Email: 739486 Autolearn: 0 AvgScore: 4.96 AvgScanTime: 4.16 sec Spam: 258797 Autolearn: 0 AvgScore: 13.88 AvgScanTime: 4.72 sec Ham: 480689 Autolearn: 0 AvgScore: 0.16 AvgScanTime: 3.85 sec Time Spent Running SA: 853.94 hours Time Spent Processing Spam: 339.60 hours Time Spent Processing Ham: 514.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 250417 90.71 96.76 87.45 2 DCC_CHECK 184388 45.26 71.25 31.28 3 DKIM_SIGNED 180646 67.89 69.80 66.86 4 XM_DK_Pass 176582 66.58 68.23 65.69 5 DKIM_VALID 166294 62.34 64.26 61.31 6 XMListUnsubscribeExists 155643 49.45 60.14 43.69 7 DKIM_VALID_AU 129424 44.79 50.01 41.98 8 MIME_HTML_ONLY 117900 26.74 45.56 16.61 9 XM_H_QuotedFrom 115394 36.02 44.59 31.41 10 BAYES_99 110829 22.26 42.82 11.18 11 XM_DK_Undo_02 104409 21.75 40.34 11.75 12 BAYES_999 87125 18.05 33.67 9.65 13 TR_DCC_Bayes_99 79921 14.13 30.88 5.12 14 HTML_FONT_LOW_CONTRAST 78251 27.02 30.24 25.29 15 LOC_TINY_FONT_1 77402 22.92 29.91 19.16 16 DCC_CHECK_NEGATIVE 71223 53.10 27.52 66.87 17 BAYES_50 70364 49.33 27.19 61.25 18 FROM_EXCESS_BASE64 67005 10.90 25.89 2.84 19 XMSubLong 65970 21.26 25.49 18.99 20 T_TM2_M_HEADER_IN_MSG 61207 27.76 23.65 29.98 21 HTML_MIME_NO_HTML_TAG 57002 9.12 22.03 2.16 22 FVGT_m_MULTI_ODD 55741 21.18 21.54 20.99 23 MIME_HEADER_CTYPE_ONLY 52971 7.26 20.47 0.15 24 XM_BadFromFormat 52752 7.22 20.38 0.13 25 HTML_IMAGE_ONLY_08 52487 10.83 20.28 5.73 26 HTML_SHORT_LINK_IMG_1 52378 10.76 20.24 5.66 27 HTML_FONT_SIZE_HUGE 52351 10.79 20.23 5.71 28 MISSING_HEADERS 52262 7.39 20.19 0.50 29 SHORTENER_SHORT_IMG 52040 10.70 20.11 5.63 30 URI_BUFFLY 52024 10.69 20.10 5.63 31 DKIM_VALID_EF 50726 23.34 19.60 25.35 32 T_KAM_HTML_FONT_INVALID 47331 16.02 18.29 14.79 33 FSL_BULK_SIG 44041 9.87 17.02 6.02 34 BODY_URI_ONLY 43618 5.93 16.85 0.05 35 XM_Body_Dirty_Words 41520 12.06 16.04 9.91 36 XM_UncommonTLD01 39134 7.39 15.12 3.23 37 XM_Multi_Part_URI 36074 11.35 13.94 9.96 38 HTML_IMAGE_RATIO_02 35534 9.56 13.73 7.32 39 MultiRelay 33246 16.04 12.85 17.76 40 RELAYCOUNTRY_META 30940 8.44 11.96 6.54 41 LOTS_OF_MONEY 29010 9.49 11.21 8.56 42 BAYES_80 28791 6.47 11.12 3.96 43 BOTNET_IPINHOSTNAME 28488 6.99 11.01 4.82 44 SpammyFromTLD_02 27357 3.92 10.57 0.34 45 XM_Evil_Numbers_Gen 27148 8.22 10.49 7.00 46 XMNumbers 27036 5.57 10.45 2.95 47 BOTNET 26461 4.26 10.22 1.05 48 XMSexyCombo_05 25620 5.42 9.90 3.01 49 BAYES_60 21410 7.15 8.27 6.54 50 T_XMDrugObfuBody_14 21395 7.54 8.27 7.15 51 HTML_IMAGE_RATIO_04 18951 5.49 7.32 4.51 52 UNTRUSTED_Relay 18604 4.30 7.19 2.74 53 XM_H_Long_From01 18210 5.78 7.04 5.11 54 XM_B_Phish_Phrases 18181 5.17 7.03 4.17 55 XMSubMetaSx_00 17740 4.67 6.85 3.49 56 BAYES_95 17630 4.14 6.81 2.70 57 LotsOfNums_01 16004 7.39 6.18 8.04 58 MPART_ALT_DIFF 15612 3.62 6.03 2.33 59 TooManyTo_001 15374 8.37 5.94 9.67 60 TR_XM_DocInvoice 15059 4.10 5.82 3.17 61 DKIM_INVALID 14352 5.55 5.55 5.55 62 XM_JunkDunk 13459 1.82 5.20 0.00 63 RCVD_IN_RP_SAFE 12262 6.32 4.74 7.16 64 MIME_HTML_MOSTLY 11271 2.92 4.36 2.14 65 XM_SendGrid 10222 4.57 3.95 4.90 66 HTML_IMAGE_RATIO_06 9778 3.52 3.78 3.39 67 XM_DIRTYINTL 9611 2.45 3.71 1.77 68 MIME_QP_LONG_LINE 9428 4.81 3.64 5.44 69 RCVD_IN_RP_CERTIFIED 9116 5.25 3.52 6.18 70 TM2_M_URI_OPT_OUT 8790 2.43 3.40 1.91 71 XM_UB50 8484 2.71 3.28 2.40 72 HTML_IMAGE_RATIO_08 8199 2.29 3.17 1.82 73 MIME_HTML_ONLY_MULTI 8170 1.72 3.16 0.94 74 XMStrtUSub 8064 3.48 3.12 3.68 75 RCVD_IN_RP_RNBL 7961 1.11 3.08 0.05 76 XM_CamelCaseFrm001 7518 2.14 2.90 1.72 77 DIET_1 7496 1.54 2.90 0.80 78 XM_SPF_SoftFail 7047 2.21 2.72 1.93 79 RCVD_IN_MSPIKE_H2 6871 4.04 2.65 4.79 80 XMSlimDrugH 6795 1.19 2.63 0.41 81 SpammyFromTLD_01 6737 1.45 2.60 0.83 82 RELAYCOUNTRY_CA 6469 1.70 2.50 1.27 83 XMMoneyMeta_00 6446 1.27 2.49 0.62 84 SUBJ_DOLLARS 6430 0.96 2.48 0.15 85 T_XMDrugObfuBody_08 6087 1.67 2.35 1.31 86 XMDiploma_00 6079 2.13 2.35 2.01 87 XM_OfRef6 5932 1.74 2.29 1.45 88 T_REMOTE_IMAGE 5916 3.81 2.29 4.63 89 T_TooManySym_01 5684 3.51 2.20 4.22 90 T_Symld_Words_02 5283 1.01 2.04 0.46 91 XM_URI_RBL 5255 0.78 2.03 0.11 92 XMWghtMeta_00 5206 0.72 2.01 0.03 93 XMBdyGiftCard01 5129 1.09 1.98 0.61 94 RCVD_IN_IADB_LISTED 5115 4.76 1.98 6.26 95 URI_HEX 5071 1.80 1.96 1.71 96 MultiRelay_Combo 5041 0.78 1.95 0.16 97 MultiRelay_CC 5041 0.78 1.95 0.16 98 RCVD_IN_IADB_SPF 4807 4.14 1.86 5.38 99 RCVD_IN_IADB_SENDERID 4613 3.65 1.78 4.65 100 RCVD_IN_IADB_DK 4582 3.58 1.77 4.56 101 XM_H_Long_From02 4546 2.23 1.76 2.49 102 XMGenDplmaNmb 4421 1.41 1.71 1.25 103 RCVD_IN_BL_SPAMCOP_NET 4208 0.75 1.63 0.27 104 XMSubMetaI_00 3764 0.79 1.45 0.43 105 TM2_M_VERY_LONG_WORD 3742 0.99 1.45 0.75 106 MAILING_LIST_MULTI 3586 2.13 1.39 2.52 107 XMSexyCombo_01 3513 0.74 1.36 0.40 108 BOTNET_NORDNS 3438 0.48 1.33 0.02 109 SUBJ_ALL_CAPS 3419 1.50 1.32 1.59 110 T_XMDrugObfuBody_00 3341 0.85 1.29 0.62 111 UNPARSEABLE_RELAY 3286 2.91 1.27 3.80 112 URIBL_BLACK 3273 0.46 1.26 0.03 113 TR_XM_RelayPhish 3246 0.74 1.25 0.46 114 XM_ProductURIs 3130 1.03 1.21 0.94 115 XMHTML_After_End 3073 0.67 1.19 0.39 116 RELAYCOUNTRY_CN 3067 0.45 1.19 0.05 117 BAYES_40 3042 2.70 1.18 3.51 118 XMPhish11 3026 1.32 1.17 1.40 119 XMBrknScrpt_02 3018 0.68 1.17 0.42 120 XM_UB99 2978 0.41 1.15 0.01 121 BAYES_00 2934 4.73 1.13 6.67 122 XM_DK_Undo_01 2931 1.55 1.13 1.77 123 T_XMHurry_00 2908 0.70 1.12 0.47 124 RELAYCOUNTRY_FR 2867 0.56 1.11 0.26 125 SUBJECT_DIET 2859 0.39 1.10 0.00 126 URI_TRY_3LD 2828 1.17 1.09 1.22 127 XMBody_17 2738 0.65 1.06 0.43 128 NO_DNS_FOR_FROM 2614 0.80 1.01 0.69 129 SUBJ_BUY 2580 0.37 1.00 0.03 130 TR_XM_DK_Bayes 2563 3.18 0.99 4.35 131 LOW_PRICE 2541 0.48 0.98 0.21 132 XMMoneyMeta_01 2484 0.37 0.96 0.06 133 XMSlimDrugs 2481 0.35 0.96 0.03 134 XM_UB60 2463 0.38 0.95 0.08 135 ALL_TRUSTED 2449 15.27 0.95 22.98 136 URI_NOVOWEL 2442 0.62 0.94 0.45 137 URIBL_DBL_SPAM 2414 0.35 0.93 0.04 138 BAYES_20 2409 1.97 0.93 2.52 139 TR_LOTS_OF_MONEY1 2403 0.34 0.93 0.02 140 TR_XM_DK_Bayes1 2383 2.81 0.92 3.83 141 XM_HighProb1 2375 0.33 0.92 0.01 142 TR_Symld_Words 2365 1.41 0.91 1.68 143 XMStockSpam_06 2361 1.09 0.91 1.18 144 XMBody_78 2360 0.57 0.91 0.38 145 XMPhish30 2357 0.52 0.91 0.31 146 RCVD_IN_IADB_VOUCHED 2228 3.17 0.86 4.41 147 XM_UB999 2210 0.31 0.85 0.01 148 NO_MEDICAL 2206 0.30 0.85 0.00 149 XMHTMLBadTable_001 2187 0.56 0.85 0.41 150 TR_XM_DK_Bayes2 2183 2.27 0.84 3.03 151 FVGT_m_MULTI_ODD_EMAIL 2148 0.31 0.83 0.03 152 TR_LOTS_OF_MONEY3 2104 0.42 0.81 0.21 153 XM_RXBody 2098 0.33 0.81 0.08 154 TM2_M_A_HREF_HREF 2090 0.65 0.81 0.56 155 T_FILL_THIS_FORM_SHORT 2065 0.82 0.80 0.83 156 T_TooManySym_02 2058 1.55 0.80 1.95 157 XM_H_PHPMailer 2050 0.68 0.79 0.62 158 RELAYCOUNTRY_AT 2014 0.35 0.78 0.11 159 XM_B_REG_HTML 2009 0.52 0.78 0.37 160 HTML_TAG_BALANCE_BODY 2007 0.54 0.78 0.42 161 TooManyTo_002 2001 2.06 0.77 2.75 162 PLING_QUERY 1992 0.44 0.77 0.27 163 TR_LOTS_OF_MONEY2 1938 0.58 0.75 0.49 164 T_MONEY_PERCENT 1938 0.58 0.75 0.49 165 RELAYCOUNTRY_GB 1891 0.94 0.73 1.06 166 XM_PDF 1884 3.18 0.73 4.50 167 XM_UB80 1865 0.29 0.72 0.05 168 RELAYCOUNTRY_DE 1848 0.50 0.71 0.39 169 HTML_FONT_FACE_BAD 1846 0.54 0.71 0.45 170 XMPhish14 1835 0.43 0.71 0.29 171 TooManyTo_003 1747 1.52 0.68 1.97 172 ANY_BOUNCE_MESSAGE 1740 7.48 0.67 11.15 173 BOUNCE_MESSAGE 1738 7.48 0.67 11.15 174 RCVD_IN_MSPIKE_WL 1734 1.65 0.67 2.18 175 RCVD_IN_MSPIKE_H3 1725 1.65 0.67 2.18 176 MPART_ALT_DIFF_COUNT 1700 0.47 0.66 0.37 177 REMOVE_BEFORE_LINK 1686 0.43 0.65 0.30 178 XM_H_PHPOS 1684 1.14 0.65 1.41 179 XMSubMetaSxObfu_03 1675 0.43 0.65 0.31 180 TR_MetaPhish_Combo_01 1662 0.73 0.64 0.77 181 DKIM_ADSP_CUSTOM_MED 1656 0.89 0.64 1.02 182 XMSexyCombo_04 1643 0.27 0.63 0.07 183 TRACKER_ID 1625 0.34 0.63 0.18 184 XM_Body_Obfu01 1582 0.41 0.61 0.30 185 XM_B_COPY_HTML 1570 0.47 0.61 0.39 186 XMSubNoVowel 1527 0.40 0.59 0.30 187 FILL_THIS_FORM 1520 0.50 0.59 0.45 188 TVD_SPACE_RATIO_MINFP 1517 0.21 0.59 0.00 189 RDNS_DYNAMIC 1514 0.48 0.59 0.42 190 HTTPS_HTTP_MISMATCH 1509 0.47 0.58 0.40 191 XMClaimOffer 1473 0.29 0.57 0.14 192 XMSubMetaSSx_00 1470 0.37 0.57 0.27 193 LONG_JUNK_URI3 1455 0.21 0.56 0.02 194 HTML_IMAGE_ONLY_28 1455 0.49 0.56 0.44 195 RELAYCOUNTRY_AU 1451 0.49 0.56 0.46 196 FORGED_GMAIL_RCVD 1444 0.52 0.56 0.51 197 RCVD_IN_IADB_OPTIN 1362 2.00 0.53 2.79 198 NML_ADSP_CUSTOM_MED 1346 0.67 0.52 0.75 199 BASE64_LENGTH_79_INF 1339 0.23 0.52 0.07 200 TooManyTo_004 1336 0.98 0.52 1.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 420367 90.71 96.76 87.45 2 DCC_CHECK_NEGATIVE 321416 53.10 27.52 66.87 3 DKIM_SIGNED 321395 67.89 69.80 66.86 4 XM_DK_Pass 315764 66.58 68.23 65.69 5 DKIM_VALID 294706 62.34 64.26 61.31 6 BAYES_50 294426 49.33 27.19 61.25 7 XMListUnsubscribeExists 210012 49.45 60.14 43.69 8 DKIM_VALID_AU 201805 44.79 50.01 41.98 9 XM_H_QuotedFrom 150986 36.02 44.59 31.41 10 DCC_CHECK 150339 45.26 71.25 31.28 11 T_TM2_M_HEADER_IN_MSG 144095 27.76 23.65 29.98 12 DKIM_VALID_EF 121862 23.34 19.60 25.35 13 HTML_FONT_LOW_CONTRAST 121557 27.02 30.24 25.29 14 ALL_TRUSTED 110469 15.27 0.95 22.98 15 FVGT_m_MULTI_ODD 100886 21.18 21.54 20.99 16 LOC_TINY_FONT_1 92077 22.92 29.91 19.16 17 XMSubLong 91274 21.26 25.49 18.99 18 MultiRelay 85381 16.04 12.85 17.76 19 MIME_HTML_ONLY 79825 26.74 45.56 16.61 20 T_KAM_HTML_FONT_INVALID 71101 16.02 18.29 14.79 21 XM_DK_Undo_02 56461 21.75 40.34 11.75 22 BAYES_99 53763 22.26 42.82 11.18 23 ANY_BOUNCE_MESSAGE 53604 7.48 0.67 11.15 24 BOUNCE_MESSAGE 53603 7.48 0.67 11.15 25 XM_Multi_Part_URI 47854 11.35 13.94 9.96 26 XM_Body_Dirty_Words 47652 12.06 16.04 9.91 27 XM_DKIMWhitelistDomains 47386 6.41 0.01 9.86 28 TooManyTo_001 46485 8.37 5.94 9.67 29 BAYES_999 46373 18.05 33.67 9.65 30 LOTS_OF_MONEY 41135 9.49 11.21 8.56 31 LotsOfNums_01 38669 7.39 6.18 8.04 32 HTML_IMAGE_RATIO_02 35188 9.56 13.73 7.32 33 RCVD_IN_RP_SAFE 34438 6.32 4.74 7.16 34 T_XMDrugObfuBody_14 34358 7.54 8.27 7.15 35 XM_Evil_Numbers_Gen 33635 8.22 10.49 7.00 36 BAYES_00 32044 4.73 1.13 6.67 37 RELAYCOUNTRY_META 31455 8.44 11.96 6.54 38 BAYES_60 31439 7.15 8.27 6.54 39 RCVD_IN_IADB_LISTED 30070 4.76 1.98 6.26 40 RCVD_IN_RP_CERTIFIED 29686 5.25 3.52 6.18 41 FSL_BULK_SIG 28957 9.87 17.02 6.02 42 HTML_IMAGE_ONLY_08 27564 10.83 20.28 5.73 43 HTML_FONT_SIZE_HUGE 27457 10.79 20.23 5.71 44 HTML_SHORT_LINK_IMG_1 27205 10.76 20.24 5.66 45 SHORTENER_SHORT_IMG 27053 10.70 20.11 5.63 46 URI_BUFFLY 27053 10.69 20.10 5.63 47 DKIM_INVALID 26689 5.55 5.55 5.55 48 MIME_QP_LONG_LINE 26159 4.81 3.64 5.44 49 RCVD_IN_IADB_SPF 25844 4.14 1.86 5.38 50 TR_DCC_Bayes_99 24600 14.13 30.88 5.12 51 XM_H_Long_From01 24546 5.78 7.04 5.11 52 XM_SendGrid 23545 4.57 3.95 4.90 53 BOTNET_IPINHOSTNAME 23173 6.99 11.01 4.82 54 RCVD_IN_MSPIKE_H2 23028 4.04 2.65 4.79 55 RCVD_IN_IADB_SENDERID 22371 3.65 1.78 4.65 56 T_REMOTE_IMAGE 22267 3.81 2.29 4.63 57 IN_ZIMBRA_NJ_WHITELIST 21999 2.98 0.03 4.58 58 RCVD_IN_IADB_DK 21906 3.58 1.77 4.56 59 HTML_IMAGE_RATIO_04 21672 5.49 7.32 4.51 60 XM_PDF 21612 3.18 0.73 4.50 61 RCVD_IN_IADB_VOUCHED 21199 3.17 0.86 4.41 62 TR_XM_DK_Bayes 20932 3.18 0.99 4.35 63 T_TooManySym_01 20288 3.51 2.20 4.22 64 XM_B_Phish_Phrases 20057 5.17 7.03 4.17 65 BAYES_80 19040 6.47 11.12 3.96 66 TR_XM_DK_Bayes1 18400 2.81 0.92 3.83 67 UNPARSEABLE_RELAY 18250 2.91 1.27 3.80 68 XMStrtUSub 17686 3.48 3.12 3.68 69 BAYES_40 16888 2.70 1.18 3.51 70 TVD_RCVD_IP 16874 2.36 0.22 3.51 71 XMSubMetaSx_00 16768 4.67 6.85 3.49 72 HTML_IMAGE_RATIO_06 16281 3.52 3.78 3.39 73 XM_UncommonTLD01 15503 7.39 15.12 3.23 74 TR_XM_DocInvoice 15256 4.10 5.82 3.17 75 TR_XM_DK_Bayes2 14568 2.27 0.84 3.03 76 XMSexyCombo_05 14490 5.42 9.90 3.01 77 XMNumbers 14183 5.57 10.45 2.95 78 FROM_EXCESS_BASE64 13628 10.90 25.89 2.84 79 RCVD_IN_IADB_OPTIN 13411 2.00 0.53 2.79 80 TooManyTo_002 13214 2.06 0.77 2.75 81 UNTRUSTED_Relay 13191 4.30 7.19 2.74 82 BAYES_95 12976 4.14 6.81 2.70 83 BAYES_20 12137 1.97 0.93 2.52 84 MAILING_LIST_MULTI 12136 2.13 1.39 2.52 85 XM_H_Long_From02 11946 2.23 1.76 2.49 86 XM_UB50 11541 2.71 3.28 2.40 87 MPART_ALT_DIFF 11180 3.62 6.03 2.33 88 RCVD_IN_MSPIKE_WL 10474 1.65 0.67 2.18 89 RCVD_IN_MSPIKE_H3 10463 1.65 0.67 2.18 90 HTML_MIME_NO_HTML_TAG 10406 9.12 22.03 2.16 91 MIME_HTML_MOSTLY 10286 2.92 4.36 2.14 92 XMDiploma_00 9681 2.13 2.35 2.01 93 TooManyTo_003 9493 1.52 0.68 1.97 94 T_TooManySym_02 9378 1.55 0.80 1.95 95 XM_SPF_SoftFail 9267 2.21 2.72 1.93 96 TM2_M_URI_OPT_OUT 9191 2.43 3.40 1.91 97 HTML_IMAGE_RATIO_08 8758 2.29 3.17 1.82 98 XM_DK_Undo_01 8530 1.55 1.13 1.77 99 XM_DIRTYINTL 8492 2.45 3.71 1.77 100 XM_CamelCaseFrm001 8290 2.14 2.90 1.72 101 HELO_NODOT 8287 1.20 0.22 1.72 102 RELAYCOUNTRY_PH 8211 1.12 0.01 1.71 103 URI_HEX 8203 1.80 1.96 1.71 104 TR_Symld_Words 8079 1.41 0.91 1.68 105 IN_HORDE_ADDRESS_BOOK 8075 1.11 0.04 1.68 106 SUBJ_ALL_CAPS 7663 1.50 1.32 1.59 107 BAYES_05 7463 1.17 0.46 1.55 108 INVALID_MSGID 7199 1.04 0.18 1.50 109 XM_OfRef6 6970 1.74 2.29 1.45 110 USER_IN_DEF_DKIM_WL 6809 0.93 0.03 1.42 111 XM_H_PHPOS 6773 1.14 0.65 1.41 112 XMPhish11 6735 1.32 1.17 1.40 113 XMCapTrack 6682 1.08 0.51 1.39 114 TO_MALFORMED 6405 0.87 0.01 1.33 115 T_XMDrugObfuBody_08 6276 1.67 2.35 1.31 116 RELAYCOUNTRY_CA 6100 1.70 2.50 1.27 117 XMGenDplmaNmb 6026 1.41 1.71 1.25 118 TooManyTo_004 5918 0.98 0.52 1.23 119 URI_TRY_3LD 5860 1.17 1.09 1.22 120 XMStockSpam_06 5665 1.09 0.91 1.18 121 XM_GoogleGroups 5624 0.90 0.41 1.17 122 XMLngstWrd_00 5339 0.84 0.33 1.11 123 RELAYCOUNTRY_GB 5075 0.94 0.73 1.06 124 BOTNET 5043 4.26 10.22 1.05 125 DKIM_ADSP_CUSTOM_MED 4897 0.89 0.64 1.02 126 TooManyTo_005 4759 0.80 0.45 0.99 127 XMLngstWrd_01 4666 0.73 0.29 0.97 128 MIME_HTML_ONLY_MULTI 4536 1.72 3.16 0.94 129 XM_ProductURIs 4507 1.03 1.21 0.94 130 XMNoVowels 4156 0.68 0.35 0.86 131 SpammyFromTLD_01 4013 1.45 2.60 0.83 132 T_FILL_THIS_FORM_SHORT 3977 0.82 0.80 0.83 133 USER_IN_WHITELIST 3913 0.53 0.00 0.81 134 DIET_1 3865 1.54 2.90 0.80 135 TR_MetaPhish_Combo_01 3724 0.73 0.64 0.77 136 XMGappySubj_01 3664 0.59 0.26 0.76 137 NML_ADSP_CUSTOM_MED 3621 0.67 0.52 0.75 138 TM2_M_VERY_LONG_WORD 3611 0.99 1.45 0.75 139 T_TooManySym_03 3557 0.55 0.19 0.74 140 NO_DNS_FOR_FROM 3321 0.80 1.01 0.69 141 XMMoneyMeta_00 2982 1.27 2.49 0.62 142 T_XMDrugObfuBody_00 2972 0.85 1.29 0.62 143 XM_H_PHPMailer 2957 0.68 0.79 0.62 144 XMBdyGiftCard01 2937 1.09 1.98 0.61 145 XMLngstWrd_02 2822 0.46 0.23 0.59 146 KHOP_DYNAMIC 2707 0.51 0.41 0.56 147 TM2_M_A_HREF_HREF 2695 0.65 0.81 0.56 148 T_OBFU_PDF_ATTACH 2594 0.43 0.21 0.54 149 XMBody_95 2447 0.39 0.17 0.51 150 XMSubMetaSxObfu_02 2444 0.43 0.29 0.51 151 FORGED_GMAIL_RCVD 2431 0.52 0.56 0.51 152 MISSING_HEADERS 2384 7.39 20.19 0.50 153 T_MONEY_PERCENT 2334 0.58 0.75 0.49 154 TR_LOTS_OF_MONEY2 2334 0.58 0.75 0.49 155 SHORT_HELO_AND_INLINE_IMAGE 2323 0.33 0.04 0.48 156 T_XMHurry_00 2254 0.70 1.12 0.47 157 XM_ShortIntro_01 2234 0.40 0.29 0.46 158 TM2_M_BODY_EMPTY 2212 0.33 0.10 0.46 159 T_Symld_Words_02 2210 1.01 2.04 0.46 160 TR_XM_RelayPhish 2209 0.74 1.25 0.46 161 RELAYCOUNTRY_AU 2208 0.49 0.56 0.46 162 FILL_THIS_FORM 2171 0.50 0.59 0.45 163 URI_NOVOWEL 2170 0.62 0.94 0.45 164 HTML_FONT_FACE_BAD 2166 0.54 0.71 0.45 165 XMGappySubj_02 2152 0.31 0.07 0.45 166 HTML_IMAGE_ONLY_28 2135 0.49 0.56 0.44 167 XMSubMetaI_00 2076 0.79 1.45 0.43 168 RELAYCOUNTRY_NL 2067 0.43 0.42 0.43 169 XMBody_17 2049 0.65 1.06 0.43 170 XMBrknScrpt_02 2037 0.68 1.17 0.42 171 HTML_TAG_BALANCE_BODY 2018 0.54 0.78 0.42 172 RDNS_DYNAMIC 2001 0.48 0.59 0.42 173 XMHTMLBadTable_001 1987 0.56 0.85 0.41 174 XMSlimDrugH 1968 1.19 2.63 0.41 175 HTTPS_HTTP_MISMATCH 1944 0.47 0.58 0.40 176 XMSexyCombo_01 1928 0.74 1.36 0.40 177 XM_B_COPY_HTML 1897 0.47 0.61 0.39 178 XMDateMe_00 1887 0.36 0.29 0.39 179 RELAYCOUNTRY_DE 1866 0.50 0.71 0.39 180 XMHTML_After_End 1864 0.67 1.19 0.39 181 RCVD_IN_SORBS_DUL 1857 0.32 0.20 0.39 182 XMBody_78 1838 0.57 0.91 0.38 183 AC_DIV_BONANZA 1822 0.28 0.09 0.38 184 XM_B_REG_HTML 1801 0.52 0.78 0.37 185 HTML_IMAGE_ONLY_32 1782 0.32 0.23 0.37 186 MPART_ALT_DIFF_COUNT 1780 0.47 0.66 0.37 187 XMLKML 1763 0.24 0.00 0.37 188 T_FILL_THIS_FORM_LONG 1724 0.40 0.47 0.36 189 XMLngstWrd_03 1689 0.28 0.14 0.35 190 SpammyFromTLD_02 1644 3.92 10.57 0.34 191 XM_B_TRADE_HTML 1583 0.29 0.23 0.33 192 HTML_IMAGE_ONLY_24 1540 0.29 0.24 0.32 193 DKIM_ADSP_NXDOMAIN 1539 0.31 0.28 0.32 194 XM_H_PHPOS_M 1519 0.32 0.32 0.32 195 XMSolicitRefs_0 1502 0.35 0.42 0.31 196 XMSubMetaSxObfu_03 1498 0.43 0.65 0.31 197 UPPERCASE_50_75 1494 0.23 0.08 0.31 198 FILL_THIS_FORM_LOAN 1480 0.35 0.43 0.31 199 XMPhish30 1475 0.52 0.91 0.31 200 REMOVE_BEFORE_LINK 1466 0.43 0.65 0.30 ----------------------------------------------------------------------