Email: 393018 Autolearn: 0 AvgScore: 4.30 AvgScanTime: 3.57 sec Spam: 141858 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 4.25 sec Ham: 251160 Autolearn: 0 AvgScore: -0.26 AvgScanTime: 3.18 sec Time Spent Running SA: 389.43 hours Time Spent Processing Spam: 167.45 hours Time Spent Processing Ham: 221.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136046 90.08 95.90 86.80 2 DKIM_SIGNED 118258 79.85 83.36 77.86 3 XM_DK_Pass 116480 78.65 82.11 76.70 4 DCC_CHECK 114679 56.54 80.84 42.81 5 DKIM_VALID 110531 75.13 77.92 73.55 6 XMListUnsubscribeExists 102726 61.23 72.41 54.91 7 DKIM_VALID_AU 89781 58.81 63.29 56.28 8 XM_H_QuotedFrom 82816 44.65 58.38 36.89 9 XM_DK_Undo_02 70825 30.52 49.93 19.56 10 BAYES_99 63048 28.01 44.44 18.73 11 LOC_TINY_FONT_1 55779 32.49 39.32 28.63 12 BAYES_999 53343 24.06 37.60 16.40 13 HTML_FONT_LOW_CONTRAST 52274 35.23 36.85 34.32 14 TR_DCC_Bayes_99 49180 18.73 34.67 9.73 15 BAYES_50 46041 45.15 32.46 52.31 16 MIME_HTML_ONLY 44140 25.73 31.12 22.69 17 FVGT_m_MULTI_ODD 36023 23.83 25.39 22.95 18 XMSubLong 31543 20.68 22.24 19.80 19 DKIM_VALID_EF 30840 27.59 21.74 30.89 20 T_KAM_HTML_FONT_INVALID 29545 16.89 20.83 14.66 21 XM_Body_Dirty_Words 27611 14.61 19.46 11.86 22 DCC_CHECK_NEGATIVE 25417 42.33 17.92 56.11 23 HTML_IMAGE_RATIO_02 25183 12.71 17.75 9.87 24 MultiRelay 23816 15.58 16.79 14.89 25 XM_Multi_Part_URI 23810 14.23 16.78 12.79 26 T_TM2_M_HEADER_IN_MSG 23627 20.10 16.66 22.05 27 RELAYCOUNTRY_META 22823 8.35 16.09 3.98 28 FSL_BULK_SIG 19711 10.22 13.89 8.14 29 XM_Evil_Numbers_Gen 19380 9.90 13.66 7.78 30 BOTNET_IPINHOSTNAME 16697 9.63 11.77 8.42 31 BOTNET 16029 4.94 11.30 1.35 32 XMSexyCombo_05 15285 6.43 10.77 3.97 33 XM_UncommonTLD01 15211 6.32 10.72 3.83 34 LOTS_OF_MONEY 15170 11.05 10.69 11.25 35 HTML_IMAGE_RATIO_04 13996 7.68 9.87 6.45 36 XM_B_Phish_Phrases 13827 7.14 9.75 5.66 37 UNTRUSTED_Relay 13558 4.12 9.56 1.05 38 T_XMDrugObfuBody_14 12592 7.72 8.88 7.06 39 XM_H_Long_From01 11410 6.57 8.04 5.73 40 FROM_EXCESS_BASE64 11172 5.89 7.88 4.77 41 XMSubMetaSx_00 10961 6.04 7.73 5.09 42 RCVD_IN_RP_SAFE 10944 11.03 7.71 12.90 43 TR_XM_DocInvoice 10836 4.64 7.64 2.94 44 MPART_ALT_DIFF 10673 5.37 7.52 4.15 45 BAYES_80 10509 5.81 7.41 4.90 46 HTML_IMAGE_RATIO_06 10266 6.02 7.24 5.34 47 TooManyTo_001 9967 5.80 7.03 5.10 48 BAYES_60 9747 7.12 6.87 7.26 49 LotsOfNums_01 9575 7.80 6.75 8.39 50 RCVD_IN_RP_CERTIFIED 8828 10.06 6.22 12.22 51 MIME_HTML_MOSTLY 8306 4.11 5.86 3.13 52 ALL_TRUSTED 7993 13.25 5.63 17.54 53 DKIM_INVALID 7727 4.72 5.45 4.31 54 XMPhish14 7635 2.08 5.38 0.22 55 XM_SendGrid 7567 5.23 5.33 5.17 56 XMStrtUSub 7069 4.87 4.98 4.80 57 XM_Combo_Sbj 6339 1.91 4.47 0.47 58 BAYES_95 6288 4.35 4.43 4.30 59 MultiRelay_CC 6123 1.66 4.32 0.17 60 MultiRelay_Combo 6123 1.66 4.32 0.17 61 XM_CamelCaseFrm001 5880 2.64 4.14 1.78 62 URI_WP_HACKED_2 5799 1.54 4.09 0.10 63 XM_UB50 5583 1.84 3.94 0.66 64 TR_MetaPhish_Sub_02 5558 1.42 3.92 0.01 65 XMNumbers 5483 3.69 3.87 3.59 66 RCVD_IN_RP_RNBL 5470 1.44 3.86 0.07 67 XM_DIRTYINTL 5102 2.67 3.60 2.15 68 T_XMDrugObfuBody_08 4864 2.07 3.43 1.30 69 RCVD_IN_MSPIKE_H2 4770 4.74 3.36 5.52 70 MIME_HTML_ONLY_MULTI 4736 2.38 3.34 1.85 71 SpammyFromTLD_02 4730 1.29 3.33 0.13 72 MIME_QP_LONG_LINE 4685 3.99 3.30 4.38 73 T_REMOTE_IMAGE 4595 3.79 3.24 4.11 74 RCVD_IN_BL_SPAMCOP_NET 4388 1.33 3.09 0.34 75 HTML_IMAGE_RATIO_08 4308 2.36 3.04 1.98 76 RELAYCOUNTRY_CA 4227 2.03 2.98 1.50 77 XM_SPF_SoftFail 4214 1.66 2.97 0.92 78 HTML_MIME_NO_HTML_TAG 4201 2.59 2.96 2.39 79 TM2_M_URI_OPT_OUT 4156 2.06 2.93 1.56 80 XMBdyGiftCard01 4128 1.90 2.91 1.33 81 XM_OfRef6 4024 1.80 2.84 1.22 82 XMBody_17 3773 1.37 2.66 0.64 83 T_TooManySym_01 3769 3.83 2.66 4.49 84 XM_URI_RBL 3425 0.95 2.41 0.13 85 URI_HEX 3322 1.95 2.34 1.74 86 XMSexyCombo_01 3295 1.25 2.32 0.65 87 SUBJ_ALL_CAPS 3053 1.87 2.15 1.71 88 XMDiploma_00 2954 1.94 2.08 1.85 89 URI_TRY_3LD 2941 1.77 2.07 1.59 90 RCVD_IN_IADB_LISTED 2726 4.18 1.92 5.46 91 UNPARSEABLE_RELAY 2725 5.32 1.92 7.25 92 NO_DNS_FOR_FROM 2693 1.63 1.90 1.47 93 URIBL_BLACK 2607 0.70 1.84 0.05 94 XM_DK_Undo_01 2595 1.76 1.83 1.71 95 TR_XM_RelayPhish 2464 0.81 1.74 0.29 96 XMSubMetaI_00 2445 1.12 1.72 0.77 97 TM2_M_VERY_LONG_WORD 2421 1.23 1.71 0.96 98 XM_UB60 2341 0.63 1.65 0.06 99 URI_NOVOWEL 2267 0.85 1.60 0.43 100 RCVD_IN_IADB_SPF 2262 3.57 1.59 4.69 101 RELAYCOUNTRY_FR 2229 0.80 1.57 0.36 102 TR_Symld_Words 2219 2.18 1.56 2.52 103 XM_ProductURIs 2177 1.44 1.53 1.39 104 BAYES_00 2124 4.65 1.50 6.44 105 TR_Mismatch_TLD_02 2114 0.57 1.49 0.04 106 XMPhish30 2094 0.81 1.48 0.44 107 RELAYCOUNTRY_DE 2077 0.72 1.46 0.30 108 TR_LOTS_OF_MONEY3 2070 0.66 1.46 0.21 109 T_XMHurry_00 2062 0.83 1.45 0.48 110 MAILING_LIST_MULTI 2058 1.62 1.45 1.71 111 RCVD_IN_IADB_SENDERID 2048 3.17 1.44 4.15 112 BOTNET_NORDNS 2028 0.53 1.43 0.02 113 XM_RXBody 2025 0.64 1.43 0.20 114 T_FILL_THIS_FORM_SHORT 2013 0.90 1.42 0.61 115 XM_H_Long_From02 2011 1.02 1.42 0.79 116 DIET_1 1980 0.75 1.40 0.38 117 XMGenDplmaNmb 1978 1.14 1.39 1.00 118 RCVD_IN_IADB_DK 1976 3.06 1.39 3.99 119 XM_B_REG_HTML 1922 0.91 1.35 0.65 120 RELAYCOUNTRY_AT 1907 0.55 1.34 0.10 121 XM_UB99 1899 0.49 1.34 0.02 122 RELAYCOUNTRY_CN 1887 0.50 1.33 0.03 123 TR_XM_DK_Bayes 1858 3.58 1.31 4.86 124 XM_HighProb1 1816 0.47 1.28 0.02 125 XMBrknScrpt_02 1807 0.71 1.27 0.39 126 TR_XM_DK_Bayes1 1764 3.40 1.24 4.62 127 XMStockSpam_06 1762 1.04 1.24 0.93 128 SpammyFromTLD_01 1754 0.68 1.24 0.37 129 XMHTMLBadTable_001 1751 0.77 1.23 0.51 130 RELAYCOUNTRY_GB 1721 0.77 1.21 0.53 131 HTML_IMAGE_ONLY_32 1701 0.65 1.20 0.33 132 BAYES_40 1694 2.23 1.19 2.82 133 XMSubMetaSSx_00 1692 0.60 1.19 0.27 134 RELAYCOUNTRY_RU 1690 0.45 1.19 0.04 135 XM_UB80 1652 0.44 1.16 0.04 136 T_MONEY_PERCENT 1630 0.73 1.15 0.50 137 TR_LOTS_OF_MONEY2 1630 0.73 1.15 0.50 138 RELAYCOUNTRY_BR 1582 0.43 1.12 0.04 139 RDNS_DYNAMIC 1575 0.78 1.11 0.59 140 TR_XM_DK_Bayes2 1554 2.82 1.10 3.79 141 RCVD_IN_IADB_VOUCHED 1551 2.65 1.09 3.53 142 FILL_THIS_FORM 1529 0.67 1.08 0.44 143 XM_UB999 1477 0.38 1.04 0.01 144 URIBL_DBL_SPAM 1459 0.42 1.03 0.07 145 REMOVE_BEFORE_LINK 1447 0.63 1.02 0.40 146 XMSexyCombo_04 1440 0.47 1.02 0.16 147 BAYES_20 1440 1.61 1.02 1.95 148 EXCUSE_4 1430 0.37 1.01 0.01 149 BODY_ENHANCEMENT 1421 0.41 1.00 0.08 150 XMPhish11 1413 1.02 1.00 1.03 151 XM_B_COPY_HTML 1397 0.70 0.98 0.54 152 FILL_THIS_FORM_LOAN 1363 0.57 0.96 0.34 153 SUBJ_DOLLARS 1355 0.50 0.96 0.25 154 XM_H_PHPOS 1353 1.06 0.95 1.12 155 MISSING_HEADERS 1329 0.50 0.94 0.25 156 XMHTML_After_End 1304 0.52 0.92 0.30 157 TooManyTo_002 1276 1.16 0.90 1.31 158 XMBody_78 1268 0.59 0.89 0.42 159 REPLYTO_WITHOUT_TO_CC 1265 0.34 0.89 0.04 160 XM_OverStock_LProb 1223 0.32 0.86 0.02 161 XMSubMetaSxObfu_03 1206 0.68 0.85 0.59 162 HTML_FONT_FACE_BAD 1188 0.61 0.84 0.49 163 BODY_URI_ONLY 1181 0.33 0.83 0.05 164 TM2_M_A_HREF_HREF 1180 0.90 0.83 0.93 165 XM_Body_Obfu01 1172 0.39 0.83 0.14 166 TooManyTo_003 1171 0.87 0.83 0.89 167 XM_OfRef7 1153 0.39 0.81 0.16 168 RELAYCOUNTRY_NL 1118 0.38 0.79 0.16 169 XMClaimOffer 1101 0.54 0.78 0.40 170 XM_H_PHPMailer 1100 0.73 0.78 0.70 171 RELAYCOUNTRY_IN 1095 0.31 0.77 0.05 172 HTML_SHORT_LINK_IMG_1 1090 0.30 0.77 0.04 173 T_Symld_Words_02 1077 0.52 0.76 0.38 174 DKIM_ADSP_CUSTOM_MED 1066 0.79 0.75 0.81 175 XM_S_JOY_D 1057 0.44 0.75 0.26 176 TVD_SPACE_RATIO_MINFP 1050 0.27 0.74 0.01 177 RCVD_IN_MSPIKE_WL 1044 2.09 0.74 2.85 178 TR_LOTS_OF_MONEY1 1042 0.27 0.73 0.01 179 RCVD_IN_MSPIKE_H3 1039 2.09 0.73 2.85 180 RCVD_IN_IADB_OPTIN 1015 1.72 0.72 2.29 181 RELAYCOUNTRY_ZA 994 0.26 0.70 0.01 182 MPART_ALT_DIFF_COUNT 992 0.59 0.70 0.53 183 HTML_IMAGE_ONLY_04 987 0.29 0.70 0.06 184 MONEY_FRAUD_5 985 0.26 0.69 0.02 185 XM_BadFromFormat 968 0.50 0.68 0.39 186 MONEY_FORM 962 0.26 0.68 0.02 187 TR_MetaPhish_Combo_01 962 0.70 0.68 0.71 188 DEAR_BENEFICIARY 958 0.26 0.68 0.02 189 XMSlimDrugH 955 0.47 0.67 0.36 190 T_HTML_TAG_BALANCE_CENTER 952 0.43 0.67 0.29 191 XMSubMetaSxObfu_02 951 0.96 0.67 1.13 192 SUBJ_ILLEGAL_CHARS 943 0.24 0.66 0.01 193 SUBJECT_NEEDS_ENCODING 943 0.24 0.66 0.01 194 TVD_RCVD_IP 940 4.50 0.66 6.67 195 FORGED_GMAIL_RCVD 932 0.53 0.66 0.46 196 KHOP_DYNAMIC 924 0.44 0.65 0.33 197 BAYES_05 921 1.02 0.65 1.24 198 T_TooManySym_02 916 1.59 0.65 2.13 199 TooManyTo_004 915 0.70 0.65 0.73 200 ADVANCE_FEE_5_NEW_FRM_MNY 905 0.24 0.64 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 217997 90.08 95.90 86.80 2 DKIM_SIGNED 195552 79.85 83.36 77.86 3 XM_DK_Pass 192634 78.65 82.11 76.70 4 DKIM_VALID 184737 75.13 77.92 73.55 5 DKIM_VALID_AU 141347 58.81 63.29 56.28 6 DCC_CHECK_NEGATIVE 140931 42.33 17.92 56.11 7 XMListUnsubscribeExists 137904 61.23 72.41 54.91 8 BAYES_50 131391 45.15 32.46 52.31 9 DCC_CHECK 107529 56.54 80.84 42.81 10 XM_H_QuotedFrom 92648 44.65 58.38 36.89 11 HTML_FONT_LOW_CONTRAST 86188 35.23 36.85 34.32 12 DKIM_VALID_EF 77585 27.59 21.74 30.89 13 LOC_TINY_FONT_1 71912 32.49 39.32 28.63 14 FVGT_m_MULTI_ODD 57633 23.83 25.39 22.95 15 MIME_HTML_ONLY 56978 25.73 31.12 22.69 16 T_TM2_M_HEADER_IN_MSG 55377 20.10 16.66 22.05 17 XMSubLong 49730 20.68 22.24 19.80 18 XM_DK_Undo_02 49135 30.52 49.93 19.56 19 BAYES_99 47035 28.01 44.44 18.73 20 ALL_TRUSTED 44063 13.25 5.63 17.54 21 BAYES_999 41200 24.06 37.60 16.40 22 XM_DKIMWhitelistDomains 39614 10.12 0.11 15.77 23 MultiRelay 37407 15.58 16.79 14.89 24 T_KAM_HTML_FONT_INVALID 36819 16.89 20.83 14.66 25 RCVD_IN_RP_SAFE 32406 11.03 7.71 12.90 26 XM_Multi_Part_URI 32113 14.23 16.78 12.79 27 RCVD_IN_RP_CERTIFIED 30694 10.06 6.22 12.22 28 XM_Body_Dirty_Words 29794 14.61 19.46 11.86 29 LOTS_OF_MONEY 28265 11.05 10.69 11.25 30 HTML_IMAGE_RATIO_02 24788 12.71 17.75 9.87 31 TR_DCC_Bayes_99 24437 18.73 34.67 9.73 32 BOTNET_IPINHOSTNAME 21148 9.63 11.77 8.42 33 LotsOfNums_01 21062 7.80 6.75 8.39 34 FSL_BULK_SIG 20444 10.22 13.89 8.14 35 XM_Evil_Numbers_Gen 19541 9.90 13.66 7.78 36 BAYES_60 18224 7.12 6.87 7.26 37 UNPARSEABLE_RELAY 18201 5.32 1.92 7.25 38 T_XMDrugObfuBody_14 17736 7.72 8.88 7.06 39 BOUNCE_MESSAGE 17309 4.56 0.44 6.89 40 ANY_BOUNCE_MESSAGE 17309 4.56 0.44 6.89 41 TVD_RCVD_IP 16744 4.50 0.66 6.67 42 HTML_IMAGE_RATIO_04 16207 7.68 9.87 6.45 43 BAYES_00 16163 4.65 1.50 6.44 44 XM_H_Long_From01 14393 6.57 8.04 5.73 45 XM_B_Phish_Phrases 14227 7.14 9.75 5.66 46 RCVD_IN_MSPIKE_H2 13875 4.74 3.36 5.52 47 RCVD_IN_IADB_LISTED 13715 4.18 1.92 5.46 48 HTML_IMAGE_RATIO_06 13410 6.02 7.24 5.34 49 XM_SendGrid 12978 5.23 5.33 5.17 50 TooManyTo_001 12816 5.80 7.03 5.10 51 XMSubMetaSx_00 12794 6.04 7.73 5.09 52 BAYES_80 12307 5.81 7.41 4.90 53 TR_XM_DK_Bayes 12201 3.58 1.31 4.86 54 XMStrtUSub 12066 4.87 4.98 4.80 55 FROM_EXCESS_BASE64 11983 5.89 7.88 4.77 56 RCVD_IN_IADB_SPF 11785 3.57 1.59 4.69 57 TR_XM_DK_Bayes1 11615 3.40 1.24 4.62 58 T_TooManySym_01 11266 3.83 2.66 4.49 59 MIME_QP_LONG_LINE 11002 3.99 3.30 4.38 60 DKIM_INVALID 10815 4.72 5.45 4.31 61 BAYES_95 10811 4.35 4.43 4.30 62 IN_ZIMBRA_NJ_WHITELIST 10540 2.69 0.02 4.20 63 RCVD_IN_IADB_SENDERID 10427 3.17 1.44 4.15 64 MPART_ALT_DIFF 10416 5.37 7.52 4.15 65 T_REMOTE_IMAGE 10311 3.79 3.24 4.11 66 RCVD_IN_IADB_DK 10031 3.06 1.39 3.99 67 RELAYCOUNTRY_META 10004 8.35 16.09 3.98 68 XMSexyCombo_05 9974 6.43 10.77 3.97 69 XM_UncommonTLD01 9611 6.32 10.72 3.83 70 TR_XM_DK_Bayes2 9522 2.82 1.10 3.79 71 XMNumbers 9019 3.69 3.87 3.59 72 RCVD_IN_IADB_VOUCHED 8856 2.65 1.09 3.53 73 MIME_HTML_MOSTLY 7852 4.11 5.86 3.13 74 TR_XM_DocInvoice 7389 4.64 7.64 2.94 75 RCVD_IN_MSPIKE_WL 7170 2.09 0.74 2.85 76 RCVD_IN_MSPIKE_H3 7167 2.09 0.73 2.85 77 BAYES_40 7088 2.23 1.19 2.82 78 INVALID_MSGID 6898 1.88 0.35 2.75 79 TO_MALFORMED 6393 1.63 0.01 2.55 80 TR_Symld_Words 6341 2.18 1.56 2.52 81 HTML_MIME_NO_HTML_TAG 5992 2.59 2.96 2.39 82 RCVD_IN_IADB_OPTIN 5744 1.72 0.72 2.29 83 USER_IN_DEF_DKIM_WL 5612 1.45 0.07 2.23 84 XM_DIRTYINTL 5391 2.67 3.60 2.15 85 T_TooManySym_02 5343 1.59 0.65 2.13 86 XM_PDF 5208 1.42 0.26 2.07 87 IN_HORDE_ADDRESS_BOOK 4987 1.29 0.06 1.99 88 HTML_IMAGE_RATIO_08 4973 2.36 3.04 1.98 89 BAYES_20 4886 1.61 1.02 1.95 90 XMDiploma_00 4656 1.94 2.08 1.85 91 MIME_HTML_ONLY_MULTI 4637 2.38 3.34 1.85 92 XM_CamelCaseFrm001 4477 2.64 4.14 1.78 93 URI_HEX 4358 1.95 2.34 1.74 94 MAILING_LIST_MULTI 4305 1.62 1.45 1.71 95 XM_DK_Undo_01 4303 1.76 1.83 1.71 96 SUBJ_ALL_CAPS 4284 1.87 2.15 1.71 97 URI_TRY_3LD 3998 1.77 2.07 1.59 98 TM2_M_URI_OPT_OUT 3928 2.06 2.93 1.56 99 RELAYCOUNTRY_CA 3762 2.03 2.98 1.50 100 NO_DNS_FOR_FROM 3702 1.63 1.90 1.47 101 XM_GoogleGroups 3543 1.04 0.39 1.41 102 XM_ProductURIs 3492 1.44 1.53 1.39 103 BOTNET 3385 4.94 11.30 1.35 104 XMBdyGiftCard01 3347 1.90 2.91 1.33 105 TooManyTo_002 3284 1.16 0.90 1.31 106 T_XMDrugObfuBody_08 3269 2.07 3.43 1.30 107 BAYES_05 3103 1.02 0.65 1.24 108 XM_OfRef6 3060 1.80 2.84 1.22 109 XMSubMetaSxObfu_02 2829 0.96 0.67 1.13 110 XM_H_PHPOS 2810 1.06 0.95 1.12 111 UNTRUSTED_Relay 2626 4.12 9.56 1.05 112 XMPhish11 2597 1.02 1.00 1.03 113 USER_IN_WHITELIST 2562 0.65 0.00 1.02 114 XMGenDplmaNmb 2517 1.14 1.39 1.00 115 XMLngstWrd_00 2437 0.69 0.21 0.97 116 TM2_M_VERY_LONG_WORD 2412 1.23 1.71 0.96 117 XMStockSpam_06 2341 1.04 1.24 0.93 118 TM2_M_A_HREF_HREF 2338 0.90 0.83 0.93 119 XM_SPF_SoftFail 2312 1.66 2.97 0.92 120 TooManyTo_003 2247 0.87 0.83 0.89 121 T_XMDrugObfuBody_00 2224 0.79 0.62 0.89 122 XM_D_tchamptons_WL 2207 0.56 0.00 0.88 123 T_TooManySym_03 2164 0.58 0.09 0.86 124 XMLngstWrd_01 2122 0.60 0.17 0.84 125 XMBody_95 2104 0.57 0.10 0.84 126 DKIM_ADSP_CUSTOM_MED 2044 0.79 0.75 0.81 127 XM_H_Long_From02 1991 1.02 1.42 0.79 128 XMSubMetaI_00 1940 1.12 1.72 0.77 129 TooManyTo_004 1825 0.70 0.65 0.73 130 TR_MetaPhish_Combo_01 1777 0.70 0.68 0.71 131 XM_H_PHPMailer 1755 0.73 0.78 0.70 132 XM_UB50 1646 1.84 3.94 0.66 133 XM_B_REG_HTML 1637 0.91 1.35 0.65 134 XMSexyCombo_01 1633 1.25 2.32 0.65 135 XMBody_17 1602 1.37 2.66 0.64 136 HELO_NODOT 1582 0.45 0.13 0.63 137 TooManyTo_005 1554 0.60 0.56 0.62 138 T_FILL_THIS_FORM_SHORT 1526 0.90 1.42 0.61 139 RDNS_DYNAMIC 1488 0.78 1.11 0.59 140 XMSolicitRefs_0 1487 0.46 0.23 0.59 141 XMSubMetaSxObfu_03 1479 0.68 0.85 0.59 142 PLING_QUERY 1460 0.58 0.58 0.58 143 NML_ADSP_CUSTOM_MED 1427 0.57 0.57 0.57 144 XM_B_COPY_HTML 1357 0.70 0.98 0.54 145 XMLngstWrd_02 1340 0.39 0.15 0.53 146 XMNoVowels 1331 0.48 0.38 0.53 147 MPART_ALT_DIFF_COUNT 1324 0.59 0.70 0.53 148 RELAYCOUNTRY_GB 1323 0.77 1.21 0.53 149 XMHTMLBadTable_001 1288 0.77 1.23 0.51 150 T_MONEY_PERCENT 1255 0.73 1.15 0.50 151 TR_LOTS_OF_MONEY2 1255 0.73 1.15 0.50 152 HTML_FONT_FACE_BAD 1226 0.61 0.84 0.49 153 DKIM_ADSP_NXDOMAIN 1224 0.50 0.53 0.49 154 T_XMHurry_00 1201 0.83 1.45 0.48 155 XM_Combo_Sbj 1182 1.91 4.47 0.47 156 FORGED_GMAIL_RCVD 1167 0.53 0.66 0.46 157 HTML_TAG_BALANCE_BODY 1139 0.46 0.47 0.45 158 XM_H_PHPOS_M 1136 0.49 0.56 0.45 159 FILL_THIS_FORM 1111 0.67 1.08 0.44 160 XMCapTrack 1111 0.37 0.24 0.44 161 XMPhish30 1094 0.81 1.48 0.44 162 URI_NOVOWEL 1088 0.85 1.60 0.43 163 XMBody_78 1052 0.59 0.89 0.42 164 XMMoneyMeta_00 1036 0.39 0.36 0.41 165 REMOVE_BEFORE_LINK 1012 0.63 1.02 0.40 166 XMClaimOffer 1011 0.54 0.78 0.40 167 T_TooManySym_04 998 0.26 0.01 0.40 168 XMBrknScrpt_02 985 0.71 1.27 0.39 169 T_OBFU_PDF_ATTACH 982 0.27 0.06 0.39 170 XMLngstWrd_03 981 0.29 0.10 0.39 171 XM_BadFromFormat 980 0.50 0.68 0.39 172 T_Symld_Words_02 966 0.52 0.76 0.38 173 DIET_1 957 0.75 1.40 0.38 174 SpammyFromTLD_01 934 0.68 1.24 0.37 175 XM_ShortIntro_01 922 0.37 0.37 0.37 176 T_FILL_THIS_FORM_LONG 912 0.44 0.56 0.36 177 XMSlimDrugH 903 0.47 0.67 0.36 178 BASE64_LENGTH_79_INF 902 0.34 0.31 0.36 179 RELAYCOUNTRY_FR 902 0.80 1.57 0.36 180 RELAYCOUNTRY_AU 863 0.35 0.36 0.34 181 FILL_THIS_FORM_LOAN 860 0.57 0.96 0.34 182 TR_MetaPhish_Combo_01b 851 0.25 0.08 0.34 183 RCVD_IN_BL_SPAMCOP_NET 851 1.33 3.09 0.34 184 HTML_IMAGE_ONLY_32 835 0.65 1.20 0.33 185 KHOP_DYNAMIC 817 0.44 0.65 0.33 186 UPPERCASE_50_75 814 0.27 0.17 0.32 187 RELAYCOUNTRY_DE 753 0.72 1.46 0.30 188 HTML_FONT_SIZE_HUGE 744 0.39 0.55 0.30 189 XMHTML_After_End 743 0.52 0.92 0.30 190 AC_DIV_BONANZA 737 0.23 0.11 0.29 191 XMBody_29 735 0.30 0.32 0.29 192 XM_H_SpoofStaff4 733 0.20 0.05 0.29 193 XMRcvdHeader_15 728 0.19 0.00 0.29 194 T_HTML_TAG_BALANCE_CENTER 724 0.43 0.67 0.29 195 TR_XM_RelayPhish 719 0.81 1.74 0.29 196 HTML_IMAGE_ONLY_16 685 0.25 0.22 0.27 197 TVD_SPACE_RATIO 675 0.29 0.33 0.27 198 HTML_IMAGE_ONLY_28 674 0.25 0.21 0.27 199 XMSubMetaSSx_00 670 0.60 1.19 0.27 200 XMLngstWrd_04 670 0.19 0.05 0.27 ----------------------------------------------------------------------