Email: 625170 Autolearn: 0 AvgScore: 3.17 AvgScanTime: 7.76 sec Spam: 178809 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 9.14 sec Ham: 446361 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 7.21 sec Time Spent Running SA: 1347.27 hours Time Spent Processing Spam: 453.80 hours Time Spent Processing Ham: 893.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170330 80.94 95.26 75.20 2 DKIM_SIGNED 155433 68.29 86.93 60.83 3 XM_DK_Pass 151788 66.80 84.89 59.56 4 DCC_CHECK 144132 45.55 80.61 31.51 5 XMListUnsubscribeExists 134162 47.45 75.03 36.41 6 XM_H_QuotedFrom 96873 37.25 54.18 30.47 7 XM_DK_Undo_02 83933 20.64 46.94 10.10 8 DKIM_VALID 83483 41.46 46.69 39.36 9 BAYES_99 76984 19.01 43.05 9.38 10 DKIM_INVALID 71950 26.83 40.24 21.46 11 LOC_TINY_FONT_1 69627 22.64 38.94 16.11 12 HTML_FONT_LOW_CONTRAST 67068 25.12 37.51 20.16 13 DKIM_VALID_AU 66817 31.03 37.37 28.49 14 BAYES_999 66684 16.62 37.29 8.34 15 BAYES_50 62928 53.43 35.19 60.74 16 TR_DCC_Bayes_99 61186 13.33 34.22 4.97 17 MIME_HTML_ONLY 53789 21.03 30.08 17.40 18 FVGT_m_MULTI_ODD 47644 19.19 26.65 16.21 19 XMSubLong 44008 20.62 24.61 19.02 20 XM_Body_Dirty_Words 35864 12.30 20.06 9.20 21 T_KAM_HTML_FONT_INVALID 34631 13.98 19.37 11.82 22 HTML_IMAGE_RATIO_02 33556 9.80 18.77 6.21 23 T_TM2_M_HEADER_IN_MSG 32952 27.09 18.43 30.56 24 DCC_CHECK_NEGATIVE 31047 52.46 17.36 66.51 25 XM_Evil_Numbers_Gen 29740 10.41 16.63 7.92 26 MultiRelay 29046 17.43 16.24 17.91 27 RELAYCOUNTRY_META 28981 8.19 16.21 4.98 28 XM_Multi_Part_URI 28973 11.83 16.20 10.08 29 BOTNET_IPINHOSTNAME 23665 6.52 13.23 3.83 30 BOTNET 20372 4.07 11.39 1.13 31 T_XMDrugObfuBody_14 19022 8.63 10.64 7.83 32 DKIM_VALID_EF 18623 12.58 10.42 13.45 33 LotsOfNums_01 18071 7.71 10.11 6.74 34 FSL_BULK_SIG 18059 8.11 10.10 7.31 35 UNTRUSTED_Relay 17646 3.91 9.87 1.52 36 LOTS_OF_MONEY 17454 8.57 9.76 8.09 37 HTML_IMAGE_RATIO_04 17427 5.75 9.75 4.15 38 XM_B_Phish_Phrases 17222 5.97 9.63 4.51 39 XMSexyCombo_05 16661 4.78 9.32 2.96 40 XM_H_Long_From01 15279 5.79 8.54 4.69 41 TooManyTo_001 15126 8.24 8.46 8.15 42 TR_XM_DocInvoice 14230 4.65 7.96 3.32 43 FROM_EXCESS_BASE64 13557 4.48 7.58 3.24 44 MPART_ALT_DIFF 12732 3.67 7.12 2.29 45 BAYES_80 12585 4.45 7.04 3.41 46 XMSubMetaSx_00 10925 3.99 6.11 3.14 47 XM_UncommonTLD01 10688 4.03 5.98 3.25 48 BAYES_60 9965 6.22 5.57 6.48 49 MIME_HTML_MOSTLY 9838 2.95 5.50 1.92 50 XMStrtUSub 9487 4.45 5.31 4.11 51 XM_UB50 9249 2.24 5.17 1.07 52 MIME_QP_LONG_LINE 9077 4.76 5.08 4.63 53 T_MIXED_ES 8671 2.78 4.85 1.95 54 TM2_M_URI_OPT_OUT 7820 2.48 4.37 1.72 55 BAYES_95 7700 2.66 4.31 2.00 56 T_REMOTE_IMAGE 7613 4.46 4.26 4.55 57 XMNumbers 7429 3.61 4.15 3.39 58 XM_DIRTYINTL 7023 2.26 3.93 1.60 59 MultiRelay_Combo 6998 1.30 3.91 0.25 60 MultiRelay_CC 6998 1.30 3.91 0.25 61 URI_HEX 6747 1.78 3.77 0.98 62 XM_SendGrid 6742 4.46 3.77 4.73 63 HTML_IMAGE_RATIO_06 6540 3.14 3.66 2.93 64 T_TooManySym_01 6470 3.84 3.62 3.93 65 RCVD_IN_RP_SAFE 6442 5.01 3.60 5.57 66 XM_CamelCaseFrm001 6186 2.07 3.46 1.52 67 XM_OfRef6 6006 1.93 3.36 1.36 68 XM_SPF_SoftFail 5973 2.36 3.34 1.96 69 RELAYCOUNTRY_CA 5358 1.72 3.00 1.21 70 MIME_HTML_ONLY_MULTI 5254 1.57 2.94 1.03 71 SUBJ_ALL_CAPS 5108 2.05 2.86 1.72 72 HTML_IMAGE_RATIO_08 5050 2.04 2.82 1.72 73 XMSubMetaI_00 4972 1.29 2.78 0.70 74 XMBdyGiftCard01 4919 1.18 2.75 0.55 75 RCVD_IN_RP_CERTIFIED 4595 4.25 2.57 4.92 76 SpammyFromTLD_02 4401 0.85 2.46 0.20 77 RCVD_IN_RP_RNBL 3909 0.65 2.19 0.03 78 MAILING_LIST_MULTI 3831 2.33 2.14 2.40 79 RCVD_IN_BL_SPAMCOP_NET 3759 0.81 2.10 0.29 80 T_XMDrugObfuBody_08 3663 1.97 2.05 1.93 81 RELAYCOUNTRY_FR 3584 0.77 2.00 0.28 82 XMSexyCombo_01 3539 1.07 1.98 0.70 83 XMDiploma_00 3500 1.40 1.96 1.18 84 XMBody_17 3201 0.80 1.79 0.40 85 FILL_THIS_FORM 3147 0.63 1.76 0.17 86 XMBody_78 3147 0.81 1.76 0.43 87 HTML_MIME_NO_HTML_TAG 3102 2.08 1.73 2.21 88 TM2_M_VERY_LONG_WORD 3057 1.02 1.71 0.74 89 XM_ProductURIs 3051 1.14 1.71 0.91 90 XM_URI_RBL 3038 0.55 1.70 0.09 91 BAYES_00 2972 7.00 1.66 9.13 92 RELAYCOUNTRY_GB 2938 1.23 1.64 1.06 93 XM_DK_Undo_01 2893 1.77 1.62 1.83 94 XM_UB99 2822 0.46 1.58 0.01 95 ALL_TRUSTED 2790 21.17 1.56 29.02 96 T_XMDrugObfuBody_00 2730 1.15 1.53 1.01 97 XMPhish30 2686 0.64 1.50 0.30 98 XMBrknScrpt_02 2683 0.79 1.50 0.51 99 TR_XM_RelayPhish 2609 0.74 1.46 0.45 100 TooManyTo_002 2549 2.30 1.43 2.65 101 REMOVE_BEFORE_LINK 2526 0.61 1.41 0.29 102 XM_H_Long_From02 2509 0.94 1.40 0.75 103 XMPhish14 2503 0.74 1.40 0.47 104 FILL_THIS_FORM_LONG 2499 0.46 1.40 0.08 105 BOTNET_NORDNS 2491 0.41 1.39 0.02 106 BAYES_40 2486 3.26 1.39 4.02 107 XMStockSpam_06 2477 1.40 1.39 1.41 108 TR_XM_DK_Bayes 2475 4.90 1.38 6.31 109 T_XMHurry_00 2441 0.77 1.37 0.53 110 XM_B_REG_HTML 2394 0.65 1.34 0.37 111 FILL_THIS_FORM_LOAN 2367 0.41 1.32 0.04 112 BODY_ENHANCEMENT 2362 0.39 1.32 0.01 113 TooManyTo_003 2307 1.62 1.29 1.76 114 TR_LOTS_OF_MONEY2 2271 1.36 1.27 1.39 115 T_MONEY_PERCENT 2271 1.36 1.27 1.39 116 XMHTML_After_End 2259 0.59 1.26 0.32 117 XM_UB999 2240 0.36 1.25 0.00 118 SpammyFromTLD_01 2220 1.01 1.24 0.92 119 TR_Caps_n_Bayes_99 2170 0.39 1.21 0.05 120 ANY_BOUNCE_MESSAGE 2159 3.88 1.21 4.95 121 BOUNCE_MESSAGE 2156 3.88 1.21 4.95 122 T_FILL_THIS_FORM_SHORT 2155 0.90 1.21 0.78 123 RCVD_IN_MSPIKE_WL 2122 2.07 1.19 2.43 124 UNPARSEABLE_RELAY 2116 2.44 1.18 2.95 125 RCVD_IN_MSPIKE_H3 2112 2.06 1.18 2.41 126 BAYES_20 2052 2.38 1.15 2.88 127 LONG_JUNK_URI 2048 0.39 1.15 0.08 128 RELAYCOUNTRY_AT 2047 0.41 1.14 0.11 129 RCVD_IN_IADB_LISTED 2032 2.37 1.14 2.86 130 BODY_URI_ONLY 2028 0.42 1.13 0.13 131 TooManyTo_004 2024 1.29 1.13 1.36 132 RCVD_IN_PSBL 1989 0.35 1.11 0.04 133 XM_S_JOY_D 1956 0.55 1.09 0.33 134 URI_TRY_3LD 1948 0.73 1.09 0.59 135 TR_Symld_Words 1939 2.57 1.08 3.16 136 XMPhish11 1932 1.09 1.08 1.09 137 XMGenDplmaNmb 1890 0.85 1.06 0.77 138 XM_B_COPY_HTML 1888 0.54 1.06 0.34 139 RCVD_IN_MSPIKE_H2 1878 2.48 1.05 3.06 140 XMClaimOffer 1847 0.51 1.03 0.30 141 URIBL_BLACK 1825 0.31 1.02 0.02 142 XMSubNoVowel 1809 0.54 1.01 0.35 143 RCVD_IN_IADB_SPF 1796 2.06 1.00 2.49 144 HTML_FONT_FACE_BAD 1791 0.52 1.00 0.33 145 SUBJ_DOLLARS 1756 0.41 0.98 0.18 146 RCVD_IN_IADB_DK 1706 1.79 0.95 2.12 147 RCVD_IN_IADB_SENDERID 1705 1.84 0.95 2.19 148 RDNS_DYNAMIC 1704 0.52 0.95 0.34 149 XM_OfRef7 1677 0.36 0.94 0.13 150 TooManyTo_005 1668 1.08 0.93 1.14 151 MPART_ALT_DIFF_COUNT 1617 0.40 0.90 0.20 152 HTML_SHORT_LINK_IMG_1 1591 0.28 0.89 0.04 153 XM_PDF 1590 3.40 0.89 4.40 154 LOW_PRICE 1581 0.60 0.88 0.48 155 T_Symld_Words_02 1562 0.46 0.87 0.30 156 PLING_QUERY 1516 0.39 0.85 0.20 157 XM_HighProb1 1487 0.24 0.83 0.01 158 FSL_THIS_IS_ADV 1485 0.27 0.83 0.05 159 DIET_1 1482 0.38 0.83 0.20 160 DKIM_ADSP_CUSTOM_MED 1479 0.83 0.83 0.83 161 T_HTML_TAG_BALANCE_CENTER 1477 0.37 0.83 0.19 162 XM_UB60 1451 0.27 0.81 0.06 163 RELAYCOUNTRY_CN 1443 0.28 0.81 0.06 164 SINGLETS_LOW_CONTRAST 1442 0.27 0.81 0.06 165 LONG_JUNK_URI3 1428 0.29 0.80 0.09 166 HTML_IMAGE_ONLY_04 1422 0.27 0.80 0.05 167 RELAYCOUNTRY_JP 1415 0.26 0.79 0.04 168 HTML_TAG_BALANCE_BODY 1409 0.44 0.79 0.30 169 XM_H_PHPOS 1376 1.12 0.77 1.26 170 TR_LOTS_OF_MONEY3 1367 0.43 0.76 0.29 171 THIS_AD 1359 0.28 0.76 0.09 172 XM_BadFromFormat 1358 0.38 0.76 0.23 173 XMSubEmpty 1351 0.43 0.76 0.30 174 XM_RXBody 1349 0.61 0.75 0.55 175 DATE_IN_PAST_03_06 1290 0.28 0.72 0.10 176 TR_XM_DK_Bayes1 1285 3.14 0.72 4.10 177 XMMoneyMeta_00 1279 0.53 0.72 0.46 178 XMSubMetaSxObfu_03 1273 0.38 0.71 0.25 179 URI_NOVOWEL 1261 0.44 0.71 0.34 180 RELAYCOUNTRY_DE 1259 0.64 0.70 0.61 181 XM_OfRef8 1248 0.22 0.70 0.03 182 TR_XM_DK_Bayes2 1242 2.51 0.69 3.23 183 XM_Body_Obfu01 1233 0.40 0.69 0.29 184 XMHTMLBadTable_001 1211 0.35 0.68 0.22 185 FORGED_GMAIL_RCVD 1208 0.45 0.68 0.35 186 XM_UB80 1196 0.21 0.67 0.02 187 NML_ADSP_CUSTOM_MED 1194 0.61 0.67 0.58 188 RELAYCOUNTRY_AU 1193 0.45 0.67 0.36 189 XMBounce_01 1189 0.24 0.66 0.07 190 HTTPS_HTTP_MISMATCH 1189 0.48 0.66 0.40 191 HTML_IMAGE_ONLY_28 1184 0.50 0.66 0.43 192 HTML_FONT_SIZE_HUGE 1183 0.28 0.66 0.13 193 T_TooManySym_02 1178 1.26 0.66 1.50 194 XMGppyBdWords 1176 0.34 0.66 0.21 195 XMSubMetaD_03 1176 0.21 0.66 0.03 196 XM_B_TRADE_HTML 1171 0.49 0.65 0.43 197 RCVD_IN_MSPIKE_BL 1160 0.39 0.65 0.29 198 BAYES_05 1103 1.51 0.62 1.87 199 RELAYCOUNTRY_IT 1098 0.21 0.61 0.05 200 HTML_SHORT_CENTER 1073 0.18 0.60 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 335684 80.94 95.26 75.20 2 DCC_CHECK_NEGATIVE 296893 52.46 17.36 66.51 3 DKIM_SIGNED 271505 68.29 86.93 60.83 4 BAYES_50 271128 53.43 35.19 60.74 5 XM_DK_Pass 265852 66.80 84.89 59.56 6 DKIM_VALID 175702 41.46 46.69 39.36 7 XMListUnsubscribeExists 162511 47.45 75.03 36.41 8 DCC_CHECK 140628 45.55 80.61 31.51 9 T_TM2_M_HEADER_IN_MSG 136411 27.09 18.43 30.56 10 XM_H_QuotedFrom 135999 37.25 54.18 30.47 11 ALL_TRUSTED 129551 21.17 1.56 29.02 12 DKIM_VALID_AU 127174 31.03 37.37 28.49 13 DKIM_INVALID 95803 26.83 40.24 21.46 14 HTML_FONT_LOW_CONTRAST 90004 25.12 37.51 20.16 15 XMSubLong 84896 20.62 24.61 19.02 16 MultiRelay 79925 17.43 16.24 17.91 17 MIME_HTML_ONLY 77674 21.03 30.08 17.40 18 FVGT_m_MULTI_ODD 72353 19.19 26.65 16.21 19 LOC_TINY_FONT_1 71893 22.64 38.94 16.11 20 DKIM_VALID_EF 60016 12.58 10.42 13.45 21 T_KAM_HTML_FONT_INVALID 52766 13.98 19.37 11.82 22 XM_DK_Undo_02 45096 20.64 46.94 10.10 23 XM_Multi_Part_URI 45015 11.83 16.20 10.08 24 XM_DKIMWhitelistDomains 42880 6.87 0.05 9.61 25 BAYES_99 41876 19.01 43.05 9.38 26 XM_Body_Dirty_Words 41051 12.30 20.06 9.20 27 BAYES_00 40761 7.00 1.66 9.13 28 BAYES_999 37247 16.62 37.29 8.34 29 TooManyTo_001 36398 8.24 8.46 8.15 30 LOTS_OF_MONEY 36122 8.57 9.76 8.09 31 XM_Evil_Numbers_Gen 35364 10.41 16.63 7.92 32 T_XMDrugObfuBody_14 34937 8.63 10.64 7.83 33 FSL_BULK_SIG 32642 8.11 10.10 7.31 34 LotsOfNums_01 30106 7.71 10.11 6.74 35 BAYES_60 28906 6.22 5.57 6.48 36 TR_XM_DK_Bayes 28144 4.90 1.38 6.31 37 HTML_IMAGE_RATIO_02 27697 9.80 18.77 6.21 38 RCVD_IN_RP_SAFE 24871 5.01 3.60 5.57 39 IN_ZIMBRA_NJ_WHITELIST 23303 3.74 0.03 5.22 40 RELAYCOUNTRY_META 22242 8.19 16.21 4.98 41 TR_DCC_Bayes_99 22180 13.33 34.22 4.97 42 ANY_BOUNCE_MESSAGE 22077 3.88 1.21 4.95 43 BOUNCE_MESSAGE 22073 3.88 1.21 4.95 44 RCVD_IN_RP_CERTIFIED 21948 4.25 2.57 4.92 45 XM_SendGrid 21124 4.46 3.77 4.73 46 XM_H_Long_From01 20944 5.79 8.54 4.69 47 MIME_QP_LONG_LINE 20665 4.76 5.08 4.63 48 T_REMOTE_IMAGE 20296 4.46 4.26 4.55 49 XM_B_Phish_Phrases 20110 5.97 9.63 4.51 50 XM_PDF 19635 3.40 0.89 4.40 51 HTML_IMAGE_RATIO_04 18539 5.75 9.75 4.15 52 XMStrtUSub 18340 4.45 5.31 4.11 53 TR_XM_DK_Bayes1 18322 3.14 0.72 4.10 54 BAYES_40 17922 3.26 1.39 4.02 55 T_TooManySym_01 17555 3.84 3.62 3.93 56 BOTNET_IPINHOSTNAME 17105 6.52 13.23 3.83 57 BAYES_80 15216 4.45 7.04 3.41 58 XMNumbers 15120 3.61 4.15 3.39 59 TR_XM_DocInvoice 14841 4.65 7.96 3.32 60 XM_UncommonTLD01 14528 4.03 5.98 3.25 61 FROM_EXCESS_BASE64 14449 4.48 7.58 3.24 62 TR_XM_DK_Bayes2 14437 2.51 0.69 3.23 63 TR_Symld_Words 14124 2.57 1.08 3.16 64 XMSubMetaSx_00 14035 3.99 6.11 3.14 65 RCVD_IN_MSPIKE_H2 13641 2.48 1.05 3.06 66 XMSexyCombo_05 13229 4.78 9.32 2.96 67 UNPARSEABLE_RELAY 13147 2.44 1.18 2.95 68 HTML_IMAGE_RATIO_06 13086 3.14 3.66 2.93 69 BAYES_20 12857 2.38 1.15 2.88 70 RCVD_IN_IADB_LISTED 12769 2.37 1.14 2.86 71 TooManyTo_002 11807 2.30 1.43 2.65 72 TVD_RCVD_IP 11187 1.88 0.33 2.51 73 RCVD_IN_IADB_SPF 11102 2.06 1.00 2.49 74 RCVD_IN_MSPIKE_WL 10848 2.07 1.19 2.43 75 RCVD_IN_MSPIKE_H3 10759 2.06 1.18 2.41 76 MAILING_LIST_MULTI 10707 2.33 2.14 2.40 77 HELO_NODOT 10518 1.78 0.33 2.36 78 MPART_ALT_DIFF 10229 3.67 7.12 2.29 79 HTML_MIME_NO_HTML_TAG 9875 2.08 1.73 2.21 80 RCVD_IN_IADB_SENDERID 9785 1.84 0.95 2.19 81 IN_HORDE_ADDRESS_BOOK 9709 1.57 0.06 2.18 82 RCVD_IN_IADB_DK 9458 1.79 0.95 2.12 83 BAYES_95 8945 2.66 4.31 2.00 84 RCVD_IN_IADB_VOUCHED 8904 1.56 0.47 1.99 85 XM_SPF_SoftFail 8753 2.36 3.34 1.96 86 T_MIXED_ES 8686 2.78 4.85 1.95 87 T_XMDrugObfuBody_08 8637 1.97 2.05 1.93 88 MIME_HTML_MOSTLY 8575 2.95 5.50 1.92 89 BAYES_05 8365 1.51 0.62 1.87 90 XM_DK_Undo_01 8173 1.77 1.62 1.83 91 TooManyTo_003 7839 1.62 1.29 1.76 92 HTML_IMAGE_RATIO_08 7697 2.04 2.82 1.72 93 SUBJ_ALL_CAPS 7680 2.05 2.86 1.72 94 TM2_M_URI_OPT_OUT 7656 2.48 4.37 1.72 95 XM_DIRTYINTL 7126 2.26 3.93 1.60 96 XM_ShortIntro_01 6824 1.20 0.39 1.53 97 UNTRUSTED_Relay 6779 3.91 9.87 1.52 98 XM_CamelCaseFrm001 6763 2.07 3.46 1.52 99 INVALID_MSGID 6691 1.13 0.19 1.50 100 T_TooManySym_02 6682 1.26 0.66 1.50 101 XMCapTrack 6286 1.15 0.51 1.41 102 XMStockSpam_06 6272 1.40 1.39 1.41 103 T_MONEY_PERCENT 6201 1.36 1.27 1.39 104 TR_LOTS_OF_MONEY2 6201 1.36 1.27 1.39 105 TO_MALFORMED 6114 0.98 0.02 1.37 106 XM_OfRef6 6072 1.93 3.36 1.36 107 TooManyTo_004 6058 1.29 1.13 1.36 108 XM_H_PHPOS 5631 1.12 0.77 1.26 109 USER_IN_DEF_DKIM_WL 5508 0.88 0.01 1.23 110 RELAYCOUNTRY_CA 5407 1.72 3.00 1.21 111 XMDiploma_00 5252 1.40 1.96 1.18 112 XM_H_SpoofStaff4 5174 0.84 0.05 1.16 113 XM_GoogleGroups 5133 0.95 0.46 1.15 114 TooManyTo_005 5084 1.08 0.93 1.14 115 BOTNET 5052 4.07 11.39 1.13 116 XMPhish11 4863 1.09 1.08 1.09 117 XM_UB50 4764 2.24 5.17 1.07 118 RELAYCOUNTRY_GB 4745 1.23 1.64 1.06 119 MIME_HTML_ONLY_MULTI 4591 1.57 2.94 1.03 120 T_XMDrugObfuBody_00 4486 1.15 1.53 1.01 121 URI_HEX 4391 1.78 3.77 0.98 122 XM_H_HyphenDoc 4321 0.70 0.03 0.97 123 RCVD_IN_IADB_OPTIN 4215 0.75 0.26 0.94 124 TO_NO_BRKTS_HTML_ONLY 4155 0.72 0.21 0.93 125 SpammyFromTLD_01 4108 1.01 1.24 0.92 126 XM_ProductURIs 4075 1.14 1.71 0.91 127 XMBody_95 3843 0.67 0.18 0.86 128 DKIM_ADSP_CUSTOM_MED 3699 0.83 0.83 0.83 129 T_FILL_THIS_FORM_SHORT 3468 0.90 1.21 0.78 130 XMGenDplmaNmb 3451 0.85 1.06 0.77 131 XM_H_Long_From02 3341 0.94 1.40 0.75 132 TM2_M_VERY_LONG_WORD 3309 1.02 1.71 0.74 133 XMSexyCombo_01 3122 1.07 1.98 0.70 134 XMNoVowels 3117 0.61 0.38 0.70 135 USER_IN_WHITELIST 3113 0.50 0.00 0.70 136 XMSubMetaI_00 3104 1.29 2.78 0.70 137 T_TooManySym_03 2991 0.53 0.19 0.67 138 HTML_IMAGE_ONLY_08 2954 0.50 0.10 0.66 139 MISSING_HEADERS 2781 0.58 0.47 0.62 140 RELAYCOUNTRY_DE 2716 0.64 0.70 0.61 141 TR_MetaPhish_Combo_01 2677 0.59 0.58 0.60 142 XM_H_PHPMailer 2668 0.55 0.43 0.60 143 URI_TRY_3LD 2630 0.73 1.09 0.59 144 XMGappySubj_01 2615 0.51 0.33 0.59 145 NML_ADSP_CUSTOM_MED 2592 0.61 0.67 0.58 146 XM_RXBody 2466 0.61 0.75 0.55 147 T_OBFU_PDF_ATTACH 2441 0.50 0.40 0.55 148 XMBdyGiftCard01 2438 1.18 2.75 0.55 149 SHORT_HELO_AND_INLINE_IMAGE 2399 0.40 0.05 0.54 150 T_XMHurry_00 2363 0.77 1.37 0.53 151 XMBrknScrpt_02 2273 0.79 1.50 0.51 152 AC_DIV_BONANZA 2243 0.39 0.10 0.50 153 LOW_PRICE 2156 0.60 0.88 0.48 154 XMPhish14 2113 0.74 1.40 0.47 155 XMDateMe_00 2074 0.44 0.36 0.46 156 XMMoneyMeta_00 2049 0.53 0.72 0.46 157 XMSubMetaSxObfu_02 2040 0.41 0.29 0.46 158 TR_XM_RelayPhish 2021 0.74 1.46 0.45 159 TVD_SPACE_RATIO 1981 0.43 0.39 0.44 160 XMBody_78 1930 0.81 1.76 0.43 161 HTML_IMAGE_ONLY_28 1929 0.50 0.66 0.43 162 XM_B_TRADE_HTML 1920 0.49 0.65 0.43 163 HTML_IMAGE_ONLY_32 1856 0.37 0.25 0.42 164 RCVD_IN_SORBS_DUL 1811 0.32 0.12 0.41 165 HTML_IMAGE_ONLY_24 1794 0.40 0.38 0.40 166 HTTPS_HTTP_MISMATCH 1781 0.48 0.66 0.40 167 TM2_M_BODY_EMPTY 1780 0.44 0.56 0.40 168 XMBody_17 1775 0.80 1.79 0.40 169 XM_B_REG_HTML 1639 0.65 1.34 0.37 170 XM_H_PHPOS_M 1634 0.33 0.25 0.37 171 RELAYCOUNTRY_AU 1624 0.45 0.67 0.36 172 RCVD_IN_IADB_DOPTIN 1604 0.27 0.04 0.36 173 XMSubNoVowel 1583 0.54 1.01 0.35 174 FORGED_GMAIL_RCVD 1576 0.45 0.68 0.35 175 T_TooManySym_04 1542 0.27 0.07 0.35 176 RDNS_DYNAMIC 1537 0.52 0.95 0.34 177 XM_B_COPY_HTML 1511 0.54 1.06 0.34 178 DOS_OUTLOOK_TO_MX 1506 0.26 0.08 0.34 179 URI_NOVOWEL 1497 0.44 0.71 0.34 180 XMGappySubj_02 1492 0.27 0.10 0.33 181 XM_S_JOY_D 1490 0.55 1.09 0.33 182 HTML_FONT_FACE_BAD 1481 0.52 1.00 0.33 183 T_MANY_PILL_PRICE 1463 0.23 0.00 0.33 184 XMLngstWrd_00 1433 0.37 0.48 0.32 185 XMHTML_After_End 1414 0.59 1.26 0.32 186 XM_H_Trusted_IP 1370 0.22 0.00 0.31 187 XMSubEmpty 1361 0.43 0.76 0.30 188 HTML_TAG_BALANCE_BODY 1361 0.44 0.79 0.30 189 XMClaimOffer 1354 0.51 1.03 0.30 190 T_Symld_Words_02 1344 0.46 0.87 0.30 191 XMPhish30 1333 0.64 1.50 0.30 192 HTML_IMAGE_ONLY_20 1331 0.27 0.19 0.30 193 RCVD_IN_MSPIKE_BL 1293 0.39 0.65 0.29 194 TR_LOTS_OF_MONEY3 1290 0.43 0.76 0.29 195 XMLngstWrd_01 1286 0.33 0.42 0.29 196 REMOVE_BEFORE_LINK 1283 0.61 1.41 0.29 197 RCVD_IN_BL_SPAMCOP_NET 1278 0.81 2.10 0.29 198 XM_Body_Obfu01 1274 0.40 0.69 0.29 199 RELAYCOUNTRY_FR 1261 0.77 2.00 0.28 200 XMRcvdHeader_15 1224 0.20 0.00 0.27 ----------------------------------------------------------------------