Email: 530101 Autolearn: 0 AvgScore: 3.36 AvgScanTime: 3.86 sec Spam: 157115 Autolearn: 0 AvgScore: 12.40 AvgScanTime: 4.86 sec Ham: 372986 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 3.44 sec Time Spent Running SA: 568.09 hours Time Spent Processing Spam: 211.99 hours Time Spent Processing Ham: 356.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149242 83.84 94.99 79.14 2 DKIM_SIGNED 138522 73.31 88.17 67.06 3 XM_DK_Pass 135081 71.70 85.98 65.68 4 DKIM_VALID 127220 66.91 80.97 60.98 5 DCC_CHECK 125639 44.87 79.97 30.09 6 XMListUnsubscribeExists 114817 51.78 73.08 42.81 7 DKIM_VALID_AU 97076 48.59 61.79 43.02 8 XM_H_QuotedFrom 84753 37.86 53.94 31.08 9 XM_DK_Undo_02 79498 23.47 50.60 12.04 10 BAYES_99 72691 21.44 46.27 10.98 11 BAYES_999 62356 18.55 39.69 9.64 12 LOC_TINY_FONT_1 57901 22.06 36.85 15.82 13 TR_DCC_Bayes_99 57521 14.43 36.61 5.08 14 HTML_FONT_LOW_CONTRAST 55054 25.75 35.04 21.83 15 MIME_HTML_ONLY 49362 20.90 31.42 16.47 16 BAYES_50 49125 49.05 31.27 56.53 17 XMSubLong 44508 21.56 28.33 18.71 18 FVGT_m_MULTI_ODD 41583 20.57 26.47 18.09 19 DKIM_VALID_EF 38523 23.89 24.52 23.63 20 T_KAM_HTML_FONT_INVALID 34428 15.67 21.91 13.04 21 T_TM2_M_HEADER_IN_MSG 33622 31.41 21.40 35.63 22 XM_Body_Dirty_Words 32618 12.30 20.76 8.73 23 MultiRelay 28541 20.84 18.17 21.97 24 DCC_CHECK_NEGATIVE 27965 52.92 17.80 67.71 25 XM_Multi_Part_URI 26923 11.79 17.14 9.54 26 XM_Evil_Numbers_Gen 26112 9.44 16.62 6.42 27 RELAYCOUNTRY_META 24834 8.02 15.81 4.74 28 LOTS_OF_MONEY 22874 10.10 14.56 8.23 29 HTML_IMAGE_RATIO_02 21943 7.89 13.97 5.34 30 FSL_BULK_SIG 20811 8.26 13.25 6.16 31 T_XMDrugObfuBody_14 18836 8.66 11.99 7.26 32 BOTNET_IPINHOSTNAME 17535 5.76 11.16 3.48 33 XMSexyCombo_05 17271 4.90 10.99 2.33 34 BOTNET 17252 4.23 10.98 1.38 35 HTML_IMAGE_RATIO_04 16232 6.02 10.33 4.21 36 LotsOfNums_01 15190 7.57 9.67 6.68 37 XM_B_Phish_Phrases 14920 5.84 9.50 4.31 38 UNTRUSTED_Relay 13715 3.44 8.73 1.22 39 XMSubMetaSx_00 12724 4.89 8.10 3.53 40 TR_XM_DocInvoice 11983 4.58 7.63 3.30 41 TooManyTo_001 11539 7.87 7.34 8.09 42 XM_H_Long_From01 11528 9.16 7.34 9.93 43 BAYES_80 11444 4.76 7.28 3.70 44 DKIM_INVALID 11302 6.41 7.19 6.08 45 FROM_EXCESS_BASE64 11099 4.14 7.06 2.91 46 XM_UncommonTLD01 10998 6.36 7.00 6.09 47 MPART_ALT_DIFF 9997 3.73 6.36 2.62 48 BAYES_60 9710 6.31 6.18 6.36 49 TM2_M_URI_OPT_OUT 8145 2.97 5.18 2.04 50 HTML_IMAGE_RATIO_06 8053 3.14 5.13 2.30 51 XMNumbers 7804 3.54 4.97 2.94 52 RCVD_IN_RP_SAFE 7413 6.60 4.72 7.39 53 MIME_QP_LONG_LINE 7091 4.73 4.51 4.83 54 XM_SendGrid 7053 4.71 4.49 4.80 55 BAYES_95 6974 3.06 4.44 2.48 56 MIME_HTML_MOSTLY 6748 2.57 4.29 1.84 57 RCVD_IN_RP_CERTIFIED 6588 6.03 4.19 6.81 58 RCVD_IN_MSPIKE_H2 6468 3.99 4.12 3.94 59 XMStrtUSub 6375 3.80 4.06 3.70 60 HTML_IMAGE_RATIO_08 6182 2.53 3.93 1.94 61 XM_DIRTYINTL 6155 2.35 3.92 1.69 62 XM_SPF_SoftFail 6143 3.54 3.91 3.38 63 T_TooManySym_01 6094 3.81 3.88 3.79 64 T_XMDrugObfuBody_08 5645 2.03 3.59 1.36 65 RCVD_IN_BL_SPAMCOP_NET 5539 1.57 3.53 0.74 66 XM_OfRef6 5438 1.91 3.46 1.25 67 URI_HEX 5416 1.88 3.45 1.22 68 T_REMOTE_IMAGE 5411 4.19 3.44 4.51 69 XM_UB50 5395 1.61 3.43 0.85 70 XM_CamelCaseFrm001 5262 2.09 3.35 1.56 71 MIME_HTML_ONLY_MULTI 4911 1.97 3.13 1.48 72 RELAYCOUNTRY_CA 4778 1.80 3.04 1.28 73 XMPhish11 4494 1.75 2.86 1.28 74 XMDiploma_00 4277 2.07 2.72 1.80 75 SUBJ_ALL_CAPS 4071 5.27 2.59 6.40 76 MultiRelay_CC 3981 0.89 2.53 0.20 77 MultiRelay_Combo 3981 0.89 2.53 0.20 78 HTML_MIME_NO_HTML_TAG 3955 2.29 2.52 2.19 79 XMStockSpam_06 3831 1.29 2.44 0.81 80 NO_DNS_FOR_FROM 3540 1.84 2.25 1.67 81 XMBody_17 3480 0.88 2.21 0.31 82 XM_URI_RBL 3456 0.72 2.20 0.10 83 RCVD_IN_IADB_LISTED 3381 4.31 2.15 5.21 84 RELAYCOUNTRY_GB 3242 1.31 2.06 1.00 85 TR_Symld_Words 3215 1.95 2.05 1.90 86 MAILING_LIST_MULTI 3154 2.47 2.01 2.66 87 XM_UB99 3021 0.58 1.92 0.01 88 XMGenDplmaNmb 2935 1.23 1.87 0.95 89 RELAYCOUNTRY_FR 2916 0.76 1.86 0.30 90 TM2_M_VERY_LONG_WORD 2868 1.05 1.83 0.73 91 RCVD_IN_IADB_SPF 2864 3.74 1.82 4.55 92 XMBdyGiftCard01 2861 0.93 1.82 0.56 93 RCVD_IN_IADB_SENDERID 2750 3.34 1.75 4.01 94 RCVD_IN_IADB_DK 2716 3.27 1.73 3.93 95 FILL_THIS_FORM 2700 0.80 1.72 0.41 96 TR_Mismatch_TLD_02 2679 0.55 1.71 0.06 97 XMPhish30 2668 0.77 1.70 0.38 98 XMHTML_After_End 2646 0.79 1.68 0.41 99 XMSubMetaSxObfu_03 2577 0.74 1.64 0.37 100 SpammyFromTLD_02 2545 0.74 1.62 0.36 101 FILL_THIS_FORM_LONG 2525 0.70 1.61 0.31 102 XM_DK_Undo_01 2483 1.88 1.58 2.01 103 XMSexyCombo_01 2478 0.77 1.58 0.43 104 XM_UB999 2460 0.47 1.57 0.01 105 URIBL_BLACK 2443 0.48 1.55 0.03 106 T_XMDrugObfuBody_00 2440 1.05 1.55 0.84 107 RCVD_IN_RP_RNBL 2385 0.48 1.52 0.04 108 BAYES_00 2361 5.85 1.50 7.68 109 LOW_PRICE 2346 0.57 1.49 0.19 110 UNPARSEABLE_RELAY 2346 2.24 1.49 2.56 111 SpammyFromTLD_01 2341 2.77 1.49 3.31 112 XMSubMetaI_00 2322 0.67 1.48 0.33 113 FSL_THIS_IS_ADV 2308 0.48 1.47 0.06 114 XMSolicitRefs_0 2302 0.75 1.47 0.45 115 LOADSA_MONEY_COMBO 2273 0.51 1.45 0.11 116 XM_OfRef7 2226 0.53 1.42 0.16 117 XM_RXBody 2225 0.54 1.42 0.17 118 XM_Nigeria_01 2158 0.45 1.37 0.06 119 XM_H_Long_From02 2115 0.85 1.35 0.64 120 TR_XM_RelayPhish 2097 0.71 1.33 0.45 121 BOTNET_NORDNS 2069 0.41 1.32 0.03 122 XM_ProductURIs 2065 0.93 1.31 0.77 123 RCVD_IN_MSPIKE_H3 2057 2.09 1.31 2.42 124 RCVD_IN_MSPIKE_WL 2057 2.09 1.31 2.42 125 T_FILL_THIS_FORM_SHORT 2048 1.05 1.30 0.94 126 BAYES_40 2035 5.54 1.30 7.32 127 XFER_LOTSA_MONEY 2031 0.45 1.29 0.10 128 SUBJ_DOLLARS 1986 0.83 1.26 0.65 129 T_XMHurry_00 1977 0.67 1.26 0.43 130 ALL_TRUSTED 1878 16.25 1.20 22.60 131 DKIM_ADSP_CUSTOM_MED 1837 1.01 1.17 0.95 132 TR_XM_DK_Bayes 1810 3.70 1.15 4.78 133 XM_HighProb1 1807 0.35 1.15 0.01 134 TR_Caps_n_Bayes_99 1800 0.39 1.15 0.07 135 PLING_QUERY 1729 0.53 1.10 0.29 136 TooManyTo_002 1717 2.15 1.09 2.59 137 TR_XM_DK_Bayes1 1689 3.37 1.08 4.33 138 RDNS_DYNAMIC 1682 0.60 1.07 0.40 139 XMPhish14 1648 0.74 1.05 0.61 140 URIBL_DBL_SPAM 1642 0.33 1.05 0.03 141 HTTPS_HTTP_MISMATCH 1637 0.63 1.04 0.46 142 BAYES_20 1631 2.30 1.04 2.84 143 TR_XM_DK_Bayes2 1625 2.72 1.03 3.43 144 XM_DKIMWhitelistDomains 1619 5.78 1.03 7.78 145 XM_B_COPY_HTML 1617 0.65 1.03 0.49 146 T_HTML_TAG_BALANCE_CENTER 1609 0.38 1.02 0.11 147 XM_BadFromFormat 1609 0.47 1.02 0.23 148 XM_UB60 1598 0.36 1.02 0.09 149 XMLongAddy 1590 0.38 1.01 0.11 150 MONEY_FRAUD_5 1554 0.29 0.99 0.00 151 MPART_ALT_DIFF_COUNT 1546 0.45 0.98 0.23 152 TR_LOTS_OF_MONEY2 1542 0.66 0.98 0.52 153 T_MONEY_PERCENT 1542 0.66 0.98 0.52 154 TO_MALFORMED 1518 1.58 0.97 1.84 155 URI_TRY_3LD 1499 1.00 0.95 1.01 156 XMBody_78 1485 0.54 0.95 0.37 157 TooManyTo_003 1485 1.49 0.95 1.72 158 XMBrknScrpt_02 1483 0.79 0.94 0.73 159 XMCapTrack 1480 1.49 0.94 1.72 160 NML_ADSP_CUSTOM_MED 1477 0.76 0.94 0.68 161 RCVD_IN_IADB_VOUCHED 1476 2.66 0.94 3.39 162 FORGED_GMAIL_RCVD 1443 0.60 0.92 0.47 163 RELAYCOUNTRY_AT 1441 0.35 0.92 0.11 164 LONG_JUNK_URI3 1433 0.31 0.91 0.05 165 XM_B_REG_HTML 1430 0.63 0.91 0.51 166 RELAYCOUNTRY_CN 1425 0.29 0.91 0.03 167 XM_UB80 1422 0.29 0.91 0.03 168 HTML_FONT_SIZE_HUGE 1417 0.33 0.90 0.10 169 XM_H_PHPOS 1405 2.90 0.89 3.74 170 DIET_1 1395 0.42 0.89 0.22 171 XMClaimOffer 1357 0.38 0.86 0.18 172 RELAYCOUNTRY_DE 1356 0.66 0.86 0.58 173 RELAYCOUNTRY_AU 1341 0.55 0.85 0.42 174 XMMoneyMeta_00 1335 0.57 0.85 0.45 175 LongTLD 1334 0.36 0.85 0.16 176 REMOVE_BEFORE_LINK 1334 0.44 0.85 0.26 177 T_TooManySym_02 1299 1.32 0.83 1.52 178 XM_PDF 1280 3.39 0.81 4.48 179 BASE64_LENGTH_79_INF 1223 0.30 0.78 0.10 180 TooManyTo_004 1210 1.14 0.77 1.29 181 URI_NOVOWEL 1182 0.46 0.75 0.34 182 TR_MetaPhish_Combo_01 1179 0.73 0.75 0.73 183 RELAYCOUNTRY_IT 1174 0.25 0.75 0.04 184 XMHTMLBadTable_001 1151 0.42 0.73 0.28 185 TR_LOTS_OF_MONEY3 1125 0.41 0.72 0.28 186 XM_H_Long_From03 1121 0.28 0.71 0.10 187 ADMITS_SPAM 1116 0.22 0.71 0.02 188 XMSexyCombo_04 1094 0.26 0.70 0.08 189 HTML_IMAGE_ONLY_28 1093 0.52 0.70 0.44 190 RCVD_IN_PSBL 1092 0.28 0.70 0.11 191 XM_Body_Obfu01 1092 0.37 0.70 0.23 192 T_Symld_Words_02 1078 0.44 0.69 0.34 193 HTML_FONT_SIZE_LARGE 1074 0.31 0.68 0.16 194 TooManyTo_005 1071 0.96 0.68 1.08 195 BODY_URI_ONLY 1057 0.23 0.67 0.05 196 XM_H_PHPMailer 1045 0.80 0.67 0.86 197 HTML_FONT_FACE_BAD 1026 0.58 0.65 0.55 198 DKIM_ADSP_NXDOMAIN 1023 0.46 0.65 0.37 199 MISSING_HEADERS 1017 0.63 0.65 0.63 200 ANY_BOUNCE_MESSAGE 1005 2.68 0.64 3.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295190 83.84 94.99 79.14 2 DCC_CHECK_NEGATIVE 252566 52.92 17.80 67.71 3 DKIM_SIGNED 250121 73.31 88.17 67.06 4 XM_DK_Pass 244979 71.70 85.98 65.68 5 DKIM_VALID 227460 66.91 80.97 60.98 6 BAYES_50 210866 49.05 31.27 56.53 7 DKIM_VALID_AU 160477 48.59 61.79 43.02 8 XMListUnsubscribeExists 159663 51.78 73.08 42.81 9 T_TM2_M_HEADER_IN_MSG 132899 31.41 21.40 35.63 10 XM_H_QuotedFrom 115938 37.86 53.94 31.08 11 DCC_CHECK 112237 44.87 79.97 30.09 12 DKIM_VALID_EF 88128 23.89 24.52 23.63 13 ALL_TRUSTED 84289 16.25 1.20 22.60 14 MultiRelay 81950 20.84 18.17 21.97 15 HTML_FONT_LOW_CONTRAST 81421 25.75 35.04 21.83 16 XMSubLong 69781 21.56 28.33 18.71 17 FVGT_m_MULTI_ODD 67484 20.57 26.47 18.09 18 MIME_HTML_ONLY 61448 20.90 31.42 16.47 19 LOC_TINY_FONT_1 59021 22.06 36.85 15.82 20 T_KAM_HTML_FONT_INVALID 48643 15.67 21.91 13.04 21 XM_DK_Undo_02 44916 23.47 50.60 12.04 22 BAYES_99 40952 21.44 46.27 10.98 23 XM_H_Long_From01 37033 9.16 7.34 9.93 24 BAYES_999 35963 18.55 39.69 9.64 25 XM_Multi_Part_URI 35599 11.79 17.14 9.54 26 XM_Body_Dirty_Words 32570 12.30 20.76 8.73 27 LOTS_OF_MONEY 30690 10.10 14.56 8.23 28 TooManyTo_001 30156 7.87 7.34 8.09 29 XM_DKIMWhitelistDomains 29001 5.78 1.03 7.78 30 BAYES_00 28634 5.85 1.50 7.68 31 RCVD_IN_RP_SAFE 27559 6.60 4.72 7.39 32 BAYES_40 27312 5.54 1.30 7.32 33 T_XMDrugObfuBody_14 27075 8.66 11.99 7.26 34 RCVD_IN_RP_CERTIFIED 25386 6.03 4.19 6.81 35 LotsOfNums_01 24918 7.57 9.67 6.68 36 XM_Evil_Numbers_Gen 23950 9.44 16.62 6.42 37 SUBJ_ALL_CAPS 23862 5.27 2.59 6.40 38 BAYES_60 23717 6.31 6.18 6.36 39 FSL_BULK_SIG 22977 8.26 13.25 6.16 40 XM_UncommonTLD01 22700 6.36 7.00 6.09 41 DKIM_INVALID 22661 6.41 7.19 6.08 42 IN_ZIMBRA_NJ_WHITELIST 20983 3.97 0.04 5.63 43 HTML_IMAGE_RATIO_02 19904 7.89 13.97 5.34 44 RCVD_IN_IADB_LISTED 19442 4.31 2.15 5.21 45 TR_DCC_Bayes_99 18958 14.43 36.61 5.08 46 MIME_QP_LONG_LINE 17998 4.73 4.51 4.83 47 XM_SendGrid 17909 4.71 4.49 4.80 48 TR_XM_DK_Bayes 17817 3.70 1.15 4.78 49 RELAYCOUNTRY_META 17686 8.02 15.81 4.74 50 RCVD_IN_IADB_SPF 16957 3.74 1.82 4.55 51 T_REMOTE_IMAGE 16815 4.19 3.44 4.51 52 XM_PDF 16713 3.39 0.81 4.48 53 TR_XM_DK_Bayes1 16153 3.37 1.08 4.33 54 XM_B_Phish_Phrases 16061 5.84 9.50 4.31 55 HTML_IMAGE_RATIO_04 15700 6.02 10.33 4.21 56 RCVD_IN_IADB_SENDERID 14948 3.34 1.75 4.01 57 RCVD_IN_MSPIKE_H2 14684 3.99 4.12 3.94 58 RCVD_IN_IADB_DK 14640 3.27 1.73 3.93 59 T_TooManySym_01 14119 3.81 3.88 3.79 60 XM_H_PHPOS 13956 2.90 0.89 3.74 61 BAYES_80 13815 4.76 7.28 3.70 62 XMStrtUSub 13788 3.80 4.06 3.70 63 ANY_BOUNCE_MESSAGE 13190 2.68 0.64 3.54 64 XMSubMetaSx_00 13185 4.89 8.10 3.53 65 BOUNCE_MESSAGE 13180 2.67 0.64 3.53 66 BOTNET_IPINHOSTNAME 12992 5.76 11.16 3.48 67 TR_XM_DK_Bayes2 12785 2.72 1.03 3.43 68 RCVD_IN_IADB_VOUCHED 12641 2.66 0.94 3.39 69 XM_SPF_SoftFail 12621 3.54 3.91 3.38 70 SpammyFromTLD_01 12355 2.77 1.49 3.31 71 TR_XM_DocInvoice 12310 4.58 7.63 3.30 72 XMNumbers 10958 3.54 4.97 2.94 73 FROM_EXCESS_BASE64 10851 4.14 7.06 2.91 74 BAYES_20 10577 2.30 1.04 2.84 75 MAILING_LIST_MULTI 9937 2.47 2.01 2.66 76 MPART_ALT_DIFF 9754 3.73 6.36 2.62 77 TooManyTo_002 9665 2.15 1.09 2.59 78 UNPARSEABLE_RELAY 9530 2.24 1.49 2.56 79 HELO_NODOT 9366 1.88 0.40 2.51 80 BAYES_95 9263 3.06 4.44 2.48 81 TVD_RCVD_IP 9150 1.84 0.39 2.45 82 RCVD_IN_MSPIKE_WL 9017 2.09 1.31 2.42 83 RCVD_IN_MSPIKE_H3 9014 2.09 1.31 2.42 84 XMSexyCombo_05 8681 4.90 10.99 2.33 85 HTML_IMAGE_RATIO_06 8568 3.14 5.13 2.30 86 IN_HORDE_ADDRESS_BOOK 8203 1.57 0.06 2.20 87 HTML_MIME_NO_HTML_TAG 8164 2.29 2.52 2.19 88 RCVD_IN_IADB_OPTIN 8082 1.69 0.57 2.17 89 TM2_M_URI_OPT_OUT 7610 2.97 5.18 2.04 90 XM_DK_Undo_01 7484 1.88 1.58 2.01 91 HTML_IMAGE_RATIO_08 7225 2.53 3.93 1.94 92 TR_Symld_Words 7101 1.95 2.05 1.90 93 BAYES_05 7057 1.51 0.61 1.89 94 INVALID_MSGID 7015 1.40 0.25 1.88 95 TO_MALFORMED 6875 1.58 0.97 1.84 96 MIME_HTML_MOSTLY 6857 2.57 4.29 1.84 97 XMDiploma_00 6717 2.07 2.72 1.80 98 MSGID_NOFQDN1 6667 1.26 0.02 1.79 99 TooManyTo_003 6423 1.49 0.95 1.72 100 XMCapTrack 6405 1.49 0.94 1.72 101 XM_DIRTYINTL 6291 2.35 3.92 1.69 102 NO_DNS_FOR_FROM 6231 1.84 2.25 1.67 103 XM_CamelCaseFrm001 5819 2.09 3.35 1.56 104 T_TooManySym_02 5673 1.32 0.83 1.52 105 MIME_HTML_ONLY_MULTI 5506 1.97 3.13 1.48 106 BOTNET 5163 4.23 10.98 1.38 107 XM_GoogleGroups 5155 1.14 0.57 1.38 108 T_XMDrugObfuBody_08 5091 2.03 3.59 1.36 109 TooManyTo_004 4812 1.14 0.77 1.29 110 XMPhish11 4782 1.75 2.86 1.28 111 RELAYCOUNTRY_CA 4766 1.80 3.04 1.28 112 XM_OfRef6 4669 1.91 3.46 1.25 113 URI_HEX 4546 1.88 3.45 1.22 114 UNTRUSTED_Relay 4532 3.44 8.73 1.22 115 USER_IN_DEF_DKIM_WL 4301 0.84 0.10 1.15 116 TooManyTo_005 4015 0.96 0.68 1.08 117 URI_TRY_3LD 3784 1.00 0.95 1.01 118 RELAYCOUNTRY_GB 3717 1.31 2.06 1.00 119 XMGenDplmaNmb 3559 1.23 1.87 0.95 120 DKIM_ADSP_CUSTOM_MED 3533 1.01 1.17 0.95 121 T_FILL_THIS_FORM_SHORT 3514 1.05 1.30 0.94 122 XMSubNoVowel 3255 0.70 0.29 0.87 123 XM_H_PHPMailer 3210 0.80 0.67 0.86 124 XM_UB50 3153 1.61 3.43 0.85 125 T_XMDrugObfuBody_00 3123 1.05 1.55 0.84 126 XMStockSpam_06 3032 1.29 2.44 0.81 127 USER_IN_WHITELIST 2895 0.55 0.00 0.78 128 XM_ProductURIs 2880 0.93 1.31 0.77 129 RCVD_IN_BL_SPAMCOP_NET 2764 1.57 3.53 0.74 130 XMSubEmpty 2727 0.57 0.19 0.73 131 XMBrknScrpt_02 2718 0.79 0.94 0.73 132 TR_MetaPhish_Combo_01 2709 0.73 0.75 0.73 133 TM2_M_VERY_LONG_WORD 2706 1.05 1.83 0.73 134 T_TooManySym_03 2649 0.56 0.21 0.71 135 NML_ADSP_CUSTOM_MED 2544 0.76 0.94 0.68 136 RCVD_IN_SORBS_DUL 2465 0.57 0.35 0.66 137 SUBJ_DOLLARS 2440 0.83 1.26 0.65 138 XM_H_Long_From02 2382 0.85 1.35 0.64 139 XMNoVowels 2371 0.60 0.53 0.64 140 MISSING_HEADERS 2339 0.63 0.65 0.63 141 XMLngstWrd_00 2282 0.58 0.50 0.61 142 XMPhish14 2271 0.74 1.05 0.61 143 T_OBFU_PDF_ATTACH 2266 0.50 0.25 0.61 144 SHORT_HELO_AND_INLINE_IMAGE 2263 0.46 0.10 0.61 145 XMGappySubj_01 2192 0.57 0.53 0.59 146 RELAYCOUNTRY_DE 2150 0.66 0.86 0.58 147 AC_DIV_BONANZA 2099 0.47 0.24 0.56 148 XMBdyGiftCard01 2074 0.93 1.82 0.56 149 HTML_FONT_FACE_BAD 2052 0.58 0.65 0.55 150 TR_LOTS_OF_MONEY2 1935 0.66 0.98 0.52 151 T_MONEY_PERCENT 1935 0.66 0.98 0.52 152 XM_B_REG_HTML 1915 0.63 0.91 0.51 153 TVD_SPACE_RATIO 1914 0.42 0.18 0.51 154 XM_ShortIntro_01 1873 0.53 0.59 0.50 155 HTML_IMAGE_ONLY_32 1870 0.47 0.39 0.50 156 XM_B_COPY_HTML 1814 0.65 1.03 0.49 157 XMDateMe_00 1777 0.48 0.50 0.48 158 FORGED_GMAIL_RCVD 1763 0.60 0.92 0.47 159 HTTPS_HTTP_MISMATCH 1728 0.63 1.04 0.46 160 XM_USANA_RCVD 1709 0.32 0.00 0.46 161 XMBody_95 1705 0.40 0.25 0.46 162 XMSolicitRefs_0 1681 0.75 1.47 0.45 163 XMMoneyMeta_00 1673 0.57 0.85 0.45 164 TR_XM_RelayPhish 1672 0.71 1.33 0.45 165 HTML_IMAGE_ONLY_16 1658 0.39 0.26 0.44 166 HTML_IMAGE_ONLY_28 1648 0.52 0.70 0.44 167 XMSexyCombo_01 1604 0.77 1.58 0.43 168 T_XMHurry_00 1588 0.67 1.26 0.43 169 RELAYCOUNTRY_AU 1550 0.55 0.85 0.42 170 XMHTML_After_End 1537 0.79 1.68 0.41 171 FILL_THIS_FORM 1520 0.80 1.72 0.41 172 RDNS_DYNAMIC 1506 0.60 1.07 0.40 173 HTML_IMAGE_ONLY_24 1484 0.40 0.41 0.40 174 HTML_TAG_BALANCE_BODY 1443 0.46 0.64 0.39 175 TM2_M_BODY_EMPTY 1436 0.33 0.21 0.39 176 TR_Mismatch_TLD_01 1428 0.39 0.40 0.38 177 XMPhish30 1426 0.77 1.70 0.38 178 DKIM_ADSP_NXDOMAIN 1390 0.46 0.65 0.37 179 XMBody_78 1390 0.54 0.95 0.37 180 UPPERCASE_50_75 1380 0.37 0.38 0.37 181 XMSubMetaSxObfu_02 1380 0.32 0.21 0.37 182 XMSubMetaSxObfu_03 1372 0.74 1.64 0.37 183 SpammyFromTLD_02 1355 0.74 1.62 0.36 184 XM_B_TRADE_HTML 1323 0.38 0.44 0.35 185 URI_NOVOWEL 1278 0.46 0.75 0.34 186 T_Symld_Words_02 1261 0.44 0.69 0.34 187 XMSubMetaI_00 1237 0.67 1.48 0.33 188 TM2_M_A_HREF_HREF 1209 0.38 0.52 0.32 189 T_TooManySym_04 1208 0.24 0.04 0.32 190 HTML_IMAGE_ONLY_12 1188 0.31 0.29 0.32 191 XMLngstWrd_01 1186 0.36 0.45 0.32 192 HTML_IMAGE_ONLY_20 1175 0.32 0.33 0.32 193 FILL_THIS_FORM_LONG 1173 0.70 1.61 0.31 194 XMBody_17 1169 0.88 2.21 0.31 195 XM_H_Trusted_IP 1142 0.22 0.00 0.31 196 RELAYCOUNTRY_FR 1127 0.76 1.86 0.30 197 XM_H_PHPOS_M 1105 0.32 0.37 0.30 198 PLING_QUERY 1099 0.53 1.10 0.29 199 TR_MetaPhish_Combo_01b 1084 0.27 0.21 0.29 200 TR_LOTS_OF_MONEY3 1062 0.41 0.72 0.28 ----------------------------------------------------------------------