Email: 364067 Autolearn: 0 AvgScore: 3.59 AvgScanTime: 3.03 sec Spam: 114719 Autolearn: 0 AvgScore: 13.85 AvgScanTime: 3.40 sec Ham: 249348 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 2.86 sec Time Spent Running SA: 306.29 hours Time Spent Processing Spam: 108.37 hours Time Spent Processing Ham: 197.92 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109619 88.49 95.55 85.25 2 DKIM_SIGNED 88399 79.01 77.06 79.91 3 DCC_CHECK 87590 55.83 76.35 46.38 4 XM_DK_Pass 85392 77.20 74.44 78.47 5 DKIM_VALID 82086 74.30 71.55 75.57 6 XMListUnsubscribeExists 77519 60.06 67.57 56.60 7 DKIM_VALID_AU 69451 58.22 60.54 57.15 8 XM_H_QuotedFrom 57865 41.32 50.44 37.13 9 MIME_HTML_ONLY 48718 29.47 42.47 23.50 10 BAYES_50 41820 49.58 36.45 55.62 11 XM_DK_Undo_02 41486 20.67 36.16 13.54 12 HTML_FONT_LOW_CONTRAST 39565 33.95 34.49 33.70 13 LOC_TINY_FONT_1 39432 29.68 34.37 27.52 14 BAYES_99 36749 18.25 32.03 11.91 15 BAYES_999 30585 15.30 26.66 10.07 16 TR_DCC_Bayes_99 30351 12.76 26.46 6.46 17 XMSubLong 29135 22.70 25.40 21.46 18 BOTNET 26909 8.69 23.46 1.89 19 DCC_CHECK_NEGATIVE 25959 43.13 22.63 52.56 20 FVGT_m_MULTI_ODD 25652 22.41 22.36 22.44 21 FROM_EXCESS_BASE64 23018 9.64 20.06 4.84 22 DKIM_VALID_EF 22605 27.91 19.70 31.68 23 T_TM2_M_HEADER_IN_MSG 22537 22.76 19.65 24.20 24 XM_UncommonTLD01 20433 8.15 17.81 3.70 25 XM_Body_Dirty_Words 20397 14.60 17.78 13.14 26 T_KAM_HTML_FONT_INVALID 19799 16.15 17.26 15.65 27 HTML_IMAGE_RATIO_02 19769 12.22 17.23 9.92 28 HTML_MIME_NO_HTML_TAG 18243 6.29 15.90 1.86 29 XM_Multi_Part_URI 17864 14.46 15.57 13.95 30 T_REMOTE_IMAGE 17403 7.45 15.17 3.90 31 RCVD_IN_RP_RNBL 17257 4.76 15.04 0.03 32 XM_Evil_Numbers_Gen 16908 10.04 14.74 7.87 33 SpammyFromTLD_02 16647 4.67 14.51 0.15 34 RELAYCOUNTRY_META 16452 7.33 14.34 4.11 35 MultiRelay 15780 15.09 13.76 15.70 36 BODY_URI_ONLY 15324 4.23 13.36 0.03 37 MISSING_HEADERS 15238 4.37 13.28 0.26 38 HTML_SHORT_LINK_IMG_1 14819 4.10 12.92 0.04 39 MIME_HEADER_CTYPE_ONLY 14516 4.08 12.65 0.14 40 HTML_IMAGE_ONLY_04 14063 3.89 12.26 0.05 41 SHORTENER_SHORT_IMG 13932 3.83 12.14 0.01 42 URI_BUFFLY 13769 3.79 12.00 0.01 43 FSL_BULK_SIG 13134 9.34 11.45 8.37 44 BAYES_80 12859 6.18 11.21 3.86 45 BOTNET_IPINHOSTNAME 12206 8.67 10.64 7.77 46 HTML_SHORT_CENTER 11704 3.22 10.20 0.01 47 HTML_IMAGE_RATIO_04 11383 8.41 9.92 7.71 48 XMSexyCombo_05 11337 6.52 9.88 4.97 49 LOTS_OF_MONEY 11045 11.00 9.63 11.63 50 BAYES_60 10760 7.32 9.38 6.37 51 UNTRUSTED_Relay 10421 3.69 9.08 1.21 52 MPART_ALT_DIFF 10185 4.97 8.88 3.18 53 T_XMDrugObfuBody_14 8861 7.50 7.72 7.40 54 XMNumbers 8601 5.46 7.50 4.53 55 TooManyTo_001 8493 6.08 7.40 5.47 56 XMSubMetaSx_00 8318 5.66 7.25 4.93 57 TR_XM_DocInvoice 8287 4.59 7.22 3.38 58 XM_H_Long_From01 7682 6.17 6.70 5.93 59 XM_B_Phish_Phrases 7666 6.25 6.68 6.04 60 BAYES_95 6602 3.67 5.75 2.71 61 DKIM_INVALID 6313 4.71 5.50 4.34 62 MIME_HTML_ONLY_MULTI 6087 2.85 5.31 1.72 63 XMStrtUSub 5866 4.57 5.11 4.32 64 HTML_IMAGE_RATIO_06 5419 4.59 4.72 4.53 65 LotsOfNums_01 5193 7.01 4.53 8.16 66 XM_UB50 5034 1.86 4.39 0.69 67 MIME_HTML_MOSTLY 4874 3.24 4.25 2.77 68 T_TooManySym_01 4669 6.23 4.07 7.22 69 XM_DIRTYINTL 4434 2.61 3.87 2.03 70 HTML_IMAGE_RATIO_08 4333 2.61 3.78 2.07 71 DIET_1 4256 1.51 3.71 0.49 72 XM_SendGrid 3655 5.20 3.19 6.13 73 RELAYCOUNTRY_CA 3574 2.02 3.12 1.52 74 XMBdyGiftCard01 3411 2.45 2.97 2.21 75 RCVD_IN_RP_SAFE 3231 10.49 2.82 14.02 76 XM_CamelCaseFrm001 3216 2.23 2.80 1.97 77 TM2_M_URI_OPT_OUT 3194 1.80 2.78 1.35 78 MultiRelay_Combo 3151 0.95 2.75 0.13 79 MultiRelay_CC 3151 0.95 2.75 0.13 80 XM_OfRef6 3141 1.93 2.74 1.56 81 RCVD_IN_MSPIKE_H2 2967 4.32 2.59 5.12 82 XMSlimDrugH 2920 1.05 2.55 0.36 83 XMSubMetaI_00 2864 1.22 2.50 0.64 84 MIME_QP_LONG_LINE 2820 4.01 2.46 4.72 85 URI_HEX 2726 2.09 2.38 1.95 86 XM_SPF_SoftFail 2681 1.49 2.34 1.10 87 XM_H_Long_From02 2467 1.45 2.15 1.12 88 UNPARSEABLE_RELAY 2434 4.35 2.12 5.38 89 XMBody_17 2318 1.06 2.02 0.62 90 RCVD_IN_RP_CERTIFIED 2312 9.68 2.02 13.21 91 XMDiploma_00 2308 1.68 2.01 1.52 92 PLING_QUERY 2294 1.36 2.00 1.07 93 XMWghtMeta_00 2234 0.66 1.95 0.06 94 XMSexyCombo_01 2144 1.13 1.87 0.79 95 T_XMDrugObfuBody_08 2133 1.43 1.86 1.23 96 URI_TRY_3LD 2119 1.58 1.85 1.46 97 T_HTML_TAG_BALANCE_CENTER 2092 0.65 1.82 0.11 98 BOTNET_NORDNS 2067 0.57 1.80 0.01 99 RCVD_IN_BL_SPAMCOP_NET 1986 0.68 1.73 0.20 100 XM_URI_RBL 1977 0.88 1.72 0.49 101 SUBJ_ALL_CAPS 1916 2.36 1.67 2.67 102 BAYES_40 1910 2.92 1.66 3.49 103 MAILING_LIST_MULTI 1857 1.68 1.62 1.71 104 XMMoneyMeta_00 1792 0.68 1.56 0.28 105 BAYES_20 1790 2.24 1.56 2.55 106 XMPhish30 1739 0.78 1.52 0.45 107 DKIM_ADSP_CUSTOM_MED 1725 0.99 1.50 0.75 108 HTML_IMAGE_ONLY_08 1719 0.53 1.50 0.08 109 NML_ADSP_CUSTOM_MED 1677 0.76 1.46 0.43 110 XMHTML_After_End 1597 0.61 1.39 0.25 111 RELAYCOUNTRY_CN 1536 0.44 1.34 0.03 112 URIBL_BLACK 1535 0.50 1.34 0.11 113 TR_XM_RelayPhish 1519 0.67 1.32 0.38 114 XMGenDplmaNmb 1498 1.02 1.31 0.89 115 SUBJ_DOLLARS 1491 0.88 1.30 0.69 116 XM_UB60 1472 0.45 1.28 0.07 117 XM_UB99 1467 0.41 1.28 0.01 118 DKIM_ADSP_NXDOMAIN 1466 0.79 1.28 0.57 119 SpammyFromTLD_01 1445 0.63 1.26 0.34 120 BODY_ENHANCEMENT 1445 0.42 1.26 0.04 121 T_XMHurry_00 1437 0.76 1.25 0.53 122 TM2_M_VERY_LONG_WORD 1426 1.07 1.24 0.99 123 RELAYCOUNTRY_AT 1422 0.59 1.24 0.30 124 RDNS_DYNAMIC 1414 0.86 1.23 0.69 125 HTML_FONT_FACE_BAD 1409 0.78 1.23 0.57 126 XM_BadFromFormat 1401 0.53 1.22 0.21 127 TR_Mismatch_TLD_02 1359 0.41 1.18 0.06 128 URIBL_DBL_SPAM 1311 0.42 1.14 0.09 129 RELAYCOUNTRY_FR 1309 0.48 1.14 0.17 130 BAYES_00 1309 8.60 1.14 12.03 131 RELAYCOUNTRY_IN 1300 0.42 1.13 0.09 132 XMStockSpam_06 1299 0.96 1.13 0.88 133 TR_LOTS_OF_MONEY1 1296 0.36 1.13 0.01 134 XMPhish11 1286 1.02 1.12 0.98 135 ALL_TRUSTED 1279 11.15 1.11 15.77 136 RCVD_IN_IADB_LISTED 1249 3.88 1.09 5.16 137 XM_H_PHPOS 1242 1.11 1.08 1.13 138 US_DOLLARS_3 1238 3.15 1.08 4.10 139 T_XMDrugObfuBody_00 1160 1.09 1.01 1.13 140 XMEqualsVooDoo_00 1132 0.36 0.99 0.07 141 URI_NOVOWEL 1128 0.58 0.98 0.39 142 XMBody_78 1124 0.74 0.98 0.62 143 XM_ProductURIs 1115 1.15 0.97 1.24 144 XMSubMetaI_01 1100 0.35 0.96 0.06 145 TO_MALFORMED 1097 3.97 0.96 5.35 146 HTML_FONT_SIZE_LARGE 1083 0.39 0.94 0.14 147 RELAYCOUNTRY_DE 1060 0.55 0.92 0.37 148 MPART_ALT_DIFF_COUNT 1050 0.56 0.92 0.40 149 HTML_TAG_BALANCE_BODY 1049 0.60 0.91 0.45 150 RCVD_IN_IADB_SPF 1046 3.35 0.91 4.48 151 XMClaimOffer 1034 0.37 0.90 0.13 152 T_MONEY_PERCENT 1020 0.63 0.89 0.51 153 TR_LOTS_OF_MONEY2 1020 0.63 0.89 0.51 154 FILL_THIS_FORM 1008 0.57 0.88 0.43 155 XM_UB80 1002 0.30 0.87 0.03 156 T_TooManySym_02 990 1.80 0.86 2.23 157 RCVD_IN_IADB_DK 984 2.92 0.86 3.86 158 RCVD_IN_IADB_SENDERID 979 2.99 0.85 3.98 159 XM_UB999 959 0.27 0.84 0.01 160 XMPhish14 949 0.63 0.83 0.54 161 T_FILL_THIS_FORM_LONG 942 0.52 0.82 0.38 162 XM_H_PHPMailer 938 0.69 0.82 0.63 163 FROM_SUSPICIOUS_NTLD 936 0.27 0.82 0.02 164 BAYES_05 919 1.26 0.80 1.47 165 BANG_GUAR 917 0.31 0.80 0.08 166 LongTLD 906 0.32 0.79 0.11 167 RELAYCOUNTRY_GB 902 0.59 0.79 0.51 168 XM_B_COPY_HTML 902 0.76 0.79 0.75 169 FILL_THIS_FORM_LOAN 898 0.49 0.78 0.35 170 FVGT_m_MULTI_ODD_EMAIL 895 0.30 0.78 0.08 171 T_FILL_THIS_FORM_SHORT 891 0.56 0.78 0.46 172 HTML_FONT_SIZE_HUGE 887 0.33 0.77 0.13 173 HTML_IMAGE_ONLY_16 880 0.39 0.77 0.21 174 XMSubMetaSx_01 870 0.33 0.76 0.13 175 XMSubject_48 868 0.26 0.76 0.04 176 DATE_IN_PAST_03_06 866 0.29 0.75 0.07 177 TVD_SPACE_RATIO_MINFP 863 0.24 0.75 0.00 178 HTML_TEXT_INVISIBLE_STYLE 857 0.28 0.75 0.07 179 TR_Symld_Words 851 1.80 0.74 2.29 180 RCVD_IN_IADB_VOUCHED 843 2.44 0.73 3.23 181 XMSlimDrugs 841 0.25 0.73 0.03 182 XM_Body_Obfu01 833 0.30 0.73 0.11 183 REMOVE_BEFORE_LINK 810 0.44 0.71 0.32 184 GUARANTEED_100_PERCENT 786 0.23 0.69 0.01 185 RCVD_IN_MSPIKE_WL 780 1.89 0.68 2.45 186 XMSubject_09 778 0.22 0.68 0.01 187 RCVD_IN_MSPIKE_H3 770 1.88 0.67 2.44 188 XM_DK_Undo_01 769 1.28 0.67 1.56 189 TR_XM_DK_Bayes 759 6.77 0.66 9.58 190 NO_DNS_FOR_FROM 753 0.61 0.66 0.59 191 REPLYTO_WITHOUT_TO_CC 740 0.25 0.65 0.07 192 XMSubMetaI_02 739 0.20 0.64 0.00 193 NO_PRESCRIPTION 738 0.20 0.64 0.00 194 TR_XM_DK_Bayes1 731 6.52 0.64 9.22 195 XM_RXBody 727 0.45 0.63 0.36 196 XMSexyCombo_04 726 0.34 0.63 0.20 197 XMWarranty1 722 0.20 0.63 0.00 198 MALE_ENHANCE 721 0.20 0.63 0.00 199 XMSubject_47 721 0.20 0.63 0.00 200 XMHTMLBadTable_001 704 0.66 0.61 0.68 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 212562 88.49 95.55 85.25 2 DKIM_SIGNED 199253 79.01 77.06 79.91 3 XM_DK_Pass 195665 77.20 74.44 78.47 4 DKIM_VALID 188430 74.30 71.55 75.57 5 DKIM_VALID_AU 142493 58.22 60.54 57.15 6 XMListUnsubscribeExists 141138 60.06 67.57 56.60 7 BAYES_50 138689 49.58 36.45 55.62 8 DCC_CHECK_NEGATIVE 131059 43.13 22.63 52.56 9 DCC_CHECK 115652 55.83 76.35 46.38 10 XM_H_QuotedFrom 92580 41.32 50.44 37.13 11 HTML_FONT_LOW_CONTRAST 84031 33.95 34.49 33.70 12 DKIM_VALID_EF 78998 27.91 19.70 31.68 13 LOC_TINY_FONT_1 68610 29.68 34.37 27.52 14 T_TM2_M_HEADER_IN_MSG 60337 22.76 19.65 24.20 15 MIME_HTML_ONLY 58590 29.47 42.47 23.50 16 FVGT_m_MULTI_ODD 55948 22.41 22.36 22.44 17 XMSubLong 53498 22.70 25.40 21.46 18 XM_DKIMWhitelistDomains 42239 11.61 0.02 16.94 19 ALL_TRUSTED 39329 11.15 1.11 15.77 20 MultiRelay 39145 15.09 13.76 15.70 21 T_KAM_HTML_FONT_INVALID 39015 16.15 17.26 15.65 22 RCVD_IN_RP_SAFE 34961 10.49 2.82 14.02 23 XM_Multi_Part_URI 34783 14.46 15.57 13.95 24 XM_DK_Undo_02 33766 20.67 36.16 13.54 25 RCVD_IN_RP_CERTIFIED 32932 9.68 2.02 13.21 26 XM_Body_Dirty_Words 32755 14.60 17.78 13.14 27 BAYES_00 30003 8.60 1.14 12.03 28 BAYES_99 29688 18.25 32.03 11.91 29 LOTS_OF_MONEY 28987 11.00 9.63 11.63 30 BAYES_999 25107 15.30 26.66 10.07 31 HTML_IMAGE_RATIO_02 24732 12.22 17.23 9.92 32 TR_XM_DK_Bayes 23876 6.77 0.66 9.58 33 TR_XM_DK_Bayes1 22988 6.52 0.64 9.22 34 FSL_BULK_SIG 20862 9.34 11.45 8.37 35 LotsOfNums_01 20335 7.01 4.53 8.16 36 TR_XM_DK_Bayes2 19785 5.60 0.54 7.93 37 XM_Evil_Numbers_Gen 19630 10.04 14.74 7.87 38 BOTNET_IPINHOSTNAME 19367 8.67 10.64 7.77 39 HTML_IMAGE_RATIO_04 19236 8.41 9.92 7.71 40 T_XMDrugObfuBody_14 18451 7.50 7.72 7.40 41 T_TooManySym_01 18000 6.23 4.07 7.22 42 TR_DCC_Bayes_99 16097 12.76 26.46 6.46 43 BAYES_60 15875 7.32 9.38 6.37 44 XM_SendGrid 15285 5.20 3.19 6.13 45 XM_B_Phish_Phrases 15072 6.25 6.68 6.04 46 XM_H_Long_From01 14786 6.17 6.70 5.93 47 TooManyTo_001 13639 6.08 7.40 5.47 48 UNPARSEABLE_RELAY 13403 4.35 2.12 5.38 49 TO_MALFORMED 13339 3.97 0.96 5.35 50 RCVD_IN_IADB_LISTED 12869 3.88 1.09 5.16 51 RCVD_IN_MSPIKE_H2 12769 4.32 2.59 5.12 52 XMSexyCombo_05 12386 6.52 9.88 4.97 53 XMSubMetaSx_00 12301 5.66 7.25 4.93 54 FROM_EXCESS_BASE64 12060 9.64 20.06 4.84 55 TVD_RCVD_IP 11992 3.40 0.33 4.81 56 MIME_QP_LONG_LINE 11781 4.01 2.46 4.72 57 HTML_IMAGE_RATIO_06 11292 4.59 4.72 4.53 58 XMNumbers 11285 5.46 7.50 4.53 59 RCVD_IN_IADB_SPF 11161 3.35 0.91 4.48 60 DKIM_INVALID 10823 4.71 5.50 4.34 61 XMStrtUSub 10765 4.57 5.11 4.32 62 RELAYCOUNTRY_META 10244 7.33 14.34 4.11 63 US_DOLLARS_3 10219 3.15 1.08 4.10 64 RCVD_IN_IADB_SENDERID 9921 2.99 0.85 3.98 65 T_REMOTE_IMAGE 9720 7.45 15.17 3.90 66 BAYES_80 9632 6.18 11.21 3.86 67 RCVD_IN_IADB_DK 9632 2.92 0.86 3.86 68 XM_UncommonTLD01 9230 8.15 17.81 3.70 69 IN_ZIMBRA_NJ_WHITELIST 8937 2.46 0.01 3.58 70 BAYES_40 8706 2.92 1.66 3.49 71 TR_XM_DocInvoice 8431 4.59 7.22 3.38 72 RCVD_IN_IADB_VOUCHED 8053 2.44 0.73 3.23 73 MPART_ALT_DIFF 7922 4.97 8.88 3.18 74 ANY_BOUNCE_MESSAGE 7504 2.13 0.22 3.01 75 BOUNCE_MESSAGE 7504 2.13 0.22 3.01 76 MIME_HTML_MOSTLY 6915 3.24 4.25 2.77 77 BAYES_95 6745 3.67 5.75 2.71 78 SUBJ_ALL_CAPS 6660 2.36 1.67 2.67 79 INVALID_MSGID 6435 1.86 0.30 2.58 80 BAYES_20 6356 2.24 1.56 2.55 81 RCVD_IN_MSPIKE_WL 6107 1.89 0.68 2.45 82 RCVD_IN_MSPIKE_H3 6087 1.88 0.67 2.44 83 XM_PDF 5800 1.75 0.50 2.33 84 TR_Symld_Words 5706 1.80 0.74 2.29 85 T_TooManySym_02 5570 1.80 0.86 2.23 86 XMBdyGiftCard01 5522 2.45 2.97 2.21 87 RCVD_IN_IADB_OPTIN 5236 1.61 0.56 2.10 88 TR_MetaPhish_Combo_01 5189 1.55 0.41 2.08 89 HTML_IMAGE_RATIO_08 5151 2.61 3.78 2.07 90 XM_DIRTYINTL 5074 2.61 3.87 2.03 91 XM_CamelCaseFrm001 4917 2.23 2.80 1.97 92 URI_HEX 4867 2.09 2.38 1.95 93 BOTNET 4719 8.69 23.46 1.89 94 IN_HORDE_ADDRESS_BOOK 4661 1.29 0.04 1.87 95 HTML_MIME_NO_HTML_TAG 4640 6.29 15.90 1.86 96 MIME_HTML_ONLY_MULTI 4296 2.85 5.31 1.72 97 MAILING_LIST_MULTI 4269 1.68 1.62 1.71 98 USER_IN_DEF_DKIM_WL 4244 1.18 0.06 1.70 99 XM_OfRef6 3901 1.93 2.74 1.56 100 XM_DK_Undo_01 3895 1.28 0.67 1.56 101 XMDiploma_00 3799 1.68 2.01 1.52 102 RELAYCOUNTRY_CA 3778 2.02 3.12 1.52 103 BAYES_05 3654 1.26 0.80 1.47 104 URI_TRY_3LD 3650 1.58 1.85 1.46 105 TM2_M_URI_OPT_OUT 3376 1.80 2.78 1.35 106 XM_ProductURIs 3086 1.15 0.97 1.24 107 TooManyTo_002 3072 1.03 0.58 1.23 108 T_XMDrugObfuBody_08 3072 1.43 1.86 1.23 109 UNTRUSTED_Relay 3015 3.69 9.08 1.21 110 XM_GoogleGroups 2925 0.96 0.51 1.17 111 XM_D_tchamptons_WL 2912 0.80 0.01 1.17 112 XM_B_REG_HTML 2826 0.90 0.38 1.13 113 T_XMDrugObfuBody_00 2818 1.09 1.01 1.13 114 XM_H_PHPOS 2812 1.11 1.08 1.13 115 XM_H_Long_From02 2797 1.45 2.15 1.12 116 XM_SPF_SoftFail 2750 1.49 2.34 1.10 117 USER_IN_WHITELIST 2739 0.75 0.00 1.10 118 PLING_QUERY 2659 1.36 2.00 1.07 119 TM2_M_VERY_LONG_WORD 2479 1.07 1.24 0.99 120 XMPhish11 2437 1.02 1.12 0.98 121 TM2_M_A_HREF_HREF 2328 0.80 0.50 0.93 122 XMBody_95 2253 0.64 0.08 0.90 123 XMGenDplmaNmb 2227 1.02 1.31 0.89 124 XMStockSpam_06 2203 0.96 1.13 0.88 125 TooManyTo_003 2109 0.73 0.49 0.85 126 XMSubMetaSxObfu_02 2025 0.64 0.27 0.81 127 GAPPY_SUBJECT 1996 0.61 0.18 0.80 128 XMSexyCombo_01 1959 1.13 1.87 0.79 129 XMSubMetaSxObfu_03 1888 0.70 0.58 0.76 130 DKIM_ADSP_CUSTOM_MED 1866 0.99 1.50 0.75 131 XM_B_COPY_HTML 1866 0.76 0.79 0.75 132 HELO_NODOT 1864 0.57 0.19 0.75 133 T_TooManySym_03 1793 0.67 0.56 0.72 134 XM_UB50 1728 1.86 4.39 0.69 135 SUBJ_DOLLARS 1727 0.88 1.30 0.69 136 RDNS_DYNAMIC 1722 0.86 1.23 0.69 137 XMHTMLBadTable_001 1692 0.66 0.61 0.68 138 TooManyTo_004 1690 0.56 0.32 0.68 139 XMSubMetaI_00 1591 1.22 2.50 0.64 140 XM_H_PHPMailer 1575 0.69 0.82 0.63 141 XMBody_78 1553 0.74 0.98 0.62 142 XMBody_17 1542 1.06 2.02 0.62 143 TooManyTo_005 1499 0.50 0.27 0.60 144 NO_DNS_FOR_FROM 1466 0.61 0.66 0.59 145 HTML_FONT_FACE_BAD 1422 0.78 1.23 0.57 146 DKIM_ADSP_NXDOMAIN 1421 0.79 1.28 0.57 147 XM_H_PHPOS_M 1383 0.56 0.58 0.55 148 XMPhish14 1353 0.63 0.83 0.54 149 T_XMHurry_00 1327 0.76 1.25 0.53 150 TR_Caps_n_Bayes_99 1293 0.43 0.22 0.52 151 T_MONEY_PERCENT 1283 0.63 0.89 0.51 152 TR_LOTS_OF_MONEY2 1283 0.63 0.89 0.51 153 XMBrknScrpt_02 1276 0.48 0.41 0.51 154 RELAYCOUNTRY_GB 1263 0.59 0.79 0.51 155 T_Symld_Words_02 1236 0.47 0.42 0.50 156 XM_URI_RBL 1231 0.88 1.72 0.49 157 DIET_1 1231 1.51 3.71 0.49 158 XMNoVowels 1209 0.47 0.43 0.48 159 XMSolicitRefs_0 1158 0.40 0.27 0.46 160 XMCapTrack 1147 0.39 0.24 0.46 161 T_FILL_THIS_FORM_SHORT 1143 0.56 0.78 0.46 162 HTML_TAG_BALANCE_BODY 1123 0.60 0.91 0.45 163 XMPhish30 1116 0.78 1.52 0.45 164 XMSubMetaSSx_00 1105 0.47 0.53 0.44 165 FORGED_GMAIL_RCVD 1079 0.48 0.60 0.43 166 NML_ADSP_CUSTOM_MED 1072 0.76 1.46 0.43 167 FILL_THIS_FORM 1066 0.57 0.88 0.43 168 XMLngstWrd_00 1014 0.35 0.24 0.41 169 MPART_ALT_DIFF_COUNT 1000 0.56 0.92 0.40 170 URI_NOVOWEL 971 0.58 0.98 0.39 171 RELAYCOUNTRY_AU 955 0.39 0.41 0.38 172 T_TooManySym_04 954 0.27 0.01 0.38 173 T_FILL_THIS_FORM_LONG 937 0.52 0.82 0.38 174 TR_XM_RelayPhish 936 0.67 1.32 0.38 175 RELAYCOUNTRY_DE 933 0.55 0.92 0.37 176 XM_RXBody 909 0.45 0.63 0.36 177 XMLngstWrd_01 904 0.32 0.23 0.36 178 XMSlimDrugH 899 1.05 2.55 0.36 179 XM_Akamai 887 0.25 0.00 0.36 180 HTTPS_HTTP_MISMATCH 877 0.43 0.61 0.35 181 FILL_THIS_FORM_LOAN 873 0.49 0.78 0.35 182 XMRcvdHeader_15 867 0.24 0.00 0.35 183 SpammyFromTLD_01 848 0.63 1.26 0.34 184 REMOVE_BEFORE_LINK 793 0.44 0.71 0.32 185 XMSUPPORT 756 0.21 0.00 0.30 186 XM_ShortIntro_01 744 0.34 0.44 0.30 187 RELAYCOUNTRY_AT 738 0.59 1.24 0.30 188 T_OBFU_PDF_ATTACH 734 0.22 0.07 0.29 189 XMGappySubj_01 715 0.25 0.17 0.29 190 XM_H_SpoofStaff4 714 0.21 0.05 0.29 191 XMMoneyMeta_00 698 0.68 1.56 0.28 192 TR_MetaPhish_Combo_01b 695 0.22 0.09 0.28 193 HTML_IMAGE_ONLY_28 675 0.30 0.35 0.27 194 MISSING_HEADERS 658 4.37 13.28 0.26 195 XMHTML_After_End 621 0.61 1.39 0.25 196 TM2_M_BODY_EMPTY 610 0.19 0.06 0.24 197 XMDateMe_00 597 0.22 0.17 0.24 198 XM_S_JOY_D 594 0.34 0.57 0.24 199 XMLngstWrd_02 594 0.23 0.20 0.24 200 XM_Sams_Club_Forge 592 0.18 0.06 0.24 ----------------------------------------------------------------------