Email: 621025 Autolearn: 7509 AvgScore: 3.09 AvgScanTime: 2.38 sec Spam: 176669 Autolearn: 407 AvgScore: 12.42 AvgScanTime: 2.63 sec Ham: 444356 Autolearn: 7102 AvgScore: -0.62 AvgScanTime: 2.28 sec Time Spent Running SA: 410.98 hours Time Spent Processing Spam: 129.09 hours Time Spent Processing Ham: 281.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 163639 82.75 92.62 78.83 2 DKIM_SIGNED 151696 71.98 85.86 66.45 3 XM_DK_Pass 146527 69.94 82.94 64.78 4 DKIM_VALID 144582 68.39 81.84 63.05 5 DCC_CHECK 139845 47.16 79.16 34.44 6 XMListUnsubscribeExists 131937 53.06 74.68 44.47 7 DKIM_VALID_AU 111925 50.40 63.35 45.26 8 XM_H_QuotedFrom 98597 39.14 55.81 32.52 9 XM_DK_Undo_02 88494 23.64 50.09 13.13 10 BAYES_99 79667 21.48 45.09 12.10 11 BAYES_999 68200 18.61 38.60 10.67 12 HTML_FONT_LOW_CONTRAST 63896 26.64 36.17 22.85 13 TR_DCC_Bayes_99 62964 14.46 35.64 6.04 14 LOC_TINY_FONT_1 61276 23.08 34.68 18.46 15 BAYES_50 53107 49.66 30.06 57.45 16 FVGT_m_MULTI_ODD 49326 21.58 27.92 19.06 17 XMSubLong 46810 21.42 26.50 19.40 18 MIME_HTML_ONLY 45555 19.52 25.79 17.03 19 XM_Body_Dirty_Words 35671 13.37 20.19 10.66 20 T_TM2_M_HEADER_IN_MSG 35599 27.39 20.15 30.27 21 DKIM_VALID_EF 33780 20.53 19.12 21.10 22 DCC_CHECK_NEGATIVE 33032 50.71 18.70 63.44 23 MultiRelay 32568 18.62 18.43 18.69 24 T_KAM_HTML_FONT_INVALID 31033 13.18 17.57 11.44 25 HTML_IMAGE_RATIO_02 30486 10.04 17.26 7.17 26 RELAYCOUNTRY_META 30472 8.88 17.25 5.55 27 XM_Multi_Part_URI 29411 12.23 16.65 10.47 28 XM_Evil_Numbers_Gen 24844 9.20 14.06 7.27 29 BOTNET_IPINHOSTNAME 23512 6.51 13.31 3.81 30 BOTNET 22166 4.26 12.55 0.97 31 UNTRUSTED_Relay 19669 4.16 11.13 1.38 32 LotsOfNums_01 18575 8.64 10.51 7.90 33 T_XMDrugObfuBody_14 17798 9.04 10.07 8.63 34 XM_UncommonTLD01 17440 5.37 9.87 3.58 35 FSL_BULK_SIG 17365 6.61 9.83 5.33 36 LOTS_OF_MONEY 16197 6.81 9.17 5.88 37 HTML_IMAGE_RATIO_04 15849 6.17 8.97 5.05 38 XMSexyCombo_05 15827 5.10 8.96 3.57 39 TR_XM_DocInvoice 15287 5.10 8.65 3.69 40 XM_B_Phish_Phrases 14966 5.80 8.47 4.74 41 XM_H_Long_From01 13988 5.96 7.92 5.19 42 TooManyTo_001 13176 7.52 7.46 7.54 43 MPART_ALT_DIFF 12789 3.85 7.24 2.50 44 BAYES_80 12032 4.65 6.81 3.79 45 BAYES_60 11807 6.13 6.68 5.91 46 RCVD_IN_RP_SAFE 10991 8.62 6.22 9.57 47 RCVD_IN_MSPIKE_H2 10539 6.84 5.97 7.19 48 MIME_HTML_MOSTLY 10017 3.18 5.67 2.19 49 XMNumbers 9938 4.65 5.63 4.26 50 FROM_EXCESS_BASE64 9932 3.80 5.62 3.07 51 XMSubMetaSx_00 9307 3.85 5.27 3.29 52 MIME_QP_LONG_LINE 8026 4.77 4.54 4.86 53 XM_SPF_SoftFail 7964 2.54 4.51 1.76 54 XM_UB50 7962 1.88 4.51 0.83 55 RCVD_IN_RP_CERTIFIED 7898 7.08 4.47 8.12 56 BAYES_95 7803 2.98 4.42 2.41 57 RCVD_IN_BL_SPAMCOP_NET 7721 1.86 4.37 0.86 58 HTML_IMAGE_RATIO_06 7711 3.26 4.36 2.82 59 TM2_M_URI_OPT_OUT 7517 2.54 4.25 1.86 60 XM_DIRTYINTL 7188 2.28 4.07 1.56 61 DKIM_INVALID 7114 3.58 4.03 3.40 62 MultiRelay_CC 7039 1.31 3.98 0.24 63 MultiRelay_Combo 7039 1.31 3.98 0.24 64 XM_SendGrid 6777 4.47 3.84 4.72 65 HTML_IMAGE_RATIO_08 6446 2.43 3.65 1.95 66 XMStrtUSub 6412 4.13 3.63 4.33 67 BAYES_00 5987 9.14 3.39 11.42 68 XM_CamelCaseFrm001 5671 2.17 3.21 1.75 69 TR_Mismatch_TLD_02 5602 0.94 3.17 0.06 70 URI_HEX 5595 1.54 3.17 0.90 71 MIME_HTML_ONLY_MULTI 5558 1.67 3.15 1.08 72 RELAYCOUNTRY_CA 5433 1.87 3.08 1.39 73 T_REMOTE_IMAGE 5260 3.46 2.98 3.65 74 SpammyFromTLD_01 5168 1.71 2.93 1.23 75 T_TooManySym_01 4748 3.75 2.69 4.17 76 TR_XM_DK_Bayes 4729 6.83 2.68 8.49 77 XMBdyGiftCard01 4538 1.32 2.57 0.82 78 TR_XM_DK_Bayes1 4489 6.45 2.54 8.01 79 XMDiploma_00 4433 1.61 2.51 1.25 80 T_XMDrugObfuBody_08 4250 1.53 2.41 1.18 81 XM_OfRef6 4246 1.45 2.40 1.07 82 XM_URI_RBL 4230 0.77 2.39 0.13 83 XM_UB60 4025 0.70 2.28 0.07 84 SUBJ_ALL_CAPS 3884 1.62 2.20 1.39 85 XM_H_PHPOS 3863 1.60 2.19 1.36 86 TM2_M_VERY_LONG_WORD 3833 1.15 2.17 0.75 87 TR_XM_DK_Bayes2 3810 5.17 2.16 6.36 88 T_MIXED_ES 3678 1.48 2.08 1.24 89 RCVD_IN_IADB_LISTED 3673 4.03 2.08 4.81 90 XMSubMetaI_00 3670 1.12 2.08 0.74 91 XM_H_Long_From02 3662 1.26 2.07 0.93 92 MAILING_LIST_MULTI 3297 2.54 1.87 2.80 93 XM_UB99 3278 0.53 1.86 0.01 94 RCVD_IN_IADB_SPF 3269 3.54 1.85 4.22 95 RELAYCOUNTRY_FR 3211 0.75 1.82 0.33 96 HTML_MIME_NO_HTML_TAG 3202 1.98 1.81 2.05 97 RCVD_IN_IADB_SENDERID 3107 3.18 1.76 3.74 98 XM_DK_Undo_01 3088 1.70 1.75 1.68 99 RCVD_IN_IADB_DK 3086 3.10 1.75 3.64 100 RELAYCOUNTRY_CL 3085 0.50 1.75 0.01 101 RELAYCOUNTRY_NG 3072 0.49 1.74 0.00 102 XM_ProductURIs 2990 1.17 1.69 0.97 103 XMSexyCombo_01 2892 1.11 1.64 0.89 104 BAYES_40 2889 2.76 1.64 3.21 105 XMPhish30 2871 0.75 1.63 0.41 106 TM2_M_BODY_EMPTY 2855 0.96 1.62 0.70 107 XMBody_17 2832 0.76 1.60 0.42 108 RCVD_IN_RP_RNBL 2800 0.46 1.58 0.01 109 XMEmptyBody_01 2746 0.74 1.55 0.41 110 T_XMHurry_00 2722 0.82 1.54 0.54 111 SpammyFromTLD_02 2703 0.67 1.53 0.32 112 TR_XM_RelayPhish 2643 0.78 1.50 0.50 113 XMGenDplmaNmb 2603 1.01 1.47 0.83 114 XM_UB999 2574 0.42 1.46 0.01 115 XMPhish14 2501 0.58 1.42 0.25 116 RELAYCOUNTRY_AT 2485 0.49 1.41 0.12 117 URIBL_BLACK 2443 0.41 1.38 0.03 118 TR_Symld_Words 2388 2.72 1.35 3.26 119 BAYES_20 2210 1.96 1.25 2.25 120 BODY_ENHANCEMENT 2199 0.39 1.24 0.05 121 BOTNET_NORDNS 2192 0.37 1.24 0.02 122 URI_TRY_3LD 2180 1.22 1.23 1.21 123 RCVD_IN_DNSWL_NONE 2177 2.14 1.23 2.50 124 REMOVE_BEFORE_LINK 2161 0.64 1.22 0.41 125 XMStockSpam_06 2159 1.09 1.22 1.03 126 XM_HighProb1 2104 0.35 1.19 0.02 127 T_XMDrugObfuBody_00 2099 0.68 1.19 0.47 128 RCVD_IN_PSBL 2093 0.37 1.18 0.05 129 TooManyTo_002 2079 1.91 1.18 2.20 130 HTML_FONT_FACE_BAD 2070 0.75 1.17 0.58 131 PLING_QUERY 2052 0.65 1.16 0.44 132 XMBody_78 2030 0.71 1.15 0.54 133 RELAYCOUNTRY_GB 2017 1.25 1.14 1.30 134 T_Symld_Words_02 1978 0.62 1.12 0.42 135 DIET_1 1969 0.45 1.11 0.18 136 DATE_IN_PAST_03_06 1936 0.37 1.10 0.08 137 RCVD_IN_IADB_VOUCHED 1924 3.05 1.09 3.82 138 RELAYCOUNTRY_DE 1863 0.77 1.05 0.66 139 XM_BadFromFormat 1862 0.45 1.05 0.21 140 TooManyTo_003 1856 1.26 1.05 1.35 141 URIBL_SBL_A 1839 1.13 1.04 1.17 142 ALL_TRUSTED 1816 16.79 1.03 23.05 143 XM_S_JOY_D 1807 0.64 1.02 0.48 144 RDNS_DYNAMIC 1798 0.56 1.02 0.37 145 UNPARSEABLE_RELAY 1777 2.42 1.01 2.98 146 XMHTML_After_End 1770 0.52 1.00 0.33 147 TR_Caps_n_Bayes_99 1726 0.34 0.98 0.08 148 HTML_SHORT_LINK_IMG_1 1702 0.30 0.96 0.03 149 FSL_THIS_IS_ADV 1702 0.32 0.96 0.06 150 RELAYCOUNTRY_CN 1693 0.32 0.96 0.07 151 LONG_JUNK_URI 1672 0.34 0.95 0.10 152 URIBL_DBL_SPAM 1654 0.27 0.94 0.01 153 SUBJ_DOLLARS 1654 0.36 0.94 0.13 154 T_FILL_THIS_FORM_SHORT 1606 0.72 0.91 0.64 155 TooManyTo_004 1600 0.93 0.91 0.94 156 XMPhish11 1586 0.99 0.90 1.03 157 TR_LOTS_OF_MONEY3 1582 0.54 0.90 0.39 158 LongTLD 1579 0.35 0.89 0.13 159 BODY_URI_ONLY 1553 0.28 0.88 0.04 160 XM_B_REG_HTML 1489 0.71 0.84 0.65 161 RELAYCOUNTRY_IN 1446 0.29 0.82 0.08 162 XM_UB80 1428 0.24 0.81 0.02 163 HTML_TAG_BALANCE_BODY 1418 0.47 0.80 0.33 164 T_MONEY_PERCENT 1378 0.54 0.78 0.45 165 TR_LOTS_OF_MONEY2 1378 0.54 0.78 0.45 166 XMBrknScrpt_02 1353 0.70 0.77 0.67 167 USB_DRIVES 1345 0.22 0.76 0.01 168 HTTPS_HTTP_MISMATCH 1340 0.54 0.76 0.45 169 HTML_IMAGE_ONLY_08 1336 0.30 0.76 0.12 170 XM_B_COPY_HTML 1328 0.55 0.75 0.47 171 XM_PDF 1274 3.22 0.72 4.21 172 XMHTMLBadTable_001 1270 0.44 0.72 0.33 173 MPART_ALT_DIFF_COUNT 1264 0.37 0.72 0.24 174 ANY_BOUNCE_MESSAGE 1237 7.54 0.70 10.26 175 BOUNCE_MESSAGE 1232 7.54 0.70 10.25 176 FILL_THIS_FORM 1216 0.38 0.69 0.25 177 LOW_PRICE 1203 0.28 0.68 0.12 178 RELAYCOUNTRY_AU 1199 0.55 0.68 0.50 179 HTML_IMAGE_ONLY_28 1181 0.50 0.67 0.43 180 BAYES_05 1167 1.23 0.66 1.46 181 HTML_FONT_SIZE_HUGE 1163 0.27 0.66 0.11 182 XMSubject_09 1140 0.24 0.65 0.07 183 XMMoneyMeta_00 1134 0.51 0.64 0.46 184 T_TooManySym_02 1124 1.40 0.64 1.71 185 FILL_THIS_FORM_LONG 1124 0.30 0.64 0.17 186 LONG_JUNK_URI3 1092 0.23 0.62 0.08 187 XM_Body_Obfu01 1085 0.43 0.61 0.36 188 RCVD_IN_DNSWL_BLOCKED 1080 0.90 0.61 1.01 189 DKIM_ADSP_CUSTOM_MED 1078 0.87 0.61 0.98 190 XM_RXBody 1076 0.28 0.61 0.14 191 XM_XX_Yahoo 1071 0.24 0.61 0.10 192 PP_MIME_FAKE_ASCII_TEXT 1050 0.32 0.59 0.21 193 URI_NOVOWEL 1048 0.43 0.59 0.37 194 FILL_THIS_FORM_LOAN 1047 0.27 0.59 0.14 195 XMBSHREFv2 1032 0.26 0.58 0.13 196 HTML_IMAGE_ONLY_24 1029 0.40 0.58 0.33 197 XMGppyBdWords 1028 0.25 0.58 0.12 198 RCVD_IN_MSPIKE_WL 1027 1.28 0.58 1.56 199 RCVD_IN_MSPIKE_H3 1027 1.28 0.58 1.55 200 XMSlimDrugH 1018 0.51 0.58 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 350264 82.75 92.62 78.83 2 DKIM_SIGNED 295295 71.98 85.86 66.45 3 XM_DK_Pass 287841 69.94 82.94 64.78 4 DCC_CHECK_NEGATIVE 281914 50.71 18.70 63.44 5 DKIM_VALID 280165 68.39 81.84 63.05 6 BAYES_50 255298 49.66 30.06 57.45 7 DKIM_VALID_AU 201098 50.40 63.35 45.26 8 XMListUnsubscribeExists 197587 53.06 74.68 44.47 9 DCC_CHECK 153016 47.16 79.16 34.44 10 XM_H_QuotedFrom 144485 39.14 55.81 32.52 11 T_TM2_M_HEADER_IN_MSG 134511 27.39 20.15 30.27 12 ALL_TRUSTED 102429 16.79 1.03 23.05 13 HTML_FONT_LOW_CONTRAST 101522 26.64 36.17 22.85 14 DKIM_VALID_EF 93742 20.53 19.12 21.10 15 XMSubLong 86202 21.42 26.50 19.40 16 FVGT_m_MULTI_ODD 84688 21.58 27.92 19.06 17 MultiRelay 83054 18.62 18.43 18.69 18 LOC_TINY_FONT_1 82029 23.08 34.68 18.46 19 MIME_HTML_ONLY 75654 19.52 25.79 17.03 20 XM_DK_Undo_02 58340 23.64 50.09 13.13 21 BAYES_99 53756 21.48 45.09 12.10 22 T_KAM_HTML_FONT_INVALID 50844 13.18 17.57 11.44 23 BAYES_00 50746 9.14 3.39 11.42 24 BAYES_999 47397 18.61 38.60 10.67 25 XM_Body_Dirty_Words 47352 13.37 20.19 10.66 26 XM_Multi_Part_URI 46525 12.23 16.65 10.47 27 ANY_BOUNCE_MESSAGE 45579 7.54 0.70 10.26 28 BOUNCE_MESSAGE 45566 7.54 0.70 10.25 29 XM_DKIMWhitelistDomains 42748 6.92 0.13 9.62 30 RCVD_IN_RP_SAFE 42521 8.62 6.22 9.57 31 T_XMDrugObfuBody_14 38366 9.04 10.07 8.63 32 TR_XM_DK_Bayes 37709 6.83 2.68 8.49 33 RCVD_IN_RP_CERTIFIED 36072 7.08 4.47 8.12 34 TR_XM_DK_Bayes1 35595 6.45 2.54 8.01 35 LotsOfNums_01 35105 8.64 10.51 7.90 36 TooManyTo_001 33523 7.52 7.46 7.54 37 XM_Evil_Numbers_Gen 32283 9.20 14.06 7.27 38 RCVD_IN_MSPIKE_H2 31949 6.84 5.97 7.19 39 HTML_IMAGE_RATIO_02 31844 10.04 17.26 7.17 40 TR_XM_DK_Bayes2 28271 5.17 2.16 6.36 41 TR_DCC_Bayes_99 26831 14.46 35.64 6.04 42 BAYES_60 26277 6.13 6.68 5.91 43 LOTS_OF_MONEY 26117 6.81 9.17 5.88 44 RELAYCOUNTRY_META 24677 8.88 17.25 5.55 45 IN_ZIMBRA_NJ_WHITELIST 24664 3.98 0.03 5.55 46 FSL_BULK_SIG 23668 6.61 9.83 5.33 47 XM_H_Long_From01 23047 5.96 7.92 5.19 48 HTML_IMAGE_RATIO_04 22450 6.17 8.97 5.05 49 MIME_QP_LONG_LINE 21577 4.77 4.54 4.86 50 RCVD_IN_IADB_LISTED 21369 4.03 2.08 4.81 51 XM_B_Phish_Phrases 21065 5.80 8.47 4.74 52 XM_SendGrid 20993 4.47 3.84 4.72 53 XMStrtUSub 19250 4.13 3.63 4.33 54 XMNumbers 18916 4.65 5.63 4.26 55 RCVD_IN_IADB_SPF 18735 3.54 1.85 4.22 56 XM_PDF 18723 3.22 0.72 4.21 57 T_TooManySym_01 18537 3.75 2.69 4.17 58 RCVD_IN_IADB_VOUCHED 16994 3.05 1.09 3.82 59 BOTNET_IPINHOSTNAME 16932 6.51 13.31 3.81 60 BAYES_80 16832 4.65 6.81 3.79 61 RCVD_IN_IADB_SENDERID 16636 3.18 1.76 3.74 62 TR_XM_DocInvoice 16385 5.10 8.65 3.69 63 T_REMOTE_IMAGE 16221 3.46 2.98 3.65 64 RCVD_IN_IADB_DK 16187 3.10 1.75 3.64 65 XM_UncommonTLD01 15891 5.37 9.87 3.58 66 XMSexyCombo_05 15842 5.10 8.96 3.57 67 DKIM_INVALID 15130 3.58 4.03 3.40 68 XMSubMetaSx_00 14615 3.85 5.27 3.29 69 TR_Symld_Words 14497 2.72 1.35 3.26 70 BAYES_40 14282 2.76 1.64 3.21 71 FROM_EXCESS_BASE64 13663 3.80 5.62 3.07 72 UNPARSEABLE_RELAY 13242 2.42 1.01 2.98 73 HTML_IMAGE_RATIO_06 12526 3.26 4.36 2.82 74 MAILING_LIST_MULTI 12464 2.54 1.87 2.80 75 RCVD_IN_DNSWL_NONE 11129 2.14 1.23 2.50 76 MPART_ALT_DIFF 11114 3.85 7.24 2.50 77 BAYES_95 10687 2.98 4.42 2.41 78 BAYES_20 9983 1.96 1.25 2.25 79 TooManyTo_002 9756 1.91 1.18 2.20 80 MIME_HTML_MOSTLY 9725 3.18 5.67 2.19 81 IN_HORDE_ADDRESS_BOOK 9580 1.56 0.07 2.16 82 HTML_MIME_NO_HTML_TAG 9116 1.98 1.81 2.05 83 HELO_NODOT 8783 1.48 0.25 1.98 84 TVD_RCVD_IP 8681 1.48 0.29 1.95 85 HTML_IMAGE_RATIO_08 8667 2.43 3.65 1.95 86 TM2_M_URI_OPT_OUT 8265 2.54 4.25 1.86 87 XM_SPF_SoftFail 7800 2.54 4.51 1.76 88 XM_CamelCaseFrm001 7784 2.17 3.21 1.75 89 T_TooManySym_02 7578 1.40 0.64 1.71 90 XM_DK_Undo_01 7478 1.70 1.75 1.68 91 XM_DIRTYINTL 6946 2.28 4.07 1.56 92 RCVD_IN_MSPIKE_WL 6910 1.28 0.58 1.56 93 RCVD_IN_MSPIKE_H3 6907 1.28 0.58 1.55 94 INVALID_MSGID 6843 1.23 0.45 1.54 95 RCVD_IN_IADB_OPTIN 6629 1.21 0.49 1.49 96 BAYES_05 6495 1.23 0.66 1.46 97 USER_IN_DEF_DKIM_WL 6273 1.03 0.07 1.41 98 SUBJ_ALL_CAPS 6175 1.62 2.20 1.39 99 RELAYCOUNTRY_CA 6170 1.87 3.08 1.39 100 TO_MALFORMED 6155 1.02 0.10 1.39 101 UNTRUSTED_Relay 6138 4.16 11.13 1.38 102 XM_H_PHPOS 6059 1.60 2.19 1.36 103 TooManyTo_003 5993 1.26 1.05 1.35 104 RELAYCOUNTRY_GB 5756 1.25 1.14 1.30 105 XMDiploma_00 5549 1.61 2.51 1.25 106 T_MIXED_ES 5529 1.48 2.08 1.24 107 SpammyFromTLD_01 5477 1.71 2.93 1.23 108 URI_TRY_3LD 5395 1.22 1.23 1.21 109 XM_GoogleGroups 5305 1.01 0.55 1.19 110 T_XMDrugObfuBody_08 5264 1.53 2.41 1.18 111 XMCapTrack 5207 1.00 0.57 1.17 112 URIBL_SBL_A 5195 1.13 1.04 1.17 113 MIME_HTML_ONLY_MULTI 4786 1.67 3.15 1.08 114 XM_OfRef6 4756 1.45 2.40 1.07 115 XMStockSpam_06 4587 1.09 1.22 1.03 116 XMPhish11 4564 0.99 0.90 1.03 117 RCVD_IN_DNSWL_BLOCKED 4500 0.90 0.61 1.01 118 DKIM_ADSP_CUSTOM_MED 4347 0.87 0.61 0.98 119 BOTNET 4306 4.26 12.55 0.97 120 XM_ProductURIs 4293 1.17 1.69 0.97 121 TooManyTo_004 4190 0.93 0.91 0.94 122 XM_H_Long_From02 4144 1.26 2.07 0.93 123 URI_HEX 3990 1.54 3.17 0.90 124 XMSexyCombo_01 3976 1.11 1.64 0.89 125 RCVD_IN_BL_SPAMCOP_NET 3824 1.86 4.37 0.86 126 XM_UB50 3686 1.88 4.51 0.83 127 XMGenDplmaNmb 3666 1.01 1.47 0.83 128 XMBdyGiftCard01 3629 1.32 2.57 0.82 129 T_TooManySym_03 3628 0.61 0.09 0.82 130 TooManyTo_005 3458 0.72 0.56 0.78 131 USER_IN_WHITELIST 3331 0.54 0.00 0.75 132 TM2_M_VERY_LONG_WORD 3319 1.15 2.17 0.75 133 XMSubMetaI_00 3268 1.12 2.08 0.74 134 NML_ADSP_CUSTOM_MED 3235 0.65 0.45 0.73 135 TM2_M_BODY_EMPTY 3090 0.96 1.62 0.70 136 XMNoVowels 3012 0.62 0.47 0.68 137 XMBrknScrpt_02 2990 0.70 0.77 0.67 138 RELAYCOUNTRY_DE 2912 0.77 1.05 0.66 139 XM_B_REG_HTML 2899 0.71 0.84 0.65 140 T_FILL_THIS_FORM_SHORT 2843 0.72 0.91 0.64 141 TR_MetaPhish_Combo_01 2788 0.61 0.57 0.63 142 XM_ShortIntro_01 2749 0.55 0.37 0.62 143 XM_H_PHPMailer 2642 0.58 0.55 0.59 144 HTML_FONT_FACE_BAD 2568 0.75 1.17 0.58 145 T_XMDrugObfuBody_12 2533 0.48 0.25 0.57 146 RCVD_IN_IADB_DOPTIN 2497 0.42 0.08 0.56 147 XMGappySubj_01 2423 0.50 0.38 0.55 148 XMBody_95 2404 0.43 0.15 0.54 149 T_XMHurry_00 2392 0.82 1.54 0.54 150 XMBody_78 2387 0.71 1.15 0.54 151 XM_B_TRADE_HTML 2339 0.54 0.56 0.53 152 SHORT_HELO_AND_INLINE_IMAGE 2282 0.38 0.05 0.51 153 RELAYCOUNTRY_AU 2242 0.55 0.68 0.50 154 TR_XM_RelayPhish 2226 0.78 1.50 0.50 155 RCVD_IN_SORBS_DUL 2208 0.41 0.18 0.50 156 XMSlimDrugH 2178 0.51 0.58 0.49 157 XM_S_JOY_D 2145 0.64 1.02 0.48 158 T_TooManySym_04 2131 0.35 0.03 0.48 159 T_XMDrugObfuBody_00 2110 0.68 1.19 0.47 160 XM_B_COPY_HTML 2094 0.55 0.75 0.47 161 XMMoneyMeta_00 2026 0.51 0.64 0.46 162 T_MONEY_PERCENT 1999 0.54 0.78 0.45 163 TR_LOTS_OF_MONEY2 1999 0.54 0.78 0.45 164 HTTPS_HTTP_MISMATCH 1991 0.54 0.76 0.45 165 MISSING_HEADERS 1985 0.41 0.32 0.45 166 PLING_QUERY 1965 0.65 1.16 0.44 167 HTML_IMAGE_ONLY_28 1925 0.50 0.67 0.43 168 T_OBFU_PDF_ATTACH 1913 0.34 0.13 0.43 169 XMBody_17 1876 0.76 1.60 0.42 170 HTML_IMAGE_ONLY_32 1874 0.40 0.36 0.42 171 T_Symld_Words_02 1860 0.62 1.12 0.42 172 XMLngstWrd_00 1847 0.44 0.49 0.42 173 XMEmptyBody_01 1830 0.74 1.55 0.41 174 REMOVE_BEFORE_LINK 1826 0.64 1.22 0.41 175 XMPhish30 1807 0.75 1.63 0.41 176 TR_LOTS_OF_MONEY3 1748 0.54 0.90 0.39 177 XMSubMetaSxObfu_02 1686 0.32 0.18 0.38 178 XMLngstWrd_01 1679 0.40 0.46 0.38 179 RDNS_DYNAMIC 1664 0.56 1.02 0.37 180 FORGED_GMAIL_RCVD 1649 0.40 0.47 0.37 181 BAD_ENC_HEADER 1640 0.27 0.04 0.37 182 URI_NOVOWEL 1629 0.43 0.59 0.37 183 XM_Body_Obfu01 1610 0.43 0.61 0.36 184 XM_H_Trusted_IP 1550 0.25 0.00 0.35 185 HTML_TAG_BALANCE_BODY 1483 0.47 0.80 0.33 186 TM2_M_A_HREF_HREF 1469 0.37 0.46 0.33 187 RELAYCOUNTRY_FR 1466 0.75 1.82 0.33 188 XMHTML_After_End 1452 0.52 1.00 0.33 189 HTML_IMAGE_ONLY_24 1450 0.40 0.58 0.33 190 XMHTMLBadTable_001 1449 0.44 0.72 0.33 191 SpammyFromTLD_02 1436 0.67 1.53 0.32 192 XMRcvdHeader_15 1382 0.22 0.00 0.31 193 XMLngstWrd_02 1379 0.34 0.40 0.31 194 XMDateMe_00 1374 0.30 0.28 0.31 195 AC_DIV_BONANZA 1353 0.25 0.12 0.30 196 XM_H_PHPOS_M 1342 0.32 0.36 0.30 197 XMSubNoVowel 1337 0.31 0.35 0.30 198 HTML_IMAGE_ONLY_20 1330 0.33 0.40 0.30 199 XM_Walgreens_Forge 1299 0.22 0.03 0.29 200 TVD_SPACE_RATIO 1276 0.27 0.24 0.29 ----------------------------------------------------------------------