Email: 757550 Autolearn: 0 AvgScore: 4.10 AvgScanTime: 4.32 sec Spam: 232954 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 5.04 sec Ham: 524596 Autolearn: 0 AvgScore: 0.37 AvgScanTime: 4.01 sec Time Spent Running SA: 909.92 hours Time Spent Processing Spam: 325.83 hours Time Spent Processing Ham: 584.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 214726 83.33 92.18 79.40 2 DKIM_SIGNED 172274 65.21 73.95 61.33 3 XM_DK_Pass 167859 63.87 72.06 60.23 4 DKIM_VALID 162190 61.22 69.62 57.49 5 DCC_CHECK 157303 41.38 67.53 29.77 6 XMListUnsubscribeExists 145824 46.55 62.60 39.43 7 DKIM_VALID_AU 128877 45.32 55.32 40.87 8 XM_H_QuotedFrom 125810 40.00 54.01 33.79 9 XM_DK_Undo_02 98387 20.81 42.23 11.30 10 BAYES_99 91188 19.58 39.14 10.89 11 BAYES_50 87754 54.60 37.67 62.12 12 BAYES_999 76508 16.61 32.84 9.41 13 MIME_HTML_ONLY 74355 22.16 31.92 17.83 14 DCC_CHECK_NEGATIVE 72284 57.02 31.03 68.56 15 HTML_FONT_LOW_CONTRAST 71869 24.92 30.85 22.28 16 LOC_TINY_FONT_1 70447 22.04 30.24 18.39 17 TR_DCC_Bayes_99 68707 12.60 29.49 5.09 18 XMSubLong 54225 19.16 23.28 17.33 19 FVGT_m_MULTI_ODD 52288 20.04 22.45 18.97 20 DKIM_VALID_EF 49439 23.84 21.22 25.01 21 T_TM2_M_HEADER_IN_MSG 46262 25.10 19.86 27.42 22 RELAYCOUNTRY_META 44231 8.78 18.99 4.25 23 T_KAM_HTML_FONT_INVALID 43263 15.13 18.57 13.60 24 XM_Body_Dirty_Words 38941 12.48 16.72 10.60 25 BOTNET 36465 5.45 15.65 0.92 26 LOTS_OF_MONEY 35620 10.66 15.29 8.60 27 MultiRelay 35182 15.75 15.10 16.04 28 XM_Multi_Part_URI 33004 10.56 14.17 8.96 29 HTML_IMAGE_RATIO_02 32314 8.44 13.87 6.03 30 XM_Evil_Numbers_Gen 30505 8.76 13.09 6.84 31 BOTNET_IPINHOSTNAME 30414 7.71 13.06 5.34 32 UNTRUSTED_Relay 29573 4.55 12.69 0.93 33 FROM_EXCESS_BASE64 25932 5.48 11.13 2.97 34 FSL_BULK_SIG 24428 7.51 10.49 6.19 35 ALL_TRUSTED 24219 23.38 10.40 29.14 36 XMSexyCombo_05 21798 4.90 9.36 2.92 37 TooManyTo_001 21498 14.17 9.23 16.36 38 XM_SPF_SoftFail 19659 5.26 8.44 3.85 39 T_XMDrugObfuBody_14 19414 7.02 8.33 6.44 40 XM_B_Phish_Phrases 18660 6.42 8.01 5.71 41 BAYES_80 18292 5.10 7.85 3.88 42 T_REMOTE_IMAGE 18010 5.05 7.73 3.85 43 HTML_IMAGE_RATIO_04 17540 5.51 7.53 4.62 44 XM_H_Long_From01 16716 5.39 7.18 4.59 45 HTML_MIME_NO_HTML_TAG 16707 4.35 7.17 3.09 46 MIME_QP_LONG_LINE 15841 11.85 6.80 14.10 47 BAYES_60 15787 6.30 6.78 6.08 48 TM2_M_URI_OPT_OUT 15676 11.06 6.73 12.98 49 XM_UncommonTLD01 15633 3.92 6.71 2.69 50 TR_XM_DocInvoice 15628 4.52 6.71 3.54 51 XM_H_Long_From02 15569 4.06 6.68 2.89 52 LotsOfNums_01 15205 6.97 6.53 7.17 53 XMSubMetaSx_00 15021 4.69 6.45 3.91 54 XMNumbers 14538 3.81 6.24 2.73 55 HTML_SHORT_LINK_IMG_1 14497 2.38 6.22 0.67 56 MPART_ALT_DIFF 13435 4.43 5.77 3.83 57 HTML_IMAGE_ONLY_04 12923 2.13 5.55 0.62 58 RCVD_IN_RP_SAFE 12847 7.28 5.51 8.07 59 HTML_SHORT_CENTER 12323 2.03 5.29 0.58 60 XM_UB50 12076 2.03 5.18 0.63 61 HTML_IMAGE_RATIO_06 11982 4.65 5.14 4.42 62 BODY_URI_ONLY 11746 1.61 5.04 0.08 63 DATE_IN_FUTURE_06_12 11420 1.52 4.90 0.01 64 MONEY_FRAUD_3 11270 2.91 4.84 2.06 65 ADVANCE_FEE_2_NEW_MONEY 11264 2.92 4.84 2.07 66 MONEY_BARRISTER 11199 2.90 4.81 2.06 67 RCVD_IN_RP_CERTIFIED 10846 6.74 4.66 7.67 68 BAYES_95 10619 3.52 4.56 3.06 69 MIME_HEADER_CTYPE_ONLY 10399 1.49 4.46 0.17 70 MIME_HTML_MOSTLY 10386 3.23 4.46 2.68 71 DKIM_INVALID 10084 3.99 4.33 3.84 72 SHORTENED_URL_SRC 9632 1.52 4.13 0.36 73 SHORTENER_SHORT_IMG 9594 1.52 4.12 0.36 74 XMStrtUSub 9377 4.05 4.03 4.06 75 URI_BUFFLY 9220 1.47 3.96 0.36 76 MISSING_HEADERS 9100 1.82 3.91 0.89 77 XM_SendGrid 8929 4.11 3.83 4.23 78 TooManyTo_002 8886 9.28 3.81 11.71 79 TooManyTo_003 8660 8.76 3.72 11.00 80 SpammyFromTLD_02 8035 1.17 3.45 0.16 81 HTML_IMAGE_RATIO_08 7890 2.23 3.39 1.72 82 RCVD_IN_MSPIKE_H2 7662 4.09 3.29 4.44 83 RELAYCOUNTRY_UA 7578 1.00 3.25 0.01 84 XM_DIRTYINTL 7400 1.98 3.18 1.45 85 URI_HEX 6927 1.82 2.97 1.30 86 RELAYCOUNTRY_CA 6845 1.68 2.94 1.13 87 BOTNET_NORDNS 6782 0.91 2.91 0.02 88 XM_OfRef6 6426 1.72 2.76 1.26 89 MIME_HTML_ONLY_MULTI 6343 2.42 2.72 2.28 90 XM_CamelCaseFrm001 6218 1.89 2.67 1.54 91 MultiRelay_CC 6135 0.92 2.63 0.16 92 MultiRelay_Combo 6135 0.92 2.63 0.16 93 RCVD_IN_RP_RNBL 6134 0.84 2.63 0.05 94 XM_salutation 5988 0.79 2.57 0.00 95 SHORT_URI 5969 0.81 2.56 0.02 96 XMBody_17 5965 1.12 2.56 0.49 97 DIET_1 5622 1.25 2.41 0.74 98 XM_UB60 5615 0.79 2.41 0.07 99 RCVD_IN_BL_SPAMCOP_NET 5428 0.89 2.33 0.25 100 T_XMDrugObfuBody_08 5421 1.55 2.33 1.20 101 T_TooManySym_01 5392 2.99 2.31 3.28 102 XM_URI_RBL 5082 0.74 2.18 0.10 103 XMDiploma_00 5030 1.70 2.16 1.50 104 XM_DK_Undo_01 4920 1.90 2.11 1.81 105 RCVD_IN_IADB_LISTED 4709 3.87 2.02 4.69 106 XM_UB80 4635 0.63 1.99 0.02 107 SUBJ_ALL_CAPS 4343 1.43 1.86 1.24 108 ANY_BOUNCE_MESSAGE 4323 4.68 1.86 5.93 109 BOUNCE_MESSAGE 4322 4.68 1.86 5.93 110 RCVD_IN_IADB_SPF 4162 3.39 1.79 4.10 111 URIBL_DBL_SPAM 4086 0.55 1.75 0.02 112 UNPARSEABLE_RELAY 4013 2.95 1.72 3.49 113 XMSubMetaI_00 3971 0.99 1.70 0.67 114 T_XMHurry_00 3893 0.88 1.67 0.52 115 RCVD_IN_IADB_SENDERID 3883 3.01 1.67 3.61 116 RCVD_IN_IADB_DK 3814 2.96 1.64 3.55 117 XMPhish11 3793 1.22 1.63 1.04 118 XMGenDplmaNmb 3773 1.18 1.62 0.98 119 TR_LOTS_OF_MONEY3 3365 0.61 1.44 0.24 120 T_FILL_THIS_FORM_SHORT 3355 1.06 1.44 0.89 121 DKIM_ADSP_CUSTOM_MED 3309 1.07 1.42 0.92 122 URI_TRY_3LD 3208 1.11 1.38 0.99 123 XMBdyGiftCard01 3152 0.92 1.35 0.72 124 XMHTML_After_End 3075 0.64 1.32 0.34 125 RDNS_DYNAMIC 3039 0.65 1.30 0.36 126 SpammyFromTLD_01 3011 0.83 1.29 0.63 127 MAILING_LIST_MULTI 2994 1.91 1.29 2.19 128 FORGED_GMAIL_RCVD 2960 0.72 1.27 0.48 129 HDRS_LCASE_IMGONLY 2952 0.43 1.27 0.06 130 XMStockSpam_06 2928 1.26 1.26 1.26 131 XM_UB99 2914 0.40 1.25 0.02 132 RELAYCOUNTRY_RO 2913 0.39 1.25 0.01 133 XMSexyCombo_01 2883 0.64 1.24 0.37 134 NML_ADSP_CUSTOM_MED 2879 0.84 1.24 0.66 135 BAYES_00 2830 5.39 1.21 7.25 136 TR_XM_RelayPhish 2829 0.68 1.21 0.44 137 TM2_M_VERY_LONG_WORD 2761 0.90 1.19 0.78 138 BAYES_40 2760 2.52 1.18 3.12 139 XM_ProductURIs 2732 1.14 1.17 1.13 140 MPART_ALT_DIFF_COUNT 2722 0.57 1.17 0.30 141 URI_NOVOWEL 2679 0.70 1.15 0.50 142 HTML_FONT_FACE_BAD 2670 0.59 1.15 0.35 143 XM_RXBody 2660 0.42 1.14 0.09 144 RELAYCOUNTRY_CN 2650 0.39 1.14 0.06 145 URIBL_BLACK 2633 0.37 1.13 0.04 146 HTML_IMAGE_ONLY_12 2547 0.57 1.09 0.34 147 XM_UB95 2530 0.34 1.09 0.01 148 XMPhish30 2519 0.52 1.08 0.27 149 RCVD_IN_IADB_VOUCHED 2505 2.49 1.08 3.12 150 RELAYCOUNTRY_FR 2501 0.46 1.07 0.18 151 HTML_TAG_BALANCE_BODY 2496 0.64 1.07 0.45 152 T_HTML_TAG_BALANCE_CENTER 2494 0.51 1.07 0.26 153 TR_Mismatch_TLD_02 2440 0.35 1.05 0.04 154 RELAYCOUNTRY_IN 2416 0.39 1.04 0.11 155 RELAYCOUNTRY_AT 2413 0.38 1.04 0.08 156 BAYES_20 2379 1.87 1.02 2.25 157 TR_XM_DK_Bayes 2312 2.77 0.99 3.57 158 XMMoneyMeta_00 2299 0.62 0.99 0.45 159 T_XMDrugObfuBody_00 2298 0.89 0.99 0.84 160 XMSlimDrugH 2250 0.49 0.97 0.27 161 XM_HighProb1 2241 0.30 0.96 0.01 162 TR_XM_DK_Bayes1 2235 2.61 0.96 3.35 163 TR_LOTS_OF_MONEY2 2199 0.46 0.94 0.24 164 T_MONEY_PERCENT 2199 0.46 0.94 0.24 165 XM_UB999 2169 0.29 0.93 0.01 166 TR_XM_DK_Bayes2 2158 2.19 0.93 2.75 167 XMPhish14 2115 0.50 0.91 0.31 168 TR_Symld_Words 2108 1.19 0.90 1.32 169 XMSubMetaSxObfu_03 2094 1.08 0.90 1.16 170 DATE_IN_PAST_03_06 2074 0.34 0.89 0.09 171 RELAYCOUNTRY_GB 2008 0.91 0.86 0.93 172 HTTPS_HTTP_MISMATCH 1980 0.57 0.85 0.44 173 XM_Body_Obfu01 1934 0.42 0.83 0.24 174 XM_PDF 1918 3.26 0.82 4.34 175 PLING_QUERY 1892 0.47 0.81 0.32 176 REMOVE_BEFORE_LINK 1871 0.43 0.80 0.26 177 XM_H_PHPOS 1861 1.08 0.80 1.20 178 HTML_FONT_SIZE_HUGE 1837 0.33 0.79 0.13 179 XM_H_PHPMailer 1812 0.74 0.78 0.73 180 T_Symld_Words_02 1804 0.58 0.77 0.50 181 FILL_THIS_FORM_LOAN 1771 0.44 0.76 0.29 182 RCVD_IN_PSBL 1705 0.24 0.73 0.02 183 KHOP_DYNAMIC 1693 0.62 0.73 0.58 184 TooManyTo_004 1691 1.06 0.73 1.21 185 XM_B_REG_HTML 1690 0.50 0.73 0.40 186 XM_ShortIntro_01 1674 1.27 0.72 1.51 187 DKIM_ADSP_NXDOMAIN 1651 0.43 0.71 0.30 188 LongTLD 1644 0.29 0.71 0.11 189 RCVD_IN_MSPIKE_WL 1627 1.48 0.70 1.83 190 RCVD_IN_MSPIKE_H3 1615 1.48 0.69 1.83 191 XMBody_78 1568 0.41 0.67 0.29 192 TVD_RCVD_IP 1558 2.47 0.67 3.26 193 XMBrknScrpt_02 1543 0.48 0.66 0.39 194 FILL_THIS_FORM 1534 0.47 0.66 0.39 195 RCVD_IN_IADB_OPTIN 1527 1.51 0.66 1.90 196 TooManyTo_005 1516 0.91 0.65 1.02 197 PP_MIME_FAKE_ASCII_TEXT 1514 0.31 0.65 0.15 198 FORM_FRAUD_5 1513 0.20 0.65 0.00 199 TR_Sbj_FN_Bdy 1508 0.33 0.65 0.19 200 XMClaimOffer 1469 0.27 0.63 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 416528 83.33 92.18 79.40 2 DCC_CHECK_NEGATIVE 359644 57.02 31.03 68.56 3 BAYES_50 325866 54.60 37.67 62.12 4 DKIM_SIGNED 321719 65.21 73.95 61.33 5 XM_DK_Pass 315975 63.87 72.06 60.23 6 DKIM_VALID 301567 61.22 69.62 57.49 7 DKIM_VALID_AU 214418 45.32 55.32 40.87 8 XMListUnsubscribeExists 206827 46.55 62.60 39.43 9 XM_H_QuotedFrom 177240 40.00 54.01 33.79 10 DCC_CHECK 156146 41.38 67.53 29.77 11 ALL_TRUSTED 152880 23.38 10.40 29.14 12 T_TM2_M_HEADER_IN_MSG 143851 25.10 19.86 27.42 13 DKIM_VALID_EF 131197 23.84 21.22 25.01 14 HTML_FONT_LOW_CONTRAST 116881 24.92 30.85 22.28 15 FVGT_m_MULTI_ODD 99502 20.04 22.45 18.97 16 LOC_TINY_FONT_1 96488 22.04 30.24 18.39 17 MIME_HTML_ONLY 93527 22.16 31.92 17.83 18 XMSubLong 90887 19.16 23.28 17.33 19 TooManyTo_001 85838 14.17 9.23 16.36 20 MultiRelay 84124 15.75 15.10 16.04 21 MIME_QP_LONG_LINE 73965 11.85 6.80 14.10 22 T_KAM_HTML_FONT_INVALID 71325 15.13 18.57 13.60 23 TM2_M_URI_OPT_OUT 68111 11.06 6.73 12.98 24 TooManyTo_002 61446 9.28 3.81 11.71 25 XM_DK_Undo_02 59267 20.81 42.23 11.30 26 TooManyTo_003 57703 8.76 3.72 11.00 27 BAYES_99 57120 19.58 39.14 10.89 28 XM_Body_Dirty_Words 55595 12.48 16.72 10.60 29 BAYES_999 49342 16.61 32.84 9.41 30 XM_Multi_Part_URI 46988 10.56 14.17 8.96 31 XM_DKIMWhitelistDomains 46058 6.09 0.02 8.78 32 LOTS_OF_MONEY 45116 10.66 15.29 8.60 33 RCVD_IN_RP_SAFE 42314 7.28 5.51 8.07 34 RCVD_IN_RP_CERTIFIED 40241 6.74 4.66 7.67 35 BAYES_00 38020 5.39 1.21 7.25 36 LotsOfNums_01 37624 6.97 6.53 7.17 37 XM_Evil_Numbers_Gen 35878 8.76 13.09 6.84 38 T_XMDrugObfuBody_14 33780 7.02 8.33 6.44 39 FSL_BULK_SIG 32470 7.51 10.49 6.19 40 BAYES_60 31916 6.30 6.78 6.08 41 HTML_IMAGE_RATIO_02 31636 8.44 13.87 6.03 42 BOUNCE_MESSAGE 31099 4.68 1.86 5.93 43 ANY_BOUNCE_MESSAGE 31099 4.68 1.86 5.93 44 XM_B_Phish_Phrases 29948 6.42 8.01 5.71 45 IN_ZIMBRA_NJ_WHITELIST 28879 3.82 0.03 5.50 46 BOTNET_IPINHOSTNAME 27990 7.71 13.06 5.34 47 TR_DCC_Bayes_99 26719 12.60 29.49 5.09 48 RCVD_IN_IADB_LISTED 24604 3.87 2.02 4.69 49 HTML_IMAGE_RATIO_04 24215 5.51 7.53 4.62 50 XM_H_Long_From01 24079 5.39 7.18 4.59 51 RCVD_IN_MSPIKE_H2 23285 4.09 3.29 4.44 52 HTML_IMAGE_RATIO_06 23211 4.65 5.14 4.42 53 XM_PDF 22793 3.26 0.82 4.34 54 RELAYCOUNTRY_META 22281 8.78 18.99 4.25 55 XM_SendGrid 22212 4.11 3.83 4.23 56 RCVD_IN_IADB_SPF 21501 3.39 1.79 4.10 57 XMStrtUSub 21304 4.05 4.03 4.06 58 XMSubMetaSx_00 20486 4.69 6.45 3.91 59 BAYES_80 20348 5.10 7.85 3.88 60 T_REMOTE_IMAGE 20212 5.05 7.73 3.85 61 XM_SPF_SoftFail 20176 5.26 8.44 3.85 62 DKIM_INVALID 20152 3.99 4.33 3.84 63 MPART_ALT_DIFF 20117 4.43 5.77 3.83 64 RCVD_IN_IADB_SENDERID 18929 3.01 1.67 3.61 65 TR_XM_DK_Bayes 18707 2.77 0.99 3.57 66 RCVD_IN_IADB_DK 18602 2.96 1.64 3.55 67 TR_XM_DocInvoice 18595 4.52 6.71 3.54 68 UNPARSEABLE_RELAY 18297 2.95 1.72 3.49 69 TR_XM_DK_Bayes1 17574 2.61 0.96 3.35 70 T_TooManySym_01 17225 2.99 2.31 3.28 71 TVD_RCVD_IP 17118 2.47 0.67 3.26 72 RCVD_IN_IADB_VOUCHED 16349 2.49 1.08 3.12 73 BAYES_40 16344 2.52 1.18 3.12 74 HTML_MIME_NO_HTML_TAG 16220 4.35 7.17 3.09 75 BAYES_95 16063 3.52 4.56 3.06 76 FROM_EXCESS_BASE64 15588 5.48 11.13 2.97 77 XMSexyCombo_05 15310 4.90 9.36 2.92 78 XM_H_Long_From02 15160 4.06 6.68 2.89 79 TR_XM_DK_Bayes2 14426 2.19 0.93 2.75 80 XMNumbers 14327 3.81 6.24 2.73 81 XM_UncommonTLD01 14090 3.92 6.71 2.69 82 MIME_HTML_MOSTLY 14073 3.23 4.46 2.68 83 MIME_HTML_ONLY_MULTI 11957 2.42 2.72 2.28 84 BAYES_20 11778 1.87 1.02 2.25 85 MAILING_LIST_MULTI 11500 1.91 1.29 2.19 86 ADVANCE_FEE_2_NEW_MONEY 10851 2.92 4.84 2.07 87 MONEY_FRAUD_3 10809 2.91 4.84 2.06 88 MONEY_BARRISTER 10802 2.90 4.81 2.06 89 RCVD_IN_IADB_OPTIN 9946 1.51 0.66 1.90 90 RCVD_IN_MSPIKE_WL 9615 1.48 0.70 1.83 91 RCVD_IN_MSPIKE_H3 9615 1.48 0.69 1.83 92 HELO_NODOT 9482 1.33 0.25 1.81 93 XM_DK_Undo_01 9478 1.90 2.11 1.81 94 HTML_IMAGE_RATIO_08 9011 2.23 3.39 1.72 95 IN_HORDE_ADDRESS_BOOK 8551 1.15 0.07 1.63 96 XM_CamelCaseFrm001 8091 1.89 2.67 1.54 97 XM_ShortIntro_01 7931 1.27 0.72 1.51 98 XMDiploma_00 7868 1.70 2.16 1.50 99 XM_DIRTYINTL 7589 1.98 3.18 1.45 100 T_TooManySym_02 7526 1.17 0.58 1.43 101 XMCapTrack 7272 1.12 0.50 1.39 102 BAYES_05 7137 1.12 0.58 1.36 103 INVALID_MSGID 7095 1.01 0.24 1.35 104 USER_IN_DEF_DKIM_WL 7088 0.94 0.02 1.35 105 TR_Symld_Words 6909 1.19 0.90 1.32 106 URI_HEX 6835 1.82 2.97 1.30 107 XM_OfRef6 6614 1.72 2.76 1.26 108 XMStockSpam_06 6613 1.26 1.26 1.26 109 SUBJ_ALL_CAPS 6503 1.43 1.86 1.24 110 TO_MALFORMED 6453 0.87 0.05 1.23 111 TooManyTo_004 6347 1.06 0.73 1.21 112 T_XMDrugObfuBody_08 6293 1.55 2.33 1.20 113 XM_H_PHPOS 6287 1.08 0.80 1.20 114 XMSubMetaSxObfu_03 6087 1.08 0.90 1.16 115 RELAYCOUNTRY_CA 5913 1.68 2.94 1.13 116 XM_ProductURIs 5910 1.14 1.17 1.13 117 XM_GoogleGroups 5534 0.85 0.39 1.05 118 XMLngstWrd_00 5500 0.88 0.51 1.05 119 XMPhish11 5447 1.22 1.63 1.04 120 TooManyTo_005 5355 0.91 0.65 1.02 121 URI_TRY_3LD 5218 1.11 1.38 0.99 122 XMGenDplmaNmb 5165 1.18 1.62 0.98 123 XMSubNoVowel 5155 0.83 0.49 0.98 124 XMLngstWrd_01 4946 0.80 0.49 0.94 125 UNTRUSTED_Relay 4888 4.55 12.69 0.93 126 RELAYCOUNTRY_GB 4880 0.91 0.86 0.93 127 BOTNET 4820 5.45 15.65 0.92 128 DKIM_ADSP_CUSTOM_MED 4808 1.07 1.42 0.92 129 MISSING_HEADERS 4666 1.82 3.91 0.89 130 T_FILL_THIS_FORM_SHORT 4654 1.06 1.44 0.89 131 XM_GRM 4544 0.60 0.00 0.87 132 T_XMDrugObfuBody_00 4418 0.89 0.99 0.84 133 TR_MetaPhish_Combo_01 4315 0.72 0.50 0.82 134 TM2_M_VERY_LONG_WORD 4072 0.90 1.19 0.78 135 DIET_1 3859 1.25 2.41 0.74 136 XM_H_PHPMailer 3816 0.74 0.78 0.73 137 XMBdyGiftCard01 3789 0.92 1.35 0.72 138 HTML_IMAGE_ONLY_32 3700 0.59 0.33 0.71 139 XMNoVowels 3606 0.62 0.46 0.69 140 XMSubMetaI_00 3526 0.99 1.70 0.67 141 HTML_SHORT_LINK_IMG_1 3522 2.38 6.22 0.67 142 NML_ADSP_CUSTOM_MED 3481 0.84 1.24 0.66 143 XMSolicitRefs_0 3461 0.55 0.29 0.66 144 XM_UB50 3323 2.03 5.18 0.63 145 SpammyFromTLD_01 3304 0.83 1.29 0.63 146 HTML_IMAGE_ONLY_04 3228 2.13 5.55 0.62 147 XMBody_95 3174 0.46 0.14 0.61 148 HTML_SHORT_CENTER 3029 2.03 5.29 0.58 149 KHOP_DYNAMIC 3017 0.62 0.73 0.58 150 XMDateMe_00 3000 0.49 0.29 0.57 151 T_OBFU_PDF_ATTACH 2878 0.45 0.23 0.55 152 URIBL_DBL_ABUSE_SPAM 2786 0.43 0.20 0.53 153 T_XMHurry_00 2752 0.88 1.67 0.52 154 XMGappySubj_01 2692 0.43 0.26 0.51 155 T_TooManySym_03 2671 0.38 0.08 0.51 156 XMSubMetaSxObfu_02 2671 0.48 0.42 0.51 157 T_Symld_Words_02 2625 0.58 0.77 0.50 158 URI_NOVOWEL 2615 0.70 1.15 0.50 159 USER_IN_WHITELIST 2589 0.34 0.00 0.49 160 AC_DIV_BONANZA 2551 0.37 0.10 0.49 161 XMLngstWrd_02 2546 0.44 0.32 0.49 162 XMBody_17 2545 1.12 2.56 0.49 163 FORGED_GMAIL_RCVD 2528 0.72 1.27 0.48 164 SHORT_HELO_AND_INLINE_IMAGE 2452 0.34 0.07 0.47 165 XMMoneyMeta_00 2385 0.62 0.99 0.45 166 HTML_TAG_BALANCE_BODY 2385 0.64 1.07 0.45 167 RCVD_IN_SORBS_DUL 2356 0.40 0.29 0.45 168 HTTPS_HTTP_MISMATCH 2318 0.57 0.85 0.44 169 TR_XM_RelayPhish 2288 0.68 1.21 0.44 170 T_MANY_PILL_PRICE 2276 0.30 0.00 0.43 171 XMSubject_40 2091 0.28 0.02 0.40 172 XM_B_REG_HTML 2079 0.50 0.73 0.40 173 XMBrknScrpt_02 2062 0.48 0.66 0.39 174 XM_B_COPY_HTML 2060 0.46 0.62 0.39 175 TM2_M_BODY_EMPTY 2055 0.31 0.11 0.39 176 FILL_THIS_FORM 2030 0.47 0.66 0.39 177 HTML_IMAGE_ONLY_28 2023 0.38 0.36 0.39 178 XMSexyCombo_01 1939 0.64 1.24 0.37 179 RELAYCOUNTRY_AU 1914 0.39 0.43 0.36 180 SHORTENED_URL_SRC 1913 1.52 4.13 0.36 181 SHORTENER_SHORT_IMG 1911 1.52 4.12 0.36 182 URI_BUFFLY 1908 1.47 3.96 0.36 183 RDNS_DYNAMIC 1879 0.65 1.30 0.36 184 REPLYTO_WITHOUT_TO_CC 1865 0.44 0.63 0.36 185 RELAYCOUNTRY_NL 1841 0.38 0.44 0.35 186 HTML_IMAGE_ONLY_20 1837 0.32 0.26 0.35 187 HTML_FONT_FACE_BAD 1835 0.59 1.15 0.35 188 TM2_M_A_HREF_HREF 1809 0.35 0.36 0.34 189 XM_B_TRADE_HTML 1805 0.36 0.39 0.34 190 HTML_IMAGE_ONLY_24 1804 0.40 0.52 0.34 191 HTML_IMAGE_ONLY_12 1798 0.57 1.09 0.34 192 RELAYCOUNTRY_DE 1791 0.40 0.53 0.34 193 XMHTML_After_End 1776 0.64 1.32 0.34 194 HTML_IMAGE_ONLY_16 1731 0.32 0.29 0.33 195 XM_H_PHPOS_M 1727 0.34 0.37 0.33 196 PLING_QUERY 1701 0.47 0.81 0.32 197 XMLngstWrd_03 1693 0.29 0.23 0.32 198 XMPhish14 1652 0.50 0.91 0.31 199 T_FILL_THIS_FORM_LONG 1611 0.40 0.62 0.31 200 XMSubLongNoVowel 1603 0.24 0.09 0.31 ----------------------------------------------------------------------