Email: 377932 Autolearn: 0 AvgScore: 3.25 AvgScanTime: 2.23 sec Spam: 126586 Autolearn: 0 AvgScore: 13.48 AvgScanTime: 2.90 sec Ham: 251346 Autolearn: 0 AvgScore: -1.91 AvgScanTime: 1.90 sec Time Spent Running SA: 234.40 hours Time Spent Processing Spam: 102.07 hours Time Spent Processing Ham: 132.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 92195 78.79 72.83 81.80 2 DKIM_SIGNED 80932 72.03 63.93 76.10 3 XM_DK_Pass 79645 70.86 62.92 74.86 4 DCC_CHECK 77494 49.54 61.22 43.66 5 DKIM_VALID 75218 67.55 59.42 71.64 6 XMListUnsubscribeExists 73056 55.08 57.71 53.76 7 DKIM_VALID_AU 63242 53.34 49.96 55.04 8 BAYES_50 59271 48.54 46.82 49.40 9 XM_H_QuotedFrom 53709 39.97 42.43 38.73 10 XM_DK_Undo_02 50861 27.04 40.18 20.43 11 DCC_CHECK_NEGATIVE 47567 49.37 37.58 55.31 12 BAYES_99 45593 24.88 36.02 19.27 13 BOTNET 44159 13.04 34.88 2.04 14 T_TM2_M_HEADER_IN_MSG 39163 25.53 30.94 22.80 15 BAYES_999 38766 21.76 30.62 17.30 16 TR_DCC_Bayes_99 36960 16.27 29.20 9.76 17 HTML_FONT_LOW_CONTRAST 36827 30.10 29.09 30.60 18 LOTS_OF_MONEY 34598 16.55 27.33 11.12 19 LOC_TINY_FONT_1 34484 25.94 27.24 25.28 20 MIME_HTML_ONLY 33751 23.80 26.66 22.36 21 RCVD_IN_RP_RNBL 32789 8.70 25.90 0.04 22 RCVD_IN_PSBL 29880 7.91 23.60 0.00 23 ANY_BOUNCE_MESSAGE 29197 11.37 23.06 5.48 24 BOUNCE_MESSAGE 29197 11.37 23.06 5.48 25 FVGT_m_MULTI_ODD 26693 20.78 21.09 20.63 26 XM_OfRef6 26114 8.05 20.63 1.72 27 XMSubLong 25031 21.85 19.77 22.89 28 FILL_THIS_FORM 23728 6.72 18.74 0.66 29 XM_OfRef7 23295 6.23 18.40 0.10 30 DEAR_FRIEND 23079 6.13 18.23 0.03 31 MONEY_FORM 22781 6.03 18.00 0.01 32 FORM_FRAUD 22239 5.88 17.57 0.00 33 RELAYCOUNTRY_META 20278 8.19 16.02 4.25 34 XM_Multi_Part_URI 19481 15.58 15.39 15.68 35 DKIM_VALID_EF 19415 24.98 15.34 29.84 36 XM_Body_Dirty_Words 19239 13.13 15.20 12.09 37 T_KAM_HTML_FONT_INVALID 19235 15.15 15.20 15.12 38 HTML_IMAGE_RATIO_02 15781 10.84 12.47 10.01 39 MultiRelay 15382 13.84 12.15 14.70 40 UNTRUSTED_Relay 13809 4.44 10.91 1.19 41 XM_Evil_Numbers_Gen 12977 9.07 10.25 8.47 42 BOTNET_IPINHOSTNAME 12852 7.81 10.15 6.64 43 FSL_BULK_SIG 11765 8.43 9.29 7.99 44 DATE_IN_PAST_03_06 10719 2.88 8.47 0.07 45 XMSexyCombo_05 10114 5.59 7.99 4.38 46 HTML_IMAGE_RATIO_04 9669 6.80 7.64 6.37 47 T_XMDrugObfuBody_14 9232 7.03 7.29 6.90 48 MPART_ALT_DIFF 8275 4.30 6.54 3.17 49 XM_UB50 7970 2.62 6.30 0.77 50 XMSubMetaSx_00 7957 5.28 6.29 4.78 51 XM_H_Long_From01 7843 6.30 6.20 6.35 52 TooManyTo_001 7409 5.59 5.85 5.45 53 XM_B_Phish_Phrases 7119 6.55 5.62 7.01 54 FROM_EXCESS_BASE64 6725 4.84 5.31 4.60 55 BAYES_80 6655 4.47 5.26 4.07 56 XM_UncommonTLD01 6549 4.56 5.17 4.26 57 MIME_HTML_MOSTLY 6123 3.16 4.84 2.32 58 HTML_IMAGE_RATIO_06 6062 3.88 4.79 3.42 59 BAYES_60 5941 5.60 4.69 6.05 60 XMBdyGiftCard01 5814 2.62 4.59 1.63 61 RCVD_IN_RP_SAFE 5778 11.31 4.56 14.71 62 DKIM_INVALID 5714 4.48 4.51 4.46 63 LotsOfNums_01 5438 6.75 4.30 7.99 64 XM_DIRTYINTL 5373 2.59 4.24 1.75 65 RCVD_IN_RP_CERTIFIED 4474 9.80 3.53 12.96 66 T_REMOTE_IMAGE 4351 3.46 3.44 3.48 67 XM_SendGrid 4124 5.14 3.26 6.09 68 XMStrtUSub 4019 4.14 3.17 4.63 69 RELAYCOUNTRY_DE 4009 1.39 3.17 0.49 70 RELAYCOUNTRY_CA 4000 2.10 3.16 1.56 71 T_XMDrugObfuBody_01 3921 1.07 3.10 0.05 72 XMNumbers 3860 3.29 3.05 3.41 73 BAYES_95 3842 3.13 3.04 3.18 74 MultiRelay_Combo 3709 1.08 2.93 0.14 75 MultiRelay_CC 3709 1.08 2.93 0.14 76 XM_SPF_SoftFail 3659 1.85 2.89 1.33 77 MIME_HTML_ONLY_MULTI 3551 1.98 2.81 1.57 78 XM_CamelCaseFrm001 3523 2.13 2.78 1.80 79 DKIM_ADSP_NXDOMAIN 3288 1.25 2.60 0.57 80 HTML_MIME_NO_HTML_TAG 3229 1.97 2.55 1.68 81 URI_HEX 3138 2.19 2.48 2.05 82 XM_URI_RBL 3044 1.26 2.40 0.68 83 BOTNET_NORDNS 2879 0.77 2.27 0.01 84 RCVD_IN_MSPIKE_H2 2813 3.73 2.22 4.49 85 HTML_IMAGE_RATIO_08 2705 1.90 2.14 1.79 86 T_TooManySym_01 2504 5.19 1.98 6.81 87 NUMERIC_HTTP_ADDR 2455 0.82 1.94 0.25 88 NORDNS_LOW_CONTRAST 2428 0.65 1.92 0.01 89 XMSubGiftCard1 2427 0.72 1.92 0.12 90 SUBJ_ALL_CAPS 2379 1.62 1.88 1.49 91 TM2_M_URI_OPT_OUT 2370 1.52 1.87 1.35 92 SpammyFromTLD_02 2329 0.77 1.84 0.23 93 MIME_HEADER_CTYPE_ONLY 2311 0.71 1.83 0.15 94 RELAYCOUNTRY_CN 2310 0.65 1.82 0.05 95 NO_DNS_FOR_FROM 2247 1.57 1.78 1.47 96 RCVD_IN_BL_SPAMCOP_NET 2238 0.83 1.77 0.35 97 THIS_AD 2235 0.83 1.77 0.37 98 XMStockSpam_06 2215 1.22 1.75 0.95 99 XM_UB60 2190 0.63 1.73 0.07 100 UNPARSEABLE_RELAY 2181 3.55 1.72 4.48 101 XMSexyCombo_01 2174 1.01 1.72 0.66 102 NORMAL_HTTP_TO_IP 2160 0.60 1.71 0.05 103 XM_RXBody 2159 0.92 1.71 0.52 104 XM_ProductURIs 2141 1.13 1.69 0.85 105 MIME_QP_LONG_LINE 2029 3.67 1.60 4.72 106 TR_XM_RelayPhish 2021 0.86 1.60 0.49 107 BAYES_40 1906 2.47 1.51 2.95 108 BODY_URI_ONLY 1840 0.52 1.45 0.05 109 T_XMHurry_00 1815 1.75 1.43 1.91 110 TM2_M_VERY_LONG_WORD 1767 1.04 1.40 0.87 111 MAILING_LIST_MULTI 1761 1.68 1.39 1.82 112 T_XMDrugObfuBody_08 1760 1.46 1.39 1.49 113 URI_TRY_3LD 1740 1.52 1.37 1.59 114 ALL_TRUSTED 1740 13.31 1.37 19.33 115 HTML_FONT_SIZE_LARGE 1737 0.59 1.37 0.19 116 RDNS_DYNAMIC 1728 0.84 1.37 0.57 117 XMDiploma_00 1719 1.27 1.36 1.23 118 XM_H_PHPOS 1626 1.14 1.28 1.07 119 BAYES_20 1595 1.92 1.26 2.26 120 SpammyFromTLD_01 1576 0.75 1.25 0.50 121 FSL_THIS_IS_ADV 1557 0.50 1.23 0.13 122 XMPhish30 1555 0.79 1.23 0.57 123 XMSubMetaI_00 1517 0.74 1.20 0.51 124 HTML_TAG_BALANCE_BODY 1501 0.71 1.19 0.47 125 RELAYCOUNTRY_FR 1500 0.54 1.18 0.21 126 REPLYTO_WITHOUT_TO_CC 1499 0.41 1.18 0.03 127 HTML_IMAGE_ONLY_12 1474 0.51 1.16 0.18 128 XMPhish11 1452 0.94 1.15 0.83 129 XMBody_17 1438 0.82 1.14 0.66 130 XM_H_Long_From02 1435 0.95 1.13 0.86 131 RCVD_IN_IADB_LISTED 1434 3.73 1.13 5.03 132 DIET_1 1431 0.68 1.13 0.46 133 XM_B_REG_HTML 1412 0.83 1.12 0.69 134 HTML_SHORT_LINK_IMG_1 1391 0.39 1.10 0.03 135 SUBJ_DOLLARS 1384 1.03 1.09 1.00 136 XM_UB99 1383 0.38 1.09 0.01 137 RELAYCOUNTRY_AT 1339 0.47 1.06 0.17 138 XMSubGiftCard2 1335 0.41 1.05 0.09 139 XMHTMLBadTable_001 1328 0.75 1.05 0.60 140 URIBL_BLACK 1304 0.40 1.03 0.08 141 TR_Mismatch_TLD_01 1296 0.49 1.02 0.22 142 TR_Mismatch_TLD_02 1296 0.40 1.02 0.08 143 HTML_IMAGE_ONLY_32 1290 0.51 1.02 0.25 144 XMLongAddy 1279 0.37 1.01 0.05 145 INVALID_MSGID 1266 2.25 1.00 2.88 146 T_FILL_THIS_FORM_SHORT 1255 0.72 0.99 0.59 147 TVD_IP_HEX 1250 0.33 0.99 0.00 148 URI_HEX_IP 1250 0.33 0.99 0.00 149 TVD_IP_SING_HEX 1250 0.33 0.99 0.00 150 XM_H_PHPMailer 1241 0.83 0.98 0.75 151 TVD_SPACE_RATIO_MINFP 1227 0.33 0.97 0.01 152 HK_SCAM 1213 0.33 0.96 0.02 153 MISSING_HEADERS 1193 0.51 0.94 0.30 154 RELAYCOUNTRY_GB 1173 0.74 0.93 0.64 155 RCVD_IN_IADB_SPF 1171 3.22 0.93 4.37 156 XM_UB80 1144 0.32 0.90 0.02 157 EXCUSE_4 1137 0.30 0.90 0.01 158 XM_salutation2 1129 0.64 0.89 0.51 159 T_Symld_Words_02 1113 0.84 0.88 0.82 160 FORGED_MUA_OUTLOOK 1097 0.32 0.87 0.04 161 XM_Walgreens_Forge 1097 0.57 0.87 0.42 162 XMGenDplmaNmb 1096 0.73 0.87 0.67 163 XM_XX_Yahoo 1087 0.45 0.86 0.25 164 XM_UB999 1083 0.29 0.86 0.01 165 LONG_JUNK_URI 1073 0.35 0.85 0.10 166 T_XMDrugObfuBody_00 1041 0.95 0.82 1.01 167 HTML_IMAGE_ONLY_24 1034 0.42 0.82 0.21 168 XMPhish14 1027 0.51 0.81 0.35 169 FILL_THIS_FORM_LONG 1023 0.67 0.81 0.60 170 PLING_QUERY 1016 0.59 0.80 0.48 171 DRUGS_ERECTILE 1007 0.31 0.80 0.06 172 RCVD_IN_IADB_SENDERID 1007 2.86 0.80 3.89 173 FROM_SUSPICIOUS_NTLD 1000 0.29 0.79 0.04 174 FILL_THIS_FORM_LOAN 998 0.65 0.79 0.59 175 SUBJ_ILLEGAL_CHARS 993 0.27 0.78 0.01 176 SUBJECT_NEEDS_ENCODING 993 0.27 0.78 0.01 177 XMHTML_After_End 988 0.53 0.78 0.41 178 DKIM_ADSP_CUSTOM_MED 985 0.75 0.78 0.74 179 RCVD_IN_IADB_DK 978 2.75 0.77 3.75 180 XM_HighProb1 970 0.27 0.77 0.01 181 FROM_MISSP_REPLYTO 966 0.27 0.76 0.02 182 RCVD_IN_IADB_VOUCHED 964 2.42 0.76 3.26 183 FVGT_m_MULTI_ODD_EMAIL 950 0.28 0.75 0.04 184 NML_ADSP_CUSTOM_MED 946 0.57 0.75 0.48 185 XM_H_PHPOS_M 912 0.60 0.72 0.54 186 XMSexyCombo_04 901 0.38 0.71 0.21 187 BAYES_05 891 1.27 0.70 1.56 188 URIBL_DBL_SPAM 890 0.24 0.70 0.01 189 TR_Caps_n_Bayes_99 869 0.41 0.69 0.27 190 TR_Symld_Words 861 1.86 0.68 2.45 191 XMBody_78 861 0.66 0.68 0.65 192 TO_NO_BRKTS_FROM_MSSP 852 0.24 0.67 0.02 193 XM_B_COPY_HTML 847 0.71 0.67 0.73 194 FORGED_GMAIL_RCVD 845 0.47 0.67 0.37 195 TR_LOTS_OF_MONEY3 844 0.55 0.67 0.49 196 HTML_FONT_FACE_BAD 831 0.49 0.66 0.40 197 HDRS_LCASE_IMGONLY 827 0.24 0.65 0.03 198 FROM_MISSP_EH_MATCH 823 0.22 0.65 0.00 199 T_MONEY_PERCENT 811 0.45 0.64 0.36 200 TR_LOTS_OF_MONEY2 811 0.45 0.64 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 205591 78.79 72.83 81.80 2 DKIM_SIGNED 191275 72.03 63.93 76.10 3 XM_DK_Pass 188155 70.86 62.92 74.86 4 DKIM_VALID 180076 67.55 59.42 71.64 5 DCC_CHECK_NEGATIVE 139028 49.37 37.58 55.31 6 DKIM_VALID_AU 138343 53.34 49.96 55.04 7 XMListUnsubscribeExists 135123 55.08 57.71 53.76 8 BAYES_50 124161 48.54 46.82 49.40 9 DCC_CHECK 109750 49.54 61.22 43.66 10 XM_H_QuotedFrom 97345 39.97 42.43 38.73 11 HTML_FONT_LOW_CONTRAST 76920 30.10 29.09 30.60 12 DKIM_VALID_EF 74995 24.98 15.34 29.84 13 LOC_TINY_FONT_1 63536 25.94 27.24 25.28 14 XMSubLong 57534 21.85 19.77 22.89 15 T_TM2_M_HEADER_IN_MSG 57314 25.53 30.94 22.80 16 MIME_HTML_ONLY 56199 23.80 26.66 22.36 17 FVGT_m_MULTI_ODD 51849 20.78 21.09 20.63 18 XM_DK_Undo_02 51345 27.04 40.18 20.43 19 ALL_TRUSTED 48576 13.31 1.37 19.33 20 BAYES_99 48437 24.88 36.02 19.27 21 BAYES_999 43490 21.76 30.62 17.30 22 XM_Multi_Part_URI 39409 15.58 15.39 15.68 23 XM_DKIMWhitelistDomains 39191 10.37 0.01 15.59 24 T_KAM_HTML_FONT_INVALID 38010 15.15 15.20 15.12 25 RCVD_IN_RP_SAFE 36963 11.31 4.56 14.71 26 MultiRelay 36939 13.84 12.15 14.70 27 RCVD_IN_RP_CERTIFIED 32568 9.80 3.53 12.96 28 XM_Body_Dirty_Words 30380 13.13 15.20 12.09 29 LOTS_OF_MONEY 27949 16.55 27.33 11.12 30 BAYES_00 27513 7.45 0.49 10.95 31 HTML_IMAGE_RATIO_02 25172 10.84 12.47 10.01 32 TR_DCC_Bayes_99 24519 16.27 29.20 9.76 33 TR_XM_DK_Bayes 23884 6.44 0.36 9.50 34 TR_XM_DK_Bayes1 22933 6.17 0.31 9.12 35 XM_Evil_Numbers_Gen 21299 9.07 10.25 8.47 36 TR_XM_DK_Bayes2 20139 5.42 0.28 8.01 37 FSL_BULK_SIG 20093 8.43 9.29 7.99 38 LotsOfNums_01 20074 6.75 4.30 7.99 39 XM_B_Phish_Phrases 17621 6.55 5.62 7.01 40 T_XMDrugObfuBody_14 17338 7.03 7.29 6.90 41 T_TooManySym_01 17119 5.19 1.98 6.81 42 BOTNET_IPINHOSTNAME 16677 7.81 10.15 6.64 43 HTML_IMAGE_RATIO_04 16017 6.80 7.64 6.37 44 XM_H_Long_From01 15961 6.30 6.20 6.35 45 XM_SendGrid 15316 5.14 3.26 6.09 46 BAYES_60 15205 5.60 4.69 6.05 47 ANY_BOUNCE_MESSAGE 13781 11.37 23.06 5.48 48 BOUNCE_MESSAGE 13780 11.37 23.06 5.48 49 TooManyTo_001 13701 5.59 5.85 5.45 50 RCVD_IN_IADB_LISTED 12650 3.73 1.13 5.03 51 TO_MALFORMED 12349 3.27 0.01 4.91 52 XMSubMetaSx_00 12005 5.28 6.29 4.78 53 MIME_QP_LONG_LINE 11860 3.67 1.60 4.72 54 XMStrtUSub 11626 4.14 3.17 4.63 55 FROM_EXCESS_BASE64 11574 4.84 5.31 4.60 56 RCVD_IN_MSPIKE_H2 11277 3.73 2.22 4.49 57 UNPARSEABLE_RELAY 11254 3.55 1.72 4.48 58 DKIM_INVALID 11199 4.48 4.51 4.46 59 XMSexyCombo_05 11014 5.59 7.99 4.38 60 RCVD_IN_IADB_SPF 10989 3.22 0.93 4.37 61 XM_UncommonTLD01 10700 4.56 5.17 4.26 62 RELAYCOUNTRY_META 10691 8.19 16.02 4.25 63 TVD_RCVD_IP 10347 2.80 0.19 4.12 64 BAYES_80 10232 4.47 5.26 4.07 65 RCVD_IN_IADB_SENDERID 9785 2.86 0.80 3.89 66 RCVD_IN_IADB_DK 9421 2.75 0.77 3.75 67 IN_ZIMBRA_NJ_WHITELIST 9203 2.44 0.01 3.66 68 T_REMOTE_IMAGE 8738 3.46 3.44 3.48 69 HTML_IMAGE_RATIO_06 8601 3.88 4.79 3.42 70 XMNumbers 8561 3.29 3.05 3.41 71 RCVD_IN_IADB_VOUCHED 8190 2.42 0.76 3.26 72 BAYES_95 7996 3.13 3.04 3.18 73 MPART_ALT_DIFF 7961 4.30 6.54 3.17 74 BAYES_40 7421 2.47 1.51 2.95 75 INVALID_MSGID 7237 2.25 1.00 2.88 76 URI_OPTOUT_3LD 6371 1.70 0.03 2.53 77 RCVD_IN_MSPIKE_WL 6353 1.81 0.38 2.53 78 RCVD_IN_MSPIKE_H3 6331 1.80 0.38 2.52 79 TR_Symld_Words 6163 1.86 0.68 2.45 80 MIME_HTML_MOSTLY 5838 3.16 4.84 2.32 81 BAYES_20 5677 1.92 1.26 2.26 82 XM_PDF 5617 1.56 0.21 2.23 83 T_TooManySym_02 5444 1.58 0.43 2.17 84 TR_MetaPhish_Combo_01 5436 1.58 0.41 2.16 85 RCVD_IN_IADB_OPTIN 5201 1.58 0.60 2.07 86 URI_HEX 5152 2.19 2.48 2.05 87 BOTNET 5139 13.04 34.88 2.04 88 IN_HORDE_ADDRESS_BOOK 4865 1.30 0.03 1.94 89 T_XMHurry_00 4806 1.75 1.43 1.91 90 MAILING_LIST_MULTI 4587 1.68 1.39 1.82 91 USER_IN_DEF_DKIM_WL 4554 1.21 0.01 1.81 92 XM_CamelCaseFrm001 4536 2.13 2.78 1.80 93 HTML_IMAGE_RATIO_08 4487 1.90 2.14 1.79 94 XM_DIRTYINTL 4409 2.59 4.24 1.75 95 XM_OfRef6 4320 8.05 20.63 1.72 96 HTML_MIME_NO_HTML_TAG 4226 1.97 2.55 1.68 97 XMBdyGiftCard01 4092 2.62 4.59 1.63 98 URI_TRY_3LD 4005 1.52 1.37 1.59 99 MIME_HTML_ONLY_MULTI 3938 1.98 2.81 1.57 100 RELAYCOUNTRY_CA 3927 2.10 3.16 1.56 101 BAYES_05 3912 1.27 0.70 1.56 102 SUBJ_ALL_CAPS 3754 1.62 1.88 1.49 103 T_XMDrugObfuBody_08 3742 1.46 1.39 1.49 104 NO_DNS_FOR_FROM 3692 1.57 1.78 1.47 105 XM_DK_Undo_01 3568 1.05 0.31 1.42 106 TM2_M_URI_OPT_OUT 3385 1.52 1.87 1.35 107 XM_SPF_SoftFail 3349 1.85 2.89 1.33 108 TooManyTo_002 3211 1.04 0.57 1.28 109 TM2_M_A_HREF_HREF 3155 0.98 0.44 1.26 110 XMDiploma_00 3099 1.27 1.36 1.23 111 XM_GoogleGroups 3022 0.92 0.35 1.20 112 UNTRUSTED_Relay 2986 4.44 10.91 1.19 113 XM_H_PHPOS 2697 1.14 1.28 1.07 114 T_XMDrugObfuBody_00 2542 0.95 0.82 1.01 115 SUBJ_DOLLARS 2504 1.03 1.09 1.00 116 XMStockSpam_06 2397 1.22 1.75 0.95 117 TooManyTo_003 2338 0.78 0.48 0.93 118 XMBody_95 2317 0.62 0.03 0.92 119 TM2_M_VERY_LONG_WORD 2176 1.04 1.40 0.87 120 XM_H_Long_From02 2168 0.95 1.13 0.86 121 USER_IN_WHITELIST 2160 0.57 0.00 0.86 122 XM_ProductURIs 2147 1.13 1.69 0.85 123 XMBody_29 2137 0.63 0.19 0.85 124 XMPhish11 2089 0.94 1.15 0.83 125 T_Symld_Words_02 2070 0.84 0.88 0.82 126 XMBrknScrpt_02 1951 0.69 0.51 0.78 127 TooManyTo_004 1940 0.65 0.41 0.77 128 XM_UB50 1924 2.62 6.30 0.77 129 XM_D_tchamptons_WL 1914 0.51 0.00 0.76 130 XM_H_PHPMailer 1883 0.83 0.98 0.75 131 DKIM_ADSP_CUSTOM_MED 1848 0.75 0.78 0.74 132 XM_B_COPY_HTML 1823 0.71 0.67 0.73 133 XM_B_REG_HTML 1741 0.83 1.12 0.69 134 XMRcvdHeader_15 1711 0.45 0.00 0.68 135 XM_URI_RBL 1706 1.26 2.40 0.68 136 TooManyTo_005 1688 0.57 0.37 0.67 137 XMGenDplmaNmb 1674 0.73 0.87 0.67 138 XMSexyCombo_01 1662 1.01 1.72 0.66 139 FILL_THIS_FORM 1651 6.72 18.74 0.66 140 XMBody_17 1647 0.82 1.14 0.66 141 XMBody_78 1637 0.66 0.68 0.65 142 RELAYCOUNTRY_GB 1612 0.74 0.93 0.64 143 XMSUPPORT 1590 0.42 0.00 0.63 144 T_TooManySym_03 1559 0.43 0.05 0.62 145 XMSubMetaSxObfu_02 1557 0.48 0.21 0.62 146 XM_H_SpoofStaff4 1524 0.41 0.02 0.61 147 XMHTMLBadTable_001 1520 0.75 1.05 0.60 148 FILL_THIS_FORM_LONG 1514 0.67 0.81 0.60 149 FILL_THIS_FORM_LOAN 1475 0.65 0.79 0.59 150 T_FILL_THIS_FORM_SHORT 1474 0.72 0.99 0.59 151 RDNS_DYNAMIC 1442 0.84 1.37 0.57 152 XMPhish30 1439 0.79 1.23 0.57 153 DKIM_ADSP_NXDOMAIN 1429 1.25 2.60 0.57 154 XM_H_PHPOS_M 1367 0.60 0.72 0.54 155 XM_RXBody 1301 0.92 1.71 0.52 156 XMSubMetaI_00 1294 0.74 1.20 0.51 157 XM_salutation2 1275 0.64 0.89 0.51 158 SpammyFromTLD_01 1261 0.75 1.25 0.50 159 TR_LOTS_OF_MONEY3 1235 0.55 0.67 0.49 160 RELAYCOUNTRY_DE 1233 1.39 3.17 0.49 161 TR_XM_RelayPhish 1232 0.86 1.60 0.49 162 PLING_QUERY 1215 0.59 0.80 0.48 163 NML_ADSP_CUSTOM_MED 1200 0.57 0.75 0.48 164 HTML_TAG_BALANCE_BODY 1185 0.71 1.19 0.47 165 HELO_NODOT 1183 0.39 0.24 0.47 166 XMBSHREFv2 1179 0.34 0.09 0.47 167 DIET_1 1144 0.68 1.13 0.46 168 HELO_NO_DOMAIN 1133 0.38 0.23 0.45 169 URI_NOVOWEL 1111 0.51 0.63 0.44 170 XMLngstWrd_00 1106 0.44 0.44 0.44 171 XM_Walgreens_Forge 1056 0.57 0.87 0.42 172 XMHTML_After_End 1024 0.53 0.78 0.41 173 XMSlimDrugH 1018 0.45 0.54 0.41 174 HTML_FONT_FACE_BAD 1009 0.49 0.66 0.40 175 XMNoVowels 1002 0.36 0.27 0.40 176 HTTPS_HTTP_MISMATCH 993 0.36 0.29 0.40 177 RELAYCOUNTRY_AU 992 0.35 0.25 0.39 178 XMLngstWrd_01 962 0.40 0.43 0.38 179 XMCapTrack 940 0.29 0.12 0.37 180 FORGED_GMAIL_RCVD 937 0.47 0.67 0.37 181 XM_shorewaves_Whitelist 926 0.25 0.00 0.37 182 XM_Akamai 922 0.25 0.00 0.37 183 THIS_AD 919 0.83 1.77 0.37 184 XMSubMetaSxObfu_03 905 0.42 0.54 0.36 185 TR_LOTS_OF_MONEY2 895 0.45 0.64 0.36 186 T_MONEY_PERCENT 895 0.45 0.64 0.36 187 RCVD_IN_BL_SPAMCOP_NET 892 0.83 1.77 0.35 188 XMPhish14 891 0.51 0.81 0.35 189 T_TooManySym_04 848 0.23 0.01 0.34 190 T_OBFU_PDF_ATTACH 815 0.23 0.05 0.32 191 XMSubMetaD_03 807 0.28 0.20 0.32 192 XM_S_JOY_D 776 0.40 0.58 0.31 193 TVD_SPACE_RATIO 764 0.25 0.13 0.30 194 XM_ShortIntro_01 750 0.29 0.27 0.30 195 MISSING_HEADERS 747 0.51 0.94 0.30 196 BASE64_LENGTH_79_INF 739 0.35 0.46 0.29 197 TM2_M_BODY_EMPTY 732 0.21 0.05 0.29 198 TR_MetaPhish_Combo_01b 697 0.20 0.06 0.28 199 TR_Caps_n_Bayes_99 690 0.41 0.69 0.27 200 AC_DIV_BONANZA 681 0.19 0.04 0.27 ----------------------------------------------------------------------