Email: 347401 Autolearn: 0 AvgScore: 1.89 AvgScanTime: 2.22 sec Spam: 76371 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 2.84 sec Ham: 271030 Autolearn: 0 AvgScore: -1.38 AvgScanTime: 2.04 sec Time Spent Running SA: 214.13 hours Time Spent Processing Spam: 60.27 hours Time Spent Processing Ham: 153.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 70083 88.44 91.77 87.51 2 DCC_CHECK 58872 57.07 77.09 51.44 3 XM_B_Unicode 51121 72.89 66.94 74.56 4 DKIM_SIGNED 50440 78.52 66.05 82.03 5 XM_DK_Pass 49204 77.37 64.43 81.01 6 DKIM_VALID 46333 74.10 60.67 77.88 7 XMListUnsubscribeExists 42953 59.90 56.24 60.93 8 DKIM_VALID_AU 34803 59.74 45.57 63.74 9 MIME_HTML_ONLY 34659 29.24 45.38 24.70 10 XM_B_Unicode3 34488 46.31 45.16 46.64 11 BAYES_50 34412 51.78 45.06 53.68 12 XM_DK_Undo_02 24950 14.16 32.67 8.94 13 HTML_FONT_LOW_CONTRAST 22642 31.99 29.65 32.65 14 XM_UncommonTLD01 20924 9.69 27.40 4.71 15 LOC_TINY_FONT_1 19829 29.04 25.96 29.91 16 RELAYCOUNTRY_META 19225 9.28 25.17 4.80 17 XM_Body_Dirty_Words 18798 17.96 24.61 16.08 18 BAYES_99 18600 9.63 24.35 5.48 19 XMSubLong 17908 23.14 23.45 23.05 20 BOTNET 16651 6.61 21.80 2.33 21 FSL_BULK_SIG 16154 11.21 21.15 8.41 22 DCC_CHECK_NEGATIVE 16011 41.61 20.96 47.42 23 FVGT_m_MULTI_ODD 15957 21.73 20.89 21.97 24 DKIM_VALID_EF 15794 26.21 20.68 27.77 25 HTML_IMAGE_RATIO_02 15020 12.87 19.67 10.95 26 MultiRelay 14583 16.63 19.09 15.93 27 BOTNET_IPINHOSTNAME 14103 8.79 18.47 6.07 28 TR_DCC_Bayes_99 13993 5.96 18.32 2.48 29 BAYES_999 13901 7.56 18.20 4.56 30 UNTRUSTED_Relay 12421 4.58 16.26 1.28 31 T_KAM_HTML_FONT_INVALID 12305 17.97 16.11 18.49 32 XM_Multi_Part_URI 12260 15.04 16.05 14.76 33 T_TM2_M_HEADER_IN_MSG 11776 21.37 15.42 23.05 34 XMSexyCombo_05 11529 7.94 15.10 5.93 35 KHOP_HELO_FCRDNS 11104 3.96 14.54 0.98 36 HTML_MIME_NO_HTML_TAG 9680 4.24 12.67 1.86 37 XM_B_Unsub 9308 10.76 12.19 10.36 38 SpammyFromTLD_02 8991 2.71 11.77 0.15 39 LOTS_OF_MONEY 8926 11.03 11.69 10.85 40 XM_H_Long_From01 8690 7.76 11.38 6.74 41 T_REMOTE_IMAGE 8686 5.46 11.37 3.79 42 XM_UB50 7789 2.82 10.20 0.74 43 RCVD_IN_MSPIKE_H2 7536 11.91 9.87 12.49 44 HTML_SHORT_LINK_IMG_1 7345 2.15 9.62 0.04 45 TR_Mismatch_TLD_02 7083 2.15 9.27 0.14 46 XMNumbers 6935 5.37 9.08 4.32 47 MPART_ALT_DIFF 6692 5.62 8.76 4.74 48 MIME_HEADER_CTYPE_ONLY 6573 2.03 8.61 0.17 49 HDRS_LCASE_IMGONLY 6526 1.88 8.55 0.01 50 BAYES_80 6382 4.25 8.36 3.10 51 BAYES_60 6252 6.45 8.19 5.96 52 RDNS_DYNAMIC 6095 2.12 7.98 0.47 53 XMSubMetaSx_00 6080 6.44 7.96 6.01 54 XM_DIRTYINTL 5993 4.48 7.85 3.53 55 XM_Evil_Numbers_Gen 5929 10.13 7.76 10.79 56 HTML_IMAGE_ONLY_08 5652 1.71 7.40 0.10 57 XM_B_Phish_Phrases 5530 7.00 7.24 6.93 58 RCVD_IN_BL_SPAMCOP_NET 5281 2.64 6.91 1.43 59 FROM_EXCESS_BASE64 5082 5.13 6.65 4.71 60 HTML_IMAGE_RATIO_04 4859 6.56 6.36 6.62 61 FROM_SUSPICIOUS_NTLD 4844 1.41 6.34 0.02 62 FROM_SUSPICIOUS_NTLD_FP 4829 1.40 6.32 0.02 63 REPLYTO_WITHOUT_TO_CC 4708 1.39 6.16 0.04 64 TooManyTo_001 4649 5.97 6.09 5.94 65 MIME_HTML_MOSTLY 4356 3.60 5.70 3.01 66 TO_EQ_FM_DOM_HTML_IMG 4275 1.23 5.60 0.00 67 LotsOfNums_01 4261 7.42 5.58 7.94 68 DKIM_INVALID 4107 4.42 5.38 4.15 69 T_TooManySym_01 4087 6.51 5.35 6.83 70 RELAYCOUNTRY_CA 3780 2.85 4.95 2.26 71 BAYES_95 3660 2.36 4.79 1.67 72 RELAYCOUNTRY_GB 3536 1.42 4.63 0.52 73 ALL_TRUSTED 3536 10.94 4.63 12.72 74 BODY_URI_ONLY 3495 1.04 4.58 0.04 75 DKIM_ADSP_NXDOMAIN 3403 1.95 4.46 1.24 76 TM2_M_URI_OPT_OUT 3401 2.19 4.45 1.55 77 RCVD_IN_RP_RNBL 3359 1.08 4.40 0.15 78 XM_SendGrid 3347 6.09 4.38 6.58 79 RCVD_IN_MSPIKE_BL 3157 2.33 4.13 1.82 80 MIME_HTML_ONLY_MULTI 3090 3.06 4.05 2.79 81 RCVD_IN_PSBL 3063 0.89 4.01 0.01 82 HTML_IMAGE_RATIO_06 3037 3.66 3.98 3.57 83 ADMITS_SPAM 3022 0.94 3.96 0.09 84 XM_SPF_SoftFail 2956 1.81 3.87 1.23 85 HDRS_MISSP 2841 0.83 3.72 0.01 86 XM_H_PHPMailer 2783 1.23 3.64 0.55 87 BODY_SINGLE_WORD 2745 0.81 3.59 0.02 88 BODY_SINGLE_URI 2744 0.79 3.59 0.00 89 XMHTML_After_End 2719 1.43 3.56 0.83 90 URI_NOVOWEL 2708 1.08 3.55 0.39 91 XM_CamelCaseFrm001 2678 2.88 3.51 2.71 92 PDS_OTHER_BAD_TLD 2620 1.34 3.43 0.75 93 SHORT_IMG_SUSP_NTLD 2584 0.74 3.38 0.00 94 XM_B_SpammyTLD 2523 2.46 3.30 2.22 95 XM_OfRef6 2516 2.12 3.29 1.79 96 BAYES_40 2485 4.48 3.25 4.82 97 XMPhish11 2394 1.53 3.13 1.07 98 BOTNET_NORDNS 2390 0.71 3.13 0.03 99 MultiRelay_CC 2338 0.78 3.06 0.14 100 MultiRelay_Combo 2338 0.78 3.06 0.14 101 NO_FM_NAME_IP_HOSTN 2321 0.67 3.04 0.00 102 XM_BadFromFormat 2320 0.75 3.04 0.11 103 MIME_QP_LONG_LINE 2258 4.11 2.96 4.43 104 XMSexyCombo_01 2198 1.76 2.88 1.45 105 DIET_1 2173 1.48 2.85 1.09 106 RCVD_IN_MSPIKE_H3 2164 8.86 2.83 10.56 107 RCVD_IN_MSPIKE_WL 2164 8.86 2.83 10.56 108 CANT_SEE_AD 2103 0.61 2.75 0.01 109 URI_HEX 2052 1.64 2.69 1.34 110 NO_DNS_FOR_FROM 2018 2.18 2.64 2.04 111 RELAYCOUNTRY_FR 1979 0.75 2.59 0.23 112 HTML_IMAGE_RATIO_08 1953 2.56 2.56 2.56 113 XMDiploma_00 1924 1.83 2.52 1.64 114 FROM_NO_USER 1917 0.56 2.51 0.01 115 TR_XM_DK_SendGrid 1897 3.59 2.48 3.90 116 XMStrtUSub 1896 4.48 2.48 5.05 117 RELAYCOUNTRY_IN 1862 0.58 2.44 0.05 118 RCVD_IN_MSPIKE_L3 1815 1.56 2.38 1.33 119 XMPhish04 1786 0.52 2.34 0.00 120 FROM_NTLD_LINKBAIT 1735 0.50 2.27 0.00 121 LongTLD 1659 0.59 2.17 0.14 122 BAYES_20 1645 3.48 2.15 3.85 123 TR_XM_PHPDW 1621 0.82 2.12 0.46 124 XM_URI_RBL 1605 0.76 2.10 0.38 125 TR_XM_PHPForged 1547 0.78 2.03 0.43 126 TR_XM_FormFill2 1538 0.77 2.01 0.42 127 XM_H_PHPOS 1534 0.77 2.01 0.42 128 URIBL_SBL_A 1510 0.82 1.98 0.49 129 T_XMHurry_00 1506 0.88 1.97 0.57 130 BAYES_00 1482 15.14 1.94 18.86 131 XM_B_Unsub2 1478 1.50 1.94 1.37 132 SUBJ_ALL_CAPS 1455 1.59 1.91 1.50 133 RELAYCOUNTRY_DE 1442 0.65 1.89 0.30 134 T_XMDrugObfuBody_14 1427 1.73 1.87 1.70 135 FILL_THIS_FORM 1423 0.92 1.86 0.65 136 XMGenDplmaNmb 1389 0.93 1.82 0.69 137 T_XMDrugObfuBody_08 1386 1.36 1.81 1.23 138 URI_TRY_3LD 1376 1.48 1.80 1.39 139 FILL_THIS_FORM_LONG 1358 0.83 1.78 0.56 140 TR_XM_RelayPhish 1352 1.21 1.77 1.05 141 DEAR_FRIEND 1346 0.46 1.76 0.09 142 XMSlimDrugH 1341 0.68 1.76 0.38 143 TR_Symld_Words 1258 2.09 1.65 2.22 144 SpammyFromTLD_01 1251 0.70 1.64 0.43 145 RCVD_IN_RP_SAFE 1244 11.43 1.63 14.20 146 MONEY_FORM 1226 0.36 1.61 0.01 147 T_MONEY_PERCENT 1216 0.73 1.59 0.48 148 TR_LOTS_OF_MONEY2 1216 0.73 1.59 0.48 149 XMStockSpam_06 1200 1.65 1.57 1.67 150 RCVD_IN_IADB_LISTED 1198 3.74 1.57 4.36 151 TM2_M_VERY_LONG_WORD 1172 1.66 1.53 1.70 152 TR_XM_DK_Bayes 1145 13.24 1.50 16.55 153 HK_RANDOM_REPLYTO 1138 0.49 1.49 0.21 154 XM_OfRef7 1136 0.44 1.49 0.15 155 TR_XM_INV_DKIM 1126 0.56 1.47 0.30 156 HTML_IMAGE_ONLY_04 1109 0.37 1.45 0.07 157 DATE_IN_PAST_03_06 1108 0.41 1.45 0.11 158 XMSexyCombo_04 1096 0.95 1.44 0.81 159 HTML_TAG_BALANCE_CENTER 1070 0.39 1.40 0.10 160 BAYES_05 1069 1.97 1.40 2.13 161 HTML_IMAGE_ONLY_12 1043 0.41 1.37 0.14 162 XMSubMetaI_00 1034 0.90 1.35 0.78 163 RCVD_IN_IADB_SPF 1028 3.19 1.35 3.71 164 RCVD_IN_IADB_DK 1004 2.73 1.31 3.13 165 RCVD_IN_IADB_SENDERID 1001 2.82 1.31 3.25 166 XMWghtMeta_00 999 0.31 1.31 0.03 167 T_FILL_THIS_FORM_LOAN 998 0.70 1.31 0.53 168 TR_XM_DK_Bayes1 997 12.78 1.31 16.01 169 XMBdyGiftCard01 980 2.03 1.28 2.25 170 TR_LOTS_OF_MONEY3 965 0.64 1.26 0.46 171 RCVD_IN_RP_CERTIFIED 961 10.32 1.26 12.88 172 DKIM_ADSP_CUSTOM_MED 959 0.94 1.26 0.86 173 XM_H_PHPOS_M 953 0.42 1.25 0.19 174 XMSubject_63 945 0.27 1.24 0.00 175 HTML_FONT_FACE_BAD 927 0.78 1.21 0.66 176 TR_Mismatch_TLD_01 924 0.49 1.21 0.28 177 XM_OfRef8 922 0.29 1.21 0.04 178 XMBody_17 921 1.37 1.21 1.42 179 TR_XM_DK_Bayes2 915 12.02 1.20 15.07 180 HTML_SHORT_CENTER 904 0.27 1.18 0.01 181 LOW_PRICE 895 0.41 1.17 0.19 182 NML_ADSP_CUSTOM_MED 891 0.71 1.17 0.59 183 XM_UB60 888 0.30 1.16 0.05 184 RELAYCOUNTRY_FI 885 0.27 1.16 0.01 185 RELAYCOUNTRY_AT 884 0.46 1.16 0.26 186 RCVD_IN_MSPIKE_L5 884 0.43 1.16 0.22 187 T_Symld_Words_02 879 0.73 1.15 0.62 188 XMSlimDrugs 869 0.28 1.14 0.04 189 MPART_ALT_DIFF_COUNT 867 0.55 1.14 0.38 190 FORGED_GMAIL_RCVD 844 0.64 1.11 0.51 191 HK_RANDOM_FROM 836 0.33 1.09 0.11 192 URIBL_CSS_A 828 1.77 1.08 1.96 193 URIBL_CSS 828 1.77 1.08 1.96 194 XMNoVowels 824 0.51 1.08 0.34 195 XM_ProductURIs 823 1.22 1.08 1.26 196 URIBL_BLACK 806 0.25 1.06 0.02 197 XM_UB80 805 0.25 1.05 0.02 198 XM_UB99 797 0.23 1.04 0.01 199 TooManyTo_002 780 1.22 1.02 1.27 200 XM_B_COPY_HTML 769 0.67 1.01 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 237165 88.44 91.77 87.51 2 DKIM_SIGNED 222324 78.52 66.05 82.03 3 XM_DK_Pass 219567 77.37 64.43 81.01 4 DKIM_VALID 211081 74.10 60.67 77.88 5 XM_B_Unicode 202091 72.89 66.94 74.56 6 DKIM_VALID_AU 172745 59.74 45.57 63.74 7 XMListUnsubscribeExists 165141 59.90 56.24 60.93 8 BAYES_50 145484 51.78 45.06 53.68 9 DCC_CHECK 139405 57.07 77.09 51.44 10 DCC_CHECK_NEGATIVE 128532 41.61 20.96 47.42 11 XM_B_Unicode3 126406 46.31 45.16 46.64 12 HTML_FONT_LOW_CONTRAST 88495 31.99 29.65 32.65 13 LOC_TINY_FONT_1 81066 29.04 25.96 29.91 14 DKIM_VALID_EF 75273 26.21 20.68 27.77 15 MIME_HTML_ONLY 66931 29.24 45.38 24.70 16 XMSubLong 62471 23.14 23.45 23.05 17 T_TM2_M_HEADER_IN_MSG 62468 21.37 15.42 23.05 18 FVGT_m_MULTI_ODD 59540 21.73 20.89 21.97 19 BAYES_00 51116 15.14 1.94 18.86 20 T_KAM_HTML_FONT_INVALID 50107 17.97 16.11 18.49 21 TR_XM_DK_Bayes 44867 13.24 1.50 16.55 22 XM_Body_Dirty_Words 43595 17.96 24.61 16.08 23 TR_XM_DK_Bayes1 43405 12.78 1.31 16.01 24 MultiRelay 43180 16.63 19.09 15.93 25 TR_XM_DK_Bayes2 40857 12.02 1.20 15.07 26 XM_Multi_Part_URI 39993 15.04 16.05 14.76 27 RCVD_IN_RP_SAFE 38477 11.43 1.63 14.20 28 RCVD_IN_RP_CERTIFIED 34904 10.32 1.26 12.88 29 ALL_TRUSTED 34478 10.94 4.63 12.72 30 RCVD_IN_MSPIKE_H2 33845 11.91 9.87 12.49 31 HTML_IMAGE_RATIO_02 29674 12.87 19.67 10.95 32 LOTS_OF_MONEY 29406 11.03 11.69 10.85 33 XM_DKIMWhitelistDomains 29308 8.46 0.09 10.81 34 XM_Evil_Numbers_Gen 29247 10.13 7.76 10.79 35 RCVD_IN_MSPIKE_WL 28626 8.86 2.83 10.56 36 RCVD_IN_MSPIKE_H3 28625 8.86 2.83 10.56 37 XM_B_Unsub 28069 10.76 12.19 10.36 38 XM_DK_Undo_02 24242 14.16 32.67 8.94 39 FSL_BULK_SIG 22793 11.21 21.15 8.41 40 LotsOfNums_01 21515 7.42 5.58 7.94 41 XM_B_Phish_Phrases 18776 7.00 7.24 6.93 42 T_TooManySym_01 18523 6.51 5.35 6.83 43 XM_H_Long_From01 18277 7.76 11.38 6.74 44 HTML_IMAGE_RATIO_04 17944 6.56 6.36 6.62 45 XM_SendGrid 17821 6.09 4.38 6.58 46 BOTNET_IPINHOSTNAME 16443 8.79 18.47 6.07 47 XMSubMetaSx_00 16280 6.44 7.96 6.01 48 BAYES_60 16162 6.45 8.19 5.96 49 TooManyTo_001 16087 5.97 6.09 5.94 50 XMSexyCombo_05 16071 7.94 15.10 5.93 51 BAYES_99 14844 9.63 24.35 5.48 52 XMStrtUSub 13681 4.48 2.48 5.05 53 BAYES_40 13067 4.48 3.25 4.82 54 RELAYCOUNTRY_META 13011 9.28 25.17 4.80 55 MPART_ALT_DIFF 12848 5.62 8.76 4.74 56 XM_UncommonTLD01 12756 9.69 27.40 4.71 57 FROM_EXCESS_BASE64 12753 5.13 6.65 4.71 58 BAYES_999 12364 7.56 18.20 4.56 59 MIME_QP_LONG_LINE 12011 4.11 2.96 4.43 60 RCVD_IN_IADB_LISTED 11809 3.74 1.57 4.36 61 XMNumbers 11712 5.37 9.08 4.32 62 DKIM_INVALID 11243 4.42 5.38 4.15 63 TR_XM_DK_SendGrid 10565 3.59 2.48 3.90 64 T_TooManySym_02 10557 3.22 0.84 3.90 65 BAYES_20 10443 3.48 2.15 3.85 66 T_REMOTE_IMAGE 10268 5.46 11.37 3.79 67 UNPARSEABLE_RELAY 10148 3.12 0.89 3.74 68 RCVD_IN_IADB_SPF 10068 3.19 1.35 3.71 69 HTML_IMAGE_RATIO_06 9674 3.66 3.98 3.57 70 XM_DIRTYINTL 9569 4.48 7.85 3.53 71 RCVD_IN_IADB_SENDERID 8813 2.82 1.31 3.25 72 IN_ZIMBRA_NJ_WHITELIST 8572 2.47 0.01 3.16 73 RCVD_IN_IADB_DK 8471 2.73 1.31 3.13 74 BAYES_80 8396 4.25 8.36 3.10 75 MIME_HTML_MOSTLY 8153 3.60 5.70 3.01 76 RCVD_IN_IADB_VOUCHED 7872 2.38 0.53 2.90 77 MIME_HTML_ONLY_MULTI 7549 3.06 4.05 2.79 78 INVALID_MSGID 7386 2.17 0.21 2.73 79 XM_CamelCaseFrm001 7340 2.88 3.51 2.71 80 TVD_RCVD_IP 7071 2.12 0.37 2.61 81 XM_PDF 7034 2.09 0.29 2.60 82 HTML_IMAGE_RATIO_08 6942 2.56 2.56 2.56 83 TR_DCC_Bayes_99 6713 5.96 18.32 2.48 84 TO_MALFORMED 6575 2.00 0.47 2.43 85 CK_HELO_DYNAMIC_SPLIT_IP 6379 1.85 0.08 2.35 86 HELO_DYNAMIC_IPADDR2 6378 1.84 0.03 2.35 87 BOTNET 6311 6.61 21.80 2.33 88 RELAYCOUNTRY_CA 6129 2.85 4.95 2.26 89 XMBdyGiftCard01 6086 2.03 1.28 2.25 90 XM_B_SpammyTLD 6008 2.46 3.30 2.22 91 TR_Symld_Words 6007 2.09 1.65 2.22 92 BAYES_05 5765 1.97 1.40 2.13 93 NO_DNS_FOR_FROM 5538 2.18 2.64 2.04 94 URIBL_CSS 5310 1.77 1.08 1.96 95 URIBL_CSS_A 5310 1.77 1.08 1.96 96 RCVD_IN_IADB_OPTIN 5202 1.57 0.33 1.92 97 HTML_MIME_NO_HTML_TAG 5046 4.24 12.67 1.86 98 RCVD_IN_MSPIKE_BL 4933 2.33 4.13 1.82 99 XM_OfRef6 4856 2.12 3.29 1.79 100 IN_HORDE_ADDRESS_BOOK 4757 1.38 0.03 1.76 101 MAILING_LIST_MULTI 4711 1.55 0.90 1.74 102 TM2_M_VERY_LONG_WORD 4602 1.66 1.53 1.70 103 T_XMDrugObfuBody_14 4598 1.73 1.87 1.70 104 USER_IN_DEF_DKIM_WL 4566 1.31 0.00 1.68 105 BAYES_95 4527 2.36 4.79 1.67 106 XMStockSpam_06 4521 1.65 1.57 1.67 107 XMDiploma_00 4444 1.83 2.52 1.64 108 TM2_M_URI_OPT_OUT 4201 2.19 4.45 1.55 109 XM_H_Trusted_IP 4064 1.17 0.00 1.50 110 SUBJ_ALL_CAPS 4061 1.59 1.91 1.50 111 XMSubMetaSxObfu_03 4019 1.31 0.71 1.48 112 BOUNCE_MESSAGE 3930 1.20 0.30 1.45 113 ANY_BOUNCE_MESSAGE 3930 1.20 0.30 1.45 114 XMSexyCombo_01 3926 1.76 2.88 1.45 115 RCVD_IN_BL_SPAMCOP_NET 3888 2.64 6.91 1.43 116 XMBody_17 3839 1.37 1.21 1.42 117 URI_TRY_3LD 3759 1.48 1.80 1.39 118 XM_B_Unsub2 3719 1.50 1.94 1.37 119 XM_DK_Undo_01 3709 1.25 0.81 1.37 120 URI_HEX 3631 1.64 2.69 1.34 121 RCVD_IN_MSPIKE_L3 3604 1.56 2.38 1.33 122 UNTRUSTED_Relay 3478 4.58 16.26 1.28 123 TooManyTo_002 3444 1.22 1.02 1.27 124 XM_ProductURIs 3416 1.22 1.08 1.26 125 XMGappySubj_01 3404 1.01 0.15 1.26 126 DKIM_ADSP_NXDOMAIN 3364 1.95 4.46 1.24 127 XM_SPF_SoftFail 3337 1.81 3.87 1.23 128 T_XMDrugObfuBody_08 3322 1.36 1.81 1.23 129 XM_H_Long_From02 3172 1.09 0.79 1.17 130 XM_GoogleGroups 3163 0.99 0.37 1.17 131 DIET_1 2961 1.48 2.85 1.09 132 T_FILL_THIS_FORM_SHORT 2948 1.05 0.92 1.09 133 XMPhish11 2911 1.53 3.13 1.07 134 TR_XM_RelayPhish 2851 1.21 1.77 1.05 135 XMBody_95 2727 0.81 0.12 1.01 136 XMBrknScrpt_02 2700 0.98 0.93 1.00 137 KHOP_HELO_FCRDNS 2665 3.96 14.54 0.98 138 XM_B_REG_HTML 2537 0.79 0.25 0.94 139 TR_MetaPhish_Combo_01 2499 0.82 0.45 0.92 140 XMSubNoVowel 2486 0.84 0.58 0.92 141 T_TooManySym_03 2364 0.73 0.21 0.87 142 AC_FROM_MANY_DOTS 2346 0.68 0.01 0.87 143 DKIM_ADSP_CUSTOM_MED 2321 0.94 1.26 0.86 144 XMHTML_After_End 2251 1.43 3.56 0.83 145 HTML_TAG_BALANCE_BODY 2232 0.80 0.70 0.82 146 TooManyTo_003 2221 0.82 0.84 0.82 147 XMSexyCombo_04 2206 0.95 1.44 0.81 148 USER_IN_WHITELIST 2166 0.62 0.00 0.80 149 XMSubMetaSx_01 2112 0.79 0.85 0.78 150 XMSubMetaI_00 2108 0.90 1.35 0.78 151 PDS_OTHER_BAD_TLD 2020 1.34 3.43 0.75 152 XM_UB50 2016 2.82 10.20 0.74 153 T_XMDrugObfuBody_00 1930 0.73 0.79 0.71 154 XMSexyCombo_02 1888 0.64 0.44 0.70 155 TM2_M_A_HREF_HREF 1875 0.73 0.85 0.69 156 XM_D_tchamptons_WL 1874 0.54 0.00 0.69 157 XMGenDplmaNmb 1859 0.93 1.82 0.69 158 XMBSHREFv2 1841 0.58 0.25 0.68 159 TooManyTo_004 1824 0.68 0.72 0.67 160 XMPhish30 1794 0.73 0.97 0.66 161 SUBJ_DOLLARS 1783 0.62 0.49 0.66 162 HTML_FONT_FACE_BAD 1780 0.78 1.21 0.66 163 FILL_THIS_FORM 1774 0.92 1.86 0.65 164 XMSubMetaSxObfu_02 1726 0.69 0.89 0.64 165 XMSolicitRefs_0 1701 0.56 0.33 0.63 166 HELO_NODOT 1695 0.55 0.28 0.63 167 XMPhish14 1689 0.69 0.95 0.62 168 XMHTMLBadTable_001 1681 0.62 0.63 0.62 169 T_Symld_Words_02 1674 0.73 1.15 0.62 170 HELO_NO_DOMAIN 1652 0.54 0.28 0.61 171 NML_ADSP_CUSTOM_MED 1592 0.71 1.17 0.59 172 XM_B_COPY_HTML 1560 0.67 1.01 0.58 173 T_XMHurry_00 1557 0.88 1.97 0.57 174 FILL_THIS_FORM_LONG 1527 0.83 1.78 0.56 175 TooManyTo_005 1491 0.57 0.63 0.55 176 XM_H_PHPMailer 1486 1.23 3.64 0.55 177 HTTPS_HTTP_MISMATCH 1432 0.50 0.41 0.53 178 T_FILL_THIS_FORM_LOAN 1424 0.70 1.31 0.53 179 RELAYCOUNTRY_GB 1397 1.42 4.63 0.52 180 FORGED_GMAIL_RCVD 1386 0.64 1.11 0.51 181 FROM_GOV_DKIM_AU 1345 0.40 0.04 0.50 182 PLING_QUERY 1332 0.60 0.97 0.49 183 URIBL_SBL_A 1323 0.82 1.98 0.49 184 TR_LOTS_OF_MONEY2 1314 0.73 1.59 0.48 185 T_MONEY_PERCENT 1314 0.73 1.59 0.48 186 XMRcvdHeader_15 1283 0.37 0.00 0.47 187 XMBody_78 1278 0.49 0.53 0.47 188 RDNS_DYNAMIC 1276 2.12 7.98 0.47 189 TR_LOTS_OF_MONEY3 1243 0.64 1.26 0.46 190 TR_XM_PHPDW 1236 0.82 2.12 0.46 191 HTML_IMAGE_ONLY_20 1189 0.38 0.19 0.44 192 SpammyFromTLD_01 1173 0.70 1.64 0.43 193 TR_XM_PHPForged 1172 0.78 2.03 0.43 194 XMCapTrack 1167 0.37 0.17 0.43 195 T_OBFU_PDF_ATTACH 1154 0.34 0.05 0.43 196 TR_XM_FormFill2 1144 0.77 2.01 0.42 197 XM_H_PHPOS 1132 0.77 2.01 0.42 198 XM_RXBody 1109 0.39 0.31 0.41 199 FSL_HELO_FAKE 1104 0.32 0.03 0.41 200 REMOVE_BEFORE_LINK 1076 0.40 0.42 0.40 ----------------------------------------------------------------------