Email: 395434 Autolearn: 0 AvgScore: 1.38 AvgScanTime: 2.35 sec Spam: 80984 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 3.17 sec Ham: 314450 Autolearn: 0 AvgScore: -1.45 AvgScanTime: 2.14 sec Time Spent Running SA: 257.92 hours Time Spent Processing Spam: 71.27 hours Time Spent Processing Ham: 186.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77133 90.37 95.24 89.11 2 DCC_CHECK 65584 59.46 80.98 53.92 3 DKIM_SIGNED 62645 82.83 77.35 84.25 4 XM_DK_Pass 61153 81.65 75.51 83.23 5 XM_B_Unicode 57532 73.67 71.04 74.35 6 DKIM_VALID 57282 78.27 70.73 80.21 7 XMListUnsubscribeExists 55661 64.26 68.73 63.11 8 DKIM_VALID_AU 47798 63.50 59.02 64.65 9 BAYES_50 38984 53.55 48.14 54.95 10 XM_B_Unicode3 37829 47.44 46.71 47.63 11 HTML_FONT_LOW_CONTRAST 32533 35.05 40.17 33.73 12 LOC_TINY_FONT_1 31229 33.26 38.56 31.89 13 XM_DK_Undo_02 28628 13.59 35.35 7.98 14 MIME_HTML_ONLY 27812 25.75 34.34 23.53 15 FVGT_m_MULTI_ODD 21962 24.68 27.12 24.06 16 BAYES_99 20637 8.82 25.48 4.53 17 XMSubLong 19100 21.63 23.58 21.13 18 XM_Body_Dirty_Words 17714 18.41 21.87 17.52 19 BOTNET_IPINHOSTNAME 16927 9.41 20.90 6.45 20 DKIM_VALID_EF 16849 27.12 20.81 28.75 21 BOTNET 16586 6.34 20.48 2.70 22 XM_UncommonTLD01 16433 7.28 20.29 3.93 23 TR_DCC_Bayes_99 16396 5.56 20.25 1.78 24 BAYES_999 16360 7.14 20.20 3.78 25 RELAYCOUNTRY_META 16265 7.78 20.08 4.61 26 XM_Multi_Part_URI 15745 16.25 19.44 15.43 27 DCC_CHECK_NEGATIVE 14341 39.31 17.71 44.87 28 T_KAM_HTML_FONT_INVALID 14326 17.21 17.69 17.08 29 FSL_BULK_SIG 14002 9.89 17.29 7.99 30 HTML_IMAGE_RATIO_02 13718 12.52 16.94 11.38 31 MultiRelay 12536 16.14 15.48 16.31 32 T_TM2_M_HEADER_IN_MSG 12008 20.58 14.83 22.06 33 XM_B_Unsub 11835 12.42 14.61 11.85 34 SpammyFromTLD_02 11479 3.01 14.17 0.14 35 XM_Evil_Numbers_Gen 9861 11.63 12.18 11.49 36 XMSexyCombo_05 9162 7.11 11.31 6.03 37 LOTS_OF_MONEY 8719 10.54 10.77 10.48 38 UNTRUSTED_Relay 8717 3.73 10.76 1.92 39 TooManyTo_001 8616 6.79 10.64 5.80 40 XM_H_Long_From01 7567 7.55 9.34 7.09 41 XMSubMetaSx_00 7381 5.06 9.11 4.02 42 HTML_IMAGE_RATIO_04 7201 9.21 8.89 9.30 43 XMNumbers 6992 4.64 8.63 3.61 44 MPART_ALT_DIFF 6884 5.32 8.50 4.50 45 T_REMOTE_IMAGE 6622 4.61 8.18 3.69 46 T_XMDrugObfuBody_14 6564 8.26 8.11 8.30 47 XM_B_Phish_Phrases 6249 8.44 7.72 8.63 48 MIME_HTML_MOSTLY 6069 4.54 7.49 3.77 49 LotsOfNums_01 5546 8.35 6.85 8.74 50 REPLYTO_WITHOUT_TO_CC 5447 1.41 6.73 0.04 51 DKIM_INVALID 5363 4.56 6.62 4.03 52 XM_B_SpammyTLD 5143 3.58 6.35 2.87 53 BAYES_80 5106 3.51 6.30 2.79 54 HTML_SHORT_LINK_IMG_1 5101 1.31 6.30 0.02 55 XM_UB50 5078 1.97 6.27 0.86 56 HTML_IMAGE_ONLY_12 4905 1.33 6.06 0.11 57 URI_HEX 4883 3.12 6.03 2.37 58 MIME_HEADER_CTYPE_ONLY 4833 1.36 5.97 0.17 59 HDRS_LCASE_IMGONLY 4716 1.20 5.82 0.01 60 XM_DIRTYINTL 4711 4.30 5.82 3.91 61 TO_EQ_FM_DOM_HTML_IMG 4695 1.19 5.80 0.00 62 KHOP_HELO_FCRDNS 4414 2.20 5.45 1.36 63 FROM_EXCESS_BASE64 4238 4.60 5.23 4.44 64 BAYES_60 4117 5.42 5.08 5.51 65 FROM_SUSPICIOUS_NTLD 3980 1.04 4.91 0.05 66 FROM_SUSPICIOUS_NTLD_FP 3965 1.04 4.90 0.04 67 RELAYCOUNTRY_GB 3820 1.31 4.72 0.43 68 XM_SendGrid 3667 7.17 4.53 7.85 69 RCVD_IN_BL_SPAMCOP_NET 3624 1.68 4.47 0.96 70 MIME_QP_LONG_LINE 3538 4.84 4.37 4.96 71 HTML_MIME_NO_HTML_TAG 3534 2.12 4.36 1.54 72 RCVD_IN_MSPIKE_H2 3513 6.68 4.34 7.29 73 HTML_IMAGE_RATIO_06 3480 4.33 4.30 4.34 74 MIME_HTML_ONLY_MULTI 3462 2.66 4.27 2.24 75 BAYES_40 3433 5.08 4.24 5.30 76 XM_CamelCaseFrm001 3167 2.89 3.91 2.63 77 XMStrtUSub 3107 4.74 3.84 4.97 78 BAYES_95 2978 2.08 3.68 1.67 79 XMBdyGiftCard01 2871 2.80 3.55 2.61 80 RELAYCOUNTRY_CA 2700 1.99 3.33 1.64 81 BAYES_20 2557 3.75 3.16 3.90 82 RELAYCOUNTRY_FR 2537 1.19 3.13 0.69 83 XM_B_Unsub2 2428 2.78 3.00 2.72 84 XMDiploma_00 2354 1.76 2.91 1.47 85 NORDNS_LOW_CONTRAST 2319 0.59 2.86 0.01 86 T_TooManySym_01 2285 4.42 2.82 4.83 87 RDNS_DYNAMIC 2236 0.91 2.76 0.43 88 NO_DNS_FOR_FROM 2218 1.58 2.74 1.28 89 XM_URI_RBL 2162 0.92 2.67 0.47 90 TR_XM_DK_SendGrid 2127 4.44 2.63 4.91 91 TM2_M_URI_OPT_OUT 2057 1.70 2.54 1.49 92 XMSexyCombo_01 2044 1.10 2.52 0.73 93 TR_Mismatch_TLD_02 2043 0.55 2.52 0.05 94 XM_SPF_SoftFail 2037 1.75 2.52 1.56 95 RCVD_IN_RP_RNBL 1971 0.55 2.43 0.06 96 TR_XM_RelayPhish 1960 1.93 2.42 1.81 97 XMBrknScrpt_02 1960 1.08 2.42 0.74 98 TM2_M_VERY_LONG_WORD 1932 2.09 2.39 2.01 99 MultiRelay_Combo 1852 0.58 2.29 0.15 100 MultiRelay_CC 1852 0.58 2.29 0.15 101 T_XMDrugObfuBody_00 1849 1.09 2.28 0.79 102 XMSubMetaSSx_00 1831 0.62 2.26 0.19 103 XMBody_17 1814 1.00 2.24 0.69 104 DKIM_ADSP_NXDOMAIN 1785 0.83 2.20 0.48 105 XM_Palau_URI 1778 0.45 2.20 0.00 106 XMGenDplmaNmb 1774 1.07 2.19 0.78 107 SpammyFromTLD_01 1744 1.08 2.15 0.81 108 T_XMHurry_00 1741 1.00 2.15 0.71 109 TR_Symld_Words 1705 1.80 2.11 1.72 110 URI_TRY_3LD 1698 1.55 2.10 1.41 111 TR_XM_PHPDW 1698 0.82 2.10 0.49 112 TR_XM_PHPForged 1693 0.80 2.09 0.47 113 TR_XM_FormFill2 1671 0.79 2.06 0.46 114 XM_H_PHPOS 1670 0.79 2.06 0.46 115 HTML_IMAGE_RATIO_08 1662 2.05 2.05 2.05 116 DATE_IN_PAST_03_06 1638 0.57 2.02 0.19 117 FROM_MISSP_DYNIP 1620 0.41 2.00 0.00 118 TR_XM_INV_DKIM 1613 0.64 1.99 0.29 119 RCVD_IN_RP_SAFE 1560 13.21 1.93 16.11 120 TO_NO_BRKTS_FROM_MSSP 1550 0.40 1.91 0.01 121 XMSubMetaI_00 1495 1.25 1.85 1.10 122 BAYES_05 1466 2.28 1.81 2.40 123 ALL_TRUSTED 1464 8.85 1.81 10.66 124 RCVD_IN_MSPIKE_BL 1447 1.29 1.79 1.16 125 BAYES_00 1435 15.17 1.77 18.62 126 FROM_MISSP_REPLYTO 1426 0.36 1.76 0.00 127 T_MONEY_PERCENT 1419 0.85 1.75 0.62 128 TR_LOTS_OF_MONEY2 1419 0.85 1.75 0.62 129 BOTNET_NORDNS 1404 0.37 1.73 0.02 130 RELAYCOUNTRY_AT 1387 0.59 1.71 0.31 131 T_XMDrugObfuBody_08 1328 1.87 1.64 1.92 132 RCVD_IN_IADB_LISTED 1302 3.74 1.61 4.29 133 SUBJ_ALL_CAPS 1294 1.98 1.60 2.08 134 XMStockSpam_06 1275 1.77 1.57 1.82 135 XM_H_PHPMailer 1268 0.73 1.57 0.51 136 XM_OfRef6 1254 1.37 1.55 1.32 137 SUBJ_DOLLARS 1248 1.02 1.54 0.89 138 ANY_BOUNCE_MESSAGE 1205 2.37 1.49 2.60 139 BOUNCE_MESSAGE 1205 2.37 1.49 2.60 140 RCVD_IN_PSBL 1188 0.35 1.47 0.06 141 RCVD_IN_IADB_SPF 1164 3.24 1.44 3.71 142 RCVD_IN_IADB_SENDERID 1135 2.87 1.40 3.25 143 RCVD_IN_IADB_DK 1130 2.80 1.40 3.17 144 XM_ProductURIs 1115 1.66 1.38 1.73 145 RCVD_IN_MSPIKE_WL 1095 4.07 1.35 4.78 146 XM_H_PHPOS_M 1076 0.43 1.33 0.20 147 RCVD_IN_RP_CERTIFIED 1075 11.86 1.33 14.57 148 RCVD_IN_MSPIKE_L5 1054 0.43 1.30 0.21 149 XMSubGiftCard1 1048 0.34 1.29 0.10 150 RELAYCOUNTRY_DE 1024 0.46 1.26 0.26 151 XMSubGiftCard2 1010 0.27 1.25 0.02 152 LOW_PRICE 996 0.54 1.23 0.36 153 HK_RANDOM_REPLYTO 996 0.46 1.23 0.26 154 BASE64_LENGTH_79_INF 984 0.42 1.22 0.22 155 LONG_HEX_URI 963 0.35 1.19 0.14 156 RCVD_IN_MSPIKE_H3 953 3.36 1.18 3.93 157 XMSubMetaSxObfu_03 949 0.51 1.17 0.33 158 URIBL_DBL_ABUSE_REDIR 949 0.25 1.17 0.01 159 UNPARSEABLE_RELAY 934 2.94 1.15 3.40 160 XMGappySubj_01 918 1.16 1.13 1.17 161 XMPhish11 887 0.94 1.10 0.90 162 TM2_M_A_HREF_HREF 879 0.90 1.09 0.86 163 DIET_1 867 0.76 1.07 0.68 164 XMGppyBdWords 857 0.32 1.06 0.13 165 XM_B_COPY_HTML 830 0.77 1.02 0.71 166 XM_BadFromFormat 828 0.29 1.02 0.11 167 PLING_QUERY 823 1.03 1.02 1.04 168 TooManyTo_002 817 1.02 1.01 1.02 169 XMGappySubj_02 815 0.32 1.01 0.15 170 HTML_TAG_BALANCE_BODY 810 1.04 1.00 1.05 171 XMMoneyMeta_00 809 0.34 1.00 0.16 172 TR_XM_DK_Bayes 809 13.60 1.00 16.85 173 XM_H_Long_From02 791 1.39 0.98 1.50 174 XMPhish30 775 0.84 0.96 0.82 175 TVD_SPACE_RATIO_MINFP 767 0.20 0.95 0.00 176 SUBJ_OBFU_PUNCT_FEW 756 0.22 0.93 0.04 177 MAILING_LIST_MULTI 752 1.44 0.93 1.58 178 SUBJ_ILLEGAL_CHARS 742 0.20 0.92 0.02 179 SUBJECT_NEEDS_ENCODING 742 0.20 0.92 0.02 180 DKIM_ADSP_CUSTOM_MED 741 0.86 0.91 0.85 181 LOADSA_MONEY_COMBO 722 0.30 0.89 0.15 182 TR_LOTS_OF_MONEY3 718 0.50 0.89 0.40 183 XM_DK_Undo_01 707 1.11 0.87 1.17 184 TVD_SPACE_RATIO 705 0.39 0.87 0.26 185 XM_XX_Yahoo 705 0.28 0.87 0.12 186 TR_XM_DK_Bayes1 694 13.11 0.86 16.27 187 XMSlimDrugH 685 0.34 0.85 0.21 188 NML_ADSP_CUSTOM_MED 656 0.64 0.81 0.60 189 THIS_AD 655 0.29 0.81 0.16 190 T_TooManySym_02 653 2.03 0.81 2.35 191 TooManyTo_003 650 0.72 0.80 0.70 192 BODY_SINGLE_URI 646 0.17 0.80 0.01 193 BODY_SINGLE_WORD 646 0.18 0.80 0.02 194 XMHTMLBadTable_001 643 0.63 0.79 0.59 195 XMNoVowels 639 0.42 0.79 0.33 196 URIBL_DBL_SPAM 638 0.23 0.79 0.08 197 XM_UB99 631 0.17 0.78 0.01 198 TR_MetaPhish_Combo_01 630 0.72 0.78 0.71 199 XMSexyCombo_04 624 0.27 0.77 0.14 200 FORGED_GMAIL_RCVD 622 0.58 0.77 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 280201 90.37 95.24 89.11 2 DKIM_SIGNED 264910 82.83 77.35 84.25 3 XM_DK_Pass 261707 81.65 75.51 83.23 4 DKIM_VALID 252223 78.27 70.73 80.21 5 XM_B_Unicode 233784 73.67 71.04 74.35 6 DKIM_VALID_AU 203305 63.50 59.02 64.65 7 XMListUnsubscribeExists 198453 64.26 68.73 63.11 8 BAYES_50 172788 53.55 48.14 54.95 9 DCC_CHECK 169559 59.46 80.98 53.92 10 XM_B_Unicode3 149784 47.44 46.71 47.63 11 DCC_CHECK_NEGATIVE 141106 39.31 17.71 44.87 12 HTML_FONT_LOW_CONTRAST 106077 35.05 40.17 33.73 13 LOC_TINY_FONT_1 100287 33.26 38.56 31.89 14 DKIM_VALID_EF 90389 27.12 20.81 28.75 15 FVGT_m_MULTI_ODD 75647 24.68 27.12 24.06 16 MIME_HTML_ONLY 74005 25.75 34.34 23.53 17 T_TM2_M_HEADER_IN_MSG 69357 20.58 14.83 22.06 18 XMSubLong 66429 21.63 23.58 21.13 19 BAYES_00 58544 15.17 1.77 18.62 20 XM_Body_Dirty_Words 55076 18.41 21.87 17.52 21 T_KAM_HTML_FONT_INVALID 53715 17.21 17.69 17.08 22 TR_XM_DK_Bayes 52985 13.60 1.00 16.85 23 MultiRelay 51275 16.14 15.48 16.31 24 TR_XM_DK_Bayes1 51160 13.11 0.86 16.27 25 RCVD_IN_RP_SAFE 50658 13.21 1.93 16.11 26 XM_Multi_Part_URI 48512 16.25 19.44 15.43 27 TR_XM_DK_Bayes2 47195 12.07 0.64 15.01 28 RCVD_IN_RP_CERTIFIED 45828 11.86 1.33 14.57 29 XM_DKIMWhitelistDomains 37388 9.49 0.15 11.89 30 XM_B_Unsub 37277 12.42 14.61 11.85 31 XM_Evil_Numbers_Gen 36128 11.63 12.18 11.49 32 HTML_IMAGE_RATIO_02 35775 12.52 16.94 11.38 33 ALL_TRUSTED 33522 8.85 1.81 10.66 34 LOTS_OF_MONEY 32966 10.54 10.77 10.48 35 HTML_IMAGE_RATIO_04 29235 9.21 8.89 9.30 36 LotsOfNums_01 27490 8.35 6.85 8.74 37 XM_B_Phish_Phrases 27145 8.44 7.72 8.63 38 T_XMDrugObfuBody_14 26091 8.26 8.11 8.30 39 FSL_BULK_SIG 25111 9.89 17.29 7.99 40 XM_DK_Undo_02 25106 13.59 35.35 7.98 41 XM_SendGrid 24672 7.17 4.53 7.85 42 RCVD_IN_MSPIKE_H2 22910 6.68 4.34 7.29 43 XM_H_Long_From01 22283 7.55 9.34 7.09 44 BOTNET_IPINHOSTNAME 20268 9.41 20.90 6.45 45 XMSexyCombo_05 18951 7.11 11.31 6.03 46 TooManyTo_001 18249 6.79 10.64 5.80 47 BAYES_60 17313 5.42 5.08 5.51 48 BAYES_40 16666 5.08 4.24 5.30 49 XMStrtUSub 15636 4.74 3.84 4.97 50 MIME_QP_LONG_LINE 15582 4.84 4.37 4.96 51 TR_XM_DK_SendGrid 15443 4.44 2.63 4.91 52 T_TooManySym_01 15199 4.42 2.82 4.83 53 RCVD_IN_MSPIKE_WL 15015 4.07 1.35 4.78 54 RELAYCOUNTRY_META 14484 7.78 20.08 4.61 55 BAYES_99 14235 8.82 25.48 4.53 56 MPART_ALT_DIFF 14163 5.32 8.50 4.50 57 FROM_EXCESS_BASE64 13969 4.60 5.23 4.44 58 HTML_IMAGE_RATIO_06 13634 4.33 4.30 4.34 59 RCVD_IN_IADB_LISTED 13482 3.74 1.61 4.29 60 DKIM_INVALID 12687 4.56 6.62 4.03 61 XMSubMetaSx_00 12638 5.06 9.11 4.02 62 XM_UncommonTLD01 12358 7.28 20.29 3.93 63 RCVD_IN_MSPIKE_H3 12343 3.36 1.18 3.93 64 XM_DIRTYINTL 12309 4.30 5.82 3.91 65 BAYES_20 12268 3.75 3.16 3.90 66 BAYES_999 11879 7.14 20.20 3.78 67 MIME_HTML_MOSTLY 11868 4.54 7.49 3.77 68 RCVD_IN_IADB_SPF 11662 3.24 1.44 3.71 69 T_REMOTE_IMAGE 11591 4.61 8.18 3.69 70 XMNumbers 11358 4.64 8.63 3.61 71 UNPARSEABLE_RELAY 10696 2.94 1.15 3.40 72 IN_ZIMBRA_NJ_WHITELIST 10472 2.65 0.01 3.33 73 RCVD_IN_IADB_SENDERID 10205 2.87 1.40 3.25 74 TVD_RCVD_IP 10038 2.65 0.53 3.19 75 RCVD_IN_IADB_DK 9958 2.80 1.40 3.17 76 XM_B_SpammyTLD 9009 3.58 6.35 2.87 77 BAYES_80 8777 3.51 6.30 2.79 78 RCVD_IN_IADB_VOUCHED 8628 2.27 0.44 2.74 79 XM_B_Unsub2 8565 2.78 3.00 2.72 80 BOTNET 8502 6.34 20.48 2.70 81 XM_CamelCaseFrm001 8273 2.89 3.91 2.63 82 XMBdyGiftCard01 8205 2.80 3.55 2.61 83 ANY_BOUNCE_MESSAGE 8180 2.37 1.49 2.60 84 BOUNCE_MESSAGE 8178 2.37 1.49 2.60 85 CK_HELO_DYNAMIC_SPLIT_IP 8030 2.18 0.72 2.55 86 HELO_DYNAMIC_IPADDR2 8027 2.05 0.10 2.55 87 BAYES_05 7562 2.28 1.81 2.40 88 URI_HEX 7466 3.12 6.03 2.37 89 T_TooManySym_02 7388 2.03 0.81 2.35 90 INVALID_MSGID 7342 1.92 0.33 2.33 91 MIME_HTML_ONLY_MULTI 7041 2.66 4.27 2.24 92 XM_PDF 6661 1.75 0.32 2.12 93 TO_MALFORMED 6612 1.67 0.00 2.10 94 SUBJ_ALL_CAPS 6532 1.98 1.60 2.08 95 HTML_IMAGE_RATIO_08 6432 2.05 2.05 2.05 96 TM2_M_VERY_LONG_WORD 6321 2.09 2.39 2.01 97 T_XMDrugObfuBody_08 6047 1.87 1.64 1.92 98 UNTRUSTED_Relay 6027 3.73 10.76 1.92 99 XMStockSpam_06 5738 1.77 1.57 1.82 100 TR_XM_RelayPhish 5691 1.93 2.42 1.81 101 TR_DCC_Bayes_99 5606 5.56 20.25 1.78 102 RCVD_IN_IADB_OPTIN 5603 1.49 0.37 1.78 103 XM_ProductURIs 5450 1.66 1.38 1.73 104 USER_IN_DEF_DKIM_WL 5439 1.38 0.00 1.73 105 TR_Symld_Words 5414 1.80 2.11 1.72 106 BAYES_95 5253 2.08 3.68 1.67 107 IN_HORDE_ADDRESS_BOOK 5163 1.31 0.03 1.64 108 RELAYCOUNTRY_CA 5159 1.99 3.33 1.64 109 MAILING_LIST_MULTI 4955 1.44 0.93 1.58 110 XM_SPF_SoftFail 4901 1.75 2.52 1.56 111 HTML_MIME_NO_HTML_TAG 4840 2.12 4.36 1.54 112 XM_H_Long_From02 4718 1.39 0.98 1.50 113 TM2_M_URI_OPT_OUT 4682 1.70 2.54 1.49 114 XMDiploma_00 4624 1.76 2.91 1.47 115 URI_TRY_3LD 4420 1.55 2.10 1.41 116 KHOP_HELO_FCRDNS 4275 2.20 5.45 1.36 117 XM_OfRef6 4150 1.37 1.55 1.32 118 NO_DNS_FOR_FROM 4022 1.58 2.74 1.28 119 XM_RXBody 3765 1.06 0.54 1.20 120 XM_DK_Undo_01 3686 1.11 0.87 1.17 121 XMGappySubj_01 3679 1.16 1.13 1.17 122 RCVD_IN_MSPIKE_BL 3645 1.29 1.79 1.16 123 XMHTML_After_End 3529 1.04 0.74 1.12 124 XM_GoogleGroups 3513 0.97 0.40 1.12 125 XMSubMetaI_00 3448 1.25 1.85 1.10 126 HTML_TAG_BALANCE_BODY 3315 1.04 1.00 1.05 127 PLING_QUERY 3261 1.03 1.02 1.04 128 TooManyTo_002 3222 1.02 1.01 1.02 129 XMBody_95 3072 0.81 0.17 0.98 130 RCVD_IN_BL_SPAMCOP_NET 3015 1.68 4.47 0.96 131 XMPhish11 2829 0.94 1.10 0.90 132 SUBJ_DOLLARS 2788 1.02 1.54 0.89 133 XM_UB50 2707 1.97 6.27 0.86 134 TM2_M_A_HREF_HREF 2691 0.90 1.09 0.86 135 DKIM_ADSP_CUSTOM_MED 2668 0.86 0.91 0.85 136 USER_IN_WHITELIST 2639 0.67 0.00 0.84 137 XMPhish30 2566 0.84 0.96 0.82 138 SpammyFromTLD_01 2543 1.08 2.15 0.81 139 XM_B_REG_HTML 2515 0.70 0.33 0.80 140 T_XMDrugObfuBody_00 2477 1.09 2.28 0.79 141 HTML_FONT_FACE_BAD 2475 0.76 0.65 0.79 142 XMGenDplmaNmb 2453 1.07 2.19 0.78 143 XMBrknScrpt_02 2312 1.08 2.42 0.74 144 XMSexyCombo_01 2305 1.10 2.52 0.73 145 URI_NOVOWEL 2276 0.72 0.68 0.72 146 TR_MetaPhish_Combo_01 2236 0.72 0.78 0.71 147 T_XMHurry_00 2233 1.00 2.15 0.71 148 XM_B_COPY_HTML 2222 0.77 1.02 0.71 149 TooManyTo_003 2196 0.72 0.80 0.70 150 RELAYCOUNTRY_FR 2173 1.19 3.13 0.69 151 XMBody_17 2156 1.00 2.24 0.69 152 FSL_THIS_IS_ADV 2132 0.66 0.60 0.68 153 DIET_1 2131 0.76 1.07 0.68 154 XMBody_78 2078 0.65 0.61 0.66 155 T_TooManySym_03 1971 0.54 0.19 0.63 156 XMLngstWrd_00 1943 0.53 0.18 0.62 157 TR_LOTS_OF_MONEY2 1934 0.85 1.75 0.62 158 T_MONEY_PERCENT 1934 0.85 1.75 0.62 159 NML_ADSP_CUSTOM_MED 1873 0.64 0.81 0.60 160 XMLngstWrd_01 1853 0.50 0.15 0.59 161 XMHTMLBadTable_001 1850 0.63 0.79 0.59 162 T_Symld_Words_02 1836 0.62 0.76 0.58 163 TooManyTo_004 1799 0.59 0.68 0.57 164 FILL_THIS_FORM 1739 0.55 0.54 0.55 165 RCVD_IN_MSPIKE_H4 1737 0.47 0.14 0.55 166 XM_Body_Obfu01 1730 0.55 0.54 0.55 167 FORGED_GMAIL_RCVD 1665 0.58 0.77 0.53 168 RCVD_IN_MSPIKE_L3 1638 0.49 0.39 0.52 169 XMBSHREFv2 1632 0.47 0.26 0.52 170 XM_H_PHPMailer 1613 0.73 1.57 0.51 171 XMPhish14 1599 0.52 0.57 0.51 172 FROM_GOV_DKIM_AU 1598 0.41 0.04 0.51 173 XMSubMetaSxObfu_02 1586 0.48 0.40 0.50 174 TooManyTo_005 1584 0.52 0.57 0.50 175 FILL_THIS_FORM_LONG 1558 0.50 0.50 0.50 176 TR_XM_PHPDW 1547 0.82 2.10 0.49 177 T_FILL_THIS_FORM_LOAN 1531 0.41 0.10 0.49 178 DKIM_ADSP_NXDOMAIN 1510 0.83 2.20 0.48 179 XM_Combo_Sbj 1500 0.46 0.40 0.48 180 XMSolicitRefs_0 1497 0.44 0.29 0.48 181 XM_D_tchamptons_WL 1482 0.37 0.00 0.47 182 XM_URI_RBL 1474 0.92 2.67 0.47 183 TR_XM_PHPForged 1466 0.80 2.09 0.47 184 HELO_NODOT 1465 0.47 0.50 0.47 185 HELO_NO_DOMAIN 1464 0.47 0.50 0.47 186 XM_shorewaves_Whitelist 1459 0.37 0.00 0.46 187 TR_XM_FormFill2 1447 0.79 2.06 0.46 188 XM_H_PHPOS 1440 0.79 2.06 0.46 189 XMLngstWrd_02 1436 0.39 0.12 0.46 190 URI_NO_WWW_INFO_CGI 1415 0.51 0.74 0.45 191 T_FILL_THIS_FORM_SHORT 1405 0.46 0.51 0.45 192 XM_Walgreens_Forge 1400 0.36 0.01 0.45 193 RCVD_IN_MSPIKE_L4 1362 0.36 0.10 0.43 194 HTTPS_HTTP_MISMATCH 1356 0.45 0.52 0.43 195 RELAYCOUNTRY_GB 1352 1.31 4.72 0.43 196 RDNS_DYNAMIC 1351 0.91 2.76 0.43 197 XM_SPF_Unknown 1284 0.39 0.31 0.41 198 TR_LOTS_OF_MONEY3 1272 0.50 0.89 0.40 199 XMLngstWrd_03 1227 0.33 0.09 0.39 200 TR_Mismatch_TLD_01 1182 0.41 0.53 0.38 ----------------------------------------------------------------------