Email: 535832 Autolearn: 0 AvgScore: 2.88 AvgScanTime: 3.70 sec Spam: 153908 Autolearn: 0 AvgScore: 12.56 AvgScanTime: 4.63 sec Ham: 381924 Autolearn: 0 AvgScore: -1.02 AvgScanTime: 3.32 sec Time Spent Running SA: 550.28 hours Time Spent Processing Spam: 197.99 hours Time Spent Processing Ham: 352.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147316 85.07 95.72 80.79 2 DKIM_SIGNED 131862 67.76 85.68 60.54 3 XM_DK_Pass 128246 66.05 83.33 59.09 4 DKIM_VALID 121414 61.55 78.89 54.57 5 DCC_CHECK 119702 42.04 77.78 27.63 6 XMListUnsubscribeExists 112167 45.79 72.88 34.87 7 DKIM_VALID_AU 94637 45.18 61.49 38.61 8 XM_H_QuotedFrom 84148 39.67 54.67 33.63 9 XM_DK_Undo_02 77682 22.28 50.47 10.91 10 BAYES_99 70472 20.23 45.79 9.93 11 BAYES_999 60743 17.56 39.47 8.74 12 LOC_TINY_FONT_1 55706 22.04 36.19 16.33 13 HTML_FONT_LOW_CONTRAST 55638 24.40 36.15 19.67 14 TR_DCC_Bayes_99 53985 13.12 35.08 4.28 15 BAYES_50 48692 50.30 31.64 57.82 16 MIME_HTML_ONLY 46340 23.28 30.11 20.53 17 FVGT_m_MULTI_ODD 42858 19.84 27.85 16.62 18 XMSubLong 39767 20.83 25.84 18.81 19 DKIM_VALID_EF 37378 24.08 24.29 23.99 20 T_TM2_M_HEADER_IN_MSG 33737 33.11 21.92 37.62 21 T_KAM_HTML_FONT_INVALID 32436 14.62 21.07 12.02 22 DCC_CHECK_NEGATIVE 30718 55.77 19.96 70.21 23 XM_Body_Dirty_Words 27697 10.98 18.00 8.15 24 MultiRelay 26746 19.19 17.38 19.92 25 RELAYCOUNTRY_META 26494 8.54 17.21 5.04 26 XM_Multi_Part_URI 25604 10.74 16.64 8.37 27 HTML_IMAGE_RATIO_02 25029 8.29 16.26 5.07 28 XM_Evil_Numbers_Gen 24286 8.96 15.78 6.21 29 BOTNET 22040 5.22 14.32 1.55 30 BOTNET_IPINHOSTNAME 19455 6.16 12.64 3.54 31 FSL_BULK_SIG 18857 8.71 12.25 7.29 32 LOTS_OF_MONEY 17832 8.37 11.59 7.07 33 UNTRUSTED_Relay 16473 3.92 10.70 1.19 34 T_XMDrugObfuBody_14 15573 7.78 10.12 6.84 35 XM_B_Phish_Phrases 14665 5.84 9.53 4.35 36 LotsOfNums_01 14553 6.97 9.46 5.96 37 XMSexyCombo_05 14086 4.48 9.15 2.60 38 HTML_IMAGE_RATIO_04 13314 5.61 8.65 4.39 39 TooManyTo_001 13109 9.69 8.52 10.17 40 XM_UncommonTLD01 12014 4.77 7.81 3.54 41 BAYES_80 11747 5.79 7.63 5.05 42 TR_XM_DocInvoice 11586 4.66 7.53 3.51 43 XM_H_Long_From01 11427 8.87 7.42 9.45 44 XMSubMetaSx_00 11171 4.22 7.26 3.00 45 DKIM_INVALID 10448 6.21 6.79 5.98 46 BAYES_60 9896 6.10 6.43 5.97 47 FROM_EXCESS_BASE64 9736 3.94 6.33 2.97 48 MPART_ALT_DIFF 9525 5.78 6.19 5.61 49 XMStrtUSub 8170 3.72 5.31 3.08 50 RCVD_IN_RP_SAFE 7804 6.35 5.07 6.86 51 MIME_QP_LONG_LINE 7756 4.74 5.04 4.61 52 RCVD_IN_MSPIKE_H2 7560 5.34 4.91 5.52 53 XM_SendGrid 7103 4.67 4.62 4.70 54 XM_UB50 7089 1.94 4.61 0.87 55 XMNumbers 7051 3.76 4.58 3.43 56 BAYES_95 6839 2.92 4.44 2.31 57 RCVD_IN_RP_CERTIFIED 6756 5.73 4.39 6.26 58 TM2_M_URI_OPT_OUT 6632 2.38 4.31 1.60 59 HTML_IMAGE_RATIO_06 6507 2.92 4.23 2.40 60 MIME_HTML_MOSTLY 6415 2.51 4.17 1.84 61 XM_SPF_SoftFail 6337 2.71 4.12 2.15 62 T_REMOTE_IMAGE 6306 4.02 4.10 3.98 63 XM_DIRTYINTL 6178 2.27 4.01 1.57 64 HTML_IMAGE_RATIO_08 5419 2.21 3.52 1.68 65 SUBJ_ALL_CAPS 5252 5.44 3.41 6.26 66 XM_CamelCaseFrm001 5177 2.10 3.36 1.59 67 T_TooManySym_01 4884 4.41 3.17 4.91 68 RELAYCOUNTRY_CA 4862 1.71 3.16 1.13 69 URI_HEX 4812 1.62 3.13 1.01 70 T_XMDrugObfuBody_08 4651 1.77 3.02 1.26 71 MIME_HTML_ONLY_MULTI 4634 4.04 3.01 4.45 72 RCVD_IN_BL_SPAMCOP_NET 4580 1.29 2.98 0.61 73 MultiRelay_CC 4171 0.93 2.71 0.22 74 MultiRelay_Combo 4171 0.93 2.71 0.22 75 NO_DNS_FOR_FROM 4028 1.96 2.62 1.69 76 HTML_MIME_NO_HTML_TAG 4000 3.70 2.60 4.15 77 XM_OfRef6 3840 1.65 2.49 1.31 78 XMSubMetaI_00 3839 1.14 2.49 0.59 79 XMDiploma_00 3750 1.71 2.44 1.42 80 TM2_M_VERY_LONG_WORD 3660 1.20 2.38 0.73 81 RCVD_IN_RP_RNBL 3425 0.66 2.23 0.03 82 MAILING_LIST_MULTI 3407 2.90 2.21 3.17 83 RCVD_IN_IADB_LISTED 3323 3.75 2.16 4.40 84 SpammyFromTLD_01 3243 1.13 2.11 0.73 85 RELAYCOUNTRY_FR 3180 0.74 2.07 0.21 86 XMBody_17 3160 0.82 2.05 0.33 87 XM_URI_RBL 3129 0.66 2.03 0.11 88 TR_Mismatch_TLD_02 3083 0.62 2.00 0.06 89 XM_UB99 2997 0.57 1.95 0.01 90 BOTNET_NORDNS 2952 0.57 1.92 0.03 91 RCVD_IN_IADB_SPF 2937 3.31 1.91 3.87 92 TooManyTo_002 2895 2.67 1.88 2.99 93 RCVD_IN_IADB_SENDERID 2794 2.99 1.82 3.47 94 XMBdyGiftCard01 2767 0.83 1.80 0.44 95 RCVD_IN_IADB_DK 2757 2.91 1.79 3.36 96 UNPARSEABLE_RELAY 2666 2.38 1.73 2.64 97 TooManyTo_003 2627 1.94 1.71 2.03 98 SpammyFromTLD_02 2605 0.64 1.69 0.21 99 RCVD_IN_PSBL 2512 0.58 1.63 0.16 100 XM_DK_Undo_01 2479 1.75 1.61 1.81 101 XMStockSpam_06 2453 1.16 1.59 0.99 102 T_XMHurry_00 2453 0.77 1.59 0.44 103 XM_UB60 2449 0.51 1.59 0.07 104 XMGenDplmaNmb 2412 1.05 1.57 0.84 105 TR_Caps_n_Bayes_99 2377 0.57 1.54 0.18 106 XM_ProductURIs 2366 1.10 1.54 0.92 107 XMPhish30 2336 0.65 1.52 0.31 108 XM_UB999 2323 0.44 1.51 0.01 109 DIET_1 2252 0.70 1.46 0.40 110 T_MONEY_PERCENT 2240 0.58 1.46 0.23 111 TR_LOTS_OF_MONEY2 2240 0.58 1.46 0.23 112 XMHTML_After_End 2219 0.60 1.44 0.27 113 REMOVE_BEFORE_LINK 2177 0.59 1.41 0.26 114 XMSexyCombo_01 2176 0.60 1.41 0.27 115 TR_XM_RelayPhish 2145 0.70 1.39 0.41 116 T_XMDrugObfuBody_00 2144 1.15 1.39 1.06 117 URIBL_BLACK 2111 0.41 1.37 0.03 118 TooManyTo_004 2109 1.46 1.37 1.50 119 ALL_TRUSTED 2093 17.41 1.36 23.88 120 URI_TRY_3LD 2015 1.10 1.31 1.01 121 BAYES_00 1960 6.76 1.27 8.97 122 XMSlimDrugH 1940 0.60 1.26 0.33 123 MISSING_HEADERS 1935 0.94 1.26 0.81 124 XMPhish14 1896 0.58 1.23 0.32 125 T_FILL_THIS_FORM_SHORT 1895 1.01 1.23 0.92 126 MPART_ALT_DIFF_COUNT 1889 0.50 1.23 0.21 127 BAYES_40 1852 4.27 1.20 5.50 128 RELAYCOUNTRY_DE 1847 0.70 1.20 0.50 129 RELAYCOUNTRY_CN 1828 0.38 1.19 0.06 130 XM_B_REG_HTML 1819 0.69 1.18 0.49 131 XMBody_78 1813 0.59 1.18 0.35 132 TR_Symld_Words 1796 1.70 1.17 1.91 133 PHOTO_EDITING_DIRECT 1795 0.34 1.17 0.00 134 RELAYCOUNTRY_GB 1774 1.23 1.15 1.26 135 ANY_BOUNCE_MESSAGE 1732 2.50 1.13 3.06 136 BOUNCE_MESSAGE 1732 2.50 1.13 3.05 137 URIBL_DBL_SPAM 1731 0.33 1.12 0.01 138 XMPhish11 1727 1.13 1.12 1.13 139 XM_H_Long_From02 1714 0.94 1.11 0.87 140 XM_UB80 1679 0.33 1.09 0.02 141 XM_HighProb1 1662 0.32 1.08 0.02 142 TR_LOTS_OF_MONEY3 1646 0.49 1.07 0.26 143 DKIM_ADSP_CUSTOM_MED 1624 1.06 1.06 1.06 144 TooManyTo_005 1623 1.20 1.05 1.26 145 HTML_FONT_FACE_BAD 1603 1.97 1.04 2.35 146 RELAYCOUNTRY_AT 1590 0.38 1.03 0.12 147 FSL_THIS_IS_ADV 1586 0.34 1.03 0.06 148 XM_PDF 1566 4.13 1.02 5.38 149 T_Symld_Words_02 1552 0.59 1.01 0.42 150 HTTPS_HTTP_MISMATCH 1541 0.68 1.00 0.55 151 T_HTML_TAG_BALANCE_CENTER 1537 0.35 1.00 0.09 152 HTML_FONT_SIZE_HUGE 1518 1.76 0.99 2.07 153 BAYES_20 1477 2.01 0.96 2.44 154 XM_H_PHPOS 1473 1.17 0.96 1.26 155 TR_MetaPhish_Combo_01 1457 0.78 0.95 0.71 156 T_TooManySym_02 1444 1.74 0.94 2.06 157 TR_XM_DK_Bayes 1436 2.76 0.93 3.49 158 XM_RXBody 1435 0.67 0.93 0.57 159 SUBJ_DOLLARS 1422 0.37 0.92 0.15 160 HTML_TAG_BALANCE_BODY 1407 0.50 0.91 0.34 161 XMBrknScrpt_02 1367 0.54 0.89 0.39 162 RCVD_IN_IADB_VOUCHED 1365 2.38 0.89 2.98 163 URI_NOVOWEL 1364 0.49 0.89 0.33 164 XMSubMetaSSx_00 1361 0.36 0.88 0.15 165 XM_B_COPY_HTML 1353 0.57 0.88 0.45 166 RDNS_DYNAMIC 1342 0.53 0.87 0.40 167 NML_ADSP_CUSTOM_MED 1340 0.75 0.87 0.70 168 FORGED_GMAIL_RCVD 1284 0.60 0.83 0.51 169 TR_XM_DK_Bayes1 1272 2.55 0.83 3.24 170 XM_BadFromFormat 1244 0.37 0.81 0.20 171 XM_Hitman 1241 0.25 0.81 0.03 172 TR_XM_DK_Bayes2 1239 2.16 0.81 2.71 173 XMLongAddy 1220 0.27 0.79 0.05 174 XMMoneyMeta_00 1208 0.53 0.78 0.43 175 RCVD_IN_MSPIKE_WL 1202 1.34 0.78 1.57 176 GAPPY_SUBJECT 1193 0.28 0.78 0.08 177 XMClaimOffer 1180 0.29 0.77 0.09 178 XMNoVowels 1174 0.79 0.76 0.80 179 RELAYCOUNTRY_NL 1161 0.34 0.75 0.18 180 XMCapTrack 1154 1.49 0.75 1.79 181 RELAYCOUNTRY_SG 1128 0.32 0.73 0.16 182 RCVD_IN_MSPIKE_H3 1122 1.32 0.73 1.56 183 XMHTMLBadTable_001 1112 0.41 0.72 0.28 184 RELAYCOUNTRY_IN 1103 0.31 0.72 0.15 185 XM_Body_Obfu01 1102 0.41 0.72 0.29 186 DATE_IN_PAST_03_06 1100 0.27 0.71 0.09 187 ADMITS_SPAM 1096 0.22 0.71 0.02 188 LONG_JUNK_URI3 1093 0.22 0.71 0.02 189 TR_Sbj_FN_Bdy 1073 0.40 0.70 0.28 190 REPLYTO_WITHOUT_TO_CC 1045 0.25 0.68 0.08 191 PLING_QUERY 1009 0.32 0.66 0.18 192 XM_S_JOY_D 988 0.36 0.64 0.25 193 HTML_IMAGE_ONLY_28 980 0.51 0.64 0.46 194 XMBounce_01 954 0.21 0.62 0.04 195 XMLngstWrd_00 952 0.40 0.62 0.31 196 LOW_PRICE 944 0.24 0.61 0.09 197 DATE_IN_PAST_06_12 940 0.22 0.61 0.06 198 RELAYCOUNTRY_AU 939 0.50 0.61 0.45 199 XMSubMetaSxObfu_03 919 0.38 0.60 0.29 200 XM_H_PHPMailer 908 0.64 0.59 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 308543 85.07 95.72 80.79 2 DCC_CHECK_NEGATIVE 268133 55.77 19.96 70.21 3 DKIM_SIGNED 231217 67.76 85.68 60.54 4 XM_DK_Pass 225687 66.05 83.33 59.09 5 BAYES_50 220826 50.30 31.64 57.82 6 DKIM_VALID 208397 61.55 78.89 54.57 7 DKIM_VALID_AU 147453 45.18 61.49 38.61 8 T_TM2_M_HEADER_IN_MSG 143669 33.11 21.92 37.62 9 XMListUnsubscribeExists 133175 45.79 72.88 34.87 10 XM_H_QuotedFrom 128439 39.67 54.67 33.63 11 DCC_CHECK 105539 42.04 77.78 27.63 12 DKIM_VALID_EF 91629 24.08 24.29 23.99 13 ALL_TRUSTED 91188 17.41 1.36 23.88 14 MIME_HTML_ONLY 78399 23.28 30.11 20.53 15 MultiRelay 76091 19.19 17.38 19.92 16 HTML_FONT_LOW_CONTRAST 75130 24.40 36.15 19.67 17 XMSubLong 71843 20.83 25.84 18.81 18 FVGT_m_MULTI_ODD 63459 19.84 27.85 16.62 19 LOC_TINY_FONT_1 62377 22.04 36.19 16.33 20 T_KAM_HTML_FONT_INVALID 45912 14.62 21.07 12.02 21 XM_DK_Undo_02 41684 22.28 50.47 10.91 22 IN_ZIMBRA_NJ_WHITELIST 40219 7.52 0.05 10.53 23 TooManyTo_001 38833 9.69 8.52 10.17 24 BAYES_99 37923 20.23 45.79 9.93 25 XM_H_Long_From01 36098 8.87 7.42 9.45 26 BAYES_00 34274 6.76 1.27 8.97 27 BAYES_999 33363 17.56 39.47 8.74 28 XM_Multi_Part_URI 31966 10.74 16.64 8.37 29 XM_Body_Dirty_Words 31132 10.98 18.00 8.15 30 XM_DKIMWhitelistDomains 29870 5.59 0.06 7.82 31 FSL_BULK_SIG 27839 8.71 12.25 7.29 32 LOTS_OF_MONEY 27017 8.37 11.59 7.07 33 RCVD_IN_RP_SAFE 26210 6.35 5.07 6.86 34 T_XMDrugObfuBody_14 26127 7.78 10.12 6.84 35 RCVD_IN_RP_CERTIFIED 23927 5.73 4.39 6.26 36 SUBJ_ALL_CAPS 23924 5.44 3.41 6.26 37 XM_Evil_Numbers_Gen 23710 8.96 15.78 6.21 38 DKIM_INVALID 22820 6.21 6.79 5.98 39 BAYES_60 22787 6.10 6.43 5.97 40 LotsOfNums_01 22774 6.97 9.46 5.96 41 MPART_ALT_DIFF 21420 5.78 6.19 5.61 42 RCVD_IN_MSPIKE_H2 21079 5.34 4.91 5.52 43 BAYES_40 21011 4.27 1.20 5.50 44 XM_PDF 20554 4.13 1.02 5.38 45 HTML_IMAGE_RATIO_02 19376 8.29 16.26 5.07 46 BAYES_80 19284 5.79 7.63 5.05 47 RELAYCOUNTRY_META 19243 8.54 17.21 5.04 48 T_TooManySym_01 18769 4.41 3.17 4.91 49 XM_SendGrid 17932 4.67 4.62 4.70 50 MIME_QP_LONG_LINE 17617 4.74 5.04 4.61 51 MIME_HTML_ONLY_MULTI 17008 4.04 3.01 4.45 52 RCVD_IN_IADB_LISTED 16793 3.75 2.16 4.40 53 HTML_IMAGE_RATIO_04 16753 5.61 8.65 4.39 54 XM_B_Phish_Phrases 16603 5.84 9.53 4.35 55 TR_DCC_Bayes_99 16334 13.12 35.08 4.28 56 HTML_MIME_NO_HTML_TAG 15842 3.70 2.60 4.15 57 T_REMOTE_IMAGE 15216 4.02 4.10 3.98 58 RCVD_IN_IADB_SPF 14785 3.31 1.91 3.87 59 BOTNET_IPINHOSTNAME 13534 6.16 12.64 3.54 60 XM_UncommonTLD01 13526 4.77 7.81 3.54 61 TR_XM_DocInvoice 13405 4.66 7.53 3.51 62 TR_XM_DK_Bayes 13330 2.76 0.93 3.49 63 RCVD_IN_IADB_SENDERID 13235 2.99 1.82 3.47 64 XMNumbers 13110 3.76 4.58 3.43 65 RCVD_IN_IADB_DK 12836 2.91 1.79 3.36 66 TR_XM_DK_Bayes1 12369 2.55 0.83 3.24 67 MAILING_LIST_MULTI 12109 2.90 2.21 3.17 68 XMStrtUSub 11749 3.72 5.31 3.08 69 ANY_BOUNCE_MESSAGE 11671 2.50 1.13 3.06 70 BOUNCE_MESSAGE 11655 2.50 1.13 3.05 71 XMSubMetaSx_00 11446 4.22 7.26 3.00 72 TooManyTo_002 11434 2.67 1.88 2.99 73 RCVD_IN_IADB_VOUCHED 11375 2.38 0.89 2.98 74 FROM_EXCESS_BASE64 11354 3.94 6.33 2.97 75 TR_XM_DK_Bayes2 10338 2.16 0.81 2.71 76 UNPARSEABLE_RELAY 10086 2.38 1.73 2.64 77 XMSexyCombo_05 9917 4.48 9.15 2.60 78 HELO_NODOT 9779 1.96 0.48 2.56 79 TVD_RCVD_IP 9452 1.88 0.40 2.47 80 BAYES_20 9311 2.01 0.96 2.44 81 HTML_IMAGE_RATIO_06 9148 2.92 4.23 2.40 82 HTML_FONT_FACE_BAD 8958 1.97 1.04 2.35 83 BAYES_95 8818 2.92 4.44 2.31 84 XMSubNoVowel 8685 1.74 0.42 2.27 85 IN_HORDE_ADDRESS_BOOK 8408 1.59 0.08 2.20 86 XM_SPF_SoftFail 8207 2.71 4.12 2.15 87 HTTP_ESCAPED_HOST 7915 1.50 0.07 2.07 88 HTML_FONT_SIZE_HUGE 7906 1.76 0.99 2.07 89 T_TooManySym_02 7881 1.74 0.94 2.06 90 TooManyTo_003 7752 1.94 1.71 2.03 91 TR_Symld_Words 7303 1.70 1.17 1.91 92 MIME_HTML_MOSTLY 7025 2.51 4.17 1.84 93 INVALID_MSGID 6920 1.35 0.21 1.81 94 BAYES_05 6909 1.44 0.53 1.81 95 XM_DK_Undo_01 6908 1.75 1.61 1.81 96 XMCapTrack 6851 1.49 0.75 1.79 97 TO_MALFORMED 6626 1.24 0.02 1.73 98 NO_DNS_FOR_FROM 6463 1.96 2.62 1.69 99 HTML_IMAGE_RATIO_08 6410 2.21 3.52 1.68 100 TM2_M_URI_OPT_OUT 6124 2.38 4.31 1.60 101 XM_CamelCaseFrm001 6084 2.10 3.36 1.59 102 RCVD_IN_MSPIKE_WL 5999 1.34 0.78 1.57 103 XM_DIRTYINTL 5989 2.27 4.01 1.57 104 RCVD_IN_MSPIKE_H3 5958 1.32 0.73 1.56 105 BOTNET 5933 5.22 14.32 1.55 106 TooManyTo_004 5740 1.46 1.37 1.50 107 XMDiploma_00 5423 1.71 2.44 1.42 108 RCVD_IN_IADB_OPTIN 5248 1.12 0.50 1.37 109 XM_GoogleGroups 5128 1.11 0.52 1.34 110 XM_OfRef6 5008 1.65 2.49 1.31 111 T_XMDrugObfuBody_08 4827 1.77 3.02 1.26 112 TooManyTo_005 4816 1.20 1.05 1.26 113 XM_H_PHPOS 4807 1.17 0.96 1.26 114 RELAYCOUNTRY_GB 4806 1.23 1.15 1.26 115 UNTRUSTED_Relay 4538 3.92 10.70 1.19 116 RELAYCOUNTRY_CA 4318 1.71 3.16 1.13 117 XMPhish11 4314 1.13 1.12 1.13 118 DKIM_ADSP_CUSTOM_MED 4049 1.06 1.06 1.06 119 T_XMDrugObfuBody_00 4031 1.15 1.39 1.06 120 URI_HEX 3870 1.62 3.13 1.01 121 URI_TRY_3LD 3862 1.10 1.31 1.01 122 XMStockSpam_06 3781 1.16 1.59 0.99 123 USER_IN_DEF_DKIM_WL 3669 0.69 0.02 0.96 124 XM_ProductURIs 3526 1.10 1.54 0.92 125 T_FILL_THIS_FORM_SHORT 3496 1.01 1.23 0.92 126 XM_H_Long_From02 3335 0.94 1.11 0.87 127 XM_UB50 3323 1.94 4.61 0.87 128 XMGenDplmaNmb 3199 1.05 1.57 0.84 129 T_TooManySym_03 3148 0.63 0.16 0.82 130 MISSING_HEADERS 3079 0.94 1.26 0.81 131 XMNoVowels 3061 0.79 0.76 0.80 132 XMSubEmpty 2930 0.66 0.41 0.77 133 SpammyFromTLD_01 2787 1.13 2.11 0.73 134 TM2_M_VERY_LONG_WORD 2778 1.20 2.38 0.73 135 TR_MetaPhish_Combo_01 2727 0.78 0.95 0.71 136 NML_ADSP_CUSTOM_MED 2660 0.75 0.87 0.70 137 USER_IN_WHITELIST 2657 0.50 0.00 0.70 138 SHORT_HELO_AND_INLINE_IMAGE 2546 0.51 0.13 0.67 139 XM_H_PHPMailer 2501 0.64 0.59 0.65 140 RCVD_IN_BL_SPAMCOP_NET 2346 1.29 2.98 0.61 141 FILL_THIS_FORM 2298 0.52 0.32 0.60 142 RCVD_IN_SORBS_DUL 2267 0.51 0.30 0.59 143 XMSubMetaI_00 2259 1.14 2.49 0.59 144 XM_ShortIntro_01 2228 0.51 0.33 0.58 145 XMGappySubj_01 2191 0.57 0.57 0.57 146 UPPERCASE_50_75 2174 0.46 0.18 0.57 147 XMSubMetaSxObfu_02 2172 0.50 0.33 0.57 148 XM_RXBody 2166 0.67 0.93 0.57 149 XMLKML 2154 0.40 0.00 0.56 150 HTTPS_HTTP_MISMATCH 2103 0.68 1.00 0.55 151 RCVD_IN_IADB_DOPTIN 2069 0.41 0.07 0.54 152 HTML_IMAGE_ONLY_20 2056 0.45 0.25 0.54 153 XMDateMe_00 2041 0.51 0.45 0.53 154 T_OBFU_PDF_ATTACH 2007 0.44 0.23 0.53 155 FORGED_GMAIL_RCVD 1948 0.60 0.83 0.51 156 RELAYCOUNTRY_DE 1899 0.70 1.20 0.50 157 HTML_IMAGE_ONLY_32 1889 0.46 0.36 0.49 158 XM_B_REG_HTML 1880 0.69 1.18 0.49 159 XMBody_95 1865 0.38 0.12 0.49 160 AC_DIV_BONANZA 1863 0.41 0.21 0.49 161 HTML_IMAGE_ONLY_28 1759 0.51 0.64 0.46 162 XMAntiAgingB 1737 0.33 0.02 0.45 163 RELAYCOUNTRY_AU 1736 0.50 0.61 0.45 164 XM_B_COPY_HTML 1717 0.57 0.88 0.45 165 TM2_M_BODY_EMPTY 1694 0.41 0.31 0.44 166 XMBdyGiftCard01 1680 0.83 1.80 0.44 167 T_XMHurry_00 1670 0.77 1.59 0.44 168 TVD_SPACE_RATIO 1656 0.42 0.39 0.43 169 XMMoneyMeta_00 1651 0.53 0.78 0.43 170 T_Symld_Words_02 1587 0.59 1.01 0.42 171 TR_XM_RelayPhish 1582 0.70 1.39 0.41 172 T_TooManySym_04 1570 0.31 0.05 0.41 173 XMSubLongNoVowel 1553 0.31 0.07 0.41 174 DIET_1 1525 0.70 1.46 0.40 175 RDNS_DYNAMIC 1521 0.53 0.87 0.40 176 XMBrknScrpt_02 1504 0.54 0.89 0.39 177 XM_E_Blogspot 1480 0.30 0.08 0.39 178 TR_Mismatch_TLD_01 1426 0.38 0.40 0.37 179 HTML_IMAGE_ONLY_24 1422 0.39 0.42 0.37 180 T_FILL_THIS_FORM_LOAN 1415 0.30 0.14 0.37 181 T_FILL_THIS_FORM_LONG 1395 0.30 0.14 0.37 182 XM_H_PHPOS_M 1364 0.35 0.35 0.36 183 XMBody_78 1354 0.59 1.18 0.35 184 XM_B_TRADE_HTML 1288 0.35 0.38 0.34 185 HTML_TAG_BALANCE_BODY 1282 0.50 0.91 0.34 186 XMSlimDrugH 1279 0.60 1.26 0.33 187 URI_NOVOWEL 1255 0.49 0.89 0.33 188 XMBody_17 1247 0.82 2.05 0.33 189 XMPhish14 1231 0.58 1.23 0.32 190 HTML_IMAGE_ONLY_16 1217 0.28 0.19 0.32 191 XMRcvdHeader_15 1213 0.23 0.00 0.32 192 DOS_OUTLOOK_TO_MX 1211 0.27 0.16 0.32 193 XMLngstWrd_00 1191 0.40 0.62 0.31 194 DKIM_ADSP_NXDOMAIN 1185 0.37 0.52 0.31 195 XMPhish30 1169 0.65 1.52 0.31 196 XMSolicitRefs_0 1167 0.31 0.33 0.31 197 TM2_M_A_HREF_HREF 1158 0.35 0.48 0.30 198 XMSubMetaSxObfu_03 1124 0.38 0.60 0.29 199 GMD_PDF_HORIZ 1117 0.23 0.07 0.29 200 XM_H_Undi_Recip 1108 0.25 0.15 0.29 ----------------------------------------------------------------------