Email: 612620 Autolearn: 0 AvgScore: 3.33 AvgScanTime: 3.64 sec Spam: 171479 Autolearn: 0 AvgScore: 13.23 AvgScanTime: 4.19 sec Ham: 441141 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 3.43 sec Time Spent Running SA: 619.56 hours Time Spent Processing Spam: 199.45 hours Time Spent Processing Ham: 420.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160894 88.50 93.83 86.43 2 DKIM_SIGNED 134336 74.01 78.34 72.33 3 DCC_CHECK 130272 47.73 75.97 36.76 4 XM_DK_Pass 129242 72.29 75.37 71.09 5 DKIM_VALID 123119 68.00 71.80 66.53 6 XMListUnsubscribeExists 115358 52.32 67.27 46.51 7 DKIM_VALID_AU 99956 50.78 58.29 47.86 8 XM_H_QuotedFrom 91919 40.55 53.60 35.47 9 BAYES_50 66347 53.66 38.69 59.48 10 MIME_HTML_ONLY 63494 24.93 37.03 20.22 11 HTML_FONT_LOW_CONTRAST 62016 28.67 36.17 25.76 12 XM_DK_Undo_02 61832 16.45 36.06 8.82 13 LOC_TINY_FONT_1 56071 24.05 32.70 20.69 14 BAYES_99 54695 14.42 31.90 7.63 15 BAYES_999 45855 12.15 26.74 6.47 16 XMSubLong 45802 22.53 26.71 20.90 17 TR_DCC_Bayes_99 43736 9.71 25.51 3.57 18 FVGT_m_MULTI_ODD 42683 21.10 24.89 19.63 19 DKIM_VALID_EF 39971 25.34 23.31 26.12 20 DCC_CHECK_NEGATIVE 38454 50.39 22.42 61.26 21 T_TM2_M_HEADER_IN_MSG 33394 29.19 19.47 32.97 22 RELAYCOUNTRY_META 32203 9.06 18.78 5.29 23 BOTNET 31632 6.27 18.45 1.53 24 XM_Body_Dirty_Words 30914 13.37 18.03 11.57 25 T_KAM_HTML_FONT_INVALID 30814 15.98 17.97 15.21 26 HTML_IMAGE_RATIO_02 27293 10.15 15.92 7.91 27 XM_Evil_Numbers_Gen 25335 10.39 14.77 8.69 28 XM_Multi_Part_URI 24968 12.07 14.56 11.10 29 XM_UncommonTLD01 24940 6.36 14.54 3.18 30 MultiRelay 24811 18.03 14.47 19.42 31 FROM_EXCESS_BASE64 24579 6.93 14.33 4.05 32 BOTNET_IPINHOSTNAME 22504 7.32 13.12 5.07 33 UNTRUSTED_Relay 22441 4.56 13.09 1.24 34 FSL_BULK_SIG 22141 8.43 12.91 6.69 35 LOTS_OF_MONEY 19510 8.55 11.38 7.45 36 XMSexyCombo_05 19233 6.15 11.22 4.18 37 HTML_MIME_NO_HTML_TAG 18821 4.94 10.98 2.59 38 SpammyFromTLD_02 17466 3.01 10.19 0.22 39 T_REMOTE_IMAGE 17275 5.80 10.07 4.14 40 BAYES_60 16755 6.85 9.77 5.72 41 MPART_ALT_DIFF 15457 4.57 9.01 2.84 42 HTML_IMAGE_RATIO_04 15039 5.86 8.77 4.73 43 BAYES_80 14909 4.84 8.69 3.34 44 T_XMDrugObfuBody_14 14787 8.55 8.62 8.52 45 BODY_URI_ONLY 14348 2.43 8.37 0.13 46 HTML_SHORT_LINK_IMG_1 14083 2.33 8.21 0.04 47 MISSING_HEADERS 14063 2.78 8.20 0.67 48 XMSubMetaSx_00 13932 5.51 8.12 4.50 49 RCVD_IN_RP_RNBL 13583 2.24 7.92 0.03 50 HTML_IMAGE_ONLY_04 13372 2.23 7.80 0.07 51 TR_XM_DocInvoice 13304 4.94 7.76 3.84 52 MIME_HEADER_CTYPE_ONLY 13278 2.28 7.74 0.15 53 XM_H_Long_From01 13211 6.24 7.70 5.68 54 XM_B_Phish_Phrases 13147 6.12 7.67 5.52 55 TooManyTo_001 12834 8.51 7.48 8.91 56 SHORTENER_SHORT_IMG 12641 2.06 7.37 0.00 57 URI_BUFFLY 12640 2.06 7.37 0.00 58 HTML_SHORT_CENTER 11996 1.96 7.00 0.00 59 XMNumbers 11570 4.30 6.75 3.34 60 DKIM_INVALID 11217 6.01 6.54 5.80 61 LotsOfNums_01 10169 7.75 5.93 8.46 62 XM_UB50 8898 1.93 5.19 0.66 63 BAYES_95 8531 2.91 4.97 2.11 64 XMStrtUSub 7975 4.50 4.65 4.44 65 HTML_IMAGE_RATIO_06 7781 3.70 4.54 3.38 66 MIME_HTML_MOSTLY 7453 3.08 4.35 2.59 67 MIME_HTML_ONLY_MULTI 7344 2.13 4.28 1.29 68 TM2_M_URI_OPT_OUT 6988 2.50 4.08 1.89 69 XM_DIRTYINTL 6861 2.52 4.00 1.94 70 XM_SPF_SoftFail 6818 2.63 3.98 2.10 71 XM_OfRef6 6312 2.11 3.68 1.49 72 RELAYCOUNTRY_CA 5607 1.95 3.27 1.43 73 HTML_IMAGE_RATIO_08 5515 2.44 3.22 2.13 74 URI_HEX 5150 2.08 3.00 1.73 75 XM_SendGrid 5081 4.83 2.96 5.55 76 RCVD_IN_MSPIKE_H2 4999 4.24 2.92 4.76 77 RELAYCOUNTRY_KR 4970 0.83 2.90 0.03 78 DIET_1 4789 1.09 2.79 0.43 79 XMDiploma_00 4709 2.09 2.75 1.83 80 XM_CamelCaseFrm001 4660 2.00 2.72 1.73 81 XM_URI_RBL 4631 0.99 2.70 0.33 82 XMBody_17 4542 1.21 2.65 0.65 83 XM_UB60 4534 0.81 2.64 0.09 84 MIME_QP_LONG_LINE 4528 4.91 2.64 5.80 85 XMSubMetaI_00 4479 1.14 2.61 0.57 86 T_XMDrugObfuBody_08 4473 1.71 2.61 1.36 87 T_TooManySym_01 4376 4.68 2.55 5.50 88 MultiRelay_CC 4333 0.82 2.53 0.15 89 MultiRelay_Combo 4333 0.82 2.53 0.15 90 LongTLD 4164 0.79 2.43 0.15 91 TR_Mismatch_TLD_02 4048 0.70 2.36 0.06 92 XMSlimDrugH 3945 0.87 2.30 0.32 93 FROM_SUSPICIOUS_NTLD 3823 0.65 2.23 0.04 94 XM_BadFromFormat 3637 0.74 2.12 0.21 95 RCVD_IN_RP_SAFE 3595 7.45 2.10 9.53 96 UNPARSEABLE_RELAY 3557 3.01 2.07 3.38 97 XM_H_Long_From02 3518 1.31 2.05 1.02 98 XMBdyGiftCard01 3420 1.52 1.99 1.34 99 XMMoneyMeta_00 3336 0.94 1.95 0.55 100 MAILING_LIST_MULTI 3297 2.49 1.92 2.70 101 SUBJ_ALL_CAPS 3294 1.89 1.92 1.88 102 ALL_TRUSTED 3287 13.51 1.92 18.01 103 BAYES_40 3279 3.57 1.91 4.22 104 XM_UB80 3267 0.60 1.91 0.09 105 XMGenDplmaNmb 3062 1.24 1.79 1.03 106 BOTNET_NORDNS 2947 0.49 1.72 0.02 107 BAYES_20 2886 2.72 1.68 3.12 108 T_Symld_Words_02 2877 0.92 1.68 0.62 109 TM2_M_VERY_LONG_WORD 2869 1.19 1.67 1.01 110 XMStockSpam_06 2846 1.46 1.66 1.38 111 XMHTML_After_End 2814 0.77 1.64 0.43 112 RELAYCOUNTRY_IN 2798 0.56 1.63 0.15 113 T_XMDrugObfuBody_00 2761 0.91 1.61 0.64 114 FILL_THIS_FORM 2728 0.72 1.59 0.38 115 URI_TRY_3LD 2708 1.05 1.58 0.84 116 TR_XM_RelayPhish 2688 0.90 1.57 0.65 117 XMSexyCombo_01 2624 1.39 1.53 1.34 118 RCVD_IN_RP_CERTIFIED 2615 6.58 1.52 8.54 119 T_FILL_THIS_FORM_LONG 2599 0.64 1.52 0.30 120 XMWghtMeta_00 2545 0.43 1.48 0.03 121 SpammyFromTLD_01 2459 0.93 1.43 0.73 122 RCVD_IN_BL_SPAMCOP_NET 2450 0.59 1.43 0.26 123 HTML_FONT_SIZE_LARGE 2418 0.53 1.41 0.19 124 PLING_QUERY 2320 0.63 1.35 0.35 125 BAYES_00 2317 9.31 1.35 12.41 126 RCVD_IN_IADB_LISTED 2296 4.15 1.34 5.24 127 TR_Symld_Words 2286 1.56 1.33 1.65 128 XMSubMetaSxObfu_03 2276 0.84 1.33 0.65 129 RELAYCOUNTRY_CN 2238 0.40 1.31 0.05 130 XMPhish11 2234 1.20 1.30 1.16 131 XM_UB99 2210 0.39 1.29 0.05 132 DKIM_ADSP_CUSTOM_MED 2203 1.09 1.28 1.02 133 TR_LOTS_OF_MONEY3 2174 0.86 1.27 0.70 134 DATE_IN_PAST_03_06 2168 0.41 1.26 0.08 135 XM_HighProb1 2136 0.37 1.25 0.03 136 NML_ADSP_CUSTOM_MED 2112 0.83 1.23 0.68 137 RELAYCOUNTRY_FR 2042 0.50 1.19 0.23 138 RCVD_IN_IADB_SPF 2037 3.67 1.19 4.63 139 XMPhish30 2022 0.57 1.18 0.33 140 XMPhish14 2017 0.56 1.18 0.31 141 RELAYCOUNTRY_AT 2010 0.48 1.17 0.22 142 HTML_FONT_FACE_BAD 1982 0.63 1.16 0.43 143 RELAYCOUNTRY_DE 1960 0.67 1.14 0.49 144 RCVD_IN_IADB_SENDERID 1919 3.26 1.12 4.10 145 RCVD_IN_IADB_DK 1886 3.24 1.10 4.07 146 T_XMHurry_00 1841 0.63 1.07 0.46 147 US_DOLLARS_3 1778 0.90 1.04 0.85 148 XMLngstWrd_00 1776 0.78 1.04 0.68 149 XMBody_78 1768 0.58 1.03 0.40 150 BAYES_05 1760 1.71 1.03 1.98 151 XMSubMetaI_01 1754 0.34 1.02 0.08 152 XM_UB95 1747 0.32 1.02 0.04 153 URIBL_BLACK 1744 0.34 1.02 0.08 154 XMLngstWrd_01 1738 0.75 1.01 0.64 155 RELAYCOUNTRY_GB 1730 1.02 1.01 1.03 156 XM_DK_Undo_01 1710 1.68 1.00 1.94 157 T_FILL_THIS_FORM_SHORT 1693 0.96 0.99 0.94 158 URI_NOVOWEL 1690 0.57 0.99 0.41 159 T_MONEY_PERCENT 1682 0.45 0.98 0.24 160 TR_LOTS_OF_MONEY2 1682 0.45 0.98 0.24 161 XM_H_PHPOS 1675 1.17 0.98 1.24 162 XM_ProductURIs 1638 0.92 0.96 0.91 163 URIBL_DBL_SPAM 1632 0.29 0.95 0.03 164 XMLngstWrd_02 1626 0.45 0.95 0.26 165 XMSlimDrugs 1615 0.28 0.94 0.02 166 TR_XM_DK_Bayes 1586 6.66 0.92 8.89 167 XM_UB999 1574 0.28 0.92 0.04 168 RELAYCOUNTRY_IT 1564 0.28 0.91 0.04 169 XM_PDF 1553 3.94 0.91 5.12 170 HTML_TAG_BALANCE_BODY 1521 0.55 0.89 0.42 171 FILL_THIS_FORM_LOAN 1490 0.43 0.87 0.26 172 RCVD_IN_IADB_VOUCHED 1481 2.68 0.86 3.39 173 TR_XM_DK_Bayes1 1462 6.16 0.85 8.22 174 XMSubject_48 1406 0.25 0.82 0.03 175 TR_XM_DK_Bayes2 1404 5.45 0.82 7.25 176 RDNS_DYNAMIC 1396 0.56 0.81 0.45 177 XMSubMetaSSx_00 1383 0.44 0.81 0.29 178 TR_LOTS_OF_MONEY1 1330 0.23 0.78 0.01 179 XM_H_PHPMailer 1318 0.69 0.77 0.65 180 SUBJ_DOLLARS 1316 0.33 0.77 0.16 181 T_HTML_TAG_BALANCE_CENTER 1315 0.31 0.77 0.14 182 DKIM_ADSP_NXDOMAIN 1288 0.55 0.75 0.48 183 TR_MetaPhish_Combo_01 1275 1.34 0.74 1.57 184 XM_Body_Obfu01 1267 0.38 0.74 0.24 185 FORGED_GMAIL_RCVD 1252 0.59 0.73 0.53 186 TooManyTo_002 1250 2.31 0.73 2.93 187 XM_RXBody 1235 0.61 0.72 0.57 188 XM_OfRef7 1218 0.32 0.71 0.17 189 REMOVE_BEFORE_LINK 1188 0.36 0.69 0.23 190 XMLngstWrd_03 1171 0.28 0.68 0.12 191 FROM_MISSP_REPLYTO 1155 0.19 0.67 0.01 192 XMBrknScrpt_02 1146 0.65 0.67 0.64 193 XMSubMetaD_03 1133 0.24 0.66 0.07 194 TO_NO_BRKTS_FROM_MSSP 1132 0.21 0.66 0.04 195 HTTPS_HTTP_MISMATCH 1131 0.52 0.66 0.47 196 MPART_ALT_DIFF_COUNT 1122 0.44 0.65 0.36 197 XMSexyCombo_04 1114 0.68 0.65 0.69 198 RELAYCOUNTRY_NL 1114 0.50 0.65 0.44 199 HTML_IMAGE_ONLY_28 1112 0.47 0.65 0.41 200 HTML_IMAGE_ONLY_12 1102 0.39 0.64 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 381275 88.50 93.83 86.43 2 DKIM_SIGNED 319081 74.01 78.34 72.33 3 XM_DK_Pass 313629 72.29 75.37 71.09 4 DKIM_VALID 293490 68.00 71.80 66.53 5 DCC_CHECK_NEGATIVE 270228 50.39 22.42 61.26 6 BAYES_50 262390 53.66 38.69 59.48 7 DKIM_VALID_AU 211150 50.78 58.29 47.86 8 XMListUnsubscribeExists 205170 52.32 67.27 46.51 9 DCC_CHECK 162146 47.73 75.97 36.76 10 XM_H_QuotedFrom 156492 40.55 53.60 35.47 11 T_TM2_M_HEADER_IN_MSG 145428 29.19 19.47 32.97 12 DKIM_VALID_EF 115241 25.34 23.31 26.12 13 HTML_FONT_LOW_CONTRAST 113623 28.67 36.17 25.76 14 XMSubLong 92209 22.53 26.71 20.90 15 LOC_TINY_FONT_1 91254 24.05 32.70 20.69 16 MIME_HTML_ONLY 89204 24.93 37.03 20.22 17 FVGT_m_MULTI_ODD 86597 21.10 24.89 19.63 18 MultiRelay 85653 18.03 14.47 19.42 19 ALL_TRUSTED 79463 13.51 1.92 18.01 20 T_KAM_HTML_FONT_INVALID 67080 15.98 17.97 15.21 21 BAYES_00 54748 9.31 1.35 12.41 22 XM_DKIMWhitelistDomains 54408 9.00 0.43 12.33 23 XM_Body_Dirty_Words 51020 13.37 18.03 11.57 24 XM_Multi_Part_URI 48980 12.07 14.56 11.10 25 RCVD_IN_RP_SAFE 42038 7.45 2.10 9.53 26 TooManyTo_001 39289 8.51 7.48 8.91 27 TR_XM_DK_Bayes 39204 6.66 0.92 8.89 28 XM_DK_Undo_02 38929 16.45 36.06 8.82 29 XM_Evil_Numbers_Gen 38324 10.39 14.77 8.69 30 RCVD_IN_RP_CERTIFIED 37694 6.58 1.52 8.54 31 T_XMDrugObfuBody_14 37595 8.55 8.62 8.52 32 LotsOfNums_01 37326 7.75 5.93 8.46 33 TR_XM_DK_Bayes1 36257 6.16 0.85 8.22 34 HTML_IMAGE_RATIO_02 34885 10.15 15.92 7.91 35 BAYES_99 33666 14.42 31.90 7.63 36 LOTS_OF_MONEY 32879 8.55 11.38 7.45 37 TR_XM_DK_Bayes2 31977 5.45 0.82 7.25 38 FSL_BULK_SIG 29531 8.43 12.91 6.69 39 BAYES_999 28549 12.15 26.74 6.47 40 DKIM_INVALID 25591 6.01 6.54 5.80 41 MIME_QP_LONG_LINE 25575 4.91 2.64 5.80 42 BAYES_60 25216 6.85 9.77 5.72 43 XM_H_Long_From01 25037 6.24 7.70 5.68 44 XM_SendGrid 24502 4.83 2.96 5.55 45 XM_B_Phish_Phrases 24372 6.12 7.67 5.52 46 T_TooManySym_01 24275 4.68 2.55 5.50 47 RELAYCOUNTRY_META 23318 9.06 18.78 5.29 48 RCVD_IN_IADB_LISTED 23135 4.15 1.34 5.24 49 XM_PDF 22591 3.94 0.91 5.12 50 BOTNET_IPINHOSTNAME 22352 7.32 13.12 5.07 51 RCVD_IN_MSPIKE_H2 21005 4.24 2.92 4.76 52 HTML_IMAGE_RATIO_04 20862 5.86 8.77 4.73 53 RCVD_IN_IADB_SPF 20419 3.67 1.19 4.63 54 XMSubMetaSx_00 19848 5.51 8.12 4.50 55 XMStrtUSub 19591 4.50 4.65 4.44 56 BAYES_40 18601 3.57 1.91 4.22 57 XMSexyCombo_05 18456 6.15 11.22 4.18 58 T_REMOTE_IMAGE 18266 5.80 10.07 4.14 59 RCVD_IN_IADB_SENDERID 18069 3.26 1.12 4.10 60 IN_ZIMBRA_NJ_WHITELIST 18009 2.95 0.03 4.08 61 RCVD_IN_IADB_DK 17966 3.24 1.10 4.07 62 FROM_EXCESS_BASE64 17865 6.93 14.33 4.05 63 TR_XM_DocInvoice 16959 4.94 7.76 3.84 64 TR_DCC_Bayes_99 15745 9.71 25.51 3.57 65 RCVD_IN_IADB_VOUCHED 14954 2.68 0.86 3.39 66 UNPARSEABLE_RELAY 14910 3.01 2.07 3.38 67 HTML_IMAGE_RATIO_06 14891 3.70 4.54 3.38 68 XMNumbers 14750 4.30 6.75 3.34 69 BAYES_80 14724 4.84 8.69 3.34 70 XM_UncommonTLD01 14020 6.36 14.54 3.18 71 BAYES_20 13764 2.72 1.68 3.12 72 TO_MALFORMED 13632 2.25 0.08 3.09 73 TVD_RCVD_IP 13369 2.23 0.18 3.03 74 TooManyTo_002 12927 2.31 0.73 2.93 75 ANY_BOUNCE_MESSAGE 12919 2.27 0.58 2.93 76 BOUNCE_MESSAGE 12919 2.27 0.58 2.93 77 MPART_ALT_DIFF 12542 4.57 9.01 2.84 78 MAILING_LIST_MULTI 11931 2.49 1.92 2.70 79 MIME_HTML_MOSTLY 11443 3.08 4.35 2.59 80 HTML_MIME_NO_HTML_TAG 11418 4.94 10.98 2.59 81 HELO_NODOT 9897 1.70 0.32 2.24 82 HTML_IMAGE_RATIO_08 9415 2.44 3.22 2.13 83 BAYES_95 9305 2.91 4.97 2.11 84 XM_SPF_SoftFail 9284 2.63 3.98 2.10 85 RCVD_IN_IADB_OPTIN 9051 1.65 0.62 2.05 86 T_TooManySym_02 8954 1.61 0.51 2.03 87 BAYES_05 8727 1.71 1.03 1.98 88 XM_DK_Undo_01 8577 1.68 1.00 1.94 89 XM_DIRTYINTL 8552 2.52 4.00 1.94 90 RCVD_IN_MSPIKE_WL 8473 1.55 0.60 1.92 91 RCVD_IN_MSPIKE_H3 8469 1.55 0.59 1.92 92 TM2_M_URI_OPT_OUT 8318 2.50 4.08 1.89 93 SUBJ_ALL_CAPS 8292 1.89 1.92 1.88 94 TooManyTo_003 8243 1.51 0.59 1.87 95 XMDiploma_00 8075 2.09 2.75 1.83 96 IN_HORDE_ADDRESS_BOOK 7712 1.28 0.06 1.75 97 URI_HEX 7622 2.08 3.00 1.73 98 XM_CamelCaseFrm001 7619 2.00 2.72 1.73 99 XMCapTrack 7466 1.30 0.28 1.69 100 TR_Symld_Words 7299 1.56 1.33 1.65 101 TR_MetaPhish_Combo_01 6933 1.34 0.74 1.57 102 INVALID_MSGID 6828 1.17 0.19 1.55 103 BOTNET 6769 6.27 18.45 1.53 104 XM_OfRef6 6589 2.11 3.68 1.49 105 USER_IN_DEF_DKIM_WL 6512 1.09 0.11 1.48 106 RELAYCOUNTRY_CA 6321 1.95 3.27 1.43 107 TooManyTo_004 6201 1.13 0.42 1.41 108 XMStockSpam_06 6079 1.46 1.66 1.38 109 T_XMDrugObfuBody_08 5992 1.71 2.61 1.36 110 XMBdyGiftCard01 5907 1.52 1.99 1.34 111 XMSexyCombo_01 5894 1.39 1.53 1.34 112 MIME_HTML_ONLY_MULTI 5680 2.13 4.28 1.29 113 XM_GoogleGroups 5644 1.05 0.46 1.28 114 UNTRUSTED_Relay 5477 4.56 13.09 1.24 115 XM_H_PHPOS 5468 1.17 0.98 1.24 116 TooManyTo_005 5293 0.97 0.37 1.20 117 XMPhish11 5128 1.20 1.30 1.16 118 XMGenDplmaNmb 4562 1.24 1.79 1.03 119 RELAYCOUNTRY_GB 4543 1.02 1.01 1.03 120 XM_H_Long_From02 4510 1.31 2.05 1.02 121 DKIM_ADSP_CUSTOM_MED 4495 1.09 1.28 1.02 122 TM2_M_VERY_LONG_WORD 4443 1.19 1.67 1.01 123 T_FILL_THIS_FORM_SHORT 4160 0.96 0.99 0.94 124 XM_ProductURIs 4011 0.92 0.96 0.91 125 XMNoVowels 3808 0.73 0.40 0.86 126 US_DOLLARS_3 3758 0.90 1.04 0.85 127 URI_TRY_3LD 3711 1.05 1.58 0.84 128 T_OBFU_PDF_ATTACH 3248 0.58 0.19 0.74 129 SpammyFromTLD_01 3220 0.93 1.43 0.73 130 TR_LOTS_OF_MONEY3 3098 0.86 1.27 0.70 131 XMSexyCombo_04 3033 0.68 0.65 0.69 132 NML_ADSP_CUSTOM_MED 2984 0.83 1.23 0.68 133 XMLngstWrd_00 2983 0.78 1.04 0.68 134 MISSING_HEADERS 2973 2.78 8.20 0.67 135 XM_B_REG_HTML 2970 0.59 0.38 0.67 136 XM_UB50 2916 1.93 5.19 0.66 137 T_TooManySym_03 2915 0.50 0.09 0.66 138 XMBody_17 2887 1.21 2.65 0.65 139 XM_H_PHPMailer 2885 0.69 0.77 0.65 140 XMSubMetaSxObfu_03 2879 0.84 1.33 0.65 141 TR_XM_RelayPhish 2849 0.90 1.57 0.65 142 XMBrknScrpt_02 2838 0.65 0.67 0.64 143 T_XMDrugObfuBody_00 2837 0.91 1.61 0.64 144 XMLngstWrd_01 2834 0.75 1.01 0.64 145 T_Symld_Words_02 2736 0.92 1.68 0.62 146 XMBody_95 2690 0.47 0.11 0.61 147 USER_IN_WHITELIST 2664 0.43 0.00 0.60 148 XMSubMetaSxObfu_02 2552 0.51 0.32 0.58 149 XMSubMetaI_00 2535 1.14 2.61 0.57 150 XM_RXBody 2532 0.61 0.72 0.57 151 XMHTMLBadTable_001 2527 0.56 0.54 0.57 152 XMMoneyMeta_00 2406 0.94 1.95 0.55 153 XMSubMetaSxObfu_04 2386 0.42 0.11 0.54 154 SHORT_HELO_AND_INLINE_IMAGE 2378 0.41 0.08 0.54 155 FORGED_GMAIL_RCVD 2348 0.59 0.73 0.53 156 XMGappySubj_01 2321 0.52 0.51 0.53 157 AC_DIV_BONANZA 2317 0.42 0.15 0.53 158 FROM_GOV_SPOOF 2271 0.46 0.31 0.51 159 XM_ShortIntro_01 2194 0.44 0.28 0.50 160 HTML_IMAGE_ONLY_32 2193 0.45 0.33 0.50 161 RELAYCOUNTRY_DE 2159 0.67 1.14 0.49 162 XM_B_COPY_HTML 2105 0.52 0.63 0.48 163 DKIM_ADSP_NXDOMAIN 2099 0.55 0.75 0.48 164 XMDateMe_00 2092 0.43 0.33 0.47 165 HTTPS_HTTP_MISMATCH 2084 0.52 0.66 0.47 166 TM2_M_BODY_EMPTY 2076 0.37 0.12 0.47 167 RCVD_IN_SORBS_DUL 2035 0.39 0.21 0.46 168 T_XMHurry_00 2030 0.63 1.07 0.46 169 RDNS_DYNAMIC 2006 0.56 0.81 0.45 170 RELAYCOUNTRY_NL 1923 0.50 0.65 0.44 171 TM2_M_A_HREF_HREF 1922 0.42 0.39 0.44 172 DIET_1 1906 1.09 2.79 0.43 173 XMHTML_After_End 1902 0.77 1.64 0.43 174 RELAYCOUNTRY_AU 1891 0.47 0.58 0.43 175 HTML_FONT_FACE_BAD 1879 0.63 1.16 0.43 176 XMLKML 1846 0.30 0.00 0.42 177 HTML_TAG_BALANCE_BODY 1837 0.55 0.89 0.42 178 HTML_IMAGE_ONLY_28 1795 0.47 0.65 0.41 179 URI_NOVOWEL 1791 0.57 0.99 0.41 180 XMBody_78 1775 0.58 1.03 0.40 181 HTML_IMAGE_ONLY_24 1696 0.39 0.39 0.38 182 FILL_THIS_FORM 1672 0.72 1.59 0.38 183 TVD_SPACE_RATIO 1622 0.35 0.31 0.37 184 XM_S_JOY_D 1589 0.43 0.61 0.36 185 XMSubNoVowel 1584 0.40 0.52 0.36 186 HTML_IMAGE_ONLY_16 1577 0.33 0.27 0.36 187 MPART_ALT_DIFF_COUNT 1576 0.44 0.65 0.36 188 PLING_QUERY 1547 0.63 1.35 0.35 189 XMSolicitRefs_0 1514 0.36 0.40 0.34 190 T_FROM_GOV_DKIM_AU 1504 0.28 0.12 0.34 191 HTML_IMAGE_ONLY_20 1483 0.35 0.39 0.34 192 TR_MetaPhish_Combo_01b 1463 0.27 0.12 0.33 193 XM_URI_RBL 1460 0.99 2.70 0.33 194 XMPhish30 1447 0.57 1.18 0.33 195 XMSubEmpty 1421 0.33 0.35 0.32 196 XMSlimDrugH 1412 0.87 2.30 0.32 197 XM_H_PHPOS_M 1393 0.36 0.48 0.32 198 XMPhish14 1386 0.56 1.18 0.31 199 NO_DNS_FOR_FROM 1375 0.35 0.44 0.31 200 GMD_PDF_EMPTY_BODY 1322 0.24 0.10 0.30 ----------------------------------------------------------------------