Email: 321647 Autolearn: 0 AvgScore: 3.45 AvgScanTime: 1.63 sec Spam: 99304 Autolearn: 0 AvgScore: 12.41 AvgScanTime: 2.00 sec Ham: 222343 Autolearn: 0 AvgScore: -0.55 AvgScanTime: 1.46 sec Time Spent Running SA: 145.41 hours Time Spent Processing Spam: 55.05 hours Time Spent Processing Ham: 90.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89069 73.26 89.69 65.92 2 DKIM_SIGNED 83010 68.34 83.59 61.52 3 XM_DK_Pass 80182 66.92 80.74 60.74 4 DKIM_VALID 79271 65.81 79.83 59.54 5 DCC_CHECK 76896 48.82 77.43 36.03 6 XMListUnsubscribeExists 74618 52.99 75.14 43.10 7 DKIM_VALID_AU 64628 52.29 65.08 46.58 8 XM_H_QuotedFrom 58901 43.27 59.31 36.10 9 XM_DK_Undo_02 49767 27.65 50.12 17.62 10 BAYES_99 44745 25.72 45.06 17.08 11 HTML_FONT_LOW_CONTRAST 38728 29.61 39.00 25.42 12 BAYES_999 38704 22.73 38.98 15.47 13 LOC_TINY_FONT_1 36713 25.70 36.97 20.67 14 TR_DCC_Bayes_99 35812 17.33 36.06 8.97 15 BAYES_50 30694 51.11 30.91 60.13 16 FVGT_m_MULTI_ODD 28347 20.94 28.55 17.55 17 MIME_HTML_ONLY 24616 18.35 24.79 15.47 18 XMSubLong 24352 21.70 24.52 20.43 19 DCC_CHECK_NEGATIVE 20890 49.91 21.04 62.80 20 HTML_IMAGE_RATIO_02 20027 10.96 20.17 6.84 21 T_TM2_M_HEADER_IN_MSG 19213 20.90 19.35 21.59 22 XM_Body_Dirty_Words 18286 11.20 18.41 7.97 23 DKIM_VALID_EF 17008 20.53 17.13 22.05 24 RELAYCOUNTRY_META 14686 7.13 14.79 3.70 25 XM_Evil_Numbers_Gen 14651 8.94 14.75 6.35 26 XM_Multi_Part_URI 14532 11.88 14.63 10.65 27 T_KAM_HTML_FONT_INVALID 13616 10.12 13.71 8.52 28 BOTNET 12737 4.53 12.83 0.82 29 MultiRelay 11997 11.51 12.08 11.26 30 BOTNET_IPINHOSTNAME 11299 8.03 11.38 6.53 31 LOTS_OF_MONEY 10775 6.71 10.85 4.86 32 HTML_IMAGE_RATIO_04 9967 5.77 10.04 3.86 33 XMSubMetaSx_00 9659 7.24 9.73 6.13 34 XMSexyCombo_05 9618 4.68 9.69 2.44 35 LotsOfNums_01 8977 7.52 9.04 6.84 36 XM_B_Phish_Phrases 8545 5.46 8.60 4.05 37 UNTRUSTED_Relay 8466 3.40 8.53 1.11 38 T_XMDrugObfuBody_14 8406 6.04 8.46 4.96 39 XM_H_Long_From01 7948 5.33 8.00 4.14 40 ALL_TRUSTED 7418 25.44 7.47 33.46 41 XM_UncommonTLD01 7374 5.16 7.43 4.15 42 BAYES_80 7295 4.85 7.35 3.73 43 TR_XM_DocInvoice 7091 4.37 7.14 3.14 44 BAYES_60 6900 7.02 6.95 7.05 45 MPART_ALT_DIFF 6876 3.86 6.92 2.49 46 TooManyTo_001 6871 5.57 6.92 4.96 47 RCVD_IN_RP_SAFE 6818 10.55 6.87 12.20 48 FSL_BULK_SIG 6520 5.65 6.57 5.23 49 FROM_EXCESS_BASE64 6515 4.56 6.56 3.67 50 RCVD_IN_RP_CERTIFIED 5414 9.33 5.45 11.05 51 BAYES_95 4742 3.18 4.78 2.47 52 RCVD_IN_MSPIKE_H2 4571 4.47 4.60 4.42 53 XMStrtUSub 4512 4.21 4.54 4.07 54 SUSPICIOUS_RECIPS 4378 2.30 4.41 1.36 55 URI_WP_HACKED_2 4325 3.00 4.36 2.39 56 BOTNET_NORDNS 4212 1.32 4.24 0.01 57 TR_LOTS_OF_MONEY3 4031 2.03 4.06 1.13 58 XM_SendGrid 3915 4.23 3.94 4.35 59 MIME_HTML_MOSTLY 3878 2.99 3.91 2.58 60 XMNumbers 3819 4.83 3.85 5.27 61 HTML_IMAGE_RATIO_06 3777 2.99 3.80 2.62 62 RELAYCOUNTRY_CA 3770 2.16 3.80 1.42 63 DKIM_INVALID 3739 2.53 3.77 1.98 64 TM2_M_URI_OPT_OUT 3653 2.21 3.68 1.55 65 IMPOTENCE 3395 2.60 3.42 2.23 66 T_XMHurry_00 3354 1.74 3.38 1.01 67 XM_DIRTYINTL 3335 1.77 3.36 1.07 68 XM_CamelCaseFrm001 3334 2.00 3.36 1.39 69 XMSubMetaI_00 3138 1.74 3.16 1.11 70 URI_HEX 3110 1.67 3.13 1.02 71 MIME_HTML_ONLY_MULTI 3041 1.51 3.06 0.82 72 RCVD_IN_BL_SPAMCOP_NET 3033 1.26 3.05 0.45 73 MIME_QP_LONG_LINE 2986 3.12 3.01 3.16 74 XM_UB50 2874 1.36 2.89 0.68 75 XM_OfRef6 2821 1.57 2.84 1.01 76 SUBJ_ALL_CAPS 2780 2.02 2.80 1.67 77 T_TooManySym_01 2649 4.22 2.67 4.91 78 XM_SPF_SoftFail 2558 1.45 2.58 0.94 79 SORTED_RECIPS 2549 1.02 2.57 0.33 80 RCVD_IN_RP_RNBL 2310 0.74 2.33 0.03 81 XM_XX_Yahoo 2060 0.75 2.07 0.16 82 HTML_IMAGE_RATIO_08 2046 2.01 2.06 1.99 83 XM_URI_RBL 1956 0.68 1.97 0.10 84 T_MIXED_ES 1943 1.40 1.96 1.15 85 SpammyFromTLD_02 1933 0.68 1.95 0.12 86 XMBody_17 1893 0.88 1.91 0.42 87 ONLINE_PHARMACY 1887 1.47 1.90 1.28 88 BAYES_00 1882 4.01 1.90 4.96 89 XMSlimDrugH 1849 0.91 1.86 0.49 90 T_REMOTE_IMAGE 1844 2.18 1.86 2.33 91 XMSubMetaSSx_00 1842 1.03 1.85 0.66 92 T_XMDrugObfuBody_08 1841 1.06 1.85 0.70 93 XM_H_Long_From02 1822 1.15 1.83 0.84 94 XM_RXBody 1816 0.84 1.83 0.39 95 URIBL_BLACK 1813 0.59 1.83 0.04 96 DIET_1 1700 0.82 1.71 0.43 97 XMPhish30 1681 0.82 1.69 0.43 98 XM_UB99 1669 0.52 1.68 0.01 99 MultiRelay_CC 1665 0.61 1.68 0.13 100 MultiRelay_Combo 1665 0.61 1.68 0.13 101 XMBdyGiftCard01 1656 1.35 1.67 1.20 102 SpammyFromTLD_01 1651 0.73 1.66 0.31 103 XMDiploma_00 1572 1.22 1.58 1.06 104 TR_XM_DK_Bayes 1558 3.03 1.57 3.68 105 TR_XM_DK_Bayes1 1540 2.94 1.55 3.56 106 URIBL_DBL_SPAM 1536 0.49 1.55 0.02 107 XM_ProductURIs 1528 1.19 1.54 1.03 108 XMSexyCombo_01 1525 0.85 1.54 0.54 109 TM2_M_VERY_LONG_WORD 1483 0.97 1.49 0.74 110 TVD_VISIT_PHARMA 1454 0.90 1.46 0.64 111 RCVD_IN_PSBL 1454 0.57 1.46 0.17 112 TR_XM_DK_Bayes2 1454 2.64 1.46 3.16 113 RCVD_IN_IADB_LISTED 1449 2.73 1.46 3.30 114 XMSlimDrugs 1390 0.66 1.40 0.33 115 XM_B_COPY_HTML 1386 0.90 1.40 0.67 116 XM_UB999 1340 0.42 1.35 0.00 117 XMStockSpam_06 1333 0.73 1.34 0.46 118 HTML_MIME_NO_HTML_TAG 1300 1.30 1.31 1.30 119 T_XMDrugObfuBody_00 1274 0.55 1.28 0.22 120 XMBody_78 1230 0.74 1.24 0.52 121 BAYES_40 1225 1.83 1.23 2.09 122 RELAYCOUNTRY_FR 1213 0.59 1.22 0.31 123 RCVD_IN_IADB_SPF 1207 2.35 1.22 2.86 124 NORDNS_LOW_CONTRAST 1198 0.39 1.21 0.03 125 SUBJ_DOLLARS 1194 0.49 1.20 0.18 126 RDNS_DYNAMIC 1180 0.70 1.19 0.48 127 RELAYCOUNTRY_AT 1172 0.43 1.18 0.10 128 XMSubMetaI_01 1159 0.42 1.17 0.08 129 RCVD_IN_IADB_SENDERID 1153 2.09 1.16 2.50 130 XM_HighProb1 1134 0.37 1.14 0.02 131 RCVD_IN_IADB_DK 1133 2.03 1.14 2.43 132 BAYES_20 1132 1.36 1.14 1.45 133 PLING_QUERY 1126 0.56 1.13 0.30 134 XM_B_REG_HTML 1118 1.09 1.13 1.07 135 XM_DK_Undo_01 1108 1.34 1.12 1.44 136 UNPARSEABLE_RELAY 1089 4.41 1.10 5.89 137 RELAYCOUNTRY_IN 1084 0.36 1.09 0.03 138 XMHTMLBadTable_001 1077 0.75 1.08 0.60 139 MAILING_LIST_MULTI 1066 1.39 1.07 1.53 140 TR_XM_RelayPhish 1056 0.54 1.06 0.31 141 XM_UB60 1051 0.36 1.06 0.05 142 DKIM_ADSP_CUSTOM_MED 1041 0.88 1.05 0.80 143 NO_PRESCRIPTION 1035 0.45 1.04 0.19 144 XM_UB80 1017 0.33 1.02 0.02 145 XMSubMetaD_03 1007 0.36 1.01 0.07 146 XM_H_PHPOS 998 1.04 1.00 1.05 147 XMBrknScrpt_02 997 1.00 1.00 0.99 148 LOW_PRICE 992 0.47 1.00 0.24 149 XMSubMetaSxObfu_03 968 0.64 0.97 0.50 150 BODY_ENHANCEMENT 960 0.31 0.97 0.02 151 RCVD_IN_IADB_VOUCHED 959 2.31 0.97 2.91 152 FILL_THIS_FORM 948 0.46 0.95 0.23 153 XM_Body_Obfu01 940 0.42 0.95 0.19 154 NML_ADSP_CUSTOM_MED 931 0.69 0.94 0.57 155 XM_S_JOY_D 924 0.56 0.93 0.39 156 RELAYCOUNTRY_CN 917 0.30 0.92 0.03 157 XMGenDplmaNmb 914 0.69 0.92 0.58 158 LONG_JUNK_URI 896 0.35 0.90 0.10 159 HTML_FONT_FACE_BAD 894 0.59 0.90 0.45 160 XMSubMetaSx_01 856 0.49 0.86 0.32 161 XMPhish11 855 0.73 0.86 0.67 162 XM_BadFromFormat 842 0.47 0.85 0.31 163 FILL_THIS_FORM_LOAN 824 0.37 0.83 0.17 164 FSL_THIS_IS_ADV 819 0.31 0.82 0.08 165 XM_OfRef7 812 0.38 0.82 0.18 166 FORGED_GMAIL_RCVD 796 0.47 0.80 0.31 167 DATE_IN_PAST_24_48 789 0.25 0.79 0.01 168 T_Symld_Words_02 784 0.41 0.79 0.24 169 XMHTML_After_End 774 0.37 0.78 0.19 170 TR_LOTS_OF_MONEY2 765 0.31 0.77 0.11 171 T_MONEY_PERCENT 765 0.31 0.77 0.11 172 XM_UB95 754 0.24 0.76 0.01 173 DATE_IN_PAST_06_12 733 0.26 0.74 0.05 174 XMPhish14 730 0.40 0.74 0.25 175 XMGppyBdWords 729 0.30 0.73 0.10 176 HTML_TAG_BALANCE_BODY 728 0.49 0.73 0.39 177 FILL_THIS_FORM_LONG 713 0.34 0.72 0.17 178 DRUGS_ERECTILE 708 0.27 0.71 0.07 179 XM_H_PHPMailer 698 0.76 0.70 0.78 180 BAYES_05 689 0.93 0.69 1.03 181 HTML_FONT_SIZE_HUGE 687 0.36 0.69 0.21 182 URI_TRY_3LD 683 0.54 0.69 0.47 183 RELAYCOUNTRY_DE 671 0.40 0.68 0.28 184 TR_Caps_n_Bayes_99 671 0.25 0.68 0.05 185 TR_Symld_Words 670 2.46 0.67 3.26 186 XMSubMetaD_00 662 0.26 0.67 0.07 187 XMSexyCombo_04 651 0.26 0.66 0.08 188 RELAYCOUNTRY_JP 641 0.22 0.65 0.03 189 DATE_IN_PAST_03_06 635 0.26 0.64 0.09 190 T_HTML_TAG_BALANCE_CENTER 634 0.32 0.64 0.18 191 RELAYCOUNTRY_GB 629 0.50 0.63 0.45 192 XMSolicitRefs_0 610 0.41 0.61 0.32 193 MPART_ALT_DIFF_COUNT 598 0.37 0.60 0.27 194 TooManyTo_002 562 1.03 0.57 1.24 195 URI_NOVOWEL 545 0.32 0.55 0.22 196 DEAR_FRIEND 541 0.23 0.54 0.09 197 MONEY_BACK 522 0.20 0.53 0.06 198 T_TooManySym_02 520 1.40 0.52 1.79 199 XMSolicitRefs_4 519 0.24 0.52 0.11 200 XM_H_PHPOS_M 515 0.51 0.52 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146569 73.26 89.69 65.92 2 DCC_CHECK_NEGATIVE 139640 49.91 21.04 62.80 3 DKIM_SIGNED 136796 68.34 83.59 61.52 4 XM_DK_Pass 135049 66.92 80.74 60.74 5 BAYES_50 133693 51.11 30.91 60.13 6 DKIM_VALID 132393 65.81 79.83 59.54 7 DKIM_VALID_AU 103576 52.29 65.08 46.58 8 XMListUnsubscribeExists 95821 52.99 75.14 43.10 9 XM_H_QuotedFrom 80260 43.27 59.31 36.10 10 DCC_CHECK 80118 48.82 77.43 36.03 11 ALL_TRUSTED 74404 25.44 7.47 33.46 12 HTML_FONT_LOW_CONTRAST 56515 29.61 39.00 25.42 13 DKIM_VALID_EF 49030 20.53 17.13 22.05 14 T_TM2_M_HEADER_IN_MSG 48005 20.90 19.35 21.59 15 LOC_TINY_FONT_1 45958 25.70 36.97 20.67 16 XMSubLong 45432 21.70 24.52 20.43 17 XM_DK_Undo_02 39172 27.65 50.12 17.62 18 FVGT_m_MULTI_ODD 39013 20.94 28.55 17.55 19 BAYES_99 37981 25.72 45.06 17.08 20 BAYES_999 34394 22.73 38.98 15.47 21 MIME_HTML_ONLY 34391 18.35 24.79 15.47 22 ANY_BOUNCE_MESSAGE 34075 10.75 0.50 15.33 23 BOUNCE_MESSAGE 34072 10.75 0.50 15.32 24 XM_DKIMWhitelistDomains 30279 9.42 0.02 13.62 25 RCVD_IN_RP_SAFE 27119 10.55 6.87 12.20 26 MultiRelay 25026 11.51 12.08 11.26 27 RCVD_IN_RP_CERTIFIED 24580 9.33 5.45 11.05 28 XM_Multi_Part_URI 23683 11.88 14.63 10.65 29 TR_DCC_Bayes_99 19939 17.33 36.06 8.97 30 T_KAM_HTML_FONT_INVALID 18945 10.12 13.71 8.52 31 XM_Body_Dirty_Words 17728 11.20 18.41 7.97 32 BAYES_60 15684 7.02 6.95 7.05 33 LotsOfNums_01 15217 7.52 9.04 6.84 34 HTML_IMAGE_RATIO_02 15210 10.96 20.17 6.84 35 BOTNET_IPINHOSTNAME 14524 8.03 11.38 6.53 36 XM_Evil_Numbers_Gen 14117 8.94 14.75 6.35 37 XMSubMetaSx_00 13619 7.24 9.73 6.13 38 UNPARSEABLE_RELAY 13101 4.41 1.10 5.89 39 XMNumbers 11727 4.83 3.85 5.27 40 FSL_BULK_SIG 11637 5.65 6.57 5.23 41 TooManyTo_001 11029 5.57 6.92 4.96 42 BAYES_00 11029 4.01 1.90 4.96 43 T_XMDrugObfuBody_14 11020 6.04 8.46 4.96 44 T_TooManySym_01 10919 4.22 2.67 4.91 45 LOTS_OF_MONEY 10802 6.71 10.85 4.86 46 RCVD_IN_MSPIKE_H2 9821 4.47 4.60 4.42 47 XM_SendGrid 9682 4.23 3.94 4.35 48 XM_UncommonTLD01 9232 5.16 7.43 4.15 49 IN_ZIMBRA_NJ_WHITELIST 9230 2.88 0.03 4.15 50 XM_H_Long_From01 9196 5.33 8.00 4.14 51 XMStrtUSub 9045 4.21 4.54 4.07 52 XM_B_Phish_Phrases 9013 5.46 8.60 4.05 53 HTML_IMAGE_RATIO_04 8592 5.77 10.04 3.86 54 TVD_RCVD_IP 8350 2.66 0.20 3.76 55 BAYES_80 8294 4.85 7.35 3.73 56 RELAYCOUNTRY_META 8232 7.13 14.79 3.70 57 TR_XM_DK_Bayes 8185 3.03 1.57 3.68 58 FROM_EXCESS_BASE64 8166 4.56 6.56 3.67 59 TR_XM_DK_Bayes1 7913 2.94 1.55 3.56 60 RCVD_IN_IADB_LISTED 7348 2.73 1.46 3.30 61 TR_Symld_Words 7245 2.46 0.67 3.26 62 MIME_QP_LONG_LINE 7035 3.12 3.01 3.16 63 TR_XM_DK_Bayes2 7033 2.64 1.46 3.16 64 TR_XM_DocInvoice 6980 4.37 7.14 3.14 65 INVALID_MSGID 6720 2.13 0.12 3.02 66 TO_MALFORMED 6666 2.07 0.01 3.00 67 RCVD_IN_IADB_VOUCHED 6463 2.31 0.97 2.91 68 RCVD_IN_IADB_SPF 6362 2.35 1.22 2.86 69 HTML_IMAGE_RATIO_06 5834 2.99 3.80 2.62 70 MIME_HTML_MOSTLY 5729 2.99 3.91 2.58 71 RCVD_IN_IADB_SENDERID 5561 2.09 1.16 2.50 72 MPART_ALT_DIFF 5534 3.86 6.92 2.49 73 BAYES_95 5485 3.18 4.78 2.47 74 XMSexyCombo_05 5430 4.68 9.69 2.44 75 RCVD_IN_IADB_DK 5403 2.03 1.14 2.43 76 URI_WP_HACKED_2 5318 3.00 4.36 2.39 77 IN_HORDE_ADDRESS_BOOK 5198 1.64 0.06 2.34 78 T_REMOTE_IMAGE 5173 2.18 1.86 2.33 79 IMPOTENCE 4958 2.60 3.42 2.23 80 BAYES_40 4657 1.83 1.23 2.09 81 HTML_IMAGE_RATIO_08 4416 2.01 2.06 1.99 82 DKIM_INVALID 4403 2.53 3.77 1.98 83 T_TooManySym_02 3990 1.40 0.52 1.79 84 SUBJ_ALL_CAPS 3712 2.02 2.80 1.67 85 USER_IN_DEF_DKIM_WL 3544 1.11 0.04 1.59 86 RCVD_IN_MSPIKE_H3 3504 1.24 0.48 1.58 87 RCVD_IN_MSPIKE_WL 3504 1.24 0.48 1.58 88 TM2_M_URI_OPT_OUT 3456 2.21 3.68 1.55 89 MAILING_LIST_MULTI 3391 1.39 1.07 1.53 90 BAYES_20 3230 1.36 1.14 1.45 91 XM_DK_Undo_01 3198 1.34 1.12 1.44 92 RELAYCOUNTRY_CA 3163 2.16 3.80 1.42 93 XM_PDF 3126 1.07 0.32 1.41 94 XM_CamelCaseFrm001 3100 2.00 3.36 1.39 95 SUSPICIOUS_RECIPS 3024 2.30 4.41 1.36 96 HTML_MIME_NO_HTML_TAG 2885 1.30 1.31 1.30 97 ONLINE_PHARMACY 2835 1.47 1.90 1.28 98 TooManyTo_002 2767 1.03 0.57 1.24 99 XMBdyGiftCard01 2675 1.35 1.67 1.20 100 T_MIXED_ES 2561 1.40 1.96 1.15 101 TR_LOTS_OF_MONEY3 2509 2.03 4.06 1.13 102 USER_IN_WHITELIST 2508 0.78 0.00 1.13 103 UNTRUSTED_Relay 2473 3.40 8.53 1.11 104 XMSubMetaI_00 2465 1.74 3.16 1.11 105 XM_GoogleGroups 2386 0.88 0.45 1.07 106 XM_B_REG_HTML 2379 1.09 1.13 1.07 107 XM_DIRTYINTL 2371 1.77 3.36 1.07 108 XMDiploma_00 2346 1.22 1.58 1.06 109 XM_H_PHPOS 2338 1.04 1.00 1.05 110 XM_ProductURIs 2299 1.19 1.54 1.03 111 BAYES_05 2290 0.93 0.69 1.03 112 RCVD_IN_IADB_OPTIN 2283 0.80 0.30 1.03 113 URI_HEX 2277 1.67 3.13 1.02 114 T_XMHurry_00 2246 1.74 3.38 1.01 115 XM_OfRef6 2237 1.57 2.84 1.01 116 XMBrknScrpt_02 2206 1.00 1.00 0.99 117 XMSubMetaSxObfu_02 2100 0.75 0.31 0.94 118 XM_SPF_SoftFail 2097 1.45 2.58 0.94 119 T_TooManySym_03 2029 0.69 0.20 0.91 120 TooManyTo_003 1933 0.75 0.49 0.87 121 XMBody_29 1923 0.68 0.26 0.86 122 XM_H_Long_From02 1876 1.15 1.83 0.84 123 XMBody_95 1842 0.59 0.06 0.83 124 BOTNET 1827 4.53 12.83 0.82 125 MIME_HTML_ONLY_MULTI 1821 1.51 3.06 0.82 126 DKIM_ADSP_CUSTOM_MED 1783 0.88 1.05 0.80 127 XM_H_PHPMailer 1738 0.76 0.70 0.78 128 TM2_M_VERY_LONG_WORD 1638 0.97 1.49 0.74 129 T_XMDrugObfuBody_08 1559 1.06 1.85 0.70 130 T_FILL_THIS_FORM_SHORT 1542 0.61 0.43 0.69 131 HELO_NODOT 1536 0.58 0.34 0.69 132 XM_UB50 1514 1.36 2.89 0.68 133 TooManyTo_004 1508 0.59 0.40 0.68 134 XM_B_COPY_HTML 1499 0.90 1.40 0.67 135 XMPhish11 1480 0.73 0.86 0.67 136 XMSubMetaSSx_00 1478 1.03 1.85 0.66 137 TVD_VISIT_PHARMA 1426 0.90 1.46 0.64 138 XMHTMLBadTable_001 1328 0.75 1.08 0.60 139 XMGenDplmaNmb 1295 0.69 0.92 0.58 140 NML_ADSP_CUSTOM_MED 1273 0.69 0.94 0.57 141 XMSexyCombo_01 1195 0.85 1.54 0.54 142 TooManyTo_005 1182 0.46 0.31 0.53 143 XMBody_78 1155 0.74 1.24 0.52 144 XM_H_PHPOS_M 1139 0.51 0.52 0.51 145 T_TooManySym_04 1116 0.39 0.13 0.50 146 XMSubMetaSxObfu_03 1102 0.64 0.97 0.50 147 XMSlimDrugH 1083 0.91 1.86 0.49 148 RDNS_DYNAMIC 1061 0.70 1.19 0.48 149 URI_TRY_3LD 1047 0.54 0.69 0.47 150 XMStockSpam_06 1015 0.73 1.34 0.46 151 RCVD_IN_BL_SPAMCOP_NET 1005 1.26 3.05 0.45 152 HTML_FONT_FACE_BAD 1000 0.59 0.90 0.45 153 RELAYCOUNTRY_GB 993 0.50 0.63 0.45 154 XM_ShortIntro_01 976 0.46 0.50 0.44 155 XMPhish30 966 0.82 1.69 0.43 156 DIET_1 952 0.82 1.71 0.43 157 TR_MetaPhish_Combo_01 949 0.45 0.49 0.43 158 XMBody_17 935 0.88 1.91 0.42 159 TM2_M_A_HREF_HREF 919 0.41 0.42 0.41 160 NO_DNS_FOR_FROM 897 0.37 0.30 0.40 161 DKIM_ADSP_NXDOMAIN 882 0.38 0.36 0.40 162 XM_RXBody 876 0.84 1.83 0.39 163 XM_S_JOY_D 872 0.56 0.93 0.39 164 HTML_TAG_BALANCE_BODY 861 0.49 0.73 0.39 165 REMOVE_BEFORE_LINK 857 0.42 0.51 0.39 166 RCVD_IN_IADB_DOPTIN 855 0.28 0.05 0.38 167 XMNoVowels 813 0.35 0.31 0.37 168 XM_D_tchamptons_WL 750 0.23 0.00 0.34 169 XMSlimDrugs 741 0.66 1.40 0.33 170 SORTED_RECIPS 730 1.02 2.57 0.33 171 XMSolicitRefs_0 722 0.41 0.61 0.32 172 XMSubMetaSx_01 720 0.49 0.86 0.32 173 XM_B_TRADE_HTML 713 0.36 0.44 0.32 174 XM_D_TLN_Whitelist 703 0.22 0.00 0.32 175 FORGED_GMAIL_RCVD 700 0.47 0.80 0.31 176 ZMIfish_ForgedBill 698 0.22 0.00 0.31 177 SpammyFromTLD_01 693 0.73 1.66 0.31 178 RELAYCOUNTRY_FR 689 0.59 1.22 0.31 179 TR_XM_RelayPhish 684 0.54 1.06 0.31 180 XM_BadFromFormat 684 0.47 0.85 0.31 181 XMCapTrack 672 0.27 0.21 0.30 182 PLING_QUERY 664 0.56 1.13 0.30 183 MISSING_HEADERS 659 0.34 0.43 0.30 184 XMSubEmpty 656 0.25 0.16 0.30 185 HTML_IMAGE_ONLY_32 644 0.31 0.37 0.29 186 URIBL_SBL_A 640 0.35 0.50 0.29 187 RELAYCOUNTRY_DE 621 0.40 0.68 0.28 188 MPART_ALT_DIFF_COUNT 603 0.37 0.60 0.27 189 T_TooManySym_05 600 0.19 0.01 0.27 190 RELAYCOUNTRY_AU 556 0.26 0.28 0.25 191 XMDateMe_00 554 0.30 0.43 0.25 192 XMPhish14 554 0.40 0.74 0.25 193 UPPERCASE_50_75 547 0.19 0.07 0.25 194 RELAYCOUNTRY_NL 545 0.32 0.49 0.25 195 T_Symld_Words_02 542 0.41 0.79 0.24 196 LOW_PRICE 532 0.47 1.00 0.24 197 HTML_IMAGE_ONLY_28 531 0.30 0.43 0.24 198 XM_Walgreens_Forge 526 0.27 0.35 0.24 199 TR_MetaPhish_Combo_01b 519 0.19 0.08 0.23 200 FILL_THIS_FORM 518 0.46 0.95 0.23 ----------------------------------------------------------------------