Email: 581790 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 3.70 sec Spam: 184259 Autolearn: 0 AvgScore: 12.83 AvgScanTime: 4.57 sec Ham: 397531 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 3.29 sec Time Spent Running SA: 597.50 hours Time Spent Processing Spam: 234.07 hours Time Spent Processing Ham: 363.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171673 84.94 93.17 81.12 2 DKIM_SIGNED 151268 69.32 82.10 63.40 3 XM_DK_Pass 147293 67.78 79.94 62.15 4 DCC_CHECK 142365 45.97 77.26 31.46 5 DKIM_VALID 138753 63.15 75.30 57.52 6 XMListUnsubscribeExists 128299 49.81 69.63 40.62 7 DKIM_VALID_AU 105289 45.26 57.14 39.76 8 XM_H_QuotedFrom 104941 40.23 56.95 32.48 9 XM_DK_Undo_02 87109 22.72 47.28 11.34 10 BAYES_99 80419 21.24 43.64 10.85 11 BAYES_999 67967 18.12 36.89 9.42 12 LOC_TINY_FONT_1 65771 22.36 35.69 16.18 13 HTML_FONT_LOW_CONTRAST 65358 26.03 35.47 21.65 14 TR_DCC_Bayes_99 62961 14.27 34.17 5.04 15 BAYES_50 59602 49.79 32.35 57.88 16 MIME_HTML_ONLY 56705 22.23 30.77 18.28 17 XMSubLong 47817 21.14 25.95 18.91 18 FVGT_m_MULTI_ODD 46419 20.00 25.19 17.59 19 DKIM_VALID_EF 45576 23.66 24.73 23.17 20 T_KAM_HTML_FONT_INVALID 37765 16.82 20.50 15.11 21 DCC_CHECK_NEGATIVE 37443 51.77 20.32 66.35 22 XM_Body_Dirty_Words 37138 12.40 20.16 8.80 23 T_TM2_M_HEADER_IN_MSG 36603 31.37 19.86 36.70 24 RELAYCOUNTRY_META 33894 9.30 18.39 5.09 25 MultiRelay 31530 18.29 17.11 18.84 26 XM_Multi_Part_URI 30049 11.61 16.31 9.43 27 BOTNET 25809 5.15 14.01 1.04 28 FSL_BULK_SIG 25721 8.85 13.96 6.49 29 XM_Evil_Numbers_Gen 25302 8.94 13.73 6.72 30 HTML_IMAGE_RATIO_02 25270 8.06 13.71 5.45 31 BOTNET_IPINHOSTNAME 24007 6.48 13.03 3.44 32 LOTS_OF_MONEY 23426 8.59 12.71 6.68 33 UNTRUSTED_Relay 21384 4.59 11.61 1.34 34 XMSexyCombo_05 18684 4.76 10.14 2.27 35 T_XMDrugObfuBody_14 18650 8.27 10.12 7.41 36 XM_B_Phish_Phrases 17044 5.59 9.25 3.89 37 HTML_IMAGE_RATIO_04 17022 5.49 9.24 3.75 38 LotsOfNums_01 15571 7.68 8.45 7.32 39 BAYES_80 14959 5.16 8.12 3.79 40 XM_H_Long_From01 14958 9.40 8.12 10.00 41 TR_XM_DocInvoice 13702 4.68 7.44 3.40 42 XM_UncommonTLD01 13234 4.58 7.18 3.37 43 DKIM_INVALID 12515 6.17 6.79 5.88 44 BAYES_60 12460 6.67 6.76 6.63 45 XMSubMetaSx_00 11972 4.47 6.50 3.53 46 TooManyTo_001 11927 7.83 6.47 8.45 47 FROM_EXCESS_BASE64 11598 4.10 6.29 3.08 48 MPART_ALT_DIFF 10878 3.70 5.90 2.68 49 HTML_IMAGE_RATIO_06 10360 3.51 5.62 2.53 50 XM_UB50 9752 2.30 5.29 0.91 51 TM2_M_URI_OPT_OUT 9095 2.93 4.94 2.00 52 XMNumbers 9061 3.74 4.92 3.19 53 XM_SPF_SoftFail 9057 2.97 4.92 2.07 54 XM_DIRTYINTL 8848 2.61 4.80 1.60 55 BAYES_95 8776 3.31 4.76 2.64 56 MIME_QP_LONG_LINE 8663 5.15 4.70 5.36 57 XM_SendGrid 8503 4.67 4.61 4.69 58 XM_OfRef6 8220 2.38 4.46 1.42 59 RCVD_IN_RP_SAFE 8041 6.12 4.36 6.93 60 RCVD_IN_MSPIKE_H2 7882 4.33 4.28 4.36 61 MIME_HTML_MOSTLY 7383 2.69 4.01 2.07 62 RCVD_IN_RP_RNBL 7205 1.26 3.91 0.03 63 XM_CamelCaseFrm001 7140 2.23 3.87 1.47 64 T_REMOTE_IMAGE 6995 4.16 3.80 4.32 65 HTML_IMAGE_RATIO_08 6868 2.42 3.73 1.81 66 RCVD_IN_BL_SPAMCOP_NET 6817 1.48 3.70 0.46 67 SUBJ_ALL_CAPS 6796 5.12 3.69 5.78 68 RELAYCOUNTRY_CA 6559 2.01 3.56 1.29 69 MultiRelay_Combo 6445 1.26 3.50 0.22 70 MultiRelay_CC 6445 1.26 3.50 0.22 71 XMStrtUSub 6380 3.68 3.46 3.78 72 RCVD_IN_RP_CERTIFIED 6337 5.43 3.44 6.36 73 URI_HEX 6071 1.90 3.29 1.25 74 T_TooManySym_01 5655 3.45 3.07 3.63 75 ALL_TRUSTED 5572 18.75 3.02 26.03 76 MIME_HTML_ONLY_MULTI 5344 1.82 2.90 1.32 77 HTML_MIME_NO_HTML_TAG 5041 2.61 2.74 2.55 78 T_XMDrugObfuBody_08 4957 1.82 2.69 1.41 79 SpammyFromTLD_02 4873 1.05 2.64 0.31 80 RCVD_IN_IADB_LISTED 4505 4.55 2.44 5.53 81 BOTNET_NORDNS 4485 0.79 2.43 0.03 82 XMDiploma_00 4223 1.81 2.29 1.59 83 SpammyFromTLD_01 4166 1.23 2.26 0.75 84 T_FILL_THIS_FORM_SHORT 4023 1.38 2.18 1.01 85 XMNoVowels 3997 3.18 2.17 3.65 86 RCVD_IN_IADB_SPF 3981 3.99 2.16 4.83 87 RELAYCOUNTRY_FR 3913 0.85 2.12 0.26 88 RCVD_IN_IADB_SENDERID 3826 3.57 2.08 4.26 89 RCVD_IN_IADB_DK 3791 3.50 2.06 4.16 90 XM_URI_RBL 3710 0.70 2.01 0.09 91 XM_BadFromFormat 3660 0.76 1.99 0.20 92 XMHTML_After_End 3583 0.85 1.94 0.34 93 UNPARSEABLE_RELAY 3580 2.30 1.94 2.47 94 XMSexyCombo_01 3564 0.99 1.93 0.55 95 URIBL_BLACK 3549 0.63 1.93 0.03 96 URIBL_DBL_SPAM 3430 0.61 1.86 0.02 97 XM_UB99 3343 0.59 1.81 0.03 98 RELAYCOUNTRY_CN 3342 0.62 1.81 0.07 99 MAILING_LIST_MULTI 3338 2.00 1.81 2.08 100 XM_UB60 3202 0.61 1.74 0.09 101 XMBody_17 3110 0.78 1.69 0.36 102 TM2_M_VERY_LONG_WORD 3060 1.01 1.66 0.71 103 XM_H_Long_From02 3050 1.06 1.66 0.79 104 XM_DK_Undo_01 3033 1.80 1.65 1.87 105 XM_ProductURIs 2978 1.18 1.62 0.98 106 XMGenDplmaNmb 2907 1.17 1.58 0.98 107 RELAYCOUNTRY_GB 2893 1.22 1.57 1.06 108 FILL_THIS_FORM 2891 0.79 1.57 0.43 109 T_FILL_THIS_FORM_LONG 2765 0.70 1.50 0.33 110 KHOP_DYNAMIC 2746 1.00 1.49 0.77 111 URI_TRY_3LD 2714 1.07 1.47 0.88 112 T_XMDrugObfuBody_00 2701 1.05 1.47 0.86 113 T_MONEY_PERCENT 2670 0.64 1.45 0.26 114 TR_LOTS_OF_MONEY2 2670 0.64 1.45 0.26 115 BAYES_40 2668 4.52 1.45 5.95 116 TR_Mismatch_TLD_02 2619 0.48 1.42 0.05 117 XMStockSpam_06 2611 0.90 1.42 0.65 118 RELAYCOUNTRY_NL 2493 0.55 1.35 0.18 119 FORM_FRAUD_5 2452 0.42 1.33 0.00 120 ADVANCE_FEE_5_NEW_MONEY 2427 0.42 1.32 0.00 121 FROM_MISSP_REPLYTO 2404 0.42 1.30 0.01 122 FROM_MISSP_EH_MATCH 2357 0.42 1.28 0.02 123 TO_NO_BRKTS_FROM_MSSP 2347 0.44 1.27 0.05 124 XMPhish30 2339 0.60 1.27 0.29 125 NO_DNS_FOR_FROM 2292 0.98 1.24 0.86 126 XMSubMetaI_00 2284 0.67 1.24 0.41 127 XM_UB80 2272 0.42 1.23 0.04 128 XMPhish11 2258 1.18 1.23 1.16 129 XM_UB999 2243 0.40 1.22 0.02 130 DEAR_FRIEND 2240 0.41 1.22 0.04 131 TR_LOTS_OF_MONEY3 2200 0.51 1.19 0.19 132 BAYES_00 2174 5.61 1.18 7.66 133 PLING_QUERY 2161 0.62 1.17 0.36 134 BODY_URI_ONLY 2145 0.41 1.16 0.05 135 SUBJ_DOLLARS 2133 0.52 1.16 0.22 136 TVD_SPACE_RATIO_MINFP 2122 0.37 1.15 0.01 137 TR_XM_RelayPhish 2094 0.68 1.14 0.46 138 T_XMHurry_00 2046 0.62 1.11 0.39 139 URI_WP_HACKED_2 2043 0.85 1.11 0.73 140 XM_B_COPY_HTML 2012 0.66 1.09 0.47 141 XMBrknScrpt_02 2003 0.60 1.09 0.38 142 XMSlimDrugH 1985 0.58 1.08 0.35 143 XMHTMLBadTable_001 1985 0.57 1.08 0.33 144 DKIM_ADSP_CUSTOM_MED 1945 1.07 1.06 1.07 145 BAYES_20 1944 2.21 1.06 2.75 146 XM_B_REG_HTML 1936 0.70 1.05 0.54 147 XMBody_78 1934 0.73 1.05 0.58 148 BOUNCE_MESSAGE 1922 2.54 1.04 3.23 149 ANY_BOUNCE_MESSAGE 1922 2.54 1.04 3.23 150 TR_Symld_Words 1917 2.63 1.04 3.36 151 XMBdyGiftCard01 1887 0.68 1.02 0.52 152 RELAYCOUNTRY_AT 1880 0.43 1.02 0.16 153 XMLongAddy 1876 0.37 1.02 0.07 154 REMOVE_BEFORE_LINK 1874 0.66 1.02 0.49 155 DIET_1 1871 0.50 1.02 0.27 156 HTML_IMAGE_ONLY_08 1841 0.43 1.00 0.17 157 XM_HighProb1 1815 0.32 0.99 0.01 158 TR_MetaPhish_Combo_01 1778 0.77 0.96 0.69 159 RCVD_IN_IADB_VOUCHED 1772 2.85 0.96 3.72 160 XM_H_PHPOS 1762 1.84 0.96 2.24 161 TR_XM_DK_Bayes 1756 3.43 0.95 4.58 162 HTML_SHORT_LINK_IMG_1 1755 0.35 0.95 0.07 163 FORGED_GMAIL_RCVD 1754 0.67 0.95 0.54 164 MPART_ALT_DIFF_COUNT 1744 0.49 0.95 0.27 165 HTTPS_HTTP_MISMATCH 1731 0.60 0.94 0.45 166 XMSubMetaSSx_00 1709 0.44 0.93 0.21 167 DEAR_BENEFICIARY 1699 0.30 0.92 0.00 168 XM_RXBody 1688 0.35 0.92 0.09 169 HTML_IMAGE_ONLY_28 1670 0.60 0.91 0.46 170 T_Symld_Words_02 1666 0.58 0.90 0.42 171 T_TooManySym_02 1645 1.31 0.89 1.50 172 NML_ADSP_CUSTOM_MED 1615 0.83 0.88 0.81 173 HTML_FONT_SIZE_HUGE 1604 0.33 0.87 0.08 174 HTML_TAG_BALANCE_BODY 1580 0.53 0.86 0.38 175 TVD_RCVD_IP 1574 1.87 0.85 2.34 176 BODY_ENHANCEMENT 1551 0.28 0.84 0.01 177 HTML_IMAGE_ONLY_20 1537 0.52 0.83 0.37 178 MONEY_FORM_SHORT 1526 0.28 0.83 0.02 179 URI_NOVOWEL 1526 0.56 0.83 0.44 180 XM_OfRef7 1515 0.38 0.82 0.17 181 RELAYCOUNTRY_PL 1511 0.27 0.82 0.01 182 TR_XM_DK_Bayes1 1508 3.00 0.82 4.01 183 MISSING_HEADERS 1492 0.72 0.81 0.68 184 MONEY_FRAUD_8 1491 0.26 0.81 0.00 185 HTML_FONT_SIZE_LARGE 1471 0.39 0.80 0.21 186 RDNS_DYNAMIC 1469 0.50 0.80 0.37 187 TR_Caps_n_Bayes_99 1457 0.27 0.79 0.03 188 XMSubNoVowel 1456 0.77 0.79 0.76 189 TR_XM_DK_Bayes2 1455 2.53 0.79 3.33 190 IMPOTENCE 1455 0.57 0.79 0.47 191 LongTLD 1453 0.37 0.79 0.18 192 HTML_FONT_FACE_BAD 1441 0.52 0.78 0.40 193 RELAYCOUNTRY_ES 1439 0.27 0.78 0.03 194 XM_PDF 1433 3.85 0.78 5.28 195 T_HTML_TAG_BALANCE_CENTER 1417 0.33 0.77 0.12 196 XMMoneyMeta_00 1417 0.59 0.77 0.50 197 RELAYCOUNTRY_AU 1390 0.56 0.75 0.47 198 TM2_M_BODY_EMPTY 1388 0.59 0.75 0.52 199 XM_Body_Obfu01 1373 0.44 0.75 0.30 200 XM_Nigeria_01 1372 0.26 0.74 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 322474 84.94 93.17 81.12 2 DCC_CHECK_NEGATIVE 263763 51.77 20.32 66.35 3 DKIM_SIGNED 252041 69.32 82.10 63.40 4 XM_DK_Pass 247072 67.78 79.94 62.15 5 BAYES_50 230072 49.79 32.35 57.88 6 DKIM_VALID 228673 63.15 75.30 57.52 7 XMListUnsubscribeExists 161482 49.81 69.63 40.62 8 DKIM_VALID_AU 158042 45.26 57.14 39.76 9 T_TM2_M_HEADER_IN_MSG 145894 31.37 19.86 36.70 10 XM_H_QuotedFrom 129129 40.23 56.95 32.48 11 DCC_CHECK 125061 45.97 77.26 31.46 12 ALL_TRUSTED 103486 18.75 3.02 26.03 13 DKIM_VALID_EF 92093 23.66 24.73 23.17 14 HTML_FONT_LOW_CONTRAST 86058 26.03 35.47 21.65 15 XMSubLong 75176 21.14 25.95 18.91 16 MultiRelay 74887 18.29 17.11 18.84 17 MIME_HTML_ONLY 72654 22.23 30.77 18.28 18 FVGT_m_MULTI_ODD 69924 20.00 25.19 17.59 19 LOC_TINY_FONT_1 64308 22.36 35.69 16.18 20 T_KAM_HTML_FONT_INVALID 60080 16.82 20.50 15.11 21 XM_DK_Undo_02 45065 22.72 47.28 11.34 22 BAYES_99 43138 21.24 43.64 10.85 23 XM_H_Long_From01 39747 9.40 8.12 10.00 24 XM_Multi_Part_URI 37501 11.61 16.31 9.43 25 BAYES_999 37451 18.12 36.89 9.42 26 XM_Body_Dirty_Words 34982 12.40 20.16 8.80 27 TooManyTo_001 33610 7.83 6.47 8.45 28 BAYES_00 30457 5.61 1.18 7.66 29 T_XMDrugObfuBody_14 29474 8.27 10.12 7.41 30 LotsOfNums_01 29086 7.68 8.45 7.32 31 RCVD_IN_RP_SAFE 27556 6.12 4.36 6.93 32 XM_DKIMWhitelistDomains 27413 4.72 0.02 6.90 33 XM_Evil_Numbers_Gen 26723 8.94 13.73 6.72 34 LOTS_OF_MONEY 26561 8.59 12.71 6.68 35 BAYES_60 26373 6.67 6.76 6.63 36 FSL_BULK_SIG 25785 8.85 13.96 6.49 37 RCVD_IN_RP_CERTIFIED 25273 5.43 3.44 6.36 38 BAYES_40 23635 4.52 1.45 5.95 39 DKIM_INVALID 23368 6.17 6.79 5.88 40 IN_ZIMBRA_NJ_WHITELIST 23260 4.01 0.04 5.85 41 SUBJ_ALL_CAPS 22983 5.12 3.69 5.78 42 RCVD_IN_IADB_LISTED 21984 4.55 2.44 5.53 43 HTML_IMAGE_RATIO_02 21649 8.06 13.71 5.45 44 MIME_QP_LONG_LINE 21293 5.15 4.70 5.36 45 XM_PDF 20980 3.85 0.78 5.28 46 RELAYCOUNTRY_META 20217 9.30 18.39 5.09 47 TR_DCC_Bayes_99 20046 14.27 34.17 5.04 48 RCVD_IN_IADB_SPF 19208 3.99 2.16 4.83 49 XM_SendGrid 18647 4.67 4.61 4.69 50 TR_XM_DK_Bayes 18223 3.43 0.95 4.58 51 RCVD_IN_MSPIKE_H2 17324 4.33 4.28 4.36 52 T_REMOTE_IMAGE 17193 4.16 3.80 4.32 53 RCVD_IN_IADB_SENDERID 16950 3.57 2.08 4.26 54 RCVD_IN_IADB_DK 16545 3.50 2.06 4.16 55 TR_XM_DK_Bayes1 15958 3.00 0.82 4.01 56 XM_B_Phish_Phrases 15456 5.59 9.25 3.89 57 BAYES_80 15062 5.16 8.12 3.79 58 XMStrtUSub 15011 3.68 3.46 3.78 59 HTML_IMAGE_RATIO_04 14890 5.49 9.24 3.75 60 RCVD_IN_IADB_VOUCHED 14799 2.85 0.96 3.72 61 XMNoVowels 14519 3.18 2.17 3.65 62 T_TooManySym_01 14418 3.45 3.07 3.63 63 XMSubMetaSx_00 14046 4.47 6.50 3.53 64 BOTNET_IPINHOSTNAME 13671 6.48 13.03 3.44 65 TR_XM_DocInvoice 13528 4.68 7.44 3.40 66 XM_UncommonTLD01 13410 4.58 7.18 3.37 67 TR_Symld_Words 13372 2.63 1.04 3.36 68 TR_XM_DK_Bayes2 13239 2.53 0.79 3.33 69 ANY_BOUNCE_MESSAGE 12838 2.54 1.04 3.23 70 BOUNCE_MESSAGE 12836 2.54 1.04 3.23 71 XMNumbers 12686 3.74 4.92 3.19 72 FROM_EXCESS_BASE64 12247 4.10 6.29 3.08 73 BAYES_20 10923 2.21 1.06 2.75 74 MPART_ALT_DIFF 10673 3.70 5.90 2.68 75 BAYES_95 10489 3.31 4.76 2.64 76 TooManyTo_002 10398 2.02 0.73 2.62 77 HTML_MIME_NO_HTML_TAG 10126 2.61 2.74 2.55 78 HTML_IMAGE_RATIO_06 10066 3.51 5.62 2.53 79 HELO_NODOT 9909 1.87 0.53 2.49 80 UNPARSEABLE_RELAY 9804 2.30 1.94 2.47 81 RCVD_IN_IADB_OPTIN 9550 1.82 0.56 2.40 82 TVD_RCVD_IP 9298 1.87 0.85 2.34 83 XMSexyCombo_05 9024 4.76 10.14 2.27 84 XM_H_PHPOS 8924 1.84 0.96 2.24 85 IN_HORDE_ADDRESS_BOOK 8347 1.45 0.06 2.10 86 MAILING_LIST_MULTI 8288 2.00 1.81 2.08 87 MIME_HTML_MOSTLY 8247 2.69 4.01 2.07 88 XM_SPF_SoftFail 8244 2.97 4.92 2.07 89 TM2_M_URI_OPT_OUT 7964 2.93 4.94 2.00 90 XM_DK_Undo_01 7422 1.80 1.65 1.87 91 HTML_IMAGE_RATIO_08 7209 2.42 3.73 1.81 92 BAYES_05 7023 1.40 0.62 1.77 93 INVALID_MSGID 7005 1.28 0.23 1.76 94 XMCapTrack 7002 1.40 0.61 1.76 95 RCVD_IN_MSPIKE_WL 6947 1.41 0.67 1.75 96 RCVD_IN_MSPIKE_H3 6942 1.40 0.66 1.75 97 TooManyTo_003 6802 1.37 0.62 1.71 98 TO_MALFORMED 6514 1.12 0.01 1.64 99 XM_DIRTYINTL 6347 2.61 4.80 1.60 100 XMDiploma_00 6327 1.81 2.29 1.59 101 T_TooManySym_02 5975 1.31 0.89 1.50 102 XM_CamelCaseFrm001 5831 2.23 3.87 1.47 103 XM_OfRef6 5631 2.38 4.46 1.42 104 T_XMDrugObfuBody_08 5617 1.82 2.69 1.41 105 UNTRUSTED_Relay 5309 4.59 11.61 1.34 106 MIME_HTML_ONLY_MULTI 5262 1.82 2.90 1.32 107 RELAYCOUNTRY_CA 5119 2.01 3.56 1.29 108 TooManyTo_004 5017 1.00 0.44 1.26 109 URI_HEX 4958 1.90 3.29 1.25 110 XM_GoogleGroups 4875 0.98 0.46 1.23 111 XMPhish11 4628 1.18 1.23 1.16 112 USER_IN_DEF_DKIM_WL 4302 0.75 0.02 1.08 113 DKIM_ADSP_CUSTOM_MED 4269 1.07 1.06 1.07 114 RELAYCOUNTRY_GB 4210 1.22 1.57 1.06 115 BOTNET 4134 5.15 14.01 1.04 116 TooManyTo_005 4105 0.82 0.35 1.03 117 T_FILL_THIS_FORM_SHORT 4020 1.38 2.18 1.01 118 XM_ProductURIs 3900 1.18 1.62 0.98 119 XMGenDplmaNmb 3879 1.17 1.58 0.98 120 TO_NO_BRKTS_HTML_ONLY 3664 0.67 0.11 0.92 121 XM_UB50 3605 2.30 5.29 0.91 122 URI_TRY_3LD 3516 1.07 1.47 0.88 123 T_XMDrugObfuBody_00 3425 1.05 1.47 0.86 124 NO_DNS_FOR_FROM 3410 0.98 1.24 0.86 125 NML_ADSP_CUSTOM_MED 3235 0.83 0.88 0.81 126 XM_H_Long_From02 3144 1.06 1.66 0.79 127 KHOP_DYNAMIC 3070 1.00 1.49 0.77 128 XMSubNoVowel 3020 0.77 0.79 0.76 129 SpammyFromTLD_01 2986 1.23 2.26 0.75 130 URI_WP_HACKED_2 2896 0.85 1.11 0.73 131 XM_H_PHPMailer 2851 0.70 0.66 0.72 132 TM2_M_VERY_LONG_WORD 2823 1.01 1.66 0.71 133 TR_MetaPhish_Combo_01 2729 0.77 0.96 0.69 134 T_TooManySym_03 2696 0.54 0.25 0.68 135 MISSING_HEADERS 2693 0.72 0.81 0.68 136 SHORT_HELO_AND_INLINE_IMAGE 2661 0.49 0.09 0.67 137 USER_IN_WHITELIST 2633 0.45 0.00 0.66 138 T_OBFU_PDF_ATTACH 2615 0.51 0.20 0.66 139 XMStockSpam_06 2602 0.90 1.42 0.65 140 XMSubEmpty 2367 0.52 0.35 0.60 141 XMLngstWrd_00 2326 0.58 0.57 0.59 142 RELAYCOUNTRY_DE 2294 0.60 0.66 0.58 143 XMBody_78 2292 0.73 1.05 0.58 144 RCVD_IN_SORBS_DUL 2283 0.60 0.64 0.57 145 XM_ShortIntro_01 2196 0.45 0.24 0.55 146 XMSexyCombo_01 2189 0.99 1.93 0.55 147 FORGED_GMAIL_RCVD 2163 0.67 0.95 0.54 148 XM_B_REG_HTML 2137 0.70 1.05 0.54 149 XMLngstWrd_01 2112 0.51 0.46 0.53 150 XMBdyGiftCard01 2085 0.68 1.02 0.52 151 TM2_M_BODY_EMPTY 2061 0.59 0.75 0.52 152 HTML_IMAGE_ONLY_32 2042 0.48 0.42 0.51 153 XMGappySubj_01 2016 0.49 0.47 0.51 154 XMMoneyMeta_00 2006 0.59 0.77 0.50 155 REMOVE_BEFORE_LINK 1938 0.66 1.02 0.49 156 XMDateMe_00 1925 0.55 0.70 0.48 157 RELAYCOUNTRY_AU 1885 0.56 0.75 0.47 158 IMPOTENCE 1876 0.57 0.79 0.47 159 XM_B_COPY_HTML 1849 0.66 1.09 0.47 160 TR_XM_RelayPhish 1841 0.68 1.14 0.46 161 HTML_IMAGE_ONLY_28 1826 0.60 0.91 0.46 162 RCVD_IN_BL_SPAMCOP_NET 1809 1.48 3.70 0.46 163 AC_DIV_BONANZA 1802 0.34 0.11 0.45 164 HTTPS_HTTP_MISMATCH 1772 0.60 0.94 0.45 165 URI_NOVOWEL 1748 0.56 0.83 0.44 166 FILL_THIS_FORM 1722 0.79 1.57 0.43 167 T_Symld_Words_02 1685 0.58 0.90 0.42 168 TVD_SPACE_RATIO 1683 0.37 0.24 0.42 169 XMBody_95 1668 0.32 0.12 0.42 170 XMSubMetaI_00 1616 0.67 1.24 0.41 171 HTML_FONT_FACE_BAD 1602 0.52 0.78 0.40 172 XM_H_PHPOS_M 1540 0.38 0.37 0.39 173 T_XMHurry_00 1537 0.62 1.11 0.39 174 HTML_TAG_BALANCE_BODY 1525 0.53 0.86 0.38 175 HTML_IMAGE_ONLY_24 1505 0.47 0.66 0.38 176 XMBrknScrpt_02 1497 0.60 1.09 0.38 177 XMSubMetaSxObfu_02 1491 0.34 0.27 0.38 178 HTML_IMAGE_ONLY_20 1465 0.52 0.83 0.37 179 XMSubMetaSxObfu_03 1458 0.47 0.69 0.37 180 RDNS_DYNAMIC 1457 0.50 0.80 0.37 181 PLING_QUERY 1444 0.62 1.17 0.36 182 XMBody_17 1443 0.78 1.69 0.36 183 XMSlimDrugH 1379 0.58 1.08 0.35 184 XM_B_TRADE_HTML 1371 0.36 0.39 0.34 185 XMHTML_After_End 1357 0.85 1.94 0.34 186 XMHTMLBadTable_001 1321 0.57 1.08 0.33 187 T_FILL_THIS_FORM_LONG 1305 0.70 1.50 0.33 188 SpammyFromTLD_02 1241 1.05 2.64 0.31 189 XM_H_Trusted_IP 1232 0.21 0.00 0.31 190 T_TooManySym_04 1231 0.23 0.05 0.31 191 XMSolicitRefs_0 1230 0.30 0.29 0.31 192 XMRcvdHeader_15 1223 0.21 0.00 0.31 193 XM_Body_Obfu01 1204 0.44 0.75 0.30 194 GMD_PDF_EMPTY_BODY 1195 0.23 0.08 0.30 195 DKIM_ADSP_NXDOMAIN 1186 0.43 0.71 0.30 196 TM2_M_A_HREF_HREF 1176 0.36 0.49 0.30 197 XMPhish30 1143 0.60 1.27 0.29 198 FILL_THIS_FORM_LOAN 1131 0.36 0.51 0.28 199 XM_USANA_RCVD 1128 0.19 0.00 0.28 200 XMPhish14 1123 0.40 0.65 0.28 ----------------------------------------------------------------------