Email: 350984 Autolearn: 0 AvgScore: 1.42 AvgScanTime: 1.73 sec Spam: 72545 Autolearn: 0 AvgScore: 12.94 AvgScanTime: 2.80 sec Ham: 278439 Autolearn: 0 AvgScore: -1.58 AvgScanTime: 1.45 sec Time Spent Running SA: 168.39 hours Time Spent Processing Spam: 56.38 hours Time Spent Processing Ham: 112.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 66998 87.40 92.35 86.10 2 DKIM_SIGNED 59748 80.73 82.36 80.30 3 DCC_CHECK 57640 56.21 79.45 50.15 4 XM_DK_Pass 56914 79.09 78.45 79.26 5 RELAYCOUNTRY_US 53818 80.44 74.19 82.06 6 XM_B_Unicode 52088 73.75 71.80 74.26 7 XMListUnsubscribeExists 50500 61.26 69.61 59.09 8 DKIM_VALID 48987 74.47 67.53 76.28 9 DKIM_VALID_AU 39164 60.60 53.99 62.33 10 XM_B_Unicode3 31976 47.26 44.08 48.09 11 XM_DK_Undo_02 30276 15.83 41.73 9.08 12 BAYES_50 30062 49.01 41.44 50.98 13 LOC_TINY_FONT_1 27587 33.13 38.03 31.86 14 MIME_HTML_ONLY 27499 26.61 37.91 23.67 15 HTML_FONT_LOW_CONTRAST 22978 34.31 31.67 35.00 16 BAYES_99 20594 10.24 28.39 5.52 17 DKIM_VALID_EF 19286 26.60 26.58 26.60 18 RELAYCOUNTRY_META 17791 9.26 24.52 5.28 19 XMSubLong 17634 22.05 24.31 21.47 20 BOTNET 17396 7.09 23.98 2.69 21 BAYES_999 16082 8.18 22.17 4.54 22 FVGT_m_MULTI_ODD 16036 22.04 22.10 22.02 23 TR_DCC_Bayes_99 15349 6.76 21.16 3.00 24 T_KAM_HTML_FONT_INVALID 14771 18.06 20.36 17.46 25 XM_Body_Dirty_Words 14489 16.40 19.97 15.47 26 XM_UncommonTLD01 14257 6.83 19.65 3.49 27 T_TM2_M_HEADER_IN_MSG 14050 21.16 19.37 21.63 28 DCC_CHECK_NEGATIVE 13522 42.47 18.64 48.67 29 HTML_IMAGE_RATIO_02 12975 13.02 17.89 11.75 30 UNTRUSTED_Relay 12746 5.12 17.57 1.87 31 XM_Multi_Part_URI 11257 14.83 15.52 14.66 32 LOTS_OF_MONEY 11193 10.08 15.43 8.69 33 DKIM_INVALID 10761 6.26 14.83 4.02 34 BOTNET_IPINHOSTNAME 10650 7.78 14.68 5.99 35 FSL_BULK_SIG 10615 9.40 14.63 8.03 36 XMSubMetaSx_00 10566 9.18 14.56 7.78 37 XMSexyCombo_05 9829 7.58 13.55 6.03 38 XM_B_Unsub 8256 10.52 11.38 10.30 39 SpammyFromTLD_02 7250 2.22 9.99 0.19 40 XM_Evil_Numbers_Gen 7234 10.80 9.97 11.02 41 XM_UB50 7001 2.74 9.65 0.93 42 TooManyTo_001 6654 8.22 9.17 7.97 43 NO_DNS_FOR_FROM 6253 3.57 8.62 2.26 44 MPART_ALT_DIFF 5726 6.05 7.89 5.56 45 XM_B_Phish_Phrases 5664 8.18 7.81 8.27 46 BAYES_60 5547 5.98 7.65 5.55 47 RCVD_IN_MSPIKE_BL 5534 2.50 7.63 1.17 48 PDS_OTHER_BAD_TLD 5459 2.24 7.52 0.86 49 RCVD_IN_MSPIKE_L3 5329 2.28 7.35 0.96 50 BAYES_80 5212 3.89 7.18 3.04 51 LotsOfNums_01 4943 7.50 6.81 7.68 52 FROM_SUSPICIOUS_NTLD 4821 1.41 6.65 0.04 53 XM_H_Long_From01 4813 6.50 6.63 6.46 54 FROM_SUSPICIOUS_NTLD_FP 4788 1.40 6.60 0.04 55 XM_B_SpammyTLD 4725 3.25 6.51 2.40 56 XMNumbers 4712 4.51 6.50 3.99 57 HTML_IMAGE_RATIO_04 4519 6.68 6.23 6.80 58 MIME_HTML_MOSTLY 4479 4.06 6.17 3.51 59 XM_SPF_SoftFail 4005 1.91 5.52 0.97 60 RELAYCOUNTRY_CA 3935 2.78 5.42 2.09 61 XM_CamelCaseFrm001 3900 3.10 5.38 2.50 62 RCVD_IN_BL_SPAMCOP_NET 3736 1.87 5.15 1.02 63 RCVD_IN_MSPIKE_H2 3428 9.73 4.73 11.03 64 KHOP_HELO_FCRDNS 3369 1.71 4.64 0.95 65 XM_DIRTYINTL 3303 1.37 4.55 0.54 66 BOTNET_NORDNS 3257 0.94 4.49 0.01 67 DATE_IN_PAST_03_06 3165 0.98 4.36 0.09 68 T_REMOTE_IMAGE 3138 3.10 4.33 2.78 69 RCVD_IN_RP_SAFE 3136 12.00 4.32 13.99 70 RCVD_IN_RP_RNBL 3106 1.09 4.28 0.25 71 RELAYCOUNTRY_FR 3105 1.07 4.28 0.24 72 BODY_URI_ONLY 2987 0.87 4.12 0.03 73 XM_OfRef6 2942 2.13 4.06 1.63 74 REPLYTO_WITHOUT_TO_CC 2831 1.04 3.90 0.30 75 T_TooManySym_01 2801 5.86 3.86 6.37 76 BAYES_40 2764 4.77 3.81 5.02 77 LongTLD 2733 0.87 3.77 0.11 78 XMStrtUSub 2714 5.24 3.74 5.63 79 MIME_HTML_ONLY_MULTI 2711 3.25 3.74 3.12 80 BAYES_95 2697 2.28 3.72 1.91 81 XM_SendGrid 2685 7.04 3.70 7.91 82 FROM_EXCESS_BASE64 2682 4.31 3.70 4.47 83 SUBJ_ALL_CAPS 2615 1.60 3.60 1.08 84 TR_XM_INV_DKIM 2505 0.82 3.45 0.14 85 HTML_IMAGE_RATIO_06 2477 4.03 3.41 4.19 86 BAYES_20 2475 3.75 3.41 3.84 87 XMSexyCombo_01 2426 1.91 3.34 1.53 88 T_XMDrugObfuBody_08 2413 1.85 3.33 1.46 89 TR_Mismatch_TLD_02 2386 0.74 3.29 0.08 90 MIME_QP_LONG_LINE 2365 3.91 3.26 4.08 91 XM_URI_RBL 2227 0.81 3.07 0.22 92 XMHTML_After_End 2217 1.17 3.06 0.68 93 URIBL_SBL_A 2175 0.74 3.00 0.15 94 TR_Mismatch_TLD_01 2149 0.78 2.96 0.21 95 RDNS_DYNAMIC 2079 0.89 2.87 0.38 96 MISSING_HEADERS 2021 1.00 2.79 0.54 97 RCVD_IN_PSBL 2000 0.62 2.76 0.07 98 DKIM_ADSP_CUSTOM_MED 1999 1.45 2.76 1.11 99 TM2_M_URI_OPT_OUT 1987 3.00 2.74 3.07 100 RCVD_IN_RP_CERTIFIED 1940 11.05 2.67 13.23 101 SpammyFromTLD_01 1913 0.85 2.64 0.39 102 FORGED_GMAIL_RCVD 1910 0.98 2.63 0.55 103 NML_ADSP_CUSTOM_MED 1876 1.16 2.59 0.78 104 XMBody_17 1863 1.48 2.57 1.20 105 HTML_IMAGE_RATIO_08 1855 2.64 2.56 2.67 106 RCVD_IN_MSPIKE_H3 1794 8.45 2.47 10.01 107 RCVD_IN_MSPIKE_WL 1794 8.45 2.47 10.01 108 DATE_IN_PAST_06_12 1744 0.54 2.40 0.05 109 BAYES_00 1738 17.28 2.40 21.16 110 RELAYCOUNTRY_DE 1690 0.92 2.33 0.55 111 TR_XM_PHPDW 1686 0.81 2.32 0.42 112 XM_H_TOP 1683 0.48 2.32 0.00 113 TR_XM_PHPForged 1672 0.80 2.30 0.41 114 TR_XM_FormFill2 1656 0.79 2.28 0.40 115 XM_H_PHPOS 1653 0.79 2.28 0.40 116 TR_XM_MaxBayes 1635 0.48 2.25 0.02 117 THIS_AD 1587 0.83 2.19 0.48 118 ALL_TRUSTED 1587 11.43 2.19 13.84 119 FILL_THIS_FORM_SHORT 1554 1.32 2.14 1.10 120 NO_FM_NAME_IP_HOSTN 1518 0.43 2.09 0.00 121 TR_LOTS_OF_MONEY1 1503 0.43 2.07 0.01 122 HTML_SHORT_LINK_IMG_1 1498 0.44 2.06 0.01 123 MIME_HEADER_CTYPE_ONLY 1490 0.59 2.05 0.20 124 URI_HEX 1486 1.53 2.05 1.39 125 FROM_ADDR_WS 1485 0.42 2.05 0.00 126 FROM_NO_USER 1452 0.42 2.00 0.01 127 HDRS_LCASE_IMGONLY 1444 0.42 1.99 0.01 128 TR_LOTS_OF_MONEY3 1439 0.68 1.98 0.34 129 T_Symld_Words_02 1420 0.83 1.96 0.54 130 XMDiploma_00 1420 1.50 1.96 1.38 131 HTML_MIME_NO_HTML_TAG 1416 1.71 1.95 1.65 132 TR_XM_DK_Bayes 1409 13.59 1.94 16.63 133 XM_UB99 1382 0.41 1.91 0.02 134 RELAYCOUNTRY_GB 1377 0.92 1.90 0.67 135 TM2_M_VERY_LONG_WORD 1375 1.59 1.90 1.50 136 XMBdyGiftCard01 1368 2.37 1.89 2.50 137 BAYES_05 1353 2.68 1.87 2.89 138 NORDNS_LOW_CONTRAST 1348 0.38 1.86 0.00 139 XM_H_PHPMailer 1325 0.74 1.83 0.45 140 XM_B_Unsub2 1311 1.21 1.81 1.06 141 XMNoVowels 1305 1.61 1.80 1.56 142 DIET_1 1300 1.02 1.79 0.81 143 RELAYCOUNTRY_IN 1271 0.40 1.75 0.04 144 XM_UB60 1270 0.41 1.75 0.06 145 TR_XM_MaxSPIKE 1254 0.40 1.73 0.05 146 XM_H_PHPOS_M 1248 0.47 1.72 0.15 147 T_XMDrugObfuBody_14 1228 1.67 1.69 1.67 148 XMStockSpam_06 1216 1.67 1.68 1.67 149 SUBJ_DOLLARS 1209 0.76 1.67 0.52 150 XMSubMetaSSx_00 1207 0.67 1.66 0.41 151 TR_XM_DK_SendGrid 1170 3.94 1.61 4.55 152 DKIM_ADSP_NXDOMAIN 1165 0.70 1.61 0.46 153 T_XMHurry_00 1154 1.22 1.59 1.12 154 TR_Symld_Words 1151 1.25 1.59 1.16 155 URI_TRY_3LD 1072 1.31 1.48 1.27 156 XM_ProductURIs 1068 1.09 1.47 1.00 157 MONEY_FORM_SHORT 1067 0.31 1.47 0.01 158 TR_Caps_n_Bayes_99 1002 0.40 1.38 0.14 159 UNPARSEABLE_RELAY 999 3.15 1.38 3.62 160 RCVD_IN_IADB_LISTED 993 2.92 1.37 3.33 161 DEAR_BENEFICIARY 989 0.28 1.36 0.00 162 TR_XM_DK_Bayes1 978 12.96 1.35 15.99 163 HTML_IMAGE_ONLY_12 977 0.38 1.35 0.13 164 RELAYCOUNTRY_AT 973 0.45 1.34 0.22 165 TR_XM_RelayPhish 969 0.41 1.34 0.17 166 XM_UB80 955 0.29 1.32 0.02 167 T_XMDrugObfuBody_00 954 0.82 1.32 0.69 168 XM_Lotto 943 0.31 1.30 0.05 169 RCVD_IN_IADB_SPF 940 2.56 1.30 2.89 170 RCVD_IN_IADB_SENDERID 930 2.30 1.28 2.57 171 RCVD_IN_IADB_DK 929 2.23 1.28 2.48 172 TR_XM_DK_Bayes2 918 12.32 1.27 15.20 173 XMSubNoVowel 912 1.79 1.26 1.93 174 XM_Combo_Sbj 907 0.42 1.25 0.20 175 XMSubMetaI_00 894 0.94 1.23 0.86 176 XMSexyCombo_04 880 0.57 1.21 0.40 177 XM_H_Long_From02 877 1.18 1.21 1.18 178 XM_UB999 871 0.26 1.20 0.01 179 URIBL_DBL_SPAM 870 0.29 1.20 0.06 180 XMPhish30 865 0.67 1.19 0.53 181 PDS_FRNOM_TODOM_NAKED_TO 863 0.25 1.19 0.00 182 PDS_FROM_NAME_TO_DOMAIN 863 0.25 1.19 0.00 183 XMGenDplmaNmb 862 0.98 1.19 0.93 184 HK_SCAM 857 0.26 1.18 0.03 185 MPART_ALT_DIFF_COUNT 856 0.62 1.18 0.48 186 HK_RANDOM_REPLYTO 852 0.45 1.17 0.26 187 XMBody_78 852 0.64 1.17 0.50 188 T_TooManySym_02 835 3.22 1.15 3.76 189 RELAYCOUNTRY_NL 834 0.39 1.15 0.19 190 LOADSA_MONEY_COMBO 832 0.27 1.15 0.04 191 RELAYCOUNTRY_NG 829 0.24 1.14 0.00 192 TR_Sbj_FN_Bdy 821 0.41 1.13 0.22 193 XMBSHREFv2 811 0.67 1.12 0.55 194 XMSubMetaSxObfu_03 800 0.74 1.10 0.64 195 XMPhish08 794 0.83 1.09 0.76 196 MONEY_FRAUD_3 781 0.22 1.08 0.00 197 SHORT_URI 769 0.23 1.06 0.02 198 HTML_IMAGE_ONLY_08 739 0.27 1.02 0.07 199 FORM_FRAUD_3 726 0.21 1.00 0.00 200 XM_B_COPY_HTML 712 0.68 0.98 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 239748 87.40 92.35 86.10 2 RELAYCOUNTRY_US 228500 80.44 74.19 82.06 3 DKIM_SIGNED 223594 80.73 82.36 80.30 4 XM_DK_Pass 220687 79.09 78.45 79.26 5 DKIM_VALID 212397 74.47 67.53 76.28 6 XM_B_Unicode 206756 73.75 71.80 74.26 7 DKIM_VALID_AU 173546 60.60 53.99 62.33 8 XMListUnsubscribeExists 164525 61.26 69.61 59.09 9 BAYES_50 141949 49.01 41.44 50.98 10 DCC_CHECK 139651 56.21 79.45 50.15 11 DCC_CHECK_NEGATIVE 135528 42.47 18.64 48.67 12 XM_B_Unicode3 133911 47.26 44.08 48.09 13 HTML_FONT_LOW_CONTRAST 97445 34.31 31.67 35.00 14 LOC_TINY_FONT_1 88697 33.13 38.03 31.86 15 DKIM_VALID_EF 74072 26.60 26.58 26.60 16 MIME_HTML_ONLY 65910 26.61 37.91 23.67 17 FVGT_m_MULTI_ODD 61314 22.04 22.10 22.02 18 T_TM2_M_HEADER_IN_MSG 60216 21.16 19.37 21.63 19 XMSubLong 59771 22.05 24.31 21.47 20 BAYES_00 58921 17.28 2.40 21.16 21 T_KAM_HTML_FONT_INVALID 48628 18.06 20.36 17.46 22 TR_XM_DK_Bayes 46294 13.59 1.94 16.63 23 TR_XM_DK_Bayes1 44515 12.96 1.35 15.99 24 XM_Body_Dirty_Words 43073 16.40 19.97 15.47 25 TR_XM_DK_Bayes2 42327 12.32 1.27 15.20 26 XM_Multi_Part_URI 40809 14.83 15.52 14.66 27 RCVD_IN_RP_SAFE 38966 12.00 4.32 13.99 28 ALL_TRUSTED 38548 11.43 2.19 13.84 29 RCVD_IN_RP_CERTIFIED 36851 11.05 2.67 13.23 30 HTML_IMAGE_RATIO_02 32728 13.02 17.89 11.75 31 RCVD_IN_MSPIKE_H2 30717 9.73 4.73 11.03 32 XM_Evil_Numbers_Gen 30683 10.80 9.97 11.02 33 XM_DKIMWhitelistDomains 30135 8.59 0.03 10.82 34 XM_B_Unsub 28680 10.52 11.38 10.30 35 RCVD_IN_MSPIKE_WL 27863 8.45 2.47 10.01 36 RCVD_IN_MSPIKE_H3 27863 8.45 2.47 10.01 37 XM_DK_Undo_02 25273 15.83 41.73 9.08 38 LOTS_OF_MONEY 24197 10.08 15.43 8.69 39 XM_B_Phish_Phrases 23033 8.18 7.81 8.27 40 FSL_BULK_SIG 22369 9.40 14.63 8.03 41 TooManyTo_001 22194 8.22 9.17 7.97 42 XM_SendGrid 22013 7.04 3.70 7.91 43 XMSubMetaSx_00 21656 9.18 14.56 7.78 44 LotsOfNums_01 21374 7.50 6.81 7.68 45 HTML_IMAGE_RATIO_04 18944 6.68 6.23 6.80 46 XM_H_Long_From01 17986 6.50 6.63 6.46 47 T_TooManySym_01 17750 5.86 3.86 6.37 48 XMSexyCombo_05 16793 7.58 13.55 6.03 49 BOTNET_IPINHOSTNAME 16669 7.78 14.68 5.99 50 XMStrtUSub 15680 5.24 3.74 5.63 51 MPART_ALT_DIFF 15495 6.05 7.89 5.56 52 BAYES_60 15451 5.98 7.65 5.55 53 BAYES_99 15359 10.24 28.39 5.52 54 RELAYCOUNTRY_META 14712 9.26 24.52 5.28 55 BAYES_40 13991 4.77 3.81 5.02 56 TR_XM_DK_SendGrid 12671 3.94 1.61 4.55 57 BAYES_999 12646 8.18 22.17 4.54 58 FROM_EXCESS_BASE64 12433 4.31 3.70 4.47 59 HTML_IMAGE_RATIO_06 11674 4.03 3.41 4.19 60 MIME_QP_LONG_LINE 11366 3.91 3.26 4.08 61 DKIM_INVALID 11197 6.26 14.83 4.02 62 XMNumbers 11119 4.51 6.50 3.99 63 BAYES_20 10703 3.75 3.41 3.84 64 T_TooManySym_02 10459 3.22 1.15 3.76 65 UNPARSEABLE_RELAY 10066 3.15 1.38 3.62 66 MIME_HTML_MOSTLY 9766 4.06 6.17 3.51 67 XM_UncommonTLD01 9710 6.83 19.65 3.49 68 RCVD_IN_IADB_LISTED 9272 2.92 1.37 3.33 69 MIME_HTML_ONLY_MULTI 8695 3.25 3.74 3.12 70 IN_ZIMBRA_NJ_WHITELIST 8541 2.44 0.02 3.07 71 TM2_M_URI_OPT_OUT 8535 3.00 2.74 3.07 72 BAYES_80 8458 3.89 7.18 3.04 73 TR_DCC_Bayes_99 8364 6.76 21.16 3.00 74 RCVD_IN_IADB_SPF 8057 2.56 1.30 2.89 75 BAYES_05 8046 2.68 1.87 2.89 76 T_REMOTE_IMAGE 7729 3.10 4.33 2.78 77 BOTNET 7482 7.09 23.98 2.69 78 HTML_IMAGE_RATIO_08 7422 2.64 2.56 2.67 79 TVD_RCVD_IP 7253 2.19 0.61 2.60 80 RCVD_IN_IADB_SENDERID 7158 2.30 1.28 2.57 81 INVALID_MSGID 7151 2.08 0.21 2.57 82 XM_CamelCaseFrm001 6965 3.10 5.38 2.50 83 XMBdyGiftCard01 6949 2.37 1.89 2.50 84 RCVD_IN_IADB_DK 6910 2.23 1.28 2.48 85 XM_H_Trusted_IP 6909 1.97 0.00 2.48 86 TO_MALFORMED 6839 1.95 0.01 2.46 87 XM_B_SpammyTLD 6690 3.25 6.51 2.40 88 CK_HELO_DYNAMIC_SPLIT_IP 6440 1.86 0.11 2.31 89 HELO_DYNAMIC_IPADDR2 6438 1.84 0.05 2.31 90 ANY_BOUNCE_MESSAGE 6348 1.86 0.24 2.28 91 BOUNCE_MESSAGE 6346 1.86 0.24 2.28 92 NO_DNS_FOR_FROM 6287 3.57 8.62 2.26 93 RELAYCOUNTRY_CA 5826 2.78 5.42 2.09 94 XM_PDF 5808 1.74 0.42 2.09 95 RCVD_IN_IADB_VOUCHED 5750 1.70 0.28 2.07 96 XMSubNoVowel 5375 1.79 1.26 1.93 97 BAYES_95 5309 2.28 3.72 1.91 98 UNTRUSTED_Relay 5220 5.12 17.57 1.87 99 MAILING_LIST_MULTI 5203 1.68 0.96 1.87 100 USER_IN_DEF_DKIM_WL 4988 1.42 0.00 1.79 101 TooManyTo_002 4963 1.50 0.41 1.78 102 IN_HORDE_ADDRESS_BOOK 4803 1.37 0.02 1.72 103 XMGappySubj_01 4771 1.39 0.15 1.71 104 T_XMDrugObfuBody_14 4645 1.67 1.69 1.67 105 XMStockSpam_06 4644 1.67 1.68 1.67 106 HTML_MIME_NO_HTML_TAG 4591 1.71 1.95 1.65 107 XM_OfRef6 4530 2.13 4.06 1.63 108 XMNoVowels 4333 1.61 1.80 1.56 109 XMSexyCombo_01 4268 1.91 3.34 1.53 110 TM2_M_VERY_LONG_WORD 4189 1.59 1.90 1.50 111 T_XMDrugObfuBody_08 4079 1.85 3.33 1.46 112 URI_HEX 3879 1.53 2.05 1.39 113 XM_DK_Undo_01 3845 1.26 0.78 1.38 114 XMDiploma_00 3837 1.50 1.96 1.38 115 TooManyTo_003 3699 1.13 0.35 1.33 116 RCVD_IN_IADB_OPTIN 3630 1.10 0.31 1.30 117 URI_TRY_3LD 3543 1.31 1.48 1.27 118 XMBody_17 3340 1.48 2.57 1.20 119 XM_GoogleGroups 3291 1.01 0.33 1.18 120 XM_H_Long_From02 3278 1.18 1.21 1.18 121 RCVD_IN_MSPIKE_BL 3252 2.50 7.63 1.17 122 TR_Symld_Words 3229 1.25 1.59 1.16 123 T_XMHurry_00 3131 1.22 1.59 1.12 124 DKIM_ADSP_CUSTOM_MED 3083 1.45 2.76 1.11 125 FILL_THIS_FORM_SHORT 3066 1.32 2.14 1.10 126 TR_MSPIKEBAYES00 3056 0.88 0.06 1.10 127 SUBJ_ALL_CAPS 3018 1.60 3.60 1.08 128 HTML_FONT_FACE_BAD 3000 0.94 0.42 1.08 129 XM_RXBody 2955 0.95 0.53 1.06 130 XM_B_Unsub2 2938 1.21 1.81 1.06 131 TooManyTo_004 2879 0.88 0.30 1.03 132 RCVD_IN_BL_SPAMCOP_NET 2832 1.87 5.15 1.02 133 XM_ProductURIs 2774 1.09 1.47 1.00 134 FILL_THIS_FORM 2738 0.84 0.29 0.98 135 XM_SPF_SoftFail 2705 1.91 5.52 0.97 136 T_TooManySym_03 2682 0.85 0.40 0.96 137 RCVD_IN_MSPIKE_L3 2670 2.28 7.35 0.96 138 KHOP_HELO_FCRDNS 2641 1.71 4.64 0.95 139 XM_UB50 2602 2.74 9.65 0.93 140 XMGenDplmaNmb 2580 0.98 1.19 0.93 141 XMBody_95 2576 0.75 0.07 0.93 142 FILL_THIS_FORM_LONG 2438 0.73 0.16 0.88 143 XM_B_REG_HTML 2409 0.82 0.63 0.87 144 XMSubMetaI_00 2392 0.94 1.23 0.86 145 PDS_OTHER_BAD_TLD 2387 2.24 7.52 0.86 146 TooManyTo_005 2357 0.72 0.23 0.85 147 DIET_1 2264 1.02 1.79 0.81 148 T_FILL_THIS_FORM_LOAN 2256 0.84 0.97 0.81 149 NML_ADSP_CUSTOM_MED 2178 1.16 2.59 0.78 150 XMPhish08 2125 0.83 1.09 0.76 151 HTML_IMAGE_ONLY_20 1957 0.62 0.30 0.70 152 T_XMDrugObfuBody_00 1916 0.82 1.32 0.69 153 XMHTML_After_End 1903 1.17 3.06 0.68 154 XMGappySubj_02 1896 0.56 0.10 0.68 155 RELAYCOUNTRY_GB 1869 0.92 1.90 0.67 156 USER_IN_WHITELIST 1865 0.53 0.00 0.67 157 PLING_QUERY 1848 0.62 0.47 0.66 158 XMSubMetaSxObfu_03 1790 0.74 1.10 0.64 159 XMSubMetaSxObfu_02 1749 0.60 0.48 0.63 160 TM2_M_A_HREF_HREF 1701 0.60 0.55 0.61 161 XM_B_COPY_HTML 1671 0.68 0.98 0.60 162 TR_MetaPhish_Combo_01 1650 0.57 0.49 0.59 163 XMHTMLBadTable_001 1629 0.64 0.85 0.59 164 FORGED_GMAIL_RCVD 1542 0.98 2.63 0.55 165 RELAYCOUNTRY_DE 1542 0.92 2.33 0.55 166 XMBSHREFv2 1540 0.67 1.12 0.55 167 T_Symld_Words_02 1504 0.83 1.96 0.54 168 MISSING_HEADERS 1500 1.00 2.79 0.54 169 XM_DIRTYINTL 1494 1.37 4.55 0.54 170 HELO_NODOT 1488 0.54 0.57 0.53 171 HELO_NO_DOMAIN 1479 0.54 0.56 0.53 172 XMPhish30 1475 0.67 1.19 0.53 173 SUBJ_DOLLARS 1454 0.76 1.67 0.52 174 XMBody_78 1388 0.64 1.17 0.50 175 THIS_AD 1342 0.83 2.19 0.48 176 MPART_ALT_DIFF_COUNT 1336 0.62 1.18 0.48 177 XMLngstWrd_00 1322 0.44 0.30 0.47 178 XMSolicitRefs_0 1279 0.47 0.51 0.46 179 DKIM_ADSP_NXDOMAIN 1276 0.70 1.61 0.46 180 XMPhish14 1273 0.45 0.42 0.46 181 XM_H_PHPMailer 1258 0.74 1.83 0.45 182 XMBrknScrpt_02 1254 0.52 0.78 0.45 183 XMLngstWrd_01 1224 0.41 0.28 0.44 184 HTML_OBFUSCATE_05_10 1222 0.36 0.06 0.44 185 XMCapTrack 1216 0.43 0.40 0.44 186 TR_XM_PHPDW 1171 0.81 2.32 0.42 187 XMSubMetaSSx_00 1147 0.67 1.66 0.41 188 TR_XM_PHPForged 1142 0.80 2.30 0.41 189 REMOVE_BEFORE_LINK 1142 0.48 0.74 0.41 190 XMSubject_48 1121 0.33 0.06 0.40 191 TR_XM_FormFill2 1120 0.79 2.28 0.40 192 XMSubEmpty 1114 0.43 0.57 0.40 193 XM_H_PHPOS 1110 0.79 2.28 0.40 194 XMSexyCombo_04 1109 0.57 1.21 0.40 195 HTML_TAG_BALANCE_BODY 1100 0.48 0.81 0.40 196 SpammyFromTLD_01 1081 0.85 2.64 0.39 197 RDNS_DYNAMIC 1051 0.89 2.87 0.38 198 XMLngstWrd_02 1017 0.34 0.24 0.37 199 T_TooManySym_04 1008 0.31 0.12 0.36 200 UNICODE_OBFU_ZW 970 0.28 0.02 0.35 ----------------------------------------------------------------------