Email: 453734 Autolearn: 0 AvgScore: 6.15 AvgScanTime: 3.36 sec Spam: 180700 Autolearn: 0 AvgScore: 15.35 AvgScanTime: 4.00 sec Ham: 273034 Autolearn: 0 AvgScore: 0.06 AvgScanTime: 2.94 sec Time Spent Running SA: 423.51 hours Time Spent Processing Spam: 200.75 hours Time Spent Processing Ham: 222.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174396 90.35 96.51 86.27 2 DKIM_SIGNED 125367 67.38 69.38 66.06 3 XM_DK_Pass 123147 66.44 68.15 65.30 4 DCC_CHECK 121815 48.12 67.41 35.35 5 DKIM_VALID 115862 62.87 64.12 62.04 6 XMListUnsubscribeExists 110253 51.38 61.01 45.01 7 DKIM_VALID_AU 94608 49.16 52.36 47.04 8 MIME_HTML_ONLY 81885 29.32 45.32 18.74 9 XM_H_QuotedFrom 77164 35.69 42.70 31.05 10 XM_DK_Undo_02 75082 25.97 41.55 15.67 11 BAYES_99 72319 25.18 40.02 15.36 12 BAYES_999 58651 21.06 32.46 13.52 13 DCC_CHECK_NEGATIVE 57290 50.93 31.70 63.66 14 LOC_TINY_FONT_1 56308 26.80 31.16 23.91 15 TR_DCC_Bayes_99 55174 16.57 30.53 7.32 16 BAYES_50 52230 46.43 28.90 58.03 17 HTML_FONT_LOW_CONTRAST 51939 28.94 28.74 29.07 18 RELAYCOUNTRY_META 50336 13.29 27.86 3.66 19 BOTNET 49617 11.45 27.46 0.86 20 BOTNET_IPINHOSTNAME 46767 14.30 25.88 6.63 21 UNTRUSTED_Relay 43161 10.10 23.89 0.98 22 FROM_EXCESS_BASE64 42520 11.70 23.53 3.88 23 XM_UncommonTLD01 39558 10.87 21.89 3.57 24 FVGT_m_MULTI_ODD 38178 20.95 21.13 20.83 25 T_REMOTE_IMAGE 37171 10.48 20.57 3.80 26 XMSubLong 36585 18.78 20.25 17.80 27 SpammyFromTLD_02 34973 7.86 19.35 0.26 28 BODY_URI_ONLY 34559 7.68 19.13 0.11 29 HTML_MIME_NO_HTML_TAG 33581 8.11 18.58 1.18 30 HTML_SHORT_LINK_IMG_1 32632 10.78 18.06 5.97 31 HTML_FONT_SIZE_LARGE 32253 10.78 17.85 6.11 32 DKIM_VALID_EF 32187 23.20 17.81 26.77 33 MISSING_HEADERS 31632 7.23 17.51 0.42 34 HTML_IMAGE_RATIO_02 31331 12.30 17.34 8.96 35 MIME_HEADER_CTYPE_ONLY 30981 6.91 17.14 0.14 36 T_KAM_HTML_FONT_INVALID 29987 14.36 16.59 12.88 37 XM_Body_Dirty_Words 28654 12.59 15.86 10.43 38 RELAYCOUNTRY_TH 28546 6.29 15.80 0.00 39 MultiRelay 27905 14.60 15.44 14.04 40 XMNumbers 27092 8.38 14.99 4.00 41 T_TM2_M_HEADER_IN_MSG 24392 17.65 13.50 20.39 42 XM_Multi_Part_URI 23384 12.22 12.94 11.75 43 SHORTENER_SHORT_IMG 23036 7.64 12.75 4.25 44 SHORTENED_URL_SRC 23020 7.63 12.74 4.26 45 XM_Evil_Numbers_Gen 21129 8.93 11.69 7.10 46 HTML_IMAGE_ONLY_08 19782 6.49 10.95 3.54 47 FSL_BULK_SIG 19279 8.58 10.67 7.20 48 BAYES_80 18629 6.52 10.31 4.02 49 HTML_IMAGE_RATIO_04 15151 6.32 8.38 4.95 50 XMSexyCombo_05 15113 5.15 8.36 3.03 51 BAYES_60 14212 7.15 7.86 6.68 52 LOTS_OF_MONEY 13718 8.92 7.59 9.80 53 XM_B_Phish_Phrases 13578 5.88 7.51 4.81 54 MPART_ALT_DIFF 13564 5.69 7.51 4.48 55 T_XMDrugObfuBody_14 13509 6.62 7.48 6.05 56 BAYES_95 13494 4.83 7.47 3.09 57 HTML_IMAGE_ONLY_04 12990 4.38 7.19 2.52 58 XM_SPF_SoftFail 11930 3.56 6.60 1.55 59 LotsOfNums_01 11881 7.64 6.57 8.35 60 RCVD_IN_RP_SAFE 11617 8.40 6.43 9.70 61 XM_H_Long_From01 11533 5.20 6.38 4.42 62 XMNoVowels 10775 3.84 5.96 2.44 63 XM_UB50 10515 2.69 5.82 0.62 64 TooManyTo_001 10157 6.17 5.62 6.53 65 XMSubMetaSx_00 9925 4.81 5.49 4.36 66 DKIM_INVALID 9505 4.51 5.26 4.02 67 XMGappySubj_01 9232 2.19 5.11 0.26 68 TR_XM_DocInvoice 9197 3.63 5.09 2.67 69 BODY_SINGLE_WORD 8843 1.95 4.89 0.01 70 MIME_HTML_MOSTLY 8660 4.14 4.79 3.70 71 RCVD_IN_RP_CERTIFIED 8610 7.22 4.76 8.84 72 XM_UB80 8312 1.84 4.60 0.02 73 TVD_SPACE_RATIO_MINFP 8029 1.77 4.44 0.00 74 XM_UB95 7748 1.72 4.29 0.02 75 XMStrtUSub 7492 4.68 4.15 5.04 76 XM_UB60 7368 1.65 4.08 0.05 77 SUBJ_ALL_CAPS 6933 2.60 3.84 1.78 78 HTML_IMAGE_RATIO_06 6793 3.47 3.76 3.28 79 XM_UB99 6335 1.41 3.51 0.02 80 URI_HEX 6332 2.64 3.50 2.08 81 XM_CamelCaseFrm001 6252 2.27 3.46 1.48 82 T_TooManySym_01 6140 3.66 3.40 3.83 83 MIME_HTML_ONLY_MULTI 6003 2.15 3.32 1.37 84 DIET_1 5760 1.80 3.19 0.87 85 XM_SendGrid 5750 4.04 3.18 4.61 86 HTML_IMAGE_RATIO_08 5642 2.29 3.12 1.75 87 XM_DIRTYINTL 5452 2.24 3.02 1.73 88 RCVD_IN_MSPIKE_H2 5402 3.49 2.99 3.83 89 MIME_QP_LONG_LINE 4714 3.68 2.61 4.39 90 TM2_M_URI_OPT_OUT 4702 2.39 2.60 2.25 91 XMBody_17 4584 1.32 2.54 0.52 92 XM_JunkDunk 4380 0.97 2.42 0.00 93 XM_OfRef6 4326 1.68 2.39 1.21 94 XMBdyGiftCard01 4137 1.58 2.29 1.12 95 HTML_SHORT_CENTER 4097 1.40 2.27 0.82 96 RCVD_IN_RP_RNBL 4059 0.95 2.25 0.10 97 URIBL_DBL_SPAM 3839 1.42 2.12 0.96 98 NO_DNS_FOR_FROM 3819 1.64 2.11 1.32 99 TR_Symld_Words 3781 2.07 2.09 2.05 100 RELAYCOUNTRY_CA 3754 1.53 2.08 1.17 101 XMDiploma_00 3630 1.72 2.01 1.53 102 BOTNET_NORDNS 3511 0.78 1.94 0.01 103 MultiRelay_Combo 3318 0.79 1.84 0.10 104 MultiRelay_CC 3318 0.79 1.84 0.10 105 T_XMDrugObfuBody_08 3288 1.40 1.82 1.12 106 XM_URI_RBL 3284 0.79 1.82 0.10 107 BAYES_20 3141 1.97 1.74 2.13 108 RCVD_IN_BL_SPAMCOP_NET 2883 0.76 1.60 0.21 109 XMSubMetaI_00 2873 0.96 1.59 0.54 110 XMHTML_After_End 2794 0.76 1.55 0.25 111 DRUGS_ERECTILE 2771 0.64 1.53 0.04 112 XM_ProductURIs 2733 1.52 1.51 1.53 113 DATE_IN_PAST_06_12 2723 0.63 1.51 0.05 114 ONLINE_PHARMACY 2711 0.61 1.50 0.02 115 XMSubject_48 2690 0.60 1.49 0.02 116 T_XMHurry_00 2651 0.84 1.47 0.43 117 TVD_VISIT_PHARMA 2642 0.59 1.46 0.01 118 BAYES_40 2589 2.54 1.43 3.27 119 ALL_TRUSTED 2576 17.85 1.43 28.72 120 XMSexyCombo_01 2553 0.85 1.41 0.47 121 RCVD_IN_IADB_LISTED 2513 3.28 1.39 4.52 122 XMPhish14 2471 0.73 1.37 0.31 123 XM_H_Long_From02 2458 0.97 1.36 0.71 124 XMGappySubj_02 2414 0.60 1.34 0.12 125 RELAYCOUNTRY_RO 2371 0.52 1.31 0.00 126 MALE_ENHANCE 2368 0.78 1.31 0.42 127 BAYES_00 2365 4.11 1.31 5.96 128 TR_Caps_n_Bayes_99 2338 0.54 1.29 0.04 129 UNPARSEABLE_RELAY 2318 3.92 1.28 5.67 130 TR_Caps_n_Bayes_80 2299 0.55 1.27 0.07 131 RELAYCOUNTRY_FR 2266 0.70 1.25 0.33 132 XMPhish11 2263 1.04 1.25 0.90 133 MAILING_LIST_MULTI 2260 1.41 1.25 1.52 134 FVGT_m_MULTI_ODD_EMAIL 2229 0.56 1.23 0.11 135 URIBL_BLACK 2219 0.51 1.23 0.03 136 RCVD_IN_IADB_SPF 2200 2.84 1.22 3.91 137 RCVD_IN_IADB_SENDERID 2071 2.52 1.15 3.43 138 DRUG_ED_CAPS 2061 0.45 1.14 0.00 139 TR_XM_RelayPhish 2059 0.63 1.14 0.29 140 RCVD_IN_IADB_DK 2039 2.46 1.13 3.34 141 SUBJ_DOLLARS 2024 0.59 1.12 0.23 142 XM_HighProb1 2018 0.46 1.12 0.02 143 XM_B_REG_HTML 2010 0.81 1.11 0.62 144 XM_BadFromFormat 1990 0.54 1.10 0.17 145 XMHTMLBadTable_001 1978 0.67 1.09 0.39 146 DATE_IN_PAST_12_24 1952 0.58 1.08 0.26 147 URI_TRY_3LD 1931 1.27 1.07 1.40 148 XMBody_78 1928 0.65 1.07 0.38 149 TR_XM_DK_Bayes 1885 2.99 1.04 4.28 150 XM_DK_Undo_01 1867 1.51 1.03 1.82 151 XMStockSpam_06 1865 0.84 1.03 0.71 152 XM_UB999 1836 0.41 1.02 0.02 153 XM_RXBody 1823 0.47 1.01 0.11 154 URI_NOVOWEL 1794 0.69 0.99 0.49 155 TR_XM_DK_Bayes1 1786 2.84 0.99 4.07 156 XMGenDplmaNmb 1751 0.88 0.97 0.82 157 XMPhish30 1743 0.54 0.96 0.26 158 TM2_M_VERY_LONG_WORD 1738 0.90 0.96 0.85 159 RELAYCOUNTRY_AT 1736 0.43 0.96 0.09 160 XMLongAddy 1699 0.44 0.94 0.11 161 XM_H_PHPOS 1665 0.95 0.92 0.96 162 T_FILL_THIS_FORM_SHORT 1660 0.72 0.92 0.59 163 HTML_FONT_FACE_BAD 1660 0.60 0.92 0.39 164 FILL_THIS_FORM 1645 1.06 0.91 1.15 165 BAYES_05 1598 1.18 0.88 1.38 166 T_FILL_THIS_FORM_LONG 1595 0.61 0.88 0.44 167 TR_XM_DK_Bayes2 1552 2.35 0.86 3.34 168 RELAYCOUNTRY_CN 1538 0.35 0.85 0.02 169 BODY_ENHANCEMENT 1508 0.36 0.83 0.05 170 XMClaimOffer 1475 0.66 0.82 0.56 171 DATE_IN_PAST_03_06 1445 0.36 0.80 0.06 172 SpammyFromTLD_01 1443 0.52 0.80 0.33 173 RELAYCOUNTRY_IN 1436 0.35 0.79 0.05 174 XMSlimDrugH 1435 0.58 0.79 0.43 175 FROM_LOCAL_NOVOWEL 1367 0.35 0.76 0.08 176 T_Symld_Words_02 1360 0.51 0.75 0.35 177 HTML_TAG_BALANCE_BODY 1330 0.59 0.74 0.49 178 REMOVE_BEFORE_LINK 1326 0.55 0.73 0.43 179 BOUNCE_MESSAGE 1320 8.60 0.73 13.81 180 ANY_BOUNCE_MESSAGE 1320 8.60 0.73 13.81 181 FILL_THIS_FORM_LOAN 1300 0.51 0.72 0.37 182 XM_B_COPY_HTML 1293 0.68 0.72 0.65 183 DKIM_ADSP_CUSTOM_MED 1286 0.96 0.71 1.13 184 TooManyTo_002 1280 2.04 0.71 2.92 185 RCVD_IN_MSPIKE_WL 1275 1.67 0.71 2.31 186 TR_Mismatch_TLD_02 1267 0.32 0.70 0.07 187 TR_LOTS_OF_MONEY2 1243 0.64 0.69 0.61 188 T_MONEY_PERCENT 1243 0.64 0.69 0.61 189 RCVD_IN_MSPIKE_H3 1234 1.66 0.68 2.31 190 MPART_ALT_DIFF_COUNT 1219 0.89 0.67 1.03 191 RCVD_IN_IADB_VOUCHED 1206 2.15 0.67 3.13 192 XMSexyCombo_04 1202 0.32 0.67 0.09 193 TooManyTo_003 1198 1.77 0.66 2.50 194 TM2_M_A_HREF_HREF 1191 0.85 0.66 0.98 195 XM_H_PHPMailer 1180 0.60 0.65 0.57 196 XM_Body_Obfu01 1149 0.31 0.64 0.09 197 HTML_FONT_SIZE_HUGE 1146 0.34 0.63 0.14 198 XMBrknScrpt_02 1135 0.63 0.63 0.63 199 NML_ADSP_CUSTOM_MED 1122 0.80 0.62 0.92 200 T_TooManySym_02 1108 1.14 0.61 1.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 235539 90.35 96.51 86.27 2 DKIM_SIGNED 180353 67.38 69.38 66.06 3 XM_DK_Pass 178297 66.44 68.15 65.30 4 DCC_CHECK_NEGATIVE 173808 50.93 31.70 63.66 5 DKIM_VALID 169380 62.87 64.12 62.04 6 BAYES_50 158452 46.43 28.90 58.03 7 DKIM_VALID_AU 128445 49.16 52.36 47.04 8 XMListUnsubscribeExists 122879 51.38 61.01 45.01 9 DCC_CHECK 96508 48.12 67.41 35.35 10 XM_H_QuotedFrom 84764 35.69 42.70 31.05 11 HTML_FONT_LOW_CONTRAST 79363 28.94 28.74 29.07 12 ALL_TRUSTED 78411 17.85 1.43 28.72 13 DKIM_VALID_EF 73087 23.20 17.81 26.77 14 LOC_TINY_FONT_1 65279 26.80 31.16 23.91 15 FVGT_m_MULTI_ODD 56871 20.95 21.13 20.83 16 T_TM2_M_HEADER_IN_MSG 55674 17.65 13.50 20.39 17 MIME_HTML_ONLY 51172 29.32 45.32 18.74 18 XMSubLong 48610 18.78 20.25 17.80 19 XM_DK_Undo_02 42772 25.97 41.55 15.67 20 BAYES_99 41931 25.18 40.02 15.36 21 MultiRelay 38341 14.60 15.44 14.04 22 ANY_BOUNCE_MESSAGE 37703 8.60 0.73 13.81 23 BOUNCE_MESSAGE 37702 8.60 0.73 13.81 24 BAYES_999 36927 21.06 32.46 13.52 25 T_KAM_HTML_FONT_INVALID 35177 14.36 16.59 12.88 26 XM_DKIMWhitelistDomains 34437 7.62 0.08 12.61 27 XM_Multi_Part_URI 32070 12.22 12.94 11.75 28 XM_Body_Dirty_Words 28465 12.59 15.86 10.43 29 LOTS_OF_MONEY 26759 8.92 7.59 9.80 30 RCVD_IN_RP_SAFE 26486 8.40 6.43 9.70 31 HTML_IMAGE_RATIO_02 24462 12.30 17.34 8.96 32 RCVD_IN_RP_CERTIFIED 24134 7.22 4.76 8.84 33 LotsOfNums_01 22793 7.64 6.57 8.35 34 TR_DCC_Bayes_99 19992 16.57 30.53 7.32 35 FSL_BULK_SIG 19666 8.58 10.67 7.20 36 XM_Evil_Numbers_Gen 19388 8.93 11.69 7.10 37 BAYES_60 18235 7.15 7.86 6.68 38 BOTNET_IPINHOSTNAME 18105 14.30 25.88 6.63 39 TooManyTo_001 17837 6.17 5.62 6.53 40 HTML_FONT_SIZE_LARGE 16678 10.78 17.85 6.11 41 T_XMDrugObfuBody_14 16508 6.62 7.48 6.05 42 HTML_SHORT_LINK_IMG_1 16297 10.78 18.06 5.97 43 BAYES_00 16284 4.11 1.31 5.96 44 UNPARSEABLE_RELAY 15474 3.92 1.28 5.67 45 TVD_RCVD_IP 14528 3.28 0.19 5.32 46 XMStrtUSub 13760 4.68 4.15 5.04 47 HTML_IMAGE_RATIO_04 13515 6.32 8.38 4.95 48 XM_B_Phish_Phrases 13120 5.88 7.51 4.81 49 XM_SendGrid 12598 4.04 3.18 4.61 50 URIBL_SBL_A 12438 2.89 0.38 4.56 51 RCVD_IN_IADB_LISTED 12354 3.28 1.39 4.52 52 MPART_ALT_DIFF 12235 5.69 7.51 4.48 53 XM_H_Long_From01 12068 5.20 6.38 4.42 54 MIME_QP_LONG_LINE 11983 3.68 2.61 4.39 55 XMSubMetaSx_00 11913 4.81 5.49 4.36 56 TR_XM_DK_Bayes 11692 2.99 1.04 4.28 57 SHORTENED_URL_SRC 11620 7.63 12.74 4.26 58 SHORTENER_SHORT_IMG 11613 7.64 12.75 4.25 59 TR_XM_DK_Bayes1 11122 2.84 0.99 4.07 60 DKIM_INVALID 10973 4.51 5.26 4.02 61 BAYES_80 10968 6.52 10.31 4.02 62 XMNumbers 10917 8.38 14.99 4.00 63 RCVD_IN_IADB_SPF 10666 2.84 1.22 3.91 64 FROM_EXCESS_BASE64 10589 11.70 23.53 3.88 65 RCVD_IN_MSPIKE_H2 10455 3.49 2.99 3.83 66 T_TooManySym_01 10454 3.66 3.40 3.83 67 T_REMOTE_IMAGE 10366 10.48 20.57 3.80 68 MIME_HTML_MOSTLY 10113 4.14 4.79 3.70 69 IN_ZIMBRA_NJ_WHITELIST 10016 2.21 0.02 3.67 70 RELAYCOUNTRY_META 9983 13.29 27.86 3.66 71 XM_UncommonTLD01 9751 10.87 21.89 3.57 72 HTML_IMAGE_ONLY_08 9668 6.49 10.95 3.54 73 RCVD_IN_IADB_SENDERID 9358 2.52 1.15 3.43 74 RCVD_IN_IADB_DK 9113 2.46 1.13 3.34 75 TR_XM_DK_Bayes2 9109 2.35 0.86 3.34 76 HTML_IMAGE_RATIO_06 8960 3.47 3.76 3.28 77 BAYES_40 8924 2.54 1.43 3.27 78 RCVD_IN_IADB_VOUCHED 8550 2.15 0.67 3.13 79 BAYES_95 8440 4.83 7.47 3.09 80 XMSexyCombo_05 8271 5.15 8.36 3.03 81 TooManyTo_002 7964 2.04 0.71 2.92 82 TR_XM_DocInvoice 7288 3.63 5.09 2.67 83 HTML_IMAGE_ONLY_04 6872 4.38 7.19 2.52 84 TooManyTo_003 6823 1.77 0.66 2.50 85 TO_MALFORMED 6787 1.50 0.02 2.49 86 INVALID_MSGID 6764 1.56 0.17 2.48 87 XMNoVowels 6657 3.84 5.96 2.44 88 RCVD_IN_MSPIKE_WL 6314 1.67 0.71 2.31 89 RCVD_IN_MSPIKE_H3 6301 1.66 0.68 2.31 90 TM2_M_URI_OPT_OUT 6155 2.39 2.60 2.25 91 BAYES_20 5813 1.97 1.74 2.13 92 USER_IN_DEF_DKIM_WL 5788 1.32 0.11 2.12 93 URI_HEX 5667 2.64 3.50 2.08 94 TR_Symld_Words 5603 2.07 2.09 2.05 95 RCVD_IN_IADB_OPTIN 5319 1.34 0.43 1.95 96 XM_DK_Undo_01 4971 1.51 1.03 1.82 97 IN_HORDE_ADDRESS_BOOK 4882 1.10 0.05 1.79 98 SUBJ_ALL_CAPS 4868 2.60 3.84 1.78 99 HTML_IMAGE_RATIO_08 4768 2.29 3.12 1.75 100 XM_DIRTYINTL 4710 2.24 3.02 1.73 101 XM_SPF_SoftFail 4225 3.56 6.60 1.55 102 XM_PDF 4215 1.05 0.31 1.54 103 XM_ProductURIs 4179 1.52 1.51 1.53 104 XMDiploma_00 4171 1.72 2.01 1.53 105 MAILING_LIST_MULTI 4158 1.41 1.25 1.52 106 T_TooManySym_02 4087 1.14 0.61 1.50 107 XM_CamelCaseFrm001 4038 2.27 3.46 1.48 108 URI_TRY_3LD 3818 1.27 1.07 1.40 109 BAYES_05 3757 1.18 0.88 1.38 110 MIME_HTML_ONLY_MULTI 3730 2.15 3.32 1.37 111 NO_DNS_FOR_FROM 3607 1.64 2.11 1.32 112 XMLngstWrd_00 3499 0.85 0.20 1.28 113 XM_OfRef6 3297 1.68 2.39 1.21 114 HTML_MIME_NO_HTML_TAG 3216 8.11 18.58 1.18 115 RELAYCOUNTRY_CA 3197 1.53 2.08 1.17 116 FILL_THIS_FORM 3147 1.06 0.91 1.15 117 DKIM_ADSP_CUSTOM_MED 3087 0.96 0.71 1.13 118 T_XMDrugObfuBody_08 3058 1.40 1.82 1.12 119 XMBdyGiftCard01 3048 1.58 2.29 1.12 120 XM_GoogleGroups 3007 0.79 0.32 1.10 121 USER_IN_WHITELIST 3000 0.66 0.00 1.10 122 XMSubMetaSxObfu_02 2970 0.76 0.25 1.09 123 XMLngstWrd_01 2958 0.72 0.18 1.08 124 MPART_ALT_DIFF_COUNT 2818 0.89 0.67 1.03 125 TM2_M_A_HREF_HREF 2665 0.85 0.66 0.98 126 UNTRUSTED_Relay 2663 10.10 23.89 0.98 127 XM_H_PHPOS 2627 0.95 0.92 0.96 128 URIBL_DBL_SPAM 2620 1.42 2.12 0.96 129 XMBody_95 2503 0.59 0.09 0.92 130 NML_ADSP_CUSTOM_MED 2501 0.80 0.62 0.92 131 XMPhish11 2467 1.04 1.25 0.90 132 DIET_1 2386 1.80 3.19 0.87 133 BOTNET 2338 11.45 27.46 0.86 134 TM2_M_VERY_LONG_WORD 2330 0.90 0.96 0.85 135 XMGenDplmaNmb 2242 0.88 0.97 0.82 136 HTML_SHORT_CENTER 2241 1.40 2.27 0.82 137 FORGED_GMAIL_RCVD 2193 0.71 0.58 0.80 138 T_TooManySym_03 2111 0.52 0.13 0.77 139 T_XMDrugObfuBody_00 2107 0.70 0.60 0.77 140 XMStockSpam_06 1952 0.84 1.03 0.71 141 XM_B_FormFill 1943 0.44 0.02 0.71 142 XM_H_Long_From02 1930 0.97 1.36 0.71 143 XMLngstWrd_02 1879 0.48 0.15 0.69 144 TooManyTo_004 1865 0.58 0.41 0.68 145 HELO_NODOT 1841 0.46 0.14 0.67 146 RDNS_DYNAMIC 1815 0.62 0.55 0.66 147 XM_B_COPY_HTML 1772 0.68 0.72 0.65 148 TR_MetaPhish_Combo_01 1724 0.52 0.34 0.63 149 XMBrknScrpt_02 1709 0.63 0.63 0.63 150 XM_UB50 1697 2.69 5.82 0.62 151 XM_B_REG_HTML 1686 0.81 1.11 0.62 152 T_MONEY_PERCENT 1677 0.64 0.69 0.61 153 TR_LOTS_OF_MONEY2 1677 0.64 0.69 0.61 154 XM_D_tchamptons_WL 1625 0.36 0.00 0.60 155 T_FILL_THIS_FORM_SHORT 1604 0.72 0.92 0.59 156 TooManyTo_005 1570 0.48 0.35 0.58 157 XM_H_PHPMailer 1560 0.60 0.65 0.57 158 XMClaimOffer 1523 0.66 0.82 0.56 159 XMSubMetaI_00 1467 0.96 1.59 0.54 160 XMBody_17 1422 1.32 2.54 0.52 161 HTML_TAG_BALANCE_BODY 1333 0.59 0.74 0.49 162 URI_NOVOWEL 1330 0.69 0.99 0.49 163 XMSexyCombo_01 1294 0.85 1.41 0.47 164 RELAYCOUNTRY_GB 1277 0.48 0.49 0.47 165 XMCapTrack 1255 0.35 0.19 0.46 166 XMLngstWrd_03 1249 0.32 0.12 0.46 167 TR_MetaPhish_Combo_01b 1230 0.31 0.10 0.45 168 T_FILL_THIS_FORM_LONG 1188 0.61 0.88 0.44 169 RELAYCOUNTRY_AU 1185 0.49 0.58 0.43 170 XMSlimDrugH 1180 0.58 0.79 0.43 171 REMOVE_BEFORE_LINK 1170 0.55 0.73 0.43 172 T_XMHurry_00 1162 0.84 1.47 0.43 173 MISSING_HEADERS 1157 7.23 17.51 0.42 174 DKIM_ADSP_NXDOMAIN 1152 0.49 0.60 0.42 175 XMSolicitRefs_0 1151 0.35 0.25 0.42 176 MALE_ENHANCE 1151 0.78 1.31 0.42 177 HTML_FONT_FACE_BAD 1076 0.60 0.92 0.39 178 XMHTMLBadTable_001 1074 0.67 1.09 0.39 179 XMBody_78 1035 0.65 1.07 0.38 180 XM_H_PHPOS_M 1018 0.43 0.52 0.37 181 T_TooManySym_04 1015 0.23 0.02 0.37 182 FILL_THIS_FORM_LOAN 1005 0.51 0.72 0.37 183 XMMoneyMeta_00 972 0.38 0.43 0.36 184 T_Symld_Words_02 949 0.51 0.75 0.35 185 RELAYCOUNTRY_DE 939 0.44 0.58 0.34 186 XMSubNoVowel 929 0.29 0.21 0.34 187 XM_ShortIntro_01 916 0.28 0.20 0.34 188 SpammyFromTLD_01 903 0.52 0.80 0.33 189 RELAYCOUNTRY_FR 893 0.70 1.25 0.33 190 XMPhish14 836 0.73 1.37 0.31 191 KHOP_DYNAMIC 828 0.30 0.30 0.30 192 UPPERCASE_50_75 817 0.25 0.19 0.30 193 XMSubMetaSSx_00 811 0.37 0.49 0.30 194 TM2_M_BODY_EMPTY 804 0.30 0.32 0.29 195 XMDateMe_00 791 0.32 0.37 0.29 196 TR_XM_RelayPhish 781 0.63 1.14 0.29 197 XMEqualsVooDoo_00 754 0.21 0.11 0.28 198 T_OBFU_PDF_ATTACH 743 0.20 0.08 0.27 199 XMSubMetaSx_01 732 0.31 0.38 0.27 200 XMPhish30 701 0.54 0.96 0.26 ----------------------------------------------------------------------