Email: 734172 Autolearn: 0 AvgScore: 5.26 AvgScanTime: 4.76 sec Spam: 255322 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 5.51 sec Ham: 478850 Autolearn: 0 AvgScore: 0.57 AvgScanTime: 4.35 sec Time Spent Running SA: 969.82 hours Time Spent Processing Spam: 391.07 hours Time Spent Processing Ham: 578.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243181 90.42 95.24 87.85 2 DKIM_SIGNED 183140 69.80 71.73 68.77 3 XM_DK_Pass 178794 68.39 70.03 67.52 4 DCC_CHECK 173488 45.55 67.95 33.60 5 DKIM_VALID 172609 65.55 67.60 64.46 6 XMListUnsubscribeExists 154418 51.23 60.48 46.30 7 DKIM_VALID_AU 133092 48.22 52.13 46.13 8 XM_H_QuotedFrom 120335 38.44 47.13 33.80 9 XM_DK_Undo_02 104651 22.33 40.99 12.38 10 MIME_HTML_ONLY 100069 24.69 39.19 16.95 11 BAYES_99 94754 20.67 37.11 11.90 12 BAYES_50 88192 50.77 34.54 59.43 13 HTML_FONT_LOW_CONTRAST 80198 28.34 31.41 26.70 14 BAYES_999 79788 17.56 31.25 10.26 15 DCC_CHECK_NEGATIVE 78272 52.64 30.66 64.36 16 LOC_TINY_FONT_1 75764 23.50 29.67 20.20 17 TR_DCC_Bayes_99 74699 13.72 29.26 5.43 18 RELAYCOUNTRY_META 70179 12.69 27.49 4.80 19 XMSubLong 62044 20.36 24.30 18.26 20 BOTNET 59179 8.63 23.18 0.87 21 FVGT_m_MULTI_ODD 57843 21.74 22.65 21.25 22 UNTRUSTED_Relay 55110 8.20 21.58 1.07 23 DKIM_VALID_EF 54004 24.26 21.15 25.92 24 T_TM2_M_HEADER_IN_MSG 53388 26.46 20.91 29.43 25 FROM_EXCESS_BASE64 49297 9.16 19.31 3.75 26 XM_UncommonTLD01 47428 8.50 18.58 3.12 27 T_KAM_HTML_FONT_INVALID 46103 15.94 18.06 14.81 28 T_REMOTE_IMAGE 43185 8.63 16.91 4.22 29 HTML_MIME_NO_HTML_TAG 41541 7.04 16.27 2.13 30 HTML_SHORT_LINK_IMG_1 40140 7.74 15.72 3.49 31 XM_Body_Dirty_Words 39223 11.82 15.36 9.93 32 SpammyFromTLD_02 38649 5.42 15.14 0.24 33 BODY_URI_ONLY 37676 5.17 14.76 0.07 34 HTML_IMAGE_ONLY_04 37167 7.21 14.56 3.30 35 MIME_HEADER_CTYPE_ONLY 36657 5.09 14.36 0.15 36 MISSING_HEADERS 36320 5.27 14.23 0.49 37 XM_Multi_Part_URI 35900 11.24 14.06 9.74 38 HTML_IMAGE_RATIO_02 35750 9.57 14.00 7.21 39 MultiRelay 35386 16.00 13.86 17.15 40 LOTS_OF_MONEY 33770 10.06 13.23 8.37 41 RELAYCOUNTRY_UA 32871 4.48 12.87 0.00 42 HTML_SHORT_CENTER 31360 6.01 12.28 2.66 43 FSL_BULK_SIG 31157 8.17 12.20 6.01 44 SHORTENER_SHORT_IMG 30957 5.93 12.12 2.63 45 SHORTENED_URL_SRC 30918 5.93 12.11 2.63 46 XM_Evil_Numbers_Gen 30381 8.89 11.90 7.29 47 URI_BUFFLY 30306 5.84 11.87 2.63 48 BOTNET_IPINHOSTNAME 29435 7.30 11.53 5.04 49 BAYES_80 27115 6.60 10.62 4.46 50 XMNumbers 23770 5.13 9.31 2.91 51 XMSexyCombo_05 23638 4.73 9.26 2.32 52 XM_UB50 23255 3.63 9.11 0.71 53 HTML_IMAGE_RATIO_04 20892 5.88 8.18 4.66 54 BAYES_60 20700 7.46 8.11 7.11 55 T_XMDrugObfuBody_14 20196 7.63 7.91 7.48 56 XM_H_Long_From01 19619 6.28 7.68 5.54 57 LotsOfNums_01 18147 7.99 7.11 8.46 58 XMSubMetaSx_00 17985 4.69 7.04 3.43 59 XM_B_Phish_Phrases 17630 5.25 6.91 4.37 60 MPART_ALT_DIFF 16003 4.13 6.27 2.99 61 TR_XM_DocInvoice 15801 4.57 6.19 3.71 62 TooManyTo_001 15474 7.16 6.06 7.75 63 BAYES_95 13846 3.91 5.42 3.10 64 RCVD_IN_RP_SAFE 12725 7.74 4.98 9.21 65 HTML_IMAGE_RATIO_06 11580 3.62 4.54 3.14 66 XMStrtUSub 11159 3.89 4.37 3.64 67 XM_SPF_SoftFail 10956 3.26 4.29 2.71 68 XM_UB80 10877 1.50 4.26 0.03 69 XM_UB60 10572 1.48 4.14 0.07 70 DKIM_INVALID 10531 4.25 4.12 4.31 71 MIME_QP_LONG_LINE 10428 5.25 4.08 5.87 72 RCVD_IN_RP_CERTIFIED 10118 7.06 3.96 8.71 73 TM2_M_URI_OPT_OUT 9871 2.81 3.87 2.24 74 MIME_HTML_MOSTLY 9576 2.80 3.75 2.29 75 XM_SendGrid 9054 4.33 3.55 4.75 76 MIME_HTML_ONLY_MULTI 8801 2.08 3.45 1.35 77 ALL_TRUSTED 8556 15.60 3.35 22.12 78 RCVD_IN_RP_RNBL 8370 1.18 3.28 0.07 79 XM_DIRTYINTL 8154 2.15 3.19 1.59 80 RCVD_IN_MSPIKE_H2 7819 4.36 3.06 5.06 81 XM_OfRef6 7684 1.96 3.01 1.40 82 RELAYCOUNTRY_CA 7553 1.90 2.96 1.33 83 HTML_IMAGE_RATIO_08 7386 2.27 2.89 1.94 84 URI_HEX 7186 1.94 2.81 1.48 85 RCVD_IN_BL_SPAMCOP_NET 7080 1.19 2.77 0.34 86 DIET_1 7012 1.28 2.75 0.50 87 XM_CamelCaseFrm001 6726 2.05 2.63 1.73 88 XM_H_Long_From02 6415 2.03 2.51 1.77 89 XMSubMetaI_00 6336 1.11 2.48 0.38 90 T_TooManySym_01 6236 3.22 2.44 3.63 91 XMMoneyMeta_00 5947 1.15 2.33 0.52 92 MultiRelay_Combo 5758 0.89 2.26 0.17 93 MultiRelay_CC 5758 0.89 2.26 0.17 94 RCVD_IN_IADB_LISTED 5520 4.71 2.16 6.07 95 XMPhish11 5500 1.54 2.15 1.21 96 XM_URI_RBL 5449 0.81 2.13 0.11 97 T_XMDrugObfuBody_08 5183 1.60 2.03 1.37 98 SUBJ_ALL_CAPS 5177 1.65 2.03 1.44 99 XMDiploma_00 5140 1.94 2.01 1.90 100 RCVD_IN_IADB_SPF 4920 4.13 1.93 5.31 101 RDNS_DYNAMIC 4870 0.94 1.91 0.43 102 BOTNET_NORDNS 4780 0.66 1.87 0.01 103 XM_UB95 4707 0.65 1.84 0.02 104 RCVD_IN_IADB_SENDERID 4651 3.66 1.82 4.63 105 RELAYCOUNTRY_FR 4640 0.79 1.82 0.25 106 RCVD_IN_IADB_DK 4598 3.61 1.80 4.58 107 T_FILL_THIS_FORM_SHORT 4567 1.25 1.79 0.96 108 DATE_IN_PAST_03_06 4452 0.68 1.74 0.12 109 XM_DK_Undo_01 4349 1.93 1.70 2.06 110 XMBdyGiftCard01 4097 1.04 1.60 0.74 111 UNPARSEABLE_RELAY 3854 3.07 1.51 3.91 112 BOUNCE_MESSAGE 3751 6.37 1.47 8.99 113 ANY_BOUNCE_MESSAGE 3751 6.37 1.47 8.99 114 XMSubMetaSSx_00 3703 0.62 1.45 0.18 115 BANG_GUAR 3700 0.52 1.45 0.03 116 BAYES_40 3662 2.82 1.43 3.55 117 XMSexyCombo_01 3551 0.69 1.39 0.31 118 XM_ProductURIs 3536 1.15 1.38 1.02 119 GUARANTEED_100_PERCENT 3521 0.48 1.38 0.01 120 ADVANCE_FEE_2_NEW_MONEY 3516 1.04 1.38 0.87 121 TR_XM_RelayPhish 3504 0.78 1.37 0.47 122 XMHTML_After_End 3495 0.75 1.37 0.42 123 MONEY_FRAUD_3 3488 1.04 1.37 0.86 124 URI_TRY_3LD 3481 1.20 1.36 1.12 125 HTML_FONT_SIZE_LARGE 3469 0.80 1.36 0.50 126 MONEY_BARRISTER 3419 1.03 1.34 0.86 127 SpammyFromTLD_01 3395 0.99 1.33 0.80 128 TM2_M_VERY_LONG_WORD 3344 0.97 1.31 0.78 129 T_XMHurry_00 3301 0.77 1.29 0.50 130 XMBody_17 3229 0.88 1.26 0.68 131 XMStockSpam_06 3202 0.85 1.25 0.64 132 TR_LOTS_OF_MONEY3 3198 0.69 1.25 0.39 133 XM_UB99 3182 0.46 1.25 0.03 134 XMGenDplmaNmb 3175 1.18 1.24 1.14 135 SUBJ_DOLLARS 3148 0.58 1.23 0.23 136 MAILING_LIST_MULTI 3131 2.04 1.23 2.47 137 T_XMDrugObfuBody_00 3055 0.78 1.20 0.56 138 TR_Mismatch_TLD_02 3054 0.46 1.20 0.07 139 BAYES_00 3018 4.58 1.18 6.39 140 URIBL_DBL_SPAM 2812 0.40 1.10 0.03 141 URIBL_BLACK 2767 0.40 1.08 0.04 142 URIBL_SBL_A 2761 1.05 1.08 1.03 143 TR_LOTS_OF_MONEY2 2740 0.51 1.07 0.21 144 T_MONEY_PERCENT 2740 0.51 1.07 0.21 145 XM_HighProb1 2657 0.37 1.04 0.01 146 HTML_IMAGE_ONLY_08 2646 0.57 1.04 0.32 147 T_Symld_Words_02 2615 0.66 1.02 0.46 148 XMHTMLBadTable_001 2600 0.64 1.02 0.44 149 BAYES_20 2584 1.98 1.01 2.50 150 XM_Combo_Sbj 2570 0.51 1.01 0.25 151 TR_LOTS_OF_MONEY1 2567 0.36 1.01 0.02 152 TR_Symld_Words 2545 1.35 1.00 1.54 153 TR_XM_DK_Bayes 2536 2.94 0.99 3.97 154 RELAYCOUNTRY_CN 2530 0.38 0.99 0.06 155 HTML_FONT_FACE_BAD 2490 0.64 0.98 0.46 156 XMPhish14 2474 0.58 0.97 0.37 157 RCVD_IN_IADB_VOUCHED 2461 2.96 0.96 4.03 158 TooManyTo_002 2460 1.98 0.96 2.52 159 TR_XM_DK_Bayes1 2440 2.77 0.96 3.74 160 HELO_DYNAMIC_IPADDR 2436 0.35 0.95 0.02 161 XMSubject_09 2415 0.34 0.95 0.01 162 HTML_TAG_BALANCE_BODY 2410 0.61 0.94 0.43 163 XM_H_PHPOS 2392 1.48 0.94 1.77 164 TR_XM_DK_Bayes2 2380 2.43 0.93 3.22 165 XM_UB999 2379 0.33 0.93 0.01 166 RCVD_IN_PSBL 2333 0.34 0.91 0.03 167 FORM_FRAUD_5 2306 0.32 0.90 0.00 168 XMSubMetaI_01 2288 0.33 0.90 0.02 169 ADVANCE_FEE_4_NEW 2273 0.31 0.89 0.00 170 RELAYCOUNTRY_NL 2263 0.42 0.89 0.17 171 DKIM_ADSP_CUSTOM_MED 2214 0.99 0.87 1.06 172 MPART_ALT_DIFF_COUNT 2213 0.53 0.87 0.35 173 TooManyTo_003 2198 1.43 0.86 1.73 174 PLING_QUERY 2191 0.57 0.86 0.42 175 XMSubject_48 2189 0.32 0.86 0.04 176 REMOVE_BEFORE_LINK 2176 0.55 0.85 0.39 177 RELAYCOUNTRY_IN 2151 0.36 0.84 0.10 178 RELAYCOUNTRY_AT 2146 0.37 0.84 0.12 179 XMMoneyMeta_01 2137 0.32 0.84 0.05 180 RELAYCOUNTRY_GB 2078 1.03 0.81 1.14 181 XM_RXBody 1985 0.37 0.78 0.15 182 XMPhish30 1964 0.50 0.77 0.35 183 FORGED_GMAIL_RCVD 1960 0.60 0.77 0.51 184 XM_B_REG_HTML 1904 0.50 0.75 0.37 185 MONEY_FRAUD_8 1862 0.26 0.73 0.01 186 MILLION_USD 1856 0.27 0.73 0.03 187 SUBJECT_DIET 1846 0.25 0.72 0.00 188 TVD_SUBJ_WIPE_DEBT 1846 0.25 0.72 0.00 189 XMSlimDrugH 1840 0.45 0.72 0.31 190 LongTLD 1837 0.37 0.72 0.18 191 XM_PDF 1814 3.30 0.71 4.68 192 XMSubMetaI_02 1811 0.25 0.71 0.00 193 XMBody_78 1798 0.54 0.70 0.45 194 T_HTML_TAG_BALANCE_CENTER 1794 0.43 0.70 0.28 195 URI_NOVOWEL 1785 0.60 0.70 0.55 196 URIBL_DBL_ABUSE_PHISH 1771 0.36 0.69 0.18 197 ADVANCE_FEE_5_NEW_MONEY 1766 0.25 0.69 0.02 198 TR_Caps_n_Bayes_99 1759 0.29 0.69 0.08 199 KHOP_DYNAMIC 1757 0.64 0.69 0.62 200 FVGT_m_MULTI_ODD_EMAIL 1739 0.29 0.68 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 420669 90.42 95.24 87.85 2 DKIM_SIGNED 329311 69.80 71.73 68.77 3 XM_DK_Pass 323304 68.39 70.03 67.52 4 DKIM_VALID 308675 65.55 67.60 64.46 5 DCC_CHECK_NEGATIVE 308164 52.64 30.66 64.36 6 BAYES_50 284577 50.77 34.54 59.43 7 XMListUnsubscribeExists 221722 51.23 60.48 46.30 8 DKIM_VALID_AU 220890 48.22 52.13 46.13 9 XM_H_QuotedFrom 161875 38.44 47.13 33.80 10 DCC_CHECK 160913 45.55 67.95 33.60 11 T_TM2_M_HEADER_IN_MSG 140903 26.46 20.91 29.43 12 HTML_FONT_LOW_CONTRAST 127832 28.34 31.41 26.70 13 DKIM_VALID_EF 124099 24.26 21.15 25.92 14 ALL_TRUSTED 105943 15.60 3.35 22.12 15 FVGT_m_MULTI_ODD 101741 21.74 22.65 21.25 16 LOC_TINY_FONT_1 96748 23.50 29.67 20.20 17 XMSubLong 87441 20.36 24.30 18.26 18 MultiRelay 82104 16.00 13.86 17.15 19 MIME_HTML_ONLY 81171 24.69 39.19 16.95 20 T_KAM_HTML_FONT_INVALID 70939 15.94 18.06 14.81 21 XM_DK_Undo_02 59291 22.33 40.99 12.38 22 BAYES_99 56992 20.67 37.11 11.90 23 BAYES_999 49129 17.56 31.25 10.26 24 XM_Body_Dirty_Words 47534 11.82 15.36 9.93 25 XM_Multi_Part_URI 46648 11.24 14.06 9.74 26 RCVD_IN_RP_SAFE 44094 7.74 4.98 9.21 27 ANY_BOUNCE_MESSAGE 43051 6.37 1.47 8.99 28 BOUNCE_MESSAGE 43050 6.37 1.47 8.99 29 RCVD_IN_RP_CERTIFIED 41697 7.06 3.96 8.71 30 XM_DKIMWhitelistDomains 40839 5.58 0.05 8.53 31 LotsOfNums_01 40525 7.99 7.11 8.46 32 LOTS_OF_MONEY 40058 10.06 13.23 8.37 33 TooManyTo_001 37126 7.16 6.06 7.75 34 T_XMDrugObfuBody_14 35835 7.63 7.91 7.48 35 XM_Evil_Numbers_Gen 34894 8.89 11.90 7.29 36 HTML_IMAGE_RATIO_02 34527 9.57 14.00 7.21 37 BAYES_60 34058 7.46 8.11 7.11 38 BAYES_00 30603 4.58 1.18 6.39 39 RCVD_IN_IADB_LISTED 29071 4.71 2.16 6.07 40 FSL_BULK_SIG 28793 8.17 12.20 6.01 41 MIME_QP_LONG_LINE 28111 5.25 4.08 5.87 42 XM_H_Long_From01 26521 6.28 7.68 5.54 43 TR_DCC_Bayes_99 26006 13.72 29.26 5.43 44 RCVD_IN_IADB_SPF 25404 4.13 1.93 5.31 45 RCVD_IN_MSPIKE_H2 24223 4.36 3.06 5.06 46 BOTNET_IPINHOSTNAME 24136 7.30 11.53 5.04 47 IN_ZIMBRA_NJ_WHITELIST 23008 3.14 0.03 4.80 48 RELAYCOUNTRY_META 22970 12.69 27.49 4.80 49 XM_SendGrid 22736 4.33 3.55 4.75 50 XM_PDF 22406 3.30 0.71 4.68 51 HTML_IMAGE_RATIO_04 22304 5.88 8.18 4.66 52 RCVD_IN_IADB_SENDERID 22193 3.66 1.82 4.63 53 RCVD_IN_IADB_DK 21941 3.61 1.80 4.58 54 BAYES_80 21369 6.60 10.62 4.46 55 XM_B_Phish_Phrases 20936 5.25 6.91 4.37 56 DKIM_INVALID 20636 4.25 4.12 4.31 57 T_REMOTE_IMAGE 20201 8.63 16.91 4.22 58 RCVD_IN_IADB_VOUCHED 19283 2.96 0.96 4.03 59 TR_XM_DK_Bayes 19033 2.94 0.99 3.97 60 UNPARSEABLE_RELAY 18702 3.07 1.51 3.91 61 FROM_EXCESS_BASE64 17967 9.16 19.31 3.75 62 TR_XM_DK_Bayes1 17900 2.77 0.96 3.74 63 TR_XM_DocInvoice 17786 4.57 6.19 3.71 64 XMStrtUSub 17409 3.89 4.37 3.64 65 T_TooManySym_01 17378 3.22 2.44 3.63 66 TVD_RCVD_IP 17049 2.42 0.28 3.56 67 BAYES_40 17014 2.82 1.43 3.55 68 HTML_SHORT_LINK_IMG_1 16721 7.74 15.72 3.49 69 XMSubMetaSx_00 16431 4.69 7.04 3.43 70 HTML_IMAGE_ONLY_04 15794 7.21 14.56 3.30 71 TR_XM_DK_Bayes2 15442 2.43 0.93 3.22 72 HTML_IMAGE_RATIO_06 15012 3.62 4.54 3.14 73 XM_UncommonTLD01 14951 8.50 18.58 3.12 74 BAYES_95 14846 3.91 5.42 3.10 75 MPART_ALT_DIFF 14307 4.13 6.27 2.99 76 XMNumbers 13928 5.13 9.31 2.91 77 XM_SPF_SoftFail 12977 3.26 4.29 2.71 78 HTML_SHORT_CENTER 12731 6.01 12.28 2.66 79 SHORTENED_URL_SRC 12617 5.93 12.11 2.63 80 SHORTENER_SHORT_IMG 12604 5.93 12.12 2.63 81 URI_BUFFLY 12594 5.84 11.87 2.63 82 RCVD_IN_IADB_OPTIN 12262 1.87 0.58 2.56 83 TooManyTo_002 12052 1.98 0.96 2.52 84 BAYES_20 11976 1.98 1.01 2.50 85 MAILING_LIST_MULTI 11821 2.04 1.23 2.47 86 XMSexyCombo_05 11118 4.73 9.26 2.32 87 MIME_HTML_MOSTLY 10947 2.80 3.75 2.29 88 TM2_M_URI_OPT_OUT 10735 2.81 3.87 2.24 89 HTML_MIME_NO_HTML_TAG 10176 7.04 16.27 2.13 90 RCVD_IN_MSPIKE_WL 10129 1.59 0.60 2.12 91 RCVD_IN_MSPIKE_H3 10118 1.58 0.58 2.11 92 XM_DK_Undo_01 9845 1.93 1.70 2.06 93 HELO_NODOT 9427 1.41 0.37 1.97 94 HTML_IMAGE_RATIO_08 9278 2.27 2.89 1.94 95 XMDiploma_00 9100 1.94 2.01 1.90 96 XM_H_PHPOS 8485 1.48 0.94 1.77 97 XM_H_Long_From02 8457 2.03 2.51 1.77 98 XM_CamelCaseFrm001 8295 2.05 2.63 1.73 99 TooManyTo_003 8287 1.43 0.86 1.73 100 IN_HORDE_ADDRESS_BOOK 8245 1.15 0.07 1.72 101 XM_DIRTYINTL 7596 2.15 3.19 1.59 102 BAYES_05 7410 1.21 0.57 1.55 103 TR_Symld_Words 7389 1.35 1.00 1.54 104 T_TooManySym_02 7374 1.20 0.56 1.54 105 INVALID_MSGID 7128 1.08 0.32 1.49 106 URI_HEX 7085 1.94 2.81 1.48 107 XMCapTrack 6992 1.12 0.48 1.46 108 SUBJ_ALL_CAPS 6917 1.65 2.03 1.44 109 XM_OfRef6 6721 1.96 3.01 1.40 110 T_XMDrugObfuBody_08 6545 1.60 2.03 1.37 111 USER_IN_DEF_DKIM_WL 6458 0.89 0.02 1.35 112 MIME_HTML_ONLY_MULTI 6457 2.08 3.45 1.35 113 TO_MALFORMED 6447 0.88 0.02 1.35 114 RELAYCOUNTRY_CA 6362 1.90 2.96 1.33 115 XM_GoogleGroups 5788 0.91 0.34 1.21 116 XMPhish11 5776 1.54 2.15 1.21 117 RELAYCOUNTRY_GB 5479 1.03 0.81 1.14 118 XMGenDplmaNmb 5469 1.18 1.24 1.14 119 URI_TRY_3LD 5363 1.20 1.36 1.12 120 TooManyTo_004 5305 0.95 0.65 1.11 121 UNTRUSTED_Relay 5111 8.20 21.58 1.07 122 DKIM_ADSP_CUSTOM_MED 5070 0.99 0.87 1.06 123 URIBL_SBL_A 4916 1.05 1.08 1.03 124 XM_ProductURIs 4898 1.15 1.38 1.02 125 XMLngstWrd_00 4848 0.74 0.23 1.01 126 T_FILL_THIS_FORM_SHORT 4604 1.25 1.79 0.96 127 TooManyTo_005 4420 0.80 0.58 0.92 128 XMLngstWrd_01 4279 0.66 0.21 0.89 129 BOTNET 4170 8.63 23.18 0.87 130 ADVANCE_FEE_2_NEW_MONEY 4146 1.04 1.38 0.87 131 MONEY_FRAUD_3 4136 1.04 1.37 0.86 132 TR_MetaPhish_Combo_01 4135 0.76 0.57 0.86 133 MONEY_BARRISTER 4113 1.03 1.34 0.86 134 SpammyFromTLD_01 3843 0.99 1.33 0.80 135 NML_ADSP_CUSTOM_MED 3804 0.75 0.67 0.79 136 TM2_M_VERY_LONG_WORD 3744 0.97 1.31 0.78 137 TO_NO_BRKTS_HTML_ONLY 3707 0.55 0.13 0.77 138 XMBdyGiftCard01 3542 1.04 1.60 0.74 139 XM_UB50 3400 3.63 9.11 0.71 140 XM_H_PHPMailer 3370 0.68 0.64 0.70 141 XMBody_17 3259 0.88 1.26 0.68 142 XMNoVowels 3147 0.54 0.33 0.66 143 T_TooManySym_03 3107 0.45 0.09 0.65 144 XMStockSpam_06 3056 0.85 1.25 0.64 145 KHOP_DYNAMIC 2961 0.64 0.69 0.62 146 T_OBFU_PDF_ATTACH 2950 0.48 0.22 0.62 147 XM_USANA_RCVD 2932 0.40 0.00 0.61 148 T_XMDrugObfuBody_00 2672 0.78 1.20 0.56 149 USER_IN_WHITELIST 2635 0.36 0.00 0.55 150 URI_NOVOWEL 2617 0.60 0.70 0.55 151 XMSubMetaSxObfu_02 2569 0.45 0.28 0.54 152 XMLngstWrd_02 2553 0.41 0.17 0.53 153 XMMoneyMeta_00 2503 1.15 2.33 0.52 154 SHORT_HELO_AND_INLINE_IMAGE 2495 0.36 0.06 0.52 155 XMBody_95 2451 0.37 0.10 0.51 156 FORGED_GMAIL_RCVD 2430 0.60 0.77 0.51 157 XM_ShortIntro_01 2429 0.45 0.34 0.51 158 XMBrknScrpt_02 2403 0.56 0.67 0.50 159 HTML_FONT_SIZE_LARGE 2402 0.80 1.36 0.50 160 DIET_1 2393 1.28 2.75 0.50 161 T_XMHurry_00 2386 0.77 1.29 0.50 162 MISSING_HEADERS 2365 5.27 14.23 0.49 163 XMGappySubj_01 2285 0.44 0.37 0.48 164 TR_XM_RelayPhish 2230 0.78 1.37 0.47 165 T_Symld_Words_02 2223 0.66 1.02 0.46 166 XM_B_COPY_HTML 2218 0.50 0.56 0.46 167 RELAYCOUNTRY_AU 2208 0.49 0.54 0.46 168 HTML_FONT_FACE_BAD 2203 0.64 0.98 0.46 169 HTML_IMAGE_ONLY_32 2167 0.37 0.21 0.45 170 RCVD_IN_SORBS_DUL 2161 0.37 0.23 0.45 171 XMBody_78 2137 0.54 0.70 0.45 172 TM2_M_BODY_EMPTY 2136 0.35 0.17 0.45 173 HTML_IMAGE_ONLY_28 2103 0.48 0.55 0.44 174 XMHTMLBadTable_001 2084 0.64 1.02 0.44 175 DKIM_ADSP_NXDOMAIN 2079 0.40 0.34 0.43 176 HTML_TAG_BALANCE_BODY 2046 0.61 0.94 0.43 177 RDNS_DYNAMIC 2037 0.94 1.91 0.43 178 PLING_QUERY 2027 0.57 0.86 0.42 179 XMHTML_After_End 1993 0.75 1.37 0.42 180 XMDateMe_00 1972 0.37 0.30 0.41 181 RELAYCOUNTRY_DE 1967 0.44 0.50 0.41 182 HTTPS_HTTP_MISMATCH 1945 0.49 0.66 0.41 183 FILL_THIS_FORM 1903 0.44 0.52 0.40 184 TR_LOTS_OF_MONEY3 1886 0.69 1.25 0.39 185 REMOVE_BEFORE_LINK 1864 0.55 0.85 0.39 186 XMSubMetaI_00 1836 1.11 2.48 0.38 187 XMSubMetaSxObfu_03 1812 0.44 0.55 0.38 188 XMPhish14 1794 0.58 0.97 0.37 189 AC_DIV_BONANZA 1789 0.27 0.09 0.37 190 XM_B_REG_HTML 1752 0.50 0.75 0.37 191 XMPhish30 1682 0.50 0.77 0.35 192 MPART_ALT_DIFF_COUNT 1680 0.53 0.87 0.35 193 RCVD_IN_BL_SPAMCOP_NET 1649 1.19 2.77 0.34 194 HTML_IMAGE_ONLY_24 1641 0.35 0.37 0.34 195 HTML_IMAGE_ONLY_20 1640 0.30 0.23 0.34 196 XMLngstWrd_03 1621 0.26 0.11 0.34 197 TM2_M_A_HREF_HREF 1590 0.36 0.40 0.33 198 XM_H_PHPOS_M 1584 0.34 0.37 0.33 199 XMSubNoVowel 1556 0.35 0.39 0.32 200 HTML_IMAGE_ONLY_08 1555 0.57 1.04 0.32 ----------------------------------------------------------------------