Email: 607364 Autolearn: 0 AvgScore: 3.54 AvgScanTime: 3.95 sec Spam: 175596 Autolearn: 0 AvgScore: 12.47 AvgScanTime: 4.84 sec Ham: 431768 Autolearn: 0 AvgScore: -0.09 AvgScanTime: 3.58 sec Time Spent Running SA: 665.67 hours Time Spent Processing Spam: 235.85 hours Time Spent Processing Ham: 429.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164730 82.28 93.81 77.58 2 DKIM_SIGNED 145432 64.86 82.82 57.55 3 XM_DK_Pass 141224 63.24 80.43 56.25 4 DCC_CHECK 137728 43.42 78.43 29.17 5 DKIM_VALID 134382 59.95 76.53 53.20 6 XMListUnsubscribeExists 124625 45.98 70.97 35.81 7 DKIM_VALID_AU 102528 43.28 58.39 37.13 8 XM_H_QuotedFrom 99571 39.94 56.70 33.12 9 XM_DK_Undo_02 82155 20.90 46.79 10.38 10 BAYES_99 76525 19.68 43.58 9.96 11 BAYES_999 64592 16.86 36.78 8.76 12 HTML_FONT_LOW_CONTRAST 62266 24.03 35.46 19.38 13 TR_DCC_Bayes_99 60455 13.33 34.43 4.75 14 LOC_TINY_FONT_1 58590 19.85 33.37 14.35 15 BAYES_50 56675 52.11 32.28 60.18 16 MIME_HTML_ONLY 50516 19.21 28.77 15.32 17 XMSubLong 46260 19.77 26.34 17.10 18 FVGT_m_MULTI_ODD 46094 19.38 26.25 16.59 19 DKIM_VALID_EF 43620 22.60 24.84 21.68 20 T_TM2_M_HEADER_IN_MSG 38010 32.40 21.65 36.77 21 T_KAM_HTML_FONT_INVALID 37041 14.86 21.09 12.32 22 DCC_CHECK_NEGATIVE 34567 54.53 19.69 68.70 23 XM_Body_Dirty_Words 33152 11.67 18.88 8.74 24 RELAYCOUNTRY_META 29328 8.16 16.70 4.68 25 MultiRelay 29107 16.98 16.58 17.14 26 XM_Multi_Part_URI 27987 10.61 15.94 8.45 27 HTML_IMAGE_RATIO_02 26525 8.04 15.11 5.17 28 XM_Evil_Numbers_Gen 24925 8.41 14.19 6.06 29 FSL_BULK_SIG 24715 9.39 14.07 7.49 30 LOTS_OF_MONEY 21220 10.11 12.08 9.31 31 BOTNET_IPINHOSTNAME 20630 5.47 11.75 2.91 32 BOTNET 19640 3.80 11.18 0.79 33 T_XMDrugObfuBody_14 16690 7.25 9.50 6.33 34 XM_B_Phish_Phrases 16620 5.62 9.46 4.05 35 XMSexyCombo_05 16086 4.16 9.16 2.12 36 UNTRUSTED_Relay 15994 3.55 9.11 1.29 37 HTML_IMAGE_RATIO_04 15061 4.87 8.58 3.36 38 LotsOfNums_01 14778 6.71 8.42 6.02 39 TR_XM_DocInvoice 14527 4.76 8.27 3.34 40 BAYES_80 14229 5.19 8.10 4.01 41 TooManyTo_001 14110 9.62 8.04 10.26 42 XM_H_Long_From01 13703 8.66 7.80 9.00 43 XM_UncommonTLD01 12642 4.43 7.20 3.31 44 BAYES_60 12274 6.89 6.99 6.85 45 XMSubMetaSx_00 11595 4.19 6.60 3.21 46 DKIM_INVALID 11050 4.91 6.29 4.35 47 MPART_ALT_DIFF 10966 3.53 6.25 2.43 48 FROM_EXCESS_BASE64 10906 3.84 6.21 2.87 49 XM_SPF_SoftFail 10292 5.01 5.86 4.66 50 ALL_TRUSTED 9932 24.79 5.66 32.58 51 RCVD_IN_RP_SAFE 8784 6.29 5.00 6.81 52 TM2_M_URI_OPT_OUT 8559 2.56 4.87 1.62 53 HTML_IMAGE_RATIO_06 8225 3.11 4.68 2.47 54 MIME_QP_LONG_LINE 8129 4.51 4.63 4.47 55 BAYES_95 8036 3.13 4.58 2.54 56 XMNumbers 7836 3.74 4.46 3.45 57 MIME_HTML_MOSTLY 7596 2.64 4.33 1.95 58 XMStrtUSub 7575 3.52 4.31 3.19 59 XM_SendGrid 7372 4.14 4.20 4.11 60 XM_UB50 7203 1.79 4.10 0.85 61 RCVD_IN_RP_CERTIFIED 7093 5.59 4.04 6.22 62 T_REMOTE_IMAGE 6748 3.92 3.84 3.95 63 RELAYCOUNTRY_CA 6723 1.99 3.83 1.25 64 XM_CamelCaseFrm001 6580 2.12 3.75 1.46 65 T_TooManySym_01 6232 3.71 3.55 3.77 66 XM_DIRTYINTL 6100 2.04 3.47 1.46 67 HTML_IMAGE_RATIO_08 5978 2.17 3.40 1.67 68 RCVD_IN_BL_SPAMCOP_NET 5917 1.33 3.37 0.50 69 RCVD_IN_MSPIKE_H2 5838 3.24 3.32 3.20 70 URI_HEX 5656 1.79 3.22 1.21 71 SpammyFromTLD_01 5268 1.51 3.00 0.90 72 MIME_HTML_ONLY_MULTI 5159 1.63 2.94 1.10 73 XMSubNoVowel 4846 2.19 2.76 1.95 74 MultiRelay_Combo 4631 0.92 2.64 0.22 75 MultiRelay_CC 4631 0.92 2.64 0.22 76 SUBJ_ALL_CAPS 4607 5.09 2.62 6.10 77 XM_OfRef6 4529 1.63 2.58 1.24 78 TR_Mismatch_TLD_01 4274 1.04 2.43 0.47 79 T_XMDrugObfuBody_08 4059 1.63 2.31 1.35 80 RCVD_IN_IADB_LISTED 3966 4.14 2.26 4.91 81 TooManyTo_002 3856 3.72 2.20 4.34 82 HTML_MIME_NO_HTML_TAG 3726 2.35 2.12 2.45 83 TR_XM_RelayPhish 3628 0.93 2.07 0.46 84 RCVD_IN_IADB_SPF 3598 3.61 2.05 4.24 85 XMSubEmpty 3575 1.79 2.04 1.69 86 XMDiploma_00 3562 1.64 2.03 1.48 87 XM_URI_RBL 3526 0.65 2.01 0.09 88 TooManyTo_003 3451 2.77 1.97 3.10 89 XMSubMetaI_00 3448 1.03 1.96 0.65 90 TM2_M_VERY_LONG_WORD 3448 1.06 1.96 0.70 91 RCVD_IN_IADB_SENDERID 3443 3.20 1.96 3.70 92 RCVD_IN_IADB_DK 3413 3.10 1.94 3.57 93 RCVD_IN_RP_RNBL 3410 0.61 1.94 0.07 94 XMPhish11 3363 1.43 1.92 1.23 95 SpammyFromTLD_02 3325 0.74 1.89 0.27 96 UNPARSEABLE_RELAY 3166 2.04 1.80 2.14 97 XM_UB99 3154 0.56 1.80 0.06 98 XM_DK_Undo_01 3125 1.78 1.78 1.78 99 XMSexyCombo_01 3092 0.87 1.76 0.51 100 XMBody_17 3086 0.72 1.76 0.30 101 DKIM_ADSP_CUSTOM_MED 3031 1.21 1.73 1.00 102 T_XMDrugObfuBody_00 3020 0.85 1.72 0.50 103 URIBL_BLACK 2990 0.52 1.70 0.03 104 MAILING_LIST_MULTI 2883 2.07 1.64 2.25 105 TooManyTo_004 2829 2.09 1.61 2.28 106 URIBL_DBL_SPAM 2790 0.50 1.59 0.06 107 RELAYCOUNTRY_FR 2737 0.60 1.56 0.21 108 T_XMHurry_00 2728 3.00 1.55 3.58 109 FORGED_GMAIL_RCVD 2709 0.80 1.54 0.50 110 XM_H_PHPOS 2706 1.72 1.54 1.79 111 SHORT_URI_2 2682 0.76 1.53 0.45 112 NML_ADSP_CUSTOM_MED 2653 0.94 1.51 0.71 113 XMHTML_After_End 2594 0.63 1.48 0.29 114 XMPhish30 2542 0.65 1.45 0.33 115 NO_DNS_FOR_FROM 2518 0.85 1.43 0.61 116 T_FILL_THIS_FORM_SHORT 2504 2.06 1.43 2.32 117 XMGenDplmaNmb 2449 1.06 1.39 0.93 118 BOTNET_NORDNS 2424 0.42 1.38 0.02 119 RELAYCOUNTRY_GB 2418 1.08 1.38 0.96 120 BAYES_40 2410 4.17 1.37 5.30 121 FSL_THIS_IS_ADV 2397 0.44 1.37 0.07 122 XM_UB999 2375 0.41 1.35 0.03 123 XMStockSpam_06 2339 0.77 1.33 0.54 124 XM_ProductURIs 2318 0.95 1.32 0.80 125 RCVD_IN_PSBL 2252 0.43 1.28 0.09 126 TooManyTo_005 2246 1.57 1.28 1.69 127 BAYES_00 2203 5.31 1.25 6.96 128 XM_H_Long_From02 2193 0.85 1.25 0.69 129 XM_BadFromFormat 2193 0.50 1.25 0.20 130 RELAYCOUNTRY_AT 2144 0.47 1.22 0.17 131 XMBdyGiftCard01 2120 0.60 1.21 0.35 132 TR_MetaPhish_Combo_01 2051 0.81 1.17 0.67 133 XM_UB60 2048 0.41 1.17 0.10 134 XMPhish14 1989 0.62 1.13 0.41 135 SUBJ_DOLLARS 1945 0.40 1.11 0.11 136 T_MONEY_PERCENT 1942 0.51 1.11 0.27 137 TR_LOTS_OF_MONEY2 1942 0.51 1.11 0.27 138 BAYES_20 1935 2.07 1.10 2.47 139 MPART_ALT_DIFF_COUNT 1933 0.49 1.10 0.24 140 T_Symld_Words_02 1923 0.60 1.10 0.39 141 T_TooManySym_02 1890 1.36 1.08 1.48 142 RCVD_IN_MSPIKE_H3 1824 2.22 1.04 2.70 143 RCVD_IN_MSPIKE_WL 1824 2.22 1.04 2.70 144 XM_B_REG_HTML 1824 0.60 1.04 0.42 145 HTTPS_HTTP_MISMATCH 1808 0.63 1.03 0.47 146 HTML_IMAGE_ONLY_28 1806 0.60 1.03 0.43 147 RELAYCOUNTRY_CN 1795 0.34 1.02 0.06 148 TR_XM_DK_Bayes 1794 3.19 1.02 4.08 149 XMBrknScrpt_02 1768 0.53 1.01 0.34 150 XMBody_78 1721 0.55 0.98 0.37 151 TR_XM_DK_Bayes1 1721 2.92 0.98 3.71 152 XMLongAddy 1714 0.34 0.98 0.09 153 XM_HighProb1 1697 0.28 0.97 0.01 154 TR_Caps_n_Bayes_99 1697 0.35 0.97 0.10 155 TR_Symld_Words 1686 1.74 0.96 2.06 156 URI_TRY_3LD 1671 0.90 0.95 0.89 157 TR_XM_DK_Bayes2 1647 2.32 0.94 2.88 158 FILL_THIS_FORM 1592 0.52 0.91 0.36 159 URI_NOVOWEL 1567 0.53 0.89 0.38 160 REMOVE_BEFORE_LINK 1560 0.42 0.89 0.24 161 XMHTMLBadTable_001 1538 0.60 0.88 0.48 162 XM_B_COPY_HTML 1531 0.58 0.87 0.45 163 RDNS_DYNAMIC 1525 0.52 0.87 0.38 164 XM_UB80 1511 0.27 0.86 0.03 165 BODY_URI_ONLY 1496 0.28 0.85 0.04 166 XMMoneyMeta_00 1489 0.71 0.85 0.65 167 XMNoVowels 1486 0.89 0.85 0.91 168 BOUNCE_MESSAGE 1483 4.01 0.84 5.30 169 ANY_BOUNCE_MESSAGE 1483 4.01 0.84 5.30 170 PLING_QUERY 1479 0.42 0.84 0.25 171 TR_Mismatch_TLD_02 1472 0.28 0.84 0.05 172 XMEmptySub 1457 0.52 0.83 0.39 173 DIET_1 1456 0.40 0.83 0.22 174 FILL_THIS_FORM_LONG 1453 0.44 0.83 0.29 175 HTML_FONT_FACE_BAD 1434 0.50 0.82 0.37 176 XM_PDF 1430 3.71 0.81 4.89 177 RCVD_IN_IADB_VOUCHED 1424 2.61 0.81 3.34 178 MISSING_HEADERS 1423 0.64 0.81 0.57 179 TM2_M_A_HREF_HREF 1406 0.45 0.80 0.31 180 RELAYCOUNTRY_DE 1396 0.67 0.80 0.63 181 SHORT_URI 1376 0.43 0.78 0.28 182 HTML_IMAGE_ONLY_08 1359 0.30 0.77 0.11 183 RELAYCOUNTRY_IT 1358 0.25 0.77 0.03 184 TR_LOTS_OF_MONEY3 1354 0.33 0.77 0.15 185 TVD_SPACE_RATIO 1332 0.70 0.76 0.67 186 XMLngstWrd_00 1324 0.50 0.75 0.40 187 HTML_SHORT_LINK_IMG_1 1300 0.23 0.74 0.02 188 XMSlimDrugH 1296 0.38 0.74 0.24 189 RELAYCOUNTRY_NL 1274 0.33 0.73 0.18 190 RELAYCOUNTRY_AU 1271 0.48 0.72 0.38 191 DATE_IN_PAST_12_24 1258 0.23 0.72 0.03 192 HTML_TAG_BALANCE_BODY 1256 0.50 0.72 0.42 193 XMLngstWrd_01 1255 0.46 0.71 0.36 194 XM_S_JOY_D 1255 0.34 0.71 0.19 195 FORGED_MUA_OUTLOOK 1253 0.22 0.71 0.03 196 BAYES_05 1201 1.37 0.68 1.65 197 XM_Body_Obfu01 1194 0.37 0.68 0.24 198 XM_H_Long_From03 1187 0.26 0.68 0.09 199 PP_MIME_FAKE_ASCII_TEXT 1180 0.42 0.67 0.32 200 LongTLD 1177 0.28 0.67 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 334981 82.28 93.81 77.58 2 DCC_CHECK_NEGATIVE 296639 54.53 19.69 68.70 3 BAYES_50 259827 52.11 32.28 60.18 4 DKIM_SIGNED 248488 64.86 82.82 57.55 5 XM_DK_Pass 242872 63.24 80.43 56.25 6 DKIM_VALID 229716 59.95 76.53 53.20 7 DKIM_VALID_AU 160314 43.28 58.39 37.13 8 T_TM2_M_HEADER_IN_MSG 158778 32.40 21.65 36.77 9 XMListUnsubscribeExists 154629 45.98 70.97 35.81 10 XM_H_QuotedFrom 142996 39.94 56.70 33.12 11 ALL_TRUSTED 140663 24.79 5.66 32.58 12 DCC_CHECK 125966 43.42 78.43 29.17 13 DKIM_VALID_EF 93621 22.60 24.84 21.68 14 HTML_FONT_LOW_CONTRAST 83676 24.03 35.46 19.38 15 MultiRelay 74022 16.98 16.58 17.14 16 XMSubLong 73830 19.77 26.34 17.10 17 FVGT_m_MULTI_ODD 71618 19.38 26.25 16.59 18 MIME_HTML_ONLY 66166 19.21 28.77 15.32 19 LOC_TINY_FONT_1 61977 19.85 33.37 14.35 20 T_KAM_HTML_FONT_INVALID 53205 14.86 21.09 12.32 21 XM_DK_Undo_02 44806 20.90 46.79 10.38 22 TooManyTo_001 44290 9.62 8.04 10.26 23 BAYES_99 43025 19.68 43.58 9.96 24 LOTS_OF_MONEY 40181 10.11 12.08 9.31 25 XM_H_Long_From01 38875 8.66 7.80 9.00 26 BAYES_999 37818 16.86 36.78 8.76 27 XM_Body_Dirty_Words 37752 11.67 18.88 8.74 28 XM_Multi_Part_URI 36473 10.61 15.94 8.45 29 FSL_BULK_SIG 32322 9.39 14.07 7.49 30 BAYES_00 30070 5.31 1.25 6.96 31 BAYES_60 29596 6.89 6.99 6.85 32 RCVD_IN_RP_SAFE 29403 6.29 5.00 6.81 33 XM_DKIMWhitelistDomains 27570 4.57 0.11 6.39 34 T_XMDrugObfuBody_14 27320 7.25 9.50 6.33 35 RCVD_IN_RP_CERTIFIED 26854 5.59 4.04 6.22 36 SUBJ_ALL_CAPS 26330 5.09 2.62 6.10 37 XM_Evil_Numbers_Gen 26149 8.41 14.19 6.06 38 LotsOfNums_01 25980 6.71 8.42 6.02 39 IN_ZIMBRA_NJ_WHITELIST 23005 3.80 0.04 5.33 40 BAYES_40 22892 4.17 1.37 5.30 41 ANY_BOUNCE_MESSAGE 22880 4.01 0.84 5.30 42 BOUNCE_MESSAGE 22877 4.01 0.84 5.30 43 HTML_IMAGE_RATIO_02 22328 8.04 15.11 5.17 44 RCVD_IN_IADB_LISTED 21205 4.14 2.26 4.91 45 XM_PDF 21119 3.71 0.81 4.89 46 TR_DCC_Bayes_99 20494 13.33 34.43 4.75 47 RELAYCOUNTRY_META 20220 8.16 16.70 4.68 48 XM_SPF_SoftFail 20132 5.01 5.86 4.66 49 MIME_QP_LONG_LINE 19280 4.51 4.63 4.47 50 DKIM_INVALID 18772 4.91 6.29 4.35 51 TooManyTo_002 18747 3.72 2.20 4.34 52 RCVD_IN_IADB_SPF 18314 3.61 2.05 4.24 53 XM_SendGrid 17756 4.14 4.20 4.11 54 TR_XM_DK_Bayes 17605 3.19 1.02 4.08 55 XM_B_Phish_Phrases 17494 5.62 9.46 4.05 56 BAYES_80 17306 5.19 8.10 4.01 57 T_REMOTE_IMAGE 17046 3.92 3.84 3.95 58 T_TooManySym_01 16274 3.71 3.55 3.77 59 TR_XM_DK_Bayes1 16028 2.92 0.98 3.71 60 RCVD_IN_IADB_SENDERID 15992 3.20 1.96 3.70 61 T_XMHurry_00 15469 3.00 1.55 3.58 62 RCVD_IN_IADB_DK 15431 3.10 1.94 3.57 63 XMNumbers 14879 3.74 4.46 3.45 64 HTML_IMAGE_RATIO_04 14506 4.87 8.58 3.36 65 RCVD_IN_IADB_VOUCHED 14435 2.61 0.81 3.34 66 TR_XM_DocInvoice 14402 4.76 8.27 3.34 67 XM_UncommonTLD01 14289 4.43 7.20 3.31 68 XMSubMetaSx_00 13852 4.19 6.60 3.21 69 RCVD_IN_MSPIKE_H2 13825 3.24 3.32 3.20 70 XMStrtUSub 13774 3.52 4.31 3.19 71 TooManyTo_003 13395 2.77 1.97 3.10 72 BOTNET_IPINHOSTNAME 12575 5.47 11.75 2.91 73 TR_XM_DK_Bayes2 12422 2.32 0.94 2.88 74 FROM_EXCESS_BASE64 12389 3.84 6.21 2.87 75 RCVD_IN_MSPIKE_H3 11663 2.22 1.04 2.70 76 RCVD_IN_MSPIKE_WL 11663 2.22 1.04 2.70 77 BAYES_95 10981 3.13 4.58 2.54 78 HTML_IMAGE_RATIO_06 10675 3.11 4.68 2.47 79 BAYES_20 10665 2.07 1.10 2.47 80 HTML_MIME_NO_HTML_TAG 10577 2.35 2.12 2.45 81 MPART_ALT_DIFF 10476 3.53 6.25 2.43 82 T_FILL_THIS_FORM_SHORT 10036 2.06 1.43 2.32 83 HELO_NODOT 9902 1.73 0.35 2.29 84 TooManyTo_004 9838 2.09 1.61 2.28 85 MAILING_LIST_MULTI 9717 2.07 1.64 2.25 86 RCVD_IN_IADB_OPTIN 9304 1.69 0.56 2.15 87 UNPARSEABLE_RELAY 9250 2.04 1.80 2.14 88 XMSexyCombo_05 9155 4.16 9.16 2.12 89 TR_Symld_Words 8901 1.74 0.96 2.06 90 MIME_HTML_MOSTLY 8439 2.64 4.33 1.95 91 XMSubNoVowel 8435 2.19 2.76 1.95 92 TVD_RCVD_IP 8369 1.45 0.24 1.94 93 IN_HORDE_ADDRESS_BOOK 7998 1.34 0.08 1.85 94 XM_H_PHPOS 7743 1.72 1.54 1.79 95 XM_DK_Undo_01 7668 1.78 1.78 1.78 96 XMSubEmpty 7309 1.79 2.04 1.69 97 TooManyTo_005 7291 1.57 1.28 1.69 98 HTML_IMAGE_RATIO_08 7192 2.17 3.40 1.67 99 BAYES_05 7112 1.37 0.68 1.65 100 TM2_M_URI_OPT_OUT 7014 2.56 4.87 1.62 101 XMCapTrack 6909 1.32 0.65 1.60 102 INVALID_MSGID 6882 1.19 0.20 1.59 103 MSGID_NOFQDN1 6564 1.08 0.01 1.52 104 TO_MALFORMED 6485 1.07 0.01 1.50 105 XMDiploma_00 6406 1.64 2.03 1.48 106 T_TooManySym_02 6372 1.36 1.08 1.48 107 XM_CamelCaseFrm001 6299 2.12 3.75 1.46 108 XM_DIRTYINTL 6285 2.04 3.47 1.46 109 MONEY_FORM_SHORT 5949 1.02 0.15 1.38 110 T_XMDrugObfuBody_08 5850 1.63 2.31 1.35 111 UNTRUSTED_Relay 5584 3.55 9.11 1.29 112 RELAYCOUNTRY_CA 5381 1.99 3.83 1.25 113 XM_OfRef6 5342 1.63 2.58 1.24 114 XMPhish11 5306 1.43 1.92 1.23 115 URI_HEX 5224 1.79 3.22 1.21 116 XM_GoogleGroups 5104 0.98 0.49 1.18 117 USER_IN_DEF_DKIM_WL 4831 0.81 0.06 1.12 118 MIME_HTML_ONLY_MULTI 4766 1.63 2.94 1.10 119 DKIM_ADSP_CUSTOM_MED 4322 1.21 1.73 1.00 120 RELAYCOUNTRY_GB 4129 1.08 1.38 0.96 121 XMGenDplmaNmb 4007 1.06 1.39 0.93 122 XMNoVowels 3945 0.89 0.85 0.91 123 SpammyFromTLD_01 3890 1.51 3.00 0.90 124 URI_TRY_3LD 3823 0.90 0.95 0.89 125 TO_NO_BRKTS_HTML_ONLY 3764 0.65 0.12 0.87 126 XM_UB50 3669 1.79 4.10 0.85 127 XMGappySubj_01 3457 0.76 0.65 0.80 128 XM_ProductURIs 3439 0.95 1.32 0.80 129 BOTNET 3416 3.80 11.18 0.79 130 T_OBFU_PDF_ATTACH 3116 0.57 0.21 0.72 131 NML_ADSP_CUSTOM_MED 3086 0.94 1.51 0.71 132 TM2_M_VERY_LONG_WORD 3013 1.06 1.96 0.70 133 XM_H_Long_From02 2979 0.85 1.25 0.69 134 XM_ShortIntro_01 2927 0.64 0.54 0.68 135 TVD_SPACE_RATIO 2913 0.70 0.76 0.67 136 USER_IN_WHITELIST 2898 0.48 0.00 0.67 137 TR_MetaPhish_Combo_01 2875 0.81 1.17 0.67 138 XMMoneyMeta_00 2813 0.71 0.85 0.65 139 XMSubMetaI_00 2793 1.03 1.96 0.65 140 XM_H_PHPMailer 2742 0.60 0.52 0.64 141 RELAYCOUNTRY_DE 2701 0.67 0.80 0.63 142 NO_DNS_FOR_FROM 2631 0.85 1.43 0.61 143 T_TooManySym_03 2592 0.53 0.34 0.60 144 SHORT_HELO_AND_INLINE_IMAGE 2492 0.44 0.09 0.58 145 RCVD_IN_SORBS_DUL 2484 0.48 0.26 0.58 146 MISSING_HEADERS 2450 0.64 0.81 0.57 147 XMStockSpam_06 2334 0.77 1.33 0.54 148 XMSexyCombo_01 2215 0.87 1.76 0.51 149 T_XMDrugObfuBody_00 2160 0.85 1.72 0.50 150 RCVD_IN_BL_SPAMCOP_NET 2147 1.33 3.37 0.50 151 FORGED_GMAIL_RCVD 2141 0.80 1.54 0.50 152 XMHTMLBadTable_001 2093 0.60 0.88 0.48 153 TR_Mismatch_TLD_01 2021 1.04 2.43 0.47 154 HTTPS_HTTP_MISMATCH 2020 0.63 1.03 0.47 155 TR_XM_RelayPhish 2000 0.93 2.07 0.46 156 XMDateMe_00 1985 0.42 0.32 0.46 157 HTML_IMAGE_ONLY_32 1969 0.39 0.22 0.46 158 XM_B_COPY_HTML 1963 0.58 0.87 0.45 159 SHORT_URI_2 1945 0.76 1.53 0.45 160 TM2_M_BODY_EMPTY 1906 0.41 0.32 0.44 161 HTML_IMAGE_ONLY_28 1849 0.60 1.03 0.43 162 XM_B_REG_HTML 1814 0.60 1.04 0.42 163 HTML_TAG_BALANCE_BODY 1793 0.50 0.72 0.42 164 XMPhish14 1752 0.62 1.13 0.41 165 AC_DIV_BONANZA 1723 0.35 0.22 0.40 166 XMLngstWrd_00 1715 0.50 0.75 0.40 167 T_Symld_Words_02 1702 0.60 1.10 0.39 168 XMEmptySub 1697 0.52 0.83 0.39 169 URI_NOVOWEL 1654 0.53 0.89 0.38 170 RELAYCOUNTRY_AU 1651 0.48 0.72 0.38 171 RDNS_DYNAMIC 1621 0.52 0.87 0.38 172 XMBody_78 1617 0.55 0.98 0.37 173 XMSubMetaSxObfu_02 1609 0.33 0.23 0.37 174 HTML_FONT_FACE_BAD 1604 0.50 0.82 0.37 175 URIBL_DBL_ABUSE_SPAM 1597 0.43 0.57 0.37 176 XMBody_95 1585 0.32 0.19 0.37 177 FILL_THIS_FORM 1567 0.52 0.91 0.36 178 XM_USANA_RCVD 1549 0.26 0.00 0.36 179 XMLngstWrd_01 1534 0.46 0.71 0.36 180 UPPERCASE_50_75 1504 0.28 0.12 0.35 181 XMBdyGiftCard01 1500 0.60 1.21 0.35 182 XMRcvdHeader_15 1487 0.24 0.00 0.34 183 XMBrknScrpt_02 1469 0.53 1.01 0.34 184 HTML_IMAGE_ONLY_20 1414 0.31 0.26 0.33 185 XMPhish30 1412 0.65 1.45 0.33 186 MY_SERVERS_FOUND 1411 0.31 0.26 0.33 187 XM_H_Trusted_IP 1406 0.23 0.00 0.33 188 PP_MIME_FAKE_ASCII_TEXT 1391 0.42 0.67 0.32 189 XM_B_TRADE_HTML 1379 0.32 0.33 0.32 190 HTML_IMAGE_ONLY_24 1367 0.33 0.35 0.32 191 GMD_PDF_EMPTY_BODY 1339 0.24 0.07 0.31 192 TM2_M_A_HREF_HREF 1327 0.45 0.80 0.31 193 XMBody_17 1314 0.72 1.76 0.30 194 DKIM_ADSP_NXDOMAIN 1289 0.36 0.51 0.30 195 T_TooManySym_04 1264 0.22 0.05 0.29 196 XMHTML_After_End 1247 0.63 1.48 0.29 197 FILL_THIS_FORM_LONG 1232 0.44 0.83 0.29 198 SHORT_URI 1215 0.43 0.78 0.28 199 XM_H_PHPOS_M 1205 0.28 0.29 0.28 200 XMSolicitRefs_0 1185 0.30 0.35 0.27 ----------------------------------------------------------------------