Email: 651354 Autolearn: 0 AvgScore: 3.66 AvgScanTime: 3.53 sec Spam: 194308 Autolearn: 0 AvgScore: 13.26 AvgScanTime: 4.04 sec Ham: 457046 Autolearn: 0 AvgScore: -0.43 AvgScanTime: 3.32 sec Time Spent Running SA: 638.99 hours Time Spent Processing Spam: 218.10 hours Time Spent Processing Ham: 420.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 182147 85.39 93.74 81.84 2 DKIM_SIGNED 136354 70.54 70.17 70.69 3 DCC_CHECK 135494 45.27 69.73 34.87 4 XM_DK_Pass 131401 68.84 67.63 69.36 5 DKIM_VALID 125619 64.76 64.65 64.80 6 XMListUnsubscribeExists 117173 50.55 60.30 46.40 7 DKIM_VALID_AU 101473 48.37 52.22 46.73 8 XM_H_QuotedFrom 97736 39.10 50.30 34.34 9 BAYES_50 77383 52.40 39.82 57.75 10 MIME_HTML_ONLY 76272 24.09 39.25 17.65 11 XM_DK_Undo_02 62562 15.83 32.20 8.87 12 HTML_FONT_LOW_CONTRAST 60858 26.22 31.32 24.06 13 LOC_TINY_FONT_1 58705 23.00 30.21 19.94 14 BAYES_99 57573 14.39 29.63 7.91 15 DCC_CHECK_NEGATIVE 55720 52.86 28.68 63.13 16 XMSubLong 46327 21.24 23.84 20.14 17 TR_DCC_Bayes_99 46253 9.71 23.80 3.71 18 BAYES_999 46218 11.66 23.79 6.50 19 T_TM2_M_HEADER_IN_MSG 45158 29.81 23.24 32.61 20 FVGT_m_MULTI_ODD 42717 20.57 21.98 19.97 21 DKIM_VALID_EF 41802 24.31 21.51 25.51 22 BOTNET 37824 6.82 19.47 1.45 23 FROM_EXCESS_BASE64 36468 7.87 18.77 3.24 24 RELAYCOUNTRY_META 36153 9.52 18.61 5.66 25 XM_Body_Dirty_Words 35997 13.58 18.53 11.47 26 T_KAM_HTML_FONT_INVALID 32791 15.64 16.88 15.11 27 MISSING_HEADERS 32524 5.68 16.74 0.97 28 RCVD_IN_RP_RNBL 32152 4.95 16.55 0.03 29 LOTS_OF_MONEY 31583 10.28 16.25 7.74 30 MultiRelay 30892 18.91 15.90 20.19 31 T_REMOTE_IMAGE 29486 7.28 15.17 3.92 32 HTML_MIME_NO_HTML_TAG 29253 6.22 15.05 2.47 33 FSL_BULK_SIG 26872 8.92 13.83 6.84 34 HTML_IMAGE_RATIO_02 26781 8.87 13.78 6.78 35 BODY_URI_ONLY 26677 4.19 13.73 0.14 36 XM_Multi_Part_URI 26162 11.85 13.46 11.16 37 XM_UncommonTLD01 25535 7.62 13.14 5.28 38 HTML_SHORT_LINK_IMG_1 25184 3.89 12.96 0.03 39 MIME_HEADER_CTYPE_ONLY 24935 3.95 12.83 0.17 40 T_XMDrugObfuBody_14 24262 9.14 12.49 7.72 41 XM_Evil_Numbers_Gen 24076 8.78 12.39 7.24 42 HTML_IMAGE_ONLY_04 23786 3.70 12.24 0.07 43 TR_XM_DocInvoice 22628 6.02 11.65 3.62 44 UNTRUSTED_Relay 21605 4.28 11.12 1.37 45 BOTNET_IPINHOSTNAME 21088 6.75 10.85 5.00 46 BAYES_80 20987 5.72 10.80 3.55 47 HTML_SHORT_CENTER 20447 3.14 10.52 0.01 48 XMSexyCombo_05 20434 5.93 10.52 3.98 49 BAYES_60 20223 7.17 10.41 5.80 50 SpammyFromTLD_02 19851 3.19 10.22 0.20 51 XM_H_Long_From01 16475 6.32 8.48 5.40 52 T_XMDrugObfuBody_08 14718 3.34 7.57 1.54 53 XM_OfRef6 14637 3.34 7.53 1.55 54 XMNumbers 14353 5.95 7.39 5.34 55 XM_B_Phish_Phrases 13856 5.45 7.13 4.73 56 HTML_IMAGE_RATIO_04 13803 5.56 7.10 4.90 57 XMSubMetaSx_00 13232 5.30 6.81 4.66 58 MPART_ALT_DIFF 12278 3.56 6.32 2.39 59 SUBJ_ALL_CAPS 12230 4.25 6.29 3.38 60 TooManyTo_001 11940 8.19 6.14 9.06 61 XM_OfRef7 11008 1.99 5.67 0.42 62 DKIM_INVALID 10735 5.78 5.52 5.89 63 RELAYCOUNTRY_FR 10575 1.81 5.44 0.27 64 ALL_TRUSTED 10459 15.68 5.38 20.05 65 BAYES_95 10358 3.22 5.33 2.32 66 XM_DIRTYINTL 10015 2.91 5.15 1.96 67 XMStockSpam_06 9662 2.56 4.97 1.54 68 XMStrtUSub 9463 4.50 4.87 4.34 69 LotsOfNums_01 9391 7.07 4.83 8.02 70 TR_LOTS_OF_MONEY1 9249 1.43 4.76 0.02 71 XM_UB50 9201 1.99 4.74 0.82 72 TM2_M_URI_OPT_OUT 7819 2.48 4.02 1.82 73 REPLYTO_WITHOUT_TO_CC 7572 1.26 3.90 0.14 74 XMBody_106 7465 1.32 3.84 0.24 75 MIME_HTML_MOSTLY 7185 2.64 3.70 2.19 76 MIME_HTML_ONLY_MULTI 6730 1.88 3.46 1.21 77 HTML_IMAGE_RATIO_06 6709 3.21 3.45 3.10 78 XM_SendGrid 6395 4.54 3.29 5.07 79 RELAYCOUNTRY_CA 6372 2.14 3.28 1.66 80 XM_SPF_SoftFail 6165 3.05 3.17 2.99 81 XMSubMetaI_00 5848 1.35 3.01 0.64 82 URI_HEX 5738 1.88 2.95 1.42 83 MultiRelay_CC 5715 1.01 2.94 0.19 84 MultiRelay_Combo 5715 1.01 2.94 0.19 85 DIET_1 5594 1.13 2.88 0.38 86 RCVD_IN_MSPIKE_H2 5301 4.01 2.73 4.56 87 RCVD_IN_BL_SPAMCOP_NET 4892 0.93 2.52 0.25 88 XM_CamelCaseFrm001 4838 1.83 2.49 1.54 89 MIME_QP_LONG_LINE 4831 5.10 2.49 6.21 90 XMDiploma_00 4749 2.13 2.44 1.99 91 T_TooManySym_01 4731 4.44 2.43 5.29 92 XMBody_17 4600 1.10 2.37 0.56 93 XM_UB60 4542 0.75 2.34 0.08 94 HTML_IMAGE_RATIO_08 4143 1.92 2.13 1.84 95 RELAYCOUNTRY_GB 4055 1.65 2.09 1.47 96 T_XMDrugObfuBody_00 3888 1.08 2.00 0.69 97 XM_URI_RBL 3728 0.79 1.92 0.31 98 XMSlimDrugH 3542 0.74 1.82 0.27 99 URG_BIZ 3537 0.56 1.82 0.02 100 MONEY_FRAUD_8 3534 0.70 1.82 0.22 101 FILL_THIS_FORM 3506 0.88 1.80 0.48 102 RELAYCOUNTRY_DE 3501 0.93 1.80 0.56 103 XM_UB80 3357 0.57 1.73 0.08 104 T_FILL_THIS_FORM_LONG 3333 0.78 1.72 0.38 105 RCVD_IN_RP_SAFE 3302 6.67 1.70 8.78 106 T_FILL_THIS_FORM_LOAN 3209 0.75 1.65 0.37 107 XMMoneyMeta_00 3150 0.84 1.62 0.51 108 XMGenDplmaNmb 3114 1.25 1.60 1.10 109 T_XMHurry_00 3086 0.93 1.59 0.65 110 RDNS_DYNAMIC 3048 0.78 1.57 0.44 111 MAILING_LIST_MULTI 2980 2.31 1.53 2.64 112 UNPARSEABLE_RELAY 2965 2.92 1.53 3.51 113 TR_XM_RelayPhish 2933 0.76 1.51 0.45 114 TR_Mismatch_TLD_01 2858 0.52 1.47 0.11 115 TR_LOTS_OF_MONEY2 2851 0.69 1.47 0.35 116 T_MONEY_PERCENT 2851 0.69 1.47 0.35 117 XMHTML_After_End 2800 0.73 1.44 0.43 118 RELAYCOUNTRY_CN 2775 0.46 1.43 0.05 119 URI_TRY_3LD 2769 0.95 1.43 0.74 120 PLING_QUERY 2763 0.68 1.42 0.36 121 TM2_M_VERY_LONG_WORD 2757 1.07 1.42 0.92 122 RCVD_IN_RP_CERTIFIED 2645 6.23 1.36 8.30 123 XMBdyGiftCard01 2634 1.23 1.36 1.18 124 BAYES_40 2614 3.52 1.35 4.44 125 XM_H_Long_From02 2588 1.11 1.33 1.02 126 XMSexyCombo_01 2581 1.28 1.33 1.25 127 SpammyFromTLD_01 2571 2.36 1.32 2.81 128 XM_OfRef8 2560 0.41 1.32 0.03 129 SUBJ_DOLLARS 2558 0.51 1.32 0.17 130 T_FILL_THIS_FORM_FRAUD_PHISH 2490 0.45 1.28 0.09 131 TR_Caps_n_Bayes_99 2429 0.38 1.25 0.02 132 XMWghtMeta_00 2414 0.38 1.24 0.02 133 BAYES_20 2399 3.00 1.23 3.75 134 BOTNET_NORDNS 2353 0.38 1.21 0.02 135 HELO_NODOT 2350 1.82 1.21 2.08 136 XM_BadFromFormat 2278 0.46 1.17 0.15 137 TR_Symld_Words 2259 1.42 1.16 1.53 138 RCVD_IN_IADB_LISTED 2199 4.18 1.13 5.48 139 DKIM_ADSP_CUSTOM_MED 2182 1.05 1.12 1.02 140 XMWarranty1 2160 0.33 1.11 0.00 141 HTML_FONT_SIZE_LARGE 2158 0.43 1.11 0.15 142 T_Symld_Words_02 2147 0.56 1.10 0.33 143 URIBL_BLACK 2129 0.37 1.10 0.06 144 XM_H_PHPOS 2100 2.47 1.08 3.06 145 XM_ProductURIs 2076 1.01 1.07 0.99 146 XM_DK_Undo_01 2073 1.82 1.07 2.13 147 NML_ADSP_CUSTOM_MED 2069 0.83 1.06 0.72 148 XMPhish11 2066 1.08 1.06 1.09 149 TR_LOTS_OF_MONEY3 2016 0.51 1.04 0.29 150 FSL_HELO_NON_FQDN_1 1986 0.34 1.02 0.04 151 XMBody_78 1920 0.54 0.99 0.35 152 XMPhish30 1902 0.50 0.98 0.30 153 RCVD_IN_IADB_SPF 1898 3.74 0.98 4.92 154 XMPhish14 1831 0.54 0.94 0.37 155 XM_UB99 1817 0.29 0.94 0.02 156 URIBL_DBL_SPAM 1816 0.32 0.93 0.06 157 RCVD_IN_IADB_SENDERID 1797 3.12 0.92 4.05 158 RCVD_IN_IADB_DK 1793 3.36 0.92 4.40 159 DKIM_ADSP_NXDOMAIN 1773 0.59 0.91 0.46 160 REMOVE_BEFORE_LINK 1766 0.47 0.91 0.28 161 XM_PDF 1758 3.65 0.90 4.81 162 T_TooManySym_02 1745 1.51 0.90 1.77 163 URI_NOVOWEL 1712 0.57 0.88 0.44 164 LONG_JUNK_URI 1703 0.29 0.88 0.04 165 RELAYCOUNTRY_AT 1660 0.38 0.85 0.18 166 HTML_FONT_FACE_BAD 1659 0.52 0.85 0.38 167 XMSubNoVowel 1644 0.50 0.85 0.35 168 HTTPS_HTTP_MISMATCH 1643 0.56 0.85 0.44 169 BAYES_00 1628 8.34 0.84 11.53 170 THIS_AD 1594 0.35 0.82 0.15 171 XMSlimDrugs 1566 0.25 0.81 0.02 172 XM_H_PHPMailer 1524 0.73 0.78 0.71 173 LONG_JUNK_URI3 1519 0.25 0.78 0.03 174 HTML_IMAGE_ONLY_08 1515 0.31 0.78 0.11 175 T_HTML_TAG_BALANCE_CENTER 1512 0.31 0.78 0.12 176 BODY_ENHANCEMENT 1511 0.25 0.78 0.02 177 ANY_BOUNCE_MESSAGE 1484 2.75 0.76 3.60 178 BOUNCE_MESSAGE 1469 2.75 0.76 3.59 179 HTML_TAG_BALANCE_BODY 1456 0.50 0.75 0.40 180 RELAYCOUNTRY_IN 1435 0.28 0.74 0.09 181 XM_UB95 1417 0.25 0.73 0.05 182 NO_PRESCRIPTION 1415 0.22 0.73 0.00 183 RCVD_IN_IADB_VOUCHED 1409 2.73 0.73 3.59 184 MIME_CHARSET_FARAWAY 1407 0.30 0.72 0.12 185 HTML_COMMENT_SAVED_URL 1397 0.24 0.72 0.03 186 BANG_GUAR 1392 0.23 0.72 0.03 187 XM_Body_Obfu01 1372 0.37 0.71 0.23 188 XM_B_COPY_HTML 1370 0.53 0.71 0.46 189 DATE_IN_PAST_03_06 1359 0.29 0.70 0.12 190 LongTLD 1356 0.35 0.70 0.21 191 CHARSET_FARAWAY_HEADER 1349 0.25 0.69 0.05 192 XM_H_Undi_Recip 1347 0.39 0.69 0.27 193 XMSubMetaSxObfu_03 1323 0.53 0.68 0.46 194 XM_GoogleGroups 1322 1.09 0.68 1.27 195 XMBrknScrpt_02 1300 0.60 0.67 0.57 196 TooManyTo_002 1288 2.25 0.66 2.92 197 GUARANTEED_100_PERCENT 1274 0.20 0.66 0.01 198 TR_Mismatch_TLD_02 1244 0.23 0.64 0.06 199 T_FILL_THIS_FORM_SHORT 1240 0.84 0.64 0.92 200 TR_XM_DK_Bayes 1227 5.84 0.63 8.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 374052 85.39 93.74 81.84 2 DKIM_SIGNED 323095 70.54 70.17 70.69 3 XM_DK_Pass 317007 68.84 67.63 69.36 4 DKIM_VALID 296187 64.76 64.65 64.80 5 DCC_CHECK_NEGATIVE 288554 52.86 28.68 63.13 6 BAYES_50 263933 52.40 39.82 57.75 7 DKIM_VALID_AU 213588 48.37 52.22 46.73 8 XMListUnsubscribeExists 212088 50.55 60.30 46.40 9 DCC_CHECK 159365 45.27 69.73 34.87 10 XM_H_QuotedFrom 156936 39.10 50.30 34.34 11 T_TM2_M_HEADER_IN_MSG 149026 29.81 23.24 32.61 12 DKIM_VALID_EF 116573 24.31 21.51 25.51 13 HTML_FONT_LOW_CONTRAST 109945 26.22 31.32 24.06 14 MultiRelay 92270 18.91 15.90 20.19 15 XMSubLong 92041 21.24 23.84 20.14 16 ALL_TRUSTED 91643 15.68 5.38 20.05 17 FVGT_m_MULTI_ODD 91280 20.57 21.98 19.97 18 LOC_TINY_FONT_1 91138 23.00 30.21 19.94 19 MIME_HTML_ONLY 80657 24.09 39.25 17.65 20 T_KAM_HTML_FONT_INVALID 69057 15.64 16.88 15.11 21 XM_DKIMWhitelistDomains 56939 8.76 0.07 12.46 22 BAYES_00 52715 8.34 0.84 11.53 23 XM_Body_Dirty_Words 52444 13.58 18.53 11.47 24 XM_Multi_Part_URI 51021 11.85 13.46 11.16 25 TooManyTo_001 41411 8.19 6.14 9.06 26 XM_DK_Undo_02 40560 15.83 32.20 8.87 27 RCVD_IN_RP_SAFE 40139 6.67 1.70 8.78 28 RCVD_IN_RP_CERTIFIED 37943 6.23 1.36 8.30 29 TR_XM_DK_Bayes 36793 5.84 0.63 8.05 30 LotsOfNums_01 36667 7.07 4.83 8.02 31 BAYES_99 36168 14.39 29.63 7.91 32 LOTS_OF_MONEY 35383 10.28 16.25 7.74 33 T_XMDrugObfuBody_14 35290 9.14 12.49 7.72 34 TR_XM_DK_Bayes1 33849 5.37 0.59 7.41 35 XM_Evil_Numbers_Gen 33106 8.78 12.39 7.24 36 FSL_BULK_SIG 31247 8.92 13.83 6.84 37 HTML_IMAGE_RATIO_02 30981 8.87 13.78 6.78 38 BAYES_999 29721 11.66 23.79 6.50 39 TR_XM_DK_Bayes2 29506 4.70 0.56 6.46 40 MIME_QP_LONG_LINE 28403 5.10 2.49 6.21 41 DKIM_INVALID 26908 5.78 5.52 5.89 42 BAYES_60 26486 7.17 10.41 5.80 43 RELAYCOUNTRY_META 25874 9.52 18.61 5.66 44 RCVD_IN_IADB_LISTED 25053 4.18 1.13 5.48 45 XM_H_Long_From01 24688 6.32 8.48 5.40 46 XMNumbers 24426 5.95 7.39 5.34 47 T_TooManySym_01 24163 4.44 2.43 5.29 48 XM_UncommonTLD01 24115 7.62 13.14 5.28 49 XM_SendGrid 23188 4.54 3.29 5.07 50 BOTNET_IPINHOSTNAME 22853 6.75 10.85 5.00 51 RCVD_IN_IADB_SPF 22479 3.74 0.98 4.92 52 HTML_IMAGE_RATIO_04 22380 5.56 7.10 4.90 53 XM_PDF 21990 3.65 0.90 4.81 54 XM_B_Phish_Phrases 21628 5.45 7.13 4.73 55 XMSubMetaSx_00 21297 5.30 6.81 4.66 56 RCVD_IN_MSPIKE_H2 20846 4.01 2.73 4.56 57 BAYES_40 20300 3.52 1.35 4.44 58 RCVD_IN_IADB_DK 20091 3.36 0.92 4.40 59 XMStrtUSub 19855 4.50 4.87 4.34 60 RCVD_IN_IADB_SENDERID 18499 3.12 0.92 4.05 61 XMSexyCombo_05 18194 5.93 10.52 3.98 62 IN_ZIMBRA_NJ_WHITELIST 18097 2.78 0.02 3.96 63 T_REMOTE_IMAGE 17934 7.28 15.17 3.92 64 BAYES_20 17145 3.00 1.23 3.75 65 TR_DCC_Bayes_99 16966 9.71 23.80 3.71 66 TR_XM_DocInvoice 16557 6.02 11.65 3.62 67 ANY_BOUNCE_MESSAGE 16433 2.75 0.76 3.60 68 BOUNCE_MESSAGE 16428 2.75 0.76 3.59 69 RCVD_IN_IADB_VOUCHED 16387 2.73 0.73 3.59 70 BAYES_80 16239 5.72 10.80 3.55 71 UNPARSEABLE_RELAY 16034 2.92 1.53 3.51 72 SUBJ_ALL_CAPS 15437 4.25 6.29 3.38 73 FROM_EXCESS_BASE64 14815 7.87 18.77 3.24 74 HTML_IMAGE_RATIO_06 14191 3.21 3.45 3.10 75 TVD_RCVD_IP 13982 2.19 0.13 3.06 76 XM_H_PHPOS 13968 2.47 1.08 3.06 77 XM_SPF_SoftFail 13676 3.05 3.17 2.99 78 BAYES_05 13468 2.24 0.59 2.95 79 TooManyTo_002 13335 2.25 0.66 2.92 80 TO_MALFORMED 12960 2.07 0.27 2.84 81 SpammyFromTLD_01 12823 2.36 1.32 2.81 82 MAILING_LIST_MULTI 12082 2.31 1.53 2.64 83 HTML_MIME_NO_HTML_TAG 11276 6.22 15.05 2.47 84 MPART_ALT_DIFF 10910 3.56 6.32 2.39 85 BAYES_95 10592 3.22 5.33 2.32 86 MIME_HTML_MOSTLY 10020 2.64 3.70 2.19 87 XM_DK_Undo_01 9754 1.82 1.07 2.13 88 HELO_NODOT 9492 1.82 1.21 2.08 89 TooManyTo_003 9308 1.59 0.54 2.04 90 RCVD_IN_MSPIKE_WL 9264 1.58 0.53 2.03 91 RCVD_IN_MSPIKE_H3 9260 1.58 0.52 2.03 92 XMDiploma_00 9103 2.13 2.44 1.99 93 XM_DIRTYINTL 8966 2.91 5.15 1.96 94 RCVD_IN_IADB_OPTIN 8853 1.51 0.50 1.94 95 HTML_IMAGE_RATIO_08 8394 1.92 2.13 1.84 96 TM2_M_URI_OPT_OUT 8303 2.48 4.02 1.82 97 T_TooManySym_02 8067 1.51 0.90 1.77 98 XMCapTrack 7676 1.29 0.39 1.68 99 RELAYCOUNTRY_CA 7588 2.14 3.28 1.66 100 IN_HORDE_ADDRESS_BOOK 7547 1.17 0.04 1.65 101 INVALID_MSGID 7236 1.20 0.29 1.58 102 TooManyTo_004 7170 1.22 0.39 1.57 103 XM_OfRef6 7107 3.34 7.53 1.55 104 XM_CamelCaseFrm001 7054 1.83 2.49 1.54 105 T_XMDrugObfuBody_08 7020 3.34 7.57 1.54 106 XMStockSpam_06 7016 2.56 4.97 1.54 107 TR_Symld_Words 6981 1.42 1.16 1.53 108 RELAYCOUNTRY_GB 6722 1.65 2.09 1.47 109 BOTNET 6618 6.82 19.47 1.45 110 URI_HEX 6512 1.88 2.95 1.42 111 UNTRUSTED_Relay 6255 4.28 11.12 1.37 112 TR_MetaPhish_Combo_01 6203 1.11 0.51 1.36 113 TooManyTo_005 5924 1.01 0.34 1.30 114 XM_GoogleGroups 5810 1.09 0.68 1.27 115 XMSexyCombo_01 5724 1.28 1.33 1.25 116 USER_IN_DEF_DKIM_WL 5645 0.89 0.08 1.24 117 MIME_HTML_ONLY_MULTI 5540 1.88 3.46 1.21 118 XMBdyGiftCard01 5410 1.23 1.36 1.18 119 XMGenDplmaNmb 5029 1.25 1.60 1.10 120 XMPhish11 5000 1.08 1.06 1.09 121 XM_H_Long_From02 4666 1.11 1.33 1.02 122 DKIM_ADSP_CUSTOM_MED 4642 1.05 1.12 1.02 123 XM_ProductURIs 4533 1.01 1.07 0.99 124 MISSING_HEADERS 4442 5.68 16.74 0.97 125 T_FILL_THIS_FORM_SHORT 4214 0.84 0.64 0.92 126 TM2_M_VERY_LONG_WORD 4193 1.07 1.42 0.92 127 XM_UB50 3766 1.99 4.74 0.82 128 XMSolicitRefs_0 3718 0.68 0.36 0.81 129 XMSexyCombo_04 3427 0.71 0.62 0.75 130 URI_TRY_3LD 3394 0.95 1.43 0.74 131 TM2_M_BODY_EMPTY 3363 0.56 0.14 0.74 132 NML_ADSP_CUSTOM_MED 3305 0.83 1.06 0.72 133 XM_H_PHPMailer 3245 0.73 0.78 0.71 134 T_XMDrugObfuBody_00 3157 1.08 2.00 0.69 135 XMNoVowels 3128 0.58 0.33 0.68 136 XMLngstWrd_00 3087 0.58 0.35 0.68 137 XM_B_REG_HTML 3015 0.57 0.38 0.66 138 TM2_M_A_HREF_HREF 2982 0.59 0.44 0.65 139 T_XMHurry_00 2961 0.93 1.59 0.65 140 XMSubMetaI_00 2932 1.35 3.01 0.64 141 XMLngstWrd_01 2865 0.53 0.32 0.63 142 AC_DIV_BONANZA 2830 0.48 0.14 0.62 143 XMBody_95 2710 0.45 0.13 0.59 144 FORGED_GMAIL_RCVD 2650 0.57 0.56 0.58 145 XMBrknScrpt_02 2620 0.60 0.67 0.57 146 XMSubMetaSxObfu_02 2617 0.53 0.42 0.57 147 USER_IN_WHITELIST 2596 0.40 0.00 0.57 148 XMBody_17 2576 1.10 2.37 0.56 149 RELAYCOUNTRY_DE 2571 0.93 1.80 0.56 150 SHORT_HELO_AND_INLINE_IMAGE 2571 0.41 0.06 0.56 151 T_OBFU_PDF_ATTACH 2560 0.46 0.21 0.56 152 T_TooManySym_03 2435 0.42 0.16 0.53 153 XMMoneyMeta_00 2314 0.84 1.62 0.51 154 RELAYCOUNTRY_AU 2279 0.52 0.56 0.50 155 RCVD_IN_SORBS_DUL 2271 0.40 0.18 0.50 156 XM_ShortIntro_01 2254 0.48 0.44 0.49 157 FILL_THIS_FORM 2214 0.88 1.80 0.48 158 XMHTMLBadTable_001 2196 0.50 0.53 0.48 159 T_MANY_PILL_PRICE 2190 0.34 0.00 0.48 160 XMDateMe_00 2154 0.41 0.27 0.47 161 XMSubMetaSxObfu_03 2109 0.53 0.68 0.46 162 XM_B_COPY_HTML 2102 0.53 0.71 0.46 163 DKIM_ADSP_NXDOMAIN 2092 0.59 0.91 0.46 164 T_FROM_GOV_SPOOF 2070 0.40 0.26 0.45 165 TR_XM_RelayPhish 2045 0.76 1.51 0.45 166 RCVD_IN_IADB_UT_CPR_MAT 2033 0.31 0.00 0.44 167 HTTPS_HTTP_MISMATCH 2017 0.56 0.85 0.44 168 RDNS_DYNAMIC 2008 0.78 1.57 0.44 169 XMGappySubj_01 2001 0.41 0.34 0.44 170 URI_NOVOWEL 1995 0.57 0.88 0.44 171 XMHTML_After_End 1963 0.73 1.44 0.43 172 RCVD_IN_IADB_DOPTIN 1939 0.30 0.01 0.42 173 XM_OfRef7 1928 1.99 5.67 0.42 174 HTML_IMAGE_ONLY_32 1900 0.42 0.45 0.42 175 HTML_TAG_BALANCE_BODY 1813 0.50 0.75 0.40 176 XM_RXBody 1769 0.44 0.55 0.39 177 DIET_1 1759 1.13 2.88 0.38 178 T_FILL_THIS_FORM_LONG 1758 0.78 1.72 0.38 179 HTML_FONT_FACE_BAD 1715 0.52 0.85 0.38 180 XMPhish14 1700 0.54 0.94 0.37 181 T_FILL_THIS_FORM_LOAN 1698 0.75 1.65 0.37 182 HTML_IMAGE_ONLY_28 1673 0.39 0.43 0.37 183 PLING_QUERY 1662 0.68 1.42 0.36 184 TR_LOTS_OF_MONEY2 1620 0.69 1.47 0.35 185 T_MONEY_PERCENT 1620 0.69 1.47 0.35 186 XMSubNoVowel 1616 0.50 0.85 0.35 187 XMBody_78 1609 0.54 0.99 0.35 188 XM_H_PHPOS_M 1576 0.38 0.48 0.34 189 HTML_IMAGE_ONLY_24 1548 0.35 0.38 0.34 190 HTML_IMAGE_ONLY_16 1522 0.33 0.32 0.33 191 T_Symld_Words_02 1502 0.56 1.10 0.33 192 XMSubEmpty 1490 0.29 0.22 0.33 193 XM_H_Trusted_IP 1472 0.23 0.00 0.32 194 NO_DNS_FOR_FROM 1462 0.30 0.25 0.32 195 TR_MetaPhish_Combo_01b 1407 0.29 0.24 0.31 196 HTML_IMAGE_ONLY_20 1405 0.29 0.24 0.31 197 XM_URI_RBL 1394 0.79 1.92 0.31 198 T_FROM_GOV_DKIM_AU 1376 0.25 0.12 0.30 199 XMPhish30 1355 0.50 0.98 0.30 200 XM_S_JOY_D 1328 0.35 0.50 0.29 ----------------------------------------------------------------------