Email: 647325 Autolearn: 0 AvgScore: 1.71 AvgScanTime: 1.99 sec Spam: 131371 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 2.38 sec Ham: 515954 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.89 sec Time Spent Running SA: 358.41 hours Time Spent Processing Spam: 86.84 hours Time Spent Processing Ham: 271.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124801 90.87 95.00 89.81 2 DKIM_SIGNED 101259 77.00 77.08 76.98 3 DCC_CHECK 100965 50.42 76.85 43.68 4 XM_DK_Pass 98330 75.55 74.85 75.72 5 DKIM_VALID 93178 71.94 70.93 72.19 6 XMListUnsubscribeExists 90734 56.24 69.07 52.98 7 DKIM_VALID_AU 76230 54.08 58.03 53.08 8 XM_H_QuotedFrom 64276 42.02 48.93 40.26 9 BAYES_50 61670 56.04 46.94 58.35 10 HTML_FONT_LOW_CONTRAST 50772 30.18 38.65 28.02 11 XM_DK_Undo_02 47190 13.12 35.92 7.32 12 MIME_HTML_ONLY 45616 23.58 34.72 20.74 13 LOC_TINY_FONT_1 43836 25.46 33.37 23.44 14 BAYES_99 35771 9.69 27.23 5.22 15 XMSubLong 35171 23.66 26.77 22.86 16 FVGT_m_MULTI_ODD 33702 22.17 25.65 21.28 17 DKIM_VALID_EF 30191 26.46 22.98 27.34 18 BAYES_999 29066 8.07 22.13 4.50 19 TR_DCC_Bayes_99 28901 6.79 22.00 2.92 20 DCC_CHECK_NEGATIVE 28031 47.63 21.34 54.32 21 XM_Body_Dirty_Words 27279 14.27 20.76 12.61 22 RELAYCOUNTRY_META 26250 8.49 19.98 5.57 23 T_KAM_HTML_FONT_INVALID 26132 17.65 19.89 17.08 24 BOTNET_IPINHOSTNAME 25743 7.74 19.60 4.72 25 BOTNET 24307 5.36 18.50 2.01 26 T_TM2_M_HEADER_IN_MSG 22976 28.24 17.49 30.97 27 HTML_IMAGE_RATIO_02 20824 10.42 15.85 9.03 28 MultiRelay 20172 17.17 15.35 17.63 29 XM_Multi_Part_URI 19599 13.31 14.92 12.90 30 XM_Evil_Numbers_Gen 18442 10.13 14.04 9.13 31 XM_UncommonTLD01 17677 5.12 13.46 3.00 32 FSL_BULK_SIG 16546 7.83 12.59 6.61 33 UNTRUSTED_Relay 16437 4.01 12.51 1.84 34 LOTS_OF_MONEY 15987 9.60 12.17 8.95 35 XMSexyCombo_05 15574 5.84 11.85 4.31 36 TooManyTo_001 12527 8.59 9.54 8.35 37 HTML_IMAGE_RATIO_04 11453 6.43 8.72 5.85 38 XM_B_Phish_Phrases 11388 6.80 8.67 6.33 39 MPART_ALT_DIFF 11049 4.73 8.41 3.79 40 T_XMDrugObfuBody_14 10972 8.03 8.35 7.94 41 BAYES_60 10571 5.61 8.05 4.99 42 XM_H_Long_From01 9957 6.52 7.58 6.25 43 BAYES_80 9281 3.57 7.06 2.68 44 XMSubMetaSx_00 9183 4.29 6.99 3.60 45 SpammyFromTLD_02 8915 1.61 6.79 0.29 46 XM_UB50 8543 2.33 6.50 1.27 47 DKIM_INVALID 8081 5.06 6.15 4.78 48 FROM_EXCESS_BASE64 8002 4.91 6.09 4.61 49 XM_SPF_SoftFail 7983 2.96 6.08 2.17 50 T_REMOTE_IMAGE 7908 4.42 6.02 4.02 51 LotsOfNums_01 7875 8.21 5.99 8.77 52 XMNumbers 7282 3.28 5.54 2.70 53 HTML_MIME_NO_HTML_TAG 7029 2.89 5.35 2.26 54 HTML_IMAGE_RATIO_06 6949 4.33 5.29 4.09 55 XM_DIRTYINTL 6873 2.49 5.23 1.79 56 XM_URI_RBL 6313 1.35 4.81 0.47 57 RCVD_IN_RP_RNBL 6245 1.01 4.75 0.06 58 XMStrtUSub 6093 5.17 4.64 5.30 59 TM2_M_URI_OPT_OUT 5560 2.65 4.23 2.25 60 ALL_TRUSTED 5378 12.38 4.09 14.49 61 MIME_HTML_ONLY_MULTI 5163 2.11 3.93 1.65 62 RELAYCOUNTRY_CA 4839 2.08 3.68 1.67 63 MIME_HTML_MOSTLY 4829 3.21 3.68 3.09 64 BODY_URI_ONLY 4791 0.81 3.65 0.08 65 URI_HEX 4717 1.98 3.59 1.57 66 BAYES_95 4681 1.97 3.56 1.56 67 HTML_SHORT_LINK_IMG_1 4638 0.74 3.53 0.03 68 RCVD_IN_MSPIKE_H2 4461 4.11 3.40 4.29 69 MultiRelay_CC 4207 0.77 3.20 0.15 70 MultiRelay_Combo 4207 0.77 3.20 0.15 71 MIME_QP_LONG_LINE 4140 5.36 3.15 5.93 72 FROM_SUSPICIOUS_NTLD 4112 0.67 3.13 0.04 73 MIME_HEADER_CTYPE_ONLY 3828 0.69 2.91 0.13 74 SHORTENER_SHORT_IMG 3720 0.57 2.83 0.00 75 HTML_IMAGE_ONLY_04 3710 0.61 2.82 0.04 76 HTML_SHORT_CENTER 3661 0.57 2.79 0.00 77 RCVD_IN_RP_SAFE 3656 8.73 2.78 10.25 78 XM_CamelCaseFrm001 3590 2.29 2.73 2.17 79 RCVD_IN_BL_SPAMCOP_NET 3582 1.05 2.73 0.63 80 HTML_IMAGE_RATIO_08 3559 2.61 2.71 2.59 81 XM_SendGrid 3508 5.16 2.67 5.80 82 XMDiploma_00 3444 1.77 2.62 1.56 83 RELAYCOUNTRY_IN 3443 0.63 2.62 0.12 84 T_XMDrugObfuBody_08 3335 1.77 2.54 1.57 85 T_TooManySym_01 3294 4.59 2.51 5.12 86 XMSexyCombo_01 3084 0.88 2.35 0.50 87 BAYES_40 3077 4.36 2.34 4.87 88 XM_OfRef6 3072 1.49 2.34 1.28 89 BOTNET_NORDNS 3046 0.48 2.32 0.02 90 RCVD_IN_RP_CERTIFIED 3024 7.60 2.30 8.95 91 MISSING_HEADERS 2982 0.83 2.27 0.46 92 XMSubMetaI_00 2915 1.21 2.22 0.95 93 XMBdyGiftCard01 2723 1.45 2.07 1.29 94 XMSubNoVowel 2713 0.66 2.07 0.30 95 NO_DNS_FOR_FROM 2602 1.29 1.98 1.11 96 BASE64_LENGTH_79_INF 2591 0.67 1.97 0.34 97 HTML_IMAGE_ONLY_28 2570 0.74 1.96 0.43 98 RELAYCOUNTRY_GB 2552 1.16 1.94 0.96 99 BAYES_20 2535 3.42 1.93 3.80 100 T_XMHurry_00 2534 1.55 1.93 1.45 101 XM_UB60 2532 0.45 1.93 0.07 102 XMPhish14 2493 0.86 1.90 0.60 103 XMGenDplmaNmb 2390 1.17 1.82 1.01 104 MAILING_LIST_MULTI 2369 2.16 1.80 2.26 105 SpammyFromTLD_01 2323 0.94 1.77 0.73 106 XM_H_Long_From02 2308 1.53 1.76 1.48 107 TR_XM_RelayPhish 2281 0.82 1.74 0.59 108 FSL_THIS_IS_ADV 2271 0.44 1.73 0.11 109 XMSubEmpty 2235 0.56 1.70 0.27 110 RELAYCOUNTRY_FR 2225 0.52 1.69 0.22 111 RCVD_IN_IADB_LISTED 2167 4.75 1.65 5.53 112 BAYES_00 2121 13.06 1.61 15.97 113 TR_LOTS_OF_MONEY2 2115 0.67 1.61 0.43 114 T_MONEY_PERCENT 2115 0.67 1.61 0.43 115 T_XMDrugObfuBody_00 2101 0.93 1.60 0.75 116 TO_NO_BRKTS_HTML_IMG 2088 0.41 1.59 0.10 117 URIBL_RHS_DOB 2029 0.33 1.54 0.03 118 XMBody_78 2008 0.91 1.53 0.75 119 RELAYCOUNTRY_CN 2006 0.36 1.53 0.06 120 SUBJ_ALL_CAPS 1966 1.47 1.50 1.46 121 XMPhish11 1965 1.27 1.50 1.21 122 UNPARSEABLE_RELAY 1959 2.23 1.49 2.41 123 T_FILL_THIS_FORM_SHORT 1944 0.98 1.48 0.85 124 XMStockSpam_06 1937 1.31 1.47 1.27 125 DATE_IN_PAST_03_06 1926 0.39 1.47 0.11 126 MPART_ALT_DIFF_COUNT 1898 0.49 1.44 0.25 127 XM_UB99 1879 0.30 1.43 0.01 128 TM2_M_VERY_LONG_WORD 1803 0.95 1.37 0.84 129 RCVD_IN_IADB_SPF 1797 4.12 1.37 4.82 130 XMHTML_After_End 1793 0.62 1.36 0.44 131 T_HTML_TAG_BALANCE_CENTER 1791 0.39 1.36 0.14 132 RCVD_IN_PSBL 1766 0.30 1.34 0.03 133 XMBrknScrpt_02 1763 0.74 1.34 0.58 134 XM_H_TOP 1760 0.28 1.34 0.00 135 XM_salutation2 1750 0.84 1.33 0.72 136 XMPhish30 1747 0.64 1.33 0.46 137 PLING_QUERY 1705 0.68 1.30 0.52 138 HTML_IMAGE_ONLY_24 1686 0.52 1.28 0.32 139 RELAYCOUNTRY_AT 1682 0.45 1.28 0.24 140 RCVD_IN_IADB_SENDERID 1659 3.63 1.26 4.23 141 RCVD_IN_IADB_DK 1637 3.54 1.25 4.13 142 TR_Symld_Words 1632 1.60 1.24 1.69 143 HELO_NODOT 1631 1.48 1.24 1.54 144 HELO_NO_DOMAIN 1630 1.48 1.24 1.54 145 DATE_IN_PAST_06_12 1592 0.27 1.21 0.04 146 XM_DK_Undo_01 1591 1.71 1.21 1.83 147 XM_H_PHPOS 1590 1.46 1.21 1.53 148 HTML_TAG_BALANCE_BODY 1588 0.69 1.21 0.56 149 TVD_SPACE_RATIO_MINFP 1560 0.25 1.19 0.01 150 URIBL_BLACK 1552 0.29 1.18 0.06 151 LONG_JUNK_URI 1547 0.30 1.18 0.07 152 DATE_IN_PAST_12_24 1527 0.29 1.16 0.07 153 XMSexyCombo_04 1525 0.36 1.16 0.15 154 TooManyTo_002 1515 1.86 1.15 2.04 155 XMSubMetaSxObfu_03 1496 0.53 1.14 0.38 156 DIET_1 1471 0.51 1.12 0.36 157 TR_Mismatch_TLD_02 1462 0.28 1.11 0.06 158 URI_TRY_3LD 1446 1.29 1.10 1.34 159 RELAYCOUNTRY_NL 1444 0.38 1.10 0.20 160 XMMoneyMeta_00 1426 0.65 1.09 0.54 161 XM_ProductURIs 1425 1.29 1.08 1.34 162 XMHTMLBadTable_001 1416 0.66 1.08 0.56 163 BODY_ENHANCEMENT 1397 0.23 1.06 0.02 164 TR_XM_DK_Bayes 1380 10.51 1.05 12.92 165 BAYES_05 1369 2.01 1.04 2.25 166 NUMERIC_HTTP_ADDR 1362 0.61 1.04 0.50 167 XM_HighProb1 1360 0.21 1.04 0.01 168 FILL_THIS_FORM 1352 0.50 1.03 0.37 169 LIST_PARTIAL 1343 0.23 1.02 0.03 170 RCVD_IN_IADB_VOUCHED 1303 3.07 0.99 3.60 171 TooManyTo_003 1293 1.29 0.98 1.37 172 FILL_THIS_FORM_LONG 1283 0.43 0.98 0.29 173 XMBody_17 1269 0.79 0.97 0.74 174 XM_UB80 1239 0.22 0.94 0.04 175 TR_XM_DK_Bayes1 1236 10.08 0.94 12.40 176 XM_UB999 1209 0.19 0.92 0.01 177 NORDNS_LOW_CONTRAST 1202 0.20 0.91 0.01 178 HTML_FONT_SIZE_LARGE 1192 0.32 0.91 0.17 179 HTML_IMAGE_ONLY_12 1178 0.36 0.90 0.22 180 TR_XM_DK_Bayes2 1150 8.58 0.88 10.54 181 DKIM_ADSP_CUSTOM_MED 1145 0.95 0.87 0.97 182 LongTLD 1145 0.30 0.87 0.16 183 RELAYCOUNTRY_DE 1143 0.47 0.87 0.37 184 TooManyTo_004 1130 0.95 0.86 0.98 185 LONG_JUNK_URI2 1107 0.19 0.84 0.03 186 DEAR_FRIEND 1096 0.23 0.83 0.07 187 XM_PDF 1093 3.65 0.83 4.37 188 NML_ADSP_CUSTOM_MED 1092 0.71 0.83 0.68 189 RDNS_DYNAMIC 1081 0.53 0.82 0.45 190 ANY_BOUNCE_MESSAGE 1079 1.57 0.82 1.77 191 URI_NOVOWEL 1078 0.64 0.82 0.60 192 BOUNCE_MESSAGE 1077 1.57 0.82 1.77 193 XM_B_COPY_HTML 1055 0.57 0.80 0.51 194 RELAYCOUNTRY_AU 1036 0.52 0.79 0.45 195 T_Symld_Words_02 1021 0.65 0.78 0.62 196 TooManyTo_005 1004 0.79 0.76 0.79 197 TR_MetaPhish_Combo_01 1001 1.46 0.76 1.64 198 XM_H_Undi_Recip 996 0.33 0.76 0.22 199 HTTPS_HTTP_MISMATCH 995 0.59 0.76 0.55 200 XMGppyBdWords 994 0.33 0.76 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 463395 90.87 95.00 89.81 2 DKIM_SIGNED 397162 77.00 77.08 76.98 3 XM_DK_Pass 390706 75.55 74.85 75.72 4 DKIM_VALID 372479 71.94 70.93 72.19 5 BAYES_50 301083 56.04 46.94 58.35 6 DCC_CHECK_NEGATIVE 280261 47.63 21.34 54.32 7 DKIM_VALID_AU 273874 54.08 58.03 53.08 8 XMListUnsubscribeExists 273328 56.24 69.07 52.98 9 DCC_CHECK 225394 50.42 76.85 43.68 10 XM_H_QuotedFrom 207704 42.02 48.93 40.26 11 T_TM2_M_HEADER_IN_MSG 159816 28.24 17.49 30.97 12 HTML_FONT_LOW_CONTRAST 144563 30.18 38.65 28.02 13 DKIM_VALID_EF 141087 26.46 22.98 27.34 14 LOC_TINY_FONT_1 120945 25.46 33.37 23.44 15 XMSubLong 117967 23.66 26.77 22.86 16 FVGT_m_MULTI_ODD 109790 22.17 25.65 21.28 17 MIME_HTML_ONLY 107024 23.58 34.72 20.74 18 MultiRelay 90961 17.17 15.35 17.63 19 T_KAM_HTML_FONT_INVALID 88121 17.65 19.89 17.08 20 BAYES_00 82392 13.06 1.61 15.97 21 ALL_TRUSTED 74776 12.38 4.09 14.49 22 TR_XM_DK_Bayes 66671 10.51 1.05 12.92 23 XM_Multi_Part_URI 66576 13.31 14.92 12.90 24 XM_Body_Dirty_Words 65085 14.27 20.76 12.61 25 XM_DKIMWhitelistDomains 64706 10.00 0.02 12.54 26 TR_XM_DK_Bayes1 63984 10.08 0.94 12.40 27 TR_XM_DK_Bayes2 54401 8.58 0.88 10.54 28 RCVD_IN_RP_SAFE 52880 8.73 2.78 10.25 29 XM_Evil_Numbers_Gen 47111 10.13 14.04 9.13 30 HTML_IMAGE_RATIO_02 46606 10.42 15.85 9.03 31 RCVD_IN_RP_CERTIFIED 46192 7.60 2.30 8.95 32 LOTS_OF_MONEY 46179 9.60 12.17 8.95 33 LotsOfNums_01 45251 8.21 5.99 8.77 34 TooManyTo_001 43074 8.59 9.54 8.35 35 T_XMDrugObfuBody_14 40991 8.03 8.35 7.94 36 XM_DK_Undo_02 37755 13.12 35.92 7.32 37 FSL_BULK_SIG 34119 7.83 12.59 6.61 38 XM_B_Phish_Phrases 32651 6.80 8.67 6.33 39 XM_H_Long_From01 32251 6.52 7.58 6.25 40 MIME_QP_LONG_LINE 30579 5.36 3.15 5.93 41 HTML_IMAGE_RATIO_04 30171 6.43 8.72 5.85 42 XM_SendGrid 29916 5.16 2.67 5.80 43 RELAYCOUNTRY_META 28734 8.49 19.98 5.57 44 RCVD_IN_IADB_LISTED 28552 4.75 1.65 5.53 45 XMStrtUSub 27347 5.17 4.64 5.30 46 BAYES_99 26948 9.69 27.23 5.22 47 T_TooManySym_01 26416 4.59 2.51 5.12 48 BAYES_60 25755 5.61 8.05 4.99 49 BAYES_40 25123 4.36 2.34 4.87 50 RCVD_IN_IADB_SPF 24858 4.12 1.37 4.82 51 DKIM_INVALID 24683 5.06 6.15 4.78 52 BOTNET_IPINHOSTNAME 24364 7.74 19.60 4.72 53 FROM_EXCESS_BASE64 23767 4.91 6.09 4.61 54 BAYES_999 23193 8.07 22.13 4.50 55 XM_PDF 22566 3.65 0.83 4.37 56 XMSexyCombo_05 22260 5.84 11.85 4.31 57 RCVD_IN_MSPIKE_H2 22151 4.11 3.40 4.29 58 RCVD_IN_IADB_SENDERID 21807 3.63 1.26 4.23 59 RCVD_IN_IADB_DK 21294 3.54 1.25 4.13 60 HTML_IMAGE_RATIO_06 21080 4.33 5.29 4.09 61 T_REMOTE_IMAGE 20725 4.42 6.02 4.02 62 BAYES_20 19628 3.42 1.93 3.80 63 MPART_ALT_DIFF 19550 4.73 8.41 3.79 64 IN_ZIMBRA_NJ_WHITELIST 19340 2.99 0.03 3.75 65 XMSubMetaSx_00 18595 4.29 6.99 3.60 66 RCVD_IN_IADB_VOUCHED 18575 3.07 0.99 3.60 67 MIME_HTML_MOSTLY 15919 3.21 3.68 3.09 68 XM_UncommonTLD01 15471 5.12 13.46 3.00 69 TR_DCC_Bayes_99 15072 6.79 22.00 2.92 70 XMNumbers 13924 3.28 5.54 2.70 71 BAYES_80 13819 3.57 7.06 2.68 72 HTML_IMAGE_RATIO_08 13368 2.61 2.71 2.59 73 UNPARSEABLE_RELAY 12455 2.23 1.49 2.41 74 TO_MALFORMED 12404 1.92 0.03 2.40 75 RCVD_IN_IADB_OPTIN 11973 1.98 0.66 2.32 76 HTML_MIME_NO_HTML_TAG 11683 2.89 5.35 2.26 77 MAILING_LIST_MULTI 11645 2.16 1.80 2.26 78 BAYES_05 11627 2.01 1.04 2.25 79 TM2_M_URI_OPT_OUT 11601 2.65 4.23 2.25 80 XM_CamelCaseFrm001 11214 2.29 2.73 2.17 81 XM_SPF_SoftFail 11193 2.96 6.08 2.17 82 TVD_RCVD_IP 11163 1.79 0.31 2.16 83 TooManyTo_002 10527 1.86 1.15 2.04 84 BOTNET 10390 5.36 18.50 2.01 85 RCVD_IN_MSPIKE_H3 9799 1.64 0.64 1.90 86 RCVD_IN_MSPIKE_WL 9799 1.64 0.64 1.90 87 UNTRUSTED_Relay 9495 4.01 12.51 1.84 88 XM_DK_Undo_01 9462 1.71 1.21 1.83 89 T_TooManySym_02 9274 1.57 0.66 1.80 90 XM_DIRTYINTL 9218 2.49 5.23 1.79 91 ANY_BOUNCE_MESSAGE 9114 1.57 0.82 1.77 92 BOUNCE_MESSAGE 9107 1.57 0.82 1.77 93 TR_Symld_Words 8727 1.60 1.24 1.69 94 RELAYCOUNTRY_CA 8625 2.08 3.68 1.67 95 IN_HORDE_ADDRESS_BOOK 8522 1.33 0.05 1.65 96 MIME_HTML_ONLY_MULTI 8520 2.11 3.93 1.65 97 TR_MetaPhish_Combo_01 8455 1.46 0.76 1.64 98 URI_HEX 8126 1.98 3.59 1.57 99 T_XMDrugObfuBody_08 8106 1.77 2.54 1.57 100 BAYES_95 8054 1.97 3.56 1.56 101 XMDiploma_00 8024 1.77 2.62 1.56 102 HELO_NODOT 7951 1.48 1.24 1.54 103 HELO_NO_DOMAIN 7948 1.48 1.24 1.54 104 XM_H_PHPOS 7876 1.46 1.21 1.53 105 XM_H_Long_From02 7626 1.53 1.76 1.48 106 SUBJ_ALL_CAPS 7520 1.47 1.50 1.46 107 T_XMHurry_00 7475 1.55 1.93 1.45 108 INVALID_MSGID 7338 1.17 0.17 1.42 109 XMCapTrack 7146 1.16 0.27 1.39 110 TooManyTo_003 7061 1.29 0.98 1.37 111 XM_ProductURIs 6937 1.29 1.08 1.34 112 URI_TRY_3LD 6916 1.29 1.10 1.34 113 XMBody_95 6702 1.06 0.11 1.30 114 XMBdyGiftCard01 6639 1.45 2.07 1.29 115 XM_OfRef6 6583 1.49 2.34 1.28 116 XMStockSpam_06 6570 1.31 1.47 1.27 117 XM_UB50 6567 2.33 6.50 1.27 118 XM_GoogleGroups 6294 1.08 0.53 1.22 119 XMPhish11 6258 1.27 1.50 1.21 120 NO_DNS_FOR_FROM 5747 1.29 1.98 1.11 121 USER_IN_DEF_DKIM_WL 5615 0.88 0.05 1.09 122 XMGenDplmaNmb 5189 1.17 1.82 1.01 123 TooManyTo_004 5035 0.95 0.86 0.98 124 DKIM_ADSP_CUSTOM_MED 5030 0.95 0.87 0.97 125 RELAYCOUNTRY_GB 4958 1.16 1.94 0.96 126 XMSubMetaI_00 4898 1.21 2.22 0.95 127 T_FILL_THIS_FORM_SHORT 4397 0.98 1.48 0.85 128 TM2_M_VERY_LONG_WORD 4336 0.95 1.37 0.84 129 TooManyTo_005 4092 0.79 0.76 0.79 130 T_XMDrugObfuBody_00 3893 0.93 1.60 0.75 131 XMBody_78 3871 0.91 1.53 0.75 132 XMBody_17 3815 0.79 0.97 0.74 133 SpammyFromTLD_01 3749 0.94 1.77 0.73 134 XM_salutation2 3701 0.84 1.33 0.72 135 XM_RXBody 3671 0.70 0.68 0.71 136 NML_ADSP_CUSTOM_MED 3516 0.71 0.83 0.68 137 TO_NO_BRKTS_HTML_ONLY 3456 0.57 0.16 0.67 138 RCVD_IN_BL_SPAMCOP_NET 3247 1.05 2.73 0.63 139 T_Symld_Words_02 3212 0.65 0.78 0.62 140 XMPhish14 3079 0.86 1.90 0.60 141 URI_NOVOWEL 3076 0.64 0.82 0.60 142 XM_H_PHPMailer 3050 0.60 0.66 0.59 143 TR_XM_RelayPhish 3045 0.82 1.74 0.59 144 XMBrknScrpt_02 3016 0.74 1.34 0.58 145 T_OBFU_PDF_ATTACH 2997 0.51 0.21 0.58 146 XMLngstWrd_00 2996 0.52 0.29 0.58 147 HTML_FONT_FACE_BAD 2958 0.55 0.48 0.57 148 HTML_TAG_BALANCE_BODY 2891 0.69 1.21 0.56 149 XMHTMLBadTable_001 2865 0.66 1.08 0.56 150 HTTPS_HTTP_MISMATCH 2822 0.59 0.76 0.55 151 XMLngstWrd_01 2797 0.49 0.27 0.54 152 XMMoneyMeta_00 2778 0.65 1.09 0.54 153 TM2_M_A_HREF_HREF 2739 0.51 0.44 0.53 154 PLING_QUERY 2697 0.68 1.30 0.52 155 RELAYCOUNTRY_PH 2664 0.41 0.01 0.52 156 XMNoVowels 2652 0.52 0.53 0.51 157 XM_B_COPY_HTML 2650 0.57 0.80 0.51 158 XMGappySubj_01 2619 0.48 0.39 0.51 159 XM_B_REG_HTML 2594 0.53 0.64 0.50 160 XMSexyCombo_01 2581 0.88 2.35 0.50 161 USER_IN_WHITELIST 2572 0.40 0.00 0.50 162 NUMERIC_HTTP_ADDR 2555 0.61 1.04 0.50 163 XM_ShortIntro_01 2542 0.50 0.54 0.49 164 FORGED_GMAIL_RCVD 2521 0.52 0.66 0.49 165 T_TooManySym_03 2483 0.42 0.18 0.48 166 DKIM_ADSP_NXDOMAIN 2438 0.51 0.64 0.47 167 XM_URI_RBL 2403 1.35 4.81 0.47 168 FROM_GOV_SPOOF 2385 0.40 0.17 0.46 169 MISSING_HEADERS 2380 0.83 2.27 0.46 170 XMPhish30 2378 0.64 1.33 0.46 171 RDNS_DYNAMIC 2335 0.53 0.82 0.45 172 RELAYCOUNTRY_AU 2312 0.52 0.79 0.45 173 XMDateMe_00 2291 0.49 0.65 0.44 174 XMHTML_After_End 2248 0.62 1.36 0.44 175 HTML_IMAGE_ONLY_28 2232 0.74 1.96 0.43 176 TR_LOTS_OF_MONEY2 2217 0.67 1.61 0.43 177 T_MONEY_PERCENT 2217 0.67 1.61 0.43 178 SHORT_HELO_AND_INLINE_IMAGE 2149 0.36 0.13 0.42 179 SUBJ_DOLLARS 2073 0.44 0.60 0.40 180 XMSolicitRefs_0 2052 0.37 0.27 0.40 181 XMSubMetaSxObfu_03 1961 0.53 1.14 0.38 182 RELAYCOUNTRY_DE 1928 0.47 0.87 0.37 183 RCVD_IN_SORBS_DUL 1910 0.37 0.35 0.37 184 FILL_THIS_FORM 1907 0.50 1.03 0.37 185 AC_DIV_BONANZA 1907 0.31 0.09 0.37 186 XMSubMetaSxObfu_02 1899 0.34 0.24 0.37 187 FROM_GOV_DKIM_AU 1898 0.32 0.12 0.37 188 TM2_M_BODY_EMPTY 1863 0.31 0.11 0.36 189 HTML_IMAGE_ONLY_32 1857 0.41 0.60 0.36 190 DIET_1 1834 0.51 1.12 0.36 191 BASE64_LENGTH_79_INF 1761 0.67 1.97 0.34 192 XMSlimDrugH 1758 0.38 0.52 0.34 193 REMOVE_BEFORE_LINK 1694 0.36 0.51 0.33 194 HTML_IMAGE_ONLY_24 1675 0.52 1.28 0.32 195 TR_LOTS_OF_MONEY3 1667 0.38 0.60 0.32 196 XMLngstWrd_02 1593 0.29 0.21 0.31 197 XMSubNoVowel 1565 0.66 2.07 0.30 198 XM_H_PHPOS_M 1546 0.31 0.37 0.30 199 XM_Body_Obfu01 1543 0.35 0.53 0.30 200 FILL_THIS_FORM_LONG 1508 0.43 0.98 0.29 ----------------------------------------------------------------------