65 HTML_IMAGE_RATIO_08 3623 2.17 3.39 1.52 66 RELAYCOUNTRY_CA 3593 1.98 3.36 1.25 67 XM_SPF_SoftFail 3536 1.93 3.31 1.20 68 XM_CamelCaseFrm001 3508 2.12 3.28 1.51 69 URI_HEX 3355 2.06 3.14 1.48 70 MIME_HTML_ONLY_MULTI 3353 1.77 3.14 1.04 71 TM2_M_URI_OPT_OUT 3321 1.97 3.11 1.36 72 TR_Mismatch_TLD_01 3247 1.53 3.04 0.73 73 T_TooManySym_01 3231 4.09 3.03 4.66 74 RCVD_IN_BL_SPAMCOP_NET 3074 1.37 2.88 0.58 75 XMSubEmpty 2996 2.73 2.81 2.70 76 RCVD_IN_IADB_LISTED 2692 4.04 2.52 4.85 77 SpammyFromTLD_01 2671 1.21 2.50 0.52 78 MultiRelay_Combo 2623 0.95 2.46 0.16 79 MultiRelay_CC 2623 0.95 2.46 0.16 80 RCVD_IN_IADB_SPF 2475 3.46 2.32 4.06 81 RELAYCOUNTRY_FR 2468 1.01 2.31 0.33 82 XM_OfRef6 2450 1.49 2.29 1.06 83 URIBL_BLACK 2371 0.79 2.22 0.03 84 RCVD_IN_IADB_SENDERID 2362 3.06 2.21 3.50 85 SUBJ_ALL_CAPS 2351 8.26 2.20 11.47 86 XMBody_17 2335 1.05 2.19 0.46 87 RCVD_IN_IADB_DK 2335 2.95 2.19 3.36 88 XM_BadFromFormat 2221 0.91 2.08 0.29 89 XM_UB99 2204 0.74 2.06 0.04 90 XMSubMetaI_00 2187 1.17 2.05 0.70 91 SpammyFromTLD_02 2169 0.79 2.03 0.13 92 TM2_M_VERY_LONG_WORD 2157 1.26 2.02 0.85 93 XMSexyCombo_01 2091 1.00 1.96 0.49 94 URIBL_DBL_SPAM 2078 0.72 1.95 0.06 95 SHORT_URI_2 2033 1.28 1.90 0.95 96 XM_B_REG_HTML 1991 1.20 1.86 0.85 97 XMBdyGiftCard01 1983 1.24 1.86 0.91 98 SUBJ_DOLLARS 1949 0.89 1.83 0.40 99 MAILING_LIST_MULTI 1913 1.78 1.79 1.78 100 T_XMDrugObfuBody_08 1856 1.31 1.74 1.09 101 XM_H_Long_From02 1790 1.02 1.68 0.67 102 XMLongAddy 1782 0.66 1.67 0.13 103 XMPhish30 1768 0.78 1.66 0.31 104 BAYES_40 1703 5.02 1.59 6.83 105 HTML_MIME_NO_HTML_TAG 1680 1.52 1.57 1.48 106 XM_ProductURIs 1658 1.35 1.55 1.25 107 XM_UB999 1649 0.55 1.54 0.03 108 RCVD_IN_RP_RNBL 1640 0.55 1.54 0.03 109 RCVD_IN_PSBL 1633 0.63 1.53 0.15 110 XMStockSpam_06 1601 1.00 1.50 0.74 111 XM_H_Long_From03 1596 0.61 1.49 0.14 112 DKIM_ADSP_CUSTOM_MED 1583 1.04 1.48 0.80 113 DIET_1 1572 0.68 1.47 0.26 114 XM_URI_RBL 1558 0.58 1.46 0.11 115 XM_RXBody 1550 0.59 1.45 0.13 116 BODY_ENHANCEMENT 1525 0.52 1.43 0.04 117 UNPARSEABLE_RELAY 1480 3.06 1.39 3.95 118 NML_ADSP_CUSTOM_MED 1462 0.86 1.37 0.59 119 BAYES_00 1456 4.77 1.36 6.58 120 RELAYCOUNTRY_AT 1423 0.53 1.33 0.11 121 FORGED_GMAIL_RCVD 1410 0.74 1.32 0.43 122 XM_UB60 1375 0.51 1.29 0.10 123 RDNS_DYNAMIC 1329 0.76 1.24 0.50 124 XM_H_PHPOS 1320 1.11 1.24 1.05 125 TR_XM_RelayPhish 1304 0.69 1.22 0.40 126 TR_Symld_Words 1293 2.46 1.21 3.12 127 XMDiploma_00 1283 1.08 1.20 1.02 128 TooManyTo_002 1267 1.75 1.19 2.04 129 FSL_THIS_IS_ADV 1243 0.49 1.16 0.14 130 MPART_ALT_DIFF_COUNT 1239 0.67 1.16 0.42 131 BODY_URI_ONLY 1238 0.44 1.16 0.06 132 XMSlimDrugH 1231 0.57 1.15 0.26 133 XM_UB80 1212 0.41 1.13 0.03 134 T_XMHurry_00 1206 0.67 1.13 0.42 135 RELAYCOUNTRY_IN 1170 0.41 1.10 0.05 136 PLING_QUERY 1155 0.55 1.08 0.28 137 T_MONEY_PERCENT 1151 0.80 1.08 0.65 138 TR_LOTS_OF_MONEY2 1151 0.80 1.08 0.65 139 HTML_FONT_SIZE_HUGE 1147 0.49 1.07 0.18 140 TooManyTo_003 1136 1.14 1.06 1.18 141 TR_Mismatch_TLD_02 1122 0.40 1.05 0.06 142 XMGppyBdWords 1122 0.41 1.05 0.07 143 CK_HELO_DYNAMIC_SPLIT_IP 1117 0.36 1.05 0.00 144 TR_XM_DK_Bayes 1114 3.54 1.04 4.86 145 TVD_SPACE_RATIO 1108 0.84 1.04 0.74 146 XM_DK_Undo_01 1105 1.62 1.03 1.93 147 XMEmptySub 1102 0.80 1.03 0.68 148 BAYES_20 1096 1.56 1.03 1.84 149 HTML_SHORT_LINK_IMG_1 1071 0.36 1.00 0.02 150 XMPhish11 1071 0.97 1.00 0.96 151 RCVD_IN_MSPIKE_H3 1062 2.18 0.99 2.81 152 RCVD_IN_MSPIKE_WL 1062 2.18 0.99 2.81 153 T_XMDrugObfuBody_00 1058 0.97 0.99 0.95 154 XM_H_PHPMailer 1057 0.85 0.99 0.78 155 BASE64_LENGTH_79_INF 1053 0.46 0.99 0.18 156 HTML_IMAGE_ONLY_08 1048 0.44 0.98 0.16 157 XM_B_COPY_HTML 1046 0.81 0.98 0.72 158 URI_TRY_3LD 1042 1.05 0.98 1.09 159 TM2_M_A_HREF_HREF 1026 1.17 0.96 1.28 160 LONG_JUNK_URI3 1021 0.39 0.96 0.09 161 RELAYCOUNTRY_GB 1020 0.73 0.96 0.61 162 HTML_FONT_FACE_BAD 1017 0.74 0.95 0.63 163 XMBody_78 1017 0.68 0.95 0.54 164 RCVD_IN_IADB_VOUCHED 1003 2.61 0.94 3.50 165 XMHTMLBadTable_001 997 0.55 0.93 0.35 166 HELO_MISC_IP 985 0.33 0.92 0.01 167 BOTNET_NORDNS 980 0.33 0.92 0.02 168 XM_Body_Obfu01 978 0.46 0.92 0.21 169 XMHTML_After_End 974 0.46 0.91 0.23 170 TR_XM_DK_Bayes1 968 3.24 0.91 4.48 171 XMClaimOffer 968 0.53 0.91 0.32 172 FILL_THIS_FORM 955 0.60 0.89 0.45 173 RELAYCOUNTRY_AL 951 0.31 0.89 0.00 174 REMOVE_BEFORE_LINK 943 0.68 0.88 0.57 175 SUBJECT_NEEDS_ENCODING 939 0.31 0.88 0.01 176 SUBJ_ILLEGAL_CHARS 938 0.31 0.88 0.01 177 TR_LOTS_OF_MONEY3 937 0.42 0.88 0.18 178 TO_IN_SUBJ 930 0.52 0.87 0.34 179 HDRS_LCASE_IMGONLY 920 0.32 0.86 0.04 180 TR_Caps_n_Bayes_99 912 0.49 0.85 0.29 181 GAPPY_SUBJECT 910 0.36 0.85 0.10 182 T_FILL_THIS_FORM_SHORT 895 0.72 0.84 0.66 183 XM_HighProb1 885 0.30 0.83 0.01 184 TooManyTo_004 879 0.87 0.82 0.89 185 FILL_THIS_FORM_LONG 871 0.52 0.82 0.37 186 XM_S_JOY_D 855 0.42 0.80 0.22 187 URI_NOVOWEL 843 0.56 0.79 0.44 188 DKIM_ADSP_NXDOMAIN 833 0.55 0.78 0.43 189 XMGappySubj_01 802 0.45 0.75 0.29 190 MISSING_HEADERS 797 0.49 0.75 0.36 191 XMGenDplmaNmb 794 0.60 0.74 0.53 192 LongTLD 792 0.35 0.74 0.14 193 FROM_LOCAL_HEX 775 0.29 0.73 0.06 194 RELAYCOUNTRY_DE 770 0.46 0.72 0.33 195 XMBrknScrpt_02 765 0.57 0.72 0.49 196 XMSexyCombo_04 752 0.29 0.70 0.06 197 TooManyTo_005 741 0.72 0.69 0.74 198 XMLngstWrd_00 740 0.44 0.69 0.30 199 FROM_LOCAL_DIGITS 734 0.25 0.69 0.02 200 XM_UB95 727 0.25 0.68 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152842 82.40 94.87 75.79 2 DKIM_SIGNED 136226 73.84 85.71 67.55 3 XM_DK_Pass 134555 72.52 83.46 66.72 4 DKIM_VALID 125239 67.18 76.76 62.10 5 DCC_CHECK_NEGATIVE 122459 45.48 16.68 60.73 6 BAYES_50 111824 46.74 30.28 55.45 7 DKIM_VALID_AU 90492 50.80 62.00 44.87 8 XMListUnsubscribeExists 86261 53.83 74.70 42.78 9 DCC_CHECK 76711 53.13 81.64 38.04 10 XM_H_QuotedFrom 64791 39.98 54.81 32.13 11 T_TM2_M_HEADER_IN_MSG 62027 26.21 17.62 30.76 12 ALL_TRUSTED 55156 19.65 5.11 27.35 13 HTML_FONT_LOW_CONTRAST 53035 30.12 37.34 26.30 14 DKIM_VALID_EF 51473 23.60 19.98 25.52 15 LOC_TINY_FONT_1 40110 26.52 39.05 19.89 16 MIME_HTML_ONLY 39724 23.11 29.56 19.70 17 FVGT_m_MULTI_ODD 38649 21.28 25.27 19.17 18 XMSubLong 37764 20.64 24.25 18.73 19 MultiRelay 34234 16.13 14.55 16.98 20 XM_DK_Undo_02 31705 27.94 51.01 15.72 21 XM_H_Long_From01 30192 12.59 8.08 14.97 22 BAYES_99 30098 25.36 45.06 14.93 23 BAYES_999 26843 22.12 38.75 13.31 24 T_KAM_HTML_FONT_INVALID 24888 15.43 21.25 12.34 25 LOTS_OF_MONEY 24290 11.58 10.71 12.04 26 SUBJ_ALL_CAPS 23137 8.26 2.20 11.47 27 XM_Multi_Part_URI 22886 13.65 17.99 11.35 28 XM_DKIMWhitelistDomains 22796 7.40 0.03 11.30 29 FSL_BULK_SIG 21812 11.89 13.91 10.82 30 XM_Body_Dirty_Words 19421 13.16 19.82 9.63 31 RCVD_IN_RP_SAFE 19055 8.21 5.88 9.45 32 RCVD_IN_RP_CERTIFIED 17471 7.41 5.03 8.66 33 TR_DCC_Bayes_99 14621 17.07 35.61 7.25 34 HTML_IMAGE_RATIO_02 14402 10.55 16.98 7.14 35 XM_Evil_Numbers_Gen 13904 9.56 14.59 6.89 36 BAYES_40 13782 5.02 1.59 6.83 37 BAYES_00 13271 4.77 1.36 6.58 38 BAYES_60 13114 6.83 7.45 6.50 39 LotsOfNums_01 12636 7.55 9.97 6.27 40 T_XMDrugObfuBody_14 12415 6.90 8.30 6.16 41 TooManyTo_001 12037 6.43 7.30 5.97 42 XM_SendGrid 12026 5.42 4.39 5.96 43 DKIM_INVALID 10987 6.66 8.95 5.45 44 HTML_IMAGE_RATIO_04 10173 6.84 10.22 5.04 45 IN_ZIMBRA_NJ_WHITELIST 9948 3.24 0.04 4.93 46 TR_XM_DK_Bayes 9802 3.54 1.04 4.86 47 RCVD_IN_IADB_LISTED 9772 4.04 2.52 4.85 48 BOTNET_IPINHOSTNAME 9657 7.43 12.42 4.79 49 T_TooManySym_01 9389 4.09 3.03 4.66 50 XM_UncommonTLD01 9288 5.38 6.84 4.61 51 T_REMOTE_IMAGE 9088 4.36 4.08 4.51 52 TR_XM_DK_Bayes1 9033 3.24 0.91 4.48 53 XM_B_Phish_Phrases 8752 5.81 8.59 4.34 54 RCVD_IN_IADB_SPF 8183 3.46 2.32 4.06 55 RELAYCOUNTRY_META 8158 8.39 16.59 4.05 56 XMNumbers 8132 4.10 4.24 4.03 57 FROM_EXCESS_BASE64 8126 4.94 6.65 4.03 58 UNPARSEABLE_RELAY 7973 3.06 1.39 3.95 59 NO_DNS_FOR_FROM 7968 4.85 6.53 3.95 60 RCVD_IN_MSPIKE_H2 7824 3.75 3.51 3.88 61 XMStrtUSub 7722 4.01 4.35 3.83 62 BAYES_80 7648 5.11 7.59 3.79 63 XMSubMetaSx_00 7565 5.07 7.57 3.75 64 TVD_RCVD_IP 7317 2.57 0.59 3.63 65 ANY_BOUNCE_MESSAGE 7298 2.46 0.27 3.62 66 BOUNCE_MESSAGE 7295 2.46 0.27 3.62 67 MIME_QP_LONG_LINE 7267 3.81 4.20 3.60 68 RCVD_IN_IADB_SENDERID 7068 3.06 2.21 3.50 69 RCVD_IN_IADB_VOUCHED 7058 2.61 0.94 3.50 70 TR_XM_DK_Bayes2 6950 2.46 0.60 3.45 71 INVALID_MSGID 6804 2.29 0.25 3.37 72 RCVD_IN_IADB_DK 6766 2.95 2.19 3.36 73 TO_MALFORMED 6702 2.18 0.01 3.32 74 MSGID_NOFQDN1 6578 2.14 0.02 3.26 75 TR_Symld_Words 6299 2.46 1.21 3.12 76 XMSubNoVowel 6273 3.26 3.55 3.11 77 TR_XM_DocInvoice 6074 4.44 7.12 3.01 78 MPART_ALT_DIFF 6013 4.27 6.70 2.98 79 HTML_IMAGE_RATIO_06 5994 3.82 5.42 2.97 80 XMSexyCombo_05 5772 5.39 10.16 2.86 81 RCVD_IN_MSPIKE_WL 5658 2.18 0.99 2.81 82 RCVD_IN_MSPIKE_H3 5658 2.18 0.99 2.81 83 XMSubEmpty 5436 2.73 2.81 2.70 84 MIME_HTML_MOSTLY 5399 3.33 4.55 2.68 85 BAYES_95 5077 3.35 4.92 2.52 86 IN_HORDE_ADDRESS_BOOK 5039 1.66 0.08 2.50 87 RCVD_IN_IADB_OPTIN 4569 1.69 0.60 2.27 88 XM_PDF 4156 1.47 0.34 2.06 89 TooManyTo_002 4117 1.75 1.19 2.04 90 XM_DK_Undo_01 3897 1.62 1.03 1.93 91 XM_DIRTYINTL 3891 2.71 4.18 1.93 92 T_TooManySym_02 3713 1.42 0.62 1.84 93 BAYES_20 3713 1.56 1.03 1.84 94 MAILING_LIST_MULTI 3592 1.78 1.79 1.78 95 USER_IN_DEF_DKIM_WL 3518 1.16 0.07 1.74 96 BOTNET 3076 5.62 13.35 1.53 97 HTML_IMAGE_RATIO_08 3075 2.17 3.39 1.52 98 XM_CamelCaseFrm001 3036 2.12 3.28 1.51 99 HTML_MIME_NO_HTML_TAG 2994 1.52 1.57 1.48 100 URI_HEX 2992 2.06 3.14 1.48 101 BAYES_05 2809 1.12 0.61 1.39 102 TM2_M_URI_OPT_OUT 2746 1.97 3.11 1.36 103 TM2_M_A_HREF_HREF 2578 1.17 0.96 1.28 104 XM_ProductURIs 2514 1.35 1.55 1.25 105 RELAYCOUNTRY_CA 2513 1.98 3.36 1.25 106 XM_GoogleGroups 2440 0.98 0.54 1.21 107 USER_IN_WHITELIST 2430 0.79 0.00 1.20 108 XM_SPF_SoftFail 2413 1.93 3.31 1.20 109 XM_D_tchamptons_WL 2381 0.77 0.00 1.18 110 TooManyTo_003 2379 1.14 1.06 1.18 111 UNTRUSTED_Relay 2304 4.31 10.28 1.14 112 T_XMDrugObfuBody_08 2193 1.31 1.74 1.09 113 URI_TRY_3LD 2191 1.05 0.98 1.09 114 XM_OfRef6 2137 1.49 2.29 1.06 115 XM_H_PHPOS 2109 1.11 1.24 1.05 116 MIME_HTML_ONLY_MULTI 2094 1.77 3.14 1.04 117 XMDiploma_00 2056 1.08 1.20 1.02 118 XMPhish11 1931 0.97 1.00 0.96 119 T_XMDrugObfuBody_00 1922 0.97 0.99 0.95 120 SHORT_URI_2 1916 1.28 1.90 0.95 121 T_TooManySym_03 1843 0.64 0.11 0.91 122 XMBdyGiftCard01 1836 1.24 1.86 0.91 123 TooManyTo_004 1794 0.87 0.82 0.89 124 TM2_M_VERY_LONG_WORD 1723 1.26 2.02 0.85 125 XM_B_REG_HTML 1712 1.20 1.86 0.85 126 XMBody_95 1670 0.61 0.20 0.83 127 DKIM_ADSP_CUSTOM_MED 1623 1.04 1.48 0.80 128 XM_H_PHPMailer 1569 0.85 0.99 0.78 129 UPPERCASE_50_75 1552 0.53 0.08 0.77 130 XMStockSpam_06 1493 1.00 1.50 0.74 131 TooManyTo_005 1490 0.72 0.69 0.74 132 TVD_SPACE_RATIO 1488 0.84 1.04 0.74 133 TR_Mismatch_TLD_01 1482 1.53 3.04 0.73 134 HELO_NODOT 1464 0.54 0.19 0.73 135 XM_B_COPY_HTML 1454 0.81 0.98 0.72 136 XM_UB50 1441 1.83 3.95 0.71 137 XMSubMetaI_00 1417 1.17 2.05 0.70 138 TR_MetaPhish_Combo_01 1414 0.63 0.50 0.70 139 XMEmptySub 1367 0.80 1.03 0.68 140 XMSubMetaSxObfu_02 1363 0.53 0.25 0.68 141 XM_H_Long_From02 1357 1.02 1.68 0.67 142 T_FILL_THIS_FORM_SHORT 1324 0.72 0.84 0.66 143 TR_LOTS_OF_MONEY2 1320 0.80 1.08 0.65 144 T_MONEY_PERCENT 1320 0.80 1.08 0.65 145 HTML_FONT_FACE_BAD 1268 0.74 0.95 0.63 146 RELAYCOUNTRY_GB 1229 0.73 0.96 0.61 147 NML_ADSP_CUSTOM_MED 1189 0.86 1.37 0.59 148 RCVD_IN_BL_SPAMCOP_NET 1160 1.37 2.88 0.58 149 REMOVE_BEFORE_LINK 1144 0.68 0.88 0.57 150 XMBody_78 1092 0.68 0.95 0.54 151 XMGenDplmaNmb 1061 0.60 0.74 0.53 152 XMCapTrack 1058 0.48 0.39 0.52 153 SpammyFromTLD_01 1049 1.21 2.50 0.52 154 RDNS_DYNAMIC 1011 0.76 1.24 0.50 155 T_TooManySym_04 1004 0.33 0.02 0.50 156 XMBrknScrpt_02 996 0.57 0.72 0.49 157 XMSexyCombo_01 995 1.00 1.96 0.49 158 XMNoVowels 947 0.49 0.52 0.47 159 XMBody_17 919 1.05 2.19 0.46 160 PP_MIME_FAKE_ASCII_TEXT 918 0.53 0.68 0.46 161 SHORT_URI 907 0.52 0.64 0.45 162 FILL_THIS_FORM 900 0.60 0.89 0.45 163 URI_NOVOWEL 881 0.56 0.79 0.44 164 DKIM_ADSP_NXDOMAIN 870 0.55 0.78 0.43 165 FORGED_GMAIL_RCVD 864 0.74 1.32 0.43 166 T_XMHurry_00 856 0.67 1.13 0.42 167 MPART_ALT_DIFF_COUNT 840 0.67 1.16 0.42 168 HTML_TAG_BALANCE_BODY 822 0.48 0.62 0.41 169 TR_XM_RelayPhish 813 0.69 1.22 0.40 170 XM_ShortIntro_01 811 0.47 0.59 0.40 171 SUBJ_DOLLARS 801 0.89 1.83 0.40 172 XMRcvdHeader_15 783 0.25 0.00 0.39 173 T_OBFU_PDF_ATTACH 768 0.28 0.09 0.38 174 FILL_THIS_FORM_LONG 743 0.52 0.82 0.37 175 T_FILL_THIS_FORM_LOAN 737 0.44 0.59 0.37 176 XM_H_PHPOS_M 732 0.46 0.63 0.36 177 MISSING_HEADERS 727 0.49 0.75 0.36 178 XM_B_TRADE_HTML 711 0.37 0.40 0.35 179 XMHTMLBadTable_001 696 0.55 0.93 0.35 180 TO_IN_SUBJ 677 0.52 0.87 0.34 181 XMSubMetaSxObfu_03 673 0.45 0.68 0.33 182 RELAYCOUNTRY_DE 661 0.46 0.72 0.33 183 RELAYCOUNTRY_FR 657 1.01 2.31 0.33 184 XMClaimOffer 654 0.53 0.91 0.32 185 XMSUPPORT 643 0.21 0.00 0.32 186 TR_MetaPhish_Combo_01b 632 0.26 0.16 0.31 187 XMPhish30 629 0.78 1.66 0.31 188 XM_H_SpoofStaff4 614 0.20 0.01 0.30 189 XMLngstWrd_00 610 0.44 0.69 0.30 190 TR_Caps_n_Bayes_99 588 0.49 0.85 0.29 191 XM_BadFromFormat 586 0.91 2.08 0.29 192 HTML_IMAGE_ONLY_28 583 0.30 0.31 0.29 193 XMGappySubj_01 579 0.45 0.75 0.29 194 T_Symld_Words_02 575 0.37 0.53 0.29 195 RELAYCOUNTRY_NL 568 0.33 0.41 0.28 196 XMBody_29 560 0.32 0.41 0.28 197 RELAYCOUNTRY_AU 557 0.31 0.38 0.28 198 PLING_QUERY 556 0.55 1.08 0.28 199 MIME_BASE64_TEXT 550 0.28 0.31 0.27 200 DIET_1 531 0.68 1.47 0.26 ----------------------------------------------------------------------