Email: 677684 Autolearn: 0 AvgScore: 1.44 AvgScanTime: 2.12 sec Spam: 131801 Autolearn: 0 AvgScore: 12.07 AvgScanTime: 3.63 sec Ham: 545883 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.76 sec Time Spent Running SA: 399.26 hours Time Spent Processing Spam: 133.01 hours Time Spent Processing Ham: 266.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 122524 86.96 92.96 85.51 2 DCC_CHECK 101987 46.77 77.38 39.39 3 XM_B_Unicode 99729 69.67 75.67 68.22 4 DKIM_SIGNED 96811 72.19 73.45 71.88 5 XM_DK_Pass 93294 70.77 70.78 70.77 6 XMListUnsubscribeExists 82001 51.94 62.22 49.46 7 DKIM_VALID 78921 65.41 59.88 66.74 8 BAYES_50 66117 49.48 50.16 49.31 9 XM_B_Unicode3 60404 40.74 45.83 39.51 10 DKIM_VALID_AU 57781 48.97 43.84 50.21 11 MIME_HTML_ONLY 51617 23.39 39.16 19.58 12 XM_DK_Undo_02 46891 12.70 35.58 7.17 13 HTML_FONT_LOW_CONTRAST 45421 28.45 34.46 27.00 14 LOC_TINY_FONT_1 40282 23.97 30.56 22.37 15 T_TM2_M_HEADER_IN_MSG 33158 28.53 25.16 29.35 16 BOTNET 31426 6.99 23.84 2.92 17 XMSubLong 30966 20.90 23.49 20.27 18 FVGT_m_MULTI_ODD 30445 21.20 23.10 20.75 19 DKIM_VALID_EF 29864 24.34 22.66 24.75 20 BAYES_99 28007 6.72 21.25 3.22 21 XM_Body_Dirty_Words 27447 14.03 20.82 12.39 22 RELAYCOUNTRY_META 27357 8.40 20.76 5.41 23 DCC_CHECK_NEGATIVE 27152 51.17 20.60 58.55 24 T_KAM_HTML_FONT_INVALID 26980 17.83 20.47 17.19 25 FSL_BULK_SIG 24872 9.11 18.87 6.75 26 MultiRelay 24594 18.18 18.66 18.06 27 BOTNET_IPINHOSTNAME 21862 6.71 16.59 4.33 28 TR_DCC_Bayes_99 21442 4.65 16.27 1.85 29 BAYES_999 21373 5.27 16.22 2.63 30 XM_B_Unsub 21048 11.25 15.97 10.11 31 XM_Multi_Part_URI 20364 13.20 15.45 12.66 32 LOTS_OF_MONEY 19088 9.85 14.48 8.74 33 DKIM_INVALID 17890 6.78 13.57 5.14 34 UNTRUSTED_Relay 17563 3.73 13.33 1.41 35 XMSexyCombo_05 17020 6.05 12.91 4.39 36 XMPhish08 16782 4.13 12.73 2.06 37 HTML_IMAGE_RATIO_02 16616 8.75 12.61 7.82 38 XM_UncommonTLD01 14926 4.48 11.32 2.83 39 XM_Evil_Numbers_Gen 14764 9.14 11.20 8.64 40 NO_DNS_FOR_FROM 14356 4.51 10.89 2.97 41 ALL_TRUSTED 12169 16.84 9.23 18.67 42 XMSubMetaSx_00 11420 5.36 8.66 4.56 43 RCVD_IN_MSPIKE_H2 10567 10.63 8.02 11.26 44 XM_UB50 9964 2.05 7.56 0.72 45 LotsOfNums_01 9962 7.57 7.56 7.58 46 TO_NO_BRKTS_HTML_ONLY 9874 1.71 7.49 0.31 47 XM_H_Long_From01 9622 6.05 7.30 5.74 48 XM_B_Phish_Phrases 9479 6.75 7.19 6.65 49 XM_DIRTYINTL 9056 3.31 6.87 2.45 50 MPART_ALT_DIFF 8826 5.09 6.70 4.70 51 KHOP_HELO_FCRDNS 8234 2.68 6.25 1.82 52 BAYES_80 7969 2.86 6.05 2.09 53 XM_SPF_SoftFail 7963 2.64 6.04 1.81 54 TooManyTo_001 7376 7.28 5.60 7.69 55 BAYES_60 7373 4.72 5.59 4.51 56 HTML_MIME_NO_HTML_TAG 7083 2.57 5.37 1.89 57 TO_IN_SUBJ 7074 1.35 5.37 0.38 58 PDS_FROM_NAME_TO_DOMAIN 7012 1.32 5.32 0.36 59 PDS_FRNOM_TODOM_NAKED_TO 7011 1.32 5.32 0.36 60 HTML_IMAGE_RATIO_04 6836 5.00 5.19 4.95 61 XM_SendGrid 6669 5.53 5.06 5.64 62 HTML_IMAGE_RATIO_06 6076 4.22 4.61 4.12 63 RELAYCOUNTRY_CA 6037 2.19 4.58 1.62 64 RCVD_IN_BL_SPAMCOP_NET 5878 1.79 4.46 1.15 65 XM_OfRef6 5786 1.91 4.39 1.31 66 MIME_QP_LONG_LINE 5781 5.26 4.39 5.47 67 TM2_M_URI_OPT_OUT 5730 6.29 4.35 6.76 68 TR_XM_PHPDW 5718 1.54 4.34 0.86 69 TR_XM_PHPForged 5668 1.52 4.30 0.84 70 TR_XM_FormFill2 5644 1.51 4.28 0.84 71 XM_H_PHPOS 5635 1.50 4.28 0.84 72 BAYES_40 5575 5.55 4.23 5.86 73 XMNumbers 5456 3.52 4.14 3.36 74 MIME_HTML_MOSTLY 5373 2.83 4.08 2.53 75 SpammyFromTLD_02 5225 1.01 3.96 0.30 76 BAYES_20 4976 4.49 3.78 4.66 77 RELAYCOUNTRY_FR 4970 0.94 3.77 0.25 78 T_XMDrugObfuBody_14 4846 2.13 3.68 1.75 79 XM_URI_RBL 4761 0.91 3.61 0.26 80 RDNS_DYNAMIC 4643 0.96 3.52 0.34 81 BAYES_00 4552 21.06 3.45 25.31 82 RCVD_IN_MSPIKE_H3 4544 8.12 3.45 9.25 83 RCVD_IN_MSPIKE_WL 4544 8.12 3.45 9.25 84 XMHTML_After_End 4453 1.48 3.38 1.03 85 SUBJ_ALL_CAPS 4453 1.77 3.38 1.38 86 T_REMOTE_IMAGE 4409 3.59 3.35 3.64 87 BAYES_95 4340 1.73 3.29 1.36 88 XMStrtUSub 4265 4.02 3.24 4.21 89 XM_CamelCaseFrm001 4249 2.44 3.22 2.25 90 FROM_EXCESS_BASE64 4240 3.11 3.22 3.08 91 T_FILL_THIS_FORM_SHORT 4210 1.41 3.19 0.98 92 MIME_HTML_ONLY_MULTI 4173 3.06 3.17 3.03 93 RCVD_IN_RP_RNBL 4135 0.69 3.14 0.10 94 XM_B_SpammyTLD 4053 2.00 3.08 1.74 95 MultiRelay_Combo 3916 0.72 2.97 0.17 96 MultiRelay_CC 3916 0.72 2.97 0.17 97 T_XMDrugObfuBody_08 3857 1.83 2.93 1.56 98 T_TooManySym_01 3621 4.02 2.75 4.32 99 URI_HEX 3504 1.48 2.66 1.20 100 TR_XM_DK_Bayes 3504 13.13 2.66 15.66 101 DKIM_ADSP_NXDOMAIN 3409 0.77 2.59 0.33 102 XMSexyCombo_01 3366 1.08 2.55 0.72 103 SpammyFromTLD_01 3363 1.00 2.55 0.63 104 XMDiploma_00 3363 1.82 2.55 1.64 105 MONEY_FRAUD_5 3345 0.50 2.54 0.01 106 HTML_IMAGE_RATIO_08 3333 2.58 2.53 2.59 107 FROM_SUSPICIOUS_NTLD 3248 0.50 2.46 0.03 108 FROM_SUSPICIOUS_NTLD_FP 3219 0.50 2.44 0.03 109 BOTNET_NORDNS 3198 0.51 2.43 0.04 110 RELAYCOUNTRY_IN 3122 0.56 2.37 0.12 111 XM_B_Unsub2 3118 2.53 2.37 2.57 112 XM_OfRef7 3111 0.57 2.36 0.14 113 PDS_OTHER_BAD_TLD 3093 0.80 2.35 0.42 114 XM_BadFromFormat 3067 0.54 2.33 0.11 115 TR_XM_INV_DKIM 3056 0.52 2.32 0.08 116 TR_XM_DK_SendGrid 3004 3.01 2.28 3.18 117 FILL_THIS_FORM 2929 0.81 2.22 0.47 118 TR_Mismatch_TLD_02 2902 0.48 2.20 0.07 119 FORM_FRAUD_5 2847 0.42 2.16 0.00 120 RCVD_IN_MSPIKE_BL 2832 1.46 2.15 1.29 121 HTML_SHORT_LINK_IMG_1 2742 0.43 2.08 0.03 122 XMStockSpam_06 2684 1.25 2.04 1.06 123 RCVD_IN_RP_SAFE 2684 6.86 2.04 8.02 124 MONEY_FORM 2679 0.40 2.03 0.01 125 BAYES_05 2553 3.20 1.94 3.50 126 DATE_IN_PAST_03_06 2533 0.46 1.92 0.11 127 TR_XM_DK_Bayes1 2499 12.21 1.90 14.70 128 RCVD_IN_RP_CERTIFIED 2493 6.21 1.89 7.25 129 T_FILL_THIS_FORM_LOAN 2414 0.62 1.83 0.33 130 RELAYCOUNTRY_GB 2372 1.49 1.80 1.41 131 XM_Lotto 2370 0.39 1.80 0.06 132 RCVD_IN_PSBL 2327 0.35 1.77 0.00 133 XM_OfRef8 2260 0.36 1.71 0.03 134 T_XMHurry_00 2258 0.90 1.71 0.70 135 TM2_M_VERY_LONG_WORD 2227 1.42 1.69 1.36 136 XMGenDplmaNmb 2139 1.21 1.62 1.11 137 RCVD_IN_IADB_LISTED 2109 4.44 1.60 5.13 138 MONEY_ATM_CARD 2108 0.31 1.60 0.00 139 ADVANCE_FEE_4_NEW_FRM_MNY 2099 0.31 1.59 0.00 140 RELAYCOUNTRY_DE 2086 0.63 1.58 0.40 141 HTML_IMAGE_ONLY_08 2082 0.42 1.58 0.14 142 XMBody_17 2054 1.01 1.56 0.88 143 MAILING_LIST_MULTI 1975 2.02 1.50 2.15 144 TR_LOTS_OF_MONEY2 1962 0.62 1.49 0.41 145 T_MONEY_PERCENT 1962 0.62 1.49 0.41 146 URIBL_SBL_A 1936 0.53 1.47 0.30 147 RCVD_IN_IADB_SPF 1907 3.84 1.45 4.42 148 TR_Symld_Words 1907 1.60 1.45 1.63 149 T_XMDrugObfuBody_00 1890 0.92 1.43 0.79 150 NO_FM_NAME_IP_HOSTN 1878 0.28 1.42 0.00 151 RCVD_IN_IADB_DK 1863 3.30 1.41 3.75 152 RCVD_IN_IADB_SENDERID 1845 3.35 1.40 3.81 153 RCVD_IN_MSPIKE_L3 1816 0.84 1.38 0.71 154 MIME_HEADER_CTYPE_ONLY 1785 0.43 1.35 0.20 155 TR_XM_DK_Bayes2 1734 10.74 1.32 13.01 156 HDRS_LCASE_IMGONLY 1717 0.26 1.30 0.01 157 HDRS_MISSP 1708 0.26 1.30 0.01 158 THIS_AD 1678 0.41 1.27 0.20 159 XMPhish11 1667 1.08 1.26 1.03 160 XM_H_PHPMailer 1658 0.61 1.26 0.46 161 TR_LOTS_OF_MONEY3 1655 0.48 1.26 0.30 162 REMOVE_BEFORE_LINK 1611 0.50 1.22 0.33 163 DKIM_ADSP_CUSTOM_MED 1573 1.06 1.19 1.02 164 DIET_1 1551 0.83 1.18 0.74 165 XM_H_PHPOS_M 1532 0.63 1.16 0.51 166 SHORT_IMG_SUSP_NTLD 1512 0.22 1.15 0.00 167 T_Symld_Words_02 1494 0.77 1.13 0.68 168 XM_DK_Undo_01 1482 1.42 1.12 1.49 169 HTTPS_HTTP_MISMATCH 1475 0.66 1.12 0.55 170 XM_H_Long_From02 1474 1.02 1.12 1.00 171 TVD_SPACE_RATIO_MINFP 1452 0.23 1.10 0.02 172 XMSubMetaI_00 1452 0.61 1.10 0.49 173 TVD_SPACE_RATIO 1451 0.49 1.10 0.35 174 UNPARSEABLE_RELAY 1440 1.71 1.09 1.86 175 LongTLD 1406 0.35 1.07 0.17 176 HTML_TAG_BALANCE_BODY 1402 0.60 1.06 0.49 177 DATE_IN_PAST_06_12 1396 0.24 1.06 0.04 178 FORGED_GMAIL_RCVD 1395 0.64 1.06 0.54 179 URIBL_DBL_ABUSE_REDIR 1378 0.65 1.05 0.55 180 NML_ADSP_CUSTOM_MED 1373 0.78 1.04 0.72 181 XM_H_MailChimp 1363 0.37 1.03 0.21 182 FROM_MISSP_REPLYTO 1360 0.21 1.03 0.01 183 XMSexyCombo_04 1349 0.29 1.02 0.11 184 XMBody_78 1327 0.53 1.01 0.42 185 XM_ProductURIs 1292 0.61 0.98 0.52 186 TR_Mismatch_TLD_01 1279 0.37 0.97 0.23 187 XM_UB60 1275 0.24 0.97 0.06 188 MPART_ALT_DIFF_COUNT 1263 0.42 0.96 0.29 189 XMPhish30 1260 0.63 0.96 0.55 190 XMBdyGiftCard01 1256 0.93 0.95 0.92 191 URI_TRY_3LD 1238 1.20 0.94 1.27 192 XMPhish14 1213 0.71 0.92 0.66 193 HTML_TAG_BALANCE_CENTER 1202 0.28 0.91 0.12 194 URIBL_BLACK 1200 0.19 0.91 0.02 195 XMSlimDrugH 1196 0.43 0.91 0.32 196 HTML_FONT_SIZE_LARGE 1181 0.27 0.90 0.12 197 T_TooManySym_02 1164 1.99 0.88 2.26 198 MISSING_HEADERS 1141 0.62 0.87 0.56 199 XMHTMLBadTable_001 1131 0.62 0.86 0.56 200 XM_PDF 1129 3.46 0.86 4.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 466777 86.96 92.96 85.51 2 DKIM_SIGNED 392389 72.19 73.45 71.88 3 XM_DK_Pass 386309 70.77 70.78 70.77 4 XM_B_Unicode 372411 69.67 75.67 68.22 5 DKIM_VALID 364324 65.41 59.88 66.74 6 DCC_CHECK_NEGATIVE 319589 51.17 20.60 58.55 7 DKIM_VALID_AU 274093 48.97 43.84 50.21 8 XMListUnsubscribeExists 269993 51.94 62.22 49.46 9 BAYES_50 269200 49.48 50.16 49.31 10 XM_B_Unicode3 215678 40.74 45.83 39.51 11 DCC_CHECK 214997 46.77 77.38 39.39 12 T_TM2_M_HEADER_IN_MSG 160194 28.53 25.16 29.35 13 HTML_FONT_LOW_CONTRAST 147386 28.45 34.46 27.00 14 BAYES_00 138189 21.06 3.45 25.31 15 DKIM_VALID_EF 135081 24.34 22.66 24.75 16 LOC_TINY_FONT_1 122125 23.97 30.56 22.37 17 FVGT_m_MULTI_ODD 113247 21.20 23.10 20.75 18 XMSubLong 110652 20.90 23.49 20.27 19 MIME_HTML_ONLY 106898 23.39 39.16 19.58 20 ALL_TRUSTED 101934 16.84 9.23 18.67 21 MultiRelay 98578 18.18 18.66 18.06 22 T_KAM_HTML_FONT_INVALID 93850 17.83 20.47 17.19 23 TR_XM_DK_Bayes 85480 13.13 2.66 15.66 24 TR_XM_DK_Bayes1 80253 12.21 1.90 14.70 25 TR_XM_DK_Bayes2 71024 10.74 1.32 13.01 26 XM_Multi_Part_URI 69084 13.20 15.45 12.66 27 XM_Body_Dirty_Words 67619 14.03 20.82 12.39 28 RCVD_IN_MSPIKE_H2 61460 10.63 8.02 11.26 29 XM_B_Unsub 55168 11.25 15.97 10.11 30 RCVD_IN_MSPIKE_WL 50477 8.12 3.45 9.25 31 RCVD_IN_MSPIKE_H3 50477 8.12 3.45 9.25 32 LOTS_OF_MONEY 47694 9.85 14.48 8.74 33 XM_Evil_Numbers_Gen 47174 9.14 11.20 8.64 34 RCVD_IN_RP_SAFE 43798 6.86 2.04 8.02 35 HTML_IMAGE_RATIO_02 42671 8.75 12.61 7.82 36 TooManyTo_001 41975 7.28 5.60 7.69 37 LotsOfNums_01 41367 7.57 7.56 7.58 38 RCVD_IN_RP_CERTIFIED 39574 6.21 1.89 7.25 39 XM_DK_Undo_02 39143 12.70 35.58 7.17 40 ANY_BOUNCE_MESSAGE 38330 5.77 0.61 7.02 41 BOUNCE_MESSAGE 38327 5.77 0.60 7.02 42 XM_DKIMWhitelistDomains 37979 5.63 0.12 6.96 43 TM2_M_URI_OPT_OUT 36902 6.29 4.35 6.76 44 FSL_BULK_SIG 36859 9.11 18.87 6.75 45 XM_B_Phish_Phrases 36298 6.75 7.19 6.65 46 BAYES_40 32008 5.55 4.23 5.86 47 XM_H_Long_From01 31359 6.05 7.30 5.74 48 XM_SendGrid 30802 5.53 5.06 5.64 49 MIME_QP_LONG_LINE 29866 5.26 4.39 5.47 50 RELAYCOUNTRY_META 29553 8.40 20.76 5.41 51 DKIM_INVALID 28065 6.78 13.57 5.14 52 RCVD_IN_IADB_LISTED 27985 4.44 1.60 5.13 53 HTML_IMAGE_RATIO_04 27037 5.00 5.19 4.95 54 MPART_ALT_DIFF 25644 5.09 6.70 4.70 55 BAYES_20 25450 4.49 3.78 4.66 56 XMSubMetaSx_00 24903 5.36 8.66 4.56 57 BAYES_60 24615 4.72 5.59 4.51 58 RCVD_IN_IADB_SPF 24115 3.84 1.45 4.42 59 XMSexyCombo_05 23961 6.05 12.91 4.39 60 BOTNET_IPINHOSTNAME 23644 6.71 16.59 4.33 61 T_TooManySym_01 23590 4.02 2.75 4.32 62 XMStrtUSub 22986 4.02 3.24 4.21 63 HTML_IMAGE_RATIO_06 22512 4.22 4.61 4.12 64 XM_PDF 22300 3.46 0.86 4.09 65 RCVD_IN_IADB_SENDERID 20824 3.35 1.40 3.81 66 RCVD_IN_IADB_DK 20481 3.30 1.41 3.75 67 IN_ZIMBRA_NJ_WHITELIST 20032 2.96 0.02 3.67 68 T_REMOTE_IMAGE 19895 3.59 3.35 3.64 69 BAYES_05 19121 3.20 1.94 3.50 70 RCVD_IN_IADB_VOUCHED 18986 2.90 0.53 3.48 71 XMNumbers 18365 3.52 4.14 3.36 72 BAYES_99 17557 6.72 21.25 3.22 73 TR_XM_DK_SendGrid 17363 3.01 2.28 3.18 74 FROM_EXCESS_BASE64 16827 3.11 3.22 3.08 75 MIME_HTML_ONLY_MULTI 16564 3.06 3.17 3.03 76 NO_DNS_FOR_FROM 16208 4.51 10.89 2.97 77 BOTNET 15913 6.99 23.84 2.92 78 XM_UncommonTLD01 15434 4.48 11.32 2.83 79 BAYES_999 14372 5.27 16.22 2.63 80 HTML_IMAGE_RATIO_08 14125 2.58 2.53 2.59 81 XM_B_Unsub2 14051 2.53 2.37 2.57 82 MIME_HTML_MOSTLY 13810 2.83 4.08 2.53 83 XM_DIRTYINTL 13393 3.31 6.87 2.45 84 XM_H_Trusted_IP 13348 1.97 0.00 2.45 85 T_TooManySym_02 12315 1.99 0.88 2.26 86 RCVD_IN_IADB_OPTIN 12313 1.88 0.32 2.26 87 XM_CamelCaseFrm001 12291 2.44 3.22 2.25 88 MAILING_LIST_MULTI 11746 2.02 1.50 2.15 89 BAYES_80 11421 2.86 6.05 2.09 90 XMPhish08 11229 4.13 12.73 2.06 91 TooManyTo_002 10378 1.66 0.66 1.90 92 HTML_MIME_NO_HTML_TAG 10301 2.57 5.37 1.89 93 UNPARSEABLE_RELAY 10151 1.71 1.09 1.86 94 TR_DCC_Bayes_99 10094 4.65 16.27 1.85 95 KHOP_HELO_FCRDNS 9917 2.68 6.25 1.82 96 XM_SPF_SoftFail 9897 2.64 6.04 1.81 97 T_XMDrugObfuBody_14 9566 2.13 3.68 1.75 98 XM_B_SpammyTLD 9498 2.00 3.08 1.74 99 TVD_RCVD_IP 9007 1.42 0.49 1.65 100 XMDiploma_00 8949 1.82 2.55 1.64 101 TR_Symld_Words 8922 1.60 1.45 1.63 102 RELAYCOUNTRY_CA 8824 2.19 4.58 1.62 103 HELO_NODOT 8587 1.37 0.53 1.57 104 HELO_NO_DOMAIN 8543 1.36 0.52 1.56 105 T_XMDrugObfuBody_08 8527 1.83 2.93 1.56 106 XM_DK_Undo_01 8123 1.42 1.12 1.49 107 IN_HORDE_ADDRESS_BOOK 7725 1.15 0.04 1.42 108 RELAYCOUNTRY_GB 7724 1.49 1.80 1.41 109 UNTRUSTED_Relay 7721 3.73 13.33 1.41 110 SUBJ_ALL_CAPS 7536 1.77 3.38 1.38 111 INVALID_MSGID 7482 1.13 0.15 1.37 112 TM2_M_VERY_LONG_WORD 7408 1.42 1.69 1.36 113 BAYES_95 7400 1.73 3.29 1.36 114 XM_OfRef6 7174 1.91 4.39 1.31 115 TooManyTo_003 7107 1.15 0.52 1.30 116 RCVD_IN_MSPIKE_BL 7051 1.46 2.15 1.29 117 XMCapTrack 7032 1.14 0.52 1.29 118 URI_TRY_3LD 6909 1.20 0.94 1.27 119 TO_MALFORMED 6855 1.07 0.29 1.26 120 XMSubNoVowel 6696 1.05 0.32 1.23 121 URI_HEX 6550 1.48 2.66 1.20 122 RCVD_IN_BL_SPAMCOP_NET 6266 1.79 4.46 1.15 123 USER_IN_DEF_DKIM_WL 6194 0.92 0.01 1.13 124 CK_HELO_DYNAMIC_SPLIT_IP 6168 0.94 0.14 1.13 125 HELO_DYNAMIC_IPADDR2 6160 0.91 0.03 1.13 126 XMGenDplmaNmb 6055 1.21 1.62 1.11 127 XM_GoogleGroups 5896 0.95 0.40 1.08 128 XMStockSpam_06 5761 1.25 2.04 1.06 129 XMPhish11 5621 1.08 1.26 1.03 130 XMHTML_After_End 5608 1.48 3.38 1.03 131 DKIM_ADSP_CUSTOM_MED 5588 1.06 1.19 1.02 132 TR_MetaPhish_Combo_01 5588 0.97 0.75 1.02 133 XM_H_Long_From02 5469 1.02 1.12 1.00 134 T_FILL_THIS_FORM_SHORT 5323 1.41 3.19 0.98 135 XMGappySubj_01 5185 0.83 0.33 0.95 136 TooManyTo_004 5144 0.84 0.42 0.94 137 XMBdyGiftCard01 5047 0.93 0.95 0.92 138 XMBody_17 4824 1.01 1.56 0.88 139 TR_XM_PHPDW 4704 1.54 4.34 0.86 140 TR_XM_PHPForged 4600 1.52 4.30 0.84 141 TR_XM_FormFill2 4585 1.51 4.28 0.84 142 XM_H_PHPOS 4561 1.50 4.28 0.84 143 T_XMDrugObfuBody_00 4318 0.92 1.43 0.79 144 TooManyTo_005 4276 0.70 0.34 0.78 145 DIET_1 4052 0.83 1.18 0.74 146 HTML_FONT_FACE_BAD 3992 0.72 0.66 0.73 147 XM_UB50 3949 2.05 7.56 0.72 148 NML_ADSP_CUSTOM_MED 3926 0.78 1.04 0.72 149 XMSexyCombo_01 3920 1.08 2.55 0.72 150 RCVD_IN_MSPIKE_L3 3855 0.84 1.38 0.71 151 T_XMHurry_00 3820 0.90 1.71 0.70 152 XMSolicitRefs_0 3723 0.66 0.57 0.68 153 T_Symld_Words_02 3715 0.77 1.13 0.68 154 FROM_GOV_DKIM_AU 3714 0.59 0.20 0.68 155 XMPhish14 3578 0.71 0.92 0.66 156 XMNoVowels 3541 0.67 0.75 0.65 157 SpammyFromTLD_01 3439 1.00 2.55 0.63 158 XM_SPF_Unknown 3316 0.64 0.80 0.61 159 XMBody_95 3285 0.52 0.16 0.60 160 XMMoneyMeta_00 3134 0.59 0.68 0.57 161 MISSING_HEADERS 3084 0.62 0.87 0.56 162 XMHTMLBadTable_001 3076 0.62 0.86 0.56 163 URIBL_DBL_ABUSE_REDIR 3023 0.65 1.05 0.55 164 HTTPS_HTTP_MISMATCH 3014 0.66 1.12 0.55 165 XMPhish30 3005 0.63 0.96 0.55 166 FORGED_GMAIL_RCVD 2934 0.64 1.06 0.54 167 PLING_QUERY 2924 0.60 0.84 0.54 168 T_OBFU_PDF_ATTACH 2876 0.46 0.20 0.53 169 XM_ProductURIs 2851 0.61 0.98 0.52 170 XM_ShortIntro_01 2773 0.50 0.47 0.51 171 XM_H_PHPOS_M 2757 0.63 1.16 0.51 172 HTML_IMAGE_ONLY_20 2722 0.50 0.49 0.50 173 XMSubMetaI_00 2692 0.61 1.10 0.49 174 HTML_TAG_BALANCE_BODY 2668 0.60 1.06 0.49 175 FILL_THIS_FORM 2585 0.81 2.22 0.47 176 XMBrknScrpt_02 2583 0.53 0.78 0.47 177 XM_B_REG_HTML 2558 0.45 0.36 0.47 178 XM_H_PHPMailer 2505 0.61 1.26 0.46 179 SUBJ_DOLLARS 2487 0.46 0.50 0.46 180 T_TooManySym_03 2467 0.43 0.32 0.45 181 RELAYCOUNTRY_AU 2455 0.46 0.52 0.45 182 XMLngstWrd_00 2367 0.44 0.46 0.43 183 USER_IN_WHITELIST 2364 0.35 0.00 0.43 184 SHORT_HELO_AND_INLINE_IMAGE 2351 0.35 0.03 0.43 185 HTML_IMAGE_ONLY_28 2323 0.46 0.58 0.43 186 PDS_OTHER_BAD_TLD 2297 0.80 2.35 0.42 187 XMSubMetaSxObfu_03 2291 0.47 0.69 0.42 188 FROM_GOV_SPOOF 2277 0.40 0.34 0.42 189 XMBody_78 2267 0.53 1.01 0.42 190 TM2_M_BODY_EMPTY 2264 0.35 0.09 0.41 191 T_MONEY_PERCENT 2251 0.62 1.49 0.41 192 TR_LOTS_OF_MONEY2 2251 0.62 1.49 0.41 193 RELAYCOUNTRY_DE 2197 0.63 1.58 0.40 194 SHORT_SHORTNER 2152 0.34 0.14 0.39 195 XMLngstWrd_01 2131 0.40 0.43 0.39 196 HTML_IMAGE_ONLY_32 2127 0.37 0.29 0.39 197 TO_IN_SUBJ 2062 1.35 5.37 0.38 198 RCVD_IN_SORBS_DUL 2018 0.33 0.16 0.37 199 RCVD_IN_MSPIKE_L4 1997 0.31 0.10 0.37 200 XMSubMetaSxObfu_02 1973 0.36 0.35 0.36 ----------------------------------------------------------------------