Email: 838108 Autolearn: 0 AvgScore: 5.19 AvgScanTime: 4.30 sec Spam: 293117 Autolearn: 0 AvgScore: 14.10 AvgScanTime: 5.10 sec Ham: 544991 Autolearn: 0 AvgScore: 0.40 AvgScanTime: 3.87 sec Time Spent Running SA: 1000.96 hours Time Spent Processing Spam: 415.34 hours Time Spent Processing Ham: 585.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 283731 83.84 96.80 76.87 2 DCC_CHECK 204251 42.83 69.68 28.39 3 DKIM_SIGNED 199646 62.41 68.11 59.34 4 XM_DK_Pass 194751 61.15 66.44 58.31 5 DKIM_VALID 182413 57.05 62.23 54.27 6 XMListUnsubscribeExists 172787 45.82 58.95 38.75 7 DKIM_VALID_AU 140532 41.25 47.94 37.66 8 XM_H_QuotedFrom 129589 33.68 44.21 28.02 9 MIME_HTML_ONLY 122443 24.19 41.77 14.73 10 XM_DK_Undo_02 117003 21.02 39.92 10.86 11 BAYES_99 110514 20.46 37.70 11.19 12 BAYES_999 92245 17.21 31.47 9.54 13 BAYES_50 90116 51.46 30.74 62.61 14 TR_DCC_Bayes_99 87252 13.49 29.77 4.74 15 HTML_FONT_LOW_CONTRAST 85360 24.57 29.12 22.12 16 DCC_CHECK_NEGATIVE 84926 55.57 28.97 69.88 17 LOC_TINY_FONT_1 83704 20.63 28.56 16.36 18 RELAYCOUNTRY_META 81412 12.57 27.77 4.39 19 XMSubLong 80541 20.38 27.48 16.57 20 UNTRUSTED_Relay 67671 8.79 23.09 1.10 21 FVGT_m_MULTI_ODD 62374 19.50 21.28 18.55 22 FROM_EXCESS_BASE64 61211 9.29 20.88 3.06 23 HTML_SHORT_LINK_IMG_1 57440 9.17 19.60 3.57 24 T_REMOTE_IMAGE 57313 9.34 19.55 3.85 25 DKIM_VALID_EF 55049 20.68 18.78 21.69 26 T_TM2_M_HEADER_IN_MSG 53597 23.72 18.29 26.65 27 HTML_MIME_NO_HTML_TAG 53366 7.46 18.21 1.68 28 SHORTENED_URL_SRC 52552 8.30 17.93 3.12 29 SHORTENER_SHORT_IMG 52491 8.29 17.91 3.12 30 BODY_URI_ONLY 52399 6.28 17.88 0.04 31 URI_BUFFLY 51126 8.13 17.44 3.12 32 T_KAM_HTML_FONT_INVALID 50767 14.51 17.32 13.00 33 MISSING_HEADERS 50209 6.36 17.13 0.57 34 MIME_HEADER_CTYPE_ONLY 49423 5.97 16.86 0.11 35 HTML_IMAGE_ONLY_08 48643 7.61 16.60 2.78 36 FSL_BULK_SIG 45542 8.91 15.54 5.34 37 XM_Body_Dirty_Words 44900 11.24 15.32 9.05 38 MultiRelay 44382 15.48 15.14 15.67 39 RELAYCOUNTRY_NL 41111 4.98 14.03 0.12 40 HTML_IMAGE_RATIO_02 41090 9.00 14.02 6.30 41 XM_Multi_Part_URI 38407 10.45 13.10 9.03 42 BOTNET 38252 5.20 13.05 0.98 43 BOTNET_IPINHOSTNAME 36800 6.99 12.55 4.00 44 BAYES_80 36489 6.89 12.45 3.89 45 XM_Evil_Numbers_Gen 30312 7.53 10.34 6.02 46 XMNumbers 28919 6.19 9.87 4.21 47 LOTS_OF_MONEY 28125 8.87 9.60 8.49 48 XM_UncommonTLD01 26893 5.12 9.17 2.94 49 XM_B_Phish_Phrases 25912 5.71 8.84 4.02 50 BAYES_60 25402 7.08 8.67 6.22 51 T_XMDrugObfuBody_14 23741 6.87 8.10 6.21 52 HTML_IMAGE_RATIO_04 21276 5.08 7.26 3.91 53 LotsOfNums_01 21141 7.70 7.21 7.97 54 XM_UB80 20699 2.48 7.06 0.02 55 XMSexyCombo_05 19972 4.02 6.81 2.52 56 BAYES_95 19346 4.14 6.60 2.82 57 SpammyFromTLD_02 18994 2.41 6.48 0.22 58 TR_XM_DocInvoice 18739 3.99 6.39 2.70 59 XM_H_Long_From01 18332 5.28 6.25 4.75 60 TooManyTo_001 18198 8.17 6.21 9.22 61 XMSubMetaSx_00 17729 4.50 6.05 3.67 62 MPART_ALT_DIFF 17260 3.78 5.89 2.65 63 DKIM_INVALID 17233 5.36 5.88 5.07 64 XM_SPF_SoftFail 16036 3.06 5.47 1.77 65 XMNoVowels 14643 3.36 5.00 2.48 66 XM_UB60 14296 1.78 4.88 0.11 67 XM_UB50 13274 2.08 4.53 0.76 68 HTML_IMAGE_RATIO_06 12305 3.27 4.20 2.77 69 RCVD_IN_RP_SAFE 11958 5.66 4.08 6.51 70 DIET_1 11781 1.56 4.02 0.23 71 XMStrtUSub 11322 3.38 3.86 3.13 72 MIME_HTML_MOSTLY 10888 2.70 3.71 2.15 73 ALL_TRUSTED 10834 22.16 3.70 32.09 74 MIME_QP_LONG_LINE 10328 4.80 3.52 5.48 75 XM_UB95 10002 1.20 3.41 0.01 76 XM_DIRTYINTL 9901 2.15 3.38 1.49 77 T_TooManySym_01 9857 3.51 3.36 3.59 78 TM2_M_URI_OPT_OUT 9715 2.67 3.31 2.33 79 XM_SendGrid 9560 3.76 3.26 4.03 80 RCVD_IN_RP_CERTIFIED 9510 5.00 3.24 5.94 81 HTML_IMAGE_ONLY_04 9233 1.68 3.15 0.89 82 RCVD_IN_MSPIKE_H2 8817 3.63 3.01 3.96 83 XMDiploma_00 8413 2.33 2.87 2.05 84 ANY_BOUNCE_MESSAGE 8334 12.67 2.84 17.96 85 BOUNCE_MESSAGE 8330 12.67 2.84 17.96 86 XM_CamelCaseFrm001 8063 2.03 2.75 1.65 87 XM_OfRef6 8004 1.77 2.73 1.25 88 TR_XM_RelayPhish 7828 1.19 2.67 0.39 89 MIME_HTML_ONLY_MULTI 7536 1.63 2.57 1.12 90 URI_HEX 7293 1.73 2.49 1.33 91 RELAYCOUNTRY_CA 7103 1.64 2.42 1.22 92 XM_UB99 6920 0.83 2.36 0.01 93 HTML_IMAGE_RATIO_08 6868 2.05 2.34 1.89 94 T_XMDrugObfuBody_08 6746 1.59 2.30 1.21 95 HTML_FONT_SIZE_LARGE 6648 1.10 2.27 0.46 96 RELAYCOUNTRY_TH 6512 0.78 2.22 0.01 97 XMSubMetaI_00 6188 0.97 2.11 0.36 98 RCVD_IN_IADB_LISTED 5547 4.24 1.89 5.50 99 XM_URI_RBL 5540 0.72 1.89 0.09 100 TR_Symld_Words 5532 2.58 1.89 2.96 101 RCVD_IN_BL_SPAMCOP_NET 5473 0.82 1.87 0.26 102 SUBJ_ALL_CAPS 5323 1.62 1.82 1.51 103 MultiRelay_CC 5161 0.72 1.76 0.17 104 MultiRelay_Combo 5161 0.72 1.76 0.17 105 RCVD_IN_IADB_SPF 5031 3.72 1.72 4.80 106 XMHTML_After_End 5026 0.89 1.71 0.44 107 XM_H_Long_From02 4989 1.11 1.70 0.79 108 T_XMHurry_00 4969 0.97 1.70 0.57 109 RCVD_IN_IADB_SENDERID 4824 3.31 1.65 4.20 110 RCVD_IN_IADB_DK 4770 3.25 1.63 4.12 111 XMGenDplmaNmb 4550 1.27 1.55 1.11 112 URIBL_DBL_SPAM 4505 0.60 1.54 0.09 113 XM_ProductURIs 4341 1.14 1.48 0.95 114 XM_JunkDunk 4112 0.49 1.40 0.00 115 TM2_M_VERY_LONG_WORD 4029 0.99 1.37 0.78 116 BOTNET_NORDNS 4027 0.49 1.37 0.01 117 XMSexyCombo_01 3997 0.74 1.36 0.40 118 RCVD_IN_RP_RNBL 3892 0.48 1.33 0.03 119 XM_UB999 3891 0.47 1.33 0.01 120 XMBdyGiftCard01 3875 0.81 1.32 0.53 121 URIBL_BLACK 3782 0.47 1.29 0.03 122 XMBody_17 3715 0.69 1.27 0.38 123 TR_LOTS_OF_MONEY2 3709 0.77 1.27 0.50 124 T_MONEY_PERCENT 3709 0.77 1.27 0.50 125 XMSlimDrugH 3634 0.61 1.24 0.26 126 RELAYCOUNTRY_FR 3550 0.59 1.21 0.26 127 TooManyTo_002 3549 3.09 1.21 4.11 128 MAILING_LIST_MULTI 3469 1.67 1.18 1.93 129 XMStockSpam_06 3398 0.80 1.16 0.61 130 NO_DNS_FOR_FROM 3332 0.78 1.14 0.59 131 SpammyFromTLD_01 3314 0.78 1.13 0.59 132 XM_DK_Undo_01 3207 1.52 1.09 1.75 133 BAYES_00 3136 4.28 1.07 6.01 134 TooManyTo_003 3123 2.34 1.07 3.03 135 RELAYCOUNTRY_CN 3045 0.39 1.04 0.04 136 BAYES_40 3041 2.51 1.04 3.30 137 URI_TRY_3LD 3011 1.10 1.03 1.14 138 XMPhish11 2993 1.02 1.02 1.02 139 FVGT_m_MULTI_ODD_EMAIL 2929 0.38 1.00 0.04 140 RELAYCOUNTRY_RO 2834 0.34 0.97 0.00 141 XMPhish30 2817 0.52 0.96 0.29 142 BAYES_20 2802 1.87 0.96 2.35 143 T_XMDrugObfuBody_00 2735 0.75 0.93 0.65 144 DRUGS_ERECTILE 2713 0.35 0.93 0.03 145 TR_XM_DK_Bayes 2709 2.79 0.92 3.79 146 XMSubNoVowel 2672 0.53 0.91 0.33 147 XM_HighProb1 2664 0.32 0.91 0.01 148 UNPARSEABLE_RELAY 2634 2.34 0.90 3.11 149 FILL_THIS_FORM 2548 0.55 0.87 0.38 150 TR_XM_DK_Bayes1 2545 2.46 0.87 3.31 151 XMSlimDrugs 2462 0.30 0.84 0.01 152 XMBody_78 2455 0.47 0.84 0.27 153 HTML_FONT_FACE_BAD 2436 0.54 0.83 0.38 154 ONLINE_PHARMACY 2420 0.29 0.83 0.01 155 RELAYCOUNTRY_GB 2405 0.89 0.82 0.93 156 XMWghtMeta_00 2394 0.30 0.82 0.02 157 RELAYCOUNTRY_AT 2389 0.35 0.82 0.09 158 TVD_VISIT_PHARMA 2384 0.29 0.81 0.01 159 T_FILL_THIS_FORM_LONG 2365 0.48 0.81 0.30 160 XMSubject_48 2359 0.29 0.80 0.01 161 TR_LOTS_OF_MONEY3 2342 0.51 0.80 0.35 162 TooManyTo_004 2297 1.49 0.78 1.87 163 TR_XM_DK_Bayes2 2281 2.02 0.78 2.69 164 TVD_SPACE_RATIO_MINFP 2260 0.27 0.77 0.00 165 PLING_QUERY 2254 0.39 0.77 0.19 166 HTML_TAG_BALANCE_BODY 2234 0.52 0.76 0.40 167 RCVD_IN_IADB_VOUCHED 2228 2.64 0.76 3.65 168 XM_ArrestRecordFrm03 2211 0.26 0.75 0.00 169 REMOVE_BEFORE_LINK 2207 0.45 0.75 0.29 170 HTML_SHORT_CENTER 2203 0.40 0.75 0.22 171 XMLongAddy 2182 0.30 0.74 0.07 172 T_FILL_THIS_FORM_SHORT 2161 0.77 0.74 0.78 173 T_Symld_Words_02 2161 0.61 0.74 0.53 174 XMPhish14 2144 0.43 0.73 0.27 175 URI_NOVOWEL 2102 0.53 0.72 0.43 176 DKIM_ADSP_CUSTOM_MED 2090 0.82 0.71 0.88 177 DATE_IN_PAST_06_12 2057 0.27 0.70 0.03 178 HTTPS_HTTP_MISMATCH 2039 0.50 0.70 0.40 179 DKIM_ADSP_NXDOMAIN 2027 0.40 0.69 0.25 180 T_TooManySym_02 1976 1.10 0.67 1.33 181 DRUG_ED_CAPS 1972 0.24 0.67 0.00 182 XMBrknScrpt_02 1946 0.52 0.66 0.45 183 XM_H_PHPOS 1938 0.87 0.66 0.98 184 XMSubMetaSSx_00 1896 0.35 0.65 0.19 185 FORGED_GMAIL_RCVD 1889 0.51 0.64 0.44 186 MPART_ALT_DIFF_COUNT 1866 0.62 0.64 0.61 187 TooManyTo_005 1846 1.13 0.63 1.39 188 XM_Body_Obfu01 1829 0.37 0.62 0.24 189 SUBJ_DOLLARS 1814 0.31 0.62 0.15 190 RCVD_IN_MSPIKE_WL 1812 1.31 0.62 1.68 191 LongTLD 1810 0.29 0.62 0.12 192 RCVD_IN_MSPIKE_H3 1807 1.31 0.62 1.68 193 XMSexyCombo_04 1795 0.25 0.61 0.06 194 HTML_IMAGE_ONLY_28 1777 0.43 0.61 0.34 195 XM_BadFromFormat 1764 0.31 0.60 0.15 196 XM_OfRef7 1762 0.36 0.60 0.23 197 NML_ADSP_CUSTOM_MED 1759 0.61 0.60 0.62 198 TR_MetaPhish_Combo_01 1758 0.63 0.60 0.65 199 XMClaimOffer 1755 0.27 0.60 0.10 200 XMMoneyMeta_00 1750 0.52 0.60 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 418949 83.84 96.80 76.87 2 DCC_CHECK_NEGATIVE 380820 55.57 28.97 69.88 3 BAYES_50 341193 51.46 30.74 62.61 4 DKIM_SIGNED 323416 62.41 68.11 59.34 5 XM_DK_Pass 317792 61.15 66.44 58.31 6 DKIM_VALID 295767 57.05 62.23 54.27 7 XMListUnsubscribeExists 211206 45.82 58.95 38.75 8 DKIM_VALID_AU 205217 41.25 47.94 37.66 9 ALL_TRUSTED 174910 22.16 3.70 32.09 10 DCC_CHECK 154722 42.83 69.68 28.39 11 XM_H_QuotedFrom 152725 33.68 44.21 28.02 12 T_TM2_M_HEADER_IN_MSG 145230 23.72 18.29 26.65 13 HTML_FONT_LOW_CONTRAST 120555 24.57 29.12 22.12 14 DKIM_VALID_EF 118234 20.68 18.78 21.69 15 FVGT_m_MULTI_ODD 101082 19.50 21.28 18.55 16 ANY_BOUNCE_MESSAGE 97890 12.67 2.84 17.96 17 BOUNCE_MESSAGE 97889 12.67 2.84 17.96 18 XMSubLong 90279 20.38 27.48 16.57 19 LOC_TINY_FONT_1 89174 20.63 28.56 16.36 20 MultiRelay 85377 15.48 15.14 15.67 21 MIME_HTML_ONLY 80285 24.19 41.77 14.73 22 T_KAM_HTML_FONT_INVALID 70823 14.51 17.32 13.00 23 BAYES_99 60997 20.46 37.70 11.19 24 XM_DK_Undo_02 59173 21.02 39.92 10.86 25 BAYES_999 51997 17.21 31.47 9.54 26 TooManyTo_001 50240 8.17 6.21 9.22 27 XM_Body_Dirty_Words 49329 11.24 15.32 9.05 28 XM_Multi_Part_URI 49197 10.45 13.10 9.03 29 LOTS_OF_MONEY 46244 8.87 9.60 8.49 30 LotsOfNums_01 43429 7.70 7.21 7.97 31 XM_DKIMWhitelistDomains 41964 5.01 0.01 7.70 32 RCVD_IN_RP_SAFE 35476 5.66 4.08 6.51 33 HTML_IMAGE_RATIO_02 34317 9.00 14.02 6.30 34 BAYES_60 33904 7.08 8.67 6.22 35 T_XMDrugObfuBody_14 33818 6.87 8.10 6.21 36 XM_Evil_Numbers_Gen 32828 7.53 10.34 6.02 37 BAYES_00 32759 4.28 1.07 6.01 38 RCVD_IN_RP_CERTIFIED 32354 5.00 3.24 5.94 39 RCVD_IN_IADB_LISTED 29958 4.24 1.89 5.50 40 MIME_QP_LONG_LINE 29863 4.80 3.52 5.48 41 FSL_BULK_SIG 29128 8.91 15.54 5.34 42 DKIM_INVALID 27649 5.36 5.88 5.07 43 RCVD_IN_IADB_SPF 26161 3.72 1.72 4.80 44 XM_H_Long_From01 25882 5.28 6.25 4.75 45 TR_DCC_Bayes_99 25843 13.49 29.77 4.74 46 IN_ZIMBRA_NJ_WHITELIST 24449 2.93 0.02 4.49 47 RELAYCOUNTRY_META 23924 12.57 27.77 4.39 48 XMNumbers 22948 6.19 9.87 4.21 49 RCVD_IN_IADB_SENDERID 22891 3.31 1.65 4.20 50 RCVD_IN_IADB_DK 22457 3.25 1.63 4.12 51 TooManyTo_002 22374 3.09 1.21 4.11 52 XM_SendGrid 21961 3.76 3.26 4.03 53 XM_B_Phish_Phrases 21926 5.71 8.84 4.02 54 BOTNET_IPINHOSTNAME 21778 6.99 12.55 4.00 55 RCVD_IN_MSPIKE_H2 21605 3.63 3.01 3.96 56 HTML_IMAGE_RATIO_04 21293 5.08 7.26 3.91 57 BAYES_80 21215 6.89 12.45 3.89 58 T_REMOTE_IMAGE 20994 9.34 19.55 3.85 59 TR_XM_DK_Bayes 20645 2.79 0.92 3.79 60 XM_PDF 20319 2.63 0.59 3.73 61 XMSubMetaSx_00 19983 4.50 6.05 3.67 62 RCVD_IN_IADB_VOUCHED 19882 2.64 0.76 3.65 63 T_TooManySym_01 19556 3.51 3.36 3.59 64 HTML_SHORT_LINK_IMG_1 19449 9.17 19.60 3.57 65 TR_XM_DK_Bayes1 18048 2.46 0.87 3.31 66 BAYES_40 18000 2.51 1.04 3.30 67 XMStrtUSub 17033 3.38 3.86 3.13 68 SHORTENED_URL_SRC 17004 8.30 17.93 3.12 69 URI_BUFFLY 16984 8.13 17.44 3.12 70 SHORTENER_SHORT_IMG 16984 8.29 17.91 3.12 71 UNPARSEABLE_RELAY 16966 2.34 0.90 3.11 72 FROM_EXCESS_BASE64 16655 9.29 20.88 3.06 73 TooManyTo_003 16501 2.34 1.07 3.03 74 TR_Symld_Words 16118 2.58 1.89 2.96 75 XM_UncommonTLD01 16003 5.12 9.17 2.94 76 BAYES_95 15377 4.14 6.60 2.82 77 TVD_RCVD_IP 15351 1.88 0.14 2.82 78 HTML_IMAGE_ONLY_08 15161 7.61 16.60 2.78 79 HTML_IMAGE_RATIO_06 15077 3.27 4.20 2.77 80 TR_XM_DocInvoice 14692 3.99 6.39 2.70 81 TR_XM_DK_Bayes2 14669 2.02 0.78 2.69 82 MPART_ALT_DIFF 14429 3.78 5.89 2.65 83 XMSexyCombo_05 13707 4.02 6.81 2.52 84 XMNoVowels 13539 3.36 5.00 2.48 85 BAYES_20 12831 1.87 0.96 2.35 86 TM2_M_URI_OPT_OUT 12685 2.67 3.31 2.33 87 RCVD_IN_IADB_OPTIN 12595 1.66 0.45 2.31 88 MIME_HTML_MOSTLY 11709 2.70 3.71 2.15 89 XMDiploma_00 11150 2.33 2.87 2.05 90 MAILING_LIST_MULTI 10533 1.67 1.18 1.93 91 HTML_IMAGE_RATIO_08 10321 2.05 2.34 1.89 92 TooManyTo_004 10212 1.49 0.78 1.87 93 XM_SPF_SoftFail 9630 3.06 5.47 1.77 94 XM_DK_Undo_01 9561 1.52 1.09 1.75 95 RCVD_IN_MSPIKE_WL 9149 1.31 0.62 1.68 96 RCVD_IN_MSPIKE_H3 9148 1.31 0.62 1.68 97 HTML_MIME_NO_HTML_TAG 9144 7.46 18.21 1.68 98 HELO_NODOT 9139 1.17 0.22 1.68 99 XM_CamelCaseFrm001 8982 2.03 2.75 1.65 100 SUBJ_ALL_CAPS 8224 1.62 1.82 1.51 101 XM_DIRTYINTL 8135 2.15 3.38 1.49 102 BAYES_05 7966 1.12 0.48 1.46 103 IN_HORDE_ADDRESS_BOOK 7893 0.96 0.04 1.45 104 TooManyTo_005 7584 1.13 0.63 1.39 105 T_TooManySym_02 7259 1.10 0.67 1.33 106 URI_HEX 7231 1.73 2.49 1.33 107 INVALID_MSGID 7024 0.88 0.12 1.29 108 XMCapTrack 6804 0.96 0.43 1.25 109 XM_OfRef6 6802 1.77 2.73 1.25 110 RELAYCOUNTRY_CA 6665 1.64 2.42 1.22 111 T_XMDrugObfuBody_08 6577 1.59 2.30 1.21 112 TO_MALFORMED 6503 0.78 0.01 1.19 113 XMLngstWrd_00 6357 0.86 0.28 1.17 114 URI_TRY_3LD 6198 1.10 1.03 1.14 115 USER_IN_DEF_DKIM_WL 6146 0.76 0.08 1.13 116 MIME_HTML_ONLY_MULTI 6127 1.63 2.57 1.12 117 XMGappySubj_01 6117 0.85 0.35 1.12 118 XMGenDplmaNmb 6064 1.27 1.55 1.11 119 UNTRUSTED_Relay 5995 8.79 23.09 1.10 120 XM_GoogleGroups 5937 0.82 0.32 1.09 121 XMPhish11 5574 1.02 1.02 1.02 122 XMLngstWrd_01 5387 0.74 0.27 0.99 123 XM_H_PHPOS 5366 0.87 0.66 0.98 124 BOTNET 5325 5.20 13.05 0.98 125 XM_ProductURIs 5184 1.14 1.48 0.95 126 RELAYCOUNTRY_GB 5091 0.89 0.82 0.93 127 HTML_IMAGE_ONLY_04 4867 1.68 3.15 0.89 128 DKIM_ADSP_CUSTOM_MED 4800 0.82 0.71 0.88 129 XM_H_Long_From02 4311 1.11 1.70 0.79 130 T_FILL_THIS_FORM_SHORT 4266 0.77 0.74 0.78 131 TM2_M_VERY_LONG_WORD 4241 0.99 1.37 0.78 132 XM_UB50 4137 2.08 4.53 0.76 133 XMGappySubj_02 4076 0.52 0.11 0.75 134 T_XMDrugObfuBody_00 3535 0.75 0.93 0.65 135 TR_MetaPhish_Combo_01 3518 0.63 0.60 0.65 136 XM_ShortIntro_01 3453 0.50 0.25 0.63 137 XMLngstWrd_02 3426 0.48 0.21 0.63 138 NML_ADSP_CUSTOM_MED 3355 0.61 0.60 0.62 139 XMStockSpam_06 3347 0.80 1.16 0.61 140 MPART_ALT_DIFF_COUNT 3304 0.62 0.64 0.61 141 XMSolicitRefs_0 3300 0.50 0.29 0.61 142 USER_IN_WHITELIST 3245 0.39 0.00 0.60 143 SpammyFromTLD_01 3213 0.78 1.13 0.59 144 NO_DNS_FOR_FROM 3197 0.78 1.14 0.59 145 T_XMHurry_00 3123 0.97 1.70 0.57 146 MISSING_HEADERS 3082 6.36 17.13 0.57 147 T_TooManySym_03 3078 0.44 0.21 0.56 148 T_Symld_Words_02 2915 0.61 0.74 0.53 149 XMBdyGiftCard01 2887 0.81 1.32 0.53 150 KHOP_DYNAMIC 2804 0.45 0.33 0.51 151 T_MONEY_PERCENT 2726 0.77 1.27 0.50 152 TR_LOTS_OF_MONEY2 2726 0.77 1.27 0.50 153 XM_H_PHPMailer 2705 0.52 0.57 0.50 154 T_OBFU_PDF_ATTACH 2689 0.36 0.12 0.49 155 RELAYCOUNTRY_DE 2682 0.49 0.48 0.49 156 XMMoneyMeta_00 2601 0.52 0.60 0.48 157 RELAYCOUNTRY_AU 2558 0.48 0.50 0.47 158 HTML_FONT_SIZE_LARGE 2532 1.10 2.27 0.46 159 SHORT_HELO_AND_INLINE_IMAGE 2528 0.32 0.05 0.46 160 XMSubMetaSxObfu_02 2490 0.40 0.29 0.46 161 XMBrknScrpt_02 2446 0.52 0.66 0.45 162 XMBody_95 2439 0.32 0.09 0.45 163 XMDateMe_00 2400 0.42 0.39 0.44 164 XMHTML_After_End 2394 0.89 1.71 0.44 165 FORGED_GMAIL_RCVD 2389 0.51 0.64 0.44 166 AC_DIV_BONANZA 2384 0.32 0.10 0.44 167 URI_NOVOWEL 2326 0.53 0.72 0.43 168 XMSexyCombo_01 2197 0.74 1.36 0.40 169 RCVD_IN_SORBS_DUL 2191 0.32 0.16 0.40 170 HTTPS_HTTP_MISMATCH 2169 0.50 0.70 0.40 171 TM2_M_A_HREF_HREF 2167 0.43 0.50 0.40 172 HTML_TAG_BALANCE_BODY 2166 0.52 0.76 0.40 173 XMLngstWrd_03 2127 0.31 0.15 0.39 174 XMWinner 2112 0.26 0.03 0.39 175 RDNS_DYNAMIC 2110 0.44 0.54 0.39 176 TR_XM_RelayPhish 2104 1.19 2.67 0.39 177 FILL_THIS_FORM 2090 0.55 0.87 0.38 178 HTML_FONT_FACE_BAD 2067 0.54 0.83 0.38 179 XMBody_17 2066 0.69 1.27 0.38 180 TM2_M_BODY_EMPTY 2017 0.33 0.26 0.37 181 HTML_IMAGE_ONLY_32 1968 0.35 0.33 0.36 182 XMSubMetaI_00 1958 0.97 2.11 0.36 183 TR_LOTS_OF_MONEY3 1911 0.51 0.80 0.35 184 URIBL_DBL_ABUSE_SPAM 1888 0.34 0.33 0.35 185 HTML_IMAGE_ONLY_28 1867 0.43 0.61 0.34 186 XM_D_tchamptons_WL 1865 0.22 0.00 0.34 187 XMHTMLBadTable_001 1802 0.41 0.57 0.33 188 XMSubNoVowel 1797 0.53 0.91 0.33 189 XM_B_COPY_HTML 1765 0.38 0.50 0.32 190 XM_B_REG_HTML 1710 0.40 0.57 0.31 191 HTML_IMAGE_ONLY_24 1693 0.33 0.35 0.31 192 T_FILL_THIS_FORM_LONG 1634 0.48 0.81 0.30 193 XM_Combo_Sbj 1634 0.36 0.46 0.30 194 XMSubMetaSxObfu_03 1624 0.31 0.33 0.30 195 HTML_IMAGE_ONLY_20 1574 0.28 0.26 0.29 196 XMRcvdHeader_15 1572 0.19 0.00 0.29 197 REMOVE_BEFORE_LINK 1566 0.45 0.75 0.29 198 XMPhish30 1557 0.52 0.96 0.29 199 HTML_IMAGE_ONLY_16 1499 0.24 0.18 0.28 200 XMBody_78 1474 0.47 0.84 0.27 ----------------------------------------------------------------------