Email: 611 Autolearn: 0 AvgScore: -0.65 AvgScanTime: 2.02 sec Spam: 58 Autolearn: 0 AvgScore: 12.53 AvgScanTime: 2.78 sec Ham: 553 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 1.94 sec Time Spent Running SA: 0.34 hours Time Spent Processing Spam: 0.04 hours Time Spent Processing Ham: 0.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 53 74.14 91.38 72.33 2 T_SCC_BODY_TEXT_LINE 48 82.00 82.76 81.92 3 XM_B_Unicode 48 68.90 82.76 67.45 4 DKIM_SIGNED 43 29.62 74.14 24.95 5 DKIM_VALID 42 28.81 72.41 24.23 6 XM_DK_Pass 42 28.81 72.41 24.23 7 RELAYCOUNTRY_US 39 40.59 67.24 37.79 8 DCC_CHECK_NEGATIVE 37 92.96 63.79 96.02 9 XMListUnsubscribeExists 31 19.15 53.45 15.55 10 LOC_TINY_FONT_1 31 17.84 53.45 14.10 11 BAYES_50 30 49.10 51.72 48.82 12 XM_B_SpammyWords 29 16.04 50.00 12.48 13 HTML_FONT_LOW_CONTRAST 26 17.02 44.83 14.10 14 DKIM_VALID_AU 26 22.42 44.83 20.07 15 XM_B_Unicode3 24 56.96 41.38 58.59 16 XM_DK_Undo_02 21 4.26 36.21 0.90 17 XM_Multi_Part_URI 21 7.36 36.21 4.34 18 DCC_CHECK 21 7.04 36.21 3.98 19 FVGT_m_MULTI_ODD 19 20.62 32.76 19.35 20 XMSubLong 17 8.18 29.31 5.97 21 T_TM2_M_HEADER_IN_MSG 16 10.15 27.59 8.32 22 BOTNET_IPINHOSTNAME 14 3.76 24.14 1.63 23 T_KAM_HTML_FONT_INVALID 14 7.69 24.14 5.97 24 TR_XM_DKIM_Undo 14 2.29 24.14 0.00 25 BOTNET 13 2.29 22.41 0.18 26 UNPARSEABLE_RELAY 13 6.22 22.41 4.52 27 XM_B_SpammyWords2 13 5.07 22.41 3.25 28 RELAYCOUNTRY_META 12 6.71 20.69 5.24 29 LOTS_OF_MONEY 12 3.11 20.69 1.27 30 XM_B_SpammyTLD 11 4.26 18.97 2.71 31 TR_XM_SpammyWords4 11 2.29 18.97 0.54 32 RCVD_IN_MSPIKE_H2 11 4.75 18.97 3.25 33 MIME_HTML_ONLY 10 14.40 17.24 14.10 34 DKIM_VALID_EF 10 11.29 17.24 10.67 35 TR_XM_SpammyRelay 9 2.62 15.52 1.27 36 XM_B_Unsub 9 5.56 15.52 4.52 37 ALL_TRUSTED 9 53.68 15.52 57.69 38 TR_XM_UnparsRelay 9 2.45 15.52 1.08 39 UNTRUSTED_Relay 8 3.60 13.79 2.53 40 XM_Body_Dirty_Words 8 4.42 13.79 3.44 41 XM_UncommonTLD01 8 3.27 13.79 2.17 42 XM_SPF_SoftFail 8 3.27 13.79 2.17 43 TR_XM_BayesUnsub 8 4.26 13.79 3.25 44 RCVD_IN_BL_SPAMCOP_NET 7 1.15 12.07 0.00 45 BAYES_99 7 33.06 12.07 35.26 46 BAYES_60 7 4.75 12.07 3.98 47 MIME_HTML_MOSTLY 7 4.42 12.07 3.62 48 BAYES_80 7 2.78 12.07 1.81 49 HTML_IMAGE_RATIO_06 6 3.60 10.34 2.89 50 FSL_BULK_SIG 6 1.80 10.34 0.90 51 TooManyTo_001 6 3.76 10.34 3.07 52 BAYES_999 5 32.41 8.62 34.90 53 TR_XM_SPAMCOP 5 0.82 8.62 0.00 54 XM_B_Phish_Phrases 5 1.15 8.62 0.36 55 RELAYCOUNTRY_AT 5 2.13 8.62 1.45 56 BAYES_95 4 1.31 6.90 0.72 57 SHORT_URI_3 4 1.80 6.90 1.27 58 XM_B_Investor 4 1.15 6.90 0.54 59 FORGED_GMAIL_RCVD 4 0.65 6.90 0.00 60 XM_UB50 4 1.15 6.90 0.54 61 TR_XM_RelayPhish 4 0.82 6.90 0.18 62 DKIM_ADSP_CUSTOM_MED 4 0.65 6.90 0.00 63 XM_DIRTYINTL 4 0.82 6.90 0.18 64 SpammyFromTLD_01 4 0.65 6.90 0.00 65 XM_B_SpammyWords3 4 1.15 6.90 0.54 66 NML_ADSP_CUSTOM_MED 4 0.65 6.90 0.00 67 XM_Evil_Numbers_Gen 4 1.47 6.90 0.90 68 XMSexyCombo_05 4 0.65 6.90 0.00 69 TR_XM_DK_Unsub 4 5.56 6.90 5.42 70 TM2_M_URI_OPT_OUT 4 5.73 6.90 5.61 71 XM_H_Long_From01 4 1.47 6.90 0.90 72 TR_XM_MaxWHORU 3 0.49 5.17 0.00 73 T_XMDrugObfuBody_14 3 1.15 5.17 0.72 74 TR_XM_SpammyWords2 3 0.49 5.17 0.00 75 NO_DNS_FOR_FROM 3 0.49 5.17 0.00 76 TM2_M_VERY_LONG_WORD 3 1.47 5.17 1.08 77 XMSubMetaSx_00 3 1.80 5.17 1.45 78 XM_H_PHPMailer 3 0.65 5.17 0.18 79 PDS_OTHER_BAD_TLD 3 0.49 5.17 0.00 80 MPART_ALT_DIFF 3 10.15 5.17 10.67 81 URIBL_DBL_SPAM 3 0.49 5.17 0.00 82 DIET_1 3 0.82 5.17 0.36 83 TooManyTo_003 2 0.49 3.45 0.18 84 TR_XM_DK_Bayes 2 2.62 3.45 2.53 85 DOS_RCVD_IP_TWICE_B 2 0.33 3.45 0.00 86 TooManyTo_002 2 0.49 3.45 0.18 87 SpammyFromTLD_02 2 0.49 3.45 0.18 88 XMSubPhish11 2 0.49 3.45 0.18 89 T_US_DOLLARS_3 2 0.33 3.45 0.00 90 FROM_EXCESS_BASE64 2 0.49 3.45 0.18 91 XM_ShortIntro_01 2 0.98 3.45 0.72 92 XM_H_PHPOS 2 0.33 3.45 0.00 93 TR_XM_SpammyWords5 2 0.98 3.45 0.72 94 HTML_IMAGE_RATIO_02 2 1.47 3.45 1.27 95 TR_Mismatch_TLD_02 2 0.33 3.45 0.00 96 XM_Lotto 2 0.33 3.45 0.00 97 XMStockSpam_06 2 0.33 3.45 0.00 98 TR_XM_FormFill2 2 0.33 3.45 0.00 99 TR_XM_PHPDW 2 0.33 3.45 0.00 100 BAYES_00 2 3.76 3.45 3.80 101 XMBody_17 2 0.82 3.45 0.54 102 TR_XM_SB_Phish 2 0.49 3.45 0.18 103 TR_XM_DK_Bayes1 2 2.62 3.45 2.53 104 XMBody_03 2 0.49 3.45 0.18 105 RCVD_IN_VALIDITY_SAFE 2 1.31 3.45 1.08 106 RELAYCOUNTRY_CA 2 1.31 3.45 1.08 107 RCVD_IN_VALIDITY_CERTIFIED 2 1.15 3.45 0.90 108 TR_MetaPhish_Combo_01 2 0.33 3.45 0.00 109 XM_ProductURIs 2 5.07 3.45 5.24 110 XMNumbers 2 2.13 3.45 1.99 111 FORGED_RELAY_MUA_TO_MX 2 0.49 3.45 0.18 112 TooManyTo_004 2 0.49 3.45 0.18 113 TR_XM_PHPForged 2 0.33 3.45 0.00 114 DRUGS_ANXIETY 1 0.16 1.72 0.00 115 RDNS_DYNAMIC 1 0.16 1.72 0.00 116 MIME_HTML_ONLY_MULTI 1 7.36 1.72 7.96 117 XMLngstWrd_03 1 0.33 1.72 0.18 118 DEAR_FRIEND 1 0.16 1.72 0.00 119 TR_XM_SEO4 1 0.16 1.72 0.00 120 XM_SendGrid 1 0.82 1.72 0.72 121 XM_Body_Dirty_Words_01 1 0.33 1.72 0.18 122 XM_B_SEO 1 0.16 1.72 0.00 123 RELAYCOUNTRY_AU 1 1.15 1.72 1.08 124 RCVD_IN_RP_SAFE 1 0.33 1.72 0.18 125 XMSolicitRefs_5 1 0.16 1.72 0.00 126 TooManyTo_005 1 0.16 1.72 0.00 127 TR_XM_Base64_L1 1 0.16 1.72 0.00 128 XMStrtUSub 1 1.31 1.72 1.27 129 T_Symld_Words_02 1 0.16 1.72 0.00 130 XM_UB99 1 0.16 1.72 0.00 131 PDS_PHPEXP_BOT 1 0.16 1.72 0.00 132 BOUNCE_MESSAGE 1 46.81 1.72 51.54 133 T_MONEY_PERCENT 1 0.16 1.72 0.00 134 FSL_HELO_NON_FQDN_1 1 0.16 1.72 0.00 135 HTML_IMAGE_RATIO_04 1 1.31 1.72 1.27 136 XMBrknScrpt_02 1 0.33 1.72 0.18 137 UNDISC_MONEY 1 0.16 1.72 0.00 138 LONG_JUNK_URI2 1 0.16 1.72 0.00 139 XMLngstWrd_02 1 2.13 1.72 2.17 140 PDS_PHP_EVAL 1 0.16 1.72 0.00 141 T_TooManySym_01 1 1.64 1.72 1.63 142 XM_DK_Undo_01 1 0.65 1.72 0.54 143 XM_H_Undi_Recip 1 0.49 1.72 0.36 144 FROM_GOV_SPOOF 1 0.49 1.72 0.36 145 XMLngstWrd_00 1 5.07 1.72 5.42 146 XM_B_DNDMA 1 0.16 1.72 0.00 147 DKIM_INVALID 1 0.82 1.72 0.72 148 RELAYCOUNTRY_BD 1 0.49 1.72 0.36 149 URI_TRUNCATED 1 0.16 1.72 0.00 150 XM_UB999 1 0.16 1.72 0.00 151 TR_XM_DK_Bayes2 1 1.96 1.72 1.99 152 HTTP_EXCESSIVE_ESCAPES 1 0.16 1.72 0.00 153 XMSolicitRefs_4 1 0.16 1.72 0.00 154 HELO_NO_DOMAIN 1 0.16 1.72 0.00 155 TR_DCC_Bayes_99 1 0.16 1.72 0.00 156 MONEY_FRAUD_8 1 0.16 1.72 0.00 157 RELAYCOUNTRY_FR 1 0.16 1.72 0.00 158 XMLngstWrd_01 1 3.44 1.72 3.62 159 XMClaimOffer 1 0.16 1.72 0.00 160 XMEqualsVooDoo_02 1 0.16 1.72 0.00 161 XMSubject_70 1 0.16 1.72 0.00 162 XM_H_PHPOS_E 1 0.16 1.72 0.00 163 RCVD_IN_MSPIKE_WL 1 2.45 1.72 2.53 164 XM_OfRef6 1 0.49 1.72 0.36 165 BAYES_20 1 2.95 1.72 3.07 166 XMSubLongNoVowel 1 0.33 1.72 0.18 167 XMSolicitRefs_0 1 0.16 1.72 0.00 168 TR_XM_InvalidRelay 1 0.16 1.72 0.00 169 TR_XM_Undi_Recip11 1 0.16 1.72 0.00 170 LOADSA_MONEY_COMBO 1 0.16 1.72 0.00 171 XM_B_Phish66 1 0.33 1.72 0.18 172 XM_CamelCaseFrm001 1 0.49 1.72 0.36 173 TR_LOTS_OF_MONEY2 1 0.16 1.72 0.00 174 PHP_ORIG_SCRIPT_EVAL 1 0.16 1.72 0.00 175 EXCLAMACION_ES 1 0.16 1.72 0.00 176 XM_Dr_From 1 0.49 1.72 0.36 177 XM_H_PHPOS_M 1 0.16 1.72 0.00 178 TR_XM_Undi_RecipCombo2 1 0.16 1.72 0.00 179 URI_NOVOWEL 1 0.33 1.72 0.18 180 RCVD_IN_RP_CERTIFIED 1 0.33 1.72 0.18 181 TR_XM_Undi_Recip5 1 0.16 1.72 0.00 182 XMCmmnCold 1 0.16 1.72 0.00 183 DATE_IN_PAST_06_12 1 0.16 1.72 0.00 184 OBFU_TEXT_ATTACH 1 0.16 1.72 0.00 185 HELO_NODOT 1 0.16 1.72 0.00 186 MONEY_NOHTML 1 0.33 1.72 0.18 187 URIBL_BLACK 1 0.16 1.72 0.00 188 XMEqualsVooDoo_00 1 0.16 1.72 0.00 189 XFER_LOTSA_MONEY 1 0.16 1.72 0.00 190 PDS_RDNS_DYNAMIC_FP 1 0.16 1.72 0.00 191 XMMoneyMeta_00 1 0.49 1.72 0.36 192 T_TooManySym_02 1 1.31 1.72 1.27 193 BOTNET_NORDNS 1 0.16 1.72 0.00 194 TR_XM_PhishingBody 1 0.33 1.72 0.18 195 RELAYCOUNTRY_CN 1 0.33 1.72 0.18 196 XMHTMLBadTable_001 1 0.33 1.72 0.18 197 PRICES_ARE_AFFORDABLE 1 0.16 1.72 0.00 198 RELAYCOUNTRY_PL 1 0.16 1.72 0.00 199 PDS_LITECOIN_ID 1 0.16 1.72 0.00 200 XMEqualsVooDoo_01 1 0.16 1.72 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 531 92.96 63.79 96.02 2 T_SCC_BODY_TEXT_LINE 453 82.00 82.76 81.92 3 HTML_MESSAGE 400 74.14 91.38 72.33 4 XM_B_Unicode 373 68.90 82.76 67.45 5 XM_B_Unicode3 324 56.96 41.38 58.59 6 ALL_TRUSTED 319 53.68 15.52 57.69 7 ANY_BOUNCE_MESSAGE 285 46.81 1.72 51.54 8 BOUNCE_MESSAGE 285 46.81 1.72 51.54 9 BAYES_50 270 49.10 51.72 48.82 10 RELAYCOUNTRY_US 209 40.59 67.24 37.79 11 BAYES_99 195 33.06 12.07 35.26 12 BAYES_999 193 32.41 8.62 34.90 13 DKIM_SIGNED 138 29.62 74.14 24.95 14 XM_DK_Pass 134 28.81 72.41 24.23 15 DKIM_VALID 134 28.81 72.41 24.23 16 DKIM_VALID_AU 111 22.42 44.83 20.07 17 FVGT_m_MULTI_ODD 107 20.62 32.76 19.35 18 XM_H_Trusted_IP 92 15.06 0.00 16.64 19 SCC_BODY_URI_ONLY 91 14.89 0.00 16.46 20 XMListUnsubscribeExists 86 19.15 53.45 15.55 21 LOC_TINY_FONT_1 78 17.84 53.45 14.10 22 HTML_FONT_LOW_CONTRAST 78 17.02 44.83 14.10 23 MIME_HTML_ONLY 78 14.40 17.24 14.10 24 XMSubNoVowel 77 12.77 1.72 13.92 25 XM_B_SpammyWords 69 16.04 50.00 12.48 26 DKIM_VALID_EF 59 11.29 17.24 10.67 27 MPART_ALT_DIFF 59 10.15 5.17 10.67 28 T_TM2_M_HEADER_IN_MSG 46 10.15 27.59 8.32 29 MIME_HTML_ONLY_MULTI 44 7.36 1.72 7.96 30 T_KAM_HTML_FONT_INVALID 33 7.69 24.14 5.97 31 XMSubLong 33 8.18 29.31 5.97 32 TM2_M_URI_OPT_OUT 31 5.73 6.90 5.61 33 TR_XM_DK_Unsub 30 5.56 6.90 5.42 34 XMLngstWrd_00 30 5.07 1.72 5.42 35 XM_ProductURIs 29 5.07 3.45 5.24 36 RELAYCOUNTRY_META 29 6.71 20.69 5.24 37 UNPARSEABLE_RELAY 25 6.22 22.41 4.52 38 XM_B_Unsub 25 5.56 15.52 4.52 39 XM_Multi_Part_URI 24 7.36 36.21 4.34 40 XMBody_95 22 3.60 0.00 3.98 41 DCC_CHECK 22 7.04 36.21 3.98 42 BAYES_60 22 4.75 12.07 3.98 43 T_XMDrugObfuBody_08 21 3.44 0.00 3.80 44 BAYES_00 21 3.76 3.45 3.80 45 LotsOfNums_01 21 3.44 0.00 3.80 46 MIME_HTML_MOSTLY 20 4.42 12.07 3.62 47 XMSubGarbage 20 3.27 0.00 3.62 48 XM_DKIMWhitelistDomains 20 3.27 0.00 3.62 49 XMLngstWrd_01 20 3.44 1.72 3.62 50 XM_Body_Dirty_Words 19 4.42 13.79 3.44 51 TR_XM_BayesUnsub 18 4.26 13.79 3.25 52 XM_B_SpammyWords2 18 5.07 22.41 3.25 53 RCVD_IN_MSPIKE_H2 18 4.75 18.97 3.25 54 BAYES_20 17 2.95 1.72 3.07 55 TooManyTo_001 17 3.76 10.34 3.07 56 HTML_IMAGE_RATIO_06 16 3.60 10.34 2.89 57 XM_B_SpammyTLD 15 4.26 18.97 2.71 58 TR_XM_DK_Bayes1 14 2.62 3.45 2.53 59 RCVD_IN_MSPIKE_WL 14 2.45 1.72 2.53 60 TR_XM_DK_Bayes 14 2.62 3.45 2.53 61 UNTRUSTED_Relay 14 3.60 13.79 2.53 62 BAYES_40 13 2.13 0.00 2.35 63 XM_SPF_SoftFail 12 3.27 13.79 2.17 64 XM_UncommonTLD01 12 3.27 13.79 2.17 65 XMLngstWrd_02 12 2.13 1.72 2.17 66 XMNumbers 11 2.13 3.45 1.99 67 TVD_SPACE_RATIO_MINFP 11 1.80 0.00 1.99 68 T_REMOTE_IMAGE 11 1.80 0.00 1.99 69 TR_XM_DK_Bayes2 11 1.96 1.72 1.99 70 BAYES_80 10 2.78 12.07 1.81 71 RCVD_IN_MSPIKE_H3 10 1.64 0.00 1.81 72 USER_IN_DEF_DKIM_WL 10 1.64 0.00 1.81 73 IN_ZIMBRA_NJ_WHITELIST 9 1.47 0.00 1.63 74 T_TooManySym_01 9 1.64 1.72 1.63 75 BOTNET_IPINHOSTNAME 9 3.76 24.14 1.63 76 XMSubMetaSx_00 8 1.80 5.17 1.45 77 RELAYCOUNTRY_AT 8 2.13 8.62 1.45 78 T_TooManySym_02 7 1.31 1.72 1.27 79 LOTS_OF_MONEY 7 3.11 20.69 1.27 80 HTML_IMAGE_RATIO_02 7 1.47 3.45 1.27 81 XMStrtUSub 7 1.31 1.72 1.27 82 SHORT_URI_3 7 1.80 6.90 1.27 83 TR_XM_SpammyRelay 7 2.62 15.52 1.27 84 MIME_QP_LONG_LINE 7 1.15 0.00 1.27 85 HTML_IMAGE_RATIO_04 7 1.31 1.72 1.27 86 USER_IN_WHITELIST 6 0.98 0.00 1.08 87 INVALID_MSGID 6 1.15 1.72 1.08 88 USER_IN_WELCOMELIST 6 0.98 0.00 1.08 89 HTML_MIME_NO_HTML_TAG 6 0.98 0.00 1.08 90 TR_XM_UnparsRelay 6 2.45 15.52 1.08 91 TM2_M_VERY_LONG_WORD 6 1.47 5.17 1.08 92 RELAYCOUNTRY_CA 6 1.31 3.45 1.08 93 RCVD_IN_VALIDITY_SAFE 6 1.31 3.45 1.08 94 XM_GoogleGroups 6 0.98 0.00 1.08 95 RELAYCOUNTRY_AU 6 1.15 1.72 1.08 96 RCVD_IN_VALIDITY_CERTIFIED 5 1.15 3.45 0.90 97 XM_H_Long_From01 5 1.47 6.90 0.90 98 TR_Symld_Words 5 0.98 1.72 0.90 99 XM_B_Unsub2 5 0.82 0.00 0.90 100 RELAYCOUNTRY_GB 5 0.82 0.00 0.90 101 XM_Evil_Numbers_Gen 5 1.47 6.90 0.90 102 FSL_BULK_SIG 5 1.80 10.34 0.90 103 TO_MALFORMED 5 0.82 0.00 0.90 104 MAILING_LIST_MULTI 5 0.82 0.00 0.90 105 XM_DK_Undo_02 5 4.26 36.21 0.90 106 SHORTENED_URL_HREF 5 0.82 0.00 0.90 107 XM_ZIP 4 0.65 0.00 0.72 108 HTML_IMAGE_RATIO_08 4 0.65 0.00 0.72 109 RCVD_IN_MSPIKE_H4 4 0.82 1.72 0.72 110 XMBSHREFv2 4 0.65 0.00 0.72 111 XMEmptySub 4 0.65 0.00 0.72 112 T_XMDrugObfuBody_14 4 1.15 5.17 0.72 113 DKIM_INVALID 4 0.82 1.72 0.72 114 XM_ShortIntro_01 4 0.98 3.45 0.72 115 XMNoVowels 4 0.65 0.00 0.72 116 TR_XM_SpammyWords5 4 0.98 3.45 0.72 117 XM_SendGrid 4 0.82 1.72 0.72 118 BAYES_95 4 1.31 6.90 0.72 119 URI_OPTOUT_3LD 4 0.65 0.00 0.72 120 TVD_SPACE_RATIO 3 0.49 0.00 0.54 121 XM_PDF 3 0.49 0.00 0.54 122 MY_SERVERS_FOUND 3 0.49 0.00 0.54 123 XMBody_17 3 0.82 3.45 0.54 124 TR_XM_SpammyWords4 3 2.29 18.97 0.54 125 XMGappySubj_01 3 0.49 0.00 0.54 126 XM_DK_Undo_01 3 0.65 1.72 0.54 127 XM_B_SpammyWords3 3 1.15 6.90 0.54 128 XM_B_Investor 3 1.15 6.90 0.54 129 XM_UB50 3 1.15 6.90 0.54 130 TVD_RCVD_IP 3 0.49 0.00 0.54 131 XMManySubDom_06 2 0.33 0.00 0.36 132 IN_HORDE_ADDRESS_BOOK 2 0.33 0.00 0.36 133 XM_ZohoDesk1 2 0.33 0.00 0.36 134 XMMoneyMeta_00 2 0.49 1.72 0.36 135 DIET_1 2 0.82 5.17 0.36 136 OOOBOUNCE_MESSAGE 2 0.33 0.00 0.36 137 SUBJ_ALL_CAPS 2 0.33 0.00 0.36 138 NORDNS_LOW_CONTRAST 2 0.33 0.00 0.36 139 TR_XM_SpoofStaff 2 0.33 0.00 0.36 140 XM_Dr_From 2 0.49 1.72 0.36 141 HTML_IMAGE_ONLY_28 2 0.33 0.00 0.36 142 XM_CamelCaseFrm001 2 0.49 1.72 0.36 143 DEAR_SOMETHING 2 0.33 0.00 0.36 144 T_TooManySym_03 2 0.33 0.00 0.36 145 XM_B_Phish_Phrases 2 1.15 8.62 0.36 146 RELAYCOUNTRY_BD 2 0.49 1.72 0.36 147 TR_XM_SpoofPhishAttach 2 0.33 0.00 0.36 148 FROM_GOV_SPOOF 2 0.49 1.72 0.36 149 XM_H_Undi_Recip 2 0.49 1.72 0.36 150 XM_OfRef6 2 0.49 1.72 0.36 151 XM_H_SpoofStaff4 2 0.33 0.00 0.36 152 XMSpoofStaff2 2 0.33 0.00 0.36 153 XMSubMetaSxObfu_02 2 0.33 0.00 0.36 154 TR_XM_PSC1 2 0.33 0.00 0.36 155 RCVD_IN_IADB_LISTED 2 0.33 0.00 0.36 156 RELAYCOUNTRY_NO 2 0.33 0.00 0.36 157 RCVD_IN_IADB_DK 2 0.33 0.00 0.36 158 RCVD_IN_IADB_SENDERID 2 0.33 0.00 0.36 159 URI_HEX 2 0.33 0.00 0.36 160 TR_XM_DK_SendGrid 2 0.33 0.00 0.36 161 RCVD_IN_IADB_SPF 2 0.33 0.00 0.36 162 TR_Mismatch_TLD_01 2 0.33 0.00 0.36 163 RELAYCOUNTRY_UA 1 0.16 0.00 0.18 164 FROM_GOV_DKIM_AU 1 0.16 0.00 0.18 165 XM_H_PHPMailer 1 0.65 5.17 0.18 166 XM_Body_Obfu01 1 0.16 0.00 0.18 167 KHOP_HELO_FCRDNS 1 0.33 1.72 0.18 168 XMSubMetaI_00 1 0.16 0.00 0.18 169 FROM_LOCAL_HEX 1 0.16 0.00 0.18 170 XMHTMLBadTable_001 1 0.33 1.72 0.18 171 XM_B_FormFill 1 0.16 0.00 0.18 172 HTML_IMAGE_ONLY_20 1 0.16 0.00 0.18 173 XMSubMetaSxObfu_03 1 0.16 0.00 0.18 174 RELAYCOUNTRY_CN 1 0.33 1.72 0.18 175 MSGID_NOFQDN1 1 0.16 0.00 0.18 176 TR_XM_PhishingBody 1 0.33 1.72 0.18 177 BAYES_05 1 0.16 0.00 0.18 178 T_FILL_THIS_FORM_SHORT 1 0.16 0.00 0.18 179 GMD_PDF_SQUARE 1 0.16 0.00 0.18 180 XM_URI_RBL 1 0.16 0.00 0.18 181 URI_TRY_3LD 1 0.16 0.00 0.18 182 FROM_STARTS_WITH_NUMS 1 0.16 0.00 0.18 183 TooManyTo_004 1 0.49 3.45 0.18 184 TR_XM_NoHeaderRelay 1 0.33 1.72 0.18 185 CTE_8BIT_MISMATCH 1 0.16 0.00 0.18 186 HTML_FONT_TINY_NORDNS 1 0.33 1.72 0.18 187 RELAYCOUNTRY_DE 1 0.16 0.00 0.18 188 XMLngstWrd_04 1 0.16 0.00 0.18 189 FORGED_RELAY_MUA_TO_MX 1 0.49 3.45 0.18 190 HTML_FONT_FACE_BAD 1 0.16 0.00 0.18 191 HK_RANDOM_FROM 1 0.16 0.00 0.18 192 XMGappySubj_02 1 0.16 0.00 0.18 193 TR_XM_SB_Phish 1 0.49 3.45 0.18 194 XM_B_Phish66 1 0.33 1.72 0.18 195 XMSubLongNoVowel 1 0.33 1.72 0.18 196 GB_FAKE_RF_SHORT 1 0.16 0.00 0.18 197 FORGED_YAHOO_RCVD 1 0.16 0.00 0.18 198 DC_PNG_UNO_LARGO 1 0.16 0.00 0.18 199 XMBody_03 1 0.49 3.45 0.18 200 ACT_NOW_CAPS 1 0.16 0.00 0.18 ----------------------------------------------------------------------