Email: 289454 Autolearn: 0 AvgScore: 3.79 AvgScanTime: 3.02 sec Spam: 96037 Autolearn: 0 AvgScore: 13.07 AvgScanTime: 3.77 sec Ham: 193417 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 2.65 sec Time Spent Running SA: 243.18 hours Time Spent Processing Spam: 100.58 hours Time Spent Processing Ham: 142.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89294 79.46 92.98 72.75 2 DKIM_SIGNED 82351 73.77 85.75 67.82 3 XM_DK_Pass 79698 72.23 82.99 66.89 4 DCC_CHECK 76717 51.58 79.88 37.53 5 DKIM_VALID 76639 69.14 79.80 63.85 6 XMListUnsubscribeExists 70985 54.11 73.91 44.28 7 DKIM_VALID_AU 64468 56.75 67.13 51.59 8 XM_H_QuotedFrom 54704 39.38 56.96 30.65 9 XM_DK_Undo_02 48449 29.02 50.45 18.38 10 BAYES_99 44116 27.31 45.94 18.07 11 LOC_TINY_FONT_1 38163 27.55 39.74 21.50 12 BAYES_999 38059 24.03 39.63 16.28 13 HTML_FONT_LOW_CONTRAST 36937 31.18 38.46 27.57 14 TR_DCC_Bayes_99 34790 18.71 36.23 10.01 15 MIME_HTML_ONLY 30950 22.01 32.23 16.93 16 BAYES_50 28515 45.16 29.69 52.84 17 FVGT_m_MULTI_ODD 24590 20.89 25.60 18.55 18 XMSubLong 24425 20.86 25.43 18.60 19 XM_Body_Dirty_Words 20120 13.91 20.95 10.42 20 HTML_IMAGE_RATIO_02 18940 11.76 19.72 7.81 21 DKIM_VALID_EF 18912 25.23 19.69 27.98 22 T_KAM_HTML_FONT_INVALID 18128 13.97 18.88 11.53 23 RELAYCOUNTRY_META 17900 9.44 18.64 4.87 24 T_TM2_M_HEADER_IN_MSG 17583 27.29 18.31 31.76 25 DCC_CHECK_NEGATIVE 17254 46.78 17.97 61.09 26 XM_Multi_Part_URI 16182 13.30 16.85 11.54 27 MultiRelay 15521 15.09 16.16 14.56 28 XM_Evil_Numbers_Gen 14679 9.77 15.28 7.03 29 BOTNET 14613 5.85 15.22 1.20 30 BOTNET_IPINHOSTNAME 13010 8.06 13.55 5.34 31 FSL_BULK_SIG 12093 9.24 12.59 7.58 32 UNTRUSTED_Relay 11260 4.90 11.72 1.52 33 XMSexyCombo_05 10489 5.64 10.92 3.02 34 LOTS_OF_MONEY 10047 8.34 10.46 7.29 35 XM_B_Phish_Phrases 10019 6.98 10.43 5.27 36 LotsOfNums_01 8504 7.90 8.85 7.42 37 TR_XM_DocInvoice 8474 5.43 8.82 3.75 38 HTML_IMAGE_RATIO_04 8446 5.80 8.79 4.32 39 T_XMDrugObfuBody_14 8324 7.07 8.67 6.27 40 TooManyTo_001 8044 7.20 8.38 6.62 41 FROM_EXCESS_BASE64 7821 5.37 8.14 3.99 42 BAYES_80 7465 4.97 7.77 3.58 43 XM_H_Long_From01 7407 12.96 7.71 15.57 44 XM_UncommonTLD01 7111 6.19 7.40 5.58 45 RCVD_IN_RP_SAFE 7064 11.09 7.36 12.94 46 XMSubMetaSx_00 6351 4.48 6.61 3.42 47 HTML_IMAGE_RATIO_06 6344 4.66 6.61 3.69 48 BAYES_60 6214 6.13 6.47 5.96 49 RCVD_IN_RP_CERTIFIED 6057 10.04 6.31 11.90 50 MPART_ALT_DIFF 5737 3.92 5.97 2.90 51 DKIM_INVALID 5712 4.62 5.95 3.97 52 XMNumbers 5492 5.31 5.72 5.11 53 XMStrtUSub 5486 5.33 5.71 5.13 54 RCVD_IN_MSPIKE_H2 5397 5.00 5.62 4.70 55 MIME_HTML_MOSTLY 4781 3.84 4.98 3.28 56 BAYES_95 4408 3.31 4.59 2.67 57 XM_SendGrid 4314 4.47 4.49 4.47 58 XM_UB50 4261 2.09 4.44 0.93 59 XM_DIRTYINTL 4251 2.67 4.43 1.80 60 SUBJ_ALL_CAPS 4114 9.04 4.28 11.41 61 RCVD_IN_BL_SPAMCOP_NET 4072 1.53 4.24 0.18 62 XM_SPF_SoftFail 3982 2.48 4.15 1.65 63 T_REMOTE_IMAGE 3878 3.48 4.04 3.20 64 MultiRelay_Combo 3751 1.45 3.91 0.23 65 MultiRelay_CC 3751 1.45 3.91 0.23 66 TM2_M_URI_OPT_OUT 3694 2.28 3.85 1.51 67 RCVD_IN_RP_RNBL 3579 1.27 3.73 0.06 68 XM_CamelCaseFrm001 3507 2.14 3.65 1.39 69 XM_OfRef6 3412 2.15 3.55 1.45 70 URI_HEX 3341 2.12 3.48 1.44 71 MIME_QP_LONG_LINE 3326 3.51 3.46 3.54 72 NO_DNS_FOR_FROM 3175 2.30 3.31 1.80 73 RELAYCOUNTRY_CA 3082 1.91 3.21 1.27 74 BOTNET_NORDNS 2728 0.96 2.84 0.02 75 MIME_HTML_ONLY_MULTI 2633 1.58 2.74 1.01 76 HTML_MIME_NO_HTML_TAG 2558 1.94 2.66 1.58 77 XMSubMetaI_00 2528 1.33 2.63 0.69 78 UNPARSEABLE_RELAY 2420 3.75 2.52 4.36 79 T_TooManySym_01 2318 3.74 2.41 4.41 80 XM_H_Long_From02 2290 1.25 2.38 0.69 81 XM_BadFromFormat 2280 0.95 2.37 0.25 82 XMBdyGiftCard01 2274 1.55 2.37 1.14 83 HTML_IMAGE_RATIO_08 2254 1.86 2.35 1.61 84 SpammyFromTLD_01 2186 1.52 2.28 1.15 85 XM_UB99 2075 0.73 2.16 0.02 86 XMBody_17 2067 0.98 2.15 0.39 87 URIBL_BLACK 2051 0.72 2.14 0.02 88 DIET_1 2040 0.93 2.12 0.34 89 XM_ProductURIs 2021 1.66 2.10 1.44 90 XM_RXBody 1998 0.80 2.08 0.16 91 TR_Mismatch_TLD_02 1985 0.72 2.07 0.05 92 RCVD_IN_PSBL 1976 0.81 2.06 0.19 93 XM_B_REG_HTML 1912 1.18 1.99 0.78 94 XM_UB60 1895 0.76 1.97 0.16 95 FILL_THIS_FORM 1855 1.13 1.93 0.73 96 T_FILL_THIS_FORM_SHORT 1843 1.00 1.92 0.54 97 XMPhish30 1781 0.84 1.85 0.34 98 T_XMHurry_00 1773 1.02 1.85 0.61 99 BAYES_40 1729 5.81 1.80 7.80 100 FILL_THIS_FORM_LONG 1718 0.97 1.79 0.56 101 XM_URI_RBL 1672 0.64 1.74 0.09 102 SpammyFromTLD_02 1662 0.69 1.73 0.18 103 RELAYCOUNTRY_CN 1662 0.62 1.73 0.07 104 SUBJ_DOLLARS 1624 0.71 1.69 0.22 105 XM_UB999 1608 0.57 1.67 0.02 106 URIBL_DBL_SPAM 1572 0.57 1.64 0.03 107 MAILING_LIST_MULTI 1567 1.89 1.63 2.02 108 PLING_QUERY 1563 0.91 1.63 0.56 109 T_XMDrugObfuBody_08 1529 1.18 1.59 0.98 110 BAYES_00 1520 4.26 1.58 5.59 111 RCVD_IN_IADB_LISTED 1462 2.57 1.52 3.09 112 ALL_TRUSTED 1446 18.69 1.51 27.23 113 XM_DK_Undo_01 1420 1.71 1.48 1.83 114 BODY_URI_ONLY 1406 0.51 1.46 0.04 115 RELAYCOUNTRY_PL 1400 0.50 1.46 0.02 116 RELAYCOUNTRY_GB 1372 0.96 1.43 0.72 117 HTML_IMAGE_ONLY_08 1363 0.54 1.42 0.10 118 RCVD_IN_IADB_SPF 1339 2.29 1.39 2.74 119 HTML_SHORT_LINK_IMG_1 1326 0.47 1.38 0.02 120 TR_XM_DK_Bayes 1323 3.06 1.38 3.90 121 XMHTMLBadTable_001 1315 0.89 1.37 0.64 122 XMSexyCombo_01 1303 0.68 1.36 0.35 123 XMStockSpam_06 1300 0.84 1.35 0.59 124 TR_XM_DK_Bayes1 1299 2.86 1.35 3.60 125 RCVD_IN_IADB_SENDERID 1291 2.09 1.34 2.46 126 TM2_M_VERY_LONG_WORD 1288 0.98 1.34 0.80 127 XM_UB80 1269 0.48 1.32 0.06 128 RCVD_IN_IADB_DK 1260 2.04 1.31 2.40 129 RELAYCOUNTRY_AT 1254 0.55 1.31 0.17 130 DKIM_ADSP_CUSTOM_MED 1236 1.11 1.29 1.03 131 XMHTML_After_End 1232 0.61 1.28 0.28 132 TR_XM_DK_Bayes2 1232 2.59 1.28 3.24 133 BAYES_20 1229 1.75 1.28 1.98 134 XMDiploma_00 1200 1.13 1.25 1.08 135 XM_H_PHPOS 1186 1.52 1.23 1.67 136 TooManyTo_002 1184 1.57 1.23 1.74 137 T_XMDrugObfuBody_00 1180 0.66 1.23 0.37 138 T_FILL_THIS_FORM_LOAN 1179 0.83 1.23 0.64 139 DEAR_FRIEND 1175 0.42 1.22 0.02 140 FORM_FRAUD_5 1173 0.41 1.22 0.00 141 TR_MetaPhish_Combo_01 1115 0.74 1.16 0.52 142 MONEY_FORM_SHORT 1111 0.39 1.16 0.01 143 TooManyTo_003 1088 1.17 1.13 1.19 144 NML_ADSP_CUSTOM_MED 1082 0.87 1.13 0.75 145 RELAYCOUNTRY_FR 1062 0.57 1.11 0.30 146 FROM_MISSP_EH_MATCH 1060 0.37 1.10 0.00 147 TR_XM_RelayPhish 1029 0.56 1.07 0.30 148 XMBody_78 1029 0.90 1.07 0.82 149 XM_HighProb1 1027 0.37 1.07 0.02 150 DKIM_ADSP_NXDOMAIN 1026 0.69 1.07 0.50 151 XM_XX_Yahoo 1023 0.45 1.07 0.15 152 XM_B_COPY_HTML 1018 0.84 1.06 0.73 153 RDNS_DYNAMIC 1007 0.68 1.05 0.49 154 XMClaimOffer 987 0.45 1.03 0.16 155 RELAYCOUNTRY_NL 979 0.50 1.02 0.24 156 RELAYCOUNTRY_ES 969 0.36 1.01 0.03 157 FORGED_GMAIL_RCVD 960 0.62 1.00 0.44 158 XMPhish11 953 1.21 0.99 1.32 159 URI_TRY_3LD 951 1.03 0.99 1.05 160 TR_Caps_n_Bayes_80 936 0.34 0.97 0.02 161 TR_Mismatch_TLD_01 883 0.38 0.92 0.12 162 RELAYCOUNTRY_RU 828 0.31 0.86 0.04 163 XM_OfRef7 805 0.39 0.84 0.16 164 XMBrknScrpt_02 802 0.61 0.84 0.49 165 TooManyTo_004 796 0.91 0.83 0.94 166 FROM_LOCAL_HEX 796 0.32 0.83 0.07 167 TR_LOTS_OF_MONEY2 794 0.38 0.83 0.16 168 T_MONEY_PERCENT 794 0.38 0.83 0.16 169 HDRS_LCASE_IMGONLY 794 0.29 0.83 0.03 170 CK_HELO_DYNAMIC_SPLIT_IP 777 0.27 0.81 0.00 171 FROM_LOCAL_DIGITS 776 0.28 0.81 0.02 172 TR_LOTS_OF_MONEY3 775 0.64 0.81 0.55 173 BODY_ENHANCEMENT 763 0.28 0.79 0.02 174 T_Symld_Words_02 759 0.49 0.79 0.34 175 XMLongAddy 755 0.32 0.79 0.10 176 BAYES_05 754 1.23 0.79 1.45 177 RELAYCOUNTRY_JP 754 0.29 0.79 0.05 178 RELAYCOUNTRY_DE 745 0.60 0.78 0.52 179 HTML_FONT_FACE_BAD 739 0.62 0.77 0.55 180 XM_Body_Obfu01 735 0.37 0.77 0.17 181 FSL_THIS_IS_ADV 719 0.31 0.75 0.10 182 XMSubNoVowel 719 0.74 0.75 0.74 183 XM_H_PHPMailer 714 0.92 0.74 1.00 184 TooManyTo_005 705 0.79 0.73 0.82 185 T_TooManySym_02 704 1.58 0.73 2.01 186 RELAYCOUNTRY_BR 702 0.25 0.73 0.02 187 XMSlimDrugH 701 0.45 0.73 0.31 188 RELAYCOUNTRY_IN 661 0.28 0.69 0.08 189 TR_Symld_Words 653 1.35 0.68 1.68 190 XMGppyBdWords 649 0.29 0.68 0.11 191 ADVANCE_FEE_4_NEW 645 0.30 0.67 0.12 192 XMSubMetaSSx_00 643 0.36 0.67 0.21 193 HTML_FONT_SIZE_LARGE 639 0.31 0.67 0.13 194 XM_ShortIntro_01 620 0.55 0.65 0.50 195 PP_MIME_FAKE_ASCII_TEXT 614 0.34 0.64 0.19 196 FORM_FRAUD 606 0.21 0.63 0.00 197 RCVD_IN_MSPIKE_H3 604 1.12 0.63 1.37 198 RCVD_IN_MSPIKE_WL 604 1.12 0.63 1.37 199 HELO_MISC_IP 604 0.21 0.63 0.01 200 LongTLD 593 0.32 0.62 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140714 79.46 92.98 72.75 2 DKIM_SIGNED 131169 73.77 85.75 67.82 3 XM_DK_Pass 129369 72.23 82.99 66.89 4 DKIM_VALID 123495 69.14 79.80 63.85 5 DCC_CHECK_NEGATIVE 118153 46.78 17.97 61.09 6 BAYES_50 102193 45.16 29.69 52.84 7 DKIM_VALID_AU 99792 56.75 67.13 51.59 8 XMListUnsubscribeExists 85642 54.11 73.91 44.28 9 DCC_CHECK 72590 51.58 79.88 37.53 10 T_TM2_M_HEADER_IN_MSG 61423 27.29 18.31 31.76 11 XM_H_QuotedFrom 59281 39.38 56.96 30.65 12 DKIM_VALID_EF 54122 25.23 19.69 27.98 13 HTML_FONT_LOW_CONTRAST 53319 31.18 38.46 27.57 14 ALL_TRUSTED 52658 18.69 1.51 27.23 15 LOC_TINY_FONT_1 41589 27.55 39.74 21.50 16 XMSubLong 35968 20.86 25.43 18.60 17 FVGT_m_MULTI_ODD 35884 20.89 25.60 18.55 18 XM_DK_Undo_02 35551 29.02 50.45 18.38 19 BAYES_99 34941 27.31 45.94 18.07 20 MIME_HTML_ONLY 32747 22.01 32.23 16.93 21 BAYES_999 31494 24.03 39.63 16.28 22 XM_H_Long_From01 30111 12.96 7.71 15.57 23 MultiRelay 28162 15.09 16.16 14.56 24 RCVD_IN_RP_SAFE 25028 11.09 7.36 12.94 25 XM_DKIMWhitelistDomains 24162 8.36 0.04 12.49 26 RCVD_IN_RP_CERTIFIED 23014 10.04 6.31 11.90 27 XM_Multi_Part_URI 22328 13.30 16.85 11.54 28 T_KAM_HTML_FONT_INVALID 22295 13.97 18.88 11.53 29 SUBJ_ALL_CAPS 22067 9.04 4.28 11.41 30 XM_Body_Dirty_Words 20150 13.91 20.95 10.42 31 TR_DCC_Bayes_99 19361 18.71 36.23 10.01 32 HTML_IMAGE_RATIO_02 15113 11.76 19.72 7.81 33 BAYES_40 15088 5.81 1.80 7.80 34 FSL_BULK_SIG 14660 9.24 12.59 7.58 35 LotsOfNums_01 14352 7.90 8.85 7.42 36 LOTS_OF_MONEY 14097 8.34 10.46 7.29 37 XM_Evil_Numbers_Gen 13604 9.77 15.28 7.03 38 TooManyTo_001 12811 7.20 8.38 6.62 39 T_XMDrugObfuBody_14 12134 7.07 8.67 6.27 40 BAYES_60 11524 6.13 6.47 5.96 41 BAYES_00 10803 4.26 1.58 5.59 42 XM_UncommonTLD01 10799 6.19 7.40 5.58 43 BOTNET_IPINHOSTNAME 10330 8.06 13.55 5.34 44 XM_B_Phish_Phrases 10193 6.98 10.43 5.27 45 XMStrtUSub 9930 5.33 5.71 5.13 46 XMNumbers 9874 5.31 5.72 5.11 47 RELAYCOUNTRY_META 9410 9.44 18.64 4.87 48 IN_ZIMBRA_NJ_WHITELIST 9399 3.26 0.04 4.86 49 ANY_BOUNCE_MESSAGE 9254 3.34 0.44 4.78 50 BOUNCE_MESSAGE 9252 3.34 0.44 4.78 51 RCVD_IN_MSPIKE_H2 9084 5.00 5.62 4.70 52 XM_SendGrid 8637 4.47 4.49 4.47 53 T_TooManySym_01 8521 3.74 2.41 4.41 54 UNPARSEABLE_RELAY 8442 3.75 2.52 4.36 55 HTML_IMAGE_RATIO_04 8356 5.80 8.79 4.32 56 TVD_RCVD_IP 7762 2.85 0.49 4.01 57 FROM_EXCESS_BASE64 7709 5.37 8.14 3.99 58 DKIM_INVALID 7674 4.62 5.95 3.97 59 TR_XM_DK_Bayes 7546 3.06 1.38 3.90 60 TO_MALFORMED 7302 2.53 0.01 3.78 61 TR_XM_DocInvoice 7244 5.43 8.82 3.75 62 HTML_IMAGE_RATIO_06 7142 4.66 6.61 3.69 63 TR_XM_DK_Bayes1 6970 2.86 1.35 3.60 64 BAYES_80 6919 4.97 7.77 3.58 65 MIME_QP_LONG_LINE 6843 3.51 3.46 3.54 66 INVALID_MSGID 6800 2.43 0.25 3.52 67 XMSubMetaSx_00 6624 4.48 6.61 3.42 68 MSGID_NOFQDN1 6614 2.30 0.03 3.42 69 MIME_HTML_MOSTLY 6339 3.84 4.98 3.28 70 TR_XM_DK_Bayes2 6259 2.59 1.28 3.24 71 T_REMOTE_IMAGE 6199 3.48 4.04 3.20 72 RCVD_IN_IADB_LISTED 5982 2.57 1.52 3.09 73 XMSexyCombo_05 5844 5.64 10.92 3.02 74 MPART_ALT_DIFF 5611 3.92 5.97 2.90 75 RCVD_IN_IADB_SPF 5296 2.29 1.39 2.74 76 BAYES_95 5166 3.31 4.59 2.67 77 IN_HORDE_ADDRESS_BOOK 4909 1.73 0.09 2.54 78 RCVD_IN_IADB_SENDERID 4749 2.09 1.34 2.46 79 USER_IN_DEF_DKIM_WL 4744 1.68 0.13 2.45 80 RCVD_IN_IADB_DK 4646 2.04 1.31 2.40 81 RCVD_IN_IADB_VOUCHED 3924 1.55 0.60 2.03 82 MAILING_LIST_MULTI 3913 1.89 1.63 2.02 83 T_TooManySym_02 3882 1.58 0.73 2.01 84 BAYES_20 3828 1.75 1.28 1.98 85 XM_PDF 3571 1.35 0.36 1.85 86 XM_DK_Undo_01 3530 1.71 1.48 1.83 87 NO_DNS_FOR_FROM 3485 2.30 3.31 1.80 88 XM_DIRTYINTL 3472 2.67 4.43 1.80 89 TooManyTo_002 3374 1.57 1.23 1.74 90 TR_Symld_Words 3242 1.35 0.68 1.68 91 XM_H_PHPOS 3224 1.52 1.23 1.67 92 XM_SPF_SoftFail 3200 2.48 4.15 1.65 93 HTML_IMAGE_RATIO_08 3117 1.86 2.35 1.61 94 HTML_MIME_NO_HTML_TAG 3050 1.94 2.66 1.58 95 UNTRUSTED_Relay 2935 4.90 11.72 1.52 96 TM2_M_URI_OPT_OUT 2914 2.28 3.85 1.51 97 XM_OfRef6 2800 2.15 3.55 1.45 98 BAYES_05 2799 1.23 0.79 1.45 99 URI_HEX 2791 2.12 3.48 1.44 100 XM_ProductURIs 2781 1.66 2.10 1.44 101 XM_CamelCaseFrm001 2680 2.14 3.65 1.39 102 RCVD_IN_MSPIKE_WL 2645 1.12 0.63 1.37 103 RCVD_IN_MSPIKE_H3 2645 1.12 0.63 1.37 104 XM_GoogleGroups 2615 1.10 0.58 1.35 105 XMPhish11 2561 1.21 0.99 1.32 106 USER_IN_WHITELIST 2496 0.86 0.00 1.29 107 RELAYCOUNTRY_CA 2450 1.91 3.21 1.27 108 BOTNET 2329 5.85 15.22 1.20 109 TooManyTo_003 2307 1.17 1.13 1.19 110 RCVD_IN_IADB_OPTIN 2299 0.96 0.50 1.19 111 SpammyFromTLD_01 2223 1.52 2.28 1.15 112 XMBdyGiftCard01 2205 1.55 2.37 1.14 113 XMDiploma_00 2083 1.13 1.25 1.08 114 URI_TRY_3LD 2023 1.03 0.99 1.05 115 DKIM_ADSP_CUSTOM_MED 1985 1.11 1.29 1.03 116 T_TooManySym_03 1981 0.76 0.23 1.02 117 MIME_HTML_ONLY_MULTI 1947 1.58 2.74 1.01 118 XM_H_PHPMailer 1939 0.92 0.74 1.00 119 T_XMDrugObfuBody_08 1888 1.18 1.59 0.98 120 XMBody_29 1881 0.70 0.15 0.97 121 TooManyTo_004 1825 0.91 0.83 0.94 122 XM_UB50 1801 2.09 4.44 0.93 123 XMBody_95 1690 0.64 0.16 0.87 124 XMBody_78 1585 0.90 1.07 0.82 125 TooManyTo_005 1580 0.79 0.73 0.82 126 TM2_M_VERY_LONG_WORD 1541 0.98 1.34 0.80 127 XM_B_REG_HTML 1511 1.18 1.99 0.78 128 XMLngstWrd_00 1460 0.64 0.42 0.75 129 XMSubMetaSxObfu_02 1451 0.59 0.28 0.75 130 NML_ADSP_CUSTOM_MED 1447 0.87 1.13 0.75 131 XMNoVowels 1443 0.67 0.51 0.75 132 XMSubNoVowel 1427 0.74 0.75 0.74 133 XM_B_COPY_HTML 1416 0.84 1.06 0.73 134 FILL_THIS_FORM 1414 1.13 1.93 0.73 135 HELO_NODOT 1402 0.55 0.19 0.72 136 RELAYCOUNTRY_GB 1396 0.96 1.43 0.72 137 XMSubMetaI_00 1333 1.33 2.63 0.69 138 XM_H_Long_From02 1329 1.25 2.38 0.69 139 XMLngstWrd_01 1314 0.58 0.38 0.68 140 XMGenDplmaNmb 1260 0.63 0.59 0.65 141 MISSING_HEADERS 1253 0.54 0.34 0.65 142 XMHTMLBadTable_001 1247 0.89 1.37 0.64 143 T_FILL_THIS_FORM_LOAN 1229 0.83 1.23 0.64 144 T_XMHurry_00 1179 1.02 1.85 0.61 145 XMStockSpam_06 1134 0.84 1.35 0.59 146 T_TooManySym_04 1088 0.38 0.02 0.56 147 PLING_QUERY 1084 0.91 1.63 0.56 148 FILL_THIS_FORM_LONG 1084 0.97 1.79 0.56 149 TR_LOTS_OF_MONEY3 1073 0.64 0.81 0.55 150 HTML_FONT_FACE_BAD 1060 0.62 0.77 0.55 151 T_FILL_THIS_FORM_SHORT 1051 1.00 1.92 0.54 152 XMCapTrack 1037 0.51 0.47 0.54 153 TR_MetaPhish_Combo_01 1014 0.74 1.16 0.52 154 RELAYCOUNTRY_DE 997 0.60 0.78 0.52 155 DKIM_ADSP_NXDOMAIN 976 0.69 1.07 0.50 156 XM_ShortIntro_01 972 0.55 0.65 0.50 157 XMSubject_48 960 0.43 0.31 0.50 158 RDNS_DYNAMIC 957 0.68 1.05 0.49 159 XMBrknScrpt_02 951 0.61 0.84 0.49 160 XMLngstWrd_02 883 0.41 0.31 0.46 161 ADMITS_SPAM 866 0.47 0.51 0.45 162 XMSubEmpty 850 0.40 0.31 0.44 163 FORGED_GMAIL_RCVD 846 0.62 1.00 0.44 164 XM_H_PHPOS_M 803 0.44 0.48 0.42 165 TR_Sbj_FN_Bdy 790 0.34 0.22 0.41 166 XMBody_17 759 0.98 2.15 0.39 167 RELAYCOUNTRY_AU 756 0.38 0.34 0.39 168 XM_H_SpoofStaff4 744 0.27 0.04 0.38 169 T_XMDrugObfuBody_00 723 0.66 1.23 0.37 170 XMSubGiftCard1 707 0.44 0.59 0.37 171 TM2_M_A_HREF_HREF 699 0.35 0.31 0.36 172 XMSexyCombo_01 671 0.68 1.36 0.35 173 DIET_1 662 0.93 2.12 0.34 174 XMRcvdHeader_15 661 0.23 0.00 0.34 175 MPART_ALT_DIFF_COUNT 656 0.42 0.58 0.34 176 XMPhish30 655 0.84 1.85 0.34 177 XMSolicitRefs_0 655 0.38 0.47 0.34 178 T_Symld_Words_02 651 0.49 0.79 0.34 179 XMDateMe_00 634 0.31 0.26 0.33 180 URI_NOVOWEL 628 0.42 0.61 0.32 181 TR_MetaPhish_Combo_01b 614 0.39 0.55 0.32 182 HTML_TAG_BALANCE_BODY 610 0.39 0.54 0.32 183 FROM_EGROUPS 608 0.21 0.00 0.31 184 XMSlimDrugH 597 0.45 0.73 0.31 185 AD_PREFS 592 0.23 0.06 0.31 186 TR_XM_RelayPhish 589 0.56 1.07 0.30 187 XMLngstWrd_03 582 0.28 0.24 0.30 188 XMGappySubj_01 578 0.37 0.53 0.30 189 XM_B_TRADE_HTML 576 0.33 0.39 0.30 190 XM_Walgreens_Forge 574 0.31 0.35 0.30 191 RELAYCOUNTRY_FR 574 0.57 1.11 0.30 192 HTTPS_HTTP_MISMATCH 572 0.33 0.40 0.30 193 XMSUPPORT 567 0.20 0.00 0.29 194 T_OBFU_PDF_ATTACH 563 0.23 0.11 0.29 195 XMSubMetaSxObfu_03 551 0.34 0.45 0.28 196 HTML_IMAGE_ONLY_28 548 0.31 0.36 0.28 197 HTML_IMAGE_ONLY_32 541 0.26 0.21 0.28 198 T_TooManySym_05 539 0.19 0.00 0.28 199 XMHTML_After_End 533 0.61 1.28 0.28 200 TVD_SPACE_RATIO 523 0.23 0.16 0.27 ----------------------------------------------------------------------