Email: 539112 Autolearn: 0 AvgScore: 3.07 AvgScanTime: 3.94 sec Spam: 163460 Autolearn: 0 AvgScore: 12.72 AvgScanTime: 4.84 sec Ham: 375652 Autolearn: 0 AvgScore: -1.13 AvgScanTime: 3.55 sec Time Spent Running SA: 589.89 hours Time Spent Processing Spam: 219.77 hours Time Spent Processing Ham: 370.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155570 89.10 95.17 86.46 2 DKIM_SIGNED 137605 70.49 84.18 64.53 3 XM_DK_Pass 133416 68.81 81.62 63.24 4 DCC_CHECK 128429 45.55 78.57 31.18 5 DKIM_VALID 126247 64.49 77.23 58.94 6 XMListUnsubscribeExists 120723 50.03 73.85 39.66 7 DKIM_VALID_AU 95934 46.30 58.69 40.91 8 XM_H_QuotedFrom 90713 41.53 55.50 35.46 9 XM_DK_Undo_02 80977 23.32 49.54 11.92 10 BAYES_99 74185 21.47 45.38 11.07 11 BAYES_999 63831 18.66 39.05 9.78 12 HTML_FONT_LOW_CONTRAST 60793 26.76 37.19 22.22 13 TR_DCC_Bayes_99 58257 14.14 35.64 4.79 14 LOC_TINY_FONT_1 55121 23.43 33.72 18.95 15 BAYES_50 51334 50.06 31.40 58.18 16 MIME_HTML_ONLY 49191 25.62 30.09 23.68 17 XMSubLong 43879 22.21 26.84 20.19 18 FVGT_m_MULTI_ODD 42622 20.23 26.07 17.68 19 DKIM_VALID_EF 39962 24.00 24.45 23.80 20 T_TM2_M_HEADER_IN_MSG 33874 29.07 20.72 32.70 21 T_KAM_HTML_FONT_INVALID 32917 15.26 20.14 13.14 22 DCC_CHECK_NEGATIVE 31281 52.11 19.14 66.46 23 XM_Body_Dirty_Words 30363 11.52 18.58 8.45 24 MultiRelay 29402 18.83 17.99 19.19 25 RELAYCOUNTRY_META 27879 8.80 17.06 5.21 26 XM_Multi_Part_URI 25933 11.16 15.87 9.12 27 BOTNET 25858 5.88 15.82 1.56 28 HTML_IMAGE_RATIO_02 25435 8.71 15.56 5.73 29 XM_Evil_Numbers_Gen 23487 8.94 14.37 6.58 30 BOTNET_IPINHOSTNAME 22402 7.09 13.70 4.21 31 FSL_BULK_SIG 19228 8.72 11.76 7.40 32 LOTS_OF_MONEY 18155 8.24 11.11 6.99 33 HTML_IMAGE_RATIO_04 17422 5.56 10.66 3.34 34 UNTRUSTED_Relay 16710 4.01 10.22 1.30 35 T_XMDrugObfuBody_14 16567 7.95 10.14 7.00 36 XM_B_Phish_Phrases 16388 5.89 10.03 4.09 37 XMSexyCombo_05 15746 4.34 9.63 2.03 38 LotsOfNums_01 14510 7.61 8.88 7.06 39 TooManyTo_001 13670 8.71 8.36 8.86 40 XM_UncommonTLD01 13507 5.02 8.26 3.61 41 BAYES_80 13102 5.02 8.02 3.72 42 TR_XM_DocInvoice 12162 5.14 7.44 4.14 43 XM_H_Long_From01 12036 5.99 7.36 5.39 44 DKIM_INVALID 11358 6.00 6.95 5.58 45 FROM_EXCESS_BASE64 10648 4.03 6.51 2.95 46 MPART_ALT_DIFF 10387 8.38 6.35 9.27 47 BAYES_60 10249 6.22 6.27 6.20 48 XMSubMetaSx_00 10038 4.14 6.14 3.27 49 XMNumbers 8299 4.05 5.08 3.60 50 MIME_QP_LONG_LINE 8285 5.11 5.07 5.12 51 TM2_M_URI_OPT_OUT 8027 2.59 4.91 1.58 52 XM_UB50 7811 2.08 4.78 0.90 53 MIME_HTML_MOSTLY 7749 2.83 4.74 1.99 54 HTML_IMAGE_RATIO_06 7658 3.19 4.68 2.53 55 XMStrtUSub 7614 3.76 4.66 3.38 56 BAYES_95 7345 3.04 4.49 2.40 57 XM_SPF_SoftFail 7215 2.89 4.41 2.23 58 RCVD_IN_RP_SAFE 7075 6.18 4.33 6.99 59 XM_SendGrid 7026 4.54 4.30 4.64 60 T_REMOTE_IMAGE 6764 4.29 4.14 4.36 61 RCVD_IN_MSPIKE_H2 6362 4.37 3.89 4.57 62 HTML_IMAGE_RATIO_08 6114 2.98 3.74 2.65 63 SpammyFromTLD_02 6110 1.29 3.74 0.22 64 XM_DIRTYINTL 6105 2.24 3.73 1.59 65 MultiRelay_CC 5834 1.25 3.57 0.25 66 MultiRelay_Combo 5834 1.25 3.57 0.25 67 RCVD_IN_RP_CERTIFIED 5799 5.70 3.55 6.64 68 XM_CamelCaseFrm001 5703 2.16 3.49 1.59 69 T_TooManySym_01 5662 3.80 3.46 3.95 70 RCVD_IN_BL_SPAMCOP_NET 5560 1.48 3.40 0.65 71 RELAYCOUNTRY_CA 5320 1.88 3.25 1.28 72 MIME_HTML_ONLY_MULTI 5182 6.50 3.17 7.95 73 URI_HEX 4788 1.63 2.93 1.06 74 BOTNET_NORDNS 4581 0.91 2.80 0.08 75 XMDiploma_00 4335 1.77 2.65 1.39 76 XMHTML_After_End 4078 1.02 2.49 0.38 77 RCVD_IN_RP_RNBL 4032 0.76 2.47 0.02 78 SpammyFromTLD_01 3999 1.31 2.45 0.82 79 RCVD_IN_IADB_LISTED 3970 4.60 2.43 5.54 80 T_XMDrugObfuBody_08 3892 1.69 2.38 1.39 81 XM_OfRef6 3760 1.72 2.30 1.47 82 NO_DNS_FOR_FROM 3723 1.77 2.28 1.55 83 XM_H_Long_From02 3680 1.31 2.25 0.90 84 XMSubMetaI_00 3632 1.29 2.22 0.89 85 RCVD_IN_IADB_SPF 3416 3.98 2.09 4.81 86 TM2_M_VERY_LONG_WORD 3311 1.15 2.03 0.77 87 XM_URI_RBL 3286 0.69 2.01 0.11 88 RCVD_IN_IADB_SENDERID 3257 3.55 1.99 4.23 89 HTML_MIME_NO_HTML_TAG 3205 2.22 1.96 2.33 90 RCVD_IN_IADB_DK 3202 3.45 1.96 4.10 91 SUBJ_ALL_CAPS 3071 1.66 1.88 1.56 92 XM_UB99 2986 0.56 1.83 0.01 93 XMBody_17 2970 0.83 1.82 0.40 94 XMGenDplmaNmb 2958 1.20 1.81 0.94 95 RCVD_IN_PSBL 2939 0.63 1.80 0.12 96 T_XMHurry_00 2738 0.83 1.68 0.46 97 MAILING_LIST_MULTI 2662 2.26 1.63 2.53 98 TR_XM_RelayPhish 2586 0.86 1.58 0.55 99 XMPhish30 2586 0.77 1.58 0.41 100 TooManyTo_002 2561 2.36 1.57 2.70 101 ALL_TRUSTED 2516 12.76 1.54 17.64 102 UNPARSEABLE_RELAY 2482 2.62 1.52 3.11 103 URI_NOVOWEL 2470 0.70 1.51 0.34 104 XMStockSpam_06 2397 0.83 1.47 0.56 105 XM_PDF 2390 3.99 1.46 5.08 106 RELAYCOUNTRY_CN 2381 0.50 1.46 0.08 107 FSL_THIS_IS_ADV 2351 0.48 1.44 0.06 108 XM_DK_Undo_01 2342 1.71 1.43 1.83 109 XMSexyCombo_01 2336 0.65 1.43 0.31 110 HTML_TAG_BALANCE_BODY 2326 0.71 1.42 0.40 111 XM_UB60 2303 0.49 1.41 0.09 112 TooManyTo_003 2292 1.65 1.40 1.75 113 HTML_FONT_SIZE_LARGE 2286 0.57 1.40 0.20 114 BODY_URI_ONLY 2268 0.45 1.39 0.04 115 HTML_SHORT_LINK_IMG_1 2262 0.44 1.38 0.02 116 URIBL_DBL_SPAM 2245 0.42 1.37 0.01 117 URIBL_BLACK 2225 0.44 1.36 0.03 118 XM_UB999 2202 0.41 1.35 0.01 119 T_XMDrugObfuBody_00 2173 0.78 1.33 0.54 120 BAYES_00 2173 7.18 1.33 9.73 121 XM_ProductURIs 2163 1.08 1.32 0.97 122 BAYES_40 2136 3.10 1.31 3.89 123 RELAYCOUNTRY_DE 2106 0.75 1.29 0.52 124 XMPhish11 2103 1.23 1.29 1.21 125 NORDNS_LOW_CONTRAST 2083 0.40 1.27 0.02 126 HTML_IMAGE_ONLY_08 2061 0.48 1.26 0.15 127 URI_TRY_3LD 2042 0.98 1.25 0.86 128 RELAYCOUNTRY_GB 2028 1.17 1.24 1.15 129 XMLongAddy 2013 0.41 1.23 0.06 130 TM2_M_BODY_EMPTY 1990 0.71 1.22 0.49 131 XM_H_PHPOS 1987 1.75 1.22 1.98 132 XMBdyGiftCard01 1941 0.72 1.19 0.52 133 T_TooManySym_02 1939 1.47 1.19 1.60 134 TooManyTo_004 1925 1.25 1.18 1.28 135 XMEmptyBody_01 1905 0.45 1.17 0.13 136 XM_H_FedEx_Spoof 1904 0.39 1.16 0.05 137 RELAYCOUNTRY_FR 1894 0.51 1.16 0.23 138 T_MONEY_PERCENT 1875 0.60 1.15 0.37 139 TR_LOTS_OF_MONEY2 1875 0.60 1.15 0.37 140 XM_HighProb1 1845 0.35 1.13 0.02 141 XMBrknScrpt_02 1840 0.67 1.13 0.48 142 TR_MetaPhish_Combo_01 1782 0.90 1.09 0.82 143 TR_XM_DK_Bayes 1778 2.76 1.09 3.48 144 RCVD_IN_IADB_VOUCHED 1770 2.95 1.08 3.76 145 RCVD_IN_MSPIKE_WL 1758 1.56 1.08 1.77 146 RCVD_IN_MSPIKE_H3 1758 1.56 1.08 1.77 147 TR_Symld_Words 1731 1.70 1.06 1.98 148 RELAYCOUNTRY_AT 1714 0.40 1.05 0.12 149 BAYES_20 1712 2.22 1.05 2.73 150 SUBJ_DOLLARS 1709 0.42 1.05 0.15 151 XM_UB80 1687 0.34 1.03 0.03 152 T_FILL_THIS_FORM_SHORT 1683 0.92 1.03 0.88 153 XMHTMLBadTable_001 1675 0.64 1.02 0.47 154 TR_XM_DK_Bayes1 1652 2.56 1.01 3.24 155 RELAYCOUNTRY_AU 1645 0.61 1.01 0.44 156 XMBody_78 1631 0.67 1.00 0.52 157 XMMoneyMeta_00 1583 0.62 0.97 0.47 158 DKIM_ADSP_CUSTOM_MED 1577 1.05 0.96 1.09 159 TR_XM_DK_Bayes2 1570 2.27 0.96 2.83 160 DIET_1 1558 0.44 0.95 0.21 161 RDNS_DYNAMIC 1547 0.61 0.95 0.46 162 PHOTO_EDITING_DIRECT 1540 0.29 0.94 0.01 163 URIBL_SBL_A 1534 0.33 0.94 0.06 164 TM2_M_A_HREF_HREF 1522 0.46 0.93 0.26 165 T_Symld_Words_02 1469 0.65 0.90 0.54 166 HTTPS_HTTP_MISMATCH 1451 0.66 0.89 0.57 167 XMPhish14 1439 0.53 0.88 0.37 168 TooManyTo_005 1434 0.99 0.88 1.04 169 XM_B_COPY_HTML 1433 0.63 0.88 0.53 170 BOUNCE_MESSAGE 1358 2.45 0.83 3.15 171 ANY_BOUNCE_MESSAGE 1358 2.45 0.83 3.15 172 DATE_IN_PAST_03_06 1344 0.29 0.82 0.06 173 XM_Body_Obfu01 1315 0.42 0.80 0.26 174 XM_B_REG_HTML 1310 0.63 0.80 0.55 175 NML_ADSP_CUSTOM_MED 1308 0.78 0.80 0.77 176 XMSlimDrugH 1305 0.50 0.80 0.37 177 REMOVE_BEFORE_LINK 1289 0.49 0.79 0.35 178 ADMITS_SPAM 1255 0.25 0.77 0.02 179 HTML_IMAGE_ONLY_28 1234 0.57 0.75 0.50 180 XMCapTrack 1226 1.48 0.75 1.79 181 HTML_FONT_FACE_BAD 1189 0.46 0.73 0.35 182 FORGED_GMAIL_RCVD 1165 0.60 0.71 0.56 183 TR_Mismatch_TLD_02 1136 0.26 0.69 0.07 184 TRACKER_ID 1130 0.29 0.69 0.12 185 TR_Caps_n_Bayes_99 1104 0.26 0.68 0.08 186 TR_LOTS_OF_MONEY3 1079 0.33 0.66 0.19 187 XMSubMetaSxObfu_03 1073 0.41 0.66 0.30 188 XM_H_PHPMailer 1064 0.62 0.65 0.60 189 PLING_QUERY 1059 0.36 0.65 0.23 190 LOW_PRICE 1044 0.32 0.64 0.19 191 XMSexyCombo_04 1039 0.22 0.64 0.04 192 XMClaimOffer 1032 0.33 0.63 0.21 193 FVGT_m_MULTI_ODD_EMAIL 1023 0.22 0.63 0.05 194 MPART_ALT_DIFF_COUNT 1013 0.31 0.62 0.18 195 XMGppyBdWords 1012 0.26 0.62 0.10 196 RELAYCOUNTRY_IN 1009 0.28 0.62 0.13 197 RELAYCOUNTRY_NL 994 0.38 0.61 0.28 198 DATE_IN_PAST_06_12 970 0.22 0.59 0.06 199 XMBSHREFv2 939 0.24 0.57 0.10 200 BAYES_05 938 1.39 0.57 1.74 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 324781 89.10 95.17 86.46 2 DCC_CHECK_NEGATIVE 249676 52.11 19.14 66.46 3 DKIM_SIGNED 242401 70.49 84.18 64.53 4 XM_DK_Pass 237551 68.81 81.62 63.24 5 DKIM_VALID 221422 64.49 77.23 58.94 6 BAYES_50 218560 50.06 31.40 58.18 7 DKIM_VALID_AU 153691 46.30 58.69 40.91 8 XMListUnsubscribeExists 148969 50.03 73.85 39.66 9 XM_H_QuotedFrom 133197 41.53 55.50 35.46 10 T_TM2_M_HEADER_IN_MSG 122855 29.07 20.72 32.70 11 DCC_CHECK 117142 45.55 78.57 31.18 12 DKIM_VALID_EF 89422 24.00 24.45 23.80 13 MIME_HTML_ONLY 88936 25.62 30.09 23.68 14 HTML_FONT_LOW_CONTRAST 83484 26.76 37.19 22.22 15 XMSubLong 75853 22.21 26.84 20.19 16 MultiRelay 72090 18.83 17.99 19.19 17 LOC_TINY_FONT_1 71180 23.43 33.72 18.95 18 FVGT_m_MULTI_ODD 66415 20.23 26.07 17.68 19 ALL_TRUSTED 66281 12.76 1.54 17.64 20 T_KAM_HTML_FONT_INVALID 49353 15.26 20.14 13.14 21 IN_ZIMBRA_NJ_WHITELIST 47744 8.87 0.04 12.71 22 XM_DK_Undo_02 44764 23.32 49.54 11.92 23 BAYES_99 41570 21.47 45.38 11.07 24 BAYES_999 36749 18.66 39.05 9.78 25 BAYES_00 36540 7.18 1.33 9.73 26 MPART_ALT_DIFF 34813 8.38 6.35 9.27 27 XM_Multi_Part_URI 34243 11.16 15.87 9.12 28 TooManyTo_001 33274 8.71 8.36 8.86 29 XM_Body_Dirty_Words 31749 11.52 18.58 8.45 30 MIME_HTML_ONLY_MULTI 29850 6.50 3.17 7.95 31 XM_DKIMWhitelistDomains 29218 5.45 0.09 7.78 32 FSL_BULK_SIG 27789 8.72 11.76 7.40 33 LotsOfNums_01 26538 7.61 8.88 7.06 34 T_XMDrugObfuBody_14 26291 7.95 10.14 7.00 35 RCVD_IN_RP_SAFE 26260 6.18 4.33 6.99 36 LOTS_OF_MONEY 26248 8.24 11.11 6.99 37 RCVD_IN_RP_CERTIFIED 24945 5.70 3.55 6.64 38 XM_Evil_Numbers_Gen 24700 8.94 14.37 6.58 39 BAYES_60 23276 6.22 6.27 6.20 40 HTML_IMAGE_RATIO_02 21516 8.71 15.56 5.73 41 DKIM_INVALID 20979 6.00 6.95 5.58 42 RCVD_IN_IADB_LISTED 20804 4.60 2.43 5.54 43 XM_H_Long_From01 20246 5.99 7.36 5.39 44 RELAYCOUNTRY_META 19567 8.80 17.06 5.21 45 MIME_QP_LONG_LINE 19240 5.11 5.07 5.12 46 XM_PDF 19101 3.99 1.46 5.08 47 RCVD_IN_IADB_SPF 18066 3.98 2.09 4.81 48 TR_DCC_Bayes_99 17987 14.14 35.64 4.79 49 XM_SendGrid 17442 4.54 4.30 4.64 50 RCVD_IN_MSPIKE_H2 17185 4.37 3.89 4.57 51 T_REMOTE_IMAGE 16368 4.29 4.14 4.36 52 RCVD_IN_IADB_SENDERID 15905 3.55 1.99 4.23 53 BOTNET_IPINHOSTNAME 15817 7.09 13.70 4.21 54 TR_XM_DocInvoice 15549 5.14 7.44 4.14 55 RCVD_IN_IADB_DK 15392 3.45 1.96 4.10 56 XM_B_Phish_Phrases 15352 5.89 10.03 4.09 57 T_TooManySym_01 14821 3.80 3.46 3.95 58 BAYES_40 14597 3.10 1.31 3.89 59 RCVD_IN_IADB_VOUCHED 14138 2.95 1.08 3.76 60 BAYES_80 13967 5.02 8.02 3.72 61 XM_UncommonTLD01 13568 5.02 8.26 3.61 62 XMNumbers 13527 4.05 5.08 3.60 63 TR_XM_DK_Bayes 13087 2.76 1.09 3.48 64 XMStrtUSub 12680 3.76 4.66 3.38 65 HTML_IMAGE_RATIO_04 12537 5.56 10.66 3.34 66 XMSubMetaSx_00 12269 4.14 6.14 3.27 67 TR_XM_DK_Bayes1 12161 2.56 1.01 3.24 68 ANY_BOUNCE_MESSAGE 11848 2.45 0.83 3.15 69 BOUNCE_MESSAGE 11845 2.45 0.83 3.15 70 UNPARSEABLE_RELAY 11666 2.62 1.52 3.11 71 FROM_EXCESS_BASE64 11098 4.03 6.51 2.95 72 TVD_RCVD_IP 10789 2.14 0.46 2.87 73 TR_XM_DK_Bayes2 10643 2.27 0.96 2.83 74 BAYES_20 10247 2.22 1.05 2.73 75 TooManyTo_002 10144 2.36 1.57 2.70 76 HTML_IMAGE_RATIO_08 9969 2.98 3.74 2.65 77 HELO_NODOT 9964 1.96 0.37 2.65 78 HTML_IMAGE_RATIO_06 9517 3.19 4.68 2.53 79 MAILING_LIST_MULTI 9506 2.26 1.63 2.53 80 BAYES_95 9030 3.04 4.49 2.40 81 HTML_MIME_NO_HTML_TAG 8766 2.22 1.96 2.33 82 IN_HORDE_ADDRESS_BOOK 8531 1.61 0.08 2.27 83 XM_SPF_SoftFail 8365 2.89 4.41 2.23 84 XMSubNoVowel 7911 1.64 0.56 2.11 85 XMSexyCombo_05 7626 4.34 9.63 2.03 86 MIME_HTML_MOSTLY 7487 2.83 4.74 1.99 87 XM_H_PHPOS 7437 1.75 1.22 1.98 88 TR_Symld_Words 7429 1.70 1.06 1.98 89 INVALID_MSGID 6954 1.34 0.15 1.85 90 XM_DK_Undo_01 6870 1.71 1.43 1.83 91 XMCapTrack 6742 1.48 0.75 1.79 92 RCVD_IN_IADB_OPTIN 6707 1.42 0.57 1.79 93 RCVD_IN_MSPIKE_WL 6648 1.56 1.08 1.77 94 RCVD_IN_MSPIKE_H3 6637 1.56 1.08 1.77 95 TooManyTo_003 6581 1.65 1.40 1.75 96 BAYES_05 6545 1.39 0.57 1.74 97 TO_MALFORMED 6467 1.20 0.01 1.72 98 T_TooManySym_02 5998 1.47 1.19 1.60 99 XM_DIRTYINTL 5982 2.24 3.73 1.59 100 XM_CamelCaseFrm001 5964 2.16 3.49 1.59 101 TM2_M_URI_OPT_OUT 5929 2.59 4.91 1.58 102 SUBJ_ALL_CAPS 5866 1.66 1.88 1.56 103 BOTNET 5857 5.88 15.82 1.56 104 NO_DNS_FOR_FROM 5808 1.77 2.28 1.55 105 XM_OfRef6 5509 1.72 2.30 1.47 106 T_XMDrugObfuBody_08 5238 1.69 2.38 1.39 107 XMDiploma_00 5221 1.77 2.65 1.39 108 XM_GoogleGroups 4935 1.09 0.56 1.31 109 UNTRUSTED_Relay 4888 4.01 10.22 1.30 110 RELAYCOUNTRY_CA 4826 1.88 3.25 1.28 111 TooManyTo_004 4823 1.25 1.18 1.28 112 UPPERCASE_50_75 4616 0.89 0.12 1.23 113 XMPhish11 4531 1.23 1.29 1.21 114 RELAYCOUNTRY_GB 4304 1.17 1.24 1.15 115 XMSubLongNoVowel 4141 0.78 0.05 1.10 116 DKIM_ADSP_CUSTOM_MED 4098 1.05 0.96 1.09 117 URI_HEX 3998 1.63 2.93 1.06 118 TO_NO_BRKTS_HTML_ONLY 3918 0.83 0.33 1.04 119 TooManyTo_005 3907 0.99 0.88 1.04 120 XM_ProductURIs 3659 1.08 1.32 0.97 121 USER_IN_DEF_DKIM_WL 3542 0.66 0.01 0.94 122 XMGenDplmaNmb 3515 1.20 1.81 0.94 123 XM_UB50 3394 2.08 4.78 0.90 124 XM_H_Long_From02 3377 1.31 2.25 0.90 125 XMSubMetaI_00 3326 1.29 2.22 0.89 126 T_FILL_THIS_FORM_SHORT 3299 0.92 1.03 0.88 127 URI_TRY_3LD 3245 0.98 1.25 0.86 128 TR_MetaPhish_Combo_01 3078 0.90 1.09 0.82 129 SpammyFromTLD_01 3062 1.31 2.45 0.82 130 XMNoVowels 3039 0.73 0.54 0.81 131 TM2_M_VERY_LONG_WORD 2909 1.15 2.03 0.77 132 NML_ADSP_CUSTOM_MED 2893 0.78 0.80 0.77 133 T_OBFU_PDF_ATTACH 2776 0.57 0.18 0.74 134 USER_IN_WHITELIST 2686 0.50 0.00 0.72 135 SHORT_HELO_AND_INLINE_IMAGE 2673 0.53 0.10 0.71 136 RCVD_IN_IADB_DOPTIN 2584 0.50 0.08 0.69 137 T_TooManySym_03 2528 0.52 0.17 0.67 138 FUZZY_CREDIT 2440 0.49 0.13 0.65 139 RCVD_IN_BL_SPAMCOP_NET 2433 1.48 3.40 0.65 140 MISSING_HEADERS 2307 0.57 0.47 0.61 141 XM_E_Blogspot 2273 0.44 0.06 0.61 142 HTML_IMAGE_ONLY_32 2267 0.51 0.30 0.60 143 XM_H_PHPMailer 2266 0.62 0.65 0.60 144 RCVD_IN_SORBS_DUL 2202 0.51 0.33 0.59 145 FILL_THIS_FORM 2200 0.49 0.26 0.59 146 HTML_OBFUSCATE_05_10 2158 0.43 0.09 0.57 147 XM_ShortIntro_01 2151 0.48 0.26 0.57 148 HTTPS_HTTP_MISMATCH 2128 0.66 0.89 0.57 149 XMStockSpam_06 2097 0.83 1.47 0.56 150 FORGED_GMAIL_RCVD 2093 0.60 0.71 0.56 151 XM_B_REG_HTML 2081 0.63 0.80 0.55 152 TR_XM_RelayPhish 2052 0.86 1.58 0.55 153 T_XMDrugObfuBody_00 2041 0.78 1.33 0.54 154 T_Symld_Words_02 2029 0.65 0.90 0.54 155 XM_B_COPY_HTML 1989 0.63 0.88 0.53 156 XMDateMe_00 1967 0.47 0.34 0.52 157 XMBdyGiftCard01 1965 0.72 1.19 0.52 158 XMBody_78 1965 0.67 1.00 0.52 159 RELAYCOUNTRY_DE 1947 0.75 1.29 0.52 160 HTML_IMAGE_ONLY_24 1873 0.51 0.55 0.50 161 HTML_IMAGE_ONLY_28 1860 0.57 0.75 0.50 162 XMSubMetaSxObfu_02 1857 0.47 0.42 0.49 163 TM2_M_BODY_EMPTY 1828 0.71 1.22 0.49 164 XMBrknScrpt_02 1795 0.67 1.13 0.48 165 XMHTMLBadTable_001 1762 0.64 1.02 0.47 166 XMMoneyMeta_00 1747 0.62 0.97 0.47 167 T_XMHurry_00 1744 0.83 1.68 0.46 168 XMGappySubj_01 1741 0.40 0.27 0.46 169 RDNS_DYNAMIC 1736 0.61 0.95 0.46 170 XM_B_TRADE_HTML 1720 0.43 0.36 0.46 171 RELAYCOUNTRY_AU 1670 0.61 1.01 0.44 172 XMBody_95 1574 0.33 0.14 0.42 173 T_FILL_THIS_FORM_LOAN 1574 0.34 0.17 0.42 174 T_FILL_THIS_FORM_LONG 1573 0.32 0.09 0.42 175 XMPhish30 1546 0.77 1.58 0.41 176 AC_DIV_BONANZA 1539 0.32 0.11 0.41 177 HTML_TAG_BALANCE_BODY 1510 0.71 1.42 0.40 178 XMBody_17 1505 0.83 1.82 0.40 179 XMHTML_After_End 1438 1.02 2.49 0.38 180 XMPhish14 1393 0.53 0.88 0.37 181 XMSlimDrugH 1381 0.50 0.80 0.37 182 T_MONEY_PERCENT 1373 0.60 1.15 0.37 183 TR_LOTS_OF_MONEY2 1373 0.60 1.15 0.37 184 REMOVE_BEFORE_LINK 1332 0.49 0.79 0.35 185 XMRcvdHeader_15 1322 0.25 0.00 0.35 186 HTML_FONT_FACE_BAD 1304 0.46 0.73 0.35 187 URI_NOVOWEL 1282 0.70 1.51 0.34 188 TVD_SPACE_RATIO 1237 0.37 0.46 0.33 189 XM_H_PHPOS_M 1221 0.33 0.34 0.33 190 XMLKML 1210 0.22 0.00 0.32 191 XMLngstWrd_00 1202 0.37 0.48 0.32 192 HTML_IMAGE_ONLY_20 1164 0.31 0.31 0.31 193 XMSexyCombo_01 1158 0.65 1.43 0.31 194 DOS_OUTLOOK_TO_MX 1150 0.24 0.10 0.31 195 T_TooManySym_04 1147 0.23 0.05 0.31 196 XMSubMetaSxObfu_03 1143 0.41 0.66 0.30 197 XMSolicitRefs_0 1141 0.31 0.34 0.30 198 DKIM_ADSP_NXDOMAIN 1133 0.33 0.41 0.30 199 XMSubEmpty 1127 0.32 0.37 0.30 200 T_DOS_OUTLOOK_TO_MX_IMAGE 1126 0.22 0.03 0.30 ----------------------------------------------------------------------