Email: 434778 Autolearn: 0 AvgScore: 5.53 AvgScanTime: 3.18 sec Spam: 169070 Autolearn: 0 AvgScore: 14.28 AvgScanTime: 3.74 sec Ham: 265708 Autolearn: 0 AvgScore: -0.04 AvgScanTime: 2.82 sec Time Spent Running SA: 384.11 hours Time Spent Processing Spam: 175.81 hours Time Spent Processing Ham: 208.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 163047 91.05 96.44 87.62 2 DCC_CHECK 111225 48.96 65.79 38.26 3 DKIM_SIGNED 110335 65.95 65.26 66.39 4 XM_DK_Pass 108311 64.89 64.06 65.42 5 DKIM_VALID 103337 62.00 61.12 62.56 6 XMListUnsubscribeExists 96868 50.18 57.29 45.65 7 DKIM_VALID_AU 85808 49.94 50.75 49.42 8 MIME_HTML_ONLY 79527 30.17 47.04 19.43 9 XM_H_QuotedFrom 71000 36.52 41.99 33.04 10 XM_DK_Undo_02 64540 25.27 38.17 17.06 11 BAYES_99 58087 23.38 34.36 16.39 12 DCC_CHECK_NEGATIVE 56522 50.12 33.43 60.75 13 FROM_EXCESS_BASE64 50557 14.14 29.90 4.11 14 LOC_TINY_FONT_1 50152 28.26 29.66 27.37 15 BAYES_999 49467 20.16 29.26 14.37 16 BAYES_50 47598 46.55 28.15 58.26 17 HTML_FONT_LOW_CONTRAST 47128 28.99 27.87 29.70 18 T_REMOTE_IMAGE 44904 12.81 26.56 4.06 19 TR_DCC_Bayes_99 44757 15.60 26.47 8.69 20 HTML_SHORT_LINK_IMG_1 42131 13.80 24.92 6.73 21 HTML_MIME_NO_HTML_TAG 41525 10.35 24.56 1.30 22 BODY_URI_ONLY 41474 9.59 24.53 0.09 23 SHORTENED_URL_SRC 40916 13.48 24.20 6.66 24 SHORTENER_SHORT_IMG 40912 13.48 24.20 6.65 25 URI_BUFFLY 40902 13.47 24.19 6.65 26 RCVD_IN_RP_RNBL 40860 9.43 24.17 0.05 27 XMSubLong 39478 21.03 23.35 19.56 28 MISSING_HEADERS 39445 9.30 23.33 0.38 29 MIME_HEADER_CTYPE_ONLY 38793 9.00 22.94 0.13 30 XM_UncommonTLD01 35603 10.42 21.06 3.65 31 FVGT_m_MULTI_ODD 33577 19.90 19.86 19.93 32 HTML_IMAGE_RATIO_02 29464 12.20 17.43 8.87 33 SpammyFromTLD_02 29369 6.85 17.37 0.16 34 T_TM2_M_HEADER_IN_MSG 28006 20.62 16.56 23.21 35 HTML_IMAGE_ONLY_08 27497 9.17 16.26 4.66 36 DKIM_VALID_EF 26296 22.64 15.55 27.15 37 XM_Body_Dirty_Words 26012 13.44 15.39 12.20 38 FSL_BULK_SIG 23215 11.00 13.73 9.26 39 BAYES_80 22656 7.56 13.40 3.84 40 T_KAM_HTML_FONT_INVALID 22639 12.36 13.39 11.70 41 XM_Multi_Part_URI 22160 11.41 13.11 10.33 42 RELAYCOUNTRY_META 21100 8.92 12.48 6.66 43 MultiRelay 19702 11.76 11.65 11.83 44 BAYES_60 19483 8.28 11.52 6.22 45 XM_Evil_Numbers_Gen 19198 9.40 11.36 8.16 46 BOTNET 18653 5.06 11.03 1.27 47 BOTNET_IPINHOSTNAME 17992 8.81 10.64 7.64 48 XMSexyCombo_05 17670 6.90 10.45 4.64 49 XMNumbers 15200 5.74 8.99 3.66 50 HTML_IMAGE_ONLY_04 14466 4.65 8.56 2.16 51 BAYES_95 13409 4.90 7.93 2.97 52 UNTRUSTED_Relay 12862 5.45 7.61 4.07 53 XM_B_Phish_Phrases 12706 5.67 7.52 4.49 54 XMSubMetaSx_00 12521 5.97 7.41 5.06 55 HTML_IMAGE_RATIO_04 12019 7.65 7.11 8.00 56 T_XMDrugObfuBody_14 11393 6.28 6.74 5.98 57 TR_XM_DocInvoice 11246 4.57 6.65 3.25 58 TooManyTo_001 11061 8.37 6.54 9.54 59 MPART_ALT_DIFF 10643 4.31 6.30 3.05 60 LOTS_OF_MONEY 10223 7.81 6.05 8.94 61 XM_H_Long_From01 10116 4.98 5.98 4.34 62 RCVD_IN_RP_SAFE 9754 8.75 5.77 10.65 63 LotsOfNums_01 9269 6.65 5.48 7.39 64 XMStrtUSub 8612 5.02 5.09 4.97 65 RCVD_IN_RP_CERTIFIED 7748 7.99 4.58 10.16 66 MIME_HTML_MOSTLY 7386 3.15 4.37 2.38 67 DKIM_INVALID 6998 3.95 4.14 3.83 68 XMSubMetaI_00 6756 2.33 4.00 1.27 69 HTML_IMAGE_RATIO_06 6610 3.57 3.91 3.36 70 DIET_1 6192 1.76 3.66 0.54 71 XM_UB50 6116 3.66 3.62 3.68 72 XM_DIRTYINTL 5460 2.18 3.23 1.51 73 TM2_M_URI_OPT_OUT 5219 2.60 3.09 2.30 74 XM_SendGrid 5170 3.73 3.06 4.16 75 PLING_QUERY 4934 1.27 2.92 0.22 76 ALL_TRUSTED 4838 16.75 2.86 25.59 77 RCVD_IN_MSPIKE_H2 4718 4.11 2.79 4.94 78 MIME_QP_LONG_LINE 4712 3.66 2.79 4.21 79 XM_SPF_SoftFail 4665 1.67 2.76 0.98 80 XM_CamelCaseFrm001 4561 1.99 2.70 1.54 81 RELAYCOUNTRY_CA 4538 1.78 2.68 1.20 82 HTML_IMAGE_RATIO_08 4096 1.95 2.42 1.65 83 MIME_HTML_ONLY_MULTI 4087 1.64 2.42 1.14 84 NO_DNS_FOR_FROM 4079 1.81 2.41 1.42 85 XMBdyGiftCard01 3946 2.36 2.33 2.38 86 T_TooManySym_01 3826 4.49 2.26 5.90 87 URI_HEX 3755 2.27 2.22 2.30 88 XM_OfRef6 3476 1.65 2.06 1.38 89 URIBL_DBL_SPAM 3427 0.84 2.03 0.08 90 XMSlimDrugH 3364 0.92 1.99 0.25 91 XMDiploma_00 3094 1.58 1.83 1.43 92 MultiRelay_CC 3025 0.80 1.79 0.17 93 MultiRelay_Combo 3025 0.80 1.79 0.17 94 UNPARSEABLE_RELAY 2918 4.71 1.73 6.61 95 MORE_SEX 2895 0.69 1.71 0.04 96 XMSexyCombo_01 2864 1.02 1.69 0.59 97 XMBody_17 2772 0.92 1.64 0.46 98 BOTNET_NORDNS 2745 0.64 1.62 0.01 99 BOUNCE_MESSAGE 2707 8.73 1.60 13.27 100 ANY_BOUNCE_MESSAGE 2707 8.73 1.60 13.27 101 XM_URI_RBL 2668 0.67 1.58 0.09 102 XM_H_Long_From02 2628 2.92 1.55 3.79 103 LOW_PRICE 2603 0.72 1.54 0.20 104 RELAYCOUNTRY_CN 2576 0.63 1.52 0.05 105 XM_Combo_Sbj 2533 0.65 1.50 0.10 106 HTML_FONT_SIZE_LARGE 2511 0.91 1.49 0.54 107 T_XMDrugObfuBody_08 2447 1.16 1.45 0.98 108 SUBJ_ALL_CAPS 2447 1.20 1.45 1.05 109 T_XMHurry_00 2435 0.83 1.44 0.44 110 RCVD_IN_BL_SPAMCOP_NET 2398 0.69 1.42 0.22 111 RCVD_IN_IADB_LISTED 2359 3.13 1.40 4.24 112 XM_ProductURIs 2217 1.38 1.31 1.43 113 XMSubMetaI_01 2216 0.59 1.31 0.13 114 BAYES_20 2214 1.84 1.31 2.17 115 BAYES_40 2184 2.42 1.29 3.14 116 SpammyFromTLD_01 2180 0.70 1.29 0.33 117 URIBL_BLACK 2139 0.51 1.27 0.03 118 FVGT_m_MULTI_ODD_EMAIL 2137 0.57 1.26 0.12 119 MAILING_LIST_MULTI 2045 1.50 1.21 1.69 120 RCVD_IN_IADB_SPF 2024 2.64 1.20 3.56 121 XM_UB99 1993 0.47 1.18 0.01 122 XMWarranty1 1987 0.46 1.18 0.00 123 XMStockSpam_06 1980 1.33 1.17 1.43 124 TM2_M_VERY_LONG_WORD 1977 0.96 1.17 0.83 125 XM_RXBody 1931 0.59 1.14 0.24 126 RCVD_IN_IADB_SENDERID 1899 2.32 1.12 3.08 127 RCVD_IN_IADB_DK 1865 2.25 1.10 2.98 128 XMPhish30 1832 0.57 1.08 0.25 129 XMHTMLBadTable_001 1818 0.84 1.08 0.70 130 BAYES_00 1788 3.87 1.06 5.66 131 LongTLD 1783 0.48 1.05 0.11 132 XMGenDplmaNmb 1781 0.81 1.05 0.66 133 T_XMDrugObfuBody_00 1779 0.93 1.05 0.86 134 RELAYCOUNTRY_AT 1761 0.46 1.04 0.08 135 HTML_TAG_BALANCE_BODY 1745 0.65 1.03 0.41 136 XM_UB60 1669 0.42 0.99 0.06 137 TR_Mismatch_TLD_02 1657 0.41 0.98 0.05 138 MPART_ALT_DIFF_COUNT 1653 0.62 0.98 0.39 139 XM_H_PHPOS 1640 1.00 0.97 1.02 140 TR_XM_RelayPhish 1618 0.54 0.96 0.27 141 RELAYCOUNTRY_FR 1614 0.50 0.95 0.22 142 T_HTML_TAG_BALANCE_CENTER 1609 0.54 0.95 0.27 143 XM_HighProb1 1563 0.37 0.92 0.02 144 XM_UB999 1547 0.36 0.92 0.01 145 BAYES_05 1532 1.12 0.91 1.26 146 URI_TRY_3LD 1514 1.02 0.90 1.10 147 TooManyTo_002 1513 1.89 0.89 2.52 148 TR_XM_DK_Bayes 1502 2.51 0.89 3.54 149 XM_DK_Undo_01 1500 1.27 0.89 1.52 150 XM_B_REG_HTML 1479 0.69 0.87 0.58 151 TR_XM_DK_Bayes1 1468 2.36 0.87 3.31 152 SUBJ_DOLLARS 1455 0.43 0.86 0.15 153 RELAYCOUNTRY_IN 1452 0.36 0.86 0.03 154 XMSexyCombo_04 1446 0.38 0.86 0.08 155 XMPhish11 1436 1.01 0.85 1.11 156 FILL_THIS_FORM 1433 0.70 0.85 0.60 157 TooManyTo_003 1433 1.65 0.85 2.16 158 RDNS_DYNAMIC 1405 0.60 0.83 0.45 159 T_MANY_HDRS_LCASE 1396 0.34 0.83 0.04 160 T_FILL_THIS_FORM_LONG 1377 0.64 0.81 0.53 161 XMSubMetaSSx_00 1377 0.52 0.81 0.33 162 TR_XM_DK_Bayes2 1358 2.06 0.80 2.86 163 XMHTML_After_End 1335 0.48 0.79 0.28 164 TVD_SPACE_RATIO_MINFP 1335 0.31 0.79 0.00 165 XMSubNoVowel 1313 0.61 0.78 0.50 166 FILL_THIS_FORM_LOAN 1310 0.62 0.77 0.52 167 FROM_LOCAL_NOVOWEL 1304 0.38 0.77 0.13 168 HTML_FONT_SIZE_HUGE 1293 0.49 0.76 0.31 169 XMGappySubj_01 1281 0.48 0.76 0.31 170 URI_NOVOWEL 1239 0.55 0.73 0.43 171 RELAYCOUNTRY_NL 1220 0.37 0.72 0.14 172 XM_Body_Obfu01 1189 0.37 0.70 0.15 173 PP_MIME_FAKE_ASCII_TEXT 1189 0.40 0.70 0.21 174 XM_B_COPY_HTML 1172 0.57 0.69 0.48 175 LONG_JUNK_URI 1152 0.28 0.68 0.02 176 MIME_CHARSET_FARAWAY 1102 0.30 0.65 0.08 177 RCVD_IN_IADB_VOUCHED 1092 2.09 0.65 3.01 178 T_FILL_THIS_FORM_SHORT 1091 0.52 0.65 0.44 179 XM_H_PHPMailer 1087 0.63 0.64 0.62 180 RCVD_IN_MSPIKE_WL 1077 1.83 0.64 2.59 181 XMBody_78 1072 0.51 0.63 0.42 182 RCVD_IN_MSPIKE_H3 1065 1.83 0.63 2.59 183 XM_BadFromFormat 1062 0.43 0.63 0.30 184 XM_UB80 1058 0.26 0.63 0.03 185 XM_XX_Yahoo 1041 0.28 0.62 0.06 186 RELAYCOUNTRY_DE 1026 0.40 0.61 0.26 187 TooManyTo_004 1023 0.72 0.61 0.79 188 RELAYCOUNTRY_GB 1020 0.52 0.60 0.47 189 XMSolicitRefs_0 1016 0.51 0.60 0.45 190 T_TooManySym_02 1000 1.43 0.59 1.96 191 XMBrknScrpt_02 995 0.59 0.59 0.59 192 LONG_JUNK_URI3 981 0.26 0.58 0.05 193 URIBL_SBL_A 977 0.91 0.58 1.13 194 XMNoVowels 976 0.47 0.58 0.40 195 XM_OverStock_LProb 973 0.24 0.58 0.02 196 TR_Caps_n_Bayes_99 953 0.24 0.56 0.03 197 BAD_CREDIT 933 0.23 0.55 0.03 198 CHARSET_FARAWAY_HEADER 918 0.24 0.54 0.05 199 XMGppyBdWords 908 0.25 0.54 0.07 200 TooManyTo_005 907 0.64 0.54 0.70 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 232815 91.05 96.44 87.62 2 DKIM_SIGNED 176411 65.95 65.26 66.39 3 XM_DK_Pass 173831 64.89 64.06 65.42 4 DKIM_VALID 166238 62.00 61.12 62.56 5 DCC_CHECK_NEGATIVE 161406 50.12 33.43 60.75 6 BAYES_50 154803 46.55 28.15 58.26 7 DKIM_VALID_AU 131319 49.94 50.75 49.42 8 XMListUnsubscribeExists 121296 50.18 57.29 45.65 9 DCC_CHECK 101664 48.96 65.79 38.26 10 XM_H_QuotedFrom 87789 36.52 41.99 33.04 11 HTML_FONT_LOW_CONTRAST 78921 28.99 27.87 29.70 12 LOC_TINY_FONT_1 72736 28.26 29.66 27.37 13 DKIM_VALID_EF 72153 22.64 15.55 27.15 14 ALL_TRUSTED 68000 16.75 2.86 25.59 15 T_TM2_M_HEADER_IN_MSG 61658 20.62 16.56 23.21 16 FVGT_m_MULTI_ODD 52960 19.90 19.86 19.93 17 XMSubLong 51975 21.03 23.35 19.56 18 MIME_HTML_ONLY 51639 30.17 47.04 19.43 19 XM_DK_Undo_02 45329 25.27 38.17 17.06 20 BAYES_99 43551 23.38 34.36 16.39 21 XM_DKIMWhitelistDomains 41895 9.66 0.07 15.77 22 BAYES_999 38189 20.16 29.26 14.37 23 ANY_BOUNCE_MESSAGE 35269 8.73 1.60 13.27 24 BOUNCE_MESSAGE 35268 8.73 1.60 13.27 25 XM_Body_Dirty_Words 32420 13.44 15.39 12.20 26 MultiRelay 31431 11.76 11.65 11.83 27 T_KAM_HTML_FONT_INVALID 31089 12.36 13.39 11.70 28 RCVD_IN_RP_SAFE 28305 8.75 5.77 10.65 29 XM_Multi_Part_URI 27455 11.41 13.11 10.33 30 RCVD_IN_RP_CERTIFIED 26986 7.99 4.58 10.16 31 TooManyTo_001 25340 8.37 6.54 9.54 32 FSL_BULK_SIG 24616 11.00 13.73 9.26 33 LOTS_OF_MONEY 23743 7.81 6.05 8.94 34 HTML_IMAGE_RATIO_02 23577 12.20 17.43 8.87 35 TR_DCC_Bayes_99 23086 15.60 26.47 8.69 36 XM_Evil_Numbers_Gen 21683 9.40 11.36 8.16 37 HTML_IMAGE_RATIO_04 21256 7.65 7.11 8.00 38 BOTNET_IPINHOSTNAME 20291 8.81 10.64 7.64 39 LotsOfNums_01 19628 6.65 5.48 7.39 40 HTML_SHORT_LINK_IMG_1 17876 13.80 24.92 6.73 41 RELAYCOUNTRY_META 17696 8.92 12.48 6.66 42 SHORTENED_URL_SRC 17692 13.48 24.20 6.66 43 URI_BUFFLY 17680 13.47 24.19 6.65 44 SHORTENER_SHORT_IMG 17680 13.48 24.20 6.65 45 UNPARSEABLE_RELAY 17558 4.71 1.73 6.61 46 BAYES_60 16530 8.28 11.52 6.22 47 TVD_RCVD_IP 16416 3.89 0.29 6.18 48 T_XMDrugObfuBody_14 15897 6.28 6.74 5.98 49 T_TooManySym_01 15677 4.49 2.26 5.90 50 BAYES_00 15035 3.87 1.06 5.66 51 XMSubMetaSx_00 13439 5.97 7.41 5.06 52 XMStrtUSub 13206 5.02 5.09 4.97 53 RCVD_IN_MSPIKE_H2 13135 4.11 2.79 4.94 54 HTML_IMAGE_ONLY_08 12379 9.17 16.26 4.66 55 XMSexyCombo_05 12341 6.90 10.45 4.64 56 XM_B_Phish_Phrases 11929 5.67 7.52 4.49 57 XM_H_Long_From01 11527 4.98 5.98 4.34 58 IN_ZIMBRA_NJ_WHITELIST 11507 2.65 0.01 4.33 59 RCVD_IN_IADB_LISTED 11257 3.13 1.40 4.24 60 MIME_QP_LONG_LINE 11185 3.66 2.79 4.21 61 XM_SendGrid 11066 3.73 3.06 4.16 62 FROM_EXCESS_BASE64 10911 14.14 29.90 4.11 63 UNTRUSTED_Relay 10812 5.45 7.61 4.07 64 T_REMOTE_IMAGE 10794 12.81 26.56 4.06 65 BAYES_80 10211 7.56 13.40 3.84 66 DKIM_INVALID 10173 3.95 4.14 3.83 67 XM_H_Long_From02 10064 2.92 1.55 3.79 68 XM_UB50 9783 3.66 3.62 3.68 69 XMNumbers 9737 5.74 8.99 3.66 70 XM_UncommonTLD01 9699 10.42 21.06 3.65 71 RCVD_IN_IADB_SPF 9447 2.64 1.20 3.56 72 TR_XM_DK_Bayes 9406 2.51 0.89 3.54 73 HTML_IMAGE_RATIO_06 8915 3.57 3.91 3.36 74 TR_XM_DK_Bayes1 8792 2.36 0.87 3.31 75 TR_XM_DocInvoice 8623 4.57 6.65 3.25 76 BAYES_40 8352 2.42 1.29 3.14 77 RELAYCOUNTRY_PH 8286 1.91 0.02 3.12 78 RCVD_IN_IADB_SENDERID 8193 2.32 1.12 3.08 79 MPART_ALT_DIFF 8116 4.31 6.30 3.05 80 RCVD_IN_IADB_VOUCHED 8008 2.09 0.65 3.01 81 RCVD_IN_IADB_DK 7921 2.25 1.10 2.98 82 BAYES_95 7890 4.90 7.93 2.97 83 TR_XM_DK_Bayes2 7599 2.06 0.80 2.86 84 RCVD_IN_MSPIKE_WL 6894 1.83 0.64 2.59 85 RCVD_IN_MSPIKE_H3 6892 1.83 0.63 2.59 86 INVALID_MSGID 6735 1.62 0.18 2.53 87 TooManyTo_002 6694 1.89 0.89 2.52 88 TO_MALFORMED 6532 1.50 0.01 2.46 89 XMBdyGiftCard01 6327 2.36 2.33 2.38 90 MIME_HTML_MOSTLY 6315 3.15 4.37 2.38 91 URI_HEX 6114 2.27 2.22 2.30 92 TM2_M_URI_OPT_OUT 6105 2.60 3.09 2.30 93 BAYES_20 5770 1.84 1.31 2.17 94 HTML_IMAGE_ONLY_04 5752 4.65 8.56 2.16 95 TooManyTo_003 5751 1.65 0.85 2.16 96 T_TooManySym_02 5203 1.43 0.59 1.96 97 RCVD_IN_IADB_OPTIN 5063 1.33 0.42 1.91 98 USER_IN_DEF_DKIM_WL 4899 1.13 0.01 1.84 99 IN_HORDE_ADDRESS_BOOK 4800 1.13 0.06 1.81 100 MAILING_LIST_MULTI 4491 1.50 1.21 1.69 101 HTML_IMAGE_RATIO_08 4386 1.95 2.42 1.65 102 XM_CamelCaseFrm001 4080 1.99 2.70 1.54 103 XM_PDF 4066 1.04 0.27 1.53 104 XM_DK_Undo_01 4033 1.27 0.89 1.52 105 XM_DIRTYINTL 4013 2.18 3.23 1.51 106 XMStockSpam_06 3806 1.33 1.17 1.43 107 XMDiploma_00 3796 1.58 1.83 1.43 108 XM_ProductURIs 3791 1.38 1.31 1.43 109 NO_DNS_FOR_FROM 3786 1.81 2.41 1.42 110 XM_OfRef6 3678 1.65 2.06 1.38 111 TR_Symld_Words 3616 1.01 0.46 1.36 112 HTML_MIME_NO_HTML_TAG 3456 10.35 24.56 1.30 113 XMSubMetaI_00 3377 2.33 4.00 1.27 114 BOTNET 3362 5.06 11.03 1.27 115 BAYES_05 3343 1.12 0.91 1.26 116 XM_GoogleGroups 3329 0.90 0.34 1.25 117 RELAYCOUNTRY_CA 3186 1.78 2.68 1.20 118 MIME_HTML_ONLY_MULTI 3037 1.64 2.42 1.14 119 URIBL_SBL_A 2994 0.91 0.58 1.13 120 XMPhish11 2944 1.01 0.85 1.11 121 URI_TRY_3LD 2930 1.02 0.90 1.10 122 XMSubMetaSxObfu_02 2881 0.73 0.16 1.08 123 USER_IN_WHITELIST 2799 0.64 0.00 1.05 124 TO_NO_BRKTS_HTML_ONLY 2798 0.85 0.53 1.05 125 SUBJ_ALL_CAPS 2784 1.20 1.45 1.05 126 XM_H_PHPOS 2707 1.00 0.97 1.02 127 T_XMDrugObfuBody_08 2608 1.16 1.45 0.98 128 XM_SPF_SoftFail 2606 1.67 2.76 0.98 129 TO_IN_SUBJ 2510 0.77 0.51 0.94 130 HTML_FONT_FACE_BAD 2383 0.73 0.47 0.90 131 XMLngstWrd_00 2379 0.61 0.17 0.90 132 T_XMDrugObfuBody_00 2280 0.93 1.05 0.86 133 TM2_M_VERY_LONG_WORD 2205 0.96 1.17 0.83 134 XMBody_95 2164 0.55 0.13 0.81 135 T_TooManySym_03 2140 0.56 0.17 0.81 136 TooManyTo_004 2111 0.72 0.61 0.79 137 XMLngstWrd_01 2111 0.54 0.15 0.79 138 DKIM_ADSP_CUSTOM_MED 2069 0.68 0.52 0.78 139 TooManyTo_005 1859 0.64 0.54 0.70 140 XMHTMLBadTable_001 1855 0.84 1.08 0.70 141 XMGenDplmaNmb 1743 0.81 1.05 0.66 142 XM_H_PHPMailer 1658 0.63 0.64 0.62 143 XM_D_tchamptons_WL 1611 0.37 0.00 0.61 144 FILL_THIS_FORM 1601 0.70 0.85 0.60 145 XMSexyCombo_01 1576 1.02 1.69 0.59 146 XMBrknScrpt_02 1568 0.59 0.59 0.59 147 XM_B_REG_HTML 1540 0.69 0.87 0.58 148 NML_ADSP_CUSTOM_MED 1521 0.52 0.44 0.57 149 DIET_1 1448 1.76 3.66 0.54 150 HTML_FONT_SIZE_LARGE 1447 0.91 1.49 0.54 151 T_FILL_THIS_FORM_LONG 1410 0.64 0.81 0.53 152 FILL_THIS_FORM_LOAN 1369 0.62 0.77 0.52 153 TR_MetaPhish_Combo_01 1358 0.43 0.31 0.51 154 HELO_NODOT 1339 0.35 0.10 0.50 155 XMSubNoVowel 1324 0.61 0.78 0.50 156 XMLngstWrd_02 1309 0.35 0.12 0.49 157 XM_B_COPY_HTML 1288 0.57 0.69 0.48 158 RELAYCOUNTRY_GB 1254 0.52 0.60 0.47 159 DKIM_ADSP_NXDOMAIN 1246 0.47 0.46 0.47 160 XMBody_17 1218 0.92 1.64 0.46 161 TM2_M_A_HREF_HREF 1215 0.45 0.44 0.46 162 RDNS_DYNAMIC 1202 0.60 0.83 0.45 163 XMSolicitRefs_0 1201 0.51 0.60 0.45 164 T_FILL_THIS_FORM_SHORT 1180 0.52 0.65 0.44 165 XMCapTrack 1174 0.36 0.23 0.44 166 T_XMHurry_00 1160 0.83 1.44 0.44 167 URI_NOVOWEL 1145 0.55 0.73 0.43 168 XMBody_78 1125 0.51 0.63 0.42 169 T_TooManySym_04 1118 0.26 0.01 0.42 170 HTML_TAG_BALANCE_BODY 1087 0.65 1.03 0.41 171 XMSubMetaD_03 1058 0.31 0.18 0.40 172 XMNoVowels 1057 0.47 0.58 0.40 173 MPART_ALT_DIFF_COUNT 1029 0.62 0.98 0.39 174 MISSING_HEADERS 1006 9.30 23.33 0.38 175 XM_H_PHPOS_M 998 0.40 0.43 0.38 176 XMLngstWrd_03 985 0.26 0.10 0.37 177 XMSubMetaSx_01 918 0.37 0.41 0.35 178 FORGED_GMAIL_RCVD 912 0.37 0.41 0.34 179 XMSubMetaSSx_00 890 0.52 0.81 0.33 180 SpammyFromTLD_01 884 0.70 1.29 0.33 181 XMBody_29 879 0.27 0.17 0.33 182 RELAYCOUNTRY_AU 873 0.29 0.24 0.33 183 XM_ShortIntro_01 872 0.30 0.26 0.33 184 TM2_M_BODY_EMPTY 833 0.21 0.05 0.31 185 XM_Walgreens_Forge 825 0.28 0.22 0.31 186 XMGappySubj_01 821 0.48 0.76 0.31 187 HTML_FONT_SIZE_HUGE 820 0.49 0.76 0.31 188 KHOP_DYNAMIC 817 0.29 0.28 0.31 189 XM_BadFromFormat 806 0.43 0.63 0.30 190 XMRcvdHeader_15 798 0.18 0.00 0.30 191 FROM_EGROUPS 755 0.18 0.00 0.28 192 XMHTML_After_End 745 0.48 0.79 0.28 193 HTML_IMAGE_ONLY_16 739 0.21 0.09 0.28 194 T_HTML_TAG_BALANCE_CENTER 718 0.54 0.95 0.27 195 XMSubMetaSxObfu_03 713 0.36 0.51 0.27 196 TR_XM_RelayPhish 709 0.54 0.96 0.27 197 RELAYCOUNTRY_DE 704 0.40 0.61 0.26 198 XMSUPPORT 688 0.16 0.00 0.26 199 XMDateMe_00 681 0.29 0.33 0.26 200 T_Symld_Words_02 681 0.30 0.36 0.26 ----------------------------------------------------------------------