Email: 626419 Autolearn: 0 AvgScore: 1.30 AvgScanTime: 2.25 sec Spam: 96979 Autolearn: 0 AvgScore: 11.59 AvgScanTime: 2.85 sec Ham: 529440 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 2.14 sec Time Spent Running SA: 391.94 hours Time Spent Processing Spam: 76.75 hours Time Spent Processing Ham: 315.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89252 87.74 92.03 86.96 2 DCC_CHECK 76109 50.44 78.48 45.31 3 DKIM_SIGNED 73164 76.92 75.44 77.19 4 XM_B_Unicode 70615 70.40 72.81 69.96 5 XM_DK_Pass 68863 74.98 71.01 75.71 6 XMListUnsubscribeExists 67694 57.09 69.80 54.76 7 DKIM_VALID 65065 71.49 67.09 72.29 8 BAYES_50 49424 51.37 50.96 51.45 9 DKIM_VALID_AU 48658 53.04 50.17 53.57 10 XM_B_Unicode3 46013 41.90 47.45 40.89 11 HTML_FONT_LOW_CONTRAST 33096 30.87 34.13 30.28 12 MIME_HTML_ONLY 32305 22.64 33.31 20.68 13 LOC_TINY_FONT_1 31395 26.05 32.37 24.89 14 XM_DK_Undo_02 30556 9.31 31.51 5.25 15 FVGT_m_MULTI_ODD 27381 24.08 28.23 23.31 16 XMSubLong 25378 23.70 26.17 23.24 17 RELAYCOUNTRY_META 25003 8.81 25.78 5.70 18 XM_Body_Dirty_Words 22086 15.67 22.77 14.37 19 DKIM_VALID_EF 20741 26.38 21.39 27.29 20 BOTNET_IPINHOSTNAME 19690 7.17 20.30 4.77 21 BOTNET 19556 4.93 20.17 2.14 22 BAYES_99 19548 5.32 20.16 2.61 23 DCC_CHECK_NEGATIVE 19281 47.59 19.88 52.66 24 T_KAM_HTML_FONT_INVALID 18576 19.23 19.15 19.24 25 MultiRelay 17695 18.18 18.25 18.17 26 XM_Multi_Part_URI 17605 13.36 18.15 12.48 27 T_TM2_M_HEADER_IN_MSG 17372 27.26 17.91 28.97 28 UNTRUSTED_Relay 16895 4.23 17.42 1.81 29 TR_DCC_Bayes_99 15578 3.58 16.06 1.29 30 BAYES_999 15177 4.25 15.65 2.16 31 FSL_BULK_SIG 14046 8.64 14.48 7.57 32 XM_Evil_Numbers_Gen 13873 9.48 14.31 8.60 33 HTML_IMAGE_RATIO_02 12854 9.62 13.25 8.96 34 LOTS_OF_MONEY 11686 9.88 12.05 9.49 35 XMSexyCombo_05 11458 5.44 11.81 4.28 36 XM_B_Phish_Phrases 10521 6.32 10.85 5.50 37 T_XMDrugObfuBody_14 9257 8.58 9.55 8.40 38 XM_UB50 9202 2.22 9.49 0.89 39 XM_UncommonTLD01 8807 4.67 9.08 3.87 40 LotsOfNums_01 8508 8.55 8.77 8.51 41 XMSubMetaSx_00 8365 4.78 8.63 4.07 42 DKIM_INVALID 8099 5.44 8.35 4.90 43 XM_DIRTYINTL 7648 3.52 7.89 2.72 44 TooManyTo_001 7629 7.94 7.87 7.96 45 XM_H_Long_From01 7626 6.54 7.86 6.30 46 MPART_ALT_DIFF 7288 4.36 7.52 3.79 47 HTML_IMAGE_RATIO_04 7124 5.88 7.35 5.62 48 RCVD_IN_MSPIKE_H2 5755 7.39 5.93 7.65 49 HTML_MIME_NO_HTML_TAG 5576 2.69 5.75 2.13 50 BAYES_80 5313 2.36 5.48 1.79 51 BAYES_00 5250 21.04 5.41 23.91 52 T_REMOTE_IMAGE 5202 4.14 5.36 3.92 53 XM_B_SpammyTLD 5173 3.58 5.33 3.26 54 XMNumbers 5008 3.64 5.16 3.36 55 SpammyFromTLD_02 4918 1.21 5.07 0.50 56 MIME_QP_LONG_LINE 4746 5.69 4.89 5.84 57 RCVD_IN_BL_SPAMCOP_NET 4741 1.52 4.89 0.91 58 RELAYCOUNTRY_CA 4668 2.14 4.81 1.65 59 TM2_M_URI_OPT_OUT 4509 3.31 4.65 3.06 60 BAYES_40 4482 6.18 4.62 6.46 61 MIME_HTML_ONLY_MULTI 4439 2.43 4.58 2.04 62 XM_URI_RBL 4417 0.98 4.55 0.32 63 XM_SPF_SoftFail 4412 2.26 4.55 1.83 64 BAYES_60 4317 3.86 4.45 3.75 65 XMStrtUSub 4316 3.96 4.45 3.87 66 HTML_IMAGE_RATIO_06 4222 4.18 4.35 4.15 67 RELAYCOUNTRY_FR 4217 1.08 4.35 0.49 68 XMDiploma_00 4017 2.18 4.14 1.82 69 MIME_HTML_MOSTLY 3940 2.76 4.06 2.52 70 ALL_TRUSTED 3925 13.08 4.05 14.73 71 KHOP_HELO_FCRDNS 3752 2.28 3.87 1.99 72 XM_SendGrid 3678 5.93 3.79 6.32 73 BAYES_20 3647 5.09 3.76 5.33 74 URI_HEX 3471 2.17 3.58 1.92 75 XM_CamelCaseFrm001 3438 2.38 3.55 2.16 76 FROM_EXCESS_BASE64 3405 3.75 3.51 3.79 77 NO_DNS_FOR_FROM 3327 1.42 3.43 1.06 78 HTML_IMAGE_RATIO_08 3238 2.89 3.34 2.81 79 RCVD_IN_RP_RNBL 3163 0.52 3.26 0.02 80 MultiRelay_Combo 3158 0.69 3.26 0.22 81 MultiRelay_CC 3158 0.69 3.26 0.22 82 XMSexyCombo_01 3117 1.24 3.21 0.88 83 XM_BadFromFormat 3089 0.63 3.19 0.16 84 DKIM_ADSP_NXDOMAIN 3088 1.07 3.18 0.68 85 T_XMDrugObfuBody_08 3071 1.79 3.17 1.54 86 BODY_URI_ONLY 2996 0.60 3.09 0.15 87 TR_XM_PHPDW 2971 0.97 3.06 0.59 88 T_TooManySym_01 2960 5.30 3.05 5.72 89 TR_XM_PHPForged 2957 0.96 3.05 0.57 90 TR_XM_FormFill2 2935 0.95 3.03 0.57 91 XM_H_PHPOS 2922 0.94 3.01 0.56 92 XMGenDplmaNmb 2883 1.45 2.97 1.17 93 XM_OfRef6 2878 1.74 2.97 1.52 94 HDRS_LCASE_IMGONLY 2757 0.52 2.84 0.10 95 HTML_IMAGE_ONLY_08 2627 0.55 2.71 0.15 96 BAYES_95 2615 1.26 2.70 1.00 97 BOTNET_NORDNS 2603 0.45 2.68 0.04 98 NORDNS_LOW_CONTRAST 2599 0.43 2.68 0.01 99 HTML_SHORT_LINK_IMG_1 2512 0.47 2.59 0.08 100 RCVD_IN_PSBL 2508 0.44 2.59 0.05 101 TR_XM_DK_Bayes 2505 16.62 2.58 19.19 102 RCVD_IN_RP_SAFE 2426 8.34 2.50 9.41 103 SUBJ_ALL_CAPS 2341 1.95 2.41 1.87 104 TR_XM_DK_Bayes1 2264 15.87 2.33 18.34 105 RELAYCOUNTRY_DE 2257 0.64 2.33 0.33 106 SpammyFromTLD_01 2238 1.12 2.31 0.90 107 XM_B_Crypto 2066 0.37 2.13 0.05 108 RCVD_IN_IADB_LISTED 2060 4.74 2.12 5.22 109 BAYES_05 2011 3.16 2.07 3.36 110 PDS_BTC_ID 1908 0.34 1.97 0.04 111 TM2_M_VERY_LONG_WORD 1905 1.40 1.96 1.29 112 XMPhish11 1870 1.34 1.93 1.24 113 TR_XM_INV_DKIM 1859 0.38 1.92 0.10 114 RCVD_IN_IADB_SPF 1845 4.12 1.90 4.52 115 RELAYCOUNTRY_IN 1834 0.44 1.89 0.17 116 GB_BITCOIN_NH 1828 0.29 1.88 0.00 117 BITCOIN_EXTORT_01 1828 0.29 1.88 0.00 118 RELAYCOUNTRY_NL 1782 0.43 1.84 0.17 119 RCVD_IN_IADB_DK 1782 3.57 1.84 3.89 120 XMBdyGiftCard01 1780 1.32 1.84 1.23 121 RCVD_IN_IADB_SENDERID 1779 3.63 1.83 3.96 122 TR_XM_DK_SendGrid 1724 2.98 1.78 3.20 123 XM_DK_Undo_01 1714 1.73 1.77 1.72 124 THIS_AD 1710 0.51 1.76 0.28 125 TR_XM_RelayPhish 1697 1.02 1.75 0.89 126 TR_Symld_Words 1691 1.63 1.74 1.60 127 XMSubMetaI_00 1680 1.00 1.73 0.87 128 DATE_IN_PAST_03_06 1653 0.39 1.70 0.15 129 URI_TRY_3LD 1644 1.52 1.70 1.49 130 MAILING_LIST_MULTI 1631 2.34 1.68 2.46 131 XM_H_PHPMailer 1549 0.70 1.60 0.53 132 XMSlimDrugH 1516 0.54 1.56 0.36 133 T_XMDrugObfuBody_00 1509 0.83 1.56 0.70 134 XMBrknScrpt_02 1496 0.76 1.54 0.61 135 T_XMHurry_00 1465 0.87 1.51 0.75 136 TR_Mismatch_TLD_02 1415 0.30 1.46 0.09 137 RDNS_DYNAMIC 1401 0.54 1.44 0.37 138 XMMoneyMeta_00 1391 0.77 1.43 0.65 139 XM_H_PHPOS_M 1364 0.38 1.41 0.19 140 FSL_THIS_IS_ADV 1361 0.58 1.40 0.43 141 XM_UB60 1346 0.27 1.39 0.07 142 XMBody_17 1324 0.93 1.37 0.85 143 TR_LOTS_OF_MONEY2 1305 0.74 1.35 0.63 144 T_MONEY_PERCENT 1305 0.74 1.35 0.63 145 TR_XM_DK_Bayes2 1297 13.54 1.34 15.77 146 XMStockSpam_06 1270 0.88 1.31 0.80 147 RCVD_IN_MSPIKE_WL 1253 4.58 1.29 5.18 148 XM_H_Long_From02 1233 1.44 1.27 1.47 149 HTML_FONT_FACE_BAD 1232 0.78 1.27 0.69 150 XMPhish30 1227 0.70 1.27 0.59 151 URIBL_DBL_ABUSE_REDIR 1227 0.21 1.27 0.02 152 XMHTML_After_End 1222 0.62 1.26 0.51 153 RELAYCOUNTRY_GB 1197 1.09 1.23 1.06 154 RCVD_IN_MSPIKE_H3 1187 4.11 1.22 4.64 155 LONG_HEX_URI 1174 0.39 1.21 0.24 156 T_FILL_THIS_FORM_SHORT 1160 1.00 1.20 0.96 157 XMSexyCombo_04 1158 0.40 1.19 0.25 158 URIBL_BLACK 1157 0.21 1.19 0.03 159 DIET_1 1146 0.49 1.18 0.36 160 NUMERIC_HTTP_ADDR 1145 0.46 1.18 0.33 161 FROM_SUSPICIOUS_NTLD 1104 0.21 1.14 0.04 162 RELAYCOUNTRY_AT 1045 0.33 1.08 0.19 163 HELO_NODOT 1030 1.47 1.06 1.54 164 HELO_NO_DOMAIN 1028 1.47 1.06 1.54 165 RCVD_IN_RP_CERTIFIED 1012 6.84 1.04 7.90 166 URIBL_DBL_SPAM 1008 0.18 1.04 0.02 167 XM_UB99 1003 0.16 1.03 0.01 168 FROM_SUSPICIOUS_NTLD_FP 992 0.19 1.02 0.04 169 XM_ProductURIs 987 0.96 1.02 0.95 170 TooManyTo_002 968 1.98 1.00 2.16 171 XMBody_78 963 0.57 0.99 0.49 172 DATE_IN_PAST_06_12 940 0.33 0.97 0.21 173 TM2_M_A_HREF_HREF 917 0.67 0.95 0.62 174 XMWghtMeta_00 899 0.19 0.93 0.06 175 XM_OfRef7 888 0.33 0.92 0.22 176 DKIM_ADSP_CUSTOM_MED 882 0.96 0.91 0.97 177 URIBL_SBL_A 878 0.28 0.91 0.17 178 XM_Lotto 873 0.34 0.90 0.24 179 XMSubMetaSxObfu_03 871 0.47 0.90 0.40 180 T_Symld_Words_02 866 0.60 0.89 0.55 181 XM_B_REG_HTML 860 0.62 0.89 0.57 182 TR_Caps_n_Bayes_99 850 0.18 0.88 0.05 183 T_TooManySym_02 840 1.88 0.87 2.07 184 REPLYTO_WITHOUT_TO_CC 834 0.16 0.86 0.04 185 REMOVE_BEFORE_LINK 830 0.52 0.86 0.46 186 UNPARSEABLE_RELAY 826 2.16 0.85 2.40 187 SUBJECT_NEEDS_ENCODING 821 0.14 0.85 0.01 188 XM_UB80 820 0.15 0.85 0.02 189 XMPhish14 818 0.51 0.84 0.45 190 SUBJ_ILLEGAL_CHARS 813 0.14 0.84 0.01 191 NORMAL_HTTP_TO_IP 812 0.17 0.84 0.04 192 XMSubMetaSSx_00 809 0.33 0.83 0.24 193 RCVD_IN_MSPIKE_BL 808 0.19 0.83 0.07 194 MISSING_HEADERS 807 0.47 0.83 0.40 195 MPART_ALT_DIFF_COUNT 807 0.39 0.83 0.31 196 RCVD_IN_IADB_VOUCHED 796 3.05 0.82 3.46 197 XM_Combo_Sbj 793 0.29 0.82 0.20 198 TR_LOTS_OF_MONEY3 793 0.58 0.82 0.53 199 XM_UB999 782 0.13 0.81 0.00 200 XM_PDF 782 3.54 0.81 4.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 460385 87.74 92.03 86.96 2 DKIM_SIGNED 408698 76.92 75.44 77.19 3 XM_DK_Pass 400845 74.98 71.01 75.71 4 DKIM_VALID 382739 71.49 67.09 72.29 5 XM_B_Unicode 370409 70.40 72.81 69.96 6 XMListUnsubscribeExists 289919 57.09 69.80 54.76 7 DKIM_VALID_AU 283610 53.04 50.17 53.57 8 DCC_CHECK_NEGATIVE 278802 47.59 19.88 52.66 9 BAYES_50 272393 51.37 50.96 51.45 10 DCC_CHECK 239879 50.44 78.48 45.31 11 XM_B_Unicode3 216478 41.90 47.45 40.89 12 HTML_FONT_LOW_CONTRAST 160302 30.87 34.13 30.28 13 T_TM2_M_HEADER_IN_MSG 153383 27.26 17.91 28.97 14 DKIM_VALID_EF 144501 26.38 21.39 27.29 15 LOC_TINY_FONT_1 131757 26.05 32.37 24.89 16 BAYES_00 126568 21.04 5.41 23.91 17 FVGT_m_MULTI_ODD 123434 24.08 28.23 23.31 18 XMSubLong 123059 23.70 26.17 23.24 19 MIME_HTML_ONLY 109507 22.64 33.31 20.68 20 T_KAM_HTML_FONT_INVALID 101860 19.23 19.15 19.24 21 TR_XM_DK_Bayes 101586 16.62 2.58 19.19 22 TR_XM_DK_Bayes1 97121 15.87 2.33 18.34 23 MultiRelay 96214 18.18 18.25 18.17 24 TR_XM_DK_Bayes2 83508 13.54 1.34 15.77 25 ALL_TRUSTED 78008 13.08 4.05 14.73 26 XM_Body_Dirty_Words 76080 15.67 22.77 14.37 27 XM_Multi_Part_URI 66067 13.36 18.15 12.48 28 LOTS_OF_MONEY 50221 9.88 12.05 9.49 29 RCVD_IN_RP_SAFE 49795 8.34 2.50 9.41 30 HTML_IMAGE_RATIO_02 47417 9.62 13.25 8.96 31 XM_Evil_Numbers_Gen 45535 9.48 14.31 8.60 32 LotsOfNums_01 45046 8.55 8.77 8.51 33 T_XMDrugObfuBody_14 44468 8.58 9.55 8.40 34 TooManyTo_001 42120 7.94 7.87 7.96 35 RCVD_IN_RP_CERTIFIED 41808 6.84 1.04 7.90 36 RCVD_IN_MSPIKE_H2 40524 7.39 5.93 7.65 37 FSL_BULK_SIG 40071 8.64 14.48 7.57 38 XM_DKIMWhitelistDomains 36092 5.77 0.05 6.82 39 BAYES_40 34205 6.18 4.62 6.46 40 XM_SendGrid 33452 5.93 3.79 6.32 41 XM_H_Long_From01 33331 6.54 7.86 6.30 42 MIME_QP_LONG_LINE 30898 5.69 4.89 5.84 43 T_TooManySym_01 30266 5.30 3.05 5.72 44 RELAYCOUNTRY_META 30183 8.81 25.78 5.70 45 HTML_IMAGE_RATIO_04 29729 5.88 7.35 5.62 46 XM_B_Phish_Phrases 29097 6.32 10.85 5.50 47 BAYES_20 28232 5.09 3.76 5.33 48 XM_DK_Undo_02 27782 9.31 31.51 5.25 49 RCVD_IN_IADB_LISTED 27661 4.74 2.12 5.22 50 RCVD_IN_MSPIKE_WL 27423 4.58 1.29 5.18 51 DKIM_INVALID 25959 5.44 8.35 4.90 52 BOTNET_IPINHOSTNAME 25241 7.17 20.30 4.77 53 RCVD_IN_MSPIKE_H3 24558 4.11 1.22 4.64 54 RCVD_IN_IADB_SPF 23941 4.12 1.90 4.52 55 XMSexyCombo_05 22636 5.44 11.81 4.28 56 HTML_IMAGE_RATIO_06 21949 4.18 4.35 4.15 57 XMSubMetaSx_00 21553 4.78 8.63 4.07 58 XM_PDF 21375 3.54 0.81 4.04 59 RCVD_IN_IADB_SENDERID 20979 3.63 1.83 3.96 60 T_REMOTE_IMAGE 20743 4.14 5.36 3.92 61 RCVD_IN_IADB_DK 20600 3.57 1.84 3.89 62 XMStrtUSub 20483 3.96 4.45 3.87 63 XM_UncommonTLD01 20467 4.67 9.08 3.87 64 FROM_EXCESS_BASE64 20082 3.75 3.51 3.79 65 MPART_ALT_DIFF 20049 4.36 7.52 3.79 66 BAYES_60 19853 3.86 4.45 3.75 67 IN_ZIMBRA_NJ_WHITELIST 18804 3.00 0.02 3.55 68 RCVD_IN_IADB_VOUCHED 18296 3.05 0.82 3.46 69 XMNumbers 17811 3.64 5.16 3.36 70 BAYES_05 17763 3.16 2.07 3.36 71 XM_B_SpammyTLD 17283 3.58 5.33 3.26 72 TO_MALFORMED 16972 2.71 0.03 3.21 73 TR_XM_DK_SendGrid 16917 2.98 1.78 3.20 74 ANY_BOUNCE_MESSAGE 16348 2.68 0.47 3.09 75 BOUNCE_MESSAGE 16345 2.68 0.47 3.09 76 TM2_M_URI_OPT_OUT 16223 3.31 4.65 3.06 77 HTML_IMAGE_RATIO_08 14884 2.89 3.34 2.81 78 XM_DIRTYINTL 14404 3.52 7.89 2.72 79 BAYES_99 13800 5.32 20.16 2.61 80 MIME_HTML_MOSTLY 13321 2.76 4.06 2.52 81 MAILING_LIST_MULTI 12998 2.34 1.68 2.46 82 UNPARSEABLE_RELAY 12702 2.16 0.85 2.40 83 TooManyTo_002 11459 1.98 1.00 2.16 84 BAYES_999 11446 4.25 15.65 2.16 85 XM_CamelCaseFrm001 11445 2.38 3.55 2.16 86 BOTNET 11306 4.93 20.17 2.14 87 RCVD_IN_IADB_OPTIN 11299 1.88 0.52 2.13 88 HTML_MIME_NO_HTML_TAG 11264 2.69 5.75 2.13 89 INVALID_MSGID 11091 1.89 0.75 2.09 90 T_TooManySym_02 10942 1.88 0.87 2.07 91 MIME_HTML_ONLY_MULTI 10814 2.43 4.58 2.04 92 KHOP_HELO_FCRDNS 10523 2.28 3.87 1.99 93 TVD_RCVD_IP 10292 1.77 0.79 1.94 94 URI_HEX 10148 2.17 3.58 1.92 95 SUBJ_ALL_CAPS 9890 1.95 2.41 1.87 96 XM_SPF_SoftFail 9714 2.26 4.55 1.83 97 XMDiploma_00 9610 2.18 4.14 1.82 98 UNTRUSTED_Relay 9605 4.23 17.42 1.81 99 BAYES_80 9501 2.36 5.48 1.79 100 XM_DK_Undo_01 9095 1.73 1.77 1.72 101 RELAYCOUNTRY_CA 8759 2.14 4.81 1.65 102 CK_HELO_DYNAMIC_SPLIT_IP 8514 1.43 0.47 1.61 103 TR_Symld_Words 8490 1.63 1.74 1.60 104 HELO_DYNAMIC_IPADDR2 8469 1.37 0.13 1.60 105 TR_MetaPhish_Combo_01 8269 1.41 0.61 1.56 106 HELO_NODOT 8168 1.47 1.06 1.54 107 HELO_NO_DOMAIN 8167 1.47 1.06 1.54 108 T_XMDrugObfuBody_08 8150 1.79 3.17 1.54 109 XM_OfRef6 8049 1.74 2.97 1.52 110 IN_HORDE_ADDRESS_BOOK 7904 1.27 0.02 1.49 111 URI_TRY_3LD 7872 1.52 1.70 1.49 112 XM_H_Long_From02 7799 1.44 1.27 1.47 113 TooManyTo_003 7772 1.36 0.80 1.47 114 XMCapTrack 6909 1.14 0.26 1.30 115 TM2_M_VERY_LONG_WORD 6841 1.40 1.96 1.29 116 TR_DCC_Bayes_99 6837 3.58 16.06 1.29 117 XMGappySubj_01 6640 1.11 0.31 1.25 118 XMPhish11 6542 1.34 1.93 1.24 119 XMBdyGiftCard01 6518 1.32 1.84 1.23 120 XMGenDplmaNmb 6175 1.45 2.97 1.17 121 USER_IN_DEF_DKIM_WL 6151 0.98 0.01 1.16 122 XM_GoogleGroups 6014 1.04 0.52 1.14 123 TooManyTo_004 5732 1.01 0.61 1.08 124 RELAYCOUNTRY_GB 5628 1.09 1.23 1.06 125 NO_DNS_FOR_FROM 5598 1.42 3.43 1.06 126 BAYES_95 5286 1.26 2.70 1.00 127 DKIM_ADSP_CUSTOM_MED 5143 0.96 0.91 0.97 128 T_FILL_THIS_FORM_SHORT 5105 1.00 1.20 0.96 129 XM_ProductURIs 5028 0.96 1.02 0.95 130 RCVD_IN_BL_SPAMCOP_NET 4810 1.52 4.89 0.91 131 SpammyFromTLD_01 4779 1.12 2.31 0.90 132 TR_XM_RelayPhish 4707 1.02 1.75 0.89 133 XM_UB50 4694 2.22 9.49 0.89 134 XMSexyCombo_01 4654 1.24 3.21 0.88 135 TooManyTo_005 4653 0.82 0.52 0.88 136 XMSubMetaI_00 4608 1.00 1.73 0.87 137 XMBody_17 4482 0.93 1.37 0.85 138 XMStockSpam_06 4224 0.88 1.31 0.80 139 T_XMHurry_00 3990 0.87 1.51 0.75 140 URIBL_CSS 3735 0.69 0.62 0.71 141 URIBL_CSS_A 3735 0.69 0.62 0.71 142 T_XMDrugObfuBody_00 3717 0.83 1.56 0.70 143 NML_ADSP_CUSTOM_MED 3663 0.70 0.71 0.69 144 URI_OPTOUT_3LD 3646 0.60 0.15 0.69 145 HTML_FONT_FACE_BAD 3630 0.78 1.27 0.69 146 DKIM_ADSP_NXDOMAIN 3589 1.07 3.18 0.68 147 XMNoVowels 3574 0.67 0.66 0.68 148 XMMoneyMeta_00 3453 0.77 1.43 0.65 149 XMHTMLBadTable_001 3421 0.66 0.73 0.65 150 HTML_TAG_BALANCE_BODY 3373 0.62 0.56 0.64 151 TR_LOTS_OF_MONEY2 3350 0.74 1.35 0.63 152 T_MONEY_PERCENT 3350 0.74 1.35 0.63 153 TM2_M_A_HREF_HREF 3308 0.67 0.95 0.62 154 XMBrknScrpt_02 3248 0.76 1.54 0.61 155 XMPhish30 3138 0.70 1.27 0.59 156 TR_XM_PHPDW 3123 0.97 3.06 0.59 157 HTTPS_HTTP_MISMATCH 3085 0.61 0.78 0.58 158 TR_XM_PHPForged 3030 0.96 3.05 0.57 159 XM_B_REG_HTML 3020 0.62 0.89 0.57 160 TR_XM_FormFill2 2997 0.95 3.03 0.57 161 XM_H_PHPOS 2980 0.94 3.01 0.56 162 URI_NOVOWEL 2968 0.53 0.38 0.56 163 T_Symld_Words_02 2900 0.60 0.89 0.55 164 FILL_THIS_FORM 2889 0.56 0.63 0.55 165 FROM_GOV_SPOOF 2879 0.52 0.42 0.54 166 XM_H_PHPMailer 2827 0.70 1.60 0.53 167 RELAYCOUNTRY_AU 2822 0.56 0.70 0.53 168 TR_LOTS_OF_MONEY3 2816 0.58 0.82 0.53 169 XMBody_95 2740 0.46 0.14 0.52 170 T_OBFU_PDF_ATTACH 2722 0.47 0.24 0.51 171 XMHTML_After_End 2679 0.62 1.26 0.51 172 T_TooManySym_03 2650 0.46 0.25 0.50 173 SpammyFromTLD_02 2648 1.21 5.07 0.50 174 XMGappySubj_02 2637 0.44 0.12 0.50 175 USER_IN_WHITELIST 2607 0.42 0.00 0.49 176 XMBody_78 2594 0.57 0.99 0.49 177 RELAYCOUNTRY_FR 2571 1.08 4.35 0.49 178 XM_ShortIntro_01 2553 0.48 0.50 0.48 179 FORGED_GMAIL_RCVD 2526 0.52 0.77 0.48 180 FILL_THIS_FORM_LONG 2472 0.48 0.56 0.47 181 REMOVE_BEFORE_LINK 2447 0.52 0.86 0.46 182 PLING_QUERY 2417 0.49 0.68 0.46 183 RCVD_IN_MSPIKE_H5 2409 0.39 0.05 0.46 184 AC_DIV_BONANZA 2396 0.40 0.13 0.45 185 XMPhish14 2374 0.51 0.84 0.45 186 XMSubMetaSxObfu_02 2367 0.45 0.46 0.45 187 FROM_GOV_DKIM_AU 2301 0.39 0.12 0.43 188 SUBJ_DOLLARS 2297 0.46 0.59 0.43 189 FSL_THIS_IS_ADV 2287 0.58 1.40 0.43 190 FILL_THIS_FORM_LOAN 2253 0.40 0.28 0.43 191 HTML_IMAGE_ONLY_28 2224 0.46 0.66 0.42 192 XM_B_COPY_HTML 2190 0.47 0.75 0.41 193 TM2_M_BODY_EMPTY 2145 0.36 0.08 0.41 194 SHORT_HELO_AND_INLINE_IMAGE 2123 0.35 0.05 0.40 195 MISSING_HEADERS 2115 0.47 0.83 0.40 196 HTML_IMAGE_ONLY_32 2104 0.38 0.26 0.40 197 XMSubMetaSxObfu_03 2095 0.47 0.90 0.40 198 XMOemUri 2068 0.38 0.30 0.39 199 XM_Body_Obfu01 2038 0.44 0.76 0.38 200 RDNS_DYNAMIC 1957 0.54 1.44 0.37 ----------------------------------------------------------------------