Email: 372896 Autolearn: 0 AvgScore: 1.48 AvgScanTime: 1.71 sec Spam: 82782 Autolearn: 0 AvgScore: 11.65 AvgScanTime: 2.68 sec Ham: 290114 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.44 sec Time Spent Running SA: 177.52 hours Time Spent Processing Spam: 61.56 hours Time Spent Processing Ham: 115.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77603 81.86 93.74 78.47 2 DKIM_SIGNED 60781 73.52 73.42 73.54 3 XM_DK_Pass 59090 72.28 71.38 72.53 4 RELAYCOUNTRY_US 58640 73.69 70.84 74.51 5 DCC_CHECK 56726 50.36 68.52 45.18 6 XM_B_Unicode 56144 67.53 67.82 67.45 7 DKIM_VALID 52850 68.63 63.84 69.99 8 XMListUnsubscribeExists 49584 55.11 59.90 53.74 9 BAYES_50 42971 46.37 51.91 44.79 10 DKIM_VALID_AU 40967 56.03 49.49 57.89 11 XM_B_Unicode3 37046 43.73 44.75 43.43 12 XM_DK_Undo_02 26567 13.36 32.09 8.01 13 HTML_FONT_LOW_CONTRAST 25960 30.63 31.36 30.43 14 LOC_TINY_FONT_1 25177 28.57 30.41 28.05 15 DCC_CHECK_NEGATIVE 25093 48.51 30.31 53.70 16 MIME_HTML_ONLY 24347 23.46 29.41 21.76 17 FVGT_m_MULTI_ODD 19821 20.86 23.94 19.98 18 XMSubLong 19039 21.01 23.00 20.44 19 UNTRUSTED_Relay 18582 6.37 22.45 1.78 20 DKIM_VALID_EF 18399 24.98 22.23 25.77 21 BAYES_99 16993 8.23 20.53 4.72 22 T_TM2_M_HEADER_IN_MSG 16325 20.72 19.72 21.00 23 XM_Body_Dirty_Words 15510 15.00 18.74 13.94 24 T_KAM_HTML_FONT_INVALID 15330 14.98 18.52 13.98 25 XM_B_Phish_Phrases 14322 9.87 17.30 7.75 26 RELAYCOUNTRY_META 14308 7.88 17.28 5.20 27 XM_UB50 14192 4.52 17.14 0.91 28 BOTNET 14155 5.68 17.10 2.43 29 XM_Multi_Part_URI 13078 17.25 15.80 17.67 30 HTML_IMAGE_RATIO_02 12900 11.79 15.58 10.71 31 BAYES_999 12838 6.50 15.51 3.93 32 MIME_QP_LONG_LINE 12831 6.23 15.50 3.58 33 TM2_M_URI_OPT_OUT 12451 12.54 15.04 11.83 34 XM_B_Unsub 12316 10.84 14.88 9.69 35 TR_DCC_Bayes_99 11790 5.40 14.24 2.87 36 BOTNET_IPINHOSTNAME 11060 7.30 13.36 5.57 37 FSL_BULK_SIG 10542 8.72 12.73 7.57 38 LOTS_OF_MONEY 10225 9.35 12.35 8.50 39 XM_Evil_Numbers_Gen 10088 10.51 12.19 10.03 40 MISSING_HEADERS 9702 2.81 11.72 0.27 41 XM_UncommonTLD01 9333 5.28 11.27 3.56 42 XM_B_Illumintati 9039 2.44 10.92 0.03 43 HELO_NODOT 8958 2.75 10.82 0.45 44 HELO_NO_DOMAIN 8921 2.74 10.78 0.44 45 RELAYCOUNTRY_NG_I 8537 2.29 10.31 0.00 46 XMSexyCombo_05 8386 6.39 10.13 5.32 47 XMSubNoVowel 7974 3.02 9.63 1.14 48 DKIM_INVALID 7931 4.89 9.58 3.55 49 XMSubEmpty 7892 2.23 9.53 0.15 50 RCVD_IN_MSPIKE_H2 7841 10.93 9.47 11.35 51 XMSubMetaSx_00 6917 5.38 8.36 4.53 52 LotsOfNums_01 6733 7.06 8.13 6.76 53 MPART_ALT_DIFF 6203 4.96 7.49 4.23 54 NO_DNS_FOR_FROM 5860 3.10 7.08 1.97 55 XM_H_Long_From01 5842 5.90 7.06 5.57 56 BAYES_80 5803 3.43 7.01 2.41 57 KHOP_HELO_FCRDNS 5773 2.33 6.97 1.00 58 HTML_IMAGE_RATIO_04 5277 6.46 6.37 6.48 59 TooManyTo_001 5094 5.92 6.15 5.85 60 MIME_HTML_MOSTLY 4997 4.02 6.04 3.44 61 BAYES_60 4678 4.87 5.65 4.65 62 RCVD_IN_BL_SPAMCOP_NET 4183 1.97 5.05 1.09 63 XM_SendGrid 3987 6.22 4.82 6.63 64 XM_CamelCaseFrm001 3825 2.99 4.62 2.52 65 FROM_EXCESS_BASE64 3807 3.96 4.60 3.78 66 XM_SPF_SoftFail 3643 1.85 4.40 1.12 67 RELAYCOUNTRY_CA 3219 2.38 3.89 1.95 68 XMStrtUSub 3197 5.53 3.86 6.01 69 RCVD_IN_RP_RNBL 3174 0.93 3.83 0.10 70 BAYES_95 3127 2.06 3.78 1.56 71 T_REMOTE_IMAGE 3091 2.90 3.73 2.67 72 BAYES_00 2927 23.91 3.54 29.72 73 BAYES_40 2892 4.34 3.49 4.58 74 RDNS_DYNAMIC 2835 1.06 3.42 0.38 75 RCVD_IN_MSPIKE_BL 2815 1.56 3.40 1.04 76 HTML_IMAGE_RATIO_06 2720 3.63 3.29 3.73 77 TR_Mismatch_TLD_02 2652 0.75 3.20 0.04 78 MIME_HTML_ONLY_MULTI 2520 2.58 3.04 2.45 79 XMNumbers 2502 3.73 3.02 3.93 80 XM_DIRTYINTL 2499 1.05 3.02 0.49 81 XM_OfRef6 2487 1.88 3.00 1.57 82 TR_XM_DK_Bayes 2390 14.78 2.89 18.17 83 FROM_MISSP_REPLYTO 2300 0.63 2.78 0.02 84 RCVD_IN_MSPIKE_H3 2295 8.47 2.77 10.10 85 SpammyFromTLD_01 2295 0.88 2.77 0.35 86 RCVD_IN_MSPIKE_WL 2295 8.47 2.77 10.10 87 SUBJ_ALL_CAPS 2290 1.58 2.77 1.24 88 XMSubMetaI_00 2278 1.32 2.75 0.92 89 T_TooManySym_01 2240 4.56 2.71 5.08 90 RCVD_IN_RP_SAFE 2222 11.10 2.68 13.50 91 XMSexyCombo_01 2194 1.66 2.65 1.38 92 SpammyFromTLD_02 2161 0.71 2.61 0.17 93 RCVD_IN_MSPIKE_L3 2158 1.13 2.61 0.70 94 TR_XM_PHPDW 2151 1.02 2.60 0.56 95 BAYES_20 2142 3.60 2.59 3.88 96 TR_XM_PHPForged 2116 1.00 2.56 0.55 97 TR_XM_FormFill2 2106 0.99 2.54 0.55 98 XM_H_PHPOS 2100 0.99 2.54 0.55 99 XM_B_SpammyTLD 2068 2.19 2.50 2.10 100 ALL_TRUSTED 2056 17.37 2.48 21.62 101 HTML_IMAGE_RATIO_08 2046 2.68 2.47 2.73 102 RCVD_IN_RP_CERTIFIED 2046 10.32 2.47 12.56 103 T_XMDrugObfuBody_08 2018 1.37 2.44 1.07 104 PDS_OTHER_BAD_TLD 2008 1.05 2.43 0.66 105 BODY_URI_ONLY 1987 0.56 2.40 0.03 106 XMBody_17 1982 1.18 2.39 0.83 107 TR_LOTS_OF_MONEY1 1959 0.53 2.37 0.01 108 HTML_IMAGE_ONLY_08 1928 0.59 2.33 0.09 109 XMStockSpam_06 1886 1.81 2.28 1.68 110 RELAYCOUNTRY_FR 1864 0.74 2.25 0.31 111 NO_FM_NAME_IP_HOSTN 1827 0.49 2.21 0.00 112 XMBdyGiftCard01 1818 2.29 2.20 2.32 113 FROM_MISSP_DYNIP 1813 0.49 2.19 0.00 114 TR_XM_DK_Bayes1 1813 14.13 2.19 17.54 115 XMDiploma_00 1804 1.41 2.18 1.19 116 URI_HEX 1774 1.27 2.14 1.02 117 T_XMDrugObfuBody_14 1718 1.68 2.08 1.56 118 ANY_BOUNCE_MESSAGE 1692 9.56 2.04 11.71 119 BOUNCE_MESSAGE 1690 9.56 2.04 11.71 120 XMLngstWrd_00 1649 0.85 1.99 0.53 121 XM_H_PHPOS_M 1646 0.68 1.99 0.31 122 XMLngstWrd_01 1630 0.81 1.97 0.48 123 TR_XM_DK_SendGrid 1588 3.41 1.92 3.84 124 TM2_M_VERY_LONG_WORD 1549 1.46 1.87 1.34 125 XM_URI_RBL 1548 0.58 1.87 0.21 126 URI_OPTOUT_3LD 1504 0.45 1.82 0.06 127 BOTNET_NORDNS 1496 0.42 1.81 0.02 128 TR_XM_INV_DKIM 1490 0.55 1.80 0.20 129 XM_B_Unsub2 1479 1.12 1.79 0.93 130 TR_XM_DK_Bayes2 1476 13.28 1.78 16.56 131 XM_H_PHPMailer 1454 0.79 1.76 0.51 132 RELAYCOUNTRY_IN 1441 0.42 1.74 0.05 133 RCVD_IN_PSBL 1428 0.38 1.73 0.00 134 HTML_MIME_NO_HTML_TAG 1369 1.64 1.65 1.64 135 RELAYCOUNTRY_DE 1367 0.74 1.65 0.48 136 DIET_1 1352 0.80 1.63 0.56 137 TR_XM_RelayPhish 1329 0.50 1.61 0.19 138 XMGenDplmaNmb 1321 0.89 1.60 0.69 139 T_XMHurry_00 1320 1.15 1.59 1.02 140 REPLYTO_WITHOUT_TO_CC 1306 0.38 1.58 0.03 141 DATE_IN_PAST_03_06 1299 0.41 1.57 0.09 142 XMSubMetaSSx_00 1297 0.61 1.57 0.34 143 RCVD_IN_IADB_LISTED 1293 2.89 1.56 3.26 144 TR_Symld_Words 1291 1.29 1.56 1.21 145 RCVD_IN_IADB_SPF 1220 2.53 1.47 2.83 146 XMSlimDrugH 1217 0.68 1.47 0.45 147 RCVD_IN_IADB_SENDERID 1206 2.27 1.46 2.50 148 RCVD_IN_IADB_DK 1202 2.20 1.45 2.42 149 XMHTML_After_End 1181 0.82 1.43 0.64 150 URIBL_SBL_A 1176 0.52 1.42 0.26 151 BAYES_05 1136 3.10 1.37 3.59 152 RELAYCOUNTRY_AT 1126 0.56 1.36 0.34 153 NORDNS_LOW_CONTRAST 1122 0.30 1.36 0.00 154 URIBL_DBL_ABUSE_REDIR 1113 0.67 1.34 0.48 155 FROM_SUSPICIOUS_NTLD 1112 0.31 1.34 0.02 156 XM_UB99 1091 0.30 1.32 0.01 157 FROM_SUSPICIOUS_NTLD_FP 1081 0.30 1.31 0.02 158 XM_ProductURIs 1067 0.94 1.29 0.84 159 TR_Mismatch_TLD_01 1032 0.48 1.25 0.26 160 URIBL_ABUSE_SURBL 1028 0.32 1.24 0.06 161 DATE_IN_PAST_06_12 1025 0.31 1.24 0.05 162 XM_DK_Undo_01 1010 1.23 1.22 1.23 163 RELAYCOUNTRY_GB 1007 0.81 1.22 0.70 164 URIBL_DBL_SPAM 1003 0.30 1.21 0.04 165 MAILING_LIST_MULTI 995 1.61 1.20 1.72 166 HK_RANDOM_REPLYTO 983 0.43 1.19 0.21 167 XMSexyCombo_04 977 0.86 1.18 0.76 168 DKIM_ADSP_CUSTOM_MED 977 1.00 1.18 0.95 169 XM_SPF_Unknown 930 0.44 1.12 0.24 170 T_XMDrugObfuBody_00 894 0.85 1.08 0.78 171 THIS_AD 884 0.85 1.07 0.79 172 NML_ADSP_CUSTOM_MED 876 0.78 1.06 0.71 173 XMPhish08 874 0.74 1.06 0.65 174 MONEY_FRAUD_5 865 0.24 1.04 0.01 175 MPART_ALT_DIFF_COUNT 863 0.51 1.04 0.36 176 FORGED_GMAIL_RCVD 860 0.62 1.04 0.50 177 XMBounce_01 839 0.26 1.01 0.05 178 TR_LOTS_OF_MONEY3 822 0.49 0.99 0.35 179 LongTLD 813 0.31 0.98 0.12 180 UNPARSEABLE_RELAY 808 2.89 0.98 3.43 181 XMBody_29 805 0.27 0.97 0.07 182 XMMoneyMeta_00 800 0.34 0.97 0.16 183 XMSubMetaSxObfu_03 788 0.72 0.95 0.65 184 XMSubGiftCard1 787 0.29 0.95 0.10 185 LONG_JUNK_URI2 786 0.28 0.95 0.09 186 XM_UB60 769 0.27 0.93 0.08 187 XMGppyBdWords 749 0.64 0.90 0.56 188 XM_B_COPY_HTML 738 0.50 0.89 0.39 189 T_TooManySym_02 736 2.43 0.89 2.86 190 XMPhish30 736 0.63 0.89 0.56 191 DEAR_SOMETHING 730 0.29 0.88 0.12 192 XMBody_78 724 0.47 0.87 0.36 193 TM2_M_A_HREF_HREF 721 0.67 0.87 0.62 194 URIBL_BLACK 708 0.20 0.86 0.01 195 FILL_THIS_FORM 695 0.84 0.84 0.84 196 XM_UB999 682 0.19 0.82 0.01 197 TR_Caps_n_Bayes_99 672 0.26 0.81 0.11 198 TR_LOTS_OF_MONEY2 671 0.60 0.81 0.53 199 T_MONEY_PERCENT 671 0.60 0.81 0.53 200 URI_TRY_3LD 669 1.21 0.81 1.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 227642 81.86 93.74 78.47 2 RELAYCOUNTRY_US 216150 73.69 70.84 74.51 3 DKIM_SIGNED 213362 73.52 73.42 73.54 4 XM_DK_Pass 210422 72.28 71.38 72.53 5 DKIM_VALID 203056 68.63 63.84 69.99 6 XM_B_Unicode 195677 67.53 67.82 67.45 7 DKIM_VALID_AU 167950 56.03 49.49 57.89 8 XMListUnsubscribeExists 155915 55.11 59.90 53.74 9 DCC_CHECK_NEGATIVE 155801 48.51 30.31 53.70 10 DCC_CHECK 131071 50.36 68.52 45.18 11 BAYES_50 129933 46.37 51.91 44.79 12 XM_B_Unicode3 126005 43.73 44.75 43.43 13 HTML_FONT_LOW_CONTRAST 88275 30.63 31.36 30.43 14 BAYES_00 86214 23.91 3.54 29.72 15 LOC_TINY_FONT_1 81374 28.57 30.41 28.05 16 DKIM_VALID_EF 74764 24.98 22.23 25.77 17 MIME_HTML_ONLY 63131 23.46 29.41 21.76 18 ALL_TRUSTED 62732 17.37 2.48 21.62 19 T_TM2_M_HEADER_IN_MSG 60935 20.72 19.72 21.00 20 XMSubLong 59305 21.01 23.00 20.44 21 FVGT_m_MULTI_ODD 57954 20.86 23.94 19.98 22 TR_XM_DK_Bayes 52720 14.78 2.89 18.17 23 XM_Multi_Part_URI 51265 17.25 15.80 17.67 24 TR_XM_DK_Bayes1 50876 14.13 2.19 17.54 25 TR_XM_DK_Bayes2 48050 13.28 1.78 16.56 26 T_KAM_HTML_FONT_INVALID 40546 14.98 18.52 13.98 27 XM_Body_Dirty_Words 40437 15.00 18.74 13.94 28 RCVD_IN_RP_SAFE 39177 11.10 2.68 13.50 29 RCVD_IN_RP_CERTIFIED 36446 10.32 2.47 12.56 30 TM2_M_URI_OPT_OUT 34312 12.54 15.04 11.83 31 ANY_BOUNCE_MESSAGE 33968 9.56 2.04 11.71 32 BOUNCE_MESSAGE 33966 9.56 2.04 11.71 33 RCVD_IN_MSPIKE_H2 32917 10.93 9.47 11.35 34 HTML_IMAGE_RATIO_02 31058 11.79 15.58 10.71 35 XM_DKIMWhitelistDomains 29703 7.99 0.11 10.24 36 RCVD_IN_MSPIKE_H3 29290 8.47 2.77 10.10 37 RCVD_IN_MSPIKE_WL 29290 8.47 2.77 10.10 38 XM_Evil_Numbers_Gen 29101 10.51 12.19 10.03 39 XM_B_Unsub 28114 10.84 14.88 9.69 40 LOTS_OF_MONEY 24649 9.35 12.35 8.50 41 XM_DK_Undo_02 23251 13.36 32.09 8.01 42 XM_B_Phish_Phrases 22485 9.87 17.30 7.75 43 FSL_BULK_SIG 21966 8.72 12.73 7.57 44 LotsOfNums_01 19601 7.06 8.13 6.76 45 XM_SendGrid 19223 6.22 4.82 6.63 46 HTML_IMAGE_RATIO_04 18805 6.46 6.37 6.48 47 XMStrtUSub 17435 5.53 3.86 6.01 48 TooManyTo_001 16971 5.92 6.15 5.85 49 XM_H_Long_From01 16161 5.90 7.06 5.57 50 BOTNET_IPINHOSTNAME 16146 7.30 13.36 5.57 51 XMSexyCombo_05 15441 6.39 10.13 5.32 52 RELAYCOUNTRY_META 15082 7.88 17.28 5.20 53 T_TooManySym_01 14752 4.56 2.71 5.08 54 BAYES_99 13680 8.23 20.53 4.72 55 BAYES_60 13489 4.87 5.65 4.65 56 BAYES_40 13283 4.34 3.49 4.58 57 XMSubMetaSx_00 13128 5.38 8.36 4.53 58 MPART_ALT_DIFF 12276 4.96 7.49 4.23 59 XMNumbers 11398 3.73 3.02 3.93 60 BAYES_999 11393 6.50 15.51 3.93 61 BAYES_20 11268 3.60 2.59 3.88 62 TR_XM_DK_SendGrid 11145 3.41 1.92 3.84 63 FROM_EXCESS_BASE64 10952 3.96 4.60 3.78 64 HTML_IMAGE_RATIO_06 10834 3.63 3.29 3.73 65 BAYES_05 10425 3.10 1.37 3.59 66 MIME_QP_LONG_LINE 10389 6.23 15.50 3.58 67 XM_UncommonTLD01 10341 5.28 11.27 3.56 68 DKIM_INVALID 10306 4.89 9.58 3.55 69 MIME_HTML_MOSTLY 9985 4.02 6.04 3.44 70 UNPARSEABLE_RELAY 9957 2.89 0.98 3.43 71 RCVD_IN_IADB_LISTED 9469 2.89 1.56 3.26 72 IN_ZIMBRA_NJ_WHITELIST 8517 2.29 0.01 2.94 73 TR_DCC_Bayes_99 8336 5.40 14.24 2.87 74 T_TooManySym_02 8308 2.43 0.89 2.86 75 RCVD_IN_IADB_SPF 8207 2.53 1.47 2.83 76 HTML_IMAGE_RATIO_08 7933 2.68 2.47 2.73 77 T_REMOTE_IMAGE 7741 2.90 3.73 2.67 78 TVD_RCVD_IP 7673 2.19 0.60 2.64 79 INVALID_MSGID 7341 2.04 0.32 2.53 80 XM_CamelCaseFrm001 7316 2.99 4.62 2.52 81 RCVD_IN_IADB_SENDERID 7251 2.27 1.46 2.50 82 MIME_HTML_ONLY_MULTI 7108 2.58 3.04 2.45 83 BOTNET 7039 5.68 17.10 2.43 84 RCVD_IN_IADB_DK 7013 2.20 1.45 2.42 85 BAYES_80 7004 3.43 7.01 2.41 86 TO_MALFORMED 6825 1.83 0.02 2.35 87 XMBdyGiftCard01 6717 2.29 2.20 2.32 88 CK_HELO_DYNAMIC_SPLIT_IP 6380 1.75 0.18 2.20 89 HELO_DYNAMIC_IPADDR2 6379 1.73 0.07 2.20 90 RCVD_IN_IADB_VOUCHED 6117 1.70 0.29 2.11 91 XM_B_SpammyTLD 6091 2.19 2.50 2.10 92 NO_DNS_FOR_FROM 5718 3.10 7.08 1.97 93 XM_PDF 5686 1.62 0.43 1.96 94 RELAYCOUNTRY_CA 5660 2.38 3.89 1.95 95 XM_H_Trusted_IP 5301 1.42 0.00 1.83 96 UNTRUSTED_Relay 5176 6.37 22.45 1.78 97 MAILING_LIST_MULTI 4990 1.61 1.20 1.72 98 XMStockSpam_06 4876 1.81 2.28 1.68 99 HTML_MIME_NO_HTML_TAG 4763 1.64 1.65 1.64 100 XM_OfRef6 4542 1.88 3.00 1.57 101 BAYES_95 4538 2.06 3.78 1.56 102 T_XMDrugObfuBody_14 4532 1.68 2.08 1.56 103 IN_HORDE_ADDRESS_BOOK 4484 1.21 0.02 1.55 104 USER_IN_DEF_DKIM_WL 4423 1.19 0.01 1.52 105 TR_MSPIKEBAYES00 4220 1.17 0.15 1.45 106 RCVD_IN_IADB_OPTIN 4053 1.16 0.31 1.40 107 XMSexyCombo_01 4010 1.66 2.65 1.38 108 TM2_M_VERY_LONG_WORD 3884 1.46 1.87 1.34 109 URI_TRY_3LD 3837 1.21 0.81 1.32 110 XM_H_Long_From02 3646 1.13 0.68 1.26 111 SUBJ_ALL_CAPS 3592 1.58 2.77 1.24 112 XM_DK_Undo_01 3560 1.23 1.22 1.23 113 TR_Symld_Words 3524 1.29 1.56 1.21 114 XMGappySubj_01 3501 0.95 0.06 1.21 115 XMDiploma_00 3445 1.41 2.18 1.19 116 XMSubNoVowel 3300 3.02 9.63 1.14 117 XM_GoogleGroups 3279 0.97 0.43 1.13 118 XM_SPF_SoftFail 3254 1.85 4.40 1.12 119 TooManyTo_002 3200 1.03 0.75 1.10 120 RCVD_IN_BL_SPAMCOP_NET 3174 1.97 5.05 1.09 121 T_XMDrugObfuBody_08 3105 1.37 2.44 1.07 122 RCVD_IN_MSPIKE_BL 3009 1.56 3.40 1.04 123 T_XMHurry_00 2972 1.15 1.59 1.02 124 URI_HEX 2965 1.27 2.14 1.02 125 KHOP_HELO_FCRDNS 2908 2.33 6.97 1.00 126 XM_RXBody 2874 0.87 0.46 0.99 127 DKIM_ADSP_CUSTOM_MED 2745 1.00 1.18 0.95 128 XM_B_Unsub2 2693 1.12 1.79 0.93 129 XM_B_REG_HTML 2687 0.83 0.47 0.93 130 XMSubMetaI_00 2661 1.32 2.75 0.92 131 XM_UB50 2653 4.52 17.14 0.91 132 XMBody_95 2564 0.72 0.14 0.88 133 HTML_FONT_FACE_BAD 2523 0.82 0.63 0.87 134 PLING_QUERY 2483 0.83 0.75 0.86 135 T_FILL_THIS_FORM_SHORT 2452 0.83 0.77 0.85 136 XM_ProductURIs 2444 0.94 1.29 0.84 137 FILL_THIS_FORM 2428 0.84 0.84 0.84 138 XMBody_17 2404 1.18 2.39 0.83 139 TR_MetaPhish_Combo_01 2329 0.80 0.78 0.80 140 THIS_AD 2296 0.85 1.07 0.79 141 T_XMDrugObfuBody_00 2274 0.85 1.08 0.78 142 TooManyTo_003 2246 0.74 0.63 0.77 143 XMSexyCombo_04 2217 0.86 1.18 0.76 144 FILL_THIS_FORM_LONG 2145 0.64 0.28 0.74 145 T_FILL_THIS_FORM_LOAN 2120 0.59 0.08 0.73 146 NML_ADSP_CUSTOM_MED 2051 0.78 1.06 0.71 147 RCVD_IN_MSPIKE_L3 2040 1.13 2.61 0.70 148 RELAYCOUNTRY_GB 2031 0.81 1.22 0.70 149 XMGenDplmaNmb 1989 0.89 1.60 0.69 150 HTML_TAG_BALANCE_BODY 1956 0.70 0.81 0.67 151 USER_IN_WHITELIST 1955 0.52 0.00 0.67 152 PDS_OTHER_BAD_TLD 1901 1.05 2.43 0.66 153 XMSubMetaSxObfu_03 1887 0.72 0.95 0.65 154 XMPhish08 1880 0.74 1.06 0.65 155 XMHTMLBadTable_001 1877 0.67 0.76 0.65 156 XMHTML_After_End 1863 0.82 1.43 0.64 157 TooManyTo_004 1859 0.61 0.52 0.64 158 TM2_M_A_HREF_HREF 1792 0.67 0.87 0.62 159 TR_XM_PHPDW 1639 1.02 2.60 0.56 160 TooManyTo_005 1635 0.53 0.41 0.56 161 XMGppyBdWords 1635 0.64 0.90 0.56 162 XMSubMetaSxObfu_02 1629 0.49 0.26 0.56 163 DIET_1 1619 0.80 1.63 0.56 164 XMPhish30 1617 0.63 0.89 0.56 165 TR_XM_PHPForged 1607 1.00 2.56 0.55 166 TR_XM_FormFill2 1598 0.99 2.54 0.55 167 XM_H_PHPOS 1582 0.99 2.54 0.55 168 T_TooManySym_03 1559 0.47 0.24 0.54 169 TR_LOTS_OF_MONEY2 1551 0.60 0.81 0.53 170 T_MONEY_PERCENT 1551 0.60 0.81 0.53 171 SHORT_SHORTNER 1542 0.55 0.61 0.53 172 XMLngstWrd_00 1538 0.85 1.99 0.53 173 XM_H_PHPMailer 1481 0.79 1.76 0.51 174 FORGED_GMAIL_RCVD 1458 0.62 1.04 0.50 175 XM_DIRTYINTL 1420 1.05 3.02 0.49 176 XMBSHREFv2 1417 0.49 0.49 0.49 177 XMNoVowels 1415 0.50 0.54 0.49 178 XMLngstWrd_01 1404 0.81 1.97 0.48 179 URIBL_DBL_ABUSE_REDIR 1404 0.67 1.34 0.48 180 RELAYCOUNTRY_DE 1391 0.74 1.65 0.48 181 XMBrknScrpt_02 1378 0.50 0.58 0.47 182 T_Symld_Words_02 1369 0.48 0.50 0.47 183 XMSlimDrugH 1301 0.68 1.47 0.45 184 HELO_NODOT 1296 2.75 10.82 0.45 185 XMOemUri 1290 0.39 0.18 0.44 186 HELO_NO_DOMAIN 1287 2.74 10.78 0.44 187 SUBJ_DOLLARS 1258 0.44 0.47 0.43 188 XMPhish14 1250 0.46 0.58 0.43 189 XMSolicitRefs_0 1192 0.46 0.64 0.41 190 LOW_PRICE 1158 0.47 0.70 0.40 191 DKIM_ADSP_NXDOMAIN 1143 0.45 0.63 0.39 192 XMCapTrack 1139 0.42 0.50 0.39 193 XM_B_COPY_HTML 1136 0.50 0.89 0.39 194 XMRcvdHeader_15 1128 0.30 0.00 0.39 195 RDNS_DYNAMIC 1108 1.06 3.42 0.38 196 HTML_IMAGE_ONLY_20 1108 0.34 0.18 0.38 197 FSL_HELO_FAKE 1092 0.30 0.04 0.38 198 XM_H_Undi_Recip 1082 0.45 0.73 0.37 199 XMLngstWrd_02 1058 0.36 0.35 0.36 200 XMBody_78 1044 0.47 0.87 0.36 ----------------------------------------------------------------------