Email: 314414 Autolearn: 0 AvgScore: 3.48 AvgScanTime: 3.15 sec Spam: 103683 Autolearn: 0 AvgScore: 12.78 AvgScanTime: 4.04 sec Ham: 210731 Autolearn: 0 AvgScore: -1.10 AvgScanTime: 2.71 sec Time Spent Running SA: 274.86 hours Time Spent Processing Spam: 116.27 hours Time Spent Processing Ham: 158.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 97460 80.89 94.00 74.43 2 DKIM_SIGNED 86302 70.85 83.24 64.76 3 DCC_CHECK 83697 51.61 80.72 37.29 4 XM_DK_Pass 83617 69.40 80.65 63.87 5 DKIM_VALID 78285 65.18 75.50 60.11 6 XMListUnsubscribeExists 73944 51.48 71.32 41.73 7 DKIM_VALID_AU 63091 50.14 60.85 44.87 8 XM_H_QuotedFrom 59276 42.07 57.17 34.65 9 XM_DK_Undo_02 52534 27.99 50.67 16.84 10 BAYES_99 48124 25.89 46.41 15.79 11 BAYES_999 41824 22.86 40.34 14.26 12 TR_DCC_Bayes_99 38648 17.54 37.28 7.83 13 LOC_TINY_FONT_1 37807 25.14 36.46 19.57 14 HTML_FONT_LOW_CONTRAST 35817 28.19 34.54 25.06 15 BAYES_50 32150 46.92 31.01 54.74 16 MIME_HTML_ONLY 31446 22.09 30.33 18.04 17 FVGT_m_MULTI_ODD 28553 21.94 27.54 19.19 18 XMSubLong 24456 18.82 23.59 16.47 19 XM_Body_Dirty_Words 22388 13.34 21.59 9.29 20 T_KAM_HTML_FONT_INVALID 20392 14.67 19.67 12.20 21 DKIM_VALID_EF 20068 23.69 19.36 25.82 22 T_TM2_M_HEADER_IN_MSG 19662 27.74 18.96 32.05 23 HTML_IMAGE_RATIO_02 19258 11.38 18.57 7.84 24 DCC_CHECK_NEGATIVE 18235 46.98 17.59 61.43 25 MultiRelay 17658 16.24 17.03 15.85 26 XM_Multi_Part_URI 17510 12.56 16.89 10.43 27 RELAYCOUNTRY_META 17299 8.18 16.68 3.99 28 FSL_BULK_SIG 16286 12.66 15.71 11.16 29 XM_Evil_Numbers_Gen 13632 8.90 13.15 6.81 30 LOTS_OF_MONEY 13087 10.95 12.62 10.13 31 BOTNET 13056 5.16 12.59 1.50 32 BOTNET_IPINHOSTNAME 12822 7.42 12.37 4.99 33 XMSexyCombo_05 11168 5.41 10.77 2.78 34 T_XMDrugObfuBody_14 10534 7.53 10.16 6.24 35 UNTRUSTED_Relay 10360 4.14 9.99 1.25 36 HTML_IMAGE_RATIO_04 10185 5.81 9.82 3.83 37 XMSubMetaSx_00 9684 5.80 9.34 4.06 38 TooManyTo_001 8677 6.74 8.37 5.94 39 XM_B_Phish_Phrases 8474 5.40 8.17 4.04 40 XM_H_Long_From01 8250 12.83 7.96 15.23 41 LotsOfNums_01 8114 6.63 7.83 6.04 42 DKIM_INVALID 8017 5.67 7.73 4.66 43 TR_XM_DocInvoice 7901 4.37 7.62 2.78 44 FROM_EXCESS_BASE64 7333 4.45 7.07 3.16 45 BAYES_80 7319 4.82 7.06 3.72 46 RCVD_IN_RP_SAFE 7000 8.94 6.75 10.01 47 BAYES_60 6989 6.92 6.74 7.01 48 XM_UncommonTLD01 6671 5.25 6.43 4.66 49 MPART_ALT_DIFF 6460 4.16 6.23 3.14 50 RCVD_IN_RP_CERTIFIED 6159 8.26 5.94 9.40 51 ALL_TRUSTED 5348 21.97 5.16 30.24 52 XMNumbers 5228 4.16 5.04 3.72 53 RCVD_IN_MSPIKE_H2 4830 4.26 4.66 4.07 54 XM_DIRTYINTL 4745 2.64 4.58 1.68 55 NO_DNS_FOR_FROM 4632 3.44 4.47 2.93 56 MIME_QP_LONG_LINE 4616 3.82 4.45 3.51 57 XMStrtUSub 4392 4.42 4.24 4.51 58 BAYES_95 4383 3.02 4.23 2.43 59 MIME_HTML_MOSTLY 4310 3.01 4.16 2.45 60 T_REMOTE_IMAGE 4286 4.34 4.13 4.44 61 HTML_IMAGE_RATIO_06 4185 3.23 4.04 2.83 62 XM_SendGrid 4159 4.75 4.01 5.12 63 XM_UB50 4079 1.86 3.93 0.85 64 MultiRelay_Combo 3987 1.36 3.85 0.13 65 MultiRelay_CC 3987 1.36 3.85 0.13 66 XMSubNoVowel 3972 4.78 3.83 5.25 67 HTML_IMAGE_RATIO_08 3848 2.26 3.71 1.54 68 RCVD_IN_BL_SPAMCOP_NET 3691 1.59 3.56 0.61 69 TM2_M_URI_OPT_OUT 3639 2.13 3.51 1.45 70 RELAYCOUNTRY_CA 3566 1.93 3.44 1.18 71 TR_Mismatch_TLD_01 3557 2.25 3.43 1.67 72 RCVD_IN_RP_RNBL 3536 1.15 3.41 0.03 73 XM_OfRef6 3483 1.83 3.36 1.08 74 URI_HEX 3429 2.11 3.31 1.52 75 T_TooManySym_01 3366 4.18 3.25 4.65 76 XM_CamelCaseFrm001 3346 2.16 3.23 1.63 77 SUBJ_ALL_CAPS 3290 8.38 3.17 10.95 78 XMSubEmpty 3032 4.08 2.92 4.65 79 MIME_HTML_ONLY_MULTI 2930 1.81 2.83 1.31 80 XM_SPF_SoftFail 2929 1.75 2.82 1.23 81 TM2_M_VERY_LONG_WORD 2574 1.29 2.48 0.71 82 RCVD_IN_IADB_LISTED 2567 4.07 2.48 4.86 83 HTML_MIME_NO_HTML_TAG 2517 1.86 2.43 1.58 84 XMBdyGiftCard01 2313 1.23 2.23 0.74 85 RELAYCOUNTRY_FR 2287 0.93 2.21 0.30 86 XMPhish30 2277 0.96 2.20 0.35 87 RCVD_IN_IADB_SPF 2274 3.48 2.19 4.11 88 RCVD_IN_IADB_SENDERID 2195 3.09 2.12 3.57 89 T_XMHurry_00 2180 1.01 2.10 0.47 90 RCVD_IN_IADB_DK 2163 2.98 2.09 3.42 91 TooManyTo_002 2143 1.77 2.07 1.63 92 XM_URI_RBL 2142 0.75 2.07 0.10 93 XMSexyCombo_01 2135 0.90 2.06 0.33 94 XMBody_17 2124 0.90 2.05 0.33 95 SHORT_URI_2 2087 1.25 2.01 0.87 96 XM_BadFromFormat 1987 0.83 1.92 0.30 97 TooManyTo_003 1965 1.37 1.90 1.11 98 URIBL_BLACK 1961 0.64 1.89 0.03 99 UNPARSEABLE_RELAY 1947 3.34 1.88 4.06 100 T_XMDrugObfuBody_08 1941 1.30 1.87 1.03 101 DKIM_ADSP_CUSTOM_MED 1934 1.12 1.87 0.75 102 XMLongAddy 1929 0.69 1.86 0.12 103 SpammyFromTLD_02 1919 0.74 1.85 0.20 104 MPART_ALT_DIFF_COUNT 1916 0.82 1.85 0.31 105 XMSubMetaI_00 1890 0.95 1.82 0.52 106 SpammyFromTLD_01 1828 0.92 1.76 0.50 107 NML_ADSP_CUSTOM_MED 1808 0.91 1.74 0.50 108 DIET_1 1800 0.76 1.74 0.28 109 XMDiploma_00 1796 1.37 1.73 1.18 110 MAILING_LIST_MULTI 1755 2.08 1.69 2.28 111 XM_UB99 1729 0.58 1.67 0.04 112 TooManyTo_004 1703 1.10 1.64 0.84 113 XM_H_Long_From02 1607 0.97 1.55 0.68 114 BAYES_40 1601 5.15 1.54 6.93 115 TVD_SPACE_RATIO 1577 1.22 1.52 1.07 116 TooManyTo_005 1557 0.98 1.50 0.72 117 BODY_URI_ONLY 1531 0.52 1.48 0.05 118 XM_UB60 1523 0.56 1.47 0.11 119 TR_LOTS_OF_MONEY2 1512 0.78 1.46 0.44 120 T_MONEY_PERCENT 1512 0.78 1.46 0.44 121 URIBL_DBL_SPAM 1508 0.50 1.45 0.03 122 XM_H_Long_From03 1492 0.56 1.44 0.13 123 BOTNET_NORDNS 1489 0.49 1.44 0.02 124 T_XMDrugObfuBody_00 1444 0.96 1.39 0.75 125 HTML_IMAGE_ONLY_08 1442 0.57 1.39 0.16 126 T_HTML_TAG_BALANCE_CENTER 1413 0.57 1.36 0.19 127 XM_ProductURIs 1388 1.17 1.34 1.08 128 XM_Hitman 1385 0.47 1.34 0.04 129 HTML_SHORT_LINK_IMG_1 1378 0.45 1.33 0.02 130 XMGenDplmaNmb 1375 0.86 1.33 0.63 131 FILL_THIS_FORM 1362 0.73 1.31 0.44 132 XM_B_REG_HTML 1362 0.95 1.31 0.77 133 XM_DK_Undo_01 1355 1.56 1.31 1.68 134 SUBJ_DOLLARS 1349 0.59 1.30 0.24 135 BAYES_20 1344 1.70 1.30 1.90 136 XMEmptySub 1336 1.14 1.29 1.06 137 XMPhish14 1334 0.58 1.29 0.23 138 TR_Mismatch_TLD_02 1334 0.46 1.29 0.05 139 RCVD_IN_MSPIKE_H3 1333 2.02 1.29 2.38 140 RCVD_IN_MSPIKE_WL 1333 2.02 1.29 2.38 141 XM_HighProb1 1317 0.43 1.27 0.02 142 FILL_THIS_FORM_LONG 1307 0.66 1.26 0.36 143 XM_UB999 1303 0.44 1.26 0.04 144 XMStockSpam_06 1281 0.91 1.24 0.76 145 XMHTML_After_End 1230 0.54 1.19 0.22 146 TO_IN_SUBJ 1227 0.84 1.18 0.67 147 LONG_JUNK_URI3 1225 0.46 1.18 0.10 148 RELAYCOUNTRY_AT 1213 0.45 1.17 0.10 149 RELAYCOUNTRY_CN 1198 0.39 1.16 0.01 150 T_FILL_THIS_FORM_LOAN 1193 0.62 1.15 0.36 151 TR_XM_RelayPhish 1184 0.56 1.14 0.28 152 HTML_FONT_SIZE_HUGE 1154 0.46 1.11 0.13 153 XMLngstWrd_00 1144 0.58 1.10 0.32 154 TR_LOTS_OF_MONEY3 1143 0.45 1.10 0.13 155 XMLngstWrd_01 1124 0.54 1.08 0.28 156 HDRS_LCASE_IMGONLY 1110 0.38 1.07 0.04 157 TR_Caps_n_Bayes_99 1102 0.41 1.06 0.10 158 XMLngstWrd_02 1092 0.47 1.05 0.18 159 XM_B_COPY_HTML 1090 0.87 1.05 0.77 160 T_HTML_TEXT_INVISIBLE_STYLE 1083 0.39 1.04 0.06 161 BASE64_LENGTH_79_INF 1074 0.45 1.04 0.16 162 XMLngstWrd_03 1066 0.43 1.03 0.14 163 XMSlimDrugH 1059 0.53 1.02 0.29 164 XM_UB80 1052 0.35 1.01 0.03 165 XM_PDF 1050 1.62 1.01 1.92 166 XM_RXBody 1046 0.41 1.01 0.11 167 FORGED_YAHOO_RCVD 1035 0.36 1.00 0.04 168 BAYES_00 1034 4.27 1.00 5.88 169 TR_Symld_Words 1033 1.88 1.00 2.31 170 URI_TRY_3LD 1028 1.11 0.99 1.17 171 URI_NOVOWEL 1018 0.59 0.98 0.40 172 XMPhish11 1015 0.91 0.98 0.88 173 XMLngstWrd_04 1012 0.39 0.98 0.10 174 XMBody_78 1004 0.62 0.97 0.45 175 XMHTMLBadTable_001 1001 0.57 0.97 0.37 176 FROM_LOCAL_HEX 982 0.35 0.95 0.06 177 XM_OfRef7 981 0.43 0.95 0.17 178 XMSexyCombo_04 959 0.35 0.92 0.06 179 RELAYCOUNTRY_BR 937 0.31 0.90 0.01 180 XM_H_PHPOS 935 0.96 0.90 0.98 181 FROM_LOCAL_DIGITS 924 0.31 0.89 0.02 182 RCVD_IN_IADB_VOUCHED 922 2.64 0.89 3.51 183 XMSubPhish11 918 0.43 0.89 0.20 184 RCVD_IN_PSBL 916 0.40 0.88 0.16 185 RDNS_DYNAMIC 891 0.62 0.86 0.50 186 RELAYCOUNTRY_DE 873 0.61 0.84 0.50 187 XMSolicitRefs_0 869 0.42 0.84 0.21 188 FORGED_GMAIL_RCVD 856 0.49 0.83 0.32 189 LOADSA_MONEY_COMBO 852 0.43 0.82 0.24 190 BODY_ENHANCEMENT 847 0.28 0.82 0.02 191 XMClaimOffer 836 0.38 0.81 0.17 192 PLING_QUERY 828 0.43 0.80 0.25 193 XMMoneyMeta_00 826 0.40 0.80 0.21 194 XMSubMetaSSx_00 820 0.36 0.79 0.15 195 XM_H_PHPMailer 815 0.72 0.79 0.68 196 TM2_M_A_HREF_HREF 812 0.84 0.78 0.87 197 HTML_FONT_FACE_BAD 806 0.48 0.78 0.33 198 HTML_TAG_BALANCE_BODY 805 0.56 0.78 0.45 199 XM_Body_Obfu01 800 0.35 0.77 0.15 200 FSL_THIS_IS_ADV 798 0.29 0.77 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156855 80.89 94.00 74.43 2 DKIM_SIGNED 136474 70.85 83.24 64.76 3 XM_DK_Pass 134589 69.40 80.65 63.87 4 DCC_CHECK_NEGATIVE 129462 46.98 17.59 61.43 5 DKIM_VALID 126660 65.18 75.50 60.11 6 BAYES_50 115359 46.92 31.01 54.74 7 DKIM_VALID_AU 94559 50.14 60.85 44.87 8 XMListUnsubscribeExists 87932 51.48 71.32 41.73 9 DCC_CHECK 78585 51.61 80.72 37.29 10 XM_H_QuotedFrom 73011 42.07 57.17 34.65 11 T_TM2_M_HEADER_IN_MSG 67544 27.74 18.96 32.05 12 ALL_TRUSTED 63732 21.97 5.16 30.24 13 DKIM_VALID_EF 54411 23.69 19.36 25.82 14 HTML_FONT_LOW_CONTRAST 52816 28.19 34.54 25.06 15 LOC_TINY_FONT_1 41247 25.14 36.46 19.57 16 FVGT_m_MULTI_ODD 40436 21.94 27.54 19.19 17 MIME_HTML_ONLY 38008 22.09 30.33 18.04 18 XM_DK_Undo_02 35479 27.99 50.67 16.84 19 XMSubLong 34716 18.82 23.59 16.47 20 MultiRelay 33399 16.24 17.03 15.85 21 BAYES_99 33281 25.89 46.41 15.79 22 XM_H_Long_From01 32088 12.83 7.96 15.23 23 BAYES_999 30047 22.86 40.34 14.26 24 T_KAM_HTML_FONT_INVALID 25718 14.67 19.67 12.20 25 FSL_BULK_SIG 23521 12.66 15.71 11.16 26 SUBJ_ALL_CAPS 23073 8.38 3.17 10.95 27 XM_DKIMWhitelistDomains 23056 7.38 0.15 10.94 28 XM_Multi_Part_URI 21979 12.56 16.89 10.43 29 LOTS_OF_MONEY 21341 10.95 12.62 10.13 30 RCVD_IN_RP_SAFE 21094 8.94 6.75 10.01 31 RCVD_IN_RP_CERTIFIED 19815 8.26 5.94 9.40 32 XM_Body_Dirty_Words 19567 13.34 21.59 9.29 33 HTML_IMAGE_RATIO_02 16527 11.38 18.57 7.84 34 TR_DCC_Bayes_99 16505 17.54 37.28 7.83 35 BAYES_60 14769 6.92 6.74 7.01 36 BAYES_40 14607 5.15 1.54 6.93 37 XM_Evil_Numbers_Gen 14356 8.90 13.15 6.81 38 T_XMDrugObfuBody_14 13154 7.53 10.16 6.24 39 LotsOfNums_01 12720 6.63 7.83 6.04 40 TooManyTo_001 12514 6.74 8.37 5.94 41 BAYES_00 12391 4.27 1.00 5.88 42 XMSubNoVowel 11072 4.78 3.83 5.25 43 XM_SendGrid 10789 4.75 4.01 5.12 44 BOTNET_IPINHOSTNAME 10515 7.42 12.37 4.99 45 RCVD_IN_IADB_LISTED 10241 4.07 2.48 4.86 46 IN_ZIMBRA_NJ_WHITELIST 10088 3.22 0.03 4.79 47 XM_UncommonTLD01 9826 5.25 6.43 4.66 48 DKIM_INVALID 9814 5.67 7.73 4.66 49 XMSubEmpty 9806 4.08 2.92 4.65 50 T_TooManySym_01 9791 4.18 3.25 4.65 51 XMStrtUSub 9499 4.42 4.24 4.51 52 T_REMOTE_IMAGE 9352 4.34 4.13 4.44 53 TR_XM_DK_Bayes 8763 3.02 0.72 4.16 54 RCVD_IN_IADB_SPF 8671 3.48 2.19 4.11 55 RCVD_IN_MSPIKE_H2 8568 4.26 4.66 4.07 56 UNPARSEABLE_RELAY 8560 3.34 1.88 4.06 57 XMSubMetaSx_00 8556 5.80 9.34 4.06 58 XM_B_Phish_Phrases 8518 5.40 8.17 4.04 59 RELAYCOUNTRY_META 8410 8.18 16.68 3.99 60 TR_XM_DK_Bayes1 8091 2.79 0.66 3.84 61 HTML_IMAGE_RATIO_04 8076 5.81 9.82 3.83 62 TVD_RCVD_IP 7995 2.65 0.31 3.79 63 XMNumbers 7845 4.16 5.04 3.72 64 BAYES_80 7845 4.82 7.06 3.72 65 RCVD_IN_IADB_SENDERID 7533 3.09 2.12 3.57 66 MIME_QP_LONG_LINE 7401 3.82 4.45 3.51 67 RCVD_IN_IADB_VOUCHED 7391 2.64 0.89 3.51 68 ANY_BOUNCE_MESSAGE 7391 2.52 0.51 3.51 69 BOUNCE_MESSAGE 7391 2.52 0.51 3.51 70 RCVD_IN_IADB_DK 7211 2.98 2.09 3.42 71 INVALID_MSGID 6803 2.25 0.25 3.23 72 TO_MALFORMED 6730 2.16 0.07 3.19 73 FROM_EXCESS_BASE64 6661 4.45 7.07 3.16 74 MPART_ALT_DIFF 6609 4.16 6.23 3.14 75 MSGID_NOFQDN1 6605 2.11 0.02 3.13 76 TR_XM_DK_Bayes2 6374 2.22 0.58 3.02 77 NO_DNS_FOR_FROM 6170 3.44 4.47 2.93 78 HTML_IMAGE_RATIO_06 5967 3.23 4.04 2.83 79 XMSexyCombo_05 5852 5.41 10.77 2.78 80 TR_XM_DocInvoice 5852 4.37 7.62 2.78 81 MIME_HTML_MOSTLY 5157 3.01 4.16 2.45 82 BAYES_95 5121 3.02 4.23 2.43 83 IN_HORDE_ADDRESS_BOOK 5010 1.63 0.10 2.38 84 RCVD_IN_MSPIKE_H3 5005 2.02 1.29 2.38 85 RCVD_IN_MSPIKE_WL 5005 2.02 1.29 2.38 86 TR_Symld_Words 4867 1.88 1.00 2.31 87 MAILING_LIST_MULTI 4797 2.08 1.69 2.28 88 RCVD_IN_IADB_OPTIN 4634 1.69 0.66 2.20 89 USER_IN_DEF_DKIM_WL 4318 1.40 0.09 2.05 90 XM_PDF 4037 1.62 1.01 1.92 91 BAYES_20 4010 1.70 1.30 1.90 92 T_TooManySym_02 3948 1.50 0.74 1.87 93 XM_DIRTYINTL 3546 2.64 4.58 1.68 94 XM_DK_Undo_01 3546 1.56 1.31 1.68 95 TR_Mismatch_TLD_01 3520 2.25 3.43 1.67 96 XM_CamelCaseFrm001 3434 2.16 3.23 1.63 97 TooManyTo_002 3432 1.77 2.07 1.63 98 HTML_MIME_NO_HTML_TAG 3337 1.86 2.43 1.58 99 HTML_IMAGE_RATIO_08 3246 2.26 3.71 1.54 100 URI_HEX 3210 2.11 3.31 1.52 101 BOTNET 3159 5.16 12.59 1.50 102 BAYES_05 3122 1.21 0.66 1.48 103 TM2_M_URI_OPT_OUT 3046 2.13 3.51 1.45 104 XM_GoogleGroups 2943 1.11 0.52 1.40 105 MIME_HTML_ONLY_MULTI 2759 1.81 2.83 1.31 106 UNTRUSTED_Relay 2643 4.14 9.99 1.25 107 XM_SPF_SoftFail 2582 1.75 2.82 1.23 108 XMDiploma_00 2497 1.37 1.73 1.18 109 RELAYCOUNTRY_CA 2493 1.93 3.44 1.18 110 URI_TRY_3LD 2458 1.11 0.99 1.17 111 USER_IN_WHITELIST 2454 0.78 0.00 1.16 112 TooManyTo_003 2336 1.37 1.90 1.11 113 XM_OfRef6 2280 1.83 3.36 1.08 114 XM_ProductURIs 2277 1.17 1.34 1.08 115 TVD_SPACE_RATIO 2248 1.22 1.52 1.07 116 XMEmptySub 2234 1.14 1.29 1.06 117 T_XMDrugObfuBody_08 2161 1.30 1.87 1.03 118 XM_H_PHPOS 2068 0.96 0.90 0.98 119 HELO_NODOT 1962 0.71 0.25 0.93 120 T_TooManySym_03 1953 0.65 0.10 0.93 121 XMPhish11 1861 0.91 0.98 0.88 122 SHORT_URI_2 1842 1.25 2.01 0.87 123 TM2_M_A_HREF_HREF 1827 0.84 0.78 0.87 124 XM_UB50 1781 1.86 3.93 0.85 125 TooManyTo_004 1768 1.10 1.64 0.84 126 XM_B_COPY_HTML 1630 0.87 1.05 0.77 127 XM_B_REG_HTML 1622 0.95 1.31 0.77 128 XMStockSpam_06 1595 0.91 1.24 0.76 129 T_XMDrugObfuBody_00 1589 0.96 1.39 0.75 130 DKIM_ADSP_CUSTOM_MED 1582 1.12 1.87 0.75 131 XMBdyGiftCard01 1565 1.23 2.23 0.74 132 TooManyTo_005 1511 0.98 1.50 0.72 133 TM2_M_VERY_LONG_WORD 1494 1.29 2.48 0.71 134 XMBody_95 1472 0.52 0.17 0.70 135 UPPERCASE_50_75 1443 0.53 0.23 0.68 136 XMSubMetaSxObfu_02 1441 0.58 0.35 0.68 137 XM_H_PHPMailer 1440 0.72 0.79 0.68 138 XM_H_Long_From02 1436 0.97 1.55 0.68 139 TO_IN_SUBJ 1421 0.84 1.18 0.67 140 TR_MetaPhish_Combo_01 1415 0.67 0.68 0.67 141 XM_D_tchamptons_WL 1400 0.45 0.00 0.66 142 PP_MIME_FAKE_ASCII_TEXT 1354 0.57 0.42 0.64 143 XMGenDplmaNmb 1333 0.86 1.33 0.63 144 T_FILL_THIS_FORM_SHORT 1321 0.67 0.76 0.63 145 RCVD_IN_BL_SPAMCOP_NET 1295 1.59 3.56 0.61 146 RELAYCOUNTRY_GB 1243 0.61 0.65 0.59 147 XMCapTrack 1176 0.54 0.51 0.56 148 XMSubMetaI_00 1104 0.95 1.82 0.52 149 RDNS_DYNAMIC 1061 0.62 0.86 0.50 150 NML_ADSP_CUSTOM_MED 1054 0.91 1.74 0.50 151 SpammyFromTLD_01 1052 0.92 1.76 0.50 152 RELAYCOUNTRY_DE 1051 0.61 0.84 0.50 153 T_TooManySym_04 1024 0.33 0.02 0.49 154 T_XMHurry_00 983 1.01 2.10 0.47 155 XM_D_ioffer_Whitelist 982 0.31 0.00 0.47 156 T_Symld_Words_02 959 0.55 0.73 0.46 157 XMBody_78 950 0.62 0.97 0.45 158 XMNoVowels 943 0.42 0.37 0.45 159 HTML_TAG_BALANCE_BODY 942 0.56 0.78 0.45 160 AC_DIV_BONANZA 940 0.34 0.12 0.45 161 DKIM_ADSP_NXDOMAIN 935 0.45 0.46 0.44 162 TR_LOTS_OF_MONEY2 928 0.78 1.46 0.44 163 T_MONEY_PERCENT 928 0.78 1.46 0.44 164 FILL_THIS_FORM 920 0.73 1.31 0.44 165 XM_ShortIntro_01 894 0.37 0.25 0.42 166 XM_B_TRADE_HTML 862 0.48 0.62 0.41 167 URI_NOVOWEL 842 0.59 0.98 0.40 168 XMRcvdHeader_15 827 0.26 0.00 0.39 169 HTML_IMAGE_ONLY_32 822 0.37 0.34 0.39 170 FORGED_HOTMAIL_RCVD2 812 0.28 0.08 0.39 171 SHORT_URI 805 0.47 0.66 0.38 172 XMHTMLBadTable_001 782 0.57 0.97 0.37 173 T_FILL_THIS_FORM_LOAN 764 0.62 1.15 0.36 174 DATE_IN_FUTURE_06_12 758 0.27 0.08 0.36 175 FILL_THIS_FORM_LONG 755 0.66 1.26 0.36 176 MIME_BASE64_TEXT 739 0.36 0.37 0.35 177 XMPhish30 733 0.96 2.20 0.35 178 XM_H_PHPOS_M 725 0.39 0.48 0.34 179 XMSUPPORT 718 0.23 0.00 0.34 180 MISSING_HEADERS 712 0.39 0.49 0.34 181 XMSexyCombo_01 704 0.90 2.06 0.33 182 XMBrknScrpt_02 699 0.41 0.56 0.33 183 XMBody_17 695 0.90 2.05 0.33 184 HTML_FONT_FACE_BAD 688 0.48 0.78 0.33 185 HTML_IMAGE_ONLY_24 685 0.38 0.48 0.33 186 FROM_EGROUPS 684 0.23 0.02 0.32 187 DATE_IN_FUTURE_03_06 679 0.23 0.06 0.32 188 FORGED_GMAIL_RCVD 678 0.49 0.83 0.32 189 XMLngstWrd_00 676 0.58 1.10 0.32 190 XM_H_SpoofStaff4 666 0.23 0.05 0.32 191 T_OBFU_PDF_ATTACH 665 0.24 0.09 0.32 192 XMManySubDom_06 660 0.24 0.09 0.31 193 XMGappySubj_01 659 0.39 0.54 0.31 194 MPART_ALT_DIFF_COUNT 651 0.82 1.85 0.31 195 RELAYCOUNTRY_NL 634 0.35 0.44 0.30 196 XMSubMetaSxObfu_03 634 0.33 0.39 0.30 197 XM_BadFromFormat 626 0.83 1.92 0.30 198 RELAYCOUNTRY_FR 626 0.93 2.21 0.30 199 XMSlimDrugH 619 0.53 1.02 0.29 200 XMManySubDom_07 613 0.22 0.08 0.29 ----------------------------------------------------------------------