Email: 309030 Autolearn: 0 AvgScore: 3.74 AvgScanTime: 10.58 sec Spam: 115826 Autolearn: 0 AvgScore: 12.59 AvgScanTime: 11.57 sec Ham: 193204 Autolearn: 0 AvgScore: -1.57 AvgScanTime: 9.98 sec Time Spent Running SA: 907.98 hours Time Spent Processing Spam: 372.20 hours Time Spent Processing Ham: 535.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 110721 89.67 95.59 86.13 2 DKIM_SIGNED 103844 83.76 89.66 80.23 3 XM_DK_Pass 102016 82.53 88.08 79.20 4 DCC_CHECK 95241 59.26 82.23 45.50 5 XMListUnsubscribeExists 91785 61.83 79.24 51.39 6 DKIM_INVALID 68784 49.83 59.39 44.10 7 XM_H_QuotedFrom 63052 43.55 54.44 37.02 8 XM_DK_Undo_02 57223 29.01 49.40 16.78 9 BAYES_99 52779 27.07 45.57 15.99 10 LOC_TINY_FONT_1 49933 31.49 43.11 24.53 11 BAYES_999 45920 23.88 39.65 14.43 12 HTML_FONT_LOW_CONTRAST 44922 34.10 38.78 31.29 13 TR_DCC_Bayes_99 41083 18.62 35.47 8.51 14 MIME_HTML_ONLY 36354 26.34 31.39 23.31 15 BAYES_50 35742 44.76 30.86 53.09 16 DKIM_VALID 35060 33.93 30.27 36.13 17 FVGT_m_MULTI_ODD 30160 23.01 26.04 21.19 18 DKIM_VALID_AU 29844 27.01 25.77 27.75 19 XMSubLong 28128 22.27 24.28 21.06 20 HTML_IMAGE_RATIO_02 25964 14.22 22.42 9.30 21 XM_Body_Dirty_Words 25170 15.92 21.73 12.43 22 T_KAM_HTML_FONT_INVALID 21012 15.22 18.14 13.47 23 DCC_CHECK_NEGATIVE 18671 39.19 16.12 53.01 24 RELAYCOUNTRY_META 18312 8.59 15.81 4.26 25 XM_Evil_Numbers_Gen 17732 10.98 15.31 8.39 26 XM_Multi_Part_URI 17682 15.68 15.27 15.93 27 T_TM2_M_HEADER_IN_MSG 16589 20.30 14.32 23.89 28 MultiRelay 16220 16.41 14.00 17.85 29 T_XMDrugObfuBody_14 14457 8.69 12.48 6.41 30 BOTNET_IPINHOSTNAME 14337 8.97 12.38 6.92 31 HTML_IMAGE_RATIO_04 12757 8.02 11.01 6.23 32 XMSexyCombo_05 12344 6.94 10.66 4.70 33 UNTRUSTED_Relay 12215 4.69 10.55 1.19 34 XM_B_Phish_Phrases 11499 7.91 9.93 6.69 35 LotsOfNums_01 11452 9.16 9.89 8.72 36 FSL_BULK_SIG 11378 9.57 9.82 9.42 37 TooManyTo_001 11287 7.87 9.74 6.74 38 BOTNET 11183 4.47 9.65 1.37 39 XM_H_Long_From01 10871 7.49 9.39 6.36 40 FROM_EXCESS_BASE64 10471 6.27 9.04 4.61 41 LOTS_OF_MONEY 9995 11.33 8.63 12.95 42 MPART_ALT_DIFF 9797 5.26 8.46 3.34 43 BAYES_80 9221 5.10 7.96 3.39 44 TR_XM_DocInvoice 7785 5.11 6.72 4.14 45 XMSubMetaSx_00 7214 5.30 6.23 4.74 46 T_MIXED_ES 7183 4.27 6.20 3.12 47 XM_UncommonTLD01 6947 5.17 6.00 4.67 48 BAYES_60 6835 6.37 5.90 6.65 49 MIME_HTML_MOSTLY 6769 4.16 5.84 3.15 50 BAYES_95 5778 3.43 4.99 2.50 51 MIME_QP_LONG_LINE 5735 4.81 4.95 4.73 52 T_REMOTE_IMAGE 5516 4.86 4.76 4.92 53 DKIM_VALID_EF 5335 7.15 4.61 8.68 54 T_TooManySym_01 5323 5.18 4.60 5.53 55 XM_UB50 5114 2.08 4.42 0.69 56 XMStrtUSub 5058 4.86 4.37 5.16 57 URI_HEX 5029 2.70 4.34 1.72 58 XM_CamelCaseFrm001 5010 2.75 4.33 1.80 59 XMNumbers 4664 3.26 4.03 2.81 60 HTML_IMAGE_RATIO_06 4627 4.19 3.99 4.31 61 MIME_HTML_ONLY_MULTI 4465 2.28 3.85 1.34 62 XM_DIRTYINTL 4413 2.60 3.81 1.87 63 MultiRelay_Combo 4405 1.56 3.80 0.21 64 MultiRelay_CC 4405 1.56 3.80 0.21 65 XM_OfRef6 4085 1.86 3.53 0.87 66 TM2_M_URI_OPT_OUT 3832 2.26 3.31 1.63 67 XM_SendGrid 3693 5.22 3.19 6.44 68 RCVD_IN_RP_SAFE 3321 5.55 2.87 7.15 69 HTML_IMAGE_RATIO_08 3275 2.08 2.83 1.63 70 XMBdyGiftCard01 3153 1.79 2.72 1.23 71 RELAYCOUNTRY_CA 3146 1.86 2.72 1.35 72 XMSubMetaI_00 3141 1.41 2.71 0.64 73 XM_SPF_SoftFail 2969 1.73 2.56 1.23 74 SUBJ_ALL_CAPS 2933 2.40 2.53 2.31 75 XM_ProductURIs 2802 1.57 2.42 1.06 76 T_XMHurry_00 2747 1.31 2.37 0.68 77 XMDiploma_00 2742 1.58 2.37 1.10 78 RCVD_IN_RP_CERTIFIED 2732 4.76 2.36 6.20 79 SpammyFromTLD_02 2687 0.97 2.32 0.17 80 FILL_THIS_FORM 2595 0.99 2.24 0.25 81 RELAYCOUNTRY_FR 2505 0.97 2.16 0.26 82 XMPhish30 2478 1.07 2.14 0.42 83 XM_UB99 2444 0.79 2.11 0.01 84 BODY_ENHANCEMENT 2431 0.81 2.10 0.03 85 XM_B_REG_HTML 2422 1.22 2.09 0.70 86 XM_RXBody 2322 0.91 2.00 0.26 87 BAYES_00 2297 7.62 1.98 11.00 88 TR_XM_RelayPhish 2278 1.04 1.97 0.49 89 TooManyTo_002 2178 1.76 1.88 1.69 90 SUBJ_DOLLARS 2141 0.85 1.85 0.25 91 TM2_M_VERY_LONG_WORD 2099 1.26 1.81 0.93 92 T_XMDrugObfuBody_08 2072 1.94 1.79 2.03 93 XMBody_17 2069 0.97 1.79 0.48 94 T_TooManySym_02 2062 2.19 1.78 2.44 95 TR_XM_DK_Bayes 2062 6.70 1.78 9.65 96 RCVD_IN_BL_SPAMCOP_NET 2016 0.80 1.74 0.23 97 XMSexyCombo_01 2013 1.17 1.74 0.82 98 TooManyTo_003 1990 1.36 1.72 1.15 99 PLING_QUERY 1963 0.94 1.69 0.49 100 XMBody_78 1867 0.98 1.61 0.60 101 XMSubNoVowel 1852 0.76 1.60 0.26 102 XM_UB999 1838 0.60 1.59 0.01 103 XM_DK_Undo_01 1777 1.81 1.53 1.97 104 RELAYCOUNTRY_AT 1755 0.66 1.52 0.14 105 XM_S_JOY_D 1714 1.32 1.48 1.22 106 TooManyTo_004 1709 1.09 1.48 0.86 107 RELAYCOUNTRY_JP 1679 0.55 1.45 0.02 108 XMSubEmpty 1678 0.75 1.45 0.33 109 RELAYCOUNTRY_DE 1654 0.85 1.43 0.50 110 UNPARSEABLE_RELAY 1582 4.31 1.37 6.08 111 XM_H_Long_From02 1579 1.12 1.36 0.97 112 TooManyTo_005 1573 0.96 1.36 0.72 113 XM_B_COPY_HTML 1572 0.93 1.36 0.67 114 MAILING_LIST_MULTI 1541 2.08 1.33 2.53 115 TR_LOTS_OF_MONEY2 1510 1.35 1.30 1.38 116 T_MONEY_PERCENT 1510 1.35 1.30 1.38 117 XMStockSpam_06 1480 1.48 1.28 1.60 118 RCVD_IN_RP_RNBL 1478 0.51 1.28 0.04 119 XM_OfRef7 1470 0.57 1.27 0.14 120 HTML_MIME_NO_HTML_TAG 1465 1.55 1.26 1.72 121 XM_UB80 1459 0.49 1.26 0.02 122 BAYES_40 1417 2.46 1.22 3.19 123 DIET_1 1414 0.68 1.22 0.35 124 FILL_THIS_FORM_LONG 1412 0.48 1.22 0.04 125 FILL_THIS_FORM_LOAN 1348 0.46 1.16 0.04 126 SpammyFromTLD_01 1302 0.70 1.12 0.44 127 XMBrknScrpt_02 1301 0.85 1.12 0.69 128 XMGenDplmaNmb 1300 0.76 1.12 0.54 129 TR_Caps_n_Bayes_99 1289 0.64 1.11 0.35 130 BODY_URI_ONLY 1252 0.54 1.08 0.22 131 XM_UB60 1228 0.43 1.06 0.06 132 HTML_FONT_FACE_BAD 1224 0.60 1.06 0.33 133 XM_OfRef8 1223 0.41 1.06 0.02 134 XM_BadFromFormat 1202 0.56 1.04 0.28 135 URI_TRY_3LD 1200 1.06 1.04 1.07 136 DATE_IN_PAST_03_06 1175 0.46 1.01 0.13 137 XMPhish11 1152 0.98 0.99 0.96 138 FSL_THIS_IS_ADV 1139 0.47 0.98 0.17 139 T_XMDrugObfuBody_00 1139 0.85 0.98 0.78 140 BAYES_20 1108 1.89 0.96 2.45 141 T_FILL_THIS_FORM_SHORT 1107 0.73 0.96 0.60 142 RELAYCOUNTRY_GB 1105 0.79 0.95 0.68 143 XM_URI_RBL 1081 0.40 0.93 0.08 144 XMHTMLBadTable_001 1073 0.56 0.93 0.34 145 XMHTML_After_End 1068 0.55 0.92 0.32 146 ANY_BOUNCE_MESSAGE 1023 1.46 0.88 1.81 147 BOUNCE_MESSAGE 1022 1.46 0.88 1.81 148 THIS_AD 999 0.36 0.86 0.07 149 HTML_SHORT_LINK_IMG_1 993 0.35 0.86 0.05 150 URIBL_BLACK 983 0.33 0.85 0.01 151 XMClaimOffer 954 0.43 0.82 0.20 152 RDNS_DYNAMIC 931 0.68 0.80 0.61 153 XMSubMetaSSx_00 920 0.39 0.79 0.14 154 HDRS_LCASE_IMGONLY 920 0.33 0.79 0.05 155 BOTNET_NORDNS 916 0.31 0.79 0.03 156 URI_NOVOWEL 914 0.58 0.79 0.45 157 LONG_JUNK_URI 911 0.36 0.79 0.10 158 RELAYCOUNTRY_BR 910 0.32 0.79 0.04 159 HTML_TAG_BALANCE_BODY 851 0.61 0.73 0.53 160 RELAYCOUNTRY_CN 849 0.30 0.73 0.04 161 XM_UB95 845 0.28 0.73 0.01 162 DATE_IN_PAST_06_12 844 0.32 0.73 0.08 163 SINGLETS_LOW_CONTRAST 830 0.54 0.72 0.44 164 XMPhish14 821 0.44 0.71 0.27 165 XMGppyBdWords 812 0.48 0.70 0.35 166 TR_Symld_Words 793 1.71 0.68 2.32 167 SUBJECT_NEEDS_ENCODING 782 0.26 0.68 0.02 168 SUBJ_ILLEGAL_CHARS 782 0.26 0.68 0.02 169 HTML_IMAGE_ONLY_24 778 0.44 0.67 0.30 170 XMMoneyMeta_00 772 0.39 0.67 0.23 171 DKIM_ADSP_CUSTOM_MED 772 0.68 0.67 0.68 172 RCVD_IN_MSPIKE_WL 767 1.68 0.66 2.29 173 T_HTML_TAG_BALANCE_CENTER 763 0.39 0.66 0.23 174 RCVD_IN_MSPIKE_H3 758 1.67 0.65 2.28 175 XM_Body_Obfu01 753 0.34 0.65 0.16 176 XM_H_PHPOS 728 1.01 0.63 1.24 177 RCVD_IN_MSPIKE_H2 723 1.49 0.62 2.01 178 MPART_ALT_DIFF_COUNT 710 0.38 0.61 0.24 179 RCVD_IN_IADB_LISTED 709 1.79 0.61 2.49 180 TR_Mismatch_TLD_02 709 0.26 0.61 0.05 181 TR_LOTS_OF_MONEY3 708 0.35 0.61 0.20 182 T_Symld_Words_02 702 0.46 0.61 0.37 183 ALL_TRUSTED 697 8.45 0.60 13.15 184 URI_OPTOUT_3LD 694 0.26 0.60 0.05 185 URI_WP_HACKED 693 0.25 0.60 0.05 186 TR_Mismatch_TLD_01 689 0.41 0.59 0.31 187 REMOVE_BEFORE_LINK 686 0.48 0.59 0.41 188 NORMAL_HTTP_TO_IP 663 0.26 0.57 0.07 189 XM_B_TRADE_HTML 657 0.39 0.57 0.29 190 BAYES_05 649 1.30 0.56 1.75 191 HTML_FONT_SIZE_HUGE 646 0.29 0.56 0.14 192 XM_H_Undi_Recip 638 0.33 0.55 0.20 193 RCVD_IN_IADB_SPF 631 1.54 0.54 2.14 194 FORGED_GMAIL_RCVD 623 0.41 0.54 0.33 195 XM_HighProb1 613 0.20 0.53 0.01 196 TR_MetaPhish_Combo_01 611 0.56 0.53 0.58 197 LONG_JUNK_URI3 608 0.26 0.52 0.10 198 XMBounce_01 604 0.21 0.52 0.02 199 URIBL_DBL_SPAM 594 0.19 0.51 0.00 200 RCVD_IN_IADB_SENDERID 592 1.37 0.51 1.88 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 166400 89.67 95.59 86.13 2 DKIM_SIGNED 155003 83.76 89.66 80.23 3 XM_DK_Pass 153027 82.53 88.08 79.20 4 BAYES_50 102576 44.76 30.86 53.09 5 DCC_CHECK_NEGATIVE 102424 39.19 16.12 53.01 6 XMListUnsubscribeExists 99283 61.83 79.24 51.39 7 DCC_CHECK 87899 59.26 82.23 45.50 8 DKIM_INVALID 85204 49.83 59.39 44.10 9 XM_H_QuotedFrom 71532 43.55 54.44 37.02 10 DKIM_VALID 69799 33.93 30.27 36.13 11 HTML_FONT_LOW_CONTRAST 60461 34.10 38.78 31.29 12 DKIM_VALID_AU 53612 27.01 25.77 27.75 13 LOC_TINY_FONT_1 47391 31.49 43.11 24.53 14 T_TM2_M_HEADER_IN_MSG 46152 20.30 14.32 23.89 15 MIME_HTML_ONLY 45033 26.34 31.39 23.31 16 FVGT_m_MULTI_ODD 40936 23.01 26.04 21.19 17 XMSubLong 40688 22.27 24.28 21.06 18 XM_DKIMWhitelistDomains 35447 11.48 0.02 18.35 19 MultiRelay 34490 16.41 14.00 17.85 20 XM_DK_Undo_02 32429 29.01 49.40 16.78 21 BAYES_99 30890 27.07 45.57 15.99 22 XM_Multi_Part_URI 30769 15.68 15.27 15.93 23 BAYES_999 27871 23.88 39.65 14.43 24 T_KAM_HTML_FONT_INVALID 26031 15.22 18.14 13.47 25 ALL_TRUSTED 25415 8.45 0.60 13.15 26 LOTS_OF_MONEY 25029 11.33 8.63 12.95 27 XM_Body_Dirty_Words 24024 15.92 21.73 12.43 28 BAYES_00 21251 7.62 1.98 11.00 29 TR_XM_DK_Bayes 18642 6.70 1.78 9.65 30 FSL_BULK_SIG 18201 9.57 9.82 9.42 31 HTML_IMAGE_RATIO_02 17977 14.22 22.42 9.30 32 LotsOfNums_01 16846 9.16 9.89 8.72 33 DKIM_VALID_EF 16766 7.15 4.61 8.68 34 TR_DCC_Bayes_99 16448 18.62 35.47 8.51 35 XM_Evil_Numbers_Gen 16206 10.98 15.31 8.39 36 RCVD_IN_RP_SAFE 13817 5.55 2.87 7.15 37 BOTNET_IPINHOSTNAME 13379 8.97 12.38 6.92 38 TooManyTo_001 13027 7.87 9.74 6.74 39 XM_B_Phish_Phrases 12933 7.91 9.93 6.69 40 BAYES_60 12844 6.37 5.90 6.65 41 XM_SendGrid 12436 5.22 3.19 6.44 42 T_XMDrugObfuBody_14 12394 8.69 12.48 6.41 43 XM_H_Long_From01 12283 7.49 9.39 6.36 44 HTML_IMAGE_RATIO_04 12032 8.02 11.01 6.23 45 RCVD_IN_RP_CERTIFIED 11979 4.76 2.36 6.20 46 UNPARSEABLE_RELAY 11745 4.31 1.37 6.08 47 IN_ZIMBRA_NJ_WHITELIST 10930 3.55 0.03 5.66 48 T_TooManySym_01 10691 5.18 4.60 5.53 49 XMStrtUSub 9975 4.86 4.37 5.16 50 TVD_RCVD_IP 9781 3.23 0.16 5.06 51 T_REMOTE_IMAGE 9512 4.86 4.76 4.92 52 XMSubMetaSx_00 9158 5.30 6.23 4.74 53 MIME_QP_LONG_LINE 9129 4.81 4.95 4.73 54 XMSexyCombo_05 9090 6.94 10.66 4.70 55 XM_UncommonTLD01 9032 5.17 6.00 4.67 56 FROM_EXCESS_BASE64 8902 6.27 9.04 4.61 57 HTML_IMAGE_RATIO_06 8323 4.19 3.99 4.31 58 RELAYCOUNTRY_META 8225 8.59 15.81 4.26 59 TR_XM_DK_Bayes1 8205 2.84 0.50 4.25 60 TR_XM_DocInvoice 8005 5.11 6.72 4.14 61 INVALID_MSGID 6786 2.28 0.22 3.51 62 BAYES_80 6541 5.10 7.96 3.39 63 MPART_ALT_DIFF 6452 5.26 8.46 3.34 64 BAYES_40 6171 2.46 1.22 3.19 65 MIME_HTML_MOSTLY 6095 4.16 5.84 3.15 66 TO_MALFORMED 6056 1.97 0.03 3.13 67 TR_XM_DK_Bayes2 6056 2.14 0.48 3.13 68 T_MIXED_ES 6028 4.27 6.20 3.12 69 IN_HORDE_ADDRESS_BOOK 5624 1.85 0.08 2.91 70 XMNumbers 5421 3.26 4.03 2.81 71 MAILING_LIST_MULTI 4893 2.08 1.33 2.53 72 BAYES_95 4827 3.43 4.99 2.50 73 RCVD_IN_IADB_LISTED 4818 1.79 0.61 2.49 74 BAYES_20 4732 1.89 0.96 2.45 75 T_TooManySym_02 4705 2.19 1.78 2.44 76 TR_Symld_Words 4490 1.71 0.68 2.32 77 SUBJ_ALL_CAPS 4469 2.40 2.53 2.31 78 RCVD_IN_MSPIKE_WL 4433 1.68 0.66 2.29 79 RCVD_IN_MSPIKE_H3 4410 1.67 0.65 2.28 80 XM_PDF 4285 1.50 0.29 2.22 81 RCVD_IN_IADB_SPF 4132 1.54 0.54 2.14 82 T_XMDrugObfuBody_08 3931 1.94 1.79 2.03 83 RCVD_IN_MSPIKE_H2 3893 1.49 0.62 2.01 84 XM_DK_Undo_01 3807 1.81 1.53 1.97 85 RCVD_IN_IADB_SENDERID 3639 1.37 0.51 1.88 86 XM_DIRTYINTL 3618 2.60 3.81 1.87 87 ANY_BOUNCE_MESSAGE 3495 1.46 0.88 1.81 88 BOUNCE_MESSAGE 3492 1.46 0.88 1.81 89 XM_CamelCaseFrm001 3487 2.75 4.33 1.80 90 RCVD_IN_IADB_DK 3475 1.31 0.51 1.80 91 BAYES_05 3372 1.30 0.56 1.75 92 URI_HEX 3327 2.70 4.34 1.72 93 HTML_MIME_NO_HTML_TAG 3321 1.55 1.26 1.72 94 TooManyTo_002 3262 1.76 1.88 1.69 95 RCVD_IN_IADB_VOUCHED 3239 1.15 0.27 1.68 96 TM2_M_URI_OPT_OUT 3145 2.26 3.31 1.63 97 HTML_IMAGE_RATIO_08 3144 2.08 2.83 1.63 98 XMBody_95 3098 1.08 0.20 1.60 99 XMStockSpam_06 3084 1.48 1.28 1.60 100 USER_IN_WHITELIST 2862 0.93 0.00 1.48 101 XM_GoogleGroups 2798 1.07 0.43 1.45 102 TR_LOTS_OF_MONEY2 2658 1.35 1.30 1.38 103 T_MONEY_PERCENT 2658 1.35 1.30 1.38 104 BOTNET 2639 4.47 9.65 1.37 105 RELAYCOUNTRY_CA 2615 1.86 2.72 1.35 106 MIME_HTML_ONLY_MULTI 2592 2.28 3.85 1.34 107 USER_IN_DEF_DKIM_WL 2586 0.85 0.03 1.34 108 XM_H_PHPOS 2391 1.01 0.63 1.24 109 XMBdyGiftCard01 2382 1.79 2.72 1.23 110 XM_SPF_SoftFail 2376 1.73 2.56 1.23 111 XM_S_JOY_D 2356 1.32 1.48 1.22 112 UNTRUSTED_Relay 2293 4.69 10.55 1.19 113 TooManyTo_003 2228 1.36 1.72 1.15 114 T_TooManySym_03 2171 0.81 0.29 1.12 115 XMDiploma_00 2129 1.58 2.37 1.10 116 URI_TRY_3LD 2065 1.06 1.04 1.07 117 TM2_M_A_HREF_HREF 2054 0.78 0.32 1.06 118 XM_ProductURIs 2040 1.57 2.42 1.06 119 XM_H_Long_From02 1868 1.12 1.36 0.97 120 XMPhish11 1862 0.98 0.99 0.96 121 TM2_M_VERY_LONG_WORD 1802 1.26 1.81 0.93 122 HELO_NODOT 1772 0.62 0.12 0.92 123 XMSubMetaSxObfu_02 1745 0.64 0.20 0.90 124 XM_OfRef6 1675 1.86 3.53 0.87 125 TooManyTo_004 1667 1.09 1.48 0.86 126 UPPERCASE_50_75 1605 0.56 0.12 0.83 127 XMSexyCombo_01 1589 1.17 1.74 0.82 128 RCVD_IN_IADB_OPTIN 1523 0.55 0.16 0.79 129 T_XMDrugObfuBody_00 1503 0.85 0.98 0.78 130 XM_H_PHPMailer 1489 0.64 0.42 0.77 131 TooManyTo_005 1387 0.96 1.36 0.72 132 XM_B_REG_HTML 1346 1.22 2.09 0.70 133 XMBrknScrpt_02 1327 0.85 1.12 0.69 134 XM_UB50 1325 2.08 4.42 0.69 135 DKIM_ADSP_CUSTOM_MED 1323 0.68 0.67 0.68 136 RELAYCOUNTRY_GB 1321 0.79 0.95 0.68 137 T_XMHurry_00 1314 1.31 2.37 0.68 138 XM_B_COPY_HTML 1297 0.93 1.36 0.67 139 XM_D_tchamptons_WL 1267 0.41 0.00 0.66 140 XMSubMetaI_00 1229 1.41 2.71 0.64 141 RDNS_DYNAMIC 1179 0.68 0.80 0.61 142 XM_ShortIntro_01 1161 0.53 0.42 0.60 143 XMBody_78 1152 0.98 1.61 0.60 144 T_FILL_THIS_FORM_SHORT 1150 0.73 0.96 0.60 145 TR_MetaPhish_Combo_01 1114 0.56 0.53 0.58 146 XMCapTrack 1100 0.47 0.30 0.57 147 T_TooManySym_04 1097 0.36 0.01 0.57 148 XM_H_PHPOS_M 1068 0.46 0.31 0.55 149 XMGenDplmaNmb 1050 0.76 1.12 0.54 150 XMNoVowels 1037 0.48 0.40 0.54 151 HTML_TAG_BALANCE_BODY 1033 0.61 0.73 0.53 152 RELAYCOUNTRY_DE 962 0.85 1.43 0.50 153 TR_XM_RelayPhish 950 1.04 1.97 0.49 154 PLING_QUERY 950 0.94 1.69 0.49 155 XMBody_17 935 0.97 1.79 0.48 156 URI_NOVOWEL 878 0.58 0.79 0.45 157 TVD_SPACE_RATIO 872 0.47 0.50 0.45 158 SINGLETS_LOW_CONTRAST 853 0.54 0.72 0.44 159 SpammyFromTLD_01 851 0.70 1.12 0.44 160 XMPhish30 818 1.07 2.14 0.42 161 XMRcvdHeader_15 817 0.26 0.00 0.42 162 NML_ADSP_CUSTOM_MED 807 0.45 0.50 0.42 163 REMOVE_BEFORE_LINK 801 0.48 0.59 0.41 164 HTTPS_HTTP_MISMATCH 773 0.40 0.41 0.40 165 XMGappySubj_01 753 0.42 0.47 0.39 166 XMRcvdHeader_S01 734 0.25 0.04 0.38 167 T_Symld_Words_02 722 0.46 0.61 0.37 168 XMSUPPORT 711 0.23 0.00 0.37 169 TR_Caps_n_Bayes_99 679 0.64 1.11 0.35 170 DIET_1 675 0.68 1.22 0.35 171 MISSING_HEADERS 674 0.38 0.44 0.35 172 XMGppyBdWords 669 0.48 0.70 0.35 173 XM_H_SpoofStaff4 665 0.22 0.02 0.34 174 XMSolicitRefs_0 664 0.32 0.28 0.34 175 XMHTMLBadTable_001 657 0.56 0.93 0.34 176 XMSubMetaSxObfu_03 655 0.37 0.42 0.34 177 XMLngstWrd_00 645 0.35 0.38 0.33 178 XMSubEmpty 642 0.75 1.45 0.33 179 FORGED_GMAIL_RCVD 638 0.41 0.54 0.33 180 HTML_FONT_FACE_BAD 636 0.60 1.06 0.33 181 RELAYCOUNTRY_AU 625 0.35 0.39 0.32 182 XMHTML_After_End 620 0.55 0.92 0.32 183 TR_MetaPhish_Combo_01b 619 0.26 0.15 0.32 184 HTML_IMAGE_ONLY_20 615 0.27 0.19 0.32 185 HTML_IMAGE_ONLY_28 605 0.29 0.26 0.31 186 RCVD_IN_IADB_DOPTIN 598 0.21 0.04 0.31 187 TR_Mismatch_TLD_01 590 0.41 0.59 0.31 188 HTML_IMAGE_ONLY_24 582 0.44 0.67 0.30 189 T_OBFU_PDF_ATTACH 581 0.20 0.04 0.30 190 XMLngstWrd_01 566 0.32 0.37 0.29 191 XMDateMe_00 565 0.22 0.11 0.29 192 XM_B_TRADE_HTML 554 0.39 0.57 0.29 193 HTML_IMAGE_ONLY_32 552 0.29 0.30 0.29 194 MSGID_FROM_MTA_HEADER 551 0.24 0.17 0.29 195 TM2_M_BODY_EMPTY 551 0.26 0.21 0.29 196 XM_BadFromFormat 542 0.56 1.04 0.28 197 XMPhish14 528 0.44 0.71 0.27 198 XM_H_XFINITY 524 0.17 0.00 0.27 199 HTML_IMAGE_ONLY_12 517 0.29 0.32 0.27 200 RELAYCOUNTRY_FR 506 0.97 2.16 0.26 ----------------------------------------------------------------------