Email: 362955 Autolearn: 0 AvgScore: 2.97 AvgScanTime: 3.08 sec Spam: 107559 Autolearn: 0 AvgScore: 12.48 AvgScanTime: 3.54 sec Ham: 255396 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 2.89 sec Time Spent Running SA: 310.81 hours Time Spent Processing Spam: 105.72 hours Time Spent Processing Ham: 205.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87401 83.80 81.26 84.87 2 DKIM_SIGNED 76624 77.74 71.24 80.47 3 DCC_CHECK 75222 57.77 69.94 52.64 4 XM_DK_Pass 74600 76.52 69.36 79.54 5 DKIM_VALID 68878 72.99 64.04 76.76 6 XMListUnsubscribeExists 67313 59.03 62.58 57.54 7 DKIM_VALID_AU 59468 59.76 55.29 61.64 8 BAYES_50 55058 51.76 51.19 52.00 9 XM_H_QuotedFrom 49312 42.22 45.85 40.70 10 HTML_FONT_LOW_CONTRAST 38370 35.20 35.67 35.00 11 STYLE_GIBBERISH 37431 34.78 34.80 34.77 12 LOC_TINY_FONT_1 36865 31.11 34.27 29.77 13 XM_DK_Undo_02 35022 17.06 32.56 10.54 14 FVGT_m_MULTI_ODD 32407 25.05 30.13 22.92 15 DCC_CHECK_NEGATIVE 30716 40.91 28.56 46.11 16 MIME_HTML_ONLY 29701 24.19 27.61 22.75 17 BOTNET 28881 10.08 26.85 3.02 18 BAYES_99 28392 13.73 26.40 8.39 19 XM_Multi_Part_URI 26737 17.75 24.86 14.76 20 LOTS_OF_MONEY 24396 13.58 22.68 9.75 21 TR_DCC_Bayes_99 23748 10.38 22.08 5.46 22 BAYES_999 23675 11.63 22.01 7.26 23 XMSubLong 21703 20.90 20.18 21.21 24 RELAYCOUNTRY_META 21535 9.16 20.02 4.59 25 XM_Body_Dirty_Words 19872 15.06 18.48 13.62 26 HTML_IMAGE_RATIO_02 19447 13.02 18.08 10.90 27 T_KAM_HTML_FONT_INVALID 18189 15.04 16.91 14.25 28 DKIM_VALID_EF 17019 25.54 15.82 29.63 29 T_TM2_M_HEADER_IN_MSG 16982 19.60 15.79 21.20 30 RCVD_IN_RP_RNBL 16535 5.04 15.37 0.68 31 BOTNET_IPINHOSTNAME 16113 9.57 14.98 7.29 32 UNTRUSTED_Relay 15483 5.26 14.39 1.41 33 MultiRelay 14964 14.15 13.91 14.25 34 BOUNCE_MESSAGE 14315 7.15 13.31 4.56 35 ANY_BOUNCE_MESSAGE 14315 7.15 13.31 4.56 36 XM_Evil_Numbers_Gen 12108 11.06 11.26 10.97 37 FSL_BULK_SIG 11818 10.04 10.99 9.64 38 FROM_EXCESS_BASE64 10351 6.75 9.62 5.55 39 XMSexyCombo_05 10087 6.89 9.38 5.84 40 HTML_IMAGE_RATIO_04 9357 8.82 8.70 8.87 41 XMSubMetaSx_00 9141 6.06 8.50 5.03 42 XM_UncommonTLD01 8649 5.17 8.04 3.95 43 MPART_ALT_DIFF 8392 4.66 7.80 3.33 44 T_XMDrugObfuBody_14 8106 6.95 7.54 6.70 45 DKIM_INVALID 7746 4.75 7.20 3.71 46 XM_H_Long_From01 7671 6.21 7.13 5.82 47 TooManyTo_001 6958 6.20 6.47 6.09 48 BAYES_60 6924 5.90 6.44 5.67 49 XM_URI_RBL 6416 2.13 5.97 0.52 50 XM_B_Phish_Phrases 6383 7.12 5.93 7.62 51 BAYES_80 6334 3.92 5.89 3.08 52 XM_UB50 6265 2.22 5.82 0.70 53 LotsOfNums_01 6003 7.76 5.58 8.68 54 XMNumbers 5894 4.61 5.48 4.25 55 XMStrtUSub 5508 5.51 5.12 5.67 56 HTML_MIME_NO_HTML_TAG 4864 2.19 4.52 1.21 57 RCVD_IN_RP_SAFE 4807 11.35 4.47 14.25 58 MultiRelay_Combo 4514 1.34 4.20 0.14 59 MultiRelay_CC 4514 1.34 4.20 0.14 60 HTML_IMAGE_RATIO_06 4465 4.55 4.15 4.72 61 MIME_HTML_MOSTLY 4463 3.80 4.15 3.65 62 TM2_M_URI_OPT_OUT 4453 2.55 4.14 1.88 63 MIME_HTML_ONLY_MULTI 4441 2.13 4.13 1.29 64 XM_DIRTYINTL 4253 2.48 3.95 1.86 65 UNPARSEABLE_RELAY 3972 4.36 3.69 4.64 66 BOTNET_NORDNS 3946 1.10 3.67 0.01 67 RCVD_IN_RP_CERTIFIED 3873 9.94 3.60 12.61 68 URI_HEX 3700 2.19 3.44 1.66 69 XMSexyCombo_01 3644 2.05 3.39 1.49 70 XM_UB60 3602 1.05 3.35 0.08 71 SpammyFromTLD_02 3470 1.09 3.23 0.20 72 RELAYCOUNTRY_CN 3439 0.98 3.20 0.04 73 RCVD_IN_BL_SPAMCOP_NET 3318 1.08 3.08 0.23 74 RCVD_IN_MSPIKE_H2 3297 4.11 3.07 4.55 75 XMBdyGiftCard01 3246 1.97 3.02 1.53 76 RELAYCOUNTRY_CA 3216 2.13 2.99 1.77 77 XM_SPF_SoftFail 3199 1.65 2.97 1.09 78 XM_SendGrid 3150 5.53 2.93 6.63 79 BAYES_95 3107 2.20 2.89 1.91 80 XMSubMetaI_00 3068 1.52 2.85 0.95 81 T_REMOTE_IMAGE 3054 3.12 2.84 3.24 82 XM_CamelCaseFrm001 2943 2.00 2.74 1.69 83 XM_OfRef6 2760 2.17 2.57 2.01 84 T_XMDrugObfuBody_08 2563 1.33 2.38 0.89 85 HTML_IMAGE_RATIO_08 2476 2.10 2.30 2.02 86 TVD_SPACE_RATIO_MINFP 2379 0.66 2.21 0.00 87 SUBJ_ALL_CAPS 2284 1.49 2.12 1.23 88 T_TooManySym_01 2268 6.20 2.11 7.92 89 BAYES_40 2223 4.03 2.07 4.86 90 FROM_SUSPICIOUS_NTLD 2139 0.63 1.99 0.06 91 MISSING_HEADERS 2127 0.76 1.98 0.25 92 MIME_QP_LONG_LINE 2124 3.81 1.97 4.59 93 XMDiploma_00 2066 1.53 1.92 1.37 94 BAYES_20 2059 2.40 1.91 2.61 95 BAYES_00 2058 14.35 1.91 19.58 96 XM_BadFromFormat 2016 0.66 1.87 0.16 97 XM_H_Long_From02 2011 1.18 1.87 0.89 98 XM_ProductURIs 1958 1.87 1.82 1.89 99 RELAYCOUNTRY_FR 1923 0.67 1.79 0.19 100 XMBody_17 1905 1.08 1.77 0.78 101 T_FILL_THIS_FORM_SHORT 1886 0.93 1.75 0.58 102 XM_B_REG_HTML 1874 0.99 1.74 0.68 103 T_HTML_TAG_BALANCE_CENTER 1840 0.59 1.71 0.12 104 RELAYCOUNTRY_DE 1811 0.67 1.68 0.24 105 DIET_1 1771 0.80 1.65 0.45 106 MPART_ALT_DIFF_COUNT 1683 0.72 1.56 0.37 107 XM_UB80 1678 0.47 1.56 0.02 108 URIBL_DBL_SPAM 1659 0.51 1.54 0.08 109 XM_salutation2 1641 0.93 1.53 0.68 110 XMGenDplmaNmb 1628 1.09 1.51 0.92 111 XM_UB99 1614 0.46 1.50 0.03 112 BODY_URI_ONLY 1564 0.46 1.45 0.04 113 HTML_SHORT_LINK_IMG_1 1524 0.44 1.42 0.03 114 RELAYCOUNTRY_PL 1486 0.44 1.38 0.04 115 BODY_ENHANCEMENT 1472 0.42 1.37 0.03 116 SpammyFromTLD_01 1452 0.64 1.35 0.34 117 RELAYCOUNTRY_GB 1426 0.74 1.33 0.49 118 XMPhish30 1419 0.69 1.32 0.42 119 URI_TRY_3LD 1398 1.58 1.30 1.70 120 RELAYCOUNTRY_AT 1383 0.64 1.29 0.37 121 XMPhish11 1381 0.94 1.28 0.80 122 TR_XM_DK_Bayes 1370 12.18 1.27 16.77 123 XM_ShortIntro_01 1367 0.58 1.27 0.29 124 BAYES_05 1354 1.70 1.26 1.89 125 DKIM_ADSP_NXDOMAIN 1339 0.75 1.24 0.55 126 TR_Mismatch_TLD_02 1337 0.41 1.24 0.06 127 URIBL_BLACK 1335 0.43 1.24 0.09 128 TM2_M_VERY_LONG_WORD 1319 1.13 1.23 1.08 129 RELAYCOUNTRY_IN 1318 0.42 1.23 0.09 130 HTML_OFF_PAGE 1310 0.37 1.22 0.01 131 TR_XM_DK_Bayes1 1294 11.84 1.20 16.32 132 XMStockSpam_06 1292 2.10 1.20 2.48 133 MIME_HEADER_CTYPE_ONLY 1275 0.44 1.19 0.12 134 T_XMHurry_00 1254 0.93 1.17 0.84 135 ALL_TRUSTED 1239 10.72 1.15 14.76 136 DKIM_ADSP_CUSTOM_MED 1225 0.96 1.14 0.88 137 NORDNS_LOW_CONTRAST 1225 0.34 1.14 0.00 138 RELAYCOUNTRY_NG 1200 0.33 1.12 0.00 139 TR_XM_DK_Bayes2 1192 10.28 1.11 14.14 140 NML_ADSP_CUSTOM_MED 1175 0.74 1.09 0.59 141 XM_RXBody 1174 0.60 1.09 0.39 142 HTML_IMAGE_ONLY_04 1165 0.35 1.08 0.04 143 XMSexyCombo_04 1158 1.09 1.08 1.09 144 MAILING_LIST_MULTI 1134 1.54 1.05 1.74 145 XMSlimDrugH 1124 0.50 1.05 0.27 146 URG_BIZ 1114 0.32 1.04 0.01 147 RDNS_DYNAMIC 1111 0.66 1.03 0.50 148 XMBody_78 1108 0.68 1.03 0.53 149 SUBJ_DOLLARS 1106 0.69 1.03 0.55 150 FORGED_GMAIL_RCVD 1101 0.63 1.02 0.47 151 RCVD_IN_IADB_LISTED 1089 3.04 1.01 3.89 152 MONEY_FROM_41 1072 0.30 1.00 0.00 153 FROM_MISSP_EH_MATCH 1054 0.29 0.98 0.00 154 XMSubMetaSxObfu_03 1045 1.14 0.97 1.22 155 TO_NO_BRKTS_FROM_MSSP 1035 0.30 0.96 0.02 156 TooManyTo_002 1034 1.10 0.96 1.16 157 FROM_MISSP_REPLYTO 1034 0.30 0.96 0.02 158 XM_H_PHPOS 1025 0.91 0.95 0.89 159 LONG_JUNK_URI 1014 0.33 0.94 0.08 160 MONEY_FORM_SHORT 1008 0.28 0.94 0.01 161 XM_HighProb1 1008 0.28 0.94 0.00 162 ADVANCE_FEE_4_NEW_MONEY 992 0.27 0.92 0.00 163 T_DEAR_BENEFICIARY 988 0.27 0.92 0.00 164 RELAYCOUNTRY_UA 988 0.27 0.92 0.00 165 TooManyTo_003 969 0.88 0.90 0.87 166 XM_UB999 968 0.27 0.90 0.01 167 LONG_JUNK_URI3 953 0.28 0.89 0.02 168 FORM_FRAUD_3 945 0.26 0.88 0.00 169 REPLYTO_WITHOUT_TO_CC 927 0.31 0.86 0.07 170 HTML_SHORT_CENTER 925 0.26 0.86 0.00 171 XMSubMetaSSx_00 913 0.52 0.85 0.38 172 HTML_FONT_SIZE_HUGE 909 0.33 0.85 0.11 173 HTML_TAG_BALANCE_BODY 898 0.58 0.83 0.47 174 RCVD_IN_IADB_SPF 887 2.71 0.82 3.51 175 XMHTMLBadTable_001 877 0.95 0.82 1.01 176 TooManyTo_004 860 0.74 0.80 0.72 177 XMGppyBdWords 859 0.38 0.80 0.20 178 RCVD_IN_IADB_SENDERID 859 2.50 0.80 3.21 179 HTML_FONT_FACE_BAD 849 0.65 0.79 0.58 180 XM_B_COPY_HTML 845 0.73 0.79 0.71 181 RCVD_IN_IADB_DK 842 2.44 0.78 3.13 182 DATE_IN_PAST_03_06 840 0.28 0.78 0.07 183 XMPhish14 838 0.65 0.78 0.59 184 XM_XX_Yahoo 834 0.27 0.78 0.06 185 TooManyTo_005 821 0.66 0.76 0.62 186 LOW_PRICE 807 0.32 0.75 0.14 187 FILL_THIS_FORM 803 0.86 0.75 0.90 188 PP_MIME_FAKE_ASCII_TEXT 794 0.31 0.74 0.12 189 TR_XM_RelayPhish 790 0.49 0.73 0.38 190 T_XMDrugObfuBody_00 776 0.52 0.72 0.44 191 T_FILL_THIS_FORM_LONG 765 0.79 0.71 0.82 192 XM_DK_Undo_01 754 1.13 0.70 1.31 193 LongTLD 743 0.33 0.69 0.18 194 XM_H_Long_From03 730 0.25 0.68 0.07 195 XMLongAddy 728 0.24 0.68 0.06 196 BASE64_LENGTH_79_INF 719 0.27 0.67 0.10 197 PLING_QUERY 698 0.51 0.65 0.45 198 XMMoneyMeta_00 684 0.37 0.64 0.26 199 T_FILL_THIS_FORM_LOAN 674 0.74 0.63 0.79 200 XM_H_PHPMailer 671 0.74 0.62 0.79 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 216743 83.80 81.26 84.87 2 DKIM_SIGNED 205525 77.74 71.24 80.47 3 XM_DK_Pass 203140 76.52 69.36 79.54 4 DKIM_VALID 196047 72.99 64.04 76.76 5 DKIM_VALID_AU 157438 59.76 55.29 61.64 6 XMListUnsubscribeExists 146951 59.03 62.58 57.54 7 DCC_CHECK 134449 57.77 69.94 52.64 8 BAYES_50 132796 51.76 51.19 52.00 9 DCC_CHECK_NEGATIVE 117770 40.91 28.56 46.11 10 XM_H_QuotedFrom 103939 42.22 45.85 40.70 11 HTML_FONT_LOW_CONTRAST 89397 35.20 35.67 35.00 12 STYLE_GIBBERISH 88810 34.78 34.80 34.77 13 LOC_TINY_FONT_1 76041 31.11 34.27 29.77 14 DKIM_VALID_EF 75673 25.54 15.82 29.63 15 FVGT_m_MULTI_ODD 58528 25.05 30.13 22.92 16 MIME_HTML_ONLY 58104 24.19 27.61 22.75 17 XMSubLong 54171 20.90 20.18 21.21 18 T_TM2_M_HEADER_IN_MSG 54146 19.60 15.79 21.20 19 BAYES_00 50010 14.35 1.91 19.58 20 XM_DKIMWhitelistDomains 44379 12.26 0.09 17.38 21 TR_XM_DK_Bayes 42833 12.18 1.27 16.77 22 TR_XM_DK_Bayes1 41681 11.84 1.20 16.32 23 XM_Multi_Part_URI 37698 17.75 24.86 14.76 24 ALL_TRUSTED 37685 10.72 1.15 14.76 25 T_KAM_HTML_FONT_INVALID 36405 15.04 16.91 14.25 26 MultiRelay 36403 14.15 13.91 14.25 27 RCVD_IN_RP_SAFE 36389 11.35 4.47 14.25 28 TR_XM_DK_Bayes2 36106 10.28 1.11 14.14 29 XM_Body_Dirty_Words 34791 15.06 18.48 13.62 30 RCVD_IN_RP_CERTIFIED 32212 9.94 3.60 12.61 31 XM_Evil_Numbers_Gen 28027 11.06 11.26 10.97 32 HTML_IMAGE_RATIO_02 27826 13.02 18.08 10.90 33 XM_DK_Undo_02 26912 17.06 32.56 10.54 34 LOTS_OF_MONEY 24906 13.58 22.68 9.75 35 FSL_BULK_SIG 24624 10.04 10.99 9.64 36 HTML_IMAGE_RATIO_04 22663 8.82 8.70 8.87 37 LotsOfNums_01 22163 7.76 5.58 8.68 38 BAYES_99 21439 13.73 26.40 8.39 39 T_TooManySym_01 20220 6.20 2.11 7.92 40 XM_B_Phish_Phrases 19467 7.12 5.93 7.62 41 BOTNET_IPINHOSTNAME 18626 9.57 14.98 7.29 42 BAYES_999 18545 11.63 22.01 7.26 43 T_XMDrugObfuBody_14 17120 6.95 7.54 6.70 44 XM_SendGrid 16935 5.53 2.93 6.63 45 TooManyTo_001 15543 6.20 6.47 6.09 46 XMSexyCombo_05 14919 6.89 9.38 5.84 47 XM_H_Long_From01 14865 6.21 7.13 5.82 48 XMStrtUSub 14485 5.51 5.12 5.67 49 BAYES_60 14476 5.90 6.44 5.67 50 FROM_EXCESS_BASE64 14165 6.75 9.62 5.55 51 TR_DCC_Bayes_99 13941 10.38 22.08 5.46 52 XMSubMetaSx_00 12848 6.06 8.50 5.03 53 BAYES_40 12422 4.03 2.07 4.86 54 HTML_IMAGE_RATIO_06 12051 4.55 4.15 4.72 55 UNPARSEABLE_RELAY 11852 4.36 3.69 4.64 56 RELAYCOUNTRY_META 11725 9.16 20.02 4.59 57 MIME_QP_LONG_LINE 11718 3.81 1.97 4.59 58 BOUNCE_MESSAGE 11651 7.15 13.31 4.56 59 ANY_BOUNCE_MESSAGE 11651 7.15 13.31 4.56 60 RCVD_IN_MSPIKE_H2 11623 4.11 3.07 4.55 61 TO_MALFORMED 11249 3.21 0.38 4.40 62 XMNumbers 10843 4.61 5.48 4.25 63 TVD_RCVD_IP 10395 2.95 0.29 4.07 64 XM_UncommonTLD01 10099 5.17 8.04 3.95 65 RCVD_IN_IADB_LISTED 9942 3.04 1.01 3.89 66 DKIM_INVALID 9478 4.75 7.20 3.71 67 MIME_HTML_MOSTLY 9323 3.80 4.15 3.65 68 RCVD_IN_IADB_SPF 8965 2.71 0.82 3.51 69 IN_ZIMBRA_NJ_WHITELIST 8679 2.39 0.01 3.40 70 MPART_ALT_DIFF 8515 4.66 7.80 3.33 71 T_REMOTE_IMAGE 8275 3.12 2.84 3.24 72 RCVD_IN_IADB_SENDERID 8203 2.50 0.80 3.21 73 RCVD_IN_IADB_DK 8003 2.44 0.78 3.13 74 BAYES_80 7878 3.92 5.89 3.08 75 BOTNET 7718 10.08 26.85 3.02 76 INVALID_MSGID 6835 1.91 0.10 2.68 77 BAYES_20 6660 2.40 1.91 2.61 78 XMStockSpam_06 6335 2.10 1.20 2.48 79 RCVD_IN_IADB_VOUCHED 5590 1.72 0.60 2.19 80 T_TooManySym_02 5549 1.65 0.40 2.17 81 RCVD_IN_MSPIKE_WL 5310 1.56 0.33 2.08 82 RCVD_IN_MSPIKE_H3 5310 1.56 0.33 2.08 83 HTML_IMAGE_RATIO_08 5157 2.10 2.30 2.02 84 XM_OfRef6 5133 2.17 2.57 2.01 85 TR_MetaPhish_Combo_01 5086 1.57 0.57 1.99 86 IN_HORDE_ADDRESS_BOOK 5009 1.39 0.05 1.96 87 BAYES_95 4884 2.20 2.89 1.91 88 BAYES_05 4829 1.70 1.26 1.89 89 XM_ProductURIs 4816 1.87 1.82 1.89 90 TM2_M_URI_OPT_OUT 4811 2.55 4.14 1.88 91 XM_DIRTYINTL 4742 2.48 3.95 1.86 92 RELAYCOUNTRY_CA 4510 2.13 2.99 1.77 93 MAILING_LIST_MULTI 4454 1.54 1.05 1.74 94 URI_TRY_3LD 4340 1.58 1.30 1.70 95 XM_CamelCaseFrm001 4326 2.00 2.74 1.69 96 URI_HEX 4235 2.19 3.44 1.66 97 USER_IN_DEF_DKIM_WL 4191 1.16 0.01 1.64 98 XM_PDF 4063 1.18 0.20 1.59 99 XMBdyGiftCard01 3918 1.97 3.02 1.53 100 XMSexyCombo_01 3808 2.05 3.39 1.49 101 UNTRUSTED_Relay 3598 5.26 14.39 1.41 102 XMDiploma_00 3492 1.53 1.92 1.37 103 RCVD_IN_IADB_OPTIN 3359 1.05 0.41 1.32 104 XM_DK_Undo_01 3337 1.13 0.70 1.31 105 MIME_HTML_ONLY_MULTI 3306 2.13 4.13 1.29 106 TR_Symld_Words 3265 1.06 0.54 1.28 107 SUBJ_ALL_CAPS 3132 1.49 2.12 1.23 108 XMSubMetaSxObfu_03 3107 1.14 0.97 1.22 109 HTML_MIME_NO_HTML_TAG 3078 2.19 4.52 1.21 110 TooManyTo_002 2971 1.10 0.96 1.16 111 XMSexyCombo_04 2785 1.09 1.08 1.09 112 XM_SPF_SoftFail 2780 1.65 2.97 1.09 113 TM2_M_VERY_LONG_WORD 2767 1.13 1.23 1.08 114 XMBody_95 2674 0.77 0.10 1.05 115 XMHTMLBadTable_001 2572 0.95 0.82 1.01 116 XM_GoogleGroups 2547 0.83 0.44 1.00 117 XMSubMetaSx_01 2470 0.78 0.35 0.97 118 XMSubMetaI_00 2434 1.52 2.85 0.95 119 TM2_M_A_HREF_HREF 2419 0.81 0.48 0.95 120 XMGenDplmaNmb 2340 1.09 1.51 0.92 121 FILL_THIS_FORM 2303 0.86 0.75 0.90 122 XM_H_Long_From02 2272 1.18 1.87 0.89 123 XM_H_PHPOS 2268 0.91 0.95 0.89 124 T_XMDrugObfuBody_08 2262 1.33 2.38 0.89 125 DKIM_ADSP_CUSTOM_MED 2250 0.96 1.14 0.88 126 XMSexyCombo_02 2247 0.69 0.23 0.88 127 XMSubMetaSxObfu_02 2225 0.73 0.39 0.87 128 TooManyTo_003 2219 0.88 0.90 0.87 129 USER_IN_WHITELIST 2183 0.60 0.00 0.85 130 T_XMHurry_00 2133 0.93 1.17 0.84 131 T_FILL_THIS_FORM_LONG 2091 0.79 0.71 0.82 132 T_TooManySym_03 2082 0.60 0.09 0.82 133 XMBrknScrpt_02 2069 0.75 0.61 0.81 134 XMPhish11 2033 0.94 1.28 0.80 135 XM_H_PHPMailer 2030 0.74 0.62 0.79 136 T_FILL_THIS_FORM_LOAN 2011 0.74 0.63 0.79 137 XMBody_17 2002 1.08 1.77 0.78 138 TooManyTo_004 1830 0.74 0.80 0.72 139 XM_B_COPY_HTML 1816 0.73 0.79 0.71 140 XM_UB50 1791 2.22 5.82 0.70 141 RCVD_IN_RP_RNBL 1749 5.04 15.37 0.68 142 XM_salutation2 1742 0.93 1.53 0.68 143 XM_B_REG_HTML 1730 0.99 1.74 0.68 144 TooManyTo_005 1583 0.66 0.76 0.62 145 NML_ADSP_CUSTOM_MED 1518 0.74 1.09 0.59 146 XMPhish14 1508 0.65 0.78 0.59 147 HELO_NODOT 1500 0.49 0.26 0.59 148 HTML_FONT_FACE_BAD 1493 0.65 0.79 0.58 149 T_FILL_THIS_FORM_SHORT 1473 0.93 1.75 0.58 150 SUBJ_DOLLARS 1405 0.69 1.03 0.55 151 DKIM_ADSP_NXDOMAIN 1394 0.75 1.24 0.55 152 XMBody_78 1364 0.68 1.03 0.53 153 XM_URI_RBL 1318 2.13 5.97 0.52 154 RDNS_DYNAMIC 1287 0.66 1.03 0.50 155 RELAYCOUNTRY_GB 1246 0.74 1.33 0.49 156 XMHTML_After_End 1240 0.46 0.41 0.49 157 XM_H_PHPOS_M 1233 0.48 0.48 0.48 158 HTML_TAG_BALANCE_BODY 1208 0.58 0.83 0.47 159 NO_DNS_FOR_FROM 1205 0.45 0.39 0.47 160 FORGED_GMAIL_RCVD 1199 0.63 1.02 0.47 161 PLING_QUERY 1161 0.51 0.65 0.45 162 DIET_1 1143 0.80 1.65 0.45 163 T_XMDrugObfuBody_00 1128 0.52 0.72 0.44 164 T_Symld_Words_02 1107 0.49 0.61 0.43 165 T_TooManySym_04 1102 0.31 0.02 0.43 166 XM_Walgreens_Forge 1077 0.31 0.06 0.42 167 XMPhish30 1069 0.69 1.32 0.42 168 XMUrgent 1039 0.33 0.14 0.41 169 TR_LOTS_OF_MONEY2 1031 0.46 0.59 0.40 170 T_MONEY_PERCENT 1031 0.46 0.59 0.40 171 XM_RXBody 993 0.60 1.09 0.39 172 XMBSHREFv2 992 0.33 0.19 0.39 173 TR_XM_RelayPhish 976 0.49 0.73 0.38 174 XMSubMetaSSx_00 964 0.52 0.85 0.38 175 XMCapTrack 954 0.31 0.16 0.37 176 MPART_ALT_DIFF_COUNT 941 0.72 1.56 0.37 177 RELAYCOUNTRY_AT 940 0.64 1.29 0.37 178 XM_Body_Obfu01 938 0.39 0.43 0.37 179 XMLngstWrd_00 931 0.29 0.13 0.36 180 URI_NOVOWEL 911 0.41 0.53 0.36 181 FSL_THIS_IS_ADV 909 0.38 0.45 0.36 182 XMNoVowels 874 0.33 0.30 0.34 183 XM_Akamai 872 0.24 0.01 0.34 184 SpammyFromTLD_01 865 0.64 1.35 0.34 185 XMLngstWrd_01 860 0.27 0.12 0.34 186 RELAYCOUNTRY_AU 849 0.33 0.31 0.33 187 GAPPY_SUBJECT 835 0.34 0.36 0.33 188 NUMERIC_HTTP_ADDR 770 0.33 0.39 0.30 189 TR_LOTS_OF_MONEY3 762 0.29 0.28 0.30 190 REMOVE_BEFORE_LINK 759 0.39 0.62 0.30 191 XMRcvdHeader_15 745 0.21 0.00 0.29 192 FROM_EGROUPS 740 0.21 0.01 0.29 193 XMDateMe_00 739 0.33 0.43 0.29 194 XM_ShortIntro_01 739 0.58 1.27 0.29 195 XMSolicitRefs_0 728 0.30 0.35 0.29 196 HTTPS_HTTP_MISMATCH 711 0.31 0.38 0.28 197 XMSlimDrugH 693 0.50 1.05 0.27 198 XMMoneyMeta_00 670 0.37 0.64 0.26 199 XM_H_SpoofStaff4 668 0.20 0.07 0.26 200 XM_D_tchamptons_WL 653 0.18 0.00 0.26 ----------------------------------------------------------------------