Email: 770996 Autolearn: 0 AvgScore: 4.54 AvgScanTime: 4.27 sec Spam: 255380 Autolearn: 0 AvgScore: 14.08 AvgScanTime: 5.10 sec Ham: 515616 Autolearn: 0 AvgScore: -0.19 AvgScanTime: 3.85 sec Time Spent Running SA: 913.46 hours Time Spent Processing Spam: 361.55 hours Time Spent Processing Ham: 551.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 247516 90.10 96.92 86.73 2 DKIM_SIGNED 182728 65.82 71.55 62.98 3 XM_DK_Pass 178285 64.45 69.81 61.79 4 DCC_CHECK 177057 43.62 69.33 30.89 5 DKIM_VALID 169093 60.53 66.21 57.71 6 XMListUnsubscribeExists 153571 48.62 60.13 42.91 7 DKIM_VALID_AU 126213 43.26 49.42 40.20 8 XM_H_QuotedFrom 115300 37.27 45.15 33.36 9 MIME_HTML_ONLY 108163 25.95 42.35 17.83 10 XM_DK_Undo_02 103566 21.12 40.55 11.49 11 BAYES_99 95514 19.76 37.40 11.02 12 BAYES_50 80901 50.72 31.68 60.15 13 BAYES_999 79052 16.58 30.95 9.46 14 HTML_FONT_LOW_CONTRAST 76838 25.50 30.09 23.22 15 LOC_TINY_FONT_1 75782 21.70 29.67 17.75 16 DCC_CHECK_NEGATIVE 75060 54.66 29.39 67.17 17 TR_DCC_Bayes_99 73894 12.90 28.93 4.97 18 XMSubLong 62193 20.07 24.35 17.95 19 FVGT_m_MULTI_ODD 57055 20.74 22.34 19.94 20 FROM_EXCESS_BASE64 55025 9.18 21.55 3.06 21 DKIM_VALID_EF 51595 22.19 20.20 23.17 22 T_TM2_M_HEADER_IN_MSG 49930 26.58 19.55 30.06 23 T_KAM_HTML_FONT_INVALID 47464 16.08 18.59 14.84 24 T_REMOTE_IMAGE 46652 8.74 18.27 4.01 25 HTML_MIME_NO_HTML_TAG 45038 7.50 17.64 2.48 26 MISSING_HEADERS 41678 6.32 16.32 1.36 27 HTML_SHORT_LINK_IMG_1 41555 7.90 16.27 3.75 28 SHORTENER_SHORT_IMG 41116 7.82 16.10 3.71 29 SHORTENED_URL_SRC 41089 7.81 16.09 3.72 30 URI_BUFFLY 41062 7.81 16.08 3.71 31 BODY_URI_ONLY 40801 5.33 15.98 0.06 32 MIME_HEADER_CTYPE_ONLY 40426 5.35 15.83 0.16 33 XM_Body_Dirty_Words 39337 11.30 15.40 9.27 34 BOTNET 39298 5.99 15.39 1.33 35 XM_Multi_Part_URI 38866 11.00 15.22 8.92 36 FSL_BULK_SIG 38133 9.34 14.93 6.56 37 HTML_IMAGE_RATIO_02 37398 9.30 14.64 6.65 38 MultiRelay 35041 15.54 13.72 16.43 39 RCVD_IN_RP_RNBL 30547 4.00 11.96 0.05 40 RELAYCOUNTRY_META 30222 8.07 11.83 6.20 41 XM_Evil_Numbers_Gen 29047 8.68 11.37 7.35 42 BOTNET_IPINHOSTNAME 28267 6.74 11.07 4.59 43 XM_UncommonTLD01 28266 5.77 11.07 3.15 44 BAYES_80 27383 6.23 10.72 4.00 45 XMSexyCombo_05 24968 4.76 9.78 2.28 46 LOTS_OF_MONEY 24220 8.15 9.48 7.49 47 HTML_IMAGE_ONLY_08 23839 4.50 9.33 2.10 48 BAYES_60 23450 7.70 9.18 6.96 49 T_XMDrugObfuBody_14 23103 7.79 9.05 7.17 50 XMSubMetaSx_00 20626 5.03 8.08 3.52 51 HTML_IMAGE_RATIO_04 20135 5.25 7.88 3.95 52 BAYES_95 19129 4.28 7.49 2.69 53 XM_B_Phish_Phrases 18140 5.32 7.10 4.44 54 HTML_IMAGE_ONLY_04 18121 3.54 7.10 1.78 55 UNTRUSTED_Relay 17920 4.07 7.02 2.62 56 XM_H_Long_From01 17656 5.64 6.91 5.01 57 BOTNET_NORDNS 17443 2.53 6.83 0.40 58 XMNumbers 17266 4.09 6.76 2.77 59 LotsOfNums_01 16986 7.56 6.65 8.01 60 XMStrtUSub 16728 4.87 6.55 4.04 61 MPART_ALT_DIFF 16643 4.15 6.52 2.98 62 TooManyTo_001 15940 8.51 6.24 9.64 63 TR_XM_DocInvoice 15449 4.16 6.05 3.22 64 DKIM_INVALID 13635 5.29 5.34 5.27 65 XM_SPF_SoftFail 12008 2.87 4.70 1.97 66 MIME_HTML_MOSTLY 11458 2.93 4.49 2.16 67 RCVD_IN_RP_SAFE 11018 6.27 4.31 7.23 68 HTML_IMAGE_RATIO_06 10822 3.41 4.24 3.00 69 ALL_TRUSTED 10802 18.55 4.23 25.64 70 XM_SendGrid 10796 4.34 4.23 4.40 71 HTML_IMAGE_RATIO_08 10403 2.65 4.07 1.94 72 TM2_M_URI_OPT_OUT 9575 2.76 3.75 2.27 73 SpammyFromTLD_02 9567 1.37 3.75 0.19 74 MIME_QP_LONG_LINE 9111 5.11 3.57 5.88 75 DIET_1 8884 1.34 3.48 0.29 76 XM_DIRTYINTL 8226 2.08 3.22 1.51 77 XM_UB50 8030 2.54 3.14 2.23 78 RCVD_IN_RP_CERTIFIED 7997 5.12 3.13 6.11 79 RCVD_IN_MSPIKE_H2 7728 4.12 3.03 4.66 80 XMSlimDrugH 7558 1.21 2.96 0.34 81 XM_CamelCaseFrm001 7468 2.04 2.92 1.61 82 XM_URI_RBL 7173 1.02 2.81 0.13 83 MIME_HTML_ONLY_MULTI 7108 1.90 2.78 1.46 84 URI_HEX 7026 1.84 2.75 1.38 85 RELAYCOUNTRY_CA 6477 1.76 2.54 1.37 86 XM_OfRef6 5996 1.83 2.35 1.58 87 T_TooManySym_01 5966 3.03 2.34 3.38 88 T_XMDrugObfuBody_08 5495 1.64 2.15 1.39 89 XMDiploma_00 5403 1.95 2.12 1.87 90 XM_BadFromFormat 5311 0.82 2.08 0.19 91 XM_H_Long_From02 4939 2.29 1.93 2.46 92 RCVD_IN_IADB_LISTED 4921 4.58 1.93 5.89 93 PLING_QUERY 4873 0.79 1.91 0.24 94 MultiRelay_Combo 4759 0.75 1.86 0.19 95 MultiRelay_CC 4759 0.75 1.86 0.19 96 XMSubMetaI_00 4659 0.82 1.82 0.33 97 XMBdyGiftCard01 4547 1.04 1.78 0.68 98 XMSexyCombo_01 4444 0.86 1.74 0.43 99 J_WEEDS_L 4434 0.58 1.74 0.00 100 J_WEEDS_O 4434 0.58 1.74 0.00 101 J_WEEDS_M 4434 0.58 1.74 0.00 102 J_WEEDS_I 4434 0.58 1.74 0.00 103 J_WEEDS_C 4433 0.58 1.74 0.00 104 J_WEEDS_T 4433 0.58 1.74 0.00 105 J_WEEDS_R 4432 0.58 1.74 0.00 106 J_WEEDS_N 4429 0.57 1.73 0.00 107 J_WEEDS_V 4428 0.57 1.73 0.00 108 J_WEEDS_S 4426 0.57 1.73 0.00 109 J_WEEDS_B 4424 0.57 1.73 0.00 110 J_WEEDS_G 4423 0.57 1.73 0.00 111 J_WEEDS_D 4423 0.57 1.73 0.00 112 J_WEEDS_Y 4423 0.58 1.73 0.01 113 J_WEEDS_P 4422 0.57 1.73 0.00 114 J_WEEDS_K 4422 0.57 1.73 0.00 115 J_WEEDS_X 4422 0.57 1.73 0.00 116 J_WEEDS_F 4418 0.57 1.73 0.00 117 J_WEEDS_U 4414 0.57 1.73 0.00 118 J_WEEDS_W 4413 0.57 1.73 0.00 119 J_WEEDS_H 4413 0.57 1.73 0.00 120 HTML_ENTITY_ASCII 4412 0.57 1.73 0.00 121 RCVD_IN_IADB_SPF 4397 3.99 1.72 5.11 122 RCVD_IN_BL_SPAMCOP_NET 4169 0.78 1.63 0.36 123 RCVD_IN_IADB_SENDERID 4158 3.51 1.63 4.44 124 XMBody_17 4138 0.81 1.62 0.41 125 J_WEEDS_Q 4137 0.54 1.62 0.00 126 RCVD_IN_IADB_DK 4084 3.44 1.60 4.36 127 URIBL_BLACK 4041 0.56 1.58 0.05 128 XMPhish11 3917 1.27 1.53 1.13 129 SpammyFromTLD_01 3852 0.97 1.51 0.70 130 XMWghtMeta_00 3761 0.50 1.47 0.01 131 BOUNCE_MESSAGE 3504 7.01 1.37 9.81 132 ANY_BOUNCE_MESSAGE 3504 7.01 1.37 9.81 133 SUBJ_ALL_CAPS 3470 1.49 1.36 1.56 134 XMHTML_After_End 3468 0.74 1.36 0.44 135 UNPARSEABLE_RELAY 3410 2.86 1.34 3.61 136 TM2_M_VERY_LONG_WORD 3372 0.97 1.32 0.79 137 T_XMHurry_00 3353 0.72 1.31 0.43 138 XM_DK_Undo_01 3346 1.57 1.31 1.70 139 MAILING_LIST_MULTI 3325 1.93 1.30 2.24 140 LOW_PRICE 3204 0.55 1.25 0.20 141 SUBJ_DOLLARS 3173 0.52 1.24 0.17 142 XM_ProductURIs 3147 1.18 1.23 1.16 143 URI_TRY_3LD 3103 1.01 1.22 0.91 144 XM_UB99 3015 0.41 1.18 0.03 145 XMStockSpam_06 2968 0.82 1.16 0.66 146 URIBL_DBL_SPAM 2950 0.40 1.16 0.03 147 BAYES_00 2923 5.18 1.14 7.18 148 T_FILL_THIS_FORM_SHORT 2918 0.91 1.14 0.79 149 HTML_SHORT_CENTER 2906 0.57 1.14 0.29 150 XMGenDplmaNmb 2856 1.08 1.12 1.06 151 TR_XM_RelayPhish 2846 0.63 1.11 0.39 152 BAYES_40 2817 2.82 1.10 3.68 153 T_XMDrugObfuBody_00 2797 0.73 1.10 0.56 154 NO_DNS_FOR_FROM 2756 0.77 1.08 0.62 155 XM_JunkDunk 2733 0.35 1.07 0.00 156 XM_UB60 2686 0.39 1.05 0.06 157 XM_HighProb1 2618 0.35 1.03 0.01 158 T_Symld_Words_02 2549 0.69 1.00 0.53 159 XMSubMetaI_01 2546 0.34 1.00 0.01 160 TR_MetaPhish_Combo_01 2535 0.85 0.99 0.78 161 XMSlimDrugs 2530 0.35 0.99 0.03 162 XM_H_PHPOS 2510 1.88 0.98 2.33 163 TR_XM_DK_Bayes 2485 3.10 0.97 4.15 164 XM_PDF 2341 3.38 0.92 4.60 165 RCVD_IN_IADB_VOUCHED 2322 3.02 0.91 4.06 166 XM_UB999 2286 0.30 0.90 0.01 167 RELAYCOUNTRY_CN 2278 0.34 0.89 0.07 168 XMSubMetaSxObfu_03 2277 0.47 0.89 0.26 169 TR_XM_DK_Bayes1 2265 2.75 0.89 3.67 170 RELAYCOUNTRY_FR 2259 0.43 0.88 0.20 171 TR_Symld_Words 2239 1.95 0.88 2.49 172 HTML_TAG_BALANCE_BODY 2215 0.54 0.87 0.38 173 XMHTMLBadTable_001 2210 0.56 0.87 0.41 174 RELAYCOUNTRY_GB 2203 0.96 0.86 1.00 175 TR_XM_DK_Bayes2 2191 2.29 0.86 3.00 176 XMPhish30 2166 0.48 0.85 0.30 177 XMSubject_48 2159 0.29 0.85 0.02 178 XMBody_78 2019 1.11 0.79 1.27 179 XMSubMetaSx_01 2017 0.40 0.79 0.20 180 BAYES_20 1990 2.01 0.78 2.61 181 TooManyTo_002 1985 2.20 0.78 2.90 182 HTML_FONT_FACE_BAD 1968 0.67 0.77 0.63 183 XM_B_REG_HTML 1963 0.43 0.77 0.26 184 REMOVE_BEFORE_LINK 1925 0.43 0.75 0.26 185 URI_NOVOWEL 1899 0.52 0.74 0.41 186 XM_RXBody 1896 0.30 0.74 0.08 187 T_MONEY_PERCENT 1891 0.41 0.74 0.24 188 TR_LOTS_OF_MONEY2 1891 0.41 0.74 0.24 189 HTML_FONT_SIZE_LARGE 1866 0.46 0.73 0.32 190 HTTPS_HTTP_MISMATCH 1861 0.52 0.73 0.42 191 RELAYCOUNTRY_AT 1839 0.31 0.72 0.11 192 FILL_THIS_FORM 1809 0.53 0.71 0.45 193 XMSubMetaSSx_00 1787 0.38 0.70 0.22 194 RDNS_DYNAMIC 1787 0.54 0.70 0.47 195 XMWarranty1 1781 0.23 0.70 0.00 196 TooManyTo_003 1750 1.64 0.69 2.12 197 TM2_M_A_HREF_HREF 1704 0.53 0.67 0.46 198 TR_LOTS_OF_MONEY3 1698 0.36 0.66 0.21 199 XMClaimOffer 1678 0.32 0.66 0.15 200 FVGT_m_MULTI_ODD_EMAIL 1673 0.26 0.66 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 447171 90.10 96.92 86.73 2 DCC_CHECK_NEGATIVE 346365 54.66 29.39 67.17 3 DKIM_SIGNED 324746 65.82 71.55 62.98 4 XM_DK_Pass 318616 64.45 69.81 61.79 5 BAYES_50 310142 50.72 31.68 60.15 6 DKIM_VALID 297566 60.53 66.21 57.71 7 XMListUnsubscribeExists 221255 48.62 60.13 42.91 8 DKIM_VALID_AU 207285 43.26 49.42 40.20 9 XM_H_QuotedFrom 172022 37.27 45.15 33.36 10 DCC_CHECK 159253 43.62 69.33 30.89 11 T_TM2_M_HEADER_IN_MSG 154982 26.58 19.55 30.06 12 ALL_TRUSTED 132220 18.55 4.23 25.64 13 HTML_FONT_LOW_CONTRAST 119743 25.50 30.09 23.22 14 DKIM_VALID_EF 119473 22.19 20.20 23.17 15 FVGT_m_MULTI_ODD 102820 20.74 22.34 19.94 16 XMSubLong 92574 20.07 24.35 17.95 17 MIME_HTML_ONLY 91948 25.95 42.35 17.83 18 LOC_TINY_FONT_1 91530 21.70 29.67 17.75 19 MultiRelay 84739 15.54 13.72 16.43 20 T_KAM_HTML_FONT_INVALID 76543 16.08 18.59 14.84 21 XM_DK_Undo_02 59249 21.12 40.55 11.49 22 BAYES_99 56805 19.76 37.40 11.02 23 ANY_BOUNCE_MESSAGE 50567 7.01 1.37 9.81 24 BOUNCE_MESSAGE 50566 7.01 1.37 9.81 25 TooManyTo_001 49695 8.51 6.24 9.64 26 BAYES_999 48781 16.58 30.95 9.46 27 XM_Body_Dirty_Words 47788 11.30 15.40 9.27 28 XM_Multi_Part_URI 45969 11.00 15.22 8.92 29 XM_DKIMWhitelistDomains 43526 5.65 0.01 8.44 30 LotsOfNums_01 41304 7.56 6.65 8.01 31 LOTS_OF_MONEY 38606 8.15 9.48 7.49 32 XM_Evil_Numbers_Gen 37880 8.68 11.37 7.35 33 RCVD_IN_RP_SAFE 37302 6.27 4.31 7.23 34 BAYES_00 37012 5.18 1.14 7.18 35 T_XMDrugObfuBody_14 36959 7.79 9.05 7.17 36 BAYES_60 35911 7.70 9.18 6.96 37 HTML_IMAGE_RATIO_02 34295 9.30 14.64 6.65 38 FSL_BULK_SIG 33847 9.34 14.93 6.56 39 RELAYCOUNTRY_META 31977 8.07 11.83 6.20 40 RCVD_IN_RP_CERTIFIED 31515 5.12 3.13 6.11 41 RCVD_IN_IADB_LISTED 30388 4.58 1.93 5.89 42 MIME_QP_LONG_LINE 30320 5.11 3.57 5.88 43 DKIM_INVALID 27180 5.29 5.34 5.27 44 RCVD_IN_IADB_SPF 26344 3.99 1.72 5.11 45 XM_H_Long_From01 25824 5.64 6.91 5.01 46 IN_ZIMBRA_NJ_WHITELIST 25602 3.33 0.03 4.97 47 TR_DCC_Bayes_99 25601 12.90 28.93 4.97 48 RCVD_IN_MSPIKE_H2 24048 4.12 3.03 4.66 49 XM_PDF 23739 3.38 0.92 4.60 50 BOTNET_IPINHOSTNAME 23690 6.74 11.07 4.59 51 RCVD_IN_IADB_SENDERID 22918 3.51 1.63 4.44 52 XM_B_Phish_Phrases 22870 5.32 7.10 4.44 53 XM_SendGrid 22670 4.34 4.23 4.40 54 RCVD_IN_IADB_DK 22465 3.44 1.60 4.36 55 TR_XM_DK_Bayes 21398 3.10 0.97 4.15 56 RCVD_IN_IADB_VOUCHED 20929 3.02 0.91 4.06 57 XMStrtUSub 20853 4.87 6.55 4.04 58 T_REMOTE_IMAGE 20701 8.74 18.27 4.01 59 BAYES_80 20619 6.23 10.72 4.00 60 HTML_IMAGE_RATIO_04 20378 5.25 7.88 3.95 61 HTML_SHORT_LINK_IMG_1 19325 7.90 16.27 3.75 62 SHORTENED_URL_SRC 19156 7.81 16.09 3.72 63 SHORTENER_SHORT_IMG 19138 7.82 16.10 3.71 64 URI_BUFFLY 19136 7.81 16.08 3.71 65 BAYES_40 18954 2.82 1.10 3.68 66 TR_XM_DK_Bayes1 18947 2.75 0.89 3.67 67 UNPARSEABLE_RELAY 18603 2.86 1.34 3.61 68 XMSubMetaSx_00 18164 5.03 8.08 3.52 69 T_TooManySym_01 17410 3.03 2.34 3.38 70 TVD_RCVD_IP 17048 2.26 0.15 3.31 71 TR_XM_DocInvoice 16589 4.16 6.05 3.22 72 XM_UncommonTLD01 16236 5.77 11.07 3.15 73 FROM_EXCESS_BASE64 15784 9.18 21.55 3.06 74 HTML_IMAGE_RATIO_06 15484 3.41 4.24 3.00 75 TR_XM_DK_Bayes2 15447 2.29 0.86 3.00 76 MPART_ALT_DIFF 15354 4.15 6.52 2.98 77 TooManyTo_002 14966 2.20 0.78 2.90 78 XMNumbers 14306 4.09 6.76 2.77 79 BAYES_95 13887 4.28 7.49 2.69 80 UNTRUSTED_Relay 13486 4.07 7.02 2.62 81 BAYES_20 13472 2.01 0.78 2.61 82 RCVD_IN_IADB_OPTIN 13350 1.92 0.58 2.59 83 TR_Symld_Words 12827 1.95 0.88 2.49 84 HTML_MIME_NO_HTML_TAG 12806 7.50 17.64 2.48 85 XM_H_Long_From02 12687 2.29 1.93 2.46 86 XM_H_PHPOS 11998 1.88 0.98 2.33 87 XMSexyCombo_05 11738 4.76 9.78 2.28 88 TM2_M_URI_OPT_OUT 11711 2.76 3.75 2.27 89 MAILING_LIST_MULTI 11573 1.93 1.30 2.24 90 XM_UB50 11523 2.54 3.14 2.23 91 MIME_HTML_MOSTLY 11133 2.93 4.49 2.16 92 TooManyTo_003 10915 1.64 0.69 2.12 93 HTML_IMAGE_ONLY_08 10849 4.50 9.33 2.10 94 RCVD_IN_MSPIKE_WL 10237 1.53 0.61 1.99 95 RCVD_IN_MSPIKE_H3 10228 1.53 0.60 1.98 96 XM_SPF_SoftFail 10155 2.87 4.70 1.97 97 HTML_IMAGE_RATIO_08 9993 2.65 4.07 1.94 98 XMDiploma_00 9644 1.95 2.12 1.87 99 HELO_NODOT 9554 1.36 0.37 1.85 100 HTML_IMAGE_ONLY_04 9158 3.54 7.10 1.78 101 XM_DK_Undo_01 8752 1.57 1.31 1.70 102 IN_HORDE_ADDRESS_BOOK 8527 1.12 0.05 1.65 103 INVALID_MSGID 8476 1.17 0.21 1.64 104 XM_CamelCaseFrm001 8296 2.04 2.92 1.61 105 BAYES_05 8280 1.22 0.44 1.61 106 XM_OfRef6 8143 1.83 2.35 1.58 107 SUBJ_ALL_CAPS 8031 1.49 1.36 1.56 108 RELAYCOUNTRY_PH 7851 1.04 0.06 1.52 109 XM_DIRTYINTL 7806 2.08 3.22 1.51 110 T_TooManySym_02 7580 1.19 0.61 1.47 111 MIME_HTML_ONLY_MULTI 7512 1.90 2.78 1.46 112 T_XMDrugObfuBody_08 7152 1.64 2.15 1.39 113 URI_HEX 7127 1.84 2.75 1.38 114 RELAYCOUNTRY_CA 7074 1.76 2.54 1.37 115 MISSING_HEADERS 7014 6.32 16.32 1.36 116 BOTNET 6872 5.99 15.39 1.33 117 XMCapTrack 6827 1.10 0.64 1.32 118 XMBody_78 6559 1.11 0.79 1.27 119 TO_MALFORMED 6327 0.82 0.01 1.23 120 XMLngstWrd_00 5993 0.92 0.44 1.16 121 XM_ProductURIs 5978 1.18 1.23 1.16 122 USER_IN_DEF_DKIM_WL 5921 0.77 0.02 1.15 123 XMPhish11 5848 1.27 1.53 1.13 124 TooManyTo_004 5510 0.87 0.48 1.07 125 XMGenDplmaNmb 5450 1.08 1.12 1.06 126 XM_GoogleGroups 5385 0.84 0.44 1.04 127 XMLngstWrd_01 5286 0.82 0.39 1.03 128 RELAYCOUNTRY_GB 5177 0.96 0.86 1.00 129 DKIM_ADSP_CUSTOM_MED 4979 0.86 0.65 0.97 130 URI_TRY_3LD 4704 1.01 1.22 0.91 131 TooManyTo_005 4477 0.72 0.41 0.87 132 REPLYTO_WITHOUT_TO_CC 4386 0.77 0.60 0.85 133 TM2_M_VERY_LONG_WORD 4098 0.97 1.32 0.79 134 T_FILL_THIS_FORM_SHORT 4080 0.91 1.14 0.79 135 TR_MetaPhish_Combo_01 4042 0.85 0.99 0.78 136 TO_NO_BRKTS_HTML_ONLY 3749 0.51 0.08 0.73 137 NML_ADSP_CUSTOM_MED 3713 0.65 0.51 0.72 138 XMNoVowels 3657 0.62 0.44 0.71 139 SpammyFromTLD_01 3594 0.97 1.51 0.70 140 XMBdyGiftCard01 3486 1.04 1.78 0.68 141 XMStockSpam_06 3386 0.82 1.16 0.66 142 USER_IN_WHITELIST 3379 0.44 0.00 0.66 143 XMABCOffice1 3344 0.43 0.00 0.65 144 HTML_FONT_FACE_BAD 3231 0.67 0.77 0.63 145 KHOP_DYNAMIC 3229 0.57 0.47 0.63 146 NO_DNS_FOR_FROM 3174 0.77 1.08 0.62 147 T_OBFU_PDF_ATTACH 3171 0.50 0.25 0.61 148 XMLngstWrd_02 2975 0.48 0.28 0.58 149 TR_Mismatch_TLD_01 2890 0.44 0.19 0.56 150 XM_H_PHPMailer 2864 0.58 0.64 0.56 151 T_XMDrugObfuBody_00 2863 0.73 1.10 0.56 152 XMSubMetaSxObfu_02 2766 0.47 0.35 0.54 153 T_Symld_Words_02 2747 0.69 1.00 0.53 154 T_TooManySym_03 2737 0.39 0.09 0.53 155 RELAYCOUNTRY_DE 2625 0.53 0.58 0.51 156 XMMoneyMeta_00 2612 0.56 0.65 0.51 157 XMSubNoVowel 2596 0.41 0.23 0.50 158 FORGED_GMAIL_RCVD 2584 0.52 0.57 0.50 159 SHORT_HELO_AND_INLINE_IMAGE 2479 0.34 0.07 0.48 160 XM_ShortIntro_01 2456 0.45 0.39 0.48 161 RDNS_DYNAMIC 2403 0.54 0.70 0.47 162 TM2_M_A_HREF_HREF 2378 0.53 0.67 0.46 163 RELAYCOUNTRY_AU 2351 0.48 0.54 0.46 164 FILL_THIS_FORM 2309 0.53 0.71 0.45 165 XMDateMe_00 2276 0.40 0.30 0.44 166 XMHTML_After_End 2267 0.74 1.36 0.44 167 HTML_IMAGE_ONLY_28 2236 0.44 0.44 0.43 168 T_XMHurry_00 2214 0.72 1.31 0.43 169 XMSexyCombo_01 2214 0.86 1.74 0.43 170 HTML_IMAGE_ONLY_32 2208 0.35 0.18 0.43 171 XMGappySubj_01 2201 0.41 0.39 0.43 172 HTTPS_HTTP_MISMATCH 2176 0.52 0.73 0.42 173 XMBrknScrpt_02 2142 0.48 0.63 0.42 174 RCVD_IN_SORBS_DUL 2136 0.35 0.23 0.41 175 XMBody_17 2130 0.81 1.62 0.41 176 XMBody_95 2116 0.32 0.13 0.41 177 URI_NOVOWEL 2111 0.52 0.74 0.41 178 XMHTMLBadTable_001 2107 0.56 0.87 0.41 179 BOTNET_NORDNS 2088 2.53 6.83 0.40 180 AC_DIV_BONANZA 2068 0.29 0.08 0.40 181 TM2_M_BODY_EMPTY 2064 0.32 0.17 0.40 182 TR_XM_RelayPhish 2029 0.63 1.11 0.39 183 HTML_TAG_BALANCE_BODY 1964 0.54 0.87 0.38 184 MPART_ALT_DIFF_COUNT 1961 0.43 0.54 0.38 185 XMLngstWrd_03 1896 0.30 0.17 0.37 186 T_FILL_THIS_FORM_LONG 1862 0.46 0.65 0.36 187 XM_B_COPY_HTML 1852 0.43 0.59 0.36 188 RCVD_IN_BL_SPAMCOP_NET 1841 0.78 1.63 0.36 189 XM_B_TRADE_HTML 1816 0.33 0.30 0.35 190 DKIM_ADSP_NXDOMAIN 1748 0.34 0.34 0.34 191 XMSlimDrugH 1748 1.21 2.96 0.34 192 XMSubMetaI_00 1698 0.82 1.82 0.33 193 HTML_FONT_SIZE_LARGE 1662 0.46 0.73 0.32 194 URIBL_DBL_ABUSE_REDIR 1650 0.34 0.37 0.32 195 FILL_THIS_FORM_LOAN 1615 0.38 0.50 0.31 196 HTML_IMAGE_ONLY_24 1591 0.33 0.36 0.31 197 HTML_IMAGE_ONLY_16 1570 0.26 0.18 0.30 198 HTML_IMAGE_ONLY_20 1565 0.32 0.36 0.30 199 XMPhish30 1525 0.48 0.85 0.30 200 HTML_SHORT_CENTER 1492 0.57 1.14 0.29 ----------------------------------------------------------------------