Email: 583793 Autolearn: 0 AvgScore: 4.12 AvgScanTime: 3.55 sec Spam: 189511 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 4.26 sec Ham: 394282 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 3.20 sec Time Spent Running SA: 575.05 hours Time Spent Processing Spam: 224.07 hours Time Spent Processing Ham: 350.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 181542 88.24 95.79 84.61 2 DKIM_SIGNED 148639 69.52 78.43 65.24 3 XM_DK_Pass 145313 68.13 76.68 64.03 4 DCC_CHECK 143818 44.54 75.89 29.47 5 DKIM_VALID 137300 63.53 72.45 59.24 6 XMListUnsubscribeExists 128420 48.88 67.76 39.80 7 DKIM_VALID_AU 106848 46.22 56.38 41.34 8 XM_H_QuotedFrom 96479 37.77 50.91 31.45 9 XM_DK_Undo_02 86159 22.86 45.46 11.99 10 BAYES_99 79450 21.41 41.92 11.55 11 BAYES_999 67062 18.34 35.39 10.15 12 MIME_HTML_ONLY 66308 23.37 34.99 17.79 13 HTML_FONT_LOW_CONTRAST 65544 26.54 34.59 22.67 14 LOC_TINY_FONT_1 61872 22.39 32.65 17.47 15 TR_DCC_Bayes_99 61061 14.06 32.22 5.33 16 BAYES_50 56198 49.83 29.65 59.52 17 XMSubLong 47768 22.15 25.21 20.68 18 FVGT_m_MULTI_ODD 46990 20.65 24.80 18.65 19 RELAYCOUNTRY_META 43016 10.73 22.70 4.98 20 DCC_CHECK_NEGATIVE 41942 53.36 22.13 68.38 21 DKIM_VALID_EF 40611 24.26 21.43 25.62 22 T_TM2_M_HEADER_IN_MSG 40483 29.24 21.36 33.03 23 T_KAM_HTML_FONT_INVALID 36238 15.35 19.12 13.54 24 XM_Body_Dirty_Words 36009 13.34 19.00 10.62 25 UNTRUSTED_Relay 31710 6.22 16.73 1.16 26 XM_Multi_Part_URI 31178 11.77 16.45 9.52 27 MultiRelay 30587 18.65 16.14 19.86 28 HTML_IMAGE_RATIO_02 27418 8.43 14.47 5.53 29 XM_Evil_Numbers_Gen 26835 9.66 14.16 7.50 30 FSL_BULK_SIG 26441 8.88 13.95 6.44 31 BOTNET 22528 4.54 11.89 1.00 32 BOTNET_IPINHOSTNAME 22527 6.75 11.89 4.28 33 FROM_EXCESS_BASE64 22048 5.69 11.63 2.83 34 LOTS_OF_MONEY 20442 8.88 10.79 7.96 35 T_REMOTE_IMAGE 19779 6.20 10.44 4.17 36 XMSexyCombo_05 18919 5.84 9.98 3.84 37 T_XMDrugObfuBody_14 18367 8.87 9.69 8.47 38 BAYES_80 18095 5.59 9.55 3.69 39 HTML_MIME_NO_HTML_TAG 17299 4.59 9.13 2.41 40 XM_B_Phish_Phrases 15453 5.34 8.15 3.98 41 HTML_IMAGE_RATIO_04 15166 5.47 8.00 4.26 42 XM_H_Long_From01 15002 5.97 7.92 5.03 43 LotsOfNums_01 14929 7.69 7.88 7.60 44 TR_XM_DocInvoice 14776 4.98 7.80 3.62 45 BODY_URI_ONLY 14723 2.56 7.77 0.06 46 MISSING_HEADERS 14251 2.95 7.52 0.75 47 XMNumbers 14241 4.74 7.51 3.41 48 XM_UncommonTLD01 13991 4.76 7.38 3.51 49 TooManyTo_001 13429 9.00 7.09 9.92 50 BAYES_95 13418 4.04 7.08 2.58 51 BAYES_60 13357 6.55 7.05 6.31 52 MPART_ALT_DIFF 12642 3.73 6.67 2.31 53 HTML_SHORT_LINK_IMG_1 12194 3.00 6.43 1.35 54 RELAYCOUNTRY_DE 12186 2.42 6.43 0.49 55 XMSubMetaSx_00 11398 4.54 6.01 3.84 56 DKIM_INVALID 11339 5.99 5.98 5.99 57 URI_BUFFLY 11145 2.79 5.88 1.31 58 RCVD_IN_RP_SAFE 9646 6.23 5.09 6.78 59 XMStrtUSub 9575 4.05 5.05 3.56 60 HTML_IMAGE_ONLY_08 9506 2.34 5.02 1.06 61 TM2_M_URI_OPT_OUT 9185 3.51 4.85 2.87 62 XM_UB50 9049 2.06 4.77 0.76 63 XM_SPF_SoftFail 8886 3.06 4.69 2.27 64 HTML_IMAGE_RATIO_06 8858 3.52 4.67 2.97 65 MIME_HEADER_CTYPE_ONLY 8824 1.62 4.66 0.16 66 XM_DIRTYINTL 8747 2.72 4.62 1.80 67 RCVD_IN_RP_CERTIFIED 7530 5.41 3.97 6.10 68 MIME_HTML_MOSTLY 7443 2.77 3.93 2.22 69 MultiRelay_Combo 7133 1.37 3.76 0.22 70 MultiRelay_CC 7133 1.37 3.76 0.22 71 MIME_QP_LONG_LINE 7049 5.28 3.72 6.04 72 XM_SendGrid 6739 4.63 3.56 5.15 73 URI_HEX 6607 2.10 3.49 1.43 74 T_TooManySym_01 6582 3.81 3.47 3.97 75 HTML_IMAGE_RATIO_08 6399 2.36 3.38 1.87 76 XM_CamelCaseFrm001 6238 2.14 3.29 1.59 77 XM_OfRef6 6216 2.28 3.28 1.80 78 MIME_HTML_ONLY_MULTI 5960 1.64 3.14 0.92 79 RCVD_IN_MSPIKE_H2 5957 4.16 3.14 4.65 80 RCVD_IN_BL_SPAMCOP_NET 5929 1.27 3.13 0.38 81 SpammyFromTLD_02 5752 1.12 3.04 0.20 82 XM_UB95 5615 0.98 2.96 0.02 83 XM_UB80 5606 0.98 2.96 0.03 84 RELAYCOUNTRY_CA 5353 1.73 2.82 1.21 85 RCVD_IN_RP_RNBL 4817 0.84 2.54 0.03 86 T_XMDrugObfuBody_08 4668 1.74 2.46 1.39 87 XM_UB60 4582 0.83 2.42 0.07 88 T_HTML_TAG_BALANCE_CENTER 4299 1.09 2.27 0.53 89 XMNoVowels 4191 2.41 2.21 2.50 90 XM_UB99 4174 0.72 2.20 0.01 91 XMDiploma_00 4109 1.77 2.17 1.58 92 XM_URI_RBL 4101 0.81 2.16 0.15 93 RCVD_IN_IADB_LISTED 3925 4.16 2.07 5.16 94 MAILING_LIST_MULTI 3711 2.37 1.96 2.56 95 SUBJ_ALL_CAPS 3658 1.57 1.93 1.40 96 XMSubMetaI_00 3610 1.11 1.90 0.72 97 T_XMDrugObfuBody_00 3608 1.07 1.90 0.66 98 RCVD_IN_IADB_SPF 3471 3.67 1.83 4.55 99 BOTNET_NORDNS 3442 0.60 1.82 0.02 100 RELAYCOUNTRY_FR 3338 0.78 1.76 0.30 101 RCVD_IN_IADB_SENDERID 3303 3.28 1.74 4.03 102 URI_TRY_3LD 3290 1.20 1.74 0.95 103 XMBdyGiftCard01 3274 1.02 1.73 0.69 104 RCVD_IN_IADB_DK 3251 3.21 1.72 3.92 105 HTML_IMAGE_ONLY_04 3170 0.84 1.67 0.45 106 ALL_TRUSTED 3135 16.68 1.65 23.90 107 URIBL_BLACK 3053 0.57 1.61 0.07 108 XMStockSpam_06 2981 1.29 1.57 1.15 109 XM_H_Long_From02 2955 1.09 1.56 0.87 110 HTML_IMAGE_ONLY_16 2929 0.95 1.55 0.67 111 RELAYCOUNTRY_GB 2905 1.20 1.53 1.04 112 TM2_M_VERY_LONG_WORD 2886 1.09 1.52 0.88 113 XM_ProductURIs 2886 1.24 1.52 1.11 114 XMHTML_After_End 2867 0.74 1.51 0.37 115 DKIM_ADSP_CUSTOM_MED 2843 1.28 1.50 1.17 116 NO_DNS_FOR_FROM 2825 1.03 1.49 0.81 117 XMSexyCombo_01 2823 0.80 1.49 0.47 118 XMBrknScrpt_02 2814 0.80 1.48 0.48 119 XMBody_17 2766 0.72 1.46 0.37 120 TR_XM_RelayPhish 2765 0.81 1.46 0.49 121 T_XMHurry_00 2737 0.75 1.44 0.42 122 HTML_SHORT_LINK_IMG_2 2729 0.76 1.44 0.43 123 UNPARSEABLE_RELAY 2645 2.85 1.40 3.54 124 SpammyFromTLD_01 2642 0.94 1.39 0.72 125 BAYES_40 2628 3.21 1.39 4.08 126 FORGED_GMAIL_RCVD 2605 0.85 1.37 0.59 127 XM_DK_Undo_01 2569 1.83 1.36 2.05 128 XM_UB999 2560 0.44 1.35 0.01 129 TM2_M_A_HREF_HREF 2556 0.73 1.35 0.43 130 RELAYCOUNTRY_IT 2521 0.45 1.33 0.03 131 XMGenDplmaNmb 2511 1.13 1.32 1.03 132 RELAYCOUNTRY_NL 2486 0.58 1.31 0.22 133 XMPhish30 2439 0.59 1.29 0.26 134 BAYES_00 2401 5.58 1.27 7.65 135 NML_ADSP_CUSTOM_MED 2390 0.94 1.26 0.78 136 XMPhish14 2385 0.63 1.26 0.33 137 URIBL_DBL_SPAM 2345 0.43 1.24 0.05 138 DIET_1 2313 0.93 1.22 0.80 139 XMPhish11 2280 1.27 1.20 1.30 140 BAYES_20 2170 2.25 1.15 2.77 141 RELAYCOUNTRY_CN 2162 0.42 1.14 0.07 142 TR_Symld_Words 2140 1.67 1.13 1.93 143 RELAYCOUNTRY_ZA 2107 0.38 1.11 0.03 144 ANY_BOUNCE_MESSAGE 2099 5.08 1.11 6.99 145 BOUNCE_MESSAGE 2097 5.08 1.11 6.99 146 T_FILL_THIS_FORM_SHORT 2091 1.10 1.10 1.09 147 TooManyTo_002 2075 3.02 1.09 3.95 148 XMBody_78 2024 0.59 1.07 0.36 149 TR_Mismatch_TLD_02 2007 0.38 1.06 0.05 150 XMLongAddy 1957 0.42 1.03 0.13 151 RELAYCOUNTRY_AT 1916 0.41 1.01 0.12 152 HTML_TAG_BALANCE_BODY 1913 0.54 1.01 0.31 153 XM_B_REG_HTML 1913 0.65 1.01 0.48 154 XM_BadFromFormat 1911 0.49 1.01 0.24 155 XMSubMetaSSx_00 1908 0.50 1.01 0.26 156 XM_H_PHPOS 1898 1.51 1.00 1.76 157 XMSlimDrugH 1889 0.53 1.00 0.31 158 TooManyTo_003 1875 2.33 0.99 2.97 159 XMMoneyMeta_00 1860 0.64 0.98 0.47 160 RCVD_IN_IADB_VOUCHED 1852 2.67 0.98 3.49 161 XM_S_JOY_D 1842 0.44 0.97 0.19 162 REMOVE_BEFORE_LINK 1800 0.47 0.95 0.25 163 XM_PDF 1793 3.71 0.95 5.04 164 XM_HighProb1 1770 0.33 0.93 0.04 165 BAYES_05 1761 1.51 0.93 1.79 166 XM_RXBody 1744 0.35 0.92 0.08 167 FILL_THIS_FORM 1714 0.66 0.90 0.54 168 RDNS_DYNAMIC 1706 0.57 0.90 0.41 169 HTTPS_HTTP_MISMATCH 1677 0.62 0.88 0.50 170 MPART_ALT_DIFF_COUNT 1657 1.00 0.87 1.06 171 TR_XM_DK_Bayes 1632 3.36 0.86 4.57 172 TVD_SPACE_RATIO_MINFP 1631 0.28 0.86 0.01 173 BODY_ENHANCEMENT 1606 0.29 0.85 0.03 174 T_FILL_THIS_FORM_LONG 1583 0.56 0.84 0.42 175 TR_LOTS_OF_MONEY2 1578 0.43 0.83 0.24 176 T_MONEY_PERCENT 1578 0.43 0.83 0.24 177 XM_B_COPY_HTML 1554 0.56 0.82 0.44 178 TR_XM_DK_Bayes1 1524 2.95 0.80 3.98 179 T_TooManySym_02 1522 1.36 0.80 1.63 180 DKIM_ADSP_NXDOMAIN 1511 0.50 0.80 0.35 181 SUBJ_DOLLARS 1511 0.36 0.80 0.15 182 KHOP_DYNAMIC 1506 0.77 0.79 0.76 183 TR_XM_DK_Bayes2 1482 2.33 0.78 3.08 184 XMHTMLBadTable_001 1461 0.46 0.77 0.32 185 LongTLD 1429 0.35 0.75 0.15 186 PLING_QUERY 1426 0.40 0.75 0.24 187 HTML_FONT_FACE_BAD 1423 0.51 0.75 0.39 188 T_Symld_Words_02 1383 0.48 0.73 0.37 189 XM_H_Long_From03 1379 0.32 0.73 0.13 190 GAPPY_SUBJECT 1372 0.32 0.72 0.12 191 TR_Caps_n_Bayes_99 1362 0.25 0.72 0.02 192 URI_NOVOWEL 1362 0.55 0.72 0.47 193 XM_Body_Obfu01 1353 0.42 0.71 0.28 194 LOW_PRICE 1353 0.41 0.71 0.26 195 XM_H_PHPMailer 1286 0.69 0.68 0.70 196 RCVD_IN_MSPIKE_WL 1269 1.53 0.67 1.94 197 SHORTENED_URL_SRC 1269 0.24 0.67 0.04 198 SHORTENER_SHORT_IMG 1260 0.24 0.66 0.04 199 RCVD_IN_MSPIKE_H3 1248 1.53 0.66 1.94 200 XM_OfRef7 1244 0.40 0.66 0.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 333584 88.24 95.79 84.61 2 DCC_CHECK_NEGATIVE 269594 53.36 22.13 68.38 3 DKIM_SIGNED 257216 69.52 78.43 65.24 4 XM_DK_Pass 252449 68.13 76.68 64.03 5 BAYES_50 234677 49.83 29.65 59.52 6 DKIM_VALID 233581 63.53 72.45 59.24 7 DKIM_VALID_AU 162995 46.22 56.38 41.34 8 XMListUnsubscribeExists 156941 48.88 67.76 39.80 9 T_TM2_M_HEADER_IN_MSG 130212 29.24 21.36 33.03 10 XM_H_QuotedFrom 124011 37.77 50.91 31.45 11 DCC_CHECK 116178 44.54 75.89 29.47 12 DKIM_VALID_EF 101018 24.26 21.43 25.62 13 ALL_TRUSTED 94223 16.68 1.65 23.90 14 HTML_FONT_LOW_CONTRAST 89371 26.54 34.59 22.67 15 XMSubLong 81525 22.15 25.21 20.68 16 MultiRelay 78285 18.65 16.14 19.86 17 FVGT_m_MULTI_ODD 73551 20.65 24.80 18.65 18 MIME_HTML_ONLY 70128 23.37 34.99 17.79 19 LOC_TINY_FONT_1 68867 22.39 32.65 17.47 20 T_KAM_HTML_FONT_INVALID 53384 15.35 19.12 13.54 21 XM_DK_Undo_02 47292 22.86 45.46 11.99 22 BAYES_99 45553 21.41 41.92 11.55 23 XM_Body_Dirty_Words 41869 13.34 19.00 10.62 24 BAYES_999 40008 18.34 35.39 10.15 25 TooManyTo_001 39099 9.00 7.09 9.92 26 XM_Multi_Part_URI 37528 11.77 16.45 9.52 27 XM_DKIMWhitelistDomains 36061 6.21 0.10 9.15 28 T_XMDrugObfuBody_14 33404 8.87 9.69 8.47 29 LOTS_OF_MONEY 31372 8.88 10.79 7.96 30 BAYES_00 30162 5.58 1.27 7.65 31 LotsOfNums_01 29946 7.69 7.88 7.60 32 XM_Evil_Numbers_Gen 29576 9.66 14.16 7.50 33 ANY_BOUNCE_MESSAGE 27549 5.08 1.11 6.99 34 BOUNCE_MESSAGE 27545 5.08 1.11 6.99 35 RCVD_IN_RP_SAFE 26717 6.23 5.09 6.78 36 FSL_BULK_SIG 25400 8.88 13.95 6.44 37 BAYES_60 24895 6.55 7.05 6.31 38 RCVD_IN_RP_CERTIFIED 24045 5.41 3.97 6.10 39 MIME_QP_LONG_LINE 23798 5.28 3.72 6.04 40 DKIM_INVALID 23635 5.99 5.98 5.99 41 HTML_IMAGE_RATIO_02 21799 8.43 14.47 5.53 42 IN_ZIMBRA_NJ_WHITELIST 21350 3.67 0.03 5.41 43 TR_DCC_Bayes_99 21032 14.06 32.22 5.33 44 RCVD_IN_IADB_LISTED 20352 4.16 2.07 5.16 45 XM_SendGrid 20308 4.63 3.56 5.15 46 XM_PDF 19856 3.71 0.95 5.04 47 XM_H_Long_From01 19835 5.97 7.92 5.03 48 RELAYCOUNTRY_META 19627 10.73 22.70 4.98 49 RCVD_IN_MSPIKE_H2 18340 4.16 3.14 4.65 50 TR_XM_DK_Bayes 18005 3.36 0.86 4.57 51 RCVD_IN_IADB_SPF 17944 3.67 1.83 4.55 52 BOTNET_IPINHOSTNAME 16863 6.75 11.89 4.28 53 HTML_IMAGE_RATIO_04 16794 5.47 8.00 4.26 54 T_REMOTE_IMAGE 16436 6.20 10.44 4.17 55 BAYES_40 16091 3.21 1.39 4.08 56 RCVD_IN_IADB_SENDERID 15872 3.28 1.74 4.03 57 XM_B_Phish_Phrases 15696 5.34 8.15 3.98 58 TR_XM_DK_Bayes1 15679 2.95 0.80 3.98 59 T_TooManySym_01 15638 3.81 3.47 3.97 60 TooManyTo_002 15571 3.02 1.09 3.95 61 RCVD_IN_IADB_DK 15469 3.21 1.72 3.92 62 XMSexyCombo_05 15148 5.84 9.98 3.84 63 XMSubMetaSx_00 15134 4.54 6.01 3.84 64 BAYES_80 14545 5.59 9.55 3.69 65 TR_XM_DocInvoice 14282 4.98 7.80 3.62 66 XMStrtUSub 14052 4.05 5.05 3.56 67 UNPARSEABLE_RELAY 13971 2.85 1.40 3.54 68 XM_UncommonTLD01 13823 4.76 7.38 3.51 69 RCVD_IN_IADB_VOUCHED 13747 2.67 0.98 3.49 70 XMNumbers 13430 4.74 7.51 3.41 71 TVD_RCVD_IP 13188 2.39 0.42 3.34 72 TR_XM_DK_Bayes2 12129 2.33 0.78 3.08 73 TooManyTo_003 11724 2.33 0.99 2.97 74 HTML_IMAGE_RATIO_06 11719 3.52 4.67 2.97 75 TM2_M_URI_OPT_OUT 11330 3.51 4.85 2.87 76 FROM_EXCESS_BASE64 11161 5.69 11.63 2.83 77 BAYES_20 10938 2.25 1.15 2.77 78 HELO_NODOT 10253 1.88 0.37 2.60 79 BAYES_95 10178 4.04 7.08 2.58 80 MAILING_LIST_MULTI 10098 2.37 1.96 2.56 81 XMNoVowels 9863 2.41 2.21 2.50 82 HTML_MIME_NO_HTML_TAG 9498 4.59 9.13 2.41 83 MPART_ALT_DIFF 9110 3.73 6.67 2.31 84 XM_SPF_SoftFail 8950 3.06 4.69 2.27 85 MIME_HTML_MOSTLY 8745 2.77 3.93 2.22 86 RCVD_IN_IADB_OPTIN 8678 1.68 0.60 2.20 87 IN_HORDE_ADDRESS_BOOK 8281 1.44 0.06 2.10 88 XM_DK_Undo_01 8092 1.83 1.36 2.05 89 RCVD_IN_MSPIKE_WL 7668 1.53 0.67 1.94 90 RCVD_IN_MSPIKE_H3 7663 1.53 0.66 1.94 91 TR_Symld_Words 7606 1.67 1.13 1.93 92 HTML_IMAGE_RATIO_08 7354 2.36 3.38 1.87 93 XMCapTrack 7238 1.43 0.58 1.84 94 XM_OfRef6 7111 2.28 3.28 1.80 95 XM_DIRTYINTL 7110 2.72 4.62 1.80 96 BAYES_05 7040 1.51 0.93 1.79 97 XM_H_PHPOS 6939 1.51 1.00 1.76 98 INVALID_MSGID 6920 1.23 0.14 1.76 99 TO_MALFORMED 6515 1.13 0.04 1.65 100 T_TooManySym_02 6425 1.36 0.80 1.63 101 XM_CamelCaseFrm001 6282 2.14 3.29 1.59 102 XMDiploma_00 6227 1.77 2.17 1.58 103 TooManyTo_004 6133 1.24 0.60 1.56 104 URI_HEX 5636 2.10 3.49 1.43 105 SUBJ_ALL_CAPS 5508 1.57 1.93 1.40 106 T_XMDrugObfuBody_08 5485 1.74 2.46 1.39 107 XM_GoogleGroups 5358 1.07 0.47 1.36 108 HTML_SHORT_LINK_IMG_1 5314 3.00 6.43 1.35 109 USER_IN_DEF_DKIM_WL 5302 0.91 0.01 1.34 110 URI_BUFFLY 5171 2.79 5.88 1.31 111 TooManyTo_005 5160 1.05 0.51 1.31 112 XMPhish11 5122 1.27 1.20 1.30 113 RELAYCOUNTRY_CA 4769 1.73 2.82 1.21 114 DKIM_ADSP_CUSTOM_MED 4607 1.28 1.50 1.17 115 UNTRUSTED_Relay 4583 6.22 16.73 1.16 116 XMStockSpam_06 4542 1.29 1.57 1.15 117 XM_ProductURIs 4369 1.24 1.52 1.11 118 XMLngstWrd_00 4349 0.86 0.35 1.10 119 T_FILL_THIS_FORM_SHORT 4303 1.10 1.10 1.09 120 MPART_ALT_DIFF_COUNT 4187 1.00 0.87 1.06 121 HTML_IMAGE_ONLY_08 4181 2.34 5.02 1.06 122 RELAYCOUNTRY_GB 4120 1.20 1.53 1.04 123 XMGenDplmaNmb 4079 1.13 1.32 1.03 124 BOTNET 3957 4.54 11.89 1.00 125 XMLngstWrd_01 3886 0.77 0.32 0.99 126 URI_TRY_3LD 3743 1.20 1.74 0.95 127 MIME_HTML_ONLY_MULTI 3631 1.64 3.14 0.92 128 TM2_M_VERY_LONG_WORD 3451 1.09 1.52 0.88 129 XM_H_Long_From02 3435 1.09 1.56 0.87 130 XM_ShortIntro_01 3411 0.69 0.33 0.87 131 XMSolicitRefs_0 3194 0.65 0.32 0.81 132 NO_DNS_FOR_FROM 3188 1.03 1.49 0.81 133 TR_MetaPhish_Combo_01 3155 0.75 0.64 0.80 134 DIET_1 3145 0.93 1.22 0.80 135 NML_ADSP_CUSTOM_MED 3094 0.94 1.26 0.78 136 XM_UB50 3001 2.06 4.77 0.76 137 KHOP_DYNAMIC 2983 0.77 0.79 0.76 138 MISSING_HEADERS 2974 2.95 7.52 0.75 139 USER_IN_WHITELIST 2964 0.51 0.00 0.75 140 T_TooManySym_03 2881 0.55 0.17 0.73 141 SpammyFromTLD_01 2854 0.94 1.39 0.72 142 XMSubMetaI_00 2852 1.11 1.90 0.72 143 XMGappySubj_01 2847 0.60 0.35 0.72 144 XM_H_PHPMailer 2749 0.69 0.68 0.70 145 XMBdyGiftCard01 2708 1.02 1.73 0.69 146 HTML_IMAGE_ONLY_16 2635 0.95 1.55 0.67 147 T_OBFU_PDF_ATTACH 2621 0.52 0.23 0.66 148 T_XMDrugObfuBody_00 2614 1.07 1.90 0.66 149 SHORT_HELO_AND_INLINE_IMAGE 2597 0.48 0.10 0.66 150 FORGED_GMAIL_RCVD 2340 0.85 1.37 0.59 151 RCVD_IN_SORBS_DUL 2339 0.52 0.36 0.59 152 TO_NO_BRKTS_HTML_ONLY 2253 0.44 0.15 0.57 153 XMBody_95 2225 0.42 0.12 0.56 154 FILL_THIS_FORM 2134 0.66 0.90 0.54 155 T_MANY_PILL_PRICE 2095 0.36 0.00 0.53 156 XMSubMetaSxObfu_02 2082 0.44 0.27 0.53 157 T_HTML_TAG_BALANCE_CENTER 2074 1.09 2.27 0.53 158 HTML_IMAGE_ONLY_32 2013 0.51 0.50 0.51 159 XMDateMe_00 1968 0.46 0.37 0.50 160 HTTPS_HTTP_MISMATCH 1953 0.62 0.88 0.50 161 TR_XM_RelayPhish 1947 0.81 1.46 0.49 162 RELAYCOUNTRY_DE 1943 2.42 6.43 0.49 163 TM2_M_BODY_EMPTY 1932 0.49 0.48 0.49 164 XM_B_REG_HTML 1888 0.65 1.01 0.48 165 XMBrknScrpt_02 1884 0.80 1.48 0.48 166 XMMoneyMeta_00 1861 0.64 0.98 0.47 167 XMSexyCombo_01 1858 0.80 1.49 0.47 168 XM_H_PHPOS_M 1851 0.43 0.36 0.47 169 URI_NOVOWEL 1850 0.55 0.72 0.47 170 HTML_IMAGE_ONLY_20 1820 0.48 0.52 0.46 171 TR_Mismatch_TLD_01 1775 0.37 0.20 0.45 172 AC_DIV_BONANZA 1761 0.33 0.09 0.45 173 HTML_IMAGE_ONLY_04 1759 0.84 1.67 0.45 174 XM_B_COPY_HTML 1735 0.56 0.82 0.44 175 HTML_SHORT_LINK_IMG_2 1709 0.76 1.44 0.43 176 XMLngstWrd_02 1709 0.38 0.28 0.43 177 TM2_M_A_HREF_HREF 1697 0.73 1.35 0.43 178 T_FILL_THIS_FORM_LONG 1670 0.56 0.84 0.42 179 RELAYCOUNTRY_AU 1660 0.47 0.57 0.42 180 T_XMHurry_00 1637 0.75 1.44 0.42 181 HTML_IMAGE_ONLY_28 1616 0.47 0.59 0.41 182 RDNS_DYNAMIC 1605 0.57 0.90 0.41 183 HTML_IMAGE_ONLY_24 1585 0.42 0.44 0.40 184 XMSubNoVowel 1554 0.42 0.47 0.39 185 XMLKML 1548 0.27 0.00 0.39 186 HTML_FONT_FACE_BAD 1544 0.51 0.75 0.39 187 RCVD_IN_BL_SPAMCOP_NET 1504 1.27 3.13 0.38 188 TVD_SPACE_RATIO 1498 0.36 0.32 0.38 189 XMBody_17 1446 0.72 1.46 0.37 190 XMHTML_After_End 1443 0.74 1.51 0.37 191 T_Symld_Words_02 1442 0.48 0.73 0.37 192 XMBody_78 1433 0.59 1.07 0.36 193 DKIM_ADSP_NXDOMAIN 1387 0.50 0.80 0.35 194 FILL_THIS_FORM_LOAN 1385 0.40 0.51 0.35 195 T_TooManySym_04 1338 0.23 0.02 0.34 196 XMPhish14 1320 0.63 1.26 0.33 197 XMSubEmpty 1288 0.33 0.32 0.33 198 XMGappySubj_02 1278 0.24 0.07 0.32 199 HTML_IMAGE_ONLY_12 1266 0.29 0.23 0.32 200 DOS_OUTLOOK_TO_MX 1262 0.25 0.11 0.32 ----------------------------------------------------------------------