Email: 770314 Autolearn: 0 AvgScore: 5.68 AvgScanTime: 4.58 sec Spam: 278812 Autolearn: 0 AvgScore: 15.12 AvgScanTime: 5.49 sec Ham: 491502 Autolearn: 0 AvgScore: 0.33 AvgScanTime: 4.06 sec Time Spent Running SA: 979.18 hours Time Spent Processing Spam: 424.86 hours Time Spent Processing Ham: 554.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 268390 90.60 96.26 87.38 2 DCC_CHECK 199309 46.75 71.49 32.72 3 DKIM_SIGNED 195203 66.86 70.01 65.08 4 XM_DK_Pass 190152 65.51 68.20 63.99 5 DKIM_VALID 179436 61.56 64.36 59.97 6 XMListUnsubscribeExists 166683 48.99 59.78 42.86 7 DKIM_VALID_AU 140483 45.40 50.39 42.58 8 XM_H_QuotedFrom 125711 36.53 45.09 31.67 9 BAYES_99 118241 23.13 42.41 12.20 10 MIME_HTML_ONLY 115495 25.58 41.42 16.59 11 XM_DK_Undo_02 112928 22.75 40.50 12.68 12 BAYES_999 93575 18.91 33.56 10.60 13 T_TM2_M_HEADER_IN_MSG 89271 29.77 32.02 28.49 14 TR_DCC_Bayes_99 86146 14.63 30.90 5.41 15 LOC_TINY_FONT_1 83239 22.95 29.85 19.03 16 HTML_FONT_LOW_CONTRAST 83139 26.30 29.82 24.31 17 BAYES_50 79459 49.70 28.50 61.73 18 DCC_CHECK_NEGATIVE 75952 51.67 27.24 65.52 19 RELAYCOUNTRY_META 75637 12.84 27.13 4.73 20 BOTNET_IPINHOSTNAME 70534 12.16 25.30 4.71 21 XMSubLong 69637 20.84 24.98 18.49 22 BOTNET 67024 9.40 24.04 1.10 23 FVGT_m_MULTI_ODD 65612 21.83 23.53 20.87 24 UNTRUSTED_Relay 61378 8.71 22.01 1.16 25 FROM_EXCESS_BASE64 60137 10.02 21.57 3.47 26 DKIM_VALID_EF 54755 22.62 19.64 24.31 27 HTML_MIME_NO_HTML_TAG 49292 7.61 17.68 1.90 28 T_KAM_HTML_FONT_INVALID 48615 15.27 17.44 14.05 29 XM_BadFromFormat 46208 6.12 16.57 0.19 30 MISSING_HEADERS 45401 6.25 16.28 0.56 31 HTML_IMAGE_ONLY_08 45206 8.74 16.21 4.50 32 HTML_SHORT_LINK_IMG_1 45005 8.66 16.14 4.41 33 MIME_HEADER_CTYPE_ONLY 44627 5.88 16.01 0.13 34 SHORTENER_SHORT_IMG 44543 8.58 15.98 4.39 35 URI_BUFFLY 44408 8.57 15.93 4.39 36 XM_Body_Dirty_Words 43841 12.24 15.72 10.26 37 HTML_FONT_SIZE_HUGE 43738 8.40 15.69 4.27 38 FSL_BULK_SIG 43518 9.60 15.61 6.19 39 BODY_URI_ONLY 43231 5.66 15.51 0.08 40 RELAYCOUNTRY_TH 41018 5.35 14.71 0.03 41 XM_Multi_Part_URI 40735 11.80 14.61 10.21 42 MultiRelay 38460 16.12 13.79 17.44 43 HTML_IMAGE_RATIO_02 38300 9.50 13.74 7.10 44 BAYES_80 31939 6.74 11.46 4.07 45 XM_UncommonTLD01 30640 5.92 10.99 3.05 46 XM_Evil_Numbers_Gen 29861 8.31 10.71 6.95 47 LOTS_OF_MONEY 27326 8.96 9.80 8.48 48 XMSexyCombo_05 23754 4.84 8.52 2.76 49 XMNumbers 23680 4.93 8.49 2.90 50 T_XMDrugObfuBody_14 22479 7.55 8.06 7.26 51 SpammyFromTLD_02 21784 2.99 7.81 0.26 52 MPART_ALT_DIFF 21714 4.98 7.79 3.38 53 XM_B_Phish_Phrases 21696 5.41 7.78 4.06 54 BAYES_60 21520 7.11 7.72 6.76 55 XMSubMetaSx_00 20908 5.49 7.50 4.35 56 LotsOfNums_01 20482 7.99 7.35 8.36 57 HTML_IMAGE_RATIO_04 19368 5.56 6.95 4.77 58 BAYES_95 18008 4.12 6.46 2.79 59 XM_UB99 18004 2.37 6.46 0.05 60 XM_H_Long_From01 17493 5.53 6.27 5.11 61 TR_XM_DocInvoice 17168 4.21 6.16 3.10 62 TooManyTo_001 16768 7.48 6.01 8.30 63 DKIM_INVALID 15767 5.31 5.66 5.11 64 XM_JunkDunk 15150 1.97 5.43 0.00 65 XM_UB80 15011 1.99 5.38 0.06 66 HTML_IMAGE_RATIO_06 14250 3.82 5.11 3.09 67 XM_SPF_SoftFail 12929 3.19 4.64 2.38 68 RCVD_IN_RP_SAFE 12087 6.35 4.34 7.50 69 DIET_1 11321 2.51 4.06 1.63 70 XMNoVowels 11060 3.30 3.97 2.92 71 MIME_HTML_MOSTLY 10948 2.80 3.93 2.16 72 XMSlimDrugH 10553 1.63 3.78 0.40 73 MIME_QP_LONG_LINE 10534 5.15 3.78 5.92 74 XM_SendGrid 9759 4.11 3.50 4.45 75 TM2_M_URI_OPT_OUT 9657 2.92 3.46 2.62 76 XM_UB60 9461 1.30 3.39 0.11 77 XM_CamelCaseFrm001 9449 2.28 3.39 1.66 78 ALL_TRUSTED 9422 17.33 3.38 25.25 79 RCVD_IN_RP_CERTIFIED 9062 5.51 3.25 6.80 80 XMStrtUSub 8950 3.46 3.21 3.59 81 MIME_HTML_ONLY_MULTI 8768 1.92 3.14 1.22 82 XM_UB50 8575 1.54 3.08 0.68 83 XM_UB95 8403 1.11 3.01 0.04 84 XM_UB999 7926 1.05 2.84 0.03 85 XM_DIRTYINTL 7693 1.90 2.76 1.42 86 RCVD_IN_MSPIKE_H2 7391 3.57 2.65 4.09 87 XMDiploma_00 7327 2.24 2.63 2.02 88 RCVD_IN_RP_RNBL 7142 0.96 2.56 0.05 89 XMSlimDrugs 7050 0.93 2.53 0.02 90 XMWghtMeta_00 7021 0.92 2.52 0.01 91 XM_OfRef6 6930 1.75 2.49 1.33 92 RELAYCOUNTRY_CA 6886 1.67 2.47 1.22 93 URI_HEX 6633 1.74 2.38 1.37 94 T_TooManySym_01 6532 3.09 2.34 3.52 95 HTML_IMAGE_RATIO_08 6377 2.26 2.29 2.24 96 T_REMOTE_IMAGE 5913 3.46 2.12 4.22 97 XMSexyCombo_01 5833 1.08 2.09 0.51 98 T_XMDrugObfuBody_08 5769 1.56 2.07 1.28 99 SpammyFromTLD_01 5741 1.15 2.06 0.64 100 XM_URI_RBL 5572 0.79 2.00 0.11 101 RCVD_IN_IADB_LISTED 5255 4.13 1.88 5.41 102 XM_H_Long_From02 5218 1.25 1.87 0.90 103 SUBJ_ALL_CAPS 5029 1.62 1.80 1.51 104 XMSubMetaSSx_00 4912 0.82 1.76 0.28 105 XMSubMetaI_00 4790 0.96 1.72 0.53 106 MultiRelay_CC 4778 0.74 1.71 0.19 107 MultiRelay_Combo 4778 0.74 1.71 0.19 108 RCVD_IN_IADB_SPF 4770 3.64 1.71 4.73 109 RCVD_IN_IADB_SENDERID 4551 3.22 1.63 4.12 110 RCVD_IN_IADB_DK 4514 3.17 1.62 4.06 111 RCVD_IN_BL_SPAMCOP_NET 4473 0.76 1.60 0.28 112 SUBJECT_DIET 4416 0.57 1.58 0.00 113 TR_XM_RelayPhish 4128 0.79 1.48 0.40 114 XMGenDplmaNmb 4110 1.28 1.47 1.17 115 XM_DK_Undo_01 4096 1.72 1.47 1.86 116 XMPhish14 4011 0.69 1.44 0.27 117 URIBL_BLACK 3932 0.53 1.41 0.03 118 XMBody_17 3891 0.79 1.40 0.44 119 TR_LOTS_OF_MONEY3 3880 0.68 1.39 0.27 120 TM2_M_VERY_LONG_WORD 3848 1.04 1.38 0.84 121 RELAYCOUNTRY_FR 3843 0.68 1.38 0.29 122 XMSubMetaSx_01 3828 0.83 1.37 0.52 123 T_XMHurry_00 3745 0.92 1.34 0.68 124 XM_iOS_Forged_Message 3718 0.57 1.33 0.14 125 MAILING_LIST_MULTI 3632 1.93 1.30 2.29 126 T_FILL_THIS_FORM_SHORT 3488 0.98 1.25 0.82 127 URI_TRY_3LD 3468 1.12 1.24 1.05 128 XM_ProductURIs 3461 1.08 1.24 0.99 129 XMStockSpam_06 3351 1.10 1.20 1.05 130 UNPARSEABLE_RELAY 3336 2.60 1.20 3.40 131 TR_LOTS_OF_MONEY2 3110 0.57 1.12 0.26 132 T_MONEY_PERCENT 3110 0.57 1.12 0.26 133 DATE_IN_PAST_06_12 3034 0.41 1.09 0.02 134 BAYES_40 3024 2.43 1.08 3.19 135 URIBL_DBL_SPAM 3014 0.41 1.08 0.03 136 XMHTML_After_End 3005 0.64 1.08 0.40 137 ONLINE_PHARMACY 3000 0.39 1.08 0.01 138 BOTNET_NORDNS 2975 0.39 1.07 0.01 139 XMBdyGiftCard01 2975 0.96 1.07 0.90 140 TR_MetaPhish_Combo_01 2971 0.78 1.07 0.62 141 URIBL_SBL_A 2955 1.24 1.06 1.35 142 DRUGS_ERECTILE 2955 0.40 1.06 0.02 143 TVD_VISIT_PHARMA 2923 0.38 1.05 0.00 144 XMPhish11 2909 1.15 1.04 1.21 145 RELAYCOUNTRY_GB 2885 1.02 1.03 1.00 146 RELAYCOUNTRY_CN 2849 0.40 1.02 0.05 147 XM_HighProb1 2828 0.38 1.01 0.01 148 XMSubMetaSxObfu_03 2823 0.58 1.01 0.34 149 XMBody_78 2733 0.64 0.98 0.45 150 T_Symld_Words_02 2730 0.74 0.98 0.60 151 BAYES_00 2726 3.92 0.98 5.59 152 SUBJ_DOLLARS 2714 0.53 0.97 0.28 153 XMMoneyMeta_00 2658 0.67 0.95 0.51 154 XMPhish30 2550 0.54 0.91 0.33 155 DRUG_ED_CAPS 2516 0.33 0.90 0.00 156 HTML_FONT_FACE_BAD 2449 0.55 0.88 0.37 157 BAYES_20 2442 1.71 0.88 2.19 158 NO_DNS_FOR_FROM 2401 0.67 0.86 0.57 159 TooManyTo_002 2332 2.25 0.84 3.04 160 HTML_EXTRA_CLOSE 2320 0.52 0.83 0.35 161 RELAYCOUNTRY_AT 2309 0.36 0.83 0.09 162 T_XMDrugObfuBody_00 2305 0.58 0.83 0.44 163 XM_B_REG_HTML 2269 0.54 0.81 0.38 164 XM_ShortIntro_01 2240 0.96 0.80 1.05 165 RCVD_IN_IADB_VOUCHED 2218 2.59 0.80 3.61 166 HTTPS_HTTP_MISMATCH 2213 0.60 0.79 0.50 167 DKIM_ADSP_CUSTOM_MED 2174 0.93 0.78 1.02 168 TR_XM_DK_Bayes 2143 2.28 0.77 3.14 169 FVGT_m_MULTI_ODD_EMAIL 2142 0.32 0.77 0.07 170 XMBrknScrpt_02 2122 0.66 0.76 0.61 171 TooManyTo_003 2107 1.70 0.76 2.24 172 REMOVE_BEFORE_LINK 2072 0.42 0.74 0.24 173 XM_H_PHPOS 2059 1.05 0.74 1.23 174 TR_Mismatch_TLD_02 2036 0.30 0.73 0.06 175 TR_XM_DK_Bayes1 2004 2.12 0.72 2.91 176 BOUNCE_MESSAGE 2000 6.88 0.72 10.38 177 ANY_BOUNCE_MESSAGE 2000 6.88 0.72 10.38 178 TVD_SPACE_RATIO_MINFP 1977 0.26 0.71 0.01 179 MPART_ALT_DIFF_COUNT 1967 0.88 0.71 0.98 180 XMHTMLBadTable_001 1955 0.47 0.70 0.34 181 DATE_IN_PAST_12_24 1934 0.44 0.69 0.30 182 XM_B_COPY_HTML 1921 0.46 0.69 0.33 183 TR_Caps_n_Bayes_99 1897 0.29 0.68 0.07 184 HTML_TAG_BALANCE_BODY 1888 0.58 0.68 0.52 185 URI_NOVOWEL 1876 0.53 0.67 0.46 186 TR_XM_DK_Bayes2 1870 1.84 0.67 2.50 187 RELAYCOUNTRY_IN 1843 0.28 0.66 0.07 188 TR_Symld_Words 1830 1.34 0.66 1.73 189 NML_ADSP_CUSTOM_MED 1823 0.70 0.65 0.72 190 XM_PDF 1815 2.80 0.65 4.01 191 XM_RXBody 1803 0.27 0.65 0.06 192 FORGED_GMAIL_RCVD 1787 0.57 0.64 0.52 193 XMSexyCombo_04 1770 0.27 0.63 0.07 194 DATE_IN_PAST_03_06 1753 0.26 0.63 0.05 195 RELAYCOUNTRY_AU 1741 0.54 0.62 0.50 196 XM_H_PHPMailer 1733 0.69 0.62 0.74 197 PLING_QUERY 1721 0.47 0.62 0.38 198 TR_XM_FormFill 1678 0.23 0.60 0.02 199 XM_Body_Obfu01 1646 0.34 0.59 0.20 200 RCVD_IN_MSPIKE_WL 1636 1.35 0.59 1.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 429492 90.60 96.26 87.38 2 DCC_CHECK_NEGATIVE 322036 51.67 27.24 65.52 3 DKIM_SIGNED 319849 66.86 70.01 65.08 4 XM_DK_Pass 314494 65.51 68.20 63.99 5 BAYES_50 303387 49.70 28.50 61.73 6 DKIM_VALID 294737 61.56 64.36 59.97 7 XMListUnsubscribeExists 210661 48.99 59.78 42.86 8 DKIM_VALID_AU 209276 45.40 50.39 42.58 9 DCC_CHECK 160803 46.75 71.49 32.72 10 XM_H_QuotedFrom 155667 36.53 45.09 31.67 11 T_TM2_M_HEADER_IN_MSG 140023 29.77 32.02 28.49 12 ALL_TRUSTED 124081 17.33 3.38 25.25 13 DKIM_VALID_EF 119498 22.62 19.64 24.31 14 HTML_FONT_LOW_CONTRAST 119475 26.30 29.82 24.31 15 FVGT_m_MULTI_ODD 102560 21.83 23.53 20.87 16 LOC_TINY_FONT_1 93518 22.95 29.85 19.03 17 XMSubLong 90894 20.84 24.98 18.49 18 MultiRelay 85723 16.12 13.79 17.44 19 MIME_HTML_ONLY 81525 25.58 41.42 16.59 20 T_KAM_HTML_FONT_INVALID 69036 15.27 17.44 14.05 21 XM_DK_Undo_02 62338 22.75 40.50 12.68 22 BAYES_99 59966 23.13 42.41 12.20 23 BAYES_999 52083 18.91 33.56 10.60 24 ANY_BOUNCE_MESSAGE 51004 6.88 0.72 10.38 25 BOUNCE_MESSAGE 51003 6.88 0.72 10.38 26 XM_Body_Dirty_Words 50414 12.24 15.72 10.26 27 XM_Multi_Part_URI 50183 11.80 14.61 10.21 28 XM_DKIMWhitelistDomains 45797 5.97 0.06 9.32 29 LOTS_OF_MONEY 41685 8.96 9.80 8.48 30 LotsOfNums_01 41068 7.99 7.35 8.36 31 TooManyTo_001 40816 7.48 6.01 8.30 32 RCVD_IN_RP_SAFE 36841 6.35 4.34 7.50 33 T_XMDrugObfuBody_14 35704 7.55 8.06 7.26 34 HTML_IMAGE_RATIO_02 34894 9.50 13.74 7.10 35 XM_Evil_Numbers_Gen 34182 8.31 10.71 6.95 36 RCVD_IN_RP_CERTIFIED 33407 5.51 3.25 6.80 37 BAYES_60 33215 7.11 7.72 6.76 38 FSL_BULK_SIG 30402 9.60 15.61 6.19 39 MIME_QP_LONG_LINE 29118 5.15 3.78 5.92 40 BAYES_00 27462 3.92 0.98 5.59 41 TR_DCC_Bayes_99 26585 14.63 30.90 5.41 42 RCVD_IN_IADB_LISTED 26584 4.13 1.88 5.41 43 XM_H_Long_From01 25130 5.53 6.27 5.11 44 DKIM_INVALID 25112 5.31 5.66 5.11 45 HTML_IMAGE_RATIO_04 23455 5.56 6.95 4.77 46 RELAYCOUNTRY_META 23251 12.84 27.13 4.73 47 RCVD_IN_IADB_SPF 23238 3.64 1.71 4.73 48 BOTNET_IPINHOSTNAME 23150 12.16 25.30 4.71 49 IN_ZIMBRA_NJ_WHITELIST 22606 2.94 0.02 4.60 50 HTML_IMAGE_ONLY_08 22108 8.74 16.21 4.50 51 XM_SendGrid 21874 4.11 3.50 4.45 52 HTML_SHORT_LINK_IMG_1 21695 8.66 16.14 4.41 53 URI_BUFFLY 21581 8.57 15.93 4.39 54 SHORTENER_SHORT_IMG 21580 8.58 15.98 4.39 55 XMSubMetaSx_00 21382 5.49 7.50 4.35 56 HTML_FONT_SIZE_HUGE 20989 8.40 15.69 4.27 57 T_REMOTE_IMAGE 20751 3.46 2.12 4.22 58 RCVD_IN_IADB_SENDERID 20231 3.22 1.63 4.12 59 RCVD_IN_MSPIKE_H2 20093 3.57 2.65 4.09 60 BAYES_80 20004 6.74 11.46 4.07 61 XM_B_Phish_Phrases 19976 5.41 7.78 4.06 62 RCVD_IN_IADB_DK 19941 3.17 1.62 4.06 63 XM_PDF 19726 2.80 0.65 4.01 64 RCVD_IN_IADB_VOUCHED 17746 2.59 0.80 3.61 65 XMStrtUSub 17668 3.46 3.21 3.59 66 T_TooManySym_01 17283 3.09 2.34 3.52 67 FROM_EXCESS_BASE64 17075 10.02 21.57 3.47 68 UNPARSEABLE_RELAY 16713 2.60 1.20 3.40 69 MPART_ALT_DIFF 16615 4.98 7.79 3.38 70 BAYES_40 15697 2.43 1.08 3.19 71 TR_XM_DK_Bayes 15436 2.28 0.77 3.14 72 TVD_RCVD_IP 15389 2.06 0.16 3.13 73 TR_XM_DocInvoice 15256 4.21 6.16 3.10 74 HTML_IMAGE_RATIO_06 15193 3.82 5.11 3.09 75 XM_UncommonTLD01 14982 5.92 10.99 3.05 76 TooManyTo_002 14962 2.25 0.84 3.04 77 XMNoVowels 14331 3.30 3.97 2.92 78 TR_XM_DK_Bayes1 14312 2.12 0.72 2.91 79 XMNumbers 14260 4.93 8.49 2.90 80 BAYES_95 13708 4.12 6.46 2.79 81 XMSexyCombo_05 13543 4.84 8.52 2.76 82 TM2_M_URI_OPT_OUT 12855 2.92 3.46 2.62 83 TR_XM_DK_Bayes2 12311 1.84 0.67 2.50 84 XM_SPF_SoftFail 11678 3.19 4.64 2.38 85 RCVD_IN_IADB_OPTIN 11363 1.64 0.45 2.31 86 MAILING_LIST_MULTI 11269 1.93 1.30 2.29 87 HTML_IMAGE_RATIO_08 11013 2.26 2.29 2.24 88 TooManyTo_003 10988 1.70 0.76 2.24 89 BAYES_20 10758 1.71 0.88 2.19 90 MIME_HTML_MOSTLY 10618 2.80 3.93 2.16 91 XMDiploma_00 9906 2.24 2.63 2.02 92 HTML_MIME_NO_HTML_TAG 9362 7.61 17.68 1.90 93 XM_DK_Undo_01 9118 1.72 1.47 1.86 94 HELO_NODOT 8820 1.30 0.42 1.79 95 RCVD_IN_MSPIKE_WL 8748 1.35 0.59 1.78 96 RCVD_IN_MSPIKE_H3 8744 1.35 0.58 1.78 97 TR_Symld_Words 8517 1.34 0.66 1.73 98 IN_HORDE_ADDRESS_BOOK 8175 1.07 0.03 1.66 99 XM_CamelCaseFrm001 8137 2.28 3.39 1.66 100 DIET_1 8032 2.51 4.06 1.63 101 SUBJ_ALL_CAPS 7441 1.62 1.80 1.51 102 T_TooManySym_02 7319 1.14 0.53 1.49 103 BAYES_05 7093 1.10 0.49 1.44 104 INVALID_MSGID 7070 0.99 0.21 1.44 105 XM_DIRTYINTL 6977 1.90 2.76 1.42 106 URI_HEX 6751 1.74 2.38 1.37 107 URIBL_SBL_A 6631 1.24 1.06 1.35 108 XMCapTrack 6615 1.07 0.58 1.35 109 XM_OfRef6 6558 1.75 2.49 1.33 110 TO_MALFORMED 6488 0.85 0.01 1.32 111 XMLngstWrd_00 6482 1.00 0.42 1.32 112 USER_IN_DEF_DKIM_WL 6430 0.85 0.04 1.31 113 T_XMDrugObfuBody_08 6278 1.56 2.07 1.28 114 XM_H_PHPOS 6053 1.05 0.74 1.23 115 RELAYCOUNTRY_CA 6008 1.67 2.47 1.22 116 MIME_HTML_ONLY_MULTI 6005 1.92 3.14 1.22 117 XMPhish11 5971 1.15 1.04 1.21 118 XM_GoogleGroups 5749 0.88 0.36 1.17 119 XMGenDplmaNmb 5744 1.28 1.47 1.17 120 UNTRUSTED_Relay 5701 8.71 22.01 1.16 121 XMLngstWrd_01 5639 0.87 0.39 1.15 122 TooManyTo_004 5471 0.90 0.52 1.11 123 BOTNET 5412 9.40 24.04 1.10 124 URI_TRY_3LD 5161 1.12 1.24 1.05 125 XMStockSpam_06 5158 1.10 1.20 1.05 126 XM_ShortIntro_01 5148 0.96 0.80 1.05 127 DKIM_ADSP_CUSTOM_MED 5023 0.93 0.78 1.02 128 RELAYCOUNTRY_GB 4937 1.02 1.03 1.00 129 XM_ProductURIs 4859 1.08 1.24 0.99 130 MPART_ALT_DIFF_COUNT 4833 0.88 0.71 0.98 131 XMBdyGiftCard01 4414 0.96 1.07 0.90 132 XM_H_Long_From02 4404 1.25 1.87 0.90 133 TooManyTo_005 4361 0.72 0.44 0.89 134 TM2_M_VERY_LONG_WORD 4152 1.04 1.38 0.84 135 USER_IN_WHITELIST 4060 0.53 0.00 0.83 136 T_FILL_THIS_FORM_SHORT 4039 0.98 1.25 0.82 137 XM_H_PHPMailer 3618 0.69 0.62 0.74 138 XMLngstWrd_02 3573 0.59 0.34 0.73 139 XMSolicitRefs_0 3570 0.57 0.30 0.73 140 NML_ADSP_CUSTOM_MED 3547 0.70 0.65 0.72 141 T_XMHurry_00 3363 0.92 1.34 0.68 142 XM_UB50 3326 1.54 3.08 0.68 143 XMSubMetaSxObfu_02 3253 0.52 0.27 0.66 144 XMGappySubj_01 3237 0.52 0.28 0.66 145 SpammyFromTLD_01 3153 1.15 2.06 0.64 146 KHOP_DYNAMIC 3058 0.52 0.35 0.62 147 TR_MetaPhish_Combo_01 3037 0.78 1.07 0.62 148 XMBrknScrpt_02 2998 0.66 0.76 0.61 149 T_Symld_Words_02 2958 0.74 0.98 0.60 150 T_TooManySym_03 2924 0.44 0.16 0.59 151 NO_DNS_FOR_FROM 2797 0.67 0.86 0.57 152 MISSING_HEADERS 2775 6.25 16.28 0.56 153 T_OBFU_PDF_ATTACH 2678 0.40 0.14 0.54 154 XMSubMetaI_00 2611 0.96 1.72 0.53 155 RELAYCOUNTRY_DE 2573 0.50 0.45 0.52 156 FORGED_GMAIL_RCVD 2568 0.57 0.64 0.52 157 HTML_TAG_BALANCE_BODY 2554 0.58 0.68 0.52 158 XMSubMetaSx_01 2538 0.83 1.37 0.52 159 XMSexyCombo_01 2519 1.08 2.09 0.51 160 XMBody_95 2508 0.36 0.10 0.51 161 XMMoneyMeta_00 2504 0.67 0.95 0.51 162 RELAYCOUNTRY_AU 2457 0.54 0.62 0.50 163 HTTPS_HTTP_MISMATCH 2439 0.60 0.79 0.50 164 XMLngstWrd_03 2363 0.41 0.28 0.48 165 SHORT_HELO_AND_INLINE_IMAGE 2277 0.32 0.06 0.46 166 T_MANY_PILL_PRICE 2258 0.29 0.00 0.46 167 URI_NOVOWEL 2245 0.53 0.67 0.46 168 TM2_M_A_HREF_HREF 2242 0.47 0.49 0.46 169 RDNS_DYNAMIC 2239 0.48 0.53 0.46 170 XMBody_78 2225 0.64 0.98 0.45 171 FILL_THIS_FORM 2208 0.50 0.58 0.45 172 LOW_PRICE 2188 0.42 0.38 0.45 173 XMBody_17 2180 0.79 1.40 0.44 174 T_XMDrugObfuBody_00 2178 0.58 0.83 0.44 175 HTML_IMAGE_ONLY_28 2104 0.45 0.48 0.43 176 HTML_IMAGE_ONLY_32 2071 0.35 0.23 0.42 177 RCVD_IN_SORBS_DUL 2069 0.37 0.28 0.42 178 XMSlimDrugH 1990 1.63 3.78 0.40 179 TR_XM_RelayPhish 1975 0.79 1.48 0.40 180 XMHTML_After_End 1961 0.64 1.08 0.40 181 TM2_M_BODY_EMPTY 1919 0.34 0.25 0.39 182 PLING_QUERY 1877 0.47 0.62 0.38 183 XM_B_REG_HTML 1874 0.54 0.81 0.38 184 XMDateMe_00 1849 0.33 0.26 0.38 185 XM_B_TRADE_HTML 1833 0.31 0.21 0.37 186 HTML_FONT_FACE_BAD 1806 0.55 0.88 0.37 187 XMGappySubj_02 1770 0.27 0.10 0.36 188 T_FILL_THIS_FORM_LONG 1730 0.40 0.48 0.35 189 XM_D_tchamptons_WL 1730 0.22 0.00 0.35 190 HTML_EXTRA_CLOSE 1719 0.52 0.83 0.35 191 XMHTMLBadTable_001 1695 0.47 0.70 0.34 192 XMSubMetaSxObfu_03 1673 0.58 1.01 0.34 193 HTML_IMAGE_ONLY_24 1673 0.31 0.25 0.34 194 XMSubNoVowel 1673 0.36 0.40 0.34 195 AC_DIV_BONANZA 1640 0.24 0.07 0.33 196 XM_B_COPY_HTML 1611 0.46 0.69 0.33 197 XMPhish30 1609 0.54 0.91 0.33 198 XM_H_SpoofStaff4 1568 0.22 0.05 0.32 199 XM_H_PHPOS_M 1519 0.32 0.35 0.31 200 FILL_THIS_FORM_LOAN 1479 0.37 0.49 0.30 ----------------------------------------------------------------------