Email: 112 Autolearn: 0 AvgScore: 2.86 AvgScanTime: 5.18 sec Spam: 34 Autolearn: 0 AvgScore: 12.88 AvgScanTime: 5.04 sec Ham: 78 Autolearn: 0 AvgScore: -1.51 AvgScanTime: 5.24 sec Time Spent Running SA: 0.16 hours Time Spent Processing Spam: 0.05 hours Time Spent Processing Ham: 0.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 31 82.14 91.18 78.21 2 HTML_MESSAGE 30 83.04 88.24 80.77 3 XM_DK_Pass 28 69.64 82.35 64.10 4 DKIM_SIGNED 28 71.43 82.35 66.67 5 XM_B_Unicode 26 60.71 76.47 53.85 6 BAYES_50 24 62.50 70.59 58.97 7 XMListUnsubscribeExists 23 51.79 67.65 44.87 8 XM_B_Unicode3 23 48.21 67.65 39.74 9 HTML_FONT_LOW_CONTRAST 21 37.50 61.76 26.92 10 LOC_TINY_FONT_1 21 37.50 61.76 26.92 11 DCC_CHECK 18 25.89 52.94 14.10 12 XMSubLong 16 36.61 47.06 32.05 13 DCC_CHECK_NEGATIVE 16 74.11 47.06 85.90 14 XM_Multi_Part_URI 16 25.00 47.06 15.38 15 DKIM_VALID 15 54.46 44.12 58.97 16 XM_B_SpammyWords 14 38.39 41.18 37.18 17 LotsOfNums_01 13 18.75 38.24 10.26 18 DKIM_INVALID 13 16.96 38.24 7.69 19 XM_B_REG_HTML 12 12.50 35.29 2.56 20 DKIM_VALID_AU 12 44.64 35.29 48.72 21 DKIM_VALID_EF 10 27.68 29.41 26.92 22 MIME_HTML_ONLY 10 23.21 29.41 20.51 23 XM_B_SpammyWords2 7 14.29 20.59 11.54 24 XM_UncommonTLD01 7 10.71 20.59 6.41 25 XM_DK_Undo_02 7 9.82 20.59 5.13 26 BAYES_99 6 6.25 17.65 1.28 27 BOTNET 6 8.04 17.65 3.85 28 TR_XM_DK_Unsub 6 20.54 17.65 21.79 29 TR_XM_DKIM_Undo 6 6.25 17.65 1.28 30 BAYES_999 5 5.36 14.71 1.28 31 BOTNET_NORDNS 5 4.46 14.71 0.00 32 RCVD_IN_MSPIKE_WL 4 29.46 11.76 37.18 33 RCVD_IN_MSPIKE_H3 4 25.89 11.76 32.05 34 XMStrtUSub 4 3.57 11.76 0.00 35 UNPARSEABLE_RELAY 4 6.25 11.76 3.85 36 FVGT_m_MULTI_ODD 4 20.54 11.76 24.36 37 RELAYCOUNTRY_META 4 11.61 11.76 11.54 38 UPGRADE_MAILBOX 4 3.57 11.76 0.00 39 XM_Body_Dirty_Words 4 14.29 11.76 15.38 40 RCVD_IN_MSPIKE_H2 4 14.29 11.76 15.38 41 RCVD_IN_VALIDITY_RPBL 4 3.57 11.76 0.00 42 FSL_BULK_SIG 4 7.14 11.76 5.13 43 T_TM2_M_HEADER_IN_MSG 3 17.86 8.82 21.79 44 TR_XM_BayesUnsub 3 4.46 8.82 2.56 45 TR_XM_SpammyWords2 3 2.68 8.82 0.00 46 MIME_HTML_ONLY_MULTI 3 6.25 8.82 5.13 47 TooManyTo_001 3 9.82 8.82 10.26 48 XM_H_Long_From01 3 6.25 8.82 5.13 49 XM_H_PHPMailer 3 2.68 8.82 0.00 50 XM_B_SpammyWords3 3 6.25 8.82 5.13 51 HTML_IMAGE_RATIO_02 3 3.57 8.82 1.28 52 MPART_ALT_DIFF 3 8.93 8.82 8.97 53 UNTRUSTED_Relay 3 6.25 8.82 5.13 54 XM_Evil_Numbers_Gen 3 7.14 8.82 6.41 55 T_KAM_HTML_FONT_INVALID 3 13.39 8.82 15.38 56 XM_B_Unsub 3 8.04 8.82 7.69 57 TR_XM_PhishingBody 2 2.68 5.88 1.28 58 TR_XM_PHPForged 2 1.79 5.88 0.00 59 TR_MetaPhish_Combo_01 2 1.79 5.88 0.00 60 SUBJ_ALL_CAPS 2 2.68 5.88 1.28 61 XM_B_SpammyTLD 2 4.46 5.88 3.85 62 XMSubPhish8 2 1.79 5.88 0.00 63 TR_XM_SpammyWords5 2 1.79 5.88 0.00 64 TR_XM_FormFill2 2 1.79 5.88 0.00 65 KHOP_HELO_FCRDNS 2 3.57 5.88 2.56 66 TR_XM_PHPDW 2 1.79 5.88 0.00 67 LOTS_OF_MONEY 2 3.57 5.88 2.56 68 XM_SendGrid 2 2.68 5.88 1.28 69 PLING_QUERY 2 5.36 5.88 5.13 70 FSL_HELO_NON_FQDN_1 2 1.79 5.88 0.00 71 DATE_IN_PAST_03_06 2 1.79 5.88 0.00 72 BOTNET_IPINHOSTNAME 2 8.93 5.88 10.26 73 HELO_NODOT 2 1.79 5.88 0.00 74 TR_XM_DK_SendGrid 2 2.68 5.88 1.28 75 XM_H_PHPOS_M 2 1.79 5.88 0.00 76 XMSubPhish11 2 3.57 5.88 2.56 77 HELO_NO_DOMAIN 2 1.79 5.88 0.00 78 TR_Caps_n_Bayes_99 2 1.79 5.88 0.00 79 TR_XM_SB_Phish 2 3.57 5.88 2.56 80 HTML_MIME_NO_HTML_TAG 2 5.36 5.88 5.13 81 XM_H_PHPOS 2 1.79 5.88 0.00 82 REPLYTO_WITHOUT_TO_CC 1 0.89 2.94 0.00 83 TR_XM_SpoofPhishAttach 1 2.68 2.94 2.56 84 TO_NO_BRKTS_DYNIP 1 0.89 2.94 0.00 85 T_HTML_ATTACH 1 0.89 2.94 0.00 86 XMLngstWrd_00 1 3.57 2.94 3.85 87 MAY_BE_FORGED 1 0.89 2.94 0.00 88 RCVD_IN_BL_SPAMCOP_NET 1 0.89 2.94 0.00 89 T_REMOTE_IMAGE 1 4.46 2.94 5.13 90 XM_SPF_SoftFail 1 0.89 2.94 0.00 91 MIME_BASE64_TEXT 1 0.89 2.94 0.00 92 FROM_OFFERS 1 0.89 2.94 0.00 93 XMDiploma_00 1 1.79 2.94 1.28 94 FROM_MISSP_USER 1 0.89 2.94 0.00 95 XMSexyCombo_05 1 1.79 2.94 1.28 96 XM_Combo_Sbj 1 1.79 2.94 1.28 97 URI_TRY_3LD 1 0.89 2.94 0.00 98 NORDNS_LOW_CONTRAST 1 0.89 2.94 0.00 99 TR_LOTS_OF_MONEY2 1 0.89 2.94 0.00 100 XM_Nigeria_01 1 0.89 2.94 0.00 101 XM_URI_RBL 1 0.89 2.94 0.00 102 TR_XM_MSPIKECOMBO 1 1.79 2.94 1.28 103 TooManyTo_003 1 1.79 2.94 1.28 104 FROM_MISSP_REPLYTO 1 0.89 2.94 0.00 105 HTML_IMAGE_ONLY_20 1 2.68 2.94 2.56 106 XMBdyGiftCard01 1 0.89 2.94 0.00 107 TR_XM_Base64_L1 1 0.89 2.94 0.00 108 NOT_SPAM 1 0.89 2.94 0.00 109 PDS_RDNS_DYNAMIC_FP 1 0.89 2.94 0.00 110 SpammyFromTLD_02 1 0.89 2.94 0.00 111 BAYES_95 1 2.68 2.94 2.56 112 HTML_IMAGE_RATIO_08 1 2.68 2.94 2.56 113 TM2_M_VERY_LONG_WORD 1 4.46 2.94 5.13 114 XMLngstWrd_03 1 2.68 2.94 2.56 115 RELAYCOUNTRY_CL 1 0.89 2.94 0.00 116 HTML_TITLE_SUBJ_DIFF 1 2.68 2.94 2.56 117 TR_XM_RelayPhish 1 0.89 2.94 0.00 118 XMLngstWrd_01 1 2.68 2.94 2.56 119 DIET_1 1 1.79 2.94 1.28 120 XMLngstWrd_04 1 2.68 2.94 2.56 121 XMSexyCombo_01 1 3.57 2.94 3.85 122 XMSolicitRefs_0 1 1.79 2.94 1.28 123 RELAYCOUNTRY_TW 1 0.89 2.94 0.00 124 XMSubMetaSx_00 1 5.36 2.94 6.41 125 LongTLD 1 0.89 2.94 0.00 126 IMPOTENCE 1 0.89 2.94 0.00 127 RELAYCOUNTRY_UA 1 0.89 2.94 0.00 128 XMPhish11 1 0.89 2.94 0.00 129 TR_XM_SpammyRelay 1 4.46 2.94 5.13 130 TO_NO_BRKTS_FROM_MSSP 1 0.89 2.94 0.00 131 AXB_XMAILER_MIMEOLE_OL_024C2 1 0.89 2.94 0.00 132 RCVD_IN_MSPIKE_L4 1 0.89 2.94 0.00 133 TooManyTo_004 1 0.89 2.94 0.00 134 MIME_HTML_MOSTLY 1 2.68 2.94 2.56 135 XM_UB50 1 3.57 2.94 3.85 136 ADVANCE_FEE_3_NEW_MONEY 1 0.89 2.94 0.00 137 XMGenDplmaNmb 1 0.89 2.94 0.00 138 TR_XM_SpammyWords4 1 0.89 2.94 0.00 139 XM_B_Phish_Phrases 1 1.79 2.94 1.28 140 XM_UB95 1 0.89 2.94 0.00 141 SHORT_URI 1 0.89 2.94 0.00 142 RELAYCOUNTRY_LV 1 0.89 2.94 0.00 143 RCVD_IN_MSPIKE_BL 1 1.79 2.94 1.28 144 FSL_NEW_HELO_USER 1 0.89 2.94 0.00 145 MISSING_HEADERS 1 0.89 2.94 0.00 146 FORGED_MUA_OUTLOOK 1 0.89 2.94 0.00 147 FONT_INVIS_MSGID 1 0.89 2.94 0.00 148 FROM_MISSP_EH_MATCH 1 0.89 2.94 0.00 149 TR_XM_NoHeaderRelay 1 0.89 2.94 0.00 150 TR_LOTS_OF_MONEY1 1 0.89 2.94 0.00 151 OBFU_TEXT_ATTACH 1 0.89 2.94 0.00 152 XPRIO 1 0.89 2.94 0.00 153 XMPhish08 1 0.89 2.94 0.00 154 HTML_COMMENT_SAVED_URL 1 0.89 2.94 0.00 155 OBFU_UNSUB_UL 1 0.89 2.94 0.00 156 UPPERCASE_75_100 1 2.68 2.94 2.56 157 T_MONEY_PERCENT 1 0.89 2.94 0.00 158 MSOE_MID_WRONG_CASE 1 0.89 2.94 0.00 159 PDS_OTHER_BAD_TLD 1 2.68 2.94 2.56 160 XM_ShortIntro_01 1 0.89 2.94 0.00 161 BAYES_80 1 2.68 2.94 2.56 162 XM_UB60 1 0.89 2.94 0.00 163 MONEY_FROM_MISSP 1 0.89 2.94 0.00 164 T_XMDrugObfuBody_06 1 0.89 2.94 0.00 165 RDNS_DYNAMIC 1 1.79 2.94 1.28 166 FROM_MISSPACED 1 0.89 2.94 0.00 167 FSL_CTYPE_WIN1251 1 0.89 2.94 0.00 168 XMLngstWrd_02 1 2.68 2.94 2.56 169 URIBL_DBL_SPAM 1 0.89 2.94 0.00 170 XMhairloss01 1 0.89 2.94 0.00 171 XM_GoogleGroups 1 3.57 2.94 3.85 172 BAYES_40 1 1.79 2.94 1.28 173 TR_Symld_Words 1 0.89 2.94 0.00 174 FROM_MISSP_XPRIO 1 0.89 2.94 0.00 175 RELAYCOUNTRY_KR 1 0.89 2.94 0.00 176 BAYES_60 1 8.04 2.94 10.26 177 NSL_RCVD_FROM_USER 1 0.89 2.94 0.00 178 FROM_MISSP_MSFT 1 0.89 2.94 0.00 179 TooManyTo_002 1 2.68 2.94 2.56 180 MONEY_FRAUD_5 1 0.89 2.94 0.00 181 RELAYCOUNTRY_ES 1 0.89 2.94 0.00 182 TR_XM_UnparsRelay 1 1.79 2.94 1.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 67 74.11 47.06 85.90 2 HTML_MESSAGE 63 83.04 88.24 80.77 3 RELAYCOUNTRY_US 61 82.14 91.18 78.21 4 DKIM_SIGNED 52 71.43 82.35 66.67 5 XM_DK_Pass 50 69.64 82.35 64.10 6 DKIM_VALID 46 54.46 44.12 58.97 7 BAYES_50 46 62.50 70.59 58.97 8 XM_B_Unicode 42 60.71 76.47 53.85 9 DKIM_VALID_AU 38 44.64 35.29 48.72 10 XMListUnsubscribeExists 35 51.79 67.65 44.87 11 XM_B_Unicode3 31 48.21 67.65 39.74 12 XM_B_SpammyWords 29 38.39 41.18 37.18 13 RCVD_IN_MSPIKE_WL 29 29.46 11.76 37.18 14 XMSubLong 25 36.61 47.06 32.05 15 RCVD_IN_MSPIKE_H3 25 25.89 11.76 32.05 16 DKIM_VALID_EF 21 27.68 29.41 26.92 17 LOC_TINY_FONT_1 21 37.50 61.76 26.92 18 HTML_FONT_LOW_CONTRAST 21 37.50 61.76 26.92 19 FVGT_m_MULTI_ODD 19 20.54 11.76 24.36 20 T_TM2_M_HEADER_IN_MSG 17 17.86 8.82 21.79 21 TR_XM_DK_Unsub 17 20.54 17.65 21.79 22 MIME_HTML_ONLY 16 23.21 29.41 20.51 23 BAYES_00 14 12.50 0.00 17.95 24 RCVD_IN_MSPIKE_H2 12 14.29 11.76 15.38 25 XM_Body_Dirty_Words 12 14.29 11.76 15.38 26 XM_Multi_Part_URI 12 25.00 47.06 15.38 27 T_KAM_HTML_FONT_INVALID 12 13.39 8.82 15.38 28 ALL_TRUSTED 11 9.82 0.00 14.10 29 DCC_CHECK 11 25.89 52.94 14.10 30 T_TooManySym_01 11 9.82 0.00 14.10 31 USER_IN_DEF_DKIM_WL 10 8.93 0.00 12.82 32 TR_XM_DK_Bayes1 10 8.93 0.00 12.82 33 TR_XM_DK_Bayes 10 8.93 0.00 12.82 34 XM_B_SpammyWords2 9 14.29 20.59 11.54 35 HTML_IMAGE_RATIO_06 9 8.04 0.00 11.54 36 RELAYCOUNTRY_META 9 11.61 11.76 11.54 37 TR_XM_DK_Bayes2 9 8.04 0.00 11.54 38 T_TooManySym_02 9 8.04 0.00 11.54 39 LotsOfNums_01 8 18.75 38.24 10.26 40 TooManyTo_001 8 9.82 8.82 10.26 41 BOTNET_IPINHOSTNAME 8 8.93 5.88 10.26 42 BAYES_60 8 8.04 2.94 10.26 43 MPART_ALT_DIFF 7 8.93 8.82 8.97 44 INVALID_MSGID 6 5.36 0.00 7.69 45 IN_ZIMBRA_NJ_WHITELIST 6 5.36 0.00 7.69 46 XMNumbers 6 5.36 0.00 7.69 47 DKIM_INVALID 6 16.96 38.24 7.69 48 XM_B_Unsub 6 8.04 8.82 7.69 49 XMSubMetaSx_00 5 5.36 2.94 6.41 50 XM_Evil_Numbers_Gen 5 7.14 8.82 6.41 51 XM_CamelCaseFrm001 5 4.46 0.00 6.41 52 XM_H_Trusted_IP 5 4.46 0.00 6.41 53 XM_UncommonTLD01 5 10.71 20.59 6.41 54 MIME_HTML_ONLY_MULTI 4 6.25 8.82 5.13 55 T_REMOTE_IMAGE 4 4.46 2.94 5.13 56 TR_XM_SpammyRelay 4 4.46 2.94 5.13 57 BOUNCE_MESSAGE 4 3.57 0.00 5.13 58 TM2_M_VERY_LONG_WORD 4 4.46 2.94 5.13 59 XM_DKIMWhitelistDomains 4 3.57 0.00 5.13 60 UNTRUSTED_Relay 4 6.25 8.82 5.13 61 XM_DK_Undo_02 4 9.82 20.59 5.13 62 XM_B_SpammyWords3 4 6.25 8.82 5.13 63 PLING_QUERY 4 5.36 5.88 5.13 64 ANY_BOUNCE_MESSAGE 4 3.57 0.00 5.13 65 XM_H_Long_From01 4 6.25 8.82 5.13 66 FSL_BULK_SIG 4 7.14 11.76 5.13 67 HTML_MIME_NO_HTML_TAG 4 5.36 5.88 5.13 68 HTML_FONT_FACE_BAD 4 3.57 0.00 5.13 69 UNPARSEABLE_RELAY 3 6.25 11.76 3.85 70 FROM_GOV_SPOOF 3 2.68 0.00 3.85 71 XM_B_SpammyTLD 3 4.46 5.88 3.85 72 XM_DK_Undo_01 3 2.68 0.00 3.85 73 XMLngstWrd_00 3 3.57 2.94 3.85 74 XM_B_Unsub2 3 2.68 0.00 3.85 75 RCVD_IN_IADB_DK 3 2.68 0.00 3.85 76 TO_MALFORMED 3 2.68 0.00 3.85 77 RCVD_IN_IADB_LISTED 3 2.68 0.00 3.85 78 RCVD_IN_IADB_VOUCHED 3 2.68 0.00 3.85 79 XMSexyCombo_01 3 3.57 2.94 3.85 80 RCVD_IN_IADB_SPF 3 2.68 0.00 3.85 81 MSGID_NOFQDN1 3 2.68 0.00 3.85 82 XM_DIRTYINTL 3 2.68 0.00 3.85 83 BOTNET 3 8.04 17.65 3.85 84 RCVD_IN_IADB_SENDERID 3 2.68 0.00 3.85 85 XM_UB50 3 3.57 2.94 3.85 86 XM_B_COPY_HTML 3 2.68 0.00 3.85 87 T_TooManySym_03 3 2.68 0.00 3.85 88 XM_GoogleGroups 3 3.57 2.94 3.85 89 TVD_SPACE_RATIO 3 2.68 0.00 3.85 90 XM_PDF 2 1.79 0.00 2.56 91 BAYES_20 2 1.79 0.00 2.56 92 BAYES_05 2 1.79 0.00 2.56 93 TR_XM_BayesUnsub 2 4.46 8.82 2.56 94 TR_XM_SpoofPhishAttach 2 2.68 2.94 2.56 95 MIME_QP_LONG_LINE 2 1.79 0.00 2.56 96 RCVD_IN_MSPIKE_H4 2 1.79 0.00 2.56 97 XMGappySubj_01 2 1.79 0.00 2.56 98 XM_B_REG_HTML 2 12.50 35.29 2.56 99 XM_Dr_From 2 1.79 0.00 2.56 100 XMLngstWrd_04 2 2.68 2.94 2.56 101 KHOP_HELO_FCRDNS 2 3.57 5.88 2.56 102 XMLngstWrd_01 2 2.68 2.94 2.56 103 TR_XM_SpoofStaff 2 1.79 0.00 2.56 104 TM2_M_URI_OPT_OUT 2 1.79 0.00 2.56 105 HTML_TITLE_SUBJ_DIFF 2 2.68 2.94 2.56 106 XMLngstWrd_03 2 2.68 2.94 2.56 107 HTML_IMAGE_RATIO_08 2 2.68 2.94 2.56 108 BAYES_95 2 2.68 2.94 2.56 109 HTML_IMAGE_ONLY_20 2 2.68 2.94 2.56 110 TO_EQ_FM_DOM_HTML_IMG 2 1.79 0.00 2.56 111 FVGT_m_MULTI_ODD_EMAIL 2 1.79 0.00 2.56 112 XMSpoofStaff2 2 1.79 0.00 2.56 113 XM_H_SpoofStaff4 2 1.79 0.00 2.56 114 RCVD_IN_IADB_OPTIN 2 1.79 0.00 2.56 115 RELAYCOUNTRY_CA 2 1.79 0.00 2.56 116 LOTS_OF_MONEY 2 3.57 5.88 2.56 117 MIME_HTML_MOSTLY 2 2.68 2.94 2.56 118 XM_ZohoDesk1 2 1.79 0.00 2.56 119 RCVD_IN_IADB_OPTIN_GT50 2 1.79 0.00 2.56 120 TooManyTo_002 2 2.68 2.94 2.56 121 T_XMDrugObfuBody_14 2 1.79 0.00 2.56 122 TR_XM_PSC1 2 1.79 0.00 2.56 123 XMLngstWrd_02 2 2.68 2.94 2.56 124 RCVD_IN_MSPIKE_H5 2 1.79 0.00 2.56 125 TR_XM_SB_Phish 2 3.57 5.88 2.56 126 HTML_IMAGE_ONLY_24 2 1.79 0.00 2.56 127 RELAYCOUNTRY_AU 2 1.79 0.00 2.56 128 PDS_OTHER_BAD_TLD 2 2.68 2.94 2.56 129 XM_ZIP 2 1.79 0.00 2.56 130 XMSubject_78 2 1.79 0.00 2.56 131 BAYES_80 2 2.68 2.94 2.56 132 XMSubPhish11 2 3.57 5.88 2.56 133 UPPERCASE_75_100 2 2.68 2.94 2.56 134 TR_XM_MSPIKECOMBO 1 1.79 2.94 1.28 135 T_TooManySym_04 1 0.89 0.00 1.28 136 RELAYCOUNTRY_BE 1 0.89 0.00 1.28 137 XM_Combo_Sbj 1 1.79 2.94 1.28 138 XMSexyCombo_05 1 1.79 2.94 1.28 139 XMDiploma_00 1 1.79 2.94 1.28 140 IMG_ONLY_FM_DOM_INFO 1 0.89 0.00 1.28 141 TR_XM_MaxWHORU 1 0.89 0.00 1.28 142 BAYES_99 1 6.25 17.65 1.28 143 RCVD_IN_MSPIKE_L3 1 0.89 0.00 1.28 144 XMSubMetaSxObfu_03 1 0.89 0.00 1.28 145 HTML_IMAGE_ONLY_16 1 0.89 0.00 1.28 146 SUBJ_ALL_CAPS 1 2.68 5.88 1.28 147 RELAYCOUNTRY_AT 1 0.89 0.00 1.28 148 TR_XM_PhishingBody 1 2.68 5.88 1.28 149 MSGID_FROM_MTA_HEADER 1 0.89 0.00 1.28 150 MIME_HEADER_CTYPE_ONLY 1 0.89 0.00 1.28 151 XM_H_AmazonPhish 1 0.89 0.00 1.28 152 XM_Body_Dirty_Words_01 1 0.89 0.00 1.28 153 BAYES_999 1 5.36 14.71 1.28 154 DIET_1 1 1.79 2.94 1.28 155 XMSolicitRefs_0 1 1.79 2.94 1.28 156 XM_Body_Obfu01 1 0.89 0.00 1.28 157 TR_BOTNET_NEGATE 1 0.89 0.00 1.28 158 FROM_LOCAL_HEX 1 0.89 0.00 1.28 159 HTML_IMAGE_ONLY_28 1 0.89 0.00 1.28 160 RCVD_IN_VALIDITY_CERTIFIED 1 0.89 0.00 1.28 161 TooManyTo_003 1 1.79 2.94 1.28 162 XMBody_17 1 0.89 0.00 1.28 163 HTML_IMAGE_RATIO_04 1 0.89 0.00 1.28 164 XMHTMLBadTable_001 1 0.89 0.00 1.28 165 T_FILL_THIS_FORM_SHORT 1 0.89 0.00 1.28 166 SpammyFromTLD_01 1 0.89 0.00 1.28 167 TR_XM_DK_SendGrid 1 2.68 5.88 1.28 168 HTML_IMAGE_RATIO_02 1 3.57 8.82 1.28 169 RCVD_IN_VALIDITY_SAFE 1 0.89 0.00 1.28 170 IN_HORDE_ADDRESS_BOOK 1 0.89 0.00 1.28 171 RELAYCOUNTRY_IN 1 0.89 0.00 1.28 172 RCVD_IN_MSPIKE_BL 1 1.79 2.94 1.28 173 T_XMDrugObfuBody_08 1 0.89 0.00 1.28 174 XM_B_Phish_Phrases 1 1.79 2.94 1.28 175 DKIM_ADSP_NXDOMAIN 1 0.89 0.00 1.28 176 XMNoSubject 1 0.89 0.00 1.28 177 XM_SendGrid 1 2.68 5.88 1.28 178 TR_XM_UnparsRelay 1 1.79 2.94 1.28 179 XM_B_SexDrugs1 1 0.89 0.00 1.28 180 XM_Body_Dirty_Words_02 1 0.89 0.00 1.28 181 RELAYCOUNTRY_DE 1 0.89 0.00 1.28 182 BAYES_40 1 1.79 2.94 1.28 183 XMSubEmpty 1 0.89 0.00 1.28 184 TR_MetaPhish_Combo_01b 1 0.89 0.00 1.28 185 RELAYCOUNTRY_FR 1 0.89 0.00 1.28 186 FROM_LOCAL_DIGITS 1 0.89 0.00 1.28 187 XMNoVowels 1 0.89 0.00 1.28 188 XM_E_Blogspot 1 0.89 0.00 1.28 189 T_PDS_PRO_TLD 1 0.89 0.00 1.28 190 XMSubMetaI_00 1 0.89 0.00 1.28 191 XMSubNoVowel 1 0.89 0.00 1.28 192 TR_XM_DKIM_Undo 1 6.25 17.65 1.28 193 RDNS_DYNAMIC 1 1.79 2.94 1.28 194 XMSubject_71 1 0.89 0.00 1.28 195 MISSING_SUBJECT 1 0.89 0.00 1.28 196 NO_DNS_FOR_FROM 1 0.89 0.00 1.28 197 XM_B_Phish66 1 0.89 0.00 1.28 198 TR_DCC_Bayes_99 1 0.89 0.00 1.28 ----------------------------------------------------------------------