Email: 742063 Autolearn: 0 AvgScore: 5.08 AvgScanTime: 4.08 sec Spam: 259656 Autolearn: 0 AvgScore: 15.15 AvgScanTime: 4.92 sec Ham: 482407 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 3.63 sec Time Spent Running SA: 841.81 hours Time Spent Processing Spam: 355.09 hours Time Spent Processing Ham: 486.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 250618 89.94 96.52 86.39 2 DCC_CHECK 182940 45.87 70.45 32.64 3 DKIM_SIGNED 178117 65.04 68.60 63.13 4 XM_DK_Pass 173442 63.75 66.80 62.12 5 DKIM_VALID 164293 59.96 63.27 58.18 6 XMListUnsubscribeExists 153368 47.30 59.07 40.97 7 DKIM_VALID_AU 125868 42.85 48.47 39.82 8 XM_H_QuotedFrom 117354 38.30 45.20 34.59 9 MIME_HTML_ONLY 107327 28.45 41.33 21.52 10 XM_DK_Undo_02 101128 21.32 38.95 11.84 11 BAYES_99 94728 20.19 36.48 11.42 12 BAYES_999 80218 17.25 30.89 9.90 13 BAYES_50 79129 47.37 30.47 56.46 14 HTML_FONT_LOW_CONTRAST 78683 26.58 30.30 24.58 15 LOC_TINY_FONT_1 78056 22.47 30.06 18.39 16 TR_DCC_Bayes_99 74974 13.71 28.87 5.55 17 DCC_CHECK_NEGATIVE 73392 52.57 28.27 65.66 18 RELAYCOUNTRY_META 71381 12.35 27.49 4.20 19 XMSubLong 70217 21.06 27.04 17.84 20 BOTNET 65517 9.44 25.23 0.95 21 BOTNET_IPINHOSTNAME 63790 11.49 24.57 4.45 22 UNTRUSTED_Relay 58196 8.51 22.41 1.02 23 FVGT_m_MULTI_ODD 57854 20.46 22.28 19.48 24 FROM_EXCESS_BASE64 50466 9.30 19.44 3.85 25 HTML_SHORT_LINK_IMG_1 50134 8.52 19.31 2.72 26 DKIM_VALID_EF 49358 21.78 19.01 23.27 27 SHORTENED_URL_SRC 49284 8.38 18.98 2.68 28 SHORTENER_SHORT_IMG 49202 8.37 18.95 2.67 29 T_REMOTE_IMAGE 48924 9.20 18.84 4.01 30 URI_BUFFLY 47153 8.09 18.16 2.67 31 T_TM2_M_HEADER_IN_MSG 46343 24.26 17.85 27.71 32 T_KAM_HTML_FONT_INVALID 44706 14.83 17.22 13.54 33 HTML_MIME_NO_HTML_TAG 44648 7.13 17.20 1.71 34 BODY_URI_ONLY 44060 5.98 16.97 0.06 35 FSL_BULK_SIG 43464 11.01 16.74 7.92 36 MISSING_HEADERS 41731 5.96 16.07 0.52 37 XM_Body_Dirty_Words 41349 12.34 15.92 10.41 38 MultiRelay 41111 16.39 15.83 16.69 39 HTML_IMAGE_ONLY_08 40907 6.69 15.75 1.81 40 MIME_HEADER_CTYPE_ONLY 40470 5.53 15.59 0.11 41 XM_Multi_Part_URI 38473 11.80 14.82 10.17 42 HTML_IMAGE_RATIO_02 37066 9.13 14.28 6.37 43 RELAYCOUNTRY_TH 36015 4.86 13.87 0.01 44 BAYES_80 32862 7.10 12.66 4.11 45 XM_Evil_Numbers_Gen 29344 8.54 11.30 7.05 46 LOTS_OF_MONEY 27073 9.66 10.43 9.24 47 BAYES_60 24169 7.44 9.31 6.44 48 XMSexyCombo_05 23323 5.14 8.98 3.07 49 XM_UncommonTLD01 22263 4.89 8.57 2.90 50 T_XMDrugObfuBody_14 20990 7.85 8.08 7.72 51 HTML_IMAGE_RATIO_04 19986 6.22 7.70 5.42 52 LotsOfNums_01 19363 7.88 7.46 8.11 53 XM_B_Phish_Phrases 19351 7.25 7.45 7.14 54 XMNumbers 18918 4.50 7.29 3.00 55 BAYES_95 18063 4.16 6.96 2.66 56 XM_H_Long_From01 17889 5.68 6.89 5.02 57 XM_UB80 17683 2.40 6.81 0.02 58 MPART_ALT_DIFF 16014 7.14 6.17 7.66 59 TR_XM_DocInvoice 16008 5.60 6.17 5.30 60 XMSubMetaSx_00 15745 4.24 6.06 3.25 61 TooManyTo_001 15382 6.86 5.92 7.37 62 SpammyFromTLD_02 14857 2.20 5.72 0.31 63 DKIM_INVALID 13824 5.08 5.32 4.95 64 XM_SPF_SoftFail 13665 3.15 5.26 2.01 65 XM_UB60 13271 1.84 5.11 0.08 66 HTML_IMAGE_RATIO_06 11771 3.70 4.53 3.26 67 RCVD_IN_RP_SAFE 11402 6.08 4.39 6.98 68 XMNoVowels 11156 3.04 4.30 2.36 69 MIME_HTML_MOSTLY 10965 3.07 4.22 2.45 70 HTML_FONT_SIZE_LARGE 10773 1.90 4.15 0.69 71 XM_UB50 10772 1.88 4.15 0.66 72 XM_SendGrid 10648 4.31 4.10 4.43 73 ALL_TRUSTED 10181 15.79 3.92 22.18 74 MIME_QP_LONG_LINE 9590 4.71 3.69 5.26 75 HTML_IMAGE_ONLY_04 9577 1.96 3.69 1.04 76 URI_HEX 9539 2.29 3.67 1.55 77 XM_DIRTYINTL 9479 2.27 3.65 1.53 78 XMStrtUSub 9395 3.49 3.62 3.43 79 XM_UB95 9153 1.24 3.53 0.01 80 DIET_1 9079 1.41 3.50 0.29 81 ANY_BOUNCE_MESSAGE 8993 7.69 3.46 9.96 82 BOUNCE_MESSAGE 8993 7.69 3.46 9.96 83 TM2_M_URI_OPT_OUT 8789 5.72 3.38 6.98 84 RCVD_IN_RP_CERTIFIED 8000 5.00 3.08 6.04 85 RCVD_IN_MSPIKE_H2 7971 3.78 3.07 4.17 86 XM_CamelCaseFrm001 7964 2.02 3.07 1.45 87 XMDiploma_00 7761 2.39 2.99 2.07 88 MIME_HTML_ONLY_MULTI 7469 4.94 2.88 6.05 89 T_TooManySym_01 7295 3.27 2.81 3.51 90 XM_OfRef6 6308 1.70 2.43 1.31 91 RELAYCOUNTRY_CA 6040 1.60 2.33 1.20 92 T_XMDrugObfuBody_08 5735 1.70 2.21 1.43 93 HTML_IMAGE_RATIO_08 5635 2.06 2.17 2.00 94 XM_UB99 5369 0.74 2.07 0.02 95 RCVD_IN_IADB_LISTED 5283 4.59 2.03 5.96 96 SUBJ_ALL_CAPS 5173 1.81 1.99 1.71 97 RCVD_IN_BL_SPAMCOP_NET 5042 0.86 1.94 0.28 98 XMSubject_48 4960 0.69 1.91 0.03 99 TM2_M_VERY_LONG_WORD 4910 1.17 1.89 0.79 100 RCVD_IN_RP_RNBL 4876 0.67 1.88 0.03 101 XM_URI_RBL 4849 0.72 1.87 0.10 102 RCVD_IN_IADB_SPF 4824 3.95 1.86 5.07 103 TR_Symld_Words 4723 1.85 1.82 1.87 104 XMMoneyMeta_00 4687 1.02 1.81 0.60 105 XMGenDplmaNmb 4633 1.40 1.78 1.19 106 RCVD_IN_IADB_SENDERID 4623 3.47 1.78 4.38 107 RCVD_IN_IADB_DK 4566 3.38 1.76 4.25 108 XMHTML_After_End 4519 0.83 1.74 0.34 109 MultiRelay_Combo 4476 0.70 1.72 0.15 110 MultiRelay_CC 4476 0.70 1.72 0.15 111 XMSubMetaI_00 4436 0.99 1.71 0.61 112 RELAYCOUNTRY_RO 4385 0.59 1.69 0.00 113 XMBody_17 4179 0.84 1.61 0.42 114 TR_XM_RelayPhish 4025 0.83 1.55 0.45 115 BOTNET_NORDNS 3950 0.54 1.52 0.01 116 XMSexyCombo_01 3926 0.80 1.51 0.42 117 XM_UB999 3770 0.52 1.45 0.02 118 URIBL_DBL_SPAM 3514 0.59 1.35 0.18 119 BAYES_00 3443 7.58 1.33 10.95 120 T_XMDrugObfuBody_00 3396 0.93 1.31 0.73 121 XMBdyGiftCard01 3372 0.94 1.30 0.75 122 RELAYCOUNTRY_FR 3326 0.61 1.28 0.25 123 MAILING_LIST_MULTI 3237 1.66 1.25 1.89 124 XM_DK_Undo_01 3226 1.52 1.24 1.67 125 XMLongAddy 3199 0.48 1.23 0.08 126 XMStockSpam_06 3197 1.22 1.23 1.21 127 XMPhish11 3188 1.12 1.23 1.06 128 XM_ProductURIs 3110 1.04 1.20 0.96 129 BAYES_40 3098 2.90 1.19 3.81 130 FVGT_m_MULTI_ODD_EMAIL 3073 0.46 1.18 0.06 131 URIBL_BLACK 3062 0.44 1.18 0.04 132 XM_H_Long_From02 3013 0.93 1.16 0.81 133 T_FILL_THIS_FORM_SHORT 3006 0.91 1.16 0.77 134 NO_DNS_FOR_FROM 3001 0.87 1.16 0.71 135 DRUGS_ERECTILE 2956 0.41 1.14 0.03 136 URI_TRY_3LD 2896 1.06 1.12 1.03 137 T_Symld_Words_02 2895 0.68 1.11 0.45 138 ONLINE_PHARMACY 2825 0.38 1.09 0.00 139 T_XMHurry_00 2788 0.68 1.07 0.47 140 XM_JunkDunk 2755 0.37 1.06 0.00 141 TVD_VISIT_PHARMA 2743 0.37 1.06 0.00 142 RELAYCOUNTRY_AT 2727 0.44 1.05 0.12 143 T_TooManySym_02 2644 1.22 1.02 1.33 144 XMBody_78 2631 0.52 1.01 0.26 145 XM_RXBody 2579 0.40 0.99 0.08 146 UNPARSEABLE_RELAY 2574 2.62 0.99 3.50 147 SpammyFromTLD_01 2546 0.78 0.98 0.67 148 T_MONEY_PERCENT 2522 0.56 0.97 0.34 149 TR_LOTS_OF_MONEY2 2522 0.56 0.97 0.34 150 XMHTMLBadTable_001 2514 0.57 0.97 0.35 151 BAYES_20 2510 1.96 0.97 2.50 152 XMPhish14 2507 0.53 0.97 0.30 153 XMMoneyMeta_01 2505 0.35 0.96 0.02 154 DKIM_ADSP_CUSTOM_MED 2493 0.96 0.96 0.95 155 HTML_TAG_BALANCE_BODY 2487 0.62 0.96 0.44 156 TR_XM_DK_Bayes 2474 3.00 0.95 4.10 157 XM_HighProb1 2447 0.33 0.94 0.01 158 SUBJ_DOLLARS 2437 0.41 0.94 0.12 159 XMBrknScrpt_02 2410 0.62 0.93 0.46 160 XMPhish30 2366 0.49 0.91 0.27 161 MALE_ENHANCE 2333 0.31 0.90 0.00 162 HTML_FONT_FACE_BAD 2328 0.96 0.90 0.99 163 XMSubject_47 2314 0.31 0.89 0.00 164 RCVD_IN_IADB_VOUCHED 2307 3.13 0.89 4.33 165 TR_XM_DK_Bayes1 2305 2.67 0.89 3.63 166 FORGED_GMAIL_RCVD 2291 0.60 0.88 0.44 167 XM_ArrestRecordFrm03 2285 0.31 0.88 0.00 168 RELAYCOUNTRY_CN 2276 0.33 0.88 0.04 169 DRUG_ED_CAPS 2227 0.30 0.86 0.00 170 REMOVE_BEFORE_LINK 2196 0.44 0.85 0.23 171 URI_NOVOWEL 2158 0.81 0.83 0.79 172 NML_ADSP_CUSTOM_MED 2146 0.72 0.83 0.67 173 RELAYCOUNTRY_GB 2144 0.88 0.83 0.91 174 XM_B_COPY_HTML 2108 0.58 0.81 0.46 175 MPART_ALT_DIFF_COUNT 2073 0.70 0.80 0.64 176 TR_XM_DK_Bayes2 2056 2.06 0.79 2.75 177 XM_OfRef7 2046 0.39 0.79 0.18 178 RELAYCOUNTRY_DE 1994 0.45 0.77 0.28 179 XM_H_PHPOS 1978 0.98 0.76 1.10 180 TooManyTo_002 1947 1.92 0.75 2.56 181 XM_PDF 1905 2.78 0.73 3.88 182 XM_B_REG_HTML 1813 0.42 0.70 0.28 183 XMSexyCombo_04 1810 0.28 0.70 0.06 184 XM_BadFromFormat 1793 0.35 0.69 0.16 185 XMSubMetaSSx_00 1748 0.41 0.67 0.26 186 THIS_AD 1738 0.35 0.67 0.18 187 FROM_LOCAL_NOVOWEL 1727 0.27 0.67 0.06 188 TooManyTo_003 1722 1.42 0.66 1.83 189 DATE_IN_PAST_03_06 1716 0.30 0.66 0.10 190 HTTPS_HTTP_MISMATCH 1716 0.51 0.66 0.43 191 BODY_ENHANCEMENT 1683 0.24 0.65 0.02 192 PLING_QUERY 1669 0.35 0.64 0.20 193 RDNS_DYNAMIC 1661 0.50 0.64 0.43 194 FILL_THIS_FORM 1613 0.51 0.62 0.45 195 RELAYCOUNTRY_AU 1609 0.48 0.62 0.40 196 XM_Nigeria_01 1599 0.28 0.62 0.09 197 LongTLD 1599 0.28 0.62 0.11 198 FILL_THIS_FORM_LOAN 1592 0.40 0.61 0.28 199 KHOP_DYNAMIC 1574 0.57 0.61 0.55 200 RCVD_IN_MSPIKE_WL 1533 1.53 0.59 2.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 416764 89.94 96.52 86.39 2 DCC_CHECK_NEGATIVE 316725 52.57 28.27 65.66 3 DKIM_SIGNED 304550 65.04 68.60 63.13 4 XM_DK_Pass 299655 63.75 66.80 62.12 5 DKIM_VALID 280665 59.96 63.27 58.18 6 BAYES_50 272357 47.37 30.47 56.46 7 XMListUnsubscribeExists 197657 47.30 59.07 40.97 8 DKIM_VALID_AU 192074 42.85 48.47 39.82 9 XM_H_QuotedFrom 166886 38.30 45.20 34.59 10 DCC_CHECK 157469 45.87 70.45 32.64 11 T_TM2_M_HEADER_IN_MSG 133652 24.26 17.85 27.71 12 HTML_FONT_LOW_CONTRAST 118589 26.58 30.30 24.58 13 DKIM_VALID_EF 112257 21.78 19.01 23.27 14 ALL_TRUSTED 107016 15.79 3.92 22.18 15 MIME_HTML_ONLY 103823 28.45 41.33 21.52 16 FVGT_m_MULTI_ODD 93966 20.46 22.28 19.48 17 LOC_TINY_FONT_1 88716 22.47 30.06 18.39 18 XMSubLong 86061 21.06 27.04 17.84 19 MultiRelay 80535 16.39 15.83 16.69 20 T_KAM_HTML_FONT_INVALID 65313 14.83 17.22 13.54 21 XM_DK_Undo_02 57102 21.32 38.95 11.84 22 BAYES_99 55068 20.19 36.48 11.42 23 BAYES_00 52830 7.58 1.33 10.95 24 XM_Body_Dirty_Words 50202 12.34 15.92 10.41 25 IN_ZIMBRA_NJ_WHITELIST 49420 6.67 0.03 10.24 26 XM_Multi_Part_URI 49058 11.80 14.82 10.17 27 ANY_BOUNCE_MESSAGE 48059 7.69 3.46 9.96 28 BOUNCE_MESSAGE 48056 7.69 3.46 9.96 29 BAYES_999 47764 17.25 30.89 9.90 30 XM_DKIMWhitelistDomains 46591 6.29 0.03 9.66 31 LOTS_OF_MONEY 44595 9.66 10.43 9.24 32 LotsOfNums_01 39117 7.88 7.46 8.11 33 FSL_BULK_SIG 38222 11.01 16.74 7.92 34 T_XMDrugObfuBody_14 37246 7.85 8.08 7.72 35 MPART_ALT_DIFF 36937 7.14 6.17 7.66 36 TooManyTo_001 35549 6.86 5.92 7.37 37 XM_B_Phish_Phrases 34431 7.25 7.45 7.14 38 XM_Evil_Numbers_Gen 33994 8.54 11.30 7.05 39 RCVD_IN_RP_SAFE 33694 6.08 4.39 6.98 40 TM2_M_URI_OPT_OUT 33666 5.72 3.38 6.98 41 BAYES_60 31065 7.44 9.31 6.44 42 HTML_IMAGE_RATIO_02 30711 9.13 14.28 6.37 43 MIME_HTML_ONLY_MULTI 29182 4.94 2.88 6.05 44 RCVD_IN_RP_CERTIFIED 29134 5.00 3.08 6.04 45 RCVD_IN_IADB_LISTED 28756 4.59 2.03 5.96 46 TR_DCC_Bayes_99 26759 13.71 28.87 5.55 47 HTML_IMAGE_RATIO_04 26141 6.22 7.70 5.42 48 TR_XM_DocInvoice 25562 5.60 6.17 5.30 49 MIME_QP_LONG_LINE 25395 4.71 3.69 5.26 50 RCVD_IN_IADB_SPF 24473 3.95 1.86 5.07 51 XM_H_Long_From01 24237 5.68 6.89 5.02 52 DKIM_INVALID 23885 5.08 5.32 4.95 53 BOTNET_IPINHOSTNAME 21469 11.49 24.57 4.45 54 XM_SendGrid 21371 4.31 4.10 4.43 55 RCVD_IN_IADB_SENDERID 21124 3.47 1.78 4.38 56 RCVD_IN_IADB_VOUCHED 20902 3.13 0.89 4.33 57 RCVD_IN_IADB_DK 20481 3.38 1.76 4.25 58 RELAYCOUNTRY_META 20250 12.35 27.49 4.20 59 RCVD_IN_MSPIKE_H2 20113 3.78 3.07 4.17 60 BAYES_80 19814 7.10 12.66 4.11 61 TR_XM_DK_Bayes 19758 3.00 0.95 4.10 62 T_REMOTE_IMAGE 19322 9.20 18.84 4.01 63 XM_PDF 18736 2.78 0.73 3.88 64 FROM_EXCESS_BASE64 18563 9.30 19.44 3.85 65 BAYES_40 18399 2.90 1.19 3.81 66 TR_XM_DK_Bayes1 17521 2.67 0.89 3.63 67 T_TooManySym_01 16935 3.27 2.81 3.51 68 UNPARSEABLE_RELAY 16865 2.62 0.99 3.50 69 XMStrtUSub 16536 3.49 3.62 3.43 70 HTML_IMAGE_RATIO_06 15709 3.70 4.53 3.26 71 XMSubMetaSx_00 15688 4.24 6.06 3.25 72 TVD_RCVD_IP 15037 2.06 0.10 3.12 73 XMSexyCombo_05 14811 5.14 8.98 3.07 74 XMNumbers 14487 4.50 7.29 3.00 75 XM_UncommonTLD01 13992 4.89 8.57 2.90 76 RCVD_IN_IADB_OPTIN 13376 1.99 0.53 2.77 77 TR_XM_DK_Bayes2 13261 2.06 0.79 2.75 78 HTML_SHORT_LINK_IMG_1 13111 8.52 19.31 2.72 79 SHORTENED_URL_SRC 12919 8.38 18.98 2.68 80 URI_BUFFLY 12903 8.09 18.16 2.67 81 SHORTENER_SHORT_IMG 12900 8.37 18.95 2.67 82 BAYES_95 12824 4.16 6.96 2.66 83 TooManyTo_002 12335 1.92 0.75 2.56 84 BAYES_20 12039 1.96 0.97 2.50 85 XMSubNoVowel 11884 1.75 0.42 2.46 86 MIME_HTML_MOSTLY 11798 3.07 4.22 2.45 87 XMNoVowels 11387 3.04 4.30 2.36 88 XMDiploma_00 9980 2.39 2.99 2.07 89 RCVD_IN_MSPIKE_WL 9817 1.53 0.59 2.04 90 RCVD_IN_MSPIKE_H3 9816 1.53 0.58 2.03 91 XM_SPF_SoftFail 9713 3.15 5.26 2.01 92 HTML_IMAGE_RATIO_08 9638 2.06 2.17 2.00 93 MAILING_LIST_MULTI 9096 1.66 1.25 1.89 94 TR_Symld_Words 9039 1.85 1.82 1.87 95 TooManyTo_003 8817 1.42 0.66 1.83 96 HTML_IMAGE_ONLY_08 8713 6.69 15.75 1.81 97 SUBJ_ALL_CAPS 8265 1.81 1.99 1.71 98 HTML_MIME_NO_HTML_TAG 8235 7.13 17.20 1.71 99 XM_DK_Undo_01 8053 1.52 1.24 1.67 100 IN_HORDE_ADDRESS_BOOK 7945 1.09 0.06 1.65 101 HELO_NODOT 7894 1.15 0.24 1.64 102 BAYES_05 7481 1.20 0.55 1.55 103 URI_HEX 7471 2.29 3.67 1.55 104 XM_DIRTYINTL 7357 2.27 3.65 1.53 105 XM_CamelCaseFrm001 7003 2.02 3.07 1.45 106 INVALID_MSGID 6966 0.99 0.16 1.44 107 T_XMDrugObfuBody_08 6896 1.70 2.21 1.43 108 TO_MALFORMED 6705 0.91 0.01 1.39 109 XMLngstWrd_00 6584 0.98 0.27 1.36 110 USER_IN_DEF_DKIM_WL 6511 0.90 0.07 1.35 111 T_TooManySym_02 6437 1.22 1.02 1.33 112 XM_OfRef6 6331 1.70 2.43 1.31 113 XMStockSpam_06 5853 1.22 1.23 1.21 114 RELAYCOUNTRY_CA 5809 1.60 2.33 1.20 115 XMGenDplmaNmb 5759 1.40 1.78 1.19 116 XMLngstWrd_01 5619 0.84 0.24 1.16 117 XMCapTrack 5483 0.88 0.40 1.14 118 XM_H_PHPOS 5290 0.98 0.76 1.10 119 XM_GoogleGroups 5199 0.82 0.35 1.08 120 XMPhish11 5129 1.12 1.23 1.06 121 HTML_IMAGE_ONLY_04 4993 1.96 3.69 1.04 122 URI_TRY_3LD 4977 1.06 1.12 1.03 123 UNTRUSTED_Relay 4922 8.51 22.41 1.02 124 HTML_FONT_FACE_BAD 4759 0.96 0.90 0.99 125 TooManyTo_004 4705 0.79 0.44 0.98 126 XM_ProductURIs 4618 1.04 1.20 0.96 127 DKIM_ADSP_CUSTOM_MED 4605 0.96 0.96 0.95 128 BOTNET 4569 9.44 25.23 0.95 129 RELAYCOUNTRY_GB 4399 0.88 0.83 0.91 130 URIBL_SBL_A 4277 0.65 0.20 0.89 131 XM_E_Blogspot 4017 0.57 0.07 0.83 132 TooManyTo_005 3969 0.67 0.39 0.82 133 XM_H_Long_From02 3899 0.93 1.16 0.81 134 URI_NOVOWEL 3821 0.81 0.83 0.79 135 TM2_M_VERY_LONG_WORD 3797 1.17 1.89 0.79 136 T_FILL_THIS_FORM_SHORT 3731 0.91 1.16 0.77 137 XMBdyGiftCard01 3598 0.94 1.30 0.75 138 T_XMDrugObfuBody_00 3501 0.93 1.31 0.73 139 XMLngstWrd_02 3427 0.53 0.20 0.71 140 NO_DNS_FOR_FROM 3425 0.87 1.16 0.71 141 HTML_FONT_SIZE_LARGE 3324 1.90 4.15 0.69 142 SpammyFromTLD_01 3256 0.78 0.98 0.67 143 NML_ADSP_CUSTOM_MED 3230 0.72 0.83 0.67 144 XM_UB50 3174 1.88 4.15 0.66 145 MPART_ALT_DIFF_COUNT 3095 0.70 0.80 0.64 146 TM2_M_A_HREF_HREF 3016 0.58 0.49 0.63 147 USER_IN_WHITELIST 2994 0.40 0.00 0.62 148 T_OBFU_PDF_ATTACH 2965 0.46 0.16 0.61 149 HTML_IMAGE_ONLY_20 2960 0.49 0.25 0.61 150 XMSubMetaI_00 2923 0.99 1.71 0.61 151 XMMoneyMeta_00 2917 1.02 1.81 0.60 152 T_TooManySym_03 2889 0.48 0.25 0.60 153 PRESENTAMOS_ES 2803 0.38 0.02 0.58 154 TR_MetaPhish_Combo_01 2795 0.53 0.43 0.58 155 FUZZY_CREDIT 2711 0.40 0.11 0.56 156 KHOP_DYNAMIC 2658 0.57 0.61 0.55 157 SUBJ_BUY 2596 0.40 0.15 0.54 158 XMGappySubj_01 2570 0.48 0.38 0.53 159 MISSING_HEADERS 2486 5.96 16.07 0.52 160 XM_D_tchamptons_WL 2479 0.33 0.00 0.51 161 XMBody_95 2400 0.37 0.13 0.50 162 XMSubMetaSxObfu_02 2382 0.38 0.18 0.49 163 XM_H_PHPMailer 2331 0.51 0.57 0.48 164 HTML_IMAGE_ONLY_32 2303 0.40 0.27 0.48 165 T_MANY_PILL_PRICE 2276 0.31 0.00 0.47 166 XM_ShortIntro_01 2252 0.38 0.23 0.47 167 T_XMHurry_00 2245 0.68 1.07 0.47 168 XM_B_COPY_HTML 2202 0.58 0.81 0.46 169 XMBrknScrpt_02 2201 0.62 0.93 0.46 170 T_Symld_Words_02 2183 0.68 1.11 0.45 171 FILL_THIS_FORM 2181 0.51 0.62 0.45 172 TR_XM_RelayPhish 2167 0.83 1.55 0.45 173 FORGED_GMAIL_RCVD 2134 0.60 0.88 0.44 174 HTML_TAG_BALANCE_BODY 2105 0.62 0.96 0.44 175 XM_USANA_RCVD 2092 0.28 0.00 0.43 176 SHORT_HELO_AND_INLINE_IMAGE 2092 0.30 0.05 0.43 177 RDNS_DYNAMIC 2076 0.50 0.64 0.43 178 AC_DIV_BONANZA 2060 0.31 0.10 0.43 179 HTTPS_HTTP_MISMATCH 2059 0.51 0.66 0.43 180 XMLngstWrd_03 2040 0.32 0.14 0.42 181 XMSlimDrugH 2029 0.47 0.56 0.42 182 XMDateMe_00 2027 0.38 0.31 0.42 183 XMSexyCombo_01 2024 0.80 1.51 0.42 184 XMBody_17 2018 0.84 1.61 0.42 185 RELAYCOUNTRY_AU 1933 0.48 0.62 0.40 186 TM2_M_BODY_EMPTY 1813 0.34 0.27 0.38 187 HTML_IMAGE_ONLY_28 1731 0.42 0.53 0.36 188 RCVD_IN_SORBS_DUL 1718 0.28 0.13 0.36 189 XMHTMLBadTable_001 1680 0.57 0.97 0.35 190 XMHTML_After_End 1655 0.83 1.74 0.34 191 T_MONEY_PERCENT 1643 0.56 0.97 0.34 192 TR_LOTS_OF_MONEY2 1643 0.56 0.97 0.34 193 XMSubMetaSxObfu_03 1624 0.42 0.56 0.34 194 HTML_IMAGE_ONLY_24 1604 0.31 0.28 0.33 195 TR_Mismatch_TLD_01 1590 0.27 0.15 0.33 196 TR_MetaPhish_Combo_01b 1538 0.26 0.16 0.32 197 T_FILL_THIS_FORM_LONG 1531 0.40 0.57 0.32 198 SpammyFromTLD_02 1502 2.20 5.72 0.31 199 XM_B_TRADE_HTML 1462 0.29 0.28 0.30 200 XMPhish14 1452 0.53 0.97 0.30 ----------------------------------------------------------------------