Email: 505620 Autolearn: 0 AvgScore: 2.98 AvgScanTime: 2.19 sec Spam: 142978 Autolearn: 0 AvgScore: 12.57 AvgScanTime: 2.59 sec Ham: 362642 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 2.04 sec Time Spent Running SA: 308.11 hours Time Spent Processing Spam: 103.01 hours Time Spent Processing Ham: 205.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134794 87.66 94.28 85.06 2 DKIM_SIGNED 120513 73.07 84.29 68.64 3 XM_DK_Pass 117443 71.23 82.14 66.93 4 DKIM_VALID 115187 68.98 80.56 64.41 5 DCC_CHECK 114350 45.57 79.98 32.01 6 XMListUnsubscribeExists 103363 50.55 72.29 41.97 7 DKIM_VALID_AU 88292 50.26 61.75 45.72 8 XM_H_QuotedFrom 81471 39.60 56.98 32.75 9 XM_DK_Undo_02 72233 23.87 50.52 13.37 10 BAYES_99 66434 22.01 46.46 12.37 11 BAYES_999 57156 19.20 39.98 11.00 12 TR_DCC_Bayes_99 52765 14.68 36.90 5.91 13 HTML_FONT_LOW_CONTRAST 48752 25.65 34.10 22.32 14 LOC_TINY_FONT_1 45067 21.93 31.52 18.15 15 BAYES_50 44692 50.25 31.26 57.74 16 MIME_HTML_ONLY 42248 21.83 29.55 18.78 17 FVGT_m_MULTI_ODD 40624 21.85 28.41 19.27 18 XMSubLong 40558 22.04 28.37 19.55 19 DKIM_VALID_EF 30009 21.90 20.99 22.26 20 T_TM2_M_HEADER_IN_MSG 29890 30.58 20.91 34.40 21 XM_Body_Dirty_Words 27849 12.79 19.48 10.15 22 T_KAM_HTML_FONT_INVALID 26358 14.40 18.44 12.80 23 DCC_CHECK_NEGATIVE 25704 52.07 17.98 65.51 24 MultiRelay 24149 19.77 16.89 20.91 25 RELAYCOUNTRY_META 23538 8.66 16.46 5.58 26 XM_Multi_Part_URI 22844 12.20 15.98 10.71 27 HTML_IMAGE_RATIO_02 21844 8.79 15.28 6.24 28 BOTNET 20195 4.59 14.12 0.83 29 FSL_BULK_SIG 19896 9.36 13.92 7.57 30 XM_Evil_Numbers_Gen 19253 9.19 13.47 7.50 31 BOTNET_IPINHOSTNAME 18565 6.71 12.98 4.23 32 LOTS_OF_MONEY 16901 9.36 11.82 8.39 33 T_XMDrugObfuBody_14 16551 9.01 11.58 8.00 34 UNTRUSTED_Relay 15091 3.91 10.55 1.28 35 XM_B_Phish_Phrases 13963 6.47 9.77 5.17 36 XM_H_Long_From01 13634 6.73 9.54 5.63 37 LotsOfNums_01 13603 8.17 9.51 7.63 38 XMSexyCombo_05 13206 4.75 9.24 2.98 39 HTML_IMAGE_RATIO_04 12274 5.79 8.58 4.69 40 XM_UncommonTLD01 11228 5.02 7.85 3.90 41 BAYES_80 10948 4.78 7.66 3.65 42 TR_XM_DocInvoice 10885 5.24 7.61 4.30 43 TooManyTo_001 10719 9.05 7.50 9.67 44 MPART_ALT_DIFF 9906 4.48 6.93 3.52 45 XMSubMetaSx_00 8787 3.97 6.15 3.12 46 MIME_QP_LONG_LINE 8545 5.39 5.98 5.15 47 BAYES_60 8500 6.12 5.94 6.19 48 FROM_EXCESS_BASE64 8027 3.93 5.61 3.26 49 RCVD_IN_RP_SAFE 7754 8.12 5.42 9.19 50 HTML_IMAGE_RATIO_06 7018 3.05 4.91 2.32 51 XMNumbers 7016 3.77 4.91 3.33 52 RCVD_IN_RP_CERTIFIED 6799 7.51 4.76 8.60 53 BAYES_95 6542 3.04 4.58 2.43 54 XM_DIRTYINTL 6535 2.58 4.57 1.80 55 T_REMOTE_IMAGE 6519 4.67 4.56 4.71 56 XM_UB50 6369 1.87 4.45 0.84 57 XMStrtUSub 6272 4.50 4.39 4.54 58 TM2_M_URI_OPT_OUT 6116 2.60 4.28 1.94 59 XM_SendGrid 6108 4.76 4.27 4.95 60 RCVD_IN_MSPIKE_H2 5791 4.32 4.05 4.42 61 MIME_HTML_ONLY_MULTI 5463 2.53 3.82 2.02 62 DKIM_INVALID 5326 4.09 3.73 4.23 63 MIME_HTML_MOSTLY 5315 2.75 3.72 2.37 64 XM_SPF_SoftFail 5306 2.71 3.71 2.32 65 RCVD_IN_BL_SPAMCOP_NET 4876 1.74 3.41 1.08 66 XM_CamelCaseFrm001 4692 2.03 3.28 1.54 67 URI_HEX 4525 1.69 3.16 1.11 68 T_TooManySym_01 4493 4.19 3.14 4.61 69 RELAYCOUNTRY_CA 4473 1.87 3.13 1.38 70 RCVD_IN_PSBL 4041 0.89 2.83 0.13 71 XM_OfRef6 3964 2.01 2.77 1.71 72 PHOTO_EDITING_DIRECT 3940 0.78 2.76 0.01 73 RCVD_IN_RP_RNBL 3936 0.80 2.75 0.02 74 XM_URI_RBL 3929 0.87 2.75 0.13 75 HTML_IMAGE_RATIO_08 3858 2.23 2.70 2.05 76 XM_H_Long_From02 3853 1.36 2.69 0.83 77 RCVD_IN_IADB_LISTED 3754 4.55 2.63 5.30 78 XMDiploma_00 3519 1.84 2.46 1.59 79 HTML_MIME_NO_HTML_TAG 3454 2.33 2.42 2.30 80 MultiRelay_CC 3447 0.85 2.41 0.24 81 MultiRelay_Combo 3447 0.85 2.41 0.24 82 TR_Mismatch_TLD_02 3322 0.70 2.32 0.06 83 T_XMDrugObfuBody_08 3286 1.54 2.30 1.25 84 RCVD_IN_IADB_SPF 3285 3.96 2.30 4.62 85 RCVD_IN_IADB_SENDERID 3115 3.55 2.18 4.09 86 MAILING_LIST_MULTI 3109 3.02 2.17 3.36 87 XM_DK_Undo_01 3086 2.17 2.16 2.17 88 RCVD_IN_IADB_DK 3073 3.46 2.15 3.98 89 XM_UB99 2929 0.59 2.05 0.02 90 XMHTML_After_End 2880 0.80 2.01 0.32 91 RELAYCOUNTRY_FR 2781 0.71 1.95 0.22 92 XMSubMetaI_00 2675 0.98 1.87 0.63 93 BOTNET_NORDNS 2655 0.56 1.86 0.05 94 URI_TRY_3LD 2568 1.29 1.80 1.09 95 SpammyFromTLD_01 2528 1.18 1.77 0.95 96 TM2_M_VERY_LONG_WORD 2527 1.05 1.77 0.77 97 UNPARSEABLE_RELAY 2403 3.02 1.68 3.54 98 RELAYCOUNTRY_NL 2398 0.60 1.68 0.18 99 RELAYCOUNTRY_CN 2380 0.52 1.66 0.07 100 XMBody_17 2366 0.72 1.65 0.36 101 SUBJ_ALL_CAPS 2314 1.55 1.62 1.52 102 URIBL_BLACK 2293 0.48 1.60 0.04 103 DATE_IN_PAST_03_06 2272 0.50 1.59 0.07 104 XMStockSpam_06 2224 1.37 1.56 1.30 105 XMGenDplmaNmb 2210 1.23 1.55 1.10 106 TR_XM_RelayPhish 2203 0.85 1.54 0.58 107 XMPhish30 2146 0.71 1.50 0.40 108 BAYES_00 2118 6.46 1.48 8.43 109 XM_ProductURIs 2099 1.15 1.47 1.03 110 XM_UB999 2066 0.42 1.44 0.01 111 T_XMHurry_00 2062 0.71 1.44 0.42 112 XMBdyGiftCard01 2034 0.76 1.42 0.50 113 TR_Symld_Words 2027 1.89 1.42 2.07 114 XM_HighProb1 2026 0.42 1.42 0.02 115 ALL_TRUSTED 2018 13.46 1.41 18.21 116 XMPhish11 2009 1.40 1.41 1.40 117 XMSexyCombo_01 1993 0.69 1.39 0.41 118 XM_B_REG_HTML 1916 0.91 1.34 0.75 119 T_XMDrugObfuBody_00 1887 0.88 1.32 0.70 120 SpammyFromTLD_02 1866 0.69 1.31 0.45 121 DATE_IN_PAST_06_12 1837 0.39 1.28 0.04 122 TooManyTo_002 1799 2.51 1.26 3.01 123 TR_XM_DK_Bayes 1709 4.03 1.20 5.15 124 BAYES_40 1703 3.36 1.19 4.22 125 T_Symld_Words_02 1690 0.67 1.18 0.46 126 TR_XM_DK_Bayes1 1687 3.86 1.18 4.92 127 XM_UB60 1649 0.38 1.15 0.07 128 RCVD_IN_IADB_VOUCHED 1647 2.87 1.15 3.54 129 RELAYCOUNTRY_GB 1636 1.45 1.14 1.57 130 URIBL_DBL_SPAM 1621 0.33 1.13 0.01 131 LONG_JUNK_URI 1617 0.42 1.13 0.14 132 DIET_1 1587 0.54 1.11 0.31 133 XM_H_PHPOS 1563 1.27 1.09 1.34 134 TR_XM_DK_Bayes2 1549 3.04 1.08 3.82 135 XMMoneyMeta_00 1542 0.71 1.08 0.57 136 XMPhish14 1530 0.53 1.07 0.31 137 REMOVE_BEFORE_LINK 1514 0.50 1.06 0.29 138 TooManyTo_003 1510 1.69 1.06 1.94 139 T_HTML_TAG_BALANCE_CENTER 1507 0.41 1.05 0.15 140 T_FILL_THIS_FORM_SHORT 1482 1.05 1.04 1.06 141 MPART_ALT_DIFF_COUNT 1461 0.53 1.02 0.33 142 XMHTMLBadTable_001 1457 0.56 1.02 0.38 143 LONG_JUNK_URI3 1418 0.32 0.99 0.06 144 XM_B_COPY_HTML 1411 0.62 0.99 0.48 145 XM_UB80 1406 0.29 0.98 0.02 146 PLING_QUERY 1406 0.42 0.98 0.20 147 RELAYCOUNTRY_AT 1396 0.36 0.98 0.12 148 BODY_URI_ONLY 1387 0.31 0.97 0.05 149 BAYES_20 1376 2.44 0.96 3.02 150 FSL_THIS_IS_ADV 1362 0.31 0.95 0.06 151 T_MONEY_PERCENT 1352 0.56 0.95 0.41 152 HTML_FONT_FACE_BAD 1352 1.26 0.95 1.38 153 TR_LOTS_OF_MONEY2 1352 0.56 0.95 0.41 154 XM_BadFromFormat 1349 0.41 0.94 0.20 155 HTML_IMAGE_ONLY_08 1333 0.36 0.93 0.13 156 XMBody_78 1328 0.59 0.93 0.46 157 HTML_SHORT_LINK_IMG_1 1323 0.28 0.93 0.02 158 XMBSHREFv2 1320 0.38 0.92 0.17 159 DKIM_ADSP_CUSTOM_MED 1315 1.10 0.92 1.17 160 HTML_FONT_SIZE_HUGE 1291 0.33 0.90 0.11 161 ANY_BOUNCE_MESSAGE 1289 2.46 0.90 3.07 162 BOUNCE_MESSAGE 1285 2.46 0.90 3.07 163 XMBrknScrpt_02 1258 0.60 0.88 0.49 164 TooManyTo_004 1252 1.26 0.88 1.41 165 RDNS_DYNAMIC 1241 0.51 0.87 0.37 166 HTML_IMAGE_ONLY_28 1231 0.60 0.86 0.50 167 TR_MetaPhish_Combo_01 1230 0.83 0.86 0.82 168 HTML_FONT_SIZE_LARGE 1229 0.38 0.86 0.19 169 HTTPS_HTTP_MISMATCH 1212 0.55 0.85 0.43 170 XM_PDF 1179 4.03 0.82 5.29 171 T_TooManySym_02 1162 1.83 0.81 2.23 172 XM_UB95 1126 0.24 0.79 0.02 173 XM_H_PHPMailer 1126 0.79 0.79 0.79 174 SUBJ_DOLLARS 1121 0.45 0.78 0.31 175 RELAYCOUNTRY_DE 1089 0.64 0.76 0.59 176 XMCapTrack 1075 1.37 0.75 1.61 177 URI_NOVOWEL 1049 0.41 0.73 0.28 178 XM_OfRef7 1020 0.34 0.71 0.20 179 XMSubNoVowel 1006 0.62 0.70 0.59 180 XMSlimDrugH 998 0.46 0.70 0.36 181 XM_RXBody 991 0.28 0.69 0.11 182 XM_Body_Obfu01 975 0.39 0.68 0.27 183 LOW_PRICE 966 0.26 0.68 0.10 184 MIME_CHARSET_FARAWAY 929 0.27 0.65 0.12 185 NML_ADSP_CUSTOM_MED 923 0.78 0.65 0.83 186 XM_GoogleGroups 921 1.31 0.64 1.57 187 XMLongAddy 918 0.25 0.64 0.10 188 XMSolicitRefs_0 918 0.43 0.64 0.34 189 XMNoVowels 911 0.75 0.64 0.80 190 XMGppyBdWords 907 0.33 0.63 0.20 191 RCVD_IN_IADB_OPTIN 906 1.41 0.63 1.72 192 LONG_JUNK_URI2 896 0.20 0.63 0.03 193 RELAYCOUNTRY_AU 895 0.46 0.63 0.39 194 HTML_TAG_BALANCE_BODY 890 0.46 0.62 0.39 195 FORGED_GMAIL_RCVD 889 0.52 0.62 0.48 196 XMLngstWrd_00 878 0.38 0.61 0.28 197 TR_Caps_n_Bayes_99 871 0.19 0.61 0.02 198 DATE_IN_PAST_12_24 860 0.19 0.60 0.03 199 BASE64_LENGTH_79_INF 853 0.25 0.60 0.12 200 MONEY_BACK 842 0.20 0.59 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 308455 87.66 94.28 85.06 2 DKIM_SIGNED 248926 73.07 84.29 68.64 3 XM_DK_Pass 242703 71.23 82.14 66.93 4 DCC_CHECK_NEGATIVE 237583 52.07 17.98 65.51 5 DKIM_VALID 233572 68.98 80.56 64.41 6 BAYES_50 209407 50.25 31.26 57.74 7 DKIM_VALID_AU 165809 50.26 61.75 45.72 8 XMListUnsubscribeExists 152208 50.55 72.29 41.97 9 T_TM2_M_HEADER_IN_MSG 124738 30.58 20.91 34.40 10 XM_H_QuotedFrom 118750 39.60 56.98 32.75 11 DCC_CHECK 116067 45.57 79.98 32.01 12 HTML_FONT_LOW_CONTRAST 80958 25.65 34.10 22.32 13 DKIM_VALID_EF 80709 21.90 20.99 22.26 14 MultiRelay 75826 19.77 16.89 20.91 15 XMSubLong 70880 22.04 28.37 19.55 16 FVGT_m_MULTI_ODD 69874 21.85 28.41 19.27 17 MIME_HTML_ONLY 68113 21.83 29.55 18.78 18 ALL_TRUSTED 66023 13.46 1.41 18.21 19 LOC_TINY_FONT_1 65830 21.93 31.52 18.15 20 XM_DK_Undo_02 48470 23.87 50.52 13.37 21 T_KAM_HTML_FONT_INVALID 46436 14.40 18.44 12.80 22 BAYES_99 44854 22.01 46.46 12.37 23 BAYES_999 39903 19.20 39.98 11.00 24 XM_Multi_Part_URI 38829 12.20 15.98 10.71 25 XM_Body_Dirty_Words 36813 12.79 19.48 10.15 26 TooManyTo_001 35052 9.05 7.50 9.67 27 XM_DKIMWhitelistDomains 33878 6.71 0.02 9.34 28 RCVD_IN_RP_SAFE 33310 8.12 5.42 9.19 29 RCVD_IN_RP_CERTIFIED 31179 7.51 4.76 8.60 30 BAYES_00 30567 6.46 1.48 8.43 31 LOTS_OF_MONEY 30441 9.36 11.82 8.39 32 T_XMDrugObfuBody_14 29016 9.01 11.58 8.00 33 LotsOfNums_01 27686 8.17 9.51 7.63 34 FSL_BULK_SIG 27435 9.36 13.92 7.57 35 XM_Evil_Numbers_Gen 27209 9.19 13.47 7.50 36 IN_ZIMBRA_NJ_WHITELIST 25934 5.14 0.05 7.15 37 HTML_IMAGE_RATIO_02 22618 8.79 15.28 6.24 38 BAYES_60 22448 6.12 5.94 6.19 39 TR_DCC_Bayes_99 21435 14.68 36.90 5.91 40 XM_H_Long_From01 20402 6.73 9.54 5.63 41 RELAYCOUNTRY_META 20236 8.66 16.46 5.58 42 RCVD_IN_IADB_LISTED 19227 4.55 2.63 5.30 43 XM_PDF 19181 4.03 0.82 5.29 44 XM_B_Phish_Phrases 18738 6.47 9.77 5.17 45 MIME_QP_LONG_LINE 18694 5.39 5.98 5.15 46 TR_XM_DK_Bayes 18684 4.03 1.20 5.15 47 XM_SendGrid 17936 4.76 4.27 4.95 48 TR_XM_DK_Bayes1 17832 3.86 1.18 4.92 49 T_REMOTE_IMAGE 17080 4.67 4.56 4.71 50 HTML_IMAGE_RATIO_04 17006 5.79 8.58 4.69 51 RCVD_IN_IADB_SPF 16746 3.96 2.30 4.62 52 T_TooManySym_01 16701 4.19 3.14 4.61 53 XMStrtUSub 16462 4.50 4.39 4.54 54 RCVD_IN_MSPIKE_H2 16029 4.32 4.05 4.42 55 TR_XM_DocInvoice 15600 5.24 7.61 4.30 56 DKIM_INVALID 15354 4.09 3.73 4.23 57 BOTNET_IPINHOSTNAME 15341 6.71 12.98 4.23 58 BAYES_40 15302 3.36 1.19 4.22 59 RCVD_IN_IADB_SENDERID 14839 3.55 2.18 4.09 60 RCVD_IN_IADB_DK 14433 3.46 2.15 3.98 61 XM_UncommonTLD01 14139 5.02 7.85 3.90 62 TR_XM_DK_Bayes2 13841 3.04 1.08 3.82 63 BAYES_80 13229 4.78 7.66 3.65 64 UNPARSEABLE_RELAY 12847 3.02 1.68 3.54 65 RCVD_IN_IADB_VOUCHED 12840 2.87 1.15 3.54 66 MPART_ALT_DIFF 12755 4.48 6.93 3.52 67 MAILING_LIST_MULTI 12178 3.02 2.17 3.36 68 XMNumbers 12069 3.77 4.91 3.33 69 FROM_EXCESS_BASE64 11831 3.93 5.61 3.26 70 XMSubMetaSx_00 11297 3.97 6.15 3.12 71 ANY_BOUNCE_MESSAGE 11136 2.46 0.90 3.07 72 BOUNCE_MESSAGE 11133 2.46 0.90 3.07 73 TVD_RCVD_IP 11050 2.26 0.26 3.05 74 BAYES_20 10968 2.44 0.96 3.02 75 HELO_NODOT 10941 2.28 0.40 3.02 76 TooManyTo_002 10905 2.51 1.26 3.01 77 XMSexyCombo_05 10817 4.75 9.24 2.98 78 IN_HORDE_ADDRESS_BOOK 10345 2.06 0.06 2.85 79 BAYES_95 8815 3.04 4.58 2.43 80 MIME_HTML_MOSTLY 8594 2.75 3.72 2.37 81 XM_SPF_SoftFail 8412 2.71 3.71 2.32 82 HTML_IMAGE_RATIO_06 8402 3.05 4.91 2.32 83 HTML_MIME_NO_HTML_TAG 8342 2.33 2.42 2.30 84 T_TooManySym_02 8073 1.83 0.81 2.23 85 XM_DK_Undo_01 7861 2.17 2.16 2.17 86 TR_Symld_Words 7515 1.89 1.42 2.07 87 TO_MALFORMED 7445 1.48 0.01 2.05 88 HTML_IMAGE_RATIO_08 7433 2.23 2.70 2.05 89 MIME_HTML_ONLY_MULTI 7322 2.53 3.82 2.02 90 BAYES_05 7048 1.53 0.47 1.94 91 INVALID_MSGID 7036 1.46 0.22 1.94 92 TM2_M_URI_OPT_OUT 7027 2.60 4.28 1.94 93 TooManyTo_003 7021 1.69 1.06 1.94 94 XM_DIRTYINTL 6518 2.58 4.57 1.80 95 RCVD_IN_IADB_OPTIN 6240 1.41 0.63 1.72 96 XM_OfRef6 6216 2.01 2.77 1.71 97 XMCapTrack 5839 1.37 0.75 1.61 98 XMDiploma_00 5774 1.84 2.46 1.59 99 RELAYCOUNTRY_GB 5690 1.45 1.14 1.57 100 XM_GoogleGroups 5684 1.31 0.64 1.57 101 XM_CamelCaseFrm001 5596 2.03 3.28 1.54 102 RCVD_IN_MSPIKE_WL 5554 1.25 0.55 1.53 103 RCVD_IN_MSPIKE_H3 5554 1.25 0.55 1.53 104 SUBJ_ALL_CAPS 5502 1.55 1.62 1.52 105 TooManyTo_004 5114 1.26 0.88 1.41 106 XMPhish11 5089 1.40 1.41 1.40 107 HTML_FONT_FACE_BAD 5019 1.26 0.95 1.38 108 RELAYCOUNTRY_CA 4989 1.87 3.13 1.38 109 XM_H_PHPOS 4866 1.27 1.09 1.34 110 XMStockSpam_06 4728 1.37 1.56 1.30 111 UNTRUSTED_Relay 4658 3.91 10.55 1.28 112 USER_IN_DEF_DKIM_WL 4656 0.94 0.08 1.28 113 T_XMDrugObfuBody_08 4517 1.54 2.30 1.25 114 DKIM_ADSP_CUSTOM_MED 4237 1.10 0.92 1.17 115 TooManyTo_005 4156 0.98 0.57 1.15 116 URI_HEX 4011 1.69 3.16 1.11 117 XMGenDplmaNmb 3989 1.23 1.55 1.10 118 URI_TRY_3LD 3948 1.29 1.80 1.09 119 RCVD_IN_BL_SPAMCOP_NET 3908 1.74 3.41 1.08 120 T_FILL_THIS_FORM_SHORT 3843 1.05 1.04 1.06 121 XM_ProductURIs 3723 1.15 1.47 1.03 122 SpammyFromTLD_01 3454 1.18 1.77 0.95 123 T_TooManySym_03 3356 0.74 0.27 0.93 124 XM_UB50 3064 1.87 4.45 0.84 125 USER_IN_WHITELIST 3029 0.60 0.00 0.84 126 XM_H_Long_From02 3025 1.36 2.69 0.83 127 NML_ADSP_CUSTOM_MED 3001 0.78 0.65 0.83 128 BOTNET 2999 4.59 14.12 0.83 129 TR_MetaPhish_Combo_01 2972 0.83 0.86 0.82 130 XM_ShortIntro_01 2970 0.71 0.44 0.82 131 XMNoVowels 2887 0.75 0.64 0.80 132 XM_H_PHPMailer 2878 0.79 0.79 0.79 133 TM2_M_VERY_LONG_WORD 2798 1.05 1.77 0.77 134 XM_B_REG_HTML 2703 0.91 1.34 0.75 135 RCVD_IN_SORBS_DUL 2614 0.61 0.33 0.72 136 SHORT_HELO_AND_INLINE_IMAGE 2559 0.53 0.10 0.71 137 T_OBFU_PDF_ATTACH 2549 0.55 0.16 0.70 138 T_XMDrugObfuBody_00 2547 0.88 1.32 0.70 139 FILL_THIS_FORM 2385 0.56 0.30 0.66 140 XMGappySubj_01 2376 0.55 0.30 0.66 141 XMSubMetaI_00 2283 0.98 1.87 0.63 142 RCVD_IN_IADB_DOPTIN 2264 0.47 0.08 0.62 143 AC_DIV_BONANZA 2260 0.51 0.22 0.62 144 RELAYCOUNTRY_DE 2146 0.64 0.76 0.59 145 XMSubNoVowel 2130 0.62 0.70 0.59 146 TR_XM_RelayPhish 2088 0.85 1.54 0.58 147 XMDateMe_00 2061 0.50 0.33 0.57 148 XMMoneyMeta_00 2060 0.71 1.08 0.57 149 MISSING_HEADERS 2030 0.52 0.41 0.56 150 HTML_IMAGE_ONLY_32 1981 0.49 0.34 0.55 151 XMBody_95 1840 0.41 0.17 0.51 152 XMBdyGiftCard01 1817 0.76 1.42 0.50 153 HTML_IMAGE_ONLY_28 1814 0.60 0.86 0.50 154 XM_H_PHPOS_M 1812 0.49 0.46 0.50 155 TM2_M_A_HREF_HREF 1810 0.52 0.58 0.50 156 XMBrknScrpt_02 1779 0.60 0.88 0.49 157 T_FILL_THIS_FORM_LOAN 1759 0.38 0.12 0.49 158 XM_B_COPY_HTML 1740 0.62 0.99 0.48 159 FORGED_GMAIL_RCVD 1738 0.52 0.62 0.48 160 T_FILL_THIS_FORM_LONG 1717 0.37 0.12 0.47 161 T_MANY_PILL_PRICE 1697 0.34 0.00 0.47 162 T_Symld_Words_02 1686 0.67 1.18 0.46 163 XMBody_78 1661 0.59 0.93 0.46 164 SpammyFromTLD_02 1634 0.69 1.31 0.45 165 TM2_M_BODY_EMPTY 1614 0.36 0.16 0.45 166 BAD_ENC_HEADER 1594 0.32 0.02 0.44 167 HTTPS_HTTP_MISMATCH 1572 0.55 0.85 0.43 168 T_XMHurry_00 1519 0.71 1.44 0.42 169 HTML_IMAGE_ONLY_24 1510 0.43 0.48 0.42 170 XMSexyCombo_01 1503 0.69 1.39 0.41 171 XM_USANA_RCVD 1502 0.30 0.00 0.41 172 XMSubMetaSxObfu_03 1479 0.45 0.57 0.41 173 T_MONEY_PERCENT 1475 0.56 0.95 0.41 174 TR_LOTS_OF_MONEY2 1475 0.56 0.95 0.41 175 XMSubMetaSxObfu_02 1462 0.37 0.28 0.40 176 XMPhish30 1435 0.71 1.50 0.40 177 HTML_TAG_BALANCE_BODY 1428 0.46 0.62 0.39 178 RELAYCOUNTRY_AU 1407 0.46 0.63 0.39 179 XMHTMLBadTable_001 1385 0.56 1.02 0.38 180 RDNS_DYNAMIC 1359 0.51 0.87 0.37 181 XM_B_TRADE_HTML 1347 0.42 0.54 0.37 182 NO_DNS_FOR_FROM 1341 0.35 0.29 0.37 183 DKIM_ADSP_NXDOMAIN 1336 0.42 0.54 0.37 184 XMSlimDrugH 1313 0.46 0.70 0.36 185 URIBL_SBL_A 1302 0.39 0.46 0.36 186 XMBody_17 1292 0.72 1.65 0.36 187 XMLKML 1275 0.25 0.00 0.35 188 MSGID_FROM_MTA_HEADER 1265 0.32 0.24 0.35 189 HTML_IMAGE_ONLY_20 1260 0.38 0.48 0.35 190 XMSolicitRefs_0 1241 0.43 0.64 0.34 191 XMSubEmpty 1235 0.29 0.15 0.34 192 TVD_SPACE_RATIO 1226 0.34 0.34 0.34 193 T_TooManySym_04 1216 0.26 0.07 0.34 194 TR_MetaPhish_Combo_01b 1203 0.29 0.18 0.33 195 MPART_ALT_DIFF_COUNT 1196 0.53 1.02 0.33 196 XMRcvdHeader_15 1177 0.23 0.00 0.32 197 XMHTML_After_End 1177 0.80 2.01 0.32 198 DOS_OUTLOOK_TO_MX 1158 0.27 0.14 0.32 199 DIET_1 1142 0.54 1.11 0.31 200 XMPhish14 1138 0.53 1.07 0.31 ----------------------------------------------------------------------