Email: 353664 Autolearn: 0 AvgScore: 1.48 AvgScanTime: 2.84 sec Spam: 76710 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 3.25 sec Ham: 276954 Autolearn: 0 AvgScore: -1.54 AvgScanTime: 2.73 sec Time Spent Running SA: 279.43 hours Time Spent Processing Spam: 69.27 hours Time Spent Processing Ham: 210.16 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 72221 88.08 94.15 86.40 2 DKIM_SIGNED 61464 80.30 80.13 80.35 3 DCC_CHECK 60988 55.62 79.50 49.01 4 XM_DK_Pass 60272 79.04 78.57 79.17 5 DKIM_VALID 56387 75.70 73.51 76.30 6 XMListUnsubscribeExists 53405 60.97 69.62 58.57 7 DKIM_VALID_AU 45018 58.68 58.69 58.68 8 XM_H_QuotedFrom 37769 41.39 49.24 39.21 9 BAYES_50 33296 50.39 43.41 52.32 10 XM_DK_Undo_02 29792 15.96 38.84 9.62 11 MIME_HTML_ONLY 27729 27.36 36.15 24.93 12 LOC_TINY_FONT_1 26610 28.64 34.69 26.96 13 HTML_FONT_LOW_CONTRAST 25620 33.27 33.40 33.24 14 BAYES_99 23033 12.60 30.03 7.78 15 FVGT_m_MULTI_ODD 20726 22.73 27.02 21.54 16 TR_DCC_Bayes_99 19342 8.99 25.21 4.49 17 BAYES_999 19253 10.63 25.10 6.62 18 RELAYCOUNTRY_META 19005 9.05 24.78 4.70 19 XMSubLong 18941 23.08 24.69 22.64 20 BOTNET_IPINHOSTNAME 14968 9.51 19.51 6.74 21 DCC_CHECK_NEGATIVE 14804 42.75 19.30 49.25 22 DKIM_VALID_EF 14598 28.38 19.03 30.97 23 XM_Body_Dirty_Words 13903 14.52 18.12 13.52 24 UNTRUSTED_Relay 13605 5.04 17.74 1.52 25 T_KAM_HTML_FONT_INVALID 13345 16.55 17.40 16.32 26 BOTNET 12624 5.14 16.46 2.00 27 MultiRelay 12302 15.54 16.04 15.40 28 HTML_IMAGE_RATIO_02 11972 12.39 15.61 11.50 29 T_TM2_M_HEADER_IN_MSG 11949 22.00 15.58 23.78 30 XM_Multi_Part_URI 10473 14.39 13.65 14.59 31 FSL_BULK_SIG 10405 8.62 13.56 7.25 32 FROM_EXCESS_BASE64 10376 7.30 13.53 5.57 33 XM_Evil_Numbers_Gen 10368 9.96 13.52 8.97 34 LOTS_OF_MONEY 9928 12.10 12.94 11.86 35 XM_UncommonTLD01 8742 5.32 11.40 3.64 36 HTML_MIME_NO_HTML_TAG 7454 4.32 9.72 2.83 37 T_REMOTE_IMAGE 7277 5.10 9.49 3.88 38 XMSexyCombo_05 7188 5.95 9.37 5.01 39 BAYES_60 6996 6.24 9.12 5.45 40 T_XMDrugObfuBody_14 6988 7.56 9.11 7.14 41 MPART_ALT_DIFF 6868 5.04 8.95 3.96 42 TooManyTo_001 6638 6.36 8.65 5.72 43 HTML_IMAGE_RATIO_04 6633 7.56 8.65 7.26 44 XMSubMetaSx_00 6549 6.00 8.54 5.30 45 XM_H_Long_From01 6354 6.75 8.28 6.33 46 RCVD_IN_RP_RNBL 6261 1.85 8.16 0.10 47 XMNumbers 5997 5.12 7.82 4.37 48 XM_UB50 5931 2.35 7.73 0.86 49 BAYES_80 5259 4.39 6.86 3.70 50 RELAYCOUNTRY_FR 5115 1.88 6.67 0.56 51 DKIM_INVALID 5077 4.61 6.62 4.05 52 BODY_URI_ONLY 4886 1.81 6.37 0.55 53 MISSING_HEADERS 4772 1.92 6.22 0.73 54 MIME_HEADER_CTYPE_ONLY 4745 1.85 6.19 0.65 55 MIME_HTML_MOSTLY 4582 3.91 5.97 3.34 56 XM_B_Phish_Phrases 4533 6.53 5.91 6.70 57 XM_UB60 3903 1.13 5.09 0.04 58 XM_DIRTYINTL 3755 2.68 4.90 2.06 59 LotsOfNums_01 3744 7.38 4.88 8.07 60 XM_SPF_SoftFail 3612 2.10 4.71 1.38 61 MIME_HTML_ONLY_MULTI 3556 2.46 4.64 1.86 62 T_HTML_TAG_BALANCE_CENTER 3470 1.43 4.52 0.57 63 HTML_IMAGE_ONLY_16 3299 1.48 4.30 0.70 64 NORMAL_HTTP_TO_IP 3287 1.35 4.28 0.54 65 XMStrtUSub 3232 4.71 4.21 4.85 66 HTML_IMAGE_RATIO_06 3202 4.01 4.17 3.97 67 RCVD_IN_RP_SAFE 3160 10.89 4.12 12.77 68 HTML_SHORT_LINK_IMG_2 3150 1.33 4.11 0.56 69 XM_salutation2 3124 1.33 4.07 0.57 70 RCVD_IN_BL_SPAMCOP_NET 3003 1.06 3.91 0.26 71 HTML_IMAGE_RATIO_08 2930 2.65 3.82 2.32 72 RELAYCOUNTRY_CA 2901 2.15 3.78 1.70 73 XM_CamelCaseFrm001 2718 2.25 3.54 1.89 74 BAYES_95 2718 2.56 3.54 2.28 75 BOTNET_NORDNS 2702 0.78 3.52 0.02 76 MultiRelay_Combo 2675 0.86 3.49 0.13 77 MultiRelay_CC 2675 0.86 3.49 0.13 78 RCVD_IN_MSPIKE_H2 2645 4.05 3.45 4.22 79 URIBL_DBL_SPAM 2584 0.84 3.37 0.14 80 T_TooManySym_01 2543 5.73 3.32 6.40 81 XM_SendGrid 2444 5.44 3.19 6.06 82 SpammyFromTLD_02 2305 0.79 3.00 0.17 83 UNPARSEABLE_RELAY 2279 3.86 2.97 4.11 84 RELAYCOUNTRY_CN 2124 0.63 2.77 0.04 85 RCVD_IN_RP_CERTIFIED 2061 8.66 2.69 10.32 86 XMSubMetaI_00 2054 1.27 2.68 0.88 87 XMSexyCombo_01 2029 1.61 2.65 1.32 88 URI_HEX 2007 2.26 2.62 2.16 89 TM2_M_URI_OPT_OUT 1981 1.89 2.58 1.70 90 XMBody_17 1912 1.20 2.49 0.85 91 DIET_1 1864 0.88 2.43 0.46 92 SpammyFromTLD_01 1822 0.84 2.38 0.42 93 HTML_SHORT_LINK_IMG_1 1810 0.56 2.36 0.06 94 PLING_QUERY 1782 0.90 2.32 0.50 95 MIME_QP_LONG_LINE 1743 3.95 2.27 4.41 96 BAYES_40 1735 3.71 2.26 4.11 97 URIBL_BLACK 1619 0.51 2.11 0.07 98 TVD_SPACE_RATIO_MINFP 1603 0.46 2.09 0.00 99 TR_LOTS_OF_MONEY2 1585 0.87 2.07 0.54 100 T_MONEY_PERCENT 1585 0.87 2.07 0.54 101 SUBJ_ALL_CAPS 1585 2.37 2.07 2.45 102 XMStockSpam_06 1522 1.09 1.98 0.84 103 BAYES_20 1503 2.86 1.96 3.11 104 XM_OfRef6 1487 1.57 1.94 1.47 105 XM_URI_RBL 1485 0.77 1.94 0.45 106 MAILING_LIST_MULTI 1458 2.49 1.90 2.65 107 XMBdyGiftCard01 1456 1.65 1.90 1.58 108 XM_H_Long_From02 1418 1.22 1.85 1.04 109 T_XMDrugObfuBody_08 1407 1.40 1.83 1.28 110 XMDiploma_00 1372 1.43 1.79 1.33 111 HTML_IMAGE_ONLY_04 1369 0.43 1.78 0.05 112 HTML_SHORT_CENTER 1338 0.40 1.74 0.02 113 XMPhish30 1314 0.88 1.71 0.66 114 XM_UB80 1295 0.38 1.69 0.02 115 DKIM_ADSP_CUSTOM_MED 1277 0.93 1.66 0.72 116 XM_ProductURIs 1275 1.33 1.66 1.24 117 TR_Symld_Words 1237 2.16 1.61 2.31 118 URIBL_ABUSE_SURBL 1223 0.37 1.59 0.03 119 RELAYCOUNTRY_AT 1214 0.59 1.58 0.31 120 NML_ADSP_CUSTOM_MED 1212 0.68 1.58 0.43 121 FROM_SUSPICIOUS_NTLD 1206 0.38 1.57 0.05 122 BAYES_00 1194 15.49 1.56 19.34 123 XM_B_REG_HTML 1191 0.97 1.55 0.81 124 SUBJ_DOLLARS 1182 1.04 1.54 0.90 125 LONG_JUNK_URI 1171 0.41 1.53 0.10 126 TR_Mismatch_TLD_02 1163 0.38 1.52 0.07 127 RDNS_DYNAMIC 1158 0.77 1.51 0.57 128 T_XMHurry_00 1154 0.99 1.50 0.85 129 TR_XM_RelayPhish 1136 0.68 1.48 0.46 130 FORGED_GMAIL_RCVD 1127 0.63 1.47 0.39 131 XM_DK_Undo_01 1111 1.57 1.45 1.60 132 HK_RANDOM_FROM 1110 0.58 1.45 0.35 133 T_XMDrugObfuBody_00 1104 1.01 1.44 0.89 134 XMGenDplmaNmb 1096 0.83 1.43 0.66 135 XMPhish11 1092 0.99 1.42 0.88 136 RELAYCOUNTRY_GB 1079 0.78 1.41 0.61 137 XMSubMetaSSx_00 1078 0.53 1.41 0.29 138 T_Symld_Words_02 1077 0.77 1.40 0.59 139 RCVD_IN_IADB_LISTED 1063 3.95 1.39 4.66 140 XM_RXBody 1025 0.63 1.34 0.44 141 TR_XM_DK_Bayes 1018 13.34 1.33 16.67 142 LongTLD 1007 0.38 1.31 0.12 143 URI_NOVOWEL 978 0.80 1.27 0.66 144 TM2_M_VERY_LONG_WORD 968 1.01 1.26 0.94 145 XM_H_PHPOS 959 0.89 1.25 0.79 146 TR_XM_DK_Bayes1 959 13.03 1.25 16.29 147 THIS_AD 945 0.56 1.23 0.38 148 BAYES_05 942 1.75 1.23 1.89 149 XM_UB99 927 0.27 1.21 0.01 150 DATE_IN_PAST_03_06 921 0.38 1.20 0.15 151 XMBrknScrpt_02 898 0.75 1.17 0.63 152 XMSexyCombo_04 854 0.98 1.11 0.94 153 BODY_ENHANCEMENT 839 0.26 1.09 0.03 154 ALL_TRUSTED 835 11.18 1.09 13.98 155 RCVD_IN_IADB_SPF 828 3.43 1.08 4.07 156 URI_TRY_3LD 812 1.68 1.06 1.85 157 RCVD_IN_IADB_SENDERID 809 3.08 1.05 3.64 158 RCVD_IN_IADB_DK 796 2.99 1.04 3.53 159 XM_B_COPY_HTML 784 0.81 1.02 0.75 160 TR_XM_DK_Bayes2 779 10.50 1.02 13.12 161 TR_LOTS_OF_MONEY3 760 0.46 0.99 0.31 162 XM_OverStock_LProb 752 0.23 0.98 0.02 163 FILL_THIS_FORM 739 0.57 0.96 0.46 164 DEAR_SOMETHING 738 0.27 0.96 0.08 165 RCVD_IN_IADB_VOUCHED 730 2.52 0.95 2.95 166 T_FILL_THIS_FORM_SHORT 694 0.60 0.90 0.52 167 FILL_THIS_FORM_LONG 686 0.51 0.89 0.40 168 HK_RANDOM_ENVFROM 675 0.27 0.88 0.11 169 XM_UB999 669 0.20 0.87 0.01 170 RELAYCOUNTRY_DE 665 0.45 0.87 0.34 171 XMSubMetaI_01 663 0.21 0.86 0.02 172 RELAYCOUNTRY_IN 651 0.24 0.85 0.07 173 T_TooManySym_02 649 2.15 0.85 2.51 174 DKIM_ADSP_NXDOMAIN 618 0.55 0.81 0.48 175 XMHTMLBadTable_001 616 0.70 0.80 0.68 176 XMBody_78 607 0.60 0.79 0.55 177 FILL_THIS_FORM_LOAN 604 0.48 0.79 0.40 178 XMPhish14 603 0.43 0.79 0.34 179 XMSubMetaSx_01 599 0.30 0.78 0.17 180 XMSlimDrugH 592 0.40 0.77 0.30 181 RCVD_IN_SORBS_DUL 591 0.28 0.77 0.14 182 XMHTML_After_End 584 0.67 0.76 0.64 183 XM_H_PHPMailer 581 0.64 0.76 0.61 184 XM_Palau_URI 578 0.17 0.75 0.00 185 LONG_HEX_URI 573 0.22 0.75 0.08 186 RCVD_IN_IADB_OPTIN 562 1.64 0.73 1.89 187 SHORT_URI_3 554 0.17 0.72 0.02 188 HTML_FONT_FACE_BAD 552 0.63 0.72 0.60 189 XM_XX_Yahoo 549 0.20 0.72 0.05 190 TVD_RCVD_IP 533 3.08 0.69 3.73 191 XM_UB95 508 0.15 0.66 0.01 192 MPART_ALT_DIFF_COUNT 502 0.49 0.65 0.45 193 XMMoneySites 500 0.15 0.65 0.01 194 ANY_BOUNCE_MESSAGE 497 2.79 0.65 3.39 195 BOUNCE_MESSAGE 497 2.79 0.65 3.39 196 XMSubNoVowel 490 0.28 0.64 0.18 197 HK_SCAM_N2 484 0.14 0.63 0.01 198 FSL_THIS_IS_ADV 482 0.54 0.63 0.52 199 SUBJ_YOUR_FAMILY 482 0.16 0.63 0.03 200 HTML_IMAGE_ONLY_20 481 0.28 0.63 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 239288 88.08 94.15 86.40 2 DKIM_SIGNED 222530 80.30 80.13 80.35 3 XM_DK_Pass 219268 79.04 78.57 79.17 4 DKIM_VALID 211320 75.70 73.51 76.30 5 DKIM_VALID_AU 162523 58.68 58.69 58.68 6 XMListUnsubscribeExists 162220 60.97 69.62 58.57 7 BAYES_50 144901 50.39 43.41 52.32 8 DCC_CHECK_NEGATIVE 136392 42.75 19.30 49.25 9 DCC_CHECK 135725 55.62 79.50 49.01 10 XM_H_QuotedFrom 108602 41.39 49.24 39.21 11 HTML_FONT_LOW_CONTRAST 92054 33.27 33.40 33.24 12 DKIM_VALID_EF 85767 28.38 19.03 30.97 13 LOC_TINY_FONT_1 74665 28.64 34.69 26.96 14 MIME_HTML_ONLY 69036 27.36 36.15 24.93 15 T_TM2_M_HEADER_IN_MSG 65867 22.00 15.58 23.78 16 XMSubLong 62701 23.08 24.69 22.64 17 FVGT_m_MULTI_ODD 59658 22.73 27.02 21.54 18 BAYES_00 53575 15.49 1.56 19.34 19 TR_XM_DK_Bayes 46172 13.34 1.33 16.67 20 T_KAM_HTML_FONT_INVALID 45203 16.55 17.40 16.32 21 TR_XM_DK_Bayes1 45124 13.03 1.25 16.29 22 MultiRelay 42649 15.54 16.04 15.40 23 XM_Multi_Part_URI 40403 14.39 13.65 14.59 24 XM_DKIMWhitelistDomains 39795 11.25 0.01 14.37 25 ALL_TRUSTED 38718 11.18 1.09 13.98 26 XM_Body_Dirty_Words 37456 14.52 18.12 13.52 27 TR_XM_DK_Bayes2 36341 10.50 1.02 13.12 28 RCVD_IN_RP_SAFE 35360 10.89 4.12 12.77 29 LOTS_OF_MONEY 32860 12.10 12.94 11.86 30 HTML_IMAGE_RATIO_02 31850 12.39 15.61 11.50 31 RCVD_IN_RP_CERTIFIED 28569 8.66 2.69 10.32 32 XM_DK_Undo_02 26656 15.96 38.84 9.62 33 XM_Evil_Numbers_Gen 24840 9.96 13.52 8.97 34 LotsOfNums_01 22353 7.38 4.88 8.07 35 BAYES_99 21543 12.60 30.03 7.78 36 HTML_IMAGE_RATIO_04 20101 7.56 8.65 7.26 37 FSL_BULK_SIG 20068 8.62 13.56 7.25 38 T_XMDrugObfuBody_14 19762 7.56 9.11 7.14 39 BOTNET_IPINHOSTNAME 18678 9.51 19.51 6.74 40 XM_B_Phish_Phrases 18544 6.53 5.91 6.70 41 BAYES_999 18330 10.63 25.10 6.62 42 T_TooManySym_01 17722 5.73 3.32 6.40 43 XM_H_Long_From01 17521 6.75 8.28 6.33 44 XM_SendGrid 16786 5.44 3.19 6.06 45 TooManyTo_001 15848 6.36 8.65 5.72 46 FROM_EXCESS_BASE64 15433 7.30 13.53 5.57 47 BAYES_60 15087 6.24 9.12 5.45 48 XMSubMetaSx_00 14677 6.00 8.54 5.30 49 XMSexyCombo_05 13872 5.95 9.37 5.01 50 XMStrtUSub 13442 4.71 4.21 4.85 51 RELAYCOUNTRY_META 13008 9.05 24.78 4.70 52 RCVD_IN_IADB_LISTED 12897 3.95 1.39 4.66 53 TR_DCC_Bayes_99 12439 8.99 25.21 4.49 54 MIME_QP_LONG_LINE 12215 3.95 2.27 4.41 55 XMNumbers 12093 5.12 7.82 4.37 56 RCVD_IN_MSPIKE_H2 11674 4.05 3.45 4.22 57 BAYES_40 11394 3.71 2.26 4.11 58 UNPARSEABLE_RELAY 11378 3.86 2.97 4.11 59 RCVD_IN_IADB_SPF 11285 3.43 1.08 4.07 60 DKIM_INVALID 11210 4.61 6.62 4.05 61 TO_MALFORMED 11201 3.18 0.07 4.04 62 HTML_IMAGE_RATIO_06 10984 4.01 4.17 3.97 63 MPART_ALT_DIFF 10961 5.04 8.95 3.96 64 T_REMOTE_IMAGE 10751 5.10 9.49 3.88 65 TVD_RCVD_IP 10344 3.08 0.69 3.73 66 BAYES_80 10254 4.39 6.86 3.70 67 XM_UncommonTLD01 10074 5.32 11.40 3.64 68 RCVD_IN_IADB_SENDERID 10074 3.08 1.05 3.64 69 RCVD_IN_IADB_DK 9786 2.99 1.04 3.53 70 BOUNCE_MESSAGE 9385 2.79 0.65 3.39 71 ANY_BOUNCE_MESSAGE 9385 2.79 0.65 3.39 72 MIME_HTML_MOSTLY 9246 3.91 5.97 3.34 73 IN_ZIMBRA_NJ_WHITELIST 9026 2.56 0.02 3.26 74 BAYES_20 8605 2.86 1.96 3.11 75 RCVD_IN_IADB_VOUCHED 8177 2.52 0.95 2.95 76 HTML_MIME_NO_HTML_TAG 7833 4.32 9.72 2.83 77 MAILING_LIST_MULTI 7344 2.49 1.90 2.65 78 INVALID_MSGID 7001 2.00 0.10 2.53 79 T_TooManySym_02 6947 2.15 0.85 2.51 80 RCVD_IN_MSPIKE_WL 6805 2.02 0.42 2.46 81 RCVD_IN_MSPIKE_H3 6798 2.01 0.40 2.45 82 SUBJ_ALL_CAPS 6786 2.37 2.07 2.45 83 HTML_IMAGE_RATIO_08 6429 2.65 3.82 2.32 84 TR_Symld_Words 6410 2.16 1.61 2.31 85 BAYES_95 6322 2.56 3.54 2.28 86 URI_HEX 5988 2.26 2.62 2.16 87 XM_DIRTYINTL 5713 2.68 4.90 2.06 88 XM_PDF 5660 1.67 0.33 2.04 89 BOTNET 5547 5.14 16.46 2.00 90 IN_HORDE_ADDRESS_BOOK 5285 1.51 0.05 1.91 91 RCVD_IN_IADB_OPTIN 5239 1.64 0.73 1.89 92 BAYES_05 5236 1.75 1.23 1.89 93 XM_CamelCaseFrm001 5223 2.25 3.54 1.89 94 MIME_HTML_ONLY_MULTI 5138 2.46 4.64 1.86 95 URI_TRY_3LD 5117 1.68 1.06 1.85 96 TR_MetaPhish_Combo_01 4788 1.48 0.57 1.73 97 TM2_M_URI_OPT_OUT 4717 1.89 2.58 1.70 98 RELAYCOUNTRY_CA 4705 2.15 3.78 1.70 99 USER_IN_DEF_DKIM_WL 4680 1.33 0.03 1.69 100 XM_DK_Undo_01 4431 1.57 1.45 1.60 101 XMBdyGiftCard01 4380 1.65 1.90 1.58 102 UNTRUSTED_Relay 4202 5.04 17.74 1.52 103 XM_OfRef6 4067 1.57 1.94 1.47 104 XM_SPF_SoftFail 3813 2.10 4.71 1.38 105 XMDiploma_00 3684 1.43 1.79 1.33 106 XMSexyCombo_01 3654 1.61 2.65 1.32 107 T_XMDrugObfuBody_08 3544 1.40 1.83 1.28 108 XM_ProductURIs 3423 1.33 1.66 1.24 109 TM2_M_A_HREF_HREF 3293 1.05 0.56 1.19 110 XM_GoogleGroups 3141 1.00 0.51 1.13 111 TooManyTo_002 3045 0.99 0.60 1.10 112 XM_H_Long_From02 2884 1.22 1.85 1.04 113 XMBody_95 2655 0.78 0.14 0.96 114 XMSexyCombo_04 2603 0.98 1.11 0.94 115 TM2_M_VERY_LONG_WORD 2600 1.01 1.26 0.94 116 SUBJ_DOLLARS 2489 1.04 1.54 0.90 117 T_XMDrugObfuBody_00 2454 1.01 1.44 0.89 118 XMSubMetaI_00 2431 1.27 2.68 0.88 119 XMPhish11 2425 0.99 1.42 0.88 120 XM_UB50 2388 2.35 7.73 0.86 121 T_XMHurry_00 2350 0.99 1.50 0.85 122 XMBody_17 2341 1.20 2.49 0.85 123 XMStockSpam_06 2322 1.09 1.98 0.84 124 XM_B_REG_HTML 2234 0.97 1.55 0.81 125 USER_IN_WHITELIST 2212 0.63 0.00 0.80 126 XM_H_PHPOS 2201 0.89 1.25 0.79 127 XMSubMetaSxObfu_02 2183 0.74 0.55 0.79 128 XM_B_COPY_HTML 2077 0.81 1.02 0.75 129 MISSING_HEADERS 2009 1.92 6.22 0.73 130 DKIM_ADSP_CUSTOM_MED 1999 0.93 1.66 0.72 131 TooManyTo_003 1951 0.66 0.48 0.70 132 HTML_IMAGE_ONLY_16 1934 1.48 4.30 0.70 133 T_TooManySym_03 1909 0.57 0.15 0.69 134 XMHTMLBadTable_001 1876 0.70 0.80 0.68 135 URI_NOVOWEL 1835 0.80 1.27 0.66 136 XMGenDplmaNmb 1828 0.83 1.43 0.66 137 XMPhish30 1815 0.88 1.71 0.66 138 MIME_HEADER_CTYPE_ONLY 1809 1.85 6.19 0.65 139 XMHTML_After_End 1768 0.67 0.76 0.64 140 XMBrknScrpt_02 1748 0.75 1.17 0.63 141 XM_H_PHPMailer 1680 0.64 0.76 0.61 142 RELAYCOUNTRY_GB 1679 0.78 1.41 0.61 143 HTML_FONT_FACE_BAD 1675 0.63 0.72 0.60 144 HELO_NODOT 1672 0.54 0.29 0.60 145 XM_D_tchamptons_WL 1670 0.47 0.00 0.60 146 T_Symld_Words_02 1639 0.77 1.40 0.59 147 RDNS_DYNAMIC 1580 0.77 1.51 0.57 148 XM_salutation2 1578 1.33 4.07 0.57 149 T_HTML_TAG_BALANCE_CENTER 1576 1.43 4.52 0.57 150 HTML_SHORT_LINK_IMG_2 1552 1.33 4.11 0.56 151 RELAYCOUNTRY_FR 1550 1.88 6.67 0.56 152 TooManyTo_004 1522 0.51 0.38 0.55 153 XMBody_78 1518 0.60 0.79 0.55 154 BODY_URI_ONLY 1517 1.81 6.37 0.55 155 HTML_TAG_BALANCE_BODY 1511 0.51 0.40 0.55 156 T_MONEY_PERCENT 1504 0.87 2.07 0.54 157 TR_LOTS_OF_MONEY2 1504 0.87 2.07 0.54 158 NORMAL_HTTP_TO_IP 1488 1.35 4.28 0.54 159 T_FILL_THIS_FORM_SHORT 1442 0.60 0.90 0.52 160 FSL_THIS_IS_ADV 1436 0.54 0.63 0.52 161 PLING_QUERY 1384 0.90 2.32 0.50 162 TooManyTo_005 1340 0.44 0.30 0.48 163 DKIM_ADSP_NXDOMAIN 1329 0.55 0.81 0.48 164 XMLngstWrd_00 1318 0.44 0.29 0.48 165 TR_XM_RelayPhish 1275 0.68 1.48 0.46 166 DIET_1 1263 0.88 2.43 0.46 167 FILL_THIS_FORM 1261 0.57 0.96 0.46 168 XM_URI_RBL 1252 0.77 1.94 0.45 169 MPART_ALT_DIFF_COUNT 1243 0.49 0.65 0.45 170 XM_RXBody 1205 0.63 1.34 0.44 171 XMLngstWrd_01 1197 0.40 0.28 0.43 172 XM_Body_Obfu01 1196 0.38 0.22 0.43 173 NML_ADSP_CUSTOM_MED 1191 0.68 1.58 0.43 174 XMSubMetaSxObfu_03 1188 0.46 0.55 0.43 175 REMOVE_BEFORE_LINK 1164 0.39 0.28 0.42 176 SpammyFromTLD_01 1151 0.84 2.38 0.42 177 FILL_THIS_FORM_LONG 1115 0.51 0.89 0.40 178 HTTPS_HTTP_MISMATCH 1103 0.40 0.41 0.40 179 FILL_THIS_FORM_LOAN 1095 0.48 0.79 0.40 180 FORGED_GMAIL_RCVD 1090 0.63 1.47 0.39 181 XM_H_PHPOS_M 1079 0.43 0.57 0.39 182 XMCapTrack 1073 0.36 0.28 0.39 183 NO_DNS_FOR_FROM 1060 0.42 0.56 0.38 184 XMNoVowels 1056 0.40 0.45 0.38 185 UPPERCASE_50_75 1052 0.32 0.09 0.38 186 THIS_AD 1050 0.56 1.23 0.38 187 RELAYCOUNTRY_AU 1016 0.42 0.62 0.37 188 XM_shorewaves_Whitelist 971 0.27 0.00 0.35 189 T_TooManySym_04 971 0.28 0.03 0.35 190 HK_RANDOM_FROM 956 0.58 1.45 0.35 191 RELAYCOUNTRY_DE 935 0.45 0.87 0.34 192 XMPhish14 930 0.43 0.79 0.34 193 XMRcvdHeader_15 918 0.26 0.00 0.33 194 XM_Akamai 914 0.26 0.01 0.33 195 TR_MetaPhish_Combo_01b 871 0.27 0.10 0.31 196 TR_LOTS_OF_MONEY3 866 0.46 0.99 0.31 197 XM_S_JOY_D 865 0.34 0.43 0.31 198 RELAYCOUNTRY_AT 859 0.59 1.58 0.31 199 XMSlimDrugH 818 0.40 0.77 0.30 200 T_OBFU_PDF_ATTACH 805 0.24 0.07 0.29 ----------------------------------------------------------------------