Email: 496309 Autolearn: 0 AvgScore: 2.88 AvgScanTime: 1.94 sec Spam: 140241 Autolearn: 0 AvgScore: 12.57 AvgScanTime: 2.32 sec Ham: 356068 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 1.79 sec Time Spent Running SA: 267.78 hours Time Spent Processing Spam: 90.56 hours Time Spent Processing Ham: 177.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134270 87.53 95.74 84.29 2 DKIM_SIGNED 119467 72.25 85.19 67.15 3 XM_DK_Pass 116446 70.53 83.03 65.60 4 DKIM_VALID 114692 68.57 81.78 63.37 5 DCC_CHECK 111260 44.44 79.33 30.70 6 XMListUnsubscribeExists 105290 49.09 75.08 38.86 7 DKIM_VALID_AU 89815 50.78 64.04 45.55 8 XM_H_QuotedFrom 76103 38.72 54.27 32.60 9 XM_DK_Undo_02 70208 23.04 50.06 12.40 10 BAYES_99 65870 21.92 46.97 12.06 11 BAYES_999 56704 19.12 40.43 10.72 12 TR_DCC_Bayes_99 52605 14.48 37.51 5.41 13 HTML_FONT_LOW_CONTRAST 51494 25.60 36.72 21.22 14 LOC_TINY_FONT_1 47697 23.86 34.01 19.87 15 BAYES_50 43398 51.25 30.95 59.25 16 MIME_HTML_ONLY 43172 23.62 30.78 20.80 17 FVGT_m_MULTI_ODD 38969 21.07 27.79 18.42 18 XMSubLong 35000 21.42 24.96 20.03 19 XM_Body_Dirty_Words 29596 13.59 21.10 10.63 20 DKIM_VALID_EF 29026 23.14 20.70 24.10 21 T_TM2_M_HEADER_IN_MSG 28500 30.10 20.32 33.95 22 T_KAM_HTML_FONT_INVALID 27559 14.53 19.65 12.51 23 DCC_CHECK_NEGATIVE 26027 53.19 18.56 66.83 24 RELAYCOUNTRY_META 25165 9.25 17.94 5.83 25 HTML_IMAGE_RATIO_02 23757 9.06 16.94 5.95 26 XM_Multi_Part_URI 22905 11.49 16.33 9.58 27 MultiRelay 22730 19.73 16.21 21.11 28 XM_Evil_Numbers_Gen 20591 9.31 14.68 7.20 29 BOTNET_IPINHOSTNAME 17599 6.53 12.55 4.16 30 BOTNET 17502 4.20 12.48 0.93 31 LOTS_OF_MONEY 15773 8.47 11.25 7.38 32 UNTRUSTED_Relay 15747 4.16 11.23 1.37 33 T_XMDrugObfuBody_14 14939 9.17 10.65 8.58 34 FSL_BULK_SIG 14485 8.11 10.33 7.23 35 XMSexyCombo_05 14463 5.13 10.31 3.09 36 LotsOfNums_01 14163 7.49 10.10 6.46 37 XM_B_Phish_Phrases 13657 5.87 9.74 4.34 38 HTML_IMAGE_RATIO_04 12831 5.45 9.15 3.99 39 XM_H_Long_From01 11011 6.01 7.85 5.28 40 XM_UncommonTLD01 10880 4.91 7.76 3.79 41 TooManyTo_001 10833 9.43 7.72 10.10 42 MPART_ALT_DIFF 10571 6.23 7.54 5.72 43 BAYES_80 10136 4.66 7.23 3.65 44 TR_XM_DocInvoice 9995 4.98 7.13 4.14 45 RCVD_IN_RP_SAFE 9802 8.21 6.99 8.69 46 FROM_EXCESS_BASE64 9477 3.91 6.76 2.79 47 XMSubMetaSx_00 8591 4.23 6.13 3.48 48 RCVD_IN_RP_CERTIFIED 8231 7.41 5.87 8.01 49 BAYES_60 8181 5.89 5.83 5.92 50 MIME_QP_LONG_LINE 8077 4.85 5.76 4.49 51 MIME_HTML_MOSTLY 6964 3.13 4.97 2.41 52 HTML_IMAGE_RATIO_06 6663 3.24 4.75 2.64 53 XM_DIRTYINTL 6572 2.68 4.69 1.89 54 BAYES_95 6420 2.98 4.58 2.35 55 XMStrtUSub 6326 5.47 4.51 5.85 56 TM2_M_URI_OPT_OUT 6198 2.52 4.42 1.77 57 RCVD_IN_MSPIKE_H2 6096 4.73 4.35 4.88 58 XM_SPF_SoftFail 6083 2.89 4.34 2.31 59 XMNumbers 5996 3.80 4.28 3.62 60 T_REMOTE_IMAGE 5913 4.34 4.22 4.39 61 XM_UB50 5882 1.88 4.19 0.97 62 XM_SendGrid 5515 4.68 3.93 4.97 63 T_TooManySym_01 5213 4.62 3.72 4.98 64 MIME_HTML_ONLY_MULTI 5097 4.05 3.63 4.21 65 RELAYCOUNTRY_CA 5076 1.95 3.62 1.29 66 XM_CamelCaseFrm001 5007 2.17 3.57 1.62 67 DKIM_INVALID 4775 3.68 3.40 3.78 68 SUBJ_ALL_CAPS 4704 2.11 3.35 1.62 69 HTML_IMAGE_RATIO_08 4483 2.20 3.20 1.81 70 URI_HEX 4201 1.56 3.00 0.99 71 XM_URI_RBL 4017 0.90 2.86 0.12 72 T_XMDrugObfuBody_08 4015 1.75 2.86 1.31 73 RELAYCOUNTRY_FR 3842 0.92 2.74 0.21 74 RCVD_IN_BL_SPAMCOP_NET 3833 1.12 2.73 0.48 75 RCVD_IN_IADB_LISTED 3626 4.04 2.59 4.61 76 XMDiploma_00 3594 1.91 2.56 1.65 77 XM_H_Long_From02 3574 1.36 2.55 0.90 78 XMSubMetaI_00 3560 1.33 2.54 0.86 79 MultiRelay_Combo 3549 0.91 2.53 0.27 80 MultiRelay_CC 3549 0.91 2.53 0.27 81 HTML_MIME_NO_HTML_TAG 3520 2.52 2.51 2.52 82 MAILING_LIST_MULTI 3348 2.97 2.39 3.20 83 BOTNET_NORDNS 3278 0.68 2.34 0.03 84 XM_UB99 3216 0.65 2.29 0.01 85 XM_OfRef6 3091 1.87 2.20 1.74 86 RCVD_IN_IADB_SPF 3065 3.52 2.19 4.04 87 TM2_M_VERY_LONG_WORD 3034 1.19 2.16 0.81 88 SpammyFromTLD_02 3026 0.78 2.16 0.23 89 TR_Caps_n_Bayes_99 2886 0.69 2.06 0.15 90 RCVD_IN_IADB_SENDERID 2861 3.16 2.04 3.60 91 RCVD_IN_IADB_DK 2833 3.08 2.02 3.49 92 XM_RXBody 2632 0.98 1.88 0.63 93 XM_UB999 2594 0.53 1.85 0.01 94 RCVD_IN_RP_RNBL 2560 0.54 1.83 0.04 95 FSL_THIS_IS_ADV 2548 0.55 1.82 0.05 96 XMBody_17 2499 0.75 1.78 0.34 97 XMPhish30 2482 0.72 1.77 0.30 98 UNPARSEABLE_RELAY 2475 3.01 1.76 3.50 99 TR_XM_RelayPhish 2380 0.81 1.70 0.46 100 XM_UB60 2368 0.53 1.69 0.07 101 URI_TRY_3LD 2354 0.98 1.68 0.70 102 XM_HighProb1 2275 0.47 1.62 0.02 103 URIBL_BLACK 2262 0.49 1.61 0.05 104 XMGenDplmaNmb 2257 1.19 1.61 1.03 105 SpammyFromTLD_01 2216 1.05 1.58 0.84 106 RELAYCOUNTRY_DE 2178 0.99 1.55 0.77 107 XM_DK_Undo_01 2177 2.01 1.55 2.18 108 XMBdyGiftCard01 2167 0.76 1.55 0.45 109 XMSexyCombo_01 2142 0.86 1.53 0.59 110 DIET_1 2137 0.82 1.52 0.54 111 T_MONEY_PERCENT 2065 0.58 1.47 0.22 112 TR_LOTS_OF_MONEY2 2065 0.58 1.47 0.22 113 RCVD_IN_PSBL 2058 0.52 1.47 0.15 114 ALL_TRUSTED 2044 13.46 1.46 18.19 115 BAYES_00 1999 5.91 1.43 7.68 116 TR_Mismatch_TLD_02 1998 0.45 1.42 0.06 117 XMHTML_After_End 1966 0.67 1.40 0.38 118 XMPhish11 1965 1.30 1.40 1.27 119 T_XMHurry_00 1961 0.73 1.40 0.47 120 MPART_ALT_DIFF_COUNT 1952 0.55 1.39 0.22 121 XM_H_PHPOS 1933 1.27 1.38 1.22 122 T_XMDrugObfuBody_00 1853 0.71 1.32 0.48 123 XMStockSpam_06 1846 1.27 1.32 1.25 124 RCVD_IN_IADB_VOUCHED 1820 2.56 1.30 3.06 125 REMOVE_BEFORE_LINK 1787 0.55 1.27 0.26 126 BAYES_40 1759 3.42 1.25 4.28 127 XM_B_REG_HTML 1758 0.81 1.25 0.63 128 XM_BadFromFormat 1731 0.46 1.23 0.15 129 T_FILL_THIS_FORM_SHORT 1693 1.11 1.21 1.07 130 T_HTML_TAG_BALANCE_CENTER 1685 0.45 1.20 0.16 131 TR_Symld_Words 1660 1.87 1.18 2.13 132 TooManyTo_002 1621 2.73 1.16 3.35 133 XMPhish14 1615 0.63 1.15 0.43 134 HTML_FONT_FACE_BAD 1606 2.83 1.15 3.49 135 T_Symld_Words_02 1586 0.72 1.13 0.55 136 LONG_JUNK_URI 1574 0.39 1.12 0.10 137 URIBL_DBL_SPAM 1563 0.32 1.11 0.01 138 XM_ProductURIs 1561 0.96 1.11 0.91 139 BASE64_LENGTH_79_INF 1551 0.37 1.11 0.08 140 LONG_JUNK_URI3 1532 0.33 1.09 0.03 141 HTML_FONT_SIZE_HUGE 1529 0.37 1.09 0.08 142 RELAYCOUNTRY_GB 1526 1.47 1.09 1.62 143 BAYES_20 1518 2.46 1.08 3.00 144 XM_PDF 1492 4.30 1.06 5.57 145 RELAYCOUNTRY_CN 1484 0.35 1.06 0.08 146 RELAYCOUNTRY_AT 1456 0.37 1.04 0.10 147 XM_UB80 1408 0.31 1.00 0.03 148 XM_B_COPY_HTML 1396 0.74 1.00 0.63 149 XMMoneyMeta_00 1391 0.67 0.99 0.55 150 TR_Mismatch_TLD_01 1376 0.37 0.98 0.12 151 XM_H_PHPMailer 1368 0.77 0.98 0.69 152 TooManyTo_003 1351 1.90 0.96 2.27 153 TR_XM_DK_Bayes 1330 3.71 0.95 4.80 154 NORDNS_LOW_CONTRAST 1319 0.28 0.94 0.01 155 XMBody_78 1316 0.60 0.94 0.47 156 TR_XM_DK_Bayes1 1315 3.58 0.94 4.63 157 HTTPS_HTTP_MISMATCH 1311 0.58 0.93 0.44 158 RDNS_DYNAMIC 1310 0.55 0.93 0.40 159 XMSlimDrugH 1267 0.59 0.90 0.47 160 BOUNCE_MESSAGE 1265 2.70 0.90 3.40 161 ANY_BOUNCE_MESSAGE 1265 2.70 0.90 3.40 162 ADMITS_SPAM 1265 0.27 0.90 0.02 163 XM_H_Long_From03 1248 0.30 0.89 0.07 164 XMLongAddy 1226 0.29 0.87 0.07 165 XMSubMetaSxObfu_03 1220 0.50 0.87 0.36 166 GAPPY_SUBJECT 1214 0.30 0.87 0.08 167 XMSubMetaD_03 1201 0.27 0.86 0.04 168 TooManyTo_004 1201 1.49 0.86 1.74 169 XMSubMetaI_01 1194 0.29 0.85 0.07 170 PLING_QUERY 1184 0.41 0.84 0.24 171 XMLngstWrd_00 1172 0.49 0.84 0.35 172 DKIM_ADSP_CUSTOM_MED 1169 1.13 0.83 1.25 173 SUBJ_DOLLARS 1166 0.29 0.83 0.08 174 HTML_IMAGE_ONLY_32 1142 0.65 0.81 0.59 175 DATE_IN_PAST_03_06 1122 0.43 0.80 0.28 176 TR_XM_DK_Bayes2 1111 3.03 0.79 3.91 177 T_TooManySym_02 1101 1.85 0.79 2.28 178 RELAYCOUNTRY_AU 1097 0.50 0.78 0.39 179 BODY_ENHANCEMENT 1088 0.28 0.78 0.09 180 TR_MetaPhish_Combo_01 1077 0.70 0.77 0.67 181 HTML_IMAGE_ONLY_24 1077 0.54 0.77 0.45 182 XM_Body_Obfu01 1047 0.39 0.75 0.25 183 URI_NOVOWEL 1007 0.46 0.72 0.35 184 REPLYTO_WITHOUT_TO_CC 1004 0.24 0.72 0.05 185 XMBrknScrpt_02 1000 0.58 0.71 0.53 186 HTML_TAG_BALANCE_BODY 996 0.46 0.71 0.37 187 HTML_IMAGE_ONLY_28 993 0.68 0.71 0.66 188 BAYES_05 949 1.50 0.68 1.82 189 XMLngstWrd_01 941 0.40 0.67 0.30 190 LongTLD 941 0.30 0.67 0.15 191 LOW_PRICE 928 0.29 0.66 0.14 192 NML_ADSP_CUSTOM_MED 916 0.86 0.65 0.94 193 XMCapTrack 913 1.40 0.65 1.69 194 PHOTO_EDITING_DIRECT 893 0.18 0.64 0.00 195 XMGppyBdWords 887 0.28 0.63 0.14 196 XM_UB95 881 0.20 0.63 0.03 197 XMHTMLBadTable_001 864 0.45 0.62 0.38 198 XM_S_JOY_D 863 0.29 0.62 0.16 199 RELAYCOUNTRY_IN 837 0.25 0.60 0.12 200 XM_H_PHPOS_M 831 0.47 0.59 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 300140 87.53 95.74 84.29 2 DKIM_SIGNED 239112 72.25 85.19 67.15 3 DCC_CHECK_NEGATIVE 237964 53.19 18.56 66.83 4 XM_DK_Pass 233592 70.53 83.03 65.60 5 DKIM_VALID 225637 68.57 81.78 63.37 6 BAYES_50 210964 51.25 30.95 59.25 7 DKIM_VALID_AU 162206 50.78 64.04 45.55 8 XMListUnsubscribeExists 138363 49.09 75.08 38.86 9 T_TM2_M_HEADER_IN_MSG 120892 30.10 20.32 33.95 10 XM_H_QuotedFrom 116089 38.72 54.27 32.60 11 DCC_CHECK 109302 44.44 79.33 30.70 12 DKIM_VALID_EF 85796 23.14 20.70 24.10 13 HTML_FONT_LOW_CONTRAST 75565 25.60 36.72 21.22 14 MultiRelay 75174 19.73 16.21 21.11 15 MIME_HTML_ONLY 74056 23.62 30.78 20.80 16 XMSubLong 71306 21.42 24.96 20.03 17 LOC_TINY_FONT_1 70744 23.86 34.01 19.87 18 FVGT_m_MULTI_ODD 65586 21.07 27.79 18.42 19 ALL_TRUSTED 64756 13.46 1.46 18.19 20 T_KAM_HTML_FONT_INVALID 44542 14.53 19.65 12.51 21 XM_DK_Undo_02 44159 23.04 50.06 12.40 22 BAYES_99 42941 21.92 46.97 12.06 23 BAYES_999 38176 19.12 40.43 10.72 24 XM_Body_Dirty_Words 37854 13.59 21.10 10.63 25 TooManyTo_001 35960 9.43 7.72 10.10 26 XM_Multi_Part_URI 34107 11.49 16.33 9.58 27 IN_ZIMBRA_NJ_WHITELIST 33192 6.70 0.05 9.32 28 XM_DKIMWhitelistDomains 31691 6.40 0.07 8.90 29 RCVD_IN_RP_SAFE 30925 8.21 6.99 8.69 30 T_XMDrugObfuBody_14 30567 9.17 10.65 8.58 31 RCVD_IN_RP_CERTIFIED 28527 7.41 5.87 8.01 32 BAYES_00 27347 5.91 1.43 7.68 33 LOTS_OF_MONEY 26285 8.47 11.25 7.38 34 FSL_BULK_SIG 25745 8.11 10.33 7.23 35 XM_Evil_Numbers_Gen 25632 9.31 14.68 7.20 36 LotsOfNums_01 23003 7.49 10.10 6.46 37 HTML_IMAGE_RATIO_02 21186 9.06 16.94 5.95 38 BAYES_60 21064 5.89 5.83 5.92 39 XMStrtUSub 20832 5.47 4.51 5.85 40 RELAYCOUNTRY_META 20756 9.25 17.94 5.83 41 MPART_ALT_DIFF 20366 6.23 7.54 5.72 42 XM_PDF 19831 4.30 1.06 5.57 43 TR_DCC_Bayes_99 19273 14.48 37.51 5.41 44 XM_H_Long_From01 18806 6.01 7.85 5.28 45 T_TooManySym_01 17722 4.62 3.72 4.98 46 XM_SendGrid 17692 4.68 3.93 4.97 47 RCVD_IN_MSPIKE_H2 17385 4.73 4.35 4.88 48 TR_XM_DK_Bayes 17098 3.71 0.95 4.80 49 TR_XM_DK_Bayes1 16471 3.58 0.94 4.63 50 RCVD_IN_IADB_LISTED 16420 4.04 2.59 4.61 51 MIME_QP_LONG_LINE 15981 4.85 5.76 4.49 52 T_REMOTE_IMAGE 15634 4.34 4.22 4.39 53 XM_B_Phish_Phrases 15454 5.87 9.74 4.34 54 BAYES_40 15238 3.42 1.25 4.28 55 MIME_HTML_ONLY_MULTI 14993 4.05 3.63 4.21 56 BOTNET_IPINHOSTNAME 14805 6.53 12.55 4.16 57 TR_XM_DocInvoice 14735 4.98 7.13 4.14 58 RCVD_IN_IADB_SPF 14391 3.52 2.19 4.04 59 HTML_IMAGE_RATIO_04 14198 5.45 9.15 3.99 60 TR_XM_DK_Bayes2 13929 3.03 0.79 3.91 61 XM_UncommonTLD01 13492 4.91 7.76 3.79 62 DKIM_INVALID 13475 3.68 3.40 3.78 63 BAYES_80 12990 4.66 7.23 3.65 64 XMNumbers 12882 3.80 4.28 3.62 65 RCVD_IN_IADB_SENDERID 12820 3.16 2.04 3.60 66 UNPARSEABLE_RELAY 12475 3.01 1.76 3.50 67 RCVD_IN_IADB_DK 12444 3.08 2.02 3.49 68 HTML_FONT_FACE_BAD 12438 2.83 1.15 3.49 69 XMSubMetaSx_00 12401 4.23 6.13 3.48 70 ANY_BOUNCE_MESSAGE 12120 2.70 0.90 3.40 71 BOUNCE_MESSAGE 12115 2.70 0.90 3.40 72 TooManyTo_002 11941 2.73 1.16 3.35 73 MAILING_LIST_MULTI 11405 2.97 2.39 3.20 74 XMSexyCombo_05 11016 5.13 10.31 3.09 75 TVD_RCVD_IP 10975 2.28 0.23 3.08 76 RCVD_IN_IADB_VOUCHED 10910 2.56 1.30 3.06 77 BAYES_20 10673 2.46 1.08 3.00 78 FROM_EXCESS_BASE64 9947 3.91 6.76 2.79 79 HTML_IMAGE_RATIO_06 9404 3.24 4.75 2.64 80 HTML_MIME_NO_HTML_TAG 8977 2.52 2.51 2.52 81 MIME_HTML_MOSTLY 8584 3.13 4.97 2.41 82 BAYES_95 8369 2.98 4.58 2.35 83 HELO_NODOT 8307 1.79 0.41 2.33 84 XM_SPF_SoftFail 8242 2.89 4.34 2.31 85 IN_HORDE_ADDRESS_BOOK 8156 1.66 0.07 2.29 86 T_TooManySym_02 8102 1.85 0.79 2.28 87 TooManyTo_003 8079 1.90 0.96 2.27 88 TO_MALFORMED 7812 1.58 0.02 2.19 89 XM_DK_Undo_01 7778 2.01 1.55 2.18 90 TR_Symld_Words 7601 1.87 1.18 2.13 91 INVALID_MSGID 6951 1.51 0.39 1.95 92 XM_DIRTYINTL 6742 2.68 4.69 1.89 93 BAYES_05 6482 1.50 0.68 1.82 94 HTML_IMAGE_RATIO_08 6446 2.20 3.20 1.81 95 TM2_M_URI_OPT_OUT 6305 2.52 4.42 1.77 96 XM_OfRef6 6201 1.87 2.20 1.74 97 TooManyTo_004 6185 1.49 0.86 1.74 98 XMCapTrack 6026 1.40 0.65 1.69 99 XMDiploma_00 5861 1.91 2.56 1.65 100 RELAYCOUNTRY_GB 5776 1.47 1.09 1.62 101 SUBJ_ALL_CAPS 5761 2.11 3.35 1.62 102 XM_CamelCaseFrm001 5760 2.17 3.57 1.62 103 XM_GoogleGroups 5398 1.25 0.57 1.52 104 TooManyTo_005 5104 1.17 0.50 1.43 105 RCVD_IN_IADB_OPTIN 5042 1.18 0.59 1.42 106 USER_IN_DEF_DKIM_WL 4926 1.00 0.03 1.38 107 UNTRUSTED_Relay 4895 4.16 11.23 1.37 108 T_XMDrugObfuBody_08 4649 1.75 2.86 1.31 109 RELAYCOUNTRY_CA 4590 1.95 3.62 1.29 110 XMPhish11 4510 1.30 1.40 1.27 111 XMStockSpam_06 4459 1.27 1.32 1.25 112 DKIM_ADSP_CUSTOM_MED 4438 1.13 0.83 1.25 113 XM_H_PHPOS 4357 1.27 1.38 1.22 114 T_FILL_THIS_FORM_SHORT 3814 1.11 1.21 1.07 115 XMGenDplmaNmb 3651 1.19 1.61 1.03 116 URI_HEX 3542 1.56 3.00 0.99 117 XMSubNoVowel 3523 0.85 0.49 0.99 118 RCVD_IN_MSPIKE_WL 3459 0.77 0.27 0.97 119 RCVD_IN_MSPIKE_H3 3459 0.77 0.27 0.97 120 XM_UB50 3446 1.88 4.19 0.97 121 XMNoVowels 3445 0.81 0.42 0.97 122 NML_ADSP_CUSTOM_MED 3356 0.86 0.65 0.94 123 BOTNET 3324 4.20 12.48 0.93 124 XM_ProductURIs 3225 0.96 1.11 0.91 125 XM_H_Long_From02 3196 1.36 2.55 0.90 126 XM_ShortIntro_01 3083 0.74 0.43 0.87 127 XMSubMetaI_00 3063 1.33 2.54 0.86 128 SpammyFromTLD_01 2986 1.05 1.58 0.84 129 T_TooManySym_03 2946 0.68 0.29 0.83 130 TM2_M_VERY_LONG_WORD 2881 1.19 2.16 0.81 131 T_OBFU_PDF_ATTACH 2832 0.66 0.31 0.80 132 RELAYCOUNTRY_DE 2743 0.99 1.55 0.77 133 XMGappySubj_01 2743 0.68 0.45 0.77 134 USER_IN_WHITELIST 2671 0.54 0.00 0.75 135 FILL_THIS_FORM 2548 0.59 0.25 0.72 136 URI_TRY_3LD 2507 0.98 1.68 0.70 137 XM_H_PHPMailer 2468 0.77 0.98 0.69 138 TR_MetaPhish_Combo_01 2400 0.70 0.77 0.67 139 MISSING_HEADERS 2388 0.63 0.52 0.67 140 HTML_IMAGE_ONLY_28 2362 0.68 0.71 0.66 141 RCVD_IN_SORBS_DUL 2298 0.52 0.20 0.65 142 XM_B_REG_HTML 2259 0.81 1.25 0.63 143 XM_B_COPY_HTML 2256 0.74 1.00 0.63 144 XM_RXBody 2230 0.98 1.88 0.63 145 AC_DIV_BONANZA 2124 0.47 0.15 0.60 146 XMSexyCombo_01 2114 0.86 1.53 0.59 147 HTML_IMAGE_ONLY_32 2093 0.65 0.81 0.59 148 T_FILL_THIS_FORM_LONG 2039 0.46 0.16 0.57 149 RCVD_IN_IADB_DOPTIN 2018 0.43 0.10 0.57 150 T_Symld_Words_02 1966 0.72 1.13 0.55 151 SHORT_HELO_AND_INLINE_IMAGE 1953 0.41 0.07 0.55 152 XMMoneyMeta_00 1942 0.67 0.99 0.55 153 XMDateMe_00 1930 0.49 0.37 0.54 154 DKIM_ADSP_NXDOMAIN 1928 0.47 0.29 0.54 155 DIET_1 1917 0.82 1.52 0.54 156 XMBrknScrpt_02 1870 0.58 0.71 0.53 157 RELAYCOUNTRY_NL 1831 0.53 0.58 0.51 158 T_FILL_THIS_FORM_LOAN 1751 0.37 0.07 0.49 159 XMhairloss01 1746 0.37 0.06 0.49 160 RCVD_IN_BL_SPAMCOP_NET 1721 1.12 2.73 0.48 161 TM2_M_BODY_EMPTY 1695 0.39 0.18 0.48 162 T_XMDrugObfuBody_00 1695 0.71 1.32 0.48 163 T_XMHurry_00 1666 0.73 1.40 0.47 164 XMBody_78 1664 0.60 0.94 0.47 165 XMSlimDrugH 1658 0.59 0.90 0.47 166 TR_XM_RelayPhish 1641 0.81 1.70 0.46 167 XM_H_Trusted_IP 1616 0.33 0.00 0.45 168 HTML_IMAGE_ONLY_24 1605 0.54 0.77 0.45 169 FORGED_GMAIL_RCVD 1601 0.49 0.59 0.45 170 XMBody_95 1599 0.36 0.13 0.45 171 XMBdyGiftCard01 1588 0.76 1.55 0.45 172 TR_MetaPhish_Combo_01b 1583 0.35 0.10 0.44 173 HTTPS_HTTP_MISMATCH 1554 0.58 0.93 0.44 174 TVD_SPACE_RATIO 1538 0.43 0.42 0.43 175 XMLKML 1528 0.31 0.00 0.43 176 XMPhish14 1524 0.63 1.15 0.43 177 XM_H_PHPOS_M 1506 0.47 0.59 0.42 178 T_MANY_PILL_PRICE 1504 0.30 0.00 0.42 179 HTML_IMAGE_ONLY_20 1478 0.43 0.45 0.42 180 XM_H_SpoofStaff4 1478 0.32 0.06 0.42 181 EXCLAMACION_ES 1469 0.33 0.12 0.41 182 T_TooManySym_04 1454 0.30 0.04 0.41 183 RDNS_DYNAMIC 1408 0.55 0.93 0.40 184 RELAYCOUNTRY_AU 1389 0.50 0.78 0.39 185 XMSubMetaSxObfu_02 1366 0.33 0.18 0.38 186 XMHTML_After_End 1361 0.67 1.40 0.38 187 XMHTMLBadTable_001 1347 0.45 0.62 0.38 188 XM_H_Undi_Recip 1315 0.34 0.27 0.37 189 HTML_TAG_BALANCE_BODY 1311 0.46 0.71 0.37 190 MSGID_FROM_MTA_HEADER 1287 0.34 0.27 0.36 191 XMSubMetaSxObfu_03 1285 0.50 0.87 0.36 192 XM_D_omniadmin_Whitelist 1283 0.26 0.00 0.36 193 URI_NOVOWEL 1254 0.46 0.72 0.35 194 XMSubEmpty 1249 0.30 0.18 0.35 195 XMLngstWrd_00 1246 0.49 0.84 0.35 196 XMBody_17 1211 0.75 1.78 0.34 197 XMRcvdHeader_15 1209 0.24 0.00 0.34 198 XMGappySubj_02 1186 0.26 0.08 0.33 199 XM_B_TRADE_HTML 1163 0.37 0.49 0.33 200 HTML_IMAGE_ONLY_16 1129 0.29 0.23 0.32 ----------------------------------------------------------------------