Email: 398087 Autolearn: 0 AvgScore: 1.15 AvgScanTime: 1.87 sec Spam: 76962 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 3.30 sec Ham: 321125 Autolearn: 0 AvgScore: -1.50 AvgScanTime: 1.53 sec Time Spent Running SA: 207.12 hours Time Spent Processing Spam: 70.55 hours Time Spent Processing Ham: 136.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 72086 88.45 93.66 87.20 2 DKIM_SIGNED 63061 80.46 81.94 80.11 3 DCC_CHECK 60970 54.72 79.22 48.85 4 XM_DK_Pass 60552 78.85 78.68 78.90 5 RELAYCOUNTRY_US 59658 80.81 77.52 81.60 6 XM_B_Unicode 58403 74.55 75.89 74.22 7 XMListUnsubscribeExists 54435 60.53 70.73 58.09 8 DKIM_VALID 53083 74.53 68.97 75.86 9 DKIM_VALID_AU 40346 58.97 52.42 60.54 10 XM_B_Unicode3 35350 47.31 45.93 47.64 11 BAYES_50 33418 50.26 43.42 51.90 12 XM_DK_Undo_02 33312 15.75 43.28 9.15 13 MIME_HTML_ONLY 28345 28.51 36.83 26.52 14 LOC_TINY_FONT_1 27858 30.14 36.20 28.68 15 HTML_FONT_LOW_CONTRAST 24768 33.66 32.18 34.01 16 DKIM_VALID_EF 22456 27.58 29.18 27.19 17 BAYES_99 21264 9.52 27.63 5.18 18 FVGT_m_MULTI_ODD 19894 23.23 25.85 22.61 19 BOTNET 18418 6.74 23.93 2.62 20 XMSubLong 18062 20.58 23.47 19.89 21 T_KAM_HTML_FONT_INVALID 17288 19.23 22.46 18.46 22 RELAYCOUNTRY_META 17106 8.41 22.23 5.10 23 BAYES_999 16458 7.53 21.38 4.21 24 TR_DCC_Bayes_99 15822 6.09 20.56 2.62 25 XM_Body_Dirty_Words 15493 15.47 20.13 14.35 26 DCC_CHECK_NEGATIVE 15089 44.11 19.61 49.98 27 XM_Multi_Part_URI 14290 16.77 18.57 16.33 28 XM_UncommonTLD01 14269 6.18 18.54 3.21 29 T_TM2_M_HEADER_IN_MSG 14260 23.12 18.53 24.22 30 BOTNET_IPINHOSTNAME 12327 7.12 16.02 4.98 31 HTML_IMAGE_RATIO_02 12307 11.16 15.99 10.00 32 UNTRUSTED_Relay 11343 4.12 14.74 1.58 33 LOTS_OF_MONEY 10580 11.75 13.75 11.28 34 FSL_BULK_SIG 10386 9.46 13.49 8.49 35 DKIM_INVALID 9978 5.93 12.96 4.24 36 XM_B_Unsub 9230 11.79 11.99 11.75 37 NO_DNS_FOR_FROM 8414 4.05 10.93 2.40 38 XMSexyCombo_05 7981 6.34 10.37 5.38 39 XM_Evil_Numbers_Gen 7333 10.67 9.53 10.94 40 MPART_ALT_DIFF 7313 5.76 9.50 4.86 41 XM_UB50 6999 2.44 9.09 0.84 42 XM_B_Phish_Phrases 5988 9.53 7.78 9.95 43 BAYES_80 5664 3.89 7.36 3.06 44 XM_H_Long_From01 5293 6.63 6.88 6.57 45 XMStrtUSub 5227 6.06 6.79 5.88 46 LotsOfNums_01 5214 7.52 6.77 7.70 47 HTML_IMAGE_RATIO_04 5077 6.30 6.60 6.23 48 RCVD_IN_BL_SPAMCOP_NET 5051 2.55 6.56 1.59 49 BAYES_60 4844 5.63 6.29 5.47 50 TooManyTo_001 4738 5.55 6.16 5.40 51 XMSubMetaSx_00 4731 4.31 6.15 3.87 52 RCVD_IN_MSPIKE_H2 4675 9.11 6.07 9.84 53 XM_SendGrid 4674 7.32 6.07 7.61 54 T_REMOTE_IMAGE 4611 3.82 5.99 3.30 55 MIME_HTML_MOSTLY 4455 3.49 5.79 2.94 56 RELAYCOUNTRY_FR 4304 1.26 5.59 0.23 57 XM_CamelCaseFrm001 4246 3.07 5.52 2.48 58 RELAYCOUNTRY_CA 4159 2.72 5.40 2.07 59 KHOP_HELO_FCRDNS 4146 1.95 5.39 1.13 60 FROM_SUSPICIOUS_NTLD 3831 0.99 4.98 0.03 61 RCVD_IN_RP_RNBL 3821 1.08 4.96 0.14 62 FROM_SUSPICIOUS_NTLD_FP 3810 0.98 4.95 0.03 63 SpammyFromTLD_02 3710 1.12 4.82 0.24 64 XM_SPF_SoftFail 3625 1.91 4.71 1.24 65 PDS_OTHER_BAD_TLD 3469 1.42 4.51 0.68 66 HTML_IMAGE_RATIO_06 3260 3.87 4.24 3.78 67 RCVD_IN_MSPIKE_BL 3215 1.72 4.18 1.14 68 SpammyFromTLD_01 3118 1.10 4.05 0.39 69 BAYES_95 2983 2.26 3.88 1.87 70 MIME_QP_LONG_LINE 2963 6.39 3.85 6.99 71 MIME_HTML_ONLY_MULTI 2945 3.04 3.83 2.85 72 BAYES_40 2831 4.61 3.68 4.83 73 XMNumbers 2809 4.40 3.65 4.58 74 HTML_MIME_NO_HTML_TAG 2789 1.96 3.62 1.56 75 RELAYCOUNTRY_DE 2665 1.07 3.46 0.50 76 URIBL_SBL_A 2570 0.89 3.34 0.31 77 XMBody_17 2539 1.32 3.30 0.85 78 BAYES_20 2523 3.81 3.28 3.94 79 TR_Mismatch_TLD_02 2522 0.70 3.28 0.08 80 BODY_URI_ONLY 2501 0.66 3.25 0.04 81 HTML_SHORT_LINK_IMG_1 2489 0.65 3.23 0.02 82 RCVD_IN_MSPIKE_L3 2442 1.30 3.17 0.85 83 TM2_M_URI_OPT_OUT 2437 5.46 3.17 6.01 84 HTML_IMAGE_ONLY_08 2426 0.70 3.15 0.11 85 DKIM_ADSP_NXDOMAIN 2422 0.92 3.15 0.39 86 XM_DIRTYINTL 2406 1.20 3.13 0.74 87 HDRS_LCASE_IMGONLY 2386 0.61 3.10 0.01 88 URI_HEX 2379 1.69 3.09 1.35 89 BOTNET_NORDNS 2326 0.61 3.02 0.03 90 LongTLD 2281 0.66 2.96 0.11 91 URI_TRY_3LD 2183 2.43 2.84 2.34 92 XM_B_SpammyTLD 2155 2.80 2.80 2.80 93 RCVD_IN_RP_SAFE 2113 10.49 2.75 12.34 94 RCVD_IN_MSPIKE_H3 2099 8.33 2.73 9.68 95 RCVD_IN_MSPIKE_WL 2099 8.33 2.73 9.68 96 SUBJ_ALL_CAPS 2093 1.85 2.72 1.64 97 XMHTML_After_End 2091 3.22 2.72 3.34 98 TR_Symld_Words 2073 2.40 2.69 2.33 99 T_XMDrugObfuBody_08 2064 1.52 2.68 1.24 100 FROM_EXCESS_BASE64 2041 6.09 2.65 6.91 101 MIME_HEADER_CTYPE_ONLY 1979 0.68 2.57 0.23 102 HTML_IMAGE_RATIO_08 1978 2.49 2.57 2.47 103 BAYES_00 1970 17.34 2.56 20.89 104 RDNS_DYNAMIC 1969 0.79 2.56 0.37 105 TR_LOTS_OF_MONEY3 1948 1.24 2.53 0.93 106 T_XMHurry_00 1942 1.17 2.52 0.85 107 T_TooManySym_01 1932 5.18 2.51 5.82 108 HTML_TITLE_SUBJ_DIFF 1871 0.53 2.43 0.07 109 XMBdyGiftCard01 1835 1.94 2.38 1.83 110 TR_XM_PHPDW 1823 0.80 2.37 0.43 111 XM_OfRef6 1803 1.73 2.34 1.58 112 XMSexyCombo_01 1798 1.39 2.34 1.17 113 FROM_MISSP_REPLYTO 1782 0.46 2.32 0.02 114 T_XMDrugObfuBody_14 1777 1.71 2.31 1.57 115 TR_XM_PHPForged 1773 0.78 2.30 0.42 116 RCVD_IN_PSBL 1767 0.49 2.30 0.06 117 TR_XM_FormFill2 1753 0.78 2.28 0.42 118 XM_H_PHPOS 1750 0.77 2.27 0.41 119 DATE_IN_PAST_03_06 1743 0.50 2.26 0.07 120 DIET_1 1688 1.16 2.19 0.91 121 XM_URI_RBL 1685 0.62 2.19 0.24 122 XM_B_Unsub2 1679 1.82 2.18 1.73 123 TR_XM_INV_DKIM 1644 0.57 2.14 0.19 124 TR_XM_DK_Bayes 1641 14.31 2.13 17.23 125 T_Symld_Words_02 1624 0.83 2.11 0.52 126 XMSlimDrugH 1594 0.69 2.07 0.36 127 ALL_TRUSTED 1593 12.09 2.07 14.49 128 RCVD_IN_RP_CERTIFIED 1551 9.63 2.02 11.45 129 TR_XM_MaxBayes 1546 0.40 2.01 0.02 130 TR_XM_DK_SendGrid 1487 3.98 1.93 4.47 131 XM_H_PHPMailer 1468 2.80 1.91 3.02 132 REMOVE_BEFORE_LINK 1407 0.63 1.83 0.35 133 FROM_MISSP_DYNIP 1398 0.35 1.82 0.00 134 TM2_M_VERY_LONG_WORD 1390 1.53 1.81 1.47 135 XMDiploma_00 1366 1.48 1.77 1.41 136 XMSubMetaI_00 1318 1.37 1.71 1.29 137 XM_DK_Undo_01 1309 1.45 1.70 1.39 138 BAYES_05 1305 2.56 1.70 2.77 139 RCVD_IN_IADB_LISTED 1290 3.62 1.68 4.09 140 XMWghtMeta_00 1245 0.38 1.62 0.08 141 UNPARSEABLE_RELAY 1240 2.92 1.61 3.23 142 HDRS_MISSP 1215 0.34 1.58 0.04 143 XMSubGiftCard1 1210 0.59 1.57 0.35 144 XM_H_PHPOS_M 1198 0.46 1.56 0.20 145 RCVD_IN_IADB_SPF 1186 3.11 1.54 3.49 146 RCVD_IN_IADB_DK 1163 2.68 1.51 2.96 147 RCVD_IN_IADB_SENDERID 1162 2.76 1.51 3.05 148 REPLYTO_WITHOUT_TO_CC 1162 0.32 1.51 0.03 149 XMPhish14 1156 0.54 1.50 0.31 150 SHORT_IMG_SUSP_NTLD 1124 0.28 1.46 0.00 151 TR_XM_DK_Bayes1 1115 13.59 1.45 16.49 152 T_XMDrugObfuBody_00 1081 1.03 1.40 0.94 153 URIBL_ABUSE_SURBL 1067 0.37 1.39 0.12 154 XMStockSpam_06 1067 1.40 1.39 1.41 155 XMSubGiftCard2 1049 0.42 1.36 0.19 156 XMNoVowels 1047 1.00 1.36 0.92 157 XMBrknScrpt_02 1027 0.81 1.33 0.69 158 NORDNS_LOW_CONTRAST 1009 0.26 1.31 0.00 159 XMSubPhish11 956 0.37 1.24 0.16 160 TR_Mismatch_TLD_01 946 0.44 1.23 0.25 161 URI_GOOGLE_PROXY 942 0.26 1.22 0.03 162 SUBJ_OBFU_PUNCT_FEW 939 0.28 1.22 0.05 163 XMGenDplmaNmb 933 0.85 1.21 0.76 164 DEAR_SOMETHING 932 0.31 1.21 0.09 165 MPART_ALT_DIFF_COUNT 923 0.53 1.20 0.36 166 HTML_IMAGE_ONLY_12 915 0.33 1.19 0.13 167 HTML_TAG_BALANCE_CENTER 913 0.33 1.19 0.12 168 MIME_BASE64_TEXT 908 0.29 1.18 0.07 169 XM_ProductURIs 905 1.02 1.18 0.98 170 TO_IN_SUBJ 902 0.53 1.17 0.38 171 XM_UB60 882 0.26 1.15 0.05 172 RELAYCOUNTRY_GB 864 0.68 1.12 0.57 173 HK_RANDOM_REPLYTO 858 0.41 1.11 0.24 174 DKIM_ADSP_CUSTOM_MED 851 0.84 1.11 0.77 175 FILL_THIS_FORM_SHORT 845 1.01 1.10 0.99 176 XM_E_VN 842 0.21 1.09 0.00 177 DATE_IN_PAST_12_24 837 0.27 1.09 0.08 178 TR_Caps_n_Bayes_99 820 0.29 1.07 0.10 179 MAILING_LIST_MULTI 819 1.66 1.06 1.80 180 URI_NOVOWEL 807 0.49 1.05 0.35 181 XMSexyCombo_04 784 0.79 1.02 0.74 182 TO_EQ_FM_DOM_HTML_IMG 778 0.20 1.01 0.00 183 NML_ADSP_CUSTOM_MED 760 0.63 0.99 0.54 184 FORGED_GMAIL_RCVD 745 0.53 0.97 0.43 185 XMEqualsVooDoo_00 733 0.20 0.95 0.02 186 URIBL_BLACK 731 0.19 0.95 0.01 187 PLING_QUERY 725 1.10 0.94 1.14 188 TR_XM_RelayPhish 724 0.28 0.94 0.13 189 RCVD_IN_MSPIKE_L5 720 0.21 0.94 0.04 190 NO_FM_NAME_IP_HOSTN 711 0.18 0.92 0.00 191 XMEqualsVooDoo_01 709 0.18 0.92 0.00 192 XMEqualsVooDoo_02 705 0.18 0.92 0.00 193 XMEqualsVooDoo_03 698 0.18 0.91 0.00 194 URIBL_DBL_SPAM 688 0.20 0.89 0.03 195 XM_UB99 685 0.18 0.89 0.01 196 T_TooManySym_02 676 2.83 0.88 3.30 197 XM_BadFromFormat 663 0.26 0.86 0.11 198 HTML_FONT_FACE_BAD 658 0.95 0.85 0.97 199 SUBJ_DOLLARS 649 0.58 0.84 0.52 200 XMPhish30 647 0.57 0.84 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 280030 88.45 93.66 87.20 2 RELAYCOUNTRY_US 262039 80.81 77.52 81.60 3 DKIM_SIGNED 257240 80.46 81.94 80.11 4 XM_DK_Pass 253359 78.85 78.68 78.90 5 DKIM_VALID 243610 74.53 68.97 75.86 6 XM_B_Unicode 238355 74.55 75.89 74.22 7 DKIM_VALID_AU 194419 58.97 52.42 60.54 8 XMListUnsubscribeExists 186530 60.53 70.73 58.09 9 BAYES_50 166662 50.26 43.42 51.90 10 DCC_CHECK_NEGATIVE 160489 44.11 19.61 49.98 11 DCC_CHECK 156876 54.72 79.22 48.85 12 XM_B_Unicode3 152990 47.31 45.93 47.64 13 HTML_FONT_LOW_CONTRAST 109225 33.66 32.18 34.01 14 LOC_TINY_FONT_1 92112 30.14 36.20 28.68 15 DKIM_VALID_EF 87325 27.58 29.18 27.19 16 MIME_HTML_ONLY 85166 28.51 36.83 26.52 17 T_TM2_M_HEADER_IN_MSG 77788 23.12 18.53 24.22 18 FVGT_m_MULTI_ODD 72593 23.23 25.85 22.61 19 BAYES_00 67069 17.34 2.56 20.89 20 XMSubLong 63876 20.58 23.47 19.89 21 T_KAM_HTML_FONT_INVALID 59278 19.23 22.46 18.46 22 TR_XM_DK_Bayes 55331 14.31 2.13 17.23 23 TR_XM_DK_Bayes1 52967 13.59 1.45 16.49 24 XM_Multi_Part_URI 52450 16.77 18.57 16.33 25 TR_XM_DK_Bayes2 48014 12.21 0.80 14.95 26 ALL_TRUSTED 46541 12.09 2.07 14.49 27 XM_Body_Dirty_Words 46081 15.47 20.13 14.35 28 RCVD_IN_RP_SAFE 39641 10.49 2.75 12.34 29 XM_B_Unsub 37721 11.79 11.99 11.75 30 RCVD_IN_RP_CERTIFIED 36771 9.63 2.02 11.45 31 LOTS_OF_MONEY 36214 11.75 13.75 11.28 32 XM_Evil_Numbers_Gen 35135 10.67 9.53 10.94 33 HTML_IMAGE_RATIO_02 32120 11.16 15.99 10.00 34 XM_B_Phish_Phrases 31939 9.53 7.78 9.95 35 XM_DKIMWhitelistDomains 31684 7.99 0.17 9.87 36 RCVD_IN_MSPIKE_H2 31604 9.11 6.07 9.84 37 RCVD_IN_MSPIKE_H3 31081 8.33 2.73 9.68 38 RCVD_IN_MSPIKE_WL 31081 8.33 2.73 9.68 39 XM_DK_Undo_02 29389 15.75 43.28 9.15 40 FSL_BULK_SIG 27276 9.46 13.49 8.49 41 LotsOfNums_01 24720 7.52 6.77 7.70 42 XM_SendGrid 24452 7.32 6.07 7.61 43 MIME_QP_LONG_LINE 22461 6.39 3.85 6.99 44 FROM_EXCESS_BASE64 22184 6.09 2.65 6.91 45 XM_H_Long_From01 21106 6.63 6.88 6.57 46 HTML_IMAGE_RATIO_04 20019 6.30 6.60 6.23 47 TM2_M_URI_OPT_OUT 19309 5.46 3.17 6.01 48 XMStrtUSub 18878 6.06 6.79 5.88 49 T_TooManySym_01 18675 5.18 2.51 5.82 50 BAYES_60 17554 5.63 6.29 5.47 51 TooManyTo_001 17344 5.55 6.16 5.40 52 XMSexyCombo_05 17263 6.34 10.37 5.38 53 BAYES_99 16631 9.52 27.63 5.18 54 RELAYCOUNTRY_META 16391 8.41 22.23 5.10 55 BOTNET_IPINHOSTNAME 16004 7.12 16.02 4.98 56 MPART_ALT_DIFF 15614 5.76 9.50 4.86 57 BAYES_40 15522 4.61 3.68 4.83 58 XMNumbers 14711 4.40 3.65 4.58 59 TR_XM_DK_SendGrid 14352 3.98 1.93 4.47 60 DKIM_INVALID 13630 5.93 12.96 4.24 61 BAYES_999 13515 7.53 21.38 4.21 62 RCVD_IN_IADB_LISTED 13129 3.62 1.68 4.09 63 BAYES_20 12653 3.81 3.28 3.94 64 XMSubMetaSx_00 12437 4.31 6.15 3.87 65 HTML_IMAGE_RATIO_06 12137 3.87 4.24 3.78 66 RCVD_IN_IADB_SPF 11209 3.11 1.54 3.49 67 XMHTML_After_End 10711 3.22 2.72 3.34 68 T_REMOTE_IMAGE 10611 3.82 5.99 3.30 69 T_TooManySym_02 10603 2.83 0.88 3.30 70 ANY_BOUNCE_MESSAGE 10489 2.69 0.28 3.27 71 BOUNCE_MESSAGE 10488 2.69 0.27 3.27 72 UNPARSEABLE_RELAY 10382 2.92 1.61 3.23 73 XM_UncommonTLD01 10320 6.18 18.54 3.21 74 IN_ZIMBRA_NJ_WHITELIST 10002 2.51 0.01 3.11 75 BAYES_80 9831 3.89 7.36 3.06 76 RCVD_IN_IADB_SENDERID 9807 2.76 1.51 3.05 77 XM_H_PHPMailer 9693 2.80 1.91 3.02 78 RCVD_IN_IADB_DK 9511 2.68 1.51 2.96 79 MIME_HTML_MOSTLY 9439 3.49 5.79 2.94 80 MIME_HTML_ONLY_MULTI 9138 3.04 3.83 2.85 81 XM_B_SpammyTLD 8990 2.80 2.80 2.80 82 BAYES_05 8894 2.56 1.70 2.77 83 RCVD_IN_IADB_VOUCHED 8888 2.32 0.44 2.77 84 BOTNET 8417 6.74 23.93 2.62 85 TR_DCC_Bayes_99 8404 6.09 20.56 2.62 86 XM_CamelCaseFrm001 7969 3.07 5.52 2.48 87 HTML_IMAGE_RATIO_08 7941 2.49 2.57 2.47 88 NO_DNS_FOR_FROM 7697 4.05 10.93 2.40 89 URI_TRY_3LD 7503 2.43 2.84 2.34 90 TR_Symld_Words 7496 2.40 2.69 2.33 91 TVD_RCVD_IP 7376 1.97 0.60 2.30 92 INVALID_MSGID 7339 1.88 0.18 2.29 93 XM_PDF 7279 1.88 0.28 2.27 94 TO_MALFORMED 7255 1.83 0.02 2.26 95 RELAYCOUNTRY_CA 6662 2.72 5.40 2.07 96 CK_HELO_DYNAMIC_SPLIT_IP 6043 1.57 0.28 1.88 97 HELO_DYNAMIC_IPADDR2 6040 1.53 0.06 1.88 98 BAYES_95 5999 2.26 3.88 1.87 99 XMBdyGiftCard01 5887 1.94 2.38 1.83 100 MAILING_LIST_MULTI 5783 1.66 1.06 1.80 101 RCVD_IN_IADB_OPTIN 5588 1.48 0.40 1.74 102 XM_B_Unsub2 5554 1.82 2.18 1.73 103 XM_H_Trusted_IP 5373 1.35 0.00 1.67 104 SUBJ_ALL_CAPS 5261 1.85 2.72 1.64 105 IN_HORDE_ADDRESS_BOOK 5208 1.32 0.04 1.62 106 RCVD_IN_BL_SPAMCOP_NET 5117 2.55 6.56 1.59 107 XM_OfRef6 5078 1.73 2.34 1.58 108 UNTRUSTED_Relay 5074 4.12 14.74 1.58 109 T_XMDrugObfuBody_14 5035 1.71 2.31 1.57 110 HTML_MIME_NO_HTML_TAG 5015 1.96 3.62 1.56 111 USER_IN_DEF_DKIM_WL 4742 1.19 0.01 1.48 112 TM2_M_VERY_LONG_WORD 4713 1.53 1.81 1.47 113 XMDiploma_00 4515 1.48 1.77 1.41 114 XMStockSpam_06 4514 1.40 1.39 1.41 115 XM_DK_Undo_01 4466 1.45 1.70 1.39 116 URI_HEX 4350 1.69 3.09 1.35 117 XMSubMetaI_00 4142 1.37 1.71 1.29 118 XM_SPF_SoftFail 3995 1.91 4.71 1.24 119 T_XMDrugObfuBody_08 3988 1.52 2.68 1.24 120 XMSexyCombo_01 3750 1.39 2.34 1.17 121 TR_MSPIKEBAYES00 3719 0.94 0.01 1.16 122 PLING_QUERY 3656 1.10 0.94 1.14 123 RCVD_IN_MSPIKE_BL 3648 1.72 4.18 1.14 124 XM_GoogleGroups 3628 0.99 0.42 1.13 125 KHOP_HELO_FCRDNS 3614 1.95 5.39 1.13 126 XM_H_Long_From02 3593 1.03 0.66 1.12 127 TooManyTo_002 3520 0.99 0.54 1.10 128 XMGappySubj_01 3309 0.85 0.10 1.03 129 FILL_THIS_FORM_SHORT 3187 1.01 1.10 0.99 130 XMSubMetaSxObfu_03 3163 0.93 0.72 0.98 131 XM_ProductURIs 3153 1.02 1.18 0.98 132 HTML_FONT_FACE_BAD 3106 0.95 0.85 0.97 133 T_XMDrugObfuBody_00 3025 1.03 1.40 0.94 134 TR_LOTS_OF_MONEY3 3002 1.24 2.53 0.93 135 XMNoVowels 2941 1.00 1.36 0.92 136 DIET_1 2932 1.16 2.19 0.91 137 XMBody_95 2914 0.74 0.06 0.91 138 T_TooManySym_03 2790 0.76 0.29 0.87 139 THIS_AD 2762 0.85 0.81 0.86 140 XMBody_17 2731 1.32 3.30 0.85 141 T_XMHurry_00 2723 1.17 2.52 0.85 142 RCVD_IN_MSPIKE_L3 2720 1.30 3.17 0.85 143 XM_UB50 2713 2.44 9.09 0.84 144 XM_B_REG_HTML 2695 0.79 0.58 0.84 145 TR_MetaPhish_Combo_01 2674 0.81 0.71 0.83 146 DKIM_ADSP_CUSTOM_MED 2484 0.84 1.11 0.77 147 USER_IN_WHITELIST 2474 0.62 0.00 0.77 148 TM2_M_A_HREF_HREF 2466 0.78 0.81 0.77 149 XMGenDplmaNmb 2445 0.85 1.21 0.76 150 XMSubNoVowel 2418 0.72 0.60 0.75 151 HTML_TAG_BALANCE_BODY 2412 0.75 0.76 0.75 152 XMSexyCombo_04 2364 0.79 1.02 0.74 153 XM_DIRTYINTL 2362 1.20 3.13 0.74 154 TooManyTo_003 2324 0.66 0.39 0.72 155 XMBrknScrpt_02 2205 0.81 1.33 0.69 156 PDS_OTHER_BAD_TLD 2193 1.42 4.51 0.68 157 XMPhish08 2170 0.69 0.73 0.68 158 XMLngstWrd_00 2064 0.67 0.80 0.64 159 XMSubMetaSx_01 2029 0.60 0.46 0.63 160 HTTPS_HTTP_MISMATCH 2027 0.66 0.80 0.63 161 FILL_THIS_FORM 1982 0.53 0.19 0.62 162 TooManyTo_004 1919 0.54 0.31 0.60 163 XMSexyCombo_02 1908 0.54 0.33 0.59 164 RELAYCOUNTRY_GB 1839 0.68 1.12 0.57 165 XMHTMLBadTable_001 1797 0.61 0.81 0.56 166 HELO_NODOT 1768 0.52 0.40 0.55 167 NML_ADSP_CUSTOM_MED 1742 0.63 0.99 0.54 168 HELO_NO_DOMAIN 1725 0.51 0.40 0.54 169 XM_Body_Obfu01 1708 0.47 0.21 0.53 170 TooManyTo_005 1683 0.47 0.26 0.52 171 XM_RXBody 1680 0.52 0.48 0.52 172 XM_D_tchamptons_WL 1678 0.42 0.00 0.52 173 T_Symld_Words_02 1663 0.83 2.11 0.52 174 SUBJ_DOLLARS 1656 0.58 0.84 0.52 175 XMLngstWrd_01 1641 0.57 0.79 0.51 176 XMPhish30 1635 0.57 0.84 0.51 177 RELAYCOUNTRY_DE 1611 1.07 3.46 0.50 178 XM_B_COPY_HTML 1544 0.53 0.76 0.48 179 FILL_THIS_FORM_LONG 1530 0.41 0.13 0.48 180 FSL_THIS_IS_ADV 1526 0.54 0.79 0.48 181 XMSubMetaSxObfu_02 1521 0.44 0.29 0.47 182 T_OBFU_PDF_ATTACH 1510 0.40 0.09 0.47 183 URI_OPTOUT_3LD 1502 0.45 0.36 0.47 184 HTML_IMAGE_ONLY_20 1481 0.41 0.19 0.46 185 T_TooManySym_04 1461 0.39 0.13 0.45 186 T_FILL_THIS_FORM_LOAN 1452 0.38 0.08 0.45 187 RELAYCOUNTRY_AU 1411 0.42 0.36 0.44 188 XMRcvdHeader_15 1391 0.35 0.00 0.43 189 TR_XM_PHPDW 1376 0.80 2.37 0.43 190 FORGED_GMAIL_RCVD 1374 0.53 0.97 0.43 191 TR_XM_PHPForged 1351 0.78 2.30 0.42 192 XMSolicitRefs_0 1346 0.46 0.65 0.42 193 TR_XM_FormFill2 1344 0.78 2.28 0.42 194 XM_H_PHPOS 1328 0.77 2.27 0.41 195 SpammyFromTLD_01 1252 1.10 4.05 0.39 196 XMLngstWrd_02 1250 0.42 0.56 0.39 197 DKIM_ADSP_NXDOMAIN 1244 0.92 3.15 0.39 198 XMCapTrack 1233 0.46 0.80 0.38 199 TO_IN_SUBJ 1220 0.53 1.17 0.38 200 RDNS_DYNAMIC 1192 0.79 2.56 0.37 ----------------------------------------------------------------------