Email: 647075 Autolearn: 0 AvgScore: 3.07 AvgScanTime: 2.02 sec Spam: 163922 Autolearn: 0 AvgScore: 12.16 AvgScanTime: 2.42 sec Ham: 483153 Autolearn: 0 AvgScore: -0.02 AvgScanTime: 1.88 sec Time Spent Running SA: 362.75 hours Time Spent Processing Spam: 110.08 hours Time Spent Processing Ham: 252.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155094 89.60 94.61 87.89 2 DKIM_SIGNED 136715 78.23 83.40 76.47 3 XM_DK_Pass 131078 76.29 79.96 75.05 4 DCC_CHECK 130427 50.80 79.57 41.04 5 XMListUnsubscribeExists 126891 58.84 77.41 52.54 6 DKIM_VALID 124185 72.44 75.76 71.32 7 DKIM_VALID_AU 95077 53.20 58.00 51.57 8 XM_DK_Undo_02 80268 22.74 48.97 13.84 9 BAYES_99 70730 20.17 43.15 12.38 10 HTML_FONT_LOW_CONTRAST 59491 30.59 36.29 28.66 11 BAYES_999 59152 17.35 36.09 10.99 12 BAYES_50 57365 48.56 35.00 53.16 13 LOC_TINY_FONT_1 56402 26.25 34.41 23.48 14 TR_DCC_Bayes_99 56029 13.07 34.18 5.90 15 MIME_HTML_ONLY 54124 22.59 33.02 19.05 16 FVGT_m_MULTI_ODD 48154 24.00 29.38 22.18 17 XMSubLong 39826 22.21 24.30 21.50 18 DKIM_VALID_EF 36789 26.58 22.44 27.98 19 T_KAM_HTML_FONT_INVALID 36084 18.74 22.01 17.63 20 XM_Body_Dirty_Words 32704 15.70 19.95 14.26 21 T_TM2_M_HEADER_IN_MSG 32689 27.84 19.94 30.51 22 DCC_CHECK_NEGATIVE 30924 47.22 18.87 56.84 23 BOTNET 29896 6.05 18.24 1.92 24 XM_Multi_Part_URI 28940 13.89 17.65 12.61 25 RELAYCOUNTRY_META 28317 8.38 17.27 5.37 26 HTML_IMAGE_RATIO_02 28069 10.82 17.12 8.68 27 MultiRelay 25680 18.06 15.67 18.88 28 BOTNET_IPINHOSTNAME 25432 7.32 15.51 4.54 29 XM_Evil_Numbers_Gen 21278 9.30 12.98 8.05 30 LOTS_OF_MONEY 21180 9.91 12.92 8.89 31 FSL_BULK_SIG 18294 7.67 11.16 6.48 32 UNTRUSTED_Relay 17786 3.92 10.85 1.57 33 LotsOfNums_01 15957 8.69 9.73 8.34 34 XMSexyCombo_05 15842 4.79 9.66 3.14 35 T_XMDrugObfuBody_14 13731 8.15 8.38 8.07 36 XMSubMetaSx_00 13438 4.92 8.20 3.81 37 DKIM_INVALID 12530 5.78 7.64 5.15 38 HTML_IMAGE_RATIO_04 12315 6.18 7.51 5.73 39 XM_UncommonTLD01 12285 4.28 7.49 3.18 40 TooManyTo_001 12237 8.13 7.47 8.36 41 XM_B_Phish_Phrases 11673 6.17 7.12 5.85 42 BAYES_80 11649 4.86 7.11 4.10 43 MPART_ALT_DIFF 10430 4.17 6.36 3.42 44 XM_H_Long_From01 10343 6.31 6.31 6.31 45 RCVD_IN_MSPIKE_BL 10011 3.19 6.11 2.19 46 BAYES_60 9405 6.25 5.74 6.43 47 MIME_QP_LONG_LINE 9306 5.86 5.68 5.92 48 RCVD_IN_MSPIKE_H2 9214 6.84 5.62 7.25 49 XM_DIRTYINTL 8512 3.23 5.19 2.57 50 XM_UB50 8422 1.99 5.14 0.92 51 T_REMOTE_IMAGE 8318 4.31 5.07 4.06 52 FROM_EXCESS_BASE64 7888 3.88 4.81 3.56 53 RCVD_IN_MSPIKE_L5 7720 1.81 4.71 0.83 54 XMStrtUSub 7497 4.84 4.57 4.94 55 RELAYCOUNTRY_CA 7377 2.26 4.50 1.50 56 XMNumbers 7342 3.19 4.48 2.75 57 RELAYCOUNTRY_FR 6586 1.22 4.02 0.28 58 HTML_IMAGE_RATIO_06 6391 3.64 3.90 3.56 59 MIME_HTML_ONLY_MULTI 6348 2.36 3.87 1.85 60 XM_SendGrid 6339 5.61 3.87 6.21 61 TM2_M_URI_OPT_OUT 6296 2.24 3.84 1.69 62 BAYES_95 6261 3.02 3.82 2.74 63 HTML_IMAGE_RATIO_08 6078 3.05 3.71 2.82 64 RCVD_IN_PSBL 5933 0.97 3.62 0.07 65 XM_SPF_SoftFail 5775 2.21 3.52 1.76 66 HTML_MIME_NO_HTML_TAG 5731 2.31 3.50 1.91 67 URI_HEX 5690 2.09 3.47 1.62 68 MIME_HTML_MOSTLY 5555 2.52 3.39 2.22 69 RCVD_IN_RP_SAFE 5497 8.68 3.35 10.49 70 XMDiploma_00 5303 2.24 3.24 1.91 71 XM_CamelCaseFrm001 5186 2.26 3.16 1.96 72 RCVD_IN_BL_SPAMCOP_NET 5047 1.15 3.08 0.50 73 DKIM_ADSP_NXDOMAIN 5024 1.17 3.06 0.52 74 XM_URI_RBL 5023 1.04 3.06 0.35 75 XM_OfRef6 4822 1.87 2.94 1.51 76 XM_B_SpammyTLD 4653 3.07 2.84 3.14 77 RCVD_IN_IADB_LISTED 4586 4.85 2.80 5.55 78 T_TooManySym_01 4487 4.44 2.74 5.02 79 ALIBABA_IMG_NOT_RCVD_ALI 4444 0.69 2.71 0.00 80 XM_DrugUnitList 4442 0.69 2.71 0.00 81 SpammyFromTLD_02 4428 0.93 2.70 0.33 82 US_DOLLARS_3 4405 2.00 2.69 1.77 83 BOTNET_NORDNS 4361 0.69 2.66 0.02 84 XM_ProductURIs 4275 1.33 2.61 0.90 85 XMSexyCombo_01 4238 1.14 2.59 0.65 86 RCVD_IN_IADB_SPF 4111 4.26 2.51 4.85 87 RCVD_IN_MSPIKE_WL 4051 5.51 2.47 6.54 88 HOSTED_IMG_DIRECT_MX 3967 0.61 2.42 0.00 89 RCVD_IN_IADB_DK 3925 3.70 2.39 4.14 90 RCVD_IN_IADB_SENDERID 3915 3.76 2.39 4.23 91 T_XMDrugObfuBody_08 3912 1.73 2.39 1.50 92 SUBJ_ALL_CAPS 3858 2.06 2.35 1.97 93 RCVD_IN_MSPIKE_H3 3703 4.88 2.26 5.76 94 RCVD_IN_RP_CERTIFIED 3656 7.58 2.23 9.40 95 TR_XM_PHPDW 3652 1.91 2.23 1.81 96 TR_XM_PHPForged 3618 1.77 2.21 1.62 97 TR_XM_FormFill2 3596 1.09 2.19 0.71 98 XM_H_PHPOS 3575 1.08 2.18 0.71 99 XMSubMetaI_00 3464 0.96 2.11 0.56 100 MultiRelay_CC 3301 0.68 2.01 0.23 101 MultiRelay_Combo 3301 0.68 2.01 0.23 102 MAILING_LIST_MULTI 3299 2.05 2.01 2.06 103 NO_DNS_FOR_FROM 3268 1.33 1.99 1.11 104 BAYES_40 3262 3.67 1.99 4.24 105 HTML_IMAGE_ONLY_28 3212 0.77 1.96 0.36 106 SpammyFromTLD_01 3148 1.05 1.92 0.75 107 TR_Symld_Words 3089 1.72 1.88 1.67 108 XMGenDplmaNmb 3068 1.32 1.87 1.13 109 XM_UB99 3007 0.47 1.83 0.01 110 T_XMDrugObfuBody_00 2950 1.12 1.80 0.89 111 XMBdyGiftCard01 2845 1.22 1.74 1.04 112 DATE_IN_PAST_03_06 2825 0.52 1.72 0.11 113 KHOP_HELO_FCRDNS 2804 1.91 1.71 1.98 114 TR_XM_DK_SendGrid 2712 2.74 1.65 3.11 115 PDS_TO_EQ_FROM_NAME 2679 0.44 1.63 0.04 116 ALL_TRUSTED 2566 11.82 1.57 15.31 117 TM2_M_VERY_LONG_WORD 2558 1.32 1.56 1.23 118 BAYES_20 2539 2.65 1.55 3.02 119 FROM_SUSPICIOUS_NTLD 2536 0.41 1.55 0.03 120 UNPARSEABLE_RELAY 2532 2.23 1.54 2.46 121 URI_TRY_3LD 2505 1.70 1.53 1.76 122 FROM_SUSPICIOUS_NTLD_FP 2467 0.40 1.50 0.02 123 RCVD_IN_RP_RNBL 2343 0.38 1.43 0.03 124 XMBody_78 2316 0.76 1.41 0.53 125 XMPhish30 2278 0.67 1.39 0.42 126 XM_UB999 2258 0.36 1.38 0.01 127 T_Symld_Words_02 2219 0.87 1.35 0.71 128 HTML_IMAGE_ONLY_24 2199 0.58 1.34 0.33 129 XMBody_17 2169 0.77 1.32 0.58 130 XMPhish11 2160 1.13 1.32 1.07 131 BODY_ENHANCEMENT 2108 0.35 1.29 0.03 132 TR_XM_RelayPhish 2062 1.00 1.26 0.92 133 XM_UB60 2048 0.39 1.25 0.10 134 DATE_IN_PAST_06_12 2044 0.34 1.25 0.03 135 T_XMHurry_00 2042 0.79 1.25 0.64 136 XM_DK_Undo_01 2032 1.74 1.24 1.90 137 URIBL_DBL_ABUSE_REDIR 2001 0.32 1.22 0.01 138 XMHTML_After_End 1967 0.63 1.20 0.44 139 FILL_THIS_FORM 1960 0.72 1.20 0.56 140 DIET_1 1951 0.53 1.19 0.30 141 XM_H_Long_From02 1902 1.38 1.16 1.46 142 XMStockSpam_06 1889 0.94 1.15 0.87 143 XMSubMetaSxObfu_03 1846 0.60 1.13 0.42 144 RELAYCOUNTRY_GB 1759 1.17 1.07 1.20 145 URIBL_BLACK 1753 0.31 1.07 0.05 146 XMMoneyMeta_00 1714 0.66 1.05 0.53 147 RCVD_IN_MSPIKE_L3 1712 0.86 1.04 0.79 148 XMBrknScrpt_02 1696 0.66 1.03 0.53 149 FILL_THIS_FORM_LONG 1694 0.55 1.03 0.38 150 RCVD_IN_IADB_VOUCHED 1682 3.02 1.03 3.70 151 XM_HighProb1 1676 0.27 1.02 0.01 152 T_FILL_THIS_FORM_SHORT 1665 1.21 1.02 1.27 153 XM_H_PHPMailer 1650 1.47 1.01 1.63 154 T_MONEY_PERCENT 1642 0.69 1.00 0.59 155 TR_LOTS_OF_MONEY2 1642 0.69 1.00 0.59 156 HOSTED_IMG_MULTI 1597 0.25 0.97 0.00 157 XMSexyCombo_04 1577 0.34 0.96 0.12 158 TR_Caps_n_Bayes_99 1524 0.50 0.93 0.35 159 RELAYCOUNTRY_IN 1522 0.32 0.93 0.11 160 DATE_IN_PAST_12_24 1472 0.26 0.90 0.05 161 XM_UB80 1462 0.26 0.89 0.05 162 HTML_FONT_FACE_BAD 1421 0.68 0.87 0.62 163 RDNS_DYNAMIC 1398 0.52 0.85 0.40 164 XMHTMLBadTable_001 1393 0.60 0.85 0.51 165 DKIM_ADSP_CUSTOM_MED 1382 1.55 0.84 1.78 166 TR_MetaPhish_Combo_01 1370 1.75 0.84 2.06 167 TR_LOTS_OF_MONEY3 1368 0.53 0.83 0.43 168 XM_H_PHPOS_M 1366 0.36 0.83 0.20 169 LOW_PRICE 1357 0.38 0.83 0.23 170 TR_Mismatch_TLD_02 1336 0.25 0.82 0.06 171 BAYES_00 1334 8.92 0.81 11.67 172 XM_B_REG_HTML 1326 0.53 0.81 0.44 173 XMSubMetaSSx_00 1310 0.31 0.80 0.15 174 HK_RANDOM_REPLYTO 1305 0.40 0.80 0.27 175 XM_B_COPY_HTML 1304 0.63 0.80 0.57 176 RELAYCOUNTRY_DE 1296 0.47 0.79 0.37 177 XM_XX_Yahoo 1272 0.32 0.78 0.16 178 XMPhish14 1269 0.56 0.77 0.49 179 HTML_TAG_BALANCE_BODY 1257 0.70 0.77 0.67 180 RELAYCOUNTRY_AT 1246 0.38 0.76 0.25 181 HTTPS_HTTP_MISMATCH 1244 0.66 0.76 0.62 182 XM_OfRef7 1231 0.36 0.75 0.22 183 XMSlimDrugH 1224 0.74 0.75 0.74 184 URI_NOVOWEL 1210 0.51 0.74 0.44 185 URIBL_ABUSE_SURBL 1193 0.23 0.73 0.06 186 LongTLD 1184 0.27 0.72 0.12 187 TooManyTo_002 1183 1.89 0.72 2.29 188 REMOVE_BEFORE_LINK 1162 0.43 0.71 0.34 189 SUBJ_DOLLARS 1146 0.69 0.70 0.69 190 XMNoVowels 1137 0.57 0.69 0.53 191 T_TooManySym_02 1132 1.28 0.69 1.48 192 NML_ADSP_CUSTOM_MED 1132 1.31 0.69 1.53 193 FORGED_GMAIL_RCVD 1129 0.96 0.69 1.05 194 SHORT_URI_3 1124 0.30 0.69 0.16 195 HTML_IMAGE_ONLY_32 1123 0.46 0.69 0.39 196 XMSubMetaSxObfu_02 1109 0.52 0.68 0.46 197 BAYES_05 1103 1.64 0.67 1.97 198 XMBSHREFv2 1096 0.38 0.67 0.29 199 RCVD_IN_IADB_OPTIN 1094 1.93 0.67 2.36 200 LONG_HEX_URI 1068 0.27 0.65 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 424667 89.60 94.61 87.89 2 DKIM_SIGNED 369472 78.23 83.40 76.47 3 XM_DK_Pass 362603 76.29 79.96 75.05 4 DKIM_VALID 344583 72.44 75.76 71.32 5 DCC_CHECK_NEGATIVE 274621 47.22 18.87 56.84 6 BAYES_50 256868 48.56 35.00 53.16 7 XMListUnsubscribeExists 253852 58.84 77.41 52.54 8 DKIM_VALID_AU 249160 53.20 58.00 51.57 9 DCC_CHECK 198265 50.80 79.57 41.04 10 T_TM2_M_HEADER_IN_MSG 147426 27.84 19.94 30.51 11 HTML_FONT_LOW_CONTRAST 138480 30.59 36.29 28.66 12 DKIM_VALID_EF 135201 26.58 22.44 27.98 13 LOC_TINY_FONT_1 113423 26.25 34.41 23.48 14 FVGT_m_MULTI_ODD 107167 24.00 29.38 22.18 15 XMSubLong 103876 22.21 24.30 21.50 16 MIME_HTML_ONLY 92031 22.59 33.02 19.05 17 MultiRelay 91204 18.06 15.67 18.88 18 T_KAM_HTML_FONT_INVALID 85165 18.74 22.01 17.63 19 ALL_TRUSTED 73949 11.82 1.57 15.31 20 XM_Body_Dirty_Words 68902 15.70 19.95 14.26 21 XM_DK_Undo_02 66886 22.74 48.97 13.84 22 XM_Multi_Part_URI 60921 13.89 17.65 12.61 23 BAYES_99 59808 20.17 43.15 12.38 24 BAYES_00 56376 8.92 0.81 11.67 25 BAYES_999 53085 17.35 36.09 10.99 26 RCVD_IN_RP_SAFE 50674 8.68 3.35 10.49 27 TR_XM_DK_Bayes 45540 7.13 0.37 9.43 28 RCVD_IN_RP_CERTIFIED 45423 7.58 2.23 9.40 29 TR_XM_DK_Bayes1 43567 6.81 0.31 9.02 30 LOTS_OF_MONEY 42974 9.91 12.92 8.89 31 HTML_IMAGE_RATIO_02 41937 10.82 17.12 8.68 32 TooManyTo_001 40393 8.13 7.47 8.36 33 LotsOfNums_01 40301 8.69 9.73 8.34 34 T_XMDrugObfuBody_14 39011 8.15 8.38 8.07 35 XM_DKIMWhitelistDomains 38929 6.05 0.15 8.06 36 XM_Evil_Numbers_Gen 38913 9.30 12.98 8.05 37 TR_XM_DK_Bayes2 37854 5.92 0.27 7.83 38 RCVD_IN_MSPIKE_H2 35045 6.84 5.62 7.25 39 RCVD_IN_MSPIKE_WL 31610 5.51 2.47 6.54 40 FSL_BULK_SIG 31308 7.67 11.16 6.48 41 BAYES_60 31050 6.25 5.74 6.43 42 XM_H_Long_From01 30506 6.31 6.31 6.31 43 XM_SendGrid 29984 5.61 3.87 6.21 44 MIME_QP_LONG_LINE 28587 5.86 5.68 5.92 45 TR_DCC_Bayes_99 28521 13.07 34.18 5.90 46 XM_B_Phish_Phrases 28248 6.17 7.12 5.85 47 RCVD_IN_MSPIKE_H3 27850 4.88 2.26 5.76 48 HTML_IMAGE_RATIO_04 27685 6.18 7.51 5.73 49 RCVD_IN_IADB_LISTED 26802 4.85 2.80 5.55 50 RELAYCOUNTRY_META 25928 8.38 17.27 5.37 51 DKIM_INVALID 24889 5.78 7.64 5.15 52 T_TooManySym_01 24267 4.44 2.74 5.02 53 XMStrtUSub 23850 4.84 4.57 4.94 54 RCVD_IN_IADB_SPF 23431 4.26 2.51 4.85 55 BOTNET_IPINHOSTNAME 21937 7.32 15.51 4.54 56 TO_MALFORMED 20959 3.26 0.07 4.34 57 XM_PDF 20706 3.36 0.63 4.29 58 BAYES_40 20467 3.67 1.99 4.24 59 RCVD_IN_IADB_SENDERID 20420 3.76 2.39 4.23 60 RCVD_IN_IADB_DK 20010 3.70 2.39 4.14 61 BAYES_80 19822 4.86 7.11 4.10 62 T_REMOTE_IMAGE 19592 4.31 5.07 4.06 63 IN_ZIMBRA_NJ_WHITELIST 19431 3.01 0.02 4.02 64 XMSubMetaSx_00 18384 4.92 8.20 3.81 65 RCVD_IN_IADB_VOUCHED 17862 3.02 1.03 3.70 66 FROM_EXCESS_BASE64 17194 3.88 4.81 3.56 67 HTML_IMAGE_RATIO_06 17188 3.64 3.90 3.56 68 MPART_ALT_DIFF 16532 4.17 6.36 3.42 69 XM_UncommonTLD01 15384 4.28 7.49 3.18 70 XMSexyCombo_05 15184 4.79 9.66 3.14 71 XM_B_SpammyTLD 15180 3.07 2.84 3.14 72 TR_XM_DK_SendGrid 15037 2.74 1.65 3.11 73 BAYES_20 14607 2.65 1.55 3.02 74 HTML_IMAGE_RATIO_08 13634 3.05 3.71 2.82 75 XMNumbers 13283 3.19 4.48 2.75 76 BAYES_95 13257 3.02 3.82 2.74 77 XM_DIRTYINTL 12408 3.23 5.19 2.57 78 UNPARSEABLE_RELAY 11876 2.23 1.54 2.46 79 RCVD_IN_IADB_OPTIN 11418 1.93 0.67 2.36 80 TooManyTo_002 11069 1.89 0.72 2.29 81 MIME_HTML_MOSTLY 10746 2.52 3.39 2.22 82 RCVD_IN_MSPIKE_BL 10603 3.19 6.11 2.19 83 TVD_RCVD_IP 10273 1.67 0.31 2.13 84 TR_MetaPhish_Combo_01 9945 1.75 0.84 2.06 85 MAILING_LIST_MULTI 9938 2.05 2.01 2.06 86 KHOP_HELO_FCRDNS 9580 1.91 1.71 1.98 87 BAYES_05 9527 1.64 0.67 1.97 88 SUBJ_ALL_CAPS 9499 2.06 2.35 1.97 89 XM_CamelCaseFrm001 9469 2.26 3.16 1.96 90 BOTNET 9272 6.05 18.24 1.92 91 XMDiploma_00 9219 2.24 3.24 1.91 92 HTML_MIME_NO_HTML_TAG 9215 2.31 3.50 1.91 93 XM_DK_Undo_01 9198 1.74 1.24 1.90 94 MIME_HTML_ONLY_MULTI 8947 2.36 3.87 1.85 95 TR_XM_PHPDW 8730 1.91 2.23 1.81 96 DKIM_ADSP_CUSTOM_MED 8624 1.55 0.84 1.78 97 US_DOLLARS_3 8568 2.00 2.69 1.77 98 XM_SPF_SoftFail 8521 2.21 3.52 1.76 99 URI_TRY_3LD 8521 1.70 1.53 1.76 100 IN_HORDE_ADDRESS_BOOK 8353 1.30 0.04 1.73 101 TM2_M_URI_OPT_OUT 8174 2.24 3.84 1.69 102 TR_Symld_Words 8062 1.72 1.88 1.67 103 HELO_NODOT 8007 1.37 0.52 1.66 104 HELO_NO_DOMAIN 8006 1.37 0.52 1.66 105 XM_H_PHPMailer 7875 1.47 1.01 1.63 106 TR_XM_PHPForged 7824 1.77 2.21 1.62 107 URI_HEX 7813 2.09 3.47 1.62 108 USER_IN_DEF_DKIM_WL 7726 1.20 0.01 1.60 109 ANY_BOUNCE_MESSAGE 7700 1.27 0.30 1.59 110 BOUNCE_MESSAGE 7700 1.27 0.30 1.59 111 UNTRUSTED_Relay 7602 3.92 10.85 1.57 112 INVALID_MSGID 7475 1.21 0.20 1.55 113 TooManyTo_003 7384 1.29 0.60 1.53 114 NML_ADSP_CUSTOM_MED 7374 1.31 0.69 1.53 115 XM_OfRef6 7299 1.87 2.94 1.51 116 T_XMDrugObfuBody_08 7255 1.73 2.39 1.50 117 RELAYCOUNTRY_CA 7243 2.26 4.50 1.50 118 T_TooManySym_02 7143 1.28 0.69 1.48 119 XM_H_Long_From02 7037 1.38 1.16 1.46 120 XMCapTrack 6552 1.09 0.31 1.36 121 T_FILL_THIS_FORM_SHORT 6138 1.21 1.02 1.27 122 TM2_M_VERY_LONG_WORD 5960 1.32 1.56 1.23 123 RELAYCOUNTRY_GB 5805 1.17 1.07 1.20 124 XMGenDplmaNmb 5452 1.32 1.87 1.13 125 TooManyTo_004 5426 0.97 0.51 1.12 126 NO_DNS_FOR_FROM 5340 1.33 1.99 1.11 127 XMPhish11 5176 1.13 1.32 1.07 128 XM_GoogleGroups 5107 0.91 0.47 1.06 129 FORGED_GMAIL_RCVD 5068 0.96 0.69 1.05 130 XMBdyGiftCard01 5042 1.22 1.74 1.04 131 XM_UB50 4448 1.99 5.14 0.92 132 TR_XM_RelayPhish 4428 1.00 1.26 0.92 133 TooManyTo_005 4352 0.79 0.44 0.90 134 XM_ProductURIs 4331 1.33 2.61 0.90 135 T_XMDrugObfuBody_00 4298 1.12 1.80 0.89 136 XMStockSpam_06 4190 0.94 1.15 0.87 137 RCVD_IN_MSPIKE_L5 3998 1.81 4.71 0.83 138 RCVD_IN_MSPIKE_L3 3834 0.86 1.04 0.79 139 XMGappySubj_01 3822 0.65 0.23 0.79 140 SpammyFromTLD_01 3625 1.05 1.92 0.75 141 XMSlimDrugH 3566 0.74 0.75 0.74 142 TR_XM_FormFill2 3440 1.09 2.19 0.71 143 XM_H_PHPOS 3431 1.08 2.18 0.71 144 T_Symld_Words_02 3409 0.87 1.35 0.71 145 SUBJ_DOLLARS 3320 0.69 0.70 0.69 146 HTML_TAG_BALANCE_BODY 3245 0.70 0.77 0.67 147 XMSexyCombo_01 3130 1.14 2.59 0.65 148 XMSolicitRefs_0 3092 0.55 0.30 0.64 149 T_XMHurry_00 3089 0.79 1.25 0.64 150 TM2_M_BODY_EMPTY 3052 0.54 0.29 0.63 151 HTTPS_HTTP_MISMATCH 3016 0.66 0.76 0.62 152 TM2_M_A_HREF_HREF 3012 0.63 0.63 0.62 153 HTML_FONT_FACE_BAD 2972 0.68 0.87 0.62 154 T_OBFU_PDF_ATTACH 2923 0.49 0.15 0.60 155 XMBody_95 2906 0.50 0.19 0.60 156 TR_LOTS_OF_MONEY2 2849 0.69 1.00 0.59 157 T_MONEY_PERCENT 2849 0.69 1.00 0.59 158 USER_IN_WHITELIST 2831 0.44 0.00 0.59 159 XMBody_17 2792 0.77 1.32 0.58 160 RCVD_IN_MSPIKE_L4 2771 0.52 0.35 0.57 161 RELAYCOUNTRY_AU 2769 0.57 0.57 0.57 162 XM_B_COPY_HTML 2755 0.63 0.80 0.57 163 XMSubMetaI_00 2717 0.96 2.11 0.56 164 FILL_THIS_FORM 2713 0.72 1.20 0.56 165 AC_DIV_BONANZA 2602 0.44 0.14 0.54 166 XMBody_78 2570 0.76 1.41 0.53 167 XMNoVowels 2554 0.57 0.69 0.53 168 XMBrknScrpt_02 2550 0.66 1.03 0.53 169 XMMoneyMeta_00 2550 0.66 1.05 0.53 170 XM_ShortIntro_01 2529 0.50 0.43 0.52 171 DKIM_ADSP_NXDOMAIN 2524 1.17 3.06 0.52 172 XMHTMLBadTable_001 2459 0.60 0.85 0.51 173 RCVD_IN_BL_SPAMCOP_NET 2397 1.15 3.08 0.50 174 SHORT_HELO_AND_INLINE_IMAGE 2351 0.38 0.05 0.49 175 XMPhish14 2346 0.56 0.77 0.49 176 MISSING_HEADERS 2306 0.51 0.62 0.48 177 XM_D_tchamptons_WL 2297 0.35 0.00 0.48 178 RCVD_IN_MSPIKE_H5 2257 0.38 0.14 0.47 179 FROM_GOV_DKIM_AU 2254 0.37 0.10 0.47 180 XMSubMetaSxObfu_02 2244 0.52 0.68 0.46 181 T_TooManySym_03 2240 0.38 0.15 0.46 182 PLING_QUERY 2208 0.48 0.56 0.46 183 FROM_GOV_SPOOF 2193 0.42 0.32 0.45 184 XM_B_REG_HTML 2135 0.53 0.81 0.44 185 XMHTML_After_End 2122 0.63 1.20 0.44 186 XMLngstWrd_00 2117 0.40 0.28 0.44 187 URI_NOVOWEL 2113 0.51 0.74 0.44 188 NUMERIC_HTTP_ADDR 2077 0.44 0.47 0.43 189 TR_LOTS_OF_MONEY3 2072 0.53 0.83 0.43 190 XMPhish30 2049 0.67 1.39 0.42 191 XMSubMetaSxObfu_03 2044 0.60 1.13 0.42 192 XMGappySubj_02 2015 0.32 0.05 0.42 193 XMLngstWrd_01 1938 0.36 0.23 0.40 194 XMDateMe_00 1938 0.39 0.34 0.40 195 RDNS_DYNAMIC 1937 0.52 0.85 0.40 196 FILL_THIS_FORM_LOAN 1875 0.45 0.63 0.39 197 HTML_IMAGE_ONLY_32 1861 0.46 0.69 0.39 198 FILL_THIS_FORM_LONG 1859 0.55 1.03 0.38 199 XM_Body_Obfu01 1837 0.37 0.33 0.38 200 RELAYCOUNTRY_DE 1768 0.47 0.79 0.37 ----------------------------------------------------------------------