Email: 848216 Autolearn: 0 AvgScore: 2.03 AvgScanTime: 2.22 sec Spam: 143967 Autolearn: 0 AvgScore: 12.72 AvgScanTime: 2.85 sec Ham: 704249 Autolearn: 0 AvgScore: -0.15 AvgScanTime: 2.09 sec Time Spent Running SA: 522.52 hours Time Spent Processing Spam: 114.11 hours Time Spent Processing Ham: 408.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138461 92.29 96.18 91.50 2 DCC_CHECK 117867 44.85 81.87 37.28 3 DKIM_SIGNED 104677 66.17 72.71 64.83 4 XM_DK_Pass 101395 65.00 70.43 63.89 5 XM_B_Unicode 97796 60.86 67.93 59.42 6 DKIM_VALID 95117 61.93 66.07 61.08 7 XMListUnsubscribeExists 90198 49.52 62.65 46.84 8 DKIM_VALID_AU 76014 46.93 52.80 45.73 9 BAYES_50 62845 61.02 43.65 64.57 10 XM_B_Unicode3 61412 36.31 42.66 35.01 11 MIME_HTML_ONLY 55889 20.53 38.82 16.80 12 XM_DK_Undo_02 48406 10.25 33.62 5.47 13 LOC_TINY_FONT_1 48193 22.68 33.48 20.47 14 HTML_FONT_LOW_CONTRAST 47527 25.68 33.01 24.19 15 XMSubLong 34730 23.00 24.12 22.77 16 BAYES_99 34696 6.22 24.10 2.56 17 DKIM_VALID_EF 33415 22.24 23.21 22.04 18 FVGT_m_MULTI_ODD 33405 19.73 23.20 19.03 19 XM_Body_Dirty_Words 32062 14.09 22.27 12.42 20 XM_UncommonTLD01 31457 5.79 21.85 2.50 21 RELAYCOUNTRY_META 31172 7.45 21.65 4.54 22 BOTNET 30402 5.23 21.12 1.99 23 T_KAM_HTML_FONT_INVALID 29083 16.80 20.20 16.10 24 TR_DCC_Bayes_99 28967 4.38 20.12 1.16 25 XM_B_Unsub 27409 25.04 19.04 26.26 26 FSL_BULK_SIG 26876 7.42 18.67 5.12 27 BAYES_999 26176 4.78 18.18 2.04 28 XM_Multi_Part_URI 25749 11.74 17.89 10.49 29 BOTNET_IPINHOSTNAME 25490 6.91 17.71 4.70 30 DCC_CHECK_NEGATIVE 23571 53.45 16.37 61.02 31 MultiRelay 22680 15.08 15.75 14.94 32 HTML_IMAGE_RATIO_02 22288 9.17 15.48 7.88 33 T_TM2_M_HEADER_IN_MSG 20571 22.74 14.29 24.47 34 UNTRUSTED_Relay 20319 3.56 14.11 1.40 35 TooManyTo_001 19032 9.24 13.22 8.43 36 XM_Evil_Numbers_Gen 17788 8.98 12.36 8.28 37 XMSexyCombo_05 16767 4.84 11.65 3.44 38 LOTS_OF_MONEY 15506 7.95 10.77 7.37 39 XMNumbers 15006 4.06 10.42 2.75 40 FROM_SUSPICIOUS_NTLD 14247 1.73 9.90 0.06 41 FROM_SUSPICIOUS_NTLD_FP 14160 1.71 9.84 0.05 42 T_REMOTE_IMAGE 14078 4.20 9.78 3.06 43 MPART_ALT_DIFF 13027 4.27 9.05 3.29 44 XMSubMetaSx_00 12969 4.42 9.01 3.48 45 XM_H_Long_From01 12261 6.04 8.52 5.54 46 T_XMDrugObfuBody_14 11991 7.49 8.33 7.32 47 HTML_MIME_NO_HTML_TAG 11576 2.72 8.04 1.63 48 RCVD_IN_BL_SPAMCOP_NET 10908 2.05 7.58 0.92 49 SpammyFromTLD_02 10707 1.47 7.44 0.25 50 BAYES_80 10405 2.79 7.23 1.89 51 XM_UB50 10281 1.86 7.14 0.78 52 LotsOfNums_01 10122 7.26 7.03 7.31 53 XM_B_Phish_Phrases 9723 6.80 6.75 6.81 54 KHOP_HELO_FCRDNS 9602 2.57 6.67 1.73 55 DKIM_INVALID 9560 4.24 6.64 3.76 56 HTML_IMAGE_RATIO_04 9548 20.46 6.63 23.28 57 HTML_SHORT_LINK_IMG_1 9526 1.14 6.62 0.02 58 MIME_HEADER_CTYPE_ONLY 9469 1.19 6.58 0.09 59 BAYES_60 9048 4.49 6.28 4.13 60 HDRS_LCASE_IMGONLY 8281 1.00 5.75 0.02 61 XM_DIRTYINTL 8189 3.05 5.69 2.51 62 XM_B_Unsub2 8051 17.49 5.59 19.92 63 MIME_HTML_MOSTLY 7862 2.92 5.46 2.40 64 URI_HEX 7690 2.18 5.34 1.53 65 RCVD_IN_MSPIKE_H2 7660 6.15 5.32 6.32 66 XM_B_SpammyTLD 7449 2.96 5.17 2.51 67 BAYES_40 7076 4.86 4.92 4.85 68 MIME_QP_LONG_LINE 6982 5.54 4.85 5.68 69 MIME_HTML_ONLY_MULTI 6742 2.22 4.68 1.72 70 XMStrtUSub 6679 4.26 4.64 4.19 71 DKIM_ADSP_NXDOMAIN 6659 1.02 4.63 0.29 72 RDNS_DYNAMIC 6436 1.00 4.47 0.29 73 HTML_IMAGE_RATIO_06 6238 3.35 4.33 3.15 74 FROM_EXCESS_BASE64 6163 3.20 4.28 2.98 75 BAYES_95 6151 1.68 4.27 1.15 76 TR_Mismatch_TLD_02 5989 0.75 4.16 0.05 77 BODY_URI_ONLY 5668 0.71 3.94 0.05 78 T_HTML_TAG_BALANCE_CENTER 5649 0.81 3.92 0.17 79 XM_SendGrid 5636 4.97 3.91 5.19 80 BAYES_20 5563 3.69 3.86 3.65 81 ALL_TRUSTED 5265 24.65 3.66 28.94 82 TM2_M_URI_OPT_OUT 5245 2.44 3.64 2.20 83 XM_SPF_SoftFail 5114 2.00 3.55 1.68 84 DATE_IN_PAST_06_12 5102 0.65 3.54 0.06 85 HTML_IMAGE_ONLY_12 5086 0.71 3.53 0.13 86 HTML_IMAGE_ONLY_08 4977 0.66 3.46 0.08 87 REPLYTO_WITHOUT_TO_CC 4950 0.61 3.44 0.04 88 RELAYCOUNTRY_CA 4826 1.74 3.35 1.41 89 XM_Palau_URI 4739 0.56 3.29 0.00 90 DATE_IN_PAST_24_48 4721 0.57 3.28 0.01 91 XMDiploma_00 4557 1.83 3.17 1.55 92 XM_URI_RBL 4524 0.73 3.14 0.24 93 XMSexyCombo_01 4515 1.01 3.14 0.57 94 T_TooManySym_01 4307 3.68 2.99 3.82 95 BAYES_00 4291 12.66 2.98 14.64 96 TO_EQ_FM_DOM_HTML_IMG 4117 0.49 2.86 0.01 97 TooManyTo_002 3992 1.85 2.77 1.67 98 RCVD_IN_RP_RNBL 3978 0.51 2.76 0.04 99 XM_CamelCaseFrm001 3895 2.07 2.71 1.94 100 RELAYCOUNTRY_GB 3795 1.12 2.64 0.80 101 T_XMDrugObfuBody_08 3681 1.68 2.56 1.50 102 BAYES_05 3601 2.36 2.50 2.33 103 RELAYCOUNTRY_FR 3463 0.64 2.41 0.28 104 HTML_IMAGE_ONLY_16 3426 0.58 2.38 0.21 105 RCVD_IN_MSPIKE_BL 3403 1.34 2.36 1.12 106 XM_BadFromFormat 3352 0.46 2.33 0.07 107 SpammyFromTLD_01 3346 0.93 2.32 0.64 108 TooManyTo_003 3341 1.32 2.32 1.12 109 XMBdyGiftCard01 3309 1.41 2.30 1.23 110 NO_DNS_FOR_FROM 3254 1.08 2.26 0.84 111 MISSING_HEADERS 3238 0.70 2.25 0.39 112 LongTLD 3207 0.51 2.23 0.16 113 MultiRelay_Combo 3192 0.52 2.22 0.17 114 MultiRelay_CC 3192 0.52 2.22 0.17 115 RCVD_IN_PSBL 3187 0.40 2.21 0.03 116 FROM_MISSP_REPLYTO 3158 0.37 2.19 0.00 117 XMGenDplmaNmb 3135 1.22 2.18 1.02 118 TR_XM_DK_SendGrid 3081 2.78 2.14 2.91 119 HTML_IMAGE_RATIO_08 3064 1.76 2.13 1.69 120 XMStockSpam_06 2960 1.26 2.06 1.09 121 TM2_M_VERY_LONG_WORD 2950 1.32 2.05 1.17 122 RELAYCOUNTRY_NL 2945 0.49 2.05 0.17 123 BOTNET_NORDNS 2859 0.36 1.99 0.02 124 XM_OfRef6 2858 1.82 1.99 1.79 125 RCVD_IN_IADB_LISTED 2800 4.10 1.94 4.54 126 T_MONEY_PERCENT 2755 0.54 1.91 0.26 127 TR_LOTS_OF_MONEY2 2755 0.54 1.91 0.26 128 RELAYCOUNTRY_PL 2725 0.34 1.89 0.02 129 AMAZON_IMG_NOT_RCVD_AMZN 2690 0.35 1.87 0.04 130 RCVD_IN_MSPIKE_L5 2652 0.49 1.84 0.22 131 RCVD_IN_RP_SAFE 2644 7.91 1.84 9.16 132 XM_DrugUnitList 2642 0.31 1.84 0.00 133 HOSTED_IMG_MULTI 2637 0.31 1.83 0.00 134 XMHTML_After_End 2610 1.34 1.81 1.24 135 RCVD_IN_IADB_SPF 2573 3.62 1.79 4.00 136 HELO_DYNAMIC_IPADDR 2570 0.31 1.79 0.01 137 TooManyTo_004 2565 0.94 1.78 0.77 138 RCVD_IN_IADB_DK 2503 3.20 1.74 3.50 139 RCVD_IN_IADB_SENDERID 2498 3.25 1.74 3.56 140 T_XMHurry_00 2451 1.46 1.70 1.41 141 HDRS_MISSP 2420 0.29 1.68 0.00 142 URI_TRY_3LD 2399 1.40 1.67 1.35 143 TR_XM_PHPDW 2386 1.02 1.66 0.90 144 SUBJ_ALL_CAPS 2377 1.46 1.65 1.42 145 XMBody_17 2371 0.79 1.65 0.61 146 TR_XM_PHPForged 2331 1.01 1.62 0.88 147 TR_XM_FormFill2 2316 1.00 1.61 0.88 148 XMSexyCombo_04 2312 0.44 1.61 0.20 149 XM_H_PHPOS 2311 1.00 1.61 0.88 150 HOSTED_IMG_DIRECT_MX 2309 0.27 1.60 0.00 151 FROM_MISSP_DYNIP 2288 0.27 1.59 0.00 152 TR_XM_RelayPhish 2260 0.97 1.57 0.85 153 XMSubMetaI_00 2238 0.86 1.55 0.71 154 TR_XM_INV_DKIM 2199 0.32 1.53 0.07 155 RELAYCOUNTRY_DE 2056 0.54 1.43 0.36 156 SHORT_IMG_SUSP_NTLD 1984 0.23 1.38 0.00 157 XM_DK_Undo_01 1881 1.26 1.31 1.25 158 RCVD_IN_RP_CERTIFIED 1827 6.98 1.27 8.15 159 RCVD_IN_MSPIKE_WL 1826 2.98 1.27 3.33 160 TooManyTo_005 1818 0.74 1.26 0.64 161 XM_ProductURIs 1801 1.08 1.25 1.05 162 XMPhish11 1737 1.01 1.21 0.96 163 XMBrknScrpt_02 1717 0.68 1.19 0.57 164 TR_Symld_Words 1686 1.08 1.17 1.07 165 TR_XM_DK_Bayes 1659 10.15 1.15 11.98 166 RCVD_IN_MSPIKE_H3 1608 2.68 1.12 3.00 167 XM_UB60 1597 0.25 1.11 0.07 168 T_XMDrugObfuBody_00 1589 1.17 1.10 1.19 169 MAILING_LIST_MULTI 1578 1.93 1.10 2.10 170 HK_RANDOM_FROM 1574 0.27 1.09 0.10 171 XMGppyBdWords 1535 0.41 1.07 0.27 172 DIET_1 1511 0.55 1.05 0.45 173 XMSubMetaSSx_00 1504 0.31 1.04 0.16 174 TR_LOTS_OF_MONEY3 1493 0.50 1.04 0.39 175 XM_H_Long_From02 1484 1.10 1.03 1.11 176 RELAYCOUNTRY_IE 1467 0.31 1.02 0.17 177 TR_XM_DK_Bayes1 1452 9.66 1.01 11.43 178 THIS_AD 1397 0.55 0.97 0.46 179 RELAYCOUNTRY_AT 1367 0.35 0.95 0.22 180 XMPhish14 1366 0.51 0.95 0.42 181 XM_H_PHPMailer 1358 0.48 0.94 0.38 182 XMSubMetaSxObfu_03 1340 0.91 0.93 0.91 183 UNPARSEABLE_RELAY 1302 1.66 0.90 1.81 184 XMMoneyMeta_00 1286 0.56 0.89 0.49 185 NUMERIC_HTTP_ADDR 1277 0.33 0.89 0.22 186 FSL_THIS_IS_ADV 1276 0.27 0.89 0.15 187 DKIM_ADSP_CUSTOM_MED 1256 0.83 0.87 0.83 188 HK_RANDOM_REPLYTO 1253 0.34 0.87 0.23 189 TO_NO_BRKTS_DYNIP 1242 0.15 0.86 0.01 190 XMPhish30 1237 0.52 0.86 0.45 191 XMBody_78 1236 0.56 0.86 0.49 192 T_TooManySym_02 1226 1.51 0.85 1.65 193 TM2_M_A_HREF_HREF 1225 0.43 0.85 0.34 194 HK_SCAM 1216 0.16 0.84 0.02 195 MPART_ALT_DIFF_COUNT 1209 0.33 0.84 0.22 196 DATE_IN_PAST_03_06 1207 0.24 0.84 0.12 197 RELAYCOUNTRY_IN 1183 0.21 0.82 0.09 198 TO_NO_BRKTS_FROM_MSSP 1156 0.15 0.80 0.01 199 FORGED_GMAIL_RCVD 1148 0.54 0.80 0.49 200 LOW_PRICE 1146 0.31 0.80 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 644353 92.29 96.18 91.50 2 DKIM_SIGNED 456596 66.17 72.71 64.83 3 BAYES_50 454747 61.02 43.65 64.57 4 XM_DK_Pass 449946 65.00 70.43 63.89 5 DKIM_VALID 430151 61.93 66.07 61.08 6 DCC_CHECK_NEGATIVE 429760 53.45 16.37 61.02 7 XM_B_Unicode 418438 60.86 67.93 59.42 8 XMListUnsubscribeExists 329868 49.52 62.65 46.84 9 DKIM_VALID_AU 322083 46.93 52.80 45.73 10 DCC_CHECK 262574 44.85 81.87 37.28 11 XM_B_Unicode3 246552 36.31 42.66 35.01 12 ALL_TRUSTED 203783 24.65 3.66 28.94 13 XM_B_Unsub 184960 25.04 19.04 26.26 14 T_TM2_M_HEADER_IN_MSG 172345 22.74 14.29 24.47 15 HTML_FONT_LOW_CONTRAST 170331 25.68 33.01 24.19 16 HTML_IMAGE_RATIO_04 163965 20.46 6.63 23.28 17 XMSubLong 160328 23.00 24.12 22.77 18 DKIM_VALID_EF 155197 22.24 23.21 22.04 19 LOC_TINY_FONT_1 144180 22.68 33.48 20.47 20 XM_B_Unsub2 140286 17.49 5.59 19.92 21 FVGT_m_MULTI_ODD 133985 19.73 23.20 19.03 22 MIME_HTML_ONLY 118279 20.53 38.82 16.80 23 T_KAM_HTML_FONT_INVALID 113382 16.80 20.20 16.10 24 MultiRelay 105203 15.08 15.75 14.94 25 BAYES_00 103100 12.66 2.98 14.64 26 XM_Body_Dirty_Words 87458 14.09 22.27 12.42 27 TR_XM_DK_Bayes 84399 10.15 1.15 11.98 28 TR_XM_DK_Bayes1 80518 9.66 1.01 11.43 29 XM_Multi_Part_URI 73845 11.74 17.89 10.49 30 TR_XM_DK_Bayes2 69278 8.30 0.76 9.84 31 RCVD_IN_RP_SAFE 64485 7.91 1.84 9.16 32 TooManyTo_001 59341 9.24 13.22 8.43 33 XM_Evil_Numbers_Gen 58345 8.98 12.36 8.28 34 RCVD_IN_RP_CERTIFIED 57391 6.98 1.27 8.15 35 HTML_IMAGE_RATIO_02 55466 9.17 15.48 7.88 36 LOTS_OF_MONEY 51914 7.95 10.77 7.37 37 T_XMDrugObfuBody_14 51555 7.49 8.33 7.32 38 LotsOfNums_01 51451 7.26 7.03 7.31 39 XM_B_Phish_Phrases 47938 6.80 6.75 6.81 40 XM_DKIMWhitelistDomains 46082 5.45 0.08 6.54 41 RCVD_IN_MSPIKE_H2 44518 6.15 5.32 6.32 42 MIME_QP_LONG_LINE 40030 5.54 4.85 5.68 43 XM_H_Long_From01 38982 6.04 8.52 5.54 44 XM_DK_Undo_02 38554 10.25 33.62 5.47 45 XM_SendGrid 36517 4.97 3.91 5.19 46 FSL_BULK_SIG 36087 7.42 18.67 5.12 47 BAYES_40 34149 4.86 4.92 4.85 48 BOTNET_IPINHOSTNAME 33106 6.91 17.71 4.70 49 RELAYCOUNTRY_META 32001 7.45 21.65 4.54 50 RCVD_IN_IADB_LISTED 31943 4.10 1.94 4.54 51 XMStrtUSub 29483 4.26 4.64 4.19 52 BAYES_60 29063 4.49 6.28 4.13 53 RCVD_IN_IADB_SPF 28172 3.62 1.79 4.00 54 T_TooManySym_01 26936 3.68 2.99 3.82 55 DKIM_INVALID 26445 4.24 6.64 3.76 56 BAYES_20 25706 3.69 3.86 3.65 57 RCVD_IN_IADB_SENDERID 25105 3.25 1.74 3.56 58 RCVD_IN_IADB_DK 24624 3.20 1.74 3.50 59 XMSubMetaSx_00 24521 4.42 9.01 3.48 60 XMSexyCombo_05 24249 4.84 11.65 3.44 61 RCVD_IN_MSPIKE_WL 23426 2.98 1.27 3.33 62 MPART_ALT_DIFF 23162 4.27 9.05 3.29 63 XM_PDF 22687 2.78 0.62 3.22 64 HTML_IMAGE_RATIO_06 22199 3.35 4.33 3.15 65 T_REMOTE_IMAGE 21536 4.20 9.78 3.06 66 RCVD_IN_MSPIKE_H3 21135 2.68 1.12 3.00 67 FROM_EXCESS_BASE64 21003 3.20 4.28 2.98 68 TR_XM_DK_SendGrid 20516 2.78 2.14 2.91 69 IN_ZIMBRA_NJ_WHITELIST 19914 2.35 0.02 2.83 70 RCVD_IN_IADB_VOUCHED 19821 2.45 0.69 2.81 71 XMNumbers 19402 4.06 10.42 2.75 72 BAYES_99 18035 6.22 24.10 2.56 73 XM_DIRTYINTL 17706 3.05 5.69 2.51 74 XM_B_SpammyTLD 17664 2.96 5.17 2.51 75 XM_UncommonTLD01 17625 5.79 21.85 2.50 76 MIME_HTML_MOSTLY 16914 2.92 5.46 2.40 77 BAYES_05 16394 2.36 2.50 2.33 78 TM2_M_URI_OPT_OUT 15467 2.44 3.64 2.20 79 MAILING_LIST_MULTI 14797 1.93 1.10 2.10 80 BAYES_999 14400 4.78 18.18 2.04 81 BOTNET 14000 5.23 21.12 1.99 82 XM_CamelCaseFrm001 13654 2.07 2.71 1.94 83 BAYES_80 13282 2.79 7.23 1.89 84 UNPARSEABLE_RELAY 12774 1.66 0.90 1.81 85 XM_OfRef6 12585 1.82 1.99 1.79 86 RCVD_IN_IADB_OPTIN 12512 1.55 0.47 1.78 87 KHOP_HELO_FCRDNS 12173 2.57 6.67 1.73 88 MIME_HTML_ONLY_MULTI 12085 2.22 4.68 1.72 89 HTML_IMAGE_RATIO_08 11886 1.76 2.13 1.69 90 XM_SPF_SoftFail 11834 2.00 3.55 1.68 91 TooManyTo_002 11727 1.85 2.77 1.67 92 T_TooManySym_02 11598 1.51 0.85 1.65 93 HTML_MIME_NO_HTML_TAG 11461 2.72 8.04 1.63 94 XMDiploma_00 10925 1.83 3.17 1.55 95 URI_HEX 10807 2.18 5.34 1.53 96 ANY_BOUNCE_MESSAGE 10721 1.39 0.75 1.52 97 BOUNCE_MESSAGE 10719 1.39 0.75 1.52 98 T_XMDrugObfuBody_08 10545 1.68 2.56 1.50 99 TVD_RCVD_IP 10399 1.32 0.53 1.48 100 SUBJ_ALL_CAPS 10014 1.46 1.65 1.42 101 RELAYCOUNTRY_CA 9926 1.74 3.35 1.41 102 T_XMHurry_00 9905 1.46 1.70 1.41 103 UNTRUSTED_Relay 9865 3.56 14.11 1.40 104 URI_TRY_3LD 9475 1.40 1.67 1.35 105 XM_DK_Undo_01 8801 1.26 1.31 1.25 106 XMHTML_After_End 8763 1.34 1.81 1.24 107 XMBdyGiftCard01 8689 1.41 2.30 1.23 108 IN_HORDE_ADDRESS_BOOK 8551 1.01 0.02 1.21 109 T_XMDrugObfuBody_00 8362 1.17 1.10 1.19 110 HELO_NODOT 8302 1.06 0.47 1.18 111 HELO_NO_DOMAIN 8299 1.06 0.46 1.18 112 TM2_M_VERY_LONG_WORD 8227 1.32 2.05 1.17 113 TR_DCC_Bayes_99 8188 4.38 20.12 1.16 114 BAYES_95 8065 1.68 4.27 1.15 115 RCVD_IN_MSPIKE_BL 7922 1.34 2.36 1.12 116 TooManyTo_003 7875 1.32 2.32 1.12 117 XM_H_Long_From02 7850 1.10 1.03 1.11 118 XMStockSpam_06 7709 1.26 2.06 1.09 119 INVALID_MSGID 7506 0.92 0.19 1.07 120 CK_HELO_DYNAMIC_SPLIT_IP 7502 0.95 0.36 1.07 121 TR_Symld_Words 7501 1.08 1.17 1.07 122 HELO_DYNAMIC_IPADDR2 7499 0.90 0.08 1.06 123 XM_ProductURIs 7367 1.08 1.25 1.05 124 XMGenDplmaNmb 7215 1.22 2.18 1.02 125 XMCapTrack 6871 0.86 0.28 0.98 126 XMPhish11 6796 1.01 1.21 0.96 127 TO_MALFORMED 6607 0.80 0.15 0.94 128 RCVD_IN_BL_SPAMCOP_NET 6497 2.05 7.58 0.92 129 XMSubMetaSxObfu_03 6418 0.91 0.93 0.91 130 TR_XM_PHPDW 6306 1.02 1.66 0.90 131 TR_XM_PHPForged 6200 1.01 1.62 0.88 132 TR_XM_FormFill2 6177 1.00 1.61 0.88 133 XM_H_PHPOS 6165 1.00 1.61 0.88 134 XM_GoogleGroups 6012 0.78 0.41 0.85 135 XM_SPF_Unknown 6011 0.80 0.54 0.85 136 TR_XM_RelayPhish 5962 0.97 1.57 0.85 137 NO_DNS_FOR_FROM 5922 1.08 2.26 0.84 138 TR_MetaPhish_Combo_01 5913 0.79 0.54 0.84 139 DKIM_ADSP_CUSTOM_MED 5814 0.83 0.87 0.83 140 RELAYCOUNTRY_GB 5669 1.12 2.64 0.80 141 XM_UB50 5515 1.86 7.14 0.78 142 TooManyTo_004 5409 0.94 1.78 0.77 143 USER_IN_DEF_DKIM_WL 5375 0.63 0.00 0.76 144 XM_OfRef7 5348 0.70 0.41 0.76 145 XMGappySubj_01 5233 0.68 0.38 0.74 146 XMSubMetaI_00 5027 0.86 1.55 0.71 147 XM_RXBody 4796 0.63 0.35 0.68 148 XM_Nigeria_01 4718 0.61 0.30 0.67 149 XM_OfRef8 4603 0.56 0.10 0.65 150 XM_GRM 4573 0.54 0.00 0.65 151 SpammyFromTLD_01 4523 0.93 2.32 0.64 152 TooManyTo_005 4491 0.74 1.26 0.64 153 XMBody_17 4314 0.79 1.65 0.61 154 NML_ADSP_CUSTOM_MED 4264 0.63 0.76 0.61 155 T_FILL_THIS_FORM_SHORT 4153 0.61 0.70 0.59 156 TO_NO_BRKTS_HTML_ONLY 4081 0.51 0.16 0.58 157 XMSexyCombo_01 4046 1.01 3.14 0.57 158 PLING_QUERY 4039 0.57 0.57 0.57 159 XMBrknScrpt_02 4017 0.68 1.19 0.57 160 HTML_TAG_BALANCE_BODY 3967 0.55 0.49 0.56 161 FROM_GOV_DKIM_AU 3855 0.48 0.14 0.55 162 XM_B_REG_HTML 3819 0.49 0.25 0.54 163 XMHTMLBadTable_001 3702 0.53 0.55 0.53 164 XMBody_95 3660 0.46 0.18 0.52 165 XMLngstWrd_00 3628 0.53 0.57 0.52 166 T_Symld_Words_02 3552 0.54 0.73 0.50 167 XMBody_78 3482 0.56 0.86 0.49 168 XMMoneyMeta_00 3458 0.56 0.89 0.49 169 XMLngstWrd_01 3437 0.49 0.50 0.49 170 FORGED_GMAIL_RCVD 3420 0.54 0.80 0.49 171 SUBJ_DOLLARS 3359 0.51 0.68 0.48 172 HTML_FONT_FACE_BAD 3329 0.52 0.74 0.47 173 RCVD_IN_MSPIKE_L4 3272 0.43 0.28 0.46 174 THIS_AD 3268 0.55 0.97 0.46 175 HTTPS_HTTP_MISMATCH 3241 0.48 0.56 0.46 176 XM_ShortIntro_01 3205 0.42 0.25 0.46 177 XMPhish30 3186 0.52 0.86 0.45 178 DIET_1 3135 0.55 1.05 0.45 179 RCVD_IN_MSPIKE_L3 3126 0.41 0.24 0.44 180 T_OBFU_PDF_ATTACH 3125 0.40 0.19 0.44 181 RELAYCOUNTRY_AU 3051 0.43 0.41 0.43 182 URI_NOVOWEL 3040 0.45 0.55 0.43 183 XMPhish14 2969 0.51 0.95 0.42 184 T_TooManySym_03 2941 0.40 0.33 0.42 185 XMNoVowels 2797 0.40 0.40 0.40 186 TR_LOTS_OF_MONEY3 2738 0.50 1.04 0.39 187 MISSING_HEADERS 2712 0.70 2.25 0.39 188 XM_H_PHPMailer 2696 0.48 0.94 0.38 189 REMOVE_BEFORE_LINK 2617 0.37 0.38 0.37 190 USER_IN_WHITELIST 2586 0.30 0.00 0.37 191 FILL_THIS_FORM 2579 0.39 0.48 0.37 192 RELAYCOUNTRY_DE 2545 0.54 1.43 0.36 193 XMDateMe_00 2412 0.35 0.36 0.34 194 TM2_M_A_HREF_HREF 2386 0.43 0.85 0.34 195 TM2_M_BODY_EMPTY 2345 0.29 0.07 0.33 196 SHORT_HELO_AND_INLINE_IMAGE 2315 0.28 0.02 0.33 197 PDS_BTC_ID 2250 0.32 0.35 0.32 198 XM_Combo_Sbj 2209 0.34 0.46 0.31 199 XMLKML 2202 0.26 0.00 0.31 200 FROM_GOV_SPOOF 2201 0.29 0.19 0.31 ----------------------------------------------------------------------