Email: 341667 Autolearn: 0 AvgScore: 1.56 AvgScanTime: 4.85 sec Spam: 83719 Autolearn: 0 AvgScore: 11.59 AvgScanTime: 5.97 sec Ham: 257948 Autolearn: 0 AvgScore: -1.69 AvgScanTime: 4.48 sec Time Spent Running SA: 459.88 hours Time Spent Processing Spam: 138.84 hours Time Spent Processing Ham: 321.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 69525 83.55 83.05 83.71 2 DKIM_SIGNED 61797 77.69 73.81 78.95 3 DCC_CHECK 60587 55.96 72.37 50.64 4 XM_DK_Pass 60322 76.45 72.05 77.87 5 XMListUnsubscribeExists 55022 58.71 65.72 56.43 6 DKIM_VALID 54428 70.72 65.01 72.57 7 DKIM_VALID_AU 46981 58.36 56.12 59.09 8 BAYES_50 45418 54.40 54.25 54.45 9 XM_H_QuotedFrom 37934 42.63 45.31 41.76 10 LOC_TINY_FONT_1 31410 31.19 37.52 29.14 11 XM_DK_Undo_02 28014 14.72 33.46 8.63 12 HTML_FONT_LOW_CONTRAST 27810 34.15 33.22 34.45 13 MIME_HTML_ONLY 25228 24.13 30.13 22.18 14 BOTNET 22771 8.92 27.20 2.99 15 DCC_CHECK_NEGATIVE 22377 43.12 26.73 48.44 16 XM_Evil_Numbers_Gen 21838 13.87 26.08 9.91 17 BAYES_99 20990 11.18 25.07 6.68 18 FVGT_m_MULTI_ODD 19771 22.09 23.62 21.60 19 XMSubLong 18973 22.31 22.66 22.20 20 LOTS_OF_MONEY 18266 11.48 21.82 8.12 21 BAYES_999 17810 9.55 21.27 5.75 22 HTML_IMAGE_RATIO_02 17565 14.08 20.98 11.84 23 TR_DCC_Bayes_99 17414 8.29 20.80 4.23 24 XM_Body_Dirty_Words 16970 15.76 20.27 14.30 25 RELAYCOUNTRY_META 14743 7.66 17.61 4.44 26 T_KAM_HTML_FONT_INVALID 13853 14.21 16.55 13.45 27 XM_Multi_Part_URI 13245 14.56 15.82 14.15 28 BOTNET_IPINHOSTNAME 12628 10.45 15.08 8.95 29 RCVD_IN_RP_RNBL 12358 3.70 14.76 0.11 30 DKIM_VALID_EF 12298 25.52 14.69 29.04 31 T_TM2_M_HEADER_IN_MSG 12239 21.42 14.62 23.62 32 MultiRelay 11753 13.92 14.04 13.88 33 TR_LOTS_OF_MONEY3 11500 3.60 13.74 0.31 34 BOUNCE_MESSAGE 10822 5.49 12.93 3.08 35 ANY_BOUNCE_MESSAGE 10822 5.49 12.93 3.08 36 UNTRUSTED_Relay 10140 3.89 12.11 1.23 37 STYLE_GIBBERISH 10079 14.11 12.04 14.78 38 FSL_BULK_SIG 9415 9.93 11.25 9.50 39 XMSexyCombo_05 9197 6.80 10.99 5.44 40 FROM_EXCESS_BASE64 8423 6.23 10.06 4.99 41 DKIM_INVALID 7369 6.97 8.80 6.37 42 HTML_IMAGE_RATIO_04 7308 7.52 8.73 7.13 43 TooManyTo_001 7110 6.88 8.49 6.35 44 MPART_ALT_DIFF 6841 4.85 8.17 3.77 45 XM_UncommonTLD01 6540 4.97 7.81 4.04 46 XM_H_Long_From01 6523 6.89 7.79 6.59 47 XMSubMetaSx_00 6319 5.80 7.55 5.23 48 T_XMDrugObfuBody_14 6059 7.19 7.24 7.18 49 XM_UB50 5364 2.03 6.41 0.61 50 XM_B_Phish_Phrases 5318 7.23 6.35 7.51 51 BAYES_60 4879 5.29 5.83 5.12 52 BAYES_80 4507 3.47 5.38 2.85 53 XMNumbers 4481 4.37 5.35 4.05 54 LotsOfNums_01 4292 6.47 5.13 6.90 55 XMStrtUSub 3916 5.70 4.68 6.04 56 MIME_HTML_ONLY_MULTI 3557 2.01 4.25 1.28 57 XM_DIRTYINTL 3549 2.38 4.24 1.78 58 MIME_HTML_MOSTLY 3399 3.62 4.06 3.48 59 MultiRelay_CC 3146 1.03 3.76 0.14 60 MultiRelay_Combo 3146 1.03 3.76 0.14 61 HTML_IMAGE_RATIO_06 3127 4.28 3.74 4.45 62 URI_HEX 3117 2.03 3.72 1.48 63 SpammyFromTLD_02 3085 1.02 3.68 0.15 64 XMBdyGiftCard01 3024 2.56 3.61 2.21 65 HTML_MIME_NO_HTML_TAG 3002 2.20 3.59 1.75 66 T_TooManySym_01 2917 7.08 3.48 8.25 67 RELAYCOUNTRY_CA 2908 2.16 3.47 1.74 68 UNPARSEABLE_RELAY 2855 5.16 3.41 5.73 69 RCVD_IN_RP_SAFE 2833 10.51 3.38 12.82 70 T_REMOTE_IMAGE 2719 3.03 3.25 2.96 71 TM2_M_URI_OPT_OUT 2448 2.31 2.92 2.11 72 HTML_IMAGE_RATIO_08 2386 2.31 2.85 2.14 73 BAYES_95 2368 2.03 2.83 1.76 74 BOTNET_NORDNS 2289 0.68 2.73 0.01 75 XM_SPF_SoftFail 2280 1.97 2.72 1.72 76 RELAYCOUNTRY_CN 2261 0.70 2.70 0.06 77 XM_CamelCaseFrm001 2172 2.15 2.59 2.00 78 RCVD_IN_RP_CERTIFIED 2074 9.10 2.48 11.25 79 BAYES_40 2036 3.97 2.43 4.48 80 XM_SendGrid 2017 4.76 2.41 5.52 81 XM_UB60 2004 0.63 2.39 0.05 82 XMSexyCombo_01 1891 1.58 2.26 1.36 83 RCVD_IN_BL_SPAMCOP_NET 1838 0.66 2.20 0.16 84 RELAYCOUNTRY_FR 1833 0.64 2.19 0.14 85 SUBJ_ALL_CAPS 1813 1.64 2.17 1.47 86 RCVD_IN_MSPIKE_H2 1801 4.40 2.15 5.13 87 MIME_QP_LONG_LINE 1721 3.48 2.06 3.95 88 PLING_QUERY 1698 0.90 2.03 0.53 89 XM_OfRef6 1627 1.84 1.94 1.80 90 SUBJ_DOLLARS 1592 0.94 1.90 0.63 91 XM_H_Long_From02 1586 1.01 1.89 0.73 92 XMSubMetaI_00 1564 1.06 1.87 0.80 93 SpammyFromTLD_01 1526 0.81 1.82 0.48 94 T_XMDrugObfuBody_08 1512 1.15 1.81 0.93 95 URIBL_DBL_SPAM 1501 0.48 1.79 0.05 96 BODY_ENHANCEMENT 1490 0.45 1.78 0.02 97 BAYES_00 1440 15.03 1.72 19.35 98 XMDiploma_00 1339 1.20 1.60 1.07 99 BAYES_20 1322 2.78 1.58 3.17 100 XM_B_REG_HTML 1288 0.95 1.54 0.76 101 RELAYCOUNTRY_AT 1276 0.63 1.52 0.34 102 ALL_TRUSTED 1256 12.11 1.50 15.56 103 XMPhish30 1255 0.65 1.50 0.38 104 XMBody_17 1175 0.95 1.40 0.81 105 T_HTML_TAG_BALANCE_CENTER 1153 0.40 1.38 0.09 106 URIBL_BLACK 1134 0.40 1.35 0.09 107 NO_DNS_FOR_FROM 1108 1.08 1.32 1.00 108 T_XMHurry_00 1081 0.86 1.29 0.72 109 BODY_URI_ONLY 1080 0.36 1.29 0.05 110 XMStockSpam_06 1057 1.43 1.26 1.49 111 TR_XM_DK_Bayes 1049 12.30 1.25 15.88 112 XMGenDplmaNmb 1021 0.74 1.22 0.59 113 XM_BadFromFormat 1001 0.41 1.20 0.15 114 DIET_1 979 0.53 1.17 0.32 115 XMHTMLBadTable_001 973 0.92 1.16 0.84 116 DKIM_ADSP_NXDOMAIN 964 0.68 1.15 0.52 117 TR_XM_DK_Bayes1 963 11.59 1.15 14.97 118 XM_H_PHPOS 962 1.05 1.15 1.02 119 XM_ProductURIs 961 0.98 1.15 0.93 120 TM2_M_VERY_LONG_WORD 956 0.91 1.14 0.84 121 XM_URI_RBL 953 0.62 1.14 0.45 122 T_MONEY_PERCENT 945 0.49 1.13 0.28 123 TR_LOTS_OF_MONEY2 945 0.49 1.13 0.28 124 XMBody_78 932 0.82 1.11 0.73 125 XMPhish11 923 1.06 1.10 1.04 126 MAILING_LIST_MULTI 916 1.58 1.09 1.74 127 TR_XM_RelayPhish 915 0.64 1.09 0.50 128 XMSexyCombo_04 902 0.98 1.08 0.95 129 T_Symld_Words_02 899 0.85 1.07 0.78 130 XM_DK_Undo_01 868 1.48 1.04 1.62 131 XMSubMetaSSx_00 852 0.46 1.02 0.28 132 HTML_TAG_BALANCE_BODY 848 0.55 1.01 0.40 133 TR_XM_DK_Bayes2 848 10.09 1.01 13.03 134 XM_S_JOY_D 825 0.52 0.99 0.37 135 FROM_SUSPICIOUS_NTLD 792 0.27 0.95 0.05 136 HTML_SHORT_LINK_IMG_1 785 0.26 0.94 0.04 137 XM_Body_Obfu01 785 0.32 0.94 0.13 138 MPART_ALT_DIFF_COUNT 778 0.39 0.93 0.22 139 TooManyTo_002 772 1.25 0.92 1.36 140 DATE_IN_PAST_03_06 770 0.29 0.92 0.09 141 XM_UB99 763 0.23 0.91 0.00 142 TR_Mismatch_TLD_02 761 0.27 0.91 0.07 143 BAYES_05 759 1.84 0.91 2.14 144 XM_B_COPY_HTML 748 0.63 0.89 0.54 145 XM_UB80 744 0.23 0.89 0.02 146 HTML_FONT_SIZE_HUGE 736 0.30 0.88 0.11 147 RCVD_IN_IADB_LISTED 732 2.60 0.87 3.15 148 XMSlimDrugH 732 0.55 0.87 0.44 149 RDNS_DYNAMIC 725 0.62 0.87 0.54 150 TooManyTo_003 704 0.96 0.84 1.00 151 XM_H_PHPMailer 704 0.80 0.84 0.78 152 LOW_PRICE 698 0.34 0.83 0.18 153 RELAYCOUNTRY_DE 670 0.39 0.80 0.26 154 RELAYCOUNTRY_ZA 665 0.20 0.79 0.00 155 URI_TRY_3LD 664 1.73 0.79 2.04 156 RCVD_IN_IADB_SPF 658 2.32 0.79 2.82 157 SHORTENER_SHORT_IMG 656 0.19 0.78 0.00 158 URI_BUFFLY 653 0.19 0.78 0.00 159 MISSING_HEADERS 652 0.40 0.78 0.28 160 XM_RXBody 650 0.37 0.78 0.24 161 DKIM_ADSP_CUSTOM_MED 638 0.84 0.76 0.86 162 RCVD_IN_IADB_SENDERID 634 2.09 0.76 2.53 163 REPLYTO_WITHOUT_TO_CC 619 0.20 0.74 0.03 164 RCVD_IN_IADB_DK 619 2.04 0.74 2.47 165 T_TooManySym_02 611 1.90 0.73 2.28 166 NML_ADSP_CUSTOM_MED 609 0.61 0.73 0.57 167 LONG_HEX_URI 597 0.26 0.71 0.11 168 T_FILL_THIS_FORM_SHORT 596 0.71 0.71 0.70 169 XMSubMetaSxObfu_03 583 1.07 0.70 1.19 170 RELAYCOUNTRY_GB 580 0.52 0.69 0.46 171 XMPhish14 574 0.54 0.69 0.50 172 LongTLD 574 0.29 0.69 0.16 173 URI_NOVOWEL 573 0.36 0.68 0.25 174 TR_Symld_Words 572 1.31 0.68 1.51 175 RCVD_IN_MSPIKE_WL 572 1.84 0.68 2.21 176 XM_OfRef7 570 0.35 0.68 0.24 177 T_XMDrugObfuBody_00 570 0.70 0.68 0.70 178 RCVD_IN_MSPIKE_H3 568 1.84 0.68 2.21 179 FORGED_GMAIL_RCVD 559 0.52 0.67 0.48 180 TooManyTo_004 558 0.77 0.67 0.80 181 XMMoneyMeta_00 553 0.43 0.66 0.36 182 XM_UB999 549 0.16 0.66 0.00 183 XMLongAddy 541 0.19 0.65 0.05 184 RELAYCOUNTRY_PY 539 0.16 0.64 0.00 185 XM_H_Long_From03 535 0.20 0.64 0.06 186 PP_MIME_FAKE_ASCII_TEXT 529 0.32 0.63 0.22 187 BASE64_LENGTH_79_INF 525 0.22 0.63 0.09 188 RELAYCOUNTRY_NZ 505 0.16 0.60 0.01 189 HTML_FONT_FACE_BAD 501 0.51 0.60 0.48 190 RELAYCOUNTRY_BR 493 0.16 0.59 0.02 191 DATE_IN_PAST_06_12 489 0.17 0.58 0.03 192 TooManyTo_005 474 0.68 0.57 0.71 193 RELAYCOUNTRY_NL 466 0.29 0.56 0.20 194 XM_H_PHPOS_M 450 0.51 0.54 0.50 195 HTML_IMAGE_ONLY_04 450 0.16 0.54 0.03 196 RCVD_IN_SORBS_DUL 448 0.26 0.54 0.17 197 TR_MetaPhish_Combo_01 446 1.63 0.53 1.99 198 HTTPS_HTTP_MISMATCH 446 0.40 0.53 0.35 199 RCVD_IN_IADB_VOUCHED 438 1.66 0.52 2.03 200 XM_UB95 434 0.13 0.52 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 215930 83.55 83.05 83.71 2 DKIM_SIGNED 203646 77.69 73.81 78.95 3 XM_DK_Pass 200875 76.45 72.05 77.87 4 DKIM_VALID 187205 70.72 65.01 72.57 5 DKIM_VALID_AU 152422 58.36 56.12 59.09 6 XMListUnsubscribeExists 145554 58.71 65.72 56.43 7 BAYES_50 140456 54.40 54.25 54.45 8 DCC_CHECK 130616 55.96 72.37 50.64 9 DCC_CHECK_NEGATIVE 124944 43.12 26.73 48.44 10 XM_H_QuotedFrom 107711 42.63 45.31 41.76 11 HTML_FONT_LOW_CONTRAST 88866 34.15 33.22 34.45 12 LOC_TINY_FONT_1 75173 31.19 37.52 29.14 13 DKIM_VALID_EF 74908 25.52 14.69 29.04 14 T_TM2_M_HEADER_IN_MSG 60936 21.42 14.62 23.62 15 XMSubLong 57269 22.31 22.66 22.20 16 MIME_HTML_ONLY 57201 24.13 30.13 22.18 17 FVGT_m_MULTI_ODD 55715 22.09 23.62 21.60 18 BAYES_00 49909 15.03 1.72 19.35 19 XM_DKIMWhitelistDomains 42049 12.33 0.11 16.30 20 TR_XM_DK_Bayes 40960 12.30 1.25 15.88 21 ALL_TRUSTED 40136 12.11 1.50 15.56 22 TR_XM_DK_Bayes1 38627 11.59 1.15 14.97 23 STYLE_GIBBERISH 38127 14.11 12.04 14.78 24 XM_Body_Dirty_Words 36875 15.76 20.27 14.30 25 XM_Multi_Part_URI 36501 14.56 15.82 14.15 26 MultiRelay 35804 13.92 14.04 13.88 27 T_KAM_HTML_FONT_INVALID 34682 14.21 16.55 13.45 28 TR_XM_DK_Bayes2 33612 10.09 1.01 13.03 29 RCVD_IN_RP_SAFE 33074 10.51 3.38 12.82 30 HTML_IMAGE_RATIO_02 30529 14.08 20.98 11.84 31 RCVD_IN_RP_CERTIFIED 29010 9.10 2.48 11.25 32 XM_Evil_Numbers_Gen 25560 13.87 26.08 9.91 33 FSL_BULK_SIG 24497 9.93 11.25 9.50 34 BOTNET_IPINHOSTNAME 23076 10.45 15.08 8.95 35 XM_DK_Undo_02 22265 14.72 33.46 8.63 36 T_TooManySym_01 21272 7.08 3.48 8.25 37 LOTS_OF_MONEY 20949 11.48 21.82 8.12 38 XM_B_Phish_Phrases 19368 7.23 6.35 7.51 39 T_XMDrugObfuBody_14 18511 7.19 7.24 7.18 40 HTML_IMAGE_RATIO_04 18381 7.52 8.73 7.13 41 LotsOfNums_01 17798 6.47 5.13 6.90 42 BAYES_99 17220 11.18 25.07 6.68 43 XM_H_Long_From01 17011 6.89 7.79 6.59 44 DKIM_INVALID 16441 6.97 8.80 6.37 45 TooManyTo_001 16390 6.88 8.49 6.35 46 XMStrtUSub 15571 5.70 4.68 6.04 47 TVD_RCVD_IP 15028 4.46 0.25 5.83 48 BAYES_999 14820 9.55 21.27 5.75 49 UNPARSEABLE_RELAY 14781 5.16 3.41 5.73 50 XM_SendGrid 14232 4.76 2.41 5.52 51 XMSexyCombo_05 14045 6.80 10.99 5.44 52 XMSubMetaSx_00 13489 5.80 7.55 5.23 53 TO_MALFORMED 13460 3.96 0.08 5.22 54 RCVD_IN_MSPIKE_H2 13230 4.40 2.15 5.13 55 BAYES_60 13208 5.29 5.83 5.12 56 FROM_EXCESS_BASE64 12879 6.23 10.06 4.99 57 BAYES_40 11544 3.97 2.43 4.48 58 HTML_IMAGE_RATIO_06 11484 4.28 3.74 4.45 59 RELAYCOUNTRY_META 11445 7.66 17.61 4.44 60 TR_DCC_Bayes_99 10909 8.29 20.80 4.23 61 XMNumbers 10436 4.37 5.35 4.05 62 XM_UncommonTLD01 10424 4.97 7.81 4.04 63 MIME_QP_LONG_LINE 10183 3.48 2.06 3.95 64 MPART_ALT_DIFF 9737 4.85 8.17 3.77 65 MIME_HTML_MOSTLY 8980 3.62 4.06 3.48 66 INVALID_MSGID 8294 2.46 0.13 3.22 67 BAYES_20 8171 2.78 1.58 3.17 68 RCVD_IN_IADB_LISTED 8136 2.60 0.87 3.15 69 BOUNCE_MESSAGE 7937 5.49 12.93 3.08 70 ANY_BOUNCE_MESSAGE 7937 5.49 12.93 3.08 71 BOTNET 7714 8.92 27.20 2.99 72 T_REMOTE_IMAGE 7641 3.03 3.25 2.96 73 BAYES_80 7362 3.47 5.38 2.85 74 RCVD_IN_IADB_SPF 7275 2.32 0.79 2.82 75 IN_ZIMBRA_NJ_WHITELIST 7008 2.05 0.01 2.72 76 RCVD_IN_IADB_SENDERID 6517 2.09 0.76 2.53 77 RCVD_IN_IADB_DK 6367 2.04 0.74 2.47 78 T_TooManySym_02 5869 1.90 0.73 2.28 79 RCVD_IN_MSPIKE_WL 5710 1.84 0.68 2.21 80 XMBdyGiftCard01 5707 2.56 3.61 2.21 81 RCVD_IN_MSPIKE_H3 5705 1.84 0.68 2.21 82 BAYES_05 5526 1.84 0.91 2.14 83 HTML_IMAGE_RATIO_08 5521 2.31 2.85 2.14 84 TM2_M_URI_OPT_OUT 5453 2.31 2.92 2.11 85 URI_TRY_3LD 5252 1.73 0.79 2.04 86 RCVD_IN_IADB_VOUCHED 5240 1.66 0.52 2.03 87 XM_CamelCaseFrm001 5170 2.15 2.59 2.00 88 TR_MetaPhish_Combo_01 5139 1.63 0.53 1.99 89 XM_OfRef6 4650 1.84 1.94 1.80 90 XM_DIRTYINTL 4596 2.38 4.24 1.78 91 BAYES_95 4551 2.03 2.83 1.76 92 HTML_MIME_NO_HTML_TAG 4503 2.20 3.59 1.75 93 MAILING_LIST_MULTI 4499 1.58 1.09 1.74 94 RELAYCOUNTRY_CA 4483 2.16 3.47 1.74 95 XM_SPF_SoftFail 4442 1.97 2.72 1.72 96 XM_DK_Undo_01 4180 1.48 1.04 1.62 97 XM_PDF 4092 1.26 0.25 1.59 98 IN_HORDE_ADDRESS_BOOK 4082 1.20 0.03 1.58 99 USER_IN_DEF_DKIM_WL 4081 1.20 0.01 1.58 100 TR_Symld_Words 3888 1.31 0.68 1.51 101 XMStockSpam_06 3837 1.43 1.26 1.49 102 URI_HEX 3818 2.03 3.72 1.48 103 SUBJ_ALL_CAPS 3793 1.64 2.17 1.47 104 XMSexyCombo_01 3517 1.58 2.26 1.36 105 TooManyTo_002 3504 1.25 0.92 1.36 106 MIME_HTML_ONLY_MULTI 3307 2.01 4.25 1.28 107 XM_GoogleGroups 3274 1.06 0.41 1.27 108 UNTRUSTED_Relay 3167 3.89 12.11 1.23 109 RCVD_IN_IADB_OPTIN 3138 1.04 0.48 1.22 110 XMSubMetaSxObfu_03 3061 1.07 0.70 1.19 111 XMSubMetaSx_01 2803 0.93 0.44 1.09 112 XMDiploma_00 2753 1.20 1.60 1.07 113 FILL_THIS_FORM 2692 0.85 0.25 1.04 114 XMPhish11 2690 1.06 1.10 1.04 115 XM_H_PHPOS 2625 1.05 1.15 1.02 116 NO_DNS_FOR_FROM 2581 1.08 1.32 1.00 117 TooManyTo_003 2567 0.96 0.84 1.00 118 T_FILL_THIS_FORM_LONG 2502 0.78 0.18 0.97 119 XMSexyCombo_04 2458 0.98 1.08 0.95 120 T_XMDrugObfuBody_08 2401 1.15 1.81 0.93 121 XM_ProductURIs 2387 0.98 1.15 0.93 122 DKIM_ADSP_CUSTOM_MED 2219 0.84 0.76 0.86 123 XMHTMLBadTable_001 2175 0.92 1.16 0.84 124 XMBody_95 2161 0.67 0.16 0.84 125 TM2_M_VERY_LONG_WORD 2159 0.91 1.14 0.84 126 XMSexyCombo_02 2150 0.69 0.24 0.83 127 T_TooManySym_03 2114 0.67 0.22 0.82 128 USER_IN_WHITELIST 2113 0.62 0.00 0.82 129 XMBody_17 2087 0.95 1.40 0.81 130 XMSubMetaSxObfu_02 2071 0.69 0.34 0.80 131 XMSubMetaI_00 2064 1.06 1.87 0.80 132 TooManyTo_004 2060 0.77 0.67 0.80 133 XM_H_PHPMailer 2022 0.80 0.84 0.78 134 T_Symld_Words_02 2017 0.85 1.07 0.78 135 XM_B_REG_HTML 1957 0.95 1.54 0.76 136 XMBody_78 1883 0.82 1.11 0.73 137 XM_H_Long_From02 1881 1.01 1.89 0.73 138 T_XMHurry_00 1856 0.86 1.29 0.72 139 TooManyTo_005 1836 0.68 0.57 0.71 140 T_FILL_THIS_FORM_SHORT 1813 0.71 0.71 0.70 141 T_XMDrugObfuBody_00 1808 0.70 0.68 0.70 142 TM2_M_A_HREF_HREF 1730 0.60 0.38 0.67 143 XM_shorewaves_Whitelist 1724 0.50 0.00 0.67 144 XMHTML_After_End 1636 0.57 0.38 0.63 145 SUBJ_DOLLARS 1627 0.94 1.90 0.63 146 XM_UB50 1581 2.03 6.41 0.61 147 XMGenDplmaNmb 1515 0.74 1.22 0.59 148 NML_ADSP_CUSTOM_MED 1471 0.61 0.73 0.57 149 XM_Walgreens_Forge 1447 0.45 0.11 0.56 150 HELO_NODOT 1446 0.46 0.17 0.56 151 T_FILL_THIS_FORM_LOAN 1411 0.43 0.05 0.55 152 XM_B_COPY_HTML 1401 0.63 0.89 0.54 153 RDNS_DYNAMIC 1400 0.62 0.87 0.54 154 XMBrknScrpt_02 1374 0.53 0.52 0.53 155 PLING_QUERY 1363 0.90 2.03 0.53 156 DKIM_ADSP_NXDOMAIN 1354 0.68 1.15 0.52 157 XM_H_PHPOS_M 1283 0.51 0.54 0.50 158 TR_XM_RelayPhish 1283 0.64 1.09 0.50 159 XMPhish14 1277 0.54 0.69 0.50 160 T_TooManySym_04 1272 0.40 0.13 0.49 161 SpammyFromTLD_01 1241 0.81 1.82 0.48 162 HTML_FONT_FACE_BAD 1237 0.51 0.60 0.48 163 FORGED_GMAIL_RCVD 1229 0.52 0.67 0.48 164 RELAYCOUNTRY_GB 1187 0.52 0.69 0.46 165 XMCapTrack 1159 0.37 0.15 0.45 166 XM_URI_RBL 1156 0.62 1.14 0.45 167 XMNoVowels 1149 0.38 0.18 0.45 168 XMSlimDrugH 1145 0.55 0.87 0.44 169 HTML_TAG_BALANCE_BODY 1032 0.55 1.01 0.40 170 FILL_THIS_FORM_LOAN 1028 0.32 0.10 0.40 171 XMLngstWrd_00 1010 0.38 0.36 0.39 172 REMOVE_BEFORE_LINK 1010 0.41 0.47 0.39 173 XMPhish30 968 0.65 1.50 0.38 174 RELAYCOUNTRY_AU 954 0.36 0.34 0.37 175 XM_S_JOY_D 954 0.52 0.99 0.37 176 XMMoneyMeta_00 925 0.43 0.66 0.36 177 XMBSHREFv2 916 0.33 0.25 0.36 178 HTTPS_HTTP_MISMATCH 910 0.40 0.53 0.35 179 XMSolicitRefs_0 899 0.33 0.29 0.35 180 XMRcvdHeader_15 889 0.26 0.00 0.34 181 XMLngstWrd_01 877 0.31 0.22 0.34 182 RELAYCOUNTRY_AT 868 0.63 1.52 0.34 183 XM_Akamai 866 0.26 0.04 0.34 184 XM_H_SpoofStaff4 836 0.25 0.03 0.32 185 DIET_1 834 0.53 1.17 0.32 186 XMDateMe_00 827 0.27 0.12 0.32 187 TR_LOTS_OF_MONEY3 794 3.60 13.74 0.31 188 TRACKER_ID 793 0.32 0.36 0.31 189 FROM_EGROUPS 782 0.23 0.01 0.30 190 XMSUPPORT 777 0.23 0.00 0.30 191 XM_ShortIntro_01 774 0.33 0.41 0.30 192 NUMERIC_HTTP_ADDR 761 0.35 0.51 0.30 193 RCVD_IN_SORBS_WEB 741 0.27 0.22 0.29 194 TR_MetaPhish_Combo_01b 727 0.23 0.08 0.28 195 XMSubMetaSSx_00 725 0.46 1.02 0.28 196 TVD_SPACE_RATIO 725 0.27 0.22 0.28 197 MISSING_HEADERS 723 0.40 0.78 0.28 198 TR_LOTS_OF_MONEY2 717 0.49 1.13 0.28 199 T_MONEY_PERCENT 717 0.49 1.13 0.28 200 HTML_IMAGE_ONLY_32 697 0.26 0.22 0.27 ----------------------------------------------------------------------