Email: 295424 Autolearn: 0 AvgScore: 2.86 AvgScanTime: 3.25 sec Spam: 93623 Autolearn: 0 AvgScore: 12.95 AvgScanTime: 4.30 sec Ham: 201801 Autolearn: 0 AvgScore: -1.82 AvgScanTime: 2.76 sec Time Spent Running SA: 266.85 hours Time Spent Processing Spam: 111.95 hours Time Spent Processing Ham: 154.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89489 81.37 95.58 74.77 2 DKIM_SIGNED 82061 72.25 87.65 65.10 3 XM_DK_Pass 80002 70.96 85.45 64.24 4 DCC_CHECK 75976 52.13 81.15 38.67 5 DKIM_VALID 75272 66.91 80.40 60.65 6 XMListUnsubscribeExists 72253 53.50 77.17 42.52 7 DKIM_VALID_AU 63634 54.55 67.97 48.33 8 XM_H_QuotedFrom 52466 42.49 56.04 36.20 9 XM_DK_Undo_02 50643 29.74 54.09 18.44 10 BAYES_99 45579 27.38 48.68 17.49 11 BAYES_999 39836 24.28 42.55 15.80 12 LOC_TINY_FONT_1 37809 28.00 40.38 22.26 13 TR_DCC_Bayes_99 36512 19.15 39.00 9.94 14 HTML_FONT_LOW_CONTRAST 35696 30.50 38.13 26.96 15 MIME_HTML_ONLY 29279 22.21 31.27 18.00 16 BAYES_50 25471 42.90 27.21 50.18 17 FVGT_m_MULTI_ODD 25391 20.52 27.12 17.46 18 HTML_IMAGE_RATIO_02 22983 13.72 24.55 8.69 19 XM_Body_Dirty_Words 21898 14.01 23.39 9.66 20 XMSubLong 21769 19.68 23.25 18.02 21 DKIM_VALID_EF 19829 24.03 21.18 25.36 22 T_KAM_HTML_FONT_INVALID 16938 12.79 18.09 10.32 23 T_TM2_M_HEADER_IN_MSG 16709 25.87 17.85 29.59 24 RELAYCOUNTRY_META 16592 8.39 17.72 4.07 25 DCC_CHECK_NEGATIVE 16166 46.56 17.27 60.15 26 XM_Multi_Part_URI 15148 12.20 16.18 10.36 27 BOTNET 14588 6.19 15.58 1.83 28 XM_Evil_Numbers_Gen 13471 10.09 14.39 8.09 29 MultiRelay 13403 13.63 14.32 13.31 30 BOTNET_IPINHOSTNAME 12401 7.78 13.25 5.25 31 XMSexyCombo_05 11774 6.38 12.58 3.50 32 XM_B_Phish_Phrases 10572 6.79 11.29 4.70 33 UNTRUSTED_Relay 10513 4.39 11.23 1.22 34 LOTS_OF_MONEY 10096 7.93 10.78 6.60 35 HTML_IMAGE_RATIO_04 9838 9.64 10.51 9.23 36 FSL_BULK_SIG 9565 9.80 10.22 9.60 37 FROM_EXCESS_BASE64 9370 6.10 10.01 4.29 38 T_XMDrugObfuBody_14 8959 7.01 9.57 5.82 39 RCVD_IN_RP_SAFE 8000 11.32 8.54 12.61 40 TooManyTo_001 7990 7.07 8.53 6.39 41 XM_H_Long_From01 7916 12.92 8.46 14.99 42 LotsOfNums_01 7731 6.70 8.26 5.98 43 XMSubMetaSx_00 7358 4.78 7.86 3.35 44 RCVD_IN_RP_CERTIFIED 7139 10.39 7.63 11.67 45 MPART_ALT_DIFF 6828 4.19 7.29 2.74 46 BAYES_80 6809 4.74 7.27 3.56 47 DKIM_INVALID 6789 5.34 7.25 4.45 48 XM_UncommonTLD01 6786 5.33 7.25 4.44 49 TR_XM_DocInvoice 6149 4.67 6.57 3.78 50 NO_DNS_FOR_FROM 5771 4.28 6.16 3.40 51 BAYES_60 5410 5.85 5.78 5.89 52 T_REMOTE_IMAGE 5273 4.28 5.63 3.65 53 XMNumbers 5071 4.44 5.42 3.99 54 BAYES_95 4821 3.40 5.15 2.59 55 XMStrtUSub 4394 6.87 4.69 7.89 56 MIME_HTML_MOSTLY 4137 3.17 4.42 2.59 57 XM_SendGrid 4110 4.37 4.39 4.36 58 HTML_IMAGE_RATIO_06 3908 3.13 4.17 2.64 59 RELAYCOUNTRY_CA 3876 2.10 4.14 1.16 60 HTML_IMAGE_RATIO_08 3790 2.60 4.05 1.92 61 TM2_M_URI_OPT_OUT 3781 2.24 4.04 1.40 62 XM_UB50 3738 1.79 3.99 0.76 63 XM_DIRTYINTL 3641 2.08 3.89 1.25 64 MIME_QP_LONG_LINE 3498 3.53 3.74 3.44 65 XM_SPF_SoftFail 3231 1.88 3.45 1.15 66 RCVD_IN_BL_SPAMCOP_NET 3160 1.24 3.38 0.24 67 HTML_MIME_NO_HTML_TAG 3106 2.09 3.32 1.52 68 XM_CamelCaseFrm001 3024 2.11 3.23 1.60 69 XMBody_17 2853 1.23 3.05 0.39 70 RCVD_IN_MSPIKE_H2 2796 2.93 2.99 2.90 71 MultiRelay_Combo 2766 1.04 2.95 0.15 72 MultiRelay_CC 2766 1.04 2.95 0.15 73 SUBJ_ALL_CAPS 2635 7.96 2.81 10.35 74 MIME_HTML_ONLY_MULTI 2626 1.58 2.80 1.01 75 SpammyFromTLD_01 2623 1.10 2.80 0.32 76 T_TooManySym_01 2618 4.47 2.80 5.24 77 URI_HEX 2594 1.91 2.77 1.51 78 XM_BadFromFormat 2543 1.02 2.72 0.23 79 BOTNET_NORDNS 2471 0.85 2.64 0.02 80 XMBdyGiftCard01 2377 1.55 2.54 1.10 81 XM_OfRef6 2217 1.87 2.37 1.63 82 XMSexyCombo_01 2173 0.99 2.32 0.37 83 BAYES_00 2151 5.90 2.30 7.57 84 RCVD_IN_RP_RNBL 2067 0.71 2.21 0.02 85 XMDiploma_00 2033 1.36 2.17 0.98 86 RELAYCOUNTRY_FR 2020 0.86 2.16 0.26 87 XMPhish30 2018 0.93 2.16 0.37 88 T_HTML_TAG_BALANCE_CENTER 2015 0.79 2.15 0.16 89 T_XMDrugObfuBody_08 1966 1.29 2.10 0.92 90 PLING_QUERY 1904 0.89 2.03 0.37 91 XM_UB99 1846 0.64 1.97 0.03 92 XM_RXBody 1839 0.71 1.96 0.13 93 TR_XM_DK_Bayes 1801 3.78 1.92 4.64 94 TM2_M_VERY_LONG_WORD 1780 1.21 1.90 0.89 95 UNPARSEABLE_RELAY 1770 3.47 1.89 4.21 96 TR_XM_DK_Bayes1 1725 3.53 1.84 4.31 97 XM_ProductURIs 1707 1.50 1.82 1.35 98 DKIM_ADSP_CUSTOM_MED 1706 1.19 1.82 0.89 99 XM_URI_RBL 1689 0.65 1.80 0.11 100 T_XMDrugObfuBody_00 1621 0.94 1.73 0.57 101 NML_ADSP_CUSTOM_MED 1583 0.94 1.69 0.60 102 TR_XM_DK_Bayes2 1581 3.22 1.69 3.93 103 RCVD_IN_IADB_LISTED 1566 2.85 1.67 3.39 104 T_XMHurry_00 1550 0.76 1.66 0.34 105 XM_B_REG_HTML 1546 1.10 1.65 0.85 106 RELAYCOUNTRY_AT 1536 0.61 1.64 0.12 107 XM_H_Long_From02 1526 0.95 1.63 0.64 108 XMSubMetaI_00 1514 0.82 1.62 0.45 109 URIBL_DBL_SPAM 1484 0.54 1.59 0.05 110 HTML_IMAGE_ONLY_08 1474 0.60 1.57 0.14 111 MAILING_LIST_MULTI 1467 1.91 1.57 2.07 112 BAYES_40 1463 5.41 1.56 7.20 113 HTML_SHORT_LINK_IMG_1 1457 0.51 1.56 0.03 114 XMSexyCombo_04 1445 0.54 1.54 0.07 115 URIBL_BLACK 1408 0.49 1.50 0.03 116 XM_UB999 1401 0.49 1.50 0.02 117 RCVD_IN_IADB_SPF 1377 2.51 1.47 2.99 118 RCVD_IN_MSPIKE_WL 1370 2.00 1.46 2.25 119 RCVD_IN_MSPIKE_H3 1370 2.00 1.46 2.25 120 XM_DK_Undo_01 1339 1.54 1.43 1.59 121 DKIM_ADSP_NXDOMAIN 1326 0.75 1.42 0.44 122 RCVD_IN_IADB_SENDERID 1313 2.28 1.40 2.69 123 T_FILL_THIS_FORM_SHORT 1308 0.76 1.40 0.47 124 BODY_ENHANCEMENT 1306 0.54 1.39 0.14 125 RELAYCOUNTRY_CN 1305 0.45 1.39 0.02 126 FSL_THIS_IS_ADV 1298 0.51 1.39 0.10 127 XMBody_78 1293 0.75 1.38 0.45 128 DATE_IN_PAST_12_24 1292 0.52 1.38 0.12 129 RCVD_IN_PSBL 1289 0.55 1.38 0.16 130 RCVD_IN_IADB_DK 1282 2.24 1.37 2.64 131 LONG_JUNK_URI3 1235 0.48 1.32 0.10 132 HTML_FONT_SIZE_HUGE 1225 0.52 1.31 0.16 133 MPART_ALT_DIFF_COUNT 1214 0.59 1.30 0.27 134 XMGenDplmaNmb 1205 0.81 1.29 0.59 135 SpammyFromTLD_02 1198 0.51 1.28 0.15 136 BAYES_20 1178 2.38 1.26 2.90 137 FORGED_GMAIL_RCVD 1175 0.66 1.26 0.38 138 ALL_TRUSTED 1169 18.33 1.25 26.26 139 XM_B_COPY_HTML 1159 0.87 1.24 0.70 140 XMStockSpam_06 1156 1.49 1.23 1.62 141 SUBJ_DOLLARS 1148 0.46 1.23 0.10 142 TooManyTo_002 1144 1.49 1.22 1.62 143 XM_UB60 1143 0.44 1.22 0.08 144 TR_Caps_n_Bayes_99 1138 0.49 1.22 0.15 145 XMPhish11 1087 1.09 1.16 1.06 146 XM_Body_Obfu01 1083 0.48 1.16 0.16 147 XM_UB95 1080 0.38 1.15 0.02 148 XM_HighProb1 1079 0.38 1.15 0.02 149 XM_Lotto 1071 0.39 1.14 0.04 150 XMLongAddy 1068 0.43 1.14 0.10 151 T_MONEY_PERCENT 1053 0.56 1.12 0.30 152 TR_LOTS_OF_MONEY2 1053 0.56 1.12 0.30 153 TR_XM_RelayPhish 1051 0.58 1.12 0.33 154 URI_TRY_3LD 1051 0.84 1.12 0.71 155 TooManyTo_003 1048 1.11 1.12 1.11 156 MISSING_HEADERS 1030 0.59 1.10 0.35 157 MIME_HEADER_CTYPE_ONLY 1025 0.42 1.09 0.11 158 XMHTMLBadTable_001 994 0.76 1.06 0.61 159 XM_Palau_URI 989 0.34 1.06 0.00 160 XM_H_Long_From03 985 0.42 1.05 0.12 161 BASE64_LENGTH_79_INF 963 0.46 1.03 0.19 162 T_Symld_Words_02 954 0.54 1.02 0.32 163 HTML_EXTRA_CLOSE 953 0.33 1.02 0.01 164 RDNS_DYNAMIC 934 0.64 1.00 0.47 165 REPLYTO_WITHOUT_TO_CC 912 0.34 0.97 0.04 166 XM_H_PHPOS 902 1.04 0.96 1.07 167 TR_Mismatch_TLD_02 894 0.33 0.95 0.04 168 XM_Sft_Co_L33T 884 0.47 0.94 0.25 169 HTML_FONT_FACE_BAD 883 3.30 0.94 4.39 170 TooManyTo_004 868 0.90 0.93 0.89 171 DIET_1 811 0.47 0.87 0.28 172 RELAYCOUNTRY_DE 792 0.53 0.85 0.38 173 RELAYCOUNTRY_NG 770 0.26 0.82 0.00 174 XMBSHREFv2 767 0.33 0.82 0.11 175 XM_H_PHPMailer 746 0.74 0.80 0.72 176 DATE_IN_PAST_03_06 745 0.30 0.80 0.08 177 RCVD_IN_IADB_VOUCHED 737 1.73 0.79 2.17 178 XMPhish14 727 0.33 0.78 0.13 179 TR_LOTS_OF_MONEY1 725 0.25 0.77 0.01 180 RELAYCOUNTRY_NL 724 0.42 0.77 0.25 181 XM_UB80 723 0.27 0.77 0.04 182 MONEY_FORM_SHORT 712 0.24 0.76 0.00 183 XMHTML_After_End 711 0.39 0.76 0.22 184 MONEY_FRAUD_3 706 0.24 0.75 0.00 185 RELAYCOUNTRY_CL 696 0.24 0.74 0.00 186 BAYES_05 684 1.96 0.73 2.53 187 ADVANCE_FEE_2_NEW_MONEY 683 0.23 0.73 0.00 188 XM_OfRef7 667 0.36 0.71 0.20 189 FORM_FRAUD_3 660 0.22 0.70 0.00 190 RELAYCOUNTRY_GB 652 0.77 0.70 0.80 191 XMSlimDrugH 649 0.42 0.69 0.29 192 LongTLD 630 0.28 0.67 0.10 193 XMSubMetaSSx_00 624 0.30 0.67 0.12 194 HTML_TAG_BALANCE_BODY 619 0.41 0.66 0.30 195 XMMoneyMeta_00 617 0.35 0.66 0.21 196 BODY_URI_ONLY 616 0.24 0.66 0.04 197 XMClaimOffer 599 0.26 0.64 0.08 198 LOW_PRICE 598 0.25 0.64 0.06 199 T_TooManySym_02 596 1.69 0.64 2.18 200 ACT_NOW_CAPS 595 0.23 0.64 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150884 81.37 95.58 74.77 2 DKIM_SIGNED 131370 72.25 87.65 65.10 3 XM_DK_Pass 129631 70.96 85.45 64.24 4 DKIM_VALID 122383 66.91 80.40 60.65 5 DCC_CHECK_NEGATIVE 121382 46.56 17.27 60.15 6 BAYES_50 101271 42.90 27.21 50.18 7 DKIM_VALID_AU 97525 54.55 67.97 48.33 8 XMListUnsubscribeExists 85811 53.50 77.17 42.52 9 DCC_CHECK 78031 52.13 81.15 38.67 10 XM_H_QuotedFrom 73048 42.49 56.04 36.20 11 T_TM2_M_HEADER_IN_MSG 59704 25.87 17.85 29.59 12 HTML_FONT_LOW_CONTRAST 54413 30.50 38.13 26.96 13 ALL_TRUSTED 52987 18.33 1.25 26.26 14 DKIM_VALID_EF 51170 24.03 21.18 25.36 15 LOC_TINY_FONT_1 44914 28.00 40.38 22.26 16 XM_DK_Undo_02 37210 29.74 54.09 18.44 17 XMSubLong 36372 19.68 23.25 18.02 18 MIME_HTML_ONLY 36332 22.21 31.27 18.00 19 BAYES_99 35304 27.38 48.68 17.49 20 FVGT_m_MULTI_ODD 35244 20.52 27.12 17.46 21 BAYES_999 31886 24.28 42.55 15.80 22 XM_H_Long_From01 30244 12.92 8.46 14.99 23 XM_DKIMWhitelistDomains 27303 9.29 0.17 13.53 24 MultiRelay 26852 13.63 14.32 13.31 25 RCVD_IN_RP_SAFE 25440 11.32 8.54 12.61 26 RCVD_IN_RP_CERTIFIED 23556 10.39 7.63 11.67 27 XM_Multi_Part_URI 20905 12.20 16.18 10.36 28 SUBJ_ALL_CAPS 20886 7.96 2.81 10.35 29 T_KAM_HTML_FONT_INVALID 20833 12.79 18.09 10.32 30 TR_DCC_Bayes_99 20060 19.15 39.00 9.94 31 XM_Body_Dirty_Words 19488 14.01 23.39 9.66 32 FSL_BULK_SIG 19374 9.80 10.22 9.60 33 HTML_IMAGE_RATIO_04 18632 9.64 10.51 9.23 34 HTML_IMAGE_RATIO_02 17545 13.72 24.55 8.69 35 IN_ZIMBRA_NJ_WHITELIST 17363 5.89 0.04 8.60 36 XM_Evil_Numbers_Gen 16328 10.09 14.39 8.09 37 XMStrtUSub 15913 6.87 4.69 7.89 38 BAYES_00 15282 5.90 2.30 7.57 39 BAYES_40 14534 5.41 1.56 7.20 40 LOTS_OF_MONEY 13321 7.93 10.78 6.60 41 TooManyTo_001 12905 7.07 8.53 6.39 42 LotsOfNums_01 12059 6.70 8.26 5.98 43 BAYES_60 11878 5.85 5.78 5.89 44 T_XMDrugObfuBody_14 11741 7.01 9.57 5.82 45 BOTNET_IPINHOSTNAME 10588 7.78 13.25 5.25 46 T_TooManySym_01 10580 4.47 2.80 5.24 47 XM_B_Phish_Phrases 9488 6.79 11.29 4.70 48 TR_XM_DK_Bayes 9356 3.78 1.92 4.64 49 DKIM_INVALID 8987 5.34 7.25 4.45 50 XM_UncommonTLD01 8968 5.33 7.25 4.44 51 HTML_FONT_FACE_BAD 8862 3.30 0.94 4.39 52 XM_SendGrid 8799 4.37 4.39 4.36 53 TR_XM_DK_Bayes1 8700 3.53 1.84 4.31 54 FROM_EXCESS_BASE64 8654 6.10 10.01 4.29 55 UNPARSEABLE_RELAY 8493 3.47 1.89 4.21 56 RELAYCOUNTRY_META 8205 8.39 17.72 4.07 57 XMNumbers 8049 4.44 5.42 3.99 58 TR_XM_DK_Bayes2 7936 3.22 1.69 3.93 59 TVD_RCVD_IP 7913 2.79 0.36 3.92 60 TR_XM_DocInvoice 7637 4.67 6.57 3.78 61 T_REMOTE_IMAGE 7371 4.28 5.63 3.65 62 BAYES_80 7184 4.74 7.27 3.56 63 XMSexyCombo_05 7066 6.38 12.58 3.50 64 MIME_QP_LONG_LINE 6945 3.53 3.74 3.44 65 TO_MALFORMED 6886 2.34 0.02 3.41 66 NO_DNS_FOR_FROM 6866 4.28 6.16 3.40 67 RCVD_IN_IADB_LISTED 6843 2.85 1.67 3.39 68 BOUNCE_MESSAGE 6834 2.38 0.21 3.39 69 ANY_BOUNCE_MESSAGE 6834 2.38 0.21 3.39 70 INVALID_MSGID 6814 2.39 0.25 3.38 71 XMSubMetaSx_00 6763 4.78 7.86 3.35 72 RCVD_IN_IADB_SPF 6042 2.51 1.47 2.99 73 XMSubNoVowel 6025 2.20 0.52 2.99 74 RCVD_IN_MSPIKE_H2 5856 2.93 2.99 2.90 75 BAYES_20 5844 2.38 1.26 2.90 76 MPART_ALT_DIFF 5537 4.19 7.29 2.74 77 RCVD_IN_IADB_SENDERID 5422 2.28 1.40 2.69 78 HTML_IMAGE_RATIO_06 5334 3.13 4.17 2.64 79 RCVD_IN_IADB_DK 5331 2.24 1.37 2.64 80 IN_HORDE_ADDRESS_BOOK 5264 1.82 0.11 2.61 81 MIME_HTML_MOSTLY 5228 3.17 4.42 2.59 82 BAYES_95 5219 3.40 5.15 2.59 83 BAYES_05 5100 1.96 0.73 2.53 84 RCVD_IN_MSPIKE_WL 4537 2.00 1.46 2.25 85 RCVD_IN_MSPIKE_H3 4536 2.00 1.46 2.25 86 T_TooManySym_02 4409 1.69 0.64 2.18 87 RCVD_IN_IADB_VOUCHED 4376 1.73 0.79 2.17 88 MAILING_LIST_MULTI 4183 1.91 1.57 2.07 89 HTML_IMAGE_RATIO_08 3878 2.60 4.05 1.92 90 BOTNET 3694 6.19 15.58 1.83 91 XM_PDF 3596 1.34 0.38 1.78 92 USER_IN_DEF_DKIM_WL 3464 1.18 0.03 1.72 93 XMSubEmpty 3415 1.27 0.36 1.69 94 XM_OfRef6 3297 1.87 2.37 1.63 95 TooManyTo_002 3268 1.49 1.22 1.62 96 XMStockSpam_06 3260 1.49 1.23 1.62 97 XM_CamelCaseFrm001 3219 2.11 3.23 1.60 98 XM_DK_Undo_01 3209 1.54 1.43 1.59 99 HTML_MIME_NO_HTML_TAG 3068 2.09 3.32 1.52 100 URI_HEX 3046 1.91 2.77 1.51 101 TR_Symld_Words 2929 1.18 0.60 1.45 102 TM2_M_URI_OPT_OUT 2832 2.24 4.04 1.40 103 XM_ProductURIs 2732 1.50 1.82 1.35 104 RCVD_IN_IADB_OPTIN 2612 1.04 0.51 1.29 105 XM_DIRTYINTL 2515 2.08 3.89 1.25 106 UNTRUSTED_Relay 2462 4.39 11.23 1.22 107 XM_GoogleGroups 2399 0.98 0.52 1.19 108 RELAYCOUNTRY_CA 2342 2.10 4.14 1.16 109 USER_IN_WHITELIST 2318 0.78 0.00 1.15 110 XM_SPF_SoftFail 2317 1.88 3.45 1.15 111 TooManyTo_003 2232 1.11 1.12 1.11 112 XMBdyGiftCard01 2212 1.55 2.54 1.10 113 T_TooManySym_03 2179 0.80 0.21 1.08 114 XM_H_PHPOS 2162 1.04 0.96 1.07 115 XMPhish11 2145 1.09 1.16 1.06 116 MIME_HTML_ONLY_MULTI 2044 1.58 2.80 1.01 117 XMDiploma_00 1971 1.36 2.17 0.98 118 FILL_THIS_FORM 1849 0.76 0.44 0.92 119 T_XMDrugObfuBody_08 1848 1.29 2.10 0.92 120 DKIM_ADSP_CUSTOM_MED 1805 1.19 1.82 0.89 121 TM2_M_VERY_LONG_WORD 1797 1.21 1.90 0.89 122 TooManyTo_004 1787 0.90 0.93 0.89 123 XMBody_95 1745 0.66 0.21 0.86 124 TR_Mismatch_TLD_01 1731 0.70 0.36 0.86 125 XM_B_REG_HTML 1709 1.10 1.65 0.85 126 T_FILL_THIS_FORM_LOAN 1625 0.63 0.25 0.81 127 XMSubLongNoVowel 1623 0.57 0.07 0.80 128 XMSubMetaSxObfu_02 1623 0.73 0.59 0.80 129 RELAYCOUNTRY_GB 1614 0.77 0.70 0.80 130 XMSubGarbage 1612 0.56 0.04 0.80 131 TooManyTo_005 1559 0.72 0.61 0.77 132 XM_UB50 1540 1.79 3.99 0.76 133 T_FILL_THIS_FORM_LONG 1509 0.56 0.15 0.75 134 XMNoVowels 1477 0.63 0.40 0.73 135 XM_H_PHPMailer 1452 0.74 0.80 0.72 136 URI_TRY_3LD 1436 0.84 1.12 0.71 137 XM_B_COPY_HTML 1416 0.87 1.24 0.70 138 HELO_NODOT 1377 0.56 0.29 0.68 139 XM_H_Long_From02 1285 0.95 1.63 0.64 140 T_TooManySym_04 1270 0.44 0.03 0.63 141 XMHTMLBadTable_001 1238 0.76 1.06 0.61 142 NML_ADSP_CUSTOM_MED 1208 0.94 1.69 0.60 143 XMGenDplmaNmb 1192 0.81 1.29 0.59 144 T_XMDrugObfuBody_00 1142 0.94 1.73 0.57 145 TR_MetaPhish_Combo_01 1091 0.56 0.59 0.54 146 TVD_SPACE_RATIO 1009 0.44 0.30 0.50 147 RDNS_DYNAMIC 951 0.64 1.00 0.47 148 T_FILL_THIS_FORM_SHORT 939 0.76 1.40 0.47 149 XMBody_78 918 0.75 1.38 0.45 150 XMCapTrack 916 0.48 0.52 0.45 151 XMSubMetaI_00 913 0.82 1.62 0.45 152 DKIM_ADSP_NXDOMAIN 894 0.75 1.42 0.44 153 XMEmptySub 893 0.32 0.06 0.44 154 XM_H_PHPOS_M 880 0.45 0.47 0.44 155 PP_MIME_FAKE_ASCII_TEXT 880 0.44 0.44 0.44 156 XM_D_ioffer_Whitelist 861 0.29 0.00 0.43 157 TM2_M_A_HREF_HREF 850 0.42 0.42 0.42 158 XMBody_17 795 1.23 3.05 0.39 159 RELAYCOUNTRY_DE 775 0.53 0.85 0.38 160 FORGED_GMAIL_RCVD 766 0.66 1.26 0.38 161 XMSubject_09 766 0.30 0.12 0.38 162 RELAYCOUNTRY_BE 751 0.28 0.09 0.37 163 XMPhish30 742 0.93 2.16 0.37 164 XM_ShortIntro_01 741 0.35 0.31 0.37 165 PLING_QUERY 740 0.89 2.03 0.37 166 XMSexyCombo_01 739 0.99 2.32 0.37 167 XMRcvdHeader_15 734 0.25 0.00 0.36 168 XM_Walgreens_Forge 726 0.29 0.15 0.36 169 XM_H_SpoofStaff4 726 0.26 0.04 0.36 170 MISSING_HEADERS 714 0.59 1.10 0.35 171 XMDateMe_00 713 0.30 0.18 0.35 172 T_XMHurry_00 686 0.76 1.66 0.34 173 XMBrknScrpt_02 671 0.41 0.58 0.33 174 XMSolicitRefs_0 665 0.30 0.24 0.33 175 TR_XM_RelayPhish 659 0.58 1.12 0.33 176 XM_D_tchamptons_WL 658 0.22 0.00 0.33 177 XMLngstWrd_00 651 0.30 0.25 0.32 178 T_TooManySym_05 641 0.22 0.01 0.32 179 SpammyFromTLD_01 640 1.10 2.80 0.32 180 T_Symld_Words_02 638 0.54 1.02 0.32 181 XMSUPPORT 616 0.21 0.00 0.31 182 FROM_EGROUPS 609 0.21 0.01 0.30 183 HTML_TAG_BALANCE_BODY 601 0.41 0.66 0.30 184 TR_LOTS_OF_MONEY2 598 0.56 1.12 0.30 185 T_MONEY_PERCENT 598 0.56 1.12 0.30 186 T_OBFU_PDF_ATTACH 585 0.23 0.09 0.29 187 XMSlimDrugH 581 0.42 0.69 0.29 188 XMLngstWrd_01 573 0.27 0.23 0.28 189 DIET_1 570 0.47 0.87 0.28 190 XM_B_TRADE_HTML 564 0.35 0.50 0.28 191 RELAYCOUNTRY_AU 559 0.30 0.36 0.28 192 XMGappySubj_01 550 0.29 0.32 0.27 193 MPART_ALT_DIFF_COUNT 540 0.59 1.30 0.27 194 XMLKML 540 0.18 0.00 0.27 195 HTML_IMAGE_ONLY_28 536 0.37 0.59 0.27 196 XMBody_29 533 0.22 0.13 0.26 197 RELAYCOUNTRY_FR 533 0.86 2.16 0.26 198 TR_MetaPhish_Combo_01b 528 0.24 0.18 0.26 199 TO_IN_SUBJ 519 0.19 0.03 0.26 200 RELAYCOUNTRY_NL 510 0.42 0.77 0.25 ----------------------------------------------------------------------