Email: 607863 Autolearn: 0 AvgScore: 1.67 AvgScanTime: 1.88 sec Spam: 128619 Autolearn: 0 AvgScore: 13.15 AvgScanTime: 2.30 sec Ham: 479244 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.77 sec Time Spent Running SA: 317.47 hours Time Spent Processing Spam: 82.12 hours Time Spent Processing Ham: 235.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 122681 89.21 95.38 87.55 2 DCC_CHECK 92200 46.68 71.68 39.97 3 DKIM_SIGNED 89428 73.30 69.53 74.31 4 XM_DK_Pass 86927 71.87 67.58 73.02 5 DKIM_VALID 81781 68.04 63.58 69.23 6 XMListUnsubscribeExists 79174 51.26 61.56 48.50 7 DKIM_VALID_AU 66986 51.21 52.08 50.97 8 XM_H_QuotedFrom 57701 40.13 44.86 38.86 9 MIME_HTML_ONLY 54977 24.47 42.74 19.57 10 BAYES_50 51999 52.95 40.43 56.32 11 HTML_FONT_LOW_CONTRAST 48097 29.35 37.39 27.20 12 BAYES_99 42960 11.20 33.40 5.25 13 XM_DK_Undo_02 40229 12.13 31.28 6.99 14 LOC_TINY_FONT_1 38430 23.85 29.88 22.24 15 RELAYCOUNTRY_META 37826 10.51 29.41 5.44 16 BAYES_999 36009 9.34 28.00 4.33 17 DCC_CHECK_NEGATIVE 34180 51.31 26.57 57.95 18 XMSubLong 31780 22.53 24.71 21.95 19 FVGT_m_MULTI_ODD 28623 21.11 22.25 20.80 20 TR_DCC_Bayes_99 27361 6.74 21.27 2.84 21 DKIM_VALID_EF 26171 25.76 20.35 27.21 22 UNTRUSTED_Relay 26123 5.39 20.31 1.39 23 XM_Body_Dirty_Words 24350 14.31 18.93 13.07 24 T_TM2_M_HEADER_IN_MSG 24110 29.25 18.75 32.06 25 BOTNET 22481 5.28 17.48 2.01 26 T_REMOTE_IMAGE 21217 6.64 16.50 3.99 27 T_KAM_HTML_FONT_INVALID 21053 16.03 16.37 15.93 28 HTML_MIME_NO_HTML_TAG 20764 5.17 16.14 2.22 29 FROM_EXCESS_BASE64 20728 6.67 16.12 4.14 30 BOTNET_IPINHOSTNAME 20719 7.14 16.11 4.74 31 MultiRelay 18143 18.49 14.11 19.67 32 MIME_HEADER_CTYPE_ONLY 17865 3.05 13.89 0.14 33 FSL_BULK_SIG 17813 8.21 13.85 6.70 34 HTML_SHORT_LINK_IMG_1 17770 2.95 13.82 0.04 35 MISSING_HEADERS 17546 3.28 13.64 0.50 36 BODY_URI_ONLY 17291 2.93 13.44 0.10 37 XM_Multi_Part_URI 17071 12.42 13.27 12.19 38 XM_UncommonTLD01 16499 5.41 12.83 3.42 39 HTML_IMAGE_ONLY_04 16368 2.74 12.73 0.06 40 HTML_SHORT_CENTER 15625 2.57 12.15 0.00 41 XM_Evil_Numbers_Gen 14428 9.74 11.22 9.35 42 HTML_IMAGE_RATIO_02 14204 8.96 11.04 8.40 43 XMSexyCombo_05 14111 5.60 10.97 4.16 44 RELAYCOUNTRY_FR 13715 2.45 10.66 0.24 45 LOTS_OF_MONEY 13424 8.57 10.44 8.06 46 XMNumbers 12856 4.19 10.00 2.63 47 TooManyTo_001 12109 8.86 9.41 8.71 48 XM_JunkDunk 11293 1.86 8.78 0.00 49 XM_UB99 10552 1.74 8.20 0.01 50 HTML_IMAGE_RATIO_04 9838 6.31 7.65 5.95 51 BAYES_60 9600 5.50 7.46 4.97 52 BAYES_80 9411 3.69 7.32 2.72 53 T_XMDrugObfuBody_14 9316 7.59 7.24 7.68 54 XM_UB999 9217 1.52 7.17 0.00 55 XMSubMetaSx_00 8527 4.48 6.63 3.90 56 XM_UB50 8509 2.02 6.62 0.79 57 SpammyFromTLD_02 8462 1.63 6.58 0.30 58 XM_H_Long_From01 8344 6.19 6.49 6.11 59 DKIM_INVALID 7647 5.26 5.95 5.08 60 XM_B_Phish_Phrases 7599 5.96 5.91 5.97 61 MPART_ALT_DIFF 7368 3.74 5.73 3.20 62 RCVD_IN_RP_RNBL 7032 1.20 5.47 0.05 63 XMStrtUSub 6846 5.00 5.32 4.91 64 XM_DIRTYINTL 6652 2.75 5.17 2.10 65 LotsOfNums_01 6523 7.63 5.07 8.32 66 HTML_IMAGE_RATIO_06 6337 3.49 4.93 3.10 67 BAYES_95 6070 2.35 4.72 1.71 68 RELAYCOUNTRY_GB 5964 1.80 4.64 1.04 69 FROM_SUSPICIOUS_NTLD 5415 0.94 4.21 0.06 70 XM_URI_RBL 5376 1.27 4.18 0.49 71 DIET_1 5195 1.19 4.04 0.42 72 XM_SPF_SoftFail 4978 2.84 3.87 2.57 73 URI_HEX 4923 2.13 3.83 1.67 74 TM2_M_URI_OPT_OUT 4805 2.45 3.74 2.11 75 MIME_HTML_ONLY_MULTI 4656 1.87 3.62 1.41 76 SHORTENER_SHORT_IMG 4609 0.76 3.58 0.00 77 MIME_HTML_MOSTLY 4217 2.85 3.28 2.73 78 RELAYCOUNTRY_CA 4205 2.01 3.27 1.67 79 BOTNET_NORDNS 4160 0.70 3.23 0.02 80 HTML_IMAGE_RATIO_08 4115 2.36 3.20 2.13 81 MultiRelay_Combo 3591 0.72 2.79 0.17 82 MultiRelay_CC 3591 0.72 2.79 0.17 83 RCVD_IN_MSPIKE_H2 3521 3.95 2.74 4.28 84 XM_H_TOP 3501 0.58 2.72 0.00 85 XM_SendGrid 3438 5.51 2.67 6.27 86 NO_DNS_FOR_FROM 3370 1.44 2.62 1.12 87 XMSexyCombo_01 3238 1.00 2.52 0.59 88 XM_CamelCaseFrm001 3167 2.07 2.46 1.96 89 XMSlimDrugH 3083 0.75 2.40 0.30 90 XMSubMetaI_00 2926 1.43 2.27 1.20 91 T_TooManySym_01 2925 4.65 2.27 5.28 92 BODY_ENHANCEMENT 2878 0.50 2.24 0.03 93 RCVD_IN_RP_SAFE 2820 8.27 2.19 9.91 94 XMBdyGiftCard01 2784 1.00 2.16 0.68 95 BAYES_40 2755 4.34 2.14 4.94 96 MIME_QP_LONG_LINE 2745 4.71 2.13 5.41 97 XM_H_Long_From02 2740 1.37 2.13 1.17 98 XMDiploma_00 2730 1.80 2.12 1.72 99 T_XMDrugObfuBody_08 2667 1.51 2.07 1.36 100 URI_NOVOWEL 2645 0.85 2.06 0.53 101 T_Symld_Words_02 2641 0.96 2.05 0.67 102 DATE_IN_PAST_06_12 2600 0.44 2.02 0.02 103 XM_OfRef6 2575 2.09 2.00 2.12 104 XM_UB60 2465 0.45 1.92 0.06 105 BAYES_20 2455 3.52 1.91 3.95 106 XMWghtMeta_00 2360 0.41 1.83 0.03 107 RCVD_IN_RP_CERTIFIED 2331 7.16 1.81 8.60 108 SUBJ_ALL_CAPS 2209 1.73 1.72 1.73 109 XMSexyCombo_04 2174 0.50 1.69 0.18 110 TR_XM_RelayPhish 2140 0.77 1.66 0.53 111 XMGenDplmaNmb 2127 1.21 1.65 1.08 112 T_XMHurry_00 2092 0.98 1.63 0.81 113 UNPARSEABLE_RELAY 2034 2.49 1.58 2.74 114 FROM_DOMAIN_NOVOWEL 2014 0.37 1.57 0.05 115 RELAYCOUNTRY_CN 2013 0.38 1.57 0.07 116 SpammyFromTLD_01 2008 1.10 1.56 0.97 117 RCVD_IN_PSBL 1990 0.33 1.55 0.00 118 MAILING_LIST_MULTI 1971 2.26 1.53 2.45 119 XMStockSpam_06 1963 1.52 1.53 1.52 120 DATE_IN_PAST_24_48 1952 0.33 1.52 0.01 121 TM2_M_VERY_LONG_WORD 1927 1.08 1.50 0.97 122 FILL_THIS_FORM 1847 0.67 1.44 0.47 123 DKIM_ADSP_NXDOMAIN 1847 0.65 1.44 0.44 124 HK_RANDOM_FROM 1833 0.42 1.43 0.15 125 RCVD_IN_BL_SPAMCOP_NET 1811 0.51 1.41 0.26 126 URIBL_BLACK 1802 0.34 1.40 0.05 127 XM_salutation2 1792 0.81 1.39 0.65 128 TR_Mismatch_TLD_02 1766 0.35 1.37 0.07 129 BAYES_00 1765 13.89 1.37 17.25 130 NORDNS_LOW_CONTRAST 1742 0.31 1.35 0.03 131 FILL_THIS_FORM_LONG 1700 0.57 1.32 0.37 132 T_XMDrugObfuBody_00 1700 1.04 1.32 0.96 133 RELAYCOUNTRY_IN 1691 0.36 1.31 0.11 134 XM_UB95 1682 0.29 1.31 0.02 135 XM_PDF 1673 4.23 1.30 5.01 136 XM_Nigeria_01 1641 0.32 1.28 0.07 137 HTML_IMAGE_ONLY_08 1629 0.37 1.27 0.13 138 XM_H_PHPOS 1572 1.36 1.22 1.39 139 HTML_IMAGE_ONLY_16 1568 0.50 1.22 0.31 140 XMPhish30 1567 0.68 1.22 0.53 141 XMGppyBdWords 1553 0.43 1.21 0.22 142 ALL_TRUSTED 1545 13.54 1.20 16.85 143 LONG_JUNK_URI 1542 0.31 1.20 0.07 144 XM_ProductURIs 1504 1.08 1.17 1.05 145 DKIM_ADSP_CUSTOM_MED 1499 1.07 1.17 1.05 146 XM_UB80 1498 0.27 1.16 0.02 147 LongTLD 1463 0.36 1.14 0.15 148 XMPhish11 1453 1.43 1.13 1.51 149 HOSTED_IMG_DIRECT_MX 1432 0.24 1.11 0.00 150 RCVD_IN_IADB_LISTED 1410 4.27 1.10 5.12 151 NML_ADSP_CUSTOM_MED 1400 0.81 1.09 0.74 152 RELAYCOUNTRY_AT 1390 0.45 1.08 0.28 153 HTML_FONT_FACE_BAD 1386 0.67 1.08 0.56 154 T_MONEY_PERCENT 1374 0.41 1.07 0.24 155 TR_LOTS_OF_MONEY2 1374 0.41 1.07 0.24 156 TR_Symld_Words 1330 1.45 1.03 1.56 157 DATE_IN_PAST_03_06 1291 0.28 1.00 0.09 158 BAYES_05 1288 2.31 1.00 2.67 159 XMHTML_After_End 1269 0.59 0.99 0.49 160 FORGED_GMAIL_RCVD 1268 0.58 0.99 0.47 161 XMBody_17 1265 0.76 0.98 0.71 162 RCVD_IN_IADB_SPF 1264 3.77 0.98 4.52 163 TVD_SPACE_RATIO_MINFP 1237 0.21 0.96 0.01 164 RCVD_IN_IADB_SENDERID 1233 3.34 0.96 3.99 165 RCVD_IN_IADB_DK 1218 3.29 0.95 3.92 166 XM_DK_Undo_01 1210 1.69 0.94 1.90 167 XM_HighProb1 1201 0.20 0.93 0.01 168 XM_B_REG_HTML 1182 0.64 0.92 0.56 169 FSL_THIS_IS_ADV 1177 0.42 0.92 0.29 170 MONEY_FRAUD_8 1166 0.19 0.91 0.00 171 TR_XM_DK_Bayes 1164 10.88 0.90 13.56 172 XMSubGiftCard1 1160 0.21 0.90 0.03 173 XM_Lotto 1160 0.23 0.90 0.05 174 XM_ShortIntro_01 1158 0.71 0.90 0.66 175 T_FILL_THIS_FORM_SHORT 1153 0.97 0.90 0.99 176 XMPhish14 1145 0.53 0.89 0.44 177 RELAYCOUNTRY_IE 1125 0.32 0.87 0.17 178 XMBody_78 1122 0.48 0.87 0.38 179 XMSubMetaSxObfu_03 1113 0.55 0.87 0.47 180 XMSubGiftCard2 1076 0.18 0.84 0.01 181 RDNS_DYNAMIC 1068 0.53 0.83 0.45 182 HTML_FONT_SIZE_LARGE 1061 0.30 0.82 0.15 183 DATE_IN_FUTURE_06_12 1054 0.17 0.82 0.00 184 HELO_NODOT 1054 1.77 0.82 2.02 185 XM_XX_Yahoo 1045 0.25 0.81 0.10 186 TR_XM_DK_Bayes1 1013 10.32 0.79 12.88 187 URI_TRY_3LD 988 1.07 0.77 1.15 188 ADVANCE_FEE_5_NEW_FRM_MNY 976 0.16 0.76 0.00 189 HTTPS_HTTP_MISMATCH 916 0.63 0.71 0.61 190 MPART_ALT_DIFF_COUNT 915 0.33 0.71 0.22 191 REPLYTO_WITHOUT_TO_CC 914 0.19 0.71 0.05 192 RELAYCOUNTRY_DE 913 0.43 0.71 0.36 193 TooManyTo_002 908 2.17 0.71 2.56 194 XM_H_PHPMailer 901 0.76 0.70 0.77 195 UNCLAIMED_MONEY 897 0.15 0.70 0.00 196 TR_LOTS_OF_MONEY3 894 0.34 0.70 0.24 197 XMSlimDrugs 863 0.16 0.67 0.03 198 HTML_IMAGE_ONLY_28 850 0.50 0.66 0.46 199 URIBL_DBL_SPAM 831 0.16 0.65 0.03 200 TR_Caps_n_Bayes_99 811 0.20 0.63 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 419576 89.21 95.38 87.55 2 DKIM_SIGNED 356149 73.30 69.53 74.31 3 XM_DK_Pass 349952 71.87 67.58 73.02 4 DKIM_VALID 331801 68.04 63.58 69.23 5 DCC_CHECK_NEGATIVE 277743 51.31 26.57 57.95 6 BAYES_50 269888 52.95 40.43 56.32 7 DKIM_VALID_AU 244277 51.21 52.08 50.97 8 XMListUnsubscribeExists 232415 51.26 61.56 48.50 9 DCC_CHECK 191576 46.68 71.68 39.97 10 XM_H_QuotedFrom 186213 40.13 44.86 38.86 11 T_TM2_M_HEADER_IN_MSG 153664 29.25 18.75 32.06 12 DKIM_VALID_EF 130395 25.76 20.35 27.21 13 HTML_FONT_LOW_CONTRAST 130337 29.35 37.39 27.20 14 LOC_TINY_FONT_1 106572 23.85 29.88 22.24 15 XMSubLong 105179 22.53 24.71 21.95 16 FVGT_m_MULTI_ODD 99681 21.11 22.25 20.80 17 MultiRelay 94254 18.49 14.11 19.67 18 MIME_HTML_ONLY 93794 24.47 42.74 19.57 19 BAYES_00 82649 13.89 1.37 17.25 20 ALL_TRUSTED 80761 13.54 1.20 16.85 21 T_KAM_HTML_FONT_INVALID 76359 16.03 16.37 15.93 22 TR_XM_DK_Bayes 64982 10.88 0.90 13.56 23 XM_Body_Dirty_Words 62622 14.31 18.93 13.07 24 TR_XM_DK_Bayes1 61741 10.32 0.79 12.88 25 XM_Multi_Part_URI 58420 12.42 13.27 12.19 26 XM_DKIMWhitelistDomains 56206 9.25 0.01 11.73 27 TR_XM_DK_Bayes2 51429 8.59 0.59 10.73 28 RCVD_IN_RP_SAFE 47473 8.27 2.19 9.91 29 XM_Evil_Numbers_Gen 44798 9.74 11.22 9.35 30 TooManyTo_001 41752 8.86 9.41 8.71 31 RCVD_IN_RP_CERTIFIED 41221 7.16 1.81 8.60 32 HTML_IMAGE_RATIO_02 40276 8.96 11.04 8.40 33 LotsOfNums_01 39868 7.63 5.07 8.32 34 LOTS_OF_MONEY 38646 8.57 10.44 8.06 35 T_XMDrugObfuBody_14 36819 7.59 7.24 7.68 36 XM_DK_Undo_02 33509 12.13 31.28 6.99 37 FSL_BULK_SIG 32114 8.21 13.85 6.70 38 XM_SendGrid 30057 5.51 2.67 6.27 39 XM_H_Long_From01 29259 6.19 6.49 6.11 40 XM_B_Phish_Phrases 28631 5.96 5.91 5.97 41 HTML_IMAGE_RATIO_04 28500 6.31 7.65 5.95 42 RELAYCOUNTRY_META 26057 10.51 29.41 5.44 43 MIME_QP_LONG_LINE 25911 4.71 2.13 5.41 44 T_TooManySym_01 25317 4.65 2.27 5.28 45 BAYES_99 25143 11.20 33.40 5.25 46 RCVD_IN_IADB_LISTED 24534 4.27 1.10 5.12 47 DKIM_INVALID 24348 5.26 5.95 5.08 48 XM_PDF 24034 4.23 1.30 5.01 49 BAYES_60 23821 5.50 7.46 4.97 50 BAYES_40 23651 4.34 2.14 4.94 51 XMStrtUSub 23533 5.00 5.32 4.91 52 BOTNET_IPINHOSTNAME 22704 7.14 16.11 4.74 53 RCVD_IN_IADB_SPF 21660 3.77 0.98 4.52 54 BAYES_999 20737 9.34 28.00 4.33 55 RCVD_IN_MSPIKE_H2 20490 3.95 2.74 4.28 56 XMSexyCombo_05 19931 5.60 10.97 4.16 57 FROM_EXCESS_BASE64 19835 6.67 16.12 4.14 58 T_REMOTE_IMAGE 19127 6.64 16.50 3.99 59 RCVD_IN_IADB_SENDERID 19098 3.34 0.96 3.99 60 BAYES_20 18944 3.52 1.91 3.95 61 RCVD_IN_IADB_DK 18809 3.29 0.95 3.92 62 IN_ZIMBRA_NJ_WHITELIST 18757 3.09 0.02 3.91 63 XMSubMetaSx_00 18700 4.48 6.63 3.90 64 XM_UncommonTLD01 16370 5.41 12.83 3.42 65 RCVD_IN_IADB_VOUCHED 15883 2.73 0.55 3.31 66 MPART_ALT_DIFF 15354 3.74 5.73 3.20 67 HTML_IMAGE_RATIO_06 14877 3.49 4.93 3.10 68 TR_DCC_Bayes_99 13603 6.74 21.27 2.84 69 UNPARSEABLE_RELAY 13116 2.49 1.58 2.74 70 MIME_HTML_MOSTLY 13098 2.85 3.28 2.73 71 BAYES_80 13013 3.69 7.32 2.72 72 BAYES_05 12774 2.31 1.00 2.67 73 XMNumbers 12593 4.19 10.00 2.63 74 XM_SPF_SoftFail 12303 2.84 3.87 2.57 75 TooManyTo_002 12263 2.17 0.71 2.56 76 TVD_RCVD_IP 12121 2.07 0.38 2.53 77 TO_MALFORMED 11928 2.08 0.57 2.49 78 MAILING_LIST_MULTI 11743 2.26 1.53 2.45 79 HTML_MIME_NO_HTML_TAG 10652 5.17 16.14 2.22 80 HTML_IMAGE_RATIO_08 10207 2.36 3.20 2.13 81 XM_OfRef6 10137 2.09 2.00 2.12 82 TM2_M_URI_OPT_OUT 10107 2.45 3.74 2.11 83 XM_DIRTYINTL 10053 2.75 5.17 2.10 84 RCVD_IN_IADB_OPTIN 9929 1.74 0.50 2.07 85 T_TooManySym_02 9868 1.76 0.63 2.06 86 HELO_NODOT 9691 1.77 0.82 2.02 87 BOTNET 9622 5.28 17.48 2.01 88 ANY_BOUNCE_MESSAGE 9455 1.69 0.62 1.97 89 BOUNCE_MESSAGE 9454 1.69 0.62 1.97 90 XM_CamelCaseFrm001 9388 2.07 2.46 1.96 91 XM_DK_Undo_01 9082 1.69 0.94 1.90 92 RCVD_IN_MSPIKE_WL 8805 1.52 0.33 1.84 93 RCVD_IN_MSPIKE_H3 8788 1.52 0.33 1.83 94 TooManyTo_003 8476 1.51 0.57 1.77 95 SUBJ_ALL_CAPS 8302 1.73 1.72 1.73 96 XMDiploma_00 8222 1.80 2.12 1.72 97 BAYES_95 8201 2.35 4.72 1.71 98 RELAYCOUNTRY_CA 8022 2.01 3.27 1.67 99 URI_HEX 8022 2.13 3.83 1.67 100 IN_HORDE_ADDRESS_BOOK 7824 1.30 0.04 1.63 101 XMCapTrack 7746 1.33 0.28 1.62 102 TR_Symld_Words 7455 1.45 1.03 1.56 103 XMStockSpam_06 7280 1.52 1.53 1.52 104 XMPhish11 7240 1.43 1.13 1.51 105 INVALID_MSGID 7146 1.20 0.10 1.49 106 MIME_HTML_ONLY_MULTI 6739 1.87 3.62 1.41 107 XM_H_PHPOS 6680 1.36 1.22 1.39 108 UNTRUSTED_Relay 6658 5.39 20.31 1.39 109 TR_MetaPhish_Combo_01 6534 1.19 0.53 1.36 110 T_XMDrugObfuBody_08 6523 1.51 2.07 1.36 111 TooManyTo_004 6290 1.13 0.44 1.31 112 USER_IN_DEF_DKIM_WL 6231 1.03 0.02 1.30 113 XM_GoogleGroups 6203 1.12 0.47 1.29 114 XMSubMetaI_00 5741 1.43 2.27 1.20 115 XM_H_Long_From02 5617 1.37 2.13 1.17 116 URI_TRY_3LD 5508 1.07 0.77 1.15 117 NO_DNS_FOR_FROM 5391 1.44 2.62 1.12 118 TooManyTo_005 5227 0.94 0.39 1.09 119 XMGenDplmaNmb 5199 1.21 1.65 1.08 120 XM_ProductURIs 5054 1.08 1.17 1.05 121 DKIM_ADSP_CUSTOM_MED 5019 1.07 1.17 1.05 122 RELAYCOUNTRY_GB 5002 1.80 4.64 1.04 123 T_FILL_THIS_FORM_SHORT 4735 0.97 0.90 0.99 124 SpammyFromTLD_01 4663 1.10 1.56 0.97 125 TM2_M_VERY_LONG_WORD 4651 1.08 1.50 0.97 126 T_XMDrugObfuBody_00 4611 1.04 1.32 0.96 127 LOW_PRICE 3905 0.75 0.53 0.81 128 T_XMHurry_00 3893 0.98 1.63 0.81 129 XM_UB50 3796 2.02 6.62 0.79 130 XM_H_PHPMailer 3689 0.76 0.70 0.77 131 NML_ADSP_CUSTOM_MED 3539 0.81 1.09 0.74 132 XMBody_17 3384 0.76 0.98 0.71 133 XMNoVowels 3360 0.64 0.40 0.70 134 XMBdyGiftCard01 3276 1.00 2.16 0.68 135 T_OBFU_PDF_ATTACH 3197 0.58 0.25 0.67 136 T_Symld_Words_02 3190 0.96 2.05 0.67 137 XM_ShortIntro_01 3146 0.71 0.90 0.66 138 XM_salutation2 3131 0.81 1.39 0.65 139 XMBody_95 3113 0.53 0.09 0.65 140 THIS_AD 2984 0.57 0.36 0.62 141 HTTPS_HTTP_MISMATCH 2932 0.63 0.71 0.61 142 XMSexyCombo_01 2827 1.00 2.52 0.59 143 T_TooManySym_03 2826 0.50 0.15 0.59 144 XMMoneyMeta_00 2748 0.57 0.56 0.57 145 XM_B_COPY_HTML 2728 0.56 0.55 0.57 146 HTML_FONT_FACE_BAD 2703 0.67 1.08 0.56 147 XMBrknScrpt_02 2701 0.57 0.62 0.56 148 XM_B_REG_HTML 2685 0.64 0.92 0.56 149 HTML_TAG_BALANCE_BODY 2610 0.56 0.60 0.54 150 XMHTMLBadTable_001 2568 0.52 0.46 0.54 151 XMPhish30 2545 0.68 1.22 0.53 152 URI_NOVOWEL 2536 0.85 2.06 0.53 153 TR_XM_RelayPhish 2533 0.77 1.66 0.53 154 USER_IN_WHITELIST 2532 0.42 0.00 0.53 155 AC_DIV_BONANZA 2530 0.44 0.10 0.53 156 PLING_QUERY 2525 0.52 0.50 0.53 157 SHORT_HELO_AND_INLINE_IMAGE 2497 0.42 0.05 0.52 158 XMLngstWrd_00 2461 0.48 0.34 0.51 159 TM2_M_BODY_EMPTY 2403 0.43 0.17 0.50 160 MISSING_HEADERS 2389 3.28 13.64 0.50 161 XMHTML_After_End 2345 0.59 0.99 0.49 162 XM_URI_RBL 2342 1.27 4.18 0.49 163 XMLngstWrd_01 2321 0.45 0.31 0.48 164 FORGED_GMAIL_RCVD 2264 0.58 0.99 0.47 165 XMSubMetaSxObfu_03 2241 0.55 0.87 0.47 166 FILL_THIS_FORM 2235 0.67 1.44 0.47 167 HTML_IMAGE_ONLY_28 2205 0.50 0.66 0.46 168 XMGappySubj_01 2194 0.42 0.28 0.46 169 T_MANY_PILL_PRICE 2179 0.36 0.00 0.45 170 RCVD_IN_SORBS_DUL 2172 0.43 0.33 0.45 171 XMDateMe_00 2160 0.46 0.49 0.45 172 RDNS_DYNAMIC 2136 0.53 0.83 0.45 173 DKIM_ADSP_NXDOMAIN 2114 0.65 1.44 0.44 174 XMSubMetaSxObfu_02 2106 0.39 0.22 0.44 175 SUBJ_DOLLARS 2106 0.46 0.52 0.44 176 XMPhish14 2093 0.53 0.89 0.44 177 REMOVE_BEFORE_LINK 2087 0.42 0.35 0.44 178 RELAYCOUNTRY_AU 2067 0.43 0.41 0.43 179 FROM_GOV_SPOOF 2059 0.37 0.13 0.43 180 XMSolicitRefs_0 2023 0.44 0.49 0.42 181 DIET_1 2015 1.19 4.04 0.42 182 TM2_M_A_HREF_HREF 1998 0.42 0.45 0.42 183 RELAYCOUNTRY_NL 1868 0.39 0.41 0.39 184 HTML_IMAGE_ONLY_32 1856 0.38 0.36 0.39 185 XM_H_PHPOS_M 1854 0.40 0.44 0.39 186 FROM_GOV_DKIM_AU 1836 0.32 0.10 0.38 187 XM_Body_Obfu01 1825 0.38 0.36 0.38 188 XMBody_78 1811 0.48 0.87 0.38 189 XM_S_JOY_D 1767 0.40 0.51 0.37 190 FILL_THIS_FORM_LONG 1767 0.57 1.32 0.37 191 XMSubNoVowel 1746 0.40 0.53 0.36 192 RELAYCOUNTRY_DE 1702 0.43 0.71 0.36 193 FILL_THIS_FORM_LOAN 1679 0.39 0.54 0.35 194 HTML_IMAGE_ONLY_24 1618 0.34 0.36 0.34 195 TVD_SPACE_RATIO 1606 0.32 0.27 0.34 196 BASE64_LENGTH_79_INF 1603 0.29 0.12 0.33 197 XMRcvdHeader_15 1573 0.26 0.00 0.33 198 XM_RXBody 1561 0.38 0.56 0.33 199 BANG_GUAR 1552 0.29 0.15 0.32 200 XM_shorewaves_Whitelist 1527 0.25 0.00 0.32 ----------------------------------------------------------------------