Email: 548182 Autolearn: 0 AvgScore: 3.39 AvgScanTime: 4.01 sec Spam: 167159 Autolearn: 0 AvgScore: 12.42 AvgScanTime: 4.89 sec Ham: 381023 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 3.62 sec Time Spent Running SA: 610.32 hours Time Spent Processing Spam: 227.27 hours Time Spent Processing Ham: 383.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158193 85.58 94.64 81.61 2 DKIM_SIGNED 141326 71.35 84.55 65.56 3 XM_DK_Pass 136636 69.54 81.74 64.19 4 DCC_CHECK 131193 46.46 78.48 32.42 5 DKIM_VALID 128956 65.14 77.15 59.87 6 XMListUnsubscribeExists 119446 49.94 71.46 40.50 7 DKIM_VALID_AU 97809 46.81 58.51 41.67 8 XM_H_QuotedFrom 93725 40.71 56.07 33.97 9 XM_DK_Undo_02 83418 23.71 49.90 12.22 10 BAYES_99 75391 21.48 45.10 11.11 11 BAYES_999 64747 18.66 38.73 9.86 12 TR_DCC_Bayes_99 58914 14.44 35.24 5.31 13 HTML_FONT_LOW_CONTRAST 58292 26.02 34.87 22.14 14 LOC_TINY_FONT_1 57735 21.83 34.54 16.25 15 BAYES_50 54996 50.73 32.90 58.56 16 MIME_HTML_ONLY 48245 20.22 28.86 16.43 17 FVGT_m_MULTI_ODD 47764 22.25 28.57 19.48 18 XMSubLong 44798 21.87 26.80 19.70 19 DKIM_VALID_EF 39211 24.01 23.46 24.25 20 T_KAM_HTML_FONT_INVALID 36372 16.37 21.76 14.00 21 T_TM2_M_HEADER_IN_MSG 36118 31.83 21.61 36.31 22 DCC_CHECK_NEGATIVE 32316 51.26 19.33 65.26 23 XM_Body_Dirty_Words 32220 12.47 19.28 9.49 24 MultiRelay 30554 18.98 18.28 19.29 25 XM_Multi_Part_URI 28755 11.81 17.20 9.44 26 RELAYCOUNTRY_META 25926 8.32 15.51 5.16 27 HTML_IMAGE_RATIO_02 24508 8.78 14.66 6.21 28 XM_Evil_Numbers_Gen 23402 9.02 14.00 6.83 29 LOTS_OF_MONEY 23030 10.26 13.78 8.72 30 FSL_BULK_SIG 22267 9.85 13.32 8.33 31 BOTNET_IPINHOSTNAME 20537 6.34 12.29 3.72 32 BOTNET 20406 4.80 12.21 1.56 33 T_XMDrugObfuBody_14 17410 8.30 10.42 7.37 34 LotsOfNums_01 16682 7.81 9.98 6.86 35 XMSexyCombo_05 16563 5.12 9.91 3.02 36 XMSubMetaSx_00 15103 5.48 9.04 3.91 37 UNTRUSTED_Relay 14464 3.57 8.65 1.34 38 HTML_IMAGE_RATIO_04 14459 5.48 8.65 4.08 39 XM_B_Phish_Phrases 13646 4.94 8.16 3.53 40 XM_H_Long_From01 12598 9.17 7.54 9.88 41 DKIM_INVALID 12370 6.21 7.40 5.69 42 BAYES_80 11965 4.75 7.16 3.69 43 TR_XM_DocInvoice 11947 4.41 7.15 3.22 44 TooManyTo_001 11886 8.55 7.11 9.18 45 MPART_ALT_DIFF 10547 3.64 6.31 2.46 46 XM_UncommonTLD01 10523 4.37 6.30 3.53 47 BAYES_60 10464 6.43 6.26 6.50 48 MIME_HTML_MOSTLY 9126 3.10 5.46 2.07 49 RCVD_IN_RP_SAFE 8789 6.73 5.26 7.38 50 MIME_QP_LONG_LINE 8534 5.16 5.11 5.18 51 HTML_IMAGE_RATIO_06 8380 3.51 5.01 2.86 52 FROM_EXCESS_BASE64 7934 3.45 4.75 2.87 53 XM_SendGrid 7910 4.94 4.73 5.03 54 XMStrtUSub 7824 3.97 4.68 3.65 55 RCVD_IN_RP_CERTIFIED 7716 6.12 4.62 6.77 56 TM2_M_URI_OPT_OUT 7549 2.57 4.52 1.72 57 XMNumbers 7523 3.66 4.50 3.29 58 T_REMOTE_IMAGE 7226 4.57 4.32 4.68 59 RCVD_IN_MSPIKE_H2 7112 4.34 4.25 4.38 60 RCVD_IN_BL_SPAMCOP_NET 7068 1.73 4.23 0.63 61 BAYES_95 6989 2.94 4.18 2.40 62 XM_SPF_SoftFail 6961 2.68 4.16 2.03 63 HTML_IMAGE_RATIO_08 6565 2.58 3.93 1.98 64 XM_OfRef6 6546 2.32 3.92 1.63 65 XM_DIRTYINTL 6509 2.43 3.89 1.79 66 XM_UB50 6316 1.83 3.78 0.97 67 ALL_TRUSTED 5846 17.73 3.50 23.97 68 XM_CamelCaseFrm001 5159 2.28 3.09 1.93 69 URI_HEX 5103 1.76 3.05 1.19 70 MultiRelay_Combo 5009 1.05 3.00 0.20 71 MultiRelay_CC 5009 1.05 3.00 0.20 72 RELAYCOUNTRY_CA 4973 1.85 2.98 1.36 73 XMDiploma_00 4914 2.02 2.94 1.61 74 MIME_HTML_ONLY_MULTI 4896 1.57 2.93 0.98 75 RCVD_IN_RP_RNBL 4685 0.88 2.80 0.03 76 T_XMDrugObfuBody_08 4630 1.73 2.77 1.27 77 T_TooManySym_01 4612 3.74 2.76 4.18 78 RCVD_IN_IADB_LISTED 4296 4.87 2.57 5.87 79 HTML_MIME_NO_HTML_TAG 4028 2.46 2.41 2.48 80 RCVD_IN_IADB_SPF 3865 4.24 2.31 5.08 81 TM2_M_VERY_LONG_WORD 3820 1.25 2.29 0.79 82 XM_URI_RBL 3815 0.77 2.28 0.10 83 RCVD_IN_IADB_SENDERID 3723 3.80 2.23 4.49 84 XMSubNoVowel 3678 2.67 2.20 2.88 85 RCVD_IN_IADB_DK 3666 3.70 2.19 4.36 86 XMSexyCombo_01 3623 1.30 2.17 0.91 87 TR_Mismatch_TLD_01 3585 1.50 2.14 1.22 88 XM_H_Long_From02 3503 1.27 2.10 0.91 89 NO_DNS_FOR_FROM 3390 1.62 2.03 1.44 90 SpammyFromTLD_01 3085 1.17 1.85 0.88 91 XM_ProductURIs 2926 1.19 1.75 0.95 92 SpammyFromTLD_02 2904 0.76 1.74 0.33 93 XMSubMetaI_00 2844 1.14 1.70 0.89 94 XMGenDplmaNmb 2781 1.18 1.66 0.97 95 XM_DK_Undo_01 2764 1.87 1.65 1.97 96 XM_UB99 2736 0.51 1.64 0.01 97 SUBJ_ALL_CAPS 2684 4.82 1.61 6.23 98 XMSubEmpty 2675 2.23 1.60 2.50 99 RELAYCOUNTRY_FR 2670 0.66 1.60 0.24 100 TooManyTo_002 2645 2.63 1.58 3.09 101 DKIM_ADSP_CUSTOM_MED 2643 1.21 1.58 1.04 102 SUBJ_DOLLARS 2555 0.66 1.53 0.27 103 T_MONEY_PERCENT 2496 0.68 1.49 0.32 104 TR_LOTS_OF_MONEY2 2496 0.68 1.49 0.32 105 TooManyTo_003 2387 1.86 1.43 2.06 106 XMPhish30 2374 0.68 1.42 0.36 107 RCVD_IN_PSBL 2367 0.51 1.42 0.11 108 FILL_THIS_FORM 2360 0.74 1.41 0.44 109 BAYES_00 2355 5.54 1.41 7.35 110 MAILING_LIST_MULTI 2350 2.19 1.41 2.53 111 NML_ADSP_CUSTOM_MED 2329 0.94 1.39 0.74 112 T_XMHurry_00 2302 0.73 1.38 0.45 113 XMHTML_After_End 2290 0.65 1.37 0.34 114 PLING_QUERY 2247 0.56 1.34 0.22 115 TR_XM_RelayPhish 2214 0.72 1.32 0.45 116 XM_UB999 2199 0.41 1.32 0.01 117 XMBody_78 2195 0.71 1.31 0.44 118 URI_TRY_3LD 2138 1.04 1.28 0.94 119 XMStockSpam_06 2135 1.07 1.28 0.98 120 URIBL_BLACK 2128 0.41 1.27 0.03 121 TooManyTo_004 2085 1.42 1.25 1.50 122 XMBdyGiftCard01 2073 0.79 1.24 0.59 123 BAYES_40 2048 4.38 1.23 5.76 124 XMEmptySub 2047 0.79 1.22 0.61 125 XM_HighProb1 2026 0.38 1.21 0.01 126 T_XMDrugObfuBody_00 2001 0.94 1.20 0.82 127 XM_H_PHPOS 1988 1.16 1.19 1.15 128 RDNS_DYNAMIC 1981 0.66 1.19 0.43 129 XMPhish11 1958 1.15 1.17 1.14 130 BOTNET_NORDNS 1956 0.38 1.17 0.03 131 XMBody_17 1954 0.60 1.17 0.35 132 TooManyTo_005 1943 1.12 1.16 1.11 133 SHORT_URI_2 1919 0.73 1.15 0.55 134 URIBL_DBL_SPAM 1897 0.36 1.13 0.02 135 TR_XM_DK_Bayes 1882 3.54 1.13 4.60 136 XM_UB60 1880 0.40 1.12 0.08 137 XMSexyCombo_04 1857 0.68 1.11 0.49 138 RELAYCOUNTRY_AT 1849 0.42 1.11 0.11 139 XM_OfRef7 1842 0.44 1.10 0.15 140 XM_BadFromFormat 1814 0.48 1.09 0.22 141 UNPARSEABLE_RELAY 1807 2.16 1.08 2.64 142 TR_Symld_Words 1781 1.70 1.07 1.97 143 XMPhish14 1754 0.58 1.05 0.38 144 TR_XM_DK_Bayes1 1744 3.20 1.04 4.15 145 RELAYCOUNTRY_GB 1740 1.07 1.04 1.08 146 DIET_1 1734 0.47 1.04 0.23 147 XM_B_REG_HTML 1704 0.54 1.02 0.34 148 T_Symld_Words_02 1693 0.64 1.01 0.47 149 BAYES_20 1662 2.08 0.99 2.56 150 TR_XM_DK_Bayes2 1641 2.68 0.98 3.42 151 XM_B_COPY_HTML 1627 0.58 0.97 0.41 152 XMGppyBdWords 1627 0.39 0.97 0.13 153 BODY_ENHANCEMENT 1611 0.31 0.96 0.02 154 RCVD_IN_MSPIKE_WL 1608 2.10 0.96 2.59 155 RCVD_IN_MSPIKE_H3 1603 2.09 0.96 2.59 156 RCVD_IN_IADB_VOUCHED 1601 3.05 0.96 3.96 157 ANY_BOUNCE_MESSAGE 1600 2.30 0.96 2.89 158 BOUNCE_MESSAGE 1599 2.30 0.96 2.89 159 XMLngstWrd_00 1599 0.55 0.96 0.37 160 XMMoneyMeta_00 1587 0.63 0.95 0.49 161 TR_MetaPhish_Combo_01 1580 0.91 0.95 0.90 162 XMLongAddy 1580 0.35 0.95 0.09 163 MPART_ALT_DIFF_COUNT 1571 0.45 0.94 0.24 164 HTML_FONT_FACE_BAD 1562 0.57 0.93 0.41 165 XMBrknScrpt_02 1557 0.70 0.93 0.60 166 XMSubMetaSxObfu_03 1553 0.59 0.93 0.44 167 T_FILL_THIS_FORM_SHORT 1548 0.94 0.93 0.94 168 MISSING_HEADERS 1544 0.67 0.92 0.56 169 XMSlimDrugH 1536 0.48 0.92 0.29 170 URI_NOVOWEL 1508 0.59 0.90 0.46 171 HTTPS_HTTP_MISMATCH 1498 0.62 0.90 0.50 172 XMHTMLBadTable_001 1487 0.49 0.89 0.32 173 XM_PDF 1445 3.69 0.86 4.93 174 TVD_SPACE_RATIO 1416 0.76 0.85 0.73 175 LONG_JUNK_URI3 1404 0.30 0.84 0.06 176 TR_LOTS_OF_MONEY3 1400 0.43 0.84 0.25 177 REPLYTO_WITHOUT_TO_CC 1397 0.29 0.84 0.05 178 FILL_THIS_FORM_LONG 1396 0.49 0.84 0.34 179 XMLngstWrd_01 1393 0.48 0.83 0.33 180 RELAYCOUNTRY_AU 1381 0.60 0.83 0.51 181 TR_Mismatch_TLD_02 1362 0.29 0.81 0.06 182 T_HTML_TAG_BALANCE_CENTER 1353 0.33 0.81 0.12 183 HTML_FONT_SIZE_HUGE 1352 0.32 0.81 0.10 184 HTML_FONT_SIZE_LARGE 1335 0.34 0.80 0.13 185 RELAYCOUNTRY_DE 1329 0.67 0.80 0.62 186 REMOVE_BEFORE_LINK 1312 0.36 0.78 0.17 187 XMLngstWrd_02 1310 0.42 0.78 0.26 188 XMSubMetaSSx_00 1305 0.34 0.78 0.14 189 HTML_TAG_BALANCE_BODY 1293 0.52 0.77 0.40 190 FORGED_GMAIL_RCVD 1277 0.61 0.76 0.54 191 LongTLD 1267 0.32 0.76 0.13 192 TM2_M_A_HREF_HREF 1267 0.53 0.76 0.43 193 T_FILL_THIS_FORM_LOAN 1249 0.44 0.75 0.31 194 XMLngstWrd_03 1222 0.33 0.73 0.16 195 FORGED_YAHOO_RCVD 1218 0.24 0.73 0.03 196 XMGappySubj_01 1204 0.93 0.72 1.02 197 XMBSHREFv2 1190 0.31 0.71 0.14 198 XMSubMetaSx_01 1175 0.27 0.70 0.07 199 RELAYCOUNTRY_TW 1143 0.23 0.68 0.03 200 XM_H_PHPMailer 1137 0.71 0.68 0.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 310948 85.58 94.64 81.61 2 DKIM_SIGNED 249810 71.35 84.55 65.56 3 DCC_CHECK_NEGATIVE 248672 51.26 19.33 65.26 4 XM_DK_Pass 244590 69.54 81.74 64.19 5 DKIM_VALID 228113 65.14 77.15 59.87 6 BAYES_50 223121 50.73 32.90 58.56 7 DKIM_VALID_AU 158772 46.81 58.51 41.67 8 XMListUnsubscribeExists 154316 49.94 71.46 40.50 9 T_TM2_M_HEADER_IN_MSG 138363 31.83 21.61 36.31 10 XM_H_QuotedFrom 129448 40.71 56.07 33.97 11 DCC_CHECK 123519 46.46 78.48 32.42 12 DKIM_VALID_EF 92381 24.01 23.46 24.25 13 ALL_TRUSTED 91334 17.73 3.50 23.97 14 HTML_FONT_LOW_CONTRAST 84361 26.02 34.87 22.14 15 XMSubLong 75078 21.87 26.80 19.70 16 FVGT_m_MULTI_ODD 74233 22.25 28.57 19.48 17 MultiRelay 73504 18.98 18.28 19.29 18 MIME_HTML_ONLY 62601 20.22 28.86 16.43 19 LOC_TINY_FONT_1 61906 21.83 34.54 16.25 20 T_KAM_HTML_FONT_INVALID 53356 16.37 21.76 14.00 21 XM_DK_Undo_02 46549 23.71 49.90 12.22 22 BAYES_99 42345 21.48 45.10 11.11 23 XM_H_Long_From01 37653 9.17 7.54 9.88 24 BAYES_999 37551 18.66 38.73 9.86 25 XM_Body_Dirty_Words 36158 12.47 19.28 9.49 26 XM_Multi_Part_URI 35959 11.81 17.20 9.44 27 TooManyTo_001 34996 8.55 7.11 9.18 28 LOTS_OF_MONEY 33232 10.26 13.78 8.72 29 XM_DKIMWhitelistDomains 32495 5.93 0.02 8.53 30 FSL_BULK_SIG 31743 9.85 13.32 8.33 31 RCVD_IN_RP_SAFE 28124 6.73 5.26 7.38 32 T_XMDrugObfuBody_14 28087 8.30 10.42 7.37 33 BAYES_00 28022 5.54 1.41 7.35 34 LotsOfNums_01 26128 7.81 9.98 6.86 35 XM_Evil_Numbers_Gen 26038 9.02 14.00 6.83 36 RCVD_IN_RP_CERTIFIED 25814 6.12 4.62 6.77 37 BAYES_60 24768 6.43 6.26 6.50 38 SUBJ_ALL_CAPS 23743 4.82 1.61 6.23 39 HTML_IMAGE_RATIO_02 23643 8.78 14.66 6.21 40 RCVD_IN_IADB_LISTED 22383 4.87 2.57 5.87 41 IN_ZIMBRA_NJ_WHITELIST 22286 4.08 0.04 5.85 42 BAYES_40 21939 4.38 1.23 5.76 43 DKIM_INVALID 21697 6.21 7.40 5.69 44 TR_DCC_Bayes_99 20229 14.44 35.24 5.31 45 MIME_QP_LONG_LINE 19738 5.16 5.11 5.18 46 RELAYCOUNTRY_META 19664 8.32 15.51 5.16 47 RCVD_IN_IADB_SPF 19359 4.24 2.31 5.08 48 XM_SendGrid 19155 4.94 4.73 5.03 49 XM_PDF 18798 3.69 0.86 4.93 50 T_REMOTE_IMAGE 17849 4.57 4.32 4.68 51 TR_XM_DK_Bayes 17530 3.54 1.13 4.60 52 RCVD_IN_IADB_SENDERID 17103 3.80 2.23 4.49 53 RCVD_IN_MSPIKE_H2 16678 4.34 4.25 4.38 54 RCVD_IN_IADB_DK 16594 3.70 2.19 4.36 55 T_TooManySym_01 15914 3.74 2.76 4.18 56 TR_XM_DK_Bayes1 15822 3.20 1.04 4.15 57 HTML_IMAGE_RATIO_04 15555 5.48 8.65 4.08 58 RCVD_IN_IADB_VOUCHED 15098 3.05 0.96 3.96 59 XMSubMetaSx_00 14915 5.48 9.04 3.91 60 BOTNET_IPINHOSTNAME 14192 6.34 12.29 3.72 61 BAYES_80 14076 4.75 7.16 3.69 62 XMStrtUSub 13924 3.97 4.68 3.65 63 XM_B_Phish_Phrases 13459 4.94 8.16 3.53 64 XM_UncommonTLD01 13441 4.37 6.30 3.53 65 TR_XM_DK_Bayes2 13037 2.68 0.98 3.42 66 XMNumbers 12548 3.66 4.50 3.29 67 TR_XM_DocInvoice 12255 4.41 7.15 3.22 68 TooManyTo_002 11763 2.63 1.58 3.09 69 XMSexyCombo_05 11520 5.12 9.91 3.02 70 ANY_BOUNCE_MESSAGE 11003 2.30 0.96 2.89 71 BOUNCE_MESSAGE 10998 2.30 0.96 2.89 72 XMSubNoVowel 10977 2.67 2.20 2.88 73 FROM_EXCESS_BASE64 10951 3.45 4.75 2.87 74 HTML_IMAGE_RATIO_06 10886 3.51 5.01 2.86 75 UNPARSEABLE_RELAY 10060 2.16 1.08 2.64 76 RCVD_IN_MSPIKE_WL 9877 2.10 0.96 2.59 77 RCVD_IN_MSPIKE_H3 9872 2.09 0.96 2.59 78 BAYES_20 9760 2.08 0.99 2.56 79 RCVD_IN_IADB_OPTIN 9724 1.96 0.60 2.55 80 MAILING_LIST_MULTI 9630 2.19 1.41 2.53 81 XMSubEmpty 9544 2.23 1.60 2.50 82 HTML_MIME_NO_HTML_TAG 9443 2.46 2.41 2.48 83 MPART_ALT_DIFF 9385 3.64 6.31 2.46 84 HELO_NODOT 9224 1.78 0.32 2.42 85 BAYES_95 9133 2.94 4.18 2.40 86 TVD_RCVD_IP 8962 1.74 0.34 2.35 87 IN_HORDE_ADDRESS_BOOK 8456 1.57 0.09 2.22 88 MIME_HTML_MOSTLY 7886 3.10 5.46 2.07 89 TooManyTo_003 7831 1.86 1.43 2.06 90 XM_SPF_SoftFail 7732 2.68 4.16 2.03 91 HTML_IMAGE_RATIO_08 7559 2.58 3.93 1.98 92 TR_Symld_Words 7518 1.70 1.07 1.97 93 XM_DK_Undo_01 7489 1.87 1.65 1.97 94 XM_CamelCaseFrm001 7362 2.28 3.09 1.93 95 INVALID_MSGID 7001 1.32 0.15 1.84 96 XM_DIRTYINTL 6823 2.43 3.89 1.79 97 TO_MALFORMED 6688 1.23 0.02 1.76 98 MSGID_NOFQDN1 6668 1.22 0.01 1.75 99 BAYES_05 6647 1.40 0.62 1.74 100 TM2_M_URI_OPT_OUT 6548 2.57 4.52 1.72 101 XMCapTrack 6443 1.37 0.64 1.69 102 XM_OfRef6 6196 2.32 3.92 1.63 103 XMDiploma_00 6152 2.02 2.94 1.61 104 T_TooManySym_02 5950 1.28 0.64 1.56 105 BOTNET 5933 4.80 12.21 1.56 106 TooManyTo_004 5724 1.42 1.25 1.50 107 NO_DNS_FOR_FROM 5482 1.62 2.03 1.44 108 RELAYCOUNTRY_CA 5188 1.85 2.98 1.36 109 UNTRUSTED_Relay 5094 3.57 8.65 1.34 110 T_XMDrugObfuBody_08 4846 1.73 2.77 1.27 111 XM_GoogleGroups 4835 1.04 0.52 1.27 112 TR_Mismatch_TLD_01 4653 1.50 2.14 1.22 113 URI_HEX 4544 1.76 3.05 1.19 114 XM_H_PHPOS 4388 1.16 1.19 1.15 115 XMPhish11 4354 1.15 1.17 1.14 116 TooManyTo_005 4213 1.12 1.16 1.11 117 RELAYCOUNTRY_GB 4116 1.07 1.04 1.08 118 DKIM_ADSP_CUSTOM_MED 3977 1.21 1.58 1.04 119 USER_IN_DEF_DKIM_WL 3955 0.73 0.03 1.04 120 XMGappySubj_01 3893 0.93 0.72 1.02 121 XMStockSpam_06 3738 1.07 1.28 0.98 122 MIME_HTML_ONLY_MULTI 3719 1.57 2.93 0.98 123 XM_UB50 3707 1.83 3.78 0.97 124 XMGenDplmaNmb 3703 1.18 1.66 0.97 125 XM_ProductURIs 3611 1.19 1.75 0.95 126 T_FILL_THIS_FORM_SHORT 3595 0.94 0.93 0.94 127 URI_TRY_3LD 3565 1.04 1.28 0.94 128 XMSexyCombo_01 3476 1.30 2.17 0.91 129 XM_H_Long_From02 3466 1.27 2.10 0.91 130 TR_MetaPhish_Combo_01 3414 0.91 0.95 0.90 131 XMSubMetaI_00 3385 1.14 1.70 0.89 132 SpammyFromTLD_01 3338 1.17 1.85 0.88 133 T_XMDrugObfuBody_00 3135 0.94 1.20 0.82 134 TM2_M_VERY_LONG_WORD 3013 1.25 2.29 0.79 135 USER_IN_WHITELIST 2878 0.53 0.00 0.76 136 XMSolicitRefs_0 2854 0.72 0.65 0.75 137 NML_ADSP_CUSTOM_MED 2817 0.94 1.39 0.74 138 XM_H_PHPMailer 2781 0.71 0.68 0.73 139 TVD_SPACE_RATIO 2776 0.76 0.85 0.73 140 XMNoVowels 2726 0.69 0.64 0.72 141 XM_ShortIntro_01 2695 0.60 0.36 0.71 142 T_TooManySym_03 2660 0.53 0.14 0.70 143 T_OBFU_PDF_ATTACH 2545 0.53 0.20 0.67 144 RCVD_IN_BL_SPAMCOP_NET 2402 1.73 4.23 0.63 145 UPPERCASE_50_75 2386 0.47 0.12 0.63 146 RELAYCOUNTRY_DE 2371 0.67 0.80 0.62 147 XMEmptySub 2307 0.79 1.22 0.61 148 XMBrknScrpt_02 2273 0.70 0.93 0.60 149 XMBody_95 2267 0.46 0.16 0.59 150 XMBdyGiftCard01 2261 0.79 1.24 0.59 151 SHORT_HELO_AND_INLINE_IMAGE 2243 0.43 0.07 0.59 152 XMGappySubj_02 2227 0.44 0.12 0.58 153 MISSING_HEADERS 2124 0.67 0.92 0.56 154 SHORT_URI_2 2087 0.73 1.15 0.55 155 FORGED_GMAIL_RCVD 2074 0.61 0.76 0.54 156 RCVD_IN_SORBS_DUL 2016 0.44 0.24 0.53 157 RELAYCOUNTRY_AU 1935 0.60 0.83 0.51 158 XM_B_TRADE_HTML 1913 0.53 0.58 0.50 159 XMDateMe_00 1913 0.48 0.42 0.50 160 PP_MIME_FAKE_ASCII_TEXT 1913 0.48 0.43 0.50 161 HTTPS_HTTP_MISMATCH 1889 0.62 0.90 0.50 162 XMSexyCombo_04 1883 0.68 1.11 0.49 163 XMMoneyMeta_00 1863 0.63 0.95 0.49 164 AC_DIV_BONANZA 1808 0.38 0.17 0.47 165 T_Symld_Words_02 1794 0.64 1.01 0.47 166 HTML_IMAGE_ONLY_32 1766 0.43 0.35 0.46 167 URI_NOVOWEL 1734 0.59 0.90 0.46 168 T_MANY_PILL_PRICE 1730 0.32 0.00 0.45 169 TR_XM_RelayPhish 1718 0.72 1.32 0.45 170 T_XMHurry_00 1715 0.73 1.38 0.45 171 XMSubMetaSxObfu_03 1690 0.59 0.93 0.44 172 XMBody_78 1684 0.71 1.31 0.44 173 TM2_M_BODY_EMPTY 1676 0.35 0.16 0.44 174 FILL_THIS_FORM 1670 0.74 1.41 0.44 175 RDNS_DYNAMIC 1635 0.66 1.19 0.43 176 TM2_M_A_HREF_HREF 1633 0.53 0.76 0.43 177 HTML_IMAGE_ONLY_28 1584 0.45 0.52 0.42 178 XM_B_COPY_HTML 1564 0.58 0.97 0.41 179 HTML_FONT_FACE_BAD 1553 0.57 0.93 0.41 180 HTML_TAG_BALANCE_BODY 1532 0.52 0.77 0.40 181 XM_D_tchamptons_WL 1512 0.28 0.00 0.40 182 HTML_IMAGE_ONLY_24 1480 0.42 0.50 0.39 183 XMPhish14 1439 0.58 1.05 0.38 184 XMLngstWrd_00 1397 0.55 0.96 0.37 185 XMPhish30 1364 0.68 1.42 0.36 186 XMSubMetaSxObfu_02 1335 0.37 0.41 0.35 187 XMBody_17 1319 0.60 1.17 0.35 188 XM_D_ioffer_Whitelist 1312 0.24 0.00 0.34 189 FILL_THIS_FORM_LONG 1310 0.49 0.84 0.34 190 XM_H_Trusted_IP 1299 0.24 0.00 0.34 191 XM_B_REG_HTML 1277 0.54 1.02 0.34 192 XMHTML_After_End 1277 0.65 1.37 0.34 193 SpammyFromTLD_02 1268 0.76 1.74 0.33 194 XMLngstWrd_01 1242 0.48 0.83 0.33 195 TR_LOTS_OF_MONEY2 1227 0.68 1.49 0.32 196 T_MONEY_PERCENT 1227 0.68 1.49 0.32 197 T_TooManySym_04 1218 0.24 0.06 0.32 198 XMHTMLBadTable_001 1213 0.49 0.89 0.32 199 XMRcvdHeader_15 1212 0.22 0.00 0.32 200 XM_Body_Obfu01 1199 0.39 0.58 0.31 ----------------------------------------------------------------------