Email: 732004 Autolearn: 0 AvgScore: 4.96 AvgScanTime: 3.97 sec Spam: 250497 Autolearn: 0 AvgScore: 13.97 AvgScanTime: 4.87 sec Ham: 481507 Autolearn: 0 AvgScore: 0.27 AvgScanTime: 3.51 sec Time Spent Running SA: 807.72 hours Time Spent Processing Spam: 338.61 hours Time Spent Processing Ham: 469.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 242471 88.92 96.80 84.82 2 DKIM_SIGNED 177652 65.89 70.92 63.28 3 XM_DK_Pass 173954 64.70 69.44 62.23 4 DCC_CHECK 171905 43.03 68.63 29.71 5 DKIM_VALID 163710 60.43 65.35 57.87 6 XMListUnsubscribeExists 155883 47.69 62.23 40.13 7 DKIM_VALID_AU 130280 44.71 52.01 40.91 8 XM_H_QuotedFrom 115991 37.63 46.30 33.12 9 MIME_HTML_ONLY 106941 25.03 42.69 15.85 10 XM_DK_Undo_02 99336 21.15 39.66 11.52 11 BAYES_99 90255 19.54 36.03 10.96 12 BAYES_50 80745 51.25 32.23 61.14 13 HTML_FONT_LOW_CONTRAST 77938 25.66 31.11 22.82 14 LOC_TINY_FONT_1 77499 22.65 30.94 18.35 15 BAYES_999 76755 16.77 30.64 9.55 16 DCC_CHECK_NEGATIVE 75305 55.34 30.06 68.48 17 TR_DCC_Bayes_99 71686 13.14 28.62 5.08 18 XMSubLong 64282 19.94 25.66 16.96 19 FVGT_m_MULTI_ODD 55598 20.90 22.20 20.23 20 FROM_EXCESS_BASE64 54481 9.47 21.75 3.09 21 T_TM2_M_HEADER_IN_MSG 48663 27.47 19.43 31.65 22 DKIM_VALID_EF 47536 22.58 18.98 24.45 23 BOTNET 45549 6.92 18.18 1.06 24 HTML_MIME_NO_HTML_TAG 45042 7.42 17.98 1.93 25 T_REMOTE_IMAGE 44550 8.54 17.78 3.73 26 T_KAM_HTML_FONT_INVALID 43079 14.99 17.20 13.84 27 BODY_URI_ONLY 41732 5.77 16.66 0.11 28 HTML_SHORT_LINK_IMG_1 41033 8.36 16.38 4.19 29 SHORTENED_URL_SRC 40736 8.31 16.26 4.17 30 SHORTENER_SHORT_IMG 40689 8.30 16.24 4.17 31 MISSING_HEADERS 40242 5.88 16.06 0.59 32 MIME_HEADER_CTYPE_ONLY 38869 5.41 15.52 0.14 33 URI_BUFFLY 38798 8.04 15.49 4.17 34 XM_Body_Dirty_Words 38266 12.02 15.28 10.32 35 RELAYCOUNTRY_META 36453 9.07 14.55 6.22 36 XM_Multi_Part_URI 36240 10.95 14.47 9.12 37 MultiRelay 34649 16.22 13.83 17.47 38 HTML_IMAGE_RATIO_02 33937 8.81 13.55 6.35 39 RCVD_IN_RP_RNBL 30817 4.23 12.30 0.03 40 XM_Evil_Numbers_Gen 29921 8.65 11.94 6.93 41 BOTNET_IPINHOSTNAME 28399 7.38 11.34 5.31 42 BAYES_80 28383 6.33 11.33 3.73 43 FSL_BULK_SIG 27790 7.76 11.09 6.02 44 LOTS_OF_MONEY 26215 8.29 10.47 7.16 45 UNTRUSTED_Relay 25869 5.37 10.33 2.79 46 BAYES_60 23718 7.47 9.47 6.43 47 XM_B_Phish_Phrases 23238 6.51 9.28 5.08 48 XMNumbers 23020 5.13 9.19 3.02 49 HTML_IMAGE_ONLY_04 22402 4.54 8.94 2.25 50 T_XMDrugObfuBody_14 22286 7.65 8.90 7.00 51 XMSexyCombo_05 21751 4.86 8.68 2.87 52 BOTNET_NORDNS 20903 2.87 8.34 0.02 53 XM_UncommonTLD01 20816 4.83 8.31 3.01 54 HTML_IMAGE_ONLY_08 18989 3.96 7.58 2.08 55 LotsOfNums_01 17989 7.29 7.18 7.35 56 HTML_IMAGE_RATIO_04 17375 5.26 6.94 4.39 57 MPART_ALT_DIFF 17081 4.09 6.82 2.67 58 XM_H_Long_From01 16848 5.42 6.73 4.74 59 XMSubMetaSx_00 15903 5.60 6.35 5.20 60 TR_XM_DocInvoice 15843 4.64 6.32 3.76 61 TooManyTo_001 15719 9.06 6.28 10.50 62 BAYES_95 15641 3.77 6.24 2.48 63 DKIM_INVALID 13942 5.46 5.57 5.40 64 SpammyFromTLD_02 13903 2.02 5.55 0.18 65 XM_SPF_SoftFail 12865 3.32 5.14 2.37 66 RCVD_IN_RP_SAFE 10748 5.99 4.29 6.87 67 XMStrtUSub 10336 3.76 4.13 3.57 68 HTML_IMAGE_RATIO_06 10158 3.15 4.06 2.68 69 XMNoVowels 9988 2.96 3.99 2.43 70 MIME_HTML_MOSTLY 9677 2.97 3.86 2.51 71 XM_UB50 9516 2.88 3.80 2.40 72 HTML_IMAGE_RATIO_08 9478 2.58 3.78 1.96 73 TM2_M_URI_OPT_OUT 9202 3.44 3.67 3.32 74 MIME_QP_LONG_LINE 9128 4.88 3.64 5.53 75 RCVD_IN_MSPIKE_H2 8232 3.89 3.29 4.21 76 MIME_HTML_ONLY_MULTI 8115 1.78 3.24 1.02 77 RCVD_IN_RP_CERTIFIED 7868 5.06 3.14 6.06 78 URI_HEX 7595 1.85 3.03 1.23 79 XM_SendGrid 7331 4.08 2.93 4.69 80 DIET_1 7227 1.50 2.89 0.78 81 XM_DIRTYINTL 6835 1.93 2.73 1.52 82 XM_CamelCaseFrm001 6661 1.94 2.66 1.57 83 RELAYCOUNTRY_FR 6622 1.07 2.64 0.26 84 T_TooManySym_01 6398 3.25 2.55 3.61 85 XM_URI_RBL 6221 0.91 2.48 0.10 86 XMDiploma_00 6156 1.84 2.46 1.52 87 RELAYCOUNTRY_CA 5903 1.61 2.36 1.22 88 XMSubMetaI_00 5903 1.11 2.36 0.46 89 XM_OfRef6 5707 2.38 2.28 2.43 90 TR_XM_RelayPhish 5317 1.04 2.12 0.48 91 ALL_TRUSTED 5166 17.44 2.06 25.45 92 SUBJ_ALL_CAPS 4875 1.60 1.95 1.42 93 T_XMDrugObfuBody_08 4725 1.43 1.89 1.19 94 MultiRelay_CC 4668 0.77 1.86 0.20 95 MultiRelay_Combo 4668 0.77 1.86 0.20 96 T_Symld_Words_02 4649 0.87 1.86 0.36 97 XM_UB60 4555 0.67 1.82 0.07 98 MAILING_LIST_MULTI 4398 2.04 1.76 2.19 99 TR_Symld_Words 4382 1.56 1.75 1.46 100 XMSlimDrugH 4351 0.79 1.74 0.29 101 RCVD_IN_IADB_LISTED 4309 3.80 1.72 4.89 102 URIBL_BLACK 4183 0.60 1.67 0.05 103 BAYES_00 4115 5.17 1.64 7.00 104 XM_UB80 4091 0.58 1.63 0.03 105 XMGenDplmaNmb 3972 1.14 1.59 0.91 106 HTML_SHORT_CENTER 3944 0.70 1.57 0.25 107 XM_H_Long_From02 3938 2.16 1.57 2.47 108 RCVD_IN_IADB_SPF 3918 3.36 1.56 4.29 109 TM2_M_VERY_LONG_WORD 3879 1.07 1.55 0.82 110 NO_DNS_FOR_FROM 3845 0.91 1.53 0.59 111 XMPhish11 3842 1.32 1.53 1.21 112 BAYES_40 3787 3.04 1.51 3.83 113 RELAYCOUNTRY_RO 3749 0.52 1.50 0.01 114 RCVD_IN_IADB_SENDERID 3734 3.01 1.49 3.81 115 XMBody_17 3697 0.79 1.48 0.44 116 RCVD_IN_IADB_DK 3684 2.95 1.47 3.72 117 RDNS_DYNAMIC 3392 0.75 1.35 0.43 118 UNPARSEABLE_RELAY 3342 2.73 1.33 3.46 119 KHOP_DYNAMIC 3330 0.85 1.33 0.59 120 XMSubMetaI_01 3244 0.46 1.30 0.02 121 RCVD_IN_BL_SPAMCOP_NET 3230 0.60 1.29 0.24 122 URIBL_DBL_SPAM 3161 0.51 1.26 0.12 123 XM_DK_Undo_01 3094 1.55 1.24 1.72 124 XMBrknScrpt_02 3052 0.78 1.22 0.55 125 TR_LOTS_OF_MONEY3 3039 0.64 1.21 0.34 126 XM_UB99 3013 0.43 1.20 0.03 127 XMBdyGiftCard01 2993 0.89 1.19 0.73 128 HTML_FONT_SIZE_LARGE 2929 0.70 1.17 0.46 129 DKIM_ADSP_NXDOMAIN 2924 0.63 1.17 0.35 130 XMHTML_After_End 2912 0.60 1.16 0.31 131 T_XMHurry_00 2885 0.75 1.15 0.55 132 HTML_TAG_BALANCE_BODY 2884 0.71 1.15 0.48 133 SUBJ_DOLLARS 2873 0.53 1.15 0.20 134 XMSexyCombo_01 2782 1.06 1.11 1.03 135 XMStockSpam_06 2707 1.08 1.08 1.09 136 TR_XM_DK_Bayes 2700 3.13 1.08 4.20 137 URI_TRY_3LD 2686 1.36 1.07 1.51 138 XM_HighProb1 2642 0.37 1.05 0.01 139 ANY_BOUNCE_MESSAGE 2605 7.16 1.04 10.34 140 BOUNCE_MESSAGE 2605 7.16 1.04 10.34 141 XMSubject_48 2591 0.46 1.03 0.16 142 TR_LOTS_OF_MONEY1 2569 0.37 1.03 0.02 143 T_XMDrugObfuBody_00 2565 1.37 1.02 1.56 144 SpammyFromTLD_01 2509 0.82 1.00 0.72 145 RELAYCOUNTRY_IN 2501 0.40 1.00 0.10 146 TR_XM_DK_Bayes1 2501 2.78 1.00 3.71 147 DRUGS_ERECTILE 2486 0.38 0.99 0.06 148 XMPhish30 2419 0.46 0.97 0.19 149 XM_RXBody 2403 0.69 0.96 0.55 150 REMOVE_BEFORE_LINK 2373 0.47 0.95 0.23 151 TR_XM_DK_Bayes2 2356 2.26 0.94 2.95 152 XM_ProductURIs 2333 0.94 0.93 0.94 153 BAYES_20 2311 2.06 0.92 2.65 154 XM_UB95 2308 0.34 0.92 0.03 155 TR_MetaPhish_Combo_01 2305 0.81 0.92 0.75 156 T_FILL_THIS_FORM_SHORT 2297 0.97 0.92 1.00 157 DKIM_ADSP_CUSTOM_MED 2261 0.94 0.90 0.96 158 TR_Caps_n_Bayes_99 2253 0.35 0.90 0.07 159 XMSubMetaI_02 2245 0.31 0.90 0.00 160 RELAYCOUNTRY_AT 2241 0.38 0.89 0.12 161 XMClaimOffer 2167 0.37 0.87 0.11 162 MPART_ALT_DIFF_COUNT 2160 1.16 0.86 1.31 163 TM2_M_A_HREF_HREF 2154 0.62 0.86 0.50 164 XM_H_PHPOS 2145 1.09 0.86 1.21 165 XMBody_78 2137 0.51 0.85 0.33 166 FVGT_m_MULTI_ODD_EMAIL 2104 0.34 0.84 0.08 167 HTML_FONT_FACE_BAD 2075 0.51 0.83 0.34 168 HTTPS_HTTP_MISMATCH 2037 0.55 0.81 0.41 169 NML_ADSP_CUSTOM_MED 1997 0.72 0.80 0.68 170 XM_B_REG_HTML 1993 0.52 0.80 0.37 171 XMSubGiftCard1 1989 0.29 0.79 0.02 172 FORGED_GMAIL_RCVD 1972 0.58 0.79 0.48 173 XMHTMLBadTable_001 1962 0.46 0.78 0.29 174 XM_UB999 1922 0.27 0.77 0.02 175 ONLINE_PHARMACY 1914 0.27 0.76 0.01 176 T_TooManySym_02 1895 1.30 0.76 1.58 177 TooManyTo_002 1893 2.61 0.76 3.58 178 RCVD_IN_IADB_VOUCHED 1887 2.41 0.75 3.27 179 TR_LOTS_OF_MONEY2 1872 0.37 0.75 0.17 180 T_MONEY_PERCENT 1872 0.37 0.75 0.17 181 TVD_VISIT_PHARMA 1869 0.26 0.75 0.00 182 XM_Body_Obfu01 1863 0.43 0.74 0.26 183 RELAYCOUNTRY_CN 1857 0.29 0.74 0.06 184 XMSubGiftCard2 1855 0.26 0.74 0.01 185 DATE_IN_PAST_03_06 1846 0.30 0.74 0.07 186 FROM_MISSP_DYNIP 1840 0.25 0.73 0.00 187 XM_PDF 1828 3.06 0.73 4.27 188 URI_NOVOWEL 1811 0.59 0.72 0.52 189 SHORT_URI_2 1792 0.26 0.72 0.03 190 BODY_ENHANCEMENT 1782 0.26 0.71 0.02 191 XMSubMetaSxObfu_03 1769 1.34 0.71 1.67 192 AC_BR_BONANZA 1751 0.25 0.70 0.02 193 XMMoneyMeta_00 1746 0.54 0.70 0.45 194 HTML_FONT_SIZE_HUGE 1737 0.30 0.69 0.09 195 XM_BadFromFormat 1730 0.35 0.69 0.18 196 TooManyTo_003 1694 2.06 0.68 2.78 197 T_HTML_TAG_BALANCE_CENTER 1674 0.32 0.67 0.14 198 RELAYCOUNTRY_GB 1674 0.89 0.67 1.00 199 DRUG_ED_CAPS 1653 0.23 0.66 0.00 200 XMPhish14 1629 1.08 0.65 1.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 408421 88.92 96.80 84.82 2 DCC_CHECK_NEGATIVE 329754 55.34 30.06 68.48 3 DKIM_SIGNED 304675 65.89 70.92 63.28 4 XM_DK_Pass 299664 64.70 69.44 62.23 5 BAYES_50 294403 51.25 32.23 61.14 6 DKIM_VALID 278665 60.43 65.35 57.87 7 DKIM_VALID_AU 196982 44.71 52.01 40.91 8 XMListUnsubscribeExists 193226 47.69 62.23 40.13 9 XM_H_QuotedFrom 159469 37.63 46.30 33.12 10 T_TM2_M_HEADER_IN_MSG 152407 27.47 19.43 31.65 11 DCC_CHECK 143051 43.03 68.63 29.71 12 ALL_TRUSTED 122531 17.44 2.06 25.45 13 DKIM_VALID_EF 117741 22.58 18.98 24.45 14 HTML_FONT_LOW_CONTRAST 109870 25.66 31.11 22.82 15 FVGT_m_MULTI_ODD 97400 20.90 22.20 20.23 16 LOC_TINY_FONT_1 88334 22.65 30.94 18.35 17 MultiRelay 84108 16.22 13.83 17.47 18 XMSubLong 81648 19.94 25.66 16.96 19 MIME_HTML_ONLY 76316 25.03 42.69 15.85 20 T_KAM_HTML_FONT_INVALID 66622 14.99 17.20 13.84 21 XM_DK_Undo_02 55487 21.15 39.66 11.52 22 BAYES_99 52789 19.54 36.03 10.96 23 TooManyTo_001 50571 9.06 6.28 10.50 24 ANY_BOUNCE_MESSAGE 49791 7.16 1.04 10.34 25 BOUNCE_MESSAGE 49787 7.16 1.04 10.34 26 XM_Body_Dirty_Words 49699 12.02 15.28 10.32 27 BAYES_999 45968 16.77 30.64 9.55 28 XM_DKIMWhitelistDomains 44295 6.07 0.05 9.20 29 XM_Multi_Part_URI 43910 10.95 14.47 9.12 30 LotsOfNums_01 35389 7.29 7.18 7.35 31 LOTS_OF_MONEY 34470 8.29 10.47 7.16 32 BAYES_00 33728 5.17 1.64 7.00 33 T_XMDrugObfuBody_14 33714 7.65 8.90 7.00 34 XM_Evil_Numbers_Gen 33385 8.65 11.94 6.93 35 RCVD_IN_RP_SAFE 33095 5.99 4.29 6.87 36 BAYES_60 30966 7.47 9.47 6.43 37 HTML_IMAGE_RATIO_02 30563 8.81 13.55 6.35 38 RELAYCOUNTRY_META 29969 9.07 14.55 6.22 39 RCVD_IN_RP_CERTIFIED 29174 5.06 3.14 6.06 40 FSL_BULK_SIG 28984 7.76 11.09 6.02 41 MIME_QP_LONG_LINE 26628 4.88 3.64 5.53 42 DKIM_INVALID 26010 5.46 5.57 5.40 43 BOTNET_IPINHOSTNAME 25591 7.38 11.34 5.31 44 XMSubMetaSx_00 25058 5.60 6.35 5.20 45 TR_DCC_Bayes_99 24472 13.14 28.62 5.08 46 XM_B_Phish_Phrases 24445 6.51 9.28 5.08 47 RCVD_IN_IADB_LISTED 23534 3.80 1.72 4.89 48 XM_H_Long_From01 22807 5.42 6.73 4.74 49 XM_SendGrid 22567 4.08 2.93 4.69 50 IN_ZIMBRA_NJ_WHITELIST 22405 3.07 0.02 4.65 51 HTML_IMAGE_RATIO_04 21122 5.26 6.94 4.39 52 RCVD_IN_IADB_SPF 20663 3.36 1.56 4.29 53 XM_PDF 20580 3.06 0.73 4.27 54 RCVD_IN_MSPIKE_H2 20274 3.89 3.29 4.21 55 TR_XM_DK_Bayes 20201 3.13 1.08 4.20 56 HTML_SHORT_LINK_IMG_1 20191 8.36 16.38 4.19 57 SHORTENED_URL_SRC 20082 8.31 16.26 4.17 58 URI_BUFFLY 20059 8.04 15.49 4.17 59 SHORTENER_SHORT_IMG 20055 8.30 16.24 4.17 60 BAYES_40 18432 3.04 1.51 3.83 61 RCVD_IN_IADB_SENDERID 18335 3.01 1.49 3.81 62 TR_XM_DocInvoice 18124 4.64 6.32 3.76 63 BAYES_80 17980 6.33 11.33 3.73 64 T_REMOTE_IMAGE 17947 8.54 17.78 3.73 65 RCVD_IN_IADB_DK 17918 2.95 1.47 3.72 66 TR_XM_DK_Bayes1 17878 2.78 1.00 3.71 67 T_TooManySym_01 17361 3.25 2.55 3.61 68 TooManyTo_002 17223 2.61 0.76 3.58 69 XMStrtUSub 17211 3.76 4.13 3.57 70 UNPARSEABLE_RELAY 16642 2.73 1.33 3.46 71 TM2_M_URI_OPT_OUT 15991 3.44 3.67 3.32 72 RCVD_IN_IADB_VOUCHED 15733 2.41 0.75 3.27 73 TVD_RCVD_IP 15255 2.19 0.31 3.17 74 FROM_EXCESS_BASE64 14872 9.47 21.75 3.09 75 XMNumbers 14536 5.13 9.19 3.02 76 XM_UncommonTLD01 14516 4.83 8.31 3.01 77 TR_XM_DK_Bayes2 14212 2.26 0.94 2.95 78 XMSexyCombo_05 13804 4.86 8.68 2.87 79 UNTRUSTED_Relay 13422 5.37 10.33 2.79 80 TooManyTo_003 13364 2.06 0.68 2.78 81 HTML_IMAGE_RATIO_06 12915 3.15 4.06 2.68 82 MPART_ALT_DIFF 12845 4.09 6.82 2.67 83 BAYES_20 12777 2.06 0.92 2.65 84 MIME_HTML_MOSTLY 12088 2.97 3.86 2.51 85 BAYES_95 11926 3.77 6.24 2.48 86 XM_H_Long_From02 11899 2.16 1.57 2.47 87 XM_OfRef6 11713 2.38 2.28 2.43 88 XMNoVowels 11710 2.96 3.99 2.43 89 XM_UB50 11568 2.88 3.80 2.40 90 XM_SPF_SoftFail 11406 3.32 5.14 2.37 91 HTML_IMAGE_ONLY_04 10855 4.54 8.94 2.25 92 MAILING_LIST_MULTI 10542 2.04 1.76 2.19 93 HTML_IMAGE_ONLY_08 9994 3.96 7.58 2.08 94 RCVD_IN_IADB_OPTIN 9812 1.50 0.46 2.04 95 HELO_NODOT 9803 1.43 0.28 2.04 96 HTML_IMAGE_RATIO_08 9442 2.58 3.78 1.96 97 HTML_MIME_NO_HTML_TAG 9306 7.42 17.98 1.93 98 RCVD_IN_MSPIKE_WL 8836 1.35 0.40 1.84 99 RCVD_IN_MSPIKE_H3 8827 1.34 0.40 1.83 100 RELAYCOUNTRY_PH 8495 1.17 0.02 1.76 101 XM_DK_Undo_01 8264 1.55 1.24 1.72 102 BAYES_05 8085 1.29 0.55 1.68 103 XMSubMetaSxObfu_03 8056 1.34 0.71 1.67 104 IN_HORDE_ADDRESS_BOOK 7928 1.10 0.04 1.65 105 T_TooManySym_02 7587 1.30 0.76 1.58 106 XM_CamelCaseFrm001 7552 1.94 2.66 1.57 107 T_XMDrugObfuBody_00 7495 1.37 1.02 1.56 108 XMDiploma_00 7328 1.84 2.46 1.52 109 XM_DIRTYINTL 7303 1.93 2.73 1.52 110 XMCapTrack 7293 1.19 0.56 1.51 111 URI_TRY_3LD 7273 1.36 1.07 1.51 112 TR_Symld_Words 7045 1.56 1.75 1.46 113 INVALID_MSGID 6991 1.02 0.19 1.45 114 SUBJ_ALL_CAPS 6848 1.60 1.95 1.42 115 TO_MALFORMED 6463 0.89 0.03 1.34 116 MPART_ALT_DIFF_COUNT 6302 1.16 0.86 1.31 117 XMPhish14 6274 1.08 0.65 1.30 118 TooManyTo_004 6188 0.98 0.40 1.29 119 USER_IN_DEF_DKIM_WL 6106 0.84 0.02 1.27 120 URI_HEX 5934 1.85 3.03 1.23 121 RELAYCOUNTRY_CA 5894 1.61 2.36 1.22 122 XM_H_PHPOS 5825 1.09 0.86 1.21 123 XMPhish11 5825 1.32 1.53 1.21 124 T_XMDrugObfuBody_08 5752 1.43 1.89 1.19 125 XMLngstWrd_00 5503 0.88 0.38 1.14 126 XM_GoogleGroups 5334 0.87 0.40 1.11 127 XMStockSpam_06 5235 1.08 1.08 1.09 128 TooManyTo_005 5223 0.83 0.35 1.08 129 BOTNET 5095 6.92 18.18 1.06 130 XMSexyCombo_01 4962 1.06 1.11 1.03 131 MIME_HTML_ONLY_MULTI 4926 1.78 3.24 1.02 132 XMLngstWrd_01 4846 0.78 0.36 1.01 133 T_FILL_THIS_FORM_SHORT 4806 0.97 0.92 1.00 134 RELAYCOUNTRY_GB 4805 0.89 0.67 1.00 135 XM_GRM 4680 0.64 0.00 0.97 136 DKIM_ADSP_CUSTOM_MED 4615 0.94 0.90 0.96 137 XM_ProductURIs 4522 0.94 0.93 0.94 138 XMGenDplmaNmb 4360 1.14 1.59 0.91 139 TR_Mismatch_TLD_01 4080 0.63 0.23 0.85 140 TM2_M_VERY_LONG_WORD 3958 1.07 1.55 0.82 141 DIET_1 3750 1.50 2.89 0.78 142 XMSubMetaSx_01 3749 0.62 0.31 0.78 143 TR_MetaPhish_Combo_01 3592 0.81 0.92 0.75 144 XMBdyGiftCard01 3531 0.89 1.19 0.73 145 SpammyFromTLD_01 3464 0.82 1.00 0.72 146 NML_ADSP_CUSTOM_MED 3271 0.72 0.80 0.68 147 USER_IN_WHITELIST 3237 0.44 0.00 0.67 148 XM_H_PHPMailer 3106 0.64 0.62 0.65 149 T_TooManySym_03 2904 0.44 0.13 0.60 150 XMSexyCombo_04 2873 0.55 0.47 0.60 151 KHOP_DYNAMIC 2861 0.85 1.33 0.59 152 XMLngstWrd_02 2836 0.49 0.30 0.59 153 NO_DNS_FOR_FROM 2821 0.91 1.53 0.59 154 MISSING_HEADERS 2818 5.88 16.06 0.59 155 XMBody_95 2760 0.42 0.12 0.57 156 XM_RXBody 2672 0.69 0.96 0.55 157 XMBrknScrpt_02 2669 0.78 1.22 0.55 158 XMGappySubj_01 2645 0.48 0.34 0.55 159 XMSexyCombo_02 2640 0.41 0.13 0.55 160 T_XMHurry_00 2635 0.75 1.15 0.55 161 T_OBFU_PDF_ATTACH 2564 0.41 0.18 0.53 162 SHORT_HELO_AND_INLINE_IMAGE 2561 0.37 0.07 0.53 163 RELAYCOUNTRY_DE 2510 0.55 0.61 0.52 164 URI_NOVOWEL 2492 0.59 0.72 0.52 165 TM2_M_A_HREF_HREF 2390 0.62 0.86 0.50 166 TR_XM_RelayPhish 2329 1.04 2.12 0.48 167 XM_ShortIntro_01 2326 0.42 0.30 0.48 168 XMSubMetaSxObfu_02 2325 0.41 0.27 0.48 169 HTML_TAG_BALANCE_BODY 2304 0.71 1.15 0.48 170 FORGED_GMAIL_RCVD 2300 0.58 0.79 0.48 171 XMhairloss01 2263 0.36 0.14 0.47 172 RCVD_IN_SORBS_DUL 2237 0.37 0.20 0.46 173 HTML_IMAGE_ONLY_32 2234 0.40 0.29 0.46 174 HTML_FONT_SIZE_LARGE 2209 0.70 1.17 0.46 175 XMSubMetaI_00 2208 1.11 2.36 0.46 176 XMMoneyMeta_00 2190 0.54 0.70 0.45 177 T_MANY_PILL_PRICE 2162 0.31 0.05 0.45 178 TM2_M_BODY_EMPTY 2141 0.39 0.28 0.44 179 XMBody_17 2099 0.79 1.48 0.44 180 XMDateMe_00 2084 0.35 0.20 0.43 181 RDNS_DYNAMIC 2082 0.75 1.35 0.43 182 FILL_THIS_FORM 2057 0.49 0.61 0.43 183 HTML_IMAGE_ONLY_28 2006 0.40 0.36 0.42 184 HTTPS_HTTP_MISMATCH 1997 0.55 0.81 0.41 185 URIBL_SBL_A 1838 0.36 0.31 0.38 186 XM_Sft_Brands_C01 1807 0.32 0.22 0.38 187 XM_B_REG_HTML 1798 0.52 0.80 0.37 188 XMLngstWrd_03 1796 0.32 0.21 0.37 189 HTML_IMAGE_ONLY_24 1775 0.34 0.30 0.37 190 T_Symld_Words_02 1739 0.87 1.86 0.36 191 AC_DIV_BONANZA 1735 0.26 0.08 0.36 192 RELAYCOUNTRY_AU 1734 0.42 0.52 0.36 193 XM_B_COPY_HTML 1715 0.45 0.63 0.36 194 DKIM_ADSP_NXDOMAIN 1683 0.63 1.17 0.35 195 HTML_FONT_FACE_BAD 1650 0.51 0.83 0.34 196 TR_LOTS_OF_MONEY3 1644 0.64 1.21 0.34 197 HTML_IMAGE_ONLY_16 1639 0.28 0.18 0.34 198 XMSubNoVowel 1632 0.31 0.26 0.34 199 T_FILL_THIS_FORM_LONG 1632 0.41 0.54 0.34 200 XMBody_78 1572 0.51 0.85 0.33 ----------------------------------------------------------------------