Email: 375689 Autolearn: 0 AvgScore: 3.49 AvgScanTime: 4.13 sec Spam: 138333 Autolearn: 0 AvgScore: 12.44 AvgScanTime: 4.64 sec Ham: 237356 Autolearn: 0 AvgScore: -1.72 AvgScanTime: 3.84 sec Time Spent Running SA: 431.47 hours Time Spent Processing Spam: 178.14 hours Time Spent Processing Ham: 253.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125607 87.44 90.80 85.48 2 DKIM_SIGNED 101116 77.36 73.10 79.85 3 XM_DK_Pass 99411 76.14 71.86 78.63 4 DCC_CHECK 98599 51.47 71.28 39.92 5 DKIM_VALID 93538 72.17 67.62 74.82 6 XMListUnsubscribeExists 89139 58.82 64.44 55.54 7 DKIM_VALID_AU 77570 55.66 56.07 55.43 8 XM_H_QuotedFrom 66101 42.16 47.78 38.89 9 XM_DK_Undo_02 58369 25.40 42.19 15.61 10 BAYES_50 52463 49.16 37.93 55.71 11 BAYES_99 49851 22.44 36.04 14.51 12 LOC_TINY_FONT_1 46555 29.18 33.65 26.58 13 HTML_FONT_LOW_CONTRAST 43291 32.66 31.29 33.45 14 MIME_HTML_ONLY 42539 25.71 30.75 22.77 15 BAYES_999 42090 19.07 30.43 12.44 16 DCC_CHECK_NEGATIVE 38600 47.58 27.90 59.05 17 TR_DCC_Bayes_99 37658 15.06 27.22 7.97 18 BOTNET 31820 9.84 23.00 2.17 19 FVGT_m_MULTI_ODD 31249 22.72 22.59 22.80 20 XMSubLong 29466 21.95 21.30 22.33 21 T_KAM_HTML_FONT_INVALID 25689 16.56 18.57 15.39 22 DKIM_VALID_EF 24403 25.37 17.64 29.88 23 HTML_IMAGE_RATIO_02 23585 12.25 17.05 9.46 24 T_TM2_M_HEADER_IN_MSG 23199 20.63 16.77 22.87 25 XM_Body_Dirty_Words 22462 14.08 16.24 12.82 26 XM_Multi_Part_URI 20505 14.33 14.82 14.05 27 FSL_BULK_SIG 19146 8.15 13.84 4.84 28 RELAYCOUNTRY_META 19076 7.82 13.79 4.34 29 XM_Evil_Numbers_Gen 18050 9.90 13.05 8.06 30 BOTNET_IPINHOSTNAME 17773 9.27 12.85 7.18 31 MultiRelay 17551 14.99 12.69 16.33 32 RCVD_IN_RP_RNBL 15623 4.31 11.29 0.24 33 XM_UncommonTLD01 15546 5.06 11.24 1.46 34 LOTS_OF_MONEY 14300 12.20 10.34 13.29 35 XMSexyCombo_05 13213 6.38 9.55 4.54 36 HTML_FONT_SIZE_HUGE 12262 3.62 8.86 0.56 37 RCVD_IN_PSBL 12228 3.30 8.84 0.07 38 ANY_BOUNCE_MESSAGE 12091 5.57 8.74 3.73 39 BOUNCE_MESSAGE 12091 5.57 8.74 3.73 40 HTML_IMAGE_RATIO_04 12029 7.62 8.70 6.99 41 UNTRUSTED_Relay 11825 3.89 8.55 1.18 42 T_XMDrugObfuBody_14 11759 7.62 8.50 7.11 43 FROM_EXCESS_BASE64 10561 5.68 7.63 4.54 44 XMSubMetaSx_00 10289 6.56 7.44 6.04 45 TooManyTo_001 9737 6.15 7.04 5.63 46 TR_XM_DocInvoice 9714 4.62 7.02 3.22 47 XM_H_Long_From01 9703 6.09 7.01 5.54 48 XM_B_Phish_Phrases 9367 5.77 6.77 5.19 49 BAYES_80 9244 5.14 6.68 4.25 50 ALL_TRUSTED 9019 11.91 6.52 15.05 51 RCVD_IN_RP_SAFE 9011 10.07 6.51 12.14 52 MPART_ALT_DIFF 8891 4.89 6.43 4.00 53 DKIM_INVALID 7578 5.19 5.48 5.03 54 T_REMOTE_IMAGE 7576 4.71 5.48 4.26 55 BAYES_60 7456 6.23 5.39 6.72 56 RCVD_IN_RP_CERTIFIED 7389 9.36 5.34 11.69 57 LotsOfNums_01 7284 6.89 5.27 7.83 58 HTML_MIME_NO_HTML_TAG 6860 2.84 4.96 1.61 59 INVALID_MSGID 6561 1.89 4.74 0.23 60 TO_MALFORMED 6245 1.90 4.51 0.37 61 BODY_URI_ONLY 5940 1.66 4.29 0.12 62 HTML_IMAGE_RATIO_06 5907 3.86 4.27 3.61 63 XM_UB50 5764 1.95 4.17 0.66 64 MIME_HTML_MOSTLY 5691 3.34 4.11 2.89 65 NO_DNS_FOR_FROM 5657 3.32 4.09 2.88 66 BAYES_95 5602 3.50 4.05 3.18 67 DATE_IN_PAST_12_24 5525 1.65 3.99 0.29 68 XMNumbers 5497 4.01 3.97 4.03 69 BAYES_20 5254 2.88 3.80 2.34 70 SpammyFromTLD_02 4856 1.40 3.51 0.18 71 XMStrtUSub 4850 4.28 3.51 4.74 72 HTML_SHORT_LINK_IMG_1 4587 1.24 3.32 0.02 73 XM_DIRTYINTL 4549 2.68 3.29 2.33 74 MIME_HTML_ONLY_MULTI 4514 2.39 3.26 1.89 75 T_TooManySym_01 4344 4.42 3.14 5.17 76 XM_SendGrid 4340 4.83 3.14 5.82 77 XM_OfRef6 4064 2.07 2.94 1.56 78 MultiRelay_CC 4055 1.18 2.93 0.15 79 MultiRelay_Combo 4055 1.18 2.93 0.15 80 SHORTENED_URL_SRC 3801 1.02 2.75 0.01 81 SHORTENER_SHORT_IMG 3783 1.01 2.73 0.00 82 URI_BUFFLY 3781 1.01 2.73 0.00 83 XM_SPF_SoftFail 3776 1.66 2.73 1.04 84 RCVD_IN_BL_SPAMCOP_NET 3705 1.14 2.68 0.24 85 HTML_IMAGE_ONLY_04 3691 1.01 2.67 0.05 86 XM_CamelCaseFrm001 3670 2.13 2.65 1.82 87 RELAYCOUNTRY_CA 3660 1.97 2.65 1.58 88 TM2_M_URI_OPT_OUT 3612 1.95 2.61 1.57 89 URI_HEX 3586 2.33 2.59 2.17 90 MISSING_HEADERS 3515 1.05 2.54 0.18 91 XMBdyGiftCard01 3486 1.75 2.52 1.30 92 BAYES_05 3430 1.96 2.48 1.65 93 RCVD_IN_MSPIKE_H2 3361 4.28 2.43 5.36 94 HTML_IMAGE_RATIO_08 3349 2.24 2.42 2.14 95 MIME_HEADER_CTYPE_ONLY 3266 0.97 2.36 0.17 96 BOTNET_NORDNS 3245 0.88 2.35 0.03 97 MIME_QP_LONG_LINE 2919 3.90 2.11 4.94 98 HTML_SHORT_CENTER 2877 0.77 2.08 0.01 99 DIET_1 2846 1.02 2.06 0.42 100 RDNS_DYNAMIC 2713 1.12 1.96 0.63 101 XMSexyCombo_01 2686 1.10 1.94 0.60 102 BAYES_00 2673 6.03 1.93 8.41 103 XM_URI_RBL 2668 0.79 1.93 0.13 104 XMSubMetaI_00 2647 1.22 1.91 0.81 105 UNPARSEABLE_RELAY 2613 4.41 1.89 5.88 106 XMDiploma_00 2482 1.48 1.79 1.30 107 SUBJ_ALL_CAPS 2463 2.33 1.78 2.64 108 XMPhish30 2430 0.88 1.76 0.36 109 T_XMDrugObfuBody_08 2412 1.49 1.74 1.34 110 DKIM_ADSP_NXDOMAIN 2355 1.05 1.70 0.67 111 DATE_IN_PAST_03_06 2321 0.72 1.68 0.15 112 T_XMDrugObfuBody_00 2286 1.23 1.65 0.98 113 URIBL_BLACK 2244 0.63 1.62 0.05 114 SUBJ_DOLLARS 2239 0.99 1.62 0.62 115 BAYES_40 2223 2.49 1.61 3.00 116 URI_TRY_3LD 2123 1.98 1.53 2.24 117 T_XMHurry_00 2104 1.05 1.52 0.78 118 TR_XM_DK_Bayes 2076 4.80 1.50 6.72 119 XM_ProductURIs 2033 1.29 1.47 1.19 120 XM_B_REG_HTML 1915 0.92 1.38 0.65 121 TR_XM_DK_Bayes1 1907 4.53 1.38 6.37 122 RELAYCOUNTRY_AT 1906 0.57 1.38 0.11 123 XMBody_17 1899 0.96 1.37 0.71 124 XM_RXBody 1880 0.65 1.36 0.23 125 MAILING_LIST_MULTI 1864 1.83 1.35 2.11 126 XMPhish14 1858 0.77 1.34 0.43 127 XMSexyCombo_04 1807 0.59 1.31 0.17 128 XMHTMLBadTable_001 1755 0.85 1.27 0.61 129 XM_H_PHPOS 1745 1.38 1.26 1.46 130 RELAYCOUNTRY_CN 1719 0.48 1.24 0.04 131 TM2_M_VERY_LONG_WORD 1674 1.04 1.21 0.93 132 RELAYCOUNTRY_FR 1589 0.52 1.15 0.15 133 XM_DK_Undo_01 1576 1.52 1.14 1.75 134 TR_XM_RelayPhish 1574 0.62 1.14 0.31 135 XMStockSpam_06 1564 0.95 1.13 0.84 136 URIBL_DBL_SPAM 1502 0.43 1.09 0.05 137 XM_UB60 1485 0.48 1.07 0.14 138 XMGenDplmaNmb 1481 0.81 1.07 0.65 139 SpammyFromTLD_01 1481 0.62 1.07 0.37 140 XM_UB99 1473 0.43 1.06 0.07 141 TR_LOTS_OF_MONEY3 1472 0.62 1.06 0.36 142 XMSlimDrugH 1453 0.80 1.05 0.66 143 XMHTML_After_End 1441 0.53 1.04 0.24 144 XM_H_Long_From02 1432 0.99 1.04 0.96 145 XM_HighProb1 1410 0.38 1.02 0.01 146 XMBody_78 1394 0.62 1.01 0.40 147 TR_XM_DK_Bayes2 1387 3.61 1.00 5.13 148 RCVD_IN_IADB_LISTED 1354 3.75 0.98 5.37 149 MPART_ALT_DIFF_COUNT 1346 0.64 0.97 0.44 150 RCVD_IN_IADB_SPF 1304 3.27 0.94 4.63 151 XM_UB80 1290 0.39 0.93 0.08 152 T_MONEY_PERCENT 1287 0.54 0.93 0.32 153 TR_LOTS_OF_MONEY2 1287 0.54 0.93 0.32 154 RCVD_IN_IADB_SENDERID 1257 2.94 0.91 4.13 155 RELAYCOUNTRY_GB 1255 0.79 0.91 0.73 156 RCVD_IN_IADB_DK 1254 2.86 0.91 4.00 157 XM_H_PHPMailer 1238 1.01 0.89 1.08 158 URI_NOVOWEL 1218 0.61 0.88 0.45 159 TR_Mismatch_TLD_02 1212 0.36 0.88 0.06 160 T_TooManySym_02 1197 1.72 0.87 2.22 161 RELAYCOUNTRY_IE 1190 0.38 0.86 0.10 162 RELAYCOUNTRY_DE 1182 0.61 0.85 0.47 163 FILL_THIS_FORM 1181 0.73 0.85 0.66 164 PLING_QUERY 1170 0.56 0.85 0.40 165 TM2_M_A_HREF_HREF 1165 0.99 0.84 1.08 166 STYLE_GIBBERISH 1123 0.35 0.81 0.08 167 XMClaimOffer 1122 0.53 0.81 0.37 168 TR_Symld_Words 1114 1.96 0.81 2.63 169 HTML_FONT_FACE_BAD 1113 0.73 0.80 0.68 170 T_FILL_THIS_FORM_LONG 1106 0.66 0.80 0.57 171 XM_UB999 1102 0.30 0.80 0.01 172 XMPhish11 1095 0.94 0.79 1.03 173 XMSubMetaSxObfu_03 1094 0.59 0.79 0.47 174 XM_S_JOY_D 1085 0.51 0.78 0.35 175 TVD_SPACE_RATIO_MINFP 1075 0.29 0.78 0.01 176 XM_H_PHPOS_M 1049 0.77 0.76 0.77 177 HTML_IMAGE_ONLY_08 1019 0.33 0.74 0.10 178 T_Symld_Words_02 1006 0.75 0.73 0.77 179 TooManyTo_002 1000 1.10 0.72 1.32 180 FILL_THIS_FORM_LOAN 987 0.62 0.71 0.57 181 LOW_PRICE 981 0.63 0.71 0.58 182 XM_JunkDunk 978 0.26 0.71 0.00 183 RCVD_IN_IADB_VOUCHED 940 2.45 0.68 3.48 184 KHOP_DYNAMIC 928 0.44 0.67 0.31 185 TooManyTo_003 898 0.83 0.65 0.93 186 DATE_IN_PAST_24_48 889 0.25 0.64 0.03 187 BODY_ENHANCEMENT 871 0.24 0.63 0.02 188 T_HTML_TAG_BALANCE_CENTER 854 0.29 0.62 0.10 189 TVD_SPACE_RATIO 854 0.43 0.62 0.33 190 XMSubMetaSSx_00 843 0.53 0.61 0.49 191 RELAYCOUNTRY_VN 832 0.22 0.60 0.00 192 XM_B_COPY_HTML 829 0.57 0.60 0.56 193 URI_WP_HACKED_2 829 1.24 0.60 1.62 194 LongTLD 828 0.32 0.60 0.15 195 DKIM_ADSP_CUSTOM_MED 823 0.69 0.59 0.75 196 THIS_AD 809 0.35 0.58 0.21 197 XM_Combo_Sbj 805 0.37 0.58 0.25 198 DATE_IN_PAST_06_12 804 0.28 0.58 0.10 199 TO_NO_BRKTS_HTML_ONLY 800 0.31 0.58 0.16 200 XM_Body_Obfu01 791 0.29 0.57 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202885 87.44 90.80 85.48 2 DKIM_SIGNED 189521 77.36 73.10 79.85 3 XM_DK_Pass 186633 76.14 71.86 78.63 4 DKIM_VALID 177591 72.17 67.62 74.82 5 DCC_CHECK_NEGATIVE 140170 47.58 27.90 59.05 6 BAYES_50 132231 49.16 37.93 55.71 7 XMListUnsubscribeExists 131834 58.82 64.44 55.54 8 DKIM_VALID_AU 131555 55.66 56.07 55.43 9 DCC_CHECK 94761 51.47 71.28 39.92 10 XM_H_QuotedFrom 92301 42.16 47.78 38.89 11 HTML_FONT_LOW_CONTRAST 79402 32.66 31.29 33.45 12 DKIM_VALID_EF 70913 25.37 17.64 29.88 13 LOC_TINY_FONT_1 63080 29.18 33.65 26.58 14 T_TM2_M_HEADER_IN_MSG 54292 20.63 16.77 22.87 15 FVGT_m_MULTI_ODD 54117 22.72 22.59 22.80 16 MIME_HTML_ONLY 54049 25.71 30.75 22.77 17 XMSubLong 53001 21.95 21.30 22.33 18 XM_DKIMWhitelistDomains 40744 10.85 0.02 17.17 19 MultiRelay 38755 14.99 12.69 16.33 20 XM_DK_Undo_02 37046 25.40 42.19 15.61 21 T_KAM_HTML_FONT_INVALID 36534 16.56 18.57 15.39 22 ALL_TRUSTED 35721 11.91 6.52 15.05 23 BAYES_99 34448 22.44 36.04 14.51 24 XM_Multi_Part_URI 33340 14.33 14.82 14.05 25 LOTS_OF_MONEY 31541 12.20 10.34 13.29 26 XM_Body_Dirty_Words 30421 14.08 16.24 12.82 27 BAYES_999 29538 19.07 30.43 12.44 28 RCVD_IN_RP_SAFE 28825 10.07 6.51 12.14 29 RCVD_IN_RP_CERTIFIED 27758 9.36 5.34 11.69 30 HTML_IMAGE_RATIO_02 22447 12.25 17.05 9.46 31 BAYES_00 19973 6.03 1.93 8.41 32 XM_Evil_Numbers_Gen 19128 9.90 13.05 8.06 33 TR_DCC_Bayes_99 18917 15.06 27.22 7.97 34 LotsOfNums_01 18586 6.89 5.27 7.83 35 BOTNET_IPINHOSTNAME 17047 9.27 12.85 7.18 36 T_XMDrugObfuBody_14 16882 7.62 8.50 7.11 37 HTML_IMAGE_RATIO_04 16583 7.62 8.70 6.99 38 BAYES_60 15960 6.23 5.39 6.72 39 TR_XM_DK_Bayes 15950 4.80 1.50 6.72 40 TR_XM_DK_Bayes1 15112 4.53 1.38 6.37 41 XMSubMetaSx_00 14348 6.56 7.44 6.04 42 UNPARSEABLE_RELAY 13962 4.41 1.89 5.88 43 XM_SendGrid 13822 4.83 3.14 5.82 44 TooManyTo_001 13375 6.15 7.04 5.63 45 XM_H_Long_From01 13160 6.09 7.01 5.54 46 RCVD_IN_IADB_LISTED 12737 3.75 0.98 5.37 47 RCVD_IN_MSPIKE_H2 12714 4.28 2.43 5.36 48 TVD_RCVD_IP 12569 3.43 0.23 5.30 49 XM_B_Phish_Phrases 12322 5.77 6.77 5.19 50 T_TooManySym_01 12267 4.42 3.14 5.17 51 TR_XM_DK_Bayes2 12183 3.61 1.00 5.13 52 DKIM_INVALID 11930 5.19 5.48 5.03 53 MIME_QP_LONG_LINE 11724 3.90 2.11 4.94 54 FSL_BULK_SIG 11482 8.15 13.84 4.84 55 XMStrtUSub 11240 4.28 3.51 4.74 56 RCVD_IN_IADB_SPF 10988 3.27 0.94 4.63 57 FROM_EXCESS_BASE64 10786 5.68 7.63 4.54 58 XMSexyCombo_05 10771 6.38 9.55 4.54 59 RELAYCOUNTRY_META 10306 7.82 13.79 4.34 60 T_REMOTE_IMAGE 10108 4.71 5.48 4.26 61 BAYES_80 10077 5.14 6.68 4.25 62 RCVD_IN_IADB_SENDERID 9798 2.94 0.91 4.13 63 XMNumbers 9568 4.01 3.97 4.03 64 RCVD_IN_IADB_DK 9504 2.86 0.91 4.00 65 MPART_ALT_DIFF 9491 4.89 6.43 4.00 66 ANY_BOUNCE_MESSAGE 8846 5.57 8.74 3.73 67 BOUNCE_MESSAGE 8846 5.57 8.74 3.73 68 IN_ZIMBRA_NJ_WHITELIST 8651 2.31 0.02 3.64 69 HTML_IMAGE_RATIO_06 8579 3.86 4.27 3.61 70 RCVD_IN_IADB_VOUCHED 8257 2.45 0.68 3.48 71 TR_XM_DocInvoice 7646 4.62 7.02 3.22 72 BAYES_95 7546 3.50 4.05 3.18 73 BAYES_40 7131 2.49 1.61 3.00 74 MIME_HTML_MOSTLY 6860 3.34 4.11 2.89 75 NO_DNS_FOR_FROM 6828 3.32 4.09 2.88 76 SUBJ_ALL_CAPS 6273 2.33 1.78 2.64 77 TR_Symld_Words 6234 1.96 0.81 2.63 78 RCVD_IN_MSPIKE_WL 5842 1.74 0.51 2.46 79 RCVD_IN_MSPIKE_H3 5837 1.74 0.50 2.46 80 BAYES_20 5556 2.88 3.80 2.34 81 XM_DIRTYINTL 5535 2.68 3.29 2.33 82 URI_TRY_3LD 5307 1.98 1.53 2.24 83 T_TooManySym_02 5259 1.72 0.87 2.22 84 URI_HEX 5150 2.33 2.59 2.17 85 BOTNET 5142 9.84 23.00 2.17 86 RCVD_IN_IADB_OPTIN 5112 1.54 0.50 2.15 87 HTML_IMAGE_RATIO_08 5072 2.24 2.42 2.14 88 MAILING_LIST_MULTI 5008 1.83 1.35 2.11 89 IN_HORDE_ADDRESS_BOOK 4853 1.32 0.07 2.04 90 XM_PDF 4753 1.37 0.28 2.00 91 MIME_HTML_ONLY_MULTI 4476 2.39 3.26 1.89 92 USER_IN_DEF_DKIM_WL 4342 1.18 0.06 1.83 93 XM_CamelCaseFrm001 4331 2.13 2.65 1.82 94 XM_DK_Undo_01 4150 1.52 1.14 1.75 95 BAYES_05 3917 1.96 2.48 1.65 96 URI_WP_HACKED_2 3834 1.24 0.60 1.62 97 HTML_MIME_NO_HTML_TAG 3825 2.84 4.96 1.61 98 RELAYCOUNTRY_CA 3740 1.97 2.65 1.58 99 TM2_M_URI_OPT_OUT 3726 1.95 2.61 1.57 100 XM_OfRef6 3707 2.07 2.94 1.56 101 XM_UncommonTLD01 3457 5.06 11.24 1.46 102 XM_H_PHPOS 3457 1.38 1.26 1.46 103 T_XMDrugObfuBody_08 3174 1.49 1.74 1.34 104 TooManyTo_002 3143 1.10 0.72 1.32 105 XMDiploma_00 3094 1.48 1.79 1.30 106 XMBdyGiftCard01 3093 1.75 2.52 1.30 107 XM_GoogleGroups 3074 0.95 0.36 1.30 108 XM_ProductURIs 2817 1.29 1.47 1.19 109 UNTRUSTED_Relay 2795 3.89 8.55 1.18 110 IMPOTENCE 2789 0.90 0.44 1.18 111 USER_IN_WHITELIST 2633 0.70 0.00 1.11 112 XM_H_PHPMailer 2571 1.01 0.89 1.08 113 TM2_M_A_HREF_HREF 2568 0.99 0.84 1.08 114 XM_D_tchamptons_WL 2558 0.68 0.00 1.08 115 XM_SPF_SoftFail 2476 1.66 2.73 1.04 116 XMPhish11 2443 0.94 0.79 1.03 117 T_XMDrugObfuBody_00 2324 1.23 1.65 0.98 118 XM_H_Long_From02 2278 0.99 1.04 0.96 119 XMSubMetaSxObfu_02 2270 0.68 0.21 0.96 120 TooManyTo_003 2218 0.83 0.65 0.93 121 TM2_M_VERY_LONG_WORD 2216 1.04 1.21 0.93 122 TR_MetaPhish_Combo_01 2130 0.76 0.52 0.90 123 T_TooManySym_03 2081 0.59 0.11 0.88 124 XMStockSpam_06 2004 0.95 1.13 0.84 125 XMSubMetaI_00 1929 1.22 1.91 0.81 126 T_XMHurry_00 1846 1.05 1.52 0.78 127 XMRcvdHeader_15 1843 0.49 0.00 0.78 128 XM_H_PHPOS_M 1839 0.77 0.76 0.77 129 T_Symld_Words_02 1825 0.75 0.73 0.77 130 DKIM_ADSP_CUSTOM_MED 1788 0.69 0.59 0.75 131 XMBody_95 1761 0.54 0.21 0.74 132 XMNoVowels 1755 0.60 0.36 0.74 133 ONLINE_PHARMACY 1746 0.54 0.20 0.74 134 RELAYCOUNTRY_GB 1723 0.79 0.91 0.73 135 TooManyTo_004 1707 0.64 0.51 0.72 136 XMBody_17 1689 0.96 1.37 0.71 137 XMSUPPORT 1644 0.44 0.00 0.69 138 HTML_FONT_FACE_BAD 1621 0.73 0.80 0.68 139 XM_H_SpoofStaff4 1605 0.44 0.03 0.68 140 DKIM_ADSP_NXDOMAIN 1594 1.05 1.70 0.67 141 HELO_NODOT 1584 0.46 0.11 0.67 142 FILL_THIS_FORM 1577 0.73 0.85 0.66 143 XM_UB50 1576 1.95 4.17 0.66 144 XMSlimDrugH 1567 0.80 1.05 0.66 145 XMGenDplmaNmb 1546 0.81 1.07 0.65 146 XM_B_REG_HTML 1533 0.92 1.38 0.65 147 TooManyTo_005 1506 0.57 0.46 0.63 148 RDNS_DYNAMIC 1504 1.12 1.96 0.63 149 SUBJ_DOLLARS 1479 0.99 1.62 0.62 150 XMHTMLBadTable_001 1454 0.85 1.27 0.61 151 XMSexyCombo_01 1431 1.10 1.94 0.60 152 LOW_PRICE 1377 0.63 0.71 0.58 153 TVD_VISIT_PHARMA 1366 0.43 0.19 0.58 154 T_FILL_THIS_FORM_LONG 1360 0.66 0.80 0.57 155 FILL_THIS_FORM_LOAN 1357 0.62 0.71 0.57 156 HTML_FONT_SIZE_HUGE 1331 3.62 8.86 0.56 157 XM_B_COPY_HTML 1326 0.57 0.60 0.56 158 XMBrknScrpt_02 1291 0.51 0.46 0.54 159 T_FILL_THIS_FORM_SHORT 1255 0.53 0.52 0.53 160 NML_ADSP_CUSTOM_MED 1194 0.52 0.55 0.50 161 XMSubMetaSSx_00 1165 0.53 0.61 0.49 162 HTML_TAG_BALANCE_BODY 1128 0.48 0.48 0.48 163 XMSubMetaSxObfu_03 1110 0.59 0.79 0.47 164 RELAYCOUNTRY_DE 1105 0.61 0.85 0.47 165 URI_NOVOWEL 1076 0.61 0.88 0.45 166 T_TooManySym_04 1067 0.29 0.02 0.45 167 UPPERCASE_50_75 1042 0.32 0.13 0.44 168 MPART_ALT_DIFF_COUNT 1040 0.64 0.97 0.44 169 XMPhish14 1025 0.77 1.34 0.43 170 REMOVE_BEFORE_LINK 1022 0.48 0.56 0.43 171 XMCapTrack 1014 0.35 0.23 0.43 172 DIET_1 993 1.02 2.06 0.42 173 XMLngstWrd_00 988 0.35 0.25 0.42 174 FORGED_GMAIL_RCVD 961 0.44 0.50 0.40 175 PLING_QUERY 943 0.56 0.85 0.40 176 XMBody_78 938 0.62 1.01 0.40 177 RELAYCOUNTRY_AU 912 0.38 0.38 0.38 178 XMLngstWrd_01 900 0.33 0.24 0.38 179 TO_MALFORMED 890 1.90 4.51 0.37 180 HTML_IMAGE_ONLY_16 872 0.30 0.20 0.37 181 XMClaimOffer 871 0.53 0.81 0.37 182 SpammyFromTLD_01 867 0.62 1.07 0.37 183 XMPhish30 863 0.88 1.76 0.36 184 TR_LOTS_OF_MONEY3 854 0.62 1.06 0.36 185 XM_S_JOY_D 841 0.51 0.78 0.35 186 TVD_SPACE_RATIO 777 0.43 0.62 0.33 187 T_OBFU_PDF_ATTACH 765 0.23 0.08 0.32 188 AC_DIV_BONANZA 765 0.25 0.12 0.32 189 TR_LOTS_OF_MONEY2 759 0.54 0.93 0.32 190 T_MONEY_PERCENT 759 0.54 0.93 0.32 191 HTTPS_HTTP_MISMATCH 758 0.31 0.31 0.32 192 TR_XM_RelayPhish 742 0.62 1.14 0.31 193 KHOP_DYNAMIC 734 0.44 0.67 0.31 194 XM_ShortIntro_01 718 0.30 0.29 0.30 195 XMSolicitRefs_0 708 0.30 0.31 0.30 196 DATE_IN_PAST_12_24 692 1.65 3.99 0.29 197 TR_MetaPhish_Combo_01b 673 0.20 0.06 0.28 198 URIBL_SBL_A 670 0.28 0.28 0.28 199 XMGappySubj_01 667 0.36 0.50 0.28 200 XMSubMetaSx_01 665 0.25 0.19 0.28 ----------------------------------------------------------------------