Email: 930465 Autolearn: 0 AvgScore: 2.19 AvgScanTime: 2.75 sec Spam: 183477 Autolearn: 0 AvgScore: 11.48 AvgScanTime: 3.42 sec Ham: 746988 Autolearn: 0 AvgScore: -0.09 AvgScanTime: 2.59 sec Time Spent Running SA: 711.85 hours Time Spent Processing Spam: 174.21 hours Time Spent Processing Ham: 537.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176126 92.38 95.99 91.50 2 DKIM_SIGNED 157198 83.56 85.68 83.04 3 DCC_CHECK 155913 58.37 84.98 51.83 4 XM_DK_Pass 152594 82.24 83.17 82.02 5 XM_B_Unicode 148776 76.70 81.09 75.63 6 DKIM_VALID 143995 78.68 78.48 78.73 7 XMListUnsubscribeExists 137077 64.73 74.71 62.28 8 DKIM_VALID_AU 111355 58.94 60.69 58.51 9 XM_B_Unicode3 103005 48.88 56.14 47.10 10 BAYES_50 85437 53.30 46.57 54.95 11 XM_DK_Undo_02 73955 13.66 40.31 7.12 12 LOC_TINY_FONT_1 71636 31.47 39.04 29.61 13 HTML_FONT_LOW_CONTRAST 69224 33.26 37.73 32.16 14 FVGT_m_MULTI_ODD 56363 24.53 30.72 23.01 15 MIME_HTML_ONLY 56311 23.12 30.69 21.26 16 BAYES_99 49094 7.60 26.76 2.90 17 XMSubLong 46893 20.44 25.56 19.18 18 XM_Body_Dirty_Words 42017 15.91 22.90 14.19 19 TR_DCC_Bayes_99 41532 5.82 22.64 1.69 20 BAYES_999 38971 6.01 21.24 2.27 21 T_KAM_HTML_FONT_INVALID 38670 19.80 21.08 19.49 22 MultiRelay 38083 18.91 20.76 18.46 23 XM_Multi_Part_URI 37657 15.12 20.52 13.79 24 BOTNET 37402 6.20 20.39 2.72 25 DKIM_VALID_EF 37115 23.89 20.23 24.79 26 BOTNET_IPINHOSTNAME 35603 7.77 19.40 4.92 27 RELAYCOUNTRY_META 33102 7.74 18.04 5.20 28 XM_Evil_Numbers_Gen 28725 13.57 15.66 13.06 29 HTML_IMAGE_RATIO_02 28103 12.35 15.32 11.62 30 T_TM2_M_HEADER_IN_MSG 27692 23.19 15.09 25.18 31 DCC_CHECK_NEGATIVE 24894 39.80 13.57 46.25 32 FSL_BULK_SIG 24595 7.71 13.40 6.31 33 XM_B_Unsub 23690 10.78 12.91 10.26 34 LOTS_OF_MONEY 20321 9.47 11.08 9.07 35 UNTRUSTED_Relay 19931 3.63 10.86 1.86 36 XM_B_Phish_Phrases 19418 7.32 10.58 6.52 37 LotsOfNums_01 17683 10.40 9.64 10.59 38 XMSexyCombo_05 17208 5.48 9.38 4.52 39 MPART_ALT_DIFF 16768 5.10 9.14 4.11 40 T_XMDrugObfuBody_14 16510 7.56 9.00 7.21 41 XM_SendGrid 15550 8.24 8.48 8.18 42 HTML_IMAGE_RATIO_04 15182 7.75 8.27 7.62 43 XM_DIRTYINTL 14449 4.23 7.88 3.33 44 XM_UncommonTLD01 14284 3.68 7.79 2.67 45 XM_H_Long_From01 13345 7.13 7.27 7.09 46 DKIM_INVALID 13203 4.88 7.20 4.31 47 MIME_HTML_MOSTLY 12868 4.26 7.01 3.59 48 TooManyTo_001 11858 7.15 6.46 7.32 49 XMSubMetaSx_00 11170 3.52 6.09 2.89 50 MIME_QP_LONG_LINE 10909 7.35 5.95 7.69 51 BAYES_80 10881 3.39 5.93 2.77 52 XM_UB50 10659 1.81 5.81 0.83 53 XMSubMetaI_00 10620 2.78 5.79 2.05 54 RCVD_IN_MSPIKE_H2 10427 7.66 5.68 8.14 55 XMStrtUSub 9815 4.91 5.35 4.81 56 XMNumbers 9708 3.58 5.29 3.16 57 TR_XM_DK_SendGrid 9029 4.14 4.92 3.94 58 FROM_EXCESS_BASE64 8851 4.43 4.82 4.34 59 XM_B_SpammyTLD 8523 2.26 4.65 1.67 60 MIME_HTML_ONLY_MULTI 8280 2.53 4.51 2.05 61 BAYES_60 7987 5.21 4.35 5.42 62 TM2_M_URI_OPT_OUT 7837 2.44 4.27 1.99 63 HTML_IMAGE_RATIO_06 7803 3.60 4.25 3.44 64 BAYES_00 7767 16.47 4.23 19.47 65 HTML_MIME_NO_HTML_TAG 7745 2.26 4.22 1.78 66 XMBdyGiftCard01 7732 2.53 4.21 2.11 67 HTML_IMAGE_RATIO_08 7633 3.60 4.16 3.46 68 URI_HEX 7563 2.62 4.12 2.25 69 SUBJ_ALL_CAPS 7454 3.28 4.06 3.09 70 XM_SPF_SoftFail 7378 2.18 4.02 1.73 71 BAYES_40 7281 5.14 3.97 5.43 72 TR_XM_RelayPhish 6988 1.79 3.81 1.30 73 RCVD_IN_BL_SPAMCOP_NET 6906 2.03 3.76 1.61 74 T_REMOTE_IMAGE 6723 3.52 3.66 3.49 75 BOTNET_NORDNS 6643 0.74 3.62 0.04 76 SpammyFromTLD_02 6532 0.95 3.56 0.31 77 TM2_M_VERY_LONG_WORD 6380 1.68 3.48 1.24 78 MultiRelay_CC 6152 0.81 3.35 0.18 79 MultiRelay_Combo 6152 0.81 3.35 0.18 80 XMStockSpam_06 6129 1.82 3.34 1.44 81 XM_URI_RBL 5942 0.82 3.24 0.22 82 BAYES_95 5933 1.86 3.23 1.52 83 HTML_SHORT_LINK_IMG_1 5907 0.66 3.22 0.03 84 RELAYCOUNTRY_GB 5676 1.38 3.09 0.96 85 BAYES_20 5617 4.07 3.06 4.31 86 RELAYCOUNTRY_CA 5561 1.82 3.03 1.53 87 T_XMHurry_00 5051 1.71 2.75 1.46 88 KHOP_HELO_FCRDNS 5019 1.82 2.74 1.60 89 XM_B_Unsub2 4929 1.75 2.69 1.52 90 XM_OfRef6 4927 1.54 2.69 1.25 91 T_TooManySym_01 4685 3.92 2.55 4.26 92 XM_CamelCaseFrm001 4652 2.23 2.54 2.15 93 RCVD_IN_IADB_LISTED 4564 5.44 2.49 6.16 94 XMSexyCombo_01 4543 0.77 2.48 0.35 95 XMPhish11 4517 1.21 2.46 0.91 96 XMBody_17 4467 1.18 2.43 0.87 97 XMDiploma_00 4439 1.58 2.42 1.37 98 RCVD_IN_IADB_SPF 4427 4.84 2.41 5.44 99 RCVD_IN_IADB_SENDERID 4366 4.38 2.38 4.87 100 RCVD_IN_IADB_DK 4365 4.30 2.38 4.77 101 BODY_URI_ONLY 4284 0.52 2.33 0.08 102 RELAYCOUNTRY_FR 4214 0.77 2.30 0.40 103 TR_XM_DK_Bayes 4199 13.62 2.29 16.41 104 XMSubMetaSxObfu_03 4122 0.89 2.25 0.56 105 RELAYCOUNTRY_AT 3999 0.75 2.18 0.40 106 TR_XM_DK_Bayes1 3892 13.08 2.12 15.77 107 TR_XM_INV_DKIM 3835 0.48 2.09 0.08 108 T_HTML_TAG_BALANCE_CENTER 3807 0.55 2.07 0.18 109 SpammyFromTLD_01 3727 1.01 2.03 0.76 110 LOW_PRICE 3722 1.02 2.03 0.78 111 NO_DNS_FOR_FROM 3619 1.09 1.97 0.87 112 XMGenDplmaNmb 3427 1.09 1.87 0.89 113 T_FILL_THIS_FORM_SHORT 3278 0.90 1.79 0.68 114 REPLYTO_WITHOUT_TO_CC 3248 0.38 1.77 0.04 115 HDRS_LCASE_IMGONLY 3247 0.38 1.77 0.03 116 T_XMDrugObfuBody_08 3218 1.77 1.75 1.77 117 HTML_IMAGE_ONLY_08 3215 0.42 1.75 0.10 118 HTML_IMAGE_ONLY_12 3131 0.45 1.71 0.15 119 TR_XM_PHPDW 3121 0.74 1.70 0.51 120 BAYES_05 3043 2.67 1.66 2.91 121 TR_XM_PHPForged 3039 0.72 1.66 0.50 122 TR_XM_FormFill2 3017 0.72 1.64 0.49 123 XM_H_PHPOS 3011 0.71 1.64 0.49 124 RELAYCOUNTRY_CN 3007 0.36 1.64 0.05 125 MIME_HEADER_CTYPE_ONLY 2931 0.36 1.60 0.05 126 PLING_QUERY 2913 0.68 1.59 0.46 127 RCVD_IN_RP_SAFE 2832 10.10 1.54 12.20 128 RDNS_DYNAMIC 2795 0.62 1.52 0.40 129 T_XMDrugObfuBody_00 2793 0.84 1.52 0.67 130 TR_Caps_n_Bayes_99 2740 0.32 1.49 0.03 131 TR_LOTS_OF_MONEY2 2723 1.89 1.48 2.00 132 T_MONEY_PERCENT 2723 1.89 1.48 2.00 133 XM_DK_Undo_01 2702 1.49 1.47 1.49 134 TR_LOTS_OF_MONEY3 2699 0.91 1.47 0.77 135 THIS_AD 2628 0.80 1.43 0.64 136 RCVD_IN_RP_RNBL 2599 0.35 1.42 0.09 137 FORM_FRAUD_5 2518 0.27 1.37 0.01 138 MAILING_LIST_MULTI 2483 1.88 1.35 2.01 139 XM_H_Long_From02 2470 1.34 1.35 1.34 140 URI_TRY_3LD 2456 1.65 1.34 1.73 141 XMBrknScrpt_02 2368 0.96 1.29 0.88 142 T_Symld_Words_02 2339 0.53 1.27 0.34 143 ADVANCE_FEE_4_NEW 2337 0.26 1.27 0.01 144 ALL_TRUSTED 2314 8.82 1.26 10.68 145 RCVD_IN_MSPIKE_BL 2300 1.17 1.25 1.15 146 XM_BadFromFormat 2285 0.31 1.25 0.08 147 TR_Mismatch_TLD_02 2278 0.31 1.24 0.08 148 RCVD_IN_MSPIKE_WL 2265 3.87 1.23 4.51 149 XMPhish14 2168 0.63 1.18 0.50 150 FROM_SUSPICIOUS_NTLD 2156 0.27 1.18 0.05 151 XMHTML_After_End 2128 1.25 1.16 1.27 152 XM_ProductURIs 2099 1.20 1.14 1.22 153 TR_XM_DK_Bayes2 2096 11.24 1.14 13.72 154 FROM_SUSPICIOUS_NTLD_FP 2088 0.26 1.14 0.05 155 RCVD_IN_RP_CERTIFIED 2086 9.14 1.14 11.10 156 XMPhish30 2080 0.60 1.13 0.47 157 FSL_THIS_IS_ADV 2052 0.44 1.12 0.27 158 RELAYCOUNTRY_SC 1974 0.22 1.08 0.00 159 XM_H_PHPMailer 1947 0.55 1.06 0.43 160 XMHTMLBadTable_001 1942 0.75 1.06 0.68 161 XM_B_COPY_HTML 1937 0.54 1.06 0.42 162 XMMoneyMeta_00 1899 0.52 1.04 0.40 163 US_DOLLARS_3 1878 0.53 1.02 0.40 164 DKIM_ADSP_NXDOMAIN 1857 0.38 1.01 0.22 165 RCVD_IN_MSPIKE_H3 1837 3.37 1.00 3.95 166 RCVD_IN_PSBL 1818 0.23 0.99 0.04 167 TO_EQ_FM_DOM_HTML_IMG 1794 0.20 0.98 0.01 168 UNPARSEABLE_RELAY 1769 1.58 0.96 1.74 169 TR_Symld_Words 1721 1.21 0.94 1.27 170 HTML_EXTRA_CLOSE 1715 0.19 0.93 0.01 171 FROM_MISSP_REPLYTO 1712 0.19 0.93 0.00 172 HTML_TAG_BALANCE_BODY 1697 0.69 0.92 0.63 173 XMSubMetaI_01 1627 0.26 0.89 0.11 174 XM_H_PHPOS_M 1619 0.30 0.88 0.16 175 SUBJ_DOLLARS 1613 0.77 0.88 0.74 176 T_TooManySym_02 1582 1.65 0.86 1.84 177 LONG_HEX_URI 1576 0.39 0.86 0.27 178 XM_XX_Yahoo 1547 0.29 0.84 0.15 179 XMSubMetaD_03 1542 0.27 0.84 0.13 180 LongTLD 1529 0.29 0.83 0.16 181 SHOPIFY_IMG_NOT_RCVD_SFY 1525 0.44 0.83 0.35 182 DKIM_ADSP_CUSTOM_MED 1500 0.92 0.82 0.94 183 RELAYCOUNTRY_DE 1416 0.37 0.77 0.27 184 XMBody_78 1410 0.62 0.77 0.58 185 URIBL_CSS 1391 0.61 0.76 0.57 186 URIBL_CSS_A 1391 0.61 0.76 0.57 187 TM2_M_A_HREF_HREF 1356 0.38 0.74 0.29 188 DIET_1 1346 0.52 0.73 0.47 189 FORGED_GMAIL_RCVD 1332 0.63 0.73 0.60 190 URI_NO_WWW_INFO_CGI 1332 0.22 0.73 0.10 191 DATE_IN_PAST_06_12 1332 0.22 0.73 0.09 192 XMUrgent 1326 0.30 0.72 0.20 193 XM_SPF_Unknown 1324 0.97 0.72 1.03 194 HTML_FONT_FACE_BAD 1260 0.59 0.69 0.56 195 XM_Nigeria_01 1255 0.16 0.68 0.04 196 TooManyTo_002 1244 1.35 0.68 1.51 197 URI_NOVOWEL 1216 0.60 0.66 0.58 198 XMClaimOffer 1213 0.22 0.66 0.11 199 XM_PDF 1199 3.03 0.65 3.61 200 RCVD_IN_MSPIKE_L5 1170 0.38 0.64 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 683483 92.38 95.99 91.50 2 DKIM_SIGNED 620328 83.56 85.68 83.04 3 XM_DK_Pass 612666 82.24 83.17 82.02 4 DKIM_VALID 588118 78.68 78.48 78.73 5 XM_B_Unicode 564923 76.70 81.09 75.63 6 XMListUnsubscribeExists 465258 64.73 74.71 62.28 7 DKIM_VALID_AU 437077 58.94 60.69 58.51 8 BAYES_50 410462 53.30 46.57 54.95 9 DCC_CHECK 387157 58.37 84.98 51.83 10 XM_B_Unicode3 351804 48.88 56.14 47.10 11 DCC_CHECK_NEGATIVE 345450 39.80 13.57 46.25 12 HTML_FONT_LOW_CONTRAST 240241 33.26 37.73 32.16 13 LOC_TINY_FONT_1 221150 31.47 39.04 29.61 14 T_TM2_M_HEADER_IN_MSG 188064 23.19 15.09 25.18 15 DKIM_VALID_EF 185194 23.89 20.23 24.79 16 FVGT_m_MULTI_ODD 171872 24.53 30.72 23.01 17 MIME_HTML_ONLY 158776 23.12 30.69 21.26 18 T_KAM_HTML_FONT_INVALID 145597 19.80 21.08 19.49 19 BAYES_00 145473 16.47 4.23 19.47 20 XMSubLong 143283 20.44 25.56 19.18 21 MultiRelay 137871 18.91 20.76 18.46 22 TR_XM_DK_Bayes 122565 13.62 2.29 16.41 23 TR_XM_DK_Bayes1 117833 13.08 2.12 15.77 24 XM_Body_Dirty_Words 106007 15.91 22.90 14.19 25 XM_Multi_Part_URI 103016 15.12 20.52 13.79 26 TR_XM_DK_Bayes2 102499 11.24 1.14 13.72 27 XM_Evil_Numbers_Gen 97533 13.57 15.66 13.06 28 RCVD_IN_RP_SAFE 91123 10.10 1.54 12.20 29 HTML_IMAGE_RATIO_02 86810 12.35 15.32 11.62 30 RCVD_IN_RP_CERTIFIED 82932 9.14 1.14 11.10 31 ALL_TRUSTED 79787 8.82 1.26 10.68 32 LotsOfNums_01 79093 10.40 9.64 10.59 33 XM_B_Unsub 76617 10.78 12.91 10.26 34 LOTS_OF_MONEY 67755 9.47 11.08 9.07 35 XM_DKIMWhitelistDomains 62790 6.77 0.12 8.41 36 XM_SendGrid 61078 8.24 8.48 8.18 37 RCVD_IN_MSPIKE_H2 60827 7.66 5.68 8.14 38 MIME_QP_LONG_LINE 57475 7.35 5.95 7.69 39 HTML_IMAGE_RATIO_04 56907 7.75 8.27 7.62 40 TooManyTo_001 54645 7.15 6.46 7.32 41 T_XMDrugObfuBody_14 53853 7.56 9.00 7.21 42 XM_DK_Undo_02 53182 13.66 40.31 7.12 43 XM_H_Long_From01 52957 7.13 7.27 7.09 44 XM_B_Phish_Phrases 48694 7.32 10.58 6.52 45 FSL_BULK_SIG 47170 7.71 13.40 6.31 46 RCVD_IN_IADB_LISTED 46029 5.44 2.49 6.16 47 RCVD_IN_IADB_SPF 40645 4.84 2.41 5.44 48 BAYES_40 40545 5.14 3.97 5.43 49 BAYES_60 40462 5.21 4.35 5.42 50 RELAYCOUNTRY_META 38874 7.74 18.04 5.20 51 BOTNET_IPINHOSTNAME 36739 7.77 19.40 4.92 52 RCVD_IN_IADB_SENDERID 36374 4.38 2.38 4.87 53 XMStrtUSub 35913 4.91 5.35 4.81 54 RCVD_IN_IADB_DK 35625 4.30 2.38 4.77 55 XMSexyCombo_05 33772 5.48 9.38 4.52 56 RCVD_IN_MSPIKE_WL 33717 3.87 1.23 4.51 57 FROM_EXCESS_BASE64 32386 4.43 4.82 4.34 58 BAYES_20 32221 4.07 3.06 4.31 59 DKIM_INVALID 32210 4.88 7.20 4.31 60 T_TooManySym_01 31804 3.92 2.55 4.26 61 MPART_ALT_DIFF 30693 5.10 9.14 4.11 62 RCVD_IN_MSPIKE_H3 29500 3.37 1.00 3.95 63 TR_XM_DK_SendGrid 29454 4.14 4.92 3.94 64 RCVD_IN_IADB_VOUCHED 27510 3.08 0.62 3.68 65 XM_PDF 26983 3.03 0.65 3.61 66 MIME_HTML_MOSTLY 26791 4.26 7.01 3.59 67 T_REMOTE_IMAGE 26056 3.52 3.66 3.49 68 HTML_IMAGE_RATIO_08 25843 3.60 4.16 3.46 69 HTML_IMAGE_RATIO_06 25707 3.60 4.25 3.44 70 XM_DIRTYINTL 24889 4.23 7.88 3.33 71 IN_ZIMBRA_NJ_WHITELIST 24541 2.64 0.01 3.29 72 XMNumbers 23621 3.58 5.29 3.16 73 SUBJ_ALL_CAPS 23061 3.28 4.06 3.09 74 BAYES_05 21767 2.67 1.66 2.91 75 BAYES_99 21658 7.60 26.76 2.90 76 XMSubMetaSx_00 21554 3.52 6.09 2.89 77 BAYES_80 20708 3.39 5.93 2.77 78 BOTNET 20326 6.20 20.39 2.72 79 XM_UncommonTLD01 19962 3.68 7.79 2.67 80 RCVD_IN_IADB_OPTIN 17304 1.96 0.51 2.32 81 BAYES_999 16923 6.01 21.24 2.27 82 URI_HEX 16829 2.62 4.12 2.25 83 XM_CamelCaseFrm001 16069 2.23 2.54 2.15 84 XMBdyGiftCard01 15794 2.53 4.21 2.11 85 MIME_HTML_ONLY_MULTI 15285 2.53 4.51 2.05 86 XMSubMetaI_00 15277 2.78 5.79 2.05 87 MAILING_LIST_MULTI 14997 1.88 1.35 2.01 88 TR_LOTS_OF_MONEY2 14905 1.89 1.48 2.00 89 T_MONEY_PERCENT 14905 1.89 1.48 2.00 90 TM2_M_URI_OPT_OUT 14836 2.44 4.27 1.99 91 UNTRUSTED_Relay 13886 3.63 10.86 1.86 92 T_TooManySym_02 13743 1.65 0.86 1.84 93 HTML_MIME_NO_HTML_TAG 13276 2.26 4.22 1.78 94 T_XMDrugObfuBody_08 13221 1.77 1.75 1.77 95 UNPARSEABLE_RELAY 12964 1.58 0.96 1.74 96 URI_TRY_3LD 12934 1.65 1.34 1.73 97 XM_SPF_SoftFail 12898 2.18 4.02 1.73 98 TR_DCC_Bayes_99 12587 5.82 22.64 1.69 99 XM_B_SpammyTLD 12490 2.26 4.65 1.67 100 RCVD_IN_BL_SPAMCOP_NET 11994 2.03 3.76 1.61 101 KHOP_HELO_FCRDNS 11933 1.82 2.74 1.60 102 RELAYCOUNTRY_CA 11405 1.82 3.03 1.53 103 XM_B_Unsub2 11386 1.75 2.69 1.52 104 BAYES_95 11343 1.86 3.23 1.52 105 TooManyTo_002 11298 1.35 0.68 1.51 106 XM_DK_Undo_01 11128 1.49 1.47 1.49 107 XM_RXBody 10962 1.24 0.31 1.47 108 IN_HORDE_ADDRESS_BOOK 10949 1.18 0.03 1.47 109 T_XMHurry_00 10887 1.71 2.75 1.46 110 XMStockSpam_06 10788 1.82 3.34 1.44 111 XMDiploma_00 10223 1.58 2.42 1.37 112 USER_IN_DEF_DKIM_WL 10158 1.09 0.01 1.36 113 XM_H_Long_From02 10042 1.34 1.35 1.34 114 ANY_BOUNCE_MESSAGE 9895 1.14 0.38 1.32 115 BOUNCE_MESSAGE 9892 1.14 0.38 1.32 116 TVD_RCVD_IP 9748 1.10 0.29 1.30 117 TR_XM_RelayPhish 9686 1.79 3.81 1.30 118 XMHTML_After_End 9502 1.25 1.16 1.27 119 TR_Symld_Words 9495 1.21 0.94 1.27 120 XM_OfRef6 9358 1.54 2.69 1.25 121 TM2_M_VERY_LONG_WORD 9276 1.68 3.48 1.24 122 XM_ProductURIs 9106 1.20 1.14 1.22 123 HELO_NODOT 8986 1.08 0.59 1.20 124 HELO_NO_DOMAIN 8984 1.08 0.59 1.20 125 RCVD_IN_MSPIKE_BL 8554 1.17 1.25 1.15 126 XMCapTrack 8033 0.91 0.25 1.08 127 TooManyTo_003 7785 0.95 0.57 1.04 128 XM_SPF_Unknown 7730 0.97 0.72 1.03 129 INVALID_MSGID 7661 0.85 0.12 1.03 130 CK_HELO_DYNAMIC_SPLIT_IP 7449 0.86 0.28 1.00 131 HELO_DYNAMIC_IPADDR2 7446 0.81 0.07 1.00 132 RELAYCOUNTRY_GB 7187 1.38 3.09 0.96 133 XM_GoogleGroups 7049 0.84 0.40 0.94 134 DKIM_ADSP_CUSTOM_MED 7030 0.92 0.82 0.94 135 XMPhish11 6786 1.21 2.46 0.91 136 TO_MALFORMED 6717 0.73 0.02 0.90 137 XMGenDplmaNmb 6670 1.09 1.87 0.89 138 XMBrknScrpt_02 6545 0.96 1.29 0.88 139 XMBody_17 6536 1.18 2.43 0.87 140 XMGappySubj_01 6502 0.79 0.47 0.87 141 NO_DNS_FOR_FROM 6493 1.09 1.97 0.87 142 XM_UB50 6197 1.81 5.81 0.83 143 TooManyTo_004 5974 0.74 0.50 0.80 144 LOW_PRICE 5804 1.02 2.03 0.78 145 TR_LOTS_OF_MONEY3 5786 0.91 1.47 0.77 146 SpammyFromTLD_01 5672 1.01 2.03 0.76 147 SUBJ_DOLLARS 5563 0.77 0.88 0.74 148 T_FILL_THIS_FORM_SHORT 5105 0.90 1.79 0.68 149 TooManyTo_005 5098 0.63 0.44 0.68 150 XMHTMLBadTable_001 5054 0.75 1.06 0.68 151 T_XMDrugObfuBody_00 5028 0.84 1.52 0.67 152 NML_ADSP_CUSTOM_MED 4876 0.64 0.58 0.65 153 THIS_AD 4814 0.80 1.43 0.64 154 HTML_TAG_BALANCE_BODY 4733 0.69 0.92 0.63 155 NUMERIC_HTTP_ADDR 4637 0.60 0.53 0.62 156 T_OBFU_PDF_ATTACH 4593 0.54 0.22 0.61 157 FORGED_GMAIL_RCVD 4492 0.63 0.73 0.60 158 URI_NOVOWEL 4359 0.60 0.66 0.58 159 XMBody_78 4354 0.62 0.77 0.58 160 URIBL_CSS_A 4290 0.61 0.76 0.57 161 URIBL_CSS 4290 0.61 0.76 0.57 162 XMSubMetaSxObfu_03 4201 0.89 2.25 0.56 163 TR_MetaPhish_Combo_01 4201 0.55 0.49 0.56 164 HTML_FONT_FACE_BAD 4201 0.59 0.69 0.56 165 XMAntiAgingB 4149 0.47 0.10 0.56 166 FROM_GOV_DKIM_AU 4069 0.46 0.09 0.54 167 RCVD_IN_MSPIKE_L3 3844 0.51 0.50 0.51 168 TR_XM_PHPDW 3797 0.74 1.70 0.51 169 XMPhish14 3720 0.63 1.18 0.50 170 RELAYCOUNTRY_AU 3702 0.48 0.43 0.50 171 TR_XM_PHPForged 3702 0.72 1.66 0.50 172 REMOVE_BEFORE_LINK 3689 0.51 0.57 0.49 173 TR_XM_FormFill2 3659 0.72 1.64 0.49 174 HTTPS_HTTP_MISMATCH 3648 0.50 0.55 0.49 175 XM_H_PHPOS 3637 0.71 1.64 0.49 176 DIET_1 3505 0.52 0.73 0.47 177 XMPhish30 3486 0.60 1.13 0.47 178 PLING_QUERY 3437 0.68 1.59 0.46 179 XM_ShortIntro_01 3350 0.40 0.22 0.45 180 XMBody_29 3336 0.42 0.32 0.45 181 XMOemUri 3258 0.39 0.21 0.44 182 XMLngstWrd_00 3241 0.40 0.26 0.43 183 XM_H_PHPMailer 3207 0.55 1.06 0.43 184 XMBSHREFv2 3127 0.46 0.62 0.42 185 XM_B_COPY_HTML 3104 0.54 1.06 0.42 186 US_DOLLARS_3 3023 0.53 1.02 0.40 187 XMSolicitRefs_0 3021 0.39 0.35 0.40 188 RELAYCOUNTRY_AT 2991 0.75 2.18 0.40 189 XMMoneyMeta_00 2976 0.52 1.04 0.40 190 RELAYCOUNTRY_FR 2967 0.77 2.30 0.40 191 XMLngstWrd_01 2967 0.37 0.25 0.40 192 RDNS_DYNAMIC 2954 0.62 1.52 0.40 193 TM2_M_BODY_EMPTY 2947 0.34 0.12 0.39 194 XMNoVowels 2931 0.38 0.34 0.39 195 FILL_THIS_FORM 2892 0.38 0.35 0.39 196 AC_DIV_BONANZA 2795 0.32 0.08 0.37 197 MISSING_HEADERS 2763 0.36 0.31 0.37 198 XM_Ancestry_Forge 2732 0.30 0.01 0.37 199 XM_B_REG_HTML 2658 0.38 0.47 0.36 200 T_TooManySym_03 2648 0.32 0.19 0.35 ----------------------------------------------------------------------