Email: 689384 Autolearn: 0 AvgScore: 1.03 AvgScanTime: 1.93 sec Spam: 121915 Autolearn: 0 AvgScore: 12.45 AvgScanTime: 2.72 sec Ham: 567469 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.76 sec Time Spent Running SA: 368.90 hours Time Spent Processing Spam: 92.24 hours Time Spent Processing Ham: 276.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114665 85.82 94.05 84.05 2 DCC_CHECK 94726 46.72 77.70 40.06 3 XM_B_Unicode 85279 67.14 69.95 66.53 4 DKIM_SIGNED 84840 71.40 69.59 71.78 5 XM_DK_Pass 82034 70.03 67.29 70.62 6 DKIM_VALID 73916 65.75 60.63 66.85 7 XMListUnsubscribeExists 71125 51.14 58.34 49.59 8 BAYES_50 62592 49.49 51.34 49.09 9 DKIM_VALID_AU 55237 49.18 45.31 50.01 10 MIME_HTML_ONLY 49422 23.34 40.54 19.65 11 XM_B_Unicode3 47069 39.33 38.61 39.49 12 XM_DK_Undo_02 36875 10.38 30.25 6.11 13 LOC_TINY_FONT_1 35168 23.91 28.85 22.85 14 HTML_FONT_LOW_CONTRAST 34244 26.35 28.09 25.98 15 DKIM_VALID_EF 31498 25.23 25.84 25.10 16 RELAYCOUNTRY_META 30575 9.40 25.08 6.03 17 FVGT_m_MULTI_ODD 30316 20.90 24.87 20.05 18 XMSubLong 29442 20.72 24.15 19.99 19 XM_Body_Dirty_Words 28577 14.80 23.44 12.95 20 FSL_BULK_SIG 26906 9.99 22.07 7.39 21 T_TM2_M_HEADER_IN_MSG 25239 26.41 20.70 27.63 22 BAYES_99 24967 5.94 20.48 2.82 23 DCC_CHECK_NEGATIVE 24712 51.33 20.27 58.00 24 T_KAM_HTML_FONT_INVALID 23947 17.73 19.64 17.32 25 BOTNET 23734 5.21 19.47 2.15 26 XM_UncommonTLD01 21749 5.47 17.84 2.82 27 MultiRelay 21684 18.11 17.79 18.18 28 XM_B_Unsub 21502 11.61 17.64 10.32 29 UNTRUSTED_Relay 20818 4.69 17.08 2.03 30 XM_Multi_Part_URI 20338 13.38 16.68 12.68 31 BAYES_999 18959 4.58 15.55 2.22 32 TR_DCC_Bayes_99 18874 3.97 15.48 1.49 33 BOTNET_IPINHOSTNAME 18650 5.95 15.30 3.94 34 XMSexyCombo_05 17979 5.93 14.75 4.04 35 HTML_MIME_NO_HTML_TAG 16593 4.11 13.61 2.07 36 LOTS_OF_MONEY 16356 9.92 13.42 9.17 37 HTML_IMAGE_RATIO_02 14552 8.24 11.94 7.45 38 T_REMOTE_IMAGE 14173 5.09 11.63 3.69 39 XMSubMetaSx_00 13331 5.92 10.93 4.84 40 XM_UB50 12667 2.53 10.39 0.84 41 HTML_SHORT_LINK_IMG_1 12518 1.85 10.27 0.04 42 XM_Evil_Numbers_Gen 11898 8.85 9.76 8.65 43 DKIM_INVALID 10924 5.65 8.96 4.94 44 HDRS_LCASE_IMGONLY 10745 1.58 8.81 0.02 45 RCVD_IN_MSPIKE_H2 10217 11.21 8.38 11.81 46 BODY_URI_ONLY 10132 1.55 8.31 0.10 47 XM_H_Long_From01 10058 5.86 8.25 5.35 48 XM_BadFromFormat 9526 1.48 7.81 0.12 49 HTML_IMAGE_ONLY_08 9331 1.46 7.65 0.13 50 HTML_TAG_BALANCE_CENTER 9265 1.45 7.60 0.13 51 KHOP_HELO_FCRDNS 9162 2.85 7.52 1.85 52 BAYES_60 8836 4.94 7.25 4.45 53 XM_SPF_SoftFail 8734 3.28 7.16 2.44 54 BAYES_80 8724 3.18 7.16 2.33 55 SpammyFromTLD_02 8620 1.49 7.07 0.29 56 XM_B_Phish_Phrases 8566 5.94 7.03 5.71 57 LotsOfNums_01 8508 7.43 6.98 7.53 58 XMNumbers 7901 4.01 6.48 3.49 59 XM_DIRTYINTL 7660 3.33 6.28 2.69 60 URIBL_CSS_A 7603 1.14 6.24 0.05 61 URIBL_CSS 7603 1.14 6.24 0.05 62 MPART_ALT_DIFF 7600 4.76 6.23 4.45 63 HTML_IMAGE_RATIO_04 7023 6.58 5.76 6.75 64 NO_DNS_FOR_FROM 6663 2.66 5.47 2.06 65 RDNS_DYNAMIC 6549 1.20 5.37 0.31 66 XM_B_SpammyTLD 6519 2.29 5.35 1.64 67 TooManyTo_001 6184 7.00 5.07 7.42 68 RCVD_IN_BL_SPAMCOP_NET 5786 1.90 4.75 1.29 69 XM_SendGrid 5715 5.94 4.69 6.21 70 RCVD_IN_MSPIKE_BL 5552 1.65 4.55 1.02 71 HTML_IMAGE_RATIO_08 5477 2.66 4.49 2.26 72 XMSexyCombo_01 5470 1.48 4.49 0.83 73 TR_Mismatch_TLD_02 5392 0.84 4.42 0.07 74 MIME_HTML_MOSTLY 5382 2.57 4.41 2.17 75 RELAYCOUNTRY_CA 5311 2.12 4.36 1.63 76 XMStrtUSub 5212 3.66 4.28 3.53 77 RCVD_IN_MSPIKE_WL 4907 8.27 4.02 9.18 78 RCVD_IN_MSPIKE_H3 4907 8.27 4.02 9.18 79 XM_URI_RBL 4853 0.94 3.98 0.28 80 MIME_QP_LONG_LINE 4761 5.08 3.91 5.33 81 XM_OfRef6 4739 1.83 3.89 1.39 82 FROM_SUSPICIOUS_NTLD 4536 0.72 3.72 0.07 83 RELAYCOUNTRY_FR 4511 0.91 3.70 0.31 84 FROM_SUSPICIOUS_NTLD_FP 4492 0.71 3.68 0.07 85 REPLYTO_WITHOUT_TO_CC 4428 1.08 3.63 0.54 86 RELAYCOUNTRY_GB 4365 1.77 3.58 1.38 87 FROM_EXCESS_BASE64 4331 3.25 3.55 3.19 88 TM2_M_URI_OPT_OUT 4321 7.30 3.54 8.11 89 T_TooManySym_01 4313 4.10 3.54 4.22 90 PDS_OTHER_BAD_TLD 4284 0.96 3.51 0.41 91 RELAYCOUNTRY_DE 4277 0.96 3.51 0.41 92 BAYES_95 4175 1.66 3.42 1.28 93 BAYES_40 4101 5.63 3.36 6.12 94 XM_CamelCaseFrm001 3942 2.47 3.23 2.31 95 SpammyFromTLD_01 3915 1.08 3.21 0.62 96 MIME_HTML_ONLY_MULTI 3790 2.86 3.11 2.81 97 RCVD_IN_RP_RNBL 3729 0.64 3.06 0.12 98 MultiRelay_CC 3714 0.69 3.05 0.19 99 MultiRelay_Combo 3714 0.69 3.05 0.19 100 ALL_TRUSTED 3681 15.77 3.02 18.50 101 XMSubMetaSSx_00 3666 0.76 3.01 0.28 102 XMSexyCombo_04 3626 0.63 2.97 0.13 103 XMHTML_After_End 3487 1.27 2.86 0.93 104 XMDiploma_00 3464 2.06 2.84 1.90 105 T_XMDrugObfuBody_08 3404 1.83 2.79 1.62 106 HTML_IMAGE_RATIO_06 3395 3.37 2.78 3.50 107 XM_B_Unsub2 3319 3.08 2.72 3.15 108 BAYES_00 3313 20.98 2.72 24.91 109 SUBJ_ALL_CAPS 3305 1.70 2.71 1.48 110 DATE_IN_PAST_03_06 3252 0.59 2.67 0.15 111 T_XMDrugObfuBody_00 3066 1.06 2.51 0.74 112 BAYES_20 2999 4.61 2.46 5.07 113 MIME_HEADER_CTYPE_ONLY 2984 0.60 2.45 0.20 114 BOTNET_NORDNS 2977 0.47 2.44 0.05 115 LongTLD 2889 0.60 2.37 0.21 116 XM_OfRef7 2866 0.52 2.35 0.13 117 XMGenDplmaNmb 2790 1.33 2.29 1.12 118 DIET_1 2717 0.85 2.23 0.56 119 MISSING_HEADERS 2684 1.12 2.20 0.89 120 XM_H_Long_From02 2669 1.48 2.19 1.32 121 FSL_THIS_IS_ADV 2596 0.50 2.13 0.16 122 RCVD_IN_MSPIKE_L5 2488 0.57 2.04 0.25 123 HTML_IMAGE_ONLY_12 2480 0.48 2.03 0.15 124 XM_UB60 2438 0.41 2.00 0.07 125 TR_XM_PHPDW 2429 0.74 1.99 0.48 126 XMBody_17 2406 0.94 1.97 0.71 127 TR_Mismatch_TLD_01 2396 0.54 1.97 0.23 128 T_XMHurry_00 2391 0.90 1.96 0.67 129 TR_XM_PHPForged 2366 0.72 1.94 0.46 130 TR_XM_FormFill2 2357 0.72 1.93 0.46 131 XM_H_PHPOS 2340 0.71 1.92 0.45 132 TR_XM_DK_SendGrid 2330 2.91 1.91 3.12 133 RCVD_IN_MSPIKE_L3 2313 0.76 1.90 0.51 134 DATE_IN_PAST_06_12 2304 0.37 1.89 0.05 135 T_XMDrugObfuBody_14 2273 1.61 1.86 1.55 136 XMStockSpam_06 2270 1.20 1.86 1.06 137 THIS_AD 2261 0.56 1.85 0.28 138 XMReplyNow 2251 0.43 1.85 0.13 139 TR_XM_DK_Bayes 2244 12.77 1.84 15.12 140 TR_XM_RelayPhish 2183 1.14 1.79 1.00 141 URG_BIZ 2171 0.35 1.78 0.04 142 DKIM_ADSP_NXDOMAIN 2146 0.55 1.76 0.29 143 TR_XM_INV_DKIM 2114 0.40 1.73 0.11 144 T_FILL_THIS_FORM_LOAN 2067 0.62 1.70 0.39 145 XM_OfRef8 2064 0.33 1.69 0.03 146 URIBL_DBL_ABUSE_REDIR 2054 0.53 1.68 0.28 147 TM2_M_VERY_LONG_WORD 2043 1.17 1.68 1.06 148 URI_TRY_3LD 2023 1.27 1.66 1.18 149 XMDateMe_00 2017 0.56 1.65 0.32 150 URI_HEX 2002 1.45 1.64 1.41 151 RCVD_IN_IADB_LISTED 1993 4.21 1.63 4.77 152 XMMoneyMeta_00 1990 0.67 1.63 0.46 153 TO_EQ_FM_DOM_HTML_IMG 1935 0.29 1.59 0.02 154 RCVD_IN_RP_SAFE 1926 7.39 1.58 8.64 155 XM_DK_Undo_01 1881 1.66 1.54 1.68 156 BAYES_05 1877 3.35 1.54 3.74 157 TR_XM_DK_Bayes1 1856 12.04 1.52 14.31 158 MAILING_LIST_MULTI 1822 2.03 1.49 2.14 159 RCVD_IN_IADB_SPF 1788 3.65 1.47 4.12 160 HK_SCAM 1782 0.27 1.46 0.02 161 RCVD_IN_RP_CERTIFIED 1778 6.83 1.46 7.99 162 RCVD_IN_PSBL 1769 0.28 1.45 0.03 163 PLING_QUERY 1748 0.87 1.43 0.75 164 RCVD_IN_IADB_DK 1737 3.15 1.42 3.52 165 RCVD_IN_IADB_SENDERID 1735 3.19 1.42 3.57 166 REMOVE_BEFORE_LINK 1733 0.74 1.42 0.59 167 XMBrknScrpt_02 1712 0.83 1.40 0.70 168 TR_Sbj_FN_Bdy 1680 0.37 1.38 0.15 169 XMBody_78 1678 0.58 1.38 0.41 170 XMSubMetaI_00 1655 0.61 1.36 0.45 171 URIBL_SBL_A 1653 0.42 1.36 0.22 172 ADMITS_SPAM 1634 0.28 1.34 0.05 173 RELAYCOUNTRY_IN 1627 0.34 1.33 0.12 174 XM_H_PHPMailer 1620 0.63 1.33 0.48 175 XMPhish11 1611 1.07 1.32 1.02 176 XMSlimDrugH 1601 0.51 1.31 0.33 177 TR_Symld_Words 1591 1.45 1.31 1.48 178 NORDNS_LOW_CONTRAST 1577 0.23 1.29 0.00 179 XM_ProductURIs 1483 0.75 1.22 0.64 180 TR_XM_DK_Bayes2 1467 10.45 1.20 12.44 181 TONOM_EQ_TOLOC_SHRT_SHRTNER 1444 0.59 1.18 0.46 182 HTML_IMAGE_ONLY_04 1414 0.25 1.16 0.05 183 T_FILL_THIS_FORM_SHORT 1381 1.02 1.13 0.99 184 HK_RANDOM_REPLYTO 1355 0.34 1.11 0.18 185 XM_H_PHPOS_M 1354 0.29 1.11 0.12 186 XM_UB99 1353 0.20 1.11 0.01 187 TR_LOTS_OF_MONEY3 1341 0.71 1.10 0.63 188 HTML_SHORT_CENTER 1333 0.20 1.09 0.00 189 RELAYCOUNTRY_MD 1281 0.19 1.05 0.00 190 XM_UB80 1249 0.19 1.02 0.01 191 URI_NO_WWW_INFO_CGI 1216 0.20 1.00 0.02 192 T_Symld_Words_02 1186 0.64 0.97 0.57 193 DKIM_ADSP_CUSTOM_MED 1162 0.98 0.95 0.99 194 XMPhish14 1155 0.62 0.95 0.55 195 T_MONEY_PERCENT 1149 0.44 0.94 0.33 196 TR_LOTS_OF_MONEY2 1149 0.44 0.94 0.33 197 EXCUSE_4 1144 0.18 0.94 0.01 198 MSGID_FROM_MTA_HEADER 1128 0.39 0.93 0.27 199 DATE_IN_PAST_12_24 1125 0.20 0.92 0.04 200 MPART_ALT_DIFF_COUNT 1119 0.43 0.92 0.33 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 476955 85.82 94.05 84.05 2 DKIM_SIGNED 407350 71.40 69.59 71.78 3 XM_DK_Pass 400749 70.03 67.29 70.62 4 DKIM_VALID 379341 65.75 60.63 66.85 5 XM_B_Unicode 377561 67.14 69.95 66.53 6 DCC_CHECK_NEGATIVE 329125 51.33 20.27 58.00 7 DKIM_VALID_AU 283819 49.18 45.31 50.01 8 XMListUnsubscribeExists 281413 51.14 58.34 49.59 9 BAYES_50 278594 49.49 51.34 49.09 10 DCC_CHECK 227351 46.72 77.70 40.06 11 XM_B_Unicode3 224072 39.33 38.61 39.49 12 T_TM2_M_HEADER_IN_MSG 156800 26.41 20.70 27.63 13 HTML_FONT_LOW_CONTRAST 147427 26.35 28.09 25.98 14 DKIM_VALID_EF 142419 25.23 25.84 25.10 15 BAYES_00 141340 20.98 2.72 24.91 16 LOC_TINY_FONT_1 129694 23.91 28.85 22.85 17 FVGT_m_MULTI_ODD 113789 20.90 24.87 20.05 18 XMSubLong 113411 20.72 24.15 19.99 19 MIME_HTML_ONLY 111498 23.34 40.54 19.65 20 ALL_TRUSTED 105003 15.77 3.02 18.50 21 MultiRelay 103182 18.11 17.79 18.18 22 T_KAM_HTML_FONT_INVALID 98258 17.73 19.64 17.32 23 TR_XM_DK_Bayes 85798 12.77 1.84 15.12 24 TR_XM_DK_Bayes1 81178 12.04 1.52 14.31 25 XM_Body_Dirty_Words 73466 14.80 23.44 12.95 26 XM_Multi_Part_URI 71936 13.38 16.68 12.68 27 TR_XM_DK_Bayes2 70603 10.45 1.20 12.44 28 RCVD_IN_MSPIKE_H2 67033 11.21 8.38 11.81 29 XM_B_Unsub 58567 11.61 17.64 10.32 30 RCVD_IN_MSPIKE_WL 52114 8.27 4.02 9.18 31 RCVD_IN_MSPIKE_H3 52111 8.27 4.02 9.18 32 LOTS_OF_MONEY 52052 9.92 13.42 9.17 33 XM_Evil_Numbers_Gen 49080 8.85 9.76 8.65 34 RCVD_IN_RP_SAFE 49042 7.39 1.58 8.64 35 TM2_M_URI_OPT_OUT 46016 7.30 3.54 8.11 36 ANY_BOUNCE_MESSAGE 45927 6.75 0.47 8.09 37 BOUNCE_MESSAGE 45925 6.74 0.47 8.09 38 RCVD_IN_RP_CERTIFIED 45324 6.83 1.46 7.99 39 LotsOfNums_01 42728 7.43 6.98 7.53 40 HTML_IMAGE_RATIO_02 42275 8.24 11.94 7.45 41 TooManyTo_001 42084 7.00 5.07 7.42 42 FSL_BULK_SIG 41955 9.99 22.07 7.39 43 XM_DKIMWhitelistDomains 39726 5.77 0.02 7.00 44 HTML_IMAGE_RATIO_04 38308 6.58 5.76 6.75 45 XM_SendGrid 35264 5.94 4.69 6.21 46 BAYES_40 34742 5.63 3.36 6.12 47 XM_DK_Undo_02 34685 10.38 30.25 6.11 48 RELAYCOUNTRY_META 34239 9.40 25.08 6.03 49 XM_B_Phish_Phrases 32409 5.94 7.03 5.71 50 XM_H_Long_From01 30341 5.86 8.25 5.35 51 MIME_QP_LONG_LINE 30226 5.08 3.91 5.33 52 BAYES_20 28762 4.61 2.46 5.07 53 DKIM_INVALID 28009 5.65 8.96 4.94 54 XMSubMetaSx_00 27468 5.92 10.93 4.84 55 RCVD_IN_IADB_LISTED 27050 4.21 1.63 4.77 56 MPART_ALT_DIFF 25229 4.76 6.23 4.45 57 BAYES_60 25224 4.94 7.25 4.45 58 T_TooManySym_01 23957 4.10 3.54 4.22 59 XM_PDF 23831 3.59 0.74 4.20 60 RCVD_IN_IADB_SPF 23383 3.65 1.47 4.12 61 XMSexyCombo_05 22928 5.93 14.75 4.04 62 BOTNET_IPINHOSTNAME 22369 5.95 15.30 3.94 63 BAYES_05 21249 3.35 1.54 3.74 64 IN_ZIMBRA_NJ_WHITELIST 21021 3.05 0.01 3.70 65 T_REMOTE_IMAGE 20917 5.09 11.63 3.69 66 RCVD_IN_IADB_SENDERID 20275 3.19 1.42 3.57 67 XMStrtUSub 20007 3.66 4.28 3.53 68 RCVD_IN_IADB_DK 19991 3.15 1.42 3.52 69 HTML_IMAGE_RATIO_06 19863 3.37 2.78 3.50 70 XMNumbers 19777 4.01 6.48 3.49 71 FROM_EXCESS_BASE64 18074 3.25 3.55 3.19 72 XM_B_Unsub2 17887 3.08 2.72 3.15 73 TR_XM_DK_SendGrid 17709 2.91 1.91 3.12 74 RCVD_IN_IADB_VOUCHED 17499 2.63 0.53 3.08 75 XM_UncommonTLD01 15982 5.47 17.84 2.82 76 BAYES_99 15981 5.94 20.48 2.82 77 MIME_HTML_ONLY_MULTI 15960 2.86 3.11 2.81 78 XM_DIRTYINTL 15277 3.33 6.28 2.69 79 XM_SPF_SoftFail 13864 3.28 7.16 2.44 80 BAYES_80 13204 3.18 7.16 2.33 81 XM_CamelCaseFrm001 13083 2.47 3.23 2.31 82 HTML_IMAGE_RATIO_08 12850 2.66 4.49 2.26 83 XM_H_Trusted_IP 12844 1.86 0.00 2.26 84 T_TooManySym_02 12642 1.99 0.86 2.23 85 BAYES_999 12591 4.58 15.55 2.22 86 MIME_HTML_MOSTLY 12329 2.57 4.41 2.17 87 BOTNET 12207 5.21 19.47 2.15 88 MAILING_LIST_MULTI 12140 2.03 1.49 2.14 89 HTML_MIME_NO_HTML_TAG 11746 4.11 13.61 2.07 90 NO_DNS_FOR_FROM 11702 2.66 5.47 2.06 91 UNTRUSTED_Relay 11504 4.69 17.08 2.03 92 HELO_NODOT 11438 1.77 0.64 2.02 93 HELO_NO_DOMAIN 11396 1.77 0.64 2.01 94 RCVD_IN_IADB_OPTIN 11260 1.70 0.38 1.98 95 XMDiploma_00 10758 2.06 2.84 1.90 96 KHOP_HELO_FCRDNS 10493 2.85 7.52 1.85 97 UNPARSEABLE_RELAY 10438 1.66 0.83 1.84 98 TooManyTo_002 10023 1.59 0.77 1.77 99 TVD_RCVD_IP 9583 1.48 0.53 1.69 100 XM_DK_Undo_01 9554 1.66 1.54 1.68 101 XM_B_SpammyTLD 9289 2.29 5.35 1.64 102 RELAYCOUNTRY_CA 9275 2.12 4.36 1.63 103 T_XMDrugObfuBody_08 9215 1.83 2.79 1.62 104 T_XMDrugObfuBody_14 8815 1.61 1.86 1.55 105 TR_DCC_Bayes_99 8475 3.97 15.48 1.49 106 SUBJ_ALL_CAPS 8405 1.70 2.71 1.48 107 TR_Symld_Words 8380 1.45 1.31 1.48 108 URI_HEX 7988 1.45 1.64 1.41 109 XM_OfRef6 7909 1.83 3.89 1.39 110 IN_HORDE_ADDRESS_BOOK 7871 1.15 0.04 1.39 111 RELAYCOUNTRY_GB 7831 1.77 3.58 1.38 112 INVALID_MSGID 7735 1.17 0.29 1.36 113 XM_H_Long_From02 7514 1.48 2.19 1.32 114 RCVD_IN_BL_SPAMCOP_NET 7295 1.90 4.75 1.29 115 BAYES_95 7249 1.66 3.42 1.28 116 XMCapTrack 6914 1.07 0.37 1.22 117 TO_MALFORMED 6841 1.00 0.03 1.21 118 URI_TRY_3LD 6701 1.27 1.66 1.18 119 TooManyTo_003 6655 1.08 0.62 1.17 120 XMBdyGiftCard01 6592 1.05 0.55 1.16 121 XMGenDplmaNmb 6347 1.33 2.29 1.12 122 CK_HELO_DYNAMIC_SPLIT_IP 6151 0.91 0.10 1.08 123 HELO_DYNAMIC_IPADDR2 6147 0.90 0.05 1.08 124 XM_ShortIntro_01 6114 0.95 0.36 1.08 125 TM2_M_VERY_LONG_WORD 6042 1.17 1.68 1.06 126 XMStockSpam_06 6026 1.20 1.86 1.06 127 XM_GoogleGroups 6005 0.95 0.43 1.06 128 URI_OPTOUT_3LD 5805 0.87 0.17 1.02 129 RCVD_IN_MSPIKE_BL 5803 1.65 4.55 1.02 130 XMPhish11 5776 1.07 1.32 1.02 131 USER_IN_DEF_DKIM_WL 5710 0.83 0.01 1.01 132 TR_XM_RelayPhish 5659 1.14 1.79 1.00 133 XMSubNoVowel 5654 0.89 0.41 1.00 134 T_FILL_THIS_FORM_SHORT 5643 1.02 1.13 0.99 135 DKIM_ADSP_CUSTOM_MED 5599 0.98 0.95 0.99 136 XMHTML_After_End 5281 1.27 2.86 0.93 137 HTML_FONT_FACE_BAD 5249 0.84 0.44 0.92 138 MISSING_HEADERS 5036 1.12 2.20 0.89 139 XMGappySubj_01 5006 0.77 0.26 0.88 140 TooManyTo_004 4940 0.81 0.52 0.87 141 XM_UB50 4752 2.53 10.39 0.84 142 XMSexyCombo_01 4724 1.48 4.49 0.83 143 PLING_QUERY 4253 0.87 1.43 0.75 144 T_XMDrugObfuBody_00 4227 1.06 2.51 0.74 145 NML_ADSP_CUSTOM_MED 4083 0.74 0.81 0.72 146 TooManyTo_005 4065 0.67 0.44 0.72 147 XMBody_17 4041 0.94 1.97 0.71 148 XMBrknScrpt_02 3994 0.83 1.40 0.70 149 T_XMHurry_00 3828 0.90 1.96 0.67 150 TR_MetaPhish_Combo_01 3743 0.66 0.65 0.66 151 RELAYCOUNTRY_NL 3729 0.61 0.37 0.66 152 XM_ProductURIs 3659 0.75 1.22 0.64 153 TR_LOTS_OF_MONEY3 3570 0.71 1.10 0.63 154 SpammyFromTLD_01 3529 1.08 3.21 0.62 155 HTML_TAG_BALANCE_BODY 3421 0.62 0.70 0.60 156 REMOVE_BEFORE_LINK 3357 0.74 1.42 0.59 157 XMBody_95 3349 0.52 0.18 0.59 158 XMSubMetaSxObfu_03 3315 0.58 0.54 0.58 159 T_Symld_Words_02 3252 0.64 0.97 0.57 160 XMNoVowels 3217 0.57 0.60 0.57 161 DIET_1 3173 0.85 2.23 0.56 162 T_OBFU_PDF_ATTACH 3127 0.49 0.21 0.55 163 HTTPS_HTTP_MISMATCH 3126 0.57 0.64 0.55 164 XMPhish14 3096 0.62 0.95 0.55 165 XMHTMLBadTable_001 3095 0.58 0.75 0.55 166 FILL_THIS_FORM 3074 0.48 0.22 0.54 167 REPLYTO_WITHOUT_TO_CC 3048 1.08 3.63 0.54 168 RELAYCOUNTRY_AU 3043 0.52 0.45 0.54 169 XM_SPF_Unknown 3035 0.55 0.62 0.53 170 RCVD_IN_MSPIKE_L3 2916 0.76 1.90 0.51 171 HTML_IMAGE_ONLY_20 2914 0.47 0.29 0.51 172 FROM_GOV_DKIM_AU 2884 0.45 0.18 0.51 173 XMPhish30 2858 0.57 0.88 0.50 174 USER_IN_WHITELIST 2855 0.41 0.00 0.50 175 SUBJ_DOLLARS 2853 0.48 0.37 0.50 176 XM_H_PHPMailer 2713 0.63 1.33 0.48 177 TR_XM_PHPDW 2697 0.74 1.99 0.48 178 FORGED_GMAIL_RCVD 2682 0.53 0.82 0.47 179 TONOM_EQ_TOLOC_SHRT_SHRTNER 2634 0.59 1.18 0.46 180 XMMoneyMeta_00 2633 0.67 1.63 0.46 181 XM_B_REG_HTML 2604 0.44 0.34 0.46 182 TR_XM_PHPForged 2596 0.72 1.94 0.46 183 TR_XM_FormFill2 2585 0.72 1.93 0.46 184 XMLngstWrd_00 2569 0.44 0.39 0.45 185 XMSubMetaI_00 2562 0.61 1.36 0.45 186 XM_H_PHPOS 2560 0.71 1.92 0.45 187 TM2_M_A_HREF_HREF 2506 0.46 0.53 0.44 188 FROM_GOV_SPOOF 2434 0.40 0.27 0.43 189 SHORT_HELO_AND_INLINE_IMAGE 2412 0.36 0.03 0.43 190 FILL_THIS_FORM_LONG 2384 0.37 0.16 0.42 191 XMLngstWrd_01 2362 0.41 0.36 0.42 192 PDS_OTHER_BAD_TLD 2349 0.96 3.51 0.41 193 XMBody_78 2348 0.58 1.38 0.41 194 RELAYCOUNTRY_DE 2334 0.96 3.51 0.41 195 T_FILL_THIS_FORM_LOAN 2224 0.62 1.70 0.39 196 XM_Body_Obfu01 2156 0.38 0.37 0.38 197 TM2_M_BODY_EMPTY 2142 0.33 0.09 0.38 198 T_TooManySym_03 2113 0.36 0.33 0.37 199 RCVD_IN_SORBS_DUL 2099 0.33 0.17 0.37 200 XM_RXBody 2051 0.35 0.30 0.36 ----------------------------------------------------------------------