Email: 461435 Autolearn: 0 AvgScore: 4.26 AvgScanTime: 3.88 sec Spam: 159906 Autolearn: 0 AvgScore: 12.76 AvgScanTime: 4.89 sec Ham: 301529 Autolearn: 0 AvgScore: -0.25 AvgScanTime: 3.34 sec Time Spent Running SA: 496.73 hours Time Spent Processing Spam: 217.30 hours Time Spent Processing Ham: 279.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151345 84.80 94.65 79.58 2 DKIM_SIGNED 135112 71.19 84.49 64.14 3 XM_DK_Pass 131297 69.59 82.11 62.95 4 DCC_CHECK 130665 50.46 81.71 33.88 5 DKIM_VALID 122139 64.09 76.38 57.57 6 XMListUnsubscribeExists 117039 51.02 73.19 39.25 7 DKIM_VALID_AU 97701 48.29 61.10 41.50 8 XM_H_QuotedFrom 88153 41.44 55.13 34.18 9 XM_DK_Undo_02 81485 26.41 50.96 13.39 10 BAYES_99 74145 24.34 46.37 12.65 11 BAYES_999 64320 21.29 40.22 11.26 12 TR_DCC_Bayes_99 60820 17.26 38.03 6.24 13 HTML_FONT_LOW_CONTRAST 57071 26.30 35.69 21.32 14 LOC_TINY_FONT_1 55320 22.86 34.60 16.64 15 BAYES_50 48680 48.21 30.44 57.62 16 MIME_HTML_ONLY 46260 20.72 28.93 16.36 17 FVGT_m_MULTI_ODD 42459 21.04 26.55 18.12 18 XMSubLong 41131 20.95 25.72 18.41 19 DKIM_VALID_EF 34161 23.43 21.36 24.53 20 T_TM2_M_HEADER_IN_MSG 31573 29.65 19.74 34.91 21 T_KAM_HTML_FONT_INVALID 31436 15.40 19.66 13.14 22 XM_Body_Dirty_Words 30096 12.42 18.82 9.02 23 RELAYCOUNTRY_META 27699 9.71 17.32 5.67 24 XM_Multi_Part_URI 26919 12.21 16.83 9.76 25 DCC_CHECK_NEGATIVE 26191 47.78 16.38 64.44 26 HTML_IMAGE_RATIO_02 26115 9.52 16.33 5.91 27 MultiRelay 24778 17.00 15.50 17.80 28 XM_Evil_Numbers_Gen 24076 10.01 15.06 7.33 29 FSL_BULK_SIG 22715 10.98 14.21 9.27 30 BOTNET 21429 5.61 13.40 1.48 31 BOTNET_IPINHOSTNAME 19397 6.62 12.13 3.70 32 LotsOfNums_01 17994 8.64 11.25 7.26 33 UNTRUSTED_Relay 17670 4.83 11.05 1.53 34 HTML_IMAGE_RATIO_04 16901 6.32 10.57 4.06 35 XMSexyCombo_05 14905 5.03 9.32 2.76 36 T_XMDrugObfuBody_14 14465 7.52 9.05 6.71 37 LOTS_OF_MONEY 13964 7.62 8.73 7.03 38 XM_B_Phish_Phrases 13829 5.74 8.65 4.20 39 DKIM_INVALID 12973 7.10 8.11 6.57 40 XM_H_Long_From01 12641 10.06 7.91 11.21 41 TooManyTo_001 12487 8.18 7.81 8.38 42 FROM_EXCESS_BASE64 11822 4.63 7.39 3.17 43 BAYES_80 11816 4.96 7.39 3.66 44 BAYES_60 11394 6.80 7.13 6.63 45 MPART_ALT_DIFF 10777 3.73 6.74 2.14 46 TR_XM_DocInvoice 9989 4.60 6.25 3.73 47 XM_UncommonTLD01 9948 4.64 6.22 3.80 48 XMSubMetaSx_00 9623 4.23 6.02 3.28 49 XMStrtUSub 9439 4.88 5.90 4.34 50 RCVD_IN_RP_SAFE 8618 7.04 5.39 7.91 51 ALL_TRUSTED 7899 19.49 4.94 27.20 52 XM_UB50 7813 2.33 4.89 0.97 53 XMNumbers 7225 3.95 4.52 3.65 54 HTML_IMAGE_RATIO_06 7083 3.44 4.43 2.91 55 BAYES_95 7016 3.18 4.39 2.54 56 XM_SendGrid 6933 4.56 4.34 4.67 57 MIME_HTML_MOSTLY 6918 2.92 4.33 2.18 58 TM2_M_URI_OPT_OUT 6858 2.59 4.29 1.69 59 MIME_QP_LONG_LINE 6612 4.62 4.13 4.88 60 NO_DNS_FOR_FROM 6543 3.24 4.09 2.78 61 RCVD_IN_RP_CERTIFIED 6508 6.11 4.07 7.19 62 HTML_IMAGE_RATIO_08 6225 2.56 3.89 1.85 63 SUBJ_ALL_CAPS 6009 6.06 3.76 7.28 64 URI_HEX 5751 2.04 3.60 1.22 65 RELAYCOUNTRY_CA 5741 2.15 3.59 1.39 66 XM_DIRTYINTL 5686 2.20 3.56 1.48 67 XMSubNoVowel 5513 3.18 3.45 3.05 68 XM_SPF_SoftFail 5477 2.36 3.43 1.80 69 XM_CamelCaseFrm001 5189 2.09 3.25 1.48 70 TR_Mismatch_TLD_01 5125 1.62 3.21 0.77 71 RCVD_IN_MSPIKE_H2 5082 3.24 3.18 3.27 72 MultiRelay_CC 4877 1.22 3.05 0.25 73 MultiRelay_Combo 4877 1.22 3.05 0.25 74 T_REMOTE_IMAGE 4711 3.45 2.95 3.71 75 MIME_HTML_ONLY_MULTI 4705 1.57 2.94 0.84 76 XMSubMetaI_00 4643 1.58 2.90 0.88 77 XMSubEmpty 4510 2.73 2.82 2.69 78 RCVD_IN_BL_SPAMCOP_NET 4401 1.22 2.75 0.40 79 T_TooManySym_01 4337 4.05 2.71 4.76 80 XM_OfRef6 4138 1.74 2.59 1.30 81 HTML_MIME_NO_HTML_TAG 3932 2.20 2.46 2.06 82 RELAYCOUNTRY_FR 3377 0.92 2.11 0.29 83 XM_UB99 3341 0.76 2.09 0.05 84 MAILING_LIST_MULTI 3335 2.63 2.09 2.92 85 RCVD_IN_IADB_LISTED 3318 3.86 2.07 4.80 86 XM_URI_RBL 3300 0.78 2.06 0.10 87 SpammyFromTLD_02 3250 0.89 2.03 0.28 88 T_XMDrugObfuBody_08 3236 1.62 2.02 1.41 89 RCVD_IN_RP_RNBL 3183 0.71 1.99 0.02 90 XMBody_17 3114 0.92 1.95 0.37 91 TM2_M_VERY_LONG_WORD 3057 1.22 1.91 0.85 92 XMBdyGiftCard01 3047 1.06 1.91 0.60 93 TR_Caps_n_Bayes_99 3039 0.75 1.90 0.14 94 XMSexyCombo_01 3006 0.91 1.88 0.39 95 UNPARSEABLE_RELAY 3000 2.53 1.88 2.87 96 SpammyFromTLD_01 2997 1.05 1.87 0.61 97 RCVD_IN_IADB_SPF 2996 3.43 1.87 4.26 98 RCVD_IN_IADB_SENDERID 2894 3.15 1.81 3.85 99 XM_H_Long_From02 2859 1.11 1.79 0.75 100 RCVD_IN_IADB_DK 2856 3.08 1.79 3.77 101 SHORT_URI_2 2816 1.09 1.76 0.74 102 REMOVE_BEFORE_LINK 2641 0.73 1.65 0.23 103 DKIM_ADSP_CUSTOM_MED 2505 1.34 1.57 1.22 104 XM_UB999 2470 0.55 1.54 0.03 105 URIBL_BLACK 2464 0.56 1.54 0.04 106 BOTNET_NORDNS 2414 0.54 1.51 0.03 107 BODY_ENHANCEMENT 2378 0.53 1.49 0.02 108 URIBL_DBL_SPAM 2333 0.53 1.46 0.03 109 XMPhish30 2283 0.63 1.43 0.21 110 XMDiploma_00 2264 1.41 1.42 1.41 111 XM_DK_Undo_01 2255 1.79 1.41 2.00 112 XMStockSpam_06 2255 1.36 1.41 1.34 113 NML_ADSP_CUSTOM_MED 2241 1.05 1.40 0.87 114 T_FILL_THIS_FORM_SHORT 2236 0.95 1.40 0.71 115 TooManyTo_002 2174 2.20 1.36 2.64 116 XM_ProductURIs 2170 1.17 1.36 1.07 117 XM_UB60 2167 0.55 1.36 0.12 118 XMHTML_After_End 2143 0.63 1.34 0.25 119 FORGED_GMAIL_RCVD 2143 0.84 1.34 0.57 120 XM_B_REG_HTML 2137 0.80 1.34 0.52 121 BAYES_40 2102 4.37 1.31 5.99 122 XM_BadFromFormat 2066 0.61 1.29 0.24 123 DIET_1 2064 0.63 1.29 0.28 124 T_XMDrugObfuBody_00 2063 1.08 1.29 0.96 125 URI_TRY_3LD 2051 0.94 1.28 0.77 126 RELAYCOUNTRY_AT 2005 0.53 1.25 0.14 127 RELAYCOUNTRY_CN 1952 0.48 1.22 0.09 128 RCVD_IN_PSBL 1942 0.50 1.21 0.12 129 TooManyTo_003 1924 1.60 1.20 1.80 130 TVD_SPACE_RATIO 1911 0.95 1.20 0.81 131 XM_RXBody 1873 0.52 1.17 0.17 132 XM_HighProb1 1850 0.41 1.16 0.02 133 XM_B_COPY_HTML 1837 0.79 1.15 0.59 134 TR_XM_RelayPhish 1832 0.68 1.15 0.43 135 RELAYCOUNTRY_GB 1798 1.03 1.12 0.97 136 FILL_THIS_FORM 1772 0.79 1.11 0.62 137 RCVD_IN_MSPIKE_H3 1746 2.06 1.09 2.58 138 RCVD_IN_MSPIKE_WL 1746 2.06 1.09 2.58 139 XMLongAddy 1745 0.45 1.09 0.11 140 BAYES_20 1744 1.97 1.09 2.44 141 FSL_THIS_IS_ADV 1734 0.41 1.08 0.06 142 XMBody_78 1730 0.67 1.08 0.45 143 RELAYCOUNTRY_IT 1713 0.40 1.07 0.04 144 XMPhish11 1655 1.01 1.03 0.99 145 FILL_THIS_FORM_LONG 1644 0.68 1.03 0.49 146 XM_UB80 1630 0.38 1.02 0.04 147 MPART_ALT_DIFF_COUNT 1622 0.56 1.01 0.32 148 BAYES_00 1621 4.62 1.01 6.53 149 TooManyTo_004 1508 1.23 0.94 1.38 150 XMGenDplmaNmb 1507 0.82 0.94 0.76 151 XMBrknScrpt_02 1506 0.67 0.94 0.52 152 T_XMHurry_00 1504 0.69 0.94 0.56 153 TR_Symld_Words 1496 1.35 0.94 1.57 154 RELAYCOUNTRY_IN 1493 0.41 0.93 0.13 155 RELAYCOUNTRY_DE 1458 0.78 0.91 0.71 156 XMSexyCombo_04 1448 0.36 0.91 0.08 157 T_FILL_THIS_FORM_LOAN 1425 0.60 0.89 0.45 158 XMNoVowels 1396 1.07 0.87 1.17 159 TR_Mismatch_TLD_02 1387 0.34 0.87 0.06 160 BODY_URI_ONLY 1347 0.33 0.84 0.06 161 RCVD_IN_IADB_VOUCHED 1338 2.28 0.84 3.04 162 TooManyTo_005 1324 1.02 0.83 1.12 163 XMPhish14 1311 0.45 0.82 0.25 164 HTML_FONT_FACE_BAD 1301 0.54 0.81 0.39 165 XMEmptySub 1299 0.64 0.81 0.55 166 PLING_QUERY 1297 0.55 0.81 0.41 167 T_Symld_Words_02 1289 0.49 0.81 0.32 168 TR_XM_DK_Bayes 1260 3.01 0.79 4.19 169 T_MONEY_PERCENT 1247 0.56 0.78 0.44 170 TR_LOTS_OF_MONEY2 1247 0.56 0.78 0.44 171 XM_H_PHPOS 1240 0.92 0.78 0.99 172 HTTPS_HTTP_MISMATCH 1230 0.51 0.77 0.37 173 DATE_IN_PAST_03_06 1222 0.31 0.76 0.07 174 HTML_FONT_SIZE_HUGE 1217 0.37 0.76 0.17 175 HTML_IMAGE_ONLY_08 1214 0.35 0.76 0.14 176 URI_NOVOWEL 1199 0.53 0.75 0.41 177 XMHTMLBadTable_001 1197 0.46 0.75 0.30 178 XM_H_Long_From03 1186 0.34 0.74 0.13 179 HTML_SHORT_LINK_IMG_1 1174 0.27 0.73 0.02 180 ANY_BOUNCE_MESSAGE 1166 2.57 0.73 3.55 181 URIBL_SBL_A 1164 0.32 0.73 0.10 182 BOUNCE_MESSAGE 1164 2.57 0.73 3.55 183 TR_XM_DK_Bayes1 1141 2.60 0.71 3.60 184 SHORT_URI 1135 0.48 0.71 0.36 185 TO_IN_SUBJ 1108 0.48 0.69 0.36 186 TVD_PH_SUBJ_META1 1105 0.30 0.69 0.09 187 XMMoneyMeta_00 1101 0.48 0.69 0.37 188 RELAYCOUNTRY_BR 1100 0.25 0.69 0.01 189 TR_XM_DK_Bayes2 1097 2.17 0.69 2.95 190 T_TooManySym_02 1086 1.60 0.68 2.09 191 RDNS_DYNAMIC 1086 0.51 0.68 0.42 192 XMSubMetaD_03 1081 0.40 0.68 0.25 193 XMLngstWrd_00 1062 0.50 0.66 0.41 194 XM_PDF 1054 3.01 0.66 4.25 195 LONG_JUNK_URI3 1052 0.29 0.66 0.09 196 XMSubMetaI_01 1043 0.28 0.65 0.08 197 BAYES_05 1042 1.30 0.65 1.64 198 XM_H_Undi_Recip 1033 0.41 0.65 0.28 199 LongTLD 1020 0.31 0.64 0.13 200 TR_MetaPhish_Combo_01 1017 0.65 0.64 0.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 239942 84.80 94.65 79.58 2 DCC_CHECK_NEGATIVE 194293 47.78 16.38 64.44 3 DKIM_SIGNED 193386 71.19 84.49 64.14 4 XM_DK_Pass 189818 69.59 82.11 62.95 5 BAYES_50 173756 48.21 30.44 57.62 6 DKIM_VALID 173587 64.09 76.38 57.57 7 DKIM_VALID_AU 125136 48.29 61.10 41.50 8 XMListUnsubscribeExists 118365 51.02 73.19 39.25 9 T_TM2_M_HEADER_IN_MSG 105256 29.65 19.74 34.91 10 XM_H_QuotedFrom 103050 41.44 55.13 34.18 11 DCC_CHECK 102172 50.46 81.71 33.88 12 ALL_TRUSTED 82013 19.49 4.94 27.20 13 DKIM_VALID_EF 73974 23.43 21.36 24.53 14 HTML_FONT_LOW_CONTRAST 64298 26.30 35.69 21.32 15 XMSubLong 55520 20.95 25.72 18.41 16 FVGT_m_MULTI_ODD 54636 21.04 26.55 18.12 17 MultiRelay 53686 17.00 15.50 17.80 18 LOC_TINY_FONT_1 50173 22.86 34.60 16.64 19 MIME_HTML_ONLY 49329 20.72 28.93 16.36 20 XM_DK_Undo_02 40361 26.41 50.96 13.39 21 T_KAM_HTML_FONT_INVALID 39608 15.40 19.66 13.14 22 BAYES_99 38153 24.34 46.37 12.65 23 BAYES_999 33938 21.29 40.22 11.26 24 XM_H_Long_From01 33801 10.06 7.91 11.21 25 XM_Multi_Part_URI 29444 12.21 16.83 9.76 26 FSL_BULK_SIG 27966 10.98 14.21 9.27 27 XM_Body_Dirty_Words 27203 12.42 18.82 9.02 28 XM_DKIMWhitelistDomains 26812 5.83 0.06 8.89 29 TooManyTo_001 25263 8.18 7.81 8.38 30 RCVD_IN_RP_SAFE 23866 7.04 5.39 7.91 31 XM_Evil_Numbers_Gen 22095 10.01 15.06 7.33 32 SUBJ_ALL_CAPS 21965 6.06 3.76 7.28 33 LotsOfNums_01 21893 8.64 11.25 7.26 34 RCVD_IN_RP_CERTIFIED 21675 6.11 4.07 7.19 35 LOTS_OF_MONEY 21199 7.62 8.73 7.03 36 T_XMDrugObfuBody_14 20235 7.52 9.05 6.71 37 BAYES_60 20004 6.80 7.13 6.63 38 DKIM_INVALID 19799 7.10 8.11 6.57 39 BAYES_00 19702 4.62 1.01 6.53 40 TR_DCC_Bayes_99 18825 17.26 38.03 6.24 41 BAYES_40 18053 4.37 1.31 5.99 42 HTML_IMAGE_RATIO_02 17809 9.52 16.33 5.91 43 RELAYCOUNTRY_META 17098 9.71 17.32 5.67 44 IN_ZIMBRA_NJ_WHITELIST 16429 3.57 0.03 5.45 45 MIME_QP_LONG_LINE 14705 4.62 4.13 4.88 46 RCVD_IN_IADB_LISTED 14477 3.86 2.07 4.80 47 T_TooManySym_01 14340 4.05 2.71 4.76 48 XM_SendGrid 14095 4.56 4.34 4.67 49 XMStrtUSub 13086 4.88 5.90 4.34 50 RCVD_IN_IADB_SPF 12850 3.43 1.87 4.26 51 XM_PDF 12822 3.01 0.66 4.25 52 XM_B_Phish_Phrases 12678 5.74 8.65 4.20 53 TR_XM_DK_Bayes 12648 3.01 0.79 4.19 54 HTML_IMAGE_RATIO_04 12245 6.32 10.57 4.06 55 RCVD_IN_IADB_SENDERID 11622 3.15 1.81 3.85 56 XM_UncommonTLD01 11469 4.64 6.22 3.80 57 RCVD_IN_IADB_DK 11355 3.08 1.79 3.77 58 TR_XM_DocInvoice 11260 4.60 6.25 3.73 59 T_REMOTE_IMAGE 11201 3.45 2.95 3.71 60 BOTNET_IPINHOSTNAME 11168 6.62 12.13 3.70 61 BAYES_80 11051 4.96 7.39 3.66 62 XMNumbers 11008 3.95 4.52 3.65 63 TR_XM_DK_Bayes1 10846 2.60 0.71 3.60 64 ANY_BOUNCE_MESSAGE 10695 2.57 0.73 3.55 65 BOUNCE_MESSAGE 10690 2.57 0.73 3.55 66 XMSubMetaSx_00 9898 4.23 6.02 3.28 67 RCVD_IN_MSPIKE_H2 9853 3.24 3.18 3.27 68 FROM_EXCESS_BASE64 9550 4.63 7.39 3.17 69 XMSubNoVowel 9183 3.18 3.45 3.05 70 RCVD_IN_IADB_VOUCHED 9172 2.28 0.84 3.04 71 TR_XM_DK_Bayes2 8905 2.17 0.69 2.95 72 MAILING_LIST_MULTI 8812 2.63 2.09 2.92 73 HTML_IMAGE_RATIO_06 8780 3.44 4.43 2.91 74 UNPARSEABLE_RELAY 8659 2.53 1.88 2.87 75 NO_DNS_FOR_FROM 8391 3.24 4.09 2.78 76 XMSexyCombo_05 8326 5.03 9.32 2.76 77 XMSubEmpty 8107 2.73 2.82 2.69 78 TVD_RCVD_IP 8088 1.85 0.27 2.68 79 TooManyTo_002 7966 2.20 1.36 2.64 80 RCVD_IN_MSPIKE_H3 7774 2.06 1.09 2.58 81 RCVD_IN_MSPIKE_WL 7774 2.06 1.09 2.58 82 BAYES_95 7644 3.18 4.39 2.54 83 BAYES_20 7345 1.97 1.09 2.44 84 IN_HORDE_ADDRESS_BOOK 6821 1.50 0.07 2.26 85 INVALID_MSGID 6785 1.53 0.17 2.25 86 TO_MALFORMED 6566 1.43 0.03 2.18 87 MIME_HTML_MOSTLY 6563 2.92 4.33 2.18 88 MSGID_NOFQDN1 6560 1.43 0.02 2.18 89 MPART_ALT_DIFF 6452 3.73 6.74 2.14 90 T_TooManySym_02 6290 1.60 0.68 2.09 91 HTML_MIME_NO_HTML_TAG 6225 2.20 2.46 2.06 92 XM_DK_Undo_01 6020 1.79 1.41 2.00 93 RCVD_IN_IADB_OPTIN 5604 1.39 0.50 1.86 94 HTML_IMAGE_RATIO_08 5573 2.56 3.89 1.85 95 HELO_NODOT 5527 1.31 0.32 1.83 96 TooManyTo_003 5436 1.60 1.20 1.80 97 XM_SPF_SoftFail 5428 2.36 3.43 1.80 98 TM2_M_URI_OPT_OUT 5109 2.59 4.29 1.69 99 BAYES_05 4938 1.30 0.65 1.64 100 TR_Symld_Words 4743 1.35 0.94 1.57 101 USER_IN_DEF_DKIM_WL 4740 1.05 0.07 1.57 102 UNTRUSTED_Relay 4624 4.83 11.05 1.53 103 XM_DIRTYINTL 4474 2.20 3.56 1.48 104 XM_CamelCaseFrm001 4471 2.09 3.25 1.48 105 BOTNET 4453 5.61 13.40 1.48 106 T_XMDrugObfuBody_08 4257 1.62 2.02 1.41 107 XMDiploma_00 4250 1.41 1.42 1.41 108 RELAYCOUNTRY_CA 4189 2.15 3.59 1.39 109 TooManyTo_004 4174 1.23 0.94 1.38 110 XMStockSpam_06 4032 1.36 1.41 1.34 111 XM_GoogleGroups 3942 1.04 0.54 1.31 112 XMCapTrack 3909 1.04 0.55 1.30 113 XM_OfRef6 3906 1.74 2.59 1.30 114 URI_HEX 3680 2.04 3.60 1.22 115 DKIM_ADSP_CUSTOM_MED 3672 1.34 1.57 1.22 116 XMNoVowels 3521 1.07 0.87 1.17 117 TooManyTo_005 3389 1.02 0.83 1.12 118 XM_ProductURIs 3219 1.17 1.36 1.07 119 XMPhish11 2999 1.01 1.03 0.99 120 XM_H_PHPOS 2995 0.92 0.78 0.99 121 XM_UB50 2938 2.33 4.89 0.97 122 RELAYCOUNTRY_GB 2932 1.03 1.12 0.97 123 T_XMDrugObfuBody_00 2909 1.08 1.29 0.96 124 T_TooManySym_03 2669 0.62 0.13 0.89 125 XMSubMetaI_00 2639 1.58 2.90 0.88 126 NML_ADSP_CUSTOM_MED 2614 1.05 1.40 0.87 127 TM2_M_VERY_LONG_WORD 2562 1.22 1.91 0.85 128 MIME_HTML_ONLY_MULTI 2528 1.57 2.94 0.84 129 USER_IN_WHITELIST 2521 0.55 0.00 0.84 130 TVD_SPACE_RATIO 2450 0.95 1.20 0.81 131 XM_H_PHPMailer 2368 0.71 0.57 0.79 132 TR_Mismatch_TLD_01 2328 1.62 3.21 0.77 133 URI_TRY_3LD 2309 0.94 1.28 0.77 134 XMGenDplmaNmb 2277 0.82 0.94 0.76 135 XM_H_Long_From02 2258 1.11 1.79 0.75 136 SHORT_URI_2 2233 1.09 1.76 0.74 137 THIS_AD 2199 0.61 0.39 0.73 138 RELAYCOUNTRY_DE 2133 0.78 0.91 0.71 139 T_FILL_THIS_FORM_SHORT 2133 0.95 1.40 0.71 140 TR_MetaPhish_Combo_01 2000 0.65 0.64 0.66 141 FILL_THIS_FORM 1872 0.79 1.11 0.62 142 T_OBFU_PDF_ATTACH 1867 0.46 0.17 0.62 143 RELAYCOUNTRY_NL 1864 0.59 0.54 0.62 144 SpammyFromTLD_01 1832 1.05 1.87 0.61 145 XMBdyGiftCard01 1823 1.06 1.91 0.60 146 XM_B_COPY_HTML 1786 0.79 1.15 0.59 147 T_MANY_PILL_PRICE 1732 0.38 0.00 0.57 148 FORGED_GMAIL_RCVD 1720 0.84 1.34 0.57 149 MISSING_HEADERS 1692 0.58 0.61 0.56 150 XMGappySubj_01 1691 0.49 0.35 0.56 151 T_XMHurry_00 1687 0.69 0.94 0.56 152 XM_ShortIntro_01 1678 0.48 0.33 0.56 153 XMEmptySub 1660 0.64 0.81 0.55 154 XMBody_95 1653 0.43 0.20 0.55 155 XMLKML 1592 0.35 0.00 0.53 156 XMBrknScrpt_02 1581 0.67 0.94 0.52 157 XM_B_REG_HTML 1566 0.80 1.34 0.52 158 PP_MIME_FAKE_ASCII_TEXT 1530 0.55 0.63 0.51 159 FILL_THIS_FORM_LONG 1484 0.68 1.03 0.49 160 XMSubMetaSxObfu_02 1459 0.41 0.26 0.48 161 SHORT_HELO_AND_INLINE_IMAGE 1447 0.34 0.08 0.48 162 HTML_IMAGE_ONLY_28 1387 0.46 0.46 0.46 163 AC_DIV_BONANZA 1376 0.36 0.18 0.46 164 HTML_IMAGE_ONLY_32 1375 0.39 0.26 0.46 165 T_FILL_THIS_FORM_LOAN 1358 0.60 0.89 0.45 166 HTML_TAG_BALANCE_BODY 1353 0.51 0.63 0.45 167 XMBody_78 1347 0.67 1.08 0.45 168 T_MONEY_PERCENT 1339 0.56 0.78 0.44 169 TR_LOTS_OF_MONEY2 1339 0.56 0.78 0.44 170 TR_XM_RelayPhish 1311 0.68 1.15 0.43 171 RDNS_DYNAMIC 1278 0.51 0.68 0.42 172 RCVD_IN_SORBS_DUL 1252 0.37 0.28 0.42 173 PLING_QUERY 1246 0.55 0.81 0.41 174 XMDateMe_00 1238 0.32 0.14 0.41 175 URI_NOVOWEL 1237 0.53 0.75 0.41 176 T_TooManySym_04 1235 0.28 0.02 0.41 177 XMLngstWrd_00 1223 0.50 0.66 0.41 178 RCVD_IN_BL_SPAMCOP_NET 1208 1.22 2.75 0.40 179 HTML_FONT_FACE_BAD 1182 0.54 0.81 0.39 180 XMSexyCombo_01 1179 0.91 1.88 0.39 181 XMMoneyMeta_00 1119 0.48 0.69 0.37 182 HTTPS_HTTP_MISMATCH 1115 0.51 0.77 0.37 183 XMBody_17 1113 0.92 1.95 0.37 184 TO_NO_BRKTS_HTML_ONLY 1112 0.29 0.14 0.37 185 XM_H_PHPOS_M 1105 0.35 0.33 0.37 186 UPPERCASE_50_75 1094 0.32 0.25 0.36 187 SHORT_URI 1093 0.48 0.71 0.36 188 TO_IN_SUBJ 1090 0.48 0.69 0.36 189 TM2_M_BODY_EMPTY 1087 0.31 0.20 0.36 190 XMLngstWrd_01 1063 0.44 0.60 0.35 191 RELAYCOUNTRY_AU 1053 0.40 0.50 0.35 192 XM_H_Trusted_IP 1037 0.22 0.00 0.34 193 HTML_IMAGE_ONLY_20 1036 0.32 0.26 0.34 194 HTML_IMAGE_ONLY_24 1025 0.40 0.51 0.34 195 T_Symld_Words_02 975 0.49 0.81 0.32 196 MPART_ALT_DIFF_COUNT 956 0.56 1.01 0.32 197 TM2_M_A_HREF_HREF 948 0.39 0.53 0.31 198 DKIM_ADSP_NXDOMAIN 929 0.35 0.43 0.31 199 HTML_IMAGE_ONLY_16 926 0.27 0.20 0.31 200 XM_B_TRADE_HTML 924 0.28 0.24 0.31 ----------------------------------------------------------------------