Email: 311230 Autolearn: 0 AvgScore: 3.75 AvgScanTime: 2.87 sec Spam: 105557 Autolearn: 0 AvgScore: 13.13 AvgScanTime: 3.57 sec Ham: 205673 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 2.51 sec Time Spent Running SA: 248.03 hours Time Spent Processing Spam: 104.67 hours Time Spent Processing Ham: 143.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 100010 81.61 94.75 74.87 2 DKIM_SIGNED 88096 72.54 83.46 66.93 3 XM_DK_Pass 86057 71.25 81.53 65.98 4 DCC_CHECK 84314 51.76 79.88 37.33 5 DKIM_VALID 82021 67.77 77.70 62.67 6 XMListUnsubscribeExists 75666 51.91 71.68 41.77 7 DKIM_VALID_AU 66839 53.05 63.32 47.79 8 XM_H_QuotedFrom 60646 40.66 57.45 32.04 9 XM_DK_Undo_02 50633 26.80 47.97 15.94 10 BAYES_99 45301 24.95 42.92 15.73 11 BAYES_999 38823 21.81 36.78 14.12 12 LOC_TINY_FONT_1 38253 26.55 36.24 21.58 13 HTML_FONT_LOW_CONTRAST 36694 29.57 34.76 26.90 14 TR_DCC_Bayes_99 36096 16.53 34.20 7.47 15 BAYES_50 32922 45.72 31.19 53.18 16 MIME_HTML_ONLY 32818 23.44 31.09 19.51 17 XMSubLong 28633 20.93 27.13 17.76 18 FVGT_m_MULTI_ODD 26341 20.20 24.95 17.76 19 DKIM_VALID_EF 22582 24.69 21.39 26.39 20 T_KAM_HTML_FONT_INVALID 21439 14.94 20.31 12.18 21 T_TM2_M_HEADER_IN_MSG 21021 27.73 19.91 31.75 22 RELAYCOUNTRY_META 20328 9.17 19.26 3.99 23 HTML_IMAGE_RATIO_02 20206 11.21 19.14 7.14 24 XM_Body_Dirty_Words 19684 13.10 18.65 10.25 25 DCC_CHECK_NEGATIVE 19616 46.85 18.58 61.36 26 XM_Multi_Part_URI 18603 12.66 17.62 10.11 27 MultiRelay 17604 15.93 16.68 15.55 28 BOTNET 15967 5.82 15.13 1.05 29 XM_Evil_Numbers_Gen 15324 10.80 14.52 8.89 30 FSL_BULK_SIG 14794 11.95 14.02 10.89 31 LOTS_OF_MONEY 14291 10.93 13.54 9.58 32 UNTRUSTED_Relay 13266 5.08 12.57 1.24 33 BOTNET_IPINHOSTNAME 12715 7.66 12.05 5.40 34 XMSexyCombo_05 11397 6.11 10.80 3.70 35 HTML_IMAGE_RATIO_04 11163 6.22 10.58 3.98 36 XM_UncommonTLD01 9430 6.11 8.93 4.65 37 T_XMDrugObfuBody_14 9021 6.75 8.55 5.83 38 BAYES_80 9013 5.40 8.54 3.80 39 XM_B_Phish_Phrases 9010 5.43 8.54 3.83 40 MPART_ALT_DIFF 8637 4.69 8.18 2.90 41 TR_XM_DocInvoice 8256 4.88 7.82 3.37 42 FROM_EXCESS_BASE64 8133 4.83 7.70 3.36 43 BAYES_60 8107 6.62 7.68 6.08 44 RCVD_IN_RP_SAFE 7882 9.24 7.47 10.16 45 TooManyTo_001 7632 6.68 7.23 6.40 46 XM_H_Long_From01 7612 12.62 7.21 15.40 47 XMNumbers 7424 5.32 7.03 4.44 48 LotsOfNums_01 7403 6.54 7.01 6.29 49 XMSubMetaSx_00 7211 4.65 6.83 3.54 50 RCVD_IN_RP_CERTIFIED 6508 8.42 6.17 9.58 51 DKIM_INVALID 6075 4.77 5.76 4.26 52 XMStrtUSub 5711 5.27 5.41 5.20 53 RCVD_IN_RP_RNBL 5622 1.82 5.33 0.03 54 HTML_IMAGE_RATIO_06 5513 3.73 5.22 2.96 55 XM_SPF_SoftFail 5407 2.56 5.12 1.25 56 T_REMOTE_IMAGE 5142 4.62 4.87 4.50 57 MultiRelay_Combo 5022 1.71 4.76 0.14 58 MultiRelay_CC 5022 1.71 4.76 0.14 59 BAYES_95 4989 3.43 4.73 2.77 60 XM_OfRef6 4799 2.53 4.55 1.49 61 XM_UB50 4764 2.08 4.51 0.84 62 SpammyFromTLD_01 4696 1.91 4.45 0.60 63 MIME_HTML_MOSTLY 4317 3.42 4.09 3.08 64 XM_DIRTYINTL 4282 2.53 4.06 1.75 65 XM_SendGrid 4090 4.54 3.87 4.88 66 RCVD_IN_MSPIKE_H2 4039 4.07 3.83 4.20 67 RELAYCOUNTRY_CN 3994 1.31 3.78 0.04 68 BOTNET_NORDNS 3861 1.25 3.66 0.01 69 SpammyFromTLD_02 3678 1.28 3.48 0.15 70 T_TooManySym_01 3673 4.07 3.48 4.37 71 RCVD_IN_BL_SPAMCOP_NET 3585 1.34 3.40 0.29 72 RELAYCOUNTRY_CA 3512 1.91 3.33 1.18 73 NO_DNS_FOR_FROM 3412 2.37 3.23 1.93 74 HTML_MIME_NO_HTML_TAG 3291 2.78 3.12 2.60 75 URI_HEX 3237 1.78 3.07 1.12 76 TM2_M_URI_OPT_OUT 3152 1.96 2.99 1.43 77 MIME_QP_LONG_LINE 3122 3.57 2.96 3.88 78 XM_CamelCaseFrm001 3114 2.00 2.95 1.51 79 TR_Mismatch_TLD_02 2972 0.99 2.82 0.05 80 XM_OfRef7 2898 1.05 2.75 0.19 81 XMLongAddy 2829 0.97 2.68 0.10 82 XMBody_17 2818 1.27 2.67 0.55 83 MIME_HTML_ONLY_MULTI 2818 1.55 2.67 0.98 84 T_FILL_THIS_FORM_SHORT 2806 1.32 2.66 0.63 85 XMBdyGiftCard01 2786 1.50 2.64 0.92 86 SUBJ_ALL_CAPS 2705 8.24 2.56 11.16 87 XM_UB60 2677 0.90 2.54 0.06 88 UNPARSEABLE_RELAY 2609 3.71 2.47 4.35 89 XMPhish11 2486 1.48 2.36 1.03 90 XMSubMetaI_00 2470 1.14 2.34 0.52 91 DIET_1 2435 1.14 2.31 0.55 92 ALL_TRUSTED 2407 18.57 2.28 26.93 93 XMHTML_After_End 2351 0.96 2.23 0.31 94 BODY_URI_ONLY 2333 0.80 2.21 0.07 95 URIBL_DBL_SPAM 2319 0.78 2.20 0.05 96 TM2_M_VERY_LONG_WORD 2313 1.27 2.19 0.79 97 HTML_IMAGE_RATIO_08 2310 1.88 2.19 1.72 98 XM_B_REG_HTML 2299 1.20 2.18 0.70 99 MONEY_FRAUD_8 2203 0.71 2.09 0.01 100 XM_ProductURIs 2193 1.66 2.08 1.45 101 RELAYCOUNTRY_ZA 2191 0.71 2.08 0.01 102 HTML_IMAGE_ONLY_08 2181 0.78 2.07 0.11 103 HTML_SHORT_LINK_IMG_1 2165 0.72 2.05 0.03 104 HELO_NODOT 2097 1.30 1.99 0.95 105 XM_Attn_01 2059 0.70 1.95 0.05 106 MONEY_FORM_SHORT 2034 0.67 1.93 0.02 107 URIBL_BLACK 2026 0.68 1.92 0.04 108 FSL_HELO_NON_FQDN_1 2016 0.75 1.91 0.16 109 FORM_FRAUD_5 2006 0.65 1.90 0.00 110 XM_RXBody 2002 0.77 1.90 0.19 111 XM_UB80 1991 0.65 1.89 0.02 112 ANY_BOUNCE_MESSAGE 1986 3.44 1.88 4.24 113 BOUNCE_MESSAGE 1986 3.44 1.88 4.24 114 T_DEAR_BENEFICIARY 1983 0.65 1.88 0.02 115 XMDiploma_00 1979 1.40 1.87 1.15 116 RCVD_IN_IADB_LISTED 1958 3.50 1.85 4.34 117 XM_UB99 1843 0.61 1.75 0.02 118 BAYES_00 1810 5.33 1.71 7.19 119 XMNoVowels 1767 1.92 1.67 2.04 120 XMSexyCombo_01 1726 0.75 1.64 0.30 121 RCVD_IN_IADB_SPF 1705 3.01 1.62 3.72 122 RELAYCOUNTRY_FR 1660 0.69 1.57 0.24 123 MAILING_LIST_MULTI 1654 1.84 1.57 1.98 124 XM_URI_RBL 1649 0.58 1.56 0.08 125 T_XMDrugObfuBody_08 1643 1.23 1.56 1.06 126 TR_LOTS_OF_MONEY3 1629 0.67 1.54 0.22 127 XMPhish30 1624 0.76 1.54 0.36 128 RCVD_IN_IADB_SENDERID 1602 2.64 1.52 3.21 129 RELAYCOUNTRY_GB 1595 0.89 1.51 0.58 130 RCVD_IN_IADB_DK 1566 2.54 1.48 3.09 131 RELAYCOUNTRY_IN 1562 0.58 1.48 0.12 132 XM_BadFromFormat 1543 0.64 1.46 0.21 133 XM_H_PHPOS 1522 1.55 1.44 1.61 134 XMSubNoVowel 1522 1.29 1.44 1.22 135 XM_H_Long_From03 1515 0.56 1.44 0.11 136 BAYES_40 1504 5.28 1.42 7.26 137 XMPhish19 1500 0.51 1.42 0.04 138 TM2_M_BODY_EMPTY 1481 0.88 1.40 0.61 139 XM_H_Long_From02 1470 1.04 1.39 0.86 140 XMEmptyBody_01 1462 0.73 1.39 0.40 141 HTML_FONT_SIZE_LARGE 1457 0.62 1.38 0.23 142 TR_XM_DK_Bayes 1443 3.50 1.37 4.60 143 XM_UB999 1421 0.47 1.35 0.02 144 RELAYCOUNTRY_AT 1395 0.52 1.32 0.11 145 TR_XM_DK_Bayes1 1389 3.26 1.32 4.26 146 T_XMDrugObfuBody_00 1380 0.81 1.31 0.55 147 XM_DK_Undo_01 1361 1.64 1.29 1.81 148 XMGenDplmaNmb 1356 0.84 1.28 0.61 149 DKIM_ADSP_CUSTOM_MED 1342 0.98 1.27 0.83 150 XMStockSpam_06 1288 1.39 1.22 1.47 151 XMBody_78 1272 0.72 1.21 0.47 152 T_XMHurry_00 1230 0.63 1.17 0.35 153 FORGED_GMAIL_RCVD 1226 0.65 1.16 0.39 154 DKIM_ADSP_NXDOMAIN 1220 0.69 1.16 0.46 155 TR_Mismatch_TLD_01 1202 0.68 1.14 0.44 156 T_TooManySym_02 1200 1.74 1.14 2.05 157 URI_TRY_3LD 1195 1.25 1.13 1.31 158 NML_ADSP_CUSTOM_MED 1186 0.76 1.12 0.58 159 TR_XM_DK_Bayes2 1177 2.79 1.12 3.65 160 BAYES_20 1173 1.83 1.11 2.20 161 XM_B_COPY_HTML 1161 0.95 1.10 0.88 162 XMSubEmpty 1152 1.11 1.09 1.12 163 MISSING_HEADERS 1142 0.65 1.08 0.42 164 SUBJ_DOLLARS 1131 0.47 1.07 0.16 165 T_MONEY_PERCENT 1126 0.68 1.07 0.48 166 TR_LOTS_OF_MONEY2 1126 0.68 1.07 0.48 167 TR_XM_RelayPhish 1097 0.62 1.04 0.41 168 MPART_ALT_DIFF_COUNT 1094 0.61 1.04 0.39 169 REPLYTO_WITHOUT_TO_CC 1075 0.39 1.02 0.07 170 XMSubMetaSSx_00 1054 0.45 1.00 0.16 171 XMClaimOffer 1051 0.40 1.00 0.10 172 XMBrknScrpt_02 1049 0.65 0.99 0.48 173 FVGT_m_MULTI_ODD_EMAIL 1041 0.38 0.99 0.06 174 DATE_IN_PAST_06_12 1033 0.38 0.98 0.07 175 HTML_FONT_SIZE_HUGE 1032 0.43 0.98 0.15 176 T_HTML_TAG_BALANCE_CENTER 1031 0.42 0.98 0.14 177 RDNS_DYNAMIC 1026 0.65 0.97 0.49 178 RCVD_IN_IADB_VOUCHED 999 2.32 0.95 3.02 179 T_Symld_Words_02 985 0.57 0.93 0.38 180 XMSexyCombo_04 968 0.37 0.92 0.09 181 XMSlimDrugH 960 0.50 0.91 0.28 182 XM_Body_Obfu01 951 0.36 0.90 0.08 183 XMHTMLBadTable_001 945 0.57 0.90 0.40 184 LongTLD 942 0.38 0.89 0.12 185 XMReplyNow 930 0.36 0.88 0.09 186 LONG_JUNK_URI3 918 0.35 0.87 0.09 187 RELAYCOUNTRY_DE 913 0.62 0.86 0.49 188 BASE64_LENGTH_79_INF 910 0.39 0.86 0.15 189 TR_Symld_Words 909 1.67 0.86 2.09 190 HDRS_LCASE_IMGONLY 883 0.33 0.84 0.07 191 PLING_QUERY 866 0.46 0.82 0.27 192 XM_HighProb1 865 0.29 0.82 0.02 193 FROM_LOCAL_HEX 862 0.31 0.82 0.04 194 ADVANCE_FEE_3_NEW_MONEY 858 0.29 0.81 0.02 195 BODY_ENHANCEMENT 844 0.29 0.80 0.02 196 TR_LOTS_OF_MONEY1 838 0.29 0.79 0.03 197 DATE_IN_PAST_12_24 827 0.31 0.78 0.06 198 RELAYCOUNTRY_AU 822 0.45 0.78 0.29 199 FROM_LOCAL_DIGITS 809 0.27 0.77 0.01 200 RCVD_IN_MSPIKE_WL 797 1.58 0.76 2.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153992 81.61 94.75 74.87 2 DKIM_SIGNED 137658 72.54 83.46 66.93 3 XM_DK_Pass 135693 71.25 81.53 65.98 4 DKIM_VALID 128891 67.77 77.70 62.67 5 DCC_CHECK_NEGATIVE 126203 46.85 18.58 61.36 6 BAYES_50 109378 45.72 31.19 53.18 7 DKIM_VALID_AU 98282 53.05 63.32 47.79 8 XMListUnsubscribeExists 85909 51.91 71.68 41.77 9 DCC_CHECK 76785 51.76 79.88 37.33 10 XM_H_QuotedFrom 65896 40.66 57.45 32.04 11 T_TM2_M_HEADER_IN_MSG 65298 27.73 19.91 31.75 12 ALL_TRUSTED 55394 18.57 2.28 26.93 13 HTML_FONT_LOW_CONTRAST 55324 29.57 34.76 26.90 14 DKIM_VALID_EF 54271 24.69 21.39 26.39 15 LOC_TINY_FONT_1 44389 26.55 36.24 21.58 16 MIME_HTML_ONLY 40133 23.44 31.09 19.51 17 FVGT_m_MULTI_ODD 36530 20.20 24.95 17.76 18 XMSubLong 36518 20.93 27.13 17.76 19 XM_DK_Undo_02 32782 26.80 47.97 15.94 20 BAYES_99 32347 24.95 42.92 15.73 21 MultiRelay 31982 15.93 16.68 15.55 22 XM_H_Long_From01 31672 12.62 7.21 15.40 23 BAYES_999 29042 21.81 36.78 14.12 24 XM_DKIMWhitelistDomains 25532 8.22 0.04 12.41 25 T_KAM_HTML_FONT_INVALID 25044 14.94 20.31 12.18 26 SUBJ_ALL_CAPS 22954 8.24 2.56 11.16 27 FSL_BULK_SIG 22391 11.95 14.02 10.89 28 XM_Body_Dirty_Words 21087 13.10 18.65 10.25 29 RCVD_IN_RP_SAFE 20890 9.24 7.47 10.16 30 XM_Multi_Part_URI 20792 12.66 17.62 10.11 31 LOTS_OF_MONEY 19711 10.93 13.54 9.58 32 RCVD_IN_RP_CERTIFIED 19708 8.42 6.17 9.58 33 XM_Evil_Numbers_Gen 18290 10.80 14.52 8.89 34 TR_DCC_Bayes_99 15357 16.53 34.20 7.47 35 BAYES_40 14929 5.28 1.42 7.26 36 BAYES_00 14778 5.33 1.71 7.19 37 HTML_IMAGE_RATIO_02 14680 11.21 19.14 7.14 38 TooManyTo_001 13169 6.68 7.23 6.40 39 LotsOfNums_01 12938 6.54 7.01 6.29 40 BAYES_60 12504 6.62 7.68 6.08 41 T_XMDrugObfuBody_14 11992 6.75 8.55 5.83 42 BOTNET_IPINHOSTNAME 11111 7.66 12.05 5.40 43 XMStrtUSub 10686 5.27 5.41 5.20 44 IN_ZIMBRA_NJ_WHITELIST 10122 3.26 0.03 4.92 45 XM_SendGrid 10031 4.54 3.87 4.88 46 XM_UncommonTLD01 9573 6.11 8.93 4.65 47 TR_XM_DK_Bayes 9457 3.50 1.37 4.60 48 T_REMOTE_IMAGE 9252 4.62 4.87 4.50 49 XMNumbers 9127 5.32 7.03 4.44 50 T_TooManySym_01 8986 4.07 3.48 4.37 51 UNPARSEABLE_RELAY 8946 3.71 2.47 4.35 52 RCVD_IN_IADB_LISTED 8923 3.50 1.85 4.34 53 DKIM_INVALID 8767 4.77 5.76 4.26 54 TR_XM_DK_Bayes1 8753 3.26 1.32 4.26 55 ANY_BOUNCE_MESSAGE 8719 3.44 1.88 4.24 56 BOUNCE_MESSAGE 8717 3.44 1.88 4.24 57 RCVD_IN_MSPIKE_H2 8632 4.07 3.83 4.20 58 TVD_RCVD_IP 8330 2.86 0.53 4.05 59 RELAYCOUNTRY_META 8208 9.17 19.26 3.99 60 HTML_IMAGE_RATIO_04 8188 6.22 10.58 3.98 61 MIME_QP_LONG_LINE 7974 3.57 2.96 3.88 62 INVALID_MSGID 7965 2.66 0.28 3.87 63 XM_B_Phish_Phrases 7882 5.43 8.54 3.83 64 BAYES_80 7808 5.40 8.54 3.80 65 RCVD_IN_IADB_SPF 7652 3.01 1.62 3.72 66 XMSexyCombo_05 7610 6.11 10.80 3.70 67 TR_XM_DK_Bayes2 7507 2.79 1.12 3.65 68 XMSubMetaSx_00 7272 4.65 6.83 3.54 69 TR_XM_DocInvoice 6927 4.88 7.82 3.37 70 FROM_EXCESS_BASE64 6912 4.83 7.70 3.36 71 RCVD_IN_IADB_SENDERID 6609 2.64 1.52 3.21 72 TO_MALFORMED 6535 2.10 0.02 3.18 73 RCVD_IN_IADB_DK 6347 2.54 1.48 3.09 74 MIME_HTML_MOSTLY 6340 3.42 4.09 3.08 75 MSGID_NOFQDN1 6256 2.02 0.02 3.04 76 RCVD_IN_IADB_VOUCHED 6221 2.32 0.95 3.02 77 HTML_IMAGE_RATIO_06 6097 3.73 5.22 2.96 78 MPART_ALT_DIFF 5956 4.69 8.18 2.90 79 BAYES_95 5693 3.43 4.73 2.77 80 HTML_MIME_NO_HTML_TAG 5346 2.78 3.12 2.60 81 IN_HORDE_ADDRESS_BOOK 5271 1.71 0.06 2.56 82 XM_PDF 5108 1.80 0.47 2.48 83 BAYES_20 4516 1.83 1.11 2.20 84 TR_Symld_Words 4289 1.67 0.86 2.09 85 T_TooManySym_02 4214 1.74 1.14 2.05 86 XMNoVowels 4201 1.92 1.67 2.04 87 RCVD_IN_IADB_OPTIN 4164 1.56 0.65 2.02 88 RCVD_IN_MSPIKE_WL 4123 1.58 0.76 2.00 89 RCVD_IN_MSPIKE_H3 4114 1.58 0.75 2.00 90 MAILING_LIST_MULTI 4075 1.84 1.57 1.98 91 NO_DNS_FOR_FROM 3965 2.37 3.23 1.93 92 USER_IN_DEF_DKIM_WL 3832 1.29 0.16 1.86 93 TooManyTo_002 3747 1.41 0.61 1.82 94 XM_DK_Undo_01 3730 1.64 1.29 1.81 95 BAYES_05 3683 1.41 0.68 1.79 96 XM_DIRTYINTL 3590 2.53 4.06 1.75 97 HTML_IMAGE_RATIO_08 3541 1.88 2.19 1.72 98 XM_H_PHPOS 3316 1.55 1.44 1.61 99 XM_CamelCaseFrm001 3104 2.00 2.95 1.51 100 XM_OfRef6 3062 2.53 4.55 1.49 101 XMStockSpam_06 3023 1.39 1.22 1.47 102 XM_ProductURIs 2984 1.66 2.08 1.45 103 TM2_M_URI_OPT_OUT 2937 1.96 2.99 1.43 104 URI_TRY_3LD 2695 1.25 1.13 1.31 105 XM_GoogleGroups 2648 1.03 0.54 1.29 106 USER_IN_WHITELIST 2606 0.84 0.00 1.27 107 TooManyTo_003 2573 1.00 0.52 1.25 108 XM_SPF_SoftFail 2563 2.56 5.12 1.25 109 UNTRUSTED_Relay 2549 5.08 12.57 1.24 110 XMSubNoVowel 2507 1.29 1.44 1.22 111 RELAYCOUNTRY_CA 2426 1.91 3.33 1.18 112 XMDiploma_00 2371 1.40 1.87 1.15 113 URI_HEX 2311 1.78 3.07 1.12 114 XMSubEmpty 2304 1.11 1.09 1.12 115 T_XMDrugObfuBody_08 2186 1.23 1.56 1.06 116 BOTNET 2150 5.82 15.13 1.05 117 XMPhish11 2127 1.48 2.36 1.03 118 TooManyTo_004 2059 0.80 0.39 1.00 119 MIME_HTML_ONLY_MULTI 2007 1.55 2.67 0.98 120 HELO_NODOT 1954 1.30 1.99 0.95 121 XMBody_95 1915 0.65 0.11 0.93 122 XMBdyGiftCard01 1889 1.50 2.64 0.92 123 T_TooManySym_03 1873 0.64 0.11 0.91 124 TooManyTo_005 1811 0.69 0.33 0.88 125 XM_B_COPY_HTML 1805 0.95 1.10 0.88 126 XM_H_Long_From02 1769 1.04 1.39 0.86 127 XM_UB50 1721 2.08 4.51 0.84 128 DKIM_ADSP_CUSTOM_MED 1707 0.98 1.27 0.83 129 XMSubMetaSxObfu_02 1692 0.67 0.36 0.82 130 XM_H_PHPMailer 1654 0.78 0.72 0.80 131 TM2_M_VERY_LONG_WORD 1631 1.27 2.19 0.79 132 TR_MetaPhish_Combo_01 1575 0.71 0.59 0.77 133 XM_B_REG_HTML 1442 1.20 2.18 0.70 134 XMLngstWrd_00 1311 0.64 0.65 0.64 135 T_FILL_THIS_FORM_SHORT 1300 1.32 2.66 0.63 136 TM2_M_A_HREF_HREF 1294 0.62 0.61 0.63 137 XM_D_tchamptons_WL 1290 0.41 0.00 0.63 138 TM2_M_BODY_EMPTY 1261 0.88 1.40 0.61 139 XMGenDplmaNmb 1247 0.84 1.28 0.61 140 SpammyFromTLD_01 1233 1.91 4.45 0.60 141 XMLngstWrd_01 1231 0.61 0.64 0.60 142 T_OBFU_PDF_ATTACH 1187 0.43 0.16 0.58 143 NML_ADSP_CUSTOM_MED 1186 0.76 1.12 0.58 144 RELAYCOUNTRY_GB 1185 0.89 1.51 0.58 145 XMCapTrack 1170 0.50 0.37 0.57 146 FILL_THIS_FORM 1168 0.62 0.73 0.57 147 HTML_TAG_BALANCE_BODY 1152 0.58 0.62 0.56 148 T_XMDrugObfuBody_00 1140 0.81 1.31 0.55 149 XM_B_TRADE_HTML 1140 0.54 0.51 0.55 150 XMBody_17 1128 1.27 2.67 0.55 151 DIET_1 1124 1.14 2.31 0.55 152 XMSubMetaI_00 1063 1.14 2.34 0.52 153 XM_H_PHPOS_M 1018 0.52 0.55 0.49 154 TVD_SPACE_RATIO 1016 0.54 0.62 0.49 155 T_TooManySym_04 1014 0.33 0.01 0.49 156 UPPERCASE_50_75 1010 0.42 0.29 0.49 157 RELAYCOUNTRY_DE 1008 0.62 0.86 0.49 158 RDNS_DYNAMIC 999 0.65 0.97 0.49 159 T_MONEY_PERCENT 994 0.68 1.07 0.48 160 TR_LOTS_OF_MONEY2 994 0.68 1.07 0.48 161 XMBrknScrpt_02 985 0.65 0.99 0.48 162 XMBody_78 976 0.72 1.21 0.47 163 HTML_FONT_FACE_BAD 940 0.52 0.65 0.46 164 DKIM_ADSP_NXDOMAIN 939 0.69 1.16 0.46 165 T_FILL_THIS_FORM_LOAN 912 0.51 0.63 0.44 166 TR_Mismatch_TLD_01 909 0.68 1.14 0.44 167 MISSING_HEADERS 868 0.65 1.08 0.42 168 XM_ShortIntro_01 864 0.39 0.34 0.42 169 TR_XM_RelayPhish 834 0.62 1.04 0.41 170 XMRcvdHeader_15 825 0.27 0.00 0.40 171 XMEmptyBody_01 824 0.73 1.39 0.40 172 XMHTMLBadTable_001 814 0.57 0.90 0.40 173 URI_NOVOWEL 813 0.50 0.70 0.40 174 MPART_ALT_DIFF_COUNT 800 0.61 1.04 0.39 175 FORGED_GMAIL_RCVD 795 0.65 1.16 0.39 176 T_Symld_Words_02 787 0.57 0.93 0.38 177 HTML_IMAGE_ONLY_32 784 0.33 0.22 0.38 178 FILL_THIS_FORM_LONG 769 0.45 0.59 0.37 179 XMPhish30 735 0.76 1.54 0.36 180 TR_MetaPhish_Combo_01b 728 0.28 0.12 0.35 181 T_XMHurry_00 724 0.63 1.17 0.35 182 XMSUPPORT 722 0.23 0.00 0.35 183 XMSolicitRefs_0 711 0.42 0.56 0.35 184 XMGappySubj_01 685 0.29 0.21 0.33 185 XMDateMe_00 662 0.25 0.10 0.32 186 HTML_IMAGE_ONLY_24 650 0.37 0.47 0.32 187 HTML_IMAGE_ONLY_28 634 0.36 0.46 0.31 188 XMHTML_After_End 632 0.96 2.23 0.31 189 ACT_NOW_CAPS 630 0.29 0.26 0.31 190 REMOVE_BEFORE_LINK 630 0.39 0.56 0.31 191 XMLngstWrd_02 630 0.41 0.61 0.31 192 FROM_EGROUPS 615 0.20 0.00 0.30 193 XMSexyCombo_01 614 0.75 1.64 0.30 194 XM_H_SpoofStaff4 612 0.20 0.02 0.30 195 RCVD_IN_BL_SPAMCOP_NET 599 1.34 3.40 0.29 196 HTML_IMAGE_ONLY_20 596 0.32 0.38 0.29 197 RELAYCOUNTRY_AU 588 0.45 0.78 0.29 198 XMBody_29 587 0.38 0.55 0.29 199 XMSlimDrugH 583 0.50 0.91 0.28 200 XMSubMetaSxObfu_03 570 0.41 0.68 0.28 ----------------------------------------------------------------------