Email: 367066 Autolearn: 0 AvgScore: 4.41 AvgScanTime: 3.27 sec Spam: 131930 Autolearn: 0 AvgScore: 12.61 AvgScanTime: 3.94 sec Ham: 235136 Autolearn: 0 AvgScore: -0.20 AvgScanTime: 2.89 sec Time Spent Running SA: 333.38 hours Time Spent Processing Spam: 144.45 hours Time Spent Processing Ham: 188.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 116357 81.35 88.20 77.50 2 DKIM_SIGNED 104935 73.41 79.54 69.96 3 XM_DK_Pass 102828 72.34 77.94 69.20 4 DKIM_VALID 99050 69.74 75.08 66.74 5 DCC_CHECK 98456 54.06 74.63 42.52 6 XMListUnsubscribeExists 91579 57.19 69.41 50.33 7 DKIM_VALID_AU 84821 58.24 64.29 54.85 8 XM_H_QuotedFrom 78008 49.18 59.13 43.60 9 XM_DK_Undo_02 62075 30.09 47.05 20.58 10 BAYES_99 55583 28.11 42.13 20.25 11 LOC_TINY_FONT_1 47744 32.12 36.19 29.84 12 BAYES_999 47488 24.12 35.99 17.45 13 HTML_FONT_LOW_CONTRAST 45219 32.68 34.27 31.78 14 TR_DCC_Bayes_99 41819 18.43 31.70 10.98 15 MIME_HTML_ONLY 38440 22.01 29.14 18.01 16 BAYES_50 37781 41.69 28.64 49.02 17 XMSubLong 35556 25.76 26.95 25.09 18 DCC_CHECK_NEGATIVE 32030 44.80 24.28 56.32 19 FVGT_m_MULTI_ODD 31763 21.87 24.08 20.63 20 HTML_IMAGE_RATIO_02 28478 14.52 21.59 10.55 21 DKIM_VALID_EF 26343 25.59 19.97 28.74 22 XM_Body_Dirty_Words 24190 14.80 18.34 12.82 23 RELAYCOUNTRY_META 23850 8.91 18.08 3.77 24 T_TM2_M_HEADER_IN_MSG 22360 19.30 16.95 20.62 25 T_KAM_HTML_FONT_INVALID 22052 13.75 16.71 12.09 26 XM_Multi_Part_URI 21125 13.04 16.01 11.38 27 MultiRelay 20790 12.77 15.76 11.09 28 BOTNET 20691 6.48 15.68 1.32 29 XM_Evil_Numbers_Gen 18636 10.85 14.13 9.01 30 BOTNET_IPINHOSTNAME 17239 10.25 13.07 8.68 31 UNTRUSTED_Relay 15717 4.95 11.91 1.04 32 FSL_BULK_SIG 14392 9.10 10.91 8.08 33 HTML_IMAGE_RATIO_04 12964 7.35 9.83 5.96 34 BAYES_80 12938 7.45 9.81 6.14 35 XMSexyCombo_05 12508 5.90 9.48 3.89 36 XM_B_Phish_Phrases 12132 6.67 9.20 5.25 37 TooManyTo_001 11754 6.27 8.91 4.78 38 TR_XM_DocInvoice 11674 5.20 8.85 3.15 39 XMSubMetaSx_00 11664 7.69 8.84 7.05 40 FROM_EXCESS_BASE64 11512 6.12 8.73 4.66 41 T_XMDrugObfuBody_14 11197 6.88 8.49 5.98 42 RCVD_IN_RP_SAFE 11047 11.47 8.37 13.21 43 BAYES_60 10996 9.84 8.33 10.69 44 XM_H_Long_From01 10589 6.38 8.03 5.46 45 MPART_ALT_DIFF 10066 5.08 7.63 3.65 46 LOTS_OF_MONEY 9974 6.12 7.56 5.30 47 ALL_TRUSTED 9290 19.34 7.04 26.24 48 RCVD_IN_RP_CERTIFIED 9257 10.74 7.02 12.83 49 TM2_M_URI_OPT_OUT 8889 7.11 6.74 7.31 50 MIME_QP_LONG_LINE 7921 8.10 6.00 9.28 51 XM_UncommonTLD01 7729 4.68 5.86 4.03 52 LotsOfNums_01 7653 7.38 5.80 8.27 53 MIME_HTML_MOSTLY 7524 4.32 5.70 3.55 54 BAYES_95 7057 4.61 5.35 4.20 55 XM_UB50 6417 2.13 4.86 0.60 56 RCVD_IN_RP_RNBL 6414 1.79 4.86 0.07 57 XMStrtUSub 5986 4.82 4.54 4.98 58 DKIM_INVALID 5885 3.67 4.46 3.22 59 RCVD_IN_BL_SPAMCOP_NET 5858 1.68 4.44 0.14 60 URI_WP_HACKED_2 5763 4.54 4.37 4.64 61 XM_SendGrid 5496 4.19 4.17 4.20 62 MIME_HTML_ONLY_MULTI 5477 2.35 4.15 1.34 63 MultiRelay_Combo 5197 1.52 3.94 0.16 64 MultiRelay_CC 5197 1.52 3.94 0.16 65 T_TooManySym_01 4856 4.07 3.68 4.29 66 SUBJ_ALL_CAPS 4781 2.18 3.62 1.38 67 XMNumbers 4725 3.78 3.58 3.89 68 HTML_IMAGE_RATIO_06 4706 3.10 3.57 2.84 69 XM_SPF_SoftFail 4634 1.70 3.51 0.69 70 RCVD_IN_MSPIKE_H2 4570 4.44 3.46 4.98 71 XM_DIRTYINTL 4496 2.09 3.41 1.35 72 RELAYCOUNTRY_CA 4449 2.00 3.37 1.23 73 IMPOTENCE 4323 3.10 3.28 3.00 74 XMBdyGiftCard01 4305 2.43 3.26 1.96 75 BOTNET_NORDNS 4259 1.17 3.23 0.01 76 T_REMOTE_IMAGE 4062 2.92 3.08 2.82 77 XM_RXBody 3882 1.26 2.94 0.32 78 URI_HEX 3675 1.87 2.79 1.36 79 XM_CamelCaseFrm001 3555 1.98 2.69 1.58 80 SpammyFromTLD_02 3462 1.04 2.62 0.15 81 URIBL_RHS_DOB 3454 1.53 2.62 0.93 82 XM_OfRef6 2956 1.68 2.24 1.36 83 XMSlimDrugH 2930 1.24 2.22 0.68 84 UNPARSEABLE_RELAY 2839 5.65 2.15 7.60 85 HTML_IMAGE_RATIO_08 2744 2.23 2.08 2.32 86 RELAYCOUNTRY_CN 2729 0.78 2.07 0.06 87 RCVD_IN_PSBL 2712 0.81 2.06 0.11 88 SpammyFromTLD_01 2677 0.90 2.03 0.27 89 T_TooManySym_02 2601 2.00 1.97 2.02 90 HTML_MIME_NO_HTML_TAG 2600 1.79 1.97 1.68 91 XM_UB60 2540 0.75 1.93 0.09 92 NO_DNS_FOR_FROM 2508 1.43 1.90 1.17 93 ONLINE_PHARMACY 2501 1.93 1.90 1.94 94 BAYES_40 2488 2.14 1.89 2.27 95 XMSubMetaSSx_00 2436 1.15 1.85 0.76 96 XMSubMetaI_00 2416 1.27 1.83 0.96 97 XM_URI_RBL 2411 0.72 1.83 0.10 98 TR_Mismatch_TLD_02 2373 0.71 1.80 0.10 99 XMDiploma_00 2325 1.42 1.76 1.23 100 URI_TRY_3LD 2316 1.26 1.76 0.98 101 TVD_VISIT_PHARMA 2308 1.60 1.75 1.51 102 XM_UB99 2199 0.61 1.67 0.02 103 T_XMDrugObfuBody_00 2165 0.89 1.64 0.47 104 XMSexyCombo_01 2129 0.88 1.61 0.47 105 XM_H_Long_From02 2124 1.18 1.61 0.93 106 T_XMDrugObfuBody_08 2080 1.14 1.58 0.90 107 BAYES_00 2051 3.66 1.55 4.84 108 MPART_ALT_DIFF_COUNT 2026 0.89 1.54 0.53 109 BAYES_20 1991 1.45 1.51 1.41 110 XMSlimDrugs 1927 0.82 1.46 0.46 111 RELAYCOUNTRY_AT 1924 0.60 1.46 0.12 112 XM_UB80 1885 0.53 1.43 0.03 113 XM_B_REG_HTML 1880 0.93 1.42 0.66 114 URIBL_BLACK 1868 0.53 1.42 0.03 115 RELAYCOUNTRY_IN 1823 0.54 1.38 0.07 116 BODY_URI_ONLY 1786 0.55 1.35 0.10 117 T_XMHurry_00 1782 0.97 1.35 0.75 118 TR_XM_DK_Bayes 1782 2.71 1.35 3.48 119 XM_ProductURIs 1764 1.33 1.34 1.32 120 TR_XM_DK_Bayes1 1756 2.61 1.33 3.34 121 TR_XM_DK_Bayes2 1721 2.56 1.30 3.27 122 DIET_1 1649 0.67 1.25 0.35 123 URIBL_DBL_SPAM 1613 0.45 1.22 0.01 124 XMStockSpam_06 1586 1.45 1.20 1.60 125 XMHTMLBadTable_001 1586 0.93 1.20 0.78 126 XMPhish30 1584 0.65 1.20 0.35 127 XM_UB999 1558 0.43 1.18 0.02 128 XMGenDplmaNmb 1556 0.85 1.18 0.66 129 MAILING_LIST_MULTI 1556 1.44 1.18 1.59 130 T_MONEY_PERCENT 1544 0.58 1.17 0.25 131 TR_LOTS_OF_MONEY2 1544 0.58 1.17 0.25 132 NO_PRESCRIPTION 1534 0.55 1.16 0.21 133 FILL_THIS_FORM 1527 0.80 1.16 0.60 134 XM_HighProb1 1499 0.42 1.14 0.01 135 XM_H_PHPOS 1494 1.04 1.13 0.98 136 XMGppyBdWords 1482 0.46 1.12 0.10 137 PLING_QUERY 1473 0.60 1.12 0.32 138 TM2_M_VERY_LONG_WORD 1469 0.85 1.11 0.70 139 TR_Caps_n_Bayes_99 1457 0.45 1.10 0.08 140 XM_DK_Undo_01 1453 1.35 1.10 1.49 141 T_FILL_THIS_FORM_LONG 1434 0.73 1.09 0.53 142 XMPhish11 1431 1.07 1.08 1.06 143 DKIM_ADSP_CUSTOM_MED 1406 0.93 1.07 0.85 144 XMMoneyMeta_00 1394 0.53 1.06 0.23 145 RELAYCOUNTRY_ZA 1393 0.38 1.06 0.01 146 TR_XM_RelayPhish 1390 0.57 1.05 0.30 147 XMBody_17 1377 0.71 1.04 0.53 148 XM_H_PHPMailer 1359 0.77 1.03 0.62 149 FILL_THIS_FORM_LOAN 1313 0.69 1.00 0.52 150 TR_Orig_Subnet 1304 0.36 0.99 0.00 151 NML_ADSP_CUSTOM_MED 1294 0.73 0.98 0.58 152 HTML_IMAGE_ONLY_20 1281 0.47 0.97 0.19 153 RCVD_IN_IADB_LISTED 1258 2.61 0.95 3.53 154 FORGED_GMAIL_RCVD 1236 0.59 0.94 0.39 155 XM_UB95 1230 0.35 0.93 0.03 156 XM_B_COPY_HTML 1230 0.66 0.93 0.51 157 RDNS_DYNAMIC 1229 0.70 0.93 0.57 158 TR_MetaPhish_Combo_01 1229 0.70 0.93 0.57 159 RELAYCOUNTRY_FR 1228 0.47 0.93 0.21 160 RELAYCOUNTRY_VE 1215 0.33 0.92 0.00 161 XMPhish14 1212 0.56 0.92 0.36 162 XMSubMetaSx_01 1194 0.61 0.91 0.45 163 TVD_SPACE_RATIO_MINFP 1168 0.32 0.89 0.01 164 TooManyTo_002 1167 1.04 0.88 1.13 165 HELO_NODOT 1159 0.58 0.88 0.40 166 HTML_IMAGE_ONLY_04 1154 0.37 0.87 0.08 167 RELAYCOUNTRY_GB 1154 0.65 0.87 0.52 168 T_FILL_THIS_FORM_SHORT 1130 0.70 0.86 0.61 169 FROM_MISSP_REPLYTO 1113 0.32 0.84 0.02 170 RELAYCOUNTRY_DE 1110 0.49 0.84 0.29 171 TVD_SPACE_RATIO 1096 0.49 0.83 0.30 172 MONEY_FRAUD_5 1091 0.30 0.83 0.01 173 TooManyTo_003 1091 0.81 0.83 0.80 174 FSL_HELO_NON_FQDN_1 1072 0.33 0.81 0.06 175 RCVD_IN_IADB_SPF 1038 2.34 0.79 3.21 176 MONEY_FROM_MISSP 1033 0.28 0.78 0.00 177 RCVD_IN_MSPIKE_WL 1023 1.86 0.78 2.47 178 TR_Caps_n_Bayes_80 1022 0.35 0.77 0.11 179 BAYES_05 1019 1.01 0.77 1.15 180 URIBL_DBL_ABUSE_SPAM 1019 0.48 0.77 0.32 181 RCVD_IN_MSPIKE_H3 1018 1.86 0.77 2.46 182 XMBody_78 994 0.53 0.75 0.40 183 XMGappySubj_01 985 0.42 0.75 0.24 184 YOU_INHERIT 981 0.27 0.74 0.01 185 T_HTML_TAG_BALANCE_CENTER 977 0.43 0.74 0.25 186 XMBrknScrpt_02 972 0.69 0.74 0.66 187 XMHTML_After_End 969 0.43 0.73 0.26 188 NUMERIC_HTTP_ADDR 965 0.36 0.73 0.16 189 DATE_IN_PAST_03_06 964 0.30 0.73 0.06 190 HTML_TAG_BALANCE_BODY 962 0.51 0.73 0.39 191 ANY_BOUNCE_MESSAGE 957 4.87 0.73 7.19 192 BOUNCE_MESSAGE 956 4.87 0.72 7.19 193 PP_MIME_FAKE_ASCII_TEXT 947 0.38 0.72 0.19 194 RCVD_IN_IADB_SENDERID 946 2.14 0.72 2.93 195 SUBJ_DOLLARS 925 0.35 0.70 0.15 196 DRUGS_ERECTILE 910 0.30 0.69 0.08 197 RCVD_IN_IADB_DK 905 2.10 0.69 2.89 198 TR_Mismatch_TLD_01 898 0.31 0.68 0.10 199 XMSubMetaD_00 892 0.29 0.68 0.07 200 XM_Body_Obfu01 887 0.32 0.67 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 182238 81.35 88.20 77.50 2 DKIM_SIGNED 164510 73.41 79.54 69.96 3 XM_DK_Pass 162720 72.34 77.94 69.20 4 DKIM_VALID 156928 69.74 75.08 66.74 5 DCC_CHECK_NEGATIVE 132417 44.80 24.28 56.32 6 DKIM_VALID_AU 128962 58.24 64.29 54.85 7 XMListUnsubscribeExists 118344 57.19 69.41 50.33 8 BAYES_50 115254 41.69 28.64 49.02 9 XM_H_QuotedFrom 102512 49.18 59.13 43.60 10 DCC_CHECK 99980 54.06 74.63 42.52 11 HTML_FONT_LOW_CONTRAST 74731 32.68 34.27 31.78 12 LOC_TINY_FONT_1 70154 32.12 36.19 29.84 13 DKIM_VALID_EF 67572 25.59 19.97 28.74 14 ALL_TRUSTED 61709 19.34 7.04 26.24 15 XMSubLong 58992 25.76 26.95 25.09 16 FVGT_m_MULTI_ODD 48506 21.87 24.08 20.63 17 T_TM2_M_HEADER_IN_MSG 48494 19.30 16.95 20.62 18 XM_DK_Undo_02 48390 30.09 47.05 20.58 19 BAYES_99 47611 28.11 42.13 20.25 20 XM_DKIMWhitelistDomains 44858 12.23 0.03 19.08 21 MIME_HTML_ONLY 42342 22.01 29.14 18.01 22 BAYES_999 41036 24.12 35.99 17.45 23 RCVD_IN_RP_SAFE 31072 11.47 8.37 13.21 24 RCVD_IN_RP_CERTIFIED 30176 10.74 7.02 12.83 25 XM_Body_Dirty_Words 30139 14.80 18.34 12.82 26 T_KAM_HTML_FONT_INVALID 28419 13.75 16.71 12.09 27 XM_Multi_Part_URI 26753 13.04 16.01 11.38 28 MultiRelay 26066 12.77 15.76 11.09 29 TR_DCC_Bayes_99 25828 18.43 31.70 10.98 30 BAYES_60 25135 9.84 8.33 10.69 31 HTML_IMAGE_RATIO_02 24807 14.52 21.59 10.55 32 MIME_QP_LONG_LINE 21810 8.10 6.00 9.28 33 XM_Evil_Numbers_Gen 21181 10.85 14.13 9.01 34 BOTNET_IPINHOSTNAME 20400 10.25 13.07 8.68 35 LotsOfNums_01 19450 7.38 5.80 8.27 36 FSL_BULK_SIG 18999 9.10 10.91 8.08 37 UNPARSEABLE_RELAY 17882 5.65 2.15 7.60 38 TM2_M_URI_OPT_OUT 17193 7.11 6.74 7.31 39 TVD_RCVD_IP 16923 4.73 0.35 7.20 40 ANY_BOUNCE_MESSAGE 16907 4.87 0.73 7.19 41 BOUNCE_MESSAGE 16904 4.87 0.72 7.19 42 XMSubMetaSx_00 16571 7.69 8.84 7.05 43 BAYES_80 14426 7.45 9.81 6.14 44 T_XMDrugObfuBody_14 14069 6.88 8.49 5.98 45 HTML_IMAGE_RATIO_04 14019 7.35 9.83 5.96 46 XM_H_Long_From01 12828 6.38 8.03 5.46 47 LOTS_OF_MONEY 12473 6.12 7.56 5.30 48 XM_B_Phish_Phrases 12343 6.67 9.20 5.25 49 XMStrtUSub 11718 4.82 4.54 4.98 50 RCVD_IN_MSPIKE_H2 11710 4.44 3.46 4.98 51 BAYES_00 11381 3.66 1.55 4.84 52 TooManyTo_001 11248 6.27 8.91 4.78 53 FROM_EXCESS_BASE64 10961 6.12 8.73 4.66 54 URI_WP_HACKED_2 10913 4.54 4.37 4.64 55 T_TooManySym_01 10084 4.07 3.68 4.29 56 XM_SendGrid 9885 4.19 4.17 4.20 57 BAYES_95 9878 4.61 5.35 4.20 58 XM_UncommonTLD01 9465 4.68 5.86 4.03 59 XMSexyCombo_05 9152 5.90 9.48 3.89 60 XMNumbers 9138 3.78 3.58 3.89 61 RELAYCOUNTRY_META 8859 8.91 18.08 3.77 62 MPART_ALT_DIFF 8586 5.08 7.63 3.65 63 MIME_HTML_MOSTLY 8337 4.32 5.70 3.55 64 RCVD_IN_IADB_LISTED 8308 2.61 0.95 3.53 65 TR_XM_DK_Bayes 8181 2.71 1.35 3.48 66 TR_XM_DK_Bayes1 7842 2.61 1.33 3.34 67 TR_XM_DK_Bayes2 7682 2.56 1.30 3.27 68 DKIM_INVALID 7582 3.67 4.46 3.22 69 RCVD_IN_IADB_SPF 7547 2.34 0.79 3.21 70 TR_XM_DocInvoice 7405 5.20 8.85 3.15 71 IN_ZIMBRA_NJ_WHITELIST 7306 2.00 0.02 3.11 72 IMPOTENCE 7057 3.10 3.28 3.00 73 RCVD_IN_IADB_SENDERID 6898 2.14 0.72 2.93 74 RCVD_IN_IADB_DK 6803 2.10 0.69 2.89 75 INVALID_MSGID 6723 1.93 0.27 2.86 76 HTML_IMAGE_RATIO_06 6668 3.10 3.57 2.84 77 T_REMOTE_IMAGE 6641 2.92 3.08 2.82 78 TO_MALFORMED 6344 1.74 0.02 2.70 79 RCVD_IN_MSPIKE_WL 5803 1.86 0.78 2.47 80 RCVD_IN_MSPIKE_H3 5796 1.86 0.77 2.46 81 HTML_IMAGE_RATIO_08 5445 2.23 2.08 2.32 82 BAYES_40 5349 2.14 1.89 2.27 83 USER_IN_DEF_DKIM_WL 4829 1.32 0.02 2.05 84 RCVD_IN_IADB_VOUCHED 4784 1.52 0.59 2.03 85 T_TooManySym_02 4754 2.00 1.97 2.02 86 XMBdyGiftCard01 4599 2.43 3.26 1.96 87 IN_HORDE_ADDRESS_BOOK 4579 1.29 0.12 1.95 88 ONLINE_PHARMACY 4571 1.93 1.90 1.94 89 XM_PDF 4440 1.30 0.25 1.89 90 HTML_MIME_NO_HTML_TAG 3960 1.79 1.97 1.68 91 XMStockSpam_06 3754 1.45 1.20 1.60 92 MAILING_LIST_MULTI 3728 1.44 1.18 1.59 93 XM_CamelCaseFrm001 3714 1.98 2.69 1.58 94 TVD_VISIT_PHARMA 3551 1.60 1.75 1.51 95 XM_DK_Undo_01 3503 1.35 1.10 1.49 96 BAYES_20 3325 1.45 1.51 1.41 97 SUBJ_ALL_CAPS 3235 2.18 3.62 1.38 98 URI_HEX 3206 1.87 2.79 1.36 99 XM_OfRef6 3203 1.68 2.24 1.36 100 XM_DIRTYINTL 3171 2.09 3.41 1.35 101 MIME_HTML_ONLY_MULTI 3145 2.35 4.15 1.34 102 XMSubMetaSxObfu_02 3126 1.02 0.47 1.33 103 XM_ProductURIs 3114 1.33 1.34 1.32 104 BOTNET 3099 6.48 15.68 1.32 105 RELAYCOUNTRY_CA 2900 2.00 3.37 1.23 106 XMDiploma_00 2890 1.42 1.76 1.23 107 XM_GoogleGroups 2805 0.90 0.39 1.19 108 NO_DNS_FOR_FROM 2744 1.43 1.90 1.17 109 RCVD_IN_IADB_OPTIN 2710 0.89 0.41 1.15 110 BAYES_05 2699 1.01 0.77 1.15 111 TooManyTo_002 2657 1.04 0.88 1.13 112 XMPhish11 2488 1.07 1.08 1.06 113 UNTRUSTED_Relay 2456 4.95 11.91 1.04 114 USER_IN_WHITELIST 2404 0.65 0.00 1.02 115 XM_H_PHPOS 2313 1.04 1.13 0.98 116 URI_TRY_3LD 2297 1.26 1.76 0.98 117 XMSubMetaI_00 2246 1.27 1.83 0.96 118 XM_H_Long_From02 2197 1.18 1.61 0.93 119 TR_Symld_Words 2186 0.83 0.64 0.93 120 URIBL_RHS_DOB 2180 1.53 2.62 0.93 121 XMLngstWrd_00 2166 0.72 0.36 0.92 122 T_XMDrugObfuBody_08 2115 1.14 1.58 0.90 123 XMBody_95 2113 0.64 0.17 0.90 124 DKIM_ADSP_CUSTOM_MED 2002 0.93 1.07 0.85 125 T_TooManySym_03 1991 0.69 0.41 0.85 126 XMLngstWrd_01 1908 0.64 0.33 0.81 127 TooManyTo_003 1882 0.81 0.83 0.80 128 XMHTMLBadTable_001 1828 0.93 1.20 0.78 129 XMSubMetaSSx_00 1788 1.15 1.85 0.76 130 T_XMHurry_00 1771 0.97 1.35 0.75 131 TM2_M_VERY_LONG_WORD 1651 0.85 1.11 0.70 132 XM_SPF_SoftFail 1616 1.70 3.51 0.69 133 XMSlimDrugH 1604 1.24 2.22 0.68 134 TooManyTo_004 1558 0.67 0.67 0.66 135 XMBrknScrpt_02 1553 0.69 0.74 0.66 136 XM_B_REG_HTML 1550 0.93 1.42 0.66 137 XMGenDplmaNmb 1549 0.85 1.18 0.66 138 XM_H_PHPMailer 1467 0.77 1.03 0.62 139 T_FILL_THIS_FORM_SHORT 1429 0.70 0.86 0.61 140 XM_UB50 1419 2.13 4.86 0.60 141 FILL_THIS_FORM 1407 0.80 1.16 0.60 142 TooManyTo_005 1392 0.59 0.60 0.59 143 NML_ADSP_CUSTOM_MED 1374 0.73 0.98 0.58 144 XMNoVowels 1358 0.49 0.33 0.58 145 TR_MetaPhish_Combo_01 1335 0.70 0.93 0.57 146 RDNS_DYNAMIC 1334 0.70 0.93 0.57 147 T_FILL_THIS_FORM_LONG 1241 0.73 1.09 0.53 148 XMBody_17 1236 0.71 1.04 0.53 149 MPART_ALT_DIFF_COUNT 1236 0.89 1.54 0.53 150 RELAYCOUNTRY_GB 1230 0.65 0.87 0.52 151 XMLngstWrd_02 1229 0.42 0.23 0.52 152 FILL_THIS_FORM_LOAN 1220 0.69 1.00 0.52 153 XM_B_COPY_HTML 1203 0.66 0.93 0.51 154 T_TooManySym_04 1118 0.31 0.01 0.48 155 XMSexyCombo_01 1111 0.88 1.61 0.47 156 T_XMDrugObfuBody_00 1097 0.89 1.64 0.47 157 XMSlimDrugs 1077 0.82 1.46 0.46 158 XMSubMetaSx_01 1053 0.61 0.91 0.45 159 DKIM_ADSP_NXDOMAIN 1053 0.45 0.45 0.45 160 URIBL_SBL_A 985 0.40 0.36 0.42 161 RELAYCOUNTRY_AU 960 0.47 0.57 0.41 162 HELO_NODOT 952 0.58 0.88 0.40 163 XMBody_78 950 0.53 0.75 0.40 164 HTML_FONT_FACE_BAD 923 0.48 0.64 0.39 165 FORGED_GMAIL_RCVD 915 0.59 0.94 0.39 166 HTML_TAG_BALANCE_BODY 910 0.51 0.73 0.39 167 XM_S_JOY_D 897 0.44 0.54 0.38 168 XMRcvdHeader_15 897 0.24 0.00 0.38 169 XMLngstWrd_03 871 0.30 0.17 0.37 170 XMSolicitRefs_0 855 0.35 0.33 0.36 171 XM_H_PHPOS_M 855 0.47 0.66 0.36 172 XMPhish14 839 0.56 0.92 0.36 173 XMPhish30 820 0.65 1.20 0.35 174 DIET_1 816 0.67 1.25 0.35 175 XM_H_SpoofStaff4 813 0.29 0.20 0.35 176 MISSING_HEADERS 813 0.32 0.29 0.35 177 XM_ShortIntro_01 793 0.33 0.33 0.34 178 XM_Walgreens_Forge 785 0.32 0.28 0.33 179 XMSUPPORT 775 0.21 0.00 0.33 180 XM_RXBody 759 1.26 2.94 0.32 181 URIBL_DBL_ABUSE_SPAM 754 0.48 0.77 0.32 182 XMSubMetaSxObfu_03 751 0.39 0.52 0.32 183 PLING_QUERY 747 0.60 1.12 0.32 184 LOW_PRICE 737 0.41 0.58 0.31 185 XMCapTrack 724 0.29 0.25 0.31 186 TVD_SPACE_RATIO 711 0.49 0.83 0.30 187 TR_XM_RelayPhish 707 0.57 1.05 0.30 188 TM2_M_A_HREF_HREF 699 0.37 0.49 0.30 189 RELAYCOUNTRY_DE 685 0.49 0.84 0.29 190 KHOP_DYNAMIC 666 0.36 0.51 0.28 191 T_Symld_Words_02 656 0.34 0.46 0.28 192 SpammyFromTLD_01 639 0.90 2.03 0.27 193 HTML_IMAGE_ONLY_24 630 0.24 0.18 0.27 194 XMSubNoVowel 628 0.34 0.46 0.27 195 HTTPS_HTTP_MISMATCH 617 0.28 0.31 0.26 196 TR_MetaPhish_Combo_01b 611 0.33 0.45 0.26 197 XMHTML_After_End 610 0.43 0.73 0.26 198 FROM_EGROUPS 598 0.16 0.00 0.25 199 XMDateMe_00 590 0.28 0.33 0.25 200 TR_LOTS_OF_MONEY2 589 0.58 1.17 0.25 ----------------------------------------------------------------------