Email: 291270 Autolearn: 0 AvgScore: 3.32 AvgScanTime: 3.16 sec Spam: 94842 Autolearn: 0 AvgScore: 12.76 AvgScanTime: 3.97 sec Ham: 196428 Autolearn: 0 AvgScore: -1.23 AvgScanTime: 2.77 sec Time Spent Running SA: 255.75 hours Time Spent Processing Spam: 104.70 hours Time Spent Processing Ham: 151.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 90580 80.58 95.51 73.37 2 DKIM_SIGNED 82109 74.37 86.57 68.48 3 XM_DK_Pass 79859 73.02 84.20 67.61 4 DKIM_VALID 77133 70.22 81.33 64.86 5 DCC_CHECK 76001 50.50 80.13 36.20 6 XMListUnsubscribeExists 70756 53.95 74.60 43.98 7 DKIM_VALID_AU 63544 55.42 67.00 49.83 8 XM_H_QuotedFrom 52443 37.99 55.30 29.63 9 XM_DK_Undo_02 48940 28.07 51.60 16.71 10 BAYES_99 44119 26.14 46.52 16.30 11 BAYES_999 37515 22.66 39.56 14.51 12 LOC_TINY_FONT_1 35912 26.10 37.87 20.41 13 TR_DCC_Bayes_99 34803 17.46 36.70 8.17 14 HTML_FONT_LOW_CONTRAST 33726 29.79 35.56 27.01 15 MIME_HTML_ONLY 31764 23.74 33.49 19.03 16 BAYES_50 28962 46.37 30.54 54.01 17 FVGT_m_MULTI_ODD 25244 20.63 26.62 17.74 18 XMSubLong 25111 21.27 26.48 18.76 19 T_KAM_HTML_FONT_INVALID 20550 15.23 21.67 12.12 20 DKIM_VALID_EF 20480 26.04 21.59 28.18 21 XM_Body_Dirty_Words 18791 12.92 19.81 9.59 22 HTML_IMAGE_RATIO_02 17911 11.00 18.89 7.20 23 T_TM2_M_HEADER_IN_MSG 17683 27.67 18.64 32.02 24 DCC_CHECK_NEGATIVE 17236 48.11 18.17 62.57 25 RELAYCOUNTRY_META 16728 8.80 17.64 4.53 26 XM_Multi_Part_URI 16414 13.29 17.31 11.36 27 MultiRelay 15667 16.61 16.52 16.66 28 BOTNET 13504 5.41 14.24 1.15 29 XM_Evil_Numbers_Gen 13276 9.56 14.00 7.42 30 BOTNET_IPINHOSTNAME 12252 7.79 12.92 5.31 31 FSL_BULK_SIG 11595 9.56 12.23 8.28 32 XMSexyCombo_05 11133 6.20 11.74 3.53 33 LOTS_OF_MONEY 10713 10.05 11.30 9.44 34 HTML_IMAGE_RATIO_04 10534 6.76 11.11 4.66 35 UNTRUSTED_Relay 10225 4.34 10.78 1.23 36 XM_B_Phish_Phrases 8517 5.80 8.98 4.27 37 T_XMDrugObfuBody_14 8370 6.92 8.83 6.00 38 XMSubMetaSx_00 7577 5.17 7.99 3.80 39 FROM_EXCESS_BASE64 7524 5.25 7.93 3.96 40 LotsOfNums_01 7431 6.68 7.84 6.13 41 TooManyTo_001 7396 7.05 7.80 6.68 42 XM_H_Long_From01 7273 12.48 7.67 14.81 43 RCVD_IN_RP_SAFE 7143 9.62 7.53 10.63 44 XM_UncommonTLD01 7038 5.87 7.42 5.13 45 BAYES_80 7033 5.00 7.42 3.83 46 TR_XM_DocInvoice 6096 4.22 6.43 3.15 47 RCVD_IN_RP_CERTIFIED 5988 8.80 6.31 10.01 48 MPART_ALT_DIFF 5889 3.99 6.21 2.92 49 BAYES_60 5774 6.35 6.09 6.47 50 XMNumbers 5591 5.11 5.90 4.73 51 XMStrtUSub 5385 4.74 5.68 4.29 52 RCVD_IN_MSPIKE_H2 5271 4.78 5.56 4.40 53 DKIM_INVALID 4976 4.15 5.25 3.63 54 MIME_HTML_MOSTLY 4732 3.74 4.99 3.13 55 T_REMOTE_IMAGE 4652 4.03 4.90 3.61 56 BAYES_95 4572 3.42 4.82 2.75 57 XM_UB50 4409 2.03 4.65 0.76 58 XM_SendGrid 4274 5.04 4.51 5.30 59 HTML_IMAGE_RATIO_06 4217 3.49 4.45 3.04 60 T_TooManySym_01 4060 4.81 4.28 5.06 61 MIME_QP_LONG_LINE 3746 3.90 3.95 3.88 62 XM_DIRTYINTL 3495 2.71 3.69 2.23 63 RELAYCOUNTRY_CA 3367 2.04 3.55 1.31 64 TM2_M_URI_OPT_OUT 3179 2.04 3.35 1.40 65 XM_CamelCaseFrm001 3122 1.98 3.29 1.35 66 XM_SPF_SoftFail 3111 2.24 3.28 1.73 67 NO_DNS_FOR_FROM 3025 2.31 3.19 1.89 68 SpammyFromTLD_01 2886 1.55 3.04 0.84 69 HTML_IMAGE_RATIO_08 2862 1.95 3.02 1.44 70 MIME_HTML_ONLY_MULTI 2838 1.71 2.99 1.09 71 RCVD_IN_BL_SPAMCOP_NET 2758 1.22 2.91 0.41 72 MultiRelay_Combo 2649 1.02 2.79 0.16 73 MultiRelay_CC 2649 1.02 2.79 0.16 74 URI_HEX 2611 2.09 2.75 1.77 75 HTML_MIME_NO_HTML_TAG 2588 2.00 2.73 1.65 76 SUBJ_ALL_CAPS 2509 8.33 2.65 11.08 77 BOTNET_NORDNS 2417 0.84 2.55 0.02 78 RCVD_IN_RP_RNBL 2318 0.83 2.44 0.04 79 UNPARSEABLE_RELAY 2315 3.78 2.44 4.43 80 XM_B_REG_HTML 2314 1.36 2.44 0.84 81 XMBody_17 2306 1.10 2.43 0.46 82 URIBL_BLACK 2250 0.79 2.37 0.02 83 XM_RXBody 2193 0.89 2.31 0.20 84 XM_OfRef6 2049 1.54 2.16 1.24 85 XM_ProductURIs 2049 1.84 2.16 1.69 86 XM_H_Long_From02 2003 1.20 2.11 0.76 87 URIBL_DBL_SPAM 2000 0.73 2.11 0.06 88 XM_URI_RBL 1987 0.75 2.10 0.10 89 RCVD_IN_IADB_LISTED 1917 3.38 2.02 4.04 90 XM_UB99 1877 0.66 1.98 0.02 91 XMBdyGiftCard01 1831 1.24 1.93 0.91 92 DIET_1 1789 0.88 1.89 0.39 93 T_XMDrugObfuBody_08 1725 1.41 1.82 1.21 94 SpammyFromTLD_02 1722 0.70 1.82 0.16 95 RCVD_IN_IADB_SPF 1711 2.94 1.80 3.49 96 XM_BadFromFormat 1688 0.73 1.78 0.22 97 MAILING_LIST_MULTI 1639 2.21 1.73 2.44 98 RCVD_IN_IADB_SENDERID 1634 2.63 1.72 3.06 99 XMPhish30 1633 0.83 1.72 0.39 100 RCVD_IN_IADB_DK 1629 2.57 1.72 2.98 101 BODY_URI_ONLY 1615 0.58 1.70 0.03 102 XMSexyCombo_01 1570 0.86 1.66 0.47 103 RELAYCOUNTRY_CN 1568 0.57 1.65 0.05 104 HTML_IMAGE_ONLY_08 1567 0.62 1.65 0.11 105 XMClaimOffer 1562 0.62 1.65 0.13 106 XMStockSpam_06 1556 0.97 1.64 0.65 107 XMSubMetaI_00 1521 0.84 1.60 0.46 108 HTML_SHORT_LINK_IMG_1 1520 0.54 1.60 0.03 109 BAYES_00 1485 4.56 1.57 6.00 110 XM_UB60 1479 0.61 1.56 0.15 111 T_XMHurry_00 1478 0.78 1.56 0.41 112 XM_UB999 1432 0.50 1.51 0.01 113 RELAYCOUNTRY_FR 1414 0.72 1.49 0.34 114 XMHTML_After_End 1411 0.63 1.49 0.22 115 XMDiploma_00 1373 1.20 1.45 1.09 116 RELAYCOUNTRY_AT 1313 0.54 1.38 0.13 117 BAYES_40 1306 5.24 1.38 7.10 118 TM2_M_VERY_LONG_WORD 1305 1.02 1.38 0.84 119 TR_XM_DK_Bayes 1294 3.40 1.36 4.38 120 XM_DK_Undo_01 1290 1.59 1.36 1.70 121 TR_XM_DK_Bayes1 1279 3.22 1.35 4.12 122 XMLongAddy 1261 0.47 1.33 0.06 123 ALL_TRUSTED 1218 18.18 1.28 26.34 124 XM_H_PHPOS 1211 1.76 1.28 2.00 125 MPART_ALT_DIFF_COUNT 1187 0.55 1.25 0.21 126 URI_TRY_3LD 1182 1.07 1.25 0.99 127 XMHTMLBadTable_001 1174 0.71 1.24 0.45 128 XM_B_COPY_HTML 1158 1.01 1.22 0.91 129 REMOVE_BEFORE_LINK 1156 0.59 1.22 0.28 130 TooManyTo_002 1132 1.54 1.19 1.71 131 RCVD_IN_PSBL 1118 0.52 1.18 0.20 132 HDRS_LCASE_IMGONLY 1114 0.40 1.17 0.03 133 XMBody_78 1101 0.73 1.16 0.52 134 TR_Mismatch_TLD_02 1064 0.40 1.12 0.05 135 XM_HighProb1 1060 0.38 1.12 0.02 136 DKIM_ADSP_CUSTOM_MED 1031 0.91 1.09 0.83 137 TR_XM_DK_Bayes2 1029 2.51 1.08 3.20 138 HTML_FONT_FACE_BAD 1021 0.57 1.08 0.32 139 BAYES_20 1013 1.66 1.07 1.95 140 TooManyTo_003 1006 1.08 1.06 1.10 141 TR_XM_RelayPhish 1005 0.56 1.06 0.32 142 XM_UB80 975 0.36 1.03 0.03 143 T_XMDrugObfuBody_00 975 0.66 1.03 0.48 144 TR_Symld_Words 967 2.05 1.02 2.54 145 TR_LOTS_OF_MONEY2 943 0.51 0.99 0.28 146 T_MONEY_PERCENT 943 0.51 0.99 0.28 147 XMBrknScrpt_02 933 0.63 0.98 0.46 148 NML_ADSP_CUSTOM_MED 923 0.71 0.97 0.58 149 RDNS_DYNAMIC 920 0.68 0.97 0.54 150 SUBJ_DOLLARS 916 0.41 0.97 0.14 151 TR_MetaPhish_Combo_01 916 0.90 0.97 0.87 152 RELAYCOUNTRY_SE 898 0.32 0.95 0.02 153 XMPhish11 878 1.06 0.93 1.13 154 TR_LOTS_OF_MONEY3 854 0.42 0.90 0.19 155 HTML_FONT_SIZE_HUGE 854 0.34 0.90 0.07 156 PLING_QUERY 850 0.46 0.90 0.24 157 CK_HELO_DYNAMIC_SPLIT_IP 835 0.29 0.88 0.00 158 LONG_JUNK_URI3 826 0.32 0.87 0.05 159 FROM_LOCAL_HEX 805 0.32 0.85 0.07 160 XM_H_Long_From03 803 0.33 0.85 0.07 161 BODY_ENHANCEMENT 789 0.29 0.83 0.03 162 LongTLD 788 0.42 0.83 0.22 163 XMGenDplmaNmb 787 0.67 0.83 0.60 164 RCVD_IN_MSPIKE_H3 784 1.65 0.83 2.05 165 TooManyTo_004 784 0.84 0.83 0.84 166 RCVD_IN_MSPIKE_WL 784 1.65 0.83 2.05 167 BASE64_LENGTH_79_INF 775 0.35 0.82 0.13 168 XMSlimDrugH 773 0.43 0.82 0.25 169 T_HTML_TAG_BALANCE_CENTER 761 0.31 0.80 0.07 170 FORGED_GMAIL_RCVD 760 0.54 0.80 0.41 171 XM_Body_Obfu01 758 0.37 0.80 0.16 172 XM_H_PHPMailer 749 0.93 0.79 0.99 173 FROM_LOCAL_DIGITS 746 0.27 0.79 0.03 174 URIBL_CSS 743 0.26 0.78 0.01 175 URIBL_CSS_A 743 0.26 0.78 0.01 176 FILL_THIS_FORM 721 0.58 0.76 0.49 177 T_Symld_Words_02 710 0.42 0.75 0.27 178 HELO_MISC_IP 707 0.25 0.75 0.00 179 TM2_M_A_HREF_HREF 695 1.03 0.73 1.17 180 FSL_THIS_IS_ADV 692 0.28 0.73 0.06 181 TooManyTo_005 688 0.73 0.73 0.73 182 DKIM_ADSP_NXDOMAIN 687 0.62 0.72 0.57 183 XMSubMetaSxObfu_03 682 0.41 0.72 0.26 184 RELAYCOUNTRY_JP 681 0.25 0.72 0.03 185 XMSexyCombo_04 678 0.31 0.71 0.12 186 RCVD_IN_IADB_VOUCHED 670 2.06 0.71 2.71 187 RELAYCOUNTRY_NL 659 0.41 0.69 0.28 188 URI_NOVOWEL 657 0.53 0.69 0.45 189 XMNoVowels 652 0.79 0.69 0.83 190 FILL_THIS_FORM_LONG 650 0.47 0.69 0.37 191 RELAYCOUNTRY_DE 649 0.58 0.68 0.53 192 RELAYCOUNTRY_AL 645 0.22 0.68 0.00 193 XMPhish14 644 0.42 0.68 0.29 194 SUBJECT_NEEDS_ENCODING 639 0.23 0.67 0.01 195 SUBJ_ILLEGAL_CHARS 636 0.23 0.67 0.01 196 XMMoneyMeta_00 633 0.64 0.67 0.63 197 RELAYCOUNTRY_IN 619 0.26 0.65 0.08 198 RELAYCOUNTRY_GB 618 0.66 0.65 0.66 199 NUMERIC_HTTP_ADDR 610 0.26 0.64 0.08 200 HTML_FONT_SIZE_LARGE 605 0.35 0.64 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144119 80.58 95.51 73.37 2 DKIM_SIGNED 134522 74.37 86.57 68.48 3 XM_DK_Pass 132812 73.02 84.20 67.61 4 DKIM_VALID 127399 70.22 81.33 64.86 5 DCC_CHECK_NEGATIVE 122902 48.11 18.17 62.57 6 BAYES_50 106096 46.37 30.54 54.01 7 DKIM_VALID_AU 97880 55.42 67.00 49.83 8 XMListUnsubscribeExists 86381 53.95 74.60 43.98 9 DCC_CHECK 71100 50.50 80.13 36.20 10 T_TM2_M_HEADER_IN_MSG 62906 27.67 18.64 32.02 11 XM_H_QuotedFrom 58198 37.99 55.30 29.63 12 DKIM_VALID_EF 55362 26.04 21.59 28.18 13 HTML_FONT_LOW_CONTRAST 53050 29.79 35.56 27.01 14 ALL_TRUSTED 51730 18.18 1.28 26.34 15 LOC_TINY_FONT_1 40100 26.10 37.87 20.41 16 MIME_HTML_ONLY 37380 23.74 33.49 19.03 17 XMSubLong 36851 21.27 26.48 18.76 18 FVGT_m_MULTI_ODD 34838 20.63 26.62 17.74 19 XM_DK_Undo_02 32826 28.07 51.60 16.71 20 MultiRelay 32722 16.61 16.52 16.66 21 BAYES_99 32018 26.14 46.52 16.30 22 XM_H_Long_From01 29082 12.48 7.67 14.81 23 BAYES_999 28498 22.66 39.56 14.51 24 T_KAM_HTML_FONT_INVALID 23813 15.23 21.67 12.12 25 XM_DKIMWhitelistDomains 22587 7.76 0.03 11.50 26 XM_Multi_Part_URI 22306 13.29 17.31 11.36 27 SUBJ_ALL_CAPS 21756 8.33 2.65 11.08 28 RCVD_IN_RP_SAFE 20886 9.62 7.53 10.63 29 RCVD_IN_RP_CERTIFIED 19654 8.80 6.31 10.01 30 XM_Body_Dirty_Words 18839 12.92 19.81 9.59 31 LOTS_OF_MONEY 18550 10.05 11.30 9.44 32 FSL_BULK_SIG 16258 9.56 12.23 8.28 33 TR_DCC_Bayes_99 16052 17.46 36.70 8.17 34 XM_Evil_Numbers_Gen 14572 9.56 14.00 7.42 35 HTML_IMAGE_RATIO_02 14133 11.00 18.89 7.20 36 BAYES_40 13945 5.24 1.38 7.10 37 TooManyTo_001 13128 7.05 7.80 6.68 38 BAYES_60 12712 6.35 6.09 6.47 39 LotsOfNums_01 12033 6.68 7.84 6.13 40 BAYES_00 11792 4.56 1.57 6.00 41 T_XMDrugObfuBody_14 11782 6.92 8.83 6.00 42 BOTNET_IPINHOSTNAME 10424 7.79 12.92 5.31 43 XM_SendGrid 10406 5.04 4.51 5.30 44 XM_UncommonTLD01 10073 5.87 7.42 5.13 45 T_TooManySym_01 9941 4.81 4.28 5.06 46 IN_ZIMBRA_NJ_WHITELIST 9740 3.35 0.03 4.96 47 XMNumbers 9298 5.11 5.90 4.73 48 HTML_IMAGE_RATIO_04 9154 6.76 11.11 4.66 49 RELAYCOUNTRY_META 8891 8.80 17.64 4.53 50 UNPARSEABLE_RELAY 8696 3.78 2.44 4.43 51 RCVD_IN_MSPIKE_H2 8640 4.78 5.56 4.40 52 TR_XM_DK_Bayes 8599 3.40 1.36 4.38 53 XMStrtUSub 8418 4.74 5.68 4.29 54 XM_B_Phish_Phrases 8391 5.80 8.98 4.27 55 ANY_BOUNCE_MESSAGE 8208 2.96 0.44 4.18 56 BOUNCE_MESSAGE 8208 2.96 0.44 4.18 57 TR_XM_DK_Bayes1 8097 3.22 1.35 4.12 58 RCVD_IN_IADB_LISTED 7935 3.38 2.02 4.04 59 TVD_RCVD_IP 7842 2.81 0.36 3.99 60 FROM_EXCESS_BASE64 7774 5.25 7.93 3.96 61 MIME_QP_LONG_LINE 7614 3.90 3.95 3.88 62 BAYES_80 7516 5.00 7.42 3.83 63 XMSubMetaSx_00 7473 5.17 7.99 3.80 64 DKIM_INVALID 7123 4.15 5.25 3.63 65 T_REMOTE_IMAGE 7087 4.03 4.90 3.61 66 TO_MALFORMED 6927 2.38 0.01 3.53 67 XMSexyCombo_05 6925 6.20 11.74 3.53 68 RCVD_IN_IADB_SPF 6855 2.94 1.80 3.49 69 INVALID_MSGID 6852 2.46 0.32 3.49 70 MSGID_NOFQDN1 6641 2.29 0.04 3.38 71 TR_XM_DK_Bayes2 6279 2.51 1.08 3.20 72 TR_XM_DocInvoice 6187 4.22 6.43 3.15 73 MIME_HTML_MOSTLY 6149 3.74 4.99 3.13 74 RCVD_IN_IADB_SENDERID 6012 2.63 1.72 3.06 75 HTML_IMAGE_RATIO_06 5962 3.49 4.45 3.04 76 RCVD_IN_IADB_DK 5855 2.57 1.72 2.98 77 MPART_ALT_DIFF 5742 3.99 6.21 2.92 78 BAYES_95 5394 3.42 4.82 2.75 79 RCVD_IN_IADB_VOUCHED 5324 2.06 0.71 2.71 80 IN_HORDE_ADDRESS_BOOK 5114 1.78 0.08 2.60 81 TR_Symld_Words 4993 2.05 1.02 2.54 82 MAILING_LIST_MULTI 4791 2.21 1.73 2.44 83 XM_DIRTYINTL 4385 2.71 3.69 2.23 84 XM_PDF 4245 1.58 0.38 2.16 85 USER_IN_DEF_DKIM_WL 4219 1.54 0.27 2.15 86 RCVD_IN_MSPIKE_H3 4021 1.65 0.83 2.05 87 RCVD_IN_MSPIKE_WL 4021 1.65 0.83 2.05 88 XM_H_PHPOS 3919 1.76 1.28 2.00 89 T_TooManySym_02 3878 1.54 0.63 1.97 90 BAYES_20 3822 1.66 1.07 1.95 91 NO_DNS_FOR_FROM 3710 2.31 3.19 1.89 92 URI_HEX 3467 2.09 2.75 1.77 93 XM_SPF_SoftFail 3401 2.24 3.28 1.73 94 RCVD_IN_IADB_OPTIN 3387 1.35 0.58 1.72 95 TooManyTo_002 3352 1.54 1.19 1.71 96 XM_DK_Undo_01 3345 1.59 1.36 1.70 97 XM_ProductURIs 3313 1.84 2.16 1.69 98 HTML_MIME_NO_HTML_TAG 3236 2.00 2.73 1.65 99 BAYES_05 2977 1.20 0.54 1.52 100 HTML_IMAGE_RATIO_08 2830 1.95 3.02 1.44 101 TM2_M_URI_OPT_OUT 2751 2.04 3.35 1.40 102 XM_CamelCaseFrm001 2647 1.98 3.29 1.35 103 XM_GoogleGroups 2576 1.08 0.59 1.31 104 RELAYCOUNTRY_CA 2566 2.04 3.55 1.31 105 USER_IN_WHITELIST 2462 0.85 0.00 1.25 106 XM_OfRef6 2429 1.54 2.16 1.24 107 UNTRUSTED_Relay 2418 4.34 10.78 1.23 108 T_XMDrugObfuBody_08 2379 1.41 1.82 1.21 109 TM2_M_A_HREF_HREF 2296 1.03 0.73 1.17 110 BOTNET 2260 5.41 14.24 1.15 111 XMPhish11 2223 1.06 0.93 1.13 112 TooManyTo_003 2152 1.08 1.06 1.10 113 MIME_HTML_ONLY_MULTI 2142 1.71 2.99 1.09 114 XMDiploma_00 2135 1.20 1.45 1.09 115 T_TooManySym_03 2082 0.76 0.15 1.06 116 XM_H_PHPMailer 1947 0.93 0.79 0.99 117 URI_TRY_3LD 1936 1.07 1.25 0.99 118 XM_B_COPY_HTML 1792 1.01 1.22 0.91 119 XMBdyGiftCard01 1790 1.24 1.93 0.91 120 TR_MetaPhish_Combo_01 1707 0.90 0.97 0.87 121 XMBody_95 1660 0.60 0.10 0.85 122 TooManyTo_004 1658 0.84 0.83 0.84 123 TM2_M_VERY_LONG_WORD 1658 1.02 1.38 0.84 124 XM_B_REG_HTML 1654 1.36 2.44 0.84 125 SpammyFromTLD_01 1641 1.55 3.04 0.84 126 XMNoVowels 1639 0.79 0.69 0.83 127 DKIM_ADSP_CUSTOM_MED 1624 0.91 1.09 0.83 128 HELO_NODOT 1539 0.60 0.21 0.78 129 XM_UB50 1502 2.03 4.65 0.76 130 XM_H_Long_From02 1487 1.20 2.11 0.76 131 TooManyTo_005 1435 0.73 0.73 0.73 132 T_FILL_THIS_FORM_SHORT 1368 0.65 0.56 0.70 133 RELAYCOUNTRY_GB 1297 0.66 0.65 0.66 134 XMStockSpam_06 1279 0.97 1.64 0.65 135 XMMoneyMeta_00 1241 0.64 0.67 0.63 136 XMSubMetaSxObfu_02 1240 0.52 0.30 0.63 137 XM_D_tchamptons_WL 1187 0.41 0.00 0.60 138 XMGenDplmaNmb 1171 0.67 0.83 0.60 139 NML_ADSP_CUSTOM_MED 1131 0.71 0.97 0.58 140 T_TooManySym_04 1129 0.39 0.01 0.57 141 DKIM_ADSP_NXDOMAIN 1117 0.62 0.72 0.57 142 RDNS_DYNAMIC 1062 0.68 0.97 0.54 143 RELAYCOUNTRY_DE 1045 0.58 0.68 0.53 144 XM_H_PHPOS_M 1039 0.52 0.51 0.53 145 XMBody_78 1028 0.73 1.16 0.52 146 XMSubNoVowel 1024 0.56 0.64 0.52 147 XMSubEmpty 1014 0.43 0.27 0.52 148 XM_ShortIntro_01 1011 0.47 0.37 0.51 149 XMCapTrack 970 0.49 0.48 0.49 150 FILL_THIS_FORM 957 0.58 0.76 0.49 151 T_XMDrugObfuBody_00 951 0.66 1.03 0.48 152 XMSexyCombo_01 925 0.86 1.66 0.47 153 XMSubMetaI_00 913 0.84 1.60 0.46 154 XMBody_17 912 1.10 2.43 0.46 155 XMBrknScrpt_02 911 0.63 0.98 0.46 156 XMHTMLBadTable_001 887 0.71 1.24 0.45 157 URI_NOVOWEL 876 0.53 0.69 0.45 158 HTML_TAG_BALANCE_BODY 857 0.47 0.55 0.44 159 TR_Sbj_FN_Bdy 827 0.36 0.23 0.42 160 XMLngstWrd_00 817 0.38 0.32 0.42 161 FORGED_GMAIL_RCVD 809 0.54 0.80 0.41 162 T_XMHurry_00 804 0.78 1.56 0.41 163 RCVD_IN_BL_SPAMCOP_NET 801 1.22 2.91 0.41 164 T_FILL_THIS_FORM_LOAN 786 0.46 0.58 0.40 165 XMPhish30 775 0.83 1.72 0.39 166 DIET_1 770 0.88 1.89 0.39 167 XM_B_TRADE_HTML 764 0.41 0.44 0.39 168 TR_MetaPhish_Combo_01b 752 0.35 0.27 0.38 169 T_OBFU_PDF_ATTACH 740 0.28 0.08 0.38 170 XMLngstWrd_01 729 0.34 0.29 0.37 171 FILL_THIS_FORM_LONG 717 0.47 0.69 0.37 172 HTML_IMAGE_ONLY_28 696 0.35 0.35 0.35 173 XMRcvdHeader_15 682 0.23 0.00 0.35 174 RELAYCOUNTRY_FR 672 0.72 1.49 0.34 175 XM_H_SpoofStaff4 672 0.23 0.01 0.34 176 MISSING_HEADERS 647 0.40 0.55 0.33 177 UPPERCASE_50_75 645 0.38 0.49 0.33 178 XMABCOffice1 639 0.22 0.00 0.33 179 HTML_FONT_FACE_BAD 632 0.57 1.08 0.32 180 TR_XM_RelayPhish 626 0.56 1.06 0.32 181 HTTPS_HTTP_MISMATCH 623 0.39 0.56 0.32 182 TVD_SPACE_RATIO 616 0.26 0.15 0.31 183 XMGappySubj_01 605 0.35 0.45 0.31 184 XMSUPPORT 584 0.20 0.00 0.30 185 RCVD_IN_SORBS_DUL 584 0.35 0.45 0.30 186 TM2_M_BODY_EMPTY 580 0.40 0.62 0.30 187 XMDateMe_00 575 0.32 0.38 0.29 188 XMPhish14 569 0.42 0.68 0.29 189 FROM_EGROUPS 562 0.19 0.00 0.29 190 REMOVE_BEFORE_LINK 555 0.59 1.22 0.28 191 XMRcvdHeader_S01 555 0.20 0.02 0.28 192 TR_LOTS_OF_MONEY2 549 0.51 0.99 0.28 193 T_MONEY_PERCENT 549 0.51 0.99 0.28 194 RELAYCOUNTRY_NL 545 0.41 0.69 0.28 195 RELAYCOUNTRY_AU 542 0.33 0.44 0.28 196 XMBody_29 541 0.23 0.13 0.28 197 HTML_IMAGE_ONLY_32 539 0.26 0.22 0.27 198 HTML_IMAGE_ONLY_24 538 0.30 0.35 0.27 199 XM_H_Trusted_IP 532 0.18 0.00 0.27 200 T_Symld_Words_02 527 0.42 0.75 0.27 ----------------------------------------------------------------------