Email: 491892 Autolearn: 0 AvgScore: 7.43 AvgScanTime: 3.54 sec Spam: 212087 Autolearn: 0 AvgScore: 16.74 AvgScanTime: 4.19 sec Ham: 279805 Autolearn: 0 AvgScore: 0.37 AvgScanTime: 3.04 sec Time Spent Running SA: 483.61 hours Time Spent Processing Spam: 247.07 hours Time Spent Processing Ham: 236.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 206629 91.95 97.43 87.80 2 DCC_CHECK 129777 48.07 61.19 38.13 3 DKIM_SIGNED 125366 63.34 59.11 66.54 4 XM_DK_Pass 122128 62.18 57.58 65.67 5 DKIM_VALID 116695 59.26 55.02 62.47 6 MIME_HTML_ONLY 111760 32.41 52.70 17.04 7 XMListUnsubscribeExists 110525 49.12 52.11 46.85 8 DKIM_VALID_AU 95766 47.83 45.15 49.87 9 BOTNET 86439 18.15 40.76 1.02 10 RELAYCOUNTRY_META 83374 19.20 39.31 3.96 11 DCC_CHECK_NEGATIVE 80693 51.05 38.05 60.91 12 BOTNET_IPINHOSTNAME 79794 20.11 37.62 6.84 13 XM_H_QuotedFrom 77772 34.57 36.67 32.99 14 FROM_EXCESS_BASE64 77271 18.11 36.43 4.21 15 XM_DK_Undo_02 75884 24.91 35.78 16.67 16 UNTRUSTED_Relay 75531 16.11 35.61 1.33 17 T_REMOTE_IMAGE 74010 16.75 34.90 2.99 18 HTML_MIME_NO_HTML_TAG 73052 15.66 34.44 1.42 19 HTML_SHORT_LINK_IMG_1 71411 21.83 33.67 12.85 20 BODY_URI_ONLY 70602 14.38 33.29 0.05 21 MIME_HEADER_CTYPE_ONLY 70495 14.42 33.24 0.16 22 MISSING_HEADERS 70262 14.47 33.13 0.33 23 BAYES_99 70239 23.54 33.12 16.28 24 RELAYCOUNTRY_TH 62598 12.73 29.52 0.01 25 LOC_TINY_FONT_1 59896 27.36 28.24 26.69 26 SHORTENED_URL_SRC 59847 18.26 28.22 10.70 27 SHORTENER_SHORT_IMG 59825 18.25 28.21 10.70 28 URI_BUFFLY 59825 18.25 28.21 10.70 29 BAYES_999 59011 20.07 27.82 14.20 30 TR_DCC_Bayes_99 55501 16.07 26.17 8.41 31 HTML_FONT_LOW_CONTRAST 54414 28.14 25.66 30.03 32 BAYES_50 54202 44.13 25.56 58.21 33 HTML_IMAGE_ONLY_08 45500 13.78 21.45 7.96 34 XMSubLong 41487 18.06 19.56 16.92 35 FVGT_m_MULTI_ODD 37135 18.82 17.51 19.82 36 T_TM2_M_HEADER_IN_MSG 33063 17.49 15.59 18.92 37 HTML_IMAGE_RATIO_02 32231 11.09 15.20 7.97 38 BAYES_60 32082 10.24 15.13 6.53 39 DKIM_VALID_EF 29455 20.93 13.89 26.28 40 T_KAM_HTML_FONT_INVALID 28651 12.35 13.51 11.48 41 FSL_BULK_SIG 28497 10.03 13.44 7.45 42 XM_Body_Dirty_Words 27290 11.36 12.87 10.21 43 BAYES_80 27024 7.94 12.74 4.30 44 HTML_IMAGE_ONLY_04 26629 8.26 12.56 5.01 45 XMNumbers 24029 6.79 11.33 3.35 46 XMSexyCombo_05 23924 6.67 11.28 3.18 47 XM_Multi_Part_URI 23743 11.00 11.19 10.85 48 XM_UB60 23337 4.80 11.00 0.10 49 XM_UncommonTLD01 21841 6.44 10.30 3.52 50 MultiRelay 20106 10.58 9.48 11.42 51 BAYES_95 20041 5.91 9.45 3.23 52 XM_Evil_Numbers_Gen 19977 8.38 9.42 7.60 53 XMSubMetaSx_00 17968 6.36 8.47 4.75 54 XM_UB50 17321 4.05 8.17 0.94 55 SpammyFromTLD_02 16135 3.35 7.61 0.12 56 XM_UB80 15584 3.18 7.35 0.02 57 HTML_SHORT_CENTER 15277 4.75 7.20 2.89 58 XM_B_Phish_Phrases 14089 5.60 6.64 4.80 59 LOTS_OF_MONEY 13689 6.85 6.45 7.15 60 XM_UB95 13004 2.65 6.13 0.01 61 T_XMDrugObfuBody_14 12718 5.75 6.00 5.56 62 XM_H_Long_From01 12602 5.30 5.94 4.81 63 XMStrtUSub 12575 5.44 5.93 5.07 64 TR_XM_DocInvoice 12380 4.32 5.84 3.16 65 HTML_IMAGE_RATIO_04 11863 5.67 5.59 5.74 66 RCVD_IN_RP_SAFE 11263 8.50 5.31 10.92 67 LotsOfNums_01 11257 6.66 5.31 7.69 68 MPART_ALT_DIFF 11111 3.76 5.24 2.65 69 TooManyTo_001 11011 5.83 5.19 6.32 70 RCVD_IN_RP_RNBL 9401 1.93 4.43 0.04 71 DIET_1 9268 2.34 4.37 0.81 72 BOTNET_NORDNS 9176 1.87 4.33 0.01 73 DKIM_INVALID 8671 4.08 4.09 4.07 74 URIBL_DBL_ABUSE_REDIR 8449 2.60 3.98 1.56 75 RCVD_IN_RP_CERTIFIED 8365 7.25 3.94 9.75 76 MIME_HTML_MOSTLY 8327 3.30 3.93 2.82 77 XMSlimDrugH 7866 1.76 3.71 0.28 78 PLING_QUERY 7572 1.91 3.57 0.64 79 HTML_IMAGE_RATIO_06 6769 4.02 3.19 4.64 80 HTML_FONT_SIZE_LARGE 6753 2.15 3.18 1.36 81 T_TooManySym_01 5900 3.48 2.78 4.01 82 XM_SendGrid 5807 3.56 2.74 4.18 83 XMSubMetaI_00 5684 1.63 2.68 0.83 84 TM2_M_URI_OPT_OUT 5381 2.34 2.54 2.19 85 NO_DNS_FOR_FROM 5264 1.86 2.48 1.39 86 XMSubMetaSSx_00 4991 1.13 2.35 0.21 87 XM_OfRef6 4987 1.89 2.35 1.55 88 XM_DIRTYINTL 4925 1.72 2.32 1.27 89 URI_HEX 4835 1.83 2.28 1.49 90 MIME_QP_LONG_LINE 4651 3.27 2.19 4.09 91 XM_CamelCaseFrm001 4610 1.75 2.17 1.43 92 XMWghtMeta_00 4589 0.94 2.16 0.01 93 RELAYCOUNTRY_CA 4571 1.61 2.16 1.19 94 MIME_HTML_ONLY_MULTI 4544 1.49 2.14 0.99 95 XMBdyGiftCard01 4538 1.62 2.14 1.22 96 T_XMHurry_00 4370 1.35 2.06 0.81 97 RCVD_IN_MSPIKE_H2 4314 3.54 2.03 4.68 98 HTML_IMAGE_RATIO_08 4180 1.70 1.97 1.49 99 MultiRelay_CC 4088 0.90 1.93 0.12 100 MultiRelay_Combo 4088 0.90 1.93 0.12 101 XM_SPF_SoftFail 4016 1.38 1.89 0.99 102 XM_UB99 3969 0.83 1.87 0.04 103 ALL_TRUSTED 3429 17.23 1.62 29.07 104 FVGT_m_MULTI_ODD_EMAIL 3338 0.74 1.57 0.11 105 SUBJ_ALL_CAPS 3270 1.24 1.54 1.02 106 XMBody_17 3228 1.02 1.52 0.64 107 XMDiploma_00 3135 1.55 1.48 1.61 108 URIBL_DBL_SPAM 3087 0.65 1.46 0.04 109 LOW_PRICE 2978 0.72 1.40 0.20 110 RCVD_IN_BL_SPAMCOP_NET 2947 0.71 1.39 0.20 111 BAYES_40 2927 2.15 1.38 2.74 112 URIBL_BLACK 2911 0.62 1.37 0.05 113 XM_URI_RBL 2878 0.64 1.36 0.10 114 XMSubMetaI_01 2859 0.62 1.35 0.08 115 UNPARSEABLE_RELAY 2790 4.01 1.32 6.06 116 TM2_M_VERY_LONG_WORD 2724 1.03 1.28 0.84 117 T_XMDrugObfuBody_08 2708 1.13 1.28 1.01 118 RELAYCOUNTRY_CN 2587 0.55 1.22 0.04 119 TR_LOTS_OF_MONEY3 2495 0.82 1.18 0.55 120 URI_TRY_3LD 2373 1.42 1.12 1.64 121 BAYES_00 2354 3.59 1.11 5.48 122 XM_JunkDunk 2347 0.48 1.11 0.00 123 XMSubject_48 2313 0.50 1.09 0.05 124 XM_ProductURIs 2273 1.32 1.07 1.51 125 SUBJECT_DIET 2270 0.46 1.07 0.00 126 RCVD_IN_IADB_LISTED 2259 2.51 1.07 3.61 127 ANY_BOUNCE_MESSAGE 2191 11.48 1.03 19.40 128 BOUNCE_MESSAGE 2188 11.48 1.03 19.40 129 XM_H_Long_From02 2182 1.06 1.03 1.08 130 XMPhish30 2149 0.67 1.01 0.41 131 MAILING_LIST_MULTI 2092 1.43 0.99 1.77 132 XMSexyCombo_01 2025 1.10 0.95 1.21 133 RCVD_IN_IADB_SPF 2008 2.19 0.95 3.13 134 T_XMDrugObfuBody_00 1979 0.69 0.93 0.51 135 XM_UB999 1969 0.42 0.93 0.04 136 XMStockSpam_06 1922 1.22 0.91 1.45 137 TR_XM_DK_Bayes 1915 2.56 0.90 3.82 138 RCVD_IN_IADB_SENDERID 1905 1.99 0.90 2.83 139 RCVD_IN_IADB_DK 1903 1.96 0.90 2.76 140 TR_XM_DK_Bayes1 1812 2.36 0.85 3.50 141 XMHTMLBadTable_001 1799 0.70 0.85 0.58 142 TVD_SPACE_RATIO_MINFP 1796 0.37 0.85 0.01 143 XM_B_REG_HTML 1795 0.70 0.85 0.59 144 RELAYCOUNTRY_AT 1790 0.42 0.84 0.10 145 BAYES_20 1774 1.41 0.84 1.84 146 XMHTML_After_End 1772 0.52 0.84 0.28 147 FROM_LOCAL_NOVOWEL 1766 0.41 0.83 0.08 148 LongTLD 1765 0.46 0.83 0.17 149 TR_XM_DK_Bayes2 1748 2.14 0.82 3.14 150 XM_RXBody 1743 0.42 0.82 0.12 151 FILL_THIS_FORM 1724 0.67 0.81 0.56 152 TR_XM_RelayPhish 1723 0.49 0.81 0.25 153 RELAYCOUNTRY_FR 1688 0.45 0.80 0.19 154 T_FILL_THIS_FORM_LONG 1670 0.62 0.79 0.49 155 SUBJ_DOLLARS 1660 0.43 0.78 0.16 156 XM_HighProb1 1642 0.34 0.77 0.01 157 DKIM_ADSP_CUSTOM_MED 1561 0.80 0.74 0.85 158 FILL_THIS_FORM_LOAN 1549 0.58 0.73 0.47 159 BODY_ENHANCEMENT 1538 0.34 0.73 0.04 160 XMPhish11 1503 0.93 0.71 1.10 161 DKIM_ADSP_NXDOMAIN 1487 0.54 0.70 0.42 162 TR_Caps_n_Bayes_99 1473 0.34 0.69 0.06 163 XM_DK_Undo_01 1446 1.11 0.68 1.44 164 FORGED_GMAIL_RCVD 1429 0.52 0.67 0.40 165 TooManyTo_002 1419 1.59 0.67 2.29 166 FROM_STARTS_WITH_NUMS 1418 0.32 0.67 0.05 167 SpammyFromTLD_01 1408 0.47 0.66 0.32 168 NML_ADSP_CUSTOM_MED 1397 0.61 0.66 0.57 169 T_TooManySym_02 1364 1.40 0.64 1.97 170 TRACKER_ID 1346 0.37 0.63 0.16 171 TooManyTo_003 1326 1.33 0.63 1.87 172 XM_Body_Obfu01 1299 0.35 0.61 0.16 173 XMBody_78 1293 0.47 0.61 0.36 174 XMGenDplmaNmb 1273 0.70 0.60 0.78 175 XM_H_PHPOS 1254 0.88 0.59 1.10 176 XMNoVowels 1237 0.83 0.58 1.02 177 BAYES_05 1227 0.97 0.58 1.26 178 HTML_FONT_FACE_BAD 1219 0.54 0.57 0.51 179 TR_Symld_Words 1215 0.87 0.57 1.09 180 RCVD_IN_MSPIKE_WL 1208 1.48 0.57 2.18 181 XM_B_COPY_HTML 1200 0.54 0.57 0.51 182 RCVD_IN_MSPIKE_H3 1199 1.48 0.57 2.17 183 T_Symld_Words_02 1172 0.35 0.55 0.21 184 TR_Mismatch_TLD_02 1117 0.25 0.53 0.04 185 XM_BadFromFormat 1102 0.34 0.52 0.20 186 T_HTML_TAG_BALANCE_CENTER 1096 0.30 0.52 0.14 187 XMUrgent 1072 0.26 0.51 0.07 188 URI_NOVOWEL 1067 0.39 0.50 0.30 189 XMSubNoVowel 1058 0.35 0.50 0.24 190 XMBrknScrpt_02 1054 0.49 0.50 0.48 191 HTML_FONT_SIZE_HUGE 1022 0.28 0.48 0.13 192 MPART_ALT_DIFF_COUNT 998 0.36 0.47 0.27 193 XM_H_PHPMailer 984 0.55 0.46 0.61 194 RELAYCOUNTRY_DE 978 0.45 0.46 0.44 195 RDNS_DYNAMIC 972 0.50 0.46 0.53 196 TR_LOTS_OF_MONEY2 962 0.29 0.45 0.16 197 T_MONEY_PERCENT 962 0.29 0.45 0.16 198 LONG_JUNK_URI3 959 0.22 0.45 0.04 199 RELAYCOUNTRY_GB 926 0.48 0.44 0.50 200 XMClaimOffer 924 0.35 0.44 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 245678 91.95 97.43 87.80 2 DKIM_SIGNED 186195 63.34 59.11 66.54 3 XM_DK_Pass 183750 62.18 57.58 65.67 4 DKIM_VALID 174807 59.26 55.02 62.47 5 DCC_CHECK_NEGATIVE 170428 51.05 38.05 60.91 6 BAYES_50 162883 44.13 25.56 58.21 7 DKIM_VALID_AU 139528 47.83 45.15 49.87 8 XMListUnsubscribeExists 131089 49.12 52.11 46.85 9 DCC_CHECK 106685 48.07 61.19 38.13 10 XM_H_QuotedFrom 92296 34.57 36.67 32.99 11 HTML_FONT_LOW_CONTRAST 84015 28.14 25.66 30.03 12 ALL_TRUSTED 81327 17.23 1.62 29.07 13 LOC_TINY_FONT_1 74672 27.36 28.24 26.69 14 DKIM_VALID_EF 73522 20.93 13.89 26.28 15 FVGT_m_MULTI_ODD 55458 18.82 17.51 19.82 16 ANY_BOUNCE_MESSAGE 54286 11.48 1.03 19.40 17 BOUNCE_MESSAGE 54285 11.48 1.03 19.40 18 T_TM2_M_HEADER_IN_MSG 52951 17.49 15.59 18.92 19 MIME_HTML_ONLY 47684 32.41 52.70 17.04 20 XMSubLong 47341 18.06 19.56 16.92 21 XM_DK_Undo_02 46630 24.91 35.78 16.67 22 BAYES_99 45555 23.54 33.12 16.28 23 XM_DKIMWhitelistDomains 39995 8.14 0.02 14.29 24 BAYES_999 39736 20.07 27.82 14.20 25 HTML_SHORT_LINK_IMG_1 35952 21.83 33.67 12.85 26 T_KAM_HTML_FONT_INVALID 32115 12.35 13.51 11.48 27 MultiRelay 31954 10.58 9.48 11.42 28 RCVD_IN_RP_SAFE 30541 8.50 5.31 10.92 29 XM_Multi_Part_URI 30370 11.00 11.19 10.85 30 SHORTENED_URL_SRC 29950 18.26 28.22 10.70 31 URI_BUFFLY 29937 18.25 28.21 10.70 32 SHORTENER_SHORT_IMG 29937 18.25 28.21 10.70 33 XM_Body_Dirty_Words 28580 11.36 12.87 10.21 34 RCVD_IN_RP_CERTIFIED 27279 7.25 3.94 9.75 35 TR_DCC_Bayes_99 23530 16.07 26.17 8.41 36 HTML_IMAGE_RATIO_02 22308 11.09 15.20 7.97 37 HTML_IMAGE_ONLY_08 22269 13.78 21.45 7.96 38 LotsOfNums_01 21522 6.66 5.31 7.69 39 XM_Evil_Numbers_Gen 21264 8.38 9.42 7.60 40 FSL_BULK_SIG 20833 10.03 13.44 7.45 41 LOTS_OF_MONEY 20004 6.85 6.45 7.15 42 BOTNET_IPINHOSTNAME 19146 20.11 37.62 6.84 43 BAYES_60 18271 10.24 15.13 6.53 44 TooManyTo_001 17681 5.83 5.19 6.32 45 UNPARSEABLE_RELAY 16947 4.01 1.32 6.06 46 HTML_IMAGE_RATIO_04 16049 5.67 5.59 5.74 47 T_XMDrugObfuBody_14 15549 5.75 6.00 5.56 48 TVD_RCVD_IP 15493 3.25 0.23 5.54 49 BAYES_00 15323 3.59 1.11 5.48 50 XMStrtUSub 14189 5.44 5.93 5.07 51 HTML_IMAGE_ONLY_04 14016 8.26 12.56 5.01 52 XM_H_Long_From01 13460 5.30 5.94 4.81 53 XM_B_Phish_Phrases 13434 5.60 6.64 4.80 54 XMSubMetaSx_00 13296 6.36 8.47 4.75 55 RCVD_IN_MSPIKE_H2 13096 3.54 2.03 4.68 56 HTML_IMAGE_RATIO_06 12994 4.02 3.19 4.64 57 BAYES_80 12040 7.94 12.74 4.30 58 FROM_EXCESS_BASE64 11793 18.11 36.43 4.21 59 XM_SendGrid 11702 3.56 2.74 4.18 60 MIME_QP_LONG_LINE 11455 3.27 2.19 4.09 61 DKIM_INVALID 11388 4.08 4.09 4.07 62 T_TooManySym_01 11223 3.48 2.78 4.01 63 RELAYCOUNTRY_META 11075 19.20 39.31 3.96 64 TR_XM_DK_Bayes 10680 2.56 0.90 3.82 65 IN_ZIMBRA_NJ_WHITELIST 10323 2.11 0.02 3.69 66 RCVD_IN_IADB_LISTED 10110 2.51 1.07 3.61 67 XM_UncommonTLD01 9841 6.44 10.30 3.52 68 TR_XM_DK_Bayes1 9795 2.36 0.85 3.50 69 XMNumbers 9368 6.79 11.33 3.35 70 BAYES_95 9025 5.91 9.45 3.23 71 XMSexyCombo_05 8901 6.67 11.28 3.18 72 TR_XM_DocInvoice 8852 4.32 5.84 3.16 73 TR_XM_DK_Bayes2 8786 2.14 0.82 3.14 74 RCVD_IN_IADB_SPF 8744 2.19 0.95 3.13 75 T_REMOTE_IMAGE 8363 16.75 34.90 2.99 76 HTML_SHORT_CENTER 8091 4.75 7.20 2.89 77 RCVD_IN_IADB_SENDERID 7905 1.99 0.90 2.83 78 MIME_HTML_MOSTLY 7895 3.30 3.93 2.82 79 RCVD_IN_IADB_DK 7714 1.96 0.90 2.76 80 BAYES_40 7666 2.15 1.38 2.74 81 MPART_ALT_DIFF 7407 3.76 5.24 2.65 82 INVALID_MSGID 6809 1.48 0.22 2.43 83 RCVD_IN_IADB_VOUCHED 6453 1.50 0.44 2.31 84 TooManyTo_002 6420 1.59 0.67 2.29 85 TO_MALFORMED 6360 1.30 0.02 2.27 86 TM2_M_URI_OPT_OUT 6120 2.34 2.54 2.19 87 RCVD_IN_MSPIKE_WL 6088 1.48 0.57 2.18 88 RCVD_IN_MSPIKE_H3 6084 1.48 0.57 2.17 89 T_TooManySym_02 5509 1.40 0.64 1.97 90 USER_IN_DEF_DKIM_WL 5363 1.09 0.01 1.92 91 TooManyTo_003 5227 1.33 0.63 1.87 92 BAYES_20 5147 1.41 0.84 1.84 93 IN_HORDE_ADDRESS_BOOK 4964 1.02 0.04 1.77 94 MAILING_LIST_MULTI 4945 1.43 0.99 1.77 95 XM_PDF 4798 1.05 0.18 1.71 96 URI_TRY_3LD 4588 1.42 1.12 1.64 97 XMDiploma_00 4508 1.55 1.48 1.61 98 URIBL_DBL_ABUSE_REDIR 4354 2.60 3.98 1.56 99 XM_OfRef6 4331 1.89 2.35 1.55 100 XM_ProductURIs 4214 1.32 1.07 1.51 101 URI_HEX 4167 1.83 2.28 1.49 102 HTML_IMAGE_RATIO_08 4163 1.70 1.97 1.49 103 XMStockSpam_06 4061 1.22 0.91 1.45 104 XM_DK_Undo_01 4029 1.11 0.68 1.44 105 XM_CamelCaseFrm001 4011 1.75 2.17 1.43 106 HTML_MIME_NO_HTML_TAG 3969 15.66 34.44 1.42 107 NO_DNS_FOR_FROM 3903 1.86 2.48 1.39 108 HTML_FONT_SIZE_LARGE 3815 2.15 3.18 1.36 109 RCVD_IN_IADB_OPTIN 3753 0.87 0.26 1.34 110 UNTRUSTED_Relay 3725 16.11 35.61 1.33 111 XM_DIRTYINTL 3554 1.72 2.32 1.27 112 BAYES_05 3527 0.97 0.58 1.26 113 XMBdyGiftCard01 3419 1.62 2.14 1.22 114 XMSexyCombo_01 3377 1.10 0.95 1.21 115 RELAYCOUNTRY_CA 3338 1.61 2.16 1.19 116 XM_GoogleGroups 3292 0.79 0.28 1.18 117 XMPhish11 3089 0.93 0.71 1.10 118 XM_H_PHPOS 3083 0.88 0.59 1.10 119 TR_Symld_Words 3062 0.87 0.57 1.09 120 XM_H_Long_From02 3024 1.06 1.03 1.08 121 XMSubMetaSxObfu_03 3001 0.72 0.25 1.07 122 BOTNET 2856 18.15 40.76 1.02 123 XMNoVowels 2851 0.83 0.58 1.02 124 SUBJ_ALL_CAPS 2845 1.24 1.54 1.02 125 T_XMDrugObfuBody_08 2829 1.13 1.28 1.01 126 XM_SPF_SoftFail 2765 1.38 1.89 0.99 127 MIME_HTML_ONLY_MULTI 2761 1.49 2.14 0.99 128 USER_IN_WHITELIST 2750 0.56 0.00 0.98 129 XMLngstWrd_00 2670 0.61 0.16 0.95 130 T_TooManySym_03 2622 0.67 0.31 0.94 131 XM_UB50 2621 4.05 8.17 0.94 132 XMSubMetaSxObfu_02 2410 0.57 0.18 0.86 133 XMSexyCombo_04 2384 0.66 0.41 0.85 134 DKIM_ADSP_CUSTOM_MED 2375 0.80 0.74 0.85 135 TM2_M_VERY_LONG_WORD 2362 1.03 1.28 0.84 136 XMLngstWrd_01 2341 0.54 0.15 0.84 137 XMSubMetaI_00 2319 1.63 2.68 0.83 138 T_XMHurry_00 2264 1.35 2.06 0.81 139 DIET_1 2257 2.34 4.37 0.81 140 XMBody_95 2255 0.53 0.16 0.81 141 XMGenDplmaNmb 2171 0.70 0.60 0.78 142 TooManyTo_004 2102 0.60 0.40 0.75 143 TooManyTo_005 1878 0.53 0.35 0.67 144 PLING_QUERY 1799 1.91 3.57 0.64 145 XMBody_17 1792 1.02 1.52 0.64 146 XM_H_PHPMailer 1718 0.55 0.46 0.61 147 TR_MetaPhish_Combo_01 1704 0.48 0.31 0.61 148 XM_B_REG_HTML 1643 0.70 0.85 0.59 149 XMHTMLBadTable_001 1620 0.70 0.85 0.58 150 NML_ADSP_CUSTOM_MED 1599 0.61 0.66 0.57 151 FILL_THIS_FORM 1575 0.67 0.81 0.56 152 TR_LOTS_OF_MONEY3 1527 0.82 1.18 0.55 153 XMLngstWrd_02 1503 0.36 0.12 0.54 154 RDNS_DYNAMIC 1485 0.50 0.46 0.53 155 T_FILL_THIS_FORM_SHORT 1457 0.48 0.43 0.52 156 T_TooManySym_04 1437 0.38 0.20 0.51 157 HTML_FONT_FACE_BAD 1437 0.54 0.57 0.51 158 XM_B_COPY_HTML 1434 0.54 0.57 0.51 159 T_XMDrugObfuBody_00 1416 0.69 0.93 0.51 160 RELAYCOUNTRY_GB 1411 0.48 0.44 0.50 161 T_FILL_THIS_FORM_LONG 1362 0.62 0.79 0.49 162 XMBrknScrpt_02 1348 0.49 0.50 0.48 163 TM2_M_A_HREF_HREF 1323 0.39 0.28 0.47 164 HELO_NODOT 1323 0.31 0.10 0.47 165 FILL_THIS_FORM_LOAN 1313 0.58 0.73 0.47 166 XMCapTrack 1250 0.33 0.17 0.45 167 RELAYCOUNTRY_DE 1224 0.45 0.46 0.44 168 XM_H_PHPOS_M 1192 0.39 0.35 0.43 169 DKIM_ADSP_NXDOMAIN 1188 0.54 0.70 0.42 170 XMPhish30 1150 0.67 1.01 0.41 171 FORGED_GMAIL_RCVD 1108 0.52 0.67 0.40 172 XMLngstWrd_03 1043 0.25 0.10 0.37 173 HTTPS_HTTP_MISMATCH 1023 0.38 0.40 0.37 174 XMBody_78 1007 0.47 0.61 0.36 175 HTML_TAG_BALANCE_BODY 977 0.37 0.39 0.35 176 RELAYCOUNTRY_AU 953 0.34 0.33 0.34 177 PP_MIME_FAKE_ASCII_TEXT 937 0.37 0.41 0.33 178 MISSING_HEADERS 933 14.47 33.13 0.33 179 XM_ShortIntro_01 931 0.27 0.20 0.33 180 REMOVE_BEFORE_LINK 902 0.34 0.37 0.32 181 XMRcvdHeader_15 896 0.18 0.00 0.32 182 SpammyFromTLD_01 893 0.47 0.66 0.32 183 XM_H_SpoofStaff4 890 0.18 0.01 0.32 184 XM_D_tchamptons_WL 888 0.18 0.00 0.32 185 XM_Walgreens_Forge 858 0.24 0.15 0.31 186 URI_NOVOWEL 850 0.39 0.50 0.30 187 KHOP_DYNAMIC 843 0.29 0.27 0.30 188 XMSlimDrugH 788 1.76 3.71 0.28 189 XMClaimOffer 787 0.35 0.44 0.28 190 TM2_M_BODY_EMPTY 782 0.18 0.06 0.28 191 XMSUPPORT 781 0.16 0.00 0.28 192 XMHTML_After_End 770 0.52 0.84 0.28 193 RELAYCOUNTRY_PH 767 0.16 0.01 0.27 194 T_OBFU_PDF_ATTACH 765 0.18 0.05 0.27 195 HTML_IMAGE_ONLY_16 760 0.19 0.09 0.27 196 MPART_ALT_DIFF_COUNT 754 0.36 0.47 0.27 197 XMDateMe_00 752 0.21 0.12 0.27 198 XM_H_Undi_Recip 741 0.24 0.21 0.26 199 HTML_IMAGE_ONLY_28 723 0.20 0.12 0.26 200 HTML_IMAGE_ONLY_32 699 0.19 0.12 0.25 ----------------------------------------------------------------------