Email: 520721 Autolearn: 0 AvgScore: 3.10 AvgScanTime: 3.75 sec Spam: 152984 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 4.71 sec Ham: 367737 Autolearn: 0 AvgScore: -0.76 AvgScanTime: 3.35 sec Time Spent Running SA: 542.34 hours Time Spent Processing Spam: 200.23 hours Time Spent Processing Ham: 342.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145503 84.54 95.11 80.15 2 DKIM_SIGNED 127880 68.88 83.59 62.77 3 XM_DK_Pass 124272 67.17 81.23 61.32 4 DKIM_VALID 117239 62.48 76.63 56.60 5 DCC_CHECK 117222 43.16 76.62 29.24 6 XMListUnsubscribeExists 108128 47.33 70.68 37.61 7 DKIM_VALID_AU 91014 45.48 59.49 39.65 8 XM_H_QuotedFrom 86678 39.43 56.66 32.27 9 XM_DK_Undo_02 75752 23.01 49.52 11.98 10 BAYES_99 74872 22.21 48.94 11.08 11 BAYES_999 61335 18.76 40.09 9.88 12 TR_DCC_Bayes_99 54661 14.19 35.73 5.23 13 HTML_FONT_LOW_CONTRAST 53868 24.43 35.21 19.94 14 MIME_HTML_ONLY 50532 22.34 33.03 17.89 15 LOC_TINY_FONT_1 50396 20.64 32.94 15.52 16 BAYES_50 44871 49.83 29.33 58.36 17 FVGT_m_MULTI_ODD 40392 19.90 26.40 17.19 18 XMSubLong 38125 20.40 24.92 18.52 19 DKIM_VALID_EF 36206 23.83 23.67 23.89 20 DCC_CHECK_NEGATIVE 32801 54.71 21.44 68.55 21 T_TM2_M_HEADER_IN_MSG 31881 32.81 20.84 37.80 22 T_KAM_HTML_FONT_INVALID 30296 14.67 19.80 12.54 23 XM_Body_Dirty_Words 28081 11.80 18.36 9.07 24 XM_Multi_Part_URI 26151 11.58 17.09 9.28 25 RELAYCOUNTRY_META 25487 8.27 16.66 4.78 26 MultiRelay 24573 18.42 16.06 19.39 27 HTML_IMAGE_RATIO_02 23993 8.30 15.68 5.23 28 XM_Evil_Numbers_Gen 21897 9.22 14.31 7.10 29 BOTNET 20905 5.04 13.66 1.45 30 HTML_IMAGE_RATIO_04 19794 6.85 12.94 4.32 31 BOTNET_IPINHOSTNAME 19572 6.22 12.79 3.49 32 FSL_BULK_SIG 18154 8.60 11.87 7.24 33 LOTS_OF_MONEY 16085 8.32 10.51 7.41 34 XMSexyCombo_05 15990 5.06 10.45 2.82 35 UNTRUSTED_Relay 15154 3.73 9.91 1.16 36 XMSubMetaSx_00 14798 5.42 9.67 3.66 37 T_XMDrugObfuBody_14 14474 7.94 9.46 7.31 38 LotsOfNums_01 14262 7.32 9.32 6.49 39 XM_B_Phish_Phrases 12952 5.63 8.47 4.45 40 XM_H_Long_From01 11206 9.15 7.32 9.90 41 TooManyTo_001 11040 8.53 7.22 9.08 42 MPART_ALT_DIFF 10841 3.65 7.09 2.22 43 TR_XM_DocInvoice 10643 4.54 6.96 3.54 44 DKIM_INVALID 10641 6.40 6.96 6.17 45 BAYES_80 10375 4.44 6.78 3.47 46 HTML_MIME_NO_HTML_TAG 9818 3.90 6.42 2.85 47 FROM_EXCESS_BASE64 9686 3.88 6.33 2.86 48 XM_UncommonTLD01 9582 4.41 6.26 3.64 49 HTML_IMAGE_RATIO_06 8332 3.25 5.45 2.34 50 BAYES_60 8267 5.70 5.40 5.83 51 ALL_TRUSTED 8088 20.25 5.29 26.47 52 TM2_M_URI_OPT_OUT 7456 2.65 4.87 1.73 53 MIME_HTML_MOSTLY 7167 2.77 4.68 1.97 54 MIME_QP_LONG_LINE 7095 4.67 4.64 4.68 55 XMNumbers 6794 3.65 4.44 3.32 56 XM_SendGrid 6746 4.66 4.41 4.76 57 XM_UB50 6666 1.85 4.36 0.80 58 RCVD_IN_RP_SAFE 6616 6.62 4.32 7.57 59 BAYES_95 6399 3.06 4.18 2.59 60 XM_DIRTYINTL 6065 2.31 3.96 1.62 61 RELAYCOUNTRY_CA 6059 2.03 3.96 1.23 62 XM_SPF_SoftFail 5851 2.70 3.82 2.23 63 XMStrtUSub 5800 4.34 3.79 4.57 64 RCVD_IN_RP_CERTIFIED 5640 5.95 3.69 6.89 65 T_REMOTE_IMAGE 5245 3.97 3.43 4.20 66 URI_HEX 5026 1.69 3.29 1.02 67 HTML_IMAGE_RATIO_08 4908 2.14 3.21 1.70 68 MIME_HTML_ONLY_MULTI 4872 1.72 3.18 1.11 69 XM_CamelCaseFrm001 4718 2.04 3.08 1.60 70 RCVD_IN_BL_SPAMCOP_NET 4663 1.26 3.05 0.52 71 RCVD_IN_MSPIKE_H2 4043 2.96 2.64 3.09 72 T_TooManySym_01 3901 3.58 2.55 4.01 73 XM_OfRef6 3807 1.88 2.49 1.62 74 NO_DNS_FOR_FROM 3805 1.94 2.49 1.71 75 MultiRelay_Combo 3691 0.85 2.41 0.20 76 MultiRelay_CC 3691 0.85 2.41 0.20 77 TM2_M_VERY_LONG_WORD 3673 1.24 2.40 0.75 78 SpammyFromTLD_01 3662 1.27 2.39 0.80 79 RCVD_IN_IADB_LISTED 3595 4.10 2.35 4.83 80 T_XMDrugObfuBody_08 3567 1.57 2.33 1.25 81 XMSubMetaI_00 3509 1.03 2.29 0.50 82 XMSexyCombo_01 3480 1.22 2.27 0.79 83 RCVD_IN_RP_RNBL 3475 0.68 2.27 0.02 84 XMBody_17 3199 0.88 2.09 0.37 85 RCVD_IN_IADB_SPF 3189 3.60 2.08 4.23 86 MAILING_LIST_MULTI 3132 2.39 2.05 2.53 87 RELAYCOUNTRY_FR 3130 0.76 2.05 0.22 88 RCVD_IN_IADB_SENDERID 3050 3.25 1.99 3.77 89 RCVD_IN_IADB_DK 3030 3.18 1.98 3.68 90 XM_H_Long_From02 3022 1.14 1.98 0.79 91 XMDiploma_00 2929 1.69 1.91 1.60 92 SUBJ_ALL_CAPS 2896 4.82 1.89 6.04 93 XM_URI_RBL 2848 0.63 1.86 0.11 94 BOTNET_NORDNS 2722 0.55 1.78 0.04 95 XM_UB99 2700 0.53 1.76 0.01 96 RCVD_IN_MSPIKE_WL 2696 2.38 1.76 2.64 97 RCVD_IN_MSPIKE_H3 2696 2.38 1.76 2.64 98 BAYES_40 2645 4.78 1.73 6.04 99 XM_DK_Undo_01 2526 1.87 1.65 1.96 100 RCVD_IN_PSBL 2465 0.54 1.61 0.09 101 FSL_THIS_IS_ADV 2406 0.55 1.57 0.12 102 T_XMHurry_00 2368 0.76 1.55 0.43 103 BAYES_00 2310 5.77 1.51 7.54 104 TR_XM_RelayPhish 2294 0.79 1.50 0.49 105 RELAYCOUNTRY_DE 2241 0.76 1.46 0.47 106 XMSubMetaSxObfu_03 2240 0.64 1.46 0.30 107 XMPhish30 2231 0.62 1.46 0.28 108 SpammyFromTLD_02 2215 0.58 1.45 0.22 109 UNPARSEABLE_RELAY 2142 2.27 1.40 2.63 110 XM_UB999 2130 0.42 1.39 0.01 111 XMHTML_After_End 2099 0.62 1.37 0.31 112 URIBL_BLACK 2081 0.42 1.36 0.03 113 XMStockSpam_06 2061 1.22 1.35 1.17 114 URI_TRY_3LD 1996 1.01 1.30 0.88 115 XMGenDplmaNmb 1981 1.10 1.29 1.02 116 XM_ProductURIs 1949 1.10 1.27 1.03 117 BAYES_20 1943 2.40 1.27 2.88 118 XMBdyGiftCard01 1928 0.83 1.26 0.65 119 RELAYCOUNTRY_GB 1926 1.13 1.26 1.07 120 TooManyTo_002 1902 2.51 1.24 3.04 121 RELAYCOUNTRY_AT 1845 0.46 1.21 0.15 122 URIBL_DBL_SPAM 1836 0.36 1.20 0.02 123 PHOTO_EDITING_DIRECT 1825 0.38 1.19 0.04 124 XMPhish11 1718 1.19 1.12 1.22 125 TooManyTo_003 1702 1.78 1.11 2.06 126 XMMoneyMeta_00 1663 0.66 1.09 0.48 127 SUBJ_DOLLARS 1659 0.41 1.08 0.13 128 XM_B_REG_HTML 1655 0.67 1.08 0.50 129 XM_UB60 1653 0.36 1.08 0.06 130 XMPhish14 1652 0.56 1.08 0.35 131 DKIM_ADSP_CUSTOM_MED 1618 0.98 1.06 0.94 132 RCVD_IN_IADB_VOUCHED 1602 2.62 1.05 3.27 133 TR_Mismatch_TLD_02 1586 0.35 1.04 0.06 134 T_FILL_THIS_FORM_SHORT 1582 1.02 1.03 1.02 135 XM_B_COPY_HTML 1569 0.63 1.03 0.47 136 HTML_FONT_SIZE_HUGE 1563 0.37 1.02 0.10 137 T_XMDrugObfuBody_00 1524 0.71 1.00 0.58 138 XMBody_78 1508 0.56 0.99 0.38 139 XM_H_PHPOS 1505 1.28 0.98 1.40 140 T_MONEY_PERCENT 1503 0.47 0.98 0.26 141 TR_LOTS_OF_MONEY2 1503 0.47 0.98 0.26 142 HTTPS_HTTP_MISMATCH 1503 0.65 0.98 0.51 143 TR_XM_DK_Bayes 1498 3.39 0.98 4.39 144 RDNS_DYNAMIC 1468 0.54 0.96 0.36 145 TooManyTo_004 1467 1.39 0.96 1.58 146 XM_HighProb1 1462 0.29 0.96 0.01 147 DIET_1 1462 0.48 0.96 0.28 148 REMOVE_BEFORE_LINK 1409 0.37 0.92 0.14 149 TR_XM_DK_Bayes1 1403 3.03 0.92 3.91 150 TR_XM_DK_Bayes2 1358 2.47 0.89 3.13 151 HTML_FONT_FACE_BAD 1355 0.56 0.89 0.42 152 XM_PDF 1351 4.18 0.88 5.56 153 NML_ADSP_CUSTOM_MED 1344 0.73 0.88 0.67 154 TR_Symld_Words 1342 1.60 0.88 1.91 155 DATE_IN_PAST_03_06 1342 0.31 0.88 0.07 156 XM_BadFromFormat 1332 0.40 0.87 0.21 157 XMBrknScrpt_02 1330 0.62 0.87 0.52 158 LongTLD 1317 0.40 0.86 0.20 159 XM_UB80 1315 0.27 0.86 0.03 160 XM_H_PHPMailer 1282 0.96 0.84 1.01 161 LONG_JUNK_URI3 1239 0.27 0.81 0.05 162 RELAYCOUNTRY_NL 1239 0.52 0.81 0.40 163 RELAYCOUNTRY_CN 1234 0.25 0.81 0.02 164 T_HTML_TAG_BALANCE_CENTER 1231 0.33 0.80 0.14 165 TooManyTo_005 1224 1.15 0.80 1.30 166 XMSubMetaI_01 1208 0.25 0.79 0.02 167 ANY_BOUNCE_MESSAGE 1204 2.53 0.79 3.26 168 BOUNCE_MESSAGE 1200 2.53 0.78 3.26 169 MPART_ALT_DIFF_COUNT 1196 0.41 0.78 0.25 170 URI_NOVOWEL 1188 0.44 0.78 0.30 171 XMSubMetaSSx_00 1173 0.32 0.77 0.13 172 PLING_QUERY 1154 0.35 0.75 0.19 173 FORGED_GMAIL_RCVD 1152 0.53 0.75 0.43 174 HTML_TAG_BALANCE_BODY 1133 0.47 0.74 0.36 175 BAYES_05 1123 1.57 0.73 1.92 176 XMSubMetaD_03 1072 0.22 0.70 0.02 177 XMCapTrack 1065 1.56 0.70 1.92 178 XMHTMLBadTable_001 1054 0.40 0.69 0.27 179 ADMITS_SPAM 1053 0.22 0.69 0.02 180 XM_RXBody 1052 0.27 0.69 0.10 181 XM_OfRef7 1034 0.33 0.68 0.19 182 XMSexyCombo_04 1021 0.56 0.67 0.52 183 TR_LOTS_OF_MONEY3 1016 0.30 0.66 0.15 184 XMLongAddy 990 0.25 0.65 0.09 185 XMClaimOffer 986 0.24 0.64 0.08 186 XM_S_JOY_D 966 0.32 0.63 0.19 187 T_TooManySym_02 956 1.34 0.62 1.63 188 TVD_RCVD_IP 952 1.90 0.62 2.44 189 LOW_PRICE 944 0.27 0.62 0.12 190 XMGppyBdWords 931 0.26 0.61 0.11 191 RCVD_IN_IADB_OPTIN 920 1.60 0.60 2.02 192 XM_H_Long_From03 897 0.23 0.59 0.09 193 HTML_IMAGE_ONLY_28 884 0.50 0.58 0.46 194 XMLngstWrd_00 881 0.42 0.58 0.36 195 XMGappySubj_01 879 0.64 0.57 0.67 196 RELAYCOUNTRY_AU 872 0.41 0.57 0.35 197 T_Symld_Words_02 860 0.46 0.56 0.42 198 XM_Body_Obfu01 856 0.36 0.56 0.28 199 XMWhlSbjSex 845 0.22 0.55 0.08 200 BASE64_LENGTH_79_INF 845 0.24 0.55 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 294723 84.54 95.11 80.15 2 DCC_CHECK_NEGATIVE 252073 54.71 21.44 68.55 3 DKIM_SIGNED 230816 68.88 83.59 62.77 4 XM_DK_Pass 225479 67.17 81.23 61.32 5 BAYES_50 214596 49.83 29.33 58.36 6 DKIM_VALID 208131 62.48 76.63 56.60 7 DKIM_VALID_AU 145821 45.48 59.49 39.65 8 T_TM2_M_HEADER_IN_MSG 138989 32.81 20.84 37.80 9 XMListUnsubscribeExists 138308 47.33 70.68 37.61 10 XM_H_QuotedFrom 118662 39.43 56.66 32.27 11 DCC_CHECK 107526 43.16 76.62 29.24 12 ALL_TRUSTED 97337 20.25 5.29 26.47 13 DKIM_VALID_EF 87863 23.83 23.67 23.89 14 HTML_FONT_LOW_CONTRAST 73343 24.43 35.21 19.94 15 MultiRelay 71320 18.42 16.06 19.39 16 XMSubLong 68115 20.40 24.92 18.52 17 MIME_HTML_ONLY 65799 22.34 33.03 17.89 18 FVGT_m_MULTI_ODD 63216 19.90 26.40 17.19 19 LOC_TINY_FONT_1 57087 20.64 32.94 15.52 20 T_KAM_HTML_FONT_INVALID 46103 14.67 19.80 12.54 21 XM_DK_Undo_02 44065 23.01 49.52 11.98 22 BAYES_99 40756 22.21 48.94 11.08 23 XM_H_Long_From01 36420 9.15 7.32 9.90 24 BAYES_999 36346 18.76 40.09 9.88 25 XM_Multi_Part_URI 34142 11.58 17.09 9.28 26 TooManyTo_001 33373 8.53 7.22 9.08 27 XM_Body_Dirty_Words 33340 11.80 18.36 9.07 28 XM_DKIMWhitelistDomains 28934 5.57 0.06 7.87 29 RCVD_IN_RP_SAFE 27839 6.62 4.32 7.57 30 BAYES_00 27730 5.77 1.51 7.54 31 LOTS_OF_MONEY 27265 8.32 10.51 7.41 32 T_XMDrugObfuBody_14 26871 7.94 9.46 7.31 33 FSL_BULK_SIG 26641 8.60 11.87 7.24 34 XM_Evil_Numbers_Gen 26110 9.22 14.31 7.10 35 RCVD_IN_RP_CERTIFIED 25327 5.95 3.69 6.89 36 LotsOfNums_01 23875 7.32 9.32 6.49 37 DKIM_INVALID 22685 6.40 6.96 6.17 38 BAYES_40 22223 4.78 1.73 6.04 39 SUBJ_ALL_CAPS 22211 4.82 1.89 6.04 40 BAYES_60 21424 5.70 5.40 5.83 41 IN_ZIMBRA_NJ_WHITELIST 21030 4.05 0.04 5.72 42 XM_PDF 20439 4.18 0.88 5.56 43 TR_DCC_Bayes_99 19223 14.19 35.73 5.23 44 HTML_IMAGE_RATIO_02 19218 8.30 15.68 5.23 45 RCVD_IN_IADB_LISTED 17773 4.10 2.35 4.83 46 RELAYCOUNTRY_META 17584 8.27 16.66 4.78 47 XM_SendGrid 17494 4.66 4.41 4.76 48 MIME_QP_LONG_LINE 17197 4.67 4.64 4.68 49 XMStrtUSub 16807 4.34 3.79 4.57 50 XM_B_Phish_Phrases 16348 5.63 8.47 4.45 51 TR_XM_DK_Bayes 16132 3.39 0.98 4.39 52 HTML_IMAGE_RATIO_04 15900 6.85 12.94 4.32 53 RCVD_IN_IADB_SPF 15564 3.60 2.08 4.23 54 T_REMOTE_IMAGE 15433 3.97 3.43 4.20 55 T_TooManySym_01 14736 3.58 2.55 4.01 56 TR_XM_DK_Bayes1 14388 3.03 0.92 3.91 57 RCVD_IN_IADB_SENDERID 13869 3.25 1.99 3.77 58 RCVD_IN_IADB_DK 13523 3.18 1.98 3.68 59 XMSubMetaSx_00 13449 5.42 9.67 3.66 60 XM_UncommonTLD01 13387 4.41 6.26 3.64 61 TR_XM_DocInvoice 13011 4.54 6.96 3.54 62 BOTNET_IPINHOSTNAME 12822 6.22 12.79 3.49 63 BAYES_80 12745 4.44 6.78 3.47 64 XMNumbers 12222 3.65 4.44 3.32 65 RCVD_IN_IADB_VOUCHED 12025 2.62 1.05 3.27 66 ANY_BOUNCE_MESSAGE 11990 2.53 0.79 3.26 67 BOUNCE_MESSAGE 11981 2.53 0.78 3.26 68 TR_XM_DK_Bayes2 11494 2.47 0.89 3.13 69 RCVD_IN_MSPIKE_H2 11378 2.96 2.64 3.09 70 TooManyTo_002 11178 2.51 1.24 3.04 71 BAYES_20 10574 2.40 1.27 2.88 72 FROM_EXCESS_BASE64 10521 3.88 6.33 2.86 73 HTML_MIME_NO_HTML_TAG 10473 3.90 6.42 2.85 74 XMSexyCombo_05 10372 5.06 10.45 2.82 75 HELO_NODOT 9757 2.00 0.44 2.65 76 RCVD_IN_MSPIKE_WL 9716 2.38 1.76 2.64 77 RCVD_IN_MSPIKE_H3 9714 2.38 1.76 2.64 78 UNPARSEABLE_RELAY 9661 2.27 1.40 2.63 79 BAYES_95 9530 3.06 4.18 2.59 80 MAILING_LIST_MULTI 9312 2.39 2.05 2.53 81 TVD_RCVD_IP 8959 1.90 0.62 2.44 82 IN_HORDE_ADDRESS_BOOK 8664 1.69 0.08 2.36 83 HTML_IMAGE_RATIO_06 8604 3.25 5.45 2.34 84 XM_SPF_SoftFail 8212 2.70 3.82 2.23 85 MPART_ALT_DIFF 8172 3.65 7.09 2.22 86 TooManyTo_003 7577 1.78 1.11 2.06 87 RCVD_IN_IADB_OPTIN 7410 1.60 0.60 2.02 88 MIME_HTML_MOSTLY 7249 2.77 4.68 1.97 89 XM_DK_Undo_01 7219 1.87 1.65 1.96 90 BAYES_05 7076 1.57 0.73 1.92 91 XMCapTrack 7074 1.56 0.70 1.92 92 TO_MALFORMED 7056 1.37 0.05 1.92 93 TR_Symld_Words 7012 1.60 0.88 1.91 94 INVALID_MSGID 6830 1.37 0.19 1.86 95 TM2_M_URI_OPT_OUT 6348 2.65 4.87 1.73 96 NO_DNS_FOR_FROM 6284 1.94 2.49 1.71 97 HTML_IMAGE_RATIO_08 6235 2.14 3.21 1.70 98 T_TooManySym_02 6011 1.34 0.62 1.63 99 XM_OfRef6 5967 1.88 2.49 1.62 100 XM_DIRTYINTL 5939 2.31 3.96 1.62 101 XM_CamelCaseFrm001 5891 2.04 3.08 1.60 102 XMDiploma_00 5868 1.69 1.91 1.60 103 TooManyTo_004 5792 1.39 0.96 1.58 104 BOTNET 5335 5.04 13.66 1.45 105 XMSubNoVowel 5227 1.12 0.40 1.42 106 XM_H_PHPOS 5147 1.28 0.98 1.40 107 TooManyTo_005 4789 1.15 0.80 1.30 108 USER_IN_DEF_DKIM_WL 4758 0.95 0.12 1.29 109 XM_GoogleGroups 4746 1.07 0.54 1.29 110 T_XMDrugObfuBody_08 4594 1.57 2.33 1.25 111 RELAYCOUNTRY_CA 4513 2.03 3.96 1.23 112 XMSubEmpty 4496 0.94 0.27 1.22 113 XMPhish11 4481 1.19 1.12 1.22 114 XMStockSpam_06 4314 1.22 1.35 1.17 115 UNTRUSTED_Relay 4276 3.73 9.91 1.16 116 MIME_HTML_ONLY_MULTI 4095 1.72 3.18 1.11 117 RELAYCOUNTRY_GB 3950 1.13 1.26 1.07 118 XM_ProductURIs 3774 1.10 1.27 1.03 119 URI_HEX 3757 1.69 3.29 1.02 120 XMGenDplmaNmb 3754 1.10 1.29 1.02 121 T_FILL_THIS_FORM_SHORT 3740 1.02 1.03 1.02 122 XM_H_PHPMailer 3711 0.96 0.84 1.01 123 DKIM_ADSP_CUSTOM_MED 3475 0.98 1.06 0.94 124 URI_TRY_3LD 3248 1.01 1.30 0.88 125 XMNoVowels 3232 0.76 0.48 0.88 126 XM_UB50 2947 1.85 4.36 0.80 127 SpammyFromTLD_01 2928 1.27 2.39 0.80 128 XM_H_Long_From02 2903 1.14 1.98 0.79 129 XMSexyCombo_01 2898 1.22 2.27 0.79 130 TR_MetaPhish_Combo_01 2810 0.70 0.55 0.76 131 XMSolicitRefs_0 2788 0.61 0.26 0.76 132 TM2_M_VERY_LONG_WORD 2759 1.24 2.40 0.75 133 USER_IN_WHITELIST 2712 0.52 0.00 0.74 134 T_TooManySym_03 2574 0.53 0.11 0.70 135 MISSING_HEADERS 2553 0.62 0.46 0.69 136 SHORT_HELO_AND_INLINE_IMAGE 2481 0.51 0.10 0.67 137 XMGappySubj_01 2467 0.64 0.57 0.67 138 NML_ADSP_CUSTOM_MED 2460 0.73 0.88 0.67 139 T_OBFU_PDF_ATTACH 2456 0.52 0.18 0.67 140 RCVD_IN_SORBS_DUL 2433 0.56 0.33 0.66 141 XM_ShortIntro_01 2386 0.58 0.40 0.65 142 XMBdyGiftCard01 2372 0.83 1.26 0.65 143 AC_DIV_BONANZA 2221 0.47 0.15 0.60 144 TM2_M_BODY_EMPTY 2155 0.47 0.20 0.59 145 T_XMDrugObfuBody_00 2151 0.71 1.00 0.58 146 TR_Mismatch_TLD_01 2128 0.51 0.35 0.58 147 TVD_SPACE_RATIO 2096 0.46 0.20 0.57 148 HTML_IMAGE_ONLY_32 2056 0.47 0.25 0.56 149 MSGID_NOFQDN1 2031 0.39 0.01 0.55 150 XMBody_95 2003 0.44 0.18 0.54 151 FILL_THIS_FORM 1986 0.54 0.53 0.54 152 XMBrknScrpt_02 1917 0.62 0.87 0.52 153 XMSexyCombo_04 1913 0.56 0.67 0.52 154 RCVD_IN_BL_SPAMCOP_NET 1904 1.26 3.05 0.52 155 HTTPS_HTTP_MISMATCH 1876 0.65 0.98 0.51 156 XM_B_REG_HTML 1849 0.67 1.08 0.50 157 XMSubMetaI_00 1836 1.03 2.29 0.50 158 TR_XM_RelayPhish 1817 0.79 1.50 0.49 159 XMDateMe_00 1813 0.46 0.38 0.49 160 XMMoneyMeta_00 1759 0.66 1.09 0.48 161 XM_B_COPY_HTML 1734 0.63 1.03 0.47 162 RELAYCOUNTRY_DE 1724 0.76 1.46 0.47 163 HTML_IMAGE_ONLY_28 1694 0.50 0.58 0.46 164 XMSubMetaSxObfu_02 1597 0.42 0.38 0.43 165 FORGED_GMAIL_RCVD 1595 0.53 0.75 0.43 166 T_XMHurry_00 1590 0.76 1.55 0.43 167 HTML_FONT_FACE_BAD 1537 0.56 0.89 0.42 168 T_Symld_Words_02 1537 0.46 0.56 0.42 169 XMEmptySub 1533 0.33 0.13 0.42 170 HTML_IMAGE_ONLY_24 1499 0.44 0.53 0.41 171 RELAYCOUNTRY_NL 1479 0.52 0.81 0.40 172 T_FILL_THIS_FORM_LOAN 1453 0.39 0.38 0.40 173 XMBody_78 1414 0.56 0.99 0.38 174 XMRcvdHeader_15 1389 0.27 0.00 0.38 175 HTML_IMAGE_ONLY_20 1372 0.39 0.42 0.37 176 XMBody_17 1360 0.88 2.09 0.37 177 XM_B_TRADE_HTML 1347 0.39 0.45 0.37 178 RDNS_DYNAMIC 1334 0.54 0.96 0.36 179 XMLngstWrd_00 1328 0.42 0.58 0.36 180 HTML_TAG_BALANCE_BODY 1327 0.47 0.74 0.36 181 XMLKML 1312 0.25 0.00 0.36 182 XMPhish14 1290 0.56 1.08 0.35 183 RELAYCOUNTRY_AU 1279 0.41 0.57 0.35 184 XM_H_PHPOS_M 1277 0.37 0.42 0.35 185 HTML_IMAGE_ONLY_16 1273 0.30 0.19 0.35 186 GMD_PDF_EMPTY_BODY 1254 0.29 0.15 0.34 187 T_TooManySym_04 1209 0.24 0.02 0.33 188 MSGID_FROM_MTA_HEADER 1177 0.28 0.20 0.32 189 TO_NO_BRKTS_HTML_ONLY 1166 0.29 0.24 0.32 190 XMLngstWrd_01 1163 0.35 0.45 0.32 191 XMHTML_After_End 1147 0.62 1.37 0.31 192 DKIM_ADSP_NXDOMAIN 1103 0.32 0.37 0.30 193 URI_NOVOWEL 1098 0.44 0.78 0.30 194 T_FILL_THIS_FORM_LONG 1097 0.24 0.09 0.30 195 XMSubMetaSxObfu_03 1088 0.64 1.46 0.30 196 GMD_PDF_HORIZ 1065 0.22 0.07 0.29 197 T_HTML_ATTACH 1064 0.22 0.05 0.29 198 DOS_OUTLOOK_TO_MX 1063 0.26 0.19 0.29 199 TM2_M_A_HREF_HREF 1049 0.35 0.52 0.29 200 XMSlimDrugH 1041 0.34 0.49 0.28 ----------------------------------------------------------------------