Email: 577828 Autolearn: 0 AvgScore: 3.18 AvgScanTime: 5.74 sec Spam: 163573 Autolearn: 0 AvgScore: 12.42 AvgScanTime: 6.84 sec Ham: 414255 Autolearn: 0 AvgScore: -0.47 AvgScanTime: 5.31 sec Time Spent Running SA: 921.69 hours Time Spent Processing Spam: 310.69 hours Time Spent Processing Ham: 611.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157165 86.22 96.08 82.33 2 DKIM_SIGNED 142455 72.48 87.09 66.71 3 XM_DK_Pass 138259 70.62 84.52 65.12 4 DCC_CHECK 131887 46.29 80.63 32.73 5 XMListUnsubscribeExists 120822 50.24 73.86 40.91 6 DKIM_VALID 109640 57.82 67.03 54.18 7 XM_H_QuotedFrom 88748 38.76 54.26 32.64 8 DKIM_VALID_AU 86416 42.54 52.83 38.48 9 XM_DK_Undo_02 79656 21.59 48.70 10.88 10 BAYES_99 71136 19.50 43.49 10.03 11 BAYES_999 61090 16.95 37.35 8.90 12 LOC_TINY_FONT_1 60569 22.63 37.03 16.94 13 HTML_FONT_LOW_CONTRAST 60053 25.52 36.71 21.10 14 BAYES_50 57334 53.89 35.05 61.33 15 TR_DCC_Bayes_99 56790 13.46 34.72 5.07 16 MIME_HTML_ONLY 49735 21.98 30.41 18.65 17 FVGT_m_MULTI_ODD 43638 20.07 26.68 17.45 18 XMSubLong 40937 21.39 25.03 19.96 19 XM_Body_Dirty_Words 33507 12.38 20.48 9.18 20 DKIM_INVALID 32815 14.66 20.06 12.53 21 T_TM2_M_HEADER_IN_MSG 31519 28.92 19.27 32.74 22 T_KAM_HTML_FONT_INVALID 29806 13.93 18.22 12.24 23 HTML_IMAGE_RATIO_02 29552 9.67 18.07 6.36 24 DCC_CHECK_NEGATIVE 28338 51.49 17.32 64.97 25 RELAYCOUNTRY_META 26713 8.66 16.33 5.63 26 MultiRelay 26678 19.27 16.31 20.44 27 XM_Multi_Part_URI 25860 11.81 15.81 10.24 28 XM_Evil_Numbers_Gen 24750 9.85 15.13 7.76 29 BOTNET_IPINHOSTNAME 22018 6.82 13.46 4.20 30 DKIM_VALID_EF 20906 15.12 12.78 16.04 31 BOTNET 19420 4.29 11.87 1.30 32 FSL_BULK_SIG 18539 8.41 11.33 7.26 33 XMSexyCombo_05 17663 5.24 10.80 3.05 34 T_XMDrugObfuBody_14 17504 8.09 10.70 7.06 35 HTML_IMAGE_RATIO_04 16825 6.28 10.29 4.70 36 LOTS_OF_MONEY 16121 8.42 9.86 7.86 37 UNTRUSTED_Relay 15659 3.70 9.57 1.38 38 XM_B_Phish_Phrases 15574 6.17 9.52 4.85 39 LotsOfNums_01 14708 8.02 8.99 7.64 40 TooManyTo_001 14319 9.11 8.75 9.25 41 XM_H_Long_From01 13781 6.33 8.42 5.50 42 TR_XM_DocInvoice 12129 5.15 7.42 4.25 43 MPART_ALT_DIFF 11259 3.54 6.88 2.22 44 BAYES_80 11214 4.29 6.86 3.27 45 XMSubMetaSx_00 11213 4.18 6.86 3.13 46 FROM_EXCESS_BASE64 10750 4.05 6.57 3.06 47 XM_UncommonTLD01 9732 4.16 5.95 3.45 48 MIME_QP_LONG_LINE 8746 5.18 5.35 5.12 49 MIME_HTML_MOSTLY 8743 2.94 5.35 1.99 50 BAYES_60 8605 5.41 5.26 5.47 51 RCVD_IN_RP_SAFE 8477 6.76 5.18 7.38 52 XM_UB50 8324 2.11 5.09 0.93 53 XMNumbers 7735 3.74 4.73 3.35 54 TM2_M_URI_OPT_OUT 7440 2.65 4.55 1.91 55 HTML_IMAGE_RATIO_06 7318 3.31 4.47 2.85 56 XMStrtUSub 7134 4.11 4.36 4.01 57 BAYES_95 6945 2.73 4.25 2.13 58 XM_SendGrid 6943 4.96 4.24 5.25 59 XM_DIRTYINTL 6587 2.32 4.03 1.65 60 T_REMOTE_IMAGE 6479 4.28 3.96 4.41 61 RCVD_IN_RP_CERTIFIED 6287 5.67 3.84 6.40 62 XM_SPF_SoftFail 6195 2.61 3.79 2.15 63 URI_HEX 6095 1.87 3.73 1.13 64 T_TooManySym_01 5806 4.04 3.55 4.23 65 RELAYCOUNTRY_CA 5754 1.97 3.52 1.37 66 XMDiploma_00 5577 1.99 3.41 1.43 67 MultiRelay_Combo 5551 1.17 3.39 0.29 68 MultiRelay_CC 5551 1.17 3.39 0.29 69 HTML_IMAGE_RATIO_08 5228 2.09 3.20 1.65 70 XM_CamelCaseFrm001 5142 1.98 3.14 1.52 71 MIME_HTML_ONLY_MULTI 4511 1.55 2.76 1.07 72 T_XMDrugObfuBody_08 4449 1.99 2.72 1.70 73 XMSubMetaI_00 4086 1.18 2.50 0.66 74 XM_URI_RBL 4047 0.79 2.47 0.13 75 XMBody_17 4027 0.97 2.46 0.39 76 SUBJ_ALL_CAPS 3976 1.79 2.43 1.54 77 SUBJ_DOLLARS 3942 0.93 2.41 0.35 78 HTML_MIME_NO_HTML_TAG 3819 2.45 2.33 2.50 79 MAILING_LIST_MULTI 3746 2.72 2.29 2.89 80 RCVD_IN_BL_SPAMCOP_NET 3741 0.87 2.29 0.31 81 XM_OfRef6 3738 1.46 2.29 1.14 82 XMBdyGiftCard01 3615 1.46 2.21 1.16 83 XM_H_Long_From02 3504 1.25 2.14 0.90 84 XMGenDplmaNmb 3450 1.25 2.11 0.91 85 XMSexyCombo_01 3447 0.90 2.11 0.42 86 BAYES_00 3279 7.09 2.00 9.09 87 RELAYCOUNTRY_FR 3098 0.80 1.89 0.36 88 TM2_M_VERY_LONG_WORD 3074 1.16 1.88 0.87 89 T_XMHurry_00 3013 0.91 1.84 0.54 90 RCVD_IN_RP_RNBL 2834 0.50 1.73 0.01 91 TR_XM_DK_Bayes 2793 4.75 1.71 5.95 92 SpammyFromTLD_02 2787 0.63 1.70 0.21 93 RCVD_IN_MSPIKE_H2 2691 3.12 1.65 3.70 94 RELAYCOUNTRY_GB 2689 1.50 1.64 1.44 95 XMPhish30 2681 0.68 1.64 0.30 96 SpammyFromTLD_01 2674 1.05 1.63 0.82 97 TR_XM_RelayPhish 2674 0.92 1.63 0.64 98 XM_ProductURIs 2589 1.07 1.58 0.87 99 XM_RXBody 2577 0.96 1.58 0.72 100 RCVD_IN_IADB_LISTED 2559 3.59 1.56 4.39 101 BOTNET_NORDNS 2510 0.45 1.53 0.02 102 XM_DK_Undo_01 2490 1.85 1.52 1.98 103 XMPhish14 2475 0.66 1.51 0.32 104 UNPARSEABLE_RELAY 2432 2.83 1.49 3.36 105 BODY_ENHANCEMENT 2429 0.43 1.48 0.02 106 T_MONEY_PERCENT 2359 0.66 1.44 0.35 107 TR_LOTS_OF_MONEY2 2359 0.66 1.44 0.35 108 URIBL_BLACK 2358 0.44 1.44 0.04 109 BAYES_40 2357 3.28 1.44 4.00 110 TooManyTo_002 2318 2.53 1.42 2.97 111 XMStockSpam_06 2279 1.43 1.39 1.44 112 XMHTML_After_End 2276 0.62 1.39 0.32 113 RCVD_IN_IADB_SPF 2222 3.11 1.36 3.80 114 URI_TRY_3LD 2187 0.88 1.34 0.70 115 LONG_JUNK_URI 2165 0.50 1.32 0.18 116 XM_UB99 2129 0.38 1.30 0.02 117 RCVD_IN_IADB_DK 2089 2.69 1.28 3.25 118 TR_Symld_Words 2088 2.16 1.28 2.51 119 RCVD_IN_IADB_SENDERID 2085 2.73 1.27 3.31 120 TR_XM_DK_Bayes1 2047 3.82 1.25 4.83 121 TooManyTo_003 2031 1.76 1.24 1.97 122 XM_B_REG_HTML 1997 0.56 1.22 0.30 123 T_XMDrugObfuBody_00 1979 0.72 1.21 0.52 124 XMPhish11 1939 1.12 1.19 1.10 125 DIET_1 1935 0.50 1.18 0.23 126 ALL_TRUSTED 1929 15.73 1.18 21.48 127 XMBody_78 1927 0.84 1.18 0.71 128 XM_BadFromFormat 1914 0.51 1.17 0.24 129 XMSubMetaSSx_00 1913 0.46 1.17 0.18 130 T_Symld_Words_02 1896 0.71 1.16 0.54 131 XM_HighProb1 1835 0.33 1.12 0.01 132 T_FILL_THIS_FORM_SHORT 1789 1.03 1.09 1.01 133 RELAYCOUNTRY_AT 1784 0.39 1.09 0.11 134 INVALID_DATE 1783 0.37 1.09 0.09 135 TooManyTo_004 1766 1.38 1.08 1.50 136 REMOVE_BEFORE_LINK 1732 0.63 1.06 0.46 137 BODY_URI_ONLY 1731 0.37 1.06 0.09 138 RELAYCOUNTRY_CN 1725 0.35 1.05 0.08 139 BAYES_20 1717 2.37 1.05 2.90 140 HTML_FONT_FACE_BAD 1703 0.52 1.04 0.32 141 TR_XM_DK_Bayes2 1702 3.10 1.04 3.91 142 XM_UB999 1681 0.31 1.03 0.02 143 XM_S_JOY_D 1678 0.73 1.03 0.61 144 XM_UB60 1633 0.32 1.00 0.05 145 MPART_ALT_DIFF_COUNT 1619 0.45 0.99 0.24 146 XM_PDF 1613 4.28 0.99 5.59 147 TooManyTo_005 1594 1.18 0.97 1.26 148 URIBL_DBL_SPAM 1589 0.28 0.97 0.01 149 GAPPY_SUBJECT 1529 0.32 0.93 0.07 150 T_TooManySym_02 1523 1.45 0.93 1.66 151 XMSubNoVowel 1505 0.56 0.92 0.41 152 FILL_THIS_FORM 1493 0.50 0.91 0.34 153 XM_B_COPY_HTML 1482 0.45 0.91 0.28 154 DKIM_ADSP_CUSTOM_MED 1427 1.06 0.87 1.13 155 XM_H_PHPOS 1403 1.25 0.86 1.40 156 RDNS_DYNAMIC 1389 0.49 0.85 0.35 157 XMGappySubj_01 1384 0.91 0.85 0.94 158 RCVD_IN_MSPIKE_WL 1382 2.42 0.84 3.04 159 T_HTML_TAG_BALANCE_CENTER 1371 0.36 0.84 0.17 160 RCVD_IN_MSPIKE_H3 1368 2.40 0.84 3.02 161 HTML_IMAGE_ONLY_28 1340 0.54 0.82 0.43 162 HTTPS_HTTP_MISMATCH 1337 0.60 0.82 0.52 163 ANY_BOUNCE_MESSAGE 1326 4.57 0.81 6.06 164 BOUNCE_MESSAGE 1326 4.57 0.81 6.06 165 PLING_QUERY 1326 0.50 0.81 0.38 166 XM_B_TRADE_HTML 1321 0.60 0.81 0.52 167 FILL_THIS_FORM_LONG 1315 0.27 0.80 0.06 168 RCVD_IN_MSPIKE_BL 1310 0.52 0.80 0.41 169 XMBrknScrpt_02 1303 0.98 0.80 1.05 170 XMSubGiftCard1 1279 0.34 0.78 0.17 171 RCVD_IN_PSBL 1255 0.26 0.77 0.06 172 XM_GoogleGroups 1251 1.17 0.76 1.33 173 HTML_FONT_SIZE_HUGE 1239 0.29 0.76 0.11 174 HTML_SHORT_LINK_IMG_1 1238 0.23 0.76 0.02 175 RELAYCOUNTRY_AU 1236 0.56 0.76 0.49 176 FILL_THIS_FORM_LOAN 1224 0.23 0.75 0.03 177 XMSexyCombo_04 1215 0.24 0.74 0.04 178 RELAYCOUNTRY_DE 1213 0.60 0.74 0.54 179 XM_H_PHPMailer 1196 0.67 0.73 0.65 180 THIS_AD 1191 0.29 0.73 0.12 181 HTML_TAG_BALANCE_BODY 1183 0.43 0.72 0.32 182 XMClaimOffer 1180 0.31 0.72 0.15 183 XMHTMLBadTable_001 1171 0.43 0.72 0.32 184 URI_NOVOWEL 1170 0.48 0.72 0.39 185 RCVD_IN_IADB_VOUCHED 1154 2.39 0.71 3.06 186 LOW_PRICE 1148 0.61 0.70 0.57 187 TR_Caps_n_Bayes_99 1145 0.22 0.70 0.02 188 TR_Mismatch_TLD_02 1143 0.23 0.70 0.05 189 LongTLD 1140 0.30 0.70 0.15 190 XMSubEmpty 1128 0.46 0.69 0.37 191 XM_Body_Obfu01 1120 0.40 0.68 0.29 192 XM_UB80 1116 0.20 0.68 0.01 193 NML_ADSP_CUSTOM_MED 1103 0.79 0.67 0.84 194 RELAYCOUNTRY_JP 1022 0.21 0.62 0.05 195 XM_Combo_Sbj 1019 0.37 0.62 0.27 196 XMSubMetaSxObfu_03 1018 0.38 0.62 0.29 197 RCVD_IN_MSPIKE_L5 1013 0.21 0.62 0.05 198 LONG_JUNK_URI3 994 0.22 0.61 0.07 199 XMSolicitRefs_0 991 0.46 0.61 0.40 200 BAYES_05 986 1.44 0.60 1.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 341051 86.22 96.08 82.33 2 DKIM_SIGNED 276358 72.48 87.09 66.71 3 XM_DK_Pass 269782 70.62 84.52 65.12 4 DCC_CHECK_NEGATIVE 269161 51.49 17.32 64.97 5 BAYES_50 254070 53.89 35.05 61.33 6 DKIM_VALID 224458 57.82 67.03 54.18 7 XMListUnsubscribeExists 169477 50.24 73.86 40.91 8 DKIM_VALID_AU 159392 42.54 52.83 38.48 9 T_TM2_M_HEADER_IN_MSG 135611 28.92 19.27 32.74 10 DCC_CHECK 135576 46.29 80.63 32.73 11 XM_H_QuotedFrom 135232 38.76 54.26 32.64 12 ALL_TRUSTED 88986 15.73 1.18 21.48 13 HTML_FONT_LOW_CONTRAST 87418 25.52 36.71 21.10 14 MultiRelay 84692 19.27 16.31 20.44 15 XMSubLong 82671 21.39 25.03 19.96 16 MIME_HTML_ONLY 77272 21.98 30.41 18.65 17 FVGT_m_MULTI_ODD 72308 20.07 26.68 17.45 18 LOC_TINY_FONT_1 70177 22.63 37.03 16.94 19 DKIM_VALID_EF 66449 15.12 12.78 16.04 20 DKIM_INVALID 51900 14.66 20.06 12.53 21 T_KAM_HTML_FONT_INVALID 50703 13.93 18.22 12.24 22 XM_DK_Undo_02 45081 21.59 48.70 10.88 23 XM_Multi_Part_URI 42403 11.81 15.81 10.24 24 BAYES_99 41562 19.50 43.49 10.03 25 XM_DKIMWhitelistDomains 41081 7.12 0.02 9.92 26 TooManyTo_001 38326 9.11 8.75 9.25 27 XM_Body_Dirty_Words 38011 12.38 20.48 9.18 28 BAYES_00 37661 7.09 2.00 9.09 29 BAYES_999 36857 16.95 37.35 8.90 30 LOTS_OF_MONEY 32557 8.42 9.86 7.86 31 XM_Evil_Numbers_Gen 32164 9.85 15.13 7.76 32 LotsOfNums_01 31659 8.02 8.99 7.64 33 RCVD_IN_RP_SAFE 30561 6.76 5.18 7.38 34 FSL_BULK_SIG 30072 8.41 11.33 7.26 35 T_XMDrugObfuBody_14 29234 8.09 10.70 7.06 36 RCVD_IN_RP_CERTIFIED 26495 5.67 3.84 6.40 37 HTML_IMAGE_RATIO_02 26346 9.67 18.07 6.36 38 ANY_BOUNCE_MESSAGE 25097 4.57 0.81 6.06 39 BOUNCE_MESSAGE 25095 4.57 0.81 6.06 40 TR_XM_DK_Bayes 24660 4.75 1.71 5.95 41 IN_ZIMBRA_NJ_WHITELIST 23848 4.14 0.04 5.76 42 RELAYCOUNTRY_META 23341 8.66 16.33 5.63 43 XM_PDF 23137 4.28 0.99 5.59 44 XM_H_Long_From01 22778 6.33 8.42 5.50 45 BAYES_60 22667 5.41 5.26 5.47 46 XM_SendGrid 21742 4.96 4.24 5.25 47 MIME_QP_LONG_LINE 21210 5.18 5.35 5.12 48 TR_DCC_Bayes_99 20997 13.46 34.72 5.07 49 XM_B_Phish_Phrases 20095 6.17 9.52 4.85 50 TR_XM_DK_Bayes1 20003 3.82 1.25 4.83 51 HTML_IMAGE_RATIO_04 19455 6.28 10.29 4.70 52 T_REMOTE_IMAGE 18260 4.28 3.96 4.41 53 RCVD_IN_IADB_LISTED 18190 3.59 1.56 4.39 54 TR_XM_DocInvoice 17615 5.15 7.42 4.25 55 T_TooManySym_01 17535 4.04 3.55 4.23 56 BOTNET_IPINHOSTNAME 17399 6.82 13.46 4.20 57 XMStrtUSub 16609 4.11 4.36 4.01 58 BAYES_40 16572 3.28 1.44 4.00 59 TR_XM_DK_Bayes2 16201 3.10 1.04 3.91 60 RCVD_IN_IADB_SPF 15756 3.11 1.36 3.80 61 RCVD_IN_MSPIKE_H2 15321 3.12 1.65 3.70 62 XM_UncommonTLD01 14291 4.16 5.95 3.45 63 UNPARSEABLE_RELAY 13924 2.83 1.49 3.36 64 XMNumbers 13874 3.74 4.73 3.35 65 RCVD_IN_IADB_SENDERID 13696 2.73 1.27 3.31 66 BAYES_80 13558 4.29 6.86 3.27 67 RCVD_IN_IADB_DK 13456 2.69 1.28 3.25 68 XMSubMetaSx_00 12965 4.18 6.86 3.13 69 FROM_EXCESS_BASE64 12679 4.05 6.57 3.06 70 RCVD_IN_IADB_VOUCHED 12667 2.39 0.71 3.06 71 XMSexyCombo_05 12624 5.24 10.80 3.05 72 RCVD_IN_MSPIKE_WL 12578 2.42 0.84 3.04 73 RCVD_IN_MSPIKE_H3 12505 2.40 0.84 3.02 74 TooManyTo_002 12303 2.53 1.42 2.97 75 BAYES_20 11994 2.37 1.05 2.90 76 MAILING_LIST_MULTI 11988 2.72 2.29 2.89 77 HTML_IMAGE_RATIO_06 11808 3.31 4.47 2.85 78 TVD_RCVD_IP 11190 1.99 0.20 2.70 79 HELO_NODOT 10596 1.94 0.37 2.56 80 TR_Symld_Words 10393 2.16 1.28 2.51 81 HTML_MIME_NO_HTML_TAG 10346 2.45 2.33 2.50 82 MPART_ALT_DIFF 9194 3.54 6.88 2.22 83 IN_HORDE_ADDRESS_BOOK 9122 1.60 0.09 2.20 84 XM_SPF_SoftFail 8908 2.61 3.79 2.15 85 BAYES_95 8808 2.73 4.25 2.13 86 MIME_HTML_MOSTLY 8231 2.94 5.35 1.99 87 XM_DK_Undo_01 8193 1.85 1.52 1.98 88 TooManyTo_003 8145 1.76 1.24 1.97 89 TM2_M_URI_OPT_OUT 7893 2.65 4.55 1.91 90 BAYES_05 7362 1.44 0.60 1.78 91 T_XMDrugObfuBody_08 7048 1.99 2.72 1.70 92 INVALID_MSGID 6918 1.25 0.17 1.67 93 T_TooManySym_02 6870 1.45 0.93 1.66 94 HTML_IMAGE_RATIO_08 6845 2.09 3.20 1.65 95 XM_DIRTYINTL 6841 2.32 4.03 1.65 96 TO_MALFORMED 6366 1.10 0.01 1.54 97 SUBJ_ALL_CAPS 6364 1.79 2.43 1.54 98 XM_CamelCaseFrm001 6296 1.98 3.14 1.52 99 TooManyTo_004 6203 1.38 1.08 1.50 100 XMStockSpam_06 5980 1.43 1.39 1.44 101 RELAYCOUNTRY_GB 5956 1.50 1.64 1.44 102 XMDiploma_00 5904 1.99 3.41 1.43 103 RCVD_IN_IADB_OPTIN 5893 1.13 0.39 1.42 104 XM_H_PHPOS 5809 1.25 0.86 1.40 105 XMCapTrack 5760 1.16 0.56 1.39 106 UNTRUSTED_Relay 5732 3.70 9.57 1.38 107 RELAYCOUNTRY_CA 5657 1.97 3.52 1.37 108 XM_GoogleGroups 5490 1.17 0.76 1.33 109 BOTNET 5381 4.29 11.87 1.30 110 TooManyTo_005 5208 1.18 0.97 1.26 111 USER_IN_DEF_DKIM_WL 4942 0.86 0.01 1.19 112 XMBdyGiftCard01 4813 1.46 2.21 1.16 113 XM_OfRef6 4716 1.46 2.29 1.14 114 URI_HEX 4696 1.87 3.73 1.13 115 DKIM_ADSP_CUSTOM_MED 4678 1.06 0.87 1.13 116 XMPhish11 4548 1.12 1.19 1.10 117 MIME_HTML_ONLY_MULTI 4429 1.55 2.76 1.07 118 XMBrknScrpt_02 4337 0.98 0.80 1.05 119 T_FILL_THIS_FORM_SHORT 4166 1.03 1.09 1.01 120 XM_ShortIntro_01 4087 0.87 0.56 0.99 121 XMGappySubj_01 3891 0.91 0.85 0.94 122 XM_UB50 3868 2.11 5.09 0.93 123 XMGenDplmaNmb 3788 1.25 2.11 0.91 124 T_OBFU_PDF_ATTACH 3732 0.72 0.25 0.90 125 XM_H_Long_From02 3715 1.25 2.14 0.90 126 TM2_M_VERY_LONG_WORD 3616 1.16 1.88 0.87 127 XM_ProductURIs 3586 1.07 1.58 0.87 128 NML_ADSP_CUSTOM_MED 3467 0.79 0.67 0.84 129 SpammyFromTLD_01 3403 1.05 1.63 0.82 130 XMBody_95 3022 0.57 0.16 0.73 131 XM_RXBody 2962 0.96 1.58 0.72 132 USER_IN_WHITELIST 2957 0.51 0.00 0.71 133 XMBody_78 2941 0.84 1.18 0.71 134 URI_TRY_3LD 2919 0.88 1.34 0.70 135 TR_MetaPhish_Combo_01 2865 0.66 0.56 0.69 136 T_TooManySym_03 2856 0.57 0.26 0.69 137 XMSubMetaI_00 2721 1.18 2.50 0.66 138 XM_H_PHPMailer 2687 0.67 0.73 0.65 139 TR_XM_RelayPhish 2664 0.92 1.63 0.64 140 SHORT_HELO_AND_INLINE_IMAGE 2655 0.48 0.08 0.64 141 RCVD_IN_SORBS_DUL 2567 0.51 0.25 0.62 142 XM_S_JOY_D 2535 0.73 1.03 0.61 143 XMGappySubj_02 2493 0.55 0.43 0.60 144 XMNoVowels 2448 0.55 0.45 0.59 145 MISSING_HEADERS 2422 0.54 0.41 0.58 146 LOW_PRICE 2370 0.61 0.70 0.57 147 T_XMHurry_00 2246 0.91 1.84 0.54 148 RCVD_IN_IADB_DOPTIN 2242 0.41 0.06 0.54 149 RELAYCOUNTRY_DE 2226 0.60 0.74 0.54 150 T_Symld_Words_02 2217 0.71 1.16 0.54 151 XMMoneyMeta_00 2177 0.55 0.60 0.53 152 XM_B_TRADE_HTML 2156 0.60 0.81 0.52 153 T_XMDrugObfuBody_00 2153 0.72 1.21 0.52 154 HTTPS_HTTP_MISMATCH 2141 0.60 0.82 0.52 155 HTML_IMAGE_ONLY_32 2132 0.44 0.25 0.51 156 XMSubMetaSxObfu_02 2034 0.46 0.39 0.49 157 RELAYCOUNTRY_AU 2018 0.56 0.76 0.49 158 TM2_M_BODY_EMPTY 2004 0.50 0.54 0.48 159 REMOVE_BEFORE_LINK 1888 0.63 1.06 0.46 160 AC_DIV_BONANZA 1820 0.35 0.12 0.44 161 XMDateMe_00 1797 0.40 0.31 0.43 162 HTML_IMAGE_ONLY_28 1772 0.54 0.82 0.43 163 XMSexyCombo_01 1732 0.90 2.11 0.42 164 XMSubNoVowel 1710 0.56 0.92 0.41 165 FORGED_GMAIL_RCVD 1703 0.45 0.54 0.41 166 DEAR_SOMETHING 1694 0.39 0.34 0.41 167 RCVD_IN_MSPIKE_BL 1680 0.52 0.80 0.41 168 XMSolicitRefs_0 1674 0.46 0.61 0.40 169 URI_NOVOWEL 1609 0.48 0.72 0.39 170 XMBody_17 1603 0.97 2.46 0.39 171 HTML_IMAGE_ONLY_24 1590 0.41 0.48 0.38 172 HTML_IMAGE_ONLY_20 1584 0.38 0.36 0.38 173 BAD_ENC_HEADER 1567 0.28 0.03 0.38 174 PLING_QUERY 1560 0.50 0.81 0.38 175 XM_H_PHPOS_M 1540 0.38 0.38 0.37 176 XMSubEmpty 1528 0.46 0.69 0.37 177 DOS_OUTLOOK_TO_MX 1515 0.30 0.14 0.37 178 RELAYCOUNTRY_FR 1512 0.80 1.89 0.36 179 RCVD_IN_MSPIKE_L3 1479 0.30 0.14 0.36 180 T_MONEY_PERCENT 1463 0.66 1.44 0.35 181 TR_LOTS_OF_MONEY2 1463 0.66 1.44 0.35 182 HTML_IMAGE_ONLY_16 1441 0.38 0.46 0.35 183 TR_LOTS_OF_MONEY3 1440 0.40 0.54 0.35 184 SUBJ_DOLLARS 1438 0.93 2.41 0.35 185 RDNS_DYNAMIC 1434 0.49 0.85 0.35 186 FILL_THIS_FORM 1416 0.50 0.91 0.34 187 TVD_SPACE_RATIO 1407 0.35 0.37 0.34 188 T_MANY_PILL_PRICE 1356 0.23 0.00 0.33 189 MSGID_FROM_MTA_HEADER 1355 0.32 0.30 0.33 190 GMD_PDF_EMPTY_BODY 1335 0.26 0.12 0.32 191 HTML_FONT_FACE_BAD 1317 0.52 1.04 0.32 192 HTML_TAG_BALANCE_BODY 1317 0.43 0.72 0.32 193 XMPhish14 1316 0.66 1.51 0.32 194 XMHTMLBadTable_001 1309 0.43 0.72 0.32 195 XMHTML_After_End 1305 0.62 1.39 0.32 196 RCVD_IN_BL_SPAMCOP_NET 1276 0.87 2.29 0.31 197 XMLKML 1271 0.22 0.00 0.31 198 XMRcvdHeader_15 1263 0.22 0.00 0.30 199 XM_B_REG_HTML 1248 0.56 1.22 0.30 200 XMPhish30 1242 0.68 1.64 0.30 ----------------------------------------------------------------------