Email: 322358 Autolearn: 0 AvgScore: 4.05 AvgScanTime: 2.81 sec Spam: 108627 Autolearn: 0 AvgScore: 13.04 AvgScanTime: 3.55 sec Ham: 213731 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 2.43 sec Time Spent Running SA: 251.42 hours Time Spent Processing Spam: 107.24 hours Time Spent Processing Ham: 144.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101828 81.28 93.74 74.95 2 DKIM_SIGNED 89930 68.90 82.79 61.83 3 XM_DK_Pass 87764 67.71 80.79 61.06 4 DCC_CHECK 86430 50.15 79.57 35.20 5 DKIM_VALID 83194 64.01 76.59 57.61 6 XMListUnsubscribeExists 76832 49.62 70.73 38.89 7 DKIM_VALID_AU 70186 51.68 64.61 45.10 8 XM_H_QuotedFrom 61360 38.87 56.49 29.91 9 XM_DK_Undo_02 52259 26.87 48.11 16.08 10 BAYES_99 47908 25.52 44.10 16.08 11 BAYES_999 41938 22.55 38.61 14.39 12 LOC_TINY_FONT_1 41892 26.51 38.56 20.38 13 HTML_FONT_LOW_CONTRAST 41056 28.63 37.80 23.97 14 TR_DCC_Bayes_99 38807 17.84 35.73 8.75 15 BAYES_50 34690 48.63 31.93 57.12 16 MIME_HTML_ONLY 32205 21.35 29.65 17.13 17 XMSubLong 28922 21.49 26.63 18.88 18 FVGT_m_MULTI_ODD 26626 19.08 24.51 16.32 19 DKIM_VALID_EF 22521 23.34 20.73 24.66 20 HTML_IMAGE_RATIO_02 22058 12.26 20.31 8.17 21 XM_Body_Dirty_Words 21712 13.22 19.99 9.78 22 T_TM2_M_HEADER_IN_MSG 20812 25.64 19.16 28.93 23 DCC_CHECK_NEGATIVE 20555 48.64 18.92 63.74 24 RELAYCOUNTRY_META 20307 9.12 18.69 4.26 25 T_KAM_HTML_FONT_INVALID 20294 13.10 18.68 10.27 26 XM_Multi_Part_URI 16937 11.99 15.59 10.15 27 BOTNET 16829 5.76 15.49 0.82 28 MultiRelay 15678 13.88 14.43 13.60 29 XM_Evil_Numbers_Gen 15477 9.96 14.25 7.78 30 FSL_BULK_SIG 15382 10.99 14.16 9.37 31 UNTRUSTED_Relay 13367 5.04 12.31 1.35 32 BOTNET_IPINHOSTNAME 13346 7.46 12.29 5.00 33 LOTS_OF_MONEY 12345 9.10 11.36 7.95 34 XMSexyCombo_05 11103 5.97 10.22 3.82 35 XM_B_Phish_Phrases 11063 6.02 10.18 3.90 36 HTML_IMAGE_RATIO_04 10542 6.15 9.70 4.35 37 T_XMDrugObfuBody_14 9911 6.67 9.12 5.42 38 TR_XM_DocInvoice 9216 5.07 8.48 3.34 39 RCVD_IN_RP_SAFE 8961 9.58 8.25 10.25 40 LotsOfNums_01 8470 6.56 7.80 5.94 41 FROM_EXCESS_BASE64 8407 5.10 7.74 3.76 42 MPART_ALT_DIFF 8252 4.38 7.60 2.75 43 XM_H_Long_From01 8075 11.58 7.43 13.69 44 BAYES_80 7942 4.55 7.31 3.15 45 XM_UncommonTLD01 7918 5.34 7.29 4.36 46 TooManyTo_001 7685 6.36 7.07 6.00 47 BAYES_60 7593 6.01 6.99 5.52 48 RCVD_IN_RP_CERTIFIED 6826 8.45 6.28 9.55 49 DKIM_INVALID 6736 4.89 6.20 4.22 50 HTML_IMAGE_RATIO_06 6679 4.00 6.15 2.90 51 XMSubMetaSx_00 6676 5.06 6.15 4.51 52 RCVD_IN_RP_RNBL 6265 1.98 5.77 0.05 53 XMStrtUSub 6199 5.26 5.71 5.04 54 XM_OfRef6 6084 7.52 5.60 8.50 55 XMNumbers 5853 7.40 5.39 8.42 56 XM_UB50 5567 2.31 5.12 0.87 57 MIME_HTML_MOSTLY 5270 3.55 4.85 2.88 58 T_REMOTE_IMAGE 4922 3.94 4.53 3.63 59 XM_SPF_SoftFail 4668 2.12 4.30 1.01 60 RELAYCOUNTRY_CN 4426 1.42 4.07 0.06 61 BAYES_95 4394 3.02 4.05 2.51 62 MultiRelay_CC 4329 1.46 3.99 0.18 63 MultiRelay_Combo 4329 1.46 3.99 0.18 64 XM_SendGrid 4023 4.09 3.70 4.28 65 SpammyFromTLD_01 3796 1.41 3.49 0.36 66 T_TooManySym_01 3749 3.82 3.45 4.01 67 RCVD_IN_MSPIKE_H2 3713 3.69 3.42 3.84 68 BOTNET_NORDNS 3643 1.14 3.35 0.01 69 TM2_M_URI_OPT_OUT 3633 1.98 3.34 1.29 70 RELAYCOUNTRY_CA 3622 1.92 3.33 1.20 71 SpammyFromTLD_02 3392 1.15 3.12 0.15 72 ALL_TRUSTED 3250 23.07 2.99 33.28 73 XM_DIRTYINTL 3162 2.17 2.91 1.80 74 MIME_QP_LONG_LINE 3135 3.18 2.89 3.33 75 RCVD_IN_BL_SPAMCOP_NET 3128 1.09 2.88 0.19 76 URI_HEX 3051 1.76 2.81 1.22 77 NO_DNS_FOR_FROM 3004 2.12 2.77 1.80 78 XMPhish11 2980 1.52 2.74 0.90 79 ANY_BOUNCE_MESSAGE 2951 3.49 2.72 3.88 80 BOUNCE_MESSAGE 2950 3.48 2.72 3.88 81 XM_CamelCaseFrm001 2913 1.88 2.68 1.47 82 MIME_HTML_ONLY_MULTI 2877 1.50 2.65 0.91 83 XM_B_REG_HTML 2798 1.26 2.58 0.59 84 XMLongAddy 2640 0.94 2.43 0.18 85 UNPARSEABLE_RELAY 2640 3.65 2.43 4.28 86 HTML_MIME_NO_HTML_TAG 2635 1.82 2.43 1.51 87 XMBdyGiftCard01 2603 1.92 2.40 1.67 88 XM_OfRef7 2592 5.37 2.39 6.89 89 SUBJ_ALL_CAPS 2588 7.58 2.38 10.22 90 T_FILL_THIS_FORM_SHORT 2587 1.10 2.38 0.44 91 TR_Mismatch_TLD_02 2489 0.82 2.29 0.07 92 XM_UB60 2364 0.79 2.18 0.08 93 XMSubNoVowel 2317 1.64 2.13 1.39 94 URIBL_DBL_SPAM 2288 0.73 2.11 0.04 95 XM_ProductURIs 2259 1.79 2.08 1.65 96 XMBody_17 2175 0.93 2.00 0.38 97 HTML_IMAGE_RATIO_08 2169 1.72 2.00 1.58 98 XMSubMetaI_00 2080 0.91 1.91 0.40 99 BODY_URI_ONLY 2023 0.67 1.86 0.06 100 XMDiploma_00 1975 1.43 1.82 1.24 101 XM_BadFromFormat 1937 0.81 1.78 0.32 102 URIBL_BLACK 1935 0.62 1.78 0.02 103 HTML_IMAGE_ONLY_08 1922 0.68 1.77 0.12 104 MONEY_FRAUD_8 1899 0.60 1.75 0.01 105 HTML_SHORT_LINK_IMG_1 1883 0.61 1.73 0.03 106 XM_UB99 1881 0.59 1.73 0.01 107 T_XMDrugObfuBody_08 1860 1.24 1.71 1.00 108 RELAYCOUNTRY_ZA 1825 0.59 1.68 0.03 109 BAYES_40 1807 5.20 1.66 6.99 110 XMPhish19 1779 0.58 1.64 0.05 111 T_DEAR_BENEFICIARY 1758 0.55 1.62 0.01 112 TM2_M_VERY_LONG_WORD 1751 1.08 1.61 0.82 113 MONEY_FORM_SHORT 1741 0.55 1.60 0.01 114 BAYES_20 1733 1.79 1.60 1.89 115 XM_H_Long_From03 1714 0.65 1.58 0.18 116 XMPhish30 1696 0.65 1.56 0.18 117 HELO_NODOT 1695 1.02 1.56 0.74 118 XM_URI_RBL 1692 0.58 1.56 0.08 119 FORM_FRAUD_5 1649 0.51 1.52 0.00 120 MAILING_LIST_MULTI 1647 1.80 1.52 1.95 121 XM_Attn_01 1622 0.52 1.49 0.03 122 FSL_HELO_NON_FQDN_1 1615 0.53 1.49 0.04 123 XM_H_Long_From02 1612 1.00 1.48 0.76 124 XM_UB80 1606 0.52 1.48 0.03 125 T_XMDrugObfuBody_00 1590 0.82 1.46 0.49 126 MISSING_HEADERS 1585 0.96 1.46 0.70 127 DIET_1 1562 0.66 1.44 0.27 128 XMNoVowels 1554 1.70 1.43 1.83 129 TR_Mismatch_TLD_01 1548 0.77 1.43 0.44 130 BODY_ENHANCEMENT 1525 0.50 1.40 0.04 131 REPLYTO_WITHOUT_TO_CC 1499 0.58 1.38 0.17 132 XM_RXBody 1499 0.60 1.38 0.21 133 RELAYCOUNTRY_FR 1497 0.62 1.38 0.23 134 XM_UB999 1494 0.47 1.38 0.01 135 BAYES_00 1483 4.03 1.37 5.38 136 RCVD_IN_IADB_LISTED 1472 2.70 1.36 3.38 137 LONG_JUNK_URI3 1468 0.51 1.35 0.09 138 RELAYCOUNTRY_IN 1466 0.49 1.35 0.05 139 FILL_THIS_FORM 1458 5.45 1.34 7.54 140 PLING_QUERY 1435 0.69 1.32 0.36 141 XMSexyCombo_01 1420 1.16 1.31 1.09 142 XM_DK_Undo_01 1418 1.54 1.31 1.66 143 DKIM_ADSP_CUSTOM_MED 1368 1.08 1.26 1.00 144 XMHTML_After_End 1355 0.61 1.25 0.29 145 RCVD_IN_IADB_SPF 1321 2.35 1.22 2.93 146 XM_B_COPY_HTML 1280 0.79 1.18 0.60 147 FILL_THIS_FORM_LONG 1269 4.49 1.17 6.18 148 RCVD_IN_IADB_SENDERID 1261 2.10 1.16 2.58 149 DATE_IN_PAST_12_24 1256 0.41 1.16 0.03 150 RCVD_IN_IADB_DK 1245 2.03 1.15 2.48 151 XMHTMLBadTable_001 1225 0.81 1.13 0.65 152 XMSubEmpty 1219 1.13 1.12 1.14 153 T_FILL_THIS_FORM_LOAN 1207 0.75 1.11 0.56 154 FORGED_GMAIL_RCVD 1206 0.65 1.11 0.41 155 NML_ADSP_CUSTOM_MED 1197 0.84 1.10 0.71 156 TR_LOTS_OF_MONEY3 1194 0.49 1.10 0.18 157 GAPPY_SUBJECT 1173 0.41 1.08 0.06 158 T_TooManySym_02 1172 1.59 1.08 1.85 159 XMStockSpam_06 1158 1.30 1.07 1.42 160 RELAYCOUNTRY_AT 1155 0.42 1.06 0.10 161 RELAYCOUNTRY_GB 1139 0.75 1.05 0.60 162 URI_TRY_3LD 1123 1.05 1.03 1.06 163 TR_XM_RelayPhish 1116 0.52 1.03 0.27 164 FROM_LOCAL_HEX 1099 0.40 1.01 0.08 165 TR_XM_DK_Bayes 1091 2.73 1.00 3.60 166 T_XMHurry_00 1070 0.56 0.99 0.34 167 HTML_FONT_SIZE_HUGE 1065 0.48 0.98 0.23 168 TR_XM_DK_Bayes1 1048 2.49 0.96 3.27 169 TM2_M_BODY_EMPTY 1034 0.53 0.95 0.31 170 TR_LOTS_OF_MONEY1 1025 0.34 0.94 0.03 171 BAYES_05 1025 1.18 0.94 1.30 172 HTML_FONT_SIZE_LARGE 1024 0.42 0.94 0.16 173 HDRS_LCASE_IMGONLY 1020 0.34 0.94 0.04 174 XM_H_PHPOS 1015 1.23 0.93 1.37 175 XMGenDplmaNmb 1011 0.72 0.93 0.61 176 XMSubMetaSSx_00 1011 0.47 0.93 0.24 177 REMOVE_BEFORE_LINK 1006 0.47 0.93 0.24 178 RDNS_DYNAMIC 1005 0.57 0.93 0.39 179 FROM_LOCAL_DIGITS 1002 0.32 0.92 0.02 180 T_Symld_Words_02 999 0.66 0.92 0.52 181 XMEmptyBody_01 996 0.41 0.92 0.15 182 SUBJ_DOLLARS 985 0.40 0.91 0.14 183 SUBJECT_NEEDS_ENCODING 981 0.32 0.90 0.03 184 SUBJ_ILLEGAL_CHARS 981 0.32 0.90 0.03 185 TR_Symld_Words 980 1.49 0.90 1.80 186 XM_HighProb1 959 0.31 0.88 0.02 187 LONG_JUNK_URI2 946 0.30 0.87 0.01 188 MPART_ALT_DIFF_COUNT 939 0.52 0.86 0.34 189 XMBody_78 906 0.64 0.83 0.54 190 LONG_JUNK_URI 899 0.29 0.83 0.02 191 T_HTML_TAG_BALANCE_CENTER 897 0.44 0.83 0.25 192 TR_XM_DK_Bayes2 886 2.15 0.82 2.83 193 TR_LOTS_OF_MONEY2 880 0.90 0.81 0.94 194 T_MONEY_PERCENT 880 0.90 0.81 0.94 195 XMSlimDrugH 878 0.50 0.81 0.34 196 RELAYCOUNTRY_NL 871 0.39 0.80 0.18 197 TR_Caps_n_Bayes_99 863 0.29 0.79 0.04 198 RELAYCOUNTRY_DE 855 0.60 0.79 0.51 199 CHARSET_FARAWAY_HEADER 855 0.35 0.79 0.12 200 XM_H_PHPMailer 823 0.79 0.76 0.80 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160197 81.28 93.74 74.95 2 DCC_CHECK_NEGATIVE 136239 48.64 18.92 63.74 3 DKIM_SIGNED 132159 68.90 82.79 61.83 4 XM_DK_Pass 130511 67.71 80.79 61.06 5 DKIM_VALID 123138 64.01 76.59 57.61 6 BAYES_50 122075 48.63 31.93 57.12 7 DKIM_VALID_AU 96395 51.68 64.61 45.10 8 XMListUnsubscribeExists 83111 49.62 70.73 38.89 9 DCC_CHECK 75229 50.15 79.57 35.20 10 ALL_TRUSTED 71124 23.07 2.99 33.28 11 XM_H_QuotedFrom 63935 38.87 56.49 29.91 12 T_TM2_M_HEADER_IN_MSG 61839 25.64 19.16 28.93 13 DKIM_VALID_EF 52703 23.34 20.73 24.66 14 HTML_FONT_LOW_CONTRAST 51225 28.63 37.80 23.97 15 LOC_TINY_FONT_1 43562 26.51 38.56 20.38 16 XMSubLong 40345 21.49 26.63 18.88 17 MIME_HTML_ONLY 36610 21.35 29.65 17.13 18 FVGT_m_MULTI_ODD 34890 19.08 24.51 16.32 19 BAYES_99 34368 25.52 44.10 16.08 20 XM_DK_Undo_02 34367 26.87 48.11 16.08 21 BAYES_999 30756 22.55 38.61 14.39 22 XM_H_Long_From01 29256 11.58 7.43 13.69 23 MultiRelay 29058 13.88 14.43 13.60 24 XM_DKIMWhitelistDomains 26860 8.34 0.03 12.57 25 T_KAM_HTML_FONT_INVALID 21940 13.10 18.68 10.27 26 RCVD_IN_RP_SAFE 21918 9.58 8.25 10.25 27 SUBJ_ALL_CAPS 21845 7.58 2.38 10.22 28 XM_Multi_Part_URI 21704 11.99 15.59 10.15 29 XM_Body_Dirty_Words 20912 13.22 19.99 9.78 30 RCVD_IN_RP_CERTIFIED 20420 8.45 6.28 9.55 31 FSL_BULK_SIG 20030 10.99 14.16 9.37 32 TR_DCC_Bayes_99 18711 17.84 35.73 8.75 33 XM_OfRef6 18158 7.52 5.60 8.50 34 XMNumbers 18006 7.40 5.39 8.42 35 HTML_IMAGE_RATIO_02 17468 12.26 20.31 8.17 36 LOTS_OF_MONEY 16995 9.10 11.36 7.95 37 XM_Evil_Numbers_Gen 16627 9.96 14.25 7.78 38 FILL_THIS_FORM 16114 5.45 1.34 7.54 39 BAYES_40 14947 5.20 1.66 6.99 40 XM_OfRef7 14733 5.37 2.39 6.89 41 FILL_THIS_FORM_LONG 13202 4.49 1.17 6.18 42 TooManyTo_001 12832 6.36 7.07 6.00 43 LotsOfNums_01 12691 6.56 7.80 5.94 44 BAYES_60 11789 6.01 6.99 5.52 45 T_XMDrugObfuBody_14 11591 6.67 9.12 5.42 46 BAYES_00 11499 4.03 1.37 5.38 47 XMStrtUSub 10766 5.26 5.71 5.04 48 BOTNET_IPINHOSTNAME 10695 7.46 12.29 5.00 49 XMSubMetaSx_00 9645 5.06 6.15 4.51 50 IN_ZIMBRA_NJ_WHITELIST 9512 2.96 0.02 4.45 51 XM_UncommonTLD01 9312 5.34 7.29 4.36 52 HTML_IMAGE_RATIO_04 9298 6.15 9.70 4.35 53 XM_SendGrid 9153 4.09 3.70 4.28 54 UNPARSEABLE_RELAY 9142 3.65 2.43 4.28 55 RELAYCOUNTRY_META 9107 9.12 18.69 4.26 56 DKIM_INVALID 9021 4.89 6.20 4.22 57 T_TooManySym_01 8571 3.82 3.45 4.01 58 TVD_RCVD_IP 8513 2.82 0.53 3.98 59 XM_B_Phish_Phrases 8330 6.02 10.18 3.90 60 ANY_BOUNCE_MESSAGE 8284 3.49 2.72 3.88 61 BOUNCE_MESSAGE 8283 3.48 2.72 3.88 62 RCVD_IN_MSPIKE_H2 8197 3.69 3.42 3.84 63 XMSexyCombo_05 8154 5.97 10.22 3.82 64 FROM_EXCESS_BASE64 8034 5.10 7.74 3.76 65 T_REMOTE_IMAGE 7765 3.94 4.53 3.63 66 TR_XM_DK_Bayes 7703 2.73 1.00 3.60 67 TO_MALFORMED 7381 2.29 0.01 3.45 68 RCVD_IN_IADB_LISTED 7232 2.70 1.36 3.38 69 TR_XM_DocInvoice 7141 5.07 8.48 3.34 70 MIME_QP_LONG_LINE 7110 3.18 2.89 3.33 71 TR_XM_DK_Bayes1 6986 2.49 0.96 3.27 72 INVALID_MSGID 6831 2.23 0.32 3.20 73 BAYES_80 6727 4.55 7.31 3.15 74 MSGID_NOFQDN1 6351 1.98 0.03 2.97 75 RCVD_IN_IADB_SPF 6264 2.35 1.22 2.93 76 HTML_IMAGE_RATIO_06 6201 4.00 6.15 2.90 77 MIME_HTML_MOSTLY 6161 3.55 4.85 2.88 78 TR_XM_DK_Bayes2 6047 2.15 0.82 2.83 79 MPART_ALT_DIFF 5875 4.38 7.60 2.75 80 RCVD_IN_IADB_SENDERID 5514 2.10 1.16 2.58 81 BAYES_95 5354 3.02 4.05 2.51 82 RCVD_IN_IADB_DK 5303 2.03 1.15 2.48 83 IN_HORDE_ADDRESS_BOOK 5189 1.64 0.09 2.43 84 RCVD_IN_IADB_VOUCHED 5138 1.79 0.58 2.40 85 MAILING_LIST_MULTI 4166 1.80 1.52 1.95 86 XM_PDF 4048 1.44 0.55 1.89 87 BAYES_20 4035 1.79 1.60 1.89 88 T_TooManySym_02 3954 1.59 1.08 1.85 89 XMNoVowels 3921 1.70 1.43 1.83 90 NO_DNS_FOR_FROM 3845 2.12 2.77 1.80 91 TR_Symld_Words 3838 1.49 0.90 1.80 92 XM_DIRTYINTL 3838 2.17 2.91 1.80 93 RCVD_IN_MSPIKE_WL 3670 1.37 0.69 1.72 94 USER_IN_DEF_DKIM_WL 3669 1.15 0.03 1.72 95 RCVD_IN_MSPIKE_H3 3659 1.36 0.68 1.71 96 XMBdyGiftCard01 3574 1.92 2.40 1.67 97 XM_DK_Undo_01 3552 1.54 1.31 1.66 98 XM_ProductURIs 3520 1.79 2.08 1.65 99 TooManyTo_002 3509 1.32 0.67 1.64 100 HTML_IMAGE_RATIO_08 3387 1.72 2.00 1.58 101 RCVD_IN_IADB_OPTIN 3247 1.15 0.42 1.52 102 HTML_MIME_NO_HTML_TAG 3229 1.82 2.43 1.51 103 XM_CamelCaseFrm001 3146 1.88 2.68 1.47 104 XMStockSpam_06 3027 1.30 1.07 1.42 105 XMSubNoVowel 2966 1.64 2.13 1.39 106 XM_H_PHPOS 2937 1.23 0.93 1.37 107 UNTRUSTED_Relay 2882 5.04 12.31 1.35 108 BAYES_05 2775 1.18 0.94 1.30 109 TM2_M_URI_OPT_OUT 2759 1.98 3.34 1.29 110 T_FILL_THIS_FORM_LONG 2740 0.90 0.13 1.28 111 XM_GoogleGroups 2675 1.00 0.52 1.25 112 XMDiploma_00 2643 1.43 1.82 1.24 113 URI_HEX 2607 1.76 2.81 1.22 114 RELAYCOUNTRY_CA 2573 1.92 3.33 1.20 115 TooManyTo_003 2536 0.99 0.59 1.19 116 XMSubEmpty 2429 1.13 1.12 1.14 117 USER_IN_WHITELIST 2358 0.73 0.00 1.10 118 XMSexyCombo_01 2333 1.16 1.31 1.09 119 T_TooManySym_03 2299 0.88 0.50 1.08 120 URI_TRY_3LD 2255 1.05 1.03 1.06 121 XM_SPF_SoftFail 2150 2.12 4.30 1.01 122 T_XMDrugObfuBody_08 2142 1.24 1.71 1.00 123 DKIM_ADSP_CUSTOM_MED 2128 1.08 1.26 1.00 124 TooManyTo_004 2032 0.77 0.43 0.95 125 T_MONEY_PERCENT 2007 0.90 0.81 0.94 126 TR_LOTS_OF_MONEY2 2007 0.90 0.81 0.94 127 MIME_HTML_ONLY_MULTI 1948 1.50 2.65 0.91 128 XMPhish11 1918 1.52 2.74 0.90 129 XMSexyCombo_04 1875 0.81 0.67 0.88 130 XM_UB50 1865 2.31 5.12 0.87 131 XMBody_95 1783 0.61 0.16 0.83 132 TooManyTo_005 1752 0.67 0.36 0.82 133 BOTNET 1750 5.76 15.49 0.82 134 TM2_M_VERY_LONG_WORD 1745 1.08 1.61 0.82 135 XM_H_PHPMailer 1719 0.79 0.76 0.80 136 XM_H_Long_From02 1627 1.00 1.48 0.76 137 HELO_NODOT 1581 1.02 1.56 0.74 138 NML_ADSP_CUSTOM_MED 1516 0.84 1.10 0.71 139 MISSING_HEADERS 1505 0.96 1.46 0.70 140 XMSubMetaSxObfu_02 1475 0.55 0.26 0.69 141 XMHTMLBadTable_001 1393 0.81 1.13 0.65 142 URI_WP_HACKED_2 1388 0.56 0.39 0.65 143 XM_H_PHPOS_M 1350 0.59 0.51 0.63 144 XMGenDplmaNmb 1301 0.72 0.93 0.61 145 RELAYCOUNTRY_GB 1284 0.75 1.05 0.60 146 XM_B_COPY_HTML 1281 0.79 1.18 0.60 147 TR_MetaPhish_Combo_01 1269 0.61 0.65 0.59 148 XM_B_REG_HTML 1265 1.26 2.58 0.59 149 T_TooManySym_04 1204 0.45 0.23 0.56 150 T_FILL_THIS_FORM_LOAN 1197 0.75 1.11 0.56 151 HTML_FONT_FACE_BAD 1196 0.61 0.72 0.56 152 XMLngstWrd_00 1173 0.60 0.70 0.55 153 XMBody_78 1164 0.64 0.83 0.54 154 T_Symld_Words_02 1121 0.66 0.92 0.52 155 XMCapTrack 1111 0.48 0.41 0.52 156 RELAYCOUNTRY_DE 1090 0.60 0.79 0.51 157 UPPERCASE_50_75 1072 0.46 0.37 0.50 158 TM2_M_A_HREF_HREF 1063 0.44 0.32 0.50 159 XMLngstWrd_01 1050 0.55 0.67 0.49 160 T_XMDrugObfuBody_00 1039 0.82 1.46 0.49 161 XM_D_tchamptons_WL 984 0.31 0.00 0.46 162 XM_Combo_Sbj 978 0.41 0.32 0.46 163 T_FILL_THIS_FORM_SHORT 948 1.10 2.38 0.44 164 PP_MIME_FAKE_ASCII_TEXT 943 0.50 0.62 0.44 165 TR_Mismatch_TLD_01 935 0.77 1.43 0.44 166 TVD_SPACE_RATIO 933 0.43 0.41 0.44 167 DKIM_ADSP_NXDOMAIN 913 0.45 0.51 0.43 168 FORGED_GMAIL_RCVD 878 0.65 1.11 0.41 169 IMPOTENCE 859 0.37 0.30 0.40 170 XMSubMetaI_00 850 0.91 1.91 0.40 171 RDNS_DYNAMIC 833 0.57 0.93 0.39 172 HTML_TAG_BALANCE_BODY 831 0.45 0.58 0.39 173 XMBody_17 822 0.93 2.00 0.38 174 SHORT_URI_2 819 0.47 0.65 0.38 175 XM_ShortIntro_01 816 0.35 0.30 0.38 176 XMDateMe_00 810 0.32 0.21 0.38 177 PLING_QUERY 779 0.69 1.32 0.36 178 XMSubMetaSxObfu_03 778 0.44 0.59 0.36 179 XMBrknScrpt_02 768 0.46 0.64 0.36 180 SpammyFromTLD_01 759 1.41 3.49 0.36 181 MPART_ALT_DIFF_COUNT 736 0.52 0.86 0.34 182 T_XMHurry_00 731 0.56 0.99 0.34 183 XMRcvdHeader_15 729 0.23 0.00 0.34 184 XMSlimDrugH 727 0.50 0.81 0.34 185 XM_BadFromFormat 677 0.81 1.78 0.32 186 FROM_EGROUPS 676 0.21 0.00 0.32 187 TM2_M_BODY_EMPTY 664 0.53 0.95 0.31 188 XMPhish14 658 0.32 0.33 0.31 189 XMBody_29 650 0.30 0.28 0.30 190 RELAYCOUNTRY_AU 640 0.41 0.61 0.30 191 XMGappySubj_01 638 0.41 0.62 0.30 192 HTML_IMAGE_ONLY_32 636 0.25 0.14 0.30 193 XMSUPPORT 633 0.20 0.00 0.30 194 XMLngstWrd_02 633 0.41 0.63 0.30 195 XMHTML_After_End 625 0.61 1.25 0.29 196 T_OBFU_PDF_ATTACH 622 0.23 0.12 0.29 197 XM_B_TRADE_HTML 610 0.28 0.27 0.29 198 XMEmptySub 607 0.32 0.38 0.28 199 TR_MetaPhish_Combo_01b 607 0.40 0.63 0.28 200 T_TooManySym_05 606 0.19 0.00 0.28 ----------------------------------------------------------------------