Email: 617039 Autolearn: 0 AvgScore: 2.02 AvgScanTime: 3.46 sec Spam: 143054 Autolearn: 0 AvgScore: 12.12 AvgScanTime: 3.85 sec Ham: 473985 Autolearn: 0 AvgScore: -1.02 AvgScanTime: 3.35 sec Time Spent Running SA: 593.31 hours Time Spent Processing Spam: 152.81 hours Time Spent Processing Ham: 440.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135954 89.28 95.04 87.54 2 DKIM_SIGNED 104887 72.60 73.32 72.38 3 DCC_CHECK 104311 46.95 72.92 39.11 4 XM_DK_Pass 100979 70.88 70.59 70.97 5 DKIM_VALID 94993 66.38 66.40 66.38 6 XMListUnsubscribeExists 91251 51.76 63.79 48.13 7 DKIM_VALID_AU 73917 49.07 51.67 48.28 8 XM_H_QuotedFrom 68144 41.41 47.64 39.53 9 BAYES_50 64172 55.15 44.86 58.25 10 HTML_FONT_LOW_CONTRAST 55624 29.03 38.88 26.06 11 MIME_HTML_ONLY 52770 23.34 36.89 19.25 12 XM_DK_Undo_02 47234 12.95 33.02 6.89 13 LOC_TINY_FONT_1 45719 23.76 31.96 21.29 14 BAYES_99 37579 10.14 26.27 5.27 15 DCC_CHECK_NEGATIVE 36720 51.17 25.67 58.86 16 XMSubLong 35954 21.29 25.13 20.13 17 RELAYCOUNTRY_META 35290 9.97 24.67 5.53 18 FVGT_m_MULTI_ODD 34190 21.43 23.90 20.68 19 TR_DCC_Bayes_99 31728 7.28 22.18 2.78 20 BAYES_999 31425 8.50 21.97 4.43 21 DKIM_VALID_EF 25378 24.02 17.74 25.92 22 UNTRUSTED_Relay 25351 5.14 17.72 1.34 23 XM_Body_Dirty_Words 24862 13.36 17.38 12.14 24 T_TM2_M_HEADER_IN_MSG 24655 28.40 17.23 31.77 25 BOTNET 24533 5.52 17.15 2.01 26 T_KAM_HTML_FONT_INVALID 23614 15.95 16.51 15.78 27 BOTNET_IPINHOSTNAME 22484 7.40 15.72 4.89 28 HTML_IMAGE_RATIO_02 20181 9.52 14.11 8.14 29 XM_Multi_Part_URI 19898 12.35 13.91 11.88 30 MultiRelay 19593 17.61 13.70 18.79 31 FROM_EXCESS_BASE64 19037 5.79 13.31 3.52 32 XM_Evil_Numbers_Gen 18386 9.72 12.85 8.78 33 FSL_BULK_SIG 18162 7.81 12.70 6.33 34 LOTS_OF_MONEY 17784 9.40 12.43 8.49 35 T_REMOTE_IMAGE 15588 5.77 10.90 4.23 36 HTML_MIME_NO_HTML_TAG 15341 4.42 10.72 2.51 37 XMSexyCombo_05 14070 5.36 9.84 4.01 38 RCVD_IN_RP_RNBL 13080 2.26 9.14 0.18 39 XM_UncommonTLD01 13048 4.65 9.12 3.30 40 MISSING_HEADERS 12832 2.54 8.97 0.60 41 XM_UB50 12798 2.70 8.95 0.81 42 T_XMDrugObfuBody_14 12306 8.04 8.60 7.86 43 BODY_URI_ONLY 12193 2.16 8.52 0.23 44 HTML_SHORT_LINK_IMG_1 12126 2.10 8.48 0.17 45 MIME_HEADER_CTYPE_ONLY 11375 2.07 7.95 0.29 46 MPART_ALT_DIFF 11363 4.27 7.94 3.17 47 XM_salutation2 11040 2.35 7.72 0.73 48 XMSubMetaSx_00 10914 5.09 7.63 4.32 49 BAYES_60 10873 5.68 7.60 5.10 50 XMNumbers 10867 4.44 7.60 3.49 51 RELAYCOUNTRY_FR 10657 1.99 7.45 0.34 52 BAYES_80 10540 3.94 7.37 2.90 53 XM_H_Long_From01 10153 6.38 7.10 6.17 54 HTML_IMAGE_ONLY_04 10060 1.79 7.03 0.20 55 XM_B_Phish_Phrases 10054 6.05 7.03 5.76 56 TooManyTo_001 10050 8.58 7.03 9.05 57 HTML_SHORT_CENTER 9992 1.73 6.98 0.14 58 DKIM_INVALID 9894 6.21 6.92 6.00 59 HTML_IMAGE_RATIO_04 9324 5.81 6.52 5.60 60 SHORTENER_SHORT_IMG 7723 1.25 5.40 0.00 61 XMStrtUSub 7577 5.09 5.30 5.03 62 XMPhish14 7409 1.73 5.18 0.69 63 SHORT_URI_4 7105 1.16 4.97 0.01 64 LotsOfNums_01 6947 7.39 4.86 8.15 65 ANY_BOUNCE_MESSAGE 6697 3.44 4.68 3.07 66 BOUNCE_MESSAGE 6690 3.44 4.68 3.07 67 NORDNS_LOW_CONTRAST 6628 1.19 4.63 0.15 68 SHORT_URI_2 6404 1.07 4.48 0.04 69 MIME_HTML_MOSTLY 6247 3.13 4.37 2.76 70 HTML_IMAGE_RATIO_08 5856 2.83 4.09 2.44 71 XM_DIRTYINTL 5780 2.41 4.04 1.92 72 URIBL_DBL_ABUSE_REDIR 5567 0.92 3.89 0.02 73 SpammyFromTLD_02 5493 1.06 3.84 0.22 74 XM_SPF_SoftFail 5444 2.57 3.81 2.20 75 MIME_HTML_ONLY_MULTI 5392 2.04 3.77 1.51 76 TM2_M_URI_OPT_OUT 5215 2.27 3.65 1.86 77 BAYES_40 5117 4.54 3.58 4.83 78 HTML_IMAGE_RATIO_06 5052 3.54 3.53 3.55 79 URI_HEX 5011 2.13 3.50 1.72 80 RELAYCOUNTRY_CA 4726 2.02 3.30 1.63 81 XM_CamelCaseFrm001 4716 2.16 3.30 1.82 82 RCVD_IN_RP_SAFE 4677 7.08 3.27 8.24 83 BAYES_95 4336 2.03 3.03 1.72 84 RCVD_IN_MSPIKE_H2 4279 3.96 2.99 4.26 85 XM_UB60 4215 0.72 2.95 0.05 86 MultiRelay_Combo 4077 0.80 2.85 0.18 87 MultiRelay_CC 4077 0.80 2.85 0.18 88 XM_SendGrid 3983 5.04 2.78 5.72 89 BAYES_20 3943 3.35 2.76 3.53 90 T_TooManySym_01 3867 4.55 2.70 5.11 91 XM_URI_RBL 3717 0.89 2.60 0.38 92 BAYES_00 3676 12.95 2.57 16.08 93 RELAYCOUNTRY_GB 3662 1.38 2.56 1.02 94 RCVD_IN_BL_SPAMCOP_NET 3628 0.81 2.54 0.30 95 XMSubMetaI_00 3538 1.13 2.47 0.73 96 ALL_TRUSTED 3416 14.75 2.39 18.48 97 XMDiploma_00 3403 2.01 2.38 1.90 98 MIME_QP_LONG_LINE 3399 4.63 2.38 5.31 99 FROM_SUSPICIOUS_NTLD 3373 0.60 2.36 0.07 100 XM_OfRef6 3362 1.76 2.35 1.59 101 DIET_1 3196 0.87 2.23 0.45 102 XMSexyCombo_01 3099 1.19 2.17 0.90 103 URIBL_DBL_SPAM 3092 0.54 2.16 0.05 104 BOTNET_NORDNS 3075 0.52 2.15 0.02 105 T_XMDrugObfuBody_08 3027 1.58 2.12 1.42 106 TR_Mismatch_TLD_02 2944 0.53 2.06 0.07 107 XM_ProductURIs 2920 1.14 2.04 0.87 108 RELAYCOUNTRY_CN 2880 0.51 2.01 0.06 109 UNPARSEABLE_RELAY 2861 2.58 2.00 2.75 110 XM_PDF 2841 4.46 1.99 5.21 111 BAYES_05 2817 2.23 1.97 2.31 112 XMBody_17 2700 0.87 1.89 0.56 113 XMStockSpam_06 2660 1.48 1.86 1.37 114 XMGenDplmaNmb 2618 1.33 1.83 1.18 115 T_FILL_THIS_FORM_SHORT 2551 1.09 1.78 0.89 116 RCVD_IN_RP_CERTIFIED 2526 5.43 1.77 6.54 117 XM_H_Long_From02 2526 1.19 1.77 1.01 118 LongTLD 2415 0.53 1.69 0.18 119 SUBJ_ALL_CAPS 2374 1.59 1.66 1.56 120 XMPhish11 2349 1.21 1.64 1.08 121 SpammyFromTLD_01 2188 0.96 1.53 0.78 122 MAILING_LIST_MULTI 2178 2.85 1.52 3.25 123 DKIM_ADSP_NXDOMAIN 2134 0.69 1.49 0.45 124 FSL_THIS_IS_ADV 2108 0.46 1.47 0.15 125 REPLYTO_WITHOUT_TO_CC 2098 0.37 1.47 0.04 126 T_OBFU_PDF_ATTACH 2059 0.97 1.44 0.83 127 T_XMDrugObfuBody_00 2028 1.15 1.42 1.07 128 T_XMHurry_00 2009 0.90 1.40 0.74 129 XMHTML_After_End 1979 0.65 1.38 0.43 130 XMBdyGiftCard01 1978 0.83 1.38 0.66 131 RCVD_IN_IADB_LISTED 1965 4.25 1.37 5.12 132 TR_XM_RelayPhish 1952 0.78 1.36 0.61 133 XMPhish30 1929 0.60 1.35 0.37 134 URIBL_BLACK 1881 0.35 1.31 0.05 135 TM2_M_VERY_LONG_WORD 1843 1.00 1.29 0.91 136 TR_LOTS_OF_MONEY2 1829 0.56 1.28 0.34 137 T_MONEY_PERCENT 1829 0.56 1.28 0.34 138 T_Symld_Words_02 1822 0.58 1.27 0.37 139 TVD_SPACE_RATIO_MINFP 1821 0.30 1.27 0.01 140 RELAYCOUNTRY_AT 1808 0.48 1.26 0.24 141 TR_Symld_Words 1757 1.32 1.23 1.35 142 URI_TRY_3LD 1725 1.35 1.21 1.40 143 DATE_IN_PAST_06_12 1724 0.31 1.21 0.04 144 ADVANCE_FEE_5_NEW_MONEY 1712 0.28 1.20 0.00 145 XM_H_PHPOS 1711 1.11 1.20 1.08 146 TR_LOTS_OF_MONEY1 1702 0.29 1.19 0.02 147 XM_UB80 1696 0.29 1.19 0.02 148 RELAYCOUNTRY_KR 1686 0.29 1.18 0.02 149 TR_XM_DK_Bayes 1652 9.54 1.15 12.07 150 GMD_PDF_EMPTY_BODY 1634 0.50 1.14 0.31 151 RCVD_IN_IADB_SPF 1631 3.77 1.14 4.56 152 XM_DK_Undo_01 1600 1.66 1.12 1.82 153 DKIM_ADSP_CUSTOM_MED 1598 0.99 1.12 0.95 154 XM_RXBody 1588 0.46 1.11 0.26 155 XMSubNoVowel 1576 0.57 1.10 0.41 156 XMSpoofStaff2 1573 0.33 1.10 0.09 157 XM_H_SpoofStaff4 1572 0.44 1.10 0.24 158 RCVD_IN_IADB_DK 1561 3.29 1.09 3.96 159 RCVD_IN_IADB_SENDERID 1557 3.33 1.09 4.01 160 TR_XM_DK_Bayes1 1542 8.92 1.08 11.28 161 HTML_IMAGE_ONLY_08 1538 0.35 1.08 0.13 162 XMMoneyMeta_00 1533 0.77 1.07 0.67 163 RELAYCOUNTRY_IN 1509 0.34 1.05 0.13 164 BODY_ENHANCEMENT 1500 0.26 1.05 0.02 165 NML_ADSP_CUSTOM_MED 1466 0.76 1.02 0.68 166 NO_DNS_FOR_FROM 1439 0.43 1.01 0.25 167 XM_B_REG_HTML 1437 0.62 1.00 0.50 168 FORGED_GMAIL_RCVD 1381 0.58 0.97 0.46 169 RDNS_DYNAMIC 1380 0.56 0.96 0.44 170 HTML_FONT_SIZE_LARGE 1378 0.38 0.96 0.20 171 XMSubMetaI_01 1359 0.26 0.95 0.05 172 HK_RANDOM_FROM 1356 0.36 0.95 0.18 173 TR_XM_DK_Bayes2 1356 7.57 0.95 9.57 174 THIS_AD 1330 0.30 0.93 0.10 175 DATE_IN_PAST_03_06 1316 0.27 0.92 0.08 176 XM_UB99 1272 0.21 0.89 0.01 177 SHORT_URI_3 1270 0.22 0.89 0.02 178 T_TooManySym_02 1255 1.60 0.88 1.82 179 XMGppyBdWords 1247 0.38 0.87 0.23 180 RCVD_IN_IADB_VOUCHED 1243 2.74 0.87 3.31 181 FILL_THIS_FORM 1209 0.53 0.85 0.44 182 TVD_SPACE_RATIO 1199 0.51 0.84 0.41 183 HTML_FONT_FACE_BAD 1198 0.67 0.84 0.62 184 XM_H_PHPMailer 1189 0.71 0.83 0.68 185 ADMITS_SPAM 1176 0.25 0.82 0.07 186 TooManyTo_002 1152 2.10 0.81 2.49 187 DATE_IN_PAST_12_24 1137 0.27 0.79 0.11 188 XMSlimDrugH 1135 0.51 0.79 0.42 189 LOW_PRICE 1118 0.76 0.78 0.76 190 LONG_JUNK_URI 1108 0.24 0.77 0.08 191 RELAYCOUNTRY_DE 1098 0.55 0.77 0.49 192 FILL_THIS_FORM_LONG 1046 0.44 0.73 0.36 193 HTML_IMAGE_ONLY_12 1020 0.36 0.71 0.25 194 XMSexyCombo_04 992 0.36 0.69 0.26 195 TooManyTo_003 969 1.45 0.68 1.69 196 MPART_ALT_DIFF_COUNT 965 0.31 0.67 0.20 197 XMBody_78 952 0.42 0.67 0.35 198 DATE_IN_PAST_24_48 945 0.18 0.66 0.04 199 RCVD_IN_IADB_OPTIN 943 1.74 0.66 2.07 200 XM_UB999 942 0.16 0.66 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 414927 89.28 95.04 87.54 2 DKIM_SIGNED 343066 72.60 73.32 72.38 3 XM_DK_Pass 336392 70.88 70.59 70.97 4 DKIM_VALID 314628 66.38 66.40 66.38 5 DCC_CHECK_NEGATIVE 279010 51.17 25.67 58.86 6 BAYES_50 276115 55.15 44.86 58.25 7 DKIM_VALID_AU 228841 49.07 51.67 48.28 8 XMListUnsubscribeExists 228141 51.76 63.79 48.13 9 XM_H_QuotedFrom 187348 41.41 47.64 39.53 10 DCC_CHECK 185363 46.95 72.92 39.11 11 T_TM2_M_HEADER_IN_MSG 150563 28.40 17.23 31.77 12 HTML_FONT_LOW_CONTRAST 123508 29.03 38.88 26.06 13 DKIM_VALID_EF 122836 24.02 17.74 25.92 14 LOC_TINY_FONT_1 100894 23.76 31.96 21.29 15 FVGT_m_MULTI_ODD 98033 21.43 23.90 20.68 16 XMSubLong 95408 21.29 25.13 20.13 17 MIME_HTML_ONLY 91250 23.34 36.89 19.25 18 MultiRelay 89075 17.61 13.70 18.79 19 ALL_TRUSTED 87577 14.75 2.39 18.48 20 BAYES_00 76208 12.95 2.57 16.08 21 T_KAM_HTML_FONT_INVALID 74797 15.95 16.51 15.78 22 XM_Body_Dirty_Words 57556 13.36 17.38 12.14 23 TR_XM_DK_Bayes 57209 9.54 1.15 12.07 24 XM_Multi_Part_URI 56300 12.35 13.91 11.88 25 TR_XM_DK_Bayes1 53468 8.92 1.08 11.28 26 XM_DKIMWhitelistDomains 52690 8.54 0.02 11.12 27 TR_XM_DK_Bayes2 45356 7.57 0.95 9.57 28 TooManyTo_001 42917 8.58 7.03 9.05 29 XM_Evil_Numbers_Gen 41620 9.72 12.85 8.78 30 LOTS_OF_MONEY 40227 9.40 12.43 8.49 31 RCVD_IN_RP_SAFE 39036 7.08 3.27 8.24 32 LotsOfNums_01 38639 7.39 4.86 8.15 33 HTML_IMAGE_RATIO_02 38579 9.52 14.11 8.14 34 T_XMDrugObfuBody_14 37277 8.04 8.60 7.86 35 XM_DK_Undo_02 32667 12.95 33.02 6.89 36 RCVD_IN_RP_CERTIFIED 30990 5.43 1.77 6.54 37 FSL_BULK_SIG 30015 7.81 12.70 6.33 38 XM_H_Long_From01 29240 6.38 7.10 6.17 39 DKIM_INVALID 28438 6.21 6.92 6.00 40 XM_B_Phish_Phrases 27295 6.05 7.03 5.76 41 XM_SendGrid 27110 5.04 2.78 5.72 42 HTML_IMAGE_RATIO_04 26555 5.81 6.52 5.60 43 RELAYCOUNTRY_META 26216 9.97 24.67 5.53 44 MIME_QP_LONG_LINE 25175 4.63 2.38 5.31 45 BAYES_99 24961 10.14 26.27 5.27 46 XM_PDF 24686 4.46 1.99 5.21 47 RCVD_IN_IADB_LISTED 24252 4.25 1.37 5.12 48 T_TooManySym_01 24219 4.55 2.70 5.11 49 BAYES_60 24180 5.68 7.60 5.10 50 XMStrtUSub 23820 5.09 5.30 5.03 51 BOTNET_IPINHOSTNAME 23201 7.40 15.72 4.89 52 BAYES_40 22903 4.54 3.58 4.83 53 RCVD_IN_IADB_SPF 21601 3.77 1.14 4.56 54 BAYES_999 21019 8.50 21.97 4.43 55 XMSubMetaSx_00 20488 5.09 7.63 4.32 56 RCVD_IN_MSPIKE_H2 20181 3.96 2.99 4.26 57 T_REMOTE_IMAGE 20026 5.77 10.90 4.23 58 XMSexyCombo_05 19017 5.36 9.84 4.01 59 RCVD_IN_IADB_SENDERID 19006 3.33 1.09 4.01 60 RCVD_IN_IADB_DK 18766 3.29 1.09 3.96 61 IN_ZIMBRA_NJ_WHITELIST 17472 2.84 0.03 3.69 62 HTML_IMAGE_RATIO_06 16812 3.54 3.53 3.55 63 BAYES_20 16741 3.35 2.76 3.53 64 FROM_EXCESS_BASE64 16703 5.79 13.31 3.52 65 XMNumbers 16523 4.44 7.60 3.49 66 RCVD_IN_IADB_VOUCHED 15686 2.74 0.87 3.31 67 XM_UncommonTLD01 15631 4.65 9.12 3.30 68 MAILING_LIST_MULTI 15390 2.85 1.52 3.25 69 MPART_ALT_DIFF 15007 4.27 7.94 3.17 70 ANY_BOUNCE_MESSAGE 14533 3.44 4.68 3.07 71 BOUNCE_MESSAGE 14532 3.44 4.68 3.07 72 BAYES_80 13756 3.94 7.37 2.90 73 TR_DCC_Bayes_99 13170 7.28 22.18 2.78 74 MIME_HTML_MOSTLY 13097 3.13 4.37 2.76 75 UNPARSEABLE_RELAY 13055 2.58 2.00 2.75 76 HTML_MIME_NO_HTML_TAG 11906 4.42 10.72 2.51 77 TooManyTo_002 11807 2.10 0.81 2.49 78 HTML_IMAGE_RATIO_08 11580 2.83 4.09 2.44 79 TVD_RCVD_IP 11286 1.91 0.37 2.38 80 TO_MALFORMED 11190 1.82 0.04 2.36 81 BAYES_05 10960 2.23 1.97 2.31 82 XM_SPF_SoftFail 10440 2.57 3.81 2.20 83 RCVD_IN_IADB_OPTIN 9795 1.74 0.66 2.07 84 BOTNET 9504 5.52 17.15 2.01 85 RCVD_IN_MSPIKE_WL 9311 1.58 0.30 1.96 86 RCVD_IN_MSPIKE_H3 9295 1.57 0.29 1.96 87 XM_DIRTYINTL 9103 2.41 4.04 1.92 88 XMDiploma_00 8987 2.01 2.38 1.90 89 HELO_NODOT 8945 1.52 0.29 1.89 90 TM2_M_URI_OPT_OUT 8815 2.27 3.65 1.86 91 XM_DK_Undo_01 8648 1.66 1.12 1.82 92 T_TooManySym_02 8647 1.60 0.88 1.82 93 XM_CamelCaseFrm001 8603 2.16 3.30 1.82 94 BAYES_95 8161 2.03 3.03 1.72 95 URI_HEX 8153 2.13 3.50 1.72 96 TooManyTo_003 8006 1.45 0.68 1.69 97 RELAYCOUNTRY_CA 7709 2.02 3.30 1.63 98 IN_HORDE_ADDRESS_BOOK 7698 1.26 0.04 1.62 99 XM_OfRef6 7525 1.76 2.35 1.59 100 SUBJ_ALL_CAPS 7414 1.59 1.66 1.56 101 XMCapTrack 7228 1.25 0.32 1.52 102 MIME_HTML_ONLY_MULTI 7178 2.04 3.77 1.51 103 INVALID_MSGID 7062 1.17 0.12 1.49 104 T_XMDrugObfuBody_08 6737 1.58 2.12 1.42 105 TR_MetaPhish_Combo_01 6732 1.23 0.60 1.42 106 URI_TRY_3LD 6630 1.35 1.21 1.40 107 XMStockSpam_06 6473 1.48 1.86 1.37 108 TR_Symld_Words 6391 1.32 1.23 1.35 109 UNTRUSTED_Relay 6375 5.14 17.72 1.34 110 XM_GoogleGroups 6135 1.09 0.43 1.29 111 TooManyTo_004 5940 1.09 0.57 1.25 112 USER_IN_DEF_DKIM_WL 5764 0.96 0.10 1.22 113 XMGenDplmaNmb 5602 1.33 1.83 1.18 114 XM_H_PHPOS 5130 1.11 1.20 1.08 115 XMPhish11 5111 1.21 1.64 1.08 116 T_XMDrugObfuBody_00 5048 1.15 1.42 1.07 117 TooManyTo_005 5016 0.93 0.51 1.06 118 RELAYCOUNTRY_GB 4827 1.38 2.56 1.02 119 XM_H_Long_From02 4808 1.19 1.77 1.01 120 DKIM_ADSP_CUSTOM_MED 4494 0.99 1.12 0.95 121 TM2_M_VERY_LONG_WORD 4319 1.00 1.29 0.91 122 XMSexyCombo_01 4269 1.19 2.17 0.90 123 T_FILL_THIS_FORM_SHORT 4199 1.09 1.78 0.89 124 XM_ProductURIs 4139 1.14 2.04 0.87 125 T_OBFU_PDF_ATTACH 3937 0.97 1.44 0.83 126 XM_UB50 3849 2.70 8.95 0.81 127 SpammyFromTLD_01 3720 0.96 1.53 0.78 128 LOW_PRICE 3598 0.76 0.78 0.76 129 T_XMHurry_00 3516 0.90 1.40 0.74 130 XM_salutation2 3478 2.35 7.72 0.73 131 XMSubMetaI_00 3452 1.13 2.47 0.73 132 PLING_QUERY 3288 0.67 0.58 0.69 133 XMPhish14 3266 1.73 5.18 0.69 134 NML_ADSP_CUSTOM_MED 3204 0.76 1.02 0.68 135 XM_H_PHPMailer 3202 0.71 0.83 0.68 136 XMMoneyMeta_00 3198 0.77 1.07 0.67 137 XMBdyGiftCard01 3126 0.83 1.38 0.66 138 HTTPS_HTTP_MISMATCH 3103 0.61 0.44 0.65 139 XMNoVowels 3047 0.57 0.34 0.64 140 XMBody_95 3009 0.51 0.10 0.63 141 HTML_FONT_FACE_BAD 2948 0.67 0.84 0.62 142 TR_XM_RelayPhish 2888 0.78 1.36 0.61 143 MISSING_HEADERS 2861 2.54 8.97 0.60 144 XMBrknScrpt_02 2835 0.59 0.55 0.60 145 HTML_TAG_BALANCE_BODY 2789 0.55 0.40 0.59 146 USER_IN_WHITELIST 2748 0.45 0.00 0.58 147 URI_NOVOWEL 2708 0.57 0.56 0.57 148 XMBody_17 2649 0.87 1.89 0.56 149 T_TooManySym_03 2611 0.50 0.32 0.55 150 XM_B_COPY_HTML 2583 0.54 0.52 0.54 151 XMLngstWrd_00 2570 0.50 0.34 0.54 152 AC_DIV_BONANZA 2506 0.44 0.16 0.53 153 XMLngstWrd_01 2397 0.46 0.32 0.51 154 FROM_GOV_SPOOF 2380 0.44 0.22 0.50 155 SHORT_HELO_AND_INLINE_IMAGE 2375 0.39 0.04 0.50 156 XM_B_REG_HTML 2366 0.62 1.00 0.50 157 RELAYCOUNTRY_DE 2317 0.55 0.77 0.49 158 HTML_IMAGE_ONLY_32 2302 0.44 0.28 0.49 159 XMHTMLBadTable_001 2271 0.48 0.50 0.48 160 XM_ShortIntro_01 2249 0.50 0.60 0.47 161 FORGED_GMAIL_RCVD 2197 0.58 0.97 0.46 162 DIET_1 2152 0.87 2.23 0.45 163 XMSubMetaSxObfu_02 2141 0.41 0.25 0.45 164 DKIM_ADSP_NXDOMAIN 2121 0.69 1.49 0.45 165 RDNS_DYNAMIC 2105 0.56 0.96 0.44 166 FILL_THIS_FORM 2066 0.53 0.85 0.44 167 XMGappySubj_01 2058 0.38 0.19 0.43 168 XMHTML_After_End 2053 0.65 1.38 0.43 169 RELAYCOUNTRY_AU 2031 0.44 0.49 0.43 170 XMSubMetaSxObfu_03 2004 0.46 0.57 0.42 171 XMSlimDrugH 2003 0.51 0.79 0.42 172 TM2_M_BODY_EMPTY 1956 0.39 0.30 0.41 173 XMDateMe_00 1948 0.38 0.28 0.41 174 TVD_SPACE_RATIO 1947 0.51 0.84 0.41 175 RCVD_IN_SORBS_DUL 1941 0.38 0.29 0.41 176 XMSubNoVowel 1937 0.57 1.10 0.41 177 TR_LOTS_OF_MONEY3 1916 0.45 0.61 0.40 178 SUBJ_DOLLARS 1915 0.44 0.55 0.40 179 TM2_M_A_HREF_HREF 1790 0.42 0.57 0.38 180 XM_URI_RBL 1781 0.89 2.60 0.38 181 XMPhish30 1766 0.60 1.35 0.37 182 XM_H_PHPOS_M 1764 0.39 0.45 0.37 183 T_Symld_Words_02 1762 0.58 1.27 0.37 184 HTML_IMAGE_ONLY_28 1713 0.39 0.49 0.36 185 FILL_THIS_FORM_LONG 1690 0.44 0.73 0.36 186 XMBody_78 1663 0.42 0.67 0.35 187 HTML_IMAGE_ONLY_24 1624 0.35 0.36 0.34 188 T_MONEY_PERCENT 1617 0.56 1.28 0.34 189 TR_LOTS_OF_MONEY2 1617 0.56 1.28 0.34 190 XMLKML 1609 0.26 0.00 0.34 191 RELAYCOUNTRY_FR 1606 1.99 7.45 0.34 192 FILL_THIS_FORM_LOAN 1602 0.39 0.58 0.34 193 HTML_IMAGE_ONLY_16 1597 0.37 0.49 0.34 194 FROM_GOV_DKIM_AU 1547 0.27 0.07 0.33 195 XMRcvdHeader_15 1544 0.25 0.00 0.33 196 XM_B_TRADE_HTML 1514 0.33 0.37 0.32 197 XMSubEmpty 1508 0.39 0.62 0.32 198 GMD_PDF_EMPTY_BODY 1451 0.50 1.14 0.31 199 XM_Body_Obfu01 1424 0.29 0.24 0.30 200 XMSolicitRefs_0 1421 0.32 0.37 0.30 ----------------------------------------------------------------------