Email: 692461 Autolearn: 0 AvgScore: 4.17 AvgScanTime: 4.64 sec Spam: 222564 Autolearn: 0 AvgScore: 12.74 AvgScanTime: 5.51 sec Ham: 469897 Autolearn: 0 AvgScore: 0.11 AvgScanTime: 4.23 sec Time Spent Running SA: 892.38 hours Time Spent Processing Spam: 340.75 hours Time Spent Processing Ham: 551.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 206418 86.73 92.75 83.88 2 DKIM_SIGNED 183575 72.25 82.48 67.41 3 XM_DK_Pass 179282 70.73 80.55 66.07 4 DCC_CHECK 170835 46.44 76.76 32.09 5 DKIM_VALID 169009 66.24 75.94 61.64 6 XMListUnsubscribeExists 154865 52.87 69.58 44.95 7 DKIM_VALID_AU 134391 48.26 60.38 42.52 8 XM_H_QuotedFrom 121844 40.77 54.75 34.14 9 XM_DK_Undo_02 104607 24.55 47.00 13.91 10 BAYES_99 95126 22.82 42.74 13.39 11 BAYES_999 81209 19.51 36.49 11.47 12 HTML_FONT_LOW_CONTRAST 80522 28.57 36.18 24.97 13 LOC_TINY_FONT_1 77471 24.73 34.81 19.96 14 TR_DCC_Bayes_99 72898 14.87 32.75 6.40 15 BAYES_50 72650 49.66 32.64 57.72 16 MIME_HTML_ONLY 69097 21.54 31.05 17.04 17 FVGT_m_MULTI_ODD 57789 22.92 25.97 21.48 18 DKIM_VALID_EF 56195 24.69 25.25 24.43 19 XMSubLong 54158 21.48 24.33 20.13 20 T_TM2_M_HEADER_IN_MSG 48387 27.30 21.74 29.93 21 DCC_CHECK_NEGATIVE 47730 51.55 21.45 65.81 22 T_KAM_HTML_FONT_INVALID 44129 17.00 19.83 15.66 23 XM_Body_Dirty_Words 40897 12.50 18.38 9.72 24 RELAYCOUNTRY_META 37403 8.63 16.81 4.75 25 MultiRelay 37136 17.29 16.69 17.58 26 HTML_IMAGE_RATIO_02 35990 10.12 16.17 7.25 27 XM_Multi_Part_URI 34255 11.70 15.39 9.96 28 BOTNET 30752 5.18 13.82 1.08 29 XM_Evil_Numbers_Gen 30641 8.98 13.77 6.71 30 BOTNET_IPINHOSTNAME 29922 7.63 13.44 4.88 31 FSL_BULK_SIG 29604 7.83 13.30 5.24 32 LOTS_OF_MONEY 26874 9.00 12.07 7.55 33 UNTRUSTED_Relay 22593 4.03 10.15 1.13 34 T_XMDrugObfuBody_14 22198 8.23 9.97 7.41 35 HTML_IMAGE_RATIO_04 22041 6.33 9.90 4.64 36 XMSexyCombo_05 20674 4.63 9.29 2.43 37 XM_B_Phish_Phrases 20625 5.92 9.27 4.34 38 TR_XM_DocInvoice 19604 5.02 8.81 3.23 39 FROM_EXCESS_BASE64 18808 4.73 8.45 2.96 40 BAYES_80 18439 5.98 8.28 4.89 41 XM_H_Long_From01 17947 6.21 8.06 5.34 42 XM_UncommonTLD01 17187 4.49 7.72 2.96 43 TooManyTo_001 16859 8.87 7.57 9.48 44 MPART_ALT_DIFF 16620 4.10 7.47 2.51 45 XMSubMetaSx_00 15208 5.22 6.83 4.45 46 BAYES_60 14734 7.93 6.62 8.55 47 DKIM_INVALID 14566 6.02 6.54 5.76 48 LotsOfNums_01 13223 8.03 5.94 9.01 49 RCVD_IN_RP_SAFE 10935 6.76 4.91 7.63 50 XMStrtUSub 10843 3.91 4.87 3.46 51 T_REMOTE_IMAGE 10757 4.32 4.83 4.07 52 BAYES_95 10689 3.70 4.80 3.17 53 MIME_HTML_MOSTLY 10405 2.96 4.68 2.14 54 XM_UB50 10343 1.97 4.65 0.70 55 XM_SendGrid 10224 4.45 4.59 4.39 56 HTML_IMAGE_RATIO_06 10085 3.56 4.53 3.11 57 TM2_M_URI_OPT_OUT 9979 2.73 4.48 1.90 58 XMNumbers 9409 3.51 4.23 3.17 59 RCVD_IN_RP_CERTIFIED 8977 6.17 4.03 7.19 60 XM_DIRTYINTL 8727 2.34 3.92 1.60 61 RCVD_IN_MSPIKE_H2 8720 4.59 3.92 4.91 62 SpammyFromTLD_02 8275 1.36 3.72 0.25 63 XM_OfRef6 8270 1.97 3.72 1.15 64 XM_SPF_SoftFail 8109 2.33 3.64 1.71 65 HTML_MIME_NO_HTML_TAG 8066 3.01 3.62 2.72 66 MIME_HTML_ONLY_MULTI 7961 1.90 3.58 1.11 67 URI_HEX 7902 2.18 3.55 1.53 68 RELAYCOUNTRY_CA 7560 1.98 3.40 1.31 69 HTML_IMAGE_RATIO_08 7088 2.30 3.18 1.88 70 MultiRelay_Combo 6937 1.11 3.12 0.16 71 MultiRelay_CC 6937 1.11 3.12 0.16 72 RCVD_IN_RP_RNBL 6904 1.02 3.10 0.04 73 T_TooManySym_01 6283 3.45 2.82 3.74 74 ALL_TRUSTED 6279 16.80 2.82 23.43 75 XM_CamelCaseFrm001 6207 2.07 2.79 1.73 76 MIME_QP_LONG_LINE 6092 5.10 2.74 6.22 77 SUBJ_ALL_CAPS 6033 2.06 2.71 1.74 78 XM_URI_RBL 5911 0.95 2.66 0.14 79 T_XMDrugObfuBody_08 5848 1.99 2.63 1.69 80 XMDiploma_00 5621 2.03 2.53 1.79 81 MISSING_HEADERS 5399 1.24 2.43 0.68 82 RCVD_IN_BL_SPAMCOP_NET 5267 1.18 2.37 0.61 83 HTML_SHORT_LINK_IMG_1 4998 0.86 2.25 0.21 84 BODY_URI_ONLY 4953 0.79 2.23 0.10 85 XMGppyBdWords 4673 0.77 2.10 0.13 86 XMSexyCombo_01 4239 0.88 1.90 0.39 87 SHORTENED_URL_SRC 4032 0.68 1.81 0.14 88 SHORTENER_SHORT_IMG 3978 0.67 1.79 0.14 89 BOTNET_NORDNS 3927 0.58 1.76 0.02 90 URI_BUFFLY 3890 0.66 1.75 0.14 91 XM_UB99 3887 0.59 1.75 0.04 92 BITCOIN_SPAM_07 3800 0.55 1.71 0.01 93 SUBJ_DOLLARS 3790 0.66 1.70 0.17 94 BAYES_00 3671 4.32 1.65 5.59 95 RCVD_IN_PSBL 3662 0.56 1.65 0.05 96 URI_TRY_3LD 3645 1.60 1.64 1.58 97 XMBdyGiftCard01 3642 1.00 1.64 0.70 98 XMSubMetaI_00 3627 0.93 1.63 0.60 99 URIBL_BLACK 3594 0.54 1.61 0.04 100 TR_XM_RelayPhish 3579 0.83 1.61 0.46 101 T_XMHurry_00 3528 1.01 1.59 0.74 102 MAILING_LIST_MULTI 3500 2.17 1.57 2.45 103 RELAYCOUNTRY_NL 3428 0.60 1.54 0.15 104 UNPARSEABLE_RELAY 3416 3.11 1.53 3.85 105 RCVD_IN_IADB_LISTED 3396 4.74 1.53 6.26 106 HTML_IMAGE_ONLY_04 3339 0.61 1.50 0.19 107 T_FILL_THIS_FORM_SHORT 3313 1.12 1.49 0.95 108 TR_MetaPhish_Combo_01 3304 0.98 1.48 0.74 109 NO_DNS_FOR_FROM 3300 1.15 1.48 0.99 110 HTTPS_HTTP_MISMATCH 3282 0.82 1.47 0.51 111 XM_HighProb1 3277 0.50 1.47 0.03 112 XM_B_Crypto 3274 0.51 1.47 0.06 113 XMGenDplmaNmb 3263 1.20 1.47 1.07 114 XMPhish11 3252 1.25 1.46 1.15 115 XMPhish14 3232 0.70 1.45 0.34 116 XMHTML_After_End 3171 0.74 1.42 0.41 117 SpammyFromTLD_01 3166 0.96 1.42 0.74 118 MIME_HEADER_CTYPE_ONLY 3121 0.55 1.40 0.15 119 XMBody_17 3091 0.71 1.39 0.39 120 RCVD_IN_IADB_SPF 3036 4.16 1.36 5.49 121 TR_XM_Crypto2 3035 0.44 1.36 0.01 122 TM2_M_VERY_LONG_WORD 3027 0.97 1.36 0.78 123 TR_XM_DK_Bayes 3002 2.64 1.35 3.24 124 BAYES_40 2998 2.52 1.35 3.08 125 RELAYCOUNTRY_IN 2885 0.50 1.30 0.12 126 RCVD_IN_IADB_SENDERID 2880 3.67 1.29 4.79 127 DIET_1 2876 0.60 1.29 0.28 128 XMSubMetaSxObfu_03 2845 0.72 1.28 0.46 129 RCVD_IN_IADB_DK 2840 3.63 1.28 4.75 130 XM_UB60 2838 0.49 1.28 0.12 131 RELAYCOUNTRY_CN 2775 0.45 1.25 0.07 132 XM_H_Long_From02 2754 0.99 1.24 0.88 133 XM_DK_Undo_01 2744 1.75 1.23 1.99 134 XMStockSpam_06 2742 0.81 1.23 0.61 135 DEAR_SOMETHING 2738 0.50 1.23 0.15 136 TooManyTo_002 2734 3.26 1.23 4.22 137 TR_XM_DK_Bayes1 2719 2.43 1.22 3.00 138 HTML_TAG_BALANCE_BODY 2706 0.75 1.22 0.53 139 TR_XM_DK_Bayes2 2654 2.15 1.19 2.60 140 XM_ProductURIs 2600 1.22 1.17 1.24 141 XM_UB999 2566 0.39 1.15 0.02 142 BAYES_20 2559 1.80 1.15 2.10 143 T_HTML_TAG_BALANCE_CENTER 2553 0.50 1.15 0.19 144 T_XMDrugObfuBody_00 2515 0.69 1.13 0.48 145 HTML_IMAGE_ONLY_16 2482 0.60 1.12 0.36 146 TooManyTo_003 2442 2.68 1.10 3.43 147 RDNS_DYNAMIC 2418 0.62 1.09 0.40 148 TR_LOTS_OF_MONEY2 2413 0.51 1.08 0.24 149 T_MONEY_PERCENT 2413 0.51 1.08 0.24 150 XMPhish30 2375 0.58 1.07 0.35 151 HTML_IMAGE_ONLY_08 2358 0.45 1.06 0.15 152 PLING_QUERY 2350 0.60 1.06 0.38 153 T_Symld_Words_02 2344 0.74 1.05 0.60 154 RELAYCOUNTRY_FR 2299 0.51 1.03 0.27 155 BITCOIN_DEADLINE 2299 0.34 1.03 0.01 156 RELAYCOUNTRY_GB 2282 1.01 1.03 1.01 157 TR_Symld_Words 2264 1.38 1.02 1.56 158 RELAYCOUNTRY_AT 2213 0.39 0.99 0.10 159 MPART_ALT_DIFF_COUNT 2190 0.51 0.98 0.28 160 ANY_BOUNCE_MESSAGE 2160 4.11 0.97 5.60 161 TR_Caps_n_Bayes_99 2155 0.37 0.97 0.08 162 BOUNCE_MESSAGE 2154 4.11 0.97 5.59 163 XMHTMLBadTable_001 2153 0.65 0.97 0.50 164 XM_RXBody 2111 0.40 0.95 0.15 165 URI_NOVOWEL 2097 0.60 0.94 0.43 166 REMOVE_BEFORE_LINK 2080 0.69 0.93 0.58 167 RCVD_IN_IADB_VOUCHED 2078 3.07 0.93 4.08 168 REPLYTO_WITHOUT_TO_CC 2062 0.40 0.93 0.16 169 XMBody_78 2054 0.51 0.92 0.32 170 XMSlimDrugH 2050 0.60 0.92 0.45 171 HTML_FONT_FACE_BAD 2039 0.59 0.92 0.43 172 TR_Mismatch_TLD_02 2030 0.34 0.91 0.07 173 DATE_IN_PAST_03_06 2000 0.34 0.90 0.07 174 XM_H_PHPOS 1982 1.46 0.89 1.74 175 XM_PDF 1966 3.90 0.88 5.32 176 XMMoneyMeta_00 1948 0.60 0.88 0.47 177 HTML_SHORT_CENTER 1912 0.35 0.86 0.10 178 XM_B_REG_HTML 1905 0.56 0.86 0.43 179 TR_LOTS_OF_MONEY1 1889 0.30 0.85 0.04 180 XM_UB80 1884 0.30 0.85 0.04 181 URIBL_DBL_SPAM 1852 0.29 0.83 0.03 182 TR_LOTS_OF_MONEY3 1760 0.40 0.79 0.22 183 TR_Sbj_FN_Bdy 1747 0.39 0.78 0.21 184 XMClaimOffer 1746 0.40 0.78 0.22 185 HTML_FONT_SIZE_HUGE 1706 0.39 0.77 0.21 186 XMSubNoVowel 1692 0.45 0.76 0.31 187 URG_BIZ 1688 0.27 0.76 0.04 188 LOADSA_MONEY_COMBO 1592 0.25 0.72 0.03 189 XMReplyNow 1591 0.34 0.71 0.16 190 TR_MetaPhish_Combo_01b 1590 0.38 0.71 0.22 191 T_TooManySym_02 1578 1.27 0.71 1.54 192 DKIM_ADSP_NXDOMAIN 1548 0.44 0.70 0.33 193 XM_UB95 1545 0.24 0.69 0.03 194 RELAYCOUNTRY_DE 1542 0.55 0.69 0.48 195 HTML_FONT_SIZE_LARGE 1536 0.38 0.69 0.24 196 XM_XX_Yahoo 1504 0.26 0.68 0.06 197 DKIM_ADSP_CUSTOM_MED 1502 0.98 0.67 1.12 198 XMBrknScrpt_02 1500 0.50 0.67 0.42 199 XMCapTrack 1497 1.24 0.67 1.52 200 REPTO_QUOTE_YAHOO 1484 0.25 0.67 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 394136 86.73 92.75 83.88 2 DKIM_SIGNED 316756 72.25 82.48 67.41 3 XM_DK_Pass 310464 70.73 80.55 66.07 4 DCC_CHECK_NEGATIVE 309221 51.55 21.45 65.81 5 DKIM_VALID 289668 66.24 75.94 61.64 6 BAYES_50 271214 49.66 32.64 57.72 7 XMListUnsubscribeExists 211211 52.87 69.58 44.95 8 DKIM_VALID_AU 199804 48.26 60.38 42.52 9 XM_H_QuotedFrom 160443 40.77 54.75 34.14 10 DCC_CHECK 150769 46.44 76.76 32.09 11 T_TM2_M_HEADER_IN_MSG 140647 27.30 21.74 29.93 12 HTML_FONT_LOW_CONTRAST 117343 28.57 36.18 24.97 13 DKIM_VALID_EF 114805 24.69 25.25 24.43 14 ALL_TRUSTED 110076 16.80 2.82 23.43 15 FVGT_m_MULTI_ODD 100927 22.92 25.97 21.48 16 XMSubLong 94600 21.48 24.33 20.13 17 LOC_TINY_FONT_1 93781 24.73 34.81 19.96 18 MultiRelay 82591 17.29 16.69 17.58 19 MIME_HTML_ONLY 80066 21.54 31.05 17.04 20 T_KAM_HTML_FONT_INVALID 73594 17.00 19.83 15.66 21 XM_DK_Undo_02 65378 24.55 47.00 13.91 22 XM_DKIMWhitelistDomains 64355 9.37 0.23 13.70 23 BAYES_99 62926 22.82 42.74 13.39 24 BAYES_999 53908 19.51 36.49 11.47 25 XM_Multi_Part_URI 46782 11.70 15.39 9.96 26 XM_Body_Dirty_Words 45665 12.50 18.38 9.72 27 TooManyTo_001 44562 8.87 7.57 9.48 28 LotsOfNums_01 42348 8.03 5.94 9.01 29 BAYES_60 40192 7.93 6.62 8.55 30 RCVD_IN_RP_SAFE 35866 6.76 4.91 7.63 31 LOTS_OF_MONEY 35469 9.00 12.07 7.55 32 T_XMDrugObfuBody_14 34812 8.23 9.97 7.41 33 HTML_IMAGE_RATIO_02 34067 10.12 16.17 7.25 34 RCVD_IN_RP_CERTIFIED 33781 6.17 4.03 7.19 35 XM_Evil_Numbers_Gen 31515 8.98 13.77 6.71 36 TR_DCC_Bayes_99 30057 14.87 32.75 6.40 37 RCVD_IN_IADB_LISTED 29397 4.74 1.53 6.26 38 MIME_QP_LONG_LINE 29245 5.10 2.74 6.22 39 DKIM_INVALID 27088 6.02 6.54 5.76 40 ANY_BOUNCE_MESSAGE 26291 4.11 0.97 5.60 41 BOUNCE_MESSAGE 26289 4.11 0.97 5.59 42 BAYES_00 26273 4.32 1.65 5.59 43 RCVD_IN_IADB_SPF 25779 4.16 1.36 5.49 44 XM_H_Long_From01 25073 6.21 8.06 5.34 45 XM_PDF 25017 3.90 0.88 5.32 46 FSL_BULK_SIG 24629 7.83 13.30 5.24 47 RCVD_IN_MSPIKE_H2 23065 4.59 3.92 4.91 48 BAYES_80 22986 5.98 8.28 4.89 49 BOTNET_IPINHOSTNAME 22913 7.63 13.44 4.88 50 RCVD_IN_IADB_SENDERID 22517 3.67 1.29 4.79 51 RELAYCOUNTRY_META 22341 8.63 16.81 4.75 52 RCVD_IN_IADB_DK 22325 3.63 1.28 4.75 53 HTML_IMAGE_RATIO_04 21798 6.33 9.90 4.64 54 XMSubMetaSx_00 20922 5.22 6.83 4.45 55 XM_SendGrid 20612 4.45 4.59 4.39 56 XM_B_Phish_Phrases 20383 5.92 9.27 4.34 57 TooManyTo_002 19826 3.26 1.23 4.22 58 RCVD_IN_IADB_VOUCHED 19162 3.07 0.93 4.08 59 T_REMOTE_IMAGE 19142 4.32 4.83 4.07 60 IN_ZIMBRA_NJ_WHITELIST 18343 2.66 0.05 3.90 61 UNPARSEABLE_RELAY 18110 3.11 1.53 3.85 62 T_TooManySym_01 17573 3.45 2.82 3.74 63 TVD_RCVD_IP 17473 2.59 0.21 3.72 64 XMStrtUSub 16257 3.91 4.87 3.46 65 TooManyTo_003 16105 2.68 1.10 3.43 66 TR_XM_DK_Bayes 15248 2.64 1.35 3.24 67 TR_XM_DocInvoice 15163 5.02 8.81 3.23 68 BAYES_95 14902 3.70 4.80 3.17 69 XMNumbers 14874 3.51 4.23 3.17 70 HTML_IMAGE_RATIO_06 14595 3.56 4.53 3.11 71 BAYES_40 14450 2.52 1.35 3.08 72 TR_XM_DK_Bayes1 14081 2.43 1.22 3.00 73 XM_UncommonTLD01 13925 4.49 7.72 2.96 74 FROM_EXCESS_BASE64 13921 4.73 8.45 2.96 75 HTML_MIME_NO_HTML_TAG 12798 3.01 3.62 2.72 76 RCVD_IN_IADB_OPTIN 12259 1.98 0.64 2.61 77 TR_XM_DK_Bayes2 12228 2.15 1.19 2.60 78 MPART_ALT_DIFF 11774 4.10 7.47 2.51 79 MAILING_LIST_MULTI 11509 2.17 1.57 2.45 80 XMSexyCombo_05 11407 4.63 9.29 2.43 81 MIME_HTML_MOSTLY 10072 2.96 4.68 2.14 82 RCVD_IN_MSPIKE_WL 10045 1.62 0.54 2.14 83 RCVD_IN_MSPIKE_H3 10036 1.61 0.51 2.14 84 BAYES_20 9872 1.80 1.15 2.10 85 XM_DK_Undo_01 9374 1.75 1.23 1.99 86 HELO_NODOT 9127 1.43 0.34 1.94 87 TM2_M_URI_OPT_OUT 8929 2.73 4.48 1.90 88 HTML_IMAGE_RATIO_08 8835 2.30 3.18 1.88 89 XMDiploma_00 8428 2.03 2.53 1.79 90 SUBJ_ALL_CAPS 8198 2.06 2.71 1.74 91 IN_HORDE_ADDRESS_BOOK 8184 1.26 0.25 1.74 92 XM_H_PHPOS 8159 1.46 0.89 1.74 93 XM_CamelCaseFrm001 8132 2.07 2.79 1.73 94 XM_SPF_SoftFail 8051 2.33 3.64 1.71 95 T_XMDrugObfuBody_08 7925 1.99 2.63 1.69 96 XM_DIRTYINTL 7511 2.34 3.92 1.60 97 URI_TRY_3LD 7406 1.60 1.64 1.58 98 TR_Symld_Words 7312 1.38 1.02 1.56 99 T_TooManySym_02 7232 1.27 0.71 1.54 100 URI_HEX 7202 2.18 3.55 1.53 101 XMCapTrack 7119 1.24 0.67 1.52 102 INVALID_MSGID 6504 1.09 0.46 1.38 103 RELAYCOUNTRY_CA 6137 1.98 3.40 1.31 104 BAYES_05 5974 1.07 0.64 1.27 105 TO_MALFORMED 5969 0.95 0.28 1.27 106 XM_GoogleGroups 5932 1.02 0.50 1.26 107 XM_ProductURIs 5845 1.22 1.17 1.24 108 TooManyTo_004 5840 1.05 0.65 1.24 109 USER_IN_DEF_DKIM_WL 5437 0.80 0.04 1.16 110 XMPhish11 5421 1.25 1.46 1.15 111 XM_OfRef6 5397 1.97 3.72 1.15 112 UNTRUSTED_Relay 5305 4.03 10.15 1.13 113 DKIM_ADSP_CUSTOM_MED 5266 0.98 0.67 1.12 114 MIME_HTML_ONLY_MULTI 5226 1.90 3.58 1.11 115 BOTNET 5095 5.18 13.82 1.08 116 XMGenDplmaNmb 5039 1.20 1.47 1.07 117 XMLngstWrd_00 4975 0.82 0.33 1.06 118 TooManyTo_005 4763 0.87 0.57 1.01 119 URI_WP_HACKED_2 4737 0.89 0.65 1.01 120 RELAYCOUNTRY_GB 4731 1.01 1.03 1.01 121 NO_DNS_FOR_FROM 4664 1.15 1.48 0.99 122 T_FILL_THIS_FORM_SHORT 4472 1.12 1.49 0.95 123 XMLngstWrd_01 4359 0.73 0.31 0.93 124 MY_SERVERS_FOUND 4184 0.69 0.26 0.89 125 XM_H_Long_From02 4131 0.99 1.24 0.88 126 IMPOTENCE 4110 0.75 0.48 0.87 127 TO_NO_BRKTS_HTML_ONLY 3777 0.59 0.15 0.80 128 TM2_M_VERY_LONG_WORD 3688 0.97 1.36 0.78 129 NML_ADSP_CUSTOM_MED 3641 0.73 0.62 0.77 130 XMDateMe_00 3557 0.65 0.41 0.76 131 T_XMHurry_00 3500 1.01 1.59 0.74 132 SpammyFromTLD_01 3499 0.96 1.42 0.74 133 TR_MetaPhish_Combo_01 3457 0.98 1.48 0.74 134 XMNoVowels 3359 0.69 0.62 0.71 135 XM_UB50 3297 1.97 4.65 0.70 136 XMBdyGiftCard01 3279 1.00 1.64 0.70 137 T_OBFU_PDF_ATTACH 3260 0.53 0.20 0.69 138 XM_ShortIntro_01 3210 0.61 0.47 0.68 139 MISSING_HEADERS 3192 1.24 2.43 0.68 140 TM2_M_BODY_EMPTY 3111 0.49 0.14 0.66 141 KHOP_DYNAMIC 3005 0.65 0.66 0.64 142 FORGED_GMAIL_RCVD 2956 0.61 0.56 0.63 143 XMStockSpam_06 2880 0.81 1.23 0.61 144 RCVD_IN_BL_SPAMCOP_NET 2872 1.18 2.37 0.61 145 XMSubMetaI_00 2812 0.93 1.63 0.60 146 T_Symld_Words_02 2810 0.74 1.05 0.60 147 REMOVE_BEFORE_LINK 2716 0.69 0.93 0.58 148 T_TooManySym_03 2694 0.44 0.16 0.57 149 USER_IN_WHITELIST 2660 0.38 0.00 0.57 150 XM_H_PHPMailer 2626 0.58 0.63 0.56 151 XMSubMetaSxObfu_02 2599 0.48 0.31 0.55 152 HTML_TAG_BALANCE_BODY 2513 0.75 1.22 0.53 153 XMGappySubj_01 2501 0.48 0.36 0.53 154 ONLINE_PHARMACY 2470 0.44 0.26 0.53 155 XMLngstWrd_02 2469 0.44 0.25 0.53 156 SHORT_HELO_AND_INLINE_IMAGE 2450 0.38 0.08 0.52 157 HTTPS_HTTP_MISMATCH 2393 0.82 1.47 0.51 158 RELAYCOUNTRY_AU 2388 0.56 0.66 0.51 159 XMHTMLBadTable_001 2334 0.65 0.97 0.50 160 T_XMDrugObfuBody_00 2249 0.69 1.13 0.48 161 RELAYCOUNTRY_DE 2243 0.55 0.69 0.48 162 XMMoneyMeta_00 2219 0.60 0.88 0.47 163 HTML_IMAGE_ONLY_32 2214 0.40 0.24 0.47 164 XMBody_95 2192 0.35 0.12 0.47 165 XMSubMetaSxObfu_03 2164 0.72 1.28 0.46 166 TR_XM_RelayPhish 2146 0.83 1.61 0.46 167 XMSubMetaSSx_00 2145 0.49 0.57 0.46 168 XMSlimDrugH 2127 0.60 0.92 0.45 169 XM_B_COPY_HTML 2126 0.49 0.56 0.45 170 URI_NOVOWEL 2037 0.60 0.94 0.43 171 HTML_FONT_FACE_BAD 2024 0.59 0.92 0.43 172 XM_USANA_RCVD 2024 0.29 0.00 0.43 173 XM_B_REG_HTML 2007 0.56 0.86 0.43 174 AC_DIV_BONANZA 1983 0.35 0.19 0.42 175 XMBrknScrpt_02 1977 0.50 0.67 0.42 176 XM_D_tchamptons_WL 1969 0.29 0.00 0.42 177 RCVD_IN_SORBS_DUL 1945 0.35 0.21 0.41 178 XMHTML_After_End 1937 0.74 1.42 0.41 179 TVD_VISIT_PHARMA 1916 0.36 0.24 0.41 180 RDNS_DYNAMIC 1889 0.62 1.09 0.40 181 XMSexyCombo_01 1847 0.88 1.90 0.39 182 XMBody_17 1820 0.71 1.39 0.39 183 PLING_QUERY 1777 0.60 1.06 0.38 184 HTML_IMAGE_ONLY_28 1739 0.44 0.59 0.37 185 HTML_IMAGE_ONLY_16 1675 0.60 1.12 0.36 186 XMPhish30 1659 0.58 1.07 0.35 187 XMEmptyBody_01 1657 0.26 0.06 0.35 188 XM_Body_Obfu01 1617 0.44 0.64 0.34 189 XMPhish14 1611 0.70 1.45 0.34 190 TVD_SPACE_RATIO 1608 0.38 0.45 0.34 191 XM_S_JOY_D 1602 0.43 0.62 0.34 192 DKIM_ADSP_NXDOMAIN 1532 0.44 0.70 0.33 193 XMBody_78 1504 0.51 0.92 0.32 194 HTML_IMAGE_ONLY_24 1487 0.33 0.36 0.32 195 FILL_THIS_FORM 1485 0.39 0.56 0.32 196 TM2_M_A_HREF_HREF 1467 0.41 0.60 0.31 197 HTML_IMAGE_ONLY_20 1465 0.31 0.30 0.31 198 XMSubNoVowel 1457 0.45 0.76 0.31 199 XMSolicitRefs_0 1404 0.29 0.28 0.30 200 XMLngstWrd_03 1393 0.26 0.17 0.30 ----------------------------------------------------------------------