Email: 651128 Autolearn: 0 AvgScore: 2.66 AvgScanTime: 3.74 sec Spam: 180533 Autolearn: 0 AvgScore: 12.51 AvgScanTime: 4.61 sec Ham: 470595 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 3.40 sec Time Spent Running SA: 676.11 hours Time Spent Processing Spam: 231.28 hours Time Spent Processing Ham: 444.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167733 83.38 92.91 79.72 2 DKIM_SIGNED 153446 64.01 85.00 55.96 3 XM_DK_Pass 149640 62.69 82.89 54.94 4 DKIM_VALID 141261 58.52 78.25 50.95 5 DCC_CHECK 138703 40.06 76.83 25.96 6 XMListUnsubscribeExists 129646 45.01 71.81 34.73 7 DKIM_VALID_AU 109422 41.80 60.61 34.58 8 XM_H_QuotedFrom 101906 44.90 56.45 40.47 9 XM_DK_Undo_02 88971 20.93 49.28 10.06 10 BAYES_99 81293 19.53 45.03 9.75 11 BAYES_999 69429 16.81 38.46 8.50 12 TR_DCC_Bayes_99 63505 12.88 35.18 4.33 13 LOC_TINY_FONT_1 63331 20.21 35.08 14.51 14 HTML_FONT_LOW_CONTRAST 62577 23.81 34.66 19.65 15 BAYES_50 57935 47.72 32.09 53.71 16 MIME_HTML_ONLY 53116 17.98 29.42 13.59 17 XMSubLong 49724 21.16 27.54 18.71 18 FVGT_m_MULTI_ODD 47603 18.78 26.37 15.87 19 DKIM_VALID_EF 44451 21.33 24.62 20.07 20 T_TM2_M_HEADER_IN_MSG 39800 28.22 22.05 30.59 21 DCC_CHECK_NEGATIVE 38232 58.05 21.18 72.19 22 T_KAM_HTML_FONT_INVALID 37147 14.49 20.58 12.16 23 XM_Body_Dirty_Words 33291 11.78 18.44 9.22 24 XM_Multi_Part_URI 31336 10.70 17.36 8.14 25 MultiRelay 29852 16.08 16.54 15.91 26 RELAYCOUNTRY_META 27922 7.43 15.47 4.34 27 HTML_IMAGE_RATIO_02 27375 7.87 15.16 5.07 28 XM_Evil_Numbers_Gen 23525 8.65 13.03 6.97 29 FSL_BULK_SIG 22704 7.73 12.58 5.88 30 BOTNET_IPINHOSTNAME 21509 5.29 11.91 2.75 31 BOTNET 21301 3.96 11.80 0.95 32 LOTS_OF_MONEY 21300 8.08 11.80 6.65 33 XMSexyCombo_05 17787 4.39 9.85 2.30 34 LotsOfNums_01 17349 7.25 9.61 6.34 35 T_XMDrugObfuBody_14 16638 8.13 9.22 7.71 36 UNTRUSTED_Relay 15807 3.20 8.76 1.07 37 HTML_IMAGE_RATIO_04 15794 11.54 8.75 12.62 38 XM_B_Phish_Phrases 15578 5.13 8.63 3.79 39 XMSubMetaSx_00 14761 5.39 8.18 4.32 40 XM_H_Long_From01 14592 7.17 8.08 6.81 41 BAYES_80 13427 4.90 7.44 3.93 42 TooManyTo_001 13017 10.12 7.21 11.24 43 BAYES_60 13010 7.02 7.21 6.94 44 XM_UncommonTLD01 12386 3.99 6.86 2.89 45 TR_XM_DocInvoice 12299 3.94 6.81 2.84 46 FROM_EXCESS_BASE64 12210 3.61 6.76 2.40 47 DKIM_INVALID 12185 5.49 6.75 5.01 48 MPART_ALT_DIFF 10800 3.25 5.98 2.20 49 XMNumbers 10097 3.47 5.59 2.66 50 HTML_IMAGE_RATIO_06 9315 4.00 5.16 3.56 51 RCVD_IN_RP_SAFE 9181 5.50 5.09 5.65 52 BAYES_95 8343 3.11 4.62 2.53 53 XM_SendGrid 8034 4.17 4.45 4.07 54 T_REMOTE_IMAGE 7936 4.21 4.40 4.14 55 MIME_HTML_MOSTLY 7747 2.39 4.29 1.66 56 TM2_M_URI_OPT_OUT 7645 2.66 4.23 2.06 57 MIME_QP_LONG_LINE 7534 4.72 4.17 4.94 58 XM_DIRTYINTL 7492 2.16 4.15 1.40 59 HTML_IMAGE_RATIO_08 7256 2.88 4.02 2.45 60 XM_UB50 7154 1.66 3.96 0.77 61 SUBJ_ALL_CAPS 7153 3.87 3.96 3.83 62 RCVD_IN_RP_CERTIFIED 7151 4.86 3.96 5.20 63 XMStrtUSub 7004 6.95 3.88 8.13 64 XM_SPF_SoftFail 6668 2.31 3.69 1.78 65 XM_CamelCaseFrm001 6508 2.04 3.60 1.44 66 RCVD_IN_MSPIKE_H2 6479 3.68 3.59 3.71 67 RCVD_IN_BL_SPAMCOP_NET 5843 1.33 3.24 0.60 68 RELAYCOUNTRY_CA 5762 1.67 3.19 1.08 69 ALL_TRUSTED 5566 19.01 3.08 25.12 70 T_TooManySym_01 5487 2.94 3.04 2.90 71 MIME_HTML_ONLY_MULTI 5407 1.57 3.00 1.02 72 XM_OfRef6 5173 1.74 2.87 1.31 73 XMDiploma_00 4905 1.75 2.72 1.38 74 URI_HEX 4834 1.49 2.68 1.03 75 SpammyFromTLD_02 4759 0.96 2.64 0.32 76 XMNoVowels 4749 2.22 2.63 2.06 77 HTML_MIME_NO_HTML_TAG 4744 2.04 2.63 1.81 78 MultiRelay_Combo 4711 0.86 2.61 0.19 79 MultiRelay_CC 4711 0.86 2.61 0.19 80 RCVD_IN_IADB_LISTED 4580 4.65 2.54 5.46 81 RCVD_IN_IADB_SPF 4074 4.03 2.26 4.71 82 T_XMDrugObfuBody_08 4047 1.42 2.24 1.10 83 XMSlimDrugH 3967 0.99 2.20 0.53 84 XMHTML_After_End 3901 0.80 2.16 0.28 85 RCVD_IN_IADB_SENDERID 3864 3.57 2.14 4.12 86 XM_URI_RBL 3817 0.66 2.11 0.10 87 RCVD_IN_IADB_DK 3816 3.48 2.11 4.01 88 MISSING_HEADERS 3641 0.97 2.02 0.57 89 XMGenDplmaNmb 3613 1.25 2.00 0.96 90 XM_DK_Undo_01 3582 1.77 1.98 1.68 91 XMSexyCombo_01 3576 0.88 1.98 0.45 92 XM_H_Long_From02 3467 1.07 1.92 0.75 93 URIBL_BLACK 3467 0.55 1.92 0.03 94 REPLYTO_WITHOUT_TO_CC 3459 0.57 1.92 0.05 95 BOTNET_NORDNS 3429 0.54 1.90 0.01 96 T_MONEY_PERCENT 3400 0.74 1.88 0.30 97 TR_LOTS_OF_MONEY2 3400 0.74 1.88 0.30 98 ADVANCE_FEE_5_NEW_MONEY 3320 0.51 1.84 0.00 99 TM2_M_VERY_LONG_WORD 3316 1.02 1.84 0.70 100 UNPARSEABLE_RELAY 3284 2.00 1.82 2.07 101 TR_LOTS_OF_MONEY1 3250 0.52 1.80 0.02 102 SpammyFromTLD_01 3069 1.00 1.70 0.73 103 XMSubMetaI_00 3017 0.74 1.67 0.39 104 XM_ProductURIs 2958 1.02 1.64 0.78 105 MAILING_LIST_MULTI 2900 1.79 1.61 1.87 106 RELAYCOUNTRY_FR 2892 0.60 1.60 0.21 107 T_XMHurry_00 2884 0.75 1.60 0.42 108 RCVD_IN_RP_RNBL 2855 0.46 1.58 0.03 109 RELAYCOUNTRY_GB 2837 1.10 1.57 0.92 110 RELAYCOUNTRY_CN 2762 0.46 1.53 0.05 111 XM_UB99 2727 0.43 1.51 0.01 112 NO_DNS_FOR_FROM 2648 1.10 1.47 0.96 113 XMPhish30 2638 0.58 1.46 0.24 114 DIET_1 2624 0.55 1.45 0.20 115 TR_XM_RelayPhish 2622 0.70 1.45 0.41 116 URIBL_DBL_SPAM 2603 0.43 1.44 0.04 117 T_Symld_Words_02 2583 0.61 1.43 0.30 118 XMBdyGiftCard01 2477 0.66 1.37 0.38 119 TooManyTo_002 2462 4.43 1.36 5.61 120 XM_UB60 2446 0.42 1.35 0.06 121 XMLongAddy 2419 0.42 1.34 0.07 122 XMBody_17 2330 0.58 1.29 0.31 123 XM_Nigeria_01 2321 0.38 1.29 0.04 124 XMPhish11 2254 1.05 1.25 0.97 125 URI_TRY_3LD 2222 0.89 1.23 0.75 126 TR_Caps_n_Bayes_99 2220 0.40 1.23 0.08 127 BODY_URI_ONLY 2203 0.37 1.22 0.04 128 XMStockSpam_06 2181 1.05 1.21 0.99 129 TooManyTo_003 2163 3.37 1.20 4.21 130 XMHTMLBadTable_001 2157 0.60 1.19 0.38 131 XM_UB999 2091 0.33 1.16 0.01 132 BAYES_40 2088 3.54 1.16 4.45 133 RELAYCOUNTRY_AT 2074 0.40 1.15 0.11 134 HTTPS_HTTP_MISMATCH 2073 0.57 1.15 0.35 135 TVD_SPACE_RATIO_MINFP 2059 0.32 1.14 0.01 136 RCVD_IN_IADB_VOUCHED 2056 3.04 1.14 3.77 137 TR_Sbj_FN_Bdy 2000 0.49 1.11 0.25 138 XMReplyNow 1982 0.40 1.10 0.13 139 HTML_IMAGE_ONLY_08 1959 0.37 1.09 0.10 140 HTML_FONT_SIZE_LARGE 1921 0.40 1.06 0.15 141 MONEY_FRAUD_8 1904 0.29 1.05 0.00 142 T_XMDrugObfuBody_00 1894 0.66 1.05 0.51 143 HTML_SHORT_LINK_IMG_1 1894 0.31 1.05 0.02 144 XM_HighProb1 1866 0.29 1.03 0.01 145 XM_BadFromFormat 1846 0.39 1.02 0.15 146 XMBrknScrpt_02 1820 0.56 1.01 0.39 147 XM_Nigeria_02 1816 0.28 1.01 0.01 148 LongTLD 1814 0.37 1.00 0.12 149 XMBody_78 1784 0.53 0.99 0.36 150 URI_WP_HACKED_2 1780 1.43 0.99 1.60 151 XMSubMetaSSx_00 1778 0.53 0.98 0.36 152 BAYES_00 1778 8.98 0.98 12.05 153 MPART_ALT_DIFF_COUNT 1770 0.64 0.98 0.52 154 XM_B_REG_HTML 1739 0.55 0.96 0.39 155 TR_Symld_Words 1733 1.57 0.96 1.80 156 URI_NOVOWEL 1726 0.57 0.96 0.42 157 BAYES_20 1722 2.60 0.95 3.22 158 XMSexyCombo_04 1688 0.30 0.94 0.05 159 SUBJ_DOLLARS 1680 0.33 0.93 0.10 160 T_FILL_THIS_FORM_SHORT 1671 0.79 0.93 0.74 161 DKIM_ADSP_CUSTOM_MED 1660 0.92 0.92 0.93 162 HTML_IMAGE_ONLY_28 1641 0.51 0.91 0.36 163 DKIM_ADSP_NXDOMAIN 1623 0.57 0.90 0.45 164 XM_B_COPY_HTML 1621 0.52 0.90 0.38 165 TooManyTo_004 1577 2.29 0.87 2.84 166 FILL_THIS_FORM 1573 0.54 0.87 0.41 167 XMSubMetaSxObfu_03 1568 0.46 0.87 0.30 168 XM_PDF 1567 3.32 0.87 4.26 169 XMPhish14 1544 0.49 0.86 0.35 170 BODY_ENHANCEMENT 1540 0.25 0.85 0.01 171 TR_LOTS_OF_MONEY3 1524 0.39 0.84 0.21 172 T_TooManySym_02 1489 1.10 0.82 1.20 173 IMPOTENCE 1485 1.03 0.82 1.11 174 XM_H_PHPOS 1483 1.08 0.82 1.18 175 UNCLAIMED_MONEY 1436 0.22 0.80 0.00 176 FORGED_GMAIL_RCVD 1431 0.53 0.79 0.42 177 RCVD_IN_MSPIKE_WL 1422 1.36 0.79 1.58 178 XM_UB80 1419 0.23 0.79 0.02 179 ANY_BOUNCE_MESSAGE 1408 2.24 0.78 2.80 180 XMClaimOffer 1408 0.36 0.78 0.20 181 BOUNCE_MESSAGE 1406 2.24 0.78 2.80 182 RCVD_IN_MSPIKE_H3 1397 1.35 0.77 1.58 183 RELAYCOUNTRY_AU 1385 0.60 0.77 0.54 184 XMMoneyMeta_00 1382 0.51 0.77 0.42 185 HTML_FONT_FACE_BAD 1382 7.97 0.77 10.73 186 TM2_M_BODY_EMPTY 1378 0.52 0.76 0.43 187 TR_Mismatch_TLD_02 1372 0.24 0.76 0.05 188 NML_ADSP_CUSTOM_MED 1364 0.71 0.76 0.70 189 T_HTML_TAG_BALANCE_CENTER 1363 0.27 0.75 0.08 190 REMOVE_BEFORE_LINK 1351 0.36 0.75 0.22 191 TR_MetaPhish_Combo_01 1321 0.74 0.73 0.74 192 T_FILL_THIS_FORM_LONG 1318 0.45 0.73 0.34 193 TR_XM_DK_Bayes 1303 3.02 0.72 3.90 194 XM_RXBody 1301 0.30 0.72 0.14 195 RCVD_IN_IADB_OPTIN 1265 1.99 0.70 2.49 196 XMEmptyBody_01 1260 0.28 0.70 0.11 197 TooManyTo_005 1242 1.68 0.69 2.06 198 FILL_THIS_FORM_LOAN 1240 0.40 0.69 0.29 199 XM_Combo_Sbj 1237 0.55 0.69 0.49 200 RDNS_DYNAMIC 1234 0.42 0.68 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 375150 83.38 92.91 79.72 2 DCC_CHECK_NEGATIVE 339726 58.05 21.18 72.19 3 DKIM_SIGNED 263328 64.01 85.00 55.96 4 XM_DK_Pass 258550 62.69 82.89 54.94 5 BAYES_50 252776 47.72 32.09 53.71 6 DKIM_VALID 239751 58.52 78.25 50.95 7 XM_H_QuotedFrom 190441 44.90 56.45 40.47 8 XMListUnsubscribeExists 163448 45.01 71.81 34.73 9 DKIM_VALID_AU 162755 41.80 60.61 34.58 10 T_TM2_M_HEADER_IN_MSG 143966 28.22 22.05 30.59 11 DCC_CHECK 122156 40.06 76.83 25.96 12 ALL_TRUSTED 118221 19.01 3.08 25.12 13 DKIM_VALID_EF 94441 21.33 24.62 20.07 14 HTML_FONT_LOW_CONTRAST 92454 23.81 34.66 19.65 15 XMSubLong 88057 21.16 27.54 18.71 16 MultiRelay 74860 16.08 16.54 15.91 17 FVGT_m_MULTI_ODD 74676 18.78 26.37 15.87 18 IN_ZIMBRA_NJ_WHITELIST 71276 10.96 0.04 15.15 19 LOC_TINY_FONT_1 68264 20.21 35.08 14.51 20 MIME_HTML_ONLY 63943 17.98 29.42 13.59 21 HTML_IMAGE_RATIO_04 59366 11.54 8.75 12.62 22 T_KAM_HTML_FONT_INVALID 57229 14.49 20.58 12.16 23 BAYES_00 56684 8.98 0.98 12.05 24 TooManyTo_001 52879 10.12 7.21 11.24 25 HTML_FONT_FACE_BAD 50487 7.97 0.77 10.73 26 XM_DK_Undo_02 47331 20.93 49.28 10.06 27 DATE_IN_PAST_12_24 46912 7.24 0.15 9.97 28 BAYES_99 45861 19.53 45.03 9.75 29 XM_Body_Dirty_Words 43394 11.78 18.44 9.22 30 BAYES_999 40001 16.81 38.46 8.50 31 XM_Multi_Part_URI 38322 10.70 17.36 8.14 32 XMStrtUSub 38275 6.95 3.88 8.13 33 T_XMDrugObfuBody_14 36299 8.13 9.22 7.71 34 XM_Evil_Numbers_Gen 32789 8.65 13.03 6.97 35 BAYES_60 32681 7.02 7.21 6.94 36 XM_H_Long_From01 32071 7.17 8.08 6.81 37 XM_DKIMWhitelistDomains 31425 4.83 0.02 6.68 38 LOTS_OF_MONEY 31306 8.08 11.80 6.65 39 LotsOfNums_01 29847 7.25 9.61 6.34 40 FSL_BULK_SIG 27660 7.73 12.58 5.88 41 RCVD_IN_RP_SAFE 26606 5.50 5.09 5.65 42 TooManyTo_002 26379 4.43 1.36 5.61 43 RCVD_IN_IADB_LISTED 25710 4.65 2.54 5.46 44 RCVD_IN_RP_CERTIFIED 24485 4.86 3.96 5.20 45 HTML_IMAGE_RATIO_02 23875 7.87 15.16 5.07 46 DKIM_INVALID 23577 5.49 6.75 5.01 47 MIME_QP_LONG_LINE 23230 4.72 4.17 4.94 48 RCVD_IN_IADB_SPF 22168 4.03 2.26 4.71 49 BAYES_40 20962 3.54 1.16 4.45 50 RELAYCOUNTRY_META 20431 7.43 15.47 4.34 51 TR_DCC_Bayes_99 20379 12.88 35.18 4.33 52 XMSubMetaSx_00 20330 5.39 8.18 4.32 53 XM_PDF 20029 3.32 0.87 4.26 54 TooManyTo_003 19789 3.37 1.20 4.21 55 T_REMOTE_IMAGE 19472 4.21 4.40 4.14 56 RCVD_IN_IADB_SENDERID 19365 3.57 2.14 4.12 57 XM_SendGrid 19145 4.17 4.45 4.07 58 RCVD_IN_IADB_DK 18857 3.48 2.11 4.01 59 BAYES_80 18510 4.90 7.44 3.93 60 TR_XM_DK_Bayes 18334 3.02 0.72 3.90 61 SUBJ_ALL_CAPS 18044 3.87 3.96 3.83 62 XMSubNoVowel 18002 2.90 0.50 3.83 63 XM_B_Phish_Phrases 17852 5.13 8.63 3.79 64 RCVD_IN_IADB_VOUCHED 17749 3.04 1.14 3.77 65 RCVD_IN_MSPIKE_H2 17480 3.68 3.59 3.71 66 HTML_IMAGE_RATIO_06 16740 4.00 5.16 3.56 67 TR_XM_DK_Bayes1 16079 2.65 0.67 3.42 68 BAYES_05 15748 2.55 0.49 3.35 69 BAYES_20 15175 2.60 0.95 3.22 70 T_TooManySym_01 13643 2.94 3.04 2.90 71 XM_UncommonTLD01 13608 3.99 6.86 2.89 72 TR_XM_DocInvoice 13360 3.94 6.81 2.84 73 TooManyTo_004 13357 2.29 0.87 2.84 74 ANY_BOUNCE_MESSAGE 13160 2.24 0.78 2.80 75 BOUNCE_MESSAGE 13158 2.24 0.78 2.80 76 BOTNET_IPINHOSTNAME 12927 5.29 11.91 2.75 77 XMNumbers 12526 3.47 5.59 2.66 78 TR_XM_DK_Bayes2 12489 2.09 0.61 2.65 79 BAYES_95 11897 3.11 4.62 2.53 80 RCVD_IN_IADB_OPTIN 11720 1.99 0.70 2.49 81 HTML_IMAGE_RATIO_08 11512 2.88 4.02 2.45 82 FROM_EXCESS_BASE64 11294 3.61 6.76 2.40 83 XMSexyCombo_05 10830 4.39 9.85 2.30 84 MPART_ALT_DIFF 10361 3.25 5.98 2.20 85 UNPARSEABLE_RELAY 9746 2.00 1.82 2.07 86 XMNoVowels 9708 2.22 2.63 2.06 87 TooManyTo_005 9704 1.68 0.69 2.06 88 TM2_M_URI_OPT_OUT 9697 2.66 4.23 2.06 89 HELO_NODOT 9332 1.52 0.32 1.98 90 TVD_RCVD_IP 8834 1.42 0.23 1.88 91 MAILING_LIST_MULTI 8787 1.79 1.61 1.87 92 HTML_MIME_NO_HTML_TAG 8533 2.04 2.63 1.81 93 TR_Symld_Words 8463 1.57 0.96 1.80 94 IN_HORDE_ADDRESS_BOOK 8416 1.31 0.07 1.79 95 XM_SPF_SoftFail 8369 2.31 3.69 1.78 96 XM_DK_Undo_01 7920 1.77 1.98 1.68 97 MIME_HTML_MOSTLY 7806 2.39 4.29 1.66 98 URI_WP_HACKED_2 7508 1.43 0.99 1.60 99 RCVD_IN_MSPIKE_WL 7423 1.36 0.79 1.58 100 RCVD_IN_MSPIKE_H3 7414 1.35 0.77 1.58 101 XM_CamelCaseFrm001 6780 2.04 3.60 1.44 102 INVALID_MSGID 6743 1.09 0.20 1.43 103 XM_DIRTYINTL 6604 2.16 4.15 1.40 104 XMCapTrack 6590 1.20 0.68 1.40 105 XMDiploma_00 6475 1.75 2.72 1.38 106 TO_MALFORMED 6346 0.98 0.01 1.35 107 XM_OfRef6 6160 1.74 2.87 1.31 108 T_TooManySym_02 5647 1.10 0.82 1.20 109 XM_E_Blogspot 5553 0.87 0.06 1.18 110 XM_H_PHPOS 5552 1.08 0.82 1.18 111 XMSubLongNoVowel 5483 0.86 0.06 1.17 112 XMSubGarbage 5448 0.84 0.02 1.16 113 IMPOTENCE 5217 1.03 0.82 1.11 114 T_XMDrugObfuBody_08 5185 1.42 2.24 1.10 115 XM_GoogleGroups 5139 0.92 0.48 1.09 116 RELAYCOUNTRY_CA 5086 1.67 3.19 1.08 117 UNTRUSTED_Relay 5053 3.20 8.76 1.07 118 URIBL_DBL_ABUSE_SPAM 4919 0.90 0.52 1.05 119 URI_HEX 4863 1.49 2.68 1.03 120 MIME_HTML_ONLY_MULTI 4793 1.57 3.00 1.02 121 XMStockSpam_06 4669 1.05 1.21 0.99 122 USER_IN_DEF_DKIM_WL 4570 0.71 0.04 0.97 123 XMPhish11 4567 1.05 1.25 0.97 124 NO_DNS_FOR_FROM 4534 1.10 1.47 0.96 125 XMGenDplmaNmb 4507 1.25 2.00 0.96 126 BOTNET 4467 3.96 11.80 0.95 127 DKIM_ADSP_CUSTOM_MED 4355 0.92 0.92 0.93 128 RELAYCOUNTRY_GB 4340 1.10 1.57 0.92 129 XM_ShortIntro_01 3748 0.69 0.41 0.80 130 XM_ProductURIs 3681 1.02 1.64 0.78 131 XM_UB50 3627 1.66 3.96 0.77 132 URI_TRY_3LD 3548 0.89 1.23 0.75 133 XM_H_Long_From02 3521 1.07 1.92 0.75 134 TR_MetaPhish_Combo_01 3495 0.74 0.73 0.74 135 T_FILL_THIS_FORM_SHORT 3484 0.79 0.93 0.74 136 XM_H_PHPMailer 3451 0.71 0.64 0.73 137 SpammyFromTLD_01 3431 1.00 1.70 0.73 138 XMBody_29 3361 0.64 0.45 0.71 139 TM2_M_VERY_LONG_WORD 3315 1.02 1.84 0.70 140 NML_ADSP_CUSTOM_MED 3277 0.71 0.76 0.70 141 ONLINE_PHARMACY 3084 0.58 0.40 0.66 142 USER_IN_WHITELIST 2971 0.46 0.00 0.63 143 RCVD_IN_BL_SPAMCOP_NET 2816 1.33 3.24 0.60 144 XMLngstWrd_00 2751 0.57 0.54 0.58 145 T_OBFU_PDF_ATTACH 2709 0.48 0.24 0.58 146 KHOP_DYNAMIC 2702 0.55 0.48 0.57 147 MISSING_HEADERS 2661 0.97 2.02 0.57 148 XMGappySubj_01 2653 0.54 0.48 0.56 149 XMLngstWrd_01 2560 0.53 0.51 0.54 150 RELAYCOUNTRY_AU 2523 0.60 0.77 0.54 151 XMSlimDrugH 2510 0.99 2.20 0.53 152 T_TooManySym_03 2474 0.42 0.14 0.53 153 MPART_ALT_DIFF_COUNT 2426 0.64 0.98 0.52 154 TVD_VISIT_PHARMA 2404 0.47 0.37 0.51 155 SHORT_HELO_AND_INLINE_IMAGE 2383 0.39 0.09 0.51 156 T_XMDrugObfuBody_00 2380 0.66 1.05 0.51 157 XM_Combo_Sbj 2324 0.55 0.69 0.49 158 XMDateMe_00 2171 0.44 0.39 0.46 159 XMSexyCombo_01 2135 0.88 1.98 0.45 160 DKIM_ADSP_NXDOMAIN 2118 0.57 0.90 0.45 161 RCVD_IN_SORBS_DUL 2064 0.45 0.47 0.44 162 RELAYCOUNTRY_DE 2017 0.50 0.67 0.43 163 TM2_M_BODY_EMPTY 2017 0.52 0.76 0.43 164 XMBody_95 2013 0.35 0.13 0.43 165 FORGED_GMAIL_RCVD 1992 0.53 0.79 0.42 166 URI_NOVOWEL 1981 0.57 0.96 0.42 167 XMMoneyMeta_00 1969 0.51 0.77 0.42 168 T_XMHurry_00 1968 0.75 1.60 0.42 169 TM2_M_A_HREF_HREF 1967 0.49 0.66 0.42 170 TR_XM_RelayPhish 1942 0.70 1.45 0.41 171 FILL_THIS_FORM 1926 0.54 0.87 0.41 172 XM_B_TRADE_HTML 1883 0.39 0.36 0.40 173 XMBrknScrpt_02 1847 0.56 1.01 0.39 174 XM_B_REG_HTML 1838 0.55 0.96 0.39 175 XMSubMetaI_00 1822 0.74 1.67 0.39 176 XMBdyGiftCard01 1802 0.66 1.37 0.38 177 XMHTMLBadTable_001 1771 0.60 1.19 0.38 178 HTML_IMAGE_ONLY_32 1771 0.38 0.39 0.38 179 XM_B_COPY_HTML 1769 0.52 0.90 0.38 180 HTML_IMAGE_ONLY_28 1702 0.51 0.91 0.36 181 XMBody_78 1683 0.53 0.99 0.36 182 XMSubMetaSSx_00 1679 0.53 0.98 0.36 183 HTTPS_HTTP_MISMATCH 1667 0.57 1.15 0.35 184 XMPhish14 1664 0.49 0.86 0.35 185 XMLngstWrd_02 1655 0.36 0.39 0.35 186 TVD_SPACE_RATIO 1626 0.33 0.29 0.35 187 T_FILL_THIS_FORM_LONG 1583 0.45 0.73 0.34 188 HTML_IMAGE_ONLY_20 1580 0.35 0.37 0.34 189 AC_DIV_BONANZA 1567 0.27 0.11 0.33 190 SpammyFromTLD_02 1523 0.96 2.64 0.32 191 RDNS_DYNAMIC 1510 0.42 0.68 0.32 192 HTML_TAG_BALANCE_BODY 1496 0.42 0.68 0.32 193 XMBody_17 1461 0.58 1.29 0.31 194 XM_D_tchamptons_WL 1459 0.22 0.00 0.31 195 XM_H_PHPOS_M 1433 0.31 0.31 0.30 196 XMSubMetaSxObfu_03 1429 0.46 0.87 0.30 197 TR_LOTS_OF_MONEY2 1411 0.74 1.88 0.30 198 T_MONEY_PERCENT 1411 0.74 1.88 0.30 199 T_Symld_Words_02 1393 0.61 1.43 0.30 200 XMSubMetaSxObfu_02 1381 0.29 0.27 0.29 ----------------------------------------------------------------------