Email: 774232 Autolearn: 0 AvgScore: 5.00 AvgScanTime: 4.40 sec Spam: 270836 Autolearn: 0 AvgScore: 14.54 AvgScanTime: 5.45 sec Ham: 503396 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 3.83 sec Time Spent Running SA: 945.40 hours Time Spent Processing Spam: 410.07 hours Time Spent Processing Ham: 535.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 261663 91.26 96.61 88.38 2 DKIM_SIGNED 187978 65.06 69.41 62.71 3 DCC_CHECK 185454 43.94 68.47 30.75 4 XM_DK_Pass 184008 63.81 67.94 61.59 5 DKIM_VALID 174052 59.94 64.26 57.61 6 XMListUnsubscribeExists 161402 47.76 59.59 41.39 7 DKIM_VALID_AU 134134 43.58 49.53 40.39 8 XM_H_QuotedFrom 118584 38.08 43.78 35.01 9 MIME_HTML_ONLY 117779 28.32 43.49 20.15 10 XM_DK_Undo_02 105292 20.67 38.88 10.88 11 BAYES_99 95586 19.06 35.29 10.33 12 HTML_FONT_LOW_CONTRAST 82775 25.86 30.56 23.33 13 DCC_CHECK_NEGATIVE 81481 54.35 30.08 67.41 14 BAYES_999 81049 16.29 29.93 8.95 15 LOC_TINY_FONT_1 79755 21.82 29.45 17.72 16 BAYES_50 77972 48.14 28.79 58.56 17 TR_DCC_Bayes_99 75164 12.50 27.75 4.29 18 BOTNET 68328 9.45 25.23 0.96 19 FROM_EXCESS_BASE64 66071 10.72 24.40 3.36 20 XMSubLong 62777 20.60 23.18 19.22 21 FVGT_m_MULTI_ODD 60553 20.50 22.36 19.51 22 T_REMOTE_IMAGE 56822 10.00 20.98 4.09 23 HTML_MIME_NO_HTML_TAG 55570 8.20 20.52 1.57 24 HTML_SHORT_LINK_IMG_1 52766 10.09 19.48 5.04 25 MIME_HEADER_CTYPE_ONLY 52357 6.84 19.33 0.12 26 SHORTENER_SHORT_IMG 51985 9.97 19.19 5.01 27 SHORTENED_URL_SRC 51974 9.97 19.19 5.01 28 BODY_URI_ONLY 51892 6.75 19.16 0.08 29 URI_BUFFLY 51817 9.95 19.13 5.01 30 DKIM_VALID_EF 51715 21.86 19.09 23.34 31 MISSING_HEADERS 51505 6.96 19.02 0.48 32 T_TM2_M_HEADER_IN_MSG 51454 25.80 19.00 29.47 33 T_KAM_HTML_FONT_INVALID 46954 15.18 17.34 14.03 34 XM_Body_Dirty_Words 41603 11.25 15.36 9.05 35 BOTNET_NORDNS 40156 5.20 14.83 0.01 36 FSL_BULK_SIG 38873 9.41 14.35 6.75 37 XM_Multi_Part_URI 38602 10.75 14.25 8.87 38 RELAYCOUNTRY_META 37729 9.00 13.93 6.34 39 HTML_IMAGE_ONLY_08 37661 7.17 13.91 3.55 40 RCVD_IN_RP_RNBL 36297 4.71 13.40 0.03 41 HTML_IMAGE_RATIO_02 36149 8.76 13.35 6.29 42 MultiRelay 34392 15.53 12.70 17.05 43 BAYES_60 33717 8.45 12.45 6.30 44 BAYES_80 32719 6.55 12.08 3.58 45 XM_Evil_Numbers_Gen 31780 8.29 11.73 6.43 46 LOTS_OF_MONEY 28922 8.37 10.68 7.13 47 XMSexyCombo_05 28567 5.01 10.55 2.03 48 BOTNET_IPINHOSTNAME 28316 6.59 10.46 4.51 49 UNTRUSTED_Relay 25791 5.03 9.52 2.61 50 XM_B_Phish_Phrases 24180 5.71 8.93 3.98 51 XMNumbers 23779 4.79 8.78 2.65 52 XM_UncommonTLD01 23639 5.03 8.73 3.03 53 XMSubMetaSx_00 23090 5.35 8.53 3.64 54 T_XMDrugObfuBody_14 22929 7.48 8.47 6.95 55 HTML_IMAGE_RATIO_04 20169 5.45 7.45 4.38 56 BAYES_95 19587 4.14 7.23 2.48 57 TR_XM_DocInvoice 17935 4.42 6.62 3.23 58 XM_H_Long_From01 17692 5.54 6.53 5.01 59 LotsOfNums_01 17553 7.47 6.48 8.00 60 HTML_IMAGE_ONLY_04 15401 3.05 5.69 1.62 61 SpammyFromTLD_02 15348 2.13 5.67 0.23 62 MPART_ALT_DIFF 15130 7.13 5.59 7.96 63 TooManyTo_001 14658 8.00 5.41 9.39 64 DKIM_INVALID 13926 5.12 5.14 5.10 65 RCVD_IN_RP_SAFE 11993 5.87 4.43 6.64 66 MIME_HTML_MOSTLY 11557 3.18 4.27 2.59 67 HTML_IMAGE_RATIO_06 10586 3.18 3.91 2.79 68 MIME_QP_LONG_LINE 10479 4.90 3.87 5.46 69 XM_SPF_SoftFail 10417 2.77 3.85 2.19 70 XMStrtUSub 9840 3.40 3.63 3.27 71 TM2_M_URI_OPT_OUT 9832 2.84 3.63 2.42 72 XM_UB50 9102 2.61 3.36 2.21 73 XM_SendGrid 8998 4.07 3.32 4.48 74 RCVD_IN_MSPIKE_H2 8856 4.03 3.27 4.44 75 RCVD_IN_RP_CERTIFIED 8808 4.98 3.25 5.91 76 XM_OfRef6 8548 1.93 3.16 1.27 77 XM_CamelCaseFrm001 8389 2.03 3.10 1.46 78 XM_DIRTYINTL 8322 2.08 3.07 1.55 79 URI_HEX 8030 1.91 2.96 1.35 80 HTML_IMAGE_RATIO_08 7535 2.11 2.78 1.75 81 DIET_1 7424 1.27 2.74 0.48 82 XMNoVowels 7252 2.23 2.68 1.99 83 MIME_HTML_ONLY_MULTI 7160 5.01 2.64 6.28 84 T_TooManySym_01 6949 3.21 2.57 3.56 85 XM_URI_RBL 6442 0.91 2.38 0.13 86 TR_XM_RelayPhish 6367 1.09 2.35 0.42 87 XM_UB60 6051 0.83 2.23 0.07 88 XMSubMetaI_00 6047 1.07 2.23 0.45 89 RELAYCOUNTRY_CA 6033 1.59 2.23 1.25 90 XMSlimDrugH 6011 0.99 2.22 0.32 91 XMBody_17 5851 1.04 2.16 0.44 92 XMDiploma_00 5720 1.78 2.11 1.60 93 HTML_FONT_SIZE_LARGE 5607 1.17 2.07 0.69 94 RELAYCOUNTRY_RO 5314 0.69 1.96 0.01 95 T_XMDrugObfuBody_08 5246 1.76 1.94 1.67 96 RCVD_IN_IADB_LISTED 5165 4.23 1.91 5.48 97 XMSubMetaSSx_00 4676 0.78 1.73 0.27 98 RCVD_IN_IADB_SPF 4645 3.73 1.72 4.81 99 RCVD_IN_IADB_SENDERID 4417 3.33 1.63 4.25 100 RCVD_IN_IADB_DK 4348 3.28 1.61 4.18 101 ALL_TRUSTED 4325 14.70 1.60 21.74 102 SUBJ_ALL_CAPS 4207 1.30 1.55 1.17 103 XMSubject_48 4169 0.56 1.54 0.03 104 MultiRelay_Combo 4130 0.65 1.52 0.17 105 MultiRelay_CC 4130 0.65 1.52 0.17 106 SpammyFromTLD_01 4065 1.06 1.50 0.83 107 URIBL_BLACK 3837 0.52 1.42 0.04 108 TM2_M_VERY_LONG_WORD 3775 0.99 1.39 0.77 109 RCVD_IN_BL_SPAMCOP_NET 3674 0.68 1.36 0.32 110 BAYES_40 3664 2.81 1.35 3.60 111 XM_UB80 3630 0.49 1.34 0.03 112 SUBJ_DOLLARS 3619 0.63 1.34 0.25 113 RELAYCOUNTRY_RU 3566 0.48 1.32 0.02 114 MAILING_LIST_MULTI 3555 2.05 1.31 2.45 115 XMSexyCombo_01 3517 0.74 1.30 0.44 116 XMBdyGiftCard01 3490 0.79 1.29 0.53 117 BAYES_00 3468 7.62 1.28 11.04 118 URI_NOVOWEL 3463 0.75 1.28 0.47 119 XMGenDplmaNmb 3434 1.11 1.27 1.02 120 XMPhish11 3344 1.09 1.23 1.01 121 FILL_THIS_FORM 3275 0.67 1.21 0.37 122 T_XMHurry_00 3224 0.76 1.19 0.52 123 XM_BadFromFormat 3186 0.51 1.18 0.14 124 XM_UB99 3152 0.43 1.16 0.04 125 XM_DK_Undo_01 3136 1.56 1.16 1.78 126 UNPARSEABLE_RELAY 3104 2.70 1.15 3.53 127 T_FILL_THIS_FORM_LONG 3097 0.59 1.14 0.30 128 RELAYCOUNTRY_FR 3095 0.54 1.14 0.22 129 XM_H_Long_From02 3079 1.91 1.14 2.32 130 FILL_THIS_FORM_LOAN 2958 0.54 1.09 0.24 131 XMHTML_After_End 2941 0.66 1.09 0.43 132 ANY_BOUNCE_MESSAGE 2833 7.14 1.05 10.41 133 BOUNCE_MESSAGE 2832 7.14 1.05 10.41 134 XM_OfRef7 2831 0.49 1.05 0.20 135 URI_TRY_3LD 2806 1.00 1.04 0.98 136 XMMoneyMeta_00 2780 0.64 1.03 0.44 137 XMWghtMeta_00 2779 0.37 1.03 0.02 138 T_Symld_Words_02 2767 0.75 1.02 0.60 139 TR_XM_DK_Bayes 2756 2.99 1.02 4.04 140 T_XMDrugObfuBody_00 2749 0.81 1.02 0.70 141 NO_DNS_FOR_FROM 2673 0.74 0.99 0.61 142 MPART_ALT_DIFF_COUNT 2665 0.84 0.98 0.76 143 XMStockSpam_06 2665 0.82 0.98 0.73 144 T_FILL_THIS_FORM_SHORT 2654 0.92 0.98 0.89 145 TR_LOTS_OF_MONEY3 2615 0.50 0.97 0.26 146 BAYES_20 2603 1.95 0.96 2.48 147 RELAYCOUNTRY_GB 2593 1.04 0.96 1.08 148 XMSubMetaI_01 2555 0.36 0.94 0.04 149 TR_XM_DK_Bayes1 2544 2.68 0.94 3.62 150 XM_H_PHPOS 2527 1.56 0.93 1.90 151 XMHTMLBadTable_001 2510 0.61 0.93 0.44 152 MILLION_USD 2448 0.33 0.90 0.02 153 XM_HighProb1 2440 0.32 0.90 0.01 154 HTML_SHORT_CENTER 2439 0.48 0.90 0.25 155 XM_Lotto 2421 0.38 0.89 0.10 156 FVGT_m_MULTI_ODD_EMAIL 2412 0.35 0.89 0.06 157 TR_XM_DK_Bayes2 2384 2.24 0.88 2.97 158 RELAYCOUNTRY_AT 2362 0.38 0.87 0.12 159 XM_UB999 2360 0.32 0.87 0.02 160 MONEY_FRAUD_5 2349 0.32 0.87 0.03 161 XM_RXBody 2310 0.34 0.85 0.07 162 XMPhish14 2307 0.53 0.85 0.36 163 SUBJECT_DIET 2297 0.30 0.85 0.00 164 MONEY_FORM 2277 0.31 0.84 0.02 165 HTML_TAG_BALANCE_BODY 2256 0.55 0.83 0.39 166 HTML_FONT_FACE_BAD 2246 0.62 0.83 0.51 167 XM_ProductURIs 2241 0.85 0.83 0.86 168 RCVD_IN_IADB_VOUCHED 2216 2.61 0.82 3.57 169 DRUGS_ERECTILE 2180 0.31 0.80 0.04 170 TR_Symld_Words 2167 1.11 0.80 1.27 171 RDNS_DYNAMIC 2122 0.55 0.78 0.42 172 T_MONEY_PERCENT 2114 0.41 0.78 0.21 173 TR_LOTS_OF_MONEY2 2114 0.41 0.78 0.21 174 XMPhish30 2113 0.45 0.78 0.28 175 ADVANCE_FEE_5_NEW_FRM_MNY 2100 0.27 0.78 0.01 176 XMBrknScrpt_02 2086 0.51 0.77 0.38 177 XM_OfRef8 2084 0.31 0.77 0.06 178 HTTPS_HTTP_MISMATCH 2068 0.55 0.76 0.44 179 TR_Mismatch_TLD_02 2037 0.29 0.75 0.05 180 HK_LOTTO 1951 0.25 0.72 0.00 181 RELAYCOUNTRY_CN 1950 0.28 0.72 0.05 182 XMClaimOffer 1932 0.39 0.71 0.21 183 T_HTML_TAG_BALANCE_CENTER 1905 0.32 0.70 0.12 184 XM_B_REG_HTML 1890 0.43 0.70 0.28 185 DKIM_ADSP_NXDOMAIN 1889 0.42 0.70 0.27 186 XMBody_78 1884 0.48 0.70 0.37 187 REMOVE_BEFORE_LINK 1877 0.44 0.69 0.30 188 T_TooManySym_02 1856 1.25 0.69 1.56 189 URIBL_DBL_SPAM 1835 0.25 0.68 0.02 190 XM_UB95 1832 0.26 0.68 0.03 191 HTML_FONT_SIZE_HUGE 1823 0.31 0.67 0.12 192 RELAYCOUNTRY_NL 1814 0.34 0.67 0.16 193 XM_PDF 1795 2.79 0.66 3.94 194 DKIM_ADSP_CUSTOM_MED 1782 0.86 0.66 0.96 195 XM_H_PHPMailer 1778 0.62 0.66 0.60 196 PLING_QUERY 1773 0.38 0.65 0.23 197 XM_B_COPY_HTML 1748 0.45 0.65 0.34 198 XM_Body_Obfu01 1657 0.40 0.61 0.28 199 XMSubMetaSxObfu_03 1632 0.43 0.60 0.34 200 LOW_PRICE 1615 0.30 0.60 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 444901 91.26 96.61 88.38 2 DCC_CHECK_NEGATIVE 339320 54.35 30.08 67.41 3 DKIM_SIGNED 315700 65.06 69.41 62.71 4 XM_DK_Pass 310029 63.81 67.94 61.59 5 BAYES_50 294768 48.14 28.79 58.56 6 DKIM_VALID 290022 59.94 64.26 57.61 7 XMListUnsubscribeExists 208338 47.76 59.59 41.39 8 DKIM_VALID_AU 203312 43.58 49.53 40.39 9 XM_H_QuotedFrom 176257 38.08 43.78 35.01 10 DCC_CHECK 154770 43.94 68.47 30.75 11 T_TM2_M_HEADER_IN_MSG 148335 25.80 19.00 29.47 12 DKIM_VALID_EF 117509 21.86 19.09 23.34 13 HTML_FONT_LOW_CONTRAST 117423 25.86 30.56 23.33 14 ALL_TRUSTED 109462 14.70 1.60 21.74 15 MIME_HTML_ONLY 101459 28.32 43.49 20.15 16 FVGT_m_MULTI_ODD 98188 20.50 22.36 19.51 17 XMSubLong 96751 20.60 23.18 19.22 18 LOC_TINY_FONT_1 89221 21.82 29.45 17.72 19 MultiRelay 85813 15.53 12.70 17.05 20 T_KAM_HTML_FONT_INVALID 70609 15.18 17.34 14.03 21 BAYES_00 55552 7.62 1.28 11.04 22 XM_DK_Undo_02 54767 20.67 38.88 10.88 23 ANY_BOUNCE_MESSAGE 52419 7.14 1.05 10.41 24 BOUNCE_MESSAGE 52416 7.14 1.05 10.41 25 BAYES_99 51984 19.06 35.29 10.33 26 IN_ZIMBRA_NJ_WHITELIST 48865 6.32 0.03 9.71 27 TooManyTo_001 47288 8.00 5.41 9.39 28 XM_Body_Dirty_Words 45534 11.25 15.36 9.05 29 BAYES_999 45063 16.29 29.93 8.95 30 XM_Multi_Part_URI 44631 10.75 14.25 8.87 31 LotsOfNums_01 40294 7.47 6.48 8.00 32 MPART_ALT_DIFF 40051 7.13 5.59 7.96 33 XM_DKIMWhitelistDomains 38772 5.01 0.00 7.70 34 LOTS_OF_MONEY 35913 8.37 10.68 7.13 35 T_XMDrugObfuBody_14 34995 7.48 8.47 6.95 36 FSL_BULK_SIG 33963 9.41 14.35 6.75 37 RCVD_IN_RP_SAFE 33441 5.87 4.43 6.64 38 XM_Evil_Numbers_Gen 32372 8.29 11.73 6.43 39 RELAYCOUNTRY_META 31938 9.00 13.93 6.34 40 BAYES_60 31723 8.45 12.45 6.30 41 HTML_IMAGE_RATIO_02 31642 8.76 13.35 6.29 42 MIME_HTML_ONLY_MULTI 31636 5.01 2.64 6.28 43 RCVD_IN_RP_CERTIFIED 29758 4.98 3.25 5.91 44 RCVD_IN_IADB_LISTED 27596 4.23 1.91 5.48 45 MIME_QP_LONG_LINE 27466 4.90 3.87 5.46 46 DKIM_INVALID 25678 5.12 5.14 5.10 47 HTML_SHORT_LINK_IMG_1 25354 10.09 19.48 5.04 48 SHORTENED_URL_SRC 25238 9.97 19.19 5.01 49 SHORTENER_SHORT_IMG 25217 9.97 19.19 5.01 50 URI_BUFFLY 25217 9.95 19.13 5.01 51 XM_H_Long_From01 25200 5.54 6.53 5.01 52 RCVD_IN_IADB_SPF 24214 3.73 1.72 4.81 53 BOTNET_IPINHOSTNAME 22724 6.59 10.46 4.51 54 XM_SendGrid 22546 4.07 3.32 4.48 55 RCVD_IN_MSPIKE_H2 22374 4.03 3.27 4.44 56 HTML_IMAGE_RATIO_04 22065 5.45 7.45 4.38 57 TR_DCC_Bayes_99 21610 12.50 27.75 4.29 58 RCVD_IN_IADB_SENDERID 21399 3.33 1.63 4.25 59 RCVD_IN_IADB_DK 21045 3.28 1.61 4.18 60 T_REMOTE_IMAGE 20606 10.00 20.98 4.09 61 TR_XM_DK_Bayes 20359 2.99 1.02 4.04 62 XM_B_Phish_Phrases 20042 5.71 8.93 3.98 63 XM_PDF 19838 2.79 0.66 3.94 64 XMSubMetaSx_00 18318 5.35 8.53 3.64 65 TR_XM_DK_Bayes1 18215 2.68 0.94 3.62 66 BAYES_40 18099 2.81 1.35 3.60 67 BAYES_80 18023 6.55 12.08 3.58 68 RCVD_IN_IADB_VOUCHED 17956 2.61 0.82 3.57 69 T_TooManySym_01 17931 3.21 2.57 3.56 70 HTML_IMAGE_ONLY_08 17851 7.17 13.91 3.55 71 UNPARSEABLE_RELAY 17765 2.70 1.15 3.53 72 FROM_EXCESS_BASE64 16936 10.72 24.40 3.36 73 XMStrtUSub 16454 3.40 3.63 3.27 74 TVD_RCVD_IP 16299 2.23 0.36 3.24 75 TR_XM_DocInvoice 16257 4.42 6.62 3.23 76 XM_UncommonTLD01 15267 5.03 8.73 3.03 77 TR_XM_DK_Bayes2 14950 2.24 0.88 2.97 78 HTML_IMAGE_RATIO_06 14020 3.18 3.91 2.79 79 TooManyTo_002 13566 1.95 0.57 2.69 80 XMNumbers 13344 4.79 8.78 2.65 81 UNTRUSTED_Relay 13159 5.03 9.52 2.61 82 MIME_HTML_MOSTLY 13047 3.18 4.27 2.59 83 BAYES_95 12492 4.14 7.23 2.48 84 BAYES_20 12475 1.95 0.96 2.48 85 MAILING_LIST_MULTI 12344 2.05 1.31 2.45 86 TM2_M_URI_OPT_OUT 12185 2.84 3.63 2.42 87 XM_H_Long_From02 11688 1.91 1.14 2.32 88 RCVD_IN_IADB_OPTIN 11524 1.67 0.51 2.29 89 XM_UB50 11101 2.61 3.36 2.21 90 XM_SPF_SoftFail 11007 2.77 3.85 2.19 91 XMSexyCombo_05 10207 5.01 10.55 2.03 92 TooManyTo_003 10060 1.48 0.51 2.00 93 XMNoVowels 10004 2.23 2.68 1.99 94 RCVD_IN_MSPIKE_WL 9736 1.44 0.54 1.93 95 RCVD_IN_MSPIKE_H3 9734 1.44 0.53 1.93 96 XM_H_PHPOS 9545 1.56 0.93 1.90 97 HELO_NODOT 9457 1.32 0.27 1.88 98 XMSubNoVowel 9056 1.24 0.21 1.80 99 XM_DK_Undo_01 8945 1.56 1.16 1.78 100 HTML_IMAGE_RATIO_08 8810 2.11 2.78 1.75 101 T_XMDrugObfuBody_08 8406 1.76 1.94 1.67 102 HTML_IMAGE_ONLY_04 8175 3.05 5.69 1.62 103 IN_HORDE_ADDRESS_BOOK 8123 1.07 0.05 1.61 104 XMDiploma_00 8030 1.78 2.11 1.60 105 UPPERCASE_50_75 7998 1.07 0.10 1.59 106 RELAYCOUNTRY_PH 7975 1.03 0.01 1.58 107 HTML_MIME_NO_HTML_TAG 7925 8.20 20.52 1.57 108 BAYES_05 7879 1.20 0.53 1.57 109 T_TooManySym_02 7831 1.25 0.69 1.56 110 XM_DIRTYINTL 7785 2.08 3.07 1.55 111 XMSubLongNoVowel 7343 0.97 0.06 1.46 112 XM_CamelCaseFrm001 7340 2.03 3.10 1.46 113 XMCapTrack 7089 1.10 0.53 1.41 114 INVALID_MSGID 7033 0.97 0.19 1.40 115 URI_HEX 6779 1.91 2.96 1.35 116 XM_OfRef6 6415 1.93 3.16 1.27 117 TR_Symld_Words 6402 1.11 0.80 1.27 118 TO_MALFORMED 6400 0.83 0.01 1.27 119 RELAYCOUNTRY_CA 6292 1.59 2.23 1.25 120 USER_IN_DEF_DKIM_WL 5896 0.78 0.07 1.17 121 SUBJ_ALL_CAPS 5869 1.30 1.55 1.17 122 XMLngstWrd_00 5789 0.86 0.31 1.15 123 XM_GoogleGroups 5766 0.89 0.42 1.15 124 RELAYCOUNTRY_GB 5459 1.04 0.96 1.08 125 TooManyTo_004 5188 0.79 0.35 1.03 126 XMGenDplmaNmb 5143 1.11 1.27 1.02 127 XMPhish11 5099 1.09 1.23 1.01 128 XMLngstWrd_01 4977 0.75 0.30 0.99 129 URI_TRY_3LD 4922 1.00 1.04 0.98 130 DKIM_ADSP_CUSTOM_MED 4843 0.86 0.66 0.96 131 BOTNET 4820 9.45 25.23 0.96 132 T_FILL_THIS_FORM_SHORT 4470 0.92 0.98 0.89 133 XM_ProductURIs 4335 0.85 0.83 0.86 134 TooManyTo_005 4326 0.66 0.30 0.86 135 SpammyFromTLD_01 4161 1.06 1.50 0.83 136 TM2_M_VERY_LONG_WORD 3900 0.99 1.39 0.77 137 MPART_ALT_DIFF_COUNT 3836 0.84 0.98 0.76 138 XMStockSpam_06 3659 0.82 0.98 0.73 139 NML_ADSP_CUSTOM_MED 3641 0.64 0.48 0.72 140 FUZZY_CREDIT 3555 0.50 0.10 0.71 141 T_XMDrugObfuBody_00 3510 0.81 1.02 0.70 142 HTML_FONT_SIZE_LARGE 3485 1.17 2.07 0.69 143 TO_NO_BRKTS_HTML_ONLY 3476 0.48 0.10 0.69 144 XM_E_Blogspot 3410 0.46 0.04 0.68 145 RELAYCOUNTRY_DE 3170 0.60 0.55 0.63 146 USER_IN_WHITELIST 3169 0.41 0.00 0.63 147 T_TooManySym_03 3139 0.47 0.19 0.62 148 TR_MetaPhish_Combo_01 3126 0.59 0.53 0.62 149 NO_DNS_FOR_FROM 3047 0.74 0.99 0.61 150 T_Symld_Words_02 3043 0.75 1.02 0.60 151 XM_H_PHPMailer 3023 0.62 0.66 0.60 152 XMLngstWrd_02 2804 0.45 0.24 0.56 153 KHOP_DYNAMIC 2795 0.50 0.40 0.56 154 FORGED_GMAIL_RCVD 2677 0.55 0.59 0.53 155 XMBdyGiftCard01 2647 0.79 1.29 0.53 156 T_XMHurry_00 2631 0.76 1.19 0.52 157 T_OBFU_PDF_ATTACH 2619 0.40 0.18 0.52 158 SHORT_HELO_AND_INLINE_IMAGE 2584 0.35 0.05 0.51 159 HTML_FONT_FACE_BAD 2556 0.62 0.83 0.51 160 AC_DIV_BONANZA 2520 0.37 0.12 0.50 161 RELAYCOUNTRY_AU 2469 0.51 0.56 0.49 162 DIET_1 2412 1.27 2.74 0.48 163 MISSING_HEADERS 2396 6.96 19.02 0.48 164 XMSubMetaSxObfu_02 2391 0.38 0.22 0.47 165 XMGappySubj_01 2369 0.39 0.23 0.47 166 URI_NOVOWEL 2364 0.75 1.28 0.47 167 XM_USANA_RCVD 2253 0.29 0.00 0.45 168 XMSubMetaI_00 2247 1.07 2.23 0.45 169 XMHTMLBadTable_001 2235 0.61 0.93 0.44 170 XMBody_17 2233 1.04 2.16 0.44 171 XMSexyCombo_01 2224 0.74 1.30 0.44 172 XM_ShortIntro_01 2224 0.37 0.24 0.44 173 HTTPS_HTTP_MISMATCH 2213 0.55 0.76 0.44 174 XMMoneyMeta_00 2205 0.64 1.03 0.44 175 XMHTML_After_End 2140 0.66 1.09 0.43 176 HTML_IMAGE_ONLY_32 2124 0.37 0.28 0.42 177 TR_XM_RelayPhish 2109 1.09 2.35 0.42 178 RDNS_DYNAMIC 2101 0.55 0.78 0.42 179 TM2_M_BODY_EMPTY 2079 0.35 0.23 0.41 180 XMDateMe_00 2029 0.35 0.25 0.40 181 XMBody_95 2023 0.30 0.12 0.40 182 HTML_IMAGE_ONLY_28 2018 0.42 0.46 0.40 183 HTML_TAG_BALANCE_BODY 1987 0.55 0.83 0.39 184 RCVD_IN_SORBS_DUL 1968 0.31 0.15 0.39 185 TM2_M_A_HREF_HREF 1963 0.42 0.47 0.39 186 XMBrknScrpt_02 1889 0.51 0.77 0.38 187 FILL_THIS_FORM 1885 0.67 1.21 0.37 188 XMBody_78 1841 0.48 0.70 0.37 189 XMPhish14 1832 0.53 0.85 0.36 190 XMLngstWrd_03 1755 0.29 0.19 0.35 191 XM_H_Trusted_IP 1734 0.22 0.00 0.34 192 XM_B_COPY_HTML 1730 0.45 0.65 0.34 193 XMSubMetaSxObfu_03 1715 0.43 0.60 0.34 194 XMSlimDrugH 1630 0.99 2.22 0.32 195 RCVD_IN_BL_SPAMCOP_NET 1615 0.68 1.36 0.32 196 HTML_IMAGE_ONLY_24 1579 0.34 0.38 0.31 197 XMSolicitRefs_0 1576 0.29 0.25 0.31 198 HTML_IMAGE_ONLY_20 1557 0.28 0.24 0.31 199 XM_D_omniadmin_Whitelist 1502 0.19 0.00 0.30 200 HTML_IMAGE_ONLY_16 1501 0.24 0.13 0.30 ----------------------------------------------------------------------