Email: 693942 Autolearn: 0 AvgScore: 4.37 AvgScanTime: 4.85 sec Spam: 257748 Autolearn: 0 AvgScore: 12.69 AvgScanTime: 5.49 sec Ham: 436194 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 4.47 sec Time Spent Running SA: 934.14 hours Time Spent Processing Spam: 392.75 hours Time Spent Processing Ham: 541.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 241358 88.33 93.64 85.19 2 DKIM_SIGNED 154483 67.39 59.94 71.79 3 XM_DK_Pass 150792 66.01 58.50 70.45 4 DCC_CHECK 149848 42.63 58.14 33.47 5 DKIM_VALID 141817 62.13 55.02 66.33 6 XMListUnsubscribeExists 131980 48.59 51.21 47.04 7 DKIM_VALID_AU 114040 45.12 44.24 45.63 8 BAYES_50 108641 52.91 42.15 59.27 9 DCC_CHECK_NEGATIVE 105602 55.83 40.97 64.62 10 XM_H_QuotedFrom 105309 39.20 40.86 38.22 11 BOTNET 91418 14.46 35.47 2.04 12 XM_DK_Undo_02 81140 18.75 31.48 11.23 13 BAYES_99 73854 17.13 28.65 10.31 14 MIME_HTML_ONLY 70898 23.17 27.51 20.60 15 RCVD_IN_RP_RNBL 67415 9.89 26.16 0.28 16 LOC_TINY_FONT_1 67276 22.47 26.10 20.32 17 HTML_FONT_LOW_CONTRAST 66995 26.80 25.99 27.27 18 ANY_BOUNCE_MESSAGE 61771 12.08 23.97 5.06 19 BOUNCE_MESSAGE 61770 12.08 23.97 5.06 20 HTML_FONT_SIZE_HUGE 59490 9.17 23.08 0.95 21 BAYES_999 59488 14.11 23.08 8.82 22 RCVD_IN_PSBL 58301 8.43 22.62 0.05 23 TR_DCC_Bayes_99 55417 11.47 21.50 5.55 24 FVGT_m_MULTI_ODD 55083 20.86 21.37 20.56 25 XMSubLong 51184 21.83 19.86 23.00 26 DKIM_VALID_EF 43064 22.45 16.71 25.84 27 XM_Multi_Part_URI 40907 13.25 15.87 11.70 28 T_KAM_HTML_FONT_INVALID 36762 14.86 14.26 15.21 29 T_TM2_M_HEADER_IN_MSG 35919 23.39 13.94 28.98 30 XM_Body_Dirty_Words 35536 12.56 13.79 11.84 31 BOTNET_IPINHOSTNAME 33979 7.93 13.18 4.83 32 HTML_IMAGE_RATIO_02 33518 9.36 13.00 7.21 33 FSL_BULK_SIG 29863 7.17 11.59 4.56 34 RELAYCOUNTRY_META 27915 6.99 10.83 4.72 35 DATE_IN_PAST_12_24 27784 4.24 10.78 0.37 36 MultiRelay 27602 15.48 10.71 18.30 37 XM_UncommonTLD01 26684 4.95 10.35 1.76 38 XM_Evil_Numbers_Gen 25755 8.41 9.99 7.48 39 DATE_IN_PAST_06_12 24476 3.72 9.50 0.30 40 LOTS_OF_MONEY 22421 10.11 8.70 10.95 41 BAYES_05 19473 3.97 7.56 1.86 42 XMSexyCombo_05 19346 5.05 7.51 3.60 43 HTML_IMAGE_RATIO_04 18066 6.35 7.01 5.96 44 HTML_MIME_NO_HTML_TAG 17703 5.05 6.87 3.97 45 T_XMDrugObfuBody_14 17594 7.28 6.83 7.55 46 XM_B_Phish_Phrases 17496 5.53 6.79 4.79 47 XM_H_Long_From01 16776 5.95 6.51 5.62 48 T_REMOTE_IMAGE 16333 5.27 6.34 4.63 49 MPART_ALT_DIFF 16077 4.07 6.24 2.79 50 UNTRUSTED_Relay 15964 3.02 6.19 1.15 51 BAYES_80 15424 4.90 5.98 4.25 52 ALL_TRUSTED 15172 14.33 5.89 19.32 53 XMSubMetaSx_00 15161 5.44 5.88 5.19 54 TR_XM_DocInvoice 14744 4.31 5.72 3.47 55 SpammyFromTLD_02 14603 2.37 5.67 0.42 56 HTML_SHORT_LINK_IMG_1 14001 2.08 5.43 0.10 57 TooManyTo_001 13947 6.59 5.41 7.29 58 URI_BUFFLY 13722 2.02 5.32 0.08 59 SHORTENER_SHORT_IMG 13720 2.02 5.32 0.07 60 BAYES_60 13457 5.97 5.22 6.42 61 XMNumbers 13297 3.89 5.16 3.15 62 FROM_EXCESS_BASE64 13272 4.10 5.15 3.48 63 SHORTENED_URL_SRC 13209 1.93 5.12 0.04 64 HTML_IMAGE_ONLY_04 12984 1.91 5.04 0.07 65 DKIM_INVALID 12666 5.26 4.91 5.46 66 BODY_URI_ONLY 12363 1.86 4.80 0.12 67 HTML_SHORT_CENTER 12092 1.76 4.69 0.02 68 MISSING_HEADERS 11171 1.90 4.33 0.46 69 MIME_HEADER_CTYPE_ONLY 10995 1.67 4.27 0.14 70 LotsOfNums_01 10716 6.96 4.16 8.62 71 BAYES_95 10497 3.80 4.07 3.64 72 HTML_IMAGE_RATIO_06 10345 4.29 4.01 4.46 73 RCVD_IN_RP_SAFE 9499 6.57 3.69 8.28 74 MIME_HTML_MOSTLY 8870 2.77 3.44 2.38 75 MIME_HTML_ONLY_MULTI 7958 1.98 3.09 1.32 76 DATE_IN_PAST_03_06 7846 1.32 3.04 0.30 77 TM2_M_URI_OPT_OUT 7828 2.21 3.04 1.72 78 XM_UB50 7766 1.61 3.01 0.78 79 RCVD_IN_RP_CERTIFIED 7681 6.02 2.98 7.81 80 XM_DIRTYINTL 7393 2.31 2.87 1.99 81 XM_SendGrid 7230 4.46 2.81 5.43 82 URI_HEX 6877 2.20 2.67 1.92 83 BAYES_20 6819 2.63 2.65 2.62 84 INVALID_MSGID 6794 1.08 2.64 0.16 85 XMStrtUSub 6620 3.18 2.57 3.54 86 TO_MALFORMED 6370 0.96 2.47 0.06 87 RELAYCOUNTRY_CA 6045 1.71 2.35 1.34 88 XM_SPF_SoftFail 5955 1.92 2.31 1.69 89 RCVD_IN_MSPIKE_H2 5677 3.89 2.20 4.89 90 XM_OfRef6 5483 1.95 2.13 1.84 91 XM_CamelCaseFrm001 5482 1.79 2.13 1.58 92 MIME_QP_LONG_LINE 5312 4.35 2.06 5.70 93 HTML_IMAGE_RATIO_08 5268 2.02 2.04 2.01 94 T_TooManySym_01 5157 3.10 2.00 3.75 95 XMDiploma_00 5025 1.64 1.95 1.45 96 BAYES_40 4690 2.88 1.82 3.51 97 BAYES_00 4641 5.67 1.80 7.96 98 MultiRelay_Combo 4612 0.78 1.79 0.18 99 MultiRelay_CC 4612 0.78 1.79 0.18 100 XM_URI_RBL 4607 0.75 1.79 0.14 101 BOTNET_NORDNS 4458 0.65 1.73 0.02 102 RCVD_IN_BL_SPAMCOP_NET 4374 0.85 1.70 0.35 103 T_XMDrugObfuBody_08 4226 1.58 1.64 1.55 104 XMSexyCombo_01 4084 0.94 1.58 0.56 105 XMBdyGiftCard01 4015 1.10 1.56 0.82 106 PLING_QUERY 3872 0.80 1.50 0.38 107 T_XMHurry_00 3761 0.93 1.46 0.62 108 SUBJ_ALL_CAPS 3617 2.00 1.40 2.35 109 XMGenDplmaNmb 3434 1.05 1.33 0.88 110 XMHTML_After_End 3405 0.72 1.32 0.36 111 NO_DNS_FOR_FROM 3402 1.18 1.32 1.09 112 UNPARSEABLE_RELAY 3203 2.82 1.24 3.75 113 SpammyFromTLD_01 3086 0.93 1.20 0.77 114 DIET_1 3077 0.60 1.19 0.24 115 SUBJ_DOLLARS 2922 0.68 1.13 0.40 116 TR_XM_DK_Bayes 2869 4.03 1.11 5.76 117 XMSubMetaI_00 2864 0.78 1.11 0.58 118 URI_TRY_3LD 2847 1.12 1.10 1.12 119 XMBody_17 2787 0.80 1.08 0.63 120 XMPhish30 2692 0.57 1.04 0.30 121 URIBL_BLACK 2658 0.40 1.03 0.03 122 XM_JunkDunk 2633 0.38 1.02 0.00 123 TM2_M_VERY_LONG_WORD 2620 0.92 1.02 0.87 124 TR_XM_DK_Bayes1 2597 3.72 1.01 5.32 125 XM_RXBody 2585 0.51 1.00 0.22 126 TR_XM_RelayPhish 2561 0.66 0.99 0.46 127 XMBody_78 2409 0.54 0.93 0.31 128 TR_LOTS_OF_MONEY2 2403 0.50 0.93 0.24 129 T_MONEY_PERCENT 2403 0.50 0.93 0.24 130 TR_XM_DK_Bayes2 2377 2.96 0.92 4.16 131 RELAYCOUNTRY_GB 2360 0.95 0.92 0.97 132 XM_DK_Undo_01 2321 1.50 0.90 1.86 133 XM_H_Long_From02 2320 0.87 0.90 0.85 134 XMClaimOffer 2296 0.44 0.89 0.17 135 XMStockSpam_06 2293 1.05 0.89 1.15 136 XM_ProductURIs 2266 0.84 0.88 0.81 137 RELAYCOUNTRY_CN 2256 0.35 0.88 0.04 138 XMPhish14 2231 0.55 0.87 0.37 139 RCVD_IN_IADB_LISTED 2223 4.44 0.86 6.55 140 HTML_TAG_BALANCE_BODY 2195 0.66 0.85 0.54 141 TR_Symld_Words 2152 1.51 0.83 1.90 142 MAILING_LIST_MULTI 2137 1.74 0.83 2.27 143 XM_HighProb1 2135 0.32 0.83 0.01 144 T_XMDrugObfuBody_00 2126 0.96 0.82 1.04 145 XMSlimDrugH 2123 0.64 0.82 0.53 146 T_TooManySym_02 2107 1.32 0.82 1.61 147 XM_UB99 2068 0.31 0.80 0.02 148 XM_UB60 2017 0.35 0.78 0.10 149 HTML_FONT_FACE_BAD 1985 0.57 0.77 0.45 150 T_Symld_Words_02 1959 0.62 0.76 0.54 151 RCVD_IN_IADB_SPF 1958 3.82 0.76 5.63 152 XMSexyCombo_04 1930 0.32 0.75 0.06 153 XM_Combo_Sbj 1927 0.43 0.75 0.25 154 URI_WP_HACKED_2 1902 1.62 0.74 2.14 155 XMMoneyMeta_00 1892 0.53 0.73 0.41 156 XMHTMLBadTable_001 1887 0.69 0.73 0.66 157 RCVD_IN_IADB_SENDERID 1881 3.36 0.73 4.91 158 RELAYCOUNTRY_FR 1867 0.40 0.72 0.21 159 RCVD_IN_IADB_DK 1841 3.29 0.71 4.82 160 XM_B_REG_HTML 1801 0.45 0.70 0.30 161 XM_UB80 1791 0.29 0.69 0.05 162 HTML_IMAGE_ONLY_08 1774 0.35 0.69 0.15 163 XM_PDF 1768 3.26 0.69 4.78 164 RELAYCOUNTRY_AT 1756 0.32 0.68 0.11 165 XMPhish11 1742 0.94 0.68 1.10 166 XMGppyBdWords 1734 0.42 0.67 0.27 167 URIBL_DBL_SPAM 1728 0.30 0.67 0.08 168 THIS_AD 1724 0.40 0.67 0.25 169 RELAYCOUNTRY_IN 1686 0.31 0.65 0.10 170 XMSubMetaSxObfu_03 1676 0.52 0.65 0.44 171 XMSubPhish11 1650 0.31 0.64 0.11 172 TR_LOTS_OF_MONEY3 1643 0.43 0.64 0.30 173 HTML_FONT_SIZE_LARGE 1623 0.37 0.63 0.22 174 TooManyTo_002 1609 1.53 0.62 2.07 175 FILL_THIS_FORM 1589 0.48 0.62 0.39 176 RELAYCOUNTRY_DE 1575 0.55 0.61 0.51 177 IMPOTENCE 1535 1.19 0.60 1.54 178 XM_H_PHPOS 1533 0.90 0.59 1.08 179 XM_UB999 1529 0.23 0.59 0.01 180 HTTPS_HTTP_MISMATCH 1514 0.47 0.59 0.40 181 XMSubMetaSSx_00 1508 0.51 0.59 0.46 182 RDNS_DYNAMIC 1508 0.46 0.59 0.38 183 HTML_COMMENT_SAVED_URL 1473 0.24 0.57 0.04 184 REMOVE_BEFORE_LINK 1460 0.35 0.57 0.23 185 URI_NOVOWEL 1432 0.49 0.56 0.45 186 XMSubGiftCard1 1431 0.29 0.56 0.13 187 RCVD_IN_IADB_VOUCHED 1427 2.93 0.55 4.34 188 TooManyTo_003 1400 1.08 0.54 1.39 189 T_FILL_THIS_FORM_SHORT 1380 0.65 0.54 0.72 190 DKIM_ADSP_NXDOMAIN 1371 0.41 0.53 0.35 191 LOW_PRICE 1367 0.47 0.53 0.43 192 T_FILL_THIS_FORM_LONG 1365 0.39 0.53 0.31 193 XM_B_COPY_HTML 1341 0.45 0.52 0.41 194 DKIM_ADSP_CUSTOM_MED 1329 0.88 0.52 1.09 195 TR_Mismatch_TLD_02 1318 0.23 0.51 0.06 196 XMLongAddy 1315 0.22 0.51 0.05 197 KHOP_DYNAMIC 1289 0.57 0.50 0.62 198 XMSubPhish8 1263 0.21 0.49 0.04 199 FILL_THIS_FORM_LOAN 1251 0.36 0.49 0.28 200 RELAYCOUNTRY_AU 1187 0.49 0.46 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 371606 88.33 93.64 85.19 2 DKIM_SIGNED 313155 67.39 59.94 71.79 3 XM_DK_Pass 307282 66.01 58.50 70.45 4 DKIM_VALID 289317 62.13 55.02 66.33 5 DCC_CHECK_NEGATIVE 281855 55.83 40.97 64.62 6 BAYES_50 258551 52.91 42.15 59.27 7 XMListUnsubscribeExists 205174 48.59 51.21 47.04 8 DKIM_VALID_AU 199033 45.12 44.24 45.63 9 XM_H_QuotedFrom 166718 39.20 40.86 38.22 10 DCC_CHECK 145974 42.63 58.14 33.47 11 T_TM2_M_HEADER_IN_MSG 126407 23.39 13.94 28.98 12 HTML_FONT_LOW_CONTRAST 118960 26.80 25.99 27.27 13 DKIM_VALID_EF 112721 22.45 16.71 25.84 14 XMSubLong 100319 21.83 19.86 23.00 15 MIME_HTML_ONLY 89876 23.17 27.51 20.60 16 FVGT_m_MULTI_ODD 89684 20.86 21.37 20.56 17 LOC_TINY_FONT_1 88624 22.47 26.10 20.32 18 ALL_TRUSTED 84268 14.33 5.89 19.32 19 MultiRelay 79845 15.48 10.71 18.30 20 T_KAM_HTML_FONT_INVALID 66334 14.86 14.26 15.21 21 XM_DKIMWhitelistDomains 63911 9.23 0.06 14.65 22 XM_Body_Dirty_Words 51644 12.56 13.79 11.84 23 XM_Multi_Part_URI 51039 13.25 15.87 11.70 24 XM_DK_Undo_02 48993 18.75 31.48 11.23 25 LOTS_OF_MONEY 47750 10.11 8.70 10.95 26 BAYES_99 44985 17.13 28.65 10.31 27 BAYES_999 38451 14.11 23.08 8.82 28 LotsOfNums_01 37607 6.96 4.16 8.62 29 RCVD_IN_RP_SAFE 36125 6.57 3.69 8.28 30 BAYES_00 34714 5.67 1.80 7.96 31 RCVD_IN_RP_CERTIFIED 34078 6.02 2.98 7.81 32 T_XMDrugObfuBody_14 32915 7.28 6.83 7.55 33 XM_Evil_Numbers_Gen 32638 8.41 9.99 7.48 34 TooManyTo_001 31814 6.59 5.41 7.29 35 HTML_IMAGE_RATIO_02 31459 9.36 13.00 7.21 36 RCVD_IN_IADB_LISTED 28557 4.44 0.86 6.55 37 BAYES_60 27992 5.97 5.22 6.42 38 HTML_IMAGE_RATIO_04 26008 6.35 7.01 5.96 39 TR_XM_DK_Bayes 25110 4.03 1.11 5.76 40 MIME_QP_LONG_LINE 24881 4.35 2.06 5.70 41 RCVD_IN_IADB_SPF 24565 3.82 0.76 5.63 42 XM_H_Long_From01 24500 5.95 6.51 5.62 43 TR_DCC_Bayes_99 24192 11.47 21.50 5.55 44 DKIM_INVALID 23838 5.26 4.91 5.46 45 XM_SendGrid 23700 4.46 2.81 5.43 46 TR_XM_DK_Bayes1 23198 3.72 1.01 5.32 47 XMSubMetaSx_00 22623 5.44 5.88 5.19 48 ANY_BOUNCE_MESSAGE 22090 12.08 23.97 5.06 49 BOUNCE_MESSAGE 22089 12.08 23.97 5.06 50 RCVD_IN_IADB_SENDERID 21411 3.36 0.73 4.91 51 RCVD_IN_MSPIKE_H2 21312 3.89 2.20 4.89 52 BOTNET_IPINHOSTNAME 21050 7.93 13.18 4.83 53 RCVD_IN_IADB_DK 21014 3.29 0.71 4.82 54 XM_B_Phish_Phrases 20892 5.53 6.79 4.79 55 XM_PDF 20851 3.26 0.69 4.78 56 RELAYCOUNTRY_META 20608 6.99 10.83 4.72 57 T_REMOTE_IMAGE 20215 5.27 6.34 4.63 58 FSL_BULK_SIG 19889 7.17 11.59 4.56 59 HTML_IMAGE_RATIO_06 19454 4.29 4.01 4.46 60 RCVD_IN_IADB_VOUCHED 18917 2.93 0.55 4.34 61 BAYES_80 18548 4.90 5.98 4.25 62 TR_XM_DK_Bayes2 18130 2.96 0.92 4.16 63 IN_ZIMBRA_NJ_WHITELIST 17395 2.51 0.02 3.99 64 HTML_MIME_NO_HTML_TAG 17335 5.05 6.87 3.97 65 T_TooManySym_01 16361 3.10 2.00 3.75 66 UNPARSEABLE_RELAY 16353 2.82 1.24 3.75 67 BAYES_95 15857 3.80 4.07 3.64 68 XMSexyCombo_05 15723 5.05 7.51 3.60 69 XMStrtUSub 15445 3.18 2.57 3.54 70 BAYES_40 15291 2.88 1.82 3.51 71 FROM_EXCESS_BASE64 15186 4.10 5.15 3.48 72 TR_XM_DocInvoice 15157 4.31 5.72 3.47 73 TVD_RCVD_IP 14573 2.15 0.14 3.34 74 XMNumbers 13721 3.89 5.16 3.15 75 MPART_ALT_DIFF 12175 4.07 6.24 2.79 76 RCVD_IN_IADB_OPTIN 11894 1.86 0.41 2.73 77 BAYES_20 11407 2.63 2.65 2.62 78 MIME_HTML_MOSTLY 10373 2.77 3.44 2.38 79 SUBJ_ALL_CAPS 10272 2.00 1.40 2.35 80 MAILING_LIST_MULTI 9914 1.74 0.83 2.27 81 URI_WP_HACKED_2 9351 1.62 0.74 2.14 82 RCVD_IN_MSPIKE_WL 9293 1.46 0.32 2.13 83 RCVD_IN_MSPIKE_H3 9287 1.45 0.31 2.13 84 TooManyTo_002 9021 1.53 0.62 2.07 85 BOTNET 8906 14.46 35.47 2.04 86 HTML_IMAGE_RATIO_08 8776 2.02 2.04 2.01 87 XM_DIRTYINTL 8659 2.31 2.87 1.99 88 URI_HEX 8361 2.20 2.67 1.92 89 TR_Symld_Words 8301 1.51 0.83 1.90 90 XM_DK_Undo_01 8107 1.50 0.90 1.86 91 BAYES_05 8093 3.97 7.56 1.86 92 XM_OfRef6 8022 1.95 2.13 1.84 93 IN_HORDE_ADDRESS_BOOK 7822 1.15 0.07 1.79 94 XM_UncommonTLD01 7677 4.95 10.35 1.76 95 TM2_M_URI_OPT_OUT 7500 2.21 3.04 1.72 96 XM_SPF_SoftFail 7373 1.92 2.31 1.69 97 HELO_NODOT 7264 1.13 0.22 1.67 98 T_TooManySym_02 7034 1.32 0.82 1.61 99 XM_CamelCaseFrm001 6910 1.79 2.13 1.58 100 T_XMDrugObfuBody_08 6746 1.58 1.64 1.55 101 IMPOTENCE 6700 1.19 0.60 1.54 102 XMDiploma_00 6329 1.64 1.95 1.45 103 TooManyTo_003 6083 1.08 0.54 1.39 104 RELAYCOUNTRY_CA 5834 1.71 2.35 1.34 105 MIME_HTML_ONLY_MULTI 5768 1.98 3.09 1.32 106 XMCapTrack 5617 0.95 0.38 1.29 107 XM_GoogleGroups 5236 0.86 0.28 1.20 108 USER_IN_DEF_DKIM_WL 5099 0.75 0.03 1.17 109 XMStockSpam_06 5015 1.05 0.89 1.15 110 UNTRUSTED_Relay 5012 3.02 6.19 1.15 111 URI_TRY_3LD 4897 1.12 1.10 1.12 112 XMPhish11 4807 0.94 0.68 1.10 113 NO_DNS_FOR_FROM 4776 1.18 1.32 1.09 114 DKIM_ADSP_CUSTOM_MED 4753 0.88 0.52 1.09 115 XM_H_PHPOS 4722 0.90 0.59 1.08 116 T_XMDrugObfuBody_00 4519 0.96 0.82 1.04 117 TooManyTo_004 4377 0.79 0.43 1.00 118 RELAYCOUNTRY_GB 4222 0.95 0.92 0.97 119 HTML_FONT_SIZE_HUGE 4162 9.17 23.08 0.95 120 ONLINE_PHARMACY 4092 0.68 0.24 0.94 121 XMGenDplmaNmb 3840 1.05 1.33 0.88 122 TM2_M_VERY_LONG_WORD 3782 0.92 1.02 0.87 123 XM_H_Long_From02 3729 0.87 0.90 0.85 124 TooManyTo_005 3624 0.67 0.39 0.83 125 XMBdyGiftCard01 3587 1.10 1.56 0.82 126 XM_ProductURIs 3538 0.84 0.88 0.81 127 XMLngstWrd_00 3477 0.59 0.25 0.80 128 XM_UB50 3381 1.61 3.01 0.78 129 SpammyFromTLD_01 3380 0.93 1.20 0.77 130 XM_D_tchamptons_WL 3370 0.49 0.00 0.77 131 TM2_M_A_HREF_HREF 3257 0.64 0.46 0.75 132 TVD_VISIT_PHARMA 3252 0.55 0.22 0.75 133 T_OBFU_PDF_ATTACH 3236 0.53 0.17 0.74 134 TR_MetaPhish_Combo_01 3217 0.63 0.46 0.74 135 XMLngstWrd_01 3155 0.54 0.24 0.72 136 T_FILL_THIS_FORM_SHORT 3155 0.65 0.54 0.72 137 NML_ADSP_CUSTOM_MED 3090 0.61 0.44 0.71 138 XMHTMLBadTable_001 2889 0.69 0.73 0.66 139 USER_IN_WHITELIST 2754 0.40 0.00 0.63 140 XMBody_17 2740 0.80 1.08 0.63 141 T_XMHurry_00 2722 0.93 1.46 0.62 142 XMGappySubj_01 2699 0.50 0.30 0.62 143 KHOP_DYNAMIC 2690 0.57 0.50 0.62 144 XM_H_PHPMailer 2630 0.51 0.34 0.60 145 XMSubMetaI_00 2529 0.78 1.11 0.58 146 FORGED_GMAIL_RCVD 2521 0.52 0.43 0.58 147 XMSexyCombo_01 2463 0.94 1.58 0.56 148 T_TooManySym_03 2377 0.38 0.09 0.54 149 T_Symld_Words_02 2359 0.62 0.76 0.54 150 HTML_TAG_BALANCE_BODY 2355 0.66 0.85 0.54 151 XMSubMetaSxObfu_02 2340 0.42 0.22 0.54 152 XMSlimDrugH 2311 0.64 0.82 0.53 153 XMBody_95 2253 0.38 0.15 0.52 154 XMRcvdHeader_15 2246 0.32 0.00 0.51 155 RELAYCOUNTRY_AU 2244 0.49 0.46 0.51 156 RELAYCOUNTRY_DE 2229 0.55 0.61 0.51 157 XMNoVowels 2198 0.40 0.22 0.50 158 XMBrknScrpt_02 2108 0.45 0.39 0.48 159 TR_XM_RelayPhish 2027 0.66 0.99 0.46 160 XMSubMetaSSx_00 2020 0.51 0.59 0.46 161 URI_OPTOUT_3LD 2018 0.33 0.10 0.46 162 XM_ShortIntro_01 2007 0.40 0.29 0.46 163 MISSING_HEADERS 1989 1.90 4.33 0.46 164 HTML_FONT_FACE_BAD 1972 0.57 0.77 0.45 165 URI_NOVOWEL 1968 0.49 0.56 0.45 166 SHORT_HELO_AND_INLINE_IMAGE 1915 0.29 0.04 0.44 167 XMSubMetaSxObfu_03 1914 0.52 0.65 0.44 168 LOW_PRICE 1867 0.47 0.53 0.43 169 SpammyFromTLD_02 1841 2.37 5.67 0.42 170 XMMoneyMeta_00 1787 0.53 0.73 0.41 171 XM_USANA_RCVD 1785 0.26 0.00 0.41 172 XM_B_COPY_HTML 1776 0.45 0.52 0.41 173 XMLngstWrd_02 1771 0.32 0.18 0.41 174 SUBJ_DOLLARS 1763 0.68 1.13 0.40 175 HTTPS_HTTP_MISMATCH 1728 0.47 0.59 0.40 176 FILL_THIS_FORM 1715 0.48 0.62 0.39 177 AC_DIV_BONANZA 1701 0.27 0.06 0.39 178 PLING_QUERY 1676 0.80 1.50 0.38 179 XM_S_JOY_D 1675 0.39 0.39 0.38 180 TM2_M_BODY_EMPTY 1656 0.28 0.10 0.38 181 RDNS_DYNAMIC 1650 0.46 0.59 0.38 182 HTML_IMAGE_ONLY_28 1643 0.39 0.43 0.38 183 XMPhish14 1614 0.55 0.87 0.37 184 RCVD_IN_SORBS_DUL 1614 0.28 0.13 0.37 185 XMSolicitRefs_0 1607 0.34 0.29 0.37 186 DATE_IN_PAST_12_24 1607 4.24 10.78 0.37 187 HTML_IMAGE_ONLY_32 1582 0.29 0.17 0.36 188 XMHTML_After_End 1567 0.72 1.32 0.36 189 XMDateMe_00 1554 0.32 0.27 0.36 190 XM_H_PHPOS_M 1551 0.29 0.19 0.36 191 RCVD_IN_BL_SPAMCOP_NET 1530 0.85 1.70 0.35 192 DKIM_ADSP_NXDOMAIN 1508 0.41 0.53 0.35 193 UPPERCASE_50_75 1415 0.23 0.08 0.32 194 T_FILL_THIS_FORM_LONG 1361 0.39 0.53 0.31 195 XMBody_78 1349 0.54 0.93 0.31 196 XMSubNoVowel 1347 0.31 0.31 0.31 197 DATE_IN_PAST_06_12 1328 3.72 9.50 0.30 198 XM_B_REG_HTML 1323 0.45 0.70 0.30 199 HTML_IMAGE_ONLY_24 1322 0.29 0.26 0.30 200 TR_LOTS_OF_MONEY3 1316 0.43 0.64 0.30 ----------------------------------------------------------------------