Email: 536693 Autolearn: 0 AvgScore: 3.43 AvgScanTime: 3.76 sec Spam: 156605 Autolearn: 0 AvgScore: 12.70 AvgScanTime: 4.78 sec Ham: 380088 Autolearn: 0 AvgScore: -0.39 AvgScanTime: 3.35 sec Time Spent Running SA: 561.20 hours Time Spent Processing Spam: 207.81 hours Time Spent Processing Ham: 353.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149209 82.37 95.28 77.05 2 DKIM_SIGNED 132902 67.70 84.86 60.63 3 XM_DK_Pass 128975 66.04 82.36 59.32 4 DCC_CHECK 123690 42.45 78.98 27.40 5 DKIM_VALID 121114 61.12 77.34 54.44 6 XMListUnsubscribeExists 112870 46.44 72.07 35.88 7 DKIM_VALID_AU 94126 44.23 60.10 37.69 8 XM_H_QuotedFrom 84281 37.23 53.82 30.40 9 XM_DK_Undo_02 80532 22.69 51.42 10.85 10 BAYES_99 75051 22.03 47.92 11.37 11 BAYES_999 64289 18.72 41.05 9.52 12 TR_DCC_Bayes_99 58470 14.14 37.34 4.58 13 HTML_FONT_LOW_CONTRAST 57518 24.09 36.73 18.88 14 LOC_TINY_FONT_1 53360 20.26 34.07 14.57 15 MIME_HTML_ONLY 50749 21.23 32.41 16.63 16 BAYES_50 46208 48.70 29.51 56.61 17 FVGT_m_MULTI_ODD 41185 19.33 26.30 16.46 18 XMSubLong 41130 21.14 26.26 19.03 19 DKIM_VALID_EF 35584 22.95 22.72 23.04 20 T_KAM_HTML_FONT_INVALID 33508 14.87 21.40 12.19 21 T_TM2_M_HEADER_IN_MSG 32091 32.34 20.49 37.22 22 XM_Body_Dirty_Words 31404 12.51 20.05 9.40 23 DCC_CHECK_NEGATIVE 29283 55.28 18.70 70.35 24 XM_Multi_Part_URI 26723 10.95 17.06 8.43 25 MultiRelay 26565 18.97 16.96 19.80 26 RELAYCOUNTRY_META 25813 8.65 16.48 5.42 27 HTML_IMAGE_RATIO_02 23921 8.03 15.27 5.04 28 XM_Evil_Numbers_Gen 22928 9.04 14.64 6.74 29 BOTNET 21840 4.94 13.95 1.23 30 FSL_BULK_SIG 20157 8.46 12.87 6.65 31 BOTNET_IPINHOSTNAME 19505 5.90 12.45 3.20 32 XMSexyCombo_05 18606 5.48 11.88 2.84 33 LOTS_OF_MONEY 17491 8.29 11.17 7.11 34 T_XMDrugObfuBody_14 16514 8.27 10.55 7.33 35 UNTRUSTED_Relay 15982 3.87 10.21 1.26 36 XMSubMetaSx_00 15396 5.27 9.83 3.39 37 LotsOfNums_01 14704 7.03 9.39 6.05 38 TooManyTo_001 14129 11.52 9.02 12.55 39 XM_B_Phish_Phrases 13793 5.22 8.81 3.74 40 HTML_IMAGE_RATIO_04 12925 4.86 8.25 3.46 41 XM_H_Long_From01 11871 8.89 7.58 9.43 42 DKIM_INVALID 11788 6.58 7.53 6.20 43 BAYES_80 11558 5.23 7.38 4.35 44 TR_XM_DocInvoice 10777 4.39 6.88 3.36 45 FROM_EXCESS_BASE64 10765 3.66 6.87 2.34 46 MPART_ALT_DIFF 10271 3.68 6.56 2.50 47 BAYES_60 9468 6.46 6.05 6.63 48 XM_UncommonTLD01 9317 4.37 5.95 3.72 49 TM2_M_URI_OPT_OUT 9012 2.85 5.75 1.65 50 MIME_QP_LONG_LINE 8439 4.83 5.39 4.60 51 RCVD_IN_RP_SAFE 8311 6.13 5.31 6.47 52 XMNumbers 7882 3.76 5.03 3.24 53 RCVD_IN_MSPIKE_H2 7791 4.76 4.97 4.66 54 RCVD_IN_RP_CERTIFIED 7237 5.56 4.62 5.95 55 BAYES_95 7150 3.52 4.57 3.09 56 HTML_IMAGE_RATIO_06 7097 3.19 4.53 2.64 57 MIME_HTML_MOSTLY 7083 2.67 4.52 1.90 58 XM_UB50 7064 1.91 4.51 0.84 59 T_REMOTE_IMAGE 6848 3.98 4.37 3.82 60 XM_SendGrid 6646 4.46 4.24 4.54 61 XM_DIRTYINTL 6069 2.19 3.88 1.50 62 HTML_IMAGE_RATIO_08 5941 2.18 3.79 1.51 63 XMStrtUSub 5870 3.74 3.75 3.73 64 XM_SPF_SoftFail 5831 2.56 3.72 2.09 65 T_TooManySym_01 5542 4.64 3.54 5.10 66 XMSexyCombo_01 5332 1.21 3.40 0.30 67 MIME_HTML_ONLY_MULTI 5259 1.85 3.36 1.23 68 XM_CamelCaseFrm001 5152 1.99 3.29 1.46 69 RELAYCOUNTRY_CA 4905 1.84 3.13 1.31 70 HTML_MIME_NO_HTML_TAG 4895 2.54 3.13 2.29 71 T_XMDrugObfuBody_08 4830 1.86 3.08 1.35 72 URI_HEX 4637 1.55 2.96 0.96 73 XM_OfRef6 4560 1.83 2.91 1.39 74 RCVD_IN_RP_RNBL 4346 0.84 2.78 0.04 75 XMBody_17 4184 1.03 2.67 0.35 76 MultiRelay_CC 4053 0.93 2.59 0.24 77 MultiRelay_Combo 4053 0.93 2.59 0.24 78 NO_DNS_FOR_FROM 4039 2.04 2.58 1.82 79 ALL_TRUSTED 3951 20.98 2.52 28.58 80 SUBJ_ALL_CAPS 3896 4.91 2.49 5.91 81 TooManyTo_002 3882 4.84 2.48 5.81 82 RCVD_IN_BL_SPAMCOP_NET 3845 1.02 2.46 0.42 83 XMBdyGiftCard01 3782 1.13 2.41 0.61 84 XMDiploma_00 3669 2.40 2.34 2.42 85 SpammyFromTLD_02 3537 0.81 2.26 0.22 86 XM_URI_RBL 3507 0.72 2.24 0.09 87 MAILING_LIST_MULTI 3478 2.85 2.22 3.11 88 TooManyTo_003 3460 3.61 2.21 4.18 89 RCVD_IN_IADB_LISTED 3444 3.97 2.20 4.69 90 BOTNET_NORDNS 3440 0.66 2.20 0.03 91 XMSexyCombo_04 3266 0.65 2.09 0.06 92 RELAYCOUNTRY_FR 3192 0.75 2.04 0.22 93 XM_UB99 3104 0.59 1.98 0.02 94 XM_ProductURIs 3102 1.24 1.98 0.93 95 RCVD_IN_IADB_SPF 3095 3.51 1.98 4.15 96 XMSubMetaI_00 3029 0.93 1.93 0.51 97 XMHTML_After_End 3026 0.80 1.93 0.33 98 RCVD_IN_IADB_SENDERID 2939 3.17 1.88 3.70 99 TooManyTo_004 2918 2.72 1.86 3.07 100 RCVD_IN_IADB_DK 2899 3.10 1.85 3.61 101 XM_H_Long_From02 2887 1.12 1.84 0.82 102 TM2_M_VERY_LONG_WORD 2700 1.02 1.72 0.73 103 XMGenDplmaNmb 2681 1.84 1.71 1.89 104 DKIM_ADSP_CUSTOM_MED 2657 1.25 1.70 1.07 105 TR_XM_RelayPhish 2614 0.81 1.67 0.45 106 XM_PDF 2607 4.14 1.66 5.17 107 XM_DK_Undo_01 2602 1.89 1.66 1.98 108 XM_BadFromFormat 2550 0.60 1.63 0.17 109 TooManyTo_005 2496 2.07 1.59 2.26 110 FSL_THIS_IS_ADV 2449 0.50 1.56 0.07 111 BODY_URI_ONLY 2408 0.49 1.54 0.05 112 UNPARSEABLE_RELAY 2402 2.24 1.53 2.53 113 URIBL_BLACK 2402 0.47 1.53 0.03 114 T_XMHurry_00 2369 1.12 1.51 0.95 115 BAYES_00 2342 5.75 1.50 7.50 116 XM_UB999 2342 0.45 1.50 0.01 117 XMPhish30 2322 0.64 1.48 0.30 118 HTML_IMAGE_ONLY_08 2288 0.54 1.46 0.16 119 SUBJ_DOLLARS 2287 0.54 1.46 0.16 120 XMLongAddy 2258 0.48 1.44 0.08 121 XMStockSpam_06 2252 1.16 1.44 1.05 122 NML_ADSP_CUSTOM_MED 2245 0.93 1.43 0.72 123 HTML_SHORT_LINK_IMG_1 2218 0.43 1.42 0.02 124 T_XMDrugObfuBody_00 2164 1.16 1.38 1.06 125 SpammyFromTLD_01 2151 0.95 1.37 0.77 126 RCVD_IN_MSPIKE_H3 2129 1.79 1.36 1.97 127 RCVD_IN_MSPIKE_WL 2129 1.79 1.36 1.97 128 T_FILL_THIS_FORM_SHORT 2100 0.99 1.34 0.85 129 URIBL_DBL_SPAM 2077 0.40 1.33 0.02 130 XM_UB60 2028 0.46 1.29 0.11 131 XM_B_REG_HTML 2011 0.61 1.28 0.34 132 TR_Caps_n_Bayes_99 2010 0.44 1.28 0.09 133 TR_LOTS_OF_MONEY2 1977 0.51 1.26 0.21 134 T_MONEY_PERCENT 1977 0.51 1.26 0.21 135 URI_TRY_3LD 1968 0.95 1.26 0.83 136 XMPhish11 1893 1.12 1.21 1.09 137 FROM_LOCAL_HEX 1834 0.42 1.17 0.11 138 BAYES_40 1814 4.38 1.16 5.71 139 DIET_1 1776 0.50 1.13 0.24 140 FROM_LOCAL_DIGITS 1774 0.36 1.13 0.04 141 XM_HighProb1 1771 0.34 1.13 0.01 142 T_TooManySym_02 1741 1.73 1.11 1.98 143 RELAYCOUNTRY_GB 1724 1.04 1.10 1.02 144 XMSubMetaSxObfu_03 1710 0.51 1.09 0.27 145 RELAYCOUNTRY_AT 1708 0.41 1.09 0.13 146 TR_XM_DK_Bayes 1699 3.42 1.08 4.38 147 RELAYCOUNTRY_DE 1657 0.71 1.06 0.57 148 BAYES_20 1616 2.22 1.03 2.71 149 T_HTML_TAG_BALANCE_CENTER 1597 0.38 1.02 0.12 150 REMOVE_BEFORE_LINK 1595 0.40 1.02 0.15 151 TR_Symld_Words 1595 1.99 1.02 2.39 152 XM_UB80 1573 0.32 1.00 0.03 153 TR_XM_DK_Bayes1 1564 3.01 1.00 3.84 154 RELAYCOUNTRY_CN 1559 0.32 1.00 0.04 155 RCVD_IN_IADB_VOUCHED 1541 2.51 0.98 3.14 156 TR_XM_DK_Bayes2 1518 2.40 0.97 2.99 157 XMPhish14 1516 0.50 0.97 0.30 158 MPART_ALT_DIFF_COUNT 1498 0.56 0.96 0.40 159 HTTPS_HTTP_MISMATCH 1496 0.59 0.96 0.44 160 XM_B_COPY_HTML 1496 0.60 0.96 0.46 161 FORGED_GMAIL_RCVD 1492 0.63 0.95 0.49 162 XM_H_PHPOS 1449 1.08 0.93 1.14 163 XMSlimDrugH 1407 0.47 0.90 0.29 164 XMBrknScrpt_02 1355 0.59 0.87 0.47 165 HTML_FONT_SIZE_LARGE 1319 0.38 0.84 0.19 166 RCVD_IN_PSBL 1316 0.31 0.84 0.08 167 URI_NOVOWEL 1278 0.61 0.82 0.53 168 HDRS_LCASE_IMGONLY 1272 0.27 0.81 0.04 169 XM_H_Long_From03 1265 0.29 0.81 0.08 170 XMNoVowels 1259 1.20 0.80 1.36 171 GMD_PDF_HORIZ 1255 0.42 0.80 0.26 172 RELAYCOUNTRY_IT 1230 0.25 0.79 0.04 173 XM_RXBody 1220 0.29 0.78 0.09 174 XM_S_JOY_D 1204 0.36 0.77 0.19 175 T_Symld_Words_02 1198 0.47 0.76 0.35 176 HTML_TAG_BALANCE_BODY 1194 0.44 0.76 0.31 177 XMMoneyMeta_00 1191 0.54 0.76 0.44 178 XMBody_78 1183 0.44 0.76 0.31 179 INVALID_DATE 1178 0.27 0.75 0.07 180 RDNS_DYNAMIC 1157 0.45 0.74 0.34 181 ADMITS_SPAM 1146 0.23 0.73 0.02 182 FILL_THIS_FORM 1132 0.53 0.72 0.45 183 LONG_JUNK_URI3 1131 0.23 0.72 0.03 184 HTML_FONT_FACE_BAD 1131 0.53 0.72 0.45 185 XM_H_PHPMailer 1127 0.71 0.72 0.70 186 XMClaimOffer 1090 0.35 0.70 0.20 187 BAYES_05 1086 1.46 0.69 1.78 188 XMHTMLBadTable_001 1084 0.39 0.69 0.27 189 TVD_SPACE_RATIO 1077 0.60 0.69 0.56 190 XMCapTrack 1068 1.49 0.68 1.82 191 XMSubNoVowel 1056 1.33 0.67 1.61 192 FORGED_YAHOO_RCVD 1018 0.22 0.65 0.04 193 FVGT_m_MULTI_ODD_EMAIL 1017 0.22 0.65 0.04 194 HTML_FONT_SIZE_HUGE 1014 0.24 0.65 0.08 195 SHORT_BUFFLY_IMG 1003 0.19 0.64 0.00 196 URI_BUFFLY 1003 0.19 0.64 0.00 197 FILL_THIS_FORM_LONG 998 0.44 0.64 0.36 198 XMSubMetaSSx_00 986 0.28 0.63 0.14 199 PLING_QUERY 971 0.30 0.62 0.17 200 BOUNCE_MESSAGE 959 2.18 0.61 2.82 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 292843 82.37 95.28 77.05 2 DCC_CHECK_NEGATIVE 267404 55.28 18.70 70.35 3 DKIM_SIGNED 230462 67.70 84.86 60.63 4 XM_DK_Pass 225460 66.04 82.36 59.32 5 BAYES_50 215176 48.70 29.51 56.61 6 DKIM_VALID 206910 61.12 77.34 54.44 7 DKIM_VALID_AU 143249 44.23 60.10 37.69 8 T_TM2_M_HEADER_IN_MSG 141458 32.34 20.49 37.22 9 XMListUnsubscribeExists 136360 46.44 72.07 35.88 10 XM_H_QuotedFrom 115550 37.23 53.82 30.40 11 ALL_TRUSTED 108632 20.98 2.52 28.58 12 DCC_CHECK 104148 42.45 78.98 27.40 13 DKIM_VALID_EF 87585 22.95 22.72 23.04 14 MultiRelay 75253 18.97 16.96 19.80 15 XMSubLong 72347 21.14 26.26 19.03 16 HTML_FONT_LOW_CONTRAST 71772 24.09 36.73 18.88 17 MIME_HTML_ONLY 63214 21.23 32.41 16.63 18 FVGT_m_MULTI_ODD 62580 19.33 26.30 16.46 19 LOC_TINY_FONT_1 55370 20.26 34.07 14.57 20 TooManyTo_001 47714 11.52 9.02 12.55 21 T_KAM_HTML_FONT_INVALID 46323 14.87 21.40 12.19 22 BAYES_99 43199 22.03 47.92 11.37 23 XM_DK_Undo_02 41247 22.69 51.42 10.85 24 BAYES_999 36183 18.72 41.05 9.52 25 XM_H_Long_From01 35828 8.89 7.58 9.43 26 XM_Body_Dirty_Words 35724 12.51 20.05 9.40 27 XM_Multi_Part_URI 32038 10.95 17.06 8.43 28 BAYES_00 28511 5.75 1.50 7.50 29 T_XMDrugObfuBody_14 27864 8.27 10.55 7.33 30 XM_DKIMWhitelistDomains 27550 5.15 0.06 7.25 31 LOTS_OF_MONEY 27018 8.29 11.17 7.11 32 XM_Evil_Numbers_Gen 25609 9.04 14.64 6.74 33 FSL_BULK_SIG 25274 8.46 12.87 6.65 34 BAYES_60 25191 6.46 6.05 6.63 35 RCVD_IN_RP_SAFE 24604 6.13 5.31 6.47 36 DKIM_INVALID 23552 6.58 7.53 6.20 37 LotsOfNums_01 23012 7.03 9.39 6.05 38 RCVD_IN_RP_CERTIFIED 22609 5.56 4.62 5.95 39 SUBJ_ALL_CAPS 22469 4.91 2.49 5.91 40 TooManyTo_002 22092 4.84 2.48 5.81 41 BAYES_40 21711 4.38 1.16 5.71 42 IN_ZIMBRA_NJ_WHITELIST 21512 4.02 0.04 5.66 43 RELAYCOUNTRY_META 20606 8.65 16.48 5.42 44 XM_PDF 19633 4.14 1.66 5.17 45 T_TooManySym_01 19368 4.64 3.54 5.10 46 HTML_IMAGE_RATIO_02 19165 8.03 15.27 5.04 47 RCVD_IN_IADB_LISTED 17843 3.97 2.20 4.69 48 RCVD_IN_MSPIKE_H2 17730 4.76 4.97 4.66 49 MIME_QP_LONG_LINE 17466 4.83 5.39 4.60 50 TR_DCC_Bayes_99 17408 14.14 37.34 4.58 51 XM_SendGrid 17264 4.46 4.24 4.54 52 TR_XM_DK_Bayes 16643 3.42 1.08 4.38 53 BAYES_80 16517 5.23 7.38 4.35 54 TooManyTo_003 15905 3.61 2.21 4.18 55 RCVD_IN_IADB_SPF 15760 3.51 1.98 4.15 56 TR_XM_DK_Bayes1 14592 3.01 1.00 3.84 57 T_REMOTE_IMAGE 14518 3.98 4.37 3.82 58 XM_B_Phish_Phrases 14211 5.22 8.81 3.74 59 XMStrtUSub 14178 3.74 3.75 3.73 60 XM_UncommonTLD01 14146 4.37 5.95 3.72 61 RCVD_IN_IADB_SENDERID 14051 3.17 1.88 3.70 62 RCVD_IN_IADB_DK 13714 3.10 1.85 3.61 63 HTML_IMAGE_RATIO_04 13142 4.86 8.25 3.46 64 XMSubMetaSx_00 12870 5.27 9.83 3.39 65 TR_XM_DocInvoice 12776 4.39 6.88 3.36 66 XMNumbers 12310 3.76 5.03 3.24 67 BOTNET_IPINHOSTNAME 12181 5.90 12.45 3.20 68 RCVD_IN_IADB_VOUCHED 11921 2.51 0.98 3.14 69 MAILING_LIST_MULTI 11826 2.85 2.22 3.11 70 BAYES_95 11744 3.52 4.57 3.09 71 TooManyTo_004 11662 2.72 1.86 3.07 72 TR_XM_DK_Bayes2 11371 2.40 0.97 2.99 73 XMSexyCombo_05 10807 5.48 11.88 2.84 74 ANY_BOUNCE_MESSAGE 10744 2.18 0.61 2.83 75 BOUNCE_MESSAGE 10730 2.18 0.61 2.82 76 BAYES_20 10313 2.22 1.03 2.71 77 HTML_IMAGE_RATIO_06 10026 3.19 4.53 2.64 78 HELO_NODOT 9984 1.98 0.39 2.63 79 UNPARSEABLE_RELAY 9614 2.24 1.53 2.53 80 MPART_ALT_DIFF 9490 3.68 6.56 2.50 81 XMDiploma_00 9195 2.40 2.34 2.42 82 TR_Symld_Words 9075 1.99 1.02 2.39 83 FROM_EXCESS_BASE64 8877 3.66 6.87 2.34 84 TVD_RCVD_IP 8743 1.73 0.33 2.30 85 HTML_MIME_NO_HTML_TAG 8716 2.54 3.13 2.29 86 TooManyTo_005 8605 2.07 1.59 2.26 87 XM_SPF_SoftFail 7927 2.56 3.72 2.09 88 IN_HORDE_ADDRESS_BOOK 7909 1.50 0.08 2.08 89 T_TooManySym_02 7544 1.73 1.11 1.98 90 XM_DK_Undo_01 7542 1.89 1.66 1.98 91 RCVD_IN_IADB_OPTIN 7483 1.57 0.60 1.97 92 RCVD_IN_MSPIKE_WL 7471 1.79 1.36 1.97 93 RCVD_IN_MSPIKE_H3 7470 1.79 1.36 1.97 94 MIME_HTML_MOSTLY 7223 2.67 4.52 1.90 95 XMGenDplmaNmb 7172 1.84 1.71 1.89 96 TO_MALFORMED 7153 1.35 0.07 1.88 97 XMCapTrack 6935 1.49 0.68 1.82 98 NO_DNS_FOR_FROM 6932 2.04 2.58 1.82 99 INVALID_MSGID 6890 1.32 0.14 1.81 100 BAYES_05 6776 1.46 0.69 1.78 101 MSGID_NOFQDN1 6563 1.23 0.02 1.73 102 TM2_M_URI_OPT_OUT 6283 2.85 5.75 1.65 103 XMSubNoVowel 6107 1.33 0.67 1.61 104 HTML_IMAGE_RATIO_08 5740 2.18 3.79 1.51 105 XM_DIRTYINTL 5697 2.19 3.88 1.50 106 XM_CamelCaseFrm001 5540 1.99 3.29 1.46 107 XM_GoogleGroups 5426 1.17 0.54 1.43 108 XM_OfRef6 5279 1.83 2.91 1.39 109 XMSubEmpty 5258 1.11 0.45 1.38 110 XMNoVowels 5155 1.20 0.80 1.36 111 T_XMDrugObfuBody_08 5129 1.86 3.08 1.35 112 RELAYCOUNTRY_CA 4984 1.84 3.13 1.31 113 UNTRUSTED_Relay 4774 3.87 10.21 1.26 114 MIME_HTML_ONLY_MULTI 4684 1.85 3.36 1.23 115 BOTNET 4658 4.94 13.95 1.23 116 XM_H_PHPOS 4347 1.08 0.93 1.14 117 XMPhish11 4126 1.12 1.21 1.09 118 DKIM_ADSP_CUSTOM_MED 4067 1.25 1.70 1.07 119 T_XMDrugObfuBody_00 4037 1.16 1.38 1.06 120 XMStockSpam_06 3999 1.16 1.44 1.05 121 RELAYCOUNTRY_GB 3859 1.04 1.10 1.02 122 USER_IN_DEF_DKIM_WL 3662 0.69 0.01 0.96 123 URI_HEX 3657 1.55 2.96 0.96 124 T_XMHurry_00 3622 1.12 1.51 0.95 125 XM_ProductURIs 3530 1.24 1.98 0.93 126 TR_MetaPhish_Combo_01 3407 0.78 0.51 0.90 127 XM_ShortIntro_01 3256 0.76 0.51 0.86 128 T_FILL_THIS_FORM_SHORT 3236 0.99 1.34 0.85 129 XM_UB50 3200 1.91 4.51 0.84 130 T_TooManySym_03 3161 0.63 0.13 0.83 131 URI_TRY_3LD 3149 0.95 1.26 0.83 132 XM_H_Long_From02 3111 1.12 1.84 0.82 133 SpammyFromTLD_01 2928 0.95 1.37 0.77 134 RELAYCOUNTRY_NL 2859 0.71 0.59 0.75 135 MISSING_HEADERS 2769 0.62 0.37 0.73 136 TM2_M_VERY_LONG_WORD 2768 1.02 1.72 0.73 137 NML_ADSP_CUSTOM_MED 2751 0.93 1.43 0.72 138 XM_H_PHPMailer 2678 0.71 0.72 0.70 139 USER_IN_WHITELIST 2605 0.49 0.00 0.69 140 SHORT_HELO_AND_INLINE_IMAGE 2602 0.52 0.12 0.68 141 T_OBFU_PDF_ATTACH 2409 0.52 0.24 0.63 142 XMLKML 2329 0.43 0.00 0.61 143 XMBdyGiftCard01 2306 1.13 2.41 0.61 144 TR_Mismatch_TLD_01 2268 0.55 0.45 0.60 145 LOW_PRICE 2238 0.58 0.55 0.59 146 RCVD_IN_SORBS_DUL 2160 0.47 0.24 0.57 147 RELAYCOUNTRY_DE 2151 0.71 1.06 0.57 148 TVD_SPACE_RATIO 2127 0.60 0.69 0.56 149 XMGappySubj_01 2072 0.52 0.45 0.55 150 URI_NOVOWEL 2003 0.61 0.82 0.53 151 T_MANY_PILL_PRICE 1964 0.37 0.00 0.52 152 XMSubMetaI_00 1955 0.93 1.93 0.51 153 HTML_IMAGE_ONLY_32 1920 0.42 0.23 0.51 154 URIBL_DBL_ABUSE_SPAM 1888 0.48 0.45 0.50 155 FORGED_GMAIL_RCVD 1879 0.63 0.95 0.49 156 HTML_IMAGE_ONLY_28 1867 0.52 0.61 0.49 157 XMDateMe_00 1828 0.47 0.45 0.48 158 XMBrknScrpt_02 1805 0.59 0.87 0.47 159 XM_B_COPY_HTML 1742 0.60 0.96 0.46 160 FILL_THIS_FORM 1729 0.53 0.72 0.45 161 TM2_M_BODY_EMPTY 1729 0.39 0.22 0.45 162 HTML_FONT_FACE_BAD 1715 0.53 0.72 0.45 163 TR_XM_RelayPhish 1707 0.81 1.67 0.45 164 XMMoneyMeta_00 1691 0.54 0.76 0.44 165 HTTPS_HTTP_MISMATCH 1691 0.59 0.96 0.44 166 RCVD_IN_BL_SPAMCOP_NET 1611 1.02 2.46 0.42 167 AC_DIV_BONANZA 1606 0.34 0.13 0.42 168 XMBody_95 1603 0.35 0.18 0.42 169 HTML_IMAGE_ONLY_24 1601 0.39 0.32 0.42 170 T_TooManySym_04 1580 0.30 0.02 0.42 171 MPART_ALT_DIFF_COUNT 1515 0.56 0.96 0.40 172 PP_MIME_FAKE_ASCII_TEXT 1452 0.42 0.51 0.38 173 XM_B_TRADE_HTML 1405 0.43 0.58 0.37 174 XMRcvdHeader_15 1382 0.26 0.00 0.36 175 XMSubMetaSxObfu_02 1376 0.31 0.20 0.36 176 FILL_THIS_FORM_LONG 1351 0.44 0.64 0.36 177 DKIM_ADSP_NXDOMAIN 1340 0.35 0.34 0.35 178 T_Symld_Words_02 1339 0.47 0.76 0.35 179 HTML_IMAGE_ONLY_20 1339 0.34 0.30 0.35 180 XMBody_17 1324 1.03 2.67 0.35 181 RELAYCOUNTRY_AU 1286 0.41 0.60 0.34 182 RDNS_DYNAMIC 1284 0.45 0.74 0.34 183 XM_B_REG_HTML 1281 0.61 1.28 0.34 184 XMLngstWrd_00 1257 0.34 0.38 0.33 185 XMHTML_After_End 1246 0.80 1.93 0.33 186 XMEmptySub 1201 0.26 0.14 0.32 187 HTML_TAG_BALANCE_BODY 1189 0.44 0.76 0.31 188 XMBody_78 1175 0.44 0.76 0.31 189 XMSolicitRefs_0 1168 0.31 0.30 0.31 190 T_FILL_THIS_FORM_LOAN 1162 0.39 0.58 0.31 191 GMD_PDF_EMPTY_BODY 1159 0.24 0.08 0.30 192 XMSexyCombo_01 1155 1.21 3.40 0.30 193 XMPhish14 1155 0.50 0.97 0.30 194 DOS_OUTLOOK_TO_MX 1136 0.25 0.14 0.30 195 XMLngstWrd_01 1129 0.31 0.34 0.30 196 XMPhish30 1124 0.64 1.48 0.30 197 XM_H_PHPOS_M 1124 0.32 0.38 0.30 198 XM_H_Undi_Recip 1103 0.27 0.23 0.29 199 XMSlimDrugH 1094 0.47 0.90 0.29 200 HTML_IMAGE_ONLY_16 1090 0.28 0.27 0.29 ----------------------------------------------------------------------