Email: 524778 Autolearn: 0 AvgScore: 3.52 AvgScanTime: 3.82 sec Spam: 162292 Autolearn: 0 AvgScore: 12.60 AvgScanTime: 4.56 sec Ham: 362486 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 3.49 sec Time Spent Running SA: 556.86 hours Time Spent Processing Spam: 205.59 hours Time Spent Processing Ham: 351.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154360 84.07 95.11 79.13 2 DKIM_SIGNED 135839 69.26 83.70 62.80 3 XM_DK_Pass 132141 67.68 81.42 61.53 4 DCC_CHECK 129414 45.66 79.74 30.40 5 DKIM_VALID 126749 64.06 78.10 57.77 6 XMListUnsubscribeExists 115249 47.79 71.01 37.39 7 DKIM_VALID_AU 99508 46.57 61.31 39.97 8 XM_H_QuotedFrom 95252 39.59 58.69 31.03 9 XM_DK_Undo_02 76987 22.98 47.44 12.03 10 BAYES_99 69590 21.20 42.88 11.50 11 HTML_FONT_LOW_CONTRAST 62499 26.89 38.51 21.68 12 BAYES_999 59450 18.34 36.63 10.15 13 LOC_TINY_FONT_1 56019 22.86 34.52 17.64 14 BAYES_50 55495 51.24 34.19 58.87 15 TR_DCC_Bayes_99 54124 14.05 33.35 5.41 16 MIME_HTML_ONLY 49485 22.22 30.49 18.51 17 FVGT_m_MULTI_ODD 42638 20.26 26.27 17.57 18 XMSubLong 41935 20.76 25.84 18.49 19 DKIM_VALID_EF 41820 24.46 25.77 23.88 20 T_TM2_M_HEADER_IN_MSG 32296 30.32 19.90 34.98 21 T_KAM_HTML_FONT_INVALID 32292 14.76 19.90 12.46 22 RELAYCOUNTRY_META 30624 9.10 18.87 4.73 23 XM_Body_Dirty_Words 30581 12.35 18.84 9.45 24 DCC_CHECK_NEGATIVE 29406 52.20 18.12 67.46 25 HTML_IMAGE_RATIO_02 27343 9.07 16.85 5.58 26 MultiRelay 26594 17.95 16.39 18.65 27 XM_Multi_Part_URI 26323 12.02 16.22 10.15 28 FSL_BULK_SIG 24150 9.95 14.88 7.74 29 XM_Evil_Numbers_Gen 22155 9.04 13.65 6.98 30 BOTNET 21214 4.78 13.07 1.07 31 BOTNET_IPINHOSTNAME 19548 6.11 12.04 3.45 32 LOTS_OF_MONEY 18258 9.86 11.25 9.23 33 UNTRUSTED_Relay 16651 4.06 10.26 1.28 34 XMSexyCombo_05 15239 5.11 9.39 3.20 35 T_XMDrugObfuBody_14 15107 7.59 9.31 6.82 36 XM_B_Phish_Phrases 14311 5.84 8.82 4.51 37 HTML_IMAGE_RATIO_04 14287 5.23 8.80 3.63 38 LotsOfNums_01 14245 7.39 8.78 6.77 39 TR_XM_DocInvoice 14137 5.01 8.71 3.36 40 XM_UncommonTLD01 13286 5.05 8.19 3.65 41 XM_H_Long_From01 12608 9.37 7.77 10.08 42 BAYES_80 12332 4.67 7.60 3.35 43 BAYES_60 11338 6.44 6.99 6.19 44 MPART_ALT_DIFF 11298 4.89 6.96 3.97 45 TooManyTo_001 10965 7.85 6.76 8.34 46 XMSubMetaSx_00 10944 4.33 6.74 3.24 47 FROM_EXCESS_BASE64 10937 4.07 6.74 2.87 48 DKIM_INVALID 9090 5.20 5.60 5.03 49 HTML_IMAGE_RATIO_06 8772 3.81 5.41 3.09 50 XM_UB50 8478 2.20 5.22 0.85 51 RCVD_IN_MSPIKE_H2 8347 4.75 5.14 4.58 52 XMNumbers 8228 4.43 5.07 4.15 53 RCVD_IN_RP_SAFE 8031 6.40 4.95 7.04 54 RELAYCOUNTRY_CA 7900 2.31 4.87 1.16 55 XM_SendGrid 7761 4.51 4.78 4.38 56 MIME_HTML_MOSTLY 7624 2.78 4.70 1.92 57 TM2_M_URI_OPT_OUT 7329 2.63 4.52 1.79 58 XM_DIRTYINTL 7154 2.71 4.41 1.95 59 BAYES_95 6980 2.94 4.30 2.33 60 T_REMOTE_IMAGE 6578 4.06 4.05 4.06 61 XMStrtUSub 6575 4.02 4.05 4.01 62 ALL_TRUSTED 6448 18.78 3.97 25.41 63 MIME_QP_LONG_LINE 6447 4.36 3.97 4.53 64 RCVD_IN_RP_CERTIFIED 6245 5.63 3.85 6.43 65 XM_CamelCaseFrm001 5840 2.15 3.60 1.50 66 SpammyFromTLD_01 5526 1.64 3.40 0.85 67 URI_HEX 5506 1.80 3.39 1.09 68 XM_SPF_SoftFail 5406 2.43 3.33 2.03 69 HTML_IMAGE_RATIO_08 5290 2.35 3.26 1.94 70 T_XMDrugObfuBody_08 5233 1.88 3.22 1.28 71 RCVD_IN_BL_SPAMCOP_NET 5138 1.31 3.17 0.48 72 MIME_HTML_ONLY_MULTI 5006 2.91 3.08 2.83 73 XMPhish11 4993 1.80 3.08 1.22 74 XM_OfRef6 4675 1.87 2.88 1.42 75 XMSubNoVowel 4465 2.59 2.75 2.51 76 SpammyFromTLD_02 4182 1.02 2.58 0.33 77 BOTNET_NORDNS 4151 0.81 2.56 0.02 78 XMDiploma_00 4127 1.98 2.54 1.73 79 RELAYCOUNTRY_IN 4114 0.88 2.53 0.14 80 HTML_MIME_NO_HTML_TAG 4111 2.28 2.53 2.17 81 SUBJ_ALL_CAPS 3914 5.32 2.41 6.62 82 T_TooManySym_01 3897 3.69 2.40 4.27 83 TR_Mismatch_TLD_01 3695 1.03 2.28 0.47 84 RCVD_IN_IADB_LISTED 3629 4.22 2.24 5.11 85 MultiRelay_CC 3628 0.83 2.24 0.19 86 MultiRelay_Combo 3628 0.83 2.24 0.19 87 RCVD_IN_RP_RNBL 3372 0.67 2.08 0.03 88 RCVD_IN_IADB_SPF 3301 3.67 2.03 4.41 89 XMSubEmpty 3226 1.82 1.99 1.75 90 T_XMHurry_00 3206 1.03 1.98 0.61 91 RCVD_IN_IADB_SENDERID 3200 3.27 1.97 3.85 92 RCVD_IN_IADB_DK 3144 3.19 1.94 3.75 93 TR_XM_RelayPhish 3135 0.93 1.93 0.48 94 UNPARSEABLE_RELAY 3047 2.38 1.88 2.61 95 URIBL_BLACK 2964 0.58 1.83 0.03 96 URIBL_DBL_SPAM 2956 0.64 1.82 0.10 97 XM_URI_RBL 2922 0.63 1.80 0.11 98 TM2_M_VERY_LONG_WORD 2880 1.08 1.77 0.77 99 HTML_IMAGE_ONLY_28 2780 0.82 1.71 0.42 100 MAILING_LIST_MULTI 2665 2.14 1.64 2.37 101 XMSexyCombo_01 2659 0.74 1.64 0.33 102 XMGenDplmaNmb 2625 1.30 1.62 1.16 103 URI_TRY_3LD 2593 1.28 1.60 1.14 104 XMSubMetaI_00 2506 0.73 1.54 0.37 105 XM_UB99 2490 0.49 1.53 0.02 106 NORDNS_LOW_CONTRAST 2467 0.48 1.52 0.01 107 SHORT_URI_2 2398 0.88 1.48 0.61 108 XMStockSpam_06 2391 1.28 1.47 1.19 109 RCVD_IN_PSBL 2388 0.56 1.47 0.15 110 NO_DNS_FOR_FROM 2375 1.11 1.46 0.95 111 XM_UB60 2331 0.51 1.44 0.09 112 TVD_PH_SUBJ_META1 2326 0.53 1.43 0.13 113 XMPhish30 2273 0.69 1.40 0.37 114 T_PDS_FROM_2_EMAILS 2240 0.47 1.38 0.06 115 XM_DK_Undo_01 2120 1.72 1.31 1.91 116 RELAYCOUNTRY_NL 2098 0.53 1.29 0.18 117 XM_H_Long_From02 2097 0.94 1.29 0.78 118 FSL_THIS_IS_ADV 2092 0.42 1.29 0.02 119 XM_ProductURIs 2089 0.93 1.29 0.78 120 RELAYCOUNTRY_FR 2082 0.57 1.28 0.25 121 XMHTML_After_End 2071 0.65 1.28 0.37 122 T_Symld_Words_02 2041 0.65 1.26 0.38 123 BAYES_00 1958 5.20 1.21 6.99 124 T_XMDrugObfuBody_00 1934 0.87 1.19 0.72 125 XMBdyGiftCard01 1919 0.70 1.18 0.48 126 BAYES_40 1865 4.61 1.15 6.16 127 XM_UB999 1862 0.37 1.15 0.02 128 TM2_M_A_HREF_HREF 1846 0.75 1.14 0.57 129 DIET_1 1837 0.49 1.13 0.20 130 T_FILL_THIS_FORM_SHORT 1837 0.98 1.13 0.92 131 XM_B_REG_HTML 1821 0.62 1.12 0.40 132 XM_BadFromFormat 1818 0.51 1.12 0.24 133 XMHTMLBadTable_001 1764 0.61 1.09 0.39 134 XMLongAddy 1737 0.39 1.07 0.08 135 TR_Caps_n_Bayes_99 1731 0.36 1.07 0.05 136 XMBrknScrpt_02 1728 0.66 1.06 0.47 137 RELAYCOUNTRY_CN 1728 0.37 1.06 0.06 138 BAYES_20 1709 2.26 1.05 2.81 139 RELAYCOUNTRY_AU 1691 0.60 1.04 0.40 140 DATE_IN_PAST_03_06 1675 0.37 1.03 0.08 141 XMBody_17 1652 0.52 1.02 0.29 142 HTTPS_HTTP_MISMATCH 1646 0.60 1.01 0.41 143 TR_LOTS_OF_MONEY2 1640 0.61 1.01 0.43 144 T_MONEY_PERCENT 1640 0.61 1.01 0.43 145 TooManyTo_002 1635 2.07 1.01 2.54 146 RELAYCOUNTRY_DE 1634 0.68 1.01 0.53 147 XM_B_COPY_HTML 1631 0.73 1.00 0.61 148 XMBody_78 1618 0.73 1.00 0.60 149 TR_Symld_Words 1610 1.96 0.99 2.39 150 DATE_IN_PAST_12_24 1587 0.33 0.98 0.04 151 DKIM_ADSP_CUSTOM_MED 1587 1.08 0.98 1.13 152 TR_XM_DK_Bayes 1584 3.29 0.98 4.32 153 XM_UB80 1557 0.32 0.96 0.04 154 MPART_ALT_DIFF_COUNT 1548 0.55 0.95 0.37 155 SUBJ_DOLLARS 1536 0.37 0.95 0.11 156 BODY_URI_ONLY 1518 0.32 0.94 0.04 157 RELAYCOUNTRY_GB 1513 1.00 0.93 1.03 158 RELAYCOUNTRY_AT 1499 0.35 0.92 0.10 159 TR_XM_DK_Bayes1 1449 2.93 0.89 3.85 160 HTML_FONT_FACE_BAD 1445 2.05 0.89 2.57 161 RDNS_DYNAMIC 1436 0.53 0.88 0.37 162 HTML_IMAGE_ONLY_08 1435 0.36 0.88 0.12 163 FILL_THIS_FORM 1426 0.77 0.88 0.71 164 LongTLD 1425 0.41 0.88 0.20 165 PLING_QUERY 1393 0.51 0.86 0.36 166 TooManyTo_003 1378 1.38 0.85 1.61 167 RCVD_IN_IADB_VOUCHED 1378 2.68 0.85 3.50 168 HTML_SHORT_LINK_IMG_1 1360 0.27 0.84 0.02 169 TR_MetaPhish_Combo_01 1335 0.77 0.82 0.74 170 XM_HighProb1 1328 0.26 0.82 0.01 171 FORGED_GMAIL_RCVD 1328 0.58 0.82 0.48 172 XM_H_PHPOS 1324 1.12 0.82 1.25 173 XMSubMetaSxObfu_03 1322 0.52 0.81 0.39 174 XMEmptySub 1313 0.59 0.81 0.49 175 TR_Mismatch_TLD_02 1295 0.29 0.80 0.06 176 XMClaimOffer 1272 0.30 0.78 0.08 177 TR_LOTS_OF_MONEY3 1259 0.37 0.78 0.19 178 REMOVE_BEFORE_LINK 1246 0.37 0.77 0.19 179 NML_ADSP_CUSTOM_MED 1241 0.80 0.76 0.82 180 XM_RXBody 1217 0.29 0.75 0.08 181 TR_XM_DK_Bayes2 1216 2.18 0.75 2.82 182 FILL_THIS_FORM_LONG 1216 0.49 0.75 0.37 183 T_FILL_THIS_FORM_LOAN 1183 0.48 0.73 0.37 184 URI_NOVOWEL 1176 0.53 0.72 0.45 185 RCVD_IN_MSPIKE_H3 1144 1.38 0.70 1.68 186 RCVD_IN_MSPIKE_WL 1144 1.38 0.70 1.68 187 HTML_FONT_SIZE_LARGE 1142 0.35 0.70 0.19 188 XM_PDF 1128 3.66 0.70 4.99 189 TooManyTo_004 1118 1.04 0.69 1.19 190 XMLngstWrd_00 1078 0.59 0.66 0.55 191 XMMoneyMeta_00 1060 0.50 0.65 0.43 192 PP_MIME_FAKE_ASCII_TEXT 1056 0.49 0.65 0.42 193 XM_Body_Obfu01 1053 0.34 0.65 0.21 194 DATE_IN_PAST_06_12 1049 0.24 0.65 0.05 195 XMPhish14 1049 0.42 0.65 0.32 196 T_TooManySym_02 1047 1.40 0.65 1.73 197 ANY_BOUNCE_MESSAGE 1044 3.85 0.64 5.28 198 XM_E_Weebly 1044 0.21 0.64 0.01 199 BOUNCE_MESSAGE 1044 3.85 0.64 5.28 200 ADMITS_SPAM 1035 0.21 0.64 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 286841 84.07 95.11 79.13 2 DCC_CHECK_NEGATIVE 244516 52.20 18.12 67.46 3 DKIM_SIGNED 227634 69.26 83.70 62.80 4 XM_DK_Pass 223046 67.68 81.42 61.53 5 BAYES_50 213386 51.24 34.19 58.87 6 DKIM_VALID 209417 64.06 78.10 57.77 7 DKIM_VALID_AU 144897 46.57 61.31 39.97 8 XMListUnsubscribeExists 135547 47.79 71.01 37.39 9 T_TM2_M_HEADER_IN_MSG 126803 30.32 19.90 34.98 10 XM_H_QuotedFrom 112485 39.59 58.69 31.03 11 DCC_CHECK 110203 45.66 79.74 30.40 12 ALL_TRUSTED 92112 18.78 3.97 25.41 13 DKIM_VALID_EF 86545 24.46 25.77 23.88 14 HTML_FONT_LOW_CONTRAST 78592 26.89 38.51 21.68 15 MultiRelay 67613 17.95 16.39 18.65 16 MIME_HTML_ONLY 67114 22.22 30.49 18.51 17 XMSubLong 67007 20.76 25.84 18.49 18 LOC_TINY_FONT_1 63953 22.86 34.52 17.64 19 FVGT_m_MULTI_ODD 63703 20.26 26.27 17.57 20 T_KAM_HTML_FONT_INVALID 45162 14.76 19.90 12.46 21 XM_DK_Undo_02 43598 22.98 47.44 12.03 22 BAYES_99 41682 21.20 42.88 11.50 23 BAYES_999 36803 18.34 36.63 10.15 24 XM_Multi_Part_URI 36780 12.02 16.22 10.15 25 XM_H_Long_From01 36550 9.37 7.77 10.08 26 XM_Body_Dirty_Words 34249 12.35 18.84 9.45 27 LOTS_OF_MONEY 33470 9.86 11.25 9.23 28 XM_DKIMWhitelistDomains 31067 5.93 0.03 8.57 29 TooManyTo_001 30218 7.85 6.76 8.34 30 FSL_BULK_SIG 28065 9.95 14.88 7.74 31 IN_ZIMBRA_NJ_WHITELIST 27333 5.22 0.04 7.54 32 RCVD_IN_RP_SAFE 25536 6.40 4.95 7.04 33 BAYES_00 25329 5.20 1.21 6.99 34 XM_Evil_Numbers_Gen 25305 9.04 13.65 6.98 35 T_XMDrugObfuBody_14 24733 7.59 9.31 6.82 36 LotsOfNums_01 24547 7.39 8.78 6.77 37 SUBJ_ALL_CAPS 24007 5.32 2.41 6.62 38 RCVD_IN_RP_CERTIFIED 23305 5.63 3.85 6.43 39 BAYES_60 22451 6.44 6.99 6.19 40 BAYES_40 22342 4.61 1.15 6.16 41 HTML_IMAGE_RATIO_02 20232 9.07 16.85 5.58 42 TR_DCC_Bayes_99 19608 14.05 33.35 5.41 43 ANY_BOUNCE_MESSAGE 19141 3.85 0.64 5.28 44 BOUNCE_MESSAGE 19138 3.85 0.64 5.28 45 RCVD_IN_IADB_LISTED 18537 4.22 2.24 5.11 46 DKIM_INVALID 18217 5.20 5.60 5.03 47 XM_PDF 18083 3.66 0.70 4.99 48 RELAYCOUNTRY_META 17129 9.10 18.87 4.73 49 RCVD_IN_MSPIKE_H2 16590 4.75 5.14 4.58 50 MIME_QP_LONG_LINE 16412 4.36 3.97 4.53 51 XM_B_Phish_Phrases 16346 5.84 8.82 4.51 52 RCVD_IN_IADB_SPF 15976 3.67 2.03 4.41 53 XM_SendGrid 15884 4.51 4.78 4.38 54 TR_XM_DK_Bayes 15672 3.29 0.98 4.32 55 T_TooManySym_01 15490 3.69 2.40 4.27 56 XMNumbers 15042 4.43 5.07 4.15 57 T_REMOTE_IMAGE 14717 4.06 4.05 4.06 58 XMStrtUSub 14521 4.02 4.05 4.01 59 MPART_ALT_DIFF 14378 4.89 6.96 3.97 60 RCVD_IN_IADB_SENDERID 13953 3.27 1.97 3.85 61 TR_XM_DK_Bayes1 13940 2.93 0.89 3.85 62 RCVD_IN_IADB_DK 13610 3.19 1.94 3.75 63 XM_UncommonTLD01 13236 5.05 8.19 3.65 64 HTML_IMAGE_RATIO_04 13156 5.23 8.80 3.63 65 RCVD_IN_IADB_VOUCHED 12681 2.68 0.85 3.50 66 BOTNET_IPINHOSTNAME 12521 6.11 12.04 3.45 67 TR_XM_DocInvoice 12164 5.01 8.71 3.36 68 BAYES_80 12161 4.67 7.60 3.35 69 XMSubMetaSx_00 11755 4.33 6.74 3.24 70 XMSexyCombo_05 11592 5.11 9.39 3.20 71 HTML_IMAGE_RATIO_06 11215 3.81 5.41 3.09 72 FROM_EXCESS_BASE64 10413 4.07 6.74 2.87 73 MIME_HTML_ONLY_MULTI 10248 2.91 3.08 2.83 74 TR_XM_DK_Bayes2 10206 2.18 0.75 2.82 75 BAYES_20 10168 2.26 1.05 2.81 76 UNPARSEABLE_RELAY 9448 2.38 1.88 2.61 77 HTML_FONT_FACE_BAD 9317 2.05 0.89 2.57 78 TooManyTo_002 9218 2.07 1.01 2.54 79 XMSubNoVowel 9114 2.59 2.75 2.51 80 TR_Symld_Words 8660 1.96 0.99 2.39 81 TVD_RCVD_IP 8612 1.73 0.28 2.38 82 MAILING_LIST_MULTI 8575 2.14 1.64 2.37 83 BAYES_95 8451 2.94 4.30 2.33 84 IN_HORDE_ADDRESS_BOOK 7969 1.54 0.08 2.20 85 HELO_NODOT 7922 1.61 0.33 2.19 86 HTML_MIME_NO_HTML_TAG 7874 2.28 2.53 2.17 87 RCVD_IN_IADB_OPTIN 7866 1.68 0.59 2.17 88 XM_SPF_SoftFail 7357 2.43 3.33 2.03 89 INVALID_MSGID 7089 1.45 0.31 1.96 90 XM_DIRTYINTL 7070 2.71 4.41 1.95 91 HTML_IMAGE_RATIO_08 7034 2.35 3.26 1.94 92 MIME_HTML_MOSTLY 6946 2.78 4.70 1.92 93 XM_DK_Undo_01 6930 1.72 1.31 1.91 94 TO_MALFORMED 6631 1.28 0.04 1.83 95 TM2_M_URI_OPT_OUT 6485 2.63 4.52 1.79 96 MSGID_NOFQDN1 6431 1.23 0.01 1.77 97 XMSubEmpty 6333 1.82 1.99 1.75 98 T_TooManySym_02 6283 1.40 0.65 1.73 99 XMDiploma_00 6265 1.98 2.54 1.73 100 RCVD_IN_MSPIKE_WL 6105 1.38 0.70 1.68 101 RCVD_IN_MSPIKE_H3 6105 1.38 0.70 1.68 102 BAYES_05 6105 1.34 0.58 1.68 103 TooManyTo_003 5845 1.38 0.85 1.61 104 XMCapTrack 5737 1.29 0.62 1.58 105 XM_CamelCaseFrm001 5427 2.15 3.60 1.50 106 XM_OfRef6 5157 1.87 2.88 1.42 107 XM_GoogleGroups 4800 1.09 0.56 1.32 108 USER_IN_DEF_DKIM_WL 4799 0.97 0.17 1.32 109 T_XMDrugObfuBody_08 4645 1.88 3.22 1.28 110 UNTRUSTED_Relay 4634 4.06 10.26 1.28 111 XM_H_PHPOS 4532 1.12 0.82 1.25 112 XMPhish11 4431 1.80 3.08 1.22 113 TooManyTo_004 4321 1.04 0.69 1.19 114 XMStockSpam_06 4318 1.28 1.47 1.19 115 RELAYCOUNTRY_CA 4210 2.31 4.87 1.16 116 XMGenDplmaNmb 4189 1.30 1.62 1.16 117 URI_TRY_3LD 4116 1.28 1.60 1.14 118 DKIM_ADSP_CUSTOM_MED 4099 1.08 0.98 1.13 119 XMNoVowels 3995 0.95 0.61 1.10 120 URI_HEX 3942 1.80 3.39 1.09 121 BOTNET 3892 4.78 13.07 1.07 122 RELAYCOUNTRY_GB 3737 1.00 0.93 1.03 123 TooManyTo_005 3552 0.86 0.60 0.98 124 NO_DNS_FOR_FROM 3433 1.11 1.46 0.95 125 T_FILL_THIS_FORM_SHORT 3331 0.98 1.13 0.92 126 SpammyFromTLD_01 3098 1.64 3.40 0.85 127 XM_UB50 3093 2.20 5.22 0.85 128 NML_ADSP_CUSTOM_MED 2971 0.80 0.76 0.82 129 USER_IN_WHITELIST 2877 0.55 0.00 0.79 130 XM_H_Long_From02 2812 0.94 1.29 0.78 131 XM_ProductURIs 2810 0.93 1.29 0.78 132 TM2_M_VERY_LONG_WORD 2780 1.08 1.77 0.77 133 XMGappySubj_01 2751 0.69 0.54 0.76 134 XM_H_PHPMailer 2710 0.71 0.63 0.75 135 TR_MetaPhish_Combo_01 2696 0.77 0.82 0.74 136 T_XMDrugObfuBody_00 2612 0.87 1.19 0.72 137 T_OBFU_PDF_ATTACH 2591 0.55 0.19 0.71 138 FILL_THIS_FORM 2590 0.77 0.88 0.71 139 T_TooManySym_03 2389 0.50 0.15 0.66 140 XMSubMetaSxObfu_02 2230 0.55 0.42 0.62 141 T_XMHurry_00 2222 1.03 1.98 0.61 142 SHORT_URI_2 2207 0.88 1.48 0.61 143 XM_B_COPY_HTML 2203 0.73 1.00 0.61 144 XMBody_78 2188 0.73 1.00 0.60 145 TM2_M_A_HREF_HREF 2065 0.75 1.14 0.57 146 SHORT_HELO_AND_INLINE_IMAGE 2005 0.40 0.07 0.55 147 XMLngstWrd_00 2001 0.59 0.66 0.55 148 MISSING_HEADERS 1966 0.48 0.33 0.54 149 RCVD_IN_SORBS_DUL 1925 0.45 0.26 0.53 150 TVD_SPACE_RATIO 1915 0.54 0.57 0.53 151 RELAYCOUNTRY_DE 1912 0.68 1.01 0.53 152 XM_ShortIntro_01 1911 0.45 0.27 0.53 153 AC_DIV_BONANZA 1876 0.43 0.22 0.52 154 XMLngstWrd_01 1802 0.53 0.61 0.50 155 XMEmptySub 1765 0.59 0.81 0.49 156 XMBdyGiftCard01 1750 0.70 1.18 0.48 157 TR_XM_RelayPhish 1732 0.93 1.93 0.48 158 FORGED_GMAIL_RCVD 1726 0.58 0.82 0.48 159 RCVD_IN_BL_SPAMCOP_NET 1725 1.31 3.17 0.48 160 XMBrknScrpt_02 1713 0.66 1.06 0.47 161 TR_Mismatch_TLD_01 1707 1.03 2.28 0.47 162 UPPERCASE_50_75 1697 0.46 0.43 0.47 163 URI_NOVOWEL 1621 0.53 0.72 0.45 164 HTML_IMAGE_ONLY_32 1617 0.42 0.37 0.45 165 HTML_TAG_BALANCE_BODY 1584 0.47 0.55 0.44 166 XMMoneyMeta_00 1555 0.50 0.65 0.43 167 TR_LOTS_OF_MONEY2 1551 0.61 1.01 0.43 168 T_MONEY_PERCENT 1551 0.61 1.01 0.43 169 HTML_IMAGE_ONLY_28 1538 0.82 1.71 0.42 170 PP_MIME_FAKE_ASCII_TEXT 1512 0.49 0.65 0.42 171 HTTPS_HTTP_MISMATCH 1483 0.60 1.01 0.41 172 XMBody_95 1466 0.33 0.18 0.40 173 XM_H_Undi_Recip 1460 0.35 0.23 0.40 174 XM_B_REG_HTML 1448 0.62 1.12 0.40 175 RELAYCOUNTRY_AU 1448 0.60 1.04 0.40 176 XMDateMe_00 1447 0.37 0.31 0.40 177 TM2_M_BODY_EMPTY 1446 0.39 0.38 0.40 178 XMHTMLBadTable_001 1428 0.61 1.09 0.39 179 XMSubMetaSxObfu_03 1407 0.52 0.81 0.39 180 T_Symld_Words_02 1375 0.65 1.26 0.38 181 XMHTML_After_End 1354 0.65 1.28 0.37 182 FILL_THIS_FORM_LONG 1350 0.49 0.75 0.37 183 RDNS_DYNAMIC 1347 0.53 0.88 0.37 184 XMPhish30 1343 0.69 1.40 0.37 185 T_FILL_THIS_FORM_LOAN 1342 0.48 0.73 0.37 186 T_HTML_ATTACH 1332 0.28 0.08 0.37 187 MPART_ALT_DIFF_COUNT 1331 0.55 0.95 0.37 188 XMSubMetaI_00 1331 0.73 1.54 0.37 189 URIBL_SBL_A 1303 0.33 0.26 0.36 190 XMRcvdHeader_15 1303 0.25 0.00 0.36 191 PLING_QUERY 1294 0.51 0.86 0.36 192 HTML_IMAGE_ONLY_24 1219 0.38 0.49 0.34 193 XMSexyCombo_01 1200 0.74 1.64 0.33 194 XM_B_TRADE_HTML 1198 0.32 0.31 0.33 195 SpammyFromTLD_02 1182 1.02 2.58 0.33 196 XM_D_tchamptons_WL 1180 0.23 0.00 0.33 197 T_TooManySym_04 1169 0.23 0.01 0.32 198 XMPhish14 1160 0.42 0.65 0.32 199 XM_H_PHPOS_M 1099 0.30 0.31 0.30 200 DKIM_ADSP_NXDOMAIN 1092 0.38 0.57 0.30 ----------------------------------------------------------------------