Email: 793171 Autolearn: 0 AvgScore: 5.36 AvgScanTime: 4.20 sec Spam: 284301 Autolearn: 0 AvgScore: 14.00 AvgScanTime: 4.91 sec Ham: 508870 Autolearn: 0 AvgScore: 0.53 AvgScanTime: 3.80 sec Time Spent Running SA: 924.79 hours Time Spent Processing Spam: 387.71 hours Time Spent Processing Ham: 537.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276167 91.43 97.14 88.24 2 DCC_CHECK 209916 46.74 73.84 31.60 3 DKIM_SIGNED 202494 65.35 71.23 62.07 4 XM_DK_Pass 197661 64.03 69.53 60.97 5 DKIM_VALID 186561 59.96 65.62 56.79 6 XMListUnsubscribeExists 170319 47.14 59.91 40.01 7 DKIM_VALID_AU 141815 43.45 49.88 39.86 8 XM_H_QuotedFrom 127130 35.95 44.72 31.06 9 BAYES_99 118282 22.10 41.60 11.20 10 XM_DK_Undo_02 114993 21.96 40.45 11.64 11 MIME_HTML_ONLY 110122 24.24 38.73 16.14 12 BAYES_999 92963 17.95 32.70 9.72 13 LOC_TINY_FONT_1 91583 24.74 32.21 20.56 14 TR_DCC_Bayes_99 91141 14.72 32.06 5.03 15 HTML_FONT_LOW_CONTRAST 89558 26.56 31.50 23.79 16 T_TM2_M_HEADER_IN_MSG 85754 29.45 30.16 29.05 17 BAYES_50 84874 50.17 29.85 61.52 18 RELAYCOUNTRY_META 74579 12.28 26.23 4.48 19 DCC_CHECK_NEGATIVE 70697 51.65 24.87 66.61 20 XMSubLong 69085 20.11 24.30 17.77 21 FVGT_m_MULTI_ODD 68167 21.21 23.98 19.67 22 UNTRUSTED_Relay 59459 8.19 20.91 1.08 23 DKIM_VALID_EF 56651 21.83 19.93 22.89 24 FROM_EXCESS_BASE64 55060 9.32 19.37 3.71 25 FSL_BULK_SIG 53663 11.43 18.88 7.26 26 T_KAM_HTML_FONT_INVALID 50930 15.27 17.91 13.79 27 XM_Body_Dirty_Words 48885 13.16 17.19 10.90 28 HTML_MIME_NO_HTML_TAG 45532 6.80 16.02 1.65 29 XM_BadFromFormat 43482 5.60 15.29 0.18 30 MultiRelay 42553 15.78 14.97 16.24 31 HTML_SHORT_LINK_IMG_1 42085 8.05 14.80 4.28 32 HTML_IMAGE_ONLY_08 42039 8.09 14.79 4.34 33 MISSING_HEADERS 41940 5.62 14.75 0.52 34 HTML_FONT_SIZE_HUGE 41787 8.07 14.70 4.36 35 XM_Multi_Part_URI 41222 11.18 14.50 9.33 36 BODY_URI_ONLY 41005 5.35 14.42 0.28 37 MIME_HEADER_CTYPE_ONLY 40707 5.22 14.32 0.13 38 SHORTENER_SHORT_IMG 40671 7.85 14.31 4.25 39 URI_BUFFLY 40390 7.82 14.21 4.25 40 HTML_IMAGE_RATIO_02 39101 8.56 13.75 5.66 41 RELAYCOUNTRY_DE 37977 5.03 13.36 0.37 42 XM_Evil_Numbers_Gen 33595 8.59 11.82 6.79 43 BAYES_80 30824 6.58 10.84 4.19 44 XM_UncommonTLD01 30654 5.70 10.78 2.86 45 BOTNET_IPINHOSTNAME 30167 6.48 10.61 4.17 46 BOTNET 28050 4.29 9.87 1.17 47 LOTS_OF_MONEY 24963 7.85 8.78 7.33 48 T_XMDrugObfuBody_14 24863 7.68 8.75 7.08 49 XMSexyCombo_05 22900 4.99 8.05 3.28 50 XM_B_Phish_Phrases 22853 5.42 8.04 3.95 51 XMNumbers 22357 4.66 7.86 2.86 52 HTML_IMAGE_RATIO_04 22244 6.01 7.82 4.99 53 TooManyTo_001 21245 9.26 7.47 10.27 54 SpammyFromTLD_02 20614 2.76 7.25 0.25 55 BAYES_95 20173 4.32 7.10 2.77 56 BAYES_60 20152 7.11 7.09 7.11 57 LotsOfNums_01 19323 7.52 6.80 7.92 58 XM_H_Long_From01 18528 5.49 6.52 4.92 59 XMSubMetaSx_00 18242 5.07 6.42 4.32 60 MPART_ALT_DIFF 17783 4.40 6.25 3.36 61 TR_XM_DocInvoice 17137 4.38 6.03 3.46 62 DKIM_INVALID 15933 5.39 5.60 5.28 63 XM_UB99 15901 2.01 5.59 0.02 64 XM_UB80 13076 1.67 4.60 0.03 65 MIME_HTML_MOSTLY 12891 3.52 4.53 2.95 66 XM_SPF_SoftFail 12749 2.74 4.48 1.77 67 XM_JunkDunk 12662 1.60 4.45 0.00 68 XMStrtUSub 12219 3.83 4.30 3.57 69 TM2_M_URI_OPT_OUT 11737 3.38 4.13 2.96 70 MIME_QP_LONG_LINE 11665 5.42 4.10 6.15 71 XM_UB50 11444 1.92 4.03 0.74 72 RCVD_IN_RP_SAFE 11113 5.99 3.91 7.16 73 HTML_IMAGE_RATIO_06 10785 3.56 3.79 3.44 74 XM_SendGrid 10783 4.00 3.79 4.12 75 ALL_TRUSTED 10716 18.93 3.77 27.41 76 XM_UB95 10380 1.32 3.65 0.02 77 XMNoVowels 10318 2.56 3.63 1.96 78 XM_DIRTYINTL 9572 2.28 3.37 1.68 79 URI_HEX 9252 2.05 3.25 1.38 80 DIET_1 9218 1.76 3.24 0.93 81 RCVD_IN_MSPIKE_H2 9164 3.83 3.22 4.16 82 T_REMOTE_IMAGE 8768 3.99 3.08 4.49 83 XM_CamelCaseFrm001 8737 2.00 3.07 1.41 84 XMSlimDrugH 8610 1.27 3.03 0.28 85 HTML_IMAGE_RATIO_08 8596 2.54 3.02 2.27 86 XMDiploma_00 8336 2.33 2.93 1.99 87 RCVD_IN_RP_CERTIFIED 8104 5.06 2.85 6.29 88 MIME_HTML_ONLY_MULTI 7471 1.78 2.63 1.30 89 RCVD_IN_RP_RNBL 7436 0.95 2.62 0.02 90 RELAYCOUNTRY_CA 7095 1.73 2.50 1.30 91 T_XMDrugObfuBody_08 7061 1.80 2.48 1.41 92 XM_UB60 6934 0.92 2.44 0.07 93 TooManyTo_002 6895 3.93 2.43 4.77 94 T_TooManySym_01 6679 3.03 2.35 3.41 95 TooManyTo_003 6237 3.20 2.19 3.77 96 RCVD_IN_IADB_LISTED 6070 4.37 2.14 5.61 97 XM_OfRef6 5852 1.50 2.06 1.19 98 XM_URI_RBL 5779 0.80 2.03 0.11 99 TR_XM_RelayPhish 5508 0.93 1.94 0.37 100 NO_DNS_FOR_FROM 5495 1.10 1.93 0.64 101 RCVD_IN_BL_SPAMCOP_NET 5481 0.84 1.93 0.24 102 RCVD_IN_IADB_SPF 5443 3.80 1.91 4.85 103 SpammyFromTLD_01 5417 1.08 1.91 0.63 104 MultiRelay_CC 5401 0.80 1.90 0.19 105 MultiRelay_Combo 5401 0.80 1.90 0.19 106 XM_UB999 5369 0.68 1.89 0.01 107 XMGenDplmaNmb 5317 1.45 1.87 1.21 108 XM_iOS_Forged_Message 5220 0.76 1.84 0.16 109 RCVD_IN_IADB_SENDERID 5172 3.37 1.82 4.23 110 RCVD_IN_IADB_DK 5081 3.29 1.79 4.12 111 TooManyTo_004 5070 2.15 1.78 2.36 112 URI_WP_HACKED_2 4854 1.83 1.71 1.89 113 RELAYCOUNTRY_NL 4722 0.70 1.66 0.16 114 XMSlimDrugs 4585 0.59 1.61 0.02 115 XMWghtMeta_00 4502 0.58 1.58 0.01 116 XMSexyCombo_01 4433 0.92 1.56 0.56 117 TooManyTo_005 4366 1.80 1.54 1.95 118 TM2_M_VERY_LONG_WORD 4238 0.99 1.49 0.71 119 SUBJ_ALL_CAPS 4165 1.41 1.46 1.38 120 XMBdyGiftCard01 4068 0.92 1.43 0.63 121 URIBL_DBL_SPAM 3887 0.53 1.37 0.06 122 RELAYCOUNTRY_FR 3799 0.63 1.34 0.23 123 XMBody_17 3743 0.81 1.32 0.52 124 XMSubMetaI_00 3718 0.73 1.31 0.40 125 XM_DK_Undo_01 3676 1.72 1.29 1.95 126 XM_H_Long_From02 3674 1.04 1.29 0.90 127 URI_TRY_3LD 3621 1.05 1.27 0.92 128 XMHTML_After_End 3618 0.69 1.27 0.36 129 XMStockSpam_06 3486 1.15 1.23 1.10 130 T_XMDrugObfuBody_00 3485 0.80 1.23 0.57 131 MAILING_LIST_MULTI 3460 1.76 1.22 2.06 132 URIBL_BLACK 3439 0.46 1.21 0.03 133 BOTNET_NORDNS 3415 0.44 1.20 0.01 134 DATE_IN_PAST_06_12 3323 0.45 1.17 0.04 135 T_XMHurry_00 3211 0.97 1.13 0.88 136 XM_ProductURIs 3203 1.04 1.13 1.00 137 BAYES_40 3124 2.59 1.10 3.42 138 BAYES_00 3105 4.45 1.09 6.33 139 RELAYCOUNTRY_GB 3090 0.96 1.09 0.89 140 UNPARSEABLE_RELAY 3072 2.42 1.08 3.17 141 TR_Symld_Words 3037 1.38 1.07 1.56 142 XM_HighProb1 2970 0.38 1.04 0.01 143 RELAYCOUNTRY_CN 2934 0.41 1.03 0.06 144 XMMoneyMeta_00 2922 0.71 1.03 0.54 145 XMBrknScrpt_02 2896 0.70 1.02 0.53 146 XMPhish11 2848 1.05 1.00 1.08 147 SUBJ_DOLLARS 2709 0.43 0.95 0.13 148 RCVD_IN_IADB_VOUCHED 2637 2.79 0.93 3.83 149 XMHTMLBadTable_001 2558 0.55 0.90 0.35 150 RELAYCOUNTRY_AT 2544 0.39 0.89 0.11 151 XMBody_78 2534 0.53 0.89 0.34 152 TR_XM_DK_Bayes 2531 2.19 0.89 2.91 153 HTML_TAG_BALANCE_BODY 2507 0.69 0.88 0.59 154 T_FILL_THIS_FORM_SHORT 2441 0.86 0.86 0.87 155 BAYES_20 2369 1.66 0.83 2.12 156 XM_H_PHPOS 2352 1.39 0.83 1.71 157 TR_LOTS_OF_MONEY2 2344 0.53 0.82 0.37 158 T_MONEY_PERCENT 2344 0.53 0.82 0.37 159 XMPhish14 2338 0.49 0.82 0.30 160 TR_XM_DK_Bayes1 2329 2.01 0.82 2.68 161 HTML_IMAGE_ONLY_28 2314 0.71 0.81 0.66 162 DRUGS_ERECTILE 2309 0.30 0.81 0.01 163 ONLINE_PHARMACY 2282 0.29 0.80 0.01 164 HTTPS_HTTP_MISMATCH 2281 0.59 0.80 0.48 165 SUBJECT_DIET 2267 0.29 0.80 0.00 166 TVD_VISIT_PHARMA 2241 0.28 0.79 0.00 167 HTML_FONT_FACE_BAD 2223 0.54 0.78 0.40 168 XMPhish30 2204 0.44 0.78 0.25 169 FVGT_m_MULTI_ODD_EMAIL 2202 0.34 0.77 0.09 170 MPART_ALT_DIFF_COUNT 2189 0.88 0.77 0.93 171 XMGetyour 2160 0.28 0.76 0.01 172 ANY_BOUNCE_MESSAGE 2151 7.21 0.76 10.82 173 BOUNCE_MESSAGE 2151 7.21 0.76 10.82 174 URI_NOVOWEL 2146 0.60 0.75 0.52 175 TR_XM_DK_Bayes2 2124 1.79 0.75 2.37 176 XM_H_PHPMailer 2116 0.64 0.74 0.59 177 TR_MetaPhish_Combo_01 2106 0.70 0.74 0.68 178 REMOVE_BEFORE_LINK 2097 0.52 0.74 0.40 179 DATE_IN_PAST_03_06 2089 0.32 0.73 0.09 180 DKIM_ADSP_CUSTOM_MED 2081 0.85 0.73 0.92 181 LongTLD 2020 0.35 0.71 0.14 182 XM_PDF 2010 2.80 0.71 3.97 183 DKIM_ADSP_NXDOMAIN 2002 0.46 0.70 0.33 184 RELAYCOUNTRY_AU 1929 0.54 0.68 0.46 185 XMLongAddy 1911 0.29 0.67 0.08 186 XM_B_COPY_HTML 1896 0.46 0.67 0.34 187 T_Symld_Words_02 1885 0.52 0.66 0.43 188 DRUG_ED_CAPS 1869 0.24 0.66 0.00 189 TR_LOTS_OF_MONEY3 1843 0.36 0.65 0.19 190 URIBL_DBL_ABUSE_SPAM 1830 0.59 0.64 0.56 191 TR_Mismatch_TLD_02 1811 0.27 0.64 0.06 192 TVD_SPACE_RATIO_MINFP 1808 0.23 0.64 0.00 193 XMCapTrack 1759 1.10 0.62 1.37 194 FORGED_GMAIL_RCVD 1757 0.52 0.62 0.46 195 RCVD_IN_MSPIKE_WL 1733 1.38 0.61 1.81 196 XMClaimOffer 1726 0.31 0.61 0.14 197 XMGppyBdWords 1725 0.35 0.61 0.21 198 XM_H_Long_From03 1704 0.27 0.60 0.08 199 T_HTML_TAG_BALANCE_CENTER 1700 0.30 0.60 0.14 200 RCVD_IN_MSPIKE_H3 1684 1.37 0.59 1.81 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 449010 91.43 97.14 88.24 2 DCC_CHECK_NEGATIVE 338951 51.65 24.87 66.61 3 DKIM_SIGNED 315857 65.35 71.23 62.07 4 BAYES_50 313067 50.17 29.85 61.52 5 XM_DK_Pass 310233 64.03 69.53 60.97 6 DKIM_VALID 289000 59.96 65.62 56.79 7 XMListUnsubscribeExists 203605 47.14 59.91 40.01 8 DKIM_VALID_AU 202812 43.45 49.88 39.86 9 DCC_CHECK 160813 46.74 73.84 31.60 10 XM_H_QuotedFrom 158042 35.95 44.72 31.06 11 T_TM2_M_HEADER_IN_MSG 147826 29.45 30.16 29.05 12 ALL_TRUSTED 139456 18.93 3.77 27.41 13 HTML_FONT_LOW_CONTRAST 121073 26.56 31.50 23.79 14 DKIM_VALID_EF 116479 21.83 19.93 22.89 15 LOC_TINY_FONT_1 104610 24.74 32.21 20.56 16 FVGT_m_MULTI_ODD 100092 21.21 23.98 19.67 17 XMSubLong 90415 20.11 24.30 17.77 18 MultiRelay 82623 15.78 14.97 16.24 19 MIME_HTML_ONLY 82115 24.24 38.73 16.14 20 T_KAM_HTML_FONT_INVALID 70159 15.27 17.91 13.79 21 XM_DK_Undo_02 59220 21.96 40.45 11.64 22 BAYES_99 56994 22.10 41.60 11.20 23 XM_Body_Dirty_Words 55463 13.16 17.19 10.90 24 ANY_BOUNCE_MESSAGE 55065 7.21 0.76 10.82 25 BOUNCE_MESSAGE 55063 7.21 0.76 10.82 26 TooManyTo_001 52242 9.26 7.47 10.27 27 BAYES_999 49443 17.95 32.70 9.72 28 XM_Multi_Part_URI 47471 11.18 14.50 9.33 29 XM_DKIMWhitelistDomains 44444 5.61 0.01 8.73 30 LotsOfNums_01 40290 7.52 6.80 7.92 31 LOTS_OF_MONEY 37280 7.85 8.78 7.33 32 FSL_BULK_SIG 36969 11.43 18.88 7.26 33 RCVD_IN_RP_SAFE 36416 5.99 3.91 7.16 34 BAYES_60 36203 7.11 7.09 7.11 35 T_XMDrugObfuBody_14 36049 7.68 8.75 7.08 36 XM_Evil_Numbers_Gen 34561 8.59 11.82 6.79 37 BAYES_00 32218 4.45 1.09 6.33 38 RCVD_IN_RP_CERTIFIED 32013 5.06 2.85 6.29 39 MIME_QP_LONG_LINE 31299 5.42 4.10 6.15 40 HTML_IMAGE_RATIO_02 28803 8.56 13.75 5.66 41 IN_ZIMBRA_NJ_WHITELIST 28728 3.63 0.03 5.65 42 RCVD_IN_IADB_LISTED 28560 4.37 2.14 5.61 43 DKIM_INVALID 26857 5.39 5.60 5.28 44 TR_DCC_Bayes_99 25583 14.72 32.06 5.03 45 HTML_IMAGE_RATIO_04 25398 6.01 7.82 4.99 46 XM_H_Long_From01 25024 5.49 6.52 4.92 47 RCVD_IN_IADB_SPF 24678 3.80 1.91 4.85 48 TooManyTo_002 24297 3.93 2.43 4.77 49 T_REMOTE_IMAGE 22841 3.99 3.08 4.49 50 RELAYCOUNTRY_META 22806 12.28 26.23 4.48 51 HTML_FONT_SIZE_HUGE 22201 8.07 14.70 4.36 52 HTML_IMAGE_ONLY_08 22101 8.09 14.79 4.34 53 XMSubMetaSx_00 21970 5.07 6.42 4.32 54 HTML_SHORT_LINK_IMG_1 21774 8.05 14.80 4.28 55 URI_BUFFLY 21624 7.82 14.21 4.25 56 SHORTENER_SHORT_IMG 21624 7.85 14.31 4.25 57 RCVD_IN_IADB_SENDERID 21520 3.37 1.82 4.23 58 BAYES_80 21345 6.58 10.84 4.19 59 BOTNET_IPINHOSTNAME 21224 6.48 10.61 4.17 60 RCVD_IN_MSPIKE_H2 21187 3.83 3.22 4.16 61 RCVD_IN_IADB_DK 20984 3.29 1.79 4.12 62 XM_SendGrid 20982 4.00 3.79 4.12 63 XM_PDF 20184 2.80 0.71 3.97 64 XM_B_Phish_Phrases 20101 5.42 8.04 3.95 65 RCVD_IN_IADB_VOUCHED 19515 2.79 0.93 3.83 66 TooManyTo_003 19175 3.20 2.19 3.77 67 FROM_EXCESS_BASE64 18863 9.32 19.37 3.71 68 XMStrtUSub 18151 3.83 4.30 3.57 69 TR_XM_DocInvoice 17585 4.38 6.03 3.46 70 HTML_IMAGE_RATIO_06 17489 3.56 3.79 3.44 71 BAYES_40 17422 2.59 1.10 3.42 72 T_TooManySym_01 17355 3.03 2.35 3.41 73 MPART_ALT_DIFF 17114 4.40 6.25 3.36 74 XMSexyCombo_05 16705 4.99 8.05 3.28 75 UNPARSEABLE_RELAY 16133 2.42 1.08 3.17 76 TM2_M_URI_OPT_OUT 15055 3.38 4.13 2.96 77 MIME_HTML_MOSTLY 15019 3.52 4.53 2.95 78 TR_XM_DK_Bayes 14803 2.19 0.89 2.91 79 TVD_RCVD_IP 14663 1.90 0.13 2.88 80 XMNumbers 14573 4.66 7.86 2.86 81 XM_UncommonTLD01 14570 5.70 10.78 2.86 82 BAYES_95 14075 4.32 7.10 2.77 83 TR_XM_DK_Bayes1 13631 2.01 0.82 2.68 84 RCVD_IN_IADB_OPTIN 12444 1.77 0.56 2.45 85 TR_XM_DK_Bayes2 12050 1.79 0.75 2.37 86 TooManyTo_004 12013 2.15 1.78 2.36 87 HTML_IMAGE_RATIO_08 11573 2.54 3.02 2.27 88 BAYES_20 10785 1.66 0.83 2.12 89 MAILING_LIST_MULTI 10497 1.76 1.22 2.06 90 XMDiploma_00 10124 2.33 2.93 1.99 91 XMNoVowels 9998 2.56 3.63 1.96 92 XM_DK_Undo_01 9944 1.72 1.29 1.95 93 TooManyTo_005 9935 1.80 1.54 1.95 94 URI_WP_HACKED_2 9633 1.83 1.71 1.89 95 HELO_NODOT 9492 1.28 0.24 1.87 96 RCVD_IN_MSPIKE_WL 9231 1.38 0.61 1.81 97 RCVD_IN_MSPIKE_H3 9219 1.37 0.59 1.81 98 XM_SPF_SoftFail 9020 2.74 4.48 1.77 99 XM_H_PHPOS 8703 1.39 0.83 1.71 100 XM_DIRTYINTL 8527 2.28 3.37 1.68 101 IN_HORDE_ADDRESS_BOOK 8488 1.09 0.04 1.67 102 HTML_MIME_NO_HTML_TAG 8410 6.80 16.02 1.65 103 TR_Symld_Words 7931 1.38 1.07 1.56 104 T_XMDrugObfuBody_08 7198 1.80 2.48 1.41 105 XM_CamelCaseFrm001 7159 2.00 3.07 1.41 106 INVALID_MSGID 7071 0.96 0.20 1.39 107 SUBJ_ALL_CAPS 7042 1.41 1.46 1.38 108 URI_HEX 7011 2.05 3.25 1.38 109 XMCapTrack 6973 1.10 0.62 1.37 110 TO_MALFORMED 6707 0.85 0.02 1.32 111 MIME_HTML_ONLY_MULTI 6617 1.78 2.63 1.30 112 RELAYCOUNTRY_CA 6615 1.73 2.50 1.30 113 BAYES_05 6539 0.99 0.46 1.29 114 XMLngstWrd_00 6466 0.92 0.29 1.27 115 T_TooManySym_02 6450 1.01 0.55 1.27 116 XMGenDplmaNmb 6164 1.45 1.87 1.21 117 USER_IN_DEF_DKIM_WL 6086 0.77 0.02 1.20 118 XM_OfRef6 6063 1.50 2.06 1.19 119 BOTNET 5945 4.29 9.87 1.17 120 XM_GoogleGroups 5701 0.87 0.42 1.12 121 XMStockSpam_06 5603 1.15 1.23 1.10 122 XMLngstWrd_01 5580 0.80 0.26 1.10 123 UNTRUSTED_Relay 5487 8.19 20.91 1.08 124 XMPhish11 5477 1.05 1.00 1.08 125 XM_ProductURIs 5074 1.04 1.13 1.00 126 MPART_ALT_DIFF_COUNT 4754 0.88 0.77 0.93 127 DIET_1 4733 1.76 3.24 0.93 128 URI_TRY_3LD 4693 1.05 1.27 0.92 129 DKIM_ADSP_CUSTOM_MED 4678 0.85 0.73 0.92 130 XM_H_Long_From02 4596 1.04 1.29 0.90 131 RELAYCOUNTRY_GB 4538 0.96 1.09 0.89 132 T_XMHurry_00 4479 0.97 1.13 0.88 133 T_FILL_THIS_FORM_SHORT 4406 0.86 0.86 0.87 134 TO_NO_BRKTS_HTML_ONLY 4013 0.55 0.12 0.79 135 XM_UB50 3776 1.92 4.03 0.74 136 TM2_M_VERY_LONG_WORD 3634 0.99 1.49 0.71 137 NML_ADSP_CUSTOM_MED 3549 0.66 0.59 0.70 138 URIBL_SBL_A 3464 0.61 0.49 0.68 139 TR_MetaPhish_Combo_01 3437 0.70 0.74 0.68 140 HTML_IMAGE_ONLY_32 3430 0.56 0.36 0.67 141 XMSolicitRefs_0 3351 0.54 0.34 0.66 142 HTML_IMAGE_ONLY_28 3334 0.71 0.81 0.66 143 XMSubNoVowel 3321 0.56 0.40 0.65 144 USER_IN_WHITELIST 3264 0.41 0.00 0.64 145 NO_DNS_FOR_FROM 3232 1.10 1.93 0.64 146 XMBdyGiftCard01 3218 0.92 1.43 0.63 147 HTML_EXTRA_CLOSE 3201 0.53 0.35 0.63 148 SpammyFromTLD_01 3181 1.08 1.91 0.63 149 KHOP_DYNAMIC 3053 0.52 0.39 0.60 150 XMLngstWrd_02 3036 0.45 0.20 0.60 151 XM_H_PHPMailer 2987 0.64 0.74 0.59 152 HTML_TAG_BALANCE_BODY 2980 0.69 0.88 0.59 153 XMSubMetaSxObfu_02 2919 0.45 0.24 0.57 154 T_XMDrugObfuBody_00 2877 0.80 1.23 0.57 155 T_TooManySym_03 2877 0.41 0.14 0.57 156 XMSexyCombo_01 2834 0.92 1.56 0.56 157 URIBL_DBL_ABUSE_SPAM 2830 0.59 0.64 0.56 158 XM_ShortIntro_01 2814 0.47 0.33 0.55 159 T_OBFU_PDF_ATTACH 2779 0.41 0.17 0.55 160 XMMoneyMeta_00 2738 0.71 1.03 0.54 161 XMBrknScrpt_02 2687 0.70 1.02 0.53 162 XMBody_17 2670 0.81 1.32 0.52 163 MISSING_HEADERS 2669 5.62 14.75 0.52 164 URI_NOVOWEL 2633 0.60 0.75 0.52 165 SHORT_HELO_AND_INLINE_IMAGE 2479 0.33 0.06 0.49 166 HTTPS_HTTP_MISMATCH 2420 0.59 0.80 0.48 167 RDNS_DYNAMIC 2409 0.51 0.57 0.47 168 RELAYCOUNTRY_AU 2333 0.54 0.68 0.46 169 FORGED_GMAIL_RCVD 2328 0.52 0.62 0.46 170 TM2_M_BODY_EMPTY 2210 0.37 0.24 0.43 171 T_Symld_Words_02 2204 0.52 0.66 0.43 172 XMBody_95 2200 0.33 0.14 0.43 173 XMDateMe_00 2063 0.41 0.41 0.41 174 RCVD_IN_SORBS_DUL 2051 0.34 0.22 0.40 175 XMGappySubj_01 2049 0.40 0.40 0.40 176 HTML_FONT_FACE_BAD 2047 0.54 0.78 0.40 177 REMOVE_BEFORE_LINK 2040 0.52 0.74 0.40 178 XMSubMetaI_00 2033 0.73 1.31 0.40 179 XM_B_REG_HTML 1997 0.45 0.57 0.39 180 AC_DIV_BONANZA 1905 0.27 0.09 0.37 181 TR_XM_RelayPhish 1890 0.93 1.94 0.37 182 XMLngstWrd_03 1889 0.29 0.15 0.37 183 RELAYCOUNTRY_DE 1887 5.03 13.36 0.37 184 T_MONEY_PERCENT 1876 0.53 0.82 0.37 185 TR_LOTS_OF_MONEY2 1876 0.53 0.82 0.37 186 XMHTML_After_End 1843 0.69 1.27 0.36 187 HTML_IMAGE_ONLY_24 1839 0.35 0.32 0.36 188 FILL_THIS_FORM 1835 0.43 0.57 0.36 189 PLING_QUERY 1831 0.40 0.48 0.36 190 TM2_M_A_HREF_HREF 1829 0.41 0.51 0.36 191 XMHTMLBadTable_001 1802 0.55 0.90 0.35 192 XM_B_COPY_HTML 1715 0.46 0.67 0.34 193 XMBody_78 1709 0.53 0.89 0.34 194 XMBody_29 1687 0.31 0.28 0.33 195 DKIM_ADSP_NXDOMAIN 1662 0.46 0.70 0.33 196 XM_USANA_RCVD 1554 0.20 0.00 0.31 197 HTML_IMAGE_ONLY_20 1541 0.31 0.32 0.30 198 XM_H_PHPOS_M 1536 0.34 0.42 0.30 199 XMPhish14 1519 0.49 0.82 0.30 200 XM_Combo_Sbj 1493 0.32 0.35 0.29 ----------------------------------------------------------------------