Email: 338169 Autolearn: 0 AvgScore: 1.87 AvgScanTime: 2.76 sec Spam: 80688 Autolearn: 0 AvgScore: 12.04 AvgScanTime: 3.08 sec Ham: 257481 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 2.66 sec Time Spent Running SA: 259.32 hours Time Spent Processing Spam: 69.00 hours Time Spent Processing Ham: 190.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 76507 87.91 94.82 85.75 2 DKIM_SIGNED 57805 77.75 71.64 79.66 3 DCC_CHECK 57011 55.93 70.66 51.31 4 XM_DK_Pass 56405 76.39 69.91 78.42 5 DKIM_VALID 52721 73.20 65.34 75.67 6 XMListUnsubscribeExists 50672 59.01 62.80 57.82 7 DKIM_VALID_AU 44780 60.16 55.50 61.63 8 XM_H_QuotedFrom 38065 42.27 47.18 40.73 9 BAYES_50 35148 51.37 43.56 53.81 10 MIME_HTML_ONLY 34108 28.62 42.27 24.34 11 XM_DK_Undo_02 28889 16.32 35.80 10.21 12 LOC_TINY_FONT_1 28665 30.28 35.53 28.63 13 RELAYCOUNTRY_META 27509 12.60 34.09 5.87 14 HTML_FONT_LOW_CONTRAST 27154 33.75 33.65 33.78 15 DCC_CHECK_NEGATIVE 22692 42.90 28.12 47.53 16 BAYES_99 22654 12.91 28.08 8.15 17 XMSubLong 21692 24.09 26.88 23.21 18 UNTRUSTED_Relay 21017 7.86 26.05 2.16 19 FVGT_m_MULTI_ODD 19716 22.06 24.43 21.32 20 BAYES_999 19325 10.97 23.95 6.91 21 TR_DCC_Bayes_99 19022 9.44 23.57 5.01 22 FROM_EXCESS_BASE64 17765 10.94 22.02 7.47 23 XM_Body_Dirty_Words 14821 15.13 18.37 14.11 24 HTML_MIME_NO_HTML_TAG 14394 6.40 17.84 2.82 25 T_REMOTE_IMAGE 14205 7.50 17.60 4.33 26 T_TM2_M_HEADER_IN_MSG 13454 20.99 16.67 22.35 27 BOTNET_IPINHOSTNAME 12890 9.10 15.98 6.94 28 DKIM_VALID_EF 12403 26.31 15.37 29.74 29 HTML_IMAGE_RATIO_02 12256 12.88 15.19 12.16 30 HTML_SHORT_LINK_IMG_1 12251 4.54 15.18 1.21 31 T_KAM_HTML_FONT_INVALID 12120 14.26 15.02 14.02 32 MISSING_HEADERS 11992 4.58 14.86 1.36 33 MIME_HEADER_CTYPE_ONLY 11935 4.54 14.79 1.33 34 BODY_URI_ONLY 11921 4.44 14.77 1.20 35 BOTNET 11667 5.20 14.46 2.30 36 HTML_IMAGE_ONLY_04 11617 4.35 14.40 1.21 37 RELAYCOUNTRY_FR 11604 4.19 14.38 0.99 38 MultiRelay 11333 13.84 14.05 13.77 39 HTML_SHORT_CENTER 10870 4.07 13.47 1.12 40 XM_UB50 10309 4.03 12.78 1.28 41 XM_Multi_Part_URI 10217 14.13 12.66 14.60 42 XMNumbers 9529 6.28 11.81 4.55 43 FSL_BULK_SIG 9427 8.73 11.68 7.80 44 BAYES_60 8872 6.76 11.00 5.43 45 XM_Evil_Numbers_Gen 8493 11.00 10.53 11.15 46 XMSexyCombo_05 8313 6.98 10.30 5.94 47 LOTS_OF_MONEY 7219 9.37 8.95 9.50 48 XMSubMetaSx_00 6778 5.70 8.40 4.86 49 T_XMDrugObfuBody_14 6716 7.28 8.32 6.96 50 HTML_IMAGE_RATIO_04 6329 7.92 7.84 7.95 51 TooManyTo_001 6179 6.56 7.66 6.21 52 BAYES_80 6178 4.33 7.66 3.28 53 XM_H_Long_From01 6085 6.32 7.54 5.94 54 XM_UB60 5923 1.80 7.34 0.06 55 MPART_ALT_DIFF 5589 4.42 6.93 3.64 56 XM_B_Phish_Phrases 5221 7.54 6.47 7.88 57 XM_UncommonTLD01 5174 4.60 6.41 4.03 58 DKIM_INVALID 5084 4.54 6.30 3.99 59 XMStrtUSub 4830 5.80 5.99 5.74 60 LotsOfNums_01 4243 7.14 5.26 7.72 61 XM_DIRTYINTL 3758 2.57 4.66 1.92 62 RCVD_IN_RP_RNBL 3549 1.11 4.40 0.08 63 MultiRelay_CC 3383 1.11 4.19 0.15 64 MultiRelay_Combo 3383 1.11 4.19 0.15 65 RCVD_IN_RP_SAFE 3126 11.75 3.87 14.22 66 MIME_HTML_MOSTLY 3076 3.77 3.81 3.76 67 XM_SPF_SoftFail 3006 1.78 3.73 1.17 68 DIET_1 2981 1.20 3.69 0.42 69 HTML_IMAGE_RATIO_06 2973 3.80 3.68 3.83 70 URI_HEX 2953 2.38 3.66 1.98 71 TM2_M_URI_OPT_OUT 2897 2.36 3.59 1.97 72 RCVD_IN_MSPIKE_H2 2842 4.12 3.52 4.31 73 RELAYCOUNTRY_CA 2827 2.27 3.50 1.88 74 MIME_HTML_ONLY_MULTI 2811 1.81 3.48 1.29 75 XM_CamelCaseFrm001 2804 2.21 3.48 1.81 76 HTML_IMAGE_RATIO_08 2769 2.89 3.43 2.72 77 RCVD_IN_BL_SPAMCOP_NET 2702 1.00 3.35 0.26 78 SpammyFromTLD_02 2620 0.93 3.25 0.20 79 XMSubMetaI_00 2563 1.78 3.18 1.35 80 RCVD_IN_RP_CERTIFIED 2451 10.26 3.04 12.52 81 BAYES_95 2395 2.29 2.97 2.07 82 RELAYCOUNTRY_GB 2393 1.33 2.97 0.82 83 BOTNET_NORDNS 2285 0.68 2.83 0.01 84 XM_UB80 2279 0.69 2.82 0.02 85 UNPARSEABLE_RELAY 2207 4.02 2.74 4.43 86 RELAYCOUNTRY_CN 2204 0.68 2.73 0.04 87 XM_OfRef6 2195 2.03 2.72 1.82 88 XMSexyCombo_01 2081 1.36 2.58 0.98 89 XM_SendGrid 2053 5.02 2.54 5.79 90 T_XMDrugObfuBody_08 1901 1.59 2.36 1.36 91 XMBdyGiftCard01 1750 2.15 2.17 2.14 92 SUBJ_ALL_CAPS 1742 1.47 2.16 1.26 93 XMDiploma_00 1734 1.54 2.15 1.35 94 BAYES_40 1673 3.70 2.07 4.21 95 URIBL_BLACK 1659 0.56 2.06 0.09 96 T_TooManySym_01 1642 5.96 2.03 7.18 97 XMMoneyMeta_00 1640 0.79 2.03 0.40 98 BAYES_20 1617 2.63 2.00 2.82 99 XM_H_Long_From02 1577 1.04 1.95 0.76 100 RELAYCOUNTRY_AT 1574 0.78 1.95 0.41 101 XMSlimDrugH 1515 0.82 1.88 0.49 102 HK_RANDOM_FROM 1470 0.64 1.82 0.27 103 XM_B_REG_HTML 1440 1.13 1.78 0.92 104 T_XMHurry_00 1438 1.17 1.78 0.98 105 MAILING_LIST_MULTI 1421 2.54 1.76 2.78 106 TVD_SPACE_RATIO_MINFP 1414 0.42 1.75 0.00 107 MIME_QP_LONG_LINE 1407 3.49 1.74 4.03 108 URIBL_DBL_SPAM 1403 0.46 1.74 0.05 109 XMPhish30 1381 0.75 1.71 0.45 110 XM_H_PHPOS 1334 1.11 1.65 0.94 111 XM_URI_RBL 1309 0.83 1.62 0.58 112 XMGenDplmaNmb 1309 0.84 1.62 0.60 113 T_XMDrugObfuBody_00 1304 1.22 1.62 1.10 114 XM_OverStock_LProb 1288 0.46 1.60 0.11 115 BAYES_00 1280 14.41 1.59 18.43 116 XM_ProductURIs 1270 1.93 1.57 2.04 117 TR_XM_RelayPhish 1270 0.76 1.57 0.51 118 FROM_SUSPICIOUS_NTLD 1265 0.42 1.57 0.06 119 RDNS_DYNAMIC 1215 0.79 1.51 0.56 120 XMStockSpam_06 1177 1.71 1.46 1.78 121 SpammyFromTLD_01 1168 0.67 1.45 0.43 122 DKIM_ADSP_CUSTOM_MED 1138 0.98 1.41 0.84 123 DKIM_ADSP_NXDOMAIN 1128 0.73 1.40 0.52 124 XMSubMetaI_01 1117 0.54 1.38 0.27 125 TR_XM_DK_Bayes 1112 12.27 1.38 15.68 126 RELAYCOUNTRY_IN 1107 0.40 1.37 0.09 127 NML_ADSP_CUSTOM_MED 1084 0.75 1.34 0.57 128 XMBody_17 1082 1.12 1.34 1.05 129 THIS_AD 1038 0.62 1.29 0.42 130 XMSubMetaSxObfu_03 1036 0.61 1.28 0.39 131 XM_salutation2 1031 0.85 1.28 0.71 132 TR_XM_DK_Bayes1 1030 11.98 1.28 15.34 133 LONG_JUNK_URI 1019 0.38 1.26 0.11 134 FORGED_GMAIL_RCVD 1017 0.60 1.26 0.40 135 NO_DNS_FOR_FROM 1002 0.66 1.24 0.47 136 XM_H_PHPMailer 996 0.83 1.23 0.70 137 XM_RXBody 995 0.66 1.23 0.48 138 XMPhish11 987 0.96 1.22 0.87 139 FILL_THIS_FORM 984 0.76 1.22 0.62 140 TR_Mismatch_TLD_02 981 0.34 1.22 0.06 141 TM2_M_VERY_LONG_WORD 972 0.98 1.20 0.91 142 TR_XM_DK_Bayes2 960 10.78 1.19 13.78 143 TR_MetaPhish_Combo_01 956 1.93 1.18 2.17 144 ALL_TRUSTED 950 11.68 1.18 14.97 145 XMSubMetaI_02 930 0.28 1.15 0.00 146 XM_UB99 928 0.28 1.15 0.01 147 SUBJ_DOLLARS 906 1.11 1.12 1.10 148 RCVD_IN_IADB_LISTED 895 3.09 1.11 3.72 149 FILL_THIS_FORM_LONG 883 0.69 1.09 0.56 150 BAYES_05 870 1.62 1.08 1.79 151 XMBrknScrpt_02 866 0.73 1.07 0.62 152 FILL_THIS_FORM_LOAN 852 0.67 1.06 0.54 153 TR_LOTS_OF_MONEY2 848 0.60 1.05 0.46 154 T_MONEY_PERCENT 848 0.60 1.05 0.46 155 XMGppyBdWords 842 0.38 1.04 0.17 156 XMSubMetaSSx_00 837 0.45 1.04 0.27 157 XM_DK_Undo_01 824 1.34 1.02 1.45 158 HTML_FONT_SIZE_LARGE 823 0.37 1.02 0.17 159 PLING_QUERY 814 0.99 1.01 0.99 160 TVD_RCVD_IP 812 3.13 1.01 3.80 161 DATE_IN_PAST_03_06 771 0.29 0.96 0.08 162 URI_TRY_3LD 759 1.40 0.94 1.55 163 XM_B_COPY_HTML 746 0.74 0.92 0.68 164 RELAYCOUNTRY_DE 741 0.45 0.92 0.31 165 LOW_PRICE 724 0.38 0.90 0.21 166 XMSexyCombo_04 721 0.38 0.89 0.22 167 RCVD_IN_IADB_SPF 695 2.69 0.86 3.26 168 XM_UB999 686 0.21 0.85 0.01 169 RCVD_IN_IADB_SENDERID 684 2.43 0.85 2.92 170 BODY_ENHANCEMENT 680 0.22 0.84 0.03 171 RCVD_IN_IADB_DK 677 2.37 0.84 2.85 172 T_FILL_THIS_FORM_SHORT 677 0.62 0.84 0.55 173 TR_Symld_Words 672 1.26 0.83 1.40 174 NORDNS_LOW_CONTRAST 647 0.19 0.80 0.00 175 HTML_IMAGE_ONLY_12 647 0.30 0.80 0.15 176 XM_XX_Yahoo 644 0.23 0.80 0.05 177 XMHTMLBadTable_001 636 1.04 0.79 1.12 178 HTML_FONT_FACE_BAD 635 0.78 0.79 0.78 179 DEAR_SOMETHING 611 0.27 0.76 0.12 180 XM_ShortIntro_01 610 0.37 0.76 0.25 181 SINGLETS_LOW_CONTRAST 596 0.21 0.74 0.04 182 NUMERIC_HTTP_ADDR 595 0.32 0.74 0.19 183 TR_LOTS_OF_MONEY3 592 0.53 0.73 0.46 184 URI_NOVOWEL 591 0.51 0.73 0.45 185 TR_Caps_n_Bayes_99 584 0.20 0.72 0.03 186 DEAR_FRIEND 571 0.20 0.71 0.04 187 XMPhish14 568 0.38 0.70 0.28 188 T_Symld_Words_02 566 0.41 0.70 0.32 189 LONG_HEX_URI 562 0.23 0.70 0.09 190 RCVD_IN_IADB_VOUCHED 556 1.98 0.69 2.38 191 FVGT_m_MULTI_ODD_EMAIL 541 0.19 0.67 0.04 192 FSL_THIS_IS_ADV 541 0.47 0.67 0.41 193 T_TooManySym_02 527 2.15 0.65 2.62 194 RCVD_IN_MSPIKE_WL 515 1.90 0.64 2.30 195 RCVD_IN_MSPIKE_H3 514 1.90 0.64 2.30 196 XMHTML_After_End 514 0.46 0.64 0.40 197 LongTLD 503 0.30 0.62 0.20 198 DATE_IN_PAST_06_12 501 0.19 0.62 0.05 199 RELAYCOUNTRY_PL 501 0.16 0.62 0.02 200 XM_H_PHPOS_M 492 0.50 0.61 0.46 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 220783 87.91 94.82 85.75 2 DKIM_SIGNED 205110 77.75 71.64 79.66 3 XM_DK_Pass 201910 76.39 69.91 78.42 4 DKIM_VALID 194833 73.20 65.34 75.67 5 DKIM_VALID_AU 158674 60.16 55.50 61.63 6 XMListUnsubscribeExists 148866 59.01 62.80 57.82 7 BAYES_50 138557 51.37 43.56 53.81 8 DCC_CHECK 132112 55.93 70.66 51.31 9 DCC_CHECK_NEGATIVE 122372 42.90 28.12 47.53 10 XM_H_QuotedFrom 104878 42.27 47.18 40.73 11 HTML_FONT_LOW_CONTRAST 86977 33.75 33.65 33.78 12 DKIM_VALID_EF 76564 26.31 15.37 29.74 13 LOC_TINY_FONT_1 73717 30.28 35.53 28.63 14 MIME_HTML_ONLY 62680 28.62 42.27 24.34 15 XMSubLong 59767 24.09 26.88 23.21 16 T_TM2_M_HEADER_IN_MSG 57539 20.99 16.67 22.35 17 FVGT_m_MULTI_ODD 54891 22.06 24.43 21.32 18 BAYES_00 47446 14.41 1.59 18.43 19 TR_XM_DK_Bayes 40379 12.27 1.38 15.68 20 TR_XM_DK_Bayes1 39492 11.98 1.28 15.34 21 XM_DKIMWhitelistDomains 39344 11.64 0.02 15.28 22 ALL_TRUSTED 38545 11.68 1.18 14.97 23 XM_Multi_Part_URI 37581 14.13 12.66 14.60 24 RCVD_IN_RP_SAFE 36611 11.75 3.87 14.22 25 XM_Body_Dirty_Words 36336 15.13 18.37 14.11 26 T_KAM_HTML_FONT_INVALID 36086 14.26 15.02 14.02 27 TR_XM_DK_Bayes2 35481 10.78 1.19 13.78 28 MultiRelay 35457 13.84 14.05 13.77 29 RCVD_IN_RP_CERTIFIED 32240 10.26 3.04 12.52 30 HTML_IMAGE_RATIO_02 31299 12.88 15.19 12.16 31 XM_Evil_Numbers_Gen 28715 11.00 10.53 11.15 32 XM_DK_Undo_02 26286 16.32 35.80 10.21 33 LOTS_OF_MONEY 24473 9.37 8.95 9.50 34 BAYES_99 20987 12.91 28.08 8.15 35 HTML_IMAGE_RATIO_04 20469 7.92 7.84 7.95 36 XM_B_Phish_Phrases 20283 7.54 6.47 7.88 37 FSL_BULK_SIG 20085 8.73 11.68 7.80 38 LotsOfNums_01 19889 7.14 5.26 7.72 39 FROM_EXCESS_BASE64 19223 10.94 22.02 7.47 40 T_TooManySym_01 18497 5.96 2.03 7.18 41 T_XMDrugObfuBody_14 17918 7.28 8.32 6.96 42 BOTNET_IPINHOSTNAME 17876 9.10 15.98 6.94 43 BAYES_999 17784 10.97 23.95 6.91 44 TooManyTo_001 15996 6.56 7.66 6.21 45 XM_H_Long_From01 15285 6.32 7.54 5.94 46 XMSexyCombo_05 15283 6.98 10.30 5.94 47 RELAYCOUNTRY_META 15115 12.60 34.09 5.87 48 XM_SendGrid 14911 5.02 2.54 5.79 49 XMStrtUSub 14772 5.80 5.99 5.74 50 BAYES_60 13984 6.76 11.00 5.43 51 TR_DCC_Bayes_99 12900 9.44 23.57 5.01 52 XMSubMetaSx_00 12505 5.70 8.40 4.86 53 XMNumbers 11704 6.28 11.81 4.55 54 UNPARSEABLE_RELAY 11400 4.02 2.74 4.43 55 TO_MALFORMED 11203 3.33 0.07 4.35 56 T_REMOTE_IMAGE 11160 7.50 17.60 4.33 57 RCVD_IN_MSPIKE_H2 11096 4.12 3.52 4.31 58 BAYES_40 10844 3.70 2.07 4.21 59 MIME_QP_LONG_LINE 10388 3.49 1.74 4.03 60 XM_UncommonTLD01 10382 4.60 6.41 4.03 61 DKIM_INVALID 10277 4.54 6.30 3.99 62 HTML_IMAGE_RATIO_06 9872 3.80 3.68 3.83 63 TVD_RCVD_IP 9782 3.13 1.01 3.80 64 MIME_HTML_MOSTLY 9687 3.77 3.81 3.76 65 RCVD_IN_IADB_LISTED 9571 3.09 1.11 3.72 66 MPART_ALT_DIFF 9361 4.42 6.93 3.64 67 BAYES_80 8453 4.33 7.66 3.28 68 RCVD_IN_IADB_SPF 8394 2.69 0.86 3.26 69 ANY_BOUNCE_MESSAGE 8301 2.53 0.30 3.22 70 BOUNCE_MESSAGE 8301 2.53 0.30 3.22 71 IN_ZIMBRA_NJ_WHITELIST 8123 2.41 0.02 3.15 72 RCVD_IN_IADB_SENDERID 7517 2.43 0.85 2.92 73 RCVD_IN_IADB_DK 7329 2.37 0.84 2.85 74 BAYES_20 7261 2.63 2.00 2.82 75 HTML_MIME_NO_HTML_TAG 7249 6.40 17.84 2.82 76 MAILING_LIST_MULTI 7152 2.54 1.76 2.78 77 HTML_IMAGE_RATIO_08 7016 2.89 3.43 2.72 78 INVALID_MSGID 6916 2.09 0.18 2.69 79 T_TooManySym_02 6751 2.15 0.65 2.62 80 RCVD_IN_IADB_VOUCHED 6137 1.98 0.69 2.38 81 BOTNET 5922 5.20 14.46 2.30 82 RCVD_IN_MSPIKE_WL 5921 1.90 0.64 2.30 83 RCVD_IN_MSPIKE_H3 5910 1.90 0.64 2.30 84 TR_MetaPhish_Combo_01 5586 1.93 1.18 2.17 85 UNTRUSTED_Relay 5560 7.86 26.05 2.16 86 XMBdyGiftCard01 5516 2.15 2.17 2.14 87 BAYES_95 5336 2.29 2.97 2.07 88 XM_PDF 5324 1.65 0.32 2.07 89 XM_ProductURIs 5256 1.93 1.57 2.04 90 URI_HEX 5107 2.38 3.66 1.98 91 TM2_M_URI_OPT_OUT 5084 2.36 3.59 1.97 92 XM_DIRTYINTL 4939 2.57 4.66 1.92 93 IN_HORDE_ADDRESS_BOOK 4889 1.46 0.06 1.90 94 RELAYCOUNTRY_CA 4842 2.27 3.50 1.88 95 XM_OfRef6 4683 2.03 2.72 1.82 96 XM_CamelCaseFrm001 4667 2.21 3.48 1.81 97 BAYES_05 4613 1.62 1.08 1.79 98 XMStockSpam_06 4591 1.71 1.46 1.78 99 USER_IN_DEF_DKIM_WL 4366 1.29 0.01 1.70 100 URI_TRY_3LD 3987 1.40 0.94 1.55 101 RCVD_IN_IADB_OPTIN 3806 1.23 0.44 1.48 102 XM_DK_Undo_01 3721 1.34 1.02 1.45 103 TR_Symld_Words 3593 1.26 0.83 1.40 104 MISSING_HEADERS 3513 4.58 14.86 1.36 105 TooManyTo_002 3509 1.16 0.52 1.36 106 T_XMDrugObfuBody_08 3492 1.59 2.36 1.36 107 XMDiploma_00 3474 1.54 2.15 1.35 108 XMSubMetaI_00 3472 1.78 3.18 1.35 109 MIME_HEADER_CTYPE_ONLY 3431 4.54 14.79 1.33 110 MIME_HTML_ONLY_MULTI 3316 1.81 3.48 1.29 111 XM_UB50 3305 4.03 12.78 1.28 112 SUBJ_ALL_CAPS 3233 1.47 2.16 1.26 113 HTML_IMAGE_ONLY_04 3108 4.35 14.40 1.21 114 HTML_SHORT_LINK_IMG_1 3105 4.54 15.18 1.21 115 BODY_URI_ONLY 3088 4.44 14.77 1.20 116 XM_GoogleGroups 3028 1.02 0.52 1.18 117 XM_SPF_SoftFail 3001 1.78 3.73 1.17 118 XMHTMLBadTable_001 2884 1.04 0.79 1.12 119 HTML_SHORT_CENTER 2877 4.07 13.47 1.12 120 SUBJ_DOLLARS 2845 1.11 1.12 1.10 121 T_XMDrugObfuBody_00 2835 1.22 1.62 1.10 122 XMBody_17 2698 1.12 1.34 1.05 123 T_TooManySym_03 2667 0.81 0.09 1.04 124 RELAYCOUNTRY_FR 2555 4.19 14.38 0.99 125 PLING_QUERY 2537 0.99 1.01 0.99 126 T_XMHurry_00 2530 1.17 1.78 0.98 127 XMSexyCombo_01 2528 1.36 2.58 0.98 128 XMBody_95 2444 0.75 0.12 0.95 129 XM_H_PHPOS 2411 1.11 1.65 0.94 130 TooManyTo_003 2377 0.81 0.46 0.92 131 XM_B_REG_HTML 2367 1.13 1.78 0.92 132 TM2_M_VERY_LONG_WORD 2331 0.98 1.20 0.91 133 XMPhish11 2252 0.96 1.22 0.87 134 USER_IN_WHITELIST 2243 0.66 0.00 0.87 135 DKIM_ADSP_CUSTOM_MED 2171 0.98 1.41 0.84 136 XMSubMetaSxObfu_02 2158 0.76 0.50 0.84 137 RELAYCOUNTRY_GB 2121 1.33 2.97 0.82 138 HTML_FONT_FACE_BAD 2008 0.78 0.79 0.78 139 XM_H_Long_From02 1946 1.04 1.95 0.76 140 TooManyTo_004 1944 0.66 0.35 0.76 141 XM_salutation2 1829 0.85 1.28 0.71 142 XM_H_PHPMailer 1796 0.83 1.23 0.70 143 XMBody_78 1761 0.66 0.58 0.68 144 XM_B_COPY_HTML 1745 0.74 0.92 0.68 145 TooManyTo_005 1703 0.57 0.30 0.66 146 HELO_NODOT 1636 0.54 0.24 0.64 147 HTML_TAG_BALANCE_BODY 1608 0.59 0.49 0.62 148 XMBrknScrpt_02 1595 0.73 1.07 0.62 149 FILL_THIS_FORM 1588 0.76 1.22 0.62 150 XMGenDplmaNmb 1539 0.84 1.62 0.60 151 XM_URI_RBL 1482 0.83 1.62 0.58 152 NML_ADSP_CUSTOM_MED 1469 0.75 1.34 0.57 153 RDNS_DYNAMIC 1452 0.79 1.51 0.56 154 FILL_THIS_FORM_LONG 1435 0.69 1.09 0.56 155 T_FILL_THIS_FORM_SHORT 1428 0.62 0.84 0.55 156 FILL_THIS_FORM_LOAN 1399 0.67 1.06 0.54 157 DKIM_ADSP_NXDOMAIN 1331 0.73 1.40 0.52 158 TR_XM_RelayPhish 1311 0.76 1.57 0.51 159 XMSlimDrugH 1266 0.82 1.88 0.49 160 XM_H_SpoofStaff4 1235 0.38 0.07 0.48 161 XM_RXBody 1228 0.66 1.23 0.48 162 NO_DNS_FOR_FROM 1219 0.66 1.24 0.47 163 HTTPS_HTTP_MISMATCH 1199 0.42 0.26 0.47 164 XM_H_PHPOS_M 1197 0.50 0.61 0.46 165 TR_LOTS_OF_MONEY3 1191 0.53 0.73 0.46 166 TR_LOTS_OF_MONEY2 1191 0.60 1.05 0.46 167 T_MONEY_PERCENT 1191 0.60 1.05 0.46 168 XMPhish30 1164 0.75 1.71 0.45 169 XM_Body_Obfu01 1160 0.37 0.09 0.45 170 URI_NOVOWEL 1149 0.51 0.73 0.45 171 XMSubNoVowel 1120 0.44 0.47 0.43 172 SpammyFromTLD_01 1100 0.67 1.45 0.43 173 XMSubGiftCard1 1088 0.40 0.34 0.42 174 T_TooManySym_04 1076 0.32 0.02 0.42 175 DIET_1 1073 1.20 3.69 0.42 176 THIS_AD 1069 0.62 1.29 0.42 177 TM2_M_A_HREF_HREF 1062 0.39 0.32 0.41 178 FSL_THIS_IS_ADV 1061 0.47 0.67 0.41 179 RELAYCOUNTRY_AT 1048 0.78 1.95 0.41 180 XM_Walgreens_Forge 1036 0.32 0.07 0.40 181 FORGED_GMAIL_RCVD 1025 0.60 1.26 0.40 182 XMHTML_After_End 1025 0.46 0.64 0.40 183 XMMoneyMeta_00 1020 0.79 2.03 0.40 184 XMNoVowels 1018 0.40 0.42 0.40 185 XMSubMetaSxObfu_03 1012 0.61 1.28 0.39 186 XM_S_JOY_D 997 0.42 0.55 0.39 187 XMLngstWrd_00 987 0.36 0.29 0.38 188 XMCapTrack 979 0.35 0.26 0.38 189 REMOVE_BEFORE_LINK 925 0.37 0.39 0.36 190 XMRcvdHeader_15 905 0.27 0.00 0.35 191 XM_Akamai 901 0.27 0.02 0.35 192 XMLngstWrd_01 888 0.33 0.26 0.34 193 RELAYCOUNTRY_AU 866 0.37 0.47 0.34 194 T_Symld_Words_02 825 0.41 0.70 0.32 195 RELAYCOUNTRY_DE 796 0.45 0.92 0.31 196 XMSpoofStaff2 737 0.24 0.08 0.29 197 XMPhish14 733 0.38 0.70 0.28 198 XMSubMetaI_01 705 0.54 1.38 0.27 199 XMSubMetaD_03 705 0.26 0.22 0.27 200 XMSubMetaSSx_00 701 0.45 1.04 0.27 ----------------------------------------------------------------------