Email: 695603 Autolearn: 0 AvgScore: 4.20 AvgScanTime: 4.98 sec Spam: 221672 Autolearn: 0 AvgScore: 12.40 AvgScanTime: 5.57 sec Ham: 473931 Autolearn: 0 AvgScore: 0.37 AvgScanTime: 4.70 sec Time Spent Running SA: 962.02 hours Time Spent Processing Spam: 343.04 hours Time Spent Processing Ham: 618.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 212856 90.44 96.02 87.83 2 DKIM_SIGNED 181342 73.14 81.81 69.09 3 XM_DK_Pass 176443 71.48 79.60 67.69 4 DKIM_VALID 170456 68.62 76.90 64.76 5 DCC_CHECK 166783 46.74 75.24 33.41 6 XMListUnsubscribeExists 151750 52.92 68.46 45.65 7 DKIM_VALID_AU 132900 50.77 59.95 46.48 8 XM_H_QuotedFrom 114510 38.90 51.66 32.93 9 XM_DK_Undo_02 99886 23.20 45.06 12.98 10 BAYES_99 88652 21.08 39.99 12.24 11 HTML_FONT_LOW_CONTRAST 77703 28.56 35.05 25.53 12 MIME_HTML_ONLY 75863 23.59 34.22 18.62 13 BAYES_50 75126 50.99 33.89 58.99 14 LOC_TINY_FONT_1 74803 24.52 33.74 20.20 15 BAYES_999 74781 17.91 33.73 10.51 16 TR_DCC_Bayes_99 69527 13.90 31.36 5.73 17 XMSubLong 64065 22.48 28.90 19.48 18 FVGT_m_MULTI_ODD 59142 23.39 26.68 21.86 19 DKIM_VALID_EF 53587 25.92 24.17 26.73 20 DCC_CHECK_NEGATIVE 51533 51.53 23.25 64.75 21 T_KAM_HTML_FONT_INVALID 44537 16.23 20.09 14.42 22 T_TM2_M_HEADER_IN_MSG 43568 26.59 19.65 29.84 23 XM_Body_Dirty_Words 40946 12.89 18.47 10.28 24 XM_Multi_Part_URI 38174 12.36 17.22 10.09 25 MultiRelay 34620 17.09 15.62 17.78 26 HTML_IMAGE_RATIO_02 34369 10.10 15.50 7.58 27 RELAYCOUNTRY_META 31029 7.63 14.00 4.65 28 XM_Evil_Numbers_Gen 29981 9.70 13.52 7.90 29 BOTNET_IPINHOSTNAME 27492 7.60 12.40 5.35 30 FSL_BULK_SIG 26525 8.27 11.97 6.54 31 XMSexyCombo_05 26189 5.78 11.81 2.96 32 LOTS_OF_MONEY 25874 9.61 11.67 8.65 33 FROM_EXCESS_BASE64 25463 5.86 11.49 3.23 34 BOTNET 23988 4.22 10.82 1.13 35 T_REMOTE_IMAGE 20847 6.24 9.40 4.76 36 HTML_IMAGE_RATIO_04 20188 6.38 9.11 5.10 37 XM_B_Phish_Phrases 19812 6.29 8.94 5.05 38 T_XMDrugObfuBody_14 19378 7.77 8.74 7.31 39 UNTRUSTED_Relay 18917 3.45 8.53 1.07 40 XMSubMetaSx_00 18748 5.27 8.46 3.78 41 XMNumbers 18610 4.88 8.40 3.24 42 BAYES_60 18286 7.19 8.25 6.70 43 BAYES_80 18046 5.39 8.14 4.11 44 HTML_MIME_NO_HTML_TAG 17919 4.23 8.08 2.42 45 TooManyTo_001 17830 8.67 8.04 8.97 46 LotsOfNums_01 17220 8.48 7.77 8.81 47 XM_H_Long_From01 17203 6.17 7.76 5.42 48 XM_UncommonTLD01 17168 4.53 7.74 3.03 49 RCVD_IN_RP_RNBL 16584 2.51 7.48 0.19 50 MPART_ALT_DIFF 15747 4.75 7.10 3.65 51 BODY_URI_ONLY 15520 2.42 7.00 0.28 52 MIME_HEADER_CTYPE_ONLY 14835 2.37 6.69 0.34 53 TR_XM_DocInvoice 14820 4.31 6.69 3.20 54 MISSING_HEADERS 14069 2.60 6.35 0.84 55 T_HTML_TAG_BALANCE_CENTER 13457 3.19 6.07 1.84 56 RCVD_IN_RP_SAFE 12995 8.30 5.86 9.44 57 HTML_IMAGE_ONLY_16 12882 3.21 5.81 1.99 58 BAYES_95 10903 3.61 4.92 3.00 59 DKIM_INVALID 10886 4.52 4.91 4.33 60 RCVD_IN_RP_CERTIFIED 10873 7.61 4.90 8.88 61 SpammyFromTLD_02 10790 1.71 4.87 0.23 62 HTML_SHORT_LINK_IMG_2 10556 2.54 4.76 1.51 63 HTML_IMAGE_RATIO_06 10008 3.49 4.51 3.01 64 XM_SendGrid 9860 4.71 4.45 4.83 65 MIME_HTML_MOSTLY 9404 2.96 4.24 2.37 66 MIME_QP_LONG_LINE 9389 5.11 4.24 5.52 67 TM2_M_URI_OPT_OUT 9257 2.82 4.18 2.19 68 RCVD_IN_MSPIKE_H2 8398 4.52 3.79 4.86 69 XMStrtUSub 8238 3.60 3.72 3.54 70 XM_CamelCaseFrm001 7868 2.49 3.55 1.99 71 XM_SPF_SoftFail 7774 2.38 3.51 1.85 72 XM_UB50 7683 1.61 3.47 0.74 73 MIME_HTML_ONLY_MULTI 7506 1.84 3.39 1.12 74 HTML_IMAGE_RATIO_08 7475 2.45 3.37 2.01 75 XM_DIRTYINTL 7464 2.19 3.37 1.64 76 RCVD_IN_BL_SPAMCOP_NET 7121 1.28 3.21 0.38 77 T_TooManySym_01 7093 3.59 3.20 3.77 78 RELAYCOUNTRY_CA 6728 1.86 3.04 1.31 79 URI_HEX 6531 2.16 2.95 1.79 80 XMDiploma_00 5550 1.94 2.50 1.67 81 XM_URI_RBL 5537 0.87 2.50 0.11 82 MultiRelay_Combo 5422 0.90 2.45 0.17 83 MultiRelay_CC 5422 0.90 2.45 0.17 84 RCVD_IN_IADB_LISTED 5165 4.66 2.33 5.76 85 SUBJ_ALL_CAPS 4874 2.06 2.20 1.99 86 T_XMDrugObfuBody_08 4736 2.19 2.14 2.22 87 XM_OfRef6 4699 1.50 2.12 1.21 88 XMBdyGiftCard01 4686 1.36 2.11 1.01 89 RCVD_IN_IADB_SPF 4619 4.08 2.08 5.01 90 XMSubMetaSx_01 4568 0.78 2.06 0.18 91 XMSubMetaI_00 4499 1.07 2.03 0.62 92 T_Symld_Words_02 4403 0.96 1.99 0.48 93 RCVD_IN_IADB_SENDERID 4379 3.65 1.98 4.43 94 RCVD_IN_IADB_DK 4311 3.56 1.94 4.31 95 ALL_TRUSTED 4219 15.30 1.90 21.56 96 URI_TRY_3LD 4218 1.40 1.90 1.16 97 DIET_1 4126 1.09 1.86 0.73 98 XMGenDplmaNmb 3884 1.21 1.75 0.96 99 TooManyTo_002 3856 2.99 1.74 3.58 100 XM_H_Long_From02 3797 1.17 1.71 0.91 101 XM_ProductURIs 3709 1.13 1.67 0.88 102 RELAYCOUNTRY_FR 3653 0.69 1.65 0.24 103 XMBody_17 3629 0.87 1.64 0.51 104 TooManyTo_003 3627 2.36 1.64 2.70 105 URIBL_BLACK 3522 0.54 1.59 0.04 106 MAILING_LIST_MULTI 3516 2.11 1.59 2.35 107 XMMoneyMeta_00 3514 0.84 1.59 0.49 108 SpammyFromTLD_01 3492 0.95 1.58 0.65 109 XM_DK_Undo_01 3464 1.90 1.56 2.05 110 T_TooManySym_02 3435 1.61 1.55 1.64 111 XMSexyCombo_01 3352 0.74 1.51 0.37 112 XM_RXBody 3298 0.85 1.49 0.55 113 BAYES_00 3212 5.25 1.45 7.03 114 T_XMDrugObfuBody_00 3199 0.92 1.44 0.67 115 UNPARSEABLE_RELAY 3172 3.24 1.43 4.08 116 XM_UB60 3141 0.50 1.42 0.07 117 TR_XM_RelayPhish 3135 0.78 1.41 0.48 118 BOTNET_NORDNS 3129 0.46 1.41 0.02 119 TooManyTo_004 3126 1.75 1.41 1.90 120 XMPhish14 3086 0.63 1.39 0.27 121 TR_Symld_Words 3077 1.61 1.39 1.72 122 XMPhish11 3076 1.31 1.39 1.28 123 TM2_M_VERY_LONG_WORD 3028 1.01 1.37 0.84 124 T_FILL_THIS_FORM_SHORT 2923 1.01 1.32 0.86 125 T_XMHurry_00 2917 0.72 1.32 0.45 126 TR_LOTS_OF_MONEY1 2868 0.43 1.29 0.03 127 TooManyTo_005 2860 1.50 1.29 1.60 128 XMStockSpam_06 2834 1.30 1.28 1.31 129 XM_UB99 2828 0.42 1.28 0.02 130 SUBJ_DOLLARS 2774 0.49 1.25 0.14 131 XMClaimOffer 2720 0.47 1.23 0.11 132 BAYES_40 2701 2.88 1.22 3.66 133 XM_HighProb1 2686 0.39 1.21 0.01 134 TR_MetaPhish_Combo_01 2684 0.83 1.21 0.66 135 BAYES_20 2664 2.19 1.20 2.65 136 URIBL_DBL_SPAM 2613 0.41 1.18 0.04 137 HTML_SHORT_LINK_IMG_1 2589 0.41 1.17 0.06 138 RCVD_IN_IADB_VOUCHED 2531 2.96 1.14 3.81 139 HTML_FONT_SIZE_LARGE 2525 0.63 1.14 0.40 140 HTML_SHORT_LINK_IMG_3 2514 0.62 1.13 0.38 141 HTML_FONT_FACE_BAD 2511 0.66 1.13 0.44 142 TR_XM_DK_Bayes 2483 3.34 1.12 4.38 143 T_MONEY_PERCENT 2449 0.58 1.10 0.33 144 TR_LOTS_OF_MONEY2 2449 0.58 1.10 0.33 145 XMBrknScrpt_02 2390 0.68 1.08 0.49 146 TR_XM_DK_Bayes1 2357 3.18 1.06 4.17 147 XMSubMetaSSx_00 2350 0.46 1.06 0.17 148 XMHTML_After_End 2284 0.59 1.03 0.38 149 XMSlimDrugH 2283 0.56 1.03 0.35 150 TR_XM_DK_Bayes2 2269 2.67 1.02 3.44 151 TR_Mismatch_TLD_02 2232 0.41 1.01 0.13 152 RELAYCOUNTRY_AT 2231 0.39 1.01 0.10 153 HTTPS_HTTP_MISMATCH 2166 0.63 0.98 0.46 154 DKIM_ADSP_CUSTOM_MED 2091 0.95 0.94 0.96 155 BAYES_05 2080 1.40 0.94 1.62 156 RELAYCOUNTRY_CN 2075 0.33 0.94 0.05 157 XM_UB80 2063 0.32 0.93 0.03 158 REMOVE_BEFORE_LINK 2054 0.49 0.93 0.28 159 ANY_BOUNCE_MESSAGE 2046 5.40 0.92 7.49 160 BOUNCE_MESSAGE 2040 5.40 0.92 7.49 161 XMMoneyMeta_01 2038 0.33 0.92 0.05 162 XMHTMLBadTable_001 2037 0.55 0.92 0.38 163 RELAYCOUNTRY_IN 2030 0.36 0.92 0.09 164 XM_H_PHPOS 2025 1.32 0.91 1.50 165 TR_Caps_n_Bayes_99 2006 0.35 0.90 0.10 166 XM_UB999 1965 0.29 0.89 0.01 167 RELAYCOUNTRY_GB 1917 0.98 0.86 1.04 168 HTML_TAG_BALANCE_BODY 1915 0.59 0.86 0.47 169 XMPhish30 1906 0.50 0.86 0.33 170 MALE_ENHANCE 1896 0.27 0.86 0.00 171 XMSubject_47 1896 0.27 0.86 0.00 172 XMBody_78 1882 0.49 0.85 0.32 173 URI_NOVOWEL 1869 0.57 0.84 0.45 174 XM_Body_Obfu01 1868 0.50 0.84 0.34 175 RDNS_DYNAMIC 1866 0.54 0.84 0.40 176 HTML_IMAGE_ONLY_08 1862 0.37 0.84 0.14 177 FORGED_GMAIL_RCVD 1831 0.55 0.83 0.43 178 XM_PDF 1802 3.45 0.81 4.68 179 NML_ADSP_CUSTOM_MED 1800 0.74 0.81 0.70 180 BODY_ENHANCEMENT 1793 0.27 0.81 0.02 181 RCVD_IN_MSPIKE_WL 1740 1.69 0.78 2.11 182 RCVD_IN_MSPIKE_H3 1723 1.69 0.78 2.11 183 FORGED_MUA_MOZILLA 1692 1.18 0.76 1.37 184 XMNoVowels 1686 0.72 0.76 0.69 185 TR_LOTS_OF_MONEY3 1654 0.40 0.75 0.24 186 KHOP_DYNAMIC 1611 0.66 0.73 0.62 187 FILL_THIS_FORM 1598 0.50 0.72 0.39 188 PLING_QUERY 1590 0.43 0.72 0.30 189 XM_B_REG_HTML 1589 0.57 0.72 0.50 190 DATE_IN_PAST_06_12 1586 0.32 0.72 0.14 191 XMSexyCombo_04 1571 0.29 0.71 0.10 192 XM_B_COPY_HTML 1569 0.51 0.71 0.42 193 XM_H_PHPMailer 1545 0.68 0.70 0.68 194 XMSubMetaSxObfu_03 1538 0.43 0.69 0.30 195 XM_XX_Yahoo 1492 0.25 0.67 0.06 196 T_TooManySym_03 1455 0.63 0.66 0.61 197 RELAYCOUNTRY_BR 1425 0.22 0.64 0.03 198 XM_UB95 1422 0.22 0.64 0.02 199 SHORTENED_URL_SRC 1415 0.22 0.64 0.02 200 RELAYCOUNTRY_DE 1401 0.45 0.63 0.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 416236 90.44 96.02 87.83 2 DKIM_SIGNED 327440 73.14 81.81 69.09 3 XM_DK_Pass 320783 71.48 79.60 67.69 4 DKIM_VALID 306898 68.62 76.90 64.76 5 DCC_CHECK_NEGATIVE 306883 51.53 23.25 64.75 6 BAYES_50 279591 50.99 33.89 58.99 7 DKIM_VALID_AU 220279 50.77 59.95 46.48 8 XMListUnsubscribeExists 216342 52.92 68.46 45.65 9 DCC_CHECK 158320 46.74 75.24 33.41 10 XM_H_QuotedFrom 156061 38.90 51.66 32.93 11 T_TM2_M_HEADER_IN_MSG 141413 26.59 19.65 29.84 12 DKIM_VALID_EF 126682 25.92 24.17 26.73 13 HTML_FONT_LOW_CONTRAST 120971 28.56 35.05 25.53 14 FVGT_m_MULTI_ODD 103585 23.39 26.68 21.86 15 ALL_TRUSTED 102202 15.30 1.90 21.56 16 LOC_TINY_FONT_1 95753 24.52 33.74 20.20 17 XMSubLong 92307 22.48 28.90 19.48 18 MIME_HTML_ONLY 88261 23.59 34.22 18.62 19 MultiRelay 84259 17.09 15.62 17.78 20 T_KAM_HTML_FONT_INVALID 68344 16.23 20.09 14.42 21 XM_DK_Undo_02 61500 23.20 45.06 12.98 22 BAYES_99 57986 21.08 39.99 12.24 23 BAYES_999 49829 17.91 33.73 10.51 24 XM_Body_Dirty_Words 48706 12.89 18.47 10.28 25 XM_Multi_Part_URI 47821 12.36 17.22 10.09 26 XM_DKIMWhitelistDomains 45887 6.61 0.04 9.68 27 RCVD_IN_RP_SAFE 44721 8.30 5.86 9.44 28 TooManyTo_001 42489 8.67 8.04 8.97 29 RCVD_IN_RP_CERTIFIED 42066 7.61 4.90 8.88 30 LotsOfNums_01 41773 8.48 7.77 8.81 31 LOTS_OF_MONEY 40982 9.61 11.67 8.65 32 XM_Evil_Numbers_Gen 37463 9.70 13.52 7.90 33 HTML_IMAGE_RATIO_02 35906 10.10 15.50 7.58 34 ANY_BOUNCE_MESSAGE 35508 5.40 0.92 7.49 35 BOUNCE_MESSAGE 35504 5.40 0.92 7.49 36 T_XMDrugObfuBody_14 34646 7.77 8.74 7.31 37 BAYES_00 33340 5.25 1.45 7.03 38 BAYES_60 31750 7.19 8.25 6.70 39 FSL_BULK_SIG 30974 8.27 11.97 6.54 40 RCVD_IN_IADB_LISTED 27277 4.66 2.33 5.76 41 TR_DCC_Bayes_99 27175 13.90 31.36 5.73 42 MIME_QP_LONG_LINE 26162 5.11 4.24 5.52 43 XM_H_Long_From01 25708 6.17 7.76 5.42 44 BOTNET_IPINHOSTNAME 25345 7.60 12.40 5.35 45 HTML_IMAGE_RATIO_04 24187 6.38 9.11 5.10 46 XM_B_Phish_Phrases 23917 6.29 8.94 5.05 47 RCVD_IN_IADB_SPF 23734 4.08 2.08 5.01 48 IN_ZIMBRA_NJ_WHITELIST 23280 3.36 0.03 4.91 49 RCVD_IN_MSPIKE_H2 23013 4.52 3.79 4.86 50 XM_SendGrid 22873 4.71 4.45 4.83 51 T_REMOTE_IMAGE 22549 6.24 9.40 4.76 52 XM_PDF 22202 3.45 0.81 4.68 53 RELAYCOUNTRY_META 22044 7.63 14.00 4.65 54 RCVD_IN_IADB_SENDERID 20987 3.65 1.98 4.43 55 TR_XM_DK_Bayes 20748 3.34 1.12 4.38 56 DKIM_INVALID 20542 4.52 4.91 4.33 57 RCVD_IN_IADB_DK 20441 3.56 1.94 4.31 58 TR_XM_DK_Bayes1 19742 3.18 1.06 4.17 59 BAYES_80 19474 5.39 8.14 4.11 60 UNPARSEABLE_RELAY 19352 3.24 1.43 4.08 61 RCVD_IN_IADB_VOUCHED 18059 2.96 1.14 3.81 62 XMSubMetaSx_00 17898 5.27 8.46 3.78 63 T_TooManySym_01 17846 3.59 3.20 3.77 64 TVD_RCVD_IP 17786 2.65 0.29 3.75 65 BAYES_40 17344 2.88 1.22 3.66 66 MPART_ALT_DIFF 17275 4.75 7.10 3.65 67 TooManyTo_002 16946 2.99 1.74 3.58 68 XMStrtUSub 16796 3.60 3.72 3.54 69 TR_XM_DK_Bayes2 16285 2.67 1.02 3.44 70 XMNumbers 15335 4.88 8.40 3.24 71 FROM_EXCESS_BASE64 15292 5.86 11.49 3.23 72 TR_XM_DocInvoice 15163 4.31 6.69 3.20 73 XM_UncommonTLD01 14374 4.53 7.74 3.03 74 HTML_IMAGE_RATIO_06 14247 3.49 4.51 3.01 75 BAYES_95 14218 3.61 4.92 3.00 76 XMSexyCombo_05 14022 5.78 11.81 2.96 77 TooManyTo_003 12802 2.36 1.64 2.70 78 BAYES_20 12565 2.19 1.20 2.65 79 HTML_MIME_NO_HTML_TAG 11481 4.23 8.08 2.42 80 RCVD_IN_IADB_OPTIN 11405 1.84 0.62 2.41 81 MIME_HTML_MOSTLY 11211 2.96 4.24 2.37 82 MAILING_LIST_MULTI 11132 2.11 1.59 2.35 83 T_XMDrugObfuBody_08 10528 2.19 2.14 2.22 84 TM2_M_URI_OPT_OUT 10374 2.82 4.18 2.19 85 RCVD_IN_MSPIKE_WL 10015 1.69 0.78 2.11 86 RCVD_IN_MSPIKE_H3 10005 1.69 0.78 2.11 87 XM_DK_Undo_01 9726 1.90 1.56 2.05 88 HTML_IMAGE_RATIO_08 9533 2.45 3.37 2.01 89 HTML_IMAGE_ONLY_16 9443 3.21 5.81 1.99 90 XM_CamelCaseFrm001 9422 2.49 3.55 1.99 91 SUBJ_ALL_CAPS 9421 2.06 2.20 1.99 92 HELO_NODOT 9278 1.42 0.27 1.96 93 TooManyTo_004 9027 1.75 1.41 1.90 94 XM_SPF_SoftFail 8766 2.38 3.51 1.85 95 T_HTML_TAG_BALANCE_CENTER 8718 3.19 6.07 1.84 96 URI_HEX 8506 2.16 2.95 1.79 97 IN_HORDE_ADDRESS_BOOK 8216 1.20 0.05 1.73 98 TR_Symld_Words 8130 1.61 1.39 1.72 99 XMDiploma_00 7935 1.94 2.50 1.67 100 T_TooManySym_02 7796 1.61 1.55 1.64 101 XM_DIRTYINTL 7782 2.19 3.37 1.64 102 BAYES_05 7661 1.40 0.94 1.62 103 TooManyTo_005 7588 1.50 1.29 1.60 104 INVALID_MSGID 7186 1.12 0.28 1.52 105 HTML_SHORT_LINK_IMG_2 7139 2.54 4.76 1.51 106 XM_H_PHPOS 7126 1.32 0.91 1.50 107 XMCapTrack 7077 1.21 0.61 1.49 108 XM_GoogleGroups 6774 1.11 0.43 1.43 109 USER_IN_DEF_DKIM_WL 6756 0.98 0.03 1.43 110 TO_MALFORMED 6602 0.95 0.01 1.39 111 FORGED_MUA_MOZILLA 6495 1.18 0.76 1.37 112 XMLngstWrd_00 6310 1.06 0.47 1.33 113 XMStockSpam_06 6212 1.30 1.28 1.31 114 RELAYCOUNTRY_CA 6191 1.86 3.04 1.31 115 XMPhish11 6071 1.31 1.39 1.28 116 XM_OfRef6 5757 1.50 2.12 1.21 117 XMLngstWrd_01 5531 0.93 0.43 1.17 118 URI_TRY_3LD 5499 1.40 1.90 1.16 119 BOTNET 5341 4.22 10.82 1.13 120 MIME_HTML_ONLY_MULTI 5313 1.84 3.39 1.12 121 UNTRUSTED_Relay 5076 3.45 8.53 1.07 122 RELAYCOUNTRY_GB 4906 0.98 0.86 1.04 123 XMBdyGiftCard01 4777 1.36 2.11 1.01 124 XMGenDplmaNmb 4567 1.21 1.75 0.96 125 DKIM_ADSP_CUSTOM_MED 4527 0.95 0.94 0.96 126 XM_H_Long_From02 4336 1.17 1.71 0.91 127 XM_ProductURIs 4168 1.13 1.67 0.88 128 T_FILL_THIS_FORM_SHORT 4084 1.01 1.32 0.86 129 TM2_M_VERY_LONG_WORD 4000 1.01 1.37 0.84 130 MISSING_HEADERS 3991 2.60 6.35 0.84 131 XM_UB50 3499 1.61 3.47 0.74 132 DIET_1 3445 1.09 1.86 0.73 133 NML_ADSP_CUSTOM_MED 3336 0.74 0.81 0.70 134 XMNoVowels 3290 0.72 0.76 0.69 135 XM_H_PHPMailer 3211 0.68 0.70 0.68 136 XMLngstWrd_02 3190 0.56 0.33 0.67 137 T_XMDrugObfuBody_00 3184 0.92 1.44 0.67 138 XMSubMetaSxObfu_02 3117 0.62 0.55 0.66 139 TR_MetaPhish_Combo_01 3111 0.83 1.21 0.66 140 SpammyFromTLD_01 3102 0.95 1.58 0.65 141 KHOP_DYNAMIC 2951 0.66 0.73 0.62 142 XMSubMetaI_00 2923 1.07 2.03 0.62 143 T_TooManySym_03 2910 0.63 0.66 0.61 144 T_OBFU_PDF_ATTACH 2872 0.49 0.24 0.61 145 TM2_M_A_HREF_HREF 2848 0.58 0.55 0.60 146 AC_DIV_BONANZA 2747 0.42 0.09 0.58 147 USER_IN_WHITELIST 2738 0.39 0.00 0.58 148 XM_RXBody 2622 0.85 1.49 0.55 149 XMGappySubj_01 2605 0.50 0.38 0.55 150 SHORT_HELO_AND_INLINE_IMAGE 2465 0.38 0.07 0.52 151 RELAYCOUNTRY_AU 2442 0.54 0.60 0.52 152 XM_ShortIntro_01 2431 0.46 0.36 0.51 153 XMBody_95 2429 0.40 0.15 0.51 154 XMBody_17 2403 0.87 1.64 0.51 155 XM_B_REG_HTML 2362 0.57 0.72 0.50 156 XMBrknScrpt_02 2316 0.68 1.08 0.49 157 XMMoneyMeta_00 2314 0.84 1.59 0.49 158 XMhairloss01 2298 0.35 0.05 0.48 159 TR_XM_RelayPhish 2291 0.78 1.41 0.48 160 T_Symld_Words_02 2271 0.96 1.99 0.48 161 XMAntiAgingB 2260 0.34 0.04 0.48 162 XM_H_PHPOS_M 2254 0.46 0.44 0.48 163 T_MANY_PILL_PRICE 2216 0.33 0.03 0.47 164 HTML_TAG_BALANCE_BODY 2211 0.59 0.86 0.47 165 HTTPS_HTTP_MISMATCH 2198 0.63 0.98 0.46 166 HTML_IMAGE_ONLY_32 2195 0.51 0.62 0.46 167 XMSubNoVowel 2160 0.40 0.29 0.46 168 T_XMHurry_00 2113 0.72 1.32 0.45 169 URI_NOVOWEL 2111 0.57 0.84 0.45 170 HTML_FONT_FACE_BAD 2103 0.66 1.13 0.44 171 MPART_ALT_DIFF_COUNT 2096 0.46 0.48 0.44 172 XMDateMe_00 2067 0.41 0.35 0.44 173 RCVD_IN_SORBS_DUL 2058 0.36 0.20 0.43 174 FORGED_GMAIL_RCVD 2019 0.55 0.83 0.43 175 XM_B_COPY_HTML 1969 0.51 0.71 0.42 176 XMLngstWrd_03 1942 0.35 0.22 0.41 177 HTML_IMAGE_ONLY_28 1898 0.42 0.47 0.40 178 RDNS_DYNAMIC 1881 0.54 0.84 0.40 179 HTML_FONT_SIZE_LARGE 1879 0.63 1.14 0.40 180 FILL_THIS_FORM 1852 0.50 0.72 0.39 181 DKIM_ADSP_NXDOMAIN 1850 0.42 0.49 0.39 182 XM_D_tchamptons_WL 1834 0.26 0.00 0.39 183 XMHTML_After_End 1816 0.59 1.03 0.38 184 XMHTMLBadTable_001 1810 0.55 0.92 0.38 185 RCVD_IN_BL_SPAMCOP_NET 1802 1.28 3.21 0.38 186 HTML_SHORT_LINK_IMG_3 1794 0.62 1.13 0.38 187 XMSexyCombo_01 1770 0.74 1.51 0.37 188 RELAYCOUNTRY_DE 1755 0.45 0.63 0.37 189 XMSolicitRefs_0 1751 0.38 0.42 0.37 190 HTML_IMAGE_ONLY_24 1747 0.35 0.31 0.37 191 TM2_M_BODY_EMPTY 1728 0.28 0.09 0.36 192 HTML_IMAGE_ONLY_20 1651 0.36 0.38 0.35 193 XMSlimDrugH 1647 0.56 1.03 0.35 194 MIME_HEADER_CTYPE_ONLY 1625 2.37 6.69 0.34 195 XM_Body_Obfu01 1603 0.50 0.84 0.34 196 TR_LOTS_OF_MONEY2 1579 0.58 1.10 0.33 197 T_MONEY_PERCENT 1579 0.58 1.10 0.33 198 XMPhish30 1552 0.50 0.86 0.33 199 XMBody_78 1498 0.49 0.85 0.32 200 TVD_SPACE_RATIO 1455 0.29 0.26 0.31 ----------------------------------------------------------------------