Email: 577101 Autolearn: 0 AvgScore: 3.80 AvgScanTime: 4.50 sec Spam: 188815 Autolearn: 0 AvgScore: 12.40 AvgScanTime: 5.63 sec Ham: 388286 Autolearn: 0 AvgScore: -0.38 AvgScanTime: 3.96 sec Time Spent Running SA: 721.90 hours Time Spent Processing Spam: 295.31 hours Time Spent Processing Ham: 426.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176985 86.01 93.73 82.26 2 DKIM_SIGNED 159102 71.70 84.26 65.60 3 XM_DK_Pass 154389 69.87 81.77 64.08 4 DCC_CHECK 152958 49.62 81.01 34.36 5 DKIM_VALID 143366 64.31 75.93 58.66 6 XMListUnsubscribeExists 135767 51.23 71.90 41.18 7 XM_H_QuotedFrom 109682 42.49 58.09 34.90 8 DKIM_VALID_AU 108204 45.28 57.31 39.44 9 XM_DK_Undo_02 95340 24.98 50.49 12.58 10 BAYES_99 85112 22.39 45.08 11.36 11 BAYES_999 72648 19.30 38.48 9.97 12 TR_DCC_Bayes_99 68392 15.46 36.22 5.37 13 HTML_FONT_LOW_CONTRAST 67192 26.85 35.59 22.61 14 LOC_TINY_FONT_1 63957 21.51 33.87 15.49 15 BAYES_50 58310 48.83 30.88 57.56 16 MIME_HTML_ONLY 53104 20.21 28.12 16.36 17 FVGT_m_MULTI_ODD 51934 21.69 27.51 18.86 18 XMSubLong 46597 20.97 24.68 19.17 19 DKIM_VALID_EF 42576 22.87 22.55 23.02 20 T_KAM_HTML_FONT_INVALID 41336 16.72 21.89 14.20 21 T_TM2_M_HEADER_IN_MSG 39666 30.70 21.01 35.41 22 XM_Body_Dirty_Words 34845 11.84 18.45 8.63 23 DCC_CHECK_NEGATIVE 32060 48.18 16.98 63.35 24 XM_Multi_Part_URI 31084 11.73 16.46 9.44 25 HTML_IMAGE_RATIO_02 29713 9.25 15.74 6.10 26 MultiRelay 28899 17.88 15.31 19.13 27 RELAYCOUNTRY_META 27552 8.43 14.59 5.43 28 FSL_BULK_SIG 27164 10.97 14.39 9.30 29 BOTNET 26047 5.42 13.79 1.35 30 XM_Evil_Numbers_Gen 24617 8.74 13.04 6.66 31 LOTS_OF_MONEY 23398 9.35 12.39 7.87 32 BOTNET_IPINHOSTNAME 23082 6.26 12.22 3.36 33 XMSubMetaSx_00 22522 7.41 11.93 5.22 34 T_XMDrugObfuBody_14 18985 8.09 10.05 7.14 35 XMSexyCombo_05 18476 5.10 9.79 2.82 36 LotsOfNums_01 17420 8.05 9.23 7.48 37 TR_XM_DocInvoice 16980 5.40 8.99 3.66 38 XM_B_Phish_Phrases 16211 5.32 8.59 3.74 39 UNTRUSTED_Relay 16052 3.83 8.50 1.55 40 DKIM_INVALID 15736 7.40 8.33 6.94 41 HTML_IMAGE_RATIO_04 15599 5.56 8.26 4.24 42 BAYES_80 14974 5.23 7.93 3.92 43 XM_H_Long_From01 14650 9.36 7.76 10.14 44 BAYES_60 13692 7.09 7.25 7.02 45 TooManyTo_001 12079 8.10 6.40 8.93 46 FROM_EXCESS_BASE64 11031 3.71 5.84 2.68 47 XM_UncommonTLD01 10748 4.23 5.69 3.52 48 HTML_IMAGE_RATIO_06 10695 3.59 5.66 2.59 49 MPART_ALT_DIFF 9943 3.51 5.27 2.66 50 TM2_M_URI_OPT_OUT 9629 2.86 5.10 1.77 51 ALL_TRUSTED 9435 17.91 5.00 24.19 52 MIME_HTML_MOSTLY 9189 2.84 4.87 1.85 53 MIME_QP_LONG_LINE 9023 5.21 4.78 5.43 54 RCVD_IN_MSPIKE_H2 8944 4.77 4.74 4.78 55 XM_SendGrid 8759 4.91 4.64 5.05 56 BAYES_95 8723 3.29 4.62 2.64 57 XMStrtUSub 8577 4.08 4.54 3.86 58 RCVD_IN_RP_SAFE 8410 6.22 4.45 7.08 59 XMNumbers 8010 3.50 4.24 3.13 60 RCVD_IN_RP_CERTIFIED 7037 5.62 3.73 6.54 61 SUBJ_ALL_CAPS 6952 5.29 3.68 6.07 62 XMSubNoVowel 6849 3.89 3.63 4.02 63 T_REMOTE_IMAGE 6705 4.36 3.55 4.76 64 XM_DIRTYINTL 6630 2.29 3.51 1.69 65 XM_UB50 6279 1.64 3.33 0.82 66 HTML_IMAGE_RATIO_08 6208 2.32 3.29 1.85 67 XM_OfRef6 5971 1.92 3.16 1.31 68 XM_CamelCaseFrm001 5894 2.07 3.12 1.57 69 RELAYCOUNTRY_CA 5872 1.98 3.11 1.44 70 RCVD_IN_BL_SPAMCOP_NET 5808 1.61 3.08 0.90 71 TR_Mismatch_TLD_01 5771 1.63 3.06 0.94 72 XM_SPF_SoftFail 5559 2.25 2.94 1.91 73 NO_DNS_FOR_FROM 5522 2.31 2.92 2.02 74 URI_HEX 5488 1.86 2.91 1.35 75 MIME_HTML_ONLY_MULTI 5352 1.78 2.83 1.26 76 XMSexyCombo_01 5301 1.29 2.81 0.56 77 XMSubEmpty 5029 3.20 2.66 3.46 78 RCVD_IN_IADB_LISTED 4972 4.93 2.63 6.05 79 T_TooManySym_01 4713 3.40 2.50 3.85 80 TM2_M_VERY_LONG_WORD 4568 1.34 2.42 0.82 81 RCVD_IN_IADB_SPF 4561 4.32 2.42 5.25 82 RCVD_IN_IADB_SENDERID 4366 3.86 2.31 4.62 83 XMDiploma_00 4321 1.80 2.29 1.56 84 RCVD_IN_IADB_DK 4312 3.76 2.28 4.47 85 XM_H_Long_From02 4171 1.29 2.21 0.85 86 XM_URI_RBL 3950 0.75 2.09 0.09 87 T_XMDrugObfuBody_08 3907 1.54 2.07 1.28 88 SpammyFromTLD_02 3868 0.93 2.05 0.39 89 XMBody_17 3735 0.91 1.98 0.39 90 SHORT_URI_2 3727 1.39 1.97 1.10 91 MultiRelay_Combo 3494 0.74 1.85 0.20 92 MultiRelay_CC 3494 0.74 1.85 0.20 93 BOTNET_NORDNS 3459 0.61 1.83 0.02 94 HTML_MIME_NO_HTML_TAG 3398 2.39 1.80 2.68 95 FILL_THIS_FORM 3371 0.89 1.79 0.45 96 FILL_THIS_FORM_LONG 3240 0.81 1.72 0.37 97 XM_DK_Undo_01 3240 1.85 1.72 1.91 98 T_XMHurry_00 3205 0.98 1.70 0.64 99 SpammyFromTLD_01 3169 1.13 1.68 0.86 100 XMHTML_After_End 3125 0.78 1.66 0.35 101 MAILING_LIST_MULTI 2901 2.29 1.54 2.66 102 XM_UB99 2873 0.51 1.52 0.02 103 RCVD_IN_RP_RNBL 2866 0.52 1.52 0.03 104 XMSubMetaI_00 2861 0.76 1.52 0.40 105 XMGenDplmaNmb 2812 1.11 1.49 0.92 106 XMBdyGiftCard01 2774 0.78 1.47 0.44 107 XM_ProductURIs 2750 0.96 1.46 0.72 108 MONEY_FRAUD_8 2748 0.48 1.46 0.00 109 XMPhish30 2729 0.70 1.45 0.34 110 TR_XM_RelayPhish 2669 0.81 1.41 0.52 111 XMStockSpam_06 2651 0.82 1.40 0.54 112 URIBL_BLACK 2631 0.48 1.39 0.04 113 XM_UB60 2627 0.64 1.39 0.28 114 LOADSA_MONEY_COMBO 2578 0.54 1.37 0.14 115 BAYES_40 2487 4.15 1.32 5.52 116 URI_TRY_3LD 2453 1.07 1.30 0.95 117 UNPARSEABLE_RELAY 2336 2.06 1.24 2.46 118 XFER_LOTSA_MONEY 2336 0.49 1.24 0.13 119 T_XMDrugObfuBody_00 2296 0.81 1.22 0.61 120 TR_Caps_n_Bayes_99 2295 0.46 1.22 0.09 121 XM_B_COPY_HTML 2293 0.70 1.21 0.46 122 BAYES_00 2276 5.23 1.21 7.19 123 RELAYCOUNTRY_FR 2233 0.56 1.18 0.25 124 TVD_SPACE_RATIO 2173 0.89 1.15 0.76 125 XMEmptySub 2149 0.92 1.14 0.81 126 XM_UB999 2142 0.38 1.13 0.02 127 URIBL_DBL_SPAM 2115 0.38 1.12 0.03 128 XMPhish11 2106 1.11 1.12 1.11 129 XM_HighProb1 2102 0.37 1.11 0.01 130 T_Symld_Words_02 2083 0.60 1.10 0.36 131 XMMoneyMeta_00 2042 0.71 1.08 0.53 132 RELAYCOUNTRY_HK 2042 0.36 1.08 0.01 133 XMSexyCombo_04 2025 0.49 1.07 0.20 134 RELAYCOUNTRY_DE 2003 0.90 1.06 0.82 135 RCVD_IN_MSPIKE_H3 1985 2.05 1.05 2.53 136 RCVD_IN_MSPIKE_WL 1985 2.05 1.05 2.53 137 T_DEAR_BENEFICIARY 1984 0.34 1.05 0.00 138 XM_UB80 1975 0.47 1.05 0.19 139 T_MONEY_PERCENT 1948 0.75 1.03 0.61 140 TR_LOTS_OF_MONEY2 1948 0.75 1.03 0.61 141 XMLngstWrd_00 1945 0.54 1.03 0.30 142 RELAYCOUNTRY_GB 1924 1.06 1.02 1.08 143 DIET_1 1920 0.43 1.02 0.15 144 RELAYCOUNTRY_AT 1917 0.41 1.02 0.12 145 DKIM_ADSP_CUSTOM_MED 1916 1.03 1.01 1.04 146 HTML_FONT_FACE_BAD 1913 0.66 1.01 0.49 147 XMBody_78 1911 0.64 1.01 0.46 148 RCVD_IN_IADB_VOUCHED 1904 3.02 1.01 3.99 149 XMLngstWrd_01 1895 0.51 1.00 0.26 150 BODY_URI_ONLY 1889 0.36 1.00 0.06 151 RCVD_IN_PSBL 1875 0.38 0.99 0.09 152 TR_XM_DK_Bayes 1858 3.36 0.98 4.51 153 XMSubMetaSSx_00 1846 0.47 0.98 0.22 154 HTTPS_HTTP_MISMATCH 1837 0.63 0.97 0.46 155 XM_H_PHPOS 1828 1.10 0.97 1.16 156 URI_NOVOWEL 1816 0.54 0.96 0.34 157 TR_Symld_Words 1794 1.67 0.95 2.02 158 XMLngstWrd_02 1783 0.43 0.94 0.18 159 BAYES_20 1781 2.07 0.94 2.62 160 XM_B_REG_HTML 1771 0.56 0.94 0.38 161 RDNS_DYNAMIC 1708 0.55 0.90 0.38 162 XMLongAddy 1703 0.38 0.90 0.13 163 XMBrknScrpt_02 1693 0.72 0.90 0.63 164 TR_XM_DK_Bayes1 1689 2.91 0.89 3.89 165 XMLngstWrd_03 1688 0.36 0.89 0.10 166 TO_IN_SUBJ 1644 0.49 0.87 0.30 167 RELAYCOUNTRY_AU 1628 0.62 0.86 0.50 168 TooManyTo_002 1618 2.29 0.86 2.98 169 XMClaimOffer 1611 0.35 0.85 0.10 170 XM_OfRef7 1610 0.39 0.85 0.16 171 MPART_ALT_DIFF_COUNT 1599 0.55 0.85 0.41 172 T_FILL_THIS_FORM_SHORT 1585 1.04 0.84 1.14 173 TR_XM_DK_Bayes2 1577 2.29 0.84 3.00 174 XMGappySubj_01 1576 0.96 0.83 1.02 175 HTML_IMAGE_ONLY_08 1573 0.36 0.83 0.13 176 XMSlimDrugH 1573 0.45 0.83 0.26 177 SHORT_URI 1548 0.60 0.82 0.50 178 XM_RXBody 1525 0.31 0.81 0.07 179 HTML_SHORT_LINK_IMG_1 1523 0.28 0.81 0.03 180 BODY_ENHANCEMENT 1517 0.29 0.80 0.04 181 HTML_IMAGE_ONLY_28 1517 0.57 0.80 0.45 182 NML_ADSP_CUSTOM_MED 1508 0.80 0.80 0.80 183 TR_MetaPhish_Combo_01 1494 1.02 0.79 1.13 184 XMHTMLBadTable_001 1490 0.46 0.79 0.30 185 FORGED_GMAIL_RCVD 1468 0.60 0.78 0.51 186 TR_LOTS_OF_MONEY3 1459 0.41 0.77 0.24 187 XMPhish14 1437 0.46 0.76 0.31 188 XMLngstWrd_04 1430 0.29 0.76 0.07 189 PLING_QUERY 1419 0.40 0.75 0.24 190 TooManyTo_003 1377 1.57 0.73 1.98 191 HTML_FONT_SIZE_LARGE 1355 0.44 0.72 0.30 192 REMOVE_BEFORE_LINK 1312 0.38 0.69 0.23 193 T_TooManySym_02 1304 1.26 0.69 1.54 194 XM_H_PHPMailer 1294 0.67 0.69 0.67 195 MISSING_HEADERS 1277 0.64 0.68 0.62 196 RCVD_IN_IADB_OPTIN 1276 1.99 0.68 2.63 197 XM_Body_Obfu01 1276 0.40 0.68 0.27 198 SUBJ_DOLLARS 1237 0.29 0.66 0.11 199 XM_S_JOY_D 1225 0.44 0.65 0.34 200 XM_PDF 1224 3.30 0.65 4.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 319403 86.01 93.73 82.26 2 DKIM_SIGNED 254707 71.70 84.26 65.60 3 XM_DK_Pass 248813 69.87 81.77 64.08 4 DCC_CHECK_NEGATIVE 245965 48.18 16.98 63.35 5 DKIM_VALID 227760 64.31 75.93 58.66 6 BAYES_50 223480 48.83 30.88 57.56 7 XMListUnsubscribeExists 159895 51.23 71.90 41.18 8 DKIM_VALID_AU 153136 45.28 57.31 39.44 9 T_TM2_M_HEADER_IN_MSG 137487 30.70 21.01 35.41 10 XM_H_QuotedFrom 135517 42.49 58.09 34.90 11 DCC_CHECK 133396 49.62 81.01 34.36 12 ALL_TRUSTED 93907 17.91 5.00 24.19 13 DKIM_VALID_EF 89398 22.87 22.55 23.02 14 HTML_FONT_LOW_CONTRAST 87774 26.85 35.59 22.61 15 XMSubLong 74417 20.97 24.68 19.17 16 MultiRelay 74260 17.88 15.31 19.13 17 FVGT_m_MULTI_ODD 73217 21.69 27.51 18.86 18 MIME_HTML_ONLY 63543 20.21 28.12 16.36 19 LOC_TINY_FONT_1 60149 21.51 33.87 15.49 20 T_KAM_HTML_FONT_INVALID 55156 16.72 21.89 14.20 21 XM_DK_Undo_02 48848 24.98 50.49 12.58 22 BAYES_99 44097 22.39 45.08 11.36 23 XM_H_Long_From01 39391 9.36 7.76 10.14 24 BAYES_999 38706 19.30 38.48 9.97 25 XM_Multi_Part_URI 36636 11.73 16.46 9.44 26 FSL_BULK_SIG 36119 10.97 14.39 9.30 27 TooManyTo_001 34663 8.10 6.40 8.93 28 XM_Body_Dirty_Words 33497 11.84 18.45 8.63 29 LOTS_OF_MONEY 30577 9.35 12.39 7.87 30 LotsOfNums_01 29043 8.05 9.23 7.48 31 XM_DKIMWhitelistDomains 28251 4.92 0.09 7.28 32 BAYES_00 27913 5.23 1.21 7.19 33 T_XMDrugObfuBody_14 27730 8.09 10.05 7.14 34 RCVD_IN_RP_SAFE 27474 6.22 4.45 7.08 35 BAYES_60 27248 7.09 7.25 7.02 36 DKIM_INVALID 26947 7.40 8.33 6.94 37 XM_Evil_Numbers_Gen 25846 8.74 13.04 6.66 38 RCVD_IN_RP_CERTIFIED 25410 5.62 3.73 6.54 39 HTML_IMAGE_RATIO_02 23669 9.25 15.74 6.10 40 IN_ZIMBRA_NJ_WHITELIST 23588 4.10 0.04 6.07 41 SUBJ_ALL_CAPS 23572 5.29 3.68 6.07 42 RCVD_IN_IADB_LISTED 23491 4.93 2.63 6.05 43 BAYES_40 21452 4.15 1.32 5.52 44 RELAYCOUNTRY_META 21090 8.43 14.59 5.43 45 MIME_QP_LONG_LINE 21067 5.21 4.78 5.43 46 TR_DCC_Bayes_99 20842 15.46 36.22 5.37 47 RCVD_IN_IADB_SPF 20381 4.32 2.42 5.25 48 XMSubMetaSx_00 20256 7.41 11.93 5.22 49 XM_SendGrid 19604 4.91 4.64 5.05 50 RCVD_IN_MSPIKE_H2 18558 4.77 4.74 4.78 51 T_REMOTE_IMAGE 18484 4.36 3.55 4.76 52 RCVD_IN_IADB_SENDERID 17922 3.86 2.31 4.62 53 XM_PDF 17847 3.30 0.65 4.60 54 TR_XM_DK_Bayes 17512 3.36 0.98 4.51 55 RCVD_IN_IADB_DK 17363 3.76 2.28 4.47 56 HTML_IMAGE_RATIO_04 16476 5.56 8.26 4.24 57 XMSubNoVowel 15605 3.89 3.63 4.02 58 RCVD_IN_IADB_VOUCHED 15500 3.02 1.01 3.99 59 BAYES_80 15230 5.23 7.93 3.92 60 TR_XM_DK_Bayes1 15112 2.91 0.89 3.89 61 XMStrtUSub 14976 4.08 4.54 3.86 62 T_TooManySym_01 14935 3.40 2.50 3.85 63 XM_B_Phish_Phrases 14515 5.32 8.59 3.74 64 TR_XM_DocInvoice 14197 5.40 8.99 3.66 65 XM_UncommonTLD01 13665 4.23 5.69 3.52 66 XMSubEmpty 13435 3.20 2.66 3.46 67 BOTNET_IPINHOSTNAME 13051 6.26 12.22 3.36 68 ANY_BOUNCE_MESSAGE 12252 2.31 0.56 3.16 69 BOUNCE_MESSAGE 12250 2.31 0.56 3.15 70 XMNumbers 12168 3.50 4.24 3.13 71 TR_XM_DK_Bayes2 11652 2.29 0.84 3.00 72 TooManyTo_002 11576 2.29 0.86 2.98 73 XMSexyCombo_05 10939 5.10 9.79 2.82 74 HTML_MIME_NO_HTML_TAG 10406 2.39 1.80 2.68 75 FROM_EXCESS_BASE64 10390 3.71 5.84 2.68 76 MPART_ALT_DIFF 10342 3.51 5.27 2.66 77 MAILING_LIST_MULTI 10322 2.29 1.54 2.66 78 BAYES_95 10244 3.29 4.62 2.64 79 RCVD_IN_IADB_OPTIN 10227 1.99 0.68 2.63 80 BAYES_20 10159 2.07 0.94 2.62 81 HTML_IMAGE_RATIO_06 10045 3.59 5.66 2.59 82 RCVD_IN_MSPIKE_WL 9835 2.05 1.05 2.53 83 RCVD_IN_MSPIKE_H3 9835 2.05 1.05 2.53 84 UNPARSEABLE_RELAY 9567 2.06 1.24 2.46 85 HELO_NODOT 8794 1.61 0.27 2.26 86 TVD_RCVD_IP 8515 1.58 0.33 2.19 87 IN_HORDE_ADDRESS_BOOK 8309 1.47 0.08 2.14 88 TR_Symld_Words 7835 1.67 0.95 2.02 89 NO_DNS_FOR_FROM 7826 2.31 2.92 2.02 90 TooManyTo_003 7696 1.57 0.73 1.98 91 XM_DK_Undo_01 7431 1.85 1.72 1.91 92 XM_SPF_SoftFail 7414 2.25 2.94 1.91 93 TO_MALFORMED 7246 1.27 0.05 1.87 94 MIME_HTML_MOSTLY 7183 2.84 4.87 1.85 95 HTML_IMAGE_RATIO_08 7170 2.32 3.29 1.85 96 TM2_M_URI_OPT_OUT 6882 2.86 5.10 1.77 97 INVALID_MSGID 6878 1.25 0.17 1.77 98 BAYES_05 6696 1.34 0.54 1.72 99 XM_DIRTYINTL 6557 2.29 3.51 1.69 100 MSGID_NOFQDN1 6555 1.14 0.01 1.69 101 XMCapTrack 6298 1.27 0.56 1.62 102 XM_CamelCaseFrm001 6079 2.07 3.12 1.57 103 XMDiploma_00 6042 1.80 2.29 1.56 104 UNTRUSTED_Relay 6033 3.83 8.50 1.55 105 T_TooManySym_02 5988 1.26 0.69 1.54 106 RELAYCOUNTRY_CA 5579 1.98 3.11 1.44 107 TooManyTo_004 5544 1.15 0.57 1.43 108 XM_GoogleGroups 5420 1.10 0.50 1.40 109 BOTNET 5249 5.42 13.79 1.35 110 URI_HEX 5243 1.86 2.91 1.35 111 XM_OfRef6 5091 1.92 3.16 1.31 112 T_XMDrugObfuBody_08 4953 1.54 2.07 1.28 113 MIME_HTML_ONLY_MULTI 4909 1.78 2.83 1.26 114 XM_H_PHPOS 4507 1.10 0.97 1.16 115 T_FILL_THIS_FORM_SHORT 4440 1.04 0.84 1.14 116 TR_MetaPhish_Combo_01 4375 1.02 0.79 1.13 117 XMPhish11 4323 1.11 1.12 1.11 118 SHORT_URI_2 4273 1.39 1.97 1.10 119 TooManyTo_005 4249 0.90 0.51 1.09 120 RELAYCOUNTRY_GB 4179 1.06 1.02 1.08 121 USER_IN_DEF_DKIM_WL 4118 0.73 0.06 1.06 122 DKIM_ADSP_CUSTOM_MED 4051 1.03 1.01 1.04 123 XMGappySubj_01 3964 0.96 0.83 1.02 124 URI_TRY_3LD 3700 1.07 1.30 0.95 125 TR_Mismatch_TLD_01 3655 1.63 3.06 0.94 126 XMGenDplmaNmb 3570 1.11 1.49 0.92 127 RCVD_IN_BL_SPAMCOP_NET 3483 1.61 3.08 0.90 128 SpammyFromTLD_01 3335 1.13 1.68 0.86 129 XM_H_Long_From02 3295 1.29 2.21 0.85 130 USER_IN_WHITELIST 3199 0.55 0.00 0.82 131 RELAYCOUNTRY_DE 3193 0.90 1.06 0.82 132 TM2_M_VERY_LONG_WORD 3191 1.34 2.42 0.82 133 XM_UB50 3167 1.64 3.33 0.82 134 XMEmptySub 3139 0.92 1.14 0.81 135 NML_ADSP_CUSTOM_MED 3114 0.80 0.80 0.80 136 XMNoVowels 3007 0.67 0.44 0.77 137 TVD_SPACE_RATIO 2958 0.89 1.15 0.76 138 T_TooManySym_03 2809 0.53 0.14 0.72 139 XM_ProductURIs 2789 0.96 1.46 0.72 140 XM_H_PHPMailer 2599 0.67 0.69 0.67 141 T_OBFU_PDF_ATTACH 2533 0.50 0.18 0.65 142 T_XMHurry_00 2467 0.98 1.70 0.64 143 XMBrknScrpt_02 2459 0.72 0.90 0.63 144 MISSING_HEADERS 2394 0.64 0.68 0.62 145 T_MONEY_PERCENT 2374 0.75 1.03 0.61 146 TR_LOTS_OF_MONEY2 2374 0.75 1.03 0.61 147 T_XMDrugObfuBody_00 2360 0.81 1.22 0.61 148 PP_MIME_FAKE_ASCII_TEXT 2295 0.52 0.36 0.59 149 XMGappySubj_02 2281 0.53 0.40 0.59 150 UPPERCASE_50_75 2204 0.41 0.09 0.57 151 SHORT_HELO_AND_INLINE_IMAGE 2201 0.41 0.09 0.57 152 XMSexyCombo_01 2165 1.29 2.81 0.56 153 XMStockSpam_06 2089 0.82 1.40 0.54 154 XMMoneyMeta_00 2076 0.71 1.08 0.53 155 XM_H_Trusted_IP 2033 0.35 0.00 0.52 156 TR_XM_RelayPhish 2025 0.81 1.41 0.52 157 FORGED_GMAIL_RCVD 1983 0.60 0.78 0.51 158 RELAYCOUNTRY_AU 1959 0.62 0.86 0.50 159 XM_B_TRADE_HTML 1949 0.48 0.43 0.50 160 SHORT_URI 1937 0.60 0.82 0.50 161 XMBody_95 1928 0.38 0.16 0.50 162 RCVD_IN_SORBS_DUL 1915 0.39 0.16 0.49 163 HTML_FONT_FACE_BAD 1900 0.66 1.01 0.49 164 XM_D_omniadmin_Whitelist 1837 0.32 0.00 0.47 165 TM2_M_A_HREF_HREF 1828 0.52 0.61 0.47 166 XMSubMetaSxObfu_02 1824 0.39 0.24 0.47 167 HTML_IMAGE_ONLY_32 1811 0.44 0.38 0.47 168 XM_ShortIntro_01 1810 0.43 0.35 0.47 169 HTTPS_HTTP_MISMATCH 1802 0.63 0.97 0.46 170 XMBody_78 1798 0.64 1.01 0.46 171 XM_B_COPY_HTML 1769 0.70 1.21 0.46 172 HTML_IMAGE_ONLY_28 1765 0.57 0.80 0.45 173 FILL_THIS_FORM 1739 0.89 1.79 0.45 174 XMBdyGiftCard01 1726 0.78 1.47 0.44 175 XMDateMe_00 1698 0.41 0.36 0.44 176 XMBounce_01 1669 0.39 0.30 0.43 177 XMLKML 1634 0.28 0.00 0.42 178 AC_DIV_BONANZA 1621 0.32 0.11 0.42 179 MPART_ALT_DIFF_COUNT 1577 0.55 0.85 0.41 180 XMSubMetaI_00 1539 0.76 1.52 0.40 181 XMBody_17 1525 0.91 1.98 0.39 182 XMRcvdHeader_15 1515 0.26 0.00 0.39 183 TM2_M_BODY_EMPTY 1514 0.32 0.16 0.39 184 SpammyFromTLD_02 1508 0.93 2.05 0.39 185 XM_B_REG_HTML 1477 0.56 0.94 0.38 186 RDNS_DYNAMIC 1474 0.55 0.90 0.38 187 HTML_TAG_BALANCE_BODY 1421 0.45 0.62 0.37 188 FILL_THIS_FORM_LONG 1420 0.81 1.72 0.37 189 T_Symld_Words_02 1384 0.60 1.10 0.36 190 XMHTML_After_End 1376 0.78 1.66 0.35 191 XM_S_JOY_D 1330 0.44 0.65 0.34 192 XMPhish30 1326 0.70 1.45 0.34 193 URI_NOVOWEL 1322 0.54 0.96 0.34 194 T_FILL_THIS_FORM_LOAN 1253 0.42 0.63 0.32 195 T_TooManySym_04 1252 0.23 0.05 0.32 196 HTML_IMAGE_ONLY_24 1244 0.35 0.42 0.32 197 XMSubMetaSxObfu_03 1219 0.36 0.47 0.31 198 T_HTML_ATTACH 1216 0.26 0.15 0.31 199 XMPhish14 1204 0.46 0.76 0.31 200 HTML_IMAGE_ONLY_20 1201 0.27 0.20 0.31 ----------------------------------------------------------------------