Email: 368531 Autolearn: 0 AvgScore: 1.58 AvgScanTime: 1.89 sec Spam: 87153 Autolearn: 0 AvgScore: 12.64 AvgScanTime: 2.26 sec Ham: 281378 Autolearn: 0 AvgScore: -1.84 AvgScanTime: 1.77 sec Time Spent Running SA: 193.45 hours Time Spent Processing Spam: 54.81 hours Time Spent Processing Ham: 138.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 78108 87.38 89.62 86.68 2 DKIM_SIGNED 61764 79.60 70.87 82.31 3 XM_DK_Pass 60230 78.01 69.11 80.77 4 DCC_CHECK 59524 56.41 68.30 52.73 5 DKIM_VALID 56755 74.64 65.12 77.59 6 XMListUnsubscribeExists 53566 61.02 61.46 60.89 7 DKIM_VALID_AU 48194 61.01 55.30 62.78 8 XM_H_QuotedFrom 38448 41.61 44.12 40.84 9 BAYES_50 36076 51.55 41.39 54.69 10 MIME_HTML_ONLY 31255 25.06 35.86 21.72 11 LOC_TINY_FONT_1 30773 31.41 35.31 30.20 12 HTML_FONT_LOW_CONTRAST 28517 34.29 32.72 34.77 13 XM_DK_Undo_02 27505 14.93 31.56 9.78 14 BAYES_99 27398 13.38 31.44 7.79 15 DCC_CHECK_NEGATIVE 26720 42.41 30.66 46.05 16 BAYES_999 22415 11.05 25.72 6.51 17 RELAYCOUNTRY_META 22152 9.70 25.42 4.83 18 FVGT_m_MULTI_ODD 21180 22.79 24.30 22.33 19 XMSubLong 19505 21.72 22.38 21.51 20 BOTNET 18810 6.79 21.58 2.20 21 TR_DCC_Bayes_99 18270 8.56 20.96 4.72 22 UNTRUSTED_Relay 15508 5.36 17.79 1.51 23 DKIM_VALID_EF 15139 26.65 17.37 29.52 24 HTML_MIME_NO_HTML_TAG 14213 4.91 16.31 1.39 25 BOTNET_IPINHOSTNAME 14174 8.75 16.26 6.43 26 T_REMOTE_IMAGE 13768 6.35 15.80 3.43 27 T_KAM_HTML_FONT_INVALID 13709 15.67 15.73 15.66 28 LOTS_OF_MONEY 13684 11.57 15.70 10.29 29 XM_Body_Dirty_Words 13555 15.18 15.55 15.07 30 T_TM2_M_HEADER_IN_MSG 13550 21.43 15.55 23.26 31 FROM_EXCESS_BASE64 13083 7.39 15.01 5.03 32 XM_Multi_Part_URI 12178 14.66 13.97 14.87 33 HTML_SHORT_LINK_IMG_1 12032 3.29 13.81 0.03 34 BODY_URI_ONLY 12017 3.29 13.79 0.04 35 MIME_HEADER_CTYPE_ONLY 11945 3.35 13.71 0.14 36 HTML_IMAGE_RATIO_02 11883 13.09 13.63 12.92 37 HTML_IMAGE_ONLY_04 11883 3.26 13.63 0.04 38 XM_UncommonTLD01 11876 6.01 13.63 3.65 39 HTML_SHORT_CENTER 11800 3.21 13.54 0.01 40 MultiRelay 10581 13.02 12.14 13.30 41 FSL_BULK_SIG 10063 8.78 11.55 7.92 42 XMSubMetaSx_00 9729 6.67 11.16 5.27 43 XM_Evil_Numbers_Gen 8557 10.43 9.82 10.62 44 TooManyTo_001 8502 6.68 9.76 5.72 45 MISSING_HEADERS 8460 2.45 9.71 0.20 46 XMSexyCombo_05 8109 6.28 9.30 5.34 47 BAYES_60 7980 6.47 9.16 5.64 48 XMNumbers 7957 4.83 9.13 3.50 49 RELAYCOUNTRY_FR 7635 2.24 8.76 0.22 50 RCVD_IN_RP_RNBL 6887 1.92 7.90 0.06 51 XM_OfRef6 6799 3.47 7.80 2.13 52 XM_JunkDunk 6657 1.81 7.64 0.00 53 HTML_IMAGE_RATIO_04 6573 6.22 7.54 5.81 54 XM_UB99 6297 1.72 7.23 0.01 55 BAYES_80 5918 4.20 6.79 3.40 56 XM_H_Long_From01 5784 6.38 6.64 6.30 57 T_XMDrugObfuBody_14 5488 6.97 6.30 7.18 58 XM_UB999 5458 1.49 6.26 0.01 59 XM_B_Phish_Phrases 5179 7.63 5.94 8.15 60 T_FILL_THIS_FORM_SHORT 5116 1.92 5.87 0.70 61 SpammyFromTLD_02 5034 1.51 5.78 0.19 62 DKIM_INVALID 5009 4.96 5.75 4.72 63 LotsOfNums_01 4994 7.84 5.73 8.49 64 XM_OfRef7 4792 1.64 5.50 0.45 65 ANY_BOUNCE_MESSAGE 4712 3.04 5.41 2.30 66 BOUNCE_MESSAGE 4712 3.04 5.41 2.30 67 FROM_SUSPICIOUS_NTLD 4702 1.33 5.40 0.07 68 MONEY_FORM_SHORT 4677 1.27 5.37 0.01 69 MPART_ALT_DIFF 4676 4.26 5.37 3.92 70 HTML_IMAGE_RATIO_06 4493 4.69 5.16 4.54 71 HK_SCAM_N2 4385 1.20 5.03 0.01 72 XM_UB50 4212 1.77 4.83 0.83 73 BAYES_95 4146 2.75 4.76 2.13 74 XMSexyCombo_01 3798 1.48 4.36 0.59 75 SHORTENER_SHORT_IMG 3710 1.01 4.26 0.00 76 XMStrtUSub 3564 6.33 4.09 7.02 77 XM_H_TOP 3337 0.91 3.83 0.01 78 RELAYCOUNTRY_CA 3093 2.32 3.55 1.94 79 XM_DIRTYINTL 2973 2.03 3.41 1.60 80 RELAYCOUNTRY_GB 2828 1.14 3.24 0.48 81 MIME_HTML_MOSTLY 2810 3.64 3.22 3.77 82 MIME_HTML_ONLY_MULTI 2807 1.84 3.22 1.41 83 XM_SPF_SoftFail 2797 1.87 3.21 1.46 84 HTML_IMAGE_RATIO_08 2735 2.55 3.14 2.37 85 DATE_IN_PAST_06_12 2723 0.76 3.12 0.03 86 XMBdyGiftCard01 2554 2.00 2.93 1.71 87 XMSubMetaI_00 2553 1.54 2.93 1.11 88 URI_HEX 2501 2.59 2.87 2.50 89 DIET_1 2453 1.09 2.81 0.56 90 TM2_M_URI_OPT_OUT 2421 2.24 2.78 2.08 91 MultiRelay_Combo 2369 0.73 2.72 0.11 92 MultiRelay_CC 2369 0.73 2.72 0.11 93 BOTNET_NORDNS 2212 0.61 2.54 0.01 94 XM_SendGrid 2211 5.14 2.54 5.94 95 RCVD_IN_RP_SAFE 2165 12.26 2.48 15.29 96 T_XMHurry_00 2099 1.50 2.41 1.21 97 UNPARSEABLE_RELAY 2062 3.82 2.37 4.27 98 NO_DNS_FOR_FROM 2037 1.66 2.34 1.45 99 TR_LOTS_OF_MONEY3 2006 1.34 2.30 1.04 100 RELAYCOUNTRY_CN 1977 0.57 2.27 0.04 101 XMSubMetaSSx_00 1969 1.35 2.26 1.07 102 BODY_ENHANCEMENT 1912 0.55 2.19 0.04 103 XM_CamelCaseFrm001 1878 1.91 2.15 1.83 104 XM_UB60 1820 0.54 2.09 0.06 105 RCVD_IN_BL_SPAMCOP_NET 1818 0.67 2.09 0.23 106 BAYES_40 1766 3.21 2.03 3.58 107 SUBJ_ALL_CAPS 1766 2.38 2.03 2.50 108 XMBody_17 1734 1.22 1.99 0.98 109 T_XMDrugObfuBody_08 1730 1.37 1.99 1.19 110 BAYES_20 1726 2.55 1.98 2.73 111 XM_H_Long_From02 1723 1.08 1.98 0.81 112 XM_URI_RBL 1698 1.03 1.95 0.74 113 URI_TRY_3LD 1697 2.45 1.95 2.61 114 T_TooManySym_01 1619 5.13 1.86 6.14 115 XMSexyCombo_04 1591 0.66 1.83 0.30 116 RCVD_IN_RP_CERTIFIED 1580 10.25 1.81 12.87 117 XM_salutation2 1542 0.96 1.77 0.71 118 RCVD_IN_MSPIKE_H2 1518 4.11 1.74 4.84 119 URIBL_BLACK 1459 0.45 1.67 0.08 120 TVD_SPACE_RATIO_MINFP 1404 0.39 1.61 0.01 121 MIME_QP_LONG_LINE 1396 3.69 1.60 4.33 122 XMDiploma_00 1394 1.42 1.60 1.37 123 XM_UB95 1268 0.35 1.45 0.01 124 XMSlimDrugH 1260 0.64 1.45 0.40 125 TM2_M_VERY_LONG_WORD 1259 1.06 1.44 0.94 126 XMStockSpam_06 1192 1.52 1.37 1.57 127 XMPhish30 1090 0.64 1.25 0.45 128 HTML_FONT_SIZE_LARGE 1076 0.42 1.23 0.17 129 FILL_THIS_FORM 1068 0.81 1.23 0.67 130 XMPhish11 1060 0.92 1.22 0.83 131 RELAYCOUNTRY_AT 1059 0.56 1.22 0.35 132 TR_XM_RelayPhish 1052 0.62 1.21 0.44 133 XMMoneyMeta_00 1036 0.45 1.19 0.23 134 HK_RANDOM_FROM 1024 0.42 1.17 0.19 135 DATE_IN_PAST_12_24 1023 0.31 1.17 0.04 136 TR_Mismatch_TLD_02 1012 0.32 1.16 0.06 137 LONG_JUNK_URI 992 0.34 1.14 0.09 138 XMWghtMeta_00 986 0.28 1.13 0.02 139 BAYES_00 979 13.91 1.12 17.87 140 XMGenDplmaNmb 976 0.85 1.12 0.77 141 MAILING_LIST_MULTI 972 1.51 1.12 1.63 142 HTML_FONT_FACE_BAD 965 0.85 1.11 0.77 143 RCVD_IN_IADB_LISTED 963 3.35 1.10 4.05 144 FILL_THIS_FORM_LONG 961 0.71 1.10 0.59 145 BAYES_05 955 1.74 1.10 1.94 146 LongTLD 950 0.41 1.09 0.20 147 ALL_TRUSTED 943 10.41 1.08 13.30 148 SpammyFromTLD_01 921 0.47 1.06 0.29 149 XM_B_COPY_HTML 910 0.77 1.04 0.69 150 XM_H_PHPOS 910 0.92 1.04 0.88 151 FILL_THIS_FORM_LOAN 907 0.68 1.04 0.57 152 XMHTML_After_End 893 0.66 1.02 0.54 153 XM_RXBody 890 0.80 1.02 0.73 154 SUBJ_DOLLARS 884 0.69 1.01 0.59 155 RCVD_IN_IADB_SPF 878 2.94 1.01 3.54 156 T_Symld_Words_02 863 0.52 0.99 0.38 157 LOCALPART_IN_SUBJECT 861 0.24 0.99 0.01 158 T_XMDrugObfuBody_00 848 0.93 0.97 0.91 159 RCVD_IN_IADB_DK 842 2.60 0.97 3.11 160 RCVD_IN_IADB_SENDERID 836 2.66 0.96 3.18 161 XM_UB80 808 0.24 0.93 0.03 162 XMSubject_48 760 0.45 0.87 0.32 163 SUBJECT_DIET 732 0.20 0.84 0.01 164 DKIM_ADSP_CUSTOM_MED 723 0.84 0.83 0.84 165 TR_XM_DK_Bayes 711 12.14 0.82 15.65 166 TO_NAME_SUBJ_NO_RDNS 694 0.19 0.80 0.00 167 DKIM_ADSP_NXDOMAIN 693 0.74 0.80 0.72 168 TR_Symld_Words 692 1.66 0.79 1.93 169 XMSubMetaSxObfu_03 692 0.59 0.79 0.53 170 XMQckEasyMeta_00 679 0.19 0.78 0.01 171 XMSubNoVowel 674 0.32 0.77 0.18 172 URIBL_DBL_SPAM 671 0.23 0.77 0.06 173 NML_ADSP_CUSTOM_MED 663 0.63 0.76 0.59 174 TR_Caps_n_Bayes_99 646 0.23 0.74 0.07 175 TR_LOTS_OF_MONEY2 639 0.37 0.73 0.26 176 T_MONEY_PERCENT 639 0.37 0.73 0.26 177 RCVD_IN_IADB_VOUCHED 632 2.07 0.73 2.48 178 XM_H_PHPMailer 632 0.70 0.73 0.69 179 XM_DK_Undo_01 628 1.16 0.72 1.29 180 XM_OverStock_LProb 614 0.21 0.70 0.06 181 XM_ProductURIs 613 0.94 0.70 1.02 182 TR_XM_DK_Bayes1 605 11.68 0.69 15.08 183 XMSubGiftCard1 605 0.18 0.69 0.03 184 FORGED_GMAIL_RCVD 593 0.46 0.68 0.39 185 RCVD_IN_IADB_OPTIN 577 1.35 0.66 1.56 186 RELAYCOUNTRY_PL 565 0.17 0.65 0.02 187 LOW_PRICE 560 0.41 0.64 0.34 188 TR_XM_DK_Bayes2 546 10.50 0.63 13.56 189 XMHTMLBadTable_001 546 0.92 0.63 1.01 190 RELAYCOUNTRY_DE 542 0.44 0.62 0.39 191 XMReplyNow 536 0.21 0.62 0.08 192 XM_S_JOY_D 535 0.48 0.61 0.44 193 TooManyTo_002 533 0.99 0.61 1.11 194 URIBL_SBL_A 528 0.19 0.61 0.06 195 URI_NOVOWEL 525 0.47 0.60 0.43 196 XMSubGiftCard2 515 0.14 0.59 0.01 197 XMSolicitRefs_0 514 0.41 0.59 0.35 198 MPART_ALT_DIFF_COUNT 513 0.38 0.59 0.31 199 FVGT_m_MULTI_ODD_EMAIL 487 0.15 0.56 0.02 200 TR_MetaPhish_Combo_01 480 1.61 0.55 1.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243906 87.38 89.62 86.68 2 DKIM_SIGNED 231600 79.60 70.87 82.31 3 XM_DK_Pass 227255 78.01 69.11 80.77 4 DKIM_VALID 218329 74.64 65.12 77.59 5 DKIM_VALID_AU 176657 61.01 55.30 62.78 6 XMListUnsubscribeExists 171319 61.02 61.46 60.89 7 BAYES_50 153893 51.55 41.39 54.69 8 DCC_CHECK 148368 56.41 68.30 52.73 9 DCC_CHECK_NEGATIVE 129583 42.41 30.66 46.05 10 XM_H_QuotedFrom 114910 41.61 44.12 40.84 11 HTML_FONT_LOW_CONTRAST 97844 34.29 32.72 34.77 12 LOC_TINY_FONT_1 84979 31.41 35.31 30.20 13 DKIM_VALID_EF 83064 26.65 17.37 29.52 14 T_TM2_M_HEADER_IN_MSG 65443 21.43 15.55 23.26 15 FVGT_m_MULTI_ODD 62818 22.79 24.30 22.33 16 MIME_HTML_ONLY 61115 25.06 35.86 21.72 17 XMSubLong 60530 21.72 22.38 21.51 18 BAYES_00 50279 13.91 1.12 17.87 19 T_KAM_HTML_FONT_INVALID 44056 15.67 15.73 15.66 20 TR_XM_DK_Bayes 44034 12.14 0.82 15.65 21 RCVD_IN_RP_SAFE 43021 12.26 2.48 15.29 22 XM_DKIMWhitelistDomains 43005 11.67 0.02 15.28 23 TR_XM_DK_Bayes1 42431 11.68 0.69 15.08 24 XM_Body_Dirty_Words 42393 15.18 15.55 15.07 25 XM_Multi_Part_URI 41835 14.66 13.97 14.87 26 TR_XM_DK_Bayes2 38158 10.50 0.63 13.56 27 ALL_TRUSTED 37437 10.41 1.08 13.30 28 MultiRelay 37419 13.02 12.14 13.30 29 HTML_IMAGE_RATIO_02 36359 13.09 13.63 12.92 30 RCVD_IN_RP_CERTIFIED 36205 10.25 1.81 12.87 31 XM_Evil_Numbers_Gen 29883 10.43 9.82 10.62 32 LOTS_OF_MONEY 28952 11.57 15.70 10.29 33 XM_DK_Undo_02 27519 14.93 31.56 9.78 34 LotsOfNums_01 23891 7.84 5.73 8.49 35 XM_B_Phish_Phrases 22946 7.63 5.94 8.15 36 FSL_BULK_SIG 22299 8.78 11.55 7.92 37 BAYES_99 21917 13.38 31.44 7.79 38 T_XMDrugObfuBody_14 20194 6.97 6.30 7.18 39 XMStrtUSub 19763 6.33 4.09 7.02 40 BAYES_999 18305 11.05 25.72 6.51 41 BOTNET_IPINHOSTNAME 18081 8.75 16.26 6.43 42 XM_H_Long_From01 17719 6.38 6.64 6.30 43 T_TooManySym_01 17284 5.13 1.86 6.14 44 XM_SendGrid 16726 5.14 2.54 5.94 45 HTML_IMAGE_RATIO_04 16337 6.22 7.54 5.81 46 TooManyTo_001 16098 6.68 9.76 5.72 47 BAYES_60 15870 6.47 9.16 5.64 48 XMSexyCombo_05 15032 6.28 9.30 5.34 49 XMSubMetaSx_00 14837 6.67 11.16 5.27 50 FROM_EXCESS_BASE64 14152 7.39 15.01 5.03 51 RCVD_IN_MSPIKE_H2 13619 4.11 1.74 4.84 52 RELAYCOUNTRY_META 13603 9.70 25.42 4.83 53 DKIM_INVALID 13271 4.96 5.75 4.72 54 TR_DCC_Bayes_99 13268 8.56 20.96 4.72 55 HTML_IMAGE_RATIO_06 12782 4.69 5.16 4.54 56 MIME_QP_LONG_LINE 12185 3.69 1.60 4.33 57 UNPARSEABLE_RELAY 12020 3.82 2.37 4.27 58 TO_MALFORMED 11556 3.15 0.08 4.11 59 RCVD_IN_IADB_LISTED 11394 3.35 1.10 4.05 60 MPART_ALT_DIFF 11025 4.26 5.37 3.92 61 TVD_RCVD_IP 10921 3.02 0.24 3.88 62 MIME_HTML_MOSTLY 10613 3.64 3.22 3.77 63 XM_UncommonTLD01 10262 6.01 13.63 3.65 64 BAYES_40 10060 3.21 2.03 3.58 65 RCVD_IN_IADB_SPF 9966 2.94 1.01 3.54 66 XMNumbers 9835 4.83 9.13 3.50 67 T_REMOTE_IMAGE 9644 6.35 15.80 3.43 68 BAYES_80 9576 4.20 6.79 3.40 69 IN_ZIMBRA_NJ_WHITELIST 9386 2.55 0.01 3.34 70 RCVD_IN_IADB_SENDERID 8960 2.66 0.96 3.18 71 RCVD_IN_IADB_DK 8747 2.60 0.97 3.11 72 BAYES_20 7676 2.55 1.98 2.73 73 URI_TRY_3LD 7336 2.45 1.95 2.61 74 URI_HEX 7029 2.59 2.87 2.50 75 SUBJ_ALL_CAPS 7021 2.38 2.03 2.50 76 RCVD_IN_IADB_VOUCHED 6986 2.07 0.73 2.48 77 INVALID_MSGID 6887 1.98 0.47 2.45 78 XM_PDF 6777 1.93 0.40 2.41 79 HTML_IMAGE_RATIO_08 6657 2.55 3.14 2.37 80 BOUNCE_MESSAGE 6481 3.04 5.41 2.30 81 ANY_BOUNCE_MESSAGE 6481 3.04 5.41 2.30 82 BOTNET 6202 6.79 21.58 2.20 83 BAYES_95 6006 2.75 4.76 2.13 84 XM_OfRef6 6003 3.47 7.80 2.13 85 TM2_M_URI_OPT_OUT 5849 2.24 2.78 2.08 86 RCVD_IN_MSPIKE_WL 5684 1.63 0.38 2.02 87 RCVD_IN_MSPIKE_H3 5677 1.63 0.38 2.02 88 USER_IN_DEF_DKIM_WL 5577 1.52 0.01 1.98 89 T_TooManySym_02 5549 1.62 0.49 1.97 90 TR_MetaPhish_Combo_01 5471 1.61 0.55 1.94 91 RELAYCOUNTRY_CA 5453 2.32 3.55 1.94 92 BAYES_05 5449 1.74 1.10 1.94 93 TR_Symld_Words 5418 1.66 0.79 1.93 94 XM_CamelCaseFrm001 5161 1.91 2.15 1.83 95 IN_HORDE_ADDRESS_BOOK 4871 1.33 0.01 1.73 96 XMBdyGiftCard01 4801 2.00 2.93 1.71 97 MAILING_LIST_MULTI 4582 1.51 1.12 1.63 98 XM_DIRTYINTL 4503 2.03 3.41 1.60 99 XMStockSpam_06 4419 1.52 1.37 1.57 100 RCVD_IN_IADB_OPTIN 4383 1.35 0.66 1.56 101 UNTRUSTED_Relay 4249 5.36 17.79 1.51 102 XM_SPF_SoftFail 4103 1.87 3.21 1.46 103 NO_DNS_FOR_FROM 4083 1.66 2.34 1.45 104 MIME_HTML_ONLY_MULTI 3966 1.84 3.22 1.41 105 HTML_MIME_NO_HTML_TAG 3899 4.91 16.31 1.39 106 XMDiploma_00 3849 1.42 1.60 1.37 107 XM_DK_Undo_01 3635 1.16 0.72 1.29 108 T_XMHurry_00 3416 1.50 2.41 1.21 109 T_XMDrugObfuBody_08 3335 1.37 1.99 1.19 110 XM_B_REG_HTML 3217 0.98 0.44 1.14 111 XMSubMetaI_00 3133 1.54 2.93 1.11 112 TooManyTo_002 3133 0.99 0.61 1.11 113 XMSubMetaSSx_00 3020 1.35 2.26 1.07 114 XM_GoogleGroups 2994 0.91 0.41 1.06 115 TR_LOTS_OF_MONEY3 2927 1.34 2.30 1.04 116 XM_ProductURIs 2868 0.94 0.70 1.02 117 XMHTMLBadTable_001 2832 0.92 0.63 1.01 118 XMBody_17 2769 1.22 1.99 0.98 119 XMBody_95 2766 0.77 0.07 0.98 120 TM2_M_VERY_LONG_WORD 2636 1.06 1.44 0.94 121 T_XMDrugObfuBody_00 2568 0.93 0.97 0.91 122 XM_H_PHPOS 2468 0.92 1.04 0.88 123 T_OBFU_PDF_ATTACH 2429 0.69 0.12 0.86 124 DKIM_ADSP_CUSTOM_MED 2367 0.84 0.83 0.84 125 XMPhish11 2333 0.92 1.22 0.83 126 XM_UB50 2327 1.77 4.83 0.83 127 TooManyTo_003 2313 0.75 0.53 0.82 128 XM_H_Long_From02 2268 1.08 1.98 0.81 129 USER_IN_WHITELIST 2200 0.60 0.00 0.78 130 XMGenDplmaNmb 2157 0.85 1.12 0.77 131 HTML_FONT_FACE_BAD 2155 0.85 1.11 0.77 132 XM_URI_RBL 2087 1.03 1.95 0.74 133 XMSubMetaSxObfu_01 2072 0.58 0.06 0.74 134 XM_RXBody 2042 0.80 1.02 0.73 135 T_TooManySym_03 2035 0.58 0.12 0.72 136 DKIM_ADSP_NXDOMAIN 2017 0.74 0.80 0.72 137 XM_salutation2 2009 0.96 1.77 0.71 138 T_FILL_THIS_FORM_SHORT 1970 1.92 5.87 0.70 139 XM_H_PHPMailer 1934 0.70 0.73 0.69 140 XM_B_COPY_HTML 1928 0.77 1.04 0.69 141 FILL_THIS_FORM 1899 0.81 1.23 0.67 142 UPPERCASE_75_100 1894 0.52 0.03 0.67 143 PLING_QUERY 1840 0.60 0.42 0.65 144 XMSubMetaSxObfu_02 1796 0.57 0.35 0.64 145 TooManyTo_004 1757 0.58 0.43 0.62 146 XMSexyCombo_01 1674 1.48 4.36 0.59 147 NML_ADSP_CUSTOM_MED 1674 0.63 0.76 0.59 148 FILL_THIS_FORM_LONG 1653 0.71 1.10 0.59 149 XMBrknScrpt_02 1651 0.57 0.52 0.59 150 SUBJ_DOLLARS 1648 0.69 1.01 0.59 151 TM2_M_A_HREF_HREF 1622 0.52 0.34 0.58 152 XMPhish14 1610 0.57 0.55 0.57 153 FILL_THIS_FORM_LOAN 1598 0.68 1.04 0.57 154 DIET_1 1571 1.09 2.81 0.56 155 XMBody_78 1567 0.54 0.48 0.56 156 TooManyTo_005 1555 0.51 0.36 0.55 157 XMHTML_After_End 1528 0.66 1.02 0.54 158 XMSubMetaSxObfu_03 1490 0.59 0.79 0.53 159 RDNS_DYNAMIC 1475 0.53 0.54 0.52 160 HELO_NODOT 1372 0.43 0.26 0.49 161 RELAYCOUNTRY_GB 1357 1.14 3.24 0.48 162 NUMERIC_HTTP_ADDR 1312 0.40 0.21 0.47 163 XM_shorewaves_Whitelist 1309 0.36 0.00 0.47 164 HTTPS_HTTP_MISMATCH 1285 0.41 0.28 0.46 165 GAPPY_SUBJECT 1279 0.38 0.15 0.45 166 XM_H_PHPOS_M 1278 0.47 0.51 0.45 167 XMPhish30 1260 0.64 1.25 0.45 168 XM_OfRef7 1257 1.64 5.50 0.45 169 T_TooManySym_04 1255 0.35 0.04 0.45 170 ADMITS_SPAM 1250 0.43 0.40 0.44 171 TR_XM_RelayPhish 1250 0.62 1.21 0.44 172 XM_S_JOY_D 1227 0.48 0.61 0.44 173 URI_NOVOWEL 1217 0.47 0.60 0.43 174 HTML_TAG_BALANCE_BODY 1206 0.41 0.35 0.43 175 RELAYCOUNTRY_AU 1118 0.39 0.35 0.40 176 XM_D_tchamptons_WL 1116 0.30 0.00 0.40 177 XMSlimDrugH 1114 0.64 1.45 0.40 178 XM_Walgreens_Forge 1112 0.31 0.02 0.40 179 FORGED_GMAIL_RCVD 1099 0.46 0.68 0.39 180 RELAYCOUNTRY_DE 1093 0.44 0.62 0.39 181 XMRcvdHeader_15 1077 0.29 0.00 0.38 182 T_Symld_Words_02 1067 0.52 0.99 0.38 183 XMLngstWrd_00 1063 0.33 0.17 0.38 184 REMOVE_BEFORE_LINK 1048 0.38 0.39 0.37 185 XMCapTrack 1039 0.33 0.19 0.37 186 XMNoVowels 1023 0.34 0.27 0.36 187 RELAYCOUNTRY_AT 997 0.56 1.22 0.35 188 XMSolicitRefs_0 990 0.41 0.59 0.35 189 XMSUPPORT 950 0.26 0.00 0.34 190 XMLngstWrd_01 946 0.29 0.16 0.34 191 LOW_PRICE 945 0.41 0.64 0.34 192 XM_H_SpoofStaff4 929 0.26 0.02 0.33 193 XMSubMetaD_03 925 0.36 0.48 0.33 194 XMSubject_48 901 0.45 0.87 0.32 195 MPART_ALT_DIFF_COUNT 876 0.38 0.59 0.31 196 XM_Akamai 865 0.24 0.01 0.31 197 XMSexyCombo_04 857 0.66 1.83 0.30 198 XMGappySubj_01 847 0.28 0.23 0.30 199 SpammyFromTLD_01 819 0.47 1.06 0.29 200 XM_ShortIntro_01 770 0.32 0.46 0.27 ----------------------------------------------------------------------