Email: 776607 Autolearn: 0 AvgScore: 5.14 AvgScanTime: 4.13 sec Spam: 283654 Autolearn: 0 AvgScore: 13.39 AvgScanTime: 4.73 sec Ham: 492953 Autolearn: 0 AvgScore: 0.40 AvgScanTime: 3.79 sec Time Spent Running SA: 891.96 hours Time Spent Processing Spam: 372.70 hours Time Spent Processing Ham: 519.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 275064 90.40 96.97 86.61 2 DCC_CHECK 208368 46.30 73.46 30.68 3 DKIM_SIGNED 193621 65.55 68.26 63.99 4 XM_DK_Pass 188162 64.13 66.34 62.87 5 DKIM_VALID 176222 59.69 62.13 58.29 6 XMListUnsubscribeExists 165031 48.10 58.18 42.30 7 DKIM_VALID_AU 135534 43.28 47.78 40.70 8 XM_H_QuotedFrom 123107 35.66 43.40 31.21 9 MIME_HTML_ONLY 122287 26.02 43.11 16.19 10 XM_DK_Undo_02 109169 21.19 38.49 11.23 11 BAYES_99 101798 19.94 35.89 10.77 12 BAYES_50 88750 50.14 31.29 61.00 13 RELAYCOUNTRY_META 88501 14.33 31.20 4.62 14 BAYES_999 84686 16.83 29.86 9.33 15 HTML_FONT_LOW_CONTRAST 83512 25.53 29.44 23.28 16 LOC_TINY_FONT_1 80791 22.16 28.48 18.51 17 TR_DCC_Bayes_99 79087 13.20 27.88 4.75 18 UNTRUSTED_Relay 73599 10.23 25.95 1.19 19 XMSubLong 73097 20.38 25.77 17.29 20 DCC_CHECK_NEGATIVE 71590 52.03 25.24 67.44 21 FROM_EXCESS_BASE64 67286 10.46 23.72 2.83 22 T_REMOTE_IMAGE 64221 10.88 22.64 4.12 23 FVGT_m_MULTI_ODD 61954 21.22 21.84 20.86 24 HTML_MIME_NO_HTML_TAG 60225 9.03 21.23 2.01 25 FSL_BULK_SIG 58074 11.03 20.47 5.59 26 BODY_URI_ONLY 57648 7.46 20.32 0.05 27 RELAYCOUNTRY_NL 56295 7.36 19.85 0.18 28 MISSING_HEADERS 56217 7.59 19.82 0.55 29 MIME_HEADER_CTYPE_ONLY 55795 7.27 19.67 0.14 30 HTML_SHORT_LINK_IMG_1 53778 10.25 18.96 5.23 31 DKIM_VALID_EF 52756 22.12 18.60 24.15 32 T_TM2_M_HEADER_IN_MSG 51852 25.97 18.28 30.40 33 XM_Body_Dirty_Words 48095 12.36 16.96 9.71 34 T_KAM_HTML_FONT_INVALID 47629 15.10 16.79 14.13 35 URI_BUFFLY 40734 7.77 14.36 3.98 36 XM_Multi_Part_URI 39264 11.21 13.84 9.70 37 MultiRelay 37687 15.63 13.29 16.98 38 HTML_IMAGE_ONLY_08 36049 6.76 12.71 3.34 39 HTML_IMAGE_RATIO_02 35212 8.28 12.41 5.91 40 XM_Evil_Numbers_Gen 33727 8.70 11.89 6.86 41 XMNumbers 29869 5.74 10.53 2.98 42 BAYES_60 29604 8.31 10.44 7.09 43 BOTNET_IPINHOSTNAME 29315 6.49 10.33 4.28 44 BAYES_80 29144 6.22 10.27 3.88 45 BOTNET 28617 4.24 10.09 0.88 46 LOTS_OF_MONEY 25898 8.12 9.13 7.54 47 XMSexyCombo_05 23704 4.39 8.36 2.10 48 HTML_IMAGE_RATIO_04 23288 5.58 8.21 4.07 49 XM_UncommonTLD01 21850 4.71 7.70 2.99 50 T_XMDrugObfuBody_14 21791 7.17 7.68 6.88 51 BAYES_95 20907 4.36 7.37 2.62 52 TooManyTo_001 20753 8.15 7.32 8.63 53 XM_B_Phish_Phrases 19727 4.99 6.95 3.87 54 LotsOfNums_01 18840 7.90 6.64 8.62 55 XM_H_Long_From01 18793 5.98 6.63 5.61 56 HTML_IMAGE_ONLY_04 18163 3.62 6.40 2.03 57 XM_UB60 17911 2.36 6.31 0.08 58 XM_UB50 17620 2.76 6.21 0.77 59 DKIM_INVALID 17399 5.86 6.13 5.71 60 TR_XM_DocInvoice 16337 4.24 5.76 3.36 61 XMSubMetaSx_00 16144 4.56 5.69 3.90 62 MPART_ALT_DIFF 14636 3.79 5.16 3.00 63 XM_UB80 13847 1.81 4.88 0.04 64 SHORTENED_URL_SRC 13266 2.30 4.68 0.94 65 SHORTENER_SHORT_IMG 13234 2.30 4.67 0.94 66 SpammyFromTLD_02 12479 1.77 4.40 0.25 67 XM_UB95 11600 1.51 4.09 0.02 68 RCVD_IN_RP_SAFE 10931 5.66 3.85 6.69 69 HTML_IMAGE_RATIO_06 10659 3.47 3.76 3.30 70 MIME_QP_LONG_LINE 10477 5.15 3.69 5.99 71 DIET_1 10400 1.68 3.67 0.54 72 TM2_M_URI_OPT_OUT 9961 2.90 3.51 2.55 73 XMStrtUSub 9604 3.28 3.39 3.22 74 XM_SendGrid 9563 3.92 3.37 4.24 75 T_TooManySym_01 9375 3.44 3.31 3.51 76 MIME_HTML_MOSTLY 9298 2.66 3.28 2.30 77 ALL_TRUSTED 9109 17.63 3.21 25.92 78 XM_DIRTYINTL 9089 2.14 3.20 1.53 79 XM_SPF_SoftFail 9018 2.30 3.18 1.79 80 HTML_SHORT_CENTER 8776 1.74 3.09 0.97 81 XM_CamelCaseFrm001 8525 2.13 3.01 1.63 82 RCVD_IN_MSPIKE_H2 8423 3.78 2.97 4.25 83 RCVD_IN_RP_CERTIFIED 8235 4.89 2.90 6.04 84 RCVD_IN_BL_SPAMCOP_NET 7809 1.32 2.75 0.49 85 XM_UB99 7806 1.02 2.75 0.02 86 HTML_IMAGE_RATIO_08 7548 2.29 2.66 2.07 87 URI_HEX 7420 1.86 2.62 1.42 88 MIME_HTML_ONLY_MULTI 7115 1.87 2.51 1.51 89 T_HTML_TAG_BALANCE_CENTER 7054 1.41 2.49 0.78 90 XM_OfRef6 6771 1.77 2.39 1.42 91 RELAYCOUNTRY_CA 6474 1.67 2.28 1.33 92 XMDiploma_00 6276 1.91 2.21 1.74 93 TooManyTo_002 6248 2.83 2.20 3.19 94 MultiRelay_CC 6022 0.90 2.12 0.19 95 MultiRelay_Combo 6022 0.90 2.12 0.19 96 TooManyTo_003 5977 2.27 2.11 2.37 97 XM_URI_RBL 5843 0.81 2.06 0.10 98 HTML_IMAGE_ONLY_16 5809 1.30 2.05 0.87 99 RCVD_IN_IADB_LISTED 5403 4.31 1.90 5.69 100 HTML_SHORT_LINK_IMG_2 5402 1.11 1.90 0.66 101 XMSlimDrugH 5158 0.86 1.82 0.31 102 T_XMDrugObfuBody_08 5088 1.63 1.79 1.54 103 RCVD_IN_RP_RNBL 5062 0.68 1.78 0.04 104 TooManyTo_004 5036 1.38 1.78 1.16 105 TR_Symld_Words 5034 1.79 1.77 1.79 106 XMNoVowels 5007 2.29 1.77 2.59 107 XMHTML_After_End 4916 0.92 1.73 0.45 108 SUBJ_ALL_CAPS 4896 1.53 1.73 1.42 109 RCVD_IN_IADB_SPF 4797 3.76 1.69 4.95 110 HTML_FONT_SIZE_LARGE 4789 0.94 1.69 0.51 111 XM_JunkDunk 4760 0.61 1.68 0.00 112 TooManyTo_005 4733 1.22 1.67 0.96 113 XM_UB999 4710 0.62 1.66 0.02 114 RCVD_IN_IADB_SENDERID 4546 3.33 1.60 4.33 115 FORGED_MUA_MOZILLA 4517 0.77 1.59 0.30 116 RCVD_IN_IADB_DK 4516 3.27 1.59 4.23 117 XMSexyCombo_01 4508 0.87 1.59 0.45 118 URIBL_BLACK 4255 0.58 1.50 0.06 119 TM2_M_VERY_LONG_WORD 4213 1.06 1.49 0.81 120 ANY_BOUNCE_MESSAGE 4165 8.22 1.47 12.11 121 BOUNCE_MESSAGE 4163 8.22 1.47 12.11 122 XMBody_17 4037 0.80 1.42 0.43 123 BOTNET_NORDNS 3836 0.50 1.35 0.02 124 XMGenDplmaNmb 3825 1.13 1.35 1.00 125 XM_BadFromFormat 3824 0.62 1.35 0.20 126 XMSubMetaI_00 3811 0.75 1.34 0.41 127 BAYES_40 3713 2.82 1.31 3.70 128 NO_DNS_FOR_FROM 3700 0.89 1.30 0.65 129 XMBdyGiftCard01 3698 0.84 1.30 0.57 130 SpammyFromTLD_01 3637 0.90 1.28 0.68 131 BAYES_00 3590 4.78 1.27 6.81 132 XM_H_Long_From02 3474 0.94 1.22 0.78 133 MAILING_LIST_MULTI 3361 1.92 1.18 2.34 134 XMWghtMeta_00 3360 0.44 1.18 0.01 135 T_XMDrugObfuBody_00 3349 0.79 1.18 0.57 136 FVGT_m_MULTI_ODD_EMAIL 3240 0.45 1.14 0.06 137 RELAYCOUNTRY_FR 3217 0.58 1.13 0.27 138 XMStockSpam_06 3178 0.83 1.12 0.67 139 XM_DK_Undo_01 3177 1.54 1.12 1.78 140 BAYES_20 3080 1.97 1.09 2.48 141 URI_TRY_3LD 3035 1.05 1.07 1.04 142 RELAYCOUNTRY_GB 2992 0.96 1.05 0.91 143 XMSubject_48 2938 0.40 1.04 0.03 144 XM_HighProb1 2910 0.38 1.03 0.01 145 TR_XM_RelayPhish 2898 0.65 1.02 0.43 146 URIBL_DBL_SPAM 2797 0.38 0.99 0.03 147 HTML_FONT_FACE_BAD 2762 0.63 0.97 0.43 148 XM_ArrestRecordFrm03 2741 0.35 0.97 0.00 149 T_XMHurry_00 2662 0.59 0.94 0.39 150 XMPhish30 2629 0.52 0.93 0.28 151 XMLongAddy 2622 0.39 0.92 0.09 152 XM_ProductURIs 2573 0.94 0.91 0.97 153 XMHTMLBadTable_001 2560 0.56 0.90 0.37 154 XMBody_78 2536 0.59 0.89 0.41 155 XMMoneyMeta_00 2536 0.62 0.89 0.46 156 TR_XM_DK_Bayes 2527 2.88 0.89 4.03 157 DKIM_ADSP_CUSTOM_MED 2488 1.00 0.88 1.07 158 UNPARSEABLE_RELAY 2481 2.58 0.87 3.56 159 XMPhish11 2476 1.12 0.87 1.26 160 XMSubject_09 2468 0.32 0.87 0.01 161 XMSlimDrugs 2468 0.33 0.87 0.02 162 T_TooManySym_02 2424 1.26 0.85 1.50 163 XM_H_PHPOS 2411 1.46 0.85 1.82 164 XMPhish14 2392 0.47 0.84 0.26 165 SUBJ_DOLLARS 2373 0.41 0.84 0.16 166 TR_Mismatch_TLD_02 2371 0.34 0.84 0.06 167 DKIM_ADSP_NXDOMAIN 2368 0.46 0.83 0.25 168 RCVD_IN_IADB_VOUCHED 2364 2.74 0.83 3.84 169 T_FILL_THIS_FORM_SHORT 2356 0.83 0.83 0.83 170 PLING_QUERY 2356 0.48 0.83 0.28 171 TR_XM_DK_Bayes1 2351 2.53 0.83 3.50 172 BAYES_05 2321 1.33 0.82 1.62 173 T_MONEY_PERCENT 2310 0.46 0.81 0.26 174 TR_LOTS_OF_MONEY2 2310 0.46 0.81 0.26 175 TR_LOTS_OF_MONEY3 2253 0.47 0.79 0.28 176 FORGED_GMAIL_RCVD 2247 0.69 0.79 0.63 177 XMSexyCombo_04 2200 0.33 0.78 0.07 178 RELAYCOUNTRY_CN 2172 0.31 0.77 0.05 179 TR_XM_DK_Bayes2 2171 2.06 0.77 2.80 180 RELAYCOUNTRY_AT 2153 0.35 0.76 0.12 181 XMBrknScrpt_02 2117 0.53 0.75 0.40 182 NML_ADSP_CUSTOM_MED 2113 0.80 0.74 0.83 183 HTML_TAG_BALANCE_BODY 2101 0.55 0.74 0.45 184 MPART_ALT_DIFF_COUNT 2066 0.88 0.73 0.97 185 XM_B_REG_HTML 2050 0.44 0.72 0.28 186 HTTPS_HTTP_MISMATCH 2031 0.51 0.72 0.39 187 XM_RXBody 1903 0.29 0.67 0.08 188 XM_PDF 1893 2.91 0.67 4.19 189 RELAYCOUNTRY_AU 1890 0.54 0.67 0.47 190 REMOVE_BEFORE_LINK 1873 0.46 0.66 0.35 191 FILL_THIS_FORM 1871 0.49 0.66 0.39 192 T_Symld_Words_02 1863 0.64 0.66 0.63 193 RDNS_DYNAMIC 1835 0.53 0.65 0.46 194 XM_Body_Obfu01 1826 0.41 0.64 0.27 195 KHOP_DYNAMIC 1796 0.64 0.63 0.64 196 RELAYCOUNTRY_DE 1751 0.50 0.62 0.43 197 LongTLD 1743 0.33 0.61 0.17 198 RCVD_IN_MSPIKE_WL 1717 1.42 0.61 1.89 199 RCVD_IN_MSPIKE_H3 1706 1.42 0.60 1.89 200 XMClaimOffer 1676 0.29 0.59 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 426960 90.40 96.97 86.61 2 DCC_CHECK_NEGATIVE 332453 52.03 25.24 67.44 3 DKIM_SIGNED 315445 65.55 68.26 63.99 4 XM_DK_Pass 309900 64.13 66.34 62.87 5 BAYES_50 300679 50.14 31.29 61.00 6 DKIM_VALID 287319 59.69 62.13 58.29 7 XMListUnsubscribeExists 208504 48.10 58.18 42.30 8 DKIM_VALID_AU 200614 43.28 47.78 40.70 9 XM_H_QuotedFrom 153833 35.66 43.40 31.21 10 DCC_CHECK 151218 46.30 73.46 30.68 11 T_TM2_M_HEADER_IN_MSG 149837 25.97 18.28 30.40 12 ALL_TRUSTED 127794 17.63 3.21 25.92 13 DKIM_VALID_EF 119060 22.12 18.60 24.15 14 HTML_FONT_LOW_CONTRAST 114741 25.53 29.44 23.28 15 FVGT_m_MULTI_ODD 102852 21.22 21.84 20.86 16 LOC_TINY_FONT_1 91270 22.16 28.48 18.51 17 XMSubLong 85211 20.38 25.77 17.29 18 MultiRelay 83728 15.63 13.29 16.98 19 MIME_HTML_ONLY 79791 26.02 43.11 16.19 20 T_KAM_HTML_FONT_INVALID 69671 15.10 16.79 14.13 21 ANY_BOUNCE_MESSAGE 59698 8.22 1.47 12.11 22 BOUNCE_MESSAGE 59697 8.22 1.47 12.11 23 XM_DK_Undo_02 55373 21.19 38.49 11.23 24 BAYES_99 53089 19.94 35.89 10.77 25 XM_Body_Dirty_Words 47867 12.36 16.96 9.71 26 XM_Multi_Part_URI 47793 11.21 13.84 9.70 27 BAYES_999 45990 16.83 29.86 9.33 28 TooManyTo_001 42540 8.15 7.32 8.63 29 LotsOfNums_01 42494 7.90 6.64 8.62 30 XM_DKIMWhitelistDomains 39765 5.14 0.05 8.07 31 LOTS_OF_MONEY 37183 8.12 9.13 7.54 32 BAYES_60 34931 8.31 10.44 7.09 33 T_XMDrugObfuBody_14 33909 7.17 7.68 6.88 34 XM_Evil_Numbers_Gen 33827 8.70 11.89 6.86 35 BAYES_00 33565 4.78 1.27 6.81 36 RCVD_IN_RP_SAFE 33003 5.66 3.85 6.69 37 RCVD_IN_RP_CERTIFIED 29775 4.89 2.90 6.04 38 MIME_QP_LONG_LINE 29521 5.15 3.69 5.99 39 HTML_IMAGE_RATIO_02 29114 8.28 12.41 5.91 40 DKIM_INVALID 28126 5.86 6.13 5.71 41 RCVD_IN_IADB_LISTED 28056 4.31 1.90 5.69 42 XM_H_Long_From01 27673 5.98 6.63 5.61 43 FSL_BULK_SIG 27561 11.03 20.47 5.59 44 HTML_SHORT_LINK_IMG_1 25800 10.25 18.96 5.23 45 RCVD_IN_IADB_SPF 24403 3.76 1.69 4.95 46 IN_ZIMBRA_NJ_WHITELIST 24363 3.15 0.03 4.94 47 TR_DCC_Bayes_99 23406 13.20 27.88 4.75 48 RELAYCOUNTRY_META 22765 14.33 31.20 4.62 49 RCVD_IN_IADB_SENDERID 21344 3.33 1.60 4.33 50 BOTNET_IPINHOSTNAME 21087 6.49 10.33 4.28 51 RCVD_IN_MSPIKE_H2 20946 3.78 2.97 4.25 52 XM_SendGrid 20916 3.92 3.37 4.24 53 RCVD_IN_IADB_DK 20875 3.27 1.59 4.23 54 XM_PDF 20674 2.91 0.67 4.19 55 T_REMOTE_IMAGE 20289 10.88 22.64 4.12 56 HTML_IMAGE_RATIO_04 20056 5.58 8.21 4.07 57 TR_XM_DK_Bayes 19867 2.88 0.89 4.03 58 URI_BUFFLY 19620 7.77 14.36 3.98 59 XMSubMetaSx_00 19234 4.56 5.69 3.90 60 BAYES_80 19151 6.22 10.27 3.88 61 XM_B_Phish_Phrases 19061 4.99 6.95 3.87 62 RCVD_IN_IADB_VOUCHED 18908 2.74 0.83 3.84 63 BAYES_40 18218 2.82 1.31 3.70 64 UNPARSEABLE_RELAY 17546 2.58 0.87 3.56 65 T_TooManySym_01 17306 3.44 3.31 3.51 66 TR_XM_DK_Bayes1 17259 2.53 0.83 3.50 67 TR_XM_DocInvoice 16561 4.24 5.76 3.36 68 HTML_IMAGE_ONLY_08 16455 6.76 12.71 3.34 69 HTML_IMAGE_RATIO_06 16268 3.47 3.76 3.30 70 XMStrtUSub 15849 3.28 3.39 3.22 71 TooManyTo_002 15731 2.83 2.20 3.19 72 TVD_RCVD_IP 15556 2.09 0.25 3.16 73 MPART_ALT_DIFF 14764 3.79 5.16 3.00 74 XM_UncommonTLD01 14719 4.71 7.70 2.99 75 XMNumbers 14706 5.74 10.53 2.98 76 FROM_EXCESS_BASE64 13968 10.46 23.72 2.83 77 TR_XM_DK_Bayes2 13807 2.06 0.77 2.80 78 BAYES_95 12923 4.36 7.37 2.62 79 XMNoVowels 12744 2.29 1.77 2.59 80 TM2_M_URI_OPT_OUT 12572 2.90 3.51 2.55 81 BAYES_20 12202 1.97 1.09 2.48 82 RCVD_IN_IADB_OPTIN 12075 1.74 0.51 2.45 83 TooManyTo_003 11663 2.27 2.11 2.37 84 MAILING_LIST_MULTI 11527 1.92 1.18 2.34 85 MIME_HTML_MOSTLY 11336 2.66 3.28 2.30 86 XMSexyCombo_05 10358 4.39 8.36 2.10 87 HTML_IMAGE_RATIO_08 10203 2.29 2.66 2.07 88 HTML_IMAGE_ONLY_04 9985 3.62 6.40 2.03 89 HTML_MIME_NO_HTML_TAG 9898 9.03 21.23 2.01 90 HELO_NODOT 9334 1.29 0.25 1.89 91 RCVD_IN_MSPIKE_WL 9310 1.42 0.61 1.89 92 RCVD_IN_MSPIKE_H3 9294 1.42 0.60 1.89 93 XM_H_PHPOS 8957 1.46 0.85 1.82 94 TR_Symld_Words 8838 1.79 1.77 1.79 95 XM_SPF_SoftFail 8807 2.30 3.18 1.79 96 XM_DK_Undo_01 8772 1.54 1.12 1.78 97 IN_HORDE_ADDRESS_BOOK 8612 1.12 0.04 1.75 98 XMDiploma_00 8587 1.91 2.21 1.74 99 XM_CamelCaseFrm001 8036 2.13 3.01 1.63 100 BAYES_05 7971 1.33 0.82 1.62 101 USER_IN_DEF_DKIM_WL 7767 1.01 0.03 1.58 102 T_XMDrugObfuBody_08 7578 1.63 1.79 1.54 103 XM_DIRTYINTL 7554 2.14 3.20 1.53 104 MIME_HTML_ONLY_MULTI 7435 1.87 2.51 1.51 105 XMCapTrack 7424 1.11 0.41 1.51 106 T_TooManySym_02 7375 1.26 0.85 1.50 107 URI_HEX 7004 1.86 2.62 1.42 108 SUBJ_ALL_CAPS 6988 1.53 1.73 1.42 109 XM_OfRef6 6986 1.77 2.39 1.42 110 INVALID_MSGID 6981 0.95 0.14 1.42 111 XMLngstWrd_00 6911 1.02 0.37 1.40 112 RELAYCOUNTRY_CA 6532 1.67 2.28 1.33 113 TO_MALFORMED 6525 0.84 0.01 1.32 114 XMPhish11 6220 1.12 0.87 1.26 115 XM_GoogleGroups 5995 0.89 0.33 1.22 116 UNTRUSTED_Relay 5866 10.23 25.95 1.19 117 XMLngstWrd_01 5850 0.87 0.33 1.19 118 TooManyTo_004 5716 1.38 1.78 1.16 119 DKIM_ADSP_CUSTOM_MED 5265 1.00 0.88 1.07 120 URI_TRY_3LD 5142 1.05 1.07 1.04 121 TO_NO_BRKTS_HTML_ONLY 5067 0.69 0.11 1.03 122 XMGenDplmaNmb 4930 1.13 1.35 1.00 123 MPART_ALT_DIFF_COUNT 4790 0.88 0.73 0.97 124 HTML_SHORT_CENTER 4771 1.74 3.09 0.97 125 XM_ProductURIs 4764 0.94 0.91 0.97 126 TooManyTo_005 4714 1.22 1.67 0.96 127 SHORTENED_URL_SRC 4634 2.30 4.68 0.94 128 SHORTENER_SHORT_IMG 4614 2.30 4.67 0.94 129 RELAYCOUNTRY_GB 4472 0.96 1.05 0.91 130 XMGappySubj_01 4431 0.68 0.29 0.90 131 BOTNET 4343 4.24 10.09 0.88 132 HTML_IMAGE_ONLY_16 4295 1.30 2.05 0.87 133 T_FILL_THIS_FORM_SHORT 4116 0.83 0.83 0.83 134 NML_ADSP_CUSTOM_MED 4072 0.80 0.74 0.83 135 TM2_M_VERY_LONG_WORD 3999 1.06 1.49 0.81 136 T_HTML_TAG_BALANCE_CENTER 3859 1.41 2.49 0.78 137 XM_H_Long_From02 3851 0.94 1.22 0.78 138 XM_UB50 3788 2.76 6.21 0.77 139 XMLngstWrd_02 3392 0.53 0.26 0.69 140 TR_MetaPhish_Combo_01 3381 0.63 0.52 0.69 141 T_TooManySym_03 3364 0.52 0.23 0.68 142 SpammyFromTLD_01 3356 0.90 1.28 0.68 143 XMStockSpam_06 3280 0.83 1.12 0.67 144 HTML_SHORT_LINK_IMG_2 3240 1.11 1.90 0.66 145 NO_DNS_FOR_FROM 3184 0.89 1.30 0.65 146 KHOP_DYNAMIC 3173 0.64 0.63 0.64 147 T_Symld_Words_02 3127 0.64 0.66 0.63 148 FORGED_GMAIL_RCVD 3118 0.69 0.79 0.63 149 USER_IN_WHITELIST 3106 0.40 0.00 0.63 150 XM_H_PHPMailer 2955 0.56 0.50 0.60 151 XM_ShortIntro_01 2950 0.49 0.30 0.60 152 XMBdyGiftCard01 2827 0.84 1.30 0.57 153 T_XMDrugObfuBody_00 2818 0.79 1.18 0.57 154 XMGappySubj_02 2766 0.37 0.02 0.56 155 MISSING_HEADERS 2715 7.59 19.82 0.55 156 T_OBFU_PDF_ATTACH 2663 0.41 0.18 0.54 157 DIET_1 2660 1.68 3.67 0.54 158 HTML_IMAGE_ONLY_32 2646 0.45 0.30 0.54 159 SHORT_HELO_AND_INLINE_IMAGE 2578 0.36 0.07 0.52 160 HTML_FONT_SIZE_LARGE 2498 0.94 1.69 0.51 161 XMSubMetaSxObfu_02 2477 0.39 0.21 0.50 162 XMBody_95 2449 0.35 0.11 0.50 163 RCVD_IN_BL_SPAMCOP_NET 2415 1.32 2.75 0.49 164 RELAYCOUNTRY_AU 2294 0.54 0.67 0.47 165 XMMoneyMeta_00 2260 0.62 0.89 0.46 166 RDNS_DYNAMIC 2255 0.53 0.65 0.46 167 XMSexyCombo_01 2239 0.87 1.59 0.45 168 XMHTML_After_End 2219 0.92 1.73 0.45 169 HTML_TAG_BALANCE_BODY 2198 0.55 0.74 0.45 170 RCVD_IN_SORBS_DUL 2165 0.36 0.21 0.44 171 XMDateMe_00 2143 0.40 0.33 0.43 172 XMBody_17 2140 0.80 1.42 0.43 173 TR_XM_RelayPhish 2134 0.65 1.02 0.43 174 HTML_FONT_FACE_BAD 2124 0.63 0.97 0.43 175 RELAYCOUNTRY_DE 2121 0.50 0.62 0.43 176 TM2_M_BODY_EMPTY 2077 0.37 0.28 0.42 177 TM2_M_A_HREF_HREF 2076 0.44 0.46 0.42 178 XMSubNoVowel 2073 0.36 0.26 0.42 179 XMLngstWrd_03 2065 0.34 0.19 0.42 180 XMBody_78 2036 0.59 0.89 0.41 181 XMSubMetaI_00 2019 0.75 1.34 0.41 182 URI_NOVOWEL 1992 0.46 0.54 0.40 183 XMBrknScrpt_02 1987 0.53 0.75 0.40 184 T_XMHurry_00 1941 0.59 0.94 0.39 185 HTTPS_HTTP_MISMATCH 1931 0.51 0.72 0.39 186 FILL_THIS_FORM 1909 0.49 0.66 0.39 187 XMSubMetaSxObfu_03 1900 0.43 0.50 0.39 188 XMSolicitRefs_0 1833 0.36 0.34 0.37 189 XMHTMLBadTable_001 1813 0.56 0.90 0.37 190 HTML_IMAGE_ONLY_24 1804 0.37 0.37 0.37 191 HTML_IMAGE_ONLY_28 1786 0.39 0.45 0.36 192 XM_B_COPY_HTML 1728 0.41 0.51 0.35 193 REMOVE_BEFORE_LINK 1726 0.46 0.66 0.35 194 AC_DIV_BONANZA 1662 0.24 0.07 0.34 195 XM_H_PHPOS_M 1584 0.32 0.31 0.32 196 XMLKML 1576 0.20 0.00 0.32 197 XMSubMetaSx_01 1531 0.32 0.33 0.31 198 HTML_IMAGE_ONLY_20 1508 0.36 0.45 0.31 199 XMSlimDrugH 1508 0.86 1.82 0.31 200 XM_USANA_RCVD 1480 0.19 0.00 0.30 ----------------------------------------------------------------------