Email: 742723 Autolearn: 0 AvgScore: 5.12 AvgScanTime: 4.88 sec Spam: 250422 Autolearn: 0 AvgScore: 13.70 AvgScanTime: 5.38 sec Ham: 492301 Autolearn: 0 AvgScore: 0.76 AvgScanTime: 4.62 sec Time Spent Running SA: 1006.02 hours Time Spent Processing Spam: 373.99 hours Time Spent Processing Ham: 632.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 242332 91.55 96.77 88.90 2 DKIM_SIGNED 185374 70.40 74.02 68.56 3 DCC_CHECK 185258 47.95 73.98 34.71 4 XM_DK_Pass 181246 68.94 72.38 67.19 5 DKIM_VALID 174998 66.11 69.88 64.20 6 XMListUnsubscribeExists 159876 51.69 63.84 45.51 7 DKIM_VALID_AU 136714 48.84 54.59 45.91 8 XM_H_QuotedFrom 118181 37.45 47.19 32.50 9 BAYES_99 110236 22.94 44.02 12.22 10 XM_DK_Undo_02 105704 22.67 42.21 12.73 11 MIME_HTML_ONLY 105242 26.31 42.03 18.31 12 BAYES_999 85709 18.52 34.23 10.53 13 T_TM2_M_HEADER_IN_MSG 82883 29.88 33.10 28.25 14 TR_DCC_Bayes_99 80085 14.87 31.98 6.17 15 LOC_TINY_FONT_1 80015 24.09 31.95 20.09 16 HTML_FONT_LOW_CONTRAST 79496 27.70 31.74 25.65 17 BAYES_50 71110 48.94 28.40 59.38 18 XMSubLong 68454 22.88 27.34 20.62 19 DCC_CHECK_NEGATIVE 62125 50.36 24.81 63.36 20 FVGT_m_MULTI_ODD 57035 21.83 22.78 21.35 21 FROM_EXCESS_BASE64 54225 9.46 21.65 3.26 22 DKIM_VALID_EF 53727 24.02 21.45 25.32 23 T_KAM_HTML_FONT_INVALID 48055 15.88 19.19 14.20 24 HTML_MIME_NO_HTML_TAG 45401 7.46 18.13 2.03 25 XM_Body_Dirty_Words 42270 12.38 16.88 10.09 26 HTML_FONT_SIZE_HUGE 40964 8.32 16.36 4.22 27 HTML_SHORT_LINK_IMG_1 40910 8.27 16.34 4.17 28 MISSING_HEADERS 40844 6.26 16.31 1.15 29 XM_BadFromFormat 40687 5.56 16.25 0.13 30 SHORTENER_SHORT_IMG 40280 8.17 16.08 4.14 31 URI_BUFFLY 40276 8.17 16.08 4.14 32 MIME_HEADER_CTYPE_ONLY 40213 5.50 16.06 0.14 33 HTML_IMAGE_ONLY_08 40117 8.22 16.02 4.25 34 FSL_BULK_SIG 38664 9.97 15.44 7.19 35 HTML_IMAGE_RATIO_02 37267 10.95 14.88 8.95 36 BODY_URI_ONLY 37266 5.07 14.88 0.08 37 XM_Multi_Part_URI 36242 11.62 14.47 10.16 38 XM_UncommonTLD01 36068 6.92 14.40 3.12 39 RELAYCOUNTRY_META 31675 7.31 12.65 4.59 40 MultiRelay 31365 15.65 12.52 17.24 41 BOTNET_IPINHOSTNAME 28554 7.06 11.40 4.85 42 XM_Evil_Numbers_Gen 28243 9.22 11.28 8.18 43 SpammyFromTLD_02 28025 3.96 11.19 0.29 44 BAYES_80 25967 6.25 10.37 4.15 45 BOTNET 24069 3.92 9.61 1.02 46 XMSexyCombo_05 22083 4.90 8.82 2.91 47 XMNumbers 22055 4.80 8.81 2.76 48 LOTS_OF_MONEY 21927 9.00 8.76 9.12 49 T_XMDrugObfuBody_14 20755 7.79 8.29 7.53 50 HTML_IMAGE_RATIO_04 19755 5.79 7.89 4.72 51 XM_B_Phish_Phrases 19508 5.75 7.79 4.72 52 UNTRUSTED_Relay 18885 3.26 7.54 1.08 53 BAYES_60 17772 6.92 7.10 6.84 54 LotsOfNums_01 17659 8.32 7.05 8.96 55 MPART_ALT_DIFF 17165 4.07 6.85 2.65 56 BAYES_95 16728 4.21 6.68 2.95 57 XM_H_Long_From01 16649 5.67 6.65 5.17 58 TR_XM_DocInvoice 15843 4.22 6.33 3.15 59 TooManyTo_001 15397 7.14 6.15 7.64 60 RCVD_IN_RP_SAFE 14448 8.70 5.77 10.20 61 XM_JunkDunk 14205 1.91 5.67 0.00 62 XMSubMetaSx_00 13831 4.49 5.52 3.96 63 RCVD_IN_RP_CERTIFIED 12185 7.99 4.87 9.59 64 MIME_HTML_MOSTLY 11072 2.95 4.42 2.21 65 HTML_IMAGE_RATIO_06 11024 3.59 4.40 3.18 66 DKIM_INVALID 10376 4.29 4.14 4.37 67 MIME_QP_LONG_LINE 10134 5.17 4.05 5.74 68 TM2_M_URI_OPT_OUT 9455 2.62 3.78 2.04 69 XMStrtUSub 9413 3.78 3.76 3.79 70 HTML_IMAGE_RATIO_08 8873 2.51 3.54 1.99 71 XM_SendGrid 8735 4.31 3.49 4.72 72 T_TooManySym_01 8665 4.16 3.46 4.51 73 XM_UB50 8619 1.65 3.44 0.74 74 MIME_HTML_ONLY_MULTI 8496 1.97 3.39 1.24 75 XM_CamelCaseFrm001 7971 2.38 3.18 1.97 76 XM_DIRTYINTL 7941 2.20 3.17 1.70 77 RELAYCOUNTRY_CA 7321 1.89 2.92 1.36 78 RCVD_IN_MSPIKE_H2 7118 4.05 2.84 4.67 79 XM_SPF_SoftFail 7015 2.17 2.80 1.85 80 URI_HEX 6710 1.98 2.68 1.63 81 XMSlimDrugH 6252 1.03 2.50 0.29 82 XM_OfRef6 6141 1.65 2.45 1.24 83 RCVD_IN_BL_SPAMCOP_NET 6112 1.07 2.44 0.38 84 T_REMOTE_IMAGE 6006 3.71 2.40 4.38 85 XMDiploma_00 5497 1.72 2.20 1.49 86 XM_URI_RBL 5468 0.82 2.18 0.12 87 SpammyFromTLD_01 5367 1.19 2.14 0.71 88 DIET_1 5365 1.14 2.14 0.63 89 XMSubMetaI_00 5252 1.34 2.10 0.96 90 RCVD_IN_RP_RNBL 4991 0.71 1.99 0.05 91 XMMoneyMeta_00 4962 0.98 1.98 0.47 92 RCVD_IN_IADB_LISTED 4916 4.34 1.96 5.55 93 XM_H_Long_From02 4871 1.32 1.95 1.00 94 SUBJ_ALL_CAPS 4830 1.83 1.93 1.77 95 T_XMDrugObfuBody_08 4808 1.63 1.92 1.48 96 MultiRelay_CC 4730 0.75 1.89 0.17 97 MultiRelay_Combo 4730 0.75 1.89 0.17 98 RCVD_IN_IADB_SPF 4344 3.80 1.73 4.85 99 TR_Symld_Words 4316 1.95 1.72 2.07 100 RCVD_IN_IADB_SENDERID 4094 3.38 1.63 4.27 101 XMGenDplmaNmb 4035 1.16 1.61 0.93 102 RCVD_IN_IADB_DK 4000 3.30 1.60 4.16 103 T_TooManySym_02 3648 1.53 1.46 1.57 104 XMWghtMeta_00 3620 0.50 1.45 0.01 105 XMBody_17 3524 0.77 1.41 0.45 106 XM_DK_Undo_01 3512 1.68 1.40 1.82 107 SUBJECT_DIET 3460 0.47 1.38 0.00 108 XMMoneyMeta_01 3446 0.48 1.38 0.02 109 TM2_M_VERY_LONG_WORD 3355 0.99 1.34 0.81 110 ALL_TRUSTED 3349 15.47 1.34 22.66 111 UNPARSEABLE_RELAY 3342 2.93 1.33 3.74 112 T_XMDrugObfuBody_00 3298 1.03 1.32 0.89 113 URI_TRY_3LD 3252 1.14 1.30 1.06 114 SUBJ_DOLLARS 3248 0.59 1.30 0.23 115 RELAYCOUNTRY_FR 3244 0.62 1.30 0.27 116 MAILING_LIST_MULTI 3140 1.87 1.25 2.18 117 URIBL_BLACK 3138 0.45 1.25 0.04 118 T_Symld_Words_02 3089 0.81 1.23 0.59 119 T_XMHurry_00 3085 1.11 1.23 1.05 120 XMBdyGiftCard01 3066 1.36 1.22 1.43 121 XMHTML_After_End 2980 0.64 1.19 0.36 122 XMSexyCombo_01 2967 1.00 1.18 0.91 123 XMGappySubj_01 2931 0.68 1.17 0.43 124 XM_UB99 2892 0.40 1.15 0.01 125 HTML_FONT_FACE_BAD 2864 0.71 1.14 0.49 126 XM_HighProb1 2806 0.39 1.12 0.01 127 XMPhish30 2803 0.61 1.12 0.36 128 XM_ProductURIs 2798 1.02 1.12 0.97 129 TR_XM_RelayPhish 2728 0.69 1.09 0.48 130 RELAYCOUNTRY_IN 2727 0.42 1.09 0.08 131 BOTNET_NORDNS 2727 0.37 1.09 0.01 132 XM_UB60 2720 0.40 1.09 0.06 133 TR_LOTS_OF_MONEY2 2707 0.80 1.08 0.66 134 T_MONEY_PERCENT 2707 0.80 1.08 0.66 135 BAYES_40 2689 2.68 1.07 3.50 136 XMStockSpam_06 2675 1.19 1.07 1.25 137 XMPhish11 2630 1.10 1.05 1.12 138 XMBrknScrpt_02 2606 0.64 1.04 0.44 139 RELAYCOUNTRY_AT 2569 0.41 1.03 0.10 140 XMPhish14 2521 0.61 1.01 0.41 141 BAYES_00 2422 4.59 0.97 6.43 142 RELAYCOUNTRY_CN 2422 0.36 0.97 0.06 143 REMOVE_BEFORE_LINK 2384 0.59 0.95 0.41 144 URI_NOVOWEL 2350 0.63 0.94 0.47 145 BAYES_20 2338 1.90 0.93 2.39 146 RCVD_IN_IADB_VOUCHED 2296 2.72 0.92 3.63 147 DKIM_ADSP_CUSTOM_MED 2243 1.10 0.90 1.20 148 XMClaimOffer 2198 0.37 0.88 0.11 149 TR_Caps_n_Bayes_99 2187 0.35 0.87 0.09 150 XMGappySubj_02 2181 0.36 0.87 0.11 151 URIBL_DBL_SPAM 2168 0.32 0.87 0.04 152 XMHTMLBadTable_001 2142 0.59 0.86 0.46 153 RELAYCOUNTRY_GB 2086 0.93 0.83 0.98 154 XMBody_78 2074 0.69 0.83 0.63 155 XM_H_PHPOS 2073 1.10 0.83 1.24 156 TooManyTo_002 2070 2.04 0.83 2.65 157 RDNS_DYNAMIC 2061 0.52 0.82 0.36 158 TR_XM_DK_Bayes 2054 2.93 0.82 4.01 159 XM_RXBody 2052 0.32 0.82 0.06 160 XM_UB80 2047 0.31 0.82 0.05 161 XM_UB999 2021 0.28 0.81 0.01 162 T_FILL_THIS_FORM_SHORT 1989 0.86 0.79 0.90 163 TR_XM_DK_Bayes1 1980 2.78 0.79 3.79 164 XMSlimDrugs 1974 0.28 0.79 0.02 165 HTML_TAG_BALANCE_BODY 1948 0.55 0.78 0.43 166 TR_XM_DK_Bayes2 1898 2.32 0.76 3.12 167 ANY_BOUNCE_MESSAGE 1896 6.80 0.76 9.88 168 BOUNCE_MESSAGE 1896 6.80 0.76 9.88 169 NML_ADSP_CUSTOM_MED 1873 0.88 0.75 0.94 170 TooManyTo_003 1857 1.51 0.74 1.91 171 TR_LOTS_OF_MONEY3 1827 0.50 0.73 0.39 172 FORGED_GMAIL_RCVD 1799 0.66 0.72 0.63 173 KHOP_DYNAMIC 1755 0.63 0.70 0.60 174 DATE_IN_PAST_03_06 1697 0.36 0.68 0.20 175 T_HTML_TAG_BALANCE_CENTER 1684 0.30 0.67 0.11 176 MPART_ALT_DIFF_COUNT 1665 0.40 0.66 0.27 177 XM_Combo_Sbj 1649 0.36 0.66 0.21 178 FVGT_m_MULTI_ODD_EMAIL 1642 0.25 0.66 0.04 179 PLING_QUERY 1634 0.41 0.65 0.29 180 XM_PDF 1607 3.04 0.64 4.26 181 XMSubMetaSSx_00 1601 0.41 0.64 0.29 182 FILL_THIS_FORM 1591 0.47 0.64 0.38 183 RCVD_IN_MSPIKE_WL 1572 1.56 0.63 2.03 184 RCVD_IN_MSPIKE_H3 1566 1.55 0.63 2.03 185 LOW_PRICE 1539 0.36 0.61 0.23 186 HTTPS_HTTP_MISMATCH 1537 0.51 0.61 0.45 187 TM2_M_A_HREF_HREF 1532 0.58 0.61 0.56 188 XM_H_PHPMailer 1528 0.71 0.61 0.75 189 TooManyTo_004 1517 0.94 0.61 1.11 190 BODY_ENHANCEMENT 1511 0.22 0.60 0.03 191 T_FILL_THIS_FORM_LONG 1503 0.40 0.60 0.31 192 XM_B_REG_HTML 1472 0.55 0.59 0.52 193 TR_Mismatch_TLD_02 1454 0.23 0.58 0.05 194 RELAYCOUNTRY_DE 1454 0.41 0.58 0.32 195 XMSubMetaSxObfu_03 1396 0.71 0.56 0.79 196 TR_MetaPhish_Combo_01 1375 0.57 0.55 0.58 197 RCVD_IN_IADB_OPTIN 1375 1.71 0.55 2.30 198 RELAYCOUNTRY_AU 1363 0.50 0.54 0.48 199 TooManyTo_005 1348 0.78 0.54 0.91 200 LongTLD 1321 0.27 0.53 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 437639 91.55 96.77 88.90 2 DKIM_SIGNED 337536 70.40 74.02 68.56 3 XM_DK_Pass 330797 68.94 72.38 67.19 4 DKIM_VALID 316042 66.11 69.88 64.20 5 DCC_CHECK_NEGATIVE 311933 50.36 24.81 63.36 6 BAYES_50 292351 48.94 28.40 59.38 7 DKIM_VALID_AU 226008 48.84 54.59 45.91 8 XMListUnsubscribeExists 224025 51.69 63.84 45.51 9 DCC_CHECK 170882 47.95 73.98 34.71 10 XM_H_QuotedFrom 159980 37.45 47.19 32.50 11 T_TM2_M_HEADER_IN_MSG 139074 29.88 33.10 28.25 12 HTML_FONT_LOW_CONTRAST 126264 27.70 31.74 25.65 13 DKIM_VALID_EF 124649 24.02 21.45 25.32 14 ALL_TRUSTED 111536 15.47 1.34 22.66 15 FVGT_m_MULTI_ODD 105109 21.83 22.78 21.35 16 XMSubLong 101492 22.88 27.34 20.62 17 LOC_TINY_FONT_1 98900 24.09 31.95 20.09 18 MIME_HTML_ONLY 90143 26.31 42.03 18.31 19 MultiRelay 84865 15.65 12.52 17.24 20 T_KAM_HTML_FONT_INVALID 69892 15.88 19.19 14.20 21 XM_DK_Undo_02 62694 22.67 42.21 12.73 22 BAYES_99 60171 22.94 44.02 12.22 23 BAYES_999 51862 18.52 34.23 10.53 24 RCVD_IN_RP_SAFE 50195 8.70 5.77 10.20 25 XM_Multi_Part_URI 50036 11.62 14.47 10.16 26 XM_Body_Dirty_Words 49654 12.38 16.88 10.09 27 BOUNCE_MESSAGE 48633 6.80 0.76 9.88 28 ANY_BOUNCE_MESSAGE 48633 6.80 0.76 9.88 29 RCVD_IN_RP_CERTIFIED 47191 7.99 4.87 9.59 30 XM_DKIMWhitelistDomains 44934 6.08 0.07 9.13 31 LOTS_OF_MONEY 44909 9.00 8.76 9.12 32 LotsOfNums_01 44107 8.32 7.05 8.96 33 HTML_IMAGE_RATIO_02 44046 10.95 14.88 8.95 34 XM_Evil_Numbers_Gen 40265 9.22 11.28 8.18 35 TooManyTo_001 37632 7.14 6.15 7.64 36 T_XMDrugObfuBody_14 37090 7.79 8.29 7.53 37 FSL_BULK_SIG 35414 9.97 15.44 7.19 38 BAYES_60 33653 6.92 7.10 6.84 39 BAYES_00 31643 4.59 0.97 6.43 40 TR_DCC_Bayes_99 30366 14.87 31.98 6.17 41 MIME_QP_LONG_LINE 28245 5.17 4.05 5.74 42 RCVD_IN_IADB_LISTED 27309 4.34 1.96 5.55 43 XM_H_Long_From01 25446 5.67 6.65 5.17 44 BOTNET_IPINHOSTNAME 23865 7.06 11.40 4.85 45 RCVD_IN_IADB_SPF 23856 3.80 1.73 4.85 46 IN_ZIMBRA_NJ_WHITELIST 23713 3.20 0.03 4.82 47 XM_SendGrid 23240 4.31 3.49 4.72 48 HTML_IMAGE_RATIO_04 23219 5.79 7.89 4.72 49 XM_B_Phish_Phrases 23213 5.75 7.79 4.72 50 RCVD_IN_MSPIKE_H2 22970 4.05 2.84 4.67 51 RELAYCOUNTRY_META 22595 7.31 12.65 4.59 52 T_TooManySym_01 22225 4.16 3.46 4.51 53 T_REMOTE_IMAGE 21565 3.71 2.40 4.38 54 DKIM_INVALID 21494 4.29 4.14 4.37 55 RCVD_IN_IADB_SENDERID 21009 3.38 1.63 4.27 56 XM_PDF 20989 3.04 0.64 4.26 57 HTML_IMAGE_ONLY_08 20908 8.22 16.02 4.25 58 HTML_FONT_SIZE_HUGE 20798 8.32 16.36 4.22 59 HTML_SHORT_LINK_IMG_1 20525 8.27 16.34 4.17 60 RCVD_IN_IADB_DK 20474 3.30 1.60 4.16 61 BAYES_80 20454 6.25 10.37 4.15 62 SHORTENER_SHORT_IMG 20381 8.17 16.08 4.14 63 URI_BUFFLY 20380 8.17 16.08 4.14 64 TR_XM_DK_Bayes 19736 2.93 0.82 4.01 65 XMSubMetaSx_00 19496 4.49 5.52 3.96 66 XMStrtUSub 18669 3.78 3.76 3.79 67 TR_XM_DK_Bayes1 18650 2.78 0.79 3.79 68 UNPARSEABLE_RELAY 18436 2.93 1.33 3.74 69 RCVD_IN_IADB_VOUCHED 17875 2.72 0.92 3.63 70 BAYES_40 17244 2.68 1.07 3.50 71 TVD_RCVD_IP 16947 2.35 0.20 3.44 72 FROM_EXCESS_BASE64 16048 9.46 21.65 3.26 73 HTML_IMAGE_RATIO_06 15657 3.59 4.40 3.18 74 TR_XM_DocInvoice 15499 4.22 6.33 3.15 75 XM_UncommonTLD01 15361 6.92 14.40 3.12 76 TR_XM_DK_Bayes2 15347 2.32 0.76 3.12 77 BAYES_95 14525 4.21 6.68 2.95 78 XMSexyCombo_05 14335 4.90 8.82 2.91 79 XMNumbers 13596 4.80 8.81 2.76 80 TooManyTo_002 13069 2.04 0.83 2.65 81 MPART_ALT_DIFF 13065 4.07 6.85 2.65 82 BAYES_20 11756 1.90 0.93 2.39 83 RCVD_IN_IADB_OPTIN 11304 1.71 0.55 2.30 84 MIME_HTML_MOSTLY 10860 2.95 4.42 2.21 85 MAILING_LIST_MULTI 10749 1.87 1.25 2.18 86 BAYES_05 10501 1.57 0.46 2.13 87 TR_Symld_Words 10179 1.95 1.72 2.07 88 TM2_M_URI_OPT_OUT 10027 2.62 3.78 2.04 89 HTML_MIME_NO_HTML_TAG 10001 7.46 18.13 2.03 90 RCVD_IN_MSPIKE_WL 9980 1.56 0.63 2.03 91 RCVD_IN_MSPIKE_H3 9976 1.55 0.63 2.03 92 HTML_IMAGE_RATIO_08 9776 2.51 3.54 1.99 93 XM_CamelCaseFrm001 9680 2.38 3.18 1.97 94 TooManyTo_003 9391 1.51 0.74 1.91 95 XM_SPF_SoftFail 9128 2.17 2.80 1.85 96 XM_DK_Undo_01 8946 1.68 1.40 1.82 97 HELO_NODOT 8928 1.27 0.21 1.81 98 SUBJ_ALL_CAPS 8733 1.83 1.93 1.77 99 IN_HORDE_ADDRESS_BOOK 8508 1.17 0.06 1.73 100 XM_DIRTYINTL 8367 2.20 3.17 1.70 101 URI_HEX 8012 1.98 2.68 1.63 102 USER_IN_DEF_DKIM_WL 7798 1.07 0.05 1.58 103 T_TooManySym_02 7734 1.53 1.46 1.57 104 XMDiploma_00 7311 1.72 2.20 1.49 105 T_XMDrugObfuBody_08 7284 1.63 1.92 1.48 106 INVALID_MSGID 7222 1.04 0.20 1.47 107 XMBdyGiftCard01 7054 1.36 1.22 1.43 108 XMCapTrack 6725 1.08 0.52 1.37 109 RELAYCOUNTRY_CA 6706 1.89 2.92 1.36 110 TO_MALFORMED 6482 0.87 0.00 1.32 111 XMStockSpam_06 6164 1.19 1.07 1.25 112 XM_H_PHPOS 6127 1.10 0.83 1.24 113 MIME_HTML_ONLY_MULTI 6121 1.97 3.39 1.24 114 XM_GoogleGroups 6115 0.97 0.44 1.24 115 XM_OfRef6 6084 1.65 2.45 1.24 116 DKIM_ADSP_CUSTOM_MED 5928 1.10 0.90 1.20 117 MISSING_HEADERS 5660 6.26 16.31 1.15 118 XMLngstWrd_00 5617 0.89 0.38 1.14 119 XMPhish11 5533 1.10 1.05 1.12 120 TooManyTo_004 5445 0.94 0.61 1.11 121 UNTRUSTED_Relay 5335 3.26 7.54 1.08 122 URI_TRY_3LD 5216 1.14 1.30 1.06 123 T_XMHurry_00 5179 1.11 1.23 1.05 124 BOTNET 5045 3.92 9.61 1.02 125 XMLngstWrd_01 5006 0.79 0.36 1.02 126 XM_H_Long_From02 4909 1.32 1.95 1.00 127 RELAYCOUNTRY_GB 4833 0.93 0.83 0.98 128 XM_ProductURIs 4796 1.02 1.12 0.97 129 XMSubMetaI_00 4737 1.34 2.10 0.96 130 XMSubNoVowel 4728 0.77 0.41 0.96 131 NML_ADSP_CUSTOM_MED 4636 0.88 0.75 0.94 132 XMGenDplmaNmb 4556 1.16 1.61 0.93 133 TooManyTo_005 4470 0.78 0.54 0.91 134 XMSexyCombo_01 4464 1.00 1.18 0.91 135 T_FILL_THIS_FORM_SHORT 4427 0.86 0.79 0.90 136 T_XMDrugObfuBody_00 4367 1.03 1.32 0.89 137 TO_IN_SUBJ 4315 0.66 0.22 0.88 138 TM2_M_VERY_LONG_WORD 4003 0.99 1.34 0.81 139 XMSubMetaSxObfu_03 3876 0.71 0.56 0.79 140 XM_H_PHPMailer 3714 0.71 0.61 0.75 141 XM_UB50 3626 1.65 3.44 0.74 142 REPLYTO_WITHOUT_TO_CC 3544 0.59 0.34 0.72 143 SpammyFromTLD_01 3476 1.19 2.14 0.71 144 T_TooManySym_03 3361 0.52 0.19 0.68 145 T_MONEY_PERCENT 3263 0.80 1.08 0.66 146 TR_LOTS_OF_MONEY2 3263 0.80 1.08 0.66 147 DIET_1 3101 1.14 2.14 0.63 148 FORGED_GMAIL_RCVD 3098 0.66 0.72 0.63 149 XMBody_78 3081 0.69 0.83 0.63 150 XMBody_29 2997 0.46 0.16 0.61 151 XMLngstWrd_02 2961 0.51 0.32 0.60 152 KHOP_DYNAMIC 2938 0.63 0.70 0.60 153 T_Symld_Words_02 2928 0.81 1.23 0.59 154 XMSubMetaSxObfu_02 2895 0.56 0.51 0.59 155 TR_MetaPhish_Combo_01 2875 0.57 0.55 0.58 156 XMSubLongNoVowel 2774 0.40 0.09 0.56 157 XMNoVowels 2746 0.48 0.34 0.56 158 TM2_M_A_HREF_HREF 2743 0.58 0.61 0.56 159 USER_IN_WHITELIST 2654 0.36 0.00 0.54 160 T_OBFU_PDF_ATTACH 2650 0.42 0.20 0.54 161 AC_DIV_BONANZA 2603 0.40 0.15 0.53 162 XM_B_REG_HTML 2582 0.55 0.59 0.52 163 XMSexyCombo_04 2470 0.49 0.48 0.50 164 XMBody_95 2437 0.38 0.15 0.50 165 HTML_FONT_FACE_BAD 2424 0.71 1.14 0.49 166 RELAYCOUNTRY_AU 2369 0.50 0.54 0.48 167 TR_XM_RelayPhish 2361 0.69 1.09 0.48 168 SHORT_HELO_AND_INLINE_IMAGE 2349 0.34 0.06 0.48 169 URI_NOVOWEL 2302 0.63 0.94 0.47 170 XMMoneyMeta_00 2296 0.98 1.98 0.47 171 XM_ShortIntro_01 2266 0.40 0.27 0.46 172 XMHTMLBadTable_001 2262 0.59 0.86 0.46 173 HTTPS_HTTP_MISMATCH 2219 0.51 0.61 0.45 174 XMBody_17 2200 0.77 1.41 0.45 175 XMBrknScrpt_02 2179 0.64 1.04 0.44 176 HTML_IMAGE_ONLY_32 2144 0.42 0.38 0.44 177 HTML_TAG_BALANCE_BODY 2138 0.55 0.78 0.43 178 XMGappySubj_01 2096 0.68 1.17 0.43 179 RCVD_IN_SORBS_DUL 2049 0.34 0.19 0.42 180 REMOVE_BEFORE_LINK 2032 0.59 0.95 0.41 181 XMPhish14 2009 0.61 1.01 0.41 182 TM2_M_BODY_EMPTY 1969 0.30 0.10 0.40 183 XMDateMe_00 1939 0.35 0.27 0.39 184 XMLngstWrd_03 1936 0.35 0.25 0.39 185 TR_LOTS_OF_MONEY3 1923 0.50 0.73 0.39 186 HTML_IMAGE_ONLY_28 1916 0.37 0.33 0.39 187 FILL_THIS_FORM 1872 0.47 0.64 0.38 188 RCVD_IN_BL_SPAMCOP_NET 1861 1.07 2.44 0.38 189 XM_H_PHPOS_M 1820 0.36 0.35 0.37 190 XM_B_COPY_HTML 1806 0.39 0.45 0.37 191 XMHTML_After_End 1789 0.64 1.19 0.36 192 RDNS_DYNAMIC 1786 0.52 0.82 0.36 193 XMPhish30 1752 0.61 1.12 0.36 194 HTML_IMAGE_ONLY_20 1639 0.38 0.47 0.33 195 XM_S_JOY_D 1635 0.33 0.32 0.33 196 UPPERCASE_50_75 1619 0.25 0.08 0.33 197 HTML_IMAGE_ONLY_24 1616 0.31 0.28 0.33 198 RELAYCOUNTRY_DE 1594 0.41 0.58 0.32 199 HTML_IMAGE_ONLY_16 1508 0.26 0.16 0.31 200 T_FILL_THIS_FORM_LONG 1503 0.40 0.60 0.31 ----------------------------------------------------------------------