Email: 373331 Autolearn: 0 AvgScore: 0.36 AvgScanTime: 1.84 sec Spam: 64554 Autolearn: 0 AvgScore: 12.23 AvgScanTime: 3.19 sec Ham: 308777 Autolearn: 0 AvgScore: -2.12 AvgScanTime: 1.56 sec Time Spent Running SA: 191.32 hours Time Spent Processing Spam: 57.20 hours Time Spent Processing Ham: 134.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 59406 81.12 92.03 78.84 2 DKIM_SIGNED 51405 73.22 79.63 71.88 3 XM_B_Unicode 51050 70.08 79.08 68.20 4 DCC_CHECK 50386 51.16 78.05 45.54 5 XM_DK_Pass 49886 72.12 77.28 71.04 6 DKIM_VALID 44210 68.25 68.49 68.21 7 XMListUnsubscribeExists 43064 55.13 66.71 52.71 8 DKIM_VALID_AU 33461 55.16 51.83 55.86 9 XM_B_Unicode3 29961 45.12 46.41 44.86 10 BAYES_50 27105 45.02 41.99 45.66 11 XM_DK_Undo_02 24827 13.19 38.46 7.91 12 MIME_HTML_ONLY 23162 23.93 35.88 21.43 13 LOC_TINY_FONT_1 21617 28.61 33.49 27.59 14 HTML_FONT_LOW_CONTRAST 19762 31.54 30.61 31.74 15 FVGT_m_MULTI_ODD 17157 20.42 26.58 19.13 16 BAYES_99 16802 8.06 26.03 4.30 17 DKIM_VALID_EF 16798 25.32 26.02 25.17 18 XM_Body_Dirty_Words 16211 15.77 25.11 13.81 19 XMSubLong 15459 20.29 23.95 19.52 20 RELAYCOUNTRY_META 15398 8.18 23.85 4.90 21 MultiRelay 14033 15.56 21.74 14.27 22 BOTNET 13877 5.77 21.50 2.49 23 DCC_CHECK_NEGATIVE 13388 47.66 20.74 53.29 24 T_KAM_HTML_FONT_INVALID 13043 15.31 20.20 14.29 25 BAYES_999 12929 6.42 20.03 3.58 26 TR_DCC_Bayes_99 12667 5.57 19.62 2.63 27 T_TM2_M_HEADER_IN_MSG 11539 20.38 17.87 20.90 28 XM_Multi_Part_URI 11537 17.35 17.87 17.25 29 XM_UncommonTLD01 11005 6.02 17.05 3.72 30 FSL_BULK_SIG 10715 9.43 16.60 7.93 31 HTML_IMAGE_RATIO_02 10355 11.47 16.04 10.51 32 XM_B_Unsub 10164 9.73 15.74 8.47 33 BOTNET_IPINHOSTNAME 9891 7.16 15.32 5.45 34 XMSexyCombo_05 9646 7.48 14.94 5.92 35 UNTRUSTED_Relay 9492 3.81 14.70 1.53 36 XMSubMetaSx_00 7981 6.39 12.36 5.14 37 LOTS_OF_MONEY 7419 8.21 11.49 7.53 38 XM_Evil_Numbers_Gen 7260 10.15 11.25 9.92 39 DKIM_INVALID 7195 4.96 11.15 3.67 40 RCVD_IN_MSPIKE_H2 6035 11.16 9.35 11.53 41 XM_H_Long_From01 5552 6.11 8.60 5.59 42 XMPhish08 5429 3.23 8.41 2.15 43 NO_DNS_FOR_FROM 5405 3.25 8.37 2.18 44 BAYES_80 5327 3.37 8.25 2.35 45 XM_UB50 5253 2.03 8.14 0.76 46 BAYES_60 4794 5.09 7.43 4.60 47 XM_DIRTYINTL 4767 3.69 7.38 2.92 48 XM_B_Phish_Phrases 4706 6.92 7.29 6.85 49 MPART_ALT_DIFF 4647 4.93 7.20 4.46 50 HTML_MIME_NO_HTML_TAG 4498 2.42 6.97 1.47 51 HTML_IMAGE_RATIO_08 4459 3.67 6.91 2.99 52 XMSexyCombo_01 4436 2.16 6.87 1.17 53 LotsOfNums_01 4225 6.38 6.54 6.34 54 XM_SendGrid 4105 6.40 6.36 6.40 55 KHOP_HELO_FCRDNS 4044 2.11 6.26 1.24 56 TooManyTo_001 4020 6.17 6.23 6.16 57 HTML_IMAGE_RATIO_04 3995 7.30 6.19 7.53 58 RELAYCOUNTRY_CA 3976 2.48 6.16 1.71 59 MIME_HTML_MOSTLY 3923 3.85 6.08 3.38 60 XMNumbers 3502 4.27 5.42 4.03 61 RCVD_IN_BL_SPAMCOP_NET 3458 2.12 5.36 1.44 62 RDNS_DYNAMIC 3157 1.18 4.89 0.40 63 DATE_IN_PAST_03_06 3074 0.90 4.76 0.10 64 XMSexyCombo_04 3030 0.94 4.69 0.16 65 TR_Mismatch_TLD_02 3017 0.85 4.67 0.05 66 SpammyFromTLD_02 2986 0.92 4.63 0.14 67 T_REMOTE_IMAGE 2935 2.75 4.55 2.38 68 RCVD_IN_MSPIKE_BL 2934 1.63 4.55 1.02 69 XMSubMetaSSx_00 2713 1.00 4.20 0.33 70 BAYES_95 2640 1.90 4.09 1.44 71 BAYES_00 2636 25.12 4.08 29.52 72 XMStrtUSub 2599 5.13 4.03 5.37 73 XM_SPF_SoftFail 2548 1.76 3.95 1.31 74 RCVD_IN_RP_SAFE 2528 11.23 3.92 12.76 75 HTML_IMAGE_RATIO_06 2505 3.73 3.88 3.70 76 SpammyFromTLD_01 2457 1.00 3.81 0.41 77 XM_CamelCaseFrm001 2403 2.73 3.72 2.52 78 FROM_EXCESS_BASE64 2279 4.32 3.53 4.49 79 RCVD_IN_MSPIKE_H3 2233 8.33 3.46 9.35 80 RCVD_IN_MSPIKE_WL 2233 8.33 3.46 9.35 81 RCVD_IN_RP_CERTIFIED 2215 10.41 3.43 11.87 82 MIME_HTML_ONLY_MULTI 2212 2.69 3.43 2.54 83 TR_XM_DK_Bayes 2118 14.78 3.28 17.18 84 RELAYCOUNTRY_FR 2111 0.76 3.27 0.24 85 BAYES_40 2041 4.18 3.16 4.39 86 TM2_M_URI_OPT_OUT 2041 10.16 3.16 11.62 87 XMHTML_After_End 2036 1.28 3.15 0.88 88 HTML_SHORT_LINK_IMG_1 1966 0.54 3.05 0.01 89 T_TooManySym_01 1953 5.01 3.03 5.43 90 TR_XM_PHPDW 1945 1.38 3.01 1.04 91 ALL_TRUSTED 1941 18.32 3.01 21.52 92 PDS_OTHER_BAD_TLD 1928 0.99 2.99 0.58 93 XM_OfRef6 1910 1.77 2.96 1.52 94 TR_XM_PHPForged 1908 1.36 2.96 1.03 95 XM_URI_RBL 1905 0.82 2.95 0.37 96 TR_XM_FormFill2 1904 1.35 2.95 1.02 97 XM_H_PHPOS 1900 1.35 2.94 1.02 98 MultiRelay_CC 1886 0.64 2.92 0.16 99 MultiRelay_Combo 1886 0.64 2.92 0.16 100 RCVD_IN_RP_RNBL 1872 0.60 2.90 0.12 101 RCVD_IN_MSPIKE_L3 1869 1.09 2.90 0.72 102 MIME_QP_LONG_LINE 1860 3.38 2.88 3.48 103 XM_B_SpammyTLD 1834 1.97 2.84 1.78 104 BAYES_20 1826 3.65 2.83 3.82 105 RELAYCOUNTRY_GB 1771 1.33 2.74 1.04 106 SUBJ_ALL_CAPS 1770 1.52 2.74 1.27 107 HTML_TAG_BALANCE_CENTER 1756 0.51 2.72 0.05 108 XMBody_17 1675 1.23 2.59 0.94 109 HDRS_LCASE_IMGONLY 1658 0.45 2.57 0.01 110 XMStockSpam_06 1638 1.64 2.54 1.46 111 XM_H_PHPMailer 1625 0.87 2.52 0.52 112 TR_XM_DK_Bayes1 1578 14.08 2.44 16.51 113 TM2_M_VERY_LONG_WORD 1572 1.52 2.44 1.33 114 URI_HEX 1554 1.47 2.41 1.27 115 XM_H_PHPOS_M 1549 1.03 2.40 0.74 116 T_XMHurry_00 1526 1.03 2.36 0.76 117 DIET_1 1522 0.96 2.36 0.67 118 T_XMDrugObfuBody_14 1454 1.86 2.25 1.77 119 T_XMDrugObfuBody_08 1445 1.28 2.24 1.08 120 TR_XM_INV_DKIM 1441 0.51 2.23 0.14 121 XMSubMetaI_00 1440 1.12 2.23 0.89 122 BOTNET_NORDNS 1433 0.39 2.22 0.01 123 XM_B_Unsub2 1394 1.04 2.16 0.80 124 TR_XM_DK_Bayes2 1385 13.22 2.15 15.53 125 BODY_URI_ONLY 1385 0.39 2.15 0.02 126 XMDiploma_00 1366 1.42 2.12 1.28 127 FROM_SUSPICIOUS_NTLD 1350 0.38 2.09 0.02 128 FROM_SUSPICIOUS_NTLD_FP 1327 0.37 2.06 0.02 129 HTML_IMAGE_ONLY_08 1325 0.42 2.05 0.08 130 XM_BadFromFormat 1319 0.44 2.04 0.11 131 TR_XM_DK_SendGrid 1292 3.16 2.00 3.40 132 T_MONEY_PERCENT 1247 0.64 1.93 0.38 133 TR_LOTS_OF_MONEY2 1247 0.64 1.93 0.38 134 URIBL_SBL_A 1243 0.55 1.93 0.26 135 BAYES_05 1230 3.45 1.91 3.78 136 TR_XM_RelayPhish 1203 1.07 1.86 0.91 137 T_FILL_THIS_FORM_SHORT 1125 0.94 1.74 0.77 138 XM_ProductURIs 1098 0.77 1.70 0.57 139 DATE_IN_PAST_06_12 1096 0.34 1.70 0.05 140 RELAYCOUNTRY_IN 1095 0.33 1.70 0.04 141 LongTLD 1089 0.41 1.69 0.14 142 REPLYTO_WITHOUT_TO_CC 1003 0.29 1.55 0.03 143 DKIM_ADSP_CUSTOM_MED 986 1.10 1.53 1.01 144 XM_UB60 964 0.31 1.49 0.07 145 XMLngstWrd_00 962 0.82 1.49 0.67 146 XMGenDplmaNmb 960 0.88 1.49 0.76 147 XMLngstWrd_01 943 0.79 1.46 0.65 148 TR_Mismatch_TLD_01 914 0.49 1.42 0.30 149 XMLngstWrd_02 900 0.71 1.39 0.57 150 THIS_AD 899 0.63 1.39 0.47 151 URI_TRY_3LD 898 1.15 1.39 1.10 152 NML_ADSP_CUSTOM_MED 895 0.87 1.39 0.76 153 XMHTMLBadTable_001 885 0.63 1.37 0.48 154 XM_UB99 884 0.24 1.37 0.00 155 XMBdyGiftCard01 882 2.16 1.37 2.33 156 XM_H_Long_From02 880 1.18 1.36 1.14 157 TR_Symld_Words 858 1.03 1.33 0.97 158 FORGED_GMAIL_RCVD 857 0.71 1.33 0.58 159 RELAYCOUNTRY_AT 850 0.39 1.32 0.19 160 T_TooManySym_02 821 2.86 1.27 3.19 161 RCVD_IN_MSPIKE_L5 819 0.33 1.27 0.13 162 HTML_IMAGE_ONLY_12 815 0.31 1.26 0.11 163 MPART_ALT_DIFF_COUNT 807 0.51 1.25 0.36 164 XMLngstWrd_03 794 0.61 1.23 0.48 165 MAILING_LIST_MULTI 790 1.60 1.22 1.68 166 XMPhish11 770 0.93 1.19 0.87 167 URI_NO_WWW_INFO_CGI 766 0.22 1.19 0.02 168 RCVD_IN_IADB_LISTED 755 2.57 1.17 2.86 169 MIME_HEADER_CTYPE_ONLY 736 0.35 1.14 0.19 170 RELAYCOUNTRY_DE 734 0.51 1.14 0.38 171 URIBL_BLACK 723 0.20 1.12 0.01 172 XMSubMetaSxObfu_03 701 0.97 1.09 0.94 173 XMGppyBdWords 691 0.32 1.07 0.16 174 SUBJ_DOLLARS 676 0.77 1.05 0.71 175 XM_OfRef7 672 0.31 1.04 0.16 176 XM_B_COPY_HTML 669 0.58 1.04 0.48 177 XMPhish14 665 0.54 1.03 0.44 178 TO_EQ_FM_DOM_HTML_IMG 665 0.18 1.03 0.00 179 RCVD_IN_IADB_SPF 652 2.24 1.01 2.49 180 XMLngstWrd_04 651 0.50 1.01 0.39 181 XM_DK_Undo_01 647 1.15 1.00 1.18 182 RCVD_IN_IADB_DK 638 1.96 0.99 2.16 183 RCVD_IN_IADB_SENDERID 635 2.01 0.98 2.23 184 TR_LOTS_OF_MONEY3 628 0.50 0.97 0.41 185 XMPhish30 628 0.65 0.97 0.58 186 RELAYCOUNTRY_MD 623 0.17 0.97 0.00 187 URIBL_DBL_SPAM 614 0.19 0.95 0.03 188 SUBJECT_NEEDS_ENCODING 610 0.17 0.94 0.01 189 XMBrknScrpt_02 609 0.83 0.94 0.81 190 TM2_M_A_HREF_HREF 608 0.53 0.94 0.44 191 LOW_PRICE 608 0.32 0.94 0.19 192 SUBJ_ILLEGAL_CHARS 602 0.17 0.93 0.01 193 XM_UB80 595 0.18 0.92 0.02 194 XM_UB999 590 0.16 0.91 0.00 195 UNPARSEABLE_RELAY 584 2.70 0.90 3.07 196 TooManyTo_002 575 1.11 0.89 1.16 197 T_XMDrugObfuBody_00 544 0.52 0.84 0.45 198 XMBody_78 534 0.42 0.83 0.34 199 HK_RANDOM_REPLYTO 519 0.27 0.80 0.16 200 XMSlimDrugH 510 0.44 0.79 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243454 81.12 92.03 78.84 2 DKIM_SIGNED 221938 73.22 79.63 71.88 3 XM_DK_Pass 219366 72.12 77.28 71.04 4 DKIM_VALID 210606 68.25 68.49 68.21 5 XM_B_Unicode 210599 70.08 79.08 68.20 6 DKIM_VALID_AU 172477 55.16 51.83 55.86 7 DCC_CHECK_NEGATIVE 164549 47.66 20.74 53.29 8 XMListUnsubscribeExists 162761 55.13 66.71 52.71 9 BAYES_50 140985 45.02 41.99 45.66 10 DCC_CHECK 140625 51.16 78.05 45.54 11 XM_B_Unicode3 138503 45.12 46.41 44.86 12 HTML_FONT_LOW_CONTRAST 97998 31.54 30.61 31.74 13 BAYES_00 91141 25.12 4.08 29.52 14 LOC_TINY_FONT_1 85189 28.61 33.49 27.59 15 DKIM_VALID_EF 77716 25.32 26.02 25.17 16 ALL_TRUSTED 66440 18.32 3.01 21.52 17 MIME_HTML_ONLY 66170 23.93 35.88 21.43 18 T_TM2_M_HEADER_IN_MSG 64530 20.38 17.87 20.90 19 XMSubLong 60286 20.29 23.95 19.52 20 FVGT_m_MULTI_ODD 59070 20.42 26.58 19.13 21 XM_Multi_Part_URI 53252 17.35 17.87 17.25 22 TR_XM_DK_Bayes 53057 14.78 3.28 17.18 23 TR_XM_DK_Bayes1 50973 14.08 2.44 16.51 24 TR_XM_DK_Bayes2 47952 13.22 2.15 15.53 25 T_KAM_HTML_FONT_INVALID 44129 15.31 20.20 14.29 26 MultiRelay 44074 15.56 21.74 14.27 27 XM_Body_Dirty_Words 42654 15.77 25.11 13.81 28 RCVD_IN_RP_SAFE 39388 11.23 3.92 12.76 29 RCVD_IN_RP_CERTIFIED 36662 10.41 3.43 11.87 30 TM2_M_URI_OPT_OUT 35878 10.16 3.16 11.62 31 ANY_BOUNCE_MESSAGE 35759 9.63 0.32 11.58 32 BOUNCE_MESSAGE 35756 9.63 0.32 11.58 33 RCVD_IN_MSPIKE_H2 35617 11.16 9.35 11.53 34 HTML_IMAGE_RATIO_02 32452 11.47 16.04 10.51 35 XM_Evil_Numbers_Gen 30617 10.15 11.25 9.92 36 XM_DKIMWhitelistDomains 30201 8.09 0.03 9.78 37 RCVD_IN_MSPIKE_WL 28874 8.33 3.46 9.35 38 RCVD_IN_MSPIKE_H3 28874 8.33 3.46 9.35 39 XM_B_Unsub 26147 9.73 15.74 8.47 40 FSL_BULK_SIG 24490 9.43 16.60 7.93 41 XM_DK_Undo_02 24432 13.19 38.46 7.91 42 HTML_IMAGE_RATIO_04 23265 7.30 6.19 7.53 43 LOTS_OF_MONEY 23240 8.21 11.49 7.53 44 XM_B_Phish_Phrases 21140 6.92 7.29 6.85 45 XM_SendGrid 19775 6.40 6.36 6.40 46 LotsOfNums_01 19575 6.38 6.54 6.34 47 TooManyTo_001 19018 6.17 6.23 6.16 48 XMSexyCombo_05 18266 7.48 14.94 5.92 49 XM_H_Long_From01 17258 6.11 8.60 5.59 50 BOTNET_IPINHOSTNAME 16832 7.16 15.32 5.45 51 T_TooManySym_01 16762 5.01 3.03 5.43 52 XMStrtUSub 16568 5.13 4.03 5.37 53 XMSubMetaSx_00 15874 6.39 12.36 5.14 54 RELAYCOUNTRY_META 15131 8.18 23.85 4.90 55 BAYES_60 14197 5.09 7.43 4.60 56 FROM_EXCESS_BASE64 13860 4.32 3.53 4.49 57 MPART_ALT_DIFF 13771 4.93 7.20 4.46 58 BAYES_40 13568 4.18 3.16 4.39 59 BAYES_99 13290 8.06 26.03 4.30 60 XMNumbers 12431 4.27 5.42 4.03 61 BAYES_20 11799 3.65 2.83 3.82 62 BAYES_05 11663 3.45 1.91 3.78 63 XM_UncommonTLD01 11474 6.02 17.05 3.72 64 HTML_IMAGE_RATIO_06 11425 3.73 3.88 3.70 65 DKIM_INVALID 11332 4.96 11.15 3.67 66 BAYES_999 11052 6.42 20.03 3.58 67 MIME_QP_LONG_LINE 10742 3.38 2.88 3.48 68 TR_XM_DK_SendGrid 10487 3.16 2.00 3.40 69 MIME_HTML_MOSTLY 10444 3.85 6.08 3.38 70 T_TooManySym_02 9847 2.86 1.27 3.19 71 UNPARSEABLE_RELAY 9482 2.70 0.90 3.07 72 HTML_IMAGE_RATIO_08 9241 3.67 6.91 2.99 73 XM_DIRTYINTL 9027 3.69 7.38 2.92 74 XM_H_Trusted_IP 8954 2.40 0.00 2.90 75 RCVD_IN_IADB_LISTED 8834 2.57 1.17 2.86 76 IN_ZIMBRA_NJ_WHITELIST 8638 2.32 0.02 2.80 77 TVD_RCVD_IP 8467 2.40 0.77 2.74 78 TR_DCC_Bayes_99 8119 5.57 19.62 2.63 79 MIME_HTML_ONLY_MULTI 7839 2.69 3.43 2.54 80 XM_CamelCaseFrm001 7783 2.73 3.72 2.52 81 RCVD_IN_IADB_SPF 7692 2.24 1.01 2.49 82 BOTNET 7676 5.77 21.50 2.49 83 T_REMOTE_IMAGE 7345 2.75 4.55 2.38 84 INVALID_MSGID 7304 2.03 0.41 2.37 85 BAYES_80 7248 3.37 8.25 2.35 86 XMBdyGiftCard01 7190 2.16 1.37 2.33 87 RCVD_IN_IADB_SENDERID 6879 2.01 0.98 2.23 88 TO_MALFORMED 6846 1.84 0.02 2.22 89 NO_DNS_FOR_FROM 6744 3.25 8.37 2.18 90 RCVD_IN_IADB_DK 6664 1.96 0.99 2.16 91 XMPhish08 6644 3.23 8.41 2.15 92 CK_HELO_DYNAMIC_SPLIT_IP 6523 1.77 0.13 2.11 93 HELO_DYNAMIC_IPADDR2 6522 1.76 0.09 2.11 94 XMSubNoVowel 6339 1.80 0.60 2.05 95 XM_PDF 5591 1.56 0.38 1.81 96 XM_B_SpammyTLD 5506 1.97 2.84 1.78 97 T_XMDrugObfuBody_14 5479 1.86 2.25 1.77 98 RCVD_IN_IADB_VOUCHED 5448 1.52 0.37 1.76 99 RELAYCOUNTRY_CA 5288 2.48 6.16 1.71 100 MAILING_LIST_MULTI 5175 1.60 1.22 1.68 101 IN_HORDE_ADDRESS_BOOK 4786 1.29 0.06 1.55 102 UNTRUSTED_Relay 4719 3.81 14.70 1.53 103 XM_OfRef6 4698 1.77 2.96 1.52 104 HTML_MIME_NO_HTML_TAG 4542 2.42 6.97 1.47 105 XMStockSpam_06 4495 1.64 2.54 1.46 106 RCVD_IN_BL_SPAMCOP_NET 4451 2.12 5.36 1.44 107 BAYES_95 4444 1.90 4.09 1.44 108 USER_IN_DEF_DKIM_WL 4365 1.17 0.01 1.41 109 TM2_M_VERY_LONG_WORD 4113 1.52 2.44 1.33 110 XM_SPF_SoftFail 4040 1.76 3.95 1.31 111 XMDiploma_00 3941 1.42 2.12 1.28 112 URI_HEX 3934 1.47 2.41 1.27 113 SUBJ_ALL_CAPS 3912 1.52 2.74 1.27 114 KHOP_HELO_FCRDNS 3818 2.11 6.26 1.24 115 XM_DK_Undo_01 3640 1.15 1.00 1.18 116 XMSexyCombo_01 3623 2.16 6.87 1.17 117 RCVD_IN_IADB_OPTIN 3579 1.01 0.30 1.16 118 TooManyTo_002 3573 1.11 0.89 1.16 119 XM_H_Long_From02 3511 1.18 1.36 1.14 120 XMGappySubj_01 3450 0.99 0.35 1.12 121 URI_TRY_3LD 3385 1.15 1.39 1.10 122 T_XMDrugObfuBody_08 3342 1.28 2.24 1.08 123 PLING_QUERY 3311 1.01 0.70 1.07 124 XM_GoogleGroups 3229 0.95 0.48 1.05 125 TR_XM_PHPDW 3208 1.38 3.01 1.04 126 RELAYCOUNTRY_GB 3207 1.33 2.74 1.04 127 TR_XM_PHPForged 3174 1.36 2.96 1.03 128 TR_XM_FormFill2 3153 1.35 2.95 1.02 129 RCVD_IN_MSPIKE_BL 3152 1.63 4.55 1.02 130 XM_H_PHPOS 3142 1.35 2.94 1.02 131 DKIM_ADSP_CUSTOM_MED 3119 1.10 1.53 1.01 132 TR_Symld_Words 2995 1.03 1.33 0.97 133 T_TooManySym_03 2932 0.82 0.20 0.95 134 XMSubMetaSxObfu_03 2903 0.97 1.09 0.94 135 XMBody_17 2899 1.23 2.59 0.94 136 FILL_THIS_FORM 2811 0.84 0.51 0.91 137 TR_XM_RelayPhish 2806 1.07 1.86 0.91 138 XMSubMetaI_00 2735 1.12 2.23 0.89 139 XMHTML_After_End 2726 1.28 3.15 0.88 140 XMPhish11 2696 0.93 1.19 0.87 141 HTML_FONT_FACE_BAD 2649 0.82 0.61 0.86 142 XMBody_95 2632 0.73 0.13 0.85 143 HTML_IMAGE_ONLY_20 2555 0.72 0.23 0.83 144 XMBrknScrpt_02 2495 0.83 0.94 0.81 145 TooManyTo_003 2489 0.80 0.75 0.81 146 XM_B_Unsub2 2479 1.04 2.16 0.80 147 FILL_THIS_FORM_LONG 2472 0.74 0.45 0.80 148 T_FILL_THIS_FORM_SHORT 2373 0.94 1.74 0.77 149 NML_ADSP_CUSTOM_MED 2357 0.87 1.39 0.76 150 T_XMHurry_00 2337 1.03 2.36 0.76 151 XMGenDplmaNmb 2336 0.88 1.49 0.76 152 XM_UB50 2332 2.03 8.14 0.76 153 XM_B_REG_HTML 2329 0.75 0.72 0.75 154 T_FILL_THIS_FORM_LOAN 2305 0.64 0.13 0.75 155 XM_H_PHPOS_M 2281 1.03 2.40 0.74 156 RCVD_IN_MSPIKE_L3 2214 1.09 2.90 0.72 157 SUBJ_DOLLARS 2198 0.77 1.05 0.71 158 USER_IN_WHITELIST 2116 0.57 0.00 0.69 159 TooManyTo_004 2087 0.67 0.64 0.68 160 XMLngstWrd_00 2083 0.82 1.49 0.67 161 DIET_1 2067 0.96 2.36 0.67 162 XMLngstWrd_01 2001 0.79 1.46 0.65 163 SHORT_SHORTNER 1932 0.58 0.33 0.63 164 XM_RXBody 1866 0.62 0.68 0.60 165 TooManyTo_005 1830 0.59 0.55 0.59 166 XMPhish30 1805 0.65 0.97 0.58 167 XMSubMetaSxObfu_02 1797 0.54 0.35 0.58 168 FORGED_GMAIL_RCVD 1783 0.71 1.33 0.58 169 PDS_OTHER_BAD_TLD 1779 0.99 2.99 0.58 170 XM_ProductURIs 1772 0.77 1.70 0.57 171 XMLngstWrd_02 1757 0.71 1.39 0.57 172 TR_MetaPhish_Combo_01 1739 0.55 0.50 0.56 173 XMBSHREFv2 1700 0.52 0.40 0.55 174 XM_H_PHPMailer 1617 0.87 2.52 0.52 175 URIBL_DBL_ABUSE_REDIR 1544 0.51 0.55 0.50 176 XM_B_COPY_HTML 1490 0.58 1.04 0.48 177 XMLngstWrd_03 1488 0.61 1.23 0.48 178 HELO_NODOT 1481 0.50 0.62 0.48 179 XMHTMLBadTable_001 1479 0.63 1.37 0.48 180 THIS_AD 1437 0.63 1.39 0.47 181 HELO_NO_DOMAIN 1435 0.49 0.62 0.46 182 HTML_TAG_BALANCE_BODY 1403 0.51 0.78 0.45 183 T_XMDrugObfuBody_00 1391 0.52 0.84 0.45 184 TM2_M_A_HREF_HREF 1371 0.53 0.94 0.44 185 XMSubGiftCard1 1361 0.43 0.38 0.44 186 XM_Combo_Sbj 1356 0.41 0.26 0.44 187 XMPhish14 1350 0.54 1.03 0.44 188 SpammyFromTLD_01 1281 1.00 3.81 0.41 189 XMCapTrack 1253 0.39 0.31 0.41 190 TR_LOTS_OF_MONEY3 1251 0.50 0.97 0.41 191 RDNS_DYNAMIC 1240 1.18 4.89 0.40 192 DKIM_ADSP_NXDOMAIN 1229 0.43 0.61 0.40 193 XMLngstWrd_04 1219 0.50 1.01 0.39 194 XM_shorewaves_Whitelist 1203 0.32 0.00 0.39 195 XMNoVowels 1194 0.38 0.33 0.39 196 XMSolicitRefs_0 1186 0.45 0.75 0.38 197 RELAYCOUNTRY_DE 1177 0.51 1.14 0.38 198 T_MONEY_PERCENT 1159 0.64 1.93 0.38 199 TR_LOTS_OF_MONEY2 1159 0.64 1.93 0.38 200 XM_URI_RBL 1149 0.82 2.95 0.37 ----------------------------------------------------------------------