Email: 655441 Autolearn: 0 AvgScore: 2.21 AvgScanTime: 3.69 sec Spam: 182546 Autolearn: 0 AvgScore: 12.60 AvgScanTime: 4.67 sec Ham: 472895 Autolearn: 0 AvgScore: -1.80 AvgScanTime: 3.31 sec Time Spent Running SA: 671.70 hours Time Spent Processing Spam: 236.58 hours Time Spent Processing Ham: 435.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174774 86.76 95.74 83.29 2 DKIM_SIGNED 157097 64.12 86.06 55.65 3 XM_DK_Pass 153284 62.77 83.97 54.58 4 DKIM_VALID 145230 58.71 79.56 50.66 5 DCC_CHECK 143306 41.36 78.50 27.03 6 XMListUnsubscribeExists 134924 47.06 73.91 36.69 7 DKIM_VALID_AU 111804 42.13 61.25 34.75 8 XM_H_QuotedFrom 105195 45.91 57.63 41.39 9 XM_DK_Undo_02 90675 20.84 49.67 9.71 10 BAYES_99 82748 19.27 45.33 9.21 11 BAYES_999 71047 16.66 38.92 8.06 12 HTML_FONT_LOW_CONTRAST 67966 25.06 37.23 20.36 13 LOC_TINY_FONT_1 67701 20.50 37.09 14.09 14 TR_DCC_Bayes_99 64738 12.79 35.46 4.04 15 BAYES_50 60103 47.26 32.92 52.79 16 MIME_HTML_ONLY 53501 18.68 29.31 14.58 17 FVGT_m_MULTI_ODD 48806 19.10 26.74 16.15 18 XMSubLong 48335 20.09 26.48 17.63 19 DKIM_VALID_EF 43604 21.30 23.89 20.30 20 T_KAM_HTML_FONT_INVALID 40169 15.20 22.00 12.58 21 T_TM2_M_HEADER_IN_MSG 37031 28.23 20.29 31.29 22 DCC_CHECK_NEGATIVE 35347 56.56 19.36 70.92 23 XM_Body_Dirty_Words 32525 10.34 17.82 7.45 24 XM_Multi_Part_URI 31836 10.79 17.44 8.22 25 RELAYCOUNTRY_META 30659 7.97 16.80 4.56 26 MultiRelay 30419 16.18 16.66 16.00 27 HTML_IMAGE_RATIO_02 28857 8.15 15.81 5.19 28 XM_Evil_Numbers_Gen 25548 9.13 14.00 7.25 29 BOTNET_IPINHOSTNAME 24209 5.80 13.26 2.92 30 BOTNET 23493 4.30 12.87 1.00 31 LOTS_OF_MONEY 23056 8.60 12.63 7.04 32 FSL_BULK_SIG 21041 7.55 11.53 6.02 33 UNTRUSTED_Relay 18472 3.73 10.12 1.26 34 LotsOfNums_01 17927 7.45 9.82 6.53 35 XMSexyCombo_05 17107 3.91 9.37 1.81 36 HTML_IMAGE_RATIO_04 16592 13.64 9.09 15.39 37 T_XMDrugObfuBody_14 16549 7.05 9.07 6.27 38 XM_B_Phish_Phrases 15973 4.95 8.75 3.48 39 TR_XM_DocInvoice 15121 4.48 8.28 3.01 40 XM_H_Long_From01 14989 8.61 8.21 8.77 41 MPART_ALT_DIFF 12942 3.74 7.09 2.45 42 BAYES_80 12864 4.26 7.05 3.19 43 XM_UncommonTLD01 12537 4.01 6.87 2.91 44 TooManyTo_001 12197 7.01 6.68 7.14 45 XMSubMetaSx_00 11973 3.74 6.56 2.65 46 DKIM_INVALID 11867 5.41 6.50 5.00 47 FROM_EXCESS_BASE64 11627 3.38 6.37 2.23 48 BAYES_60 10551 5.47 5.78 5.35 49 XM_UB50 10081 2.14 5.52 0.83 50 TM2_M_URI_OPT_OUT 9181 2.55 5.03 1.59 51 XM_OfRef6 9026 2.78 4.94 1.95 52 XMStrtUSub 8914 8.97 4.88 10.54 53 HTML_IMAGE_RATIO_06 8729 4.27 4.78 4.07 54 XMNumbers 8619 3.48 4.72 3.00 55 BAYES_95 8400 2.89 4.60 2.23 56 RCVD_IN_RP_SAFE 8392 5.39 4.60 5.70 57 XM_SendGrid 8193 4.16 4.49 4.04 58 MIME_QP_LONG_LINE 8066 4.64 4.42 4.72 59 MIME_HTML_MOSTLY 7517 2.36 4.12 1.68 60 RCVD_IN_BL_SPAMCOP_NET 7146 1.41 3.91 0.44 61 RCVD_IN_RP_CERTIFIED 7035 4.86 3.85 5.24 62 RCVD_IN_MSPIKE_H2 6878 3.65 3.77 3.60 63 XM_CamelCaseFrm001 6822 2.12 3.74 1.50 64 XM_SPF_SoftFail 6672 2.28 3.65 1.76 65 RELAYCOUNTRY_CA 6667 1.88 3.65 1.20 66 XM_DIRTYINTL 6642 2.13 3.64 1.54 67 HTML_IMAGE_RATIO_08 6481 2.19 3.55 1.66 68 MultiRelay_CC 6480 1.12 3.55 0.18 69 MultiRelay_Combo 6480 1.12 3.55 0.18 70 T_REMOTE_IMAGE 6467 3.68 3.54 3.74 71 MIME_HTML_ONLY_MULTI 6124 1.74 3.35 1.12 72 RCVD_IN_RP_RNBL 5772 0.90 3.16 0.03 73 URI_HEX 5585 1.69 3.06 1.16 74 T_XMDrugObfuBody_08 5037 1.70 2.76 1.29 75 T_TooManySym_01 5025 3.16 2.75 3.32 76 XMPhish11 4943 1.55 2.71 1.10 77 SpammyFromTLD_02 4734 0.91 2.59 0.26 78 T_FILL_THIS_FORM_SHORT 4678 1.52 2.56 1.12 79 XMDiploma_00 4620 1.67 2.53 1.34 80 SUBJ_ALL_CAPS 4609 4.60 2.52 5.40 81 HTML_MIME_NO_HTML_TAG 4569 1.95 2.50 1.73 82 RCVD_IN_IADB_LISTED 4061 4.32 2.22 5.13 83 XM_URI_RBL 3967 0.67 2.17 0.09 84 XM_H_Long_From02 3924 1.23 2.15 0.87 85 SpammyFromTLD_01 3784 1.05 2.07 0.65 86 XMSubMetaI_00 3729 1.04 2.04 0.65 87 ALL_TRUSTED 3707 16.43 2.03 21.98 88 TM2_M_VERY_LONG_WORD 3692 1.00 2.02 0.61 89 RCVD_IN_IADB_SPF 3663 3.80 2.01 4.50 90 XM_ProductURIs 3583 1.14 1.96 0.82 91 RCVD_IN_IADB_SENDERID 3502 3.40 1.92 3.97 92 XMHTML_After_End 3487 0.81 1.91 0.39 93 RCVD_IN_IADB_DK 3446 3.33 1.89 3.89 94 BOTNET_NORDNS 3421 0.53 1.87 0.01 95 UNPARSEABLE_RELAY 3385 2.08 1.85 2.17 96 XMBody_17 3371 0.77 1.85 0.36 97 XMNoVowels 3344 1.57 1.83 1.47 98 XM_DK_Undo_01 3321 1.74 1.82 1.70 99 T_XMHurry_00 3314 0.88 1.82 0.51 100 XMGenDplmaNmb 3100 1.11 1.70 0.89 101 URI_TRY_3LD 3031 1.40 1.66 1.30 102 FORM_FRAUD_5 3002 0.46 1.64 0.00 103 XMSexyCombo_01 2994 0.68 1.64 0.31 104 RELAYCOUNTRY_GB 2925 1.10 1.60 0.90 105 ADVANCE_FEE_4_NEW 2918 0.45 1.60 0.00 106 URIBL_DBL_SPAM 2918 0.46 1.60 0.01 107 URIBL_BLACK 2909 0.46 1.59 0.03 108 XM_UB99 2881 0.45 1.58 0.02 109 XMPhish30 2826 0.65 1.55 0.31 110 MAILING_LIST_MULTI 2780 2.18 1.52 2.44 111 HELO_NODOT 2763 1.87 1.51 2.00 112 TR_LOTS_OF_MONEY2 2757 0.75 1.51 0.46 113 T_MONEY_PERCENT 2757 0.75 1.51 0.46 114 BAYES_40 2662 4.72 1.46 5.98 115 RELAYCOUNTRY_FR 2615 0.59 1.43 0.26 116 RELAYCOUNTRY_CN 2596 0.43 1.42 0.05 117 XMStockSpam_06 2562 0.82 1.40 0.59 118 XMBrknScrpt_02 2530 0.75 1.39 0.50 119 TR_XM_RelayPhish 2507 0.74 1.37 0.50 120 NO_DNS_FOR_FROM 2490 1.22 1.36 1.17 121 RELAYCOUNTRY_ZA 2487 0.38 1.36 0.00 122 XMBdyGiftCard01 2462 0.67 1.35 0.40 123 TVD_RCVD_IP 2460 1.79 1.35 1.96 124 DIET_1 2419 0.52 1.33 0.22 125 FSL_HELO_NON_FQDN_1 2333 0.38 1.28 0.04 126 XMSubNoVowel 2296 4.60 1.26 5.89 127 XMSlimDrugH 2293 0.55 1.26 0.28 128 TR_LOTS_OF_MONEY3 2249 0.65 1.23 0.43 129 XM_UB999 2247 0.35 1.23 0.01 130 RELAYCOUNTRY_TH 2242 0.35 1.23 0.01 131 XMLongAddy 2232 0.42 1.22 0.12 132 TO_NO_BRKTS_PCNT 2223 0.35 1.22 0.01 133 XM_B_REG_HTML 2176 0.60 1.19 0.37 134 T_Symld_Words_02 2101 0.60 1.15 0.39 135 XM_HighProb1 2089 0.33 1.14 0.01 136 BODY_URI_ONLY 2089 0.35 1.14 0.05 137 TR_Symld_Words 2073 1.47 1.14 1.60 138 HTML_FONT_FACE_BAD 2069 10.51 1.13 14.12 139 RELAYCOUNTRY_AT 2068 0.44 1.13 0.17 140 T_XMDrugObfuBody_00 2045 0.77 1.12 0.63 141 BOUNCE_MESSAGE 2029 2.43 1.11 2.94 142 ANY_BOUNCE_MESSAGE 2029 2.43 1.11 2.94 143 HTML_FONT_SIZE_LARGE 2028 0.42 1.11 0.15 144 DKIM_ADSP_CUSTOM_MED 2020 1.00 1.11 0.96 145 BAYES_00 2017 8.11 1.10 10.82 146 XMMoneyMeta_00 1916 0.62 1.05 0.46 147 BAYES_20 1891 4.66 1.04 6.07 148 XM_UB60 1863 0.35 1.02 0.09 149 FORGED_GMAIL_RCVD 1823 0.61 1.00 0.46 150 XMHTMLBadTable_001 1791 0.49 0.98 0.30 151 TR_Mismatch_TLD_01 1787 0.51 0.98 0.33 152 XM_XX_Yahoo 1767 0.34 0.97 0.10 153 TR_Caps_n_Bayes_99 1722 0.31 0.94 0.06 154 HTML_IMAGE_ONLY_08 1710 0.34 0.94 0.10 155 NML_ADSP_CUSTOM_MED 1698 0.76 0.93 0.70 156 HTTPS_HTTP_MISMATCH 1695 0.55 0.93 0.41 157 RCVD_IN_IADB_VOUCHED 1683 2.61 0.92 3.26 158 MPART_ALT_DIFF_COUNT 1675 0.44 0.92 0.25 159 RCVD_IN_MSPIKE_WL 1667 1.34 0.91 1.50 160 URI_NOVOWEL 1660 0.50 0.91 0.34 161 HTML_SHORT_LINK_IMG_1 1642 0.27 0.90 0.02 162 HTML_IMAGE_ONLY_28 1642 0.50 0.90 0.35 163 RCVD_IN_MSPIKE_H3 1640 1.33 0.90 1.50 164 FSL_THIS_IS_ADV 1623 0.28 0.89 0.05 165 T_TooManySym_02 1610 1.18 0.88 1.30 166 RCVD_IN_PSBL 1587 0.31 0.87 0.09 167 XMBody_78 1547 0.52 0.85 0.39 168 TR_XM_DK_Bayes 1545 3.06 0.85 3.92 169 RELAYCOUNTRY_IN 1537 0.34 0.84 0.15 170 SUBJ_DOLLARS 1509 0.38 0.83 0.20 171 XM_B_COPY_HTML 1508 0.49 0.83 0.36 172 FILL_THIS_FORM 1503 0.72 0.82 0.68 173 XM_H_PHPOS 1499 1.14 0.82 1.27 174 XM_Body_Obfu01 1498 0.39 0.82 0.22 175 XM_BadFromFormat 1431 0.37 0.78 0.21 176 RDNS_DYNAMIC 1421 0.43 0.78 0.29 177 TR_XM_DK_Bayes1 1408 2.68 0.77 3.42 178 FILL_THIS_FORM_LONG 1378 0.50 0.75 0.41 179 HTML_TAG_BALANCE_BODY 1371 0.49 0.75 0.40 180 XM_RXBody 1368 0.26 0.75 0.07 181 LongTLD 1366 0.31 0.75 0.14 182 XM_PDF 1365 3.30 0.75 4.29 183 XMSubMetaSSx_00 1333 0.30 0.73 0.13 184 XMSubEmpty 1327 0.92 0.73 0.99 185 TR_XM_DK_Bayes2 1324 2.25 0.73 2.84 186 REMOVE_BEFORE_LINK 1322 0.32 0.72 0.16 187 LONG_JUNK_URI3 1318 0.23 0.72 0.04 188 DKIM_ADSP_NXDOMAIN 1282 0.85 0.70 0.90 189 TooManyTo_002 1247 1.72 0.68 2.12 190 T_FILL_THIS_FORM_LOAN 1242 0.41 0.68 0.30 191 T_HTML_TAG_BALANCE_CENTER 1241 0.28 0.68 0.13 192 HTML_FONT_SIZE_HUGE 1231 0.27 0.67 0.12 193 XM_Combo_Sbj 1231 0.55 0.67 0.50 194 RELAYCOUNTRY_DE 1229 0.65 0.67 0.65 195 PLING_QUERY 1216 0.33 0.67 0.20 196 TR_MetaPhish_Combo_01 1198 0.65 0.66 0.65 197 LONG_JUNK_URI2 1193 0.20 0.65 0.02 198 XM_UB80 1192 0.22 0.65 0.05 199 BAYES_05 1188 3.24 0.65 4.24 200 XMClaimOffer 1184 0.26 0.65 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 393875 86.76 95.74 83.29 2 DCC_CHECK_NEGATIVE 335376 56.56 19.36 70.92 3 DKIM_SIGNED 263169 64.12 86.06 55.65 4 XM_DK_Pass 258128 62.77 83.97 54.58 5 BAYES_50 249634 47.26 32.92 52.79 6 DKIM_VALID 239547 58.71 79.56 50.66 7 XM_H_QuotedFrom 195742 45.91 57.63 41.39 8 XMListUnsubscribeExists 173510 47.06 73.91 36.69 9 DKIM_VALID_AU 164332 42.13 61.25 34.75 10 T_TM2_M_HEADER_IN_MSG 147973 28.23 20.29 31.29 11 DCC_CHECK 127805 41.36 78.50 27.03 12 ALL_TRUSTED 103962 16.43 2.03 21.98 13 HTML_FONT_LOW_CONTRAST 96275 25.06 37.23 20.36 14 DKIM_VALID_EF 95993 21.30 23.89 20.30 15 IN_ZIMBRA_NJ_WHITELIST 87629 13.38 0.05 18.53 16 XMSubLong 83364 20.09 26.48 17.63 17 FVGT_m_MULTI_ODD 76382 19.10 26.74 16.15 18 MultiRelay 75657 16.18 16.66 16.00 19 HTML_IMAGE_RATIO_04 72779 13.64 9.09 15.39 20 MIME_HTML_ONLY 68927 18.68 29.31 14.58 21 HTML_FONT_FACE_BAD 66796 10.51 1.13 14.12 22 LOC_TINY_FONT_1 66636 20.50 37.09 14.09 23 T_KAM_HTML_FONT_INVALID 59476 15.20 22.00 12.58 24 BAYES_00 51151 8.11 1.10 10.82 25 XMStrtUSub 49849 8.97 4.88 10.54 26 XM_DK_Undo_02 45941 20.84 49.67 9.71 27 BAYES_99 43568 19.27 45.33 9.21 28 XM_H_Long_From01 41453 8.61 8.21 8.77 29 XM_Multi_Part_URI 38893 10.79 17.44 8.22 30 BAYES_999 38118 16.66 38.92 8.06 31 XM_Body_Dirty_Words 35247 10.34 17.82 7.45 32 XM_Evil_Numbers_Gen 34300 9.13 14.00 7.25 33 TooManyTo_001 33782 7.01 6.68 7.14 34 LOTS_OF_MONEY 33304 8.60 12.63 7.04 35 XM_DKIMWhitelistDomains 31152 4.78 0.09 6.59 36 LotsOfNums_01 30896 7.45 9.82 6.53 37 T_XMDrugObfuBody_14 29652 7.05 9.07 6.27 38 BAYES_20 28682 4.66 1.04 6.07 39 FSL_BULK_SIG 28450 7.55 11.53 6.02 40 BAYES_40 28287 4.72 1.46 5.98 41 XMSubNoVowel 27855 4.60 1.26 5.89 42 RCVD_IN_RP_SAFE 26937 5.39 4.60 5.70 43 SUBJ_ALL_CAPS 25520 4.60 2.52 5.40 44 BAYES_60 25305 5.47 5.78 5.35 45 RCVD_IN_RP_CERTIFIED 24788 4.86 3.85 5.24 46 HTML_IMAGE_RATIO_02 24554 8.15 15.81 5.19 47 RCVD_IN_IADB_LISTED 24239 4.32 2.22 5.13 48 DKIM_INVALID 23622 5.41 6.50 5.00 49 MIME_QP_LONG_LINE 22321 4.64 4.42 4.72 50 RELAYCOUNTRY_META 21550 7.97 16.80 4.56 51 RCVD_IN_IADB_SPF 21264 3.80 2.01 4.50 52 XM_PDF 20279 3.30 0.75 4.29 53 BAYES_05 20059 3.24 0.65 4.24 54 HTML_IMAGE_RATIO_06 19232 4.27 4.78 4.07 55 XM_SendGrid 19103 4.16 4.49 4.04 56 TR_DCC_Bayes_99 19090 12.79 35.46 4.04 57 RCVD_IN_IADB_SENDERID 18777 3.40 1.92 3.97 58 TR_XM_DK_Bayes 18517 3.06 0.85 3.92 59 RCVD_IN_IADB_DK 18408 3.33 1.89 3.89 60 T_REMOTE_IMAGE 17677 3.68 3.54 3.74 61 RCVD_IN_MSPIKE_H2 17045 3.65 3.77 3.60 62 XM_B_Phish_Phrases 16477 4.95 8.75 3.48 63 TR_XM_DK_Bayes1 16190 2.68 0.77 3.42 64 T_TooManySym_01 15706 3.16 2.75 3.32 65 RCVD_IN_IADB_VOUCHED 15410 2.61 0.92 3.26 66 BAYES_80 15071 4.26 7.05 3.19 67 TR_XM_DocInvoice 14233 4.48 8.28 3.01 68 XMNumbers 14164 3.48 4.72 3.00 69 ANY_BOUNCE_MESSAGE 13882 2.43 1.11 2.94 70 BOUNCE_MESSAGE 13882 2.43 1.11 2.94 71 BOTNET_IPINHOSTNAME 13818 5.80 13.26 2.92 72 XM_UncommonTLD01 13741 4.01 6.87 2.91 73 TR_XM_DK_Bayes2 13437 2.25 0.73 2.84 74 XMSubMetaSx_00 12540 3.74 6.56 2.65 75 MPART_ALT_DIFF 11581 3.74 7.09 2.45 76 MAILING_LIST_MULTI 11527 2.18 1.52 2.44 77 BAYES_95 10558 2.89 4.60 2.23 78 FROM_EXCESS_BASE64 10540 3.38 6.37 2.23 79 UNPARSEABLE_RELAY 10279 2.08 1.85 2.17 80 TooManyTo_002 10010 1.72 0.68 2.12 81 RCVD_IN_IADB_OPTIN 9903 1.68 0.60 2.09 82 HELO_NODOT 9481 1.87 1.51 2.00 83 TVD_RCVD_IP 9290 1.79 1.35 1.96 84 XM_OfRef6 9220 2.78 4.94 1.95 85 XMSubLongNoVowel 9181 1.42 0.07 1.94 86 XMSubGarbage 8898 1.36 0.02 1.88 87 XMSexyCombo_05 8536 3.91 9.37 1.81 88 IN_HORDE_ADDRESS_BOOK 8481 1.31 0.07 1.79 89 XM_SPF_SoftFail 8301 2.28 3.65 1.76 90 HTML_MIME_NO_HTML_TAG 8195 1.95 2.50 1.73 91 XM_DK_Undo_01 8053 1.74 1.82 1.70 92 MIME_HTML_MOSTLY 7924 2.36 4.12 1.68 93 HTML_IMAGE_RATIO_08 7860 2.19 3.55 1.66 94 TR_Symld_Words 7550 1.47 1.14 1.60 95 TM2_M_URI_OPT_OUT 7528 2.55 5.03 1.59 96 XM_DIRTYINTL 7299 2.13 3.64 1.54 97 RCVD_IN_MSPIKE_WL 7107 1.34 0.91 1.50 98 RCVD_IN_MSPIKE_H3 7101 1.33 0.90 1.50 99 XM_CamelCaseFrm001 7096 2.12 3.74 1.50 100 XMNoVowels 6964 1.57 1.83 1.47 101 INVALID_MSGID 6939 1.11 0.17 1.47 102 TO_MALFORMED 6643 1.02 0.01 1.40 103 MSGID_NOFQDN1 6570 1.00 0.01 1.39 104 XMCapTrack 6531 1.16 0.60 1.38 105 TooManyTo_003 6515 1.15 0.55 1.38 106 XMDiploma_00 6346 1.67 2.53 1.34 107 T_TooManySym_02 6144 1.18 0.88 1.30 108 URI_TRY_3LD 6126 1.40 1.66 1.30 109 T_XMDrugObfuBody_08 6078 1.70 2.76 1.29 110 XM_H_PHPOS 6003 1.14 0.82 1.27 111 UNTRUSTED_Relay 5950 3.73 10.12 1.26 112 XM_E_Blogspot 5888 0.92 0.06 1.25 113 RELAYCOUNTRY_CA 5678 1.88 3.65 1.20 114 NO_DNS_FOR_FROM 5520 1.22 1.36 1.17 115 URI_HEX 5483 1.69 3.06 1.16 116 XM_GoogleGroups 5437 0.97 0.52 1.15 117 T_FILL_THIS_FORM_SHORT 5288 1.52 2.56 1.12 118 MIME_HTML_ONLY_MULTI 5277 1.74 3.35 1.12 119 XMPhish11 5213 1.55 2.71 1.10 120 USER_IN_DEF_DKIM_WL 5193 0.81 0.06 1.10 121 TooManyTo_004 4860 0.86 0.42 1.03 122 BOTNET 4719 4.30 12.87 1.00 123 XMSubEmpty 4684 0.92 0.73 0.99 124 DKIM_ADSP_CUSTOM_MED 4548 1.00 1.11 0.96 125 DKIM_ADSP_NXDOMAIN 4275 0.85 0.70 0.90 126 RELAYCOUNTRY_GB 4256 1.10 1.60 0.90 127 XMGenDplmaNmb 4192 1.11 1.70 0.89 128 XM_H_Long_From02 4107 1.23 2.15 0.87 129 TooManyTo_005 3998 0.71 0.35 0.85 130 XM_UB50 3923 2.14 5.52 0.83 131 XM_ProductURIs 3888 1.14 1.96 0.82 132 NML_ADSP_CUSTOM_MED 3316 0.76 0.93 0.70 133 FILL_THIS_FORM 3201 0.72 0.82 0.68 134 T_OBFU_PDF_ATTACH 3113 0.53 0.19 0.66 135 XMSubMetaI_00 3094 1.04 2.04 0.65 136 TR_MetaPhish_Combo_01 3083 0.65 0.66 0.65 137 SpammyFromTLD_01 3081 1.05 2.07 0.65 138 RELAYCOUNTRY_DE 3052 0.65 0.67 0.65 139 T_XMDrugObfuBody_00 2978 0.77 1.12 0.63 140 TM2_M_VERY_LONG_WORD 2880 1.00 2.02 0.61 141 TO_NO_BRKTS_HTML_IMG 2857 0.45 0.07 0.60 142 XM_OfRef7 2812 0.58 0.55 0.59 143 XMStockSpam_06 2803 0.82 1.40 0.59 144 USER_IN_WHITELIST 2796 0.43 0.00 0.59 145 MIME_BASE64_TEXT 2692 0.46 0.18 0.57 146 T_TooManySym_03 2666 0.45 0.14 0.56 147 SHORT_HELO_AND_INLINE_IMAGE 2616 0.42 0.07 0.55 148 TM2_M_BODY_EMPTY 2579 0.50 0.38 0.55 149 XM_H_PHPMailer 2517 0.55 0.60 0.53 150 MISSING_HEADERS 2458 0.51 0.50 0.52 151 T_XMHurry_00 2432 0.88 1.82 0.51 152 XM_Combo_Sbj 2378 0.55 0.67 0.50 153 XMBrknScrpt_02 2364 0.75 1.39 0.50 154 TR_XM_RelayPhish 2363 0.74 1.37 0.50 155 XMLngstWrd_00 2249 0.48 0.49 0.48 156 RCVD_IN_SORBS_DUL 2247 0.41 0.26 0.48 157 XMGappySubj_01 2198 0.43 0.35 0.46 158 T_MONEY_PERCENT 2186 0.75 1.51 0.46 159 TR_LOTS_OF_MONEY2 2186 0.75 1.51 0.46 160 FORGED_GMAIL_RCVD 2181 0.61 1.00 0.46 161 XMMoneyMeta_00 2160 0.62 1.05 0.46 162 TVD_SPACE_RATIO 2148 0.42 0.35 0.45 163 XM_ShortIntro_01 2138 0.40 0.25 0.45 164 XMBody_95 2115 0.37 0.17 0.45 165 RCVD_IN_BL_SPAMCOP_NET 2095 1.41 3.91 0.44 166 XMLngstWrd_01 2075 0.45 0.47 0.44 167 TR_LOTS_OF_MONEY3 2022 0.65 1.23 0.43 168 HTML_IMAGE_ONLY_32 1953 0.38 0.29 0.41 169 XMDateMe_00 1950 0.41 0.40 0.41 170 HTTPS_HTTP_MISMATCH 1931 0.55 0.93 0.41 171 FILL_THIS_FORM_LONG 1931 0.50 0.75 0.41 172 RELAYCOUNTRY_AU 1915 0.45 0.57 0.40 173 XMBdyGiftCard01 1906 0.67 1.35 0.40 174 HTML_TAG_BALANCE_BODY 1871 0.49 0.75 0.40 175 XMBody_78 1859 0.52 0.85 0.39 176 XMHTML_After_End 1834 0.81 1.91 0.39 177 T_Symld_Words_02 1823 0.60 1.15 0.39 178 XM_H_Trusted_IP 1804 0.28 0.00 0.38 179 XM_B_REG_HTML 1760 0.60 1.19 0.37 180 XM_B_COPY_HTML 1708 0.49 0.83 0.36 181 XMBody_17 1683 0.77 1.85 0.36 182 HTML_IMAGE_ONLY_28 1660 0.50 0.90 0.35 183 AC_DIV_BONANZA 1615 0.28 0.11 0.34 184 URI_NOVOWEL 1604 0.50 0.91 0.34 185 XM_B_TRADE_HTML 1571 0.35 0.41 0.33 186 TR_Mismatch_TLD_01 1569 0.51 0.98 0.33 187 TM2_M_A_HREF_HREF 1558 0.37 0.46 0.33 188 GMD_PDF_EMPTY_BODY 1533 0.26 0.08 0.32 189 XMSubMetaSxObfu_02 1493 0.32 0.34 0.32 190 URI_WP_HACKED_2 1482 0.32 0.35 0.31 191 XMSexyCombo_01 1482 0.68 1.64 0.31 192 XMRcvdHeader_15 1477 0.23 0.00 0.31 193 XMBody_29 1468 0.29 0.22 0.31 194 XMPhish30 1456 0.65 1.55 0.31 195 XMHTMLBadTable_001 1435 0.49 0.98 0.30 196 XM_D_omniadmin_Whitelist 1428 0.22 0.00 0.30 197 XMLKML 1422 0.22 0.00 0.30 198 T_FILL_THIS_FORM_LOAN 1418 0.41 0.68 0.30 199 XM_H_PHPOS_M 1415 0.31 0.32 0.30 200 HTML_IMAGE_ONLY_24 1399 0.33 0.41 0.30 ----------------------------------------------------------------------