Email: 343358 Autolearn: 0 AvgScore: 2.91 AvgScanTime: 2.01 sec Spam: 102578 Autolearn: 0 AvgScore: 12.79 AvgScanTime: 2.33 sec Ham: 240780 Autolearn: 0 AvgScore: -1.31 AvgScanTime: 1.88 sec Time Spent Running SA: 191.90 hours Time Spent Processing Spam: 66.38 hours Time Spent Processing Ham: 125.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96878 88.28 94.44 85.65 2 XMListUnsubscribeExists 79339 63.58 77.35 57.72 3 DKIM_SIGNED 79224 79.74 77.23 80.81 4 XM_DK_Pass 76187 77.94 74.27 79.51 5 DCC_CHECK 75432 55.09 73.54 47.23 6 DKIM_VALID 72173 74.56 70.36 76.35 7 DKIM_VALID_AU 60315 59.71 58.80 60.09 8 XM_DK_Undo_02 48565 28.57 47.34 20.57 9 XM_H_QuotedFrom 46682 40.76 45.51 38.74 10 BAYES_99 43300 25.88 42.21 18.92 11 BAYES_50 37630 44.06 36.68 47.20 12 BAYES_999 37128 22.78 36.19 17.07 13 MIME_HTML_ONLY 36425 26.42 35.51 22.55 14 LOC_TINY_FONT_1 35234 30.39 34.35 28.70 15 TR_DCC_Bayes_99 34188 16.71 33.33 9.63 16 HTML_FONT_LOW_CONTRAST 34054 33.13 33.20 33.10 17 FVGT_m_MULTI_ODD 31196 24.19 30.41 21.54 18 DCC_CHECK_NEGATIVE 25763 43.72 25.12 51.65 19 XM_Body_Dirty_Words 25434 17.40 24.79 14.25 20 RELAYCOUNTRY_META 25431 10.39 24.79 4.26 21 BOTNET 23890 8.41 23.29 2.07 22 XMSubLong 22783 21.81 22.21 21.64 23 BOTNET_IPINHOSTNAME 20693 11.68 20.17 8.06 24 T_KAM_HTML_FONT_INVALID 19462 16.67 18.97 15.70 25 DKIM_VALID_EF 19131 27.29 18.65 30.97 26 XM_Multi_Part_URI 18082 15.31 17.63 14.32 27 T_TM2_M_HEADER_IN_MSG 17096 21.88 16.67 24.10 28 UNTRUSTED_Relay 16498 5.67 16.08 1.23 29 XMSexyCombo_05 15928 7.31 15.53 3.81 30 MultiRelay 15595 16.02 15.20 16.36 31 HTML_IMAGE_RATIO_02 15258 12.17 14.87 11.01 32 XM_Evil_Numbers_Gen 13182 10.73 12.85 9.82 33 XMSubMetaSx_00 11542 6.45 11.25 4.41 34 LOTS_OF_MONEY 11385 10.40 11.10 10.10 35 HTML_IMAGE_RATIO_04 11274 7.94 10.99 6.64 36 XM_UB50 10816 3.67 10.54 0.75 37 LotsOfNums_01 10224 8.86 9.97 8.38 38 HTML_MIME_NO_HTML_TAG 10212 4.09 9.96 1.59 39 XM_DIRTYINTL 9942 4.82 9.69 2.75 40 RELAYCOUNTRY_FR 9818 3.01 9.57 0.21 41 FSL_BULK_SIG 9381 8.23 9.15 7.83 42 MPART_ALT_DIFF 9152 5.40 8.92 3.90 43 DKIM_ADSP_NXDOMAIN 9016 3.10 8.79 0.67 44 INVALID_MSGID 8299 4.53 8.09 3.02 45 T_XMDrugObfuBody_14 8204 8.01 8.00 8.02 46 MIME_HTML_MOSTLY 7668 4.11 7.48 2.68 47 TooManyTo_001 7371 6.42 7.19 6.09 48 XM_E_Blogspot 7331 2.22 7.15 0.11 49 XM_B_Phish_Phrases 7310 7.07 7.13 7.04 50 XM_H_Long_From01 7140 6.95 6.96 6.95 51 DKIM_INVALID 7051 5.18 6.87 4.46 52 XM_UncommonTLD01 6728 4.86 6.56 4.13 53 BAYES_80 6003 4.76 5.85 4.30 54 BAYES_60 5792 6.13 5.65 6.34 55 FROM_EXCESS_BASE64 5561 5.48 5.42 5.50 56 XMSexyCombo_01 5328 2.07 5.19 0.75 57 RCVD_IN_RP_SAFE 5295 12.67 5.16 15.87 58 XMSubMetaSxObfu_03 4653 1.61 4.54 0.37 59 HTML_IMAGE_RATIO_06 4554 3.98 4.44 3.79 60 XM_CamelCaseFrm001 4541 2.57 4.43 1.78 61 XMStrtUSub 4507 4.90 4.39 5.11 62 XMBdyGiftCard01 4137 2.39 4.03 1.69 63 T_REMOTE_IMAGE 4107 3.68 4.00 3.55 64 RELAYCOUNTRY_CA 3925 2.18 3.83 1.48 65 XMSexyCombo_04 3860 1.29 3.76 0.23 66 MIME_HTML_ONLY_MULTI 3857 2.54 3.76 2.02 67 XM_SendGrid 3810 6.10 3.71 7.11 68 RCVD_IN_RP_CERTIFIED 3712 11.35 3.62 14.65 69 TR_XM_PHPDW 3666 1.68 3.57 0.87 70 TR_XM_PHPForged 3617 1.65 3.53 0.86 71 BAYES_95 3604 3.14 3.51 2.98 72 TR_XM_FormFill2 3597 1.64 3.51 0.84 73 XM_H_PHPOS 3582 1.63 3.49 0.84 74 RCVD_IN_BL_SPAMCOP_NET 3330 1.35 3.25 0.54 75 XMNumbers 3249 3.21 3.17 3.23 76 BAYES_40 3088 3.18 3.01 3.25 77 SUBJ_ALL_CAPS 3069 2.90 2.99 2.86 78 URI_HEX 3003 2.11 2.93 1.76 79 XM_SPF_SoftFail 2970 1.71 2.90 1.20 80 MIME_QP_LONG_LINE 2893 4.12 2.82 4.67 81 T_TooManySym_01 2842 6.44 2.77 8.00 82 HTML_IMAGE_RATIO_08 2669 2.15 2.60 1.96 83 DKIM_ADSP_CUSTOM_MED 2665 1.34 2.60 0.81 84 NML_ADSP_CUSTOM_MED 2631 1.13 2.56 0.52 85 SUBJ_DOLLARS 2618 1.32 2.55 0.80 86 RELAYCOUNTRY_DE 2606 0.97 2.54 0.30 87 XMSexyCombo_03 2601 0.76 2.54 0.00 88 RCVD_IN_MSPIKE_H2 2525 4.06 2.46 4.74 89 RDNS_DYNAMIC 2452 1.20 2.39 0.70 90 NUMERIC_HTTP_ADDR 2437 0.92 2.38 0.29 91 TM2_M_URI_OPT_OUT 2432 1.59 2.37 1.26 92 XM_OfRef6 2351 1.73 2.29 1.49 93 T_XMDrugObfuBody_08 2346 1.52 2.29 1.19 94 ALL_TRUSTED 2227 10.81 2.17 14.49 95 XM_URI_RBL 2195 1.22 2.14 0.83 96 RELAYCOUNTRY_GB 2151 1.12 2.10 0.70 97 T_XMDrugObfuBody_00 2095 1.18 2.04 0.81 98 NORMAL_HTTP_TO_IP 2081 0.68 2.03 0.10 99 TR_Caps_n_Bayes_99 2022 1.18 1.97 0.84 100 XMBody_17 1983 0.99 1.93 0.60 101 RCVD_IN_RP_RNBL 1980 0.64 1.93 0.10 102 MultiRelay_Combo 1978 0.67 1.93 0.13 103 MultiRelay_CC 1978 0.67 1.93 0.13 104 T_Symld_Words_02 1968 0.84 1.92 0.38 105 XMSubject_48 1961 0.58 1.91 0.02 106 NO_DNS_FOR_FROM 1936 1.56 1.89 1.42 107 MSGID_FROM_MTA_HEADER 1893 0.69 1.85 0.19 108 DIET_1 1883 0.88 1.84 0.48 109 XM_UB60 1789 0.61 1.74 0.13 110 MAILING_LIST_MULTI 1742 1.96 1.70 2.07 111 INVALID_DATE 1700 0.58 1.66 0.12 112 XMDiploma_00 1697 1.40 1.65 1.30 113 XM_H_MAILSPLOIT 1656 0.50 1.61 0.03 114 XMSubMetaI_00 1629 0.97 1.59 0.71 115 XMPhish11 1618 1.17 1.58 0.99 116 TR_XM_RelayPhish 1574 1.24 1.53 1.12 117 TM2_M_VERY_LONG_WORD 1566 1.45 1.53 1.42 118 BAYES_20 1537 2.12 1.50 2.38 119 TR_XM_DK_SendGrid 1510 3.13 1.47 3.83 120 XMSubMetaSSx_00 1507 0.62 1.47 0.26 121 RCVD_IN_IADB_LISTED 1507 3.50 1.47 4.37 122 SpammyFromTLD_02 1479 0.55 1.44 0.16 123 URI_TRY_3LD 1474 1.69 1.44 1.79 124 XM_UB99 1440 0.43 1.40 0.01 125 XM_H_PHPMailer 1434 0.88 1.40 0.66 126 UNPARSEABLE_RELAY 1430 4.35 1.39 5.60 127 XM_B_REG_HTML 1422 0.90 1.39 0.69 128 BODY_ENHANCEMENT 1407 0.44 1.37 0.04 129 XMPhish30 1361 0.83 1.33 0.62 130 URIBL_BLACK 1339 0.44 1.31 0.07 131 T_XMHurry_00 1304 0.91 1.27 0.75 132 XM_H_Long_From02 1283 1.01 1.25 0.91 133 XM_RXBody 1247 0.59 1.22 0.33 134 RCVD_IN_IADB_SPF 1222 3.04 1.19 3.83 135 BOTNET_NORDNS 1217 0.36 1.19 0.01 136 XM_H_PHPOS_M 1213 0.57 1.18 0.31 137 RELAYCOUNTRY_AT 1205 0.50 1.17 0.21 138 XMSlimDrugH 1203 0.60 1.17 0.36 139 HELO_DYNAMIC_IPADDR 1188 0.43 1.16 0.12 140 XMHTML_ManyTags1 1186 0.35 1.16 0.01 141 AC_BR_BONANZA 1184 0.36 1.15 0.02 142 SpammyFromTLD_01 1166 0.62 1.14 0.40 143 XM_UB999 1160 0.35 1.13 0.01 144 XM_ProductURIs 1128 0.90 1.10 0.81 145 XMStockSpam_06 1124 0.92 1.10 0.85 146 XMGenDplmaNmb 1105 0.76 1.08 0.63 147 TR_Symld_Words 1087 1.77 1.06 2.07 148 T_TooManySym_02 1082 2.24 1.05 2.75 149 RCVD_IN_IADB_SENDERID 1077 2.70 1.05 3.40 150 SHORT_URI_3 1073 0.51 1.05 0.28 151 RCVD_IN_IADB_VOUCHED 1043 2.26 1.02 2.79 152 FILL_THIS_FORM 1031 1.10 1.01 1.14 153 RCVD_IN_IADB_DK 1027 2.61 1.00 3.30 154 XMHTMLBadTable_001 1024 0.64 1.00 0.48 155 LONG_JUNK_URI 982 0.34 0.96 0.08 156 FILL_THIS_FORM_LONG 982 0.60 0.96 0.45 157 URI_NOVOWEL 962 0.58 0.94 0.42 158 HTML_TAG_BALANCE_BODY 932 0.77 0.91 0.71 159 XMBrknScrpt_02 929 0.87 0.91 0.86 160 XM_B_COPY_HTML 925 0.80 0.90 0.76 161 TR_LOTS_OF_MONEY2 872 0.41 0.85 0.23 162 T_MONEY_PERCENT 872 0.41 0.85 0.23 163 FORGED_GMAIL_RCVD 867 0.56 0.85 0.44 164 TR_MetaPhish_Combo_01 862 1.91 0.84 2.36 165 REPLYTO_WITHOUT_TO_CC 849 0.29 0.83 0.06 166 T_FILL_THIS_FORM_SHORT 848 0.75 0.83 0.71 167 TVD_SPACE_RATIO_MINFP 843 0.25 0.82 0.01 168 TooManyTo_002 842 1.22 0.82 1.39 169 PLING_QUERY 841 0.58 0.82 0.48 170 XM_UB80 823 0.26 0.80 0.02 171 XMMoneyMeta_00 807 0.41 0.79 0.25 172 XM_BadFromFormat 807 0.31 0.79 0.11 173 RCVD_IN_IADB_OPTIN 797 1.48 0.78 1.79 174 XM_H_Undi_Recip 793 0.39 0.77 0.23 175 FILL_THIS_FORM_LOAN 789 0.54 0.77 0.44 176 XMSubMetaSxObfu_02 785 0.88 0.77 0.93 177 XM_ShortIntro_01 783 0.49 0.76 0.37 178 HTML_SHORT_LINK_IMG_1 782 0.25 0.76 0.04 179 XMBody_78 778 0.55 0.76 0.46 180 TM2_M_A_HREF_HREF 765 1.07 0.75 1.20 181 BAYES_05 758 1.29 0.74 1.52 182 MISSING_HEADERS 737 0.38 0.72 0.24 183 FROM_SUSPICIOUS_NTLD 732 0.24 0.71 0.04 184 TR_Mismatch_TLD_02 723 0.27 0.70 0.08 185 XMGppyBdWords 721 0.28 0.70 0.10 186 TooManyTo_003 700 0.85 0.68 0.93 187 HK_RANDOM_REPLYTO 676 0.36 0.66 0.23 188 TVD_SPACE_RATIO 676 0.38 0.66 0.26 189 T_HTML_TAG_BALANCE_CENTER 672 0.25 0.66 0.08 190 XM_HighProb1 654 0.27 0.64 0.11 191 XMClaimOffer 651 0.27 0.63 0.12 192 XMWghtMeta_00 648 0.23 0.63 0.06 193 DATE_IN_PAST_12_24 648 0.25 0.63 0.09 194 XMHTML_After_End 645 0.42 0.63 0.33 195 URIBL_DBL_SPAM 642 0.19 0.63 0.01 196 XM_XX_Yahoo 639 0.30 0.62 0.16 197 BAYES_00 632 9.14 0.62 12.77 198 XMPhish14 611 0.40 0.60 0.31 199 LongTLD 608 0.26 0.59 0.12 200 XMBody_95 603 0.97 0.59 1.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 206230 88.28 94.44 85.65 2 DKIM_SIGNED 194563 79.74 77.23 80.81 3 XM_DK_Pass 191433 77.94 74.27 79.51 4 DKIM_VALID 183835 74.56 70.36 76.35 5 DKIM_VALID_AU 144692 59.71 58.80 60.09 6 XMListUnsubscribeExists 138982 63.58 77.35 57.72 7 DCC_CHECK_NEGATIVE 124361 43.72 25.12 51.65 8 DCC_CHECK 113710 55.09 73.54 47.23 9 BAYES_50 113655 44.06 36.68 47.20 10 XM_H_QuotedFrom 93281 40.76 45.51 38.74 11 HTML_FONT_LOW_CONTRAST 79702 33.13 33.20 33.10 12 DKIM_VALID_EF 74567 27.29 18.65 30.97 13 LOC_TINY_FONT_1 69112 30.39 34.35 28.70 14 T_TM2_M_HEADER_IN_MSG 58026 21.88 16.67 24.10 15 MIME_HTML_ONLY 54291 26.42 35.51 22.55 16 XMSubLong 52105 21.81 22.21 21.64 17 FVGT_m_MULTI_ODD 51863 24.19 30.41 21.54 18 XM_DK_Undo_02 49519 28.57 47.34 20.57 19 BAYES_99 45561 25.88 42.21 18.92 20 BAYES_999 41090 22.78 36.19 17.07 21 MultiRelay 39399 16.02 15.20 16.36 22 XM_DKIMWhitelistDomains 39253 11.59 0.52 16.30 23 RCVD_IN_RP_SAFE 38206 12.67 5.16 15.87 24 T_KAM_HTML_FONT_INVALID 37791 16.67 18.97 15.70 25 RCVD_IN_RP_CERTIFIED 35263 11.35 3.62 14.65 26 ALL_TRUSTED 34897 10.81 2.17 14.49 27 XM_Multi_Part_URI 34470 15.31 17.63 14.32 28 XM_Body_Dirty_Words 34302 17.40 24.79 14.25 29 BAYES_00 30749 9.14 0.62 12.77 30 TR_XM_DK_Bayes 27874 8.26 0.48 11.58 31 TR_XM_DK_Bayes1 26860 7.94 0.40 11.16 32 HTML_IMAGE_RATIO_02 26518 12.17 14.87 11.01 33 TR_XM_DK_Bayes2 24562 7.24 0.28 10.20 34 LOTS_OF_MONEY 24311 10.40 11.10 10.10 35 XM_Evil_Numbers_Gen 23645 10.73 12.85 9.82 36 TR_DCC_Bayes_99 23185 16.71 33.33 9.63 37 LotsOfNums_01 20184 8.86 9.97 8.38 38 BOTNET_IPINHOSTNAME 19418 11.68 20.17 8.06 39 T_XMDrugObfuBody_14 19308 8.01 8.00 8.02 40 T_TooManySym_01 19263 6.44 2.77 8.00 41 FSL_BULK_SIG 18865 8.23 9.15 7.83 42 XM_SendGrid 17125 6.10 3.71 7.11 43 XM_B_Phish_Phrases 16961 7.07 7.13 7.04 44 XM_H_Long_From01 16725 6.95 6.96 6.95 45 HTML_IMAGE_RATIO_04 15993 7.94 10.99 6.64 46 BAYES_60 15256 6.13 5.65 6.34 47 TooManyTo_001 14667 6.42 7.19 6.09 48 UNPARSEABLE_RELAY 13492 4.35 1.39 5.60 49 TO_MALFORMED 13375 3.90 0.00 5.55 50 FROM_EXCESS_BASE64 13243 5.48 5.42 5.50 51 XMStrtUSub 12306 4.90 4.39 5.11 52 TVD_RCVD_IP 12135 3.67 0.46 5.04 53 RCVD_IN_MSPIKE_H2 11406 4.06 2.46 4.74 54 MIME_QP_LONG_LINE 11250 4.12 2.82 4.67 55 DKIM_INVALID 10728 5.18 6.87 4.46 56 XMSubMetaSx_00 10616 6.45 11.25 4.41 57 RCVD_IN_IADB_LISTED 10518 3.50 1.47 4.37 58 BAYES_80 10351 4.76 5.85 4.30 59 RELAYCOUNTRY_META 10252 10.39 24.79 4.26 60 XM_UncommonTLD01 9949 4.86 6.56 4.13 61 IN_ZIMBRA_NJ_WHITELIST 9480 2.76 0.01 3.94 62 MPART_ALT_DIFF 9399 5.40 8.92 3.90 63 TR_XM_DK_SendGrid 9223 3.13 1.47 3.83 64 RCVD_IN_IADB_SPF 9220 3.04 1.19 3.83 65 XMSexyCombo_05 9162 7.31 15.53 3.81 66 HTML_IMAGE_RATIO_06 9127 3.98 4.44 3.79 67 RCVD_IN_MSPIKE_H3 8637 2.65 0.45 3.59 68 RCVD_IN_MSPIKE_WL 8637 2.65 0.45 3.59 69 T_REMOTE_IMAGE 8539 3.68 4.00 3.55 70 RCVD_IN_IADB_SENDERID 8192 2.70 1.05 3.40 71 RCVD_IN_IADB_DK 7939 2.61 1.00 3.30 72 BAYES_40 7830 3.18 3.01 3.25 73 XMNumbers 7781 3.21 3.17 3.23 74 INVALID_MSGID 7269 4.53 8.09 3.02 75 BAYES_95 7179 3.14 3.51 2.98 76 SUBJ_ALL_CAPS 6877 2.90 2.99 2.86 77 RCVD_IN_IADB_VOUCHED 6714 2.26 1.02 2.79 78 T_TooManySym_02 6624 2.24 1.05 2.75 79 XM_DIRTYINTL 6621 4.82 9.69 2.75 80 MIME_HTML_MOSTLY 6451 4.11 7.48 2.68 81 BAYES_20 5734 2.12 1.50 2.38 82 TR_MetaPhish_Combo_01 5680 1.91 0.84 2.36 83 IN_HORDE_ADDRESS_BOOK 5254 1.54 0.04 2.18 84 XM_PDF 5024 1.54 0.26 2.09 85 MAILING_LIST_MULTI 4992 1.96 1.70 2.07 86 TR_Symld_Words 4987 1.77 1.06 2.07 87 BOTNET 4984 8.41 23.29 2.07 88 MIME_HTML_ONLY_MULTI 4873 2.54 3.76 2.02 89 USER_IN_DEF_DKIM_WL 4764 1.39 0.02 1.98 90 HTML_IMAGE_RATIO_08 4729 2.15 2.60 1.96 91 ANY_BOUNCE_MESSAGE 4615 1.42 0.24 1.92 92 BOUNCE_MESSAGE 4614 1.42 0.24 1.92 93 URI_TRY_3LD 4317 1.69 1.44 1.79 94 RCVD_IN_IADB_OPTIN 4301 1.48 0.78 1.79 95 XM_CamelCaseFrm001 4285 2.57 4.43 1.78 96 URI_HEX 4245 2.11 2.93 1.76 97 XMBdyGiftCard01 4075 2.39 4.03 1.69 98 HTML_MIME_NO_HTML_TAG 3835 4.09 9.96 1.59 99 XM_DK_Undo_01 3818 1.26 0.49 1.59 100 BAYES_05 3662 1.29 0.74 1.52 101 XM_OfRef6 3599 1.73 2.29 1.49 102 RELAYCOUNTRY_CA 3553 2.18 3.83 1.48 103 NO_DNS_FOR_FROM 3428 1.56 1.89 1.42 104 TM2_M_VERY_LONG_WORD 3412 1.45 1.53 1.42 105 TooManyTo_002 3356 1.22 0.82 1.39 106 XM_GoogleGroups 3125 1.03 0.39 1.30 107 XMDiploma_00 3121 1.40 1.65 1.30 108 TM2_M_URI_OPT_OUT 3044 1.59 2.37 1.26 109 UNTRUSTED_Relay 2965 5.67 16.08 1.23 110 XM_SPF_SoftFail 2900 1.71 2.90 1.20 111 TM2_M_A_HREF_HREF 2893 1.07 0.75 1.20 112 T_XMDrugObfuBody_08 2863 1.52 2.29 1.19 113 FILL_THIS_FORM 2733 1.10 1.01 1.14 114 XMBody_95 2726 0.97 0.59 1.13 115 TR_XM_RelayPhish 2694 1.24 1.53 1.12 116 XMPhish11 2393 1.17 1.58 0.99 117 USER_IN_WHITELIST 2338 0.68 0.00 0.97 118 XMSubMetaSxObfu_02 2229 0.88 0.77 0.93 119 TooManyTo_003 2228 0.85 0.68 0.93 120 XM_H_Long_From02 2198 1.01 1.25 0.91 121 TR_XM_PHPDW 2098 1.68 3.57 0.87 122 XMBrknScrpt_02 2071 0.87 0.91 0.86 123 TR_XM_PHPForged 2059 1.65 3.53 0.86 124 XMStockSpam_06 2036 0.92 1.10 0.85 125 TR_XM_FormFill2 2028 1.64 3.51 0.84 126 XM_H_PHPOS 2024 1.63 3.49 0.84 127 TR_Caps_n_Bayes_99 2022 1.18 1.97 0.84 128 XM_URI_RBL 2001 1.22 2.14 0.83 129 T_XMDrugObfuBody_00 1960 1.18 2.04 0.81 130 XM_ProductURIs 1956 0.90 1.10 0.81 131 DKIM_ADSP_CUSTOM_MED 1943 1.34 2.60 0.81 132 T_TooManySym_03 1933 0.60 0.11 0.80 133 SUBJ_DOLLARS 1930 1.32 2.55 0.80 134 XM_D_tchamptons_WL 1914 0.56 0.00 0.79 135 XM_B_COPY_HTML 1826 0.80 0.90 0.76 136 T_XMHurry_00 1815 0.91 1.27 0.75 137 XM_UB50 1796 3.67 10.54 0.75 138 XMSexyCombo_01 1795 2.07 5.19 0.75 139 TooManyTo_004 1751 0.68 0.58 0.73 140 T_FILL_THIS_FORM_SHORT 1714 0.75 0.83 0.71 141 XMSubMetaI_00 1711 0.97 1.59 0.71 142 HTML_TAG_BALANCE_BODY 1703 0.77 0.91 0.71 143 RELAYCOUNTRY_GB 1686 1.12 2.10 0.70 144 RDNS_DYNAMIC 1685 1.20 2.39 0.70 145 XM_B_REG_HTML 1665 0.90 1.39 0.69 146 DKIM_ADSP_NXDOMAIN 1617 3.10 8.79 0.67 147 XM_H_PHPMailer 1589 0.88 1.40 0.66 148 TooManyTo_005 1550 0.60 0.49 0.64 149 XMGenDplmaNmb 1510 0.76 1.08 0.63 150 XMPhish30 1501 0.83 1.33 0.62 151 XMBody_17 1433 0.99 1.93 0.60 152 HELO_NODOT 1388 0.48 0.27 0.58 153 HELO_NO_DOMAIN 1387 0.48 0.27 0.58 154 XMNoVowels 1351 0.47 0.26 0.56 155 XM_Ancestry_Forge 1347 0.40 0.02 0.56 156 RCVD_IN_BL_SPAMCOP_NET 1309 1.35 3.25 0.54 157 NML_ADSP_CUSTOM_MED 1262 1.13 2.56 0.52 158 XMHTMLBadTable_001 1160 0.64 1.00 0.48 159 PLING_QUERY 1158 0.58 0.82 0.48 160 DIET_1 1147 0.88 1.84 0.48 161 XMBody_78 1098 0.55 0.76 0.46 162 HTML_FONT_FACE_BAD 1093 0.49 0.57 0.45 163 XMLngstWrd_00 1081 0.41 0.32 0.45 164 FILL_THIS_FORM_LONG 1077 0.60 0.96 0.45 165 FILL_THIS_FORM_LOAN 1071 0.54 0.77 0.44 166 FORGED_GMAIL_RCVD 1052 0.56 0.85 0.44 167 XMCapTrack 1038 0.35 0.15 0.43 168 T_TooManySym_04 1029 0.31 0.03 0.43 169 RELAYCOUNTRY_AU 1028 0.40 0.35 0.43 170 URI_NOVOWEL 1017 0.58 0.94 0.42 171 HTTPS_HTTP_MISMATCH 1014 0.37 0.24 0.42 172 XMLngstWrd_01 974 0.37 0.29 0.40 173 SpammyFromTLD_01 961 0.62 1.14 0.40 174 XMBSHREFv2 953 0.39 0.39 0.40 175 XMSolicitRefs_0 922 0.39 0.41 0.38 176 T_Symld_Words_02 913 0.84 1.92 0.38 177 XM_S_JOY_D 894 0.33 0.23 0.37 178 XM_ShortIntro_01 891 0.49 0.76 0.37 179 XMSubMetaSxObfu_03 888 1.61 4.54 0.37 180 XMSlimDrugH 873 0.60 1.17 0.36 181 XMRcvdHeader_15 831 0.24 0.00 0.35 182 LOW_PRICE 811 0.34 0.35 0.34 183 XM_Akamai 794 0.23 0.01 0.33 184 XM_RXBody 790 0.59 1.22 0.33 185 XMHTML_After_End 786 0.42 0.63 0.33 186 XM_Body_Obfu01 768 0.30 0.25 0.32 187 XM_H_PHPOS_M 757 0.57 1.18 0.31 188 XMPhish14 755 0.40 0.60 0.31 189 TR_LOTS_OF_MONEY3 745 0.39 0.57 0.31 190 XMSUPPORT 740 0.22 0.00 0.31 191 TM2_M_BODY_EMPTY 724 0.26 0.15 0.30 192 RELAYCOUNTRY_DE 721 0.97 2.54 0.30 193 NUMERIC_HTTP_ADDR 707 0.92 2.38 0.29 194 XM_H_SpoofStaff4 688 0.22 0.06 0.29 195 XM_Walgreens_Forge 683 0.20 0.01 0.28 196 SHORT_URI_3 676 0.51 1.05 0.28 197 BASE64_LENGTH_79_INF 667 0.21 0.06 0.28 198 TR_MetaPhish_Combo_01b 641 0.20 0.04 0.27 199 XMGappySubj_01 638 0.26 0.23 0.26 200 HTML_IMAGE_ONLY_24 632 0.29 0.36 0.26 ----------------------------------------------------------------------