Email: 725265 Autolearn: 0 AvgScore: 5.16 AvgScanTime: 3.93 sec Spam: 256010 Autolearn: 0 AvgScore: 13.76 AvgScanTime: 4.48 sec Ham: 469255 Autolearn: 0 AvgScore: 0.46 AvgScanTime: 3.63 sec Time Spent Running SA: 791.47 hours Time Spent Processing Spam: 318.64 hours Time Spent Processing Ham: 472.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 245891 89.98 96.05 86.68 2 DKIM_SIGNED 170170 64.07 66.47 62.76 3 DCC_CHECK 166893 42.87 65.19 30.70 4 XM_DK_Pass 166590 62.80 65.07 61.57 5 DKIM_VALID 157274 58.58 61.43 57.02 6 XMListUnsubscribeExists 144300 46.04 56.36 40.41 7 DKIM_VALID_AU 122901 43.62 48.01 41.23 8 MIME_HTML_ONLY 116917 28.36 45.67 18.92 9 XM_H_QuotedFrom 108070 34.88 42.21 30.88 10 XM_DK_Undo_02 95466 20.70 37.29 11.64 11 BAYES_99 87272 19.21 34.09 11.10 12 DCC_CHECK_NEGATIVE 86095 55.57 33.63 67.54 13 BAYES_50 77539 49.50 30.29 59.99 14 HTML_FONT_LOW_CONTRAST 75793 25.56 29.61 23.36 15 BAYES_999 74111 16.34 28.95 9.46 16 LOC_TINY_FONT_1 68439 21.25 26.73 18.25 17 TR_DCC_Bayes_99 67885 12.53 26.52 4.90 18 FROM_EXCESS_BASE64 64916 10.92 25.36 3.04 19 XMSubLong 62907 21.31 24.57 19.52 20 T_REMOTE_IMAGE 61747 11.05 24.12 3.92 21 HTML_SHORT_LINK_IMG_1 58893 11.64 23.00 5.44 22 HTML_MIME_NO_HTML_TAG 58536 9.63 22.86 2.41 23 SHORTENED_URL_SRC 57100 11.36 22.30 5.39 24 SHORTENER_SHORT_IMG 56999 11.34 22.26 5.38 25 URI_BUFFLY 56875 11.33 22.22 5.38 26 BODY_URI_ONLY 56667 7.90 22.13 0.13 27 MISSING_HEADERS 54542 8.16 21.30 0.99 28 MIME_HEADER_CTYPE_ONLY 54221 7.58 21.18 0.16 29 FVGT_m_MULTI_ODD 53760 20.28 21.00 19.89 30 XM_UncommonTLD01 49707 9.62 19.42 4.28 31 T_TM2_M_HEADER_IN_MSG 47447 25.24 18.53 28.90 32 DKIM_VALID_EF 46064 22.03 17.99 24.23 33 T_KAM_HTML_FONT_INVALID 41912 16.17 16.37 16.06 34 SpammyFromTLD_02 41530 5.84 16.22 0.18 35 XM_Body_Dirty_Words 39187 11.56 15.31 9.51 36 XM_Multi_Part_URI 35584 11.17 13.90 9.68 37 HTML_IMAGE_ONLY_08 34635 6.95 13.53 3.37 38 FSL_BULK_SIG 34106 9.42 13.32 7.29 39 MultiRelay 33069 15.84 12.92 17.44 40 HTML_IMAGE_RATIO_02 32935 8.73 12.86 6.48 41 BAYES_80 32286 7.16 12.61 4.19 42 BAYES_60 30210 8.73 11.80 7.05 43 RELAYCOUNTRY_META 29695 7.09 11.60 4.63 44 XM_Evil_Numbers_Gen 28872 8.75 11.28 7.38 45 BOTNET_IPINHOSTNAME 26534 6.79 10.36 4.83 46 LOTS_OF_MONEY 26032 8.29 10.17 7.26 47 RCVD_IN_RP_RNBL 25360 3.52 9.91 0.04 48 XMSexyCombo_05 25240 5.38 9.86 2.94 49 BOTNET 25202 4.18 9.84 1.10 50 HTML_IMAGE_ONLY_04 24427 4.79 9.54 2.20 51 XMNumbers 23313 5.02 9.11 2.79 52 XM_B_Phish_Phrases 20943 6.19 8.18 5.10 53 BAYES_95 19623 4.52 7.66 2.80 54 T_XMDrugObfuBody_14 18507 7.00 7.23 6.87 55 UNTRUSTED_Relay 18421 3.27 7.20 1.13 56 XMSubMetaSx_00 17258 4.68 6.74 3.55 57 TooManyTo_001 17112 8.54 6.68 9.55 58 HTML_IMAGE_RATIO_04 17065 5.00 6.67 4.09 59 XM_H_Long_From01 16106 5.09 6.29 4.43 60 TR_XM_DocInvoice 16071 4.22 6.28 3.09 61 LotsOfNums_01 14391 6.83 5.62 7.49 62 MPART_ALT_DIFF 13253 3.45 5.18 2.51 63 DKIM_INVALID 12896 5.49 5.04 5.74 64 RCVD_IN_RP_SAFE 12225 6.55 4.78 7.52 65 DIET_1 11726 1.93 4.58 0.48 66 HTML_SHORT_CENTER 10072 1.89 3.93 0.78 67 HTML_IMAGE_RATIO_06 9963 3.35 3.89 3.05 68 RCVD_IN_RP_CERTIFIED 9737 5.98 3.80 7.17 69 ALL_TRUSTED 9491 19.41 3.71 27.98 70 MIME_HTML_MOSTLY 9316 3.14 3.64 2.87 71 XM_SendGrid 8749 4.25 3.42 4.70 72 MIME_QP_LONG_LINE 8536 4.51 3.33 5.15 73 TM2_M_URI_OPT_OUT 8406 2.38 3.28 1.88 74 XM_OfRef6 8011 2.04 3.13 1.44 75 HTML_IMAGE_RATIO_08 7848 2.35 3.07 1.96 76 XMStrtUSub 7835 3.56 3.06 3.83 77 XM_DIRTYINTL 7787 2.03 3.04 1.48 78 XM_UB50 7681 1.54 3.00 0.74 79 T_TooManySym_01 7551 4.70 2.95 5.65 80 SUBJ_ALL_CAPS 7464 1.81 2.92 1.21 81 XM_SPF_SoftFail 7252 2.41 2.83 2.18 82 RCVD_IN_MSPIKE_H2 7106 3.87 2.78 4.47 83 XMDiploma_00 6600 1.95 2.58 1.61 84 URI_HEX 6533 1.83 2.55 1.43 85 XM_CamelCaseFrm001 6416 1.88 2.51 1.54 86 RELAYCOUNTRY_CA 6414 1.67 2.51 1.21 87 MIME_HTML_ONLY_MULTI 5949 1.46 2.32 0.99 88 PLING_QUERY 5946 1.01 2.32 0.29 89 XMBdyGiftCard01 5592 1.13 2.18 0.55 90 XM_URI_RBL 5589 0.85 2.18 0.12 91 XMSubMetaI_00 5163 1.27 2.02 0.86 92 MultiRelay_CC 5101 0.82 1.99 0.18 93 MultiRelay_Combo 5101 0.82 1.99 0.18 94 T_XMDrugObfuBody_08 5063 1.49 1.98 1.22 95 URIBL_DBL_SPAM 4873 0.69 1.90 0.03 96 ANY_BOUNCE_MESSAGE 4433 7.72 1.73 10.99 97 BOUNCE_MESSAGE 4431 7.72 1.73 10.99 98 RCVD_IN_IADB_LISTED 4409 3.68 1.72 4.75 99 XM_H_Long_From02 4379 1.15 1.71 0.84 100 XMSlimDrugH 4319 0.81 1.69 0.33 101 XMBody_17 4210 0.87 1.64 0.45 102 T_Symld_Words_02 4024 0.85 1.57 0.46 103 XMGenDplmaNmb 4012 1.13 1.57 0.89 104 RCVD_IN_IADB_SPF 4005 3.24 1.56 4.16 105 SpammyFromTLD_01 3856 1.77 1.51 1.92 106 HTML_FONT_SIZE_LARGE 3825 0.85 1.49 0.49 107 RCVD_IN_IADB_SENDERID 3771 2.89 1.47 3.67 108 RCVD_IN_IADB_DK 3735 2.84 1.46 3.59 109 XMSexyCombo_01 3711 0.74 1.45 0.35 110 TooManyTo_002 3635 3.09 1.42 4.01 111 NO_DNS_FOR_FROM 3599 0.98 1.41 0.74 112 XMPhish11 3566 1.30 1.39 1.24 113 FVGT_m_MULTI_ODD_EMAIL 3446 0.51 1.35 0.06 114 TM2_M_VERY_LONG_WORD 3367 0.97 1.32 0.79 115 XM_Combo_Sbj 3356 0.57 1.31 0.17 116 XM_ProductURIs 3315 1.38 1.29 1.42 117 TooManyTo_003 3278 2.40 1.28 3.01 118 BOTNET_NORDNS 3244 0.46 1.27 0.02 119 MAILING_LIST_MULTI 3221 1.77 1.26 2.05 120 TR_Caps_n_Bayes_99 3204 0.49 1.25 0.07 121 RCVD_IN_BL_SPAMCOP_NET 3166 0.63 1.24 0.30 122 XMStockSpam_06 3151 1.27 1.23 1.30 123 TR_XM_RelayPhish 3150 0.83 1.23 0.61 124 XM_UB60 3134 0.53 1.22 0.15 125 XM_DK_Undo_01 3130 1.59 1.22 1.79 126 XMSubMetaSx_01 3034 0.52 1.19 0.16 127 XM_UB99 3024 0.43 1.18 0.01 128 RELAYCOUNTRY_FR 3024 0.57 1.18 0.23 129 UNPARSEABLE_RELAY 3004 2.95 1.17 3.92 130 URIBL_BLACK 2964 0.44 1.16 0.04 131 T_XMHurry_00 2928 0.80 1.14 0.62 132 XM_HighProb1 2924 0.41 1.14 0.02 133 TO_NO_BRKTS_HTML_ONLY 2863 1.63 1.12 1.90 134 XMWghtMeta_00 2856 0.41 1.12 0.02 135 BAYES_00 2799 4.94 1.09 7.03 136 TO_IN_SUBJ 2702 1.45 1.06 1.67 137 TooManyTo_004 2678 1.56 1.05 1.84 138 TR_LOTS_OF_MONEY1 2645 0.39 1.03 0.03 139 TR_Symld_Words 2608 1.31 1.02 1.47 140 URI_TRY_3LD 2552 1.02 1.00 1.03 141 BAYES_40 2550 2.67 1.00 3.59 142 XM_BadFromFormat 2548 0.47 1.00 0.19 143 XMHTML_After_End 2497 0.59 0.98 0.37 144 RELAYCOUNTRY_CN 2486 0.38 0.97 0.05 145 XM_B_REG_HTML 2465 0.52 0.96 0.28 146 FILL_THIS_FORM 2460 0.66 0.96 0.49 147 TR_XM_DK_Bayes 2401 2.99 0.94 4.11 148 XM_H_PHPOS 2375 1.17 0.93 1.30 149 XMPhish14 2351 0.49 0.92 0.25 150 BAYES_20 2347 2.01 0.92 2.60 151 T_XMDrugObfuBody_00 2311 0.68 0.90 0.56 152 XMBody_78 2286 0.58 0.89 0.41 153 TR_XM_DK_Bayes1 2282 2.66 0.89 3.63 154 T_FILL_THIS_FORM_LONG 2279 0.55 0.89 0.36 155 XM_UB999 2249 0.32 0.88 0.01 156 TooManyTo_005 2248 1.25 0.88 1.46 157 XM_OfRef7 2242 0.42 0.88 0.18 158 XMWarranty1 2233 0.31 0.87 0.00 159 XMBrknScrpt_02 2204 0.66 0.86 0.56 160 HTML_FONT_FACE_BAD 2202 0.60 0.86 0.46 161 HTML_TAG_BALANCE_BODY 2196 0.59 0.86 0.44 162 TR_XM_DK_Bayes2 2181 2.25 0.85 3.01 163 TR_LOTS_OF_MONEY2 2156 0.44 0.84 0.21 164 T_MONEY_PERCENT 2156 0.44 0.84 0.21 165 XMPhish30 2129 0.44 0.83 0.22 166 FROM_LOCAL_NOVOWEL 2094 0.34 0.82 0.08 167 T_TooManySym_02 2092 1.50 0.82 1.87 168 RCVD_IN_IADB_VOUCHED 2078 2.35 0.81 3.18 169 T_HTML_TAG_BALANCE_CENTER 2052 0.41 0.80 0.20 170 XM_RXBody 2028 0.32 0.79 0.07 171 XM_UB80 1988 0.30 0.78 0.04 172 RELAYCOUNTRY_GB 1951 0.91 0.76 1.00 173 T_FILL_THIS_FORM_SHORT 1924 0.82 0.75 0.86 174 XM_PDF 1919 3.34 0.75 4.75 175 RELAYCOUNTRY_AT 1900 0.40 0.74 0.22 176 XMMoneyMeta_00 1893 0.61 0.74 0.53 177 XMHTMLBadTable_001 1863 0.47 0.73 0.33 178 PP_MIME_FAKE_ASCII_TEXT 1844 0.36 0.72 0.17 179 SUBJ_DOLLARS 1802 0.34 0.70 0.14 180 MPART_ALT_DIFF_COUNT 1796 0.45 0.70 0.31 181 RELAYCOUNTRY_IN 1774 0.30 0.69 0.09 182 XMClaimOffer 1768 0.35 0.69 0.16 183 HTTPS_HTTP_MISMATCH 1764 0.53 0.69 0.44 184 DKIM_ADSP_CUSTOM_MED 1742 0.86 0.68 0.96 185 HDRS_LCASE_IMGONLY 1727 0.27 0.67 0.05 186 MORE_SEX 1722 0.24 0.67 0.01 187 LOW_PRICE 1661 0.38 0.65 0.23 188 KHOP_DYNAMIC 1628 0.64 0.64 0.64 189 XMSubMetaSxObfu_03 1607 0.43 0.63 0.33 190 RDNS_DYNAMIC 1573 0.46 0.61 0.38 191 XMSexyCombo_04 1563 0.25 0.61 0.05 192 RELAYCOUNTRY_DE 1526 0.43 0.60 0.34 193 TVD_SPACE_RATIO_MINFP 1519 0.21 0.59 0.01 194 XM_B_COPY_HTML 1517 0.44 0.59 0.35 195 XMReplyNow 1502 0.30 0.59 0.15 196 XM_Body_Obfu01 1497 0.39 0.58 0.28 197 FORGED_GMAIL_RCVD 1472 0.50 0.57 0.46 198 XMSubMetaI_01 1468 0.24 0.57 0.07 199 MONEY_FORM 1462 0.21 0.57 0.02 200 XM_H_PHPMailer 1447 0.62 0.57 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 406737 89.98 96.05 86.68 2 DCC_CHECK_NEGATIVE 316950 55.57 33.63 67.54 3 DKIM_SIGNED 294504 64.07 66.47 62.76 4 XM_DK_Pass 288899 62.80 65.07 61.57 5 BAYES_50 281493 49.50 30.29 59.99 6 DKIM_VALID 267571 58.58 61.43 57.02 7 DKIM_VALID_AU 193456 43.62 48.01 41.23 8 XMListUnsubscribeExists 189608 46.04 56.36 40.41 9 XM_H_QuotedFrom 144902 34.88 42.21 30.88 10 DCC_CHECK 144042 42.87 65.19 30.70 11 T_TM2_M_HEADER_IN_MSG 135596 25.24 18.53 28.90 12 ALL_TRUSTED 131301 19.41 3.71 27.98 13 DKIM_VALID_EF 113684 22.03 17.99 24.23 14 HTML_FONT_LOW_CONTRAST 109604 25.56 29.61 23.36 15 FVGT_m_MULTI_ODD 93350 20.28 21.00 19.89 16 XMSubLong 91619 21.31 24.57 19.52 17 MIME_HTML_ONLY 88772 28.36 45.67 18.92 18 LOC_TINY_FONT_1 85645 21.25 26.73 18.25 19 MultiRelay 81839 15.84 12.92 17.44 20 T_KAM_HTML_FONT_INVALID 75371 16.17 16.37 16.06 21 XM_DK_Undo_02 54635 20.70 37.29 11.64 22 BAYES_99 52074 19.21 34.09 11.10 23 ANY_BOUNCE_MESSAGE 51555 7.72 1.73 10.99 24 BOUNCE_MESSAGE 51555 7.72 1.73 10.99 25 XM_Multi_Part_URI 45430 11.17 13.90 9.68 26 TooManyTo_001 44812 8.54 6.68 9.55 27 XM_Body_Dirty_Words 44642 11.56 15.31 9.51 28 BAYES_999 44371 16.34 28.95 9.46 29 XM_DKIMWhitelistDomains 43327 6.05 0.22 9.23 30 RCVD_IN_RP_SAFE 35273 6.55 4.78 7.52 31 LotsOfNums_01 35140 6.83 5.62 7.49 32 XM_Evil_Numbers_Gen 34622 8.75 11.28 7.38 33 FSL_BULK_SIG 34223 9.42 13.32 7.29 34 LOTS_OF_MONEY 34090 8.29 10.17 7.26 35 RCVD_IN_RP_CERTIFIED 33650 5.98 3.80 7.17 36 BAYES_60 33076 8.73 11.80 7.05 37 BAYES_00 32996 4.94 1.09 7.03 38 T_XMDrugObfuBody_14 32246 7.00 7.23 6.87 39 HTML_IMAGE_RATIO_02 30406 8.73 12.86 6.48 40 DKIM_INVALID 26933 5.49 5.04 5.74 41 T_TooManySym_01 26520 4.70 2.95 5.65 42 HTML_SHORT_LINK_IMG_1 25532 11.64 23.00 5.44 43 SHORTENED_URL_SRC 25280 11.36 22.30 5.39 44 SHORTENER_SHORT_IMG 25265 11.34 22.26 5.38 45 URI_BUFFLY 25265 11.33 22.22 5.38 46 MIME_QP_LONG_LINE 24170 4.51 3.33 5.15 47 XM_B_Phish_Phrases 23925 6.19 8.18 5.10 48 TR_DCC_Bayes_99 22989 12.53 26.52 4.90 49 BOTNET_IPINHOSTNAME 22676 6.79 10.36 4.83 50 RCVD_IN_IADB_LISTED 22294 3.68 1.72 4.75 51 XM_PDF 22284 3.34 0.75 4.75 52 XM_SendGrid 22039 4.25 3.42 4.70 53 RELAYCOUNTRY_META 21725 7.09 11.60 4.63 54 IN_ZIMBRA_NJ_WHITELIST 21510 2.97 0.02 4.58 55 RCVD_IN_MSPIKE_H2 20991 3.87 2.78 4.47 56 XM_H_Long_From01 20811 5.09 6.29 4.43 57 XM_UncommonTLD01 20095 9.62 19.42 4.28 58 BAYES_80 19646 7.16 12.61 4.19 59 RCVD_IN_IADB_SPF 19521 3.24 1.56 4.16 60 TR_XM_DK_Bayes 19272 2.99 0.94 4.11 61 HTML_IMAGE_RATIO_04 19195 5.00 6.67 4.09 62 TooManyTo_002 18806 3.09 1.42 4.01 63 UNPARSEABLE_RELAY 18382 2.95 1.17 3.92 64 T_REMOTE_IMAGE 18375 11.05 24.12 3.92 65 XMStrtUSub 17962 3.56 3.06 3.83 66 RCVD_IN_IADB_SENDERID 17221 2.89 1.47 3.67 67 TR_XM_DK_Bayes1 17042 2.66 0.89 3.63 68 TVD_RCVD_IP 16982 2.40 0.17 3.62 69 RCVD_IN_IADB_DK 16855 2.84 1.46 3.59 70 BAYES_40 16823 2.67 1.00 3.59 71 XMSubMetaSx_00 16650 4.68 6.74 3.55 72 HTML_IMAGE_ONLY_08 15802 6.95 13.53 3.37 73 RCVD_IN_IADB_VOUCHED 14945 2.35 0.81 3.18 74 TR_XM_DocInvoice 14521 4.22 6.28 3.09 75 HTML_IMAGE_RATIO_06 14331 3.35 3.89 3.05 76 FROM_EXCESS_BASE64 14255 10.92 25.36 3.04 77 TR_XM_DK_Bayes2 14140 2.25 0.85 3.01 78 TooManyTo_003 14108 2.40 1.28 3.01 79 XMSexyCombo_05 13780 5.38 9.86 2.94 80 MIME_HTML_MOSTLY 13468 3.14 3.64 2.87 81 BAYES_95 13152 4.52 7.66 2.80 82 XMNumbers 13080 5.02 9.11 2.79 83 BAYES_20 12201 2.01 0.92 2.60 84 MPART_ALT_DIFF 11769 3.45 5.18 2.51 85 HTML_MIME_NO_HTML_TAG 11329 9.63 22.86 2.41 86 HTML_IMAGE_ONLY_04 10330 4.79 9.54 2.20 87 XM_SPF_SoftFail 10223 2.41 2.83 2.18 88 RCVD_IN_MSPIKE_WL 9731 1.50 0.44 2.07 89 RCVD_IN_MSPIKE_H3 9722 1.49 0.43 2.07 90 MAILING_LIST_MULTI 9636 1.77 1.26 2.05 91 HELO_NODOT 9360 1.38 0.27 1.99 92 RCVD_IN_IADB_OPTIN 9352 1.47 0.50 1.99 93 HTML_IMAGE_RATIO_08 9202 2.35 3.07 1.96 94 SpammyFromTLD_01 9008 1.77 1.51 1.92 95 TO_NO_BRKTS_HTML_ONLY 8929 1.63 1.12 1.90 96 TM2_M_URI_OPT_OUT 8832 2.38 3.28 1.88 97 T_TooManySym_02 8775 1.50 0.82 1.87 98 TooManyTo_004 8617 1.56 1.05 1.84 99 XM_DK_Undo_01 8405 1.59 1.22 1.79 100 IN_HORDE_ADDRESS_BOOK 7843 1.10 0.05 1.67 101 TO_IN_SUBJ 7819 1.45 1.06 1.67 102 XMDiploma_00 7542 1.95 2.58 1.61 103 BAYES_05 7450 1.20 0.50 1.59 104 XM_CamelCaseFrm001 7225 1.88 2.51 1.54 105 INVALID_MSGID 7131 1.04 0.16 1.52 106 XM_DIRTYINTL 6965 2.03 3.04 1.48 107 TR_Symld_Words 6897 1.31 1.02 1.47 108 XMCapTrack 6877 1.11 0.47 1.47 109 TooManyTo_005 6849 1.25 0.88 1.46 110 TO_MALFORMED 6840 0.95 0.01 1.46 111 XM_OfRef6 6754 2.04 3.13 1.44 112 URI_HEX 6722 1.83 2.55 1.43 113 XM_ProductURIs 6683 1.38 1.29 1.42 114 USER_IN_DEF_DKIM_WL 6515 0.93 0.08 1.39 115 XM_H_PHPOS 6091 1.17 0.93 1.30 116 XMStockSpam_06 6082 1.27 1.23 1.30 117 XMPhish11 5834 1.30 1.39 1.24 118 T_XMDrugObfuBody_08 5734 1.49 1.98 1.22 119 SUBJ_ALL_CAPS 5672 1.81 2.92 1.21 120 RELAYCOUNTRY_CA 5668 1.67 2.51 1.21 121 XMLngstWrd_00 5375 0.83 0.26 1.15 122 UNTRUSTED_Relay 5302 3.27 7.20 1.13 123 XM_GoogleGroups 5157 0.83 0.35 1.10 124 BOTNET 5145 4.18 9.84 1.10 125 URI_TRY_3LD 4826 1.02 1.00 1.03 126 XMLngstWrd_01 4755 0.74 0.25 1.01 127 RELAYCOUNTRY_GB 4684 0.91 0.76 1.00 128 MIME_HTML_ONLY_MULTI 4668 1.46 2.32 0.99 129 MISSING_HEADERS 4631 8.16 21.30 0.99 130 DKIM_ADSP_CUSTOM_MED 4483 0.86 0.68 0.96 131 XMGenDplmaNmb 4195 1.13 1.57 0.89 132 XMSubMetaI_00 4034 1.27 2.02 0.86 133 T_FILL_THIS_FORM_SHORT 4017 0.82 0.75 0.86 134 XM_H_Long_From02 3939 1.15 1.71 0.84 135 TM2_M_VERY_LONG_WORD 3694 0.97 1.32 0.79 136 HTML_SHORT_CENTER 3640 1.89 3.93 0.78 137 NO_DNS_FOR_FROM 3489 0.98 1.41 0.74 138 XMSubNoVowel 3473 0.60 0.34 0.74 139 XM_UB50 3460 1.54 3.00 0.74 140 NML_ADSP_CUSTOM_MED 3302 0.65 0.54 0.70 141 XMNoVowels 3128 0.62 0.53 0.67 142 USER_IN_WHITELIST 3080 0.42 0.00 0.66 143 XM_H_PHPMailer 3054 0.62 0.57 0.65 144 KHOP_DYNAMIC 3024 0.64 0.64 0.64 145 T_TooManySym_03 2910 0.48 0.21 0.62 146 T_XMHurry_00 2900 0.80 1.14 0.62 147 TR_XM_RelayPhish 2853 0.83 1.23 0.61 148 XM_ShortIntro_01 2710 0.51 0.40 0.58 149 TR_MetaPhish_Combo_01 2663 0.53 0.47 0.57 150 T_XMDrugObfuBody_00 2642 0.68 0.90 0.56 151 T_OBFU_PDF_ATTACH 2625 0.42 0.17 0.56 152 XMBrknScrpt_02 2619 0.66 0.86 0.56 153 XMSubMetaSxObfu_02 2618 0.44 0.21 0.56 154 XMBdyGiftCard01 2594 1.13 2.18 0.55 155 SHORT_HELO_AND_INLINE_IMAGE 2555 0.37 0.05 0.54 156 XMLngstWrd_02 2511 0.42 0.20 0.54 157 XMMoneyMeta_00 2496 0.61 0.74 0.53 158 AC_DIV_BONANZA 2393 0.38 0.13 0.51 159 XMGappySubj_01 2391 0.45 0.33 0.51 160 HTML_FONT_SIZE_LARGE 2307 0.85 1.49 0.49 161 FILL_THIS_FORM 2300 0.66 0.96 0.49 162 DIET_1 2239 1.93 4.58 0.48 163 HTML_IMAGE_ONLY_32 2221 0.38 0.22 0.47 164 URI_NOVOWEL 2165 0.49 0.55 0.46 165 RCVD_IN_SORBS_DUL 2159 0.36 0.18 0.46 166 HTML_FONT_FACE_BAD 2149 0.60 0.86 0.46 167 T_Symld_Words_02 2148 0.85 1.57 0.46 168 FORGED_GMAIL_RCVD 2139 0.50 0.57 0.46 169 XMBody_95 2134 0.33 0.10 0.45 170 RELAYCOUNTRY_AU 2121 0.43 0.40 0.45 171 XMBody_17 2109 0.87 1.64 0.45 172 HTML_TAG_BALANCE_BODY 2085 0.59 0.86 0.44 173 TM2_M_BODY_EMPTY 2074 0.34 0.14 0.44 174 HTTPS_HTTP_MISMATCH 2060 0.53 0.69 0.44 175 REPLYTO_WITHOUT_TO_CC 2037 0.36 0.23 0.43 176 HTML_IMAGE_ONLY_28 1963 0.38 0.32 0.42 177 XMSolicitRefs_0 1943 0.38 0.32 0.41 178 XMBody_78 1934 0.58 0.89 0.41 179 XMDateMe_00 1863 0.33 0.22 0.40 180 XMSubLongNoVowel 1825 0.27 0.06 0.39 181 XMSubGarbage 1812 0.26 0.02 0.39 182 DKIM_ADSP_NXDOMAIN 1802 0.36 0.33 0.38 183 HTML_IMAGE_ONLY_24 1784 0.32 0.22 0.38 184 RDNS_DYNAMIC 1765 0.46 0.61 0.38 185 XMHTML_After_End 1747 0.59 0.98 0.37 186 T_FILL_THIS_FORM_LONG 1691 0.55 0.89 0.36 187 XM_B_COPY_HTML 1653 0.44 0.59 0.35 188 XMSexyCombo_01 1651 0.74 1.45 0.35 189 XM_H_PHPOS_M 1645 0.38 0.45 0.35 190 RELAYCOUNTRY_DE 1615 0.43 0.60 0.34 191 XMLngstWrd_03 1600 0.27 0.15 0.34 192 XMHTMLBadTable_001 1554 0.47 0.73 0.33 193 XMSlimDrugH 1551 0.81 1.69 0.33 194 XMSubMetaSxObfu_03 1531 0.43 0.63 0.33 195 URIBL_SBL_A 1525 0.33 0.34 0.32 196 T_TooManySym_04 1506 0.25 0.12 0.32 197 HTML_IMAGE_ONLY_16 1475 0.28 0.21 0.31 198 HTML_IMAGE_ONLY_20 1463 0.28 0.21 0.31 199 XMRcvdHeader_15 1449 0.20 0.00 0.31 200 MPART_ALT_DIFF_COUNT 1434 0.45 0.70 0.31 ----------------------------------------------------------------------