Email: 691429 Autolearn: 0 AvgScore: 4.35 AvgScanTime: 4.61 sec Spam: 220500 Autolearn: 0 AvgScore: 12.96 AvgScanTime: 5.46 sec Ham: 470929 Autolearn: 0 AvgScore: 0.31 AvgScanTime: 4.21 sec Time Spent Running SA: 885.09 hours Time Spent Processing Spam: 334.52 hours Time Spent Processing Ham: 550.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 204656 84.01 92.81 79.89 2 DKIM_SIGNED 172906 69.11 78.42 64.75 3 XM_DK_Pass 169057 67.75 76.67 63.58 4 DKIM_VALID 161124 64.06 73.07 59.85 5 DCC_CHECK 155386 43.12 70.47 30.31 6 XMListUnsubscribeExists 145015 49.94 65.77 42.52 7 DKIM_VALID_AU 130070 47.68 58.99 42.38 8 XM_H_QuotedFrom 113048 39.80 51.27 34.43 9 XM_DK_Undo_02 100012 23.73 45.36 13.60 10 BAYES_99 93682 23.21 42.49 14.18 11 BAYES_999 79625 19.68 36.11 11.99 12 MIME_HTML_ONLY 77196 22.31 35.01 16.36 13 HTML_FONT_LOW_CONTRAST 76117 27.84 34.52 24.71 14 TR_DCC_Bayes_99 71539 14.60 32.44 6.24 15 LOC_TINY_FONT_1 71150 23.28 32.27 19.08 16 BAYES_50 66841 47.49 30.31 55.54 17 DCC_CHECK_NEGATIVE 61981 55.09 28.11 67.73 18 XMSubLong 57008 21.59 25.85 19.60 19 FVGT_m_MULTI_ODD 56675 21.77 25.70 19.93 20 T_TM2_M_HEADER_IN_MSG 49202 26.80 22.31 28.91 21 DKIM_VALID_EF 46190 23.45 20.95 24.62 22 RELAYCOUNTRY_META 43470 9.15 19.71 4.20 23 T_KAM_HTML_FONT_INVALID 39982 15.50 18.13 14.27 24 XM_Body_Dirty_Words 38958 12.67 17.67 10.33 25 BOTNET 37311 6.21 16.92 1.20 26 XM_Multi_Part_URI 34361 11.71 15.58 9.90 27 HTML_IMAGE_RATIO_02 33933 9.08 15.39 6.12 28 MultiRelay 32523 16.24 14.75 16.93 29 XM_Evil_Numbers_Gen 31922 9.26 14.48 6.82 30 UNTRUSTED_Relay 30579 5.01 13.87 0.86 31 FROM_EXCESS_BASE64 26141 6.08 11.86 3.38 32 BOTNET_IPINHOSTNAME 26138 7.27 11.85 5.12 33 LOTS_OF_MONEY 24179 8.45 10.97 7.27 34 FSL_BULK_SIG 24135 6.91 10.95 5.03 35 XMSexyCombo_05 21366 4.77 9.69 2.47 36 HTML_IMAGE_RATIO_04 21084 5.84 9.56 4.10 37 T_REMOTE_IMAGE 20725 5.68 9.40 3.94 38 BAYES_80 20583 6.90 9.33 5.76 39 T_XMDrugObfuBody_14 19846 8.05 9.00 7.61 40 HTML_MIME_NO_HTML_TAG 19436 4.78 8.81 2.89 41 BAYES_60 18294 9.10 8.30 9.48 42 XM_UncommonTLD01 18065 5.58 8.19 4.36 43 TooManyTo_001 18042 10.46 8.18 11.53 44 HTML_SHORT_LINK_IMG_1 17863 3.40 8.10 1.20 45 XM_B_Phish_Phrases 17655 5.56 8.01 4.41 46 SHORTENED_URL_SRC 17643 3.34 8.00 1.16 47 SHORTENER_SHORT_IMG 17530 3.33 7.95 1.16 48 URI_BUFFLY 17525 3.33 7.95 1.16 49 XMSubMetaSx_00 17405 5.58 7.89 4.50 50 XM_H_Long_From01 16973 5.86 7.70 5.01 51 BODY_URI_ONLY 16070 2.40 7.29 0.11 52 TR_XM_DocInvoice 15988 4.78 7.25 3.62 53 MISSING_HEADERS 15822 2.66 7.18 0.54 54 MPART_ALT_DIFF 15256 3.75 6.92 2.27 55 MIME_HEADER_CTYPE_ONLY 15024 2.27 6.81 0.15 56 HTML_IMAGE_ONLY_04 13608 2.51 6.17 0.80 57 RCVD_IN_RP_SAFE 13515 7.49 6.13 8.12 58 LotsOfNums_01 12675 7.77 5.75 8.72 59 RELAYCOUNTRY_UA 12465 1.81 5.65 0.00 60 XMNumbers 12354 3.82 5.60 2.98 61 BAYES_95 12256 4.26 5.56 3.66 62 XM_UB50 12200 2.13 5.53 0.53 63 DKIM_INVALID 11782 5.05 5.34 4.91 64 TM2_M_URI_OPT_OUT 11640 4.09 5.28 3.53 65 ALL_TRUSTED 11572 19.84 5.25 26.68 66 XMStrtUSub 11064 3.98 5.02 3.50 67 HTML_SHORT_CENTER 10963 1.91 4.97 0.48 68 RCVD_IN_RP_CERTIFIED 10816 6.85 4.91 7.76 69 MIME_HTML_MOSTLY 10079 2.85 4.57 2.04 70 XM_SendGrid 9584 4.39 4.35 4.41 71 MIME_QP_LONG_LINE 9398 6.22 4.26 7.14 72 HTML_IMAGE_RATIO_08 8967 2.60 4.07 1.92 73 HTML_IMAGE_RATIO_06 7993 3.11 3.62 2.87 74 MIME_HTML_ONLY_MULTI 7414 1.76 3.36 1.01 75 RCVD_IN_MSPIKE_H2 7386 4.19 3.35 4.58 76 XM_DIRTYINTL 7230 2.08 3.28 1.52 77 RELAYCOUNTRY_CA 7049 1.86 3.20 1.23 78 XM_SPF_SoftFail 6957 2.23 3.16 1.79 79 XM_UB60 6957 1.05 3.16 0.06 80 URI_HEX 6899 1.90 3.13 1.33 81 XMSubMetaI_00 6665 1.36 3.02 0.58 82 SpammyFromTLD_02 6649 1.08 3.02 0.18 83 XM_CamelCaseFrm001 6412 1.98 2.91 1.54 84 SUBJ_ALL_CAPS 6114 1.93 2.77 1.54 85 DIET_1 6111 1.07 2.77 0.27 86 XM_OfRef6 5555 1.75 2.52 1.38 87 MultiRelay_CC 5387 0.88 2.44 0.15 88 XMStockSpam_06 5387 1.36 2.44 0.85 89 MultiRelay_Combo 5387 0.88 2.44 0.15 90 RCVD_IN_RP_RNBL 5342 0.80 2.42 0.04 91 XMSexyCombo_01 5303 1.03 2.40 0.39 92 XMDiploma_00 5128 1.86 2.33 1.64 93 HTML_IMAGE_ONLY_08 5075 1.14 2.30 0.60 94 XM_UB80 5054 0.75 2.29 0.03 95 RCVD_IN_BL_SPAMCOP_NET 4818 0.81 2.19 0.17 96 XM_URI_RBL 4769 0.77 2.16 0.11 97 T_TooManySym_01 4586 3.37 2.08 3.98 98 XM_RXBody 4399 0.73 2.00 0.14 99 XMBdyGiftCard01 4225 1.20 1.92 0.87 100 RELAYCOUNTRY_FR 4192 0.71 1.90 0.15 101 URIBL_RHS_DOB 4189 1.26 1.90 0.96 102 TooManyTo_002 4070 4.47 1.85 5.69 103 ANY_BOUNCE_MESSAGE 3978 5.08 1.80 6.62 104 BOUNCE_MESSAGE 3978 5.08 1.80 6.61 105 XMMoneyMeta_00 3954 0.92 1.79 0.51 106 XM_H_Long_From02 3812 1.13 1.73 0.85 107 T_XMDrugObfuBody_08 3775 1.37 1.71 1.21 108 URI_WP_HACKED_2 3671 1.48 1.66 1.39 109 XMBody_17 3647 0.81 1.65 0.42 110 T_XMHurry_00 3629 0.97 1.65 0.65 111 TooManyTo_003 3604 3.39 1.63 4.22 112 XMSexyCombo_04 3602 0.58 1.63 0.09 113 T_MONEY_PERCENT 3581 0.65 1.62 0.20 114 TR_LOTS_OF_MONEY2 3581 0.65 1.62 0.20 115 URI_TRY_3LD 3570 1.12 1.62 0.89 116 UNPARSEABLE_RELAY 3526 3.25 1.60 4.03 117 BANG_GUAR 3459 0.53 1.57 0.04 118 GUARANTEED_100_PERCENT 3380 0.49 1.53 0.01 119 XMSubMetaSxObfu_03 3370 0.75 1.53 0.38 120 XM_Combo_Sbj 3358 0.68 1.52 0.28 121 HTML_FONT_SIZE_LARGE 3299 0.82 1.50 0.51 122 BOTNET_NORDNS 3231 0.48 1.47 0.02 123 SpammyFromTLD_01 3215 1.89 1.46 2.09 124 XMSubMetaI_01 3210 0.48 1.46 0.03 125 RCVD_IN_PSBL 3164 0.50 1.43 0.06 126 TR_XM_RelayPhish 3132 0.74 1.42 0.43 127 XM_DK_Undo_01 3096 1.76 1.40 1.93 128 RCVD_IN_IADB_LISTED 3094 4.12 1.40 5.39 129 TooManyTo_004 3045 2.58 1.38 3.15 130 TM2_M_VERY_LONG_WORD 2965 0.95 1.34 0.76 131 XMSubMetaSx_01 2890 0.56 1.31 0.21 132 MAILING_LIST_MULTI 2884 1.84 1.31 2.09 133 XMSlimDrugH 2815 0.72 1.28 0.46 134 XM_UB99 2783 0.42 1.26 0.03 135 XMGenDplmaNmb 2739 1.03 1.24 0.94 136 TR_Symld_Words 2699 1.43 1.22 1.53 137 IMPOTENCE 2695 1.03 1.22 0.94 138 BAYES_00 2685 3.85 1.22 5.09 139 BAYES_40 2682 2.32 1.22 2.84 140 XMHTML_After_End 2677 0.64 1.21 0.37 141 RCVD_IN_IADB_SPF 2638 3.62 1.20 4.76 142 NO_DNS_FOR_FROM 2633 0.91 1.19 0.77 143 TR_Caps_n_Bayes_99 2592 0.44 1.18 0.10 144 XMPhish30 2568 0.56 1.16 0.28 145 TooManyTo_005 2558 1.94 1.16 2.31 146 XM_HighProb1 2536 0.38 1.15 0.02 147 RELAYCOUNTRY_CN 2535 0.40 1.15 0.05 148 XMPhish14 2485 0.61 1.13 0.37 149 XMSubMetaSSx_00 2478 0.58 1.12 0.32 150 RCVD_IN_IADB_SENDERID 2421 3.20 1.10 4.19 151 T_XMDrugObfuBody_00 2410 0.71 1.09 0.53 152 RDNS_DYNAMIC 2402 0.60 1.09 0.37 153 RCVD_IN_IADB_DK 2375 3.17 1.08 4.14 154 RELAYCOUNTRY_AT 2338 0.43 1.06 0.14 155 XMPhish11 2322 1.15 1.05 1.20 156 URIBL_BLACK 2306 0.36 1.05 0.03 157 BAD_ENC_HEADER 2267 0.34 1.03 0.02 158 XMSexyCombo_02 2256 0.36 1.02 0.05 159 XMSubject_09 2247 0.33 1.02 0.00 160 TR_XM_DK_Bayes 2228 2.46 1.01 3.14 161 HTML_FONT_FACE_BAD 2207 0.60 1.00 0.41 162 XMBody_78 2178 0.56 0.99 0.35 163 XMSubMetaI_02 2176 0.31 0.99 0.00 164 XM_DKIMWhitelistDomains 2158 8.94 0.98 12.67 165 XMAntiAgingB 2138 0.34 0.97 0.05 166 T_MANY_PILL_PRICE 2117 0.33 0.96 0.04 167 TR_XM_DK_Bayes1 2109 2.31 0.96 2.94 168 BAYES_20 2097 1.70 0.95 2.04 169 XM_UB999 2048 0.31 0.93 0.02 170 MPART_ALT_DIFF_COUNT 2042 0.47 0.93 0.26 171 RCVD_IN_IADB_VOUCHED 2041 2.64 0.93 3.44 172 TR_XM_DK_Bayes2 2021 1.98 0.92 2.48 173 XM_ProductURIs 2017 0.76 0.91 0.69 174 XM_B_REG_HTML 2012 0.56 0.91 0.39 175 TR_LOTS_OF_MONEY3 1983 0.48 0.90 0.29 176 XM_UB95 1923 0.29 0.87 0.02 177 T_FILL_THIS_FORM_SHORT 1902 0.86 0.86 0.86 178 TR_Mismatch_TLD_02 1885 0.30 0.85 0.05 179 URIBL_DBL_SPAM 1874 0.28 0.85 0.02 180 RELAYCOUNTRY_GB 1859 0.94 0.84 0.98 181 XMHTMLBadTable_001 1838 0.49 0.83 0.33 182 XM_H_PHPOS 1835 1.07 0.83 1.19 183 SUBJ_DOLLARS 1803 0.33 0.82 0.10 184 T_TooManySym_02 1774 1.43 0.80 1.72 185 HTML_TAG_BALANCE_BODY 1766 0.52 0.80 0.39 186 T_Symld_Words_02 1765 0.68 0.80 0.62 187 XMWarranty1 1758 0.25 0.80 0.00 188 RELAYCOUNTRY_IN 1752 0.32 0.79 0.10 189 XM_PDF 1725 3.81 0.78 5.23 190 FILL_THIS_FORM 1714 0.54 0.78 0.43 191 HTTPS_HTTP_MISMATCH 1684 0.53 0.76 0.42 192 XM_Body_Obfu01 1682 0.40 0.76 0.23 193 XMBrknScrpt_02 1670 0.61 0.76 0.54 194 XM_B_COPY_HTML 1623 0.48 0.74 0.36 195 PLING_QUERY 1559 0.39 0.71 0.25 196 T_HTML_TAG_BALANCE_CENTER 1559 0.35 0.71 0.18 197 XMGppyBdWords 1556 0.39 0.71 0.24 198 URI_NOVOWEL 1544 0.52 0.70 0.44 199 T_FILL_THIS_FORM_LONG 1538 0.45 0.70 0.33 200 ONLINE_PHARMACY 1536 0.61 0.70 0.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 376210 84.01 92.81 79.89 2 DCC_CHECK_NEGATIVE 318958 55.09 28.11 67.73 3 DKIM_SIGNED 304933 69.11 78.42 64.75 4 XM_DK_Pass 299409 67.75 76.67 63.58 5 DKIM_VALID 281830 64.06 73.07 59.85 6 BAYES_50 261541 47.49 30.31 55.54 7 XMListUnsubscribeExists 200253 49.94 65.77 42.52 8 DKIM_VALID_AU 199578 47.68 58.99 42.38 9 XM_H_QuotedFrom 162123 39.80 51.27 34.43 10 DCC_CHECK 142727 43.12 70.47 30.31 11 T_TM2_M_HEADER_IN_MSG 136128 26.80 22.31 28.91 12 ALL_TRUSTED 125626 19.84 5.25 26.68 13 HTML_FONT_LOW_CONTRAST 116361 27.84 34.52 24.71 14 DKIM_VALID_EF 115937 23.45 20.95 24.62 15 FVGT_m_MULTI_ODD 93871 21.77 25.70 19.93 16 XMSubLong 92301 21.59 25.85 19.60 17 LOC_TINY_FONT_1 89840 23.28 32.27 19.08 18 MultiRelay 79737 16.24 14.75 16.93 19 MIME_HTML_ONLY 77060 22.31 35.01 16.36 20 T_KAM_HTML_FONT_INVALID 67213 15.50 18.13 14.27 21 BAYES_99 66765 23.21 42.49 14.18 22 XM_DK_Undo_02 64050 23.73 45.36 13.60 23 XM_DKIMWhitelistDomains 59664 8.94 0.98 12.67 24 BAYES_999 56465 19.68 36.11 11.99 25 TooManyTo_001 54312 10.46 8.18 11.53 26 XM_Body_Dirty_Words 48645 12.67 17.67 10.33 27 XM_Multi_Part_URI 46633 11.71 15.58 9.90 28 BAYES_60 44623 9.10 8.30 9.48 29 LotsOfNums_01 41050 7.77 5.75 8.72 30 RCVD_IN_RP_SAFE 38246 7.49 6.13 8.12 31 RCVD_IN_RP_CERTIFIED 36566 6.85 4.91 7.76 32 T_XMDrugObfuBody_14 35830 8.05 9.00 7.61 33 LOTS_OF_MONEY 34220 8.45 10.97 7.27 34 MIME_QP_LONG_LINE 33620 6.22 4.26 7.14 35 XM_Evil_Numbers_Gen 32119 9.26 14.48 6.82 36 ANY_BOUNCE_MESSAGE 31153 5.08 1.80 6.62 37 BOUNCE_MESSAGE 31149 5.08 1.80 6.61 38 TR_DCC_Bayes_99 29377 14.60 32.44 6.24 39 HTML_IMAGE_RATIO_02 28818 9.08 15.39 6.12 40 BAYES_80 27120 6.90 9.33 5.76 41 TooManyTo_002 26807 4.47 1.85 5.69 42 RCVD_IN_IADB_LISTED 25404 4.12 1.40 5.39 43 XM_PDF 24651 3.81 0.78 5.23 44 BOTNET_IPINHOSTNAME 24107 7.27 11.85 5.12 45 BAYES_00 23953 3.85 1.22 5.09 46 FSL_BULK_SIG 23669 6.91 10.95 5.03 47 XM_H_Long_From01 23577 5.86 7.70 5.01 48 DKIM_INVALID 23103 5.05 5.34 4.91 49 RCVD_IN_IADB_SPF 22407 3.62 1.20 4.76 50 RCVD_IN_MSPIKE_H2 21567 4.19 3.35 4.58 51 XMSubMetaSx_00 21172 5.58 7.89 4.50 52 XM_B_Phish_Phrases 20778 5.56 8.01 4.41 53 XM_SendGrid 20759 4.39 4.35 4.41 54 XM_UncommonTLD01 20513 5.58 8.19 4.36 55 TooManyTo_003 19860 3.39 1.63 4.22 56 RELAYCOUNTRY_META 19782 9.15 19.71 4.20 57 RCVD_IN_IADB_SENDERID 19731 3.20 1.10 4.19 58 RCVD_IN_IADB_DK 19510 3.17 1.08 4.14 59 HTML_IMAGE_RATIO_04 19294 5.84 9.56 4.10 60 UNPARSEABLE_RELAY 18967 3.25 1.60 4.03 61 T_TooManySym_01 18748 3.37 2.08 3.98 62 T_REMOTE_IMAGE 18537 5.68 9.40 3.94 63 TVD_RCVD_IP 17639 2.72 0.54 3.75 64 BAYES_95 17221 4.26 5.56 3.66 65 IN_ZIMBRA_NJ_WHITELIST 17063 2.47 0.02 3.62 66 TR_XM_DocInvoice 17034 4.78 7.25 3.62 67 TM2_M_URI_OPT_OUT 16607 4.09 5.28 3.53 68 XMStrtUSub 16465 3.98 5.02 3.50 69 RCVD_IN_IADB_VOUCHED 16208 2.64 0.93 3.44 70 FROM_EXCESS_BASE64 15920 6.08 11.86 3.38 71 TooManyTo_004 14818 2.58 1.38 3.15 72 TR_XM_DK_Bayes 14788 2.46 1.01 3.14 73 XMNumbers 14036 3.82 5.60 2.98 74 TR_XM_DK_Bayes1 13841 2.31 0.96 2.94 75 HTML_MIME_NO_HTML_TAG 13615 4.78 8.81 2.89 76 HTML_IMAGE_RATIO_06 13506 3.11 3.62 2.87 77 BAYES_40 13352 2.32 1.22 2.84 78 TR_XM_DK_Bayes2 11673 1.98 0.92 2.48 79 XMSexyCombo_05 11611 4.77 9.69 2.47 80 TooManyTo_005 10890 1.94 1.16 2.31 81 MPART_ALT_DIFF 10687 3.75 6.92 2.27 82 RCVD_IN_IADB_OPTIN 9980 1.62 0.55 2.12 83 SpammyFromTLD_01 9849 1.89 1.46 2.09 84 MAILING_LIST_MULTI 9835 1.84 1.31 2.09 85 RCVD_IN_MSPIKE_WL 9695 1.61 0.65 2.06 86 RCVD_IN_MSPIKE_H3 9680 1.60 0.61 2.06 87 BAYES_20 9630 1.70 0.95 2.04 88 MIME_HTML_MOSTLY 9626 2.85 4.57 2.04 89 XM_DK_Undo_01 9092 1.76 1.40 1.93 90 HTML_IMAGE_RATIO_08 9020 2.60 4.07 1.92 91 HELO_NODOT 8625 1.34 0.29 1.83 92 XM_SPF_SoftFail 8446 2.23 3.16 1.79 93 IN_HORDE_ADDRESS_BOOK 8129 1.20 0.07 1.73 94 T_TooManySym_02 8088 1.43 0.80 1.72 95 XMDiploma_00 7717 1.86 2.33 1.64 96 XM_CamelCaseFrm001 7266 1.98 2.91 1.54 97 SUBJ_ALL_CAPS 7253 1.93 2.77 1.54 98 TR_Symld_Words 7198 1.43 1.22 1.53 99 XM_DIRTYINTL 7170 2.08 3.28 1.52 100 INVALID_MSGID 7081 1.08 0.17 1.50 101 USER_IN_DEF_DKIM_WL 6783 1.01 0.10 1.44 102 XMCapTrack 6697 1.16 0.59 1.42 103 URI_WP_HACKED_2 6528 1.48 1.66 1.39 104 XM_OfRef6 6520 1.75 2.52 1.38 105 TO_MALFORMED 6517 0.95 0.01 1.38 106 URI_HEX 6253 1.90 3.13 1.33 107 BAYES_05 5889 1.02 0.54 1.25 108 RELAYCOUNTRY_CA 5787 1.86 3.20 1.23 109 T_XMDrugObfuBody_08 5713 1.37 1.71 1.21 110 HTML_SHORT_LINK_IMG_1 5660 3.40 8.10 1.20 111 XMPhish11 5648 1.15 1.05 1.20 112 BOTNET 5641 6.21 16.92 1.20 113 XM_H_PHPOS 5591 1.07 0.83 1.19 114 SHORTENED_URL_SRC 5478 3.34 8.00 1.16 115 SHORTENER_SHORT_IMG 5469 3.33 7.95 1.16 116 URI_BUFFLY 5469 3.33 7.95 1.16 117 XM_GoogleGroups 5087 0.88 0.45 1.08 118 DKIM_ADSP_CUSTOM_MED 5068 0.92 0.60 1.08 119 XMLngstWrd_00 5030 0.83 0.33 1.07 120 MIME_HTML_ONLY_MULTI 4760 1.76 3.36 1.01 121 RELAYCOUNTRY_GB 4630 0.94 0.84 0.98 122 URIBL_RHS_DOB 4525 1.26 1.90 0.96 123 XMLngstWrd_01 4443 0.74 0.30 0.94 124 IMPOTENCE 4414 1.03 1.22 0.94 125 XMGenDplmaNmb 4408 1.03 1.24 0.94 126 URI_TRY_3LD 4189 1.12 1.62 0.89 127 XMBdyGiftCard01 4102 1.20 1.92 0.87 128 T_FILL_THIS_FORM_SHORT 4036 0.86 0.86 0.86 129 UNTRUSTED_Relay 4029 5.01 13.87 0.86 130 XM_H_Long_From02 4012 1.13 1.73 0.85 131 XMStockSpam_06 4001 1.36 2.44 0.85 132 HTML_IMAGE_ONLY_04 3745 2.51 6.17 0.80 133 NML_ADSP_CUSTOM_MED 3713 0.71 0.53 0.79 134 NO_DNS_FOR_FROM 3635 0.91 1.19 0.77 135 TM2_M_VERY_LONG_WORD 3596 0.95 1.34 0.76 136 XM_ShortIntro_01 3497 0.65 0.44 0.74 137 TR_MetaPhish_Combo_01 3308 0.67 0.60 0.70 138 XM_ProductURIs 3270 0.76 0.91 0.69 139 T_XMHurry_00 3053 0.97 1.65 0.65 140 XMSubMetaSxObfu_02 2939 0.50 0.22 0.62 141 T_Symld_Words_02 2920 0.68 0.80 0.62 142 KHOP_DYNAMIC 2918 0.56 0.43 0.62 143 T_TooManySym_03 2894 0.51 0.28 0.61 144 HTML_IMAGE_ONLY_08 2827 1.14 2.30 0.60 145 XM_H_PHPMailer 2760 0.59 0.61 0.59 146 USER_IN_WHITELIST 2740 0.40 0.00 0.58 147 XMSubMetaI_00 2736 1.36 3.02 0.58 148 ONLINE_PHARMACY 2664 0.61 0.70 0.57 149 FORGED_GMAIL_RCVD 2635 0.53 0.46 0.56 150 XMNoVowels 2620 0.56 0.56 0.56 151 AC_DIV_BONANZA 2578 0.42 0.16 0.55 152 MISSING_HEADERS 2554 2.66 7.18 0.54 153 XMBrknScrpt_02 2535 0.61 0.76 0.54 154 XM_UB50 2509 2.13 5.53 0.53 155 T_XMDrugObfuBody_00 2482 0.71 1.09 0.53 156 XMBody_95 2462 0.40 0.13 0.52 157 XMLngstWrd_02 2450 0.42 0.22 0.52 158 T_OBFU_PDF_ATTACH 2391 0.40 0.16 0.51 159 HTML_FONT_SIZE_LARGE 2390 0.82 1.50 0.51 160 XMMoneyMeta_00 2384 0.92 1.79 0.51 161 SHORT_HELO_AND_INLINE_IMAGE 2275 0.35 0.08 0.48 162 HTML_SHORT_CENTER 2266 1.91 4.97 0.48 163 HTML_IMAGE_ONLY_32 2206 0.43 0.34 0.47 164 XMSlimDrugH 2147 0.72 1.28 0.46 165 RCVD_IN_SORBS_DUL 2071 0.35 0.15 0.44 166 RELAYCOUNTRY_AU 2068 0.50 0.62 0.44 167 URI_NOVOWEL 2049 0.52 0.70 0.44 168 TM2_M_BODY_EMPTY 2039 0.39 0.31 0.43 169 TVD_VISIT_PHARMA 2027 0.50 0.64 0.43 170 FILL_THIS_FORM 2021 0.54 0.78 0.43 171 TR_XM_RelayPhish 2014 0.74 1.42 0.43 172 HTTPS_HTTP_MISMATCH 1979 0.53 0.76 0.42 173 XMBody_17 1974 0.81 1.65 0.42 174 HTML_FONT_FACE_BAD 1953 0.60 1.00 0.41 175 XMDateMe_00 1930 0.42 0.45 0.41 176 XMSexyCombo_01 1835 1.03 2.40 0.39 177 XM_B_REG_HTML 1833 0.56 0.91 0.39 178 HTML_TAG_BALANCE_BODY 1832 0.52 0.80 0.39 179 XMSubMetaSxObfu_03 1793 0.75 1.53 0.38 180 TM2_M_A_HREF_HREF 1778 0.41 0.49 0.38 181 XMHTML_After_End 1763 0.64 1.21 0.37 182 URIBL_DBL_ABUSE_SPAM 1749 0.40 0.45 0.37 183 RDNS_DYNAMIC 1748 0.60 1.09 0.37 184 XMPhish14 1738 0.61 1.13 0.37 185 XM_B_COPY_HTML 1715 0.48 0.74 0.36 186 TVD_SPACE_RATIO 1688 0.38 0.44 0.36 187 XMBody_78 1671 0.56 0.99 0.35 188 HTML_IMAGE_ONLY_28 1649 0.37 0.41 0.35 189 XMGappySubj_01 1604 0.36 0.40 0.34 190 XMSubNoVowel 1597 0.44 0.65 0.34 191 XM_H_PHPOS_M 1582 0.35 0.37 0.34 192 XMHTMLBadTable_001 1564 0.49 0.83 0.33 193 T_FILL_THIS_FORM_LONG 1552 0.45 0.70 0.33 194 HTML_IMAGE_ONLY_16 1533 0.28 0.19 0.33 195 XMSolicitRefs_0 1522 0.34 0.37 0.32 196 DKIM_ADSP_NXDOMAIN 1519 0.39 0.53 0.32 197 XMSubMetaSSx_00 1515 0.58 1.12 0.32 198 XM_USANA_RCVD 1510 0.22 0.00 0.32 199 HTML_IMAGE_ONLY_24 1477 0.33 0.37 0.31 200 RELAYCOUNTRY_DE 1475 0.38 0.51 0.31 ----------------------------------------------------------------------