Email: 449851 Autolearn: 0 AvgScore: 5.64 AvgScanTime: 3.22 sec Spam: 177987 Autolearn: 0 AvgScore: 14.06 AvgScanTime: 3.73 sec Ham: 271864 Autolearn: 0 AvgScore: 0.12 AvgScanTime: 2.89 sec Time Spent Running SA: 402.36 hours Time Spent Processing Spam: 184.21 hours Time Spent Processing Ham: 218.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171496 90.93 96.35 87.37 2 DKIM_SIGNED 114513 65.37 64.34 66.04 3 XM_DK_Pass 112513 64.56 63.21 65.44 4 DCC_CHECK 108585 45.66 61.01 35.61 5 DKIM_VALID 106217 61.28 59.68 62.33 6 XMListUnsubscribeExists 99696 50.12 56.01 46.27 7 DKIM_VALID_AU 88578 48.72 49.77 48.04 8 MIME_HTML_ONLY 88101 30.68 49.50 18.35 9 XM_H_QuotedFrom 74209 35.10 41.69 30.79 10 BAYES_99 71665 24.95 40.26 14.92 11 DCC_CHECK_NEGATIVE 67777 53.41 38.08 63.45 12 XM_DK_Undo_02 66444 24.04 37.33 15.34 13 BAYES_999 53149 19.74 29.86 13.12 14 LOC_TINY_FONT_1 52268 26.05 29.37 23.89 15 BAYES_50 51487 47.21 28.93 59.17 16 HTML_FONT_LOW_CONTRAST 48659 27.96 27.34 28.37 17 TR_DCC_Bayes_99 47880 14.86 26.90 6.98 18 HTML_MIME_NO_HTML_TAG 43099 10.34 24.21 1.26 19 MISSING_HEADERS 40727 9.41 22.88 0.59 20 BODY_URI_ONLY 40439 9.03 22.72 0.06 21 HTML_IMAGE_ONLY_08 40266 13.67 22.62 7.81 22 HTML_SHORT_LINK_IMG_1 40243 13.63 22.61 7.75 23 MIME_HEADER_CTYPE_ONLY 40044 8.98 22.50 0.14 24 SHORTENER_SHORT_IMG 40036 13.57 22.49 7.73 25 URI_BUFFLY 39904 13.54 22.42 7.73 26 XMSubLong 38257 18.47 21.49 16.49 27 XM_BadFromFormat 37614 8.49 21.13 0.21 28 RCVD_IN_RP_RNBL 36637 8.19 20.58 0.08 29 FVGT_m_MULTI_ODD 36066 20.56 20.26 20.76 30 T_TM2_M_HEADER_IN_MSG 28076 20.32 15.77 23.29 31 XM_Body_Dirty_Words 28011 12.57 15.74 10.50 32 HTML_IMAGE_RATIO_02 27813 11.03 15.63 8.01 33 XM_UncommonTLD01 27476 8.34 15.44 3.69 34 T_KAM_HTML_FONT_INVALID 27337 13.33 15.36 12.00 35 DKIM_VALID_EF 27165 21.82 15.26 26.11 36 MultiRelay 25528 13.59 14.34 13.10 37 RELAYCOUNTRY_META 24381 9.48 13.70 6.71 38 XM_Multi_Part_URI 23930 11.74 13.44 10.63 39 BOTNET 21412 5.39 12.03 1.05 40 XMSexyCombo_05 20963 6.38 11.78 2.85 41 XM_Evil_Numbers_Gen 19167 8.23 10.77 6.57 42 BAYES_80 19016 6.66 10.68 4.02 43 BOTNET_IPINHOSTNAME 18887 8.27 10.61 6.73 44 SpammyFromTLD_02 18609 4.22 10.46 0.14 45 FSL_BULK_SIG 17558 8.15 9.86 7.02 46 UNTRUSTED_Relay 17110 6.31 9.61 4.14 47 BAYES_60 16087 7.46 9.04 6.43 48 XMSubMetaSx_00 15689 6.20 8.81 4.49 49 XM_B_Phish_Phrases 15522 6.19 8.72 4.54 50 LOTS_OF_MONEY 14979 9.32 8.42 9.91 51 BAYES_95 13086 4.69 7.35 2.95 52 HTML_IMAGE_RATIO_04 12995 6.33 7.30 5.70 53 XM_JunkDunk 12922 2.87 7.26 0.00 54 T_XMDrugObfuBody_14 11938 6.19 6.71 5.85 55 XM_H_Long_From01 11393 5.28 6.40 4.54 56 TR_XM_DocInvoice 11319 4.17 6.36 2.74 57 TooManyTo_001 10854 7.96 6.10 9.18 58 XM_SPF_SoftFail 10789 3.43 6.06 1.70 59 MPART_ALT_DIFF 10710 4.68 6.02 3.81 60 RCVD_IN_RP_SAFE 10224 8.08 5.74 9.61 61 FROM_EXCESS_BASE64 10175 5.03 5.72 4.58 62 XMNumbers 9496 3.98 5.34 3.10 63 LotsOfNums_01 9437 6.83 5.30 7.83 64 DKIM_INVALID 8296 4.09 4.66 3.71 65 XMNoVowels 7918 3.29 4.45 2.53 66 RCVD_IN_RP_CERTIFIED 7904 7.01 4.44 8.70 67 HTML_IMAGE_RATIO_06 7072 3.82 3.97 3.72 68 DIET_1 6854 2.08 3.85 0.92 69 MIME_HTML_MOSTLY 6694 3.28 3.76 2.97 70 XMStrtUSub 6618 3.70 3.72 3.69 71 XM_UB50 6241 3.69 3.51 3.80 72 RCVD_IN_MSPIKE_H2 6113 3.76 3.43 3.97 73 XM_CamelCaseFrm001 5657 2.18 3.18 1.52 74 TR_Symld_Words 5615 2.15 3.15 1.50 75 MIME_QP_LONG_LINE 5550 4.12 3.12 4.77 76 XM_DIRTYINTL 5417 2.28 3.04 1.78 77 MIME_HTML_ONLY_MULTI 5196 2.11 2.92 1.58 78 XM_SendGrid 5052 3.65 2.84 4.19 79 URI_HEX 4866 2.20 2.73 1.85 80 MultiRelay_CC 4793 1.14 2.69 0.12 81 MultiRelay_Combo 4793 1.14 2.69 0.12 82 TM2_M_URI_OPT_OUT 4471 2.56 2.51 2.58 83 FROM_NO_USER 4451 0.99 2.50 0.01 84 TR_XM_RelayPhish 4431 1.14 2.49 0.25 85 T_TooManySym_01 4423 3.62 2.49 4.36 86 SUBJ_ALL_CAPS 4146 1.82 2.33 1.49 87 RELAYCOUNTRY_CA 4120 1.71 2.31 1.31 88 SpammyFromTLD_01 4068 1.12 2.29 0.36 89 NO_DNS_FOR_FROM 4044 1.68 2.27 1.30 90 RELAYCOUNTRY_RO 4021 0.90 2.26 0.01 91 XM_OfRef6 3924 1.69 2.20 1.35 92 BOTNET_NORDNS 3906 0.87 2.19 0.01 93 XMDiploma_00 3896 1.73 2.19 1.43 94 HTML_IMAGE_RATIO_08 3742 1.86 2.10 1.70 95 XMBdyGiftCard01 3535 1.50 1.99 1.19 96 TVD_SPACE_RATIO_MINFP 3485 0.78 1.96 0.01 97 XM_ProductURIs 3439 1.78 1.93 1.68 98 XM_URI_RBL 3387 0.81 1.90 0.10 99 T_REMOTE_IMAGE 3246 3.06 1.82 3.86 100 XMBody_17 3213 0.97 1.81 0.43 101 XMSlimDrugH 3201 0.85 1.80 0.23 102 XM_UB60 3198 0.75 1.80 0.06 103 URIBL_BLACK 3123 0.72 1.75 0.05 104 ALL_TRUSTED 3061 15.97 1.72 25.31 105 T_XMDrugObfuBody_08 2993 1.33 1.68 1.10 106 XMSubMetaSxObfu_03 2993 0.82 1.68 0.26 107 XM_UB99 2930 0.67 1.65 0.02 108 DRUGS_ERECTILE 2919 0.68 1.64 0.06 109 XMUrgent 2886 0.74 1.62 0.16 110 RCVD_IN_BL_SPAMCOP_NET 2782 0.74 1.56 0.21 111 XMGappySubj_01 2633 0.71 1.48 0.21 112 ONLINE_PHARMACY 2623 0.59 1.47 0.01 113 TM2_M_VERY_LONG_WORD 2599 1.07 1.46 0.81 114 TVD_VISIT_PHARMA 2562 0.57 1.44 0.01 115 RCVD_IN_IADB_LISTED 2488 3.33 1.40 4.59 116 XMSlimDrugs 2424 0.55 1.36 0.02 117 XMWghtMeta_00 2399 0.54 1.35 0.01 118 XMSubMetaI_00 2384 0.79 1.34 0.42 119 XMSubject_48 2376 0.55 1.33 0.03 120 XMGenDplmaNmb 2368 1.03 1.33 0.84 121 T_XMHurry_00 2320 0.84 1.30 0.54 122 TR_Mismatch_TLD_02 2306 0.55 1.30 0.06 123 XMPhish11 2277 1.11 1.28 0.99 124 UNPARSEABLE_RELAY 2265 3.95 1.27 5.70 125 XMGappySubj_02 2260 0.53 1.27 0.05 126 RCVD_IN_IADB_SPF 2205 2.88 1.24 3.95 127 XMSexyCombo_01 2201 0.86 1.24 0.62 128 SUBJ_DOLLARS 2186 0.73 1.23 0.40 129 BAYES_40 2164 2.33 1.22 3.06 130 T_FILL_THIS_FORM_SHORT 2124 0.84 1.19 0.61 131 XM_H_Long_From02 2119 2.89 1.19 4.00 132 RCVD_IN_IADB_SENDERID 2077 2.56 1.17 3.47 133 XM_UB80 2053 0.47 1.15 0.03 134 XM_RXBody 2048 0.52 1.15 0.11 135 RCVD_IN_IADB_DK 2037 2.48 1.14 3.35 136 DRUG_ED_CAPS 2030 0.45 1.14 0.00 137 BAYES_00 1983 4.10 1.11 6.05 138 DATE_IN_PAST_12_24 1957 0.68 1.10 0.40 139 MAILING_LIST_MULTI 1952 1.48 1.10 1.73 140 URI_TRY_3LD 1938 1.08 1.09 1.08 141 TooManyTo_002 1874 1.91 1.05 2.46 142 XMPhish30 1850 0.61 1.04 0.33 143 DATE_IN_PAST_06_12 1829 0.45 1.03 0.06 144 XM_B_REG_HTML 1793 0.76 1.01 0.59 145 TR_LOTS_OF_MONEY3 1781 0.53 1.00 0.22 146 RELAYCOUNTRY_FR 1771 0.53 1.00 0.22 147 TooManyTo_003 1755 1.63 0.99 2.06 148 PLING_QUERY 1745 0.58 0.98 0.32 149 XM_DK_Undo_01 1741 1.30 0.98 1.50 150 RELAYCOUNTRY_PL 1739 0.40 0.98 0.02 151 URIBL_DBL_SPAM 1716 0.40 0.96 0.04 152 RELAYCOUNTRY_AT 1709 0.44 0.96 0.10 153 XMBody_78 1668 0.66 0.94 0.47 154 XMClaimOffer 1657 0.57 0.93 0.33 155 MPART_ALT_DIFF_COUNT 1657 1.13 0.93 1.26 156 XMHTMLBadTable_001 1654 0.61 0.93 0.40 157 BAYES_20 1641 1.57 0.92 1.99 158 TR_XM_DK_Bayes 1635 2.86 0.92 4.12 159 XMPhish14 1635 0.51 0.92 0.24 160 FILL_THIS_FORM 1621 0.66 0.91 0.49 161 XM_UB999 1619 0.37 0.91 0.02 162 RELAYCOUNTRY_CN 1613 0.38 0.91 0.03 163 TR_XM_DK_Bayes1 1547 2.67 0.87 3.85 164 DEAR_FRIEND 1519 0.37 0.85 0.05 165 XM_H_PHPOS 1516 1.04 0.85 1.16 166 T_FILL_THIS_FORM_LONG 1493 0.59 0.84 0.42 167 XM_HighProb1 1481 0.34 0.83 0.01 168 T_XMDrugObfuBody_00 1464 0.78 0.82 0.75 169 XMStockSpam_06 1433 0.67 0.81 0.58 170 TM2_M_A_HREF_HREF 1425 0.74 0.80 0.70 171 FROM_MISSP_REPLYTO 1418 0.33 0.80 0.02 172 DKIM_ADSP_CUSTOM_MED 1418 0.71 0.80 0.65 173 TR_XM_DK_Bayes2 1415 2.40 0.80 3.45 174 XM_H_PHPMailer 1397 0.76 0.78 0.75 175 HTML_FONT_FACE_BAD 1386 0.68 0.78 0.61 176 XMHTML_After_End 1382 0.50 0.78 0.32 177 T_MONEY_PERCENT 1381 0.45 0.78 0.24 178 TR_LOTS_OF_MONEY2 1381 0.45 0.78 0.24 179 FROM_MISSP_EH_MATCH 1377 0.31 0.77 0.00 180 TO_NO_BRKTS_FROM_MSSP 1363 0.33 0.77 0.04 181 FORM_FRAUD_5 1351 0.30 0.76 0.00 182 XM_XX_Yahoo 1348 0.36 0.76 0.09 183 URI_NOVOWEL 1337 0.53 0.75 0.39 184 ADVANCE_FEE_5_NEW_MONEY 1304 0.29 0.73 0.00 185 XM_B_COPY_HTML 1296 0.63 0.73 0.57 186 TooManyTo_004 1264 0.68 0.71 0.67 187 DATE_IN_PAST_03_06 1251 0.34 0.70 0.11 188 MONEY_FORM_SHORT 1243 0.29 0.70 0.03 189 TR_MetaPhish_Combo_01 1238 0.58 0.70 0.50 190 NML_ADSP_CUSTOM_MED 1234 0.55 0.69 0.46 191 XM_UB95 1224 0.28 0.69 0.01 192 TR_Caps_n_Bayes_99 1216 0.32 0.68 0.08 193 RELAYCOUNTRY_DE 1178 0.46 0.66 0.33 194 XM_Body_Obfu01 1172 0.33 0.66 0.11 195 RCVD_IN_IADB_VOUCHED 1137 2.12 0.64 3.09 196 T_Symld_Words_02 1135 0.58 0.64 0.54 197 MONEY_BARRISTER 1114 0.29 0.63 0.07 198 FORGED_GMAIL_RCVD 1095 0.43 0.62 0.32 199 TooManyTo_005 1094 0.59 0.61 0.58 200 HTML_FONT_SIZE_HUGE 1093 0.32 0.61 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 237532 90.93 96.35 87.37 2 DKIM_SIGNED 179546 65.37 64.34 66.04 3 XM_DK_Pass 177905 64.56 63.21 65.44 4 DCC_CHECK_NEGATIVE 172487 53.41 38.08 63.45 5 DKIM_VALID 169456 61.28 59.68 62.33 6 BAYES_50 160873 47.21 28.93 59.17 7 DKIM_VALID_AU 130593 48.72 49.77 48.04 8 XMListUnsubscribeExists 125784 50.12 56.01 46.27 9 DCC_CHECK 96799 45.66 61.01 35.61 10 XM_H_QuotedFrom 83710 35.10 41.69 30.79 11 HTML_FONT_LOW_CONTRAST 77124 27.96 27.34 28.37 12 DKIM_VALID_EF 70986 21.82 15.26 26.11 13 ALL_TRUSTED 68798 15.97 1.72 25.31 14 LOC_TINY_FONT_1 64936 26.05 29.37 23.89 15 T_TM2_M_HEADER_IN_MSG 63319 20.32 15.77 23.29 16 FVGT_m_MULTI_ODD 56443 20.56 20.26 20.76 17 MIME_HTML_ONLY 49898 30.68 49.50 18.35 18 XMSubLong 44843 18.47 21.49 16.49 19 XM_DK_Undo_02 41716 24.04 37.33 15.34 20 BAYES_99 40563 24.95 40.26 14.92 21 ANY_BOUNCE_MESSAGE 39851 9.10 0.60 14.66 22 BOUNCE_MESSAGE 39850 9.10 0.60 14.66 23 BAYES_999 35662 19.74 29.86 13.12 24 MultiRelay 35612 13.59 14.34 13.10 25 XM_DKIMWhitelistDomains 34737 7.72 0.01 12.78 26 T_KAM_HTML_FONT_INVALID 32616 13.33 15.36 12.00 27 XM_Multi_Part_URI 28901 11.74 13.44 10.63 28 XM_Body_Dirty_Words 28539 12.57 15.74 10.50 29 LOTS_OF_MONEY 26944 9.32 8.42 9.91 30 RCVD_IN_RP_SAFE 26125 8.08 5.74 9.61 31 TooManyTo_001 24952 7.96 6.10 9.18 32 RCVD_IN_RP_CERTIFIED 23647 7.01 4.44 8.70 33 HTML_IMAGE_RATIO_02 21784 11.03 15.63 8.01 34 LotsOfNums_01 21291 6.83 5.30 7.83 35 HTML_IMAGE_ONLY_08 21227 13.67 22.62 7.81 36 HTML_SHORT_LINK_IMG_1 21080 13.63 22.61 7.75 37 SHORTENER_SHORT_IMG 21012 13.57 22.49 7.73 38 URI_BUFFLY 21011 13.54 22.42 7.73 39 FSL_BULK_SIG 19091 8.15 9.86 7.02 40 TR_DCC_Bayes_99 18964 14.86 26.90 6.98 41 BOTNET_IPINHOSTNAME 18303 8.27 10.61 6.73 42 RELAYCOUNTRY_META 18253 9.48 13.70 6.71 43 XM_Evil_Numbers_Gen 17875 8.23 10.77 6.57 44 BAYES_60 17484 7.46 9.04 6.43 45 BAYES_00 16442 4.10 1.11 6.05 46 T_XMDrugObfuBody_14 15907 6.19 6.71 5.85 47 UNPARSEABLE_RELAY 15498 3.95 1.27 5.70 48 HTML_IMAGE_RATIO_04 15488 6.33 7.30 5.70 49 TVD_RCVD_IP 14261 3.31 0.35 5.25 50 MIME_QP_LONG_LINE 12974 4.12 3.12 4.77 51 RCVD_IN_IADB_LISTED 12472 3.33 1.40 4.59 52 FROM_EXCESS_BASE64 12449 5.03 5.72 4.58 53 XM_H_Long_From01 12344 5.28 6.40 4.54 54 XM_B_Phish_Phrases 12337 6.19 8.72 4.54 55 XMSubMetaSx_00 12216 6.20 8.81 4.49 56 T_TooManySym_01 11841 3.62 2.49 4.36 57 XM_SendGrid 11379 3.65 2.84 4.19 58 UNTRUSTED_Relay 11258 6.31 9.61 4.14 59 TR_XM_DK_Bayes 11213 2.86 0.92 4.12 60 BAYES_80 10923 6.66 10.68 4.02 61 XM_H_Long_From02 10878 2.89 1.19 4.00 62 RCVD_IN_MSPIKE_H2 10800 3.76 3.43 3.97 63 RCVD_IN_IADB_SPF 10741 2.88 1.24 3.95 64 T_REMOTE_IMAGE 10497 3.06 1.82 3.86 65 TR_XM_DK_Bayes1 10456 2.67 0.87 3.85 66 MPART_ALT_DIFF 10351 4.68 6.02 3.81 67 XM_UB50 10339 3.69 3.51 3.80 68 HTML_IMAGE_RATIO_06 10114 3.82 3.97 3.72 69 DKIM_INVALID 10090 4.09 4.66 3.71 70 XM_UncommonTLD01 10040 8.34 15.44 3.69 71 XMStrtUSub 10034 3.70 3.72 3.69 72 IN_ZIMBRA_NJ_WHITELIST 10006 2.23 0.02 3.68 73 RCVD_IN_IADB_SENDERID 9429 2.56 1.17 3.47 74 TR_XM_DK_Bayes2 9367 2.40 0.80 3.45 75 RCVD_IN_IADB_DK 9105 2.48 1.14 3.35 76 RELAYCOUNTRY_PH 8617 1.92 0.01 3.17 77 XMNumbers 8418 3.98 5.34 3.10 78 RCVD_IN_IADB_VOUCHED 8404 2.12 0.64 3.09 79 BAYES_40 8316 2.33 1.22 3.06 80 MIME_HTML_MOSTLY 8069 3.28 3.76 2.97 81 BAYES_95 8012 4.69 7.35 2.95 82 XMSexyCombo_05 7758 6.38 11.78 2.85 83 TR_XM_DocInvoice 7453 4.17 6.36 2.74 84 TM2_M_URI_OPT_OUT 7027 2.56 2.51 2.58 85 INVALID_MSGID 6900 1.62 0.23 2.54 86 XMNoVowels 6885 3.29 4.45 2.53 87 TooManyTo_002 6701 1.91 1.05 2.46 88 TO_MALFORMED 6441 1.43 0.01 2.37 89 RCVD_IN_MSPIKE_WL 5618 1.49 0.61 2.07 90 RCVD_IN_MSPIKE_H3 5609 1.48 0.58 2.06 91 TooManyTo_003 5593 1.63 0.99 2.06 92 RCVD_IN_IADB_OPTIN 5540 1.39 0.41 2.04 93 BAYES_20 5417 1.57 0.92 1.99 94 URI_HEX 5033 2.20 2.73 1.85 95 IN_HORDE_ADDRESS_BOOK 4860 1.10 0.05 1.79 96 XM_DIRTYINTL 4835 2.28 3.04 1.78 97 USER_IN_DEF_DKIM_WL 4826 1.09 0.04 1.78 98 MAILING_LIST_MULTI 4715 1.48 1.10 1.73 99 T_TooManySym_02 4663 1.21 0.45 1.72 100 XM_SPF_SoftFail 4633 3.43 6.06 1.70 101 HTML_IMAGE_RATIO_08 4626 1.86 2.10 1.70 102 XM_ProductURIs 4554 1.78 1.93 1.68 103 XM_PDF 4294 1.04 0.23 1.58 104 MIME_HTML_ONLY_MULTI 4293 2.11 2.92 1.58 105 XM_CamelCaseFrm001 4134 2.18 3.18 1.52 106 XM_DK_Undo_01 4090 1.30 0.98 1.50 107 TR_Symld_Words 4073 2.15 3.15 1.50 108 SUBJ_ALL_CAPS 4060 1.82 2.33 1.49 109 XMDiploma_00 3891 1.73 2.19 1.43 110 BAYES_05 3744 1.01 0.46 1.38 111 XM_OfRef6 3666 1.69 2.20 1.35 112 RELAYCOUNTRY_CA 3560 1.71 2.31 1.31 113 NO_DNS_FOR_FROM 3534 1.68 2.27 1.30 114 MPART_ALT_DIFF_COUNT 3436 1.13 0.93 1.26 115 HTML_MIME_NO_HTML_TAG 3419 10.34 24.21 1.26 116 XMBdyGiftCard01 3229 1.50 1.99 1.19 117 XM_H_PHPOS 3145 1.04 0.85 1.16 118 XMLngstWrd_00 3090 0.80 0.29 1.14 119 T_XMDrugObfuBody_08 2979 1.33 1.68 1.10 120 URI_TRY_3LD 2933 1.08 1.09 1.08 121 USER_IN_WHITELIST 2888 0.64 0.00 1.06 122 XM_GoogleGroups 2850 0.76 0.32 1.05 123 BOTNET 2848 5.39 12.03 1.05 124 XMPhish11 2701 1.11 1.28 0.99 125 XMLngstWrd_01 2623 0.68 0.25 0.96 126 DIET_1 2509 2.08 3.85 0.92 127 XMSubMetaSxObfu_02 2417 0.65 0.28 0.89 128 XM_D_tchamptons_WL 2380 0.53 0.00 0.88 129 XMGenDplmaNmb 2285 1.03 1.33 0.84 130 TM2_M_VERY_LONG_WORD 2210 1.07 1.46 0.81 131 HELO_NODOT 2086 0.51 0.12 0.77 132 XMBody_95 2072 0.50 0.09 0.76 133 T_XMDrugObfuBody_00 2052 0.78 0.82 0.75 134 XM_H_PHPMailer 2042 0.76 0.78 0.75 135 T_TooManySym_03 1964 0.48 0.12 0.72 136 TM2_M_A_HREF_HREF 1899 0.74 0.80 0.70 137 RDNS_DYNAMIC 1825 0.65 0.61 0.67 138 TooManyTo_004 1814 0.68 0.71 0.67 139 DKIM_ADSP_CUSTOM_MED 1768 0.71 0.80 0.65 140 XMSexyCombo_01 1677 0.86 1.24 0.62 141 T_FILL_THIS_FORM_SHORT 1669 0.84 1.19 0.61 142 XMLngstWrd_02 1655 0.45 0.21 0.61 143 HTML_FONT_FACE_BAD 1652 0.68 0.78 0.61 144 URIBL_SBL_A 1642 0.50 0.34 0.60 145 XM_B_REG_HTML 1608 0.76 1.01 0.59 146 MISSING_HEADERS 1591 9.41 22.88 0.59 147 XMStockSpam_06 1579 0.67 0.81 0.58 148 TooManyTo_005 1564 0.59 0.61 0.58 149 XM_B_COPY_HTML 1550 0.63 0.73 0.57 150 XMSubNoVowel 1481 0.40 0.17 0.54 151 T_XMHurry_00 1460 0.84 1.30 0.54 152 T_Symld_Words_02 1459 0.58 0.64 0.54 153 XMBrknScrpt_02 1384 0.52 0.53 0.51 154 TR_MetaPhish_Combo_01 1360 0.58 0.70 0.50 155 FILL_THIS_FORM 1341 0.66 0.91 0.49 156 HTML_TAG_BALANCE_BODY 1298 0.48 0.49 0.48 157 XMBody_78 1283 0.66 0.94 0.47 158 NML_ADSP_CUSTOM_MED 1248 0.55 0.69 0.46 159 XM_H_PHPOS_M 1236 0.49 0.55 0.45 160 RELAYCOUNTRY_GB 1232 0.47 0.49 0.45 161 XMBody_17 1171 0.97 1.81 0.43 162 XMLngstWrd_03 1167 0.32 0.15 0.43 163 XMCapTrack 1167 0.33 0.17 0.43 164 T_FILL_THIS_FORM_LONG 1152 0.59 0.84 0.42 165 XMSubMetaI_00 1149 0.79 1.34 0.42 166 SUBJ_DOLLARS 1096 0.73 1.23 0.40 167 XMHTMLBadTable_001 1095 0.61 0.93 0.40 168 DATE_IN_PAST_12_24 1087 0.68 1.10 0.40 169 URI_NOVOWEL 1053 0.53 0.75 0.39 170 XMSubMetaSx_01 1049 0.44 0.52 0.39 171 DKIM_ADSP_NXDOMAIN 1035 0.42 0.48 0.38 172 FILL_THIS_FORM_LOAN 1031 0.45 0.55 0.38 173 T_TooManySym_04 1000 0.23 0.01 0.37 174 SpammyFromTLD_01 990 1.12 2.29 0.36 175 REPLYTO_WITHOUT_TO_CC 986 0.32 0.27 0.36 176 KHOP_DYNAMIC 963 0.40 0.47 0.35 177 PP_MIME_FAKE_ASCII_TEXT 909 0.38 0.45 0.33 178 XMPhish30 901 0.61 1.04 0.33 179 RELAYCOUNTRY_DE 898 0.46 0.66 0.33 180 XM_ShortIntro_01 895 0.34 0.35 0.33 181 XMClaimOffer 887 0.57 0.93 0.33 182 PLING_QUERY 883 0.58 0.98 0.32 183 XMSubMetaSSx_00 874 0.43 0.61 0.32 184 HTML_IMAGE_ONLY_20 870 0.41 0.54 0.32 185 XMHTML_After_End 864 0.50 0.78 0.32 186 FORGED_GMAIL_RCVD 861 0.43 0.62 0.32 187 XM_Doc_Oz_Body 816 0.24 0.15 0.30 188 XMBody_29 801 0.27 0.24 0.29 189 RELAYCOUNTRY_AU 781 0.27 0.25 0.29 190 HTML_IMAGE_ONLY_28 780 0.38 0.53 0.29 191 T_OBFU_PDF_ATTACH 766 0.19 0.06 0.28 192 THIS_AD 763 0.35 0.46 0.28 193 UPPERCASE_50_75 758 0.19 0.06 0.28 194 TM2_M_BODY_EMPTY 718 0.29 0.33 0.26 195 XMLngstWrd_04 717 0.18 0.06 0.26 196 XMSubMetaSxObfu_03 711 0.82 1.68 0.26 197 REMOVE_BEFORE_LINK 700 0.39 0.59 0.26 198 XMDateMe_00 688 0.23 0.19 0.25 199 XMRcvdHeader_15 687 0.15 0.00 0.25 200 TR_XM_RelayPhish 685 1.14 2.49 0.25 ----------------------------------------------------------------------