Email: 479823 Autolearn: 0 AvgScore: 6.98 AvgScanTime: 3.35 sec Spam: 198214 Autolearn: 0 AvgScore: 16.41 AvgScanTime: 4.08 sec Ham: 281609 Autolearn: 0 AvgScore: 0.35 AvgScanTime: 2.84 sec Time Spent Running SA: 447.13 hours Time Spent Processing Spam: 224.69 hours Time Spent Processing Ham: 222.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 191941 90.20 96.84 85.52 2 DKIM_SIGNED 125428 63.50 63.28 63.66 3 XM_DK_Pass 122452 62.46 61.78 62.94 4 DCC_CHECK 119424 46.49 60.25 36.80 5 DKIM_VALID 114940 59.07 57.99 59.82 6 XMListUnsubscribeExists 109648 48.39 55.32 43.51 7 MIME_HTML_ONLY 99391 30.93 50.14 17.40 8 DKIM_VALID_AU 97216 48.28 49.05 47.74 9 XM_H_QuotedFrom 80405 34.90 40.56 30.90 10 BAYES_99 79272 26.29 39.99 16.65 11 DCC_CHECK_NEGATIVE 77411 52.65 39.05 62.22 12 XM_DK_Undo_02 75345 25.74 38.01 17.10 13 RELAYCOUNTRY_META 70465 16.79 35.55 3.58 14 BOTNET 67536 14.71 34.07 1.09 15 BAYES_999 63273 21.84 31.92 14.75 16 BOTNET_IPINHOSTNAME 62927 16.74 31.75 6.17 17 UNTRUSTED_Relay 62877 13.72 31.72 1.05 18 TR_DCC_Bayes_99 57822 17.50 29.17 9.29 19 LOC_TINY_FONT_1 57234 25.99 28.87 23.96 20 XM_UncommonTLD01 56847 13.97 28.68 3.62 21 HTML_FONT_LOW_CONTRAST 55873 28.29 28.19 28.36 22 T_REMOTE_IMAGE 53850 13.08 27.17 3.16 23 HTML_MIME_NO_HTML_TAG 51874 11.45 26.17 1.09 24 BODY_URI_ONLY 51379 10.86 25.92 0.27 25 HTML_SHORT_LINK_IMG_1 51049 16.03 25.75 9.19 26 HTML_IMAGE_ONLY_08 51024 16.07 25.74 9.26 27 SpammyFromTLD_01 50648 10.70 25.55 0.25 28 MISSING_HEADERS 50042 10.82 25.25 0.66 29 SHORTENER_SHORT_IMG 50024 15.80 25.24 9.17 30 BAYES_50 49720 44.80 25.08 58.67 31 RELAYCOUNTRY_TH 44920 9.37 22.66 0.01 32 XMSubLong 41273 18.67 20.82 17.16 33 FROM_EXCESS_BASE64 38451 10.51 19.40 4.26 34 MIME_HEADER_CTYPE_ONLY 38084 8.02 19.21 0.14 35 FVGT_m_MULTI_ODD 38024 18.89 19.18 18.69 36 XM_Body_Dirty_Words 32570 12.93 16.43 10.47 37 HTML_IMAGE_RATIO_02 32320 11.32 16.31 7.81 38 DKIM_VALID_EF 28144 21.33 14.20 26.35 39 T_KAM_HTML_FONT_INVALID 27696 12.40 13.97 11.29 40 URI_BUFFLY 26818 8.52 13.53 5.00 41 MultiRelay 26122 12.17 13.18 11.46 42 XMNumbers 25611 7.53 12.92 3.74 43 BAYES_80 25159 7.69 12.69 4.17 44 T_TM2_M_HEADER_IN_MSG 23845 16.08 12.03 18.92 45 HTML_FONT_SIZE_LARGE 23768 7.52 11.99 4.37 46 XM_Multi_Part_URI 23244 11.75 11.73 11.77 47 XM_Evil_Numbers_Gen 20615 8.60 10.40 7.34 48 BAYES_95 20344 6.08 10.26 3.14 49 FSL_BULK_SIG 18124 8.48 9.14 8.02 50 XMSexyCombo_05 17760 6.12 8.96 4.12 51 XM_BadFromFormat 17445 3.74 8.80 0.17 52 XM_B_Phish_Phrases 17359 6.44 8.76 4.80 53 BAYES_60 16788 7.28 8.47 6.45 54 HTML_IMAGE_RATIO_04 16134 6.38 8.14 5.15 55 XM_UB80 15740 3.30 7.94 0.04 56 LOTS_OF_MONEY 14995 7.81 7.57 7.99 57 XM_UB95 14328 3.01 7.23 0.04 58 T_XMDrugObfuBody_14 13438 5.85 6.78 5.20 59 XM_UB99 12748 2.68 6.43 0.04 60 XMSubMetaSx_00 12260 5.41 6.19 4.86 61 RCVD_IN_RP_SAFE 12189 8.96 6.15 10.94 62 TooManyTo_001 11921 7.10 6.01 7.86 63 XM_H_Long_From01 11529 5.04 5.82 4.50 64 LotsOfNums_01 11457 7.10 5.78 8.03 65 TR_XM_DocInvoice 11151 4.04 5.63 2.93 66 DKIM_INVALID 10488 4.44 5.29 3.84 67 XMStrtUSub 10447 5.10 5.27 4.98 68 MPART_ALT_DIFF 10301 4.26 5.20 3.60 69 XM_UB60 9817 2.09 4.95 0.08 70 XM_JunkDunk 9769 2.04 4.93 0.00 71 XM_UB50 9093 2.26 4.59 0.62 72 XM_SPF_SoftFail 9079 2.43 4.58 0.92 73 RCVD_IN_RP_CERTIFIED 8944 7.56 4.51 9.70 74 HTML_IMAGE_RATIO_06 8412 3.84 4.24 3.56 75 TVD_SPACE_RATIO_MINFP 8245 1.72 4.16 0.00 76 XMSlimDrugH 8112 1.84 4.09 0.26 77 MIME_HTML_MOSTLY 8028 3.72 4.05 3.49 78 XMNoVowels 7314 2.41 3.69 1.52 79 XMGappySubj_01 7224 1.64 3.64 0.22 80 BODY_SINGLE_WORD 6733 1.41 3.40 0.01 81 DIET_1 6327 1.99 3.19 1.15 82 TM2_M_URI_OPT_OUT 5876 2.93 2.96 2.91 83 RCVD_IN_MSPIKE_H2 5674 3.36 2.86 3.71 84 XM_UB999 5621 1.19 2.84 0.03 85 XM_SendGrid 5548 3.50 2.80 4.00 86 XM_DIRTYINTL 5501 1.92 2.78 1.32 87 XMMoneyMeta_00 5389 1.23 2.72 0.18 88 FVGT_m_MULTI_ODD_EMAIL 5206 1.15 2.63 0.11 89 XMWghtMeta_00 5164 1.09 2.61 0.02 90 MIME_QP_LONG_LINE 5113 3.88 2.58 4.79 91 XM_CamelCaseFrm001 5069 1.99 2.56 1.58 92 URI_HEX 5040 2.02 2.54 1.64 93 XMBdyGiftCard01 4939 1.62 2.49 1.01 94 XMSlimDrugs 4911 1.03 2.48 0.02 95 T_TooManySym_01 4742 3.25 2.39 3.86 96 XMGappySubj_02 4658 1.01 2.35 0.07 97 XMDiploma_00 4521 1.71 2.28 1.30 98 NO_DNS_FOR_FROM 4296 1.65 2.17 1.28 99 MIME_HTML_ONLY_MULTI 4280 1.56 2.16 1.13 100 XM_OfRef6 4264 1.63 2.15 1.26 101 RELAYCOUNTRY_RO 4255 0.89 2.15 0.01 102 HTML_IMAGE_RATIO_08 4216 2.24 2.13 2.32 103 TR_XM_RelayPhish 4123 1.04 2.08 0.30 104 RCVD_IN_RP_RNBL 4112 0.90 2.07 0.07 105 MultiRelay_CC 4090 0.93 2.06 0.13 106 MultiRelay_Combo 4090 0.93 2.06 0.13 107 BOTNET_NORDNS 4075 0.86 2.06 0.01 108 RELAYCOUNTRY_CA 3666 1.40 1.85 1.09 109 SUBJ_ALL_CAPS 3611 1.36 1.82 1.03 110 XMBody_17 3466 1.04 1.75 0.54 111 XMSexyCombo_01 3364 1.10 1.70 0.67 112 XMSubMetaI_00 3347 0.97 1.69 0.46 113 TR_Symld_Words 3162 1.41 1.60 1.28 114 XM_URI_RBL 3151 0.73 1.59 0.13 115 T_Symld_Words_02 3121 0.77 1.57 0.20 116 RCVD_IN_BL_SPAMCOP_NET 3121 0.75 1.57 0.17 117 XM_H_Long_From02 3062 1.06 1.54 0.71 118 URIBL_DBL_SPAM 2955 0.99 1.49 0.64 119 DRUGS_ERECTILE 2941 0.63 1.48 0.03 120 T_XMDrugObfuBody_08 2935 1.06 1.48 0.77 121 TR_LOTS_OF_MONEY1 2911 0.61 1.47 0.01 122 XM_S_JOY_D 2806 0.71 1.42 0.22 123 T_XMHurry_00 2725 0.82 1.37 0.43 124 RCVD_IN_IADB_LISTED 2655 2.70 1.34 3.65 125 ONLINE_PHARMACY 2629 0.56 1.33 0.01 126 SpammyFromTLD_02 2607 0.63 1.32 0.16 127 XMHTML_After_End 2594 0.72 1.31 0.31 128 UNPARSEABLE_RELAY 2591 3.77 1.31 5.50 129 TVD_VISIT_PHARMA 2556 0.54 1.29 0.01 130 TVD_SPACE_RATIO 2555 0.67 1.29 0.23 131 XM_RXBody 2509 0.61 1.27 0.15 132 ALL_TRUSTED 2394 19.27 1.21 31.98 133 RCVD_IN_IADB_SPF 2368 2.37 1.19 3.20 134 MAILING_LIST_MULTI 2314 1.40 1.17 1.56 135 URI_TRY_3LD 2280 1.26 1.15 1.34 136 RCVD_IN_IADB_SENDERID 2247 2.16 1.13 2.88 137 RCVD_IN_IADB_DK 2230 2.11 1.13 2.80 138 XMGenDplmaNmb 2219 0.88 1.12 0.72 139 XMHTMLBadTable_001 2218 0.82 1.12 0.61 140 SUBJ_YOUR_FAMILY 2212 0.47 1.12 0.01 141 DRUG_ED_CAPS 2179 0.45 1.10 0.00 142 RELAYCOUNTRY_FR 2084 0.58 1.05 0.25 143 BAYES_40 2062 2.26 1.04 3.11 144 XM_DK_Undo_01 2056 1.36 1.04 1.59 145 MPART_ALT_DIFF_COUNT 2037 1.10 1.03 1.14 146 TM2_M_VERY_LONG_WORD 1945 0.88 0.98 0.81 147 RELAYCOUNTRY_CN 1906 0.42 0.96 0.03 148 BAYES_00 1898 3.04 0.96 4.51 149 TR_Caps_n_Bayes_99 1875 0.42 0.95 0.04 150 RELAYCOUNTRY_AT 1851 0.47 0.93 0.14 151 XMPhish30 1828 0.52 0.92 0.24 152 FILL_THIS_FORM 1823 1.67 0.92 2.19 153 TooManyTo_002 1820 2.84 0.92 4.19 154 BAYES_20 1814 1.52 0.92 1.94 155 HTML_TAG_BALANCE_BODY 1789 0.56 0.90 0.32 156 XMPhish11 1772 0.97 0.89 1.03 157 XM_HighProb1 1716 0.37 0.87 0.02 158 TooManyTo_003 1686 2.60 0.85 3.82 159 XMSexyCombo_04 1660 0.39 0.84 0.08 160 XM_B_REG_HTML 1652 0.70 0.83 0.60 161 DATE_IN_PAST_06_12 1645 0.36 0.83 0.02 162 XM_H_PHPOS 1614 0.99 0.81 1.11 163 XMBody_78 1598 0.50 0.81 0.29 164 TR_XM_DK_Bayes 1565 1.97 0.79 2.80 165 XMStockSpam_06 1550 1.18 0.78 1.45 166 XM_ProductURIs 1511 1.09 0.76 1.32 167 BODY_ENHANCEMENT 1508 0.33 0.76 0.03 168 TR_XM_DK_Bayes1 1502 1.85 0.76 2.62 169 FILL_THIS_FORM_LOAN 1489 0.54 0.75 0.40 170 URIBL_BLACK 1488 0.34 0.75 0.05 171 RELAYCOUNTRY_NL 1485 0.41 0.75 0.17 172 FROM_LOCAL_NOVOWEL 1476 0.37 0.74 0.11 173 TR_XM_DK_Bayes2 1443 1.68 0.73 2.35 174 XMLongAddy 1437 0.35 0.72 0.09 175 XMSubMetaSSxObfu_00 1432 0.41 0.72 0.19 176 SUBJ_DOLLARS 1371 0.44 0.69 0.26 177 T_FILL_THIS_FORM_SHORT 1340 0.55 0.68 0.47 178 RDNS_DYNAMIC 1329 0.63 0.67 0.60 179 T_FILL_THIS_FORM_LONG 1322 0.53 0.67 0.43 180 PLING_QUERY 1304 0.53 0.66 0.43 181 XM_H_PHPMailer 1287 0.58 0.65 0.53 182 XM_B_COPY_HTML 1283 0.47 0.65 0.34 183 RCVD_IN_MSPIKE_WL 1279 1.45 0.65 2.02 184 RCVD_IN_MSPIKE_H3 1268 1.45 0.64 2.02 185 DKIM_ADSP_CUSTOM_MED 1229 0.70 0.62 0.75 186 FROM_STARTS_WITH_NUMS 1225 0.28 0.62 0.05 187 XM_Body_Obfu01 1212 0.33 0.61 0.13 188 RELAYCOUNTRY_GB 1202 0.49 0.61 0.42 189 T_TooManySym_02 1200 1.12 0.61 1.49 190 TR_Mismatch_TLD_02 1200 0.28 0.61 0.05 191 RCVD_IN_IADB_VOUCHED 1189 1.62 0.60 2.34 192 RELAYCOUNTRY_IN 1187 0.27 0.60 0.03 193 HDRS_LCASE_IMGONLY 1168 0.26 0.59 0.03 194 RELAYCOUNTRY_DE 1138 0.41 0.57 0.30 195 T_HTML_TAG_BALANCE_CENTER 1132 0.31 0.57 0.12 196 TooManyTo_004 1107 0.70 0.56 0.79 197 XMPhish14 1091 0.33 0.55 0.18 198 DKIM_ADSP_NXDOMAIN 1089 0.46 0.55 0.40 199 BAYES_05 1088 0.99 0.55 1.30 200 T_XMDrugObfuBody_00 1068 0.45 0.54 0.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 240846 90.20 96.84 85.52 2 DKIM_SIGNED 179281 63.50 63.28 63.66 3 XM_DK_Pass 177245 62.46 61.78 62.94 4 DCC_CHECK_NEGATIVE 175211 52.65 39.05 62.22 5 DKIM_VALID 168472 59.07 57.99 59.82 6 BAYES_50 165230 44.80 25.08 58.67 7 DKIM_VALID_AU 134430 48.28 49.05 47.74 8 XMListUnsubscribeExists 122530 48.39 55.32 43.51 9 DCC_CHECK 103627 46.49 60.25 36.80 10 ALL_TRUSTED 90062 19.27 1.21 31.98 11 XM_H_QuotedFrom 87031 34.90 40.56 30.90 12 HTML_FONT_LOW_CONTRAST 79874 28.29 28.19 28.36 13 DKIM_VALID_EF 74194 21.33 14.20 26.35 14 LOC_TINY_FONT_1 67475 25.99 28.87 23.96 15 T_TM2_M_HEADER_IN_MSG 53288 16.08 12.03 18.92 16 FVGT_m_MULTI_ODD 52622 18.89 19.18 18.69 17 MIME_HTML_ONLY 49006 30.93 50.14 17.40 18 XMSubLong 48324 18.67 20.82 17.16 19 XM_DK_Undo_02 48169 25.74 38.01 17.10 20 ANY_BOUNCE_MESSAGE 47106 10.00 0.45 16.73 21 BOUNCE_MESSAGE 47105 10.00 0.45 16.73 22 BAYES_99 46896 26.29 39.99 16.65 23 BAYES_999 41542 21.84 31.92 14.75 24 XM_DKIMWhitelistDomains 40140 8.37 0.01 14.25 25 XM_Multi_Part_URI 33153 11.75 11.73 11.77 26 MultiRelay 32282 12.17 13.18 11.46 27 T_KAM_HTML_FONT_INVALID 31802 12.40 13.97 11.29 28 RCVD_IN_RP_SAFE 30801 8.96 6.15 10.94 29 XM_Body_Dirty_Words 29492 12.93 16.43 10.47 30 RCVD_IN_RP_CERTIFIED 27324 7.56 4.51 9.70 31 TR_DCC_Bayes_99 26158 17.50 29.17 9.29 32 HTML_IMAGE_ONLY_08 26068 16.07 25.74 9.26 33 HTML_SHORT_LINK_IMG_1 25882 16.03 25.75 9.19 34 SHORTENER_SHORT_IMG 25812 15.80 25.24 9.17 35 LotsOfNums_01 22623 7.10 5.78 8.03 36 FSL_BULK_SIG 22577 8.48 9.14 8.02 37 LOTS_OF_MONEY 22496 7.81 7.57 7.99 38 TooManyTo_001 22136 7.10 6.01 7.86 39 HTML_IMAGE_RATIO_02 21991 11.32 16.31 7.81 40 XM_Evil_Numbers_Gen 20667 8.60 10.40 7.34 41 BAYES_60 18153 7.28 8.47 6.45 42 BOTNET_IPINHOSTNAME 17376 16.74 31.75 6.17 43 UNPARSEABLE_RELAY 15494 3.77 1.31 5.50 44 T_XMDrugObfuBody_14 14637 5.85 6.78 5.20 45 HTML_IMAGE_RATIO_04 14494 6.38 8.14 5.15 46 TVD_RCVD_IP 14436 3.11 0.25 5.13 47 URI_BUFFLY 14080 8.52 13.53 5.00 48 XMStrtUSub 14035 5.10 5.27 4.98 49 XMSubMetaSx_00 13693 5.41 6.19 4.86 50 XM_B_Phish_Phrases 13521 6.44 8.76 4.80 51 MIME_QP_LONG_LINE 13487 3.88 2.58 4.79 52 BAYES_00 12706 3.04 0.96 4.51 53 XM_H_Long_From01 12664 5.04 5.82 4.50 54 HTML_FONT_SIZE_LARGE 12320 7.52 11.99 4.37 55 FROM_EXCESS_BASE64 11994 10.51 19.40 4.26 56 TooManyTo_002 11810 2.84 0.92 4.19 57 BAYES_80 11735 7.69 12.69 4.17 58 XMSexyCombo_05 11594 6.12 8.96 4.12 59 XM_SendGrid 11264 3.50 2.80 4.00 60 T_TooManySym_01 10875 3.25 2.39 3.86 61 DKIM_INVALID 10809 4.44 5.29 3.84 62 TooManyTo_003 10766 2.60 0.85 3.82 63 XMNumbers 10519 7.53 12.92 3.74 64 RCVD_IN_MSPIKE_H2 10444 3.36 2.86 3.71 65 RCVD_IN_IADB_LISTED 10290 2.70 1.34 3.65 66 XM_UncommonTLD01 10208 13.97 28.68 3.62 67 IN_ZIMBRA_NJ_WHITELIST 10179 2.13 0.01 3.61 68 MPART_ALT_DIFF 10148 4.26 5.20 3.60 69 RELAYCOUNTRY_META 10083 16.79 35.55 3.58 70 HTML_IMAGE_RATIO_06 10015 3.84 4.24 3.56 71 MIME_HTML_MOSTLY 9842 3.72 4.05 3.49 72 URIBL_SBL_A 9241 2.04 0.28 3.28 73 RCVD_IN_IADB_SPF 9015 2.37 1.19 3.20 74 T_REMOTE_IMAGE 8893 13.08 27.17 3.16 75 BAYES_95 8840 6.08 10.26 3.14 76 BAYES_40 8759 2.26 1.04 3.11 77 TR_XM_DocInvoice 8241 4.04 5.63 2.93 78 TM2_M_URI_OPT_OUT 8186 2.93 2.96 2.91 79 RCVD_IN_IADB_SENDERID 8098 2.16 1.13 2.88 80 RCVD_IN_IADB_DK 7892 2.11 1.13 2.80 81 TR_XM_DK_Bayes 7876 1.97 0.79 2.80 82 TR_XM_DK_Bayes1 7391 1.85 0.76 2.62 83 TO_MALFORMED 7122 1.50 0.03 2.53 84 INVALID_MSGID 6824 1.49 0.17 2.42 85 TR_XM_DK_Bayes2 6622 1.68 0.73 2.35 86 RCVD_IN_IADB_VOUCHED 6586 1.62 0.60 2.34 87 HTML_IMAGE_RATIO_08 6520 2.24 2.13 2.32 88 FILL_THIS_FORM 6175 1.67 0.92 2.19 89 RCVD_IN_MSPIKE_WL 5695 1.45 0.65 2.02 90 RCVD_IN_MSPIKE_H3 5684 1.45 0.64 2.02 91 BAYES_20 5472 1.52 0.92 1.94 92 USER_IN_DEF_DKIM_WL 5343 1.15 0.09 1.90 93 IN_HORDE_ADDRESS_BOOK 5045 1.07 0.04 1.79 94 XM_B_FormFill 4913 1.04 0.03 1.74 95 URI_HEX 4630 2.02 2.54 1.64 96 XM_DK_Undo_01 4479 1.36 1.04 1.59 97 XM_CamelCaseFrm001 4460 1.99 2.56 1.58 98 MAILING_LIST_MULTI 4387 1.40 1.17 1.56 99 XMNoVowels 4272 2.41 3.69 1.52 100 T_TooManySym_02 4183 1.12 0.61 1.49 101 RCVD_IN_IADB_OPTIN 4161 1.01 0.35 1.48 102 XMStockSpam_06 4092 1.18 0.78 1.45 103 URI_TRY_3LD 3778 1.26 1.15 1.34 104 XM_ProductURIs 3713 1.09 0.76 1.32 105 XM_DIRTYINTL 3713 1.92 2.78 1.32 106 XMDiploma_00 3668 1.71 2.28 1.30 107 BAYES_05 3653 0.99 0.55 1.30 108 XM_PDF 3613 0.86 0.26 1.28 109 NO_DNS_FOR_FROM 3611 1.65 2.17 1.28 110 TR_Symld_Words 3597 1.41 1.60 1.28 111 XM_OfRef6 3557 1.63 2.15 1.26 112 XMLngstWrd_00 3522 0.83 0.22 1.25 113 DIET_1 3237 1.99 3.19 1.15 114 MPART_ALT_DIFF_COUNT 3222 1.10 1.03 1.14 115 MIME_HTML_ONLY_MULTI 3195 1.56 2.16 1.13 116 XM_GoogleGroups 3135 0.79 0.32 1.11 117 XM_H_PHPOS 3116 0.99 0.81 1.11 118 HTML_MIME_NO_HTML_TAG 3064 11.45 26.17 1.09 119 RELAYCOUNTRY_CA 3062 1.40 1.85 1.09 120 BOTNET 3058 14.71 34.07 1.09 121 XMSubMetaSxObfu_02 2993 0.72 0.23 1.06 122 XMLngstWrd_01 2988 0.70 0.20 1.06 123 UNTRUSTED_Relay 2968 13.72 31.72 1.05 124 XMPhish11 2898 0.97 0.89 1.03 125 SUBJ_ALL_CAPS 2897 1.36 1.82 1.03 126 XMBdyGiftCard01 2854 1.62 2.49 1.01 127 USER_IN_WHITELIST 2732 0.57 0.00 0.97 128 XM_SPF_SoftFail 2580 2.43 4.58 0.92 129 XMBody_95 2509 0.57 0.12 0.89 130 XMSolicitRefs_0 2429 0.63 0.30 0.86 131 TM2_M_VERY_LONG_WORD 2278 0.88 0.98 0.81 132 T_TooManySym_03 2253 0.58 0.28 0.80 133 TooManyTo_004 2231 0.70 0.56 0.79 134 T_XMDrugObfuBody_08 2158 1.06 1.48 0.77 135 DKIM_ADSP_CUSTOM_MED 2118 0.70 0.62 0.75 136 XMGenDplmaNmb 2017 0.88 1.12 0.72 137 XM_H_Long_From02 2005 1.06 1.54 0.71 138 TooManyTo_005 1946 0.60 0.47 0.69 139 XMSexyCombo_01 1898 1.10 1.70 0.67 140 TR_MetaPhish_Combo_01 1860 0.55 0.38 0.66 141 XMLngstWrd_02 1856 0.45 0.15 0.66 142 MISSING_HEADERS 1855 10.82 25.25 0.66 143 URIBL_DBL_SPAM 1814 0.99 1.49 0.64 144 XM_ShortIntro_01 1760 0.49 0.29 0.62 145 XM_UB50 1757 2.26 4.59 0.62 146 XMWinner 1754 0.39 0.05 0.62 147 XMHTMLBadTable_001 1704 0.82 1.12 0.61 148 XM_B_REG_HTML 1686 0.70 0.83 0.60 149 RDNS_DYNAMIC 1676 0.63 0.67 0.60 150 XMBrknScrpt_02 1631 0.50 0.38 0.58 151 XM_H_PHPOS_M 1522 0.52 0.49 0.54 152 XMBody_17 1510 1.04 1.75 0.54 153 XM_H_PHPMailer 1490 0.58 0.65 0.53 154 NML_ADSP_CUSTOM_MED 1483 0.53 0.53 0.53 155 HELO_NODOT 1439 0.34 0.10 0.51 156 HTML_EXTRA_CLOSE 1432 0.37 0.16 0.51 157 HTML_FONT_FACE_BAD 1402 0.50 0.50 0.50 158 TM2_M_A_HREF_HREF 1364 0.50 0.51 0.48 159 T_FILL_THIS_FORM_SHORT 1318 0.55 0.68 0.47 160 XMSubMetaI_00 1295 0.97 1.69 0.46 161 XMLngstWrd_03 1259 0.31 0.11 0.45 162 XM_Ancestry_Forge 1229 0.29 0.08 0.44 163 PLING_QUERY 1220 0.53 0.66 0.43 164 T_FILL_THIS_FORM_LONG 1218 0.53 0.67 0.43 165 T_XMHurry_00 1197 0.82 1.37 0.43 166 RELAYCOUNTRY_GB 1173 0.49 0.61 0.42 167 T_TooManySym_04 1145 0.26 0.04 0.41 168 DKIM_ADSP_NXDOMAIN 1121 0.46 0.55 0.40 169 FILL_THIS_FORM_LOAN 1118 0.54 0.75 0.40 170 T_XMDrugObfuBody_00 1114 0.45 0.54 0.40 171 RELAYCOUNTRY_AU 1091 0.35 0.29 0.39 172 URI_NOVOWEL 1051 0.38 0.39 0.37 173 XMCapTrack 1012 0.29 0.19 0.36 174 FORGED_GMAIL_RCVD 1007 0.43 0.53 0.36 175 TR_MetaPhish_Combo_01b 980 0.24 0.09 0.35 176 XM_B_COPY_HTML 952 0.47 0.65 0.34 177 XMSubMetaSSx_00 939 0.41 0.53 0.33 178 T_MONEY_PERCENT 937 0.40 0.50 0.33 179 TR_LOTS_OF_MONEY2 937 0.40 0.50 0.33 180 XMEqualsVooDoo_00 929 0.25 0.14 0.33 181 XMSubNoVowel 914 0.30 0.27 0.32 182 HTML_TAG_BALANCE_BODY 906 0.56 0.90 0.32 183 XMSubMetaSx_01 895 0.31 0.30 0.32 184 XMHTML_After_End 878 0.72 1.31 0.31 185 XMDateMe_00 860 0.35 0.41 0.31 186 RELAYCOUNTRY_DE 852 0.41 0.57 0.30 187 TR_XM_RelayPhish 851 1.04 2.08 0.30 188 KHOP_DYNAMIC 843 0.33 0.38 0.30 189 REPLYTO_WITHOUT_TO_CC 816 0.37 0.49 0.29 190 XMBody_78 812 0.50 0.81 0.29 191 XMSubMetaSxObfu_03 800 0.32 0.37 0.28 192 XMBody_29 793 0.24 0.19 0.28 193 HTML_IMAGE_ONLY_32 780 0.24 0.18 0.28 194 XM_Doc_Oz_Body 780 0.21 0.12 0.28 195 BODY_URI_ONLY 749 10.86 25.92 0.27 196 SUBJ_DOLLARS 743 0.44 0.69 0.26 197 TM2_M_BODY_EMPTY 737 0.27 0.27 0.26 198 XMSlimDrugH 730 1.84 4.09 0.26 199 XM_H_SpoofStaff4 714 0.16 0.03 0.25 200 SpammyFromTLD_01 710 10.70 25.55 0.25 ----------------------------------------------------------------------