Email: 351981 Autolearn: 0 AvgScore: 1.12 AvgScanTime: 1.80 sec Spam: 68636 Autolearn: 0 AvgScore: 12.61 AvgScanTime: 2.91 sec Ham: 283345 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 1.53 sec Time Spent Running SA: 175.80 hours Time Spent Processing Spam: 55.51 hours Time Spent Processing Ham: 120.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 63942 87.63 93.16 86.29 2 DCC_CHECK 53648 53.59 78.16 47.63 3 DKIM_SIGNED 53622 79.67 78.13 80.04 4 RELAYCOUNTRY_US 52848 81.11 77.00 82.11 5 XM_DK_Pass 52578 78.60 76.60 79.08 6 XM_B_Unicode 49441 73.85 72.03 74.29 7 XMListUnsubscribeExists 46904 59.91 68.34 57.87 8 DKIM_VALID 46209 74.40 67.32 76.11 9 DKIM_VALID_AU 35150 59.08 51.21 60.99 10 XM_B_Unicode3 31231 46.88 45.50 47.21 11 XM_DK_Undo_02 30688 16.48 44.71 9.64 12 BAYES_50 26634 48.89 38.80 51.34 13 MIME_HTML_ONLY 26522 27.23 38.64 24.47 14 LOC_TINY_FONT_1 24324 30.21 35.44 28.94 15 HTML_FONT_LOW_CONTRAST 21027 31.38 30.64 31.56 16 BAYES_99 20196 10.51 29.42 5.93 17 DKIM_VALID_EF 18639 27.49 27.16 27.57 18 XMSubLong 17000 21.26 24.77 20.42 19 BOTNET 16557 6.97 24.12 2.81 20 FVGT_m_MULTI_ODD 16433 22.51 23.94 22.16 21 BAYES_999 15787 8.36 23.00 4.81 22 TR_DCC_Bayes_99 14908 6.46 21.72 2.76 23 T_KAM_HTML_FONT_INVALID 14467 18.12 21.08 17.40 24 DCC_CHECK_NEGATIVE 14274 45.26 20.80 51.19 25 XM_Body_Dirty_Words 13856 15.66 20.19 14.56 26 XM_UncommonTLD01 13610 6.82 19.83 3.67 27 RELAYCOUNTRY_META 13157 7.94 19.17 5.22 28 T_TM2_M_HEADER_IN_MSG 13053 21.72 19.02 22.38 29 XM_Multi_Part_URI 12365 15.43 18.02 14.80 30 FSL_BULK_SIG 11278 9.69 16.43 8.05 31 LOTS_OF_MONEY 10469 11.89 15.25 11.07 32 BOTNET_IPINHOSTNAME 9862 7.46 14.37 5.78 33 HTML_IMAGE_RATIO_02 9576 10.87 13.95 10.12 34 UNTRUSTED_Relay 9494 4.08 13.83 1.72 35 XMSexyCombo_05 7901 6.51 11.51 5.30 36 SpammyFromTLD_02 7856 2.49 11.45 0.33 37 DKIM_INVALID 7413 5.27 10.80 3.93 38 XM_B_Unsub 7186 10.89 10.47 10.99 39 NO_DNS_FOR_FROM 6598 3.72 9.61 2.29 40 XM_Evil_Numbers_Gen 6476 10.10 9.44 10.26 41 XMSubMetaSx_00 6155 5.55 8.97 4.73 42 XM_B_Phish_Phrases 5924 7.90 8.63 7.72 43 XMNumbers 5686 5.12 8.28 4.36 44 MPART_ALT_DIFF 5546 5.86 8.08 5.32 45 BAYES_80 5450 4.15 7.94 3.23 46 BAYES_60 5292 6.07 7.71 5.67 47 HTML_IMAGE_RATIO_04 4874 7.11 7.10 7.11 48 XM_UB50 4855 2.17 7.07 0.99 49 LotsOfNums_01 4778 7.64 6.96 7.80 50 TooManyTo_001 4523 6.74 6.59 6.78 51 XM_SPF_SoftFail 4412 2.13 6.43 1.09 52 KHOP_HELO_FCRDNS 4360 2.03 6.35 0.99 53 XM_H_Long_From01 4076 6.24 5.94 6.31 54 BODY_URI_ONLY 3945 1.15 5.75 0.04 55 XM_CamelCaseFrm001 3799 3.23 5.53 2.67 56 TR_Mismatch_TLD_02 3729 1.11 5.43 0.06 57 XMHTML_After_End 3709 1.62 5.40 0.70 58 PDS_OTHER_BAD_TLD 3507 1.62 5.11 0.77 59 T_REMOTE_IMAGE 3493 4.03 5.09 3.78 60 RELAYCOUNTRY_CA 3459 2.88 5.04 2.36 61 RCVD_IN_MSPIKE_BL 3424 2.03 4.99 1.31 62 RDNS_DYNAMIC 3279 1.30 4.78 0.45 63 MIME_HTML_MOSTLY 3268 2.83 4.76 2.36 64 RCVD_IN_BL_SPAMCOP_NET 3206 1.85 4.67 1.17 65 BAYES_95 3201 2.51 4.66 1.99 66 RCVD_IN_MSPIKE_L3 3195 1.75 4.65 1.05 67 RCVD_IN_RP_RNBL 3191 1.08 4.65 0.22 68 XM_B_SpammyTLD 3188 2.99 4.64 2.59 69 RCVD_IN_MSPIKE_H2 3047 9.53 4.44 10.76 70 FROM_ADDR_WS 2968 0.85 4.32 0.00 71 TR_Symld_Words 2941 2.12 4.28 1.60 72 NO_FM_NAME_IP_HOSTN 2798 0.79 4.08 0.00 73 FROM_NO_USER 2783 0.80 4.05 0.01 74 FROM_SUSPICIOUS_NTLD 2744 0.83 4.00 0.06 75 FROM_SUSPICIOUS_NTLD_FP 2696 0.81 3.93 0.06 76 XMBody_17 2672 1.55 3.89 0.98 77 MIME_QP_LONG_LINE 2667 4.13 3.89 4.19 78 ALL_TRUSTED 2657 11.77 3.87 13.69 79 URIBL_SBL_A 2558 0.90 3.73 0.21 80 MIME_HTML_ONLY_MULTI 2525 3.47 3.68 3.42 81 XM_SendGrid 2505 6.96 3.65 7.76 82 RCVD_IN_RP_SAFE 2492 11.40 3.63 13.28 83 FROM_EXCESS_BASE64 2470 4.46 3.60 4.67 84 BOTNET_NORDNS 2453 0.72 3.57 0.03 85 REPLYTO_WITHOUT_TO_CC 2445 0.80 3.56 0.13 86 BAYES_40 2393 4.56 3.49 4.82 87 XMStrtUSub 2334 4.42 3.40 4.66 88 HTML_IMAGE_RATIO_06 2283 3.52 3.33 3.56 89 HTML_SHORT_LINK_IMG_1 2262 0.66 3.30 0.02 90 HTML_IMAGE_ONLY_12 2248 0.76 3.28 0.15 91 BAYES_20 2208 3.59 3.22 3.69 92 XM_DIRTYINTL 2173 1.09 3.17 0.59 93 MIME_HEADER_CTYPE_ONLY 2164 0.86 3.15 0.31 94 DIET_1 2126 1.23 3.10 0.78 95 HDRS_LCASE_IMGONLY 2107 0.60 3.07 0.01 96 URI_HEX 2018 2.05 2.94 1.84 97 T_XMDrugObfuBody_08 2014 1.72 2.93 1.43 98 RCVD_IN_MSPIKE_H3 2007 8.13 2.92 9.39 99 RCVD_IN_MSPIKE_WL 2007 8.13 2.92 9.39 100 DATE_IN_PAST_03_06 1994 0.64 2.91 0.09 101 T_TooManySym_01 1960 5.12 2.86 5.67 102 TR_Mismatch_TLD_01 1957 0.77 2.85 0.27 103 RELAYCOUNTRY_FR 1942 0.75 2.83 0.24 104 XMSexyCombo_01 1891 1.05 2.76 0.64 105 XM_OfRef6 1889 1.90 2.75 1.70 106 XM_B_COPY_HTML 1834 1.06 2.67 0.67 107 TR_XM_MaxBayes 1792 0.52 2.61 0.01 108 BAYES_00 1790 16.89 2.61 20.35 109 RCVD_IN_RP_CERTIFIED 1697 10.25 2.47 12.14 110 XMDiploma_00 1626 1.55 2.37 1.35 111 XM_URI_RBL 1601 0.63 2.33 0.22 112 SUBJ_ALL_CAPS 1599 1.47 2.33 1.26 113 TR_XM_PHPDW 1597 0.85 2.33 0.49 114 TR_XM_PHPForged 1592 0.82 2.32 0.46 115 PLING_QUERY 1570 0.81 2.29 0.45 116 TM2_M_VERY_LONG_WORD 1567 1.84 2.28 1.73 117 SUBJ_DOLLARS 1558 1.06 2.27 0.77 118 TR_XM_FormFill2 1551 0.81 2.26 0.45 119 XM_H_PHPOS 1549 0.80 2.26 0.45 120 TR_XM_DK_Bayes 1487 13.48 2.17 16.22 121 URI_TRY_3LD 1481 1.79 2.16 1.70 122 DKIM_ADSP_CUSTOM_MED 1481 1.13 2.16 0.88 123 LongTLD 1461 0.57 2.13 0.19 124 TM2_M_URI_OPT_OUT 1443 2.65 2.10 2.78 125 TR_XM_INV_DKIM 1431 0.60 2.08 0.24 126 SpammyFromTLD_01 1424 0.70 2.07 0.37 127 NML_ADSP_CUSTOM_MED 1372 0.86 2.00 0.59 128 XMBdyGiftCard01 1366 1.90 1.99 1.88 129 LOADSA_MONEY_COMBO 1357 0.43 1.98 0.05 130 XMNoVowels 1349 1.88 1.97 1.86 131 FORGED_GMAIL_RCVD 1343 0.77 1.96 0.49 132 TO_EQ_FM_DOM_HTML_IMG 1309 0.38 1.91 0.01 133 HTML_IMAGE_RATIO_08 1273 1.98 1.85 2.02 134 XM_B_Unsub2 1269 1.46 1.85 1.37 135 T_Symld_Words_02 1263 1.00 1.84 0.79 136 BAYES_05 1251 2.66 1.82 2.86 137 XM_UB99 1235 0.36 1.80 0.01 138 T_XMDrugObfuBody_14 1214 1.70 1.77 1.69 139 XMSpoofStaff2 1211 0.50 1.76 0.19 140 XM_H_PHPMailer 1211 0.79 1.76 0.56 141 XM_H_SpoofStaff4 1210 0.67 1.76 0.41 142 RCVD_IN_IADB_LISTED 1206 3.61 1.76 4.06 143 FILL_THIS_FORM_SHORT 1201 1.18 1.75 1.04 144 HTML_MIME_NO_HTML_TAG 1146 1.60 1.67 1.58 145 UNPARSEABLE_RELAY 1118 3.38 1.63 3.80 146 RCVD_IN_IADB_SPF 1101 3.12 1.60 3.49 147 TR_XM_DK_Bayes1 1100 12.85 1.60 15.58 148 XMGenDplmaNmb 1090 0.85 1.59 0.68 149 XMStockSpam_06 1067 1.36 1.55 1.31 150 RCVD_IN_IADB_SENDERID 1063 2.78 1.55 3.08 151 XM_H_PHPOS_M 1057 0.46 1.54 0.20 152 RCVD_IN_IADB_DK 1054 2.69 1.54 2.96 153 RELAYCOUNTRY_DE 1031 0.62 1.50 0.41 154 XM_ProductURIs 1018 1.19 1.48 1.12 155 RCVD_IN_PSBL 996 0.34 1.45 0.07 156 XM_UB60 945 0.32 1.38 0.06 157 TR_XM_MaxSPIKE 944 0.34 1.38 0.09 158 TR_LOTS_OF_MONEY3 943 0.61 1.37 0.43 159 XM_UB999 924 0.27 1.35 0.00 160 DATE_IN_PAST_06_12 914 0.32 1.33 0.07 161 THIS_AD 904 0.67 1.32 0.51 162 XM_H_TOP 892 0.26 1.30 0.00 163 TR_XM_DK_SendGrid 875 3.81 1.27 4.42 164 XMPhish30 872 0.66 1.27 0.52 165 XMMoneyMeta_00 836 0.41 1.22 0.21 166 XMSubMetaI_00 832 0.78 1.21 0.67 167 MPART_ALT_DIFF_COUNT 813 0.54 1.18 0.38 168 T_XMHurry_00 812 0.97 1.18 0.92 169 URIBL_BLACK 801 0.23 1.17 0.01 170 DKIM_ADSP_NXDOMAIN 800 0.55 1.17 0.40 171 XMSubNoVowel 795 1.63 1.16 1.75 172 URIBL_DBL_SPAM 763 0.25 1.11 0.05 173 HK_RANDOM_REPLYTO 747 0.38 1.09 0.21 174 RELAYCOUNTRY_AT 742 0.42 1.08 0.27 175 XMSexyCombo_04 741 0.33 1.08 0.15 176 XM_Combo_Sbj 729 0.43 1.06 0.28 177 XM_DK_Undo_01 728 1.33 1.06 1.39 178 TR_M_TOP_BAYES 720 0.20 1.05 0.00 179 TR_XM_RelayPhish 718 0.36 1.05 0.20 180 XMBrknScrpt_02 707 0.57 1.03 0.46 181 DEAR_BENEFICIARY 666 0.20 0.97 0.01 182 FSL_THIS_IS_ADV 655 0.38 0.95 0.24 183 T_XMDrugObfuBody_00 653 1.00 0.95 1.01 184 MONEY_FRAUD_5 642 0.24 0.94 0.07 185 RELAYCOUNTRY_IN 640 0.23 0.93 0.06 186 MAILING_LIST_MULTI 636 1.75 0.93 1.95 187 XM_RXBody 636 0.54 0.93 0.45 188 REMOVE_BEFORE_LINK 636 0.38 0.93 0.24 189 TR_XM_DK_Bayes2 633 11.75 0.92 14.37 190 XM_UB80 631 0.19 0.92 0.02 191 XMPhish08 630 0.58 0.92 0.50 192 T_TooManySym_02 629 2.92 0.92 3.41 193 RELAYCOUNTRY_BR 625 0.18 0.91 0.01 194 XMSlimDrugH 620 0.44 0.90 0.33 195 ADVANCE_FEE_4_NEW_MONEY 619 0.18 0.90 0.01 196 XMBSHREFv2 609 0.56 0.89 0.48 197 MISSING_HEADERS 596 0.45 0.87 0.35 198 HTML_TAG_BALANCE_BODY 583 0.74 0.85 0.72 199 RELAYCOUNTRY_GB 580 0.67 0.85 0.63 200 XMGppyBdWords 572 0.64 0.83 0.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 244487 87.63 93.16 86.29 2 RELAYCOUNTRY_US 232650 81.11 77.00 82.11 3 DKIM_SIGNED 226785 79.67 78.13 80.04 4 XM_DK_Pass 224062 78.60 76.60 79.08 5 DKIM_VALID 215658 74.40 67.32 76.11 6 XM_B_Unicode 210511 73.85 72.03 74.29 7 DKIM_VALID_AU 172806 59.08 51.21 60.99 8 XMListUnsubscribeExists 163985 59.91 68.34 57.87 9 BAYES_50 145461 48.89 38.80 51.34 10 DCC_CHECK_NEGATIVE 145050 45.26 20.80 51.19 11 DCC_CHECK 134968 53.59 78.16 47.63 12 XM_B_Unicode3 133761 46.88 45.50 47.21 13 HTML_FONT_LOW_CONTRAST 89426 31.38 30.64 31.56 14 LOC_TINY_FONT_1 82000 30.21 35.44 28.94 15 DKIM_VALID_EF 78105 27.49 27.16 27.57 16 MIME_HTML_ONLY 69327 27.23 38.64 24.47 17 T_TM2_M_HEADER_IN_MSG 63399 21.72 19.02 22.38 18 FVGT_m_MULTI_ODD 62792 22.51 23.94 22.16 19 XMSubLong 57848 21.26 24.77 20.42 20 BAYES_00 57656 16.89 2.61 20.35 21 T_KAM_HTML_FONT_INVALID 49315 18.12 21.08 17.40 22 TR_XM_DK_Bayes 45962 13.48 2.17 16.22 23 TR_XM_DK_Bayes1 44144 12.85 1.60 15.58 24 XM_Multi_Part_URI 41930 15.43 18.02 14.80 25 XM_Body_Dirty_Words 41267 15.66 20.19 14.56 26 TR_XM_DK_Bayes2 40719 11.75 0.92 14.37 27 ALL_TRUSTED 38778 11.77 3.87 13.69 28 RCVD_IN_RP_SAFE 37627 11.40 3.63 13.28 29 RCVD_IN_RP_CERTIFIED 34390 10.25 2.47 12.14 30 LOTS_OF_MONEY 31375 11.89 15.25 11.07 31 XM_B_Unsub 31140 10.89 10.47 10.99 32 RCVD_IN_MSPIKE_H2 30494 9.53 4.44 10.76 33 XM_Evil_Numbers_Gen 29059 10.10 9.44 10.26 34 XM_DKIMWhitelistDomains 28936 8.22 0.01 10.21 35 HTML_IMAGE_RATIO_02 28686 10.87 13.95 10.12 36 XM_DK_Undo_02 27316 16.48 44.71 9.64 37 RCVD_IN_MSPIKE_WL 26614 8.13 2.92 9.39 38 RCVD_IN_MSPIKE_H3 26614 8.13 2.92 9.39 39 FSL_BULK_SIG 22818 9.69 16.43 8.05 40 LotsOfNums_01 22112 7.64 6.96 7.80 41 XM_SendGrid 21990 6.96 3.65 7.76 42 XM_B_Phish_Phrases 21866 7.90 8.63 7.72 43 HTML_IMAGE_RATIO_04 20137 7.11 7.10 7.11 44 TooManyTo_001 19209 6.74 6.59 6.78 45 XM_H_Long_From01 17892 6.24 5.94 6.31 46 BAYES_99 16790 10.51 29.42 5.93 47 BOTNET_IPINHOSTNAME 16379 7.46 14.37 5.78 48 T_TooManySym_01 16065 5.12 2.86 5.67 49 BAYES_60 16057 6.07 7.71 5.67 50 MPART_ALT_DIFF 15073 5.86 8.08 5.32 51 XMSexyCombo_05 15023 6.51 11.51 5.30 52 RELAYCOUNTRY_META 14794 7.94 19.17 5.22 53 BAYES_40 13660 4.56 3.49 4.82 54 BAYES_999 13636 8.36 23.00 4.81 55 XMSubMetaSx_00 13395 5.55 8.97 4.73 56 FROM_EXCESS_BASE64 13220 4.46 3.60 4.67 57 XMStrtUSub 13215 4.42 3.40 4.66 58 TR_XM_DK_SendGrid 12533 3.81 1.27 4.42 59 XMNumbers 12349 5.12 8.28 4.36 60 MIME_QP_LONG_LINE 11864 4.13 3.89 4.19 61 RCVD_IN_IADB_LISTED 11503 3.61 1.76 4.06 62 DKIM_INVALID 11127 5.27 10.80 3.93 63 UNPARSEABLE_RELAY 10773 3.38 1.63 3.80 64 T_REMOTE_IMAGE 10707 4.03 5.09 3.78 65 BAYES_20 10444 3.59 3.22 3.69 66 XM_UncommonTLD01 10396 6.82 19.83 3.67 67 HTML_IMAGE_RATIO_06 10096 3.52 3.33 3.56 68 RCVD_IN_IADB_SPF 9894 3.12 1.60 3.49 69 MIME_HTML_ONLY_MULTI 9700 3.47 3.68 3.42 70 T_TooManySym_02 9654 2.92 0.92 3.41 71 IN_ZIMBRA_NJ_WHITELIST 9184 2.61 0.01 3.24 72 BAYES_80 9152 4.15 7.94 3.23 73 RCVD_IN_IADB_SENDERID 8735 2.78 1.55 3.08 74 RCVD_IN_IADB_DK 8397 2.69 1.54 2.96 75 BAYES_05 8100 2.66 1.82 2.86 76 BOTNET 7970 6.97 24.12 2.81 77 TM2_M_URI_OPT_OUT 7888 2.65 2.10 2.78 78 TR_DCC_Bayes_99 7830 6.46 21.72 2.76 79 XM_CamelCaseFrm001 7573 3.23 5.53 2.67 80 RCVD_IN_IADB_VOUCHED 7548 2.25 0.55 2.66 81 INVALID_MSGID 7514 2.18 0.25 2.65 82 TVD_RCVD_IP 7361 2.20 0.57 2.60 83 XM_B_SpammyTLD 7350 2.99 4.64 2.59 84 XM_H_Trusted_IP 7220 2.05 0.00 2.55 85 TO_MALFORMED 7052 2.01 0.03 2.49 86 ANY_BOUNCE_MESSAGE 6928 2.04 0.38 2.45 87 BOUNCE_MESSAGE 6925 2.04 0.38 2.44 88 XM_PDF 6887 2.00 0.24 2.43 89 RELAYCOUNTRY_CA 6692 2.88 5.04 2.36 90 MIME_HTML_MOSTLY 6680 2.83 4.76 2.36 91 CK_HELO_DYNAMIC_SPLIT_IP 6606 1.92 0.22 2.33 92 HELO_DYNAMIC_IPADDR2 6596 1.88 0.05 2.33 93 NO_DNS_FOR_FROM 6486 3.72 9.61 2.29 94 HTML_IMAGE_RATIO_08 5712 1.98 1.85 2.02 95 BAYES_95 5644 2.51 4.66 1.99 96 MAILING_LIST_MULTI 5524 1.75 0.93 1.95 97 XMBdyGiftCard01 5315 1.90 1.99 1.88 98 XMNoVowels 5279 1.88 1.97 1.86 99 URI_HEX 5213 2.05 2.94 1.84 100 IN_HORDE_ADDRESS_BOOK 4956 1.41 0.03 1.75 101 RCVD_IN_IADB_OPTIN 4953 1.50 0.49 1.75 102 XMSubNoVowel 4952 1.63 1.16 1.75 103 TM2_M_VERY_LONG_WORD 4897 1.84 2.28 1.73 104 UNTRUSTED_Relay 4868 4.08 13.83 1.72 105 URI_TRY_3LD 4819 1.79 2.16 1.70 106 XM_OfRef6 4803 1.90 2.75 1.70 107 T_XMDrugObfuBody_14 4778 1.70 1.77 1.69 108 USER_IN_DEF_DKIM_WL 4754 1.35 0.01 1.68 109 TR_Symld_Words 4532 2.12 4.28 1.60 110 XMGappySubj_01 4504 1.31 0.15 1.59 111 HTML_MIME_NO_HTML_TAG 4477 1.60 1.67 1.58 112 T_XMDrugObfuBody_08 4053 1.72 2.93 1.43 113 XM_DK_Undo_01 3944 1.33 1.06 1.39 114 XM_B_Unsub2 3872 1.46 1.85 1.37 115 XMDiploma_00 3837 1.55 2.37 1.35 116 XMStockSpam_06 3712 1.36 1.55 1.31 117 RCVD_IN_MSPIKE_BL 3706 2.03 4.99 1.31 118 SUBJ_ALL_CAPS 3576 1.47 2.33 1.26 119 XM_GoogleGroups 3571 1.08 0.34 1.26 120 TooManyTo_002 3468 1.06 0.40 1.22 121 XM_H_Long_From02 3429 1.10 0.63 1.21 122 RCVD_IN_BL_SPAMCOP_NET 3311 1.85 4.67 1.17 123 XM_ProductURIs 3174 1.19 1.48 1.12 124 XM_SPF_SoftFail 3094 2.13 6.43 1.09 125 RCVD_IN_MSPIKE_L3 2965 1.75 4.65 1.05 126 FILL_THIS_FORM_SHORT 2936 1.18 1.75 1.04 127 XMBody_95 2872 0.83 0.07 1.01 128 T_XMDrugObfuBody_00 2855 1.00 0.95 1.01 129 XM_UB50 2797 2.17 7.07 0.99 130 KHOP_HELO_FCRDNS 2796 2.03 6.35 0.99 131 XMBody_17 2785 1.55 3.89 0.98 132 TM2_M_A_HREF_HREF 2672 0.91 0.76 0.94 133 HTML_FONT_FACE_BAD 2652 0.88 0.65 0.94 134 T_XMHurry_00 2599 0.97 1.18 0.92 135 HTML_IMAGE_ONLY_20 2550 0.79 0.32 0.90 136 TR_MSPIKEBAYES00 2513 0.71 0.00 0.89 137 XM_B_REG_HTML 2497 0.84 0.69 0.88 138 DKIM_ADSP_CUSTOM_MED 2488 1.13 2.16 0.88 139 TooManyTo_003 2414 0.75 0.33 0.85 140 TR_MetaPhish_Combo_01 2352 0.77 0.51 0.83 141 T_Symld_Words_02 2245 1.00 1.84 0.79 142 DIET_1 2214 1.23 3.10 0.78 143 PDS_OTHER_BAD_TLD 2188 1.62 5.11 0.77 144 SUBJ_DOLLARS 2169 1.06 2.27 0.77 145 USER_IN_WHITELIST 2083 0.59 0.00 0.74 146 T_TooManySym_03 2070 0.66 0.37 0.73 147 HTML_TAG_BALANCE_BODY 2038 0.74 0.85 0.72 148 FILL_THIS_FORM 2022 0.64 0.35 0.71 149 XMHTML_After_End 1993 1.62 5.40 0.70 150 HTML_OBFUSCATE_05_10 1983 0.58 0.08 0.70 151 TooManyTo_004 1932 0.60 0.27 0.68 152 XMGenDplmaNmb 1916 0.85 1.59 0.68 153 XMSubMetaI_00 1906 0.78 1.21 0.67 154 XM_B_COPY_HTML 1903 1.06 2.67 0.67 155 XMHTMLBadTable_001 1868 0.69 0.80 0.66 156 XMSexyCombo_01 1809 1.05 2.76 0.64 157 RELAYCOUNTRY_GB 1772 0.67 0.85 0.63 158 TooManyTo_005 1711 0.53 0.22 0.60 159 XMGppyBdWords 1685 0.64 0.83 0.59 160 HELO_NODOT 1676 0.55 0.38 0.59 161 HELO_NO_DOMAIN 1674 0.55 0.36 0.59 162 FILL_THIS_FORM_LONG 1669 0.52 0.22 0.59 163 NML_ADSP_CUSTOM_MED 1665 0.86 2.00 0.59 164 XM_DIRTYINTL 1663 1.09 3.17 0.59 165 XM_H_PHPMailer 1579 0.79 1.76 0.56 166 XMSubMetaSxObfu_02 1505 0.51 0.44 0.53 167 T_FILL_THIS_FORM_LOAN 1492 0.46 0.17 0.53 168 XM_D_tchamptons_WL 1469 0.42 0.01 0.52 169 XMPhish14 1468 0.54 0.61 0.52 170 XMPhish30 1465 0.66 1.27 0.52 171 THIS_AD 1444 0.67 1.32 0.51 172 T_OBFU_PDF_ATTACH 1437 0.42 0.05 0.51 173 XMPhish08 1406 0.58 0.92 0.50 174 FORGED_GMAIL_RCVD 1383 0.77 1.96 0.49 175 TR_XM_PHPDW 1378 0.85 2.33 0.49 176 XMBSHREFv2 1369 0.56 0.89 0.48 177 XMBody_78 1359 0.55 0.82 0.48 178 HTTPS_HTTP_MISMATCH 1354 0.45 0.34 0.48 179 XMGappySubj_02 1342 0.40 0.08 0.47 180 URI_NOVOWEL 1320 0.51 0.68 0.47 181 TR_XM_PHPForged 1292 0.82 2.32 0.46 182 XMBrknScrpt_02 1291 0.57 1.03 0.46 183 RDNS_DYNAMIC 1289 1.30 4.78 0.45 184 TR_XM_FormFill2 1284 0.81 2.26 0.45 185 PLING_QUERY 1275 0.81 2.29 0.45 186 XMSubMetaSSxObfu_00 1272 0.42 0.29 0.45 187 XM_H_PHPOS 1270 0.80 2.26 0.45 188 XM_RXBody 1261 0.54 0.93 0.45 189 XMCapTrack 1247 0.38 0.16 0.44 190 TR_LOTS_OF_MONEY3 1215 0.61 1.37 0.43 191 XM_Ancestry_Forge 1210 0.37 0.14 0.43 192 RELAYCOUNTRY_DE 1157 0.62 1.50 0.41 193 XM_H_SpoofStaff4 1154 0.67 1.76 0.41 194 DKIM_ADSP_NXDOMAIN 1142 0.55 1.17 0.40 195 TVD_SPACE_RATIO 1136 0.36 0.21 0.40 196 BASE64_LENGTH_79_INF 1135 0.39 0.37 0.40 197 MPART_ALT_DIFF_COUNT 1077 0.54 1.18 0.38 198 TM2_M_BODY_EMPTY 1075 0.32 0.07 0.38 199 GAPPY_SUBJECT 1065 0.32 0.09 0.38 200 SpammyFromTLD_01 1056 0.70 2.07 0.37 ----------------------------------------------------------------------