Email: 531434 Autolearn: 0 AvgScore: 3.24 AvgScanTime: 2.35 sec Spam: 150787 Autolearn: 0 AvgScore: 12.50 AvgScanTime: 2.80 sec Ham: 380647 Autolearn: 0 AvgScore: -0.43 AvgScanTime: 2.17 sec Time Spent Running SA: 346.75 hours Time Spent Processing Spam: 117.40 hours Time Spent Processing Ham: 229.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146087 87.90 96.88 84.34 2 DKIM_SIGNED 129866 71.77 86.13 66.08 3 XM_DK_Pass 126808 70.07 84.10 64.51 4 DKIM_VALID 124662 68.00 82.67 62.19 5 DCC_CHECK 119496 45.31 79.25 31.87 6 XMListUnsubscribeExists 114688 50.74 76.06 40.71 7 DKIM_VALID_AU 95407 49.29 63.27 43.75 8 XM_H_QuotedFrom 84390 39.77 55.97 33.36 9 XM_DK_Undo_02 77434 23.04 51.35 11.82 10 BAYES_99 72564 21.69 48.12 11.22 11 BAYES_999 62340 18.79 41.34 9.86 12 TR_DCC_Bayes_99 57686 14.45 38.26 5.03 13 HTML_FONT_LOW_CONTRAST 52521 25.16 34.83 21.33 14 LOC_TINY_FONT_1 49487 21.36 32.82 16.83 15 BAYES_50 45547 50.43 30.21 58.44 16 MIME_HTML_ONLY 43940 21.18 29.14 18.03 17 XMSubLong 43470 22.58 28.83 20.11 18 FVGT_m_MULTI_ODD 43391 21.18 28.78 18.18 19 T_TM2_M_HEADER_IN_MSG 33390 31.58 22.14 35.32 20 DKIM_VALID_EF 32334 21.51 21.44 21.54 21 XM_Body_Dirty_Words 28905 12.21 19.17 9.45 22 T_KAM_HTML_FONT_INVALID 28821 14.62 19.11 12.84 23 DCC_CHECK_NEGATIVE 28009 52.30 18.58 65.66 24 HTML_IMAGE_RATIO_02 26427 8.90 17.53 5.48 25 MultiRelay 25935 19.75 17.20 20.76 26 RELAYCOUNTRY_META 23330 8.45 15.47 5.67 27 XM_Multi_Part_URI 23085 11.24 15.31 9.63 28 XM_Evil_Numbers_Gen 21619 9.19 14.34 7.15 29 LOTS_OF_MONEY 19259 8.84 12.77 7.28 30 BOTNET_IPINHOSTNAME 19183 6.44 12.72 3.95 31 BOTNET 17507 3.88 11.61 0.81 32 T_XMDrugObfuBody_14 17197 9.18 11.40 8.29 33 XMSexyCombo_05 15600 4.58 10.35 2.30 34 FSL_BULK_SIG 14927 8.27 9.90 7.62 35 LotsOfNums_01 13742 7.98 9.11 7.53 36 UNTRUSTED_Relay 13499 3.46 8.95 1.28 37 XM_B_Phish_Phrases 13252 5.44 8.79 4.12 38 HTML_IMAGE_RATIO_04 13102 4.83 8.69 3.30 39 TR_XM_DocInvoice 12661 5.83 8.40 4.81 40 TooManyTo_001 12575 9.51 8.34 9.97 41 MPART_ALT_DIFF 11802 4.46 7.83 3.12 42 XM_H_Long_From01 11748 6.10 7.79 5.43 43 XMSubMetaSx_00 11664 4.87 7.74 3.74 44 FROM_EXCESS_BASE64 10794 4.33 7.16 3.20 45 BAYES_80 10524 4.87 6.98 4.03 46 XM_UncommonTLD01 10290 4.77 6.82 3.96 47 MIME_QP_LONG_LINE 8508 5.27 5.64 5.12 48 BAYES_60 7993 6.41 5.30 6.85 49 XMNumbers 7759 3.76 5.15 3.21 50 RCVD_IN_RP_SAFE 7471 7.35 4.95 8.30 51 XM_SendGrid 7211 4.90 4.78 4.94 52 MIME_HTML_MOSTLY 7022 2.90 4.66 2.21 53 BAYES_95 6891 3.08 4.57 2.48 54 TM2_M_URI_OPT_OUT 6737 2.57 4.47 1.81 55 XM_SPF_SoftFail 6620 2.91 4.39 2.33 56 HTML_IMAGE_RATIO_06 6560 3.20 4.35 2.74 57 RCVD_IN_MSPIKE_H2 6528 4.51 4.33 4.58 58 RCVD_IN_RP_CERTIFIED 6454 6.72 4.28 7.69 59 T_REMOTE_IMAGE 6418 4.46 4.26 4.54 60 HTML_IMAGE_RATIO_08 6393 2.57 4.24 1.91 61 XM_DIRTYINTL 6391 2.42 4.24 1.69 62 XM_UB50 6389 1.83 4.24 0.88 63 XMStrtUSub 6282 4.71 4.17 4.92 64 MIME_HTML_ONLY_MULTI 5861 2.42 3.89 1.84 65 T_TooManySym_01 5813 4.69 3.86 5.02 66 RCVD_IN_BL_SPAMCOP_NET 5760 1.70 3.82 0.86 67 RELAYCOUNTRY_CA 5388 1.99 3.57 1.36 68 DKIM_INVALID 5204 3.76 3.45 3.88 69 XM_CamelCaseFrm001 4864 2.03 3.23 1.56 70 URI_HEX 4860 1.69 3.22 1.09 71 T_XMDrugObfuBody_08 4287 1.80 2.84 1.39 72 HTML_MIME_NO_HTML_TAG 4135 2.58 2.74 2.52 73 XM_URI_RBL 4111 0.86 2.73 0.12 74 XMDiploma_00 4111 2.02 2.73 1.75 75 RCVD_IN_IADB_LISTED 4071 4.63 2.70 5.40 76 XM_OfRef6 3849 1.86 2.55 1.59 77 MultiRelay_CC 3787 0.90 2.51 0.26 78 MultiRelay_Combo 3787 0.90 2.51 0.26 79 BOTNET_NORDNS 3547 0.69 2.35 0.03 80 RCVD_IN_IADB_SPF 3506 4.06 2.33 4.75 81 XMSubMetaI_00 3351 1.02 2.22 0.55 82 TM2_M_VERY_LONG_WORD 3342 1.19 2.22 0.78 83 RCVD_IN_IADB_SENDERID 3281 3.63 2.18 4.21 84 RCVD_IN_IADB_DK 3206 3.54 2.13 4.10 85 UNPARSEABLE_RELAY 3187 2.92 2.11 3.24 86 SUBJ_ALL_CAPS 3018 1.68 2.00 1.55 87 MAILING_LIST_MULTI 2928 2.95 1.94 3.35 88 XMSexyCombo_01 2839 1.23 1.88 0.97 89 SpammyFromTLD_01 2822 1.37 1.87 1.18 90 XMHTML_After_End 2772 0.79 1.84 0.37 91 URI_TRY_3LD 2736 1.15 1.81 0.89 92 T_XMDrugObfuBody_00 2712 0.97 1.80 0.64 93 XM_UB99 2695 0.52 1.79 0.01 94 XMGenDplmaNmb 2679 1.32 1.78 1.13 95 RELAYCOUNTRY_FR 2610 0.67 1.73 0.25 96 URIBL_BLACK 2608 0.52 1.73 0.04 97 SpammyFromTLD_02 2604 0.74 1.73 0.35 98 T_FILL_THIS_FORM_SHORT 2572 1.14 1.71 0.92 99 XM_H_Long_From02 2568 1.10 1.70 0.86 100 XMSubMetaSxObfu_03 2549 0.89 1.69 0.58 101 RCVD_IN_RP_RNBL 2532 0.50 1.68 0.03 102 BAYES_00 2526 6.36 1.68 8.22 103 SUBJ_DOLLARS 2471 0.61 1.64 0.20 104 FSL_THIS_IS_ADV 2456 0.50 1.63 0.05 105 XM_DK_Undo_01 2430 1.97 1.61 2.11 106 T_XMHurry_00 2429 0.86 1.61 0.56 107 XMBody_17 2299 0.70 1.52 0.38 108 XMPhish30 2254 0.73 1.49 0.43 109 DIET_1 2221 0.70 1.47 0.40 110 XM_UB999 2121 0.40 1.41 0.01 111 ALL_TRUSTED 2094 14.95 1.39 20.32 112 TR_XM_DK_Bayes 2084 4.04 1.38 5.09 113 XM_HighProb1 2081 0.40 1.38 0.02 114 XMBrknScrpt_02 2073 0.81 1.37 0.58 115 TR_XM_DK_Bayes1 2043 3.88 1.35 4.88 116 XMBdyGiftCard01 2026 0.72 1.34 0.47 117 XMPhish11 2008 1.26 1.33 1.24 118 TR_XM_RelayPhish 1994 0.74 1.32 0.51 119 BAYES_40 1988 3.26 1.32 4.03 120 RELAYCOUNTRY_CN 1987 0.43 1.32 0.08 121 TR_XM_DK_Bayes2 1970 3.19 1.31 3.94 122 TR_Symld_Words 1915 1.79 1.27 2.00 123 T_Symld_Words_02 1898 0.64 1.26 0.39 124 XMStockSpam_06 1894 0.79 1.26 0.61 125 RCVD_IN_IADB_VOUCHED 1860 2.95 1.23 3.62 126 T_TooManySym_02 1845 1.91 1.22 2.18 127 BAYES_20 1771 2.42 1.17 2.91 128 HTML_FONT_FACE_BAD 1768 1.21 1.17 1.23 129 URIBL_DBL_SPAM 1739 0.33 1.15 0.01 130 TooManyTo_002 1703 2.43 1.13 2.94 131 LongTLD 1679 0.44 1.11 0.17 132 RELAYCOUNTRY_GB 1662 1.49 1.10 1.64 133 XM_H_PHPOS 1617 1.67 1.07 1.90 134 XM_ProductURIs 1615 0.81 1.07 0.70 135 T_HTML_TAG_BALANCE_CENTER 1579 0.39 1.05 0.13 136 LONG_JUNK_URI 1563 0.38 1.04 0.12 137 MPART_ALT_DIFF_COUNT 1525 0.43 1.01 0.19 138 XMHTMLBadTable_001 1523 0.66 1.01 0.52 139 RELAYCOUNTRY_AT 1518 0.37 1.01 0.12 140 XM_UB60 1518 0.33 1.01 0.07 141 XMBody_78 1490 0.71 0.99 0.60 142 XMSexyCombo_04 1421 0.33 0.94 0.08 143 T_MONEY_PERCENT 1416 0.43 0.94 0.22 144 TR_LOTS_OF_MONEY2 1416 0.43 0.94 0.22 145 TooManyTo_003 1410 1.63 0.94 1.91 146 XM_PDF 1393 4.02 0.92 5.25 147 XMMoneyMeta_00 1393 0.73 0.92 0.65 148 XM_B_REG_HTML 1383 0.69 0.92 0.59 149 RDNS_DYNAMIC 1373 0.54 0.91 0.39 150 HTTPS_HTTP_MISMATCH 1350 0.65 0.90 0.56 151 RELAYCOUNTRY_DE 1348 0.63 0.89 0.52 152 XMPhish14 1294 0.51 0.86 0.37 153 XM_RXBody 1292 0.32 0.86 0.11 154 HTML_TAG_BALANCE_BODY 1290 0.52 0.86 0.39 155 REMOVE_BEFORE_LINK 1285 0.46 0.85 0.31 156 BOUNCE_MESSAGE 1280 2.46 0.85 3.10 157 ANY_BOUNCE_MESSAGE 1280 2.46 0.85 3.10 158 TR_LOTS_OF_MONEY3 1270 0.37 0.84 0.18 159 LONG_JUNK_URI3 1262 0.28 0.84 0.05 160 URI_NOVOWEL 1251 0.50 0.83 0.37 161 XMSubMetaSSx_00 1250 0.42 0.83 0.25 162 REPLYTO_WITHOUT_TO_CC 1237 0.27 0.82 0.05 163 TR_XM_FormFill 1237 0.27 0.82 0.05 164 DKIM_ADSP_CUSTOM_MED 1229 1.03 0.82 1.11 165 ADMITS_SPAM 1221 0.26 0.81 0.04 166 XMBSHREFv2 1215 0.31 0.81 0.11 167 TooManyTo_004 1208 1.21 0.80 1.37 168 XM_B_COPY_HTML 1176 0.56 0.78 0.47 169 XMNoVowels 1168 0.77 0.77 0.77 170 XM_Body_Obfu01 1164 0.41 0.77 0.27 171 TR_MetaPhish_Combo_01 1141 0.64 0.76 0.60 172 RELAYCOUNTRY_AU 1141 0.59 0.76 0.52 173 BODY_URI_ONLY 1139 0.25 0.76 0.05 174 XM_H_PHPMailer 1124 0.76 0.75 0.77 175 XM_UB80 1107 0.22 0.73 0.02 176 XMGppyBdWords 1101 0.34 0.73 0.19 177 RCVD_IN_PSBL 1084 0.30 0.72 0.13 178 HTML_IMAGE_ONLY_28 1073 0.56 0.71 0.50 179 TR_Mismatch_TLD_02 1072 0.25 0.71 0.07 180 XM_BadFromFormat 1066 0.35 0.71 0.22 181 LONG_JUNK_URI2 1022 0.21 0.68 0.02 182 TR_Caps_n_Bayes_99 1003 0.23 0.67 0.06 183 BASE64_LENGTH_79_INF 994 0.25 0.66 0.09 184 BAYES_05 978 1.48 0.65 1.81 185 HTML_FONT_SIZE_LARGE 977 0.30 0.65 0.16 186 NORDNS_LOW_CONTRAST 975 0.19 0.65 0.01 187 XMSlimDrugH 961 0.40 0.64 0.31 188 HTML_SHORT_LINK_IMG_1 956 0.20 0.63 0.03 189 XMSubMetaI_01 956 0.31 0.63 0.18 190 HTML_FONT_SIZE_HUGE 955 0.23 0.63 0.07 191 XMClaimOffer 947 0.33 0.63 0.21 192 NML_ADSP_CUSTOM_MED 915 0.73 0.61 0.77 193 HTML_IMAGE_ONLY_08 911 0.28 0.60 0.15 194 RELAYCOUNTRY_NL 904 0.36 0.60 0.26 195 XMSolicitRefs_0 902 0.43 0.60 0.37 196 MISSING_HEADERS 902 0.56 0.60 0.55 197 RCVD_IN_IADB_OPTIN 900 1.43 0.60 1.76 198 PLING_QUERY 897 0.40 0.59 0.32 199 LONG_HEX_URI 891 0.28 0.59 0.15 200 XMCapTrack 878 1.24 0.58 1.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 321026 87.90 96.88 84.34 2 DKIM_SIGNED 251521 71.77 86.13 66.08 3 DCC_CHECK_NEGATIVE 249940 52.30 18.58 65.66 4 XM_DK_Pass 245561 70.07 84.10 64.51 5 DKIM_VALID 236736 68.00 82.67 62.19 6 BAYES_50 222448 50.43 30.21 58.44 7 DKIM_VALID_AU 166521 49.29 63.27 43.75 8 XMListUnsubscribeExists 154973 50.74 76.06 40.71 9 T_TM2_M_HEADER_IN_MSG 134432 31.58 22.14 35.32 10 XM_H_QuotedFrom 126982 39.77 55.97 33.36 11 DCC_CHECK 121303 45.31 79.25 31.87 12 DKIM_VALID_EF 81979 21.51 21.44 21.54 13 HTML_FONT_LOW_CONTRAST 81208 25.16 34.83 21.33 14 MultiRelay 79014 19.75 17.20 20.76 15 ALL_TRUSTED 77354 14.95 1.39 20.32 16 XMSubLong 76553 22.58 28.83 20.11 17 FVGT_m_MULTI_ODD 69187 21.18 28.78 18.18 18 MIME_HTML_ONLY 68616 21.18 29.14 18.03 19 LOC_TINY_FONT_1 64053 21.36 32.82 16.83 20 T_KAM_HTML_FONT_INVALID 48871 14.62 19.11 12.84 21 XM_DK_Undo_02 44985 23.04 51.35 11.82 22 BAYES_99 42700 21.69 48.12 11.22 23 TooManyTo_001 37950 9.51 8.34 9.97 24 BAYES_999 37513 18.79 41.34 9.86 25 XM_Multi_Part_URI 36649 11.24 15.31 9.63 26 XM_Body_Dirty_Words 35966 12.21 19.17 9.45 27 RCVD_IN_RP_SAFE 31586 7.35 4.95 8.30 28 T_XMDrugObfuBody_14 31563 9.18 11.40 8.29 29 BAYES_00 31298 6.36 1.68 8.22 30 XM_DKIMWhitelistDomains 29924 5.64 0.02 7.86 31 RCVD_IN_RP_CERTIFIED 29264 6.72 4.28 7.69 32 FSL_BULK_SIG 29016 8.27 9.90 7.62 33 LotsOfNums_01 28662 7.98 9.11 7.53 34 LOTS_OF_MONEY 27697 8.84 12.77 7.28 35 XM_Evil_Numbers_Gen 27213 9.19 14.34 7.15 36 IN_ZIMBRA_NJ_WHITELIST 26540 5.00 0.03 6.97 37 BAYES_60 26084 6.41 5.30 6.85 38 RELAYCOUNTRY_META 21578 8.45 15.47 5.67 39 HTML_IMAGE_RATIO_02 20871 8.90 17.53 5.48 40 XM_H_Long_From01 20666 6.10 7.79 5.43 41 RCVD_IN_IADB_LISTED 20552 4.63 2.70 5.40 42 XM_PDF 19996 4.02 0.92 5.25 43 MIME_QP_LONG_LINE 19493 5.27 5.64 5.12 44 TR_XM_DK_Bayes 19360 4.04 1.38 5.09 45 TR_DCC_Bayes_99 19131 14.45 38.26 5.03 46 T_TooManySym_01 19103 4.69 3.86 5.02 47 XM_SendGrid 18808 4.90 4.78 4.94 48 XMStrtUSub 18729 4.71 4.17 4.92 49 TR_XM_DK_Bayes1 18580 3.88 1.35 4.88 50 TR_XM_DocInvoice 18303 5.83 8.40 4.81 51 RCVD_IN_IADB_SPF 18069 4.06 2.33 4.75 52 RCVD_IN_MSPIKE_H2 17422 4.51 4.33 4.58 53 T_REMOTE_IMAGE 17290 4.46 4.26 4.54 54 RCVD_IN_IADB_SENDERID 16029 3.63 2.18 4.21 55 XM_B_Phish_Phrases 15683 5.44 8.79 4.12 56 RCVD_IN_IADB_DK 15617 3.54 2.13 4.10 57 BAYES_40 15345 3.26 1.32 4.03 58 BAYES_80 15342 4.87 6.98 4.03 59 XM_UncommonTLD01 15058 4.77 6.82 3.96 60 BOTNET_IPINHOSTNAME 15047 6.44 12.72 3.95 61 TR_XM_DK_Bayes2 14996 3.19 1.31 3.94 62 DKIM_INVALID 14785 3.76 3.45 3.88 63 XMSubMetaSx_00 14234 4.87 7.74 3.74 64 RCVD_IN_IADB_VOUCHED 13797 2.95 1.23 3.62 65 MAILING_LIST_MULTI 12767 2.95 1.94 3.35 66 HTML_IMAGE_RATIO_04 12569 4.83 8.69 3.30 67 HELO_NODOT 12555 2.48 0.41 3.30 68 UNPARSEABLE_RELAY 12321 2.92 2.11 3.24 69 XMNumbers 12226 3.76 5.15 3.21 70 FROM_EXCESS_BASE64 12191 4.33 7.16 3.20 71 MPART_ALT_DIFF 11891 4.46 7.83 3.12 72 ANY_BOUNCE_MESSAGE 11818 2.46 0.85 3.10 73 BOUNCE_MESSAGE 11817 2.46 0.85 3.10 74 TooManyTo_002 11201 2.43 1.13 2.94 75 BAYES_20 11066 2.42 1.17 2.91 76 HTML_IMAGE_RATIO_06 10438 3.20 4.35 2.74 77 TVD_RCVD_IP 10385 2.01 0.20 2.73 78 HTML_MIME_NO_HTML_TAG 9596 2.58 2.74 2.52 79 BAYES_95 9457 3.08 4.57 2.48 80 XM_SPF_SoftFail 8862 2.91 4.39 2.33 81 XMSexyCombo_05 8764 4.58 10.35 2.30 82 MIME_HTML_MOSTLY 8414 2.90 4.66 2.21 83 T_TooManySym_02 8284 1.91 1.22 2.18 84 IN_HORDE_ADDRESS_BOOK 8280 1.58 0.08 2.18 85 XM_DK_Undo_01 8042 1.97 1.61 2.11 86 TO_MALFORMED 7853 1.48 0.01 2.06 87 TR_Symld_Words 7619 1.79 1.27 2.00 88 HTML_IMAGE_RATIO_08 7267 2.57 4.24 1.91 89 TooManyTo_003 7262 1.63 0.94 1.91 90 XM_H_PHPOS 7245 1.67 1.07 1.90 91 MIME_HTML_ONLY_MULTI 7017 2.42 3.89 1.84 92 INVALID_MSGID 6957 1.44 0.45 1.83 93 BAYES_05 6906 1.48 0.65 1.81 94 TM2_M_URI_OPT_OUT 6902 2.57 4.47 1.81 95 RCVD_IN_IADB_OPTIN 6697 1.43 0.60 1.76 96 XMDiploma_00 6647 2.02 2.73 1.75 97 XM_DIRTYINTL 6450 2.42 4.24 1.69 98 RELAYCOUNTRY_GB 6242 1.49 1.10 1.64 99 XM_OfRef6 6050 1.86 2.55 1.59 100 XM_GoogleGroups 6011 1.29 0.57 1.58 101 XM_CamelCaseFrm001 5936 2.03 3.23 1.56 102 SUBJ_ALL_CAPS 5910 1.68 2.00 1.55 103 XMCapTrack 5706 1.24 0.58 1.50 104 T_XMDrugObfuBody_08 5301 1.80 2.84 1.39 105 TooManyTo_004 5230 1.21 0.80 1.37 106 RELAYCOUNTRY_CA 5173 1.99 3.57 1.36 107 UNTRUSTED_Relay 4882 3.46 8.95 1.28 108 RCVD_IN_MSPIKE_WL 4728 1.00 0.39 1.24 109 RCVD_IN_MSPIKE_H3 4728 1.00 0.38 1.24 110 XMPhish11 4707 1.26 1.33 1.24 111 HTML_FONT_FACE_BAD 4668 1.21 1.17 1.23 112 SpammyFromTLD_01 4475 1.37 1.87 1.18 113 USER_IN_DEF_DKIM_WL 4391 0.83 0.02 1.15 114 XMGenDplmaNmb 4315 1.32 1.78 1.13 115 DKIM_ADSP_CUSTOM_MED 4227 1.03 0.82 1.11 116 TooManyTo_005 4212 0.91 0.43 1.11 117 URI_HEX 4135 1.69 3.22 1.09 118 XMSexyCombo_01 3687 1.23 1.88 0.97 119 T_FILL_THIS_FORM_SHORT 3512 1.14 1.71 0.92 120 T_TooManySym_03 3490 0.71 0.18 0.92 121 TO_NO_BRKTS_HTML_ONLY 3478 0.74 0.32 0.91 122 XM_ShortIntro_01 3412 0.77 0.44 0.90 123 URI_TRY_3LD 3396 1.15 1.81 0.89 124 XM_UB50 3358 1.83 4.24 0.88 125 XM_H_Long_From02 3282 1.10 1.70 0.86 126 RCVD_IN_BL_SPAMCOP_NET 3268 1.70 3.82 0.86 127 BOTNET 3099 3.88 11.61 0.81 128 TM2_M_VERY_LONG_WORD 2966 1.19 2.22 0.78 129 NML_ADSP_CUSTOM_MED 2947 0.73 0.61 0.77 130 XM_H_PHPMailer 2926 0.76 0.75 0.77 131 XMNoVowels 2916 0.77 0.77 0.77 132 USER_IN_WHITELIST 2770 0.52 0.00 0.73 133 XM_ProductURIs 2680 0.81 1.07 0.70 134 SHORT_HELO_AND_INLINE_IMAGE 2658 0.53 0.12 0.70 135 RCVD_IN_SORBS_DUL 2617 0.57 0.27 0.69 136 T_OBFU_PDF_ATTACH 2617 0.55 0.21 0.69 137 HTML_IMAGE_ONLY_32 2525 0.57 0.32 0.66 138 XMMoneyMeta_00 2472 0.73 0.92 0.65 139 RCVD_IN_IADB_DOPTIN 2449 0.49 0.11 0.64 140 T_XMDrugObfuBody_00 2436 0.97 1.80 0.64 141 XMGappySubj_01 2393 0.55 0.35 0.63 142 XMSubNoVowel 2347 0.54 0.33 0.62 143 FILL_THIS_FORM 2318 0.53 0.33 0.61 144 XMStockSpam_06 2318 0.79 1.26 0.61 145 TR_MetaPhish_Combo_01 2284 0.64 0.76 0.60 146 XMBody_78 2272 0.71 0.99 0.60 147 XM_B_REG_HTML 2263 0.69 0.92 0.59 148 XMBrknScrpt_02 2219 0.81 1.37 0.58 149 XMSubMetaSxObfu_03 2195 0.89 1.69 0.58 150 T_XMHurry_00 2131 0.86 1.61 0.56 151 HTTPS_HTTP_MISMATCH 2113 0.65 0.90 0.56 152 MISSING_HEADERS 2093 0.56 0.60 0.55 153 XMSubMetaI_00 2083 1.02 2.22 0.55 154 XMDateMe_00 2079 0.51 0.41 0.55 155 TM2_M_BODY_EMPTY 2014 0.43 0.20 0.53 156 RELAYCOUNTRY_DE 1990 0.63 0.89 0.52 157 RELAYCOUNTRY_AU 1988 0.59 0.76 0.52 158 XMHTMLBadTable_001 1985 0.66 1.01 0.52 159 AC_DIV_BONANZA 1961 0.41 0.14 0.52 160 TR_XM_RelayPhish 1951 0.74 1.32 0.51 161 TM2_M_A_HREF_HREF 1916 0.51 0.52 0.50 162 HTML_IMAGE_ONLY_28 1911 0.56 0.71 0.50 163 HTML_IMAGE_ONLY_24 1850 0.48 0.47 0.49 164 BAD_ENC_HEADER 1849 0.37 0.07 0.49 165 XM_B_COPY_HTML 1805 0.56 0.78 0.47 166 XMBdyGiftCard01 1797 0.72 1.34 0.47 167 T_FILL_THIS_FORM_LONG 1791 0.36 0.09 0.47 168 XM_H_PHPOS_M 1763 0.45 0.43 0.46 169 FORGED_GMAIL_RCVD 1736 0.47 0.51 0.46 170 T_HTML_ATTACH 1692 0.34 0.08 0.44 171 T_FILL_THIS_FORM_LOAN 1665 0.34 0.10 0.44 172 XMPhish30 1644 0.73 1.49 0.43 173 XMBody_95 1524 0.33 0.15 0.40 174 XM_B_TRADE_HTML 1522 0.42 0.47 0.40 175 DIET_1 1513 0.70 1.47 0.40 176 RDNS_DYNAMIC 1503 0.54 0.91 0.39 177 T_Symld_Words_02 1495 0.64 1.26 0.39 178 HTML_TAG_BALANCE_BODY 1471 0.52 0.86 0.39 179 DKIM_ADSP_NXDOMAIN 1470 0.39 0.39 0.39 180 XMLKML 1450 0.27 0.00 0.38 181 XMBody_17 1441 0.70 1.52 0.38 182 URI_NOVOWEL 1424 0.50 0.83 0.37 183 XMPhish14 1403 0.51 0.86 0.37 184 XMSolicitRefs_0 1401 0.43 0.60 0.37 185 XMHTML_After_End 1400 0.79 1.84 0.37 186 TVD_SPACE_RATIO 1384 0.36 0.34 0.36 187 XMSubEmpty 1370 0.29 0.11 0.36 188 T_TooManySym_04 1361 0.27 0.06 0.36 189 HTML_IMAGE_ONLY_20 1358 0.36 0.37 0.36 190 XMSubMetaSxObfu_02 1351 0.34 0.30 0.35 191 SpammyFromTLD_02 1350 0.74 1.73 0.35 192 MSGID_FROM_MTA_HEADER 1345 0.32 0.24 0.35 193 NO_DNS_FOR_FROM 1329 0.32 0.25 0.35 194 UPPERCASE_50_75 1284 0.30 0.19 0.34 195 FSL_HELO_NON_FQDN_1 1268 0.26 0.08 0.33 196 DOS_OUTLOOK_TO_MX 1257 0.27 0.13 0.33 197 PLING_QUERY 1231 0.40 0.59 0.32 198 XM_H_SpoofStaff4 1205 0.25 0.07 0.32 199 XM_USANA_RCVD 1201 0.23 0.00 0.32 200 XMSlimDrugH 1182 0.40 0.64 0.31 ----------------------------------------------------------------------