Email: 352068 Autolearn: 0 AvgScore: 2.99 AvgScanTime: 2.13 sec Spam: 108323 Autolearn: 0 AvgScore: 12.60 AvgScanTime: 2.47 sec Ham: 243745 Autolearn: 0 AvgScore: -1.28 AvgScanTime: 1.97 sec Time Spent Running SA: 208.11 hours Time Spent Processing Spam: 74.44 hours Time Spent Processing Ham: 133.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 98792 87.28 91.20 85.53 2 DKIM_SIGNED 87160 77.53 80.46 76.23 3 XM_DK_Pass 85747 76.47 79.16 75.27 4 DCC_CHECK 83170 54.12 76.78 44.05 5 DKIM_VALID 81793 73.23 75.51 72.21 6 XMListUnsubscribeExists 76936 58.89 71.02 53.50 7 DKIM_VALID_AU 68308 58.22 63.06 56.07 8 XM_DK_Undo_02 57482 30.80 53.07 20.91 9 BAYES_99 52190 28.28 48.18 19.43 10 XM_H_QuotedFrom 47785 39.94 44.11 38.09 11 BAYES_999 45087 25.03 41.62 17.66 12 TR_DCC_Bayes_99 43495 19.53 40.15 10.36 13 HTML_FONT_LOW_CONTRAST 39818 32.86 36.76 31.13 14 LOC_TINY_FONT_1 38786 28.90 35.81 25.82 15 MIME_HTML_ONLY 36289 25.61 33.50 22.10 16 BAYES_50 32524 43.90 30.03 50.06 17 FVGT_m_MULTI_ODD 27132 22.95 25.05 22.02 18 XMSubLong 26006 22.39 24.01 21.68 19 DCC_CHECK_NEGATIVE 23288 44.59 21.50 54.85 20 XM_Body_Dirty_Words 22734 14.82 20.99 12.08 21 BOTNET 22093 7.81 20.40 2.22 22 DKIM_VALID_EF 20993 27.17 19.38 30.63 23 T_KAM_HTML_FONT_INVALID 20991 16.86 19.38 15.75 24 T_TM2_M_HEADER_IN_MSG 18038 23.67 16.65 26.79 25 RELAYCOUNTRY_META 17700 10.41 16.34 7.77 26 HTML_IMAGE_RATIO_02 17307 11.44 15.98 9.42 27 LOTS_OF_MONEY 16132 11.27 14.89 9.66 28 XM_Multi_Part_URI 15602 14.09 14.40 13.96 29 XM_Evil_Numbers_Gen 14516 10.09 13.40 8.61 30 MultiRelay 14391 14.15 13.29 14.54 31 XMSexyCombo_05 13286 6.62 12.27 4.12 32 BOTNET_IPINHOSTNAME 13096 8.69 12.09 7.18 33 UNTRUSTED_Relay 10864 6.48 10.03 4.90 34 XM_UncommonTLD01 10415 5.79 9.61 4.09 35 HTML_IMAGE_RATIO_04 9940 6.78 9.18 5.71 36 RCVD_IN_RP_RNBL 9754 2.80 9.00 0.05 37 TooManyTo_001 9439 9.40 8.71 9.70 38 MPART_ALT_DIFF 9265 4.88 8.55 3.24 39 FSL_BULK_SIG 9150 7.81 8.45 7.53 40 T_XMDrugObfuBody_14 8884 7.78 8.20 7.59 41 XMSubMetaSx_00 8607 6.25 7.95 5.50 42 FROM_EXCESS_BASE64 8561 5.33 7.90 4.19 43 XM_H_Long_From01 8151 6.75 7.52 6.40 44 BAYES_60 7183 6.24 6.63 6.06 45 RCVD_IN_PSBL 6980 2.05 6.44 0.10 46 BAYES_80 6813 4.77 6.29 4.10 47 RCVD_IN_RP_SAFE 6284 11.79 5.80 14.45 48 LotsOfNums_01 6210 6.85 5.73 7.34 49 ANY_BOUNCE_MESSAGE 5827 3.30 5.38 2.37 50 BOUNCE_MESSAGE 5827 3.30 5.38 2.37 51 FROM_SUSPICIOUS_NTLD 5651 1.62 5.22 0.03 52 XM_B_Phish_Phrases 5622 6.31 5.19 6.81 53 HTML_IMAGE_RATIO_06 5588 3.88 5.16 3.31 54 XM_UB50 5520 4.59 5.10 4.36 55 DKIM_INVALID 5367 4.31 4.95 4.02 56 XMBdyGiftCard01 5338 2.44 4.93 1.33 57 MIME_HTML_MOSTLY 5308 3.27 4.90 2.55 58 MIME_HTML_ONLY_MULTI 5223 2.66 4.82 1.71 59 RCVD_IN_RP_CERTIFIED 4587 9.94 4.23 12.48 60 XM_DIRTYINTL 4490 2.60 4.15 1.91 61 URI_HEX 4426 2.45 4.09 1.73 62 RELAYCOUNTRY_CA 4170 2.23 3.85 1.52 63 BAYES_95 4159 3.26 3.84 3.00 64 SpammyFromTLD_02 4146 1.33 3.83 0.22 65 XMStrtUSub 4132 4.53 3.81 4.86 66 XM_SendGrid 3977 5.17 3.67 5.84 67 HTML_IMAGE_RATIO_08 3952 2.68 3.65 2.25 68 XM_SPF_SoftFail 3707 2.06 3.42 1.46 69 XM_CamelCaseFrm001 3631 2.31 3.35 1.85 70 XMNumbers 3487 3.06 3.22 2.99 71 TR_Mismatch_TLD_02 3178 0.95 2.93 0.07 72 T_TooManySym_01 3163 5.77 2.92 7.04 73 T_REMOTE_IMAGE 3014 3.16 2.78 3.32 74 XM_H_TOP 2997 0.85 2.77 0.00 75 XMBody_17 2931 1.30 2.71 0.68 76 DKIM_ADSP_NXDOMAIN 2903 1.27 2.68 0.65 77 TR_M_TOP_BAYES 2890 0.82 2.67 0.00 78 XMSexyCombo_01 2867 1.51 2.65 1.01 79 ALL_TRUSTED 2860 11.37 2.64 15.24 80 MIME_QP_LONG_LINE 2850 3.95 2.63 4.54 81 MIME_HEADER_CTYPE_ONLY 2799 1.06 2.58 0.38 82 RCVD_IN_MSPIKE_H2 2785 3.91 2.57 4.51 83 TM2_M_URI_OPT_OUT 2773 1.82 2.56 1.50 84 DATE_IN_PAST_03_06 2569 0.79 2.37 0.09 85 LongTLD 2543 0.81 2.35 0.13 86 XM_OfRef6 2528 1.70 2.33 1.42 87 HTML_MIME_NO_HTML_TAG 2417 2.09 2.23 2.02 88 T_HTML_TAG_BALANCE_CENTER 2416 0.77 2.23 0.12 89 UNPARSEABLE_RELAY 2305 3.85 2.13 4.62 90 MultiRelay_Combo 2204 0.70 2.03 0.11 91 MultiRelay_CC 2204 0.70 2.03 0.11 92 XMSubMetaI_00 2175 1.22 2.01 0.86 93 HTML_TAG_BALANCE_BODY 2151 0.92 1.99 0.45 94 XMDiploma_00 2138 1.46 1.97 1.24 95 NO_DNS_FOR_FROM 2122 1.53 1.96 1.34 96 XM_ProductURIs 2115 1.28 1.95 0.98 97 MISSING_HEADERS 2078 0.79 1.92 0.28 98 T_XMDrugObfuBody_08 2077 1.41 1.92 1.19 99 BOTNET_NORDNS 2075 0.60 1.92 0.01 100 URI_TRY_3LD 2055 1.69 1.90 1.60 101 XM_UB60 2009 0.67 1.85 0.15 102 XM_URI_RBL 2008 1.06 1.85 0.70 103 REPLYTO_WITHOUT_TO_CC 1974 0.58 1.82 0.02 104 BAYES_40 1936 2.56 1.79 2.90 105 SUBJ_ALL_CAPS 1876 1.75 1.73 1.76 106 TR_LOTS_OF_MONEY1 1871 0.54 1.73 0.02 107 NUMERIC_HTTP_ADDR 1831 0.77 1.69 0.36 108 MONEY_FRAUD_5 1828 0.52 1.69 0.00 109 XMSubNoVowel 1808 0.66 1.67 0.21 110 XMReplyNow 1808 0.57 1.67 0.08 111 XM_RXBody 1768 0.86 1.63 0.52 112 BAYES_20 1705 1.99 1.57 2.18 113 URIBL_RHS_DOB 1689 0.54 1.56 0.09 114 XMSubEmpty 1682 0.61 1.55 0.20 115 PLING_QUERY 1674 0.82 1.55 0.50 116 RELAYCOUNTRY_DE 1669 0.66 1.54 0.27 117 XMPhish30 1664 0.84 1.54 0.53 118 ADVANCE_FEE_4_NEW_MONEY 1642 0.47 1.52 0.00 119 BASE64_LENGTH_79_INF 1637 0.69 1.51 0.32 120 SpammyFromTLD_01 1632 0.78 1.51 0.46 121 RELAYCOUNTRY_CN 1615 0.48 1.49 0.03 122 XM_salutation2 1592 0.91 1.47 0.66 123 TO_NO_BRKTS_HTML_IMG 1577 0.50 1.46 0.07 124 RCVD_IN_BL_SPAMCOP_NET 1565 0.59 1.44 0.20 125 NORMAL_HTTP_TO_IP 1562 0.50 1.44 0.08 126 RCVD_IN_IADB_LISTED 1561 3.70 1.44 4.70 127 HTML_FONT_SIZE_LARGE 1557 0.57 1.44 0.18 128 TR_Symld_Words 1554 2.04 1.43 2.31 129 SUBJ_DOLLARS 1496 1.04 1.38 0.89 130 XM_UB99 1463 0.44 1.35 0.03 131 TM2_M_VERY_LONG_WORD 1453 1.07 1.34 0.95 132 XM_B_REG_HTML 1448 0.90 1.34 0.71 133 XMSexyCombo_04 1439 0.79 1.33 0.55 134 BODY_ENHANCEMENT 1423 0.44 1.31 0.05 135 T_FILL_THIS_FORM_SHORT 1420 0.93 1.31 0.77 136 T_XMHurry_00 1386 1.02 1.28 0.90 137 T_HTML_ATTACH 1384 0.50 1.28 0.16 138 XMHTMLBadTable_001 1377 0.75 1.27 0.52 139 XM_H_PHPOS 1373 1.10 1.27 1.03 140 XMStockSpam_06 1355 0.99 1.25 0.87 141 HTML_EXTRA_CLOSE 1340 0.43 1.24 0.07 142 LONG_JUNK_URI 1338 0.43 1.24 0.07 143 XM_H_Long_From02 1306 3.45 1.21 4.44 144 MAILING_LIST_MULTI 1305 1.49 1.20 1.61 145 XMGenDplmaNmb 1296 0.75 1.20 0.56 146 TVD_SPACE_RATIO_MINFP 1280 0.37 1.18 0.00 147 URIBL_BLACK 1272 0.41 1.17 0.07 148 RCVD_IN_IADB_SPF 1260 3.22 1.16 4.14 149 DIET_1 1259 0.65 1.16 0.43 150 XMBrknScrpt_02 1216 0.75 1.12 0.59 151 RELAYCOUNTRY_AT 1203 0.52 1.11 0.26 152 XMPhish11 1189 1.03 1.10 1.00 153 TR_XM_RelayPhish 1180 0.66 1.09 0.46 154 XMSubMetaSxObfu_03 1179 0.61 1.09 0.39 155 HTML_FONT_FACE_BAD 1174 0.75 1.08 0.61 156 MPART_ALT_DIFF_COUNT 1155 0.43 1.07 0.15 157 FILL_THIS_FORM 1143 0.65 1.06 0.46 158 XM_UB999 1136 0.34 1.05 0.03 159 RCVD_IN_IADB_SENDERID 1124 2.86 1.04 3.67 160 FILL_THIS_FORM_LONG 1092 0.60 1.01 0.41 161 RCVD_IN_IADB_DK 1088 2.79 1.00 3.58 162 HK_RANDOM_FROM 1066 0.39 0.98 0.12 163 RCVD_IN_IADB_VOUCHED 1050 2.42 0.97 3.06 164 DKIM_ADSP_CUSTOM_MED 1050 0.88 0.97 0.83 165 INVALID_DATE 1039 0.37 0.96 0.11 166 XMSubject_48 1030 0.43 0.95 0.20 167 RELAYCOUNTRY_FI 1030 0.32 0.95 0.04 168 T_TooManySym_02 1013 1.85 0.94 2.25 169 XMSlimDrugH 1009 0.53 0.93 0.35 170 NML_ADSP_CUSTOM_MED 1003 0.66 0.93 0.54 171 XMMoneyMeta_00 981 0.49 0.91 0.30 172 HTML_IMAGE_ONLY_28 964 0.43 0.89 0.22 173 XMSubMetaSSx_00 956 0.39 0.88 0.18 174 TR_Caps_n_Bayes_99 911 0.42 0.84 0.23 175 RELAYCOUNTRY_FR 907 0.38 0.84 0.18 176 XMHTML_After_End 901 0.56 0.83 0.43 177 RELAYCOUNTRY_IN 892 0.29 0.82 0.05 178 FORGED_GMAIL_RCVD 890 0.55 0.82 0.44 179 DATE_IN_PAST_06_12 880 0.28 0.81 0.04 180 HTML_IMAGE_ONLY_20 877 0.41 0.81 0.24 181 T_MONEY_PERCENT 869 0.38 0.80 0.19 182 TR_LOTS_OF_MONEY2 869 0.38 0.80 0.19 183 BAYES_05 857 1.15 0.79 1.31 184 XM_B_COPY_HTML 847 0.78 0.78 0.78 185 NORDNS_LOW_CONTRAST 839 0.24 0.77 0.00 186 URI_NOVOWEL 836 0.56 0.77 0.47 187 TR_LOTS_OF_MONEY3 835 0.46 0.77 0.33 188 XMBody_78 827 0.61 0.76 0.55 189 RELAYCOUNTRY_GB 826 0.61 0.76 0.54 190 XM_ShortIntro_01 824 0.42 0.76 0.27 191 XM_UB80 812 0.25 0.75 0.03 192 FILL_THIS_FORM_LOAN 808 0.50 0.75 0.39 193 TR_XM_FormFill 805 0.25 0.74 0.03 194 XM_H_PHPMailer 795 0.72 0.73 0.71 195 RCVD_IN_IADB_OPTIN 792 1.52 0.73 1.87 196 HTML_IMAGE_ONLY_24 734 0.37 0.68 0.24 197 FSL_THIS_IS_ADV 732 0.28 0.68 0.10 198 BODY_URI_ONLY 731 0.23 0.67 0.03 199 T_Symld_Words_02 724 0.58 0.67 0.55 200 XM_HighProb1 690 0.20 0.64 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 208476 87.28 91.20 85.53 2 DKIM_SIGNED 185806 77.53 80.46 76.23 3 XM_DK_Pass 183463 76.47 79.16 75.27 4 DKIM_VALID 176016 73.23 75.51 72.21 5 DKIM_VALID_AU 136667 58.22 63.06 56.07 6 DCC_CHECK_NEGATIVE 133706 44.59 21.50 54.85 7 XMListUnsubscribeExists 130404 58.89 71.02 53.50 8 BAYES_50 122017 43.90 30.03 50.06 9 DCC_CHECK 107381 54.12 76.78 44.05 10 XM_H_QuotedFrom 92845 39.94 44.11 38.09 11 HTML_FONT_LOW_CONTRAST 75876 32.86 36.76 31.13 12 DKIM_VALID_EF 74656 27.17 19.38 30.63 13 T_TM2_M_HEADER_IN_MSG 65298 23.67 16.65 26.79 14 LOC_TINY_FONT_1 62945 28.90 35.81 25.82 15 MIME_HTML_ONLY 53874 25.61 33.50 22.10 16 FVGT_m_MULTI_ODD 53668 22.95 25.05 22.02 17 XMSubLong 52835 22.39 24.01 21.68 18 XM_DK_Undo_02 50956 30.80 53.07 20.91 19 BAYES_99 47358 28.28 48.18 19.43 20 BAYES_999 43051 25.03 41.62 17.66 21 T_KAM_HTML_FONT_INVALID 38383 16.86 19.38 15.75 22 XM_DKIMWhitelistDomains 38046 10.82 0.03 15.61 23 ALL_TRUSTED 37157 11.37 2.64 15.24 24 MultiRelay 35440 14.15 13.29 14.54 25 RCVD_IN_RP_SAFE 35225 11.79 5.80 14.45 26 XM_Multi_Part_URI 34017 14.09 14.40 13.96 27 RCVD_IN_RP_CERTIFIED 30417 9.94 4.23 12.48 28 XM_Body_Dirty_Words 29456 14.82 20.99 12.08 29 BAYES_00 25315 7.37 0.60 10.39 30 TR_DCC_Bayes_99 25249 19.53 40.15 10.36 31 TooManyTo_001 23645 9.40 8.71 9.70 32 LOTS_OF_MONEY 23549 11.27 14.89 9.66 33 HTML_IMAGE_RATIO_02 22969 11.44 15.98 9.42 34 TR_XM_DK_Bayes 22129 6.41 0.39 9.08 35 TR_XM_DK_Bayes1 21288 6.15 0.34 8.73 36 XM_Evil_Numbers_Gen 20993 10.09 13.40 8.61 37 TR_XM_DK_Bayes2 19123 5.52 0.29 7.85 38 RELAYCOUNTRY_META 18940 10.41 16.34 7.77 39 T_XMDrugObfuBody_14 18495 7.78 8.20 7.59 40 FSL_BULK_SIG 18360 7.81 8.45 7.53 41 LotsOfNums_01 17893 6.85 5.73 7.34 42 BOTNET_IPINHOSTNAME 17512 8.69 12.09 7.18 43 T_TooManySym_01 17156 5.77 2.92 7.04 44 XM_B_Phish_Phrases 16608 6.31 5.19 6.81 45 XM_H_Long_From01 15598 6.75 7.52 6.40 46 BAYES_60 14770 6.24 6.63 6.06 47 XM_SendGrid 14223 5.17 3.67 5.84 48 HTML_IMAGE_RATIO_04 13924 6.78 9.18 5.71 49 XMSubMetaSx_00 13410 6.25 7.95 5.50 50 TO_MALFORMED 12263 3.49 0.03 5.03 51 UNTRUSTED_Relay 11939 6.48 10.03 4.90 52 XMStrtUSub 11834 4.53 3.81 4.86 53 RCVD_IN_IADB_LISTED 11459 3.70 1.44 4.70 54 UNPARSEABLE_RELAY 11249 3.85 2.13 4.62 55 MIME_QP_LONG_LINE 11065 3.95 2.63 4.54 56 RCVD_IN_MSPIKE_H2 10987 3.91 2.57 4.51 57 XM_H_Long_From02 10828 3.45 1.21 4.44 58 XM_UB50 10639 4.59 5.10 4.36 59 TVD_RCVD_IP 10468 3.09 0.38 4.29 60 FROM_EXCESS_BASE64 10211 5.33 7.90 4.19 61 RCVD_IN_IADB_SPF 10090 3.22 1.16 4.14 62 XMSexyCombo_05 10036 6.62 12.27 4.12 63 BAYES_80 9987 4.77 6.29 4.10 64 XM_UncommonTLD01 9967 5.79 9.61 4.09 65 DKIM_INVALID 9790 4.31 4.95 4.02 66 IN_ZIMBRA_NJ_WHITELIST 9749 2.77 0.01 4.00 67 RELAYCOUNTRY_PH 8956 2.55 0.01 3.67 68 RCVD_IN_IADB_SENDERID 8944 2.86 1.04 3.67 69 RCVD_IN_IADB_DK 8725 2.79 1.00 3.58 70 T_REMOTE_IMAGE 8096 3.16 2.78 3.32 71 HTML_IMAGE_RATIO_06 8067 3.88 5.16 3.31 72 MPART_ALT_DIFF 7906 4.88 8.55 3.24 73 RCVD_IN_IADB_VOUCHED 7455 2.42 0.97 3.06 74 BAYES_95 7322 3.26 3.84 3.00 75 XMNumbers 7294 3.06 3.22 2.99 76 BAYES_40 7062 2.56 1.79 2.90 77 INVALID_MSGID 6930 1.99 0.08 2.84 78 XM_PDF 6466 1.91 0.24 2.65 79 MIME_HTML_MOSTLY 6212 3.27 4.90 2.55 80 RCVD_IN_MSPIKE_WL 6186 1.92 0.52 2.54 81 RCVD_IN_MSPIKE_H3 6160 1.91 0.52 2.53 82 ANY_BOUNCE_MESSAGE 5779 3.30 5.38 2.37 83 BOUNCE_MESSAGE 5779 3.30 5.38 2.37 84 TR_MetaPhish_Combo_01 5729 1.74 0.38 2.35 85 TR_Symld_Words 5639 2.04 1.43 2.31 86 T_TooManySym_02 5485 1.85 0.94 2.25 87 HTML_IMAGE_RATIO_08 5477 2.68 3.65 2.25 88 BOTNET 5400 7.81 20.40 2.22 89 BAYES_20 5303 1.99 1.57 2.18 90 USER_IN_DEF_DKIM_WL 5202 1.57 0.31 2.13 91 IN_HORDE_ADDRESS_BOOK 4996 1.43 0.02 2.05 92 HTML_MIME_NO_HTML_TAG 4928 2.09 2.23 2.02 93 XM_DIRTYINTL 4667 2.60 4.15 1.91 94 RCVD_IN_IADB_OPTIN 4554 1.52 0.73 1.87 95 XM_CamelCaseFrm001 4512 2.31 3.35 1.85 96 SUBJ_ALL_CAPS 4287 1.75 1.73 1.76 97 URI_HEX 4206 2.45 4.09 1.73 98 MIME_HTML_ONLY_MULTI 4159 2.66 4.82 1.71 99 MAILING_LIST_MULTI 3935 1.49 1.20 1.61 100 URI_TRY_3LD 3909 1.69 1.90 1.60 101 XM_DK_Undo_01 3784 1.22 0.46 1.55 102 RELAYCOUNTRY_CA 3693 2.23 3.85 1.52 103 TM2_M_URI_OPT_OUT 3648 1.82 2.56 1.50 104 XM_SPF_SoftFail 3557 2.06 3.42 1.46 105 XM_OfRef6 3449 1.70 2.33 1.42 106 NO_DNS_FOR_FROM 3268 1.53 1.96 1.34 107 XMBdyGiftCard01 3248 2.44 4.93 1.33 108 BAYES_05 3204 1.15 0.79 1.31 109 XMDiploma_00 3013 1.46 1.97 1.24 110 T_XMDrugObfuBody_08 2889 1.41 1.92 1.19 111 XM_GoogleGroups 2778 0.92 0.43 1.14 112 TooManyTo_002 2691 0.91 0.48 1.10 113 XMBody_95 2593 0.77 0.10 1.06 114 XM_H_PHPOS 2499 1.10 1.27 1.03 115 XMSexyCombo_01 2454 1.51 2.65 1.01 116 XMPhish11 2432 1.03 1.10 1.00 117 XM_ProductURIs 2385 1.28 1.95 0.98 118 TM2_M_VERY_LONG_WORD 2307 1.07 1.34 0.95 119 T_XMHurry_00 2205 1.02 1.28 0.90 120 TM2_M_A_HREF_HREF 2184 0.72 0.33 0.90 121 SUBJ_DOLLARS 2177 1.04 1.38 0.89 122 T_XMDrugObfuBody_00 2151 0.80 0.60 0.88 123 XMStockSpam_06 2132 0.99 1.25 0.87 124 USER_IN_WHITELIST 2120 0.60 0.00 0.87 125 XMSubMetaI_00 2107 1.22 2.01 0.86 126 XMSubMetaSxObfu_02 2068 0.71 0.40 0.85 127 DKIM_ADSP_CUSTOM_MED 2035 0.88 0.97 0.83 128 T_TooManySym_03 1962 0.58 0.08 0.80 129 XM_B_COPY_HTML 1894 0.78 0.78 0.78 130 TooManyTo_003 1872 0.66 0.41 0.77 131 T_FILL_THIS_FORM_SHORT 1865 0.93 1.31 0.77 132 XM_H_PHPMailer 1729 0.72 0.73 0.71 133 XM_B_REG_HTML 1722 0.90 1.34 0.71 134 XM_URI_RBL 1717 1.06 1.85 0.70 135 XM_D_tchamptons_WL 1655 0.47 0.00 0.68 136 XMBody_17 1651 1.30 2.71 0.68 137 XM_salutation2 1610 0.91 1.47 0.66 138 DKIM_ADSP_NXDOMAIN 1584 1.27 2.68 0.65 139 RDNS_DYNAMIC 1573 0.63 0.61 0.65 140 TooManyTo_004 1529 0.53 0.32 0.63 141 HTML_FONT_FACE_BAD 1475 0.75 1.08 0.61 142 XMBrknScrpt_02 1431 0.75 1.12 0.59 143 XMGenDplmaNmb 1361 0.75 1.20 0.56 144 XMSexyCombo_04 1352 0.79 1.33 0.55 145 XMBody_78 1332 0.61 0.76 0.55 146 T_Symld_Words_02 1331 0.58 0.67 0.55 147 T_OBFU_PDF_ATTACH 1318 0.39 0.04 0.54 148 NML_ADSP_CUSTOM_MED 1306 0.66 0.93 0.54 149 RELAYCOUNTRY_GB 1306 0.61 0.76 0.54 150 TooManyTo_005 1298 0.45 0.26 0.53 151 XMPhish30 1294 0.84 1.54 0.53 152 XM_RXBody 1261 0.86 1.63 0.52 153 XMHTMLBadTable_001 1261 0.75 1.27 0.52 154 PLING_QUERY 1224 0.82 1.55 0.50 155 XM_H_PHPOS_M 1175 0.50 0.53 0.48 156 REMOVE_BEFORE_LINK 1150 0.48 0.51 0.47 157 URI_NOVOWEL 1150 0.56 0.77 0.47 158 HELO_NODOT 1142 0.43 0.35 0.47 159 HELO_NO_DOMAIN 1141 0.43 0.35 0.47 160 FILL_THIS_FORM 1133 0.65 1.06 0.46 161 TR_XM_RelayPhish 1130 0.66 1.09 0.46 162 XM_shorewaves_Whitelist 1127 0.32 0.00 0.46 163 SpammyFromTLD_01 1123 0.78 1.51 0.46 164 HTML_TAG_BALANCE_BODY 1099 0.92 1.99 0.45 165 RELAYCOUNTRY_AU 1071 0.42 0.36 0.44 166 FORGED_GMAIL_RCVD 1061 0.55 0.82 0.44 167 XMHTML_After_End 1053 0.56 0.83 0.43 168 HTTPS_HTTP_MISMATCH 1051 0.40 0.34 0.43 169 DIET_1 1037 0.65 1.16 0.43 170 XMLngstWrd_00 1032 0.37 0.26 0.42 171 FILL_THIS_FORM_LONG 1003 0.60 1.01 0.41 172 T_TooManySym_04 970 0.28 0.01 0.40 173 FILL_THIS_FORM_LOAN 956 0.50 0.75 0.39 174 XMSubMetaSxObfu_03 953 0.61 1.09 0.39 175 XMLngstWrd_01 939 0.34 0.22 0.39 176 MIME_HEADER_CTYPE_ONLY 927 1.06 2.58 0.38 177 XMCapTrack 915 0.40 0.45 0.38 178 NUMERIC_HTTP_ADDR 884 0.77 1.69 0.36 179 THIS_AD 878 0.42 0.55 0.36 180 XMNoVowels 872 0.43 0.60 0.36 181 XM_Akamai 869 0.25 0.01 0.36 182 XMSlimDrugH 858 0.53 0.93 0.35 183 FROM_GOV_SPOOF 853 0.25 0.04 0.35 184 XM_Doc_Oz_Body 798 0.26 0.09 0.33 185 TR_LOTS_OF_MONEY3 798 0.46 0.77 0.33 186 HTML_IMAGE_ONLY_32 791 0.40 0.56 0.32 187 BASE64_LENGTH_79_INF 789 0.69 1.51 0.32 188 XMDateMe_00 787 0.28 0.17 0.32 189 XMRcvdHeader_15 776 0.22 0.00 0.32 190 XMSolicitRefs_0 764 0.28 0.22 0.31 191 XMBSHREFv2 763 0.25 0.11 0.31 192 XMMoneyMeta_00 741 0.49 0.91 0.30 193 UPPERCASE_75_100 738 0.21 0.02 0.30 194 HTML_IMAGE_ONLY_16 734 0.27 0.20 0.30 195 FROM_GOV_DKIM_AU 700 0.21 0.03 0.29 196 MISSING_HEADERS 691 0.79 1.92 0.28 197 HTML_IMAGE_ONLY_12 675 0.33 0.46 0.28 198 XMSUPPORT 673 0.19 0.00 0.28 199 TR_MetaPhish_Combo_01b 671 0.21 0.07 0.28 200 XMPhish14 656 0.35 0.54 0.27 ----------------------------------------------------------------------