Email: 379365 Autolearn: 0 AvgScore: 4.21 AvgScanTime: 3.51 sec Spam: 135301 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 4.02 sec Ham: 244064 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 3.23 sec Time Spent Running SA: 369.91 hours Time Spent Processing Spam: 150.98 hours Time Spent Processing Ham: 218.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129950 90.12 96.05 86.83 2 DKIM_SIGNED 109370 77.90 80.83 76.28 3 XM_DK_Pass 107396 76.67 79.38 75.18 4 DKIM_VALID 104160 74.51 76.98 73.15 5 DCC_CHECK 99109 54.51 73.25 44.11 6 XMListUnsubscribeExists 93619 59.56 69.19 54.22 7 DKIM_VALID_AU 87536 61.08 64.70 59.07 8 XM_H_QuotedFrom 77844 45.40 57.53 38.67 9 XM_DK_Undo_02 65645 30.27 48.52 20.15 10 BAYES_99 58064 28.03 42.91 19.78 11 BAYES_999 50210 24.15 37.11 16.97 12 LOC_TINY_FONT_1 49353 32.79 36.48 30.75 13 BAYES_50 48635 45.98 35.95 51.55 14 HTML_FONT_LOW_CONTRAST 46559 34.86 34.41 35.11 15 TR_DCC_Bayes_99 45730 19.08 33.80 10.92 16 MIME_HTML_ONLY 41371 23.83 30.58 20.09 17 DCC_CHECK_NEGATIVE 35042 44.50 25.90 54.81 18 FVGT_m_MULTI_ODD 33940 23.20 25.08 22.15 19 XMSubLong 30668 21.55 22.67 20.93 20 XM_Body_Dirty_Words 26857 15.04 19.85 12.37 21 DKIM_VALID_EF 26665 26.83 19.71 30.78 22 HTML_IMAGE_RATIO_02 26386 14.04 19.50 11.02 23 T_KAM_HTML_FONT_INVALID 24299 14.69 17.96 12.88 24 RELAYCOUNTRY_META 23210 8.83 17.15 4.21 25 T_TM2_M_HEADER_IN_MSG 22523 19.26 16.65 20.71 26 XM_Multi_Part_URI 21321 14.12 15.76 13.21 27 LOTS_OF_MONEY 20110 11.32 14.86 9.35 28 BOTNET 19726 5.87 14.58 1.04 29 XM_Evil_Numbers_Gen 18706 10.04 13.83 7.95 30 MultiRelay 18411 13.41 13.61 13.30 31 BOTNET_IPINHOSTNAME 16308 9.74 12.05 8.46 32 FROM_EXCESS_BASE64 15927 7.72 11.77 5.48 33 UNTRUSTED_Relay 14614 4.61 10.80 1.17 34 XMSexyCombo_05 14489 6.17 10.71 3.65 35 FSL_BULK_SIG 13543 8.66 10.01 7.91 36 HTML_IMAGE_RATIO_04 12773 7.45 9.44 6.35 37 XM_B_Phish_Phrases 12700 7.33 9.39 6.19 38 T_XMDrugObfuBody_14 11616 7.19 8.59 6.42 39 XM_SPF_SoftFail 11296 4.49 8.35 2.35 40 XM_H_Long_From02 10855 4.27 8.02 2.19 41 TR_XM_DocInvoice 10466 5.22 7.74 3.83 42 RCVD_IN_RP_SAFE 10175 13.06 7.52 16.14 43 ALL_TRUSTED 10166 15.12 7.51 19.33 44 XM_H_Long_From01 9973 6.26 7.37 5.64 45 LotsOfNums_01 9883 7.73 7.30 7.96 46 XM_UncommonTLD01 9731 5.10 7.19 3.94 47 TooManyTo_001 9358 6.02 6.92 5.52 48 BAYES_80 9189 5.74 6.79 5.16 49 MPART_ALT_DIFF 8993 4.80 6.65 3.77 50 TR_Symld_Words 8802 3.39 6.51 1.67 51 XMSubMetaSx_00 8422 4.88 6.22 4.14 52 XM_UB50 8216 2.61 6.07 0.69 53 RCVD_IN_RP_CERTIFIED 8210 11.94 6.07 15.19 54 ADVANCE_FEE_2_NEW_MONEY 8017 3.07 5.93 1.49 55 MONEY_BARRISTER 7968 3.06 5.89 1.50 56 MONEY_FRAUD_3 7915 3.04 5.85 1.48 57 XMStrtUSub 7843 5.44 5.80 5.24 58 T_REMOTE_IMAGE 7247 4.02 5.36 3.29 59 BAYES_60 7035 6.48 5.20 7.18 60 MIME_HTML_MOSTLY 6988 4.47 5.16 4.09 61 HTML_MIME_NO_HTML_TAG 6851 2.72 5.06 1.41 62 BOTNET_NORDNS 6024 1.60 4.45 0.02 63 HTML_IMAGE_RATIO_06 5450 3.71 4.03 3.53 64 BAYES_95 5315 4.06 3.93 4.13 65 XM_SendGrid 5294 4.56 3.91 4.92 66 SpammyFromTLD_02 5274 1.48 3.90 0.14 67 XM_DIRTYINTL 5214 2.44 3.85 1.66 68 DKIM_INVALID 5210 3.39 3.85 3.13 69 TM2_M_URI_OPT_OUT 5093 2.61 3.76 1.98 70 XMNumbers 5070 3.85 3.75 3.91 71 HTML_SHORT_LINK_IMG_1 4832 1.67 3.57 0.61 72 XMBdyGiftCard01 4715 2.11 3.48 1.35 73 BODY_URI_ONLY 4606 1.25 3.40 0.05 74 HTML_IMAGE_ONLY_04 4528 1.59 3.35 0.62 75 RELAYCOUNTRY_CA 4475 2.18 3.31 1.56 76 HDRS_LCASE_IMGONLY 4316 1.16 3.19 0.03 77 RCVD_IN_MSPIKE_H2 4179 4.76 3.09 5.69 78 HTML_SHORT_CENTER 4118 1.46 3.04 0.59 79 MIME_QP_LONG_LINE 4088 3.49 3.02 3.76 80 XM_CamelCaseFrm001 4006 2.42 2.96 2.12 81 T_TooManySym_01 3989 4.19 2.95 4.88 82 MIME_HTML_ONLY_MULTI 3929 1.82 2.90 1.22 83 MIME_HEADER_CTYPE_ONLY 3887 1.12 2.87 0.14 84 URI_HEX 3771 2.08 2.79 1.68 85 RELAYCOUNTRY_RO 3755 0.99 2.78 0.01 86 T_XMDrugObfuBody_08 3617 1.71 2.67 1.18 87 HTML_IMAGE_RATIO_08 3554 2.31 2.63 2.14 88 RCVD_IN_RP_RNBL 3436 0.94 2.54 0.05 89 XM_OfRef6 3433 1.76 2.54 1.32 90 UNPARSEABLE_RELAY 3166 5.53 2.34 7.30 91 MultiRelay_CC 3134 0.93 2.32 0.16 92 MultiRelay_Combo 3134 0.93 2.32 0.16 93 T_XMHurry_00 3102 1.28 2.29 0.71 94 XMSubMetaI_00 3040 1.34 2.25 0.83 95 XMBody_17 2992 1.20 2.21 0.64 96 URIBL_DBL_SPAM 2948 0.81 2.18 0.05 97 XM_URI_RBL 2930 0.84 2.17 0.11 98 RCVD_IN_BL_SPAMCOP_NET 2755 0.84 2.04 0.18 99 URIBL_BLACK 2699 0.74 1.99 0.04 100 TVD_SPACE_RATIO_MINFP 2611 0.69 1.93 0.01 101 XMDiploma_00 2591 1.69 1.91 1.56 102 SUBJ_ALL_CAPS 2578 1.39 1.91 1.10 103 XM_DK_Undo_01 2495 1.77 1.84 1.73 104 RCVD_IN_IADB_LISTED 2382 3.05 1.76 3.77 105 XMSexyCombo_01 2376 0.85 1.76 0.34 106 RELAYCOUNTRY_CN 2286 0.64 1.69 0.05 107 SUBJ_DOLLARS 2228 0.76 1.65 0.27 108 BAYES_00 2095 4.64 1.55 6.36 109 XMGenDplmaNmb 2093 1.05 1.55 0.78 110 XMStockSpam_06 2085 1.07 1.54 0.81 111 BAYES_40 2067 2.33 1.53 2.77 112 XM_RXBody 2002 0.63 1.48 0.16 113 RCVD_IN_IADB_SPF 2000 2.67 1.48 3.34 114 URI_TRY_3LD 1964 1.46 1.45 1.47 115 XM_ProductURIs 1951 1.39 1.44 1.35 116 MPART_ALT_DIFF_COUNT 1925 0.81 1.42 0.47 117 DIET_1 1905 0.81 1.41 0.48 118 TM2_M_VERY_LONG_WORD 1865 1.01 1.38 0.80 119 RELAYCOUNTRY_AT 1842 0.57 1.36 0.13 120 RCVD_IN_IADB_SENDERID 1831 2.42 1.35 3.01 121 XM_UB99 1810 0.49 1.34 0.02 122 XMPhish30 1803 0.70 1.33 0.35 123 TR_XM_RelayPhish 1779 0.68 1.31 0.33 124 RCVD_IN_IADB_DK 1768 2.35 1.31 2.94 125 XM_Combo_Sbj 1762 0.53 1.30 0.11 126 BAYES_20 1736 1.65 1.28 1.85 127 XMHTML_After_End 1720 0.70 1.27 0.39 128 XM_UB60 1679 0.49 1.24 0.08 129 TR_XM_DK_Bayes 1669 3.25 1.23 4.36 130 XM_HighProb1 1665 0.45 1.23 0.02 131 TR_XM_DK_Bayes1 1616 3.15 1.19 4.23 132 XM_B_REG_HTML 1553 0.90 1.15 0.76 133 TR_XM_DK_Bayes2 1539 2.87 1.14 3.83 134 XMHTMLBadTable_001 1511 0.98 1.12 0.90 135 XMBody_78 1489 0.59 1.10 0.31 136 XMPhish14 1471 0.55 1.09 0.26 137 RELAYCOUNTRY_IE 1470 0.47 1.09 0.13 138 RELAYCOUNTRY_FR 1464 0.59 1.08 0.32 139 XMPhish11 1443 1.22 1.07 1.30 140 PLING_QUERY 1439 0.65 1.06 0.42 141 MAILING_LIST_MULTI 1436 1.56 1.06 1.83 142 T_XMDrugObfuBody_00 1408 0.82 1.04 0.70 143 XM_UB999 1407 0.38 1.04 0.01 144 SpammyFromTLD_01 1400 0.58 1.03 0.33 145 T_FILL_THIS_FORM_SHORT 1391 0.68 1.03 0.48 146 XM_H_PHPOS 1384 1.19 1.02 1.28 147 ANY_BOUNCE_MESSAGE 1378 5.22 1.02 7.56 148 BOUNCE_MESSAGE 1378 5.22 1.02 7.56 149 XMSexyCombo_04 1356 0.42 1.00 0.09 150 FILL_THIS_FORM 1356 0.77 1.00 0.64 151 RCVD_IN_IADB_VOUCHED 1326 1.85 0.98 2.34 152 DATE_IN_PAST_03_06 1303 0.39 0.96 0.07 153 T_TooManySym_02 1295 1.62 0.96 1.99 154 T_FILL_THIS_FORM_LONG 1286 0.70 0.95 0.56 155 RCVD_IN_MSPIKE_WL 1265 2.02 0.93 2.62 156 XM_BadFromFormat 1258 0.55 0.93 0.33 157 RCVD_IN_MSPIKE_H3 1254 2.02 0.93 2.62 158 FILL_THIS_FORM_LOAN 1216 0.67 0.90 0.54 159 RCVD_IN_PSBL 1214 0.32 0.90 0.00 160 RDNS_DYNAMIC 1213 0.68 0.90 0.55 161 NO_DNS_FOR_FROM 1196 0.77 0.88 0.70 162 XM_OverStock_LProb 1171 0.32 0.87 0.02 163 LongTLD 1170 0.39 0.86 0.13 164 TooManyTo_002 1161 1.24 0.86 1.45 165 BAYES_05 1158 1.09 0.86 1.21 166 XMClaimOffer 1097 0.41 0.81 0.18 167 TooManyTo_003 1089 0.99 0.80 1.09 168 T_HTML_TAG_BALANCE_CENTER 1081 0.44 0.80 0.25 169 DKIM_ADSP_CUSTOM_MED 1077 0.87 0.80 0.92 170 TR_LOTS_OF_MONEY2 1067 0.50 0.79 0.34 171 T_MONEY_PERCENT 1067 0.50 0.79 0.34 172 XM_UB80 1064 0.30 0.79 0.03 173 TR_LOTS_OF_MONEY3 1055 0.49 0.78 0.33 174 XMBrknScrpt_02 1027 0.66 0.76 0.61 175 HTML_TAG_BALANCE_BODY 990 0.54 0.73 0.43 176 TRACKER_ID 976 0.39 0.72 0.21 177 XM_Body_Obfu01 972 0.36 0.72 0.17 178 XM_H_PHPMailer 969 0.76 0.72 0.79 179 XM_B_COPY_HTML 965 0.66 0.71 0.63 180 TR_Caps_n_Bayes_99 943 0.27 0.70 0.03 181 TR_Mismatch_TLD_02 934 0.27 0.69 0.04 182 FORGED_GMAIL_RCVD 931 0.50 0.69 0.39 183 RELAYCOUNTRY_DE 921 0.46 0.68 0.33 184 XM_OfRef7 912 0.37 0.67 0.21 185 NML_ADSP_CUSTOM_MED 908 0.65 0.67 0.63 186 TooManyTo_004 905 0.82 0.67 0.90 187 INVALID_MSGID 892 2.09 0.66 2.89 188 HTML_FONT_SIZE_HUGE 884 0.40 0.65 0.25 189 XMGppyBdWords 868 0.33 0.64 0.15 190 HTML_SHORT_LINK_IMG_3 847 0.25 0.63 0.03 191 HTML_IMAGE_ONLY_20 843 0.34 0.62 0.18 192 XMSubMetaSSx_00 837 0.38 0.62 0.25 193 XMSlimDrugH 831 0.44 0.61 0.34 194 TooManyTo_005 819 0.73 0.61 0.79 195 XMMoneyMeta_00 814 0.38 0.60 0.25 196 T_Symld_Words_02 813 0.38 0.60 0.26 197 BODY_ENHANCEMENT 809 0.22 0.60 0.01 198 XM_S_JOY_D 807 0.36 0.60 0.23 199 RELAYCOUNTRY_GB 801 0.54 0.59 0.51 200 RCVD_IN_IADB_OPTIN 797 1.14 0.59 1.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 211915 90.12 96.05 86.83 2 DKIM_SIGNED 186160 77.90 80.83 76.28 3 XM_DK_Pass 183481 76.67 79.38 75.18 4 DKIM_VALID 178522 74.51 76.98 73.15 5 DKIM_VALID_AU 144170 61.08 64.70 59.07 6 DCC_CHECK_NEGATIVE 133762 44.50 25.90 54.81 7 XMListUnsubscribeExists 132335 59.56 69.19 54.22 8 BAYES_50 125812 45.98 35.95 51.55 9 DCC_CHECK 107668 54.51 73.25 44.11 10 XM_H_QuotedFrom 94378 45.40 57.53 38.67 11 HTML_FONT_LOW_CONTRAST 85679 34.86 34.41 35.11 12 DKIM_VALID_EF 75129 26.83 19.71 30.78 13 LOC_TINY_FONT_1 75057 32.79 36.48 30.75 14 FVGT_m_MULTI_ODD 54054 23.20 25.08 22.15 15 XMSubLong 51078 21.55 22.67 20.93 16 T_TM2_M_HEADER_IN_MSG 50552 19.26 16.65 20.71 17 XM_DK_Undo_02 49182 30.27 48.52 20.15 18 MIME_HTML_ONLY 49040 23.83 30.58 20.09 19 BAYES_99 48287 28.03 42.91 19.78 20 ALL_TRUSTED 47185 15.12 7.51 19.33 21 BAYES_999 41412 24.15 37.11 16.97 22 RCVD_IN_RP_SAFE 39384 13.06 7.52 16.14 23 XM_DKIMWhitelistDomains 38977 10.28 0.01 15.97 24 RCVD_IN_RP_CERTIFIED 37074 11.94 6.07 15.19 25 MultiRelay 32472 13.41 13.61 13.30 26 XM_Multi_Part_URI 32251 14.12 15.76 13.21 27 T_KAM_HTML_FONT_INVALID 31439 14.69 17.96 12.88 28 XM_Body_Dirty_Words 30188 15.04 19.85 12.37 29 HTML_IMAGE_RATIO_02 26888 14.04 19.50 11.02 30 TR_DCC_Bayes_99 26640 19.08 33.80 10.92 31 LOTS_OF_MONEY 22826 11.32 14.86 9.35 32 BOTNET_IPINHOSTNAME 20638 9.74 12.05 8.46 33 LotsOfNums_01 19434 7.73 7.30 7.96 34 XM_Evil_Numbers_Gen 19401 10.04 13.83 7.95 35 FSL_BULK_SIG 19298 8.66 10.01 7.91 36 ANY_BOUNCE_MESSAGE 18443 5.22 1.02 7.56 37 BOUNCE_MESSAGE 18443 5.22 1.02 7.56 38 UNPARSEABLE_RELAY 17818 5.53 2.34 7.30 39 BAYES_60 17531 6.48 5.20 7.18 40 TVD_RCVD_IP 16308 4.43 0.38 6.68 41 T_XMDrugObfuBody_14 15662 7.19 8.59 6.42 42 BAYES_00 15511 4.64 1.55 6.36 43 HTML_IMAGE_RATIO_04 15489 7.45 9.44 6.35 44 XM_B_Phish_Phrases 15105 7.33 9.39 6.19 45 RCVD_IN_MSPIKE_H2 13896 4.76 3.09 5.69 46 XM_H_Long_From01 13763 6.26 7.37 5.64 47 TooManyTo_001 13465 6.02 6.92 5.52 48 FROM_EXCESS_BASE64 13367 7.72 11.77 5.48 49 XMStrtUSub 12797 5.44 5.80 5.24 50 BAYES_80 12592 5.74 6.79 5.16 51 XM_SendGrid 12016 4.56 3.91 4.92 52 T_TooManySym_01 11910 4.19 2.95 4.88 53 TR_XM_DK_Bayes 10653 3.25 1.23 4.36 54 TR_XM_DK_Bayes1 10328 3.15 1.19 4.23 55 IN_ZIMBRA_NJ_WHITELIST 10297 2.72 0.02 4.22 56 RELAYCOUNTRY_META 10273 8.83 17.15 4.21 57 XMSubMetaSx_00 10097 4.88 6.22 4.14 58 BAYES_95 10090 4.06 3.93 4.13 59 MIME_HTML_MOSTLY 9975 4.47 5.16 4.09 60 XM_UncommonTLD01 9616 5.10 7.19 3.94 61 XMNumbers 9553 3.85 3.75 3.91 62 TR_XM_DocInvoice 9350 5.22 7.74 3.83 63 TR_XM_DK_Bayes2 9348 2.87 1.14 3.83 64 MPART_ALT_DIFF 9211 4.80 6.65 3.77 65 RCVD_IN_IADB_LISTED 9206 3.05 1.76 3.77 66 MIME_QP_LONG_LINE 9166 3.49 3.02 3.76 67 XMSexyCombo_05 8903 6.17 10.71 3.65 68 HTML_IMAGE_RATIO_06 8614 3.71 4.03 3.53 69 RCVD_IN_IADB_SPF 8145 2.67 1.48 3.34 70 T_REMOTE_IMAGE 8022 4.02 5.36 3.29 71 DKIM_INVALID 7638 3.39 3.85 3.13 72 RCVD_IN_IADB_SENDERID 7341 2.42 1.35 3.01 73 RCVD_IN_IADB_DK 7164 2.35 1.31 2.94 74 INVALID_MSGID 7045 2.09 0.66 2.89 75 USER_IN_DEF_DKIM_WL 6796 1.80 0.01 2.78 76 BAYES_40 6755 2.33 1.53 2.77 77 TO_MALFORMED 6407 1.69 0.01 2.63 78 RCVD_IN_MSPIKE_WL 6401 2.02 0.93 2.62 79 RCVD_IN_MSPIKE_H3 6395 2.02 0.93 2.62 80 XM_SPF_SoftFail 5731 4.49 8.35 2.35 81 RCVD_IN_IADB_VOUCHED 5701 1.85 0.98 2.34 82 XM_H_Long_From02 5339 4.27 8.02 2.19 83 HTML_IMAGE_RATIO_08 5219 2.31 2.63 2.14 84 XM_CamelCaseFrm001 5173 2.42 2.96 2.12 85 T_TooManySym_02 4866 1.62 0.96 1.99 86 TM2_M_URI_OPT_OUT 4823 2.61 3.76 1.98 87 IN_HORDE_ADDRESS_BOOK 4772 1.28 0.06 1.96 88 BAYES_20 4507 1.65 1.28 1.85 89 MAILING_LIST_MULTI 4471 1.56 1.06 1.83 90 XM_PDF 4302 1.24 0.30 1.76 91 XM_DK_Undo_01 4230 1.77 1.84 1.73 92 URI_HEX 4107 2.08 2.79 1.68 93 TR_Symld_Words 4066 3.39 6.51 1.67 94 XM_DIRTYINTL 4042 2.44 3.85 1.66 95 RELAYCOUNTRY_CA 3812 2.18 3.31 1.56 96 XMDiploma_00 3808 1.69 1.91 1.56 97 MONEY_BARRISTER 3649 3.06 5.89 1.50 98 ADVANCE_FEE_2_NEW_MONEY 3641 3.07 5.93 1.49 99 MONEY_FRAUD_3 3615 3.04 5.85 1.48 100 URI_TRY_3LD 3587 1.46 1.45 1.47 101 TooManyTo_002 3532 1.24 0.86 1.45 102 RCVD_IN_IADB_OPTIN 3509 1.14 0.59 1.44 103 HTML_MIME_NO_HTML_TAG 3453 2.72 5.06 1.41 104 XM_GoogleGroups 3431 1.05 0.40 1.41 105 XM_ProductURIs 3304 1.39 1.44 1.35 106 XMBdyGiftCard01 3297 2.11 3.48 1.35 107 XM_OfRef6 3231 1.76 2.54 1.32 108 XMPhish11 3169 1.22 1.07 1.30 109 XM_H_PHPOS 3115 1.19 1.02 1.28 110 MIME_HTML_ONLY_MULTI 2989 1.82 2.90 1.22 111 BAYES_05 2961 1.09 0.86 1.21 112 T_XMDrugObfuBody_08 2885 1.71 2.67 1.18 113 UNTRUSTED_Relay 2867 4.61 10.80 1.17 114 XMSubMetaSxObfu_02 2864 0.83 0.21 1.17 115 SUBJ_ALL_CAPS 2683 1.39 1.91 1.10 116 TooManyTo_003 2664 0.99 0.80 1.09 117 BOTNET 2544 5.87 14.58 1.04 118 XMBody_95 2495 0.69 0.10 1.02 119 XMLngstWrd_00 2419 0.74 0.29 0.99 120 USER_IN_WHITELIST 2284 0.60 0.00 0.94 121 DKIM_ADSP_CUSTOM_MED 2238 0.87 0.80 0.92 122 TooManyTo_004 2199 0.82 0.67 0.90 123 XMHTMLBadTable_001 2198 0.98 1.12 0.90 124 XMLngstWrd_01 2181 0.67 0.27 0.89 125 T_TooManySym_03 2063 0.58 0.10 0.85 126 XMSubMetaI_00 2037 1.34 2.25 0.83 127 XMStockSpam_06 1970 1.07 1.54 0.81 128 TM2_M_VERY_LONG_WORD 1959 1.01 1.38 0.80 129 TooManyTo_005 1935 0.73 0.61 0.79 130 XM_H_PHPMailer 1922 0.76 0.72 0.79 131 MISSING_HEADERS 1913 0.63 0.37 0.78 132 XMGenDplmaNmb 1901 1.05 1.55 0.78 133 XM_B_REG_HTML 1852 0.90 1.15 0.76 134 T_XMHurry_00 1738 1.28 2.29 0.71 135 NO_DNS_FOR_FROM 1714 0.77 0.88 0.70 136 T_XMDrugObfuBody_00 1703 0.82 1.04 0.70 137 XM_UB50 1678 2.61 6.07 0.69 138 XMBody_17 1556 1.20 2.21 0.64 139 XMSubNoVowel 1554 0.58 0.47 0.64 140 FILL_THIS_FORM 1554 0.77 1.00 0.64 141 NML_ADSP_CUSTOM_MED 1543 0.65 0.67 0.63 142 XM_B_COPY_HTML 1542 0.66 0.71 0.63 143 HTML_IMAGE_ONLY_04 1521 1.59 3.35 0.62 144 HTML_FONT_FACE_BAD 1516 0.61 0.58 0.62 145 HTML_SHORT_LINK_IMG_1 1495 1.67 3.57 0.61 146 XMBrknScrpt_02 1493 0.66 0.76 0.61 147 TM2_M_A_HREF_HREF 1455 0.52 0.38 0.60 148 TR_MetaPhish_Combo_01 1436 0.57 0.54 0.59 149 HTML_SHORT_CENTER 1436 1.46 3.04 0.59 150 HELO_NODOT 1395 0.43 0.19 0.57 151 XMLngstWrd_02 1390 0.45 0.22 0.57 152 XM_H_PHPOS_M 1387 0.56 0.55 0.57 153 T_FILL_THIS_FORM_LONG 1367 0.70 0.95 0.56 154 XMSubject_48 1359 0.48 0.33 0.56 155 RDNS_DYNAMIC 1349 0.68 0.90 0.55 156 FILL_THIS_FORM_LOAN 1324 0.67 0.90 0.54 157 RELAYCOUNTRY_GB 1238 0.54 0.59 0.51 158 DKIM_ADSP_NXDOMAIN 1209 0.49 0.47 0.50 159 T_FILL_THIS_FORM_SHORT 1183 0.68 1.03 0.48 160 DIET_1 1165 0.81 1.41 0.48 161 MPART_ALT_DIFF_COUNT 1149 0.81 1.42 0.47 162 T_TooManySym_04 1148 0.31 0.02 0.47 163 XMCapTrack 1062 0.37 0.26 0.44 164 HTML_TAG_BALANCE_BODY 1052 0.54 0.73 0.43 165 REPLYTO_WITHOUT_TO_CC 1045 0.39 0.31 0.43 166 XMNoVowels 1042 0.42 0.41 0.43 167 XMLngstWrd_03 1031 0.33 0.17 0.42 168 PLING_QUERY 1015 0.65 1.06 0.42 169 XMRcvdHeader_15 1012 0.27 0.00 0.41 170 XM_H_SpoofStaff4 1005 0.27 0.02 0.41 171 URI_NOVOWEL 968 0.43 0.50 0.40 172 FORGED_GMAIL_RCVD 961 0.50 0.69 0.39 173 HTML_IMAGE_ONLY_32 956 0.36 0.30 0.39 174 XMSubLongNoVowel 951 0.32 0.18 0.39 175 XMHTML_After_End 948 0.70 1.27 0.39 176 XMSubGarbage 948 0.26 0.03 0.39 177 XM_D_tchamptons_WL 926 0.24 0.00 0.38 178 XMSUPPORT 914 0.24 0.00 0.37 179 KHOP_DYNAMIC 902 0.42 0.52 0.37 180 XM_ShortIntro_01 890 0.31 0.22 0.36 181 HTML_IMAGE_ONLY_28 878 0.35 0.35 0.36 182 XMPhish30 854 0.70 1.33 0.35 183 BASE64_LENGTH_79_INF 851 0.35 0.35 0.35 184 XMSlimDrugH 842 0.44 0.61 0.34 185 T_MONEY_PERCENT 842 0.50 0.79 0.34 186 TR_LOTS_OF_MONEY2 842 0.50 0.79 0.34 187 XMSexyCombo_01 842 0.85 1.76 0.34 188 XM_Walgreens_Forge 832 0.30 0.23 0.34 189 XM_BadFromFormat 816 0.55 0.93 0.33 190 RELAYCOUNTRY_AU 813 0.42 0.58 0.33 191 SpammyFromTLD_01 811 0.58 1.03 0.33 192 RELAYCOUNTRY_DE 810 0.46 0.68 0.33 193 TR_XM_RelayPhish 804 0.68 1.31 0.33 194 TR_LOTS_OF_MONEY3 798 0.49 0.78 0.33 195 RELAYCOUNTRY_FR 783 0.59 1.08 0.32 196 TVD_SPACE_RATIO 753 0.34 0.41 0.31 197 XMBody_78 752 0.59 1.10 0.31 198 XMLngstWrd_04 739 0.24 0.12 0.30 199 XMSolicitRefs_0 727 0.29 0.27 0.30 200 HTTPS_HTTP_MISMATCH 685 0.38 0.55 0.28 ----------------------------------------------------------------------