Email: 534668 Autolearn: 0 AvgScore: 3.42 AvgScanTime: 3.75 sec Spam: 158370 Autolearn: 0 AvgScore: 12.69 AvgScanTime: 4.55 sec Ham: 376298 Autolearn: 0 AvgScore: -0.48 AvgScanTime: 3.41 sec Time Spent Running SA: 556.43 hours Time Spent Processing Spam: 200.29 hours Time Spent Processing Ham: 356.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150551 84.51 95.06 80.07 2 DKIM_SIGNED 136918 69.82 86.45 62.82 3 XM_DK_Pass 132719 68.10 83.80 61.50 4 DKIM_VALID 127015 64.05 80.20 57.26 5 DCC_CHECK 124523 42.84 78.63 27.77 6 XMListUnsubscribeExists 116490 47.26 73.56 36.19 7 DKIM_VALID_AU 100186 47.05 63.26 40.23 8 XM_H_QuotedFrom 89174 38.96 56.31 31.66 9 XM_DK_Undo_02 80071 22.68 50.56 10.94 10 BAYES_99 74069 21.35 46.77 10.66 11 BAYES_999 63412 18.44 40.04 9.35 12 HTML_FONT_LOW_CONTRAST 59329 25.17 37.46 20.00 13 TR_DCC_Bayes_99 58288 14.43 36.80 5.01 14 LOC_TINY_FONT_1 54862 21.04 34.64 15.32 15 BAYES_50 48662 48.22 30.73 55.58 16 MIME_HTML_ONLY 47930 21.75 30.26 18.16 17 XMSubLong 43042 21.22 27.18 18.72 18 FVGT_m_MULTI_ODD 42777 19.98 27.01 17.02 19 DKIM_VALID_EF 40096 24.89 25.32 24.71 20 T_TM2_M_HEADER_IN_MSG 34657 33.23 21.88 38.01 21 T_KAM_HTML_FONT_INVALID 33339 15.25 21.05 12.81 22 DCC_CHECK_NEGATIVE 30361 54.95 19.17 70.01 23 XM_Body_Dirty_Words 29305 11.42 18.50 8.44 24 RELAYCOUNTRY_META 29277 9.41 18.49 5.60 25 MultiRelay 27902 19.44 17.62 20.21 26 XM_Multi_Part_URI 26713 11.12 16.87 8.70 27 HTML_IMAGE_RATIO_02 25410 8.31 16.04 5.05 28 XM_Evil_Numbers_Gen 21262 8.62 13.43 6.60 29 BOTNET_IPINHOSTNAME 20642 6.21 13.03 3.34 30 BOTNET 20616 4.53 13.02 0.96 31 FSL_BULK_SIG 19375 8.11 12.23 6.38 32 LOTS_OF_MONEY 19261 8.58 12.16 7.07 33 UNTRUSTED_Relay 17697 4.35 11.17 1.48 34 XMSexyCombo_05 15254 4.60 9.63 2.48 35 T_XMDrugObfuBody_14 15190 7.91 9.59 7.20 36 HTML_IMAGE_RATIO_04 14411 5.31 9.10 3.71 37 XM_B_Phish_Phrases 13912 5.13 8.78 3.60 38 LotsOfNums_01 12976 7.09 8.19 6.62 39 TR_XM_DocInvoice 12706 4.78 8.02 3.42 40 XM_UncommonTLD01 12237 5.22 7.73 4.17 41 MPART_ALT_DIFF 12152 3.89 7.67 2.29 42 TooManyTo_001 11902 8.79 7.52 9.32 43 BAYES_80 11532 5.73 7.28 5.08 44 XM_H_Long_From01 11441 8.90 7.22 9.61 45 XMSubMetaSx_00 11256 4.21 7.11 2.99 46 RCVD_IN_MSPIKE_H2 11139 6.05 7.03 5.64 47 BAYES_60 10032 6.14 6.33 6.06 48 FROM_EXCESS_BASE64 9921 3.78 6.26 2.74 49 DKIM_INVALID 9903 5.76 6.25 5.56 50 XMNumbers 9891 4.26 6.25 3.43 51 HTML_IMAGE_RATIO_06 8660 3.52 5.47 2.70 52 TM2_M_URI_OPT_OUT 8243 2.73 5.20 1.69 53 RCVD_IN_RP_SAFE 8018 6.45 5.06 7.03 54 T_REMOTE_IMAGE 7546 4.37 4.76 4.21 55 XM_UB50 7198 2.02 4.55 0.95 56 XM_SendGrid 6971 4.71 4.40 4.83 57 MIME_HTML_MOSTLY 6958 2.66 4.39 1.94 58 BAYES_95 6938 3.45 4.38 3.06 59 XM_SPF_SoftFail 6575 3.07 4.15 2.62 60 XMStrtUSub 6366 3.84 4.02 3.76 61 MIME_QP_LONG_LINE 6331 4.67 4.00 4.95 62 RCVD_IN_RP_CERTIFIED 6314 5.74 3.99 6.47 63 XM_DIRTYINTL 6267 2.42 3.96 1.78 64 HTML_IMAGE_RATIO_08 5911 2.38 3.73 1.81 65 RELAYCOUNTRY_CA 5754 2.04 3.63 1.36 66 SpammyFromTLD_02 5562 1.20 3.51 0.22 67 XM_CamelCaseFrm001 5320 1.96 3.36 1.37 68 T_TooManySym_01 5117 3.82 3.23 4.07 69 URI_HEX 5002 1.73 3.16 1.13 70 MIME_HTML_ONLY_MULTI 4875 1.77 3.08 1.23 71 MultiRelay_Combo 4611 1.05 2.91 0.27 72 MultiRelay_CC 4611 1.05 2.91 0.27 73 XM_OfRef6 4365 1.82 2.76 1.43 74 HTML_MIME_NO_HTML_TAG 4216 3.75 2.66 4.21 75 SUBJ_ALL_CAPS 4160 5.17 2.63 6.23 76 SpammyFromTLD_01 4058 1.70 2.56 1.34 77 RCVD_IN_BL_SPAMCOP_NET 3661 0.89 2.31 0.29 78 RCVD_IN_RP_RNBL 3613 0.70 2.28 0.04 79 MAILING_LIST_MULTI 3553 2.35 2.24 2.40 80 XMDiploma_00 3485 1.84 2.20 1.68 81 XMHTML_After_End 3400 0.85 2.15 0.30 82 T_XMDrugObfuBody_08 3399 1.51 2.15 1.25 83 XM_UB99 3384 0.65 2.14 0.02 84 XM_URI_RBL 3344 0.70 2.11 0.10 85 RELAYCOUNTRY_FR 3341 0.82 2.11 0.27 86 RCVD_IN_IADB_LISTED 3333 3.95 2.10 4.73 87 XMSubMetaI_00 3212 0.99 2.03 0.56 88 UNPARSEABLE_RELAY 3204 2.40 2.02 2.55 89 BOTNET_NORDNS 3159 0.61 1.99 0.02 90 RCVD_IN_IADB_SPF 3035 3.50 1.92 4.17 91 URIBL_BLACK 2970 0.58 1.88 0.04 92 RCVD_IN_IADB_SENDERID 2858 3.15 1.80 3.72 93 XM_H_Long_From02 2844 1.13 1.80 0.85 94 RCVD_IN_IADB_DK 2808 3.08 1.77 3.63 95 TM2_M_VERY_LONG_WORD 2744 1.08 1.73 0.81 96 XM_H_PHPOS 2725 1.91 1.72 1.99 97 XM_UB60 2654 0.61 1.68 0.17 98 NO_DNS_FOR_FROM 2649 1.17 1.67 0.97 99 URIBL_DBL_SPAM 2629 0.52 1.66 0.04 100 XM_UB999 2622 0.50 1.66 0.01 101 XMBrknScrpt_02 2576 0.80 1.63 0.45 102 XM_ProductURIs 2535 1.21 1.60 1.05 103 XMBdyGiftCard01 2480 0.72 1.57 0.37 104 XM_DK_Undo_01 2439 1.86 1.54 1.99 105 XMBody_17 2426 0.72 1.53 0.38 106 XMLongAddy 2385 0.50 1.51 0.07 107 T_XMDrugObfuBody_00 2338 0.83 1.48 0.56 108 TR_XM_RelayPhish 2307 0.74 1.46 0.44 109 XMSexyCombo_01 2298 0.66 1.45 0.32 110 BAYES_00 2258 6.42 1.43 8.53 111 T_TooManySym_02 2245 1.63 1.42 1.72 112 HTML_IMAGE_ONLY_08 2229 0.51 1.41 0.14 113 BODY_URI_ONLY 2218 0.45 1.40 0.05 114 XMGenDplmaNmb 2202 1.16 1.39 1.06 115 XM_UB80 2160 0.44 1.36 0.04 116 T_XMHurry_00 2144 0.67 1.35 0.39 117 HTML_FONT_FACE_BAD 2133 1.06 1.35 0.94 118 HTML_IMAGE_ONLY_28 2116 0.71 1.34 0.45 119 HTML_SHORT_LINK_IMG_1 2112 0.41 1.33 0.02 120 XMPhish30 2091 0.58 1.32 0.27 121 RELAYCOUNTRY_CN 2061 0.44 1.30 0.07 122 TM2_M_BODY_EMPTY 2032 0.98 1.28 0.85 123 REMOVE_BEFORE_LINK 2020 0.51 1.28 0.19 124 MPART_ALT_DIFF_COUNT 2005 0.55 1.27 0.25 125 BAYES_40 1994 4.66 1.26 6.09 126 XMEmptyBody_01 1952 0.68 1.23 0.45 127 T_Symld_Words_02 1915 0.62 1.21 0.37 128 XM_BadFromFormat 1909 0.51 1.21 0.22 129 RELAYCOUNTRY_AT 1900 0.46 1.20 0.15 130 ALL_TRUSTED 1889 18.09 1.19 25.20 131 DIET_1 1875 0.89 1.18 0.77 132 XMStockSpam_06 1870 1.09 1.18 1.06 133 TR_Caps_n_Bayes_99 1862 0.40 1.18 0.07 134 URI_TRY_3LD 1820 1.05 1.15 1.01 135 RELAYCOUNTRY_GB 1811 1.09 1.14 1.07 136 RELAYCOUNTRY_IN 1806 0.45 1.14 0.17 137 TR_Symld_Words 1800 1.73 1.14 1.98 138 RDNS_DYNAMIC 1795 0.59 1.13 0.35 139 TR_LOTS_OF_MONEY3 1794 0.45 1.13 0.17 140 BAYES_20 1747 2.34 1.10 2.86 141 DKIM_ADSP_CUSTOM_MED 1728 1.11 1.09 1.11 142 SUBJ_DOLLARS 1671 0.41 1.06 0.14 143 XM_B_REG_HTML 1670 0.66 1.05 0.50 144 RCVD_IN_IADB_VOUCHED 1654 2.56 1.04 3.19 145 HTML_FONT_SIZE_LARGE 1649 0.45 1.04 0.20 146 T_FILL_THIS_FORM_SHORT 1646 0.98 1.04 0.95 147 TooManyTo_002 1642 2.39 1.04 2.96 148 XMPhish14 1636 0.61 1.03 0.44 149 RELAYCOUNTRY_AU 1615 0.59 1.02 0.40 150 TR_MetaPhish_Combo_01 1566 0.82 0.99 0.75 151 XMSubMetaSSx_00 1546 0.38 0.98 0.13 152 XM_HighProb1 1545 0.30 0.98 0.01 153 T_MONEY_PERCENT 1534 0.49 0.97 0.29 154 TR_LOTS_OF_MONEY2 1534 0.49 0.97 0.29 155 XM_S_JOY_D 1532 0.41 0.97 0.18 156 BODY_ENHANCEMENT 1527 0.31 0.96 0.03 157 ANY_BOUNCE_MESSAGE 1500 2.74 0.95 3.49 158 BOUNCE_MESSAGE 1495 2.73 0.94 3.49 159 XMPhish11 1486 1.15 0.94 1.24 160 XM_PDF 1475 4.03 0.93 5.34 161 NML_ADSP_CUSTOM_MED 1448 0.84 0.91 0.81 162 TooManyTo_003 1437 1.63 0.91 1.94 163 FORGED_GMAIL_RCVD 1395 0.63 0.88 0.53 164 XM_B_COPY_HTML 1390 0.63 0.88 0.52 165 TR_XM_DK_Bayes 1376 3.50 0.87 4.60 166 DATE_IN_PAST_03_06 1367 0.30 0.86 0.07 167 PLING_QUERY 1366 0.39 0.86 0.19 168 XMNoVowels 1363 1.34 0.86 1.54 169 URIBL_SBL_A 1339 0.35 0.85 0.14 170 TR_XM_DK_Bayes1 1320 3.14 0.83 4.11 171 URI_NOVOWEL 1280 0.53 0.81 0.41 172 XMBody_78 1276 0.54 0.81 0.43 173 HTTPS_HTTP_MISMATCH 1267 0.58 0.80 0.49 174 FILL_THIS_FORM 1265 0.60 0.80 0.52 175 XMCapTrack 1265 1.50 0.80 1.80 176 RELAYCOUNTRY_DE 1261 0.70 0.80 0.66 177 TR_Mismatch_TLD_02 1259 0.28 0.79 0.06 178 HTML_TAG_BALANCE_BODY 1221 0.46 0.77 0.33 179 DKIM_ADSP_NXDOMAIN 1206 0.52 0.76 0.42 180 TR_XM_DK_Bayes2 1202 2.46 0.76 3.18 181 XM_H_PHPMailer 1200 0.75 0.76 0.75 182 XMHTMLBadTable_001 1185 0.42 0.75 0.28 183 XMMoneyMeta_00 1148 0.61 0.72 0.56 184 FILL_THIS_FORM_LONG 1114 0.43 0.70 0.32 185 MISSING_HEADERS 1112 0.80 0.70 0.84 186 TooManyTo_004 1104 1.25 0.70 1.48 187 BAYES_05 1059 1.62 0.67 2.02 188 XM_H_Long_From03 1057 0.25 0.67 0.07 189 RCVD_IN_IADB_OPTIN 1057 1.63 0.67 2.03 190 FSL_THIS_IS_ADV 1052 0.23 0.66 0.05 191 T_HTML_TAG_BALANCE_CENTER 1052 0.30 0.66 0.15 192 XM_RXBody 1050 0.25 0.66 0.07 193 HTML_FONT_SIZE_HUGE 1048 0.25 0.66 0.07 194 FVGT_m_MULTI_ODD_EMAIL 1039 0.22 0.66 0.04 195 RELAYCOUNTRY_NL 1032 0.55 0.65 0.51 196 LOW_PRICE 1020 0.26 0.64 0.09 197 XMGppyBdWords 993 0.29 0.63 0.16 198 TooManyTo_005 985 1.05 0.62 1.24 199 XMClaimOffer 977 0.27 0.62 0.13 200 LongTLD 971 0.26 0.61 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301320 84.51 95.06 80.07 2 DCC_CHECK_NEGATIVE 263437 54.95 19.17 70.01 3 DKIM_SIGNED 236375 69.82 86.45 62.82 4 XM_DK_Pass 231408 68.10 83.80 61.50 5 DKIM_VALID 215460 64.05 80.20 57.26 6 BAYES_50 209143 48.22 30.73 55.58 7 DKIM_VALID_AU 151399 47.05 63.26 40.23 8 T_TM2_M_HEADER_IN_MSG 143037 33.23 21.88 38.01 9 XMListUnsubscribeExists 136185 47.26 73.56 36.19 10 XM_H_QuotedFrom 119134 38.96 56.31 31.66 11 DCC_CHECK 104515 42.84 78.63 27.77 12 ALL_TRUSTED 94842 18.09 1.19 25.20 13 DKIM_VALID_EF 92967 24.89 25.32 24.71 14 MultiRelay 76054 19.44 17.62 20.21 15 HTML_FONT_LOW_CONTRAST 75263 25.17 37.46 20.00 16 XMSubLong 70437 21.22 27.18 18.72 17 MIME_HTML_ONLY 68344 21.75 30.26 18.16 18 FVGT_m_MULTI_ODD 64064 19.98 27.01 17.02 19 LOC_TINY_FONT_1 57632 21.04 34.64 15.32 20 T_KAM_HTML_FONT_INVALID 48198 15.25 21.05 12.81 21 XM_DK_Undo_02 41166 22.68 50.56 10.94 22 BAYES_99 40102 21.35 46.77 10.66 23 XM_H_Long_From01 36150 8.90 7.22 9.61 24 BAYES_999 35193 18.44 40.04 9.35 25 TooManyTo_001 35086 8.79 7.52 9.32 26 XM_Multi_Part_URI 32739 11.12 16.87 8.70 27 BAYES_00 32093 6.42 1.43 8.53 28 XM_Body_Dirty_Words 31749 11.42 18.50 8.44 29 XM_DKIMWhitelistDomains 27487 5.17 0.09 7.30 30 T_XMDrugObfuBody_14 27096 7.91 9.59 7.20 31 LOTS_OF_MONEY 26604 8.58 12.16 7.07 32 RCVD_IN_RP_SAFE 26472 6.45 5.06 7.03 33 IN_ZIMBRA_NJ_WHITELIST 26386 4.95 0.04 7.01 34 LotsOfNums_01 24920 7.09 8.19 6.62 35 XM_Evil_Numbers_Gen 24820 8.62 13.43 6.60 36 RCVD_IN_RP_CERTIFIED 24365 5.74 3.99 6.47 37 FSL_BULK_SIG 23999 8.11 12.23 6.38 38 SUBJ_ALL_CAPS 23457 5.17 2.63 6.23 39 BAYES_40 22910 4.66 1.26 6.09 40 BAYES_60 22802 6.14 6.33 6.06 41 RCVD_IN_MSPIKE_H2 21232 6.05 7.03 5.64 42 RELAYCOUNTRY_META 21059 9.41 18.49 5.60 43 DKIM_INVALID 20915 5.76 6.25 5.56 44 XM_PDF 20096 4.03 0.93 5.34 45 BAYES_80 19118 5.73 7.28 5.08 46 HTML_IMAGE_RATIO_02 19009 8.31 16.04 5.05 47 TR_DCC_Bayes_99 18859 14.43 36.80 5.01 48 MIME_QP_LONG_LINE 18639 4.67 4.00 4.95 49 XM_SendGrid 18187 4.71 4.40 4.83 50 RCVD_IN_IADB_LISTED 17802 3.95 2.10 4.73 51 TR_XM_DK_Bayes 17323 3.50 0.87 4.60 52 HTML_MIME_NO_HTML_TAG 15844 3.75 2.66 4.21 53 T_REMOTE_IMAGE 15825 4.37 4.76 4.21 54 RCVD_IN_IADB_SPF 15686 3.50 1.92 4.17 55 XM_UncommonTLD01 15677 5.22 7.73 4.17 56 TR_XM_DK_Bayes1 15470 3.14 0.83 4.11 57 T_TooManySym_01 15306 3.82 3.23 4.07 58 XMStrtUSub 14139 3.84 4.02 3.76 59 RCVD_IN_IADB_SENDERID 14002 3.15 1.80 3.72 60 HTML_IMAGE_RATIO_04 13968 5.31 9.10 3.71 61 RCVD_IN_IADB_DK 13678 3.08 1.77 3.63 62 XM_B_Phish_Phrases 13534 5.13 8.78 3.60 63 ANY_BOUNCE_MESSAGE 13127 2.74 0.95 3.49 64 BOUNCE_MESSAGE 13124 2.73 0.94 3.49 65 XMNumbers 12895 4.26 6.25 3.43 66 TR_XM_DocInvoice 12865 4.78 8.02 3.42 67 BOTNET_IPINHOSTNAME 12566 6.21 13.03 3.34 68 RCVD_IN_IADB_VOUCHED 12009 2.56 1.04 3.19 69 TR_XM_DK_Bayes2 11975 2.46 0.76 3.18 70 BAYES_95 11525 3.45 4.38 3.06 71 XMSubMetaSx_00 11234 4.21 7.11 2.99 72 TooManyTo_002 11120 2.39 1.04 2.96 73 BAYES_20 10758 2.34 1.10 2.86 74 FROM_EXCESS_BASE64 10300 3.78 6.26 2.74 75 HTML_IMAGE_RATIO_06 10142 3.52 5.47 2.70 76 HELO_NODOT 9878 1.95 0.35 2.63 77 XM_SPF_SoftFail 9852 3.07 4.15 2.62 78 UNPARSEABLE_RELAY 9611 2.40 2.02 2.55 79 XMSexyCombo_05 9314 4.60 9.63 2.48 80 TVD_RCVD_IP 9029 1.87 0.60 2.40 81 MAILING_LIST_MULTI 9016 2.35 2.24 2.40 82 HTML_IMAGE_ONLY_20 8884 1.78 0.39 2.36 83 MPART_ALT_DIFF 8623 3.89 7.67 2.29 84 IN_HORDE_ADDRESS_BOOK 8315 1.58 0.07 2.21 85 RCVD_IN_IADB_OPTIN 7654 1.63 0.67 2.03 86 BAYES_05 7588 1.62 0.67 2.02 87 XM_DK_Undo_01 7495 1.86 1.54 1.99 88 XM_H_PHPOS 7481 1.91 1.72 1.99 89 TR_Symld_Words 7465 1.73 1.14 1.98 90 TooManyTo_003 7286 1.63 0.91 1.94 91 MIME_HTML_MOSTLY 7283 2.66 4.39 1.94 92 TO_MALFORMED 6988 1.32 0.05 1.86 93 INVALID_MSGID 6976 1.36 0.18 1.85 94 HTML_IMAGE_RATIO_08 6797 2.38 3.73 1.81 95 XMCapTrack 6757 1.50 0.80 1.80 96 XM_DIRTYINTL 6694 2.42 3.96 1.78 97 MSGID_NOFQDN1 6561 1.23 0.03 1.74 98 T_TooManySym_02 6460 1.63 1.42 1.72 99 TM2_M_URI_OPT_OUT 6347 2.73 5.20 1.69 100 XMDiploma_00 6338 1.84 2.20 1.68 101 XMNoVowels 5794 1.34 0.86 1.54 102 UNTRUSTED_Relay 5569 4.35 11.17 1.48 103 TooManyTo_004 5565 1.25 0.70 1.48 104 XM_OfRef6 5369 1.82 2.76 1.43 105 XM_CamelCaseFrm001 5172 1.96 3.36 1.37 106 RELAYCOUNTRY_CA 5134 2.04 3.63 1.36 107 SpammyFromTLD_01 5055 1.70 2.56 1.34 108 USER_IN_DEF_DKIM_WL 4998 0.96 0.07 1.33 109 T_XMDrugObfuBody_08 4689 1.51 2.15 1.25 110 XMPhish11 4679 1.15 0.94 1.24 111 TooManyTo_005 4655 1.05 0.62 1.24 112 MIME_HTML_ONLY_MULTI 4610 1.77 3.08 1.23 113 XM_GoogleGroups 4438 1.00 0.59 1.18 114 URI_HEX 4237 1.73 3.16 1.13 115 DKIM_ADSP_CUSTOM_MED 4183 1.11 1.09 1.11 116 RELAYCOUNTRY_GB 4043 1.09 1.14 1.07 117 XMGenDplmaNmb 4002 1.16 1.39 1.06 118 XMStockSpam_06 3973 1.09 1.18 1.06 119 XM_ProductURIs 3934 1.21 1.60 1.05 120 URI_TRY_3LD 3814 1.05 1.15 1.01 121 RCVD_IN_MSPIKE_WL 3670 0.79 0.37 0.98 122 RCVD_IN_MSPIKE_H3 3670 0.79 0.37 0.98 123 NO_DNS_FOR_FROM 3633 1.17 1.67 0.97 124 BOTNET 3596 4.53 13.02 0.96 125 XM_UB50 3593 2.02 4.55 0.95 126 T_FILL_THIS_FORM_SHORT 3583 0.98 1.04 0.95 127 HTML_FONT_FACE_BAD 3525 1.06 1.35 0.94 128 TM2_M_BODY_EMPTY 3184 0.98 1.28 0.85 129 XM_H_Long_From02 3184 1.13 1.80 0.85 130 MISSING_HEADERS 3161 0.80 0.70 0.84 131 XMSubNoVowel 3109 0.73 0.50 0.83 132 NML_ADSP_CUSTOM_MED 3054 0.84 0.91 0.81 133 TM2_M_VERY_LONG_WORD 3047 1.08 1.73 0.81 134 DIET_1 2896 0.89 1.18 0.77 135 TR_MetaPhish_Combo_01 2825 0.82 0.99 0.75 136 T_OBFU_PDF_ATTACH 2820 0.60 0.23 0.75 137 XMSolicitRefs_0 2813 0.62 0.31 0.75 138 XM_H_PHPMailer 2810 0.75 0.76 0.75 139 T_TooManySym_03 2738 0.63 0.39 0.73 140 XMLngstWrd_00 2733 0.61 0.33 0.73 141 USER_IN_WHITELIST 2689 0.50 0.00 0.71 142 SHORT_HELO_AND_INLINE_IMAGE 2600 0.51 0.09 0.69 143 XMLngstWrd_01 2579 0.57 0.31 0.69 144 RCVD_IN_SORBS_DUL 2536 0.61 0.47 0.67 145 XM_ShortIntro_01 2519 0.62 0.50 0.67 146 RELAYCOUNTRY_DE 2488 0.70 0.80 0.66 147 XMGappySubj_01 2368 0.56 0.41 0.63 148 TVD_SPACE_RATIO 2217 0.49 0.26 0.59 149 XMDateMe_00 2135 0.49 0.32 0.57 150 HTML_IMAGE_ONLY_32 2101 0.50 0.35 0.56 151 XMSubMetaI_00 2100 0.99 2.03 0.56 152 XMMoneyMeta_00 2097 0.61 0.72 0.56 153 T_XMDrugObfuBody_00 2093 0.83 1.48 0.56 154 XMSubEmpty 2008 0.44 0.21 0.53 155 FORGED_GMAIL_RCVD 1982 0.63 0.88 0.53 156 XM_B_COPY_HTML 1959 0.63 0.88 0.52 157 FILL_THIS_FORM 1951 0.60 0.80 0.52 158 RELAYCOUNTRY_NL 1920 0.55 0.65 0.51 159 XM_B_REG_HTML 1881 0.66 1.05 0.50 160 XMBody_95 1872 0.40 0.17 0.50 161 HTTPS_HTTP_MISMATCH 1829 0.58 0.80 0.49 162 AC_DIV_BONANZA 1811 0.37 0.12 0.48 163 XMBrknScrpt_02 1709 0.80 1.63 0.45 164 T_MANY_PILL_PRICE 1709 0.33 0.03 0.45 165 XMEmptyBody_01 1707 0.68 1.23 0.45 166 HTML_IMAGE_ONLY_28 1675 0.71 1.34 0.45 167 TR_XM_RelayPhish 1672 0.74 1.46 0.44 168 XMPhish14 1652 0.61 1.03 0.44 169 XMBody_78 1627 0.54 0.81 0.43 170 DKIM_ADSP_NXDOMAIN 1563 0.52 0.76 0.42 171 T_HTML_ATTACH 1563 0.32 0.09 0.42 172 URI_NOVOWEL 1550 0.53 0.81 0.41 173 HTML_IMAGE_ONLY_24 1539 0.47 0.60 0.41 174 RELAYCOUNTRY_AU 1522 0.59 1.02 0.40 175 XMSubMetaSxObfu_02 1483 0.37 0.31 0.39 176 T_XMHurry_00 1456 0.67 1.35 0.39 177 TR_Sbj_FN_Bdy 1451 0.32 0.15 0.39 178 XMRcvdHeader_15 1439 0.27 0.00 0.38 179 XMBody_17 1426 0.72 1.53 0.38 180 T_Symld_Words_02 1410 0.62 1.21 0.37 181 T_TooManySym_04 1404 0.29 0.09 0.37 182 XMBdyGiftCard01 1392 0.72 1.57 0.37 183 TO_NO_BRKTS_HTML_ONLY 1356 0.31 0.19 0.36 184 RDNS_DYNAMIC 1335 0.59 1.13 0.35 185 XM_H_Trusted_IP 1326 0.25 0.00 0.35 186 XM_H_PHPOS_M 1263 0.36 0.41 0.34 187 XMSubMetaSxObfu_03 1262 0.36 0.41 0.34 188 XMLKML 1259 0.24 0.00 0.33 189 HTML_TAG_BALANCE_BODY 1252 0.46 0.77 0.33 190 XM_B_TRADE_HTML 1215 0.35 0.41 0.32 191 XMSexyCombo_01 1214 0.66 1.45 0.32 192 XMSlimDrugH 1202 0.40 0.61 0.32 193 FILL_THIS_FORM_LONG 1189 0.43 0.70 0.32 194 T_FILL_THIS_FORM_LOAN 1160 0.40 0.61 0.31 195 GMD_PDF_EMPTY_BODY 1151 0.24 0.10 0.31 196 XMLngstWrd_02 1135 0.30 0.28 0.30 197 UPPERCASE_50_75 1135 0.25 0.14 0.30 198 XMHTML_After_End 1128 0.85 2.15 0.30 199 HTML_IMAGE_ONLY_16 1110 0.30 0.30 0.29 200 XMGappySubj_02 1105 0.23 0.09 0.29 ----------------------------------------------------------------------