Email: 659097 Autolearn: 0 AvgScore: 1.63 AvgScanTime: 3.76 sec Spam: 170777 Autolearn: 0 AvgScore: 12.41 AvgScanTime: 4.56 sec Ham: 488320 Autolearn: 0 AvgScore: -2.14 AvgScanTime: 3.48 sec Time Spent Running SA: 688.57 hours Time Spent Processing Spam: 216.10 hours Time Spent Processing Ham: 472.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159726 87.33 93.53 85.16 2 DKIM_SIGNED 142515 58.88 83.45 50.29 3 XM_DK_Pass 137563 57.37 80.55 49.27 4 DCC_CHECK 134945 39.64 79.02 25.87 5 DKIM_VALID 132246 54.41 77.44 46.36 6 XMListUnsubscribeExists 120158 41.19 70.36 30.99 7 DKIM_VALID_AU 103441 40.59 60.57 33.61 8 XM_H_QuotedFrom 96575 50.23 56.55 48.02 9 XM_DK_Undo_02 78378 18.74 45.89 9.24 10 BAYES_99 71904 17.46 42.10 8.84 11 BAYES_999 61188 15.06 35.83 7.80 12 BAYES_50 60598 47.99 35.48 52.36 13 HTML_FONT_LOW_CONTRAST 58937 23.05 34.51 19.04 14 LOC_TINY_FONT_1 58348 18.70 34.17 13.30 15 TR_DCC_Bayes_99 56385 11.85 33.02 4.45 16 MIME_HTML_ONLY 48351 16.76 28.31 12.71 17 XMSubLong 47596 19.56 27.87 16.65 18 FVGT_m_MULTI_ODD 46038 17.46 26.96 14.14 19 DKIM_VALID_EF 40706 20.17 23.84 18.89 20 T_TM2_M_HEADER_IN_MSG 36798 29.85 21.55 32.76 21 T_KAM_HTML_FONT_INVALID 35378 12.70 20.72 9.89 22 XM_Body_Dirty_Words 32515 10.58 19.04 7.63 23 DCC_CHECK_NEGATIVE 32359 58.49 18.95 72.32 24 MultiRelay 29417 15.80 17.23 15.30 25 RELAYCOUNTRY_META 28559 7.31 16.72 4.02 26 XM_Multi_Part_URI 27867 9.38 16.32 6.96 27 FSL_BULK_SIG 27639 9.17 16.18 6.72 28 HTML_IMAGE_RATIO_02 25581 7.01 14.98 4.22 29 XM_Evil_Numbers_Gen 23385 9.30 13.69 7.76 30 LOTS_OF_MONEY 21218 7.93 12.42 6.36 31 BOTNET_IPINHOSTNAME 20943 5.15 12.26 2.66 32 BOTNET 18831 3.41 11.03 0.74 33 UNTRUSTED_Relay 17176 3.38 10.06 1.04 34 HTML_IMAGE_RATIO_04 15894 16.51 9.31 19.02 35 XMSexyCombo_05 15804 3.96 9.25 2.10 36 XM_B_Phish_Phrases 15739 5.27 9.22 3.88 37 T_XMDrugObfuBody_14 15713 6.82 9.20 5.99 38 LotsOfNums_01 14435 6.10 8.45 5.28 39 XM_H_Long_From01 14183 8.02 8.30 7.92 40 XM_UncommonTLD01 13902 4.61 8.14 3.38 41 TR_XM_DocInvoice 12980 4.06 7.60 2.83 42 TooManyTo_001 12658 6.81 7.41 6.59 43 BAYES_80 12653 3.99 7.41 2.80 44 FROM_EXCESS_BASE64 12196 3.51 7.14 2.24 45 XMSubMetaSx_00 11793 3.74 6.91 2.63 46 BAYES_60 11595 5.39 6.79 4.90 47 MPART_ALT_DIFF 10959 3.38 6.42 2.32 48 XMNumbers 10871 3.89 6.37 3.03 49 DKIM_INVALID 10269 4.48 6.01 3.94 50 ALL_TRUSTED 8577 18.62 5.02 23.37 51 XM_SPF_SoftFail 8096 2.46 4.74 1.66 52 TM2_M_URI_OPT_OUT 7846 2.18 4.59 1.34 53 XM_UB50 7805 1.70 4.57 0.69 54 RCVD_IN_RP_SAFE 7527 5.88 4.41 6.40 55 BAYES_95 7399 2.51 4.33 1.87 56 XMStrtUSub 7285 10.60 4.27 12.82 57 HTML_IMAGE_RATIO_06 7264 4.41 4.25 4.47 58 MIME_QP_LONG_LINE 7037 3.79 4.12 3.67 59 XM_SendGrid 7022 3.76 4.11 3.63 60 SpammyFromTLD_01 6518 1.83 3.82 1.14 61 XM_DIRTYINTL 6299 1.92 3.69 1.30 62 XM_OfRef6 6211 1.71 3.64 1.04 63 XMSubNoVowel 6042 6.43 3.54 7.43 64 T_REMOTE_IMAGE 6022 3.32 3.53 3.24 65 RCVD_IN_RP_CERTIFIED 5934 5.20 3.47 5.80 66 RELAYCOUNTRY_CA 5875 1.65 3.44 1.02 67 MIME_HTML_MOSTLY 5831 2.11 3.41 1.65 68 RCVD_IN_BL_SPAMCOP_NET 5644 1.17 3.30 0.43 69 XM_CamelCaseFrm001 5364 1.66 3.14 1.14 70 RCVD_IN_MSPIKE_H2 5252 2.92 3.08 2.86 71 URI_HEX 5134 1.46 3.01 0.92 72 MIME_HTML_ONLY_MULTI 5032 1.39 2.95 0.85 73 MultiRelay_Combo 4909 0.88 2.87 0.18 74 MultiRelay_CC 4909 0.88 2.87 0.18 75 TR_Mismatch_TLD_01 4906 1.09 2.87 0.47 76 HTML_IMAGE_RATIO_08 4826 1.83 2.83 1.48 77 XMSubEmpty 4770 1.97 2.79 1.69 78 T_TooManySym_01 4723 2.86 2.77 2.90 79 T_XMDrugObfuBody_08 4325 1.36 2.53 0.95 80 SUBJ_ALL_CAPS 4094 4.17 2.40 4.79 81 HTML_MIME_NO_HTML_TAG 3929 2.00 2.30 1.89 82 XMDiploma_00 3876 1.46 2.27 1.17 83 XM_URI_RBL 3846 0.65 2.25 0.09 84 XM_H_PHPOS 3688 1.77 2.16 1.63 85 RCVD_IN_IADB_LISTED 3568 3.26 2.09 3.67 86 RCVD_IN_RP_RNBL 3394 0.53 1.99 0.01 87 TM2_M_VERY_LONG_WORD 3386 0.97 1.98 0.62 88 SpammyFromTLD_02 3244 0.68 1.90 0.25 89 RCVD_IN_IADB_SPF 3222 2.86 1.89 3.20 90 UNPARSEABLE_RELAY 3203 1.92 1.88 1.94 91 URIBL_DBL_SPAM 3095 0.50 1.81 0.05 92 RCVD_IN_IADB_SENDERID 3065 2.57 1.79 2.84 93 XM_UB99 3054 0.48 1.79 0.02 94 RCVD_IN_IADB_DK 3040 2.51 1.78 2.76 95 URIBL_BLACK 3027 0.48 1.77 0.03 96 SHORT_URI_2 2936 0.74 1.72 0.39 97 MAILING_LIST_MULTI 2855 1.87 1.67 1.94 98 TM2_M_BODY_EMPTY 2842 0.92 1.66 0.66 99 BOTNET_NORDNS 2833 0.44 1.66 0.02 100 XM_H_Long_From02 2815 0.95 1.65 0.71 101 XMEmptyBody_01 2749 0.71 1.61 0.40 102 XMSubMetaI_00 2736 0.60 1.60 0.25 103 RELAYCOUNTRY_FR 2671 0.55 1.56 0.19 104 XMGenDplmaNmb 2642 0.92 1.55 0.70 105 XMSexyCombo_01 2609 0.60 1.53 0.28 106 XMHTML_After_End 2575 0.59 1.51 0.28 107 XM_DK_Undo_01 2566 1.55 1.50 1.57 108 FSL_THIS_IS_ADV 2538 0.42 1.49 0.04 109 RELAYCOUNTRY_IN 2493 0.44 1.46 0.09 110 XMBody_17 2454 0.60 1.44 0.31 111 XM_BadFromFormat 2413 0.48 1.41 0.15 112 XM_ProductURIs 2406 0.87 1.41 0.68 113 TR_XM_RelayPhish 2370 0.62 1.39 0.36 114 XM_UB999 2370 0.37 1.39 0.02 115 XMStockSpam_06 2279 1.12 1.33 1.04 116 MPART_ALT_DIFF_COUNT 2275 0.54 1.33 0.27 117 RCVD_IN_PSBL 2251 0.37 1.32 0.04 118 BAYES_40 2200 4.00 1.29 4.94 119 RELAYCOUNTRY_GB 2160 0.90 1.26 0.77 120 XMPhish30 2148 0.49 1.26 0.23 121 XM_UB60 2138 0.39 1.25 0.09 122 XMBdyGiftCard01 2115 0.62 1.24 0.41 123 T_XMHurry_00 2100 3.39 1.23 4.15 124 BAYES_00 2072 12.19 1.21 16.03 125 SUBJ_DOLLARS 2056 0.55 1.20 0.32 126 RCVD_IN_MSPIKE_H3 2050 1.69 1.20 1.87 127 RCVD_IN_MSPIKE_WL 2050 1.69 1.20 1.87 128 T_FILL_THIS_FORM_SHORT 2016 1.07 1.18 1.03 129 T_XMDrugObfuBody_00 2016 0.77 1.18 0.62 130 URI_TRY_3LD 2005 0.88 1.17 0.77 131 T_MONEY_PERCENT 2002 0.61 1.17 0.41 132 TR_LOTS_OF_MONEY2 2002 0.61 1.17 0.41 133 XM_HighProb1 1986 0.32 1.16 0.02 134 DKIM_ADSP_CUSTOM_MED 1981 0.90 1.16 0.81 135 XMPhish11 1963 1.05 1.15 1.01 136 TooManyTo_002 1954 1.79 1.14 2.01 137 XM_UB80 1942 0.32 1.14 0.03 138 RELAYCOUNTRY_CN 1901 0.32 1.11 0.05 139 XMBrknScrpt_02 1891 0.56 1.11 0.37 140 TR_Caps_n_Bayes_99 1868 0.31 1.09 0.04 141 XMLongAddy 1835 0.32 1.07 0.06 142 XMPhish14 1810 0.43 1.06 0.20 143 FILL_THIS_FORM 1781 0.47 1.04 0.27 144 XM_Body_Obfu01 1755 0.42 1.03 0.20 145 LongTLD 1747 0.36 1.02 0.12 146 TooManyTo_003 1742 1.23 1.02 1.31 147 TR_Mismatch_TLD_02 1685 0.29 0.99 0.05 148 NML_ADSP_CUSTOM_MED 1684 0.69 0.99 0.59 149 RELAYCOUNTRY_AT 1670 0.32 0.98 0.10 150 TR_Symld_Words 1663 1.40 0.97 1.55 151 FILL_THIS_FORM_LONG 1655 0.39 0.97 0.19 152 TR_XM_DK_Bayes 1642 2.86 0.96 3.53 153 FORGED_GMAIL_RCVD 1614 0.52 0.95 0.37 154 BODY_ENHANCEMENT 1585 0.25 0.93 0.01 155 XM_B_REG_HTML 1582 0.59 0.93 0.47 156 XM_B_COPY_HTML 1561 0.46 0.91 0.30 157 TR_XM_DK_Bayes1 1553 2.60 0.91 3.20 158 XMClaimOffer 1521 0.29 0.89 0.08 159 T_Symld_Words_02 1520 0.56 0.89 0.44 160 XM_H_Long_From03 1508 0.27 0.88 0.06 161 TVD_SPACE_RATIO 1507 0.60 0.88 0.50 162 TR_XM_DK_Bayes2 1502 2.12 0.88 2.55 163 T_FILL_THIS_FORM_LOAN 1501 0.34 0.88 0.15 164 HTTPS_HTTP_MISMATCH 1480 0.49 0.87 0.36 165 BAYES_20 1477 2.90 0.86 3.62 166 RCVD_IN_IADB_VOUCHED 1476 2.02 0.86 2.43 167 ADMITS_SPAM 1474 0.24 0.86 0.02 168 HTML_TAG_BALANCE_BODY 1473 0.44 0.86 0.29 169 HTML_FONT_FACE_BAD 1473 13.85 0.86 18.39 170 XM_PDF 1438 3.13 0.84 3.93 171 REMOVE_BEFORE_LINK 1434 0.37 0.84 0.20 172 T_TooManySym_02 1425 1.05 0.83 1.13 173 RELAYCOUNTRY_DE 1420 0.58 0.83 0.49 174 URI_NOVOWEL 1420 0.43 0.83 0.29 175 XMMoneyMeta_00 1401 0.48 0.82 0.37 176 XMLngstWrd_00 1398 0.59 0.82 0.50 177 TooManyTo_004 1398 0.91 0.82 0.94 178 HTML_FONT_SIZE_HUGE 1386 0.27 0.81 0.07 179 RDNS_DYNAMIC 1375 0.44 0.81 0.31 180 XMLngstWrd_01 1355 0.55 0.79 0.46 181 DIET_1 1343 0.45 0.79 0.33 182 BODY_URI_ONLY 1335 0.23 0.78 0.04 183 XMSlimDrugH 1330 0.35 0.78 0.21 184 RELAYCOUNTRY_IT 1306 0.22 0.76 0.03 185 HTML_IMAGE_ONLY_28 1291 0.46 0.76 0.35 186 TO_IN_SUBJ 1283 0.35 0.75 0.21 187 XMEmptySub 1260 0.42 0.74 0.30 188 PLING_QUERY 1257 0.32 0.74 0.18 189 TR_LOTS_OF_MONEY3 1254 0.28 0.73 0.12 190 LONG_JUNK_URI3 1243 0.21 0.73 0.04 191 TooManyTo_005 1241 0.76 0.73 0.77 192 HTML_IMAGE_ONLY_08 1239 0.27 0.73 0.12 193 XMLngstWrd_02 1218 0.36 0.71 0.24 194 ANY_BOUNCE_MESSAGE 1204 2.16 0.71 2.67 195 BOUNCE_MESSAGE 1200 2.16 0.70 2.67 196 SHORT_URI 1187 0.38 0.70 0.27 197 DKIM_ADSP_NXDOMAIN 1180 0.51 0.69 0.44 198 XMCapTrack 1178 1.18 0.69 1.35 199 HTML_SHORT_LINK_IMG_1 1170 0.19 0.69 0.02 200 URIBL_SBL_A 1142 0.26 0.67 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 415837 87.33 93.53 85.16 2 DCC_CHECK_NEGATIVE 353164 58.49 18.95 72.32 3 BAYES_50 255685 47.99 35.48 52.36 4 DKIM_SIGNED 245593 58.88 83.45 50.29 5 XM_DK_Pass 240577 57.37 80.55 49.27 6 XM_H_QuotedFrom 234493 50.23 56.55 48.02 7 DKIM_VALID 226366 54.41 77.44 46.36 8 DKIM_VALID_AU 164113 40.59 60.57 33.61 9 T_TM2_M_HEADER_IN_MSG 159969 29.85 21.55 32.76 10 XMListUnsubscribeExists 151351 41.19 70.36 30.99 11 DCC_CHECK 126338 39.64 79.02 25.87 12 ALL_TRUSTED 114115 18.62 5.02 23.37 13 IN_ZIMBRA_NJ_WHITELIST 110133 16.72 0.04 22.55 14 HTML_FONT_LOW_CONTRAST 92998 23.05 34.51 19.04 15 HTML_IMAGE_RATIO_04 92902 16.51 9.31 19.02 16 DKIM_VALID_EF 92236 20.17 23.84 18.89 17 HTML_FONT_FACE_BAD 89800 13.85 0.86 18.39 18 XMSubLong 81315 19.56 27.87 16.65 19 BAYES_00 78294 12.19 1.21 16.03 20 MultiRelay 74707 15.80 17.23 15.30 21 FVGT_m_MULTI_ODD 69037 17.46 26.96 14.14 22 LOC_TINY_FONT_1 64931 18.70 34.17 13.30 23 XMStrtUSub 62604 10.60 4.27 12.82 24 MIME_HTML_ONLY 62082 16.76 28.31 12.71 25 T_KAM_HTML_FONT_INVALID 48314 12.70 20.72 9.89 26 XM_DK_Undo_02 45120 18.74 45.89 9.24 27 DATE_IN_PAST_06_12 43855 6.73 0.28 8.98 28 BAYES_99 43176 17.46 42.10 8.84 29 XM_H_Long_From01 38669 8.02 8.30 7.92 30 BAYES_999 38098 15.06 35.83 7.80 31 XM_Evil_Numbers_Gen 37883 9.30 13.69 7.76 32 XM_Body_Dirty_Words 37239 10.58 19.04 7.63 33 XMSubNoVowel 36305 6.43 3.54 7.43 34 XM_Multi_Part_URI 33963 9.38 16.32 6.96 35 FSL_BULK_SIG 32829 9.17 16.18 6.72 36 TooManyTo_001 32195 6.81 7.41 6.59 37 RCVD_IN_RP_SAFE 31252 5.88 4.41 6.40 38 LOTS_OF_MONEY 31062 7.93 12.42 6.36 39 XM_DKIMWhitelistDomains 30569 4.67 0.11 6.26 40 T_XMDrugObfuBody_14 29255 6.82 9.20 5.99 41 RCVD_IN_RP_CERTIFIED 28326 5.20 3.47 5.80 42 LotsOfNums_01 25783 6.10 8.45 5.28 43 BAYES_40 24139 4.00 1.29 4.94 44 BAYES_60 23932 5.39 6.79 4.90 45 SUBJ_ALL_CAPS 23368 4.17 2.40 4.79 46 BAYES_05 22608 3.56 0.51 4.63 47 DATE_IN_PAST_03_06 22565 3.53 0.40 4.62 48 HTML_IMAGE_RATIO_06 21825 4.41 4.25 4.47 49 TR_DCC_Bayes_99 21738 11.85 33.02 4.45 50 HTML_IMAGE_RATIO_02 20622 7.01 14.98 4.22 51 T_XMHurry_00 20253 3.39 1.23 4.15 52 RELAYCOUNTRY_META 19632 7.31 16.72 4.02 53 DKIM_INVALID 19227 4.48 6.01 3.94 54 XM_PDF 19200 3.13 0.84 3.93 55 XM_B_Phish_Phrases 18970 5.27 9.22 3.88 56 MIME_QP_LONG_LINE 17930 3.79 4.12 3.67 57 RCVD_IN_IADB_LISTED 17914 3.26 2.09 3.67 58 XM_SendGrid 17746 3.76 4.11 3.63 59 BAYES_20 17667 2.90 0.86 3.62 60 TR_XM_DK_Bayes 17232 2.86 0.96 3.53 61 XM_UncommonTLD01 16512 4.61 8.14 3.38 62 T_REMOTE_IMAGE 15835 3.32 3.53 3.24 63 RCVD_IN_IADB_SPF 15634 2.86 1.89 3.20 64 TR_XM_DK_Bayes1 15611 2.60 0.91 3.20 65 XMNumbers 14783 3.89 6.37 3.03 66 T_TooManySym_01 14153 2.86 2.77 2.90 67 RCVD_IN_MSPIKE_H2 13962 2.92 3.08 2.86 68 RCVD_IN_IADB_SENDERID 13881 2.57 1.79 2.84 69 TR_XM_DocInvoice 13812 4.06 7.60 2.83 70 BAYES_80 13671 3.99 7.41 2.80 71 RCVD_IN_IADB_DK 13473 2.51 1.78 2.76 72 ANY_BOUNCE_MESSAGE 13035 2.16 0.71 2.67 73 BOUNCE_MESSAGE 13033 2.16 0.70 2.67 74 BOTNET_IPINHOSTNAME 12970 5.15 12.26 2.66 75 XMSubMetaSx_00 12841 3.74 6.91 2.63 76 TR_XM_DK_Bayes2 12461 2.12 0.88 2.55 77 RCVD_IN_IADB_VOUCHED 11853 2.02 0.86 2.43 78 MPART_ALT_DIFF 11325 3.38 6.42 2.32 79 FROM_EXCESS_BASE64 10935 3.51 7.14 2.24 80 XMSexyCombo_05 10266 3.96 9.25 2.10 81 TooManyTo_002 9831 1.79 1.14 2.01 82 HELO_NODOT 9587 1.55 0.38 1.96 83 UNPARSEABLE_RELAY 9473 1.92 1.88 1.94 84 MAILING_LIST_MULTI 9449 1.87 1.67 1.94 85 XMSubLongNoVowel 9406 1.45 0.09 1.93 86 HTML_MIME_NO_HTML_TAG 9225 2.00 2.30 1.89 87 BAYES_95 9145 2.51 4.33 1.87 88 RCVD_IN_MSPIKE_WL 9115 1.69 1.20 1.87 89 RCVD_IN_MSPIKE_H3 9115 1.69 1.20 1.87 90 XMSubGarbage 9080 1.39 0.03 1.86 91 TVD_RCVD_IP 8569 1.38 0.31 1.75 92 IN_HORDE_ADDRESS_BOOK 8298 1.28 0.07 1.70 93 XMSubEmpty 8233 1.97 2.79 1.69 94 XM_SPF_SoftFail 8126 2.46 4.74 1.66 95 XM_E_Blogspot 8081 1.24 0.06 1.65 96 MIME_HTML_MOSTLY 8080 2.11 3.41 1.65 97 XM_H_PHPOS 7956 1.77 2.16 1.63 98 XM_DK_Undo_01 7667 1.55 1.50 1.57 99 TR_Symld_Words 7568 1.40 0.97 1.55 100 RCVD_IN_IADB_OPTIN 7504 1.28 0.56 1.54 101 HTML_IMAGE_RATIO_08 7243 1.83 2.83 1.48 102 INVALID_MSGID 6945 1.10 0.19 1.42 103 MSGID_NOFQDN1 6632 1.01 0.02 1.36 104 XMCapTrack 6601 1.18 0.69 1.35 105 TM2_M_URI_OPT_OUT 6543 2.18 4.59 1.34 106 TO_MALFORMED 6479 0.99 0.02 1.33 107 TooManyTo_003 6394 1.23 1.02 1.31 108 XM_DIRTYINTL 6365 1.92 3.69 1.30 109 XMDiploma_00 5723 1.46 2.27 1.17 110 XM_CamelCaseFrm001 5572 1.66 3.14 1.14 111 SpammyFromTLD_01 5553 1.83 3.82 1.14 112 T_TooManySym_02 5521 1.05 0.83 1.13 113 UNTRUSTED_Relay 5094 3.38 10.06 1.04 114 XM_OfRef6 5086 1.71 3.64 1.04 115 XMStockSpam_06 5081 1.12 1.33 1.04 116 T_FILL_THIS_FORM_SHORT 5039 1.07 1.18 1.03 117 RELAYCOUNTRY_CA 4982 1.65 3.44 1.02 118 USER_IN_DEF_DKIM_WL 4976 0.78 0.10 1.02 119 XMPhish11 4942 1.05 1.15 1.01 120 XM_GoogleGroups 4862 0.87 0.52 1.00 121 T_XMDrugObfuBody_08 4639 1.36 2.53 0.95 122 TooManyTo_004 4585 0.91 0.82 0.94 123 URI_HEX 4507 1.46 3.01 0.92 124 MIME_HTML_ONLY_MULTI 4128 1.39 2.95 0.85 125 DKIM_ADSP_CUSTOM_MED 3937 0.90 1.16 0.81 126 RELAYCOUNTRY_GB 3782 0.90 1.26 0.77 127 URI_TRY_3LD 3780 0.88 1.17 0.77 128 TooManyTo_005 3748 0.76 0.73 0.77 129 BOTNET 3622 3.41 11.03 0.74 130 XMNoVowels 3541 0.70 0.64 0.73 131 XM_H_Long_From02 3460 0.95 1.65 0.71 132 XMGenDplmaNmb 3441 0.92 1.55 0.70 133 XM_UB50 3374 1.70 4.57 0.69 134 XM_ProductURIs 3310 0.87 1.41 0.68 135 TM2_M_BODY_EMPTY 3232 0.92 1.66 0.66 136 TR_MetaPhish_Combo_01 3115 0.64 0.63 0.64 137 T_XMDrugObfuBody_00 3027 0.77 1.18 0.62 138 TM2_M_VERY_LONG_WORD 3025 0.97 1.98 0.62 139 NML_ADSP_CUSTOM_MED 2863 0.69 0.99 0.59 140 RCVD_IN_SORBS_DUL 2754 0.48 0.25 0.56 141 T_OBFU_PDF_ATTACH 2742 0.47 0.19 0.56 142 USER_IN_WHITELIST 2631 0.40 0.00 0.54 143 AC_DIV_BONANZA 2559 0.42 0.14 0.52 144 T_TooManySym_03 2535 0.44 0.21 0.52 145 SHORT_HELO_AND_INLINE_IMAGE 2484 0.40 0.10 0.51 146 XMLngstWrd_00 2463 0.59 0.82 0.50 147 XM_H_PHPMailer 2453 0.52 0.56 0.50 148 TVD_SPACE_RATIO 2421 0.60 0.88 0.50 149 RELAYCOUNTRY_DE 2375 0.58 0.83 0.49 150 XM_B_REG_HTML 2293 0.59 0.93 0.47 151 TR_Mismatch_TLD_01 2284 1.09 2.87 0.47 152 XMGappySubj_01 2274 0.45 0.42 0.47 153 XMLngstWrd_01 2254 0.55 0.79 0.46 154 MISSING_HEADERS 2217 0.41 0.30 0.45 155 DKIM_ADSP_NXDOMAIN 2162 0.51 0.69 0.44 156 T_Symld_Words_02 2149 0.56 0.89 0.44 157 RELAYCOUNTRY_AU 2145 0.49 0.62 0.44 158 RCVD_IN_BL_SPAMCOP_NET 2087 1.17 3.30 0.43 159 XMBody_95 2024 0.35 0.16 0.41 160 TR_LOTS_OF_MONEY2 2009 0.61 1.17 0.41 161 T_MONEY_PERCENT 2009 0.61 1.17 0.41 162 XMBdyGiftCard01 1989 0.62 1.24 0.41 163 XM_ShortIntro_01 1987 0.42 0.46 0.41 164 XMEmptyBody_01 1948 0.71 1.61 0.40 165 SHORT_URI_2 1919 0.74 1.72 0.39 166 HTML_IMAGE_ONLY_32 1846 0.34 0.23 0.38 167 XMDateMe_00 1821 0.39 0.43 0.37 168 XMBrknScrpt_02 1817 0.56 1.11 0.37 169 FORGED_GMAIL_RCVD 1800 0.52 0.95 0.37 170 XMMoneyMeta_00 1784 0.48 0.82 0.37 171 HTTPS_HTTP_MISMATCH 1773 0.49 0.87 0.36 172 TR_XM_RelayPhish 1738 0.62 1.39 0.36 173 HTML_IMAGE_ONLY_28 1729 0.46 0.76 0.35 174 UPPERCASE_50_75 1699 0.27 0.06 0.35 175 PP_MIME_FAKE_ASCII_TEXT 1645 0.42 0.66 0.34 176 DIET_1 1598 0.45 0.79 0.33 177 SUBJ_DOLLARS 1574 0.55 1.20 0.32 178 HTML_IMAGE_ONLY_24 1569 0.41 0.66 0.32 179 TM2_M_A_HREF_HREF 1550 0.32 0.34 0.32 180 RDNS_DYNAMIC 1519 0.44 0.81 0.31 181 XMBody_78 1506 0.36 0.50 0.31 182 XMBody_17 1490 0.60 1.44 0.31 183 XMEmptySub 1489 0.42 0.74 0.30 184 XM_B_COPY_HTML 1445 0.46 0.91 0.30 185 HTML_TAG_BALANCE_BODY 1424 0.44 0.86 0.29 186 XMSubMetaSxObfu_02 1422 0.26 0.16 0.29 187 URI_NOVOWEL 1413 0.43 0.83 0.29 188 XMSexyCombo_01 1371 0.60 1.53 0.28 189 XMHTML_After_End 1343 0.59 1.51 0.28 190 MPART_ALT_DIFF_COUNT 1317 0.54 1.33 0.27 191 SHORT_URI 1310 0.38 0.70 0.27 192 FILL_THIS_FORM 1309 0.47 1.04 0.27 193 XM_H_Trusted_IP 1288 0.20 0.00 0.26 194 XMSubMetaSxObfu_03 1285 0.37 0.66 0.26 195 XMSubMetaI_00 1245 0.60 1.60 0.25 196 XMRcvdHeader_15 1236 0.19 0.00 0.25 197 SpammyFromTLD_02 1223 0.68 1.90 0.25 198 XM_H_PHPOS_M 1191 0.26 0.30 0.24 199 XM_B_TRADE_HTML 1178 0.28 0.37 0.24 200 XMHTMLBadTable_001 1174 0.34 0.64 0.24 ----------------------------------------------------------------------