Email: 440193 Autolearn: 0 AvgScore: 6.58 AvgScanTime: 3.98 sec Spam: 191045 Autolearn: 0 AvgScore: 15.87 AvgScanTime: 4.60 sec Ham: 249148 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 3.50 sec Time Spent Running SA: 486.61 hours Time Spent Processing Spam: 244.09 hours Time Spent Processing Ham: 242.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 182319 88.44 95.43 83.08 2 BAYES_50 108330 55.57 56.70 54.69 3 DKIM_SIGNED 107054 66.91 56.04 75.25 4 XM_DK_Pass 105084 65.77 55.00 74.02 5 DCC_CHECK 98478 45.99 51.55 41.72 6 DKIM_VALID 98256 62.21 51.43 70.47 7 XMListUnsubscribeExists 95383 51.45 49.93 52.61 8 DCC_CHECK_NEGATIVE 91310 53.11 47.80 57.18 9 BOTNET 85085 20.21 44.54 1.56 10 DKIM_VALID_AU 82588 48.80 43.23 53.07 11 URI_HEX 71300 17.46 37.32 2.23 12 XM_H_QuotedFrom 70105 36.92 36.70 37.09 13 NUMERIC_HTTP_ADDR 68425 15.60 35.82 0.10 14 XMCapTrack 68401 15.78 35.80 0.42 15 ANY_BOUNCE_MESSAGE 68362 17.56 35.78 3.58 16 BOUNCE_MESSAGE 68361 17.55 35.78 3.58 17 RCVD_IN_RP_RNBL 67919 15.45 35.55 0.04 18 XM_DK_Undo_02 59911 23.13 31.36 16.82 19 XM_URI_RBL 53893 12.32 28.21 0.13 20 URIBL_BLACK 52690 12.01 27.58 0.06 21 BAYES_99 52050 20.92 27.24 16.07 22 LOC_TINY_FONT_1 50296 25.52 26.33 24.91 23 HTML_FONT_LOW_CONTRAST 44608 27.50 23.35 30.68 24 BAYES_999 43989 17.85 23.03 13.88 25 TR_DCC_Bayes_99 40910 13.91 21.41 8.16 26 FVGT_m_MULTI_ODD 38938 20.59 20.38 20.74 27 MIME_HTML_ONLY 38880 21.68 20.35 22.70 28 XMSubLong 32058 20.93 16.78 24.10 29 DKIM_VALID_EF 27385 22.90 14.33 29.48 30 HTML_IMAGE_RATIO_02 27286 12.05 14.28 10.33 31 XM_Multi_Part_URI 25999 13.34 13.61 13.14 32 T_KAM_HTML_FONT_INVALID 24772 13.67 12.97 14.20 33 XM_Body_Dirty_Words 23775 11.48 12.44 10.74 34 T_TM2_M_HEADER_IN_MSG 20538 19.34 10.75 25.93 35 RELAYCOUNTRY_META 19608 6.71 10.26 3.99 36 XM_Evil_Numbers_Gen 18788 8.70 9.83 7.84 37 BOTNET_IPINHOSTNAME 16513 7.61 8.64 6.81 38 MultiRelay 16075 12.09 8.41 14.90 39 XMSexyCombo_05 14057 5.48 7.36 4.05 40 T_XMDrugObfuBody_14 13381 6.59 7.00 6.28 41 UNTRUSTED_Relay 12572 3.43 6.58 1.01 42 XMSubMetaSx_00 12220 5.68 6.40 5.13 43 HTML_IMAGE_RATIO_04 11831 5.66 6.19 5.26 44 DATE_IN_PAST_96_XX 11738 2.67 6.14 0.00 45 LOTS_OF_MONEY 11322 8.30 5.93 10.12 46 FSL_BULK_SIG 11278 7.58 5.90 8.87 47 DATE_IN_PAST_24_48 10984 2.51 5.75 0.02 48 FROM_EXCESS_BASE64 10854 4.92 5.68 4.33 49 XM_B_Phish_Phrases 10622 5.26 5.56 5.03 50 MPART_ALT_DIFF 10553 4.39 5.52 3.52 51 RCVD_IN_RP_SAFE 10414 9.00 5.45 11.73 52 TR_XM_DocInvoice 10408 4.51 5.45 3.79 53 BAYES_80 10345 4.92 5.41 4.54 54 TooManyTo_001 9925 5.14 5.20 5.10 55 XM_H_Long_From01 9209 5.42 4.82 5.88 56 DKIM_INVALID 8798 4.71 4.61 4.78 57 RCVD_IN_RP_CERTIFIED 8406 8.24 4.40 11.19 58 BAYES_60 8214 6.10 4.30 7.48 59 XM_UncommonTLD01 7812 4.37 4.09 4.59 60 LotsOfNums_01 7286 6.04 3.81 7.75 61 MIME_HTML_MOSTLY 6395 3.30 3.35 3.26 62 XM_UB50 5805 1.68 3.04 0.64 63 BAYES_95 5582 3.15 2.92 3.32 64 XMStrtUSub 5397 3.87 2.82 4.68 65 ALL_TRUSTED 5309 12.70 2.78 20.31 66 XMNumbers 5301 3.78 2.77 4.55 67 HTML_IMAGE_RATIO_06 5256 3.21 2.75 3.55 68 XM_CamelCaseFrm001 4819 2.01 2.52 1.62 69 MIME_HTML_ONLY_MULTI 4797 1.99 2.51 1.59 70 XMBdyGiftCard01 4730 1.72 2.48 1.14 71 DATE_IN_PAST_12_24 4656 1.09 2.44 0.05 72 BOTNET_NORDNS 4399 1.01 2.30 0.02 73 XM_DIRTYINTL 4291 2.03 2.25 1.86 74 RELAYCOUNTRY_CA 4163 1.81 2.18 1.52 75 RCVD_IN_MSPIKE_H2 3991 3.76 2.09 5.05 76 XM_SendGrid 3966 4.23 2.08 5.88 77 NO_DNS_FOR_FROM 3775 2.31 1.98 2.57 78 T_REMOTE_IMAGE 3768 3.84 1.97 5.26 79 TM2_M_URI_OPT_OUT 3755 2.66 1.97 3.19 80 T_TooManySym_01 3596 4.82 1.88 7.07 81 SpammyFromTLD_02 3594 0.90 1.88 0.16 82 MultiRelay_Combo 3503 0.87 1.83 0.14 83 MultiRelay_CC 3503 0.87 1.83 0.14 84 MIME_QP_LONG_LINE 3470 3.43 1.82 4.66 85 XM_SPF_SoftFail 3195 1.31 1.67 1.04 86 HTML_IMAGE_RATIO_08 3154 1.70 1.65 1.73 87 SpammyFromTLD_01 3112 1.31 1.63 1.07 88 SUBJ_ALL_CAPS 2926 1.64 1.53 1.73 89 T_XMDrugObfuBody_08 2869 1.30 1.50 1.14 90 HTML_MIME_NO_HTML_TAG 2850 1.48 1.49 1.48 91 SUBJ_DOLLARS 2845 0.89 1.49 0.43 92 RELAYCOUNTRY_IN 2755 0.67 1.44 0.08 93 XM_OfRef6 2733 1.34 1.43 1.28 94 DATE_IN_PAST_06_12 2615 0.64 1.37 0.09 95 UNPARSEABLE_RELAY 2561 3.87 1.34 5.81 96 DIET_1 2448 0.79 1.28 0.41 97 RCVD_IN_BL_SPAMCOP_NET 2445 0.69 1.28 0.25 98 URI_TRY_3LD 2398 1.33 1.26 1.39 99 XMSlimDrugH 2338 0.78 1.22 0.44 100 BAYES_00 2266 4.70 1.19 7.40 101 XMSubMetaI_00 2188 0.77 1.15 0.48 102 MAILING_LIST_MULTI 2177 1.55 1.14 1.87 103 XM_B_REG_HTML 2114 0.80 1.11 0.57 104 XMDiploma_00 2075 1.25 1.09 1.38 105 XM_ProductURIs 2048 1.08 1.07 1.08 106 RELAYCOUNTRY_AT 2042 0.51 1.07 0.09 107 XMSexyCombo_01 2026 0.74 1.06 0.49 108 XMPhish30 2026 0.69 1.06 0.40 109 XM_UB60 2023 0.51 1.06 0.09 110 TR_XM_DK_Bayes 2022 3.90 1.06 6.08 111 XMStockSpam_06 1988 0.90 1.04 0.79 112 XM_HighProb1 1916 0.45 1.00 0.02 113 URIBL_DBL_SPAM 1903 0.47 1.00 0.07 114 TR_XM_DK_Bayes1 1891 3.64 0.99 5.67 115 T_XMHurry_00 1877 0.87 0.98 0.79 116 XM_RXBody 1872 0.52 0.98 0.17 117 XMPhish14 1835 0.70 0.96 0.51 118 RELAYCOUNTRY_CN 1816 0.44 0.95 0.05 119 BAYES_40 1742 1.91 0.91 2.67 120 XMBody_17 1737 0.64 0.91 0.43 121 DKIM_ADSP_NXDOMAIN 1710 0.74 0.90 0.63 122 XM_H_Long_From02 1645 0.85 0.86 0.83 123 XMHTMLBadTable_001 1644 0.74 0.86 0.64 124 URI_WP_HACKED_2 1620 0.64 0.85 0.47 125 TR_XM_DK_Bayes2 1597 2.95 0.84 4.57 126 TM2_M_VERY_LONG_WORD 1567 0.83 0.82 0.85 127 XMPhish11 1530 0.88 0.80 0.94 128 DATE_IN_PAST_03_06 1493 0.39 0.78 0.08 129 BAYES_20 1492 1.53 0.78 2.11 130 IMPOTENCE 1462 0.60 0.77 0.48 131 XMBody_78 1435 0.66 0.75 0.59 132 HTML_SHORT_LINK_IMG_1 1398 0.89 0.73 1.01 133 RELAYCOUNTRY_FR 1371 0.41 0.72 0.17 134 T_XMDrugObfuBody_00 1334 0.88 0.70 1.02 135 FILL_THIS_FORM 1331 0.60 0.70 0.53 136 URI_NOVOWEL 1313 0.52 0.69 0.39 137 XM_H_PHPOS 1294 1.96 0.68 2.94 138 RCVD_IN_PSBL 1293 0.39 0.68 0.17 139 TR_Caps_n_Bayes_99 1288 0.32 0.67 0.04 140 TVD_SPACE_RATIO_MINFP 1288 0.30 0.67 0.01 141 XM_UB99 1287 0.30 0.67 0.02 142 T_MONEY_PERCENT 1280 0.44 0.67 0.27 143 TR_LOTS_OF_MONEY2 1280 0.44 0.67 0.27 144 RELAYCOUNTRY_GB 1276 0.57 0.67 0.50 145 XMSubMetaD_03 1262 0.33 0.66 0.07 146 XM_S_JOY_D 1252 0.46 0.66 0.32 147 T_FILL_THIS_FORM_LONG 1248 0.54 0.65 0.45 148 XM_UB80 1191 0.29 0.62 0.03 149 RCVD_IN_IADB_LISTED 1183 3.37 0.62 5.47 150 PLING_QUERY 1143 0.45 0.60 0.34 151 XMHTML_After_End 1124 0.41 0.59 0.27 152 TR_Symld_Words 1116 1.61 0.58 2.39 153 RDNS_DYNAMIC 1113 0.56 0.58 0.54 154 XM_Body_Obfu01 1107 0.32 0.58 0.12 155 MONEY_BACK 1089 0.29 0.57 0.08 156 XMSubMetaSx_01 1085 0.35 0.57 0.17 157 XMSolicitRefs_0 1076 0.46 0.56 0.37 158 TR_XM_RelayPhish 1060 0.40 0.55 0.28 159 XMBSHREFv2 1041 0.28 0.54 0.07 160 XMSexyCombo_04 1040 0.29 0.54 0.09 161 FILL_THIS_FORM_LOAN 1012 0.45 0.53 0.39 162 XMClaimOffer 1011 0.43 0.53 0.35 163 XMSubMetaSSx_00 988 0.39 0.52 0.30 164 DKIM_ADSP_CUSTOM_MED 986 0.69 0.52 0.82 165 RELAYCOUNTRY_DE 979 0.41 0.51 0.33 166 RCVD_IN_IADB_SPF 977 2.89 0.51 4.71 167 LOW_PRICE 974 0.29 0.51 0.13 168 XM_DK_Undo_01 969 1.15 0.51 1.64 169 RCVD_IN_MSPIKE_WL 967 1.70 0.51 2.61 170 RCVD_IN_MSPIKE_H3 955 1.69 0.50 2.61 171 XM_B_COPY_HTML 954 0.60 0.50 0.68 172 T_TooManySym_02 952 1.62 0.50 2.47 173 TR_Mismatch_TLD_02 950 0.24 0.50 0.05 174 XMMoneyMeta_00 947 0.35 0.50 0.23 175 XM_H_PHPMailer 944 0.71 0.49 0.87 176 XM_UB999 939 0.22 0.49 0.01 177 RCVD_IN_IADB_DK 939 2.50 0.49 4.03 178 RCVD_IN_IADB_SENDERID 938 2.57 0.49 4.17 179 BODY_ENHANCEMENT 937 0.23 0.49 0.02 180 NML_ADSP_CUSTOM_MED 934 0.50 0.49 0.52 181 HTML_FONT_FACE_BAD 923 0.48 0.48 0.48 182 BODY_URI_ONLY 903 0.24 0.47 0.07 183 XMBrknScrpt_02 895 0.61 0.47 0.72 184 XMGppyBdWords 886 0.25 0.46 0.09 185 XMGenDplmaNmb 883 0.60 0.46 0.70 186 ONLINE_PHARMACY 877 0.35 0.46 0.27 187 T_Symld_Words_02 862 0.58 0.45 0.67 188 HTML_IMAGE_ONLY_12 856 0.82 0.45 1.11 189 BAYES_05 854 1.08 0.45 1.57 190 REMOVE_BEFORE_LINK 848 0.40 0.44 0.37 191 FORGED_GMAIL_RCVD 839 0.44 0.44 0.44 192 XMSubMetaSxObfu_02 826 0.76 0.43 1.01 193 T_HTML_TAG_BALANCE_CENTER 823 0.29 0.43 0.19 194 TM2_M_A_HREF_HREF 819 0.71 0.43 0.92 195 BASE64_LENGTH_79_INF 808 0.31 0.42 0.22 196 TVD_VISIT_PHARMA 798 0.29 0.42 0.18 197 XMWghtMeta_00 797 0.19 0.42 0.02 198 TR_LOTS_OF_MONEY3 787 0.41 0.41 0.40 199 XMSlimDrugs 786 0.23 0.41 0.09 200 HTML_IMAGE_ONLY_04 762 0.23 0.40 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 206980 88.44 95.43 83.08 2 DKIM_SIGNED 187493 66.91 56.04 75.25 3 XM_DK_Pass 184409 65.77 55.00 74.02 4 DKIM_VALID 175577 62.21 51.43 70.47 5 DCC_CHECK_NEGATIVE 142467 53.11 47.80 57.18 6 BAYES_50 136271 55.57 56.70 54.69 7 DKIM_VALID_AU 132223 48.80 43.23 53.07 8 XMListUnsubscribeExists 131079 51.45 49.93 52.61 9 DCC_CHECK 103951 45.99 51.55 41.72 10 XM_H_QuotedFrom 92407 36.92 36.70 37.09 11 HTML_FONT_LOW_CONTRAST 76448 27.50 23.35 30.68 12 DKIM_VALID_EF 73438 22.90 14.33 29.48 13 T_TM2_M_HEADER_IN_MSG 64608 19.34 10.75 25.93 14 LOC_TINY_FONT_1 62063 25.52 26.33 24.91 15 XMSubLong 60053 20.93 16.78 24.10 16 MIME_HTML_ONLY 56563 21.68 20.35 22.70 17 FVGT_m_MULTI_ODD 51678 20.59 20.38 20.74 18 ALL_TRUSTED 50603 12.70 2.78 20.31 19 XM_DKIMWhitelistDomains 42640 9.74 0.12 17.11 20 XM_DK_Undo_02 41896 23.13 31.36 16.82 21 BAYES_99 40041 20.92 27.24 16.07 22 MultiRelay 37126 12.09 8.41 14.90 23 T_KAM_HTML_FONT_INVALID 35386 13.67 12.97 14.20 24 BAYES_999 34573 17.85 23.03 13.88 25 XM_Multi_Part_URI 32736 13.34 13.61 13.14 26 RCVD_IN_RP_SAFE 29219 9.00 5.45 11.73 27 RCVD_IN_RP_CERTIFIED 27885 8.24 4.40 11.19 28 XM_Body_Dirty_Words 26763 11.48 12.44 10.74 29 HTML_IMAGE_RATIO_02 25749 12.05 14.28 10.33 30 LOTS_OF_MONEY 25221 8.30 5.93 10.12 31 FSL_BULK_SIG 22110 7.58 5.90 8.87 32 TR_DCC_Bayes_99 20326 13.91 21.41 8.16 33 XM_Evil_Numbers_Gen 19525 8.70 9.83 7.84 34 LotsOfNums_01 19305 6.04 3.81 7.75 35 BAYES_60 18624 6.10 4.30 7.48 36 BAYES_00 18432 4.70 1.19 7.40 37 T_TooManySym_01 17610 4.82 1.88 7.07 38 BOTNET_IPINHOSTNAME 16976 7.61 8.64 6.81 39 T_XMDrugObfuBody_14 15643 6.59 7.00 6.28 40 TR_XM_DK_Bayes 15152 3.90 1.06 6.08 41 XM_H_Long_From01 14653 5.42 4.82 5.88 42 XM_SendGrid 14643 4.23 2.08 5.88 43 UNPARSEABLE_RELAY 14474 3.87 1.34 5.81 44 TR_XM_DK_Bayes1 14130 3.64 0.99 5.67 45 RCVD_IN_IADB_LISTED 13631 3.37 0.62 5.47 46 T_REMOTE_IMAGE 13115 3.84 1.97 5.26 47 HTML_IMAGE_RATIO_04 13093 5.66 6.19 5.26 48 TVD_RCVD_IP 13054 3.05 0.20 5.24 49 XMSubMetaSx_00 12791 5.68 6.40 5.13 50 TooManyTo_001 12707 5.14 5.20 5.10 51 RCVD_IN_MSPIKE_H2 12574 3.76 2.09 5.05 52 XM_B_Phish_Phrases 12530 5.26 5.56 5.03 53 TO_MALFORMED 12452 2.85 0.04 5.00 54 DKIM_INVALID 11916 4.71 4.61 4.78 55 RCVD_IN_IADB_SPF 11742 2.89 0.51 4.71 56 XMStrtUSub 11660 3.87 2.82 4.68 57 MIME_QP_LONG_LINE 11607 3.43 1.82 4.66 58 XM_UncommonTLD01 11427 4.37 4.09 4.59 59 TR_XM_DK_Bayes2 11379 2.95 0.84 4.57 60 XMNumbers 11342 3.78 2.77 4.55 61 BAYES_80 11300 4.92 5.41 4.54 62 FROM_EXCESS_BASE64 10789 4.92 5.68 4.33 63 RCVD_IN_IADB_SENDERID 10392 2.57 0.49 4.17 64 XMSexyCombo_05 10081 5.48 7.36 4.05 65 RCVD_IN_IADB_DK 10046 2.50 0.49 4.03 66 RELAYCOUNTRY_META 9938 6.71 10.26 3.99 67 TR_XM_DocInvoice 9431 4.51 5.45 3.79 68 ANY_BOUNCE_MESSAGE 8917 17.56 35.78 3.58 69 BOUNCE_MESSAGE 8908 17.55 35.78 3.58 70 HTML_IMAGE_RATIO_06 8854 3.21 2.75 3.55 71 MPART_ALT_DIFF 8780 4.39 5.52 3.52 72 IN_ZIMBRA_NJ_WHITELIST 8751 1.99 0.01 3.51 73 RCVD_IN_IADB_VOUCHED 8744 2.14 0.36 3.51 74 BAYES_95 8275 3.15 2.92 3.32 75 MIME_HTML_MOSTLY 8115 3.30 3.35 3.26 76 TM2_M_URI_OPT_OUT 7948 2.66 1.97 3.19 77 XM_H_PHPOS 7325 1.96 0.68 2.94 78 INVALID_MSGID 6816 1.60 0.11 2.74 79 BAYES_40 6650 1.91 0.91 2.67 80 RCVD_IN_MSPIKE_WL 6503 1.70 0.51 2.61 81 RCVD_IN_MSPIKE_H3 6500 1.69 0.50 2.61 82 NO_DNS_FOR_FROM 6407 2.31 1.98 2.57 83 T_TooManySym_02 6166 1.62 0.50 2.47 84 TR_Symld_Words 5962 1.61 0.58 2.39 85 RCVD_IN_IADB_OPTIN 5647 1.39 0.25 2.27 86 URI_HEX 5548 17.46 37.32 2.23 87 XM_PDF 5278 1.29 0.20 2.12 88 BAYES_20 5248 1.53 0.78 2.11 89 TR_MetaPhish_Combo_01 5110 1.32 0.37 2.05 90 IN_HORDE_ADDRESS_BOOK 4809 1.12 0.05 1.93 91 MAILING_LIST_MULTI 4664 1.55 1.14 1.87 92 XM_DIRTYINTL 4645 2.03 2.25 1.86 93 MIME_HEADER_CTYPE_ONLY 4599 1.08 0.08 1.85 94 USER_IN_DEF_DKIM_WL 4489 1.04 0.04 1.80 95 HTML_IMAGE_RATIO_08 4313 1.70 1.65 1.73 96 SUBJ_ALL_CAPS 4310 1.64 1.53 1.73 97 XMSubMetaSSxObfu_01 4258 0.97 0.00 1.71 98 XM_DK_Undo_01 4083 1.15 0.51 1.64 99 XM_CamelCaseFrm001 4038 2.01 2.52 1.62 100 MIME_HTML_ONLY_MULTI 3949 1.99 2.51 1.59 101 BAYES_05 3904 1.08 0.45 1.57 102 BOTNET 3879 20.21 44.54 1.56 103 RELAYCOUNTRY_CA 3794 1.81 2.18 1.52 104 HTML_MIME_NO_HTML_TAG 3679 1.48 1.49 1.48 105 URI_TRY_3LD 3473 1.33 1.26 1.39 106 XMDiploma_00 3432 1.25 1.09 1.38 107 XM_GoogleGroups 3403 0.91 0.31 1.37 108 XM_OfRef6 3177 1.34 1.43 1.28 109 TooManyTo_002 3166 0.85 0.31 1.27 110 T_XMDrugObfuBody_08 2852 1.30 1.50 1.14 111 XMBdyGiftCard01 2835 1.72 2.48 1.14 112 HTML_IMAGE_ONLY_12 2767 0.82 0.45 1.11 113 XM_ProductURIs 2702 1.08 1.07 1.08 114 SpammyFromTLD_01 2654 1.31 1.63 1.07 115 XM_SPF_SoftFail 2588 1.31 1.67 1.04 116 T_XMDrugObfuBody_00 2531 0.88 0.70 1.02 117 UNTRUSTED_Relay 2527 3.43 6.58 1.01 118 XMSubMetaSxObfu_02 2522 0.76 0.43 1.01 119 HTML_SHORT_LINK_IMG_1 2516 0.89 0.73 1.01 120 T_TooManySym_03 2498 0.63 0.14 1.00 121 USER_IN_WHITELIST 2464 0.56 0.00 0.99 122 HTML_EXTRA_CLOSE 2400 0.71 0.39 0.96 123 XM_D_tchamptons_WL 2358 0.54 0.00 0.95 124 XMPhish11 2335 0.88 0.80 0.94 125 TM2_M_A_HREF_HREF 2298 0.71 0.43 0.92 126 XM_H_PHPMailer 2171 0.71 0.49 0.87 127 XMBody_95 2140 0.54 0.11 0.86 128 TooManyTo_003 2128 0.60 0.26 0.85 129 TM2_M_VERY_LONG_WORD 2108 0.83 0.82 0.85 130 XM_H_Long_From02 2076 0.85 0.86 0.83 131 DKIM_ADSP_CUSTOM_MED 2041 0.69 0.52 0.82 132 T_XMHurry_00 1959 0.87 0.98 0.79 133 XMStockSpam_06 1958 0.90 1.04 0.79 134 XMBrknScrpt_02 1796 0.61 0.47 0.72 135 XMGenDplmaNmb 1743 0.60 0.46 0.70 136 TooManyTo_004 1736 0.47 0.18 0.70 137 XM_B_COPY_HTML 1704 0.60 0.50 0.68 138 T_Symld_Words_02 1678 0.58 0.45 0.67 139 T_TooManySym_04 1640 0.39 0.05 0.66 140 XMHTMLBadTable_001 1606 0.74 0.86 0.64 141 XM_UB50 1602 1.68 3.04 0.64 142 DKIM_ADSP_NXDOMAIN 1561 0.74 0.90 0.63 143 HELO_NODOT 1517 0.39 0.10 0.61 144 TooManyTo_005 1503 0.41 0.15 0.60 145 XMBody_78 1460 0.66 0.75 0.59 146 XM_H_PHPOS_M 1452 0.49 0.36 0.58 147 XM_B_REG_HTML 1428 0.80 1.11 0.57 148 RDNS_DYNAMIC 1353 0.56 0.58 0.54 149 FILL_THIS_FORM 1323 0.60 0.70 0.53 150 NML_ADSP_CUSTOM_MED 1284 0.50 0.49 0.52 151 XMPhish14 1267 0.70 0.96 0.51 152 RELAYCOUNTRY_GB 1254 0.57 0.67 0.50 153 XMSexyCombo_01 1227 0.74 1.06 0.49 154 HTML_FONT_FACE_BAD 1202 0.48 0.48 0.48 155 IMPOTENCE 1197 0.60 0.77 0.48 156 XMSubMetaI_00 1186 0.77 1.15 0.48 157 URI_WP_HACKED_2 1180 0.64 0.85 0.47 158 XMLngstWrd_00 1176 0.33 0.14 0.47 159 XMNoVowels 1171 0.40 0.30 0.47 160 T_FILL_THIS_FORM_LONG 1126 0.54 0.65 0.45 161 T_FILL_THIS_FORM_SHORT 1110 0.42 0.40 0.45 162 FORGED_GMAIL_RCVD 1106 0.44 0.44 0.44 163 XMSlimDrugH 1102 0.78 1.22 0.44 164 SUBJ_DOLLARS 1081 0.89 1.49 0.43 165 HTML_TAG_BALANCE_BODY 1079 0.40 0.35 0.43 166 XMBody_17 1073 0.64 0.91 0.43 167 XMCapTrack 1053 15.78 35.80 0.42 168 XMLngstWrd_01 1046 0.29 0.13 0.42 169 DIET_1 1021 0.79 1.28 0.41 170 XMPhish30 997 0.69 1.06 0.40 171 TR_LOTS_OF_MONEY3 997 0.41 0.41 0.40 172 FILL_THIS_FORM_LOAN 974 0.45 0.53 0.39 173 URI_NOVOWEL 973 0.52 0.69 0.39 174 HTML_FONT_SIZE_HUGE 968 0.39 0.39 0.39 175 REMOVE_BEFORE_LINK 934 0.40 0.44 0.37 176 XMSubMetaSxObfu_03 929 0.35 0.32 0.37 177 XMSolicitRefs_0 928 0.46 0.56 0.37 178 XMBody_29 887 0.25 0.11 0.36 179 XMClaimOffer 864 0.43 0.53 0.35 180 PLING_QUERY 841 0.45 0.60 0.34 181 XMRcvdHeader_15 834 0.19 0.00 0.33 182 RELAYCOUNTRY_AU 822 0.29 0.25 0.33 183 RELAYCOUNTRY_DE 822 0.41 0.51 0.33 184 XM_ShortIntro_01 811 0.25 0.16 0.33 185 XM_S_JOY_D 788 0.46 0.66 0.32 186 UPPERCASE_50_75 774 0.27 0.22 0.31 187 TM2_M_BODY_EMPTY 770 0.21 0.07 0.31 188 XMSubMetaSSx_00 745 0.39 0.52 0.30 189 HTTPS_HTTP_MISMATCH 736 0.27 0.24 0.30 190 XMSUPPORT 734 0.17 0.00 0.29 191 HTML_IMAGE_ONLY_32 726 0.25 0.20 0.29 192 XMGappySubj_01 700 0.25 0.22 0.28 193 XM_BadFromFormat 696 0.29 0.31 0.28 194 TR_XM_RelayPhish 695 0.40 0.55 0.28 195 XM_H_SpoofStaff4 694 0.16 0.01 0.28 196 TVD_SPACE_RATIO 693 0.33 0.39 0.28 197 THIS_AD 691 0.28 0.28 0.28 198 TR_LOTS_OF_MONEY2 678 0.44 0.67 0.27 199 T_MONEY_PERCENT 678 0.44 0.67 0.27 200 XMHTML_After_End 670 0.41 0.59 0.27 ----------------------------------------------------------------------