Email: 350636 Autolearn: 0 AvgScore: 3.09 AvgScanTime: 2.04 sec Spam: 99249 Autolearn: 0 AvgScore: 12.18 AvgScanTime: 2.42 sec Ham: 251387 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.89 sec Time Spent Running SA: 198.86 hours Time Spent Processing Spam: 66.71 hours Time Spent Processing Ham: 132.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88834 85.11 89.51 83.37 2 DKIM_SIGNED 79807 80.20 80.41 80.12 3 XM_DK_Pass 75161 77.89 75.73 78.74 4 DCC_CHECK 74252 56.77 74.81 49.65 5 XMListUnsubscribeExists 73295 61.60 73.85 56.77 6 DKIM_VALID 70572 74.25 71.11 75.49 7 DKIM_VALID_AU 58311 60.51 58.75 61.21 8 XM_DK_Undo_02 47676 27.68 48.04 19.65 9 BAYES_99 41525 24.67 41.84 17.90 10 BAYES_999 35302 21.68 35.57 16.20 11 HTML_FONT_LOW_CONTRAST 33935 33.47 34.19 33.19 12 BAYES_50 33452 45.15 33.71 49.67 13 TR_DCC_Bayes_99 33273 16.37 33.52 9.59 14 MIME_HTML_ONLY 32558 25.10 32.80 22.06 15 LOC_TINY_FONT_1 31571 29.97 31.81 29.24 16 FVGT_m_MULTI_ODD 26259 22.48 26.46 20.90 17 XM_Body_Dirty_Words 23746 18.19 23.93 15.93 18 DCC_CHECK_NEGATIVE 23584 41.92 23.76 49.09 19 RELAYCOUNTRY_META 21804 9.29 21.97 4.29 20 BOTNET 20875 7.46 21.03 2.10 21 XMSubLong 19990 22.62 20.14 23.60 22 T_KAM_HTML_FONT_INVALID 17780 14.90 17.91 13.71 23 BOTNET_IPINHOSTNAME 17194 9.68 17.32 6.66 24 DKIM_VALID_EF 17126 26.18 17.26 29.71 25 UNTRUSTED_Relay 16916 5.87 17.04 1.45 26 T_TM2_M_HEADER_IN_MSG 16536 21.11 16.66 22.87 27 MultiRelay 15648 15.97 15.77 16.05 28 HTML_IMAGE_RATIO_02 14539 12.33 14.65 11.42 29 XM_UncommonTLD01 13609 8.13 13.71 5.93 30 XM_Multi_Part_URI 13509 14.69 13.61 15.11 31 LOTS_OF_MONEY 12468 10.15 12.56 9.20 32 XM_Evil_Numbers_Gen 10452 10.85 10.53 10.98 33 XMSexyCombo_05 10374 6.42 10.45 4.83 34 FSL_BULK_SIG 10199 10.15 10.28 10.10 35 DKIM_INVALID 9235 5.95 9.30 4.63 36 XM_UB50 8706 3.00 8.77 0.72 37 XM_H_Long_From01 8601 7.33 8.67 6.80 38 TooManyTo_001 8047 6.62 8.11 6.03 39 HTML_IMAGE_RATIO_04 8044 7.59 8.10 7.39 40 FROM_EXCESS_BASE64 7731 6.24 7.79 5.63 41 BAYES_60 7239 6.51 7.29 6.20 42 LotsOfNums_01 7210 7.33 7.26 7.36 43 T_XMDrugObfuBody_14 6934 7.46 6.99 7.65 44 BAYES_80 6833 4.94 6.88 4.17 45 HTML_MIME_NO_HTML_TAG 6624 2.85 6.67 1.34 46 XMSubMetaSx_00 6480 4.73 6.53 4.03 47 XM_B_Phish_Phrases 6427 7.45 6.48 7.84 48 RCVD_IN_MSPIKE_H2 5609 7.47 5.65 8.18 49 MPART_ALT_DIFF 5547 4.26 5.59 3.74 50 RCVD_IN_RP_SAFE 5430 12.87 5.47 15.79 51 DKIM_ADSP_NXDOMAIN 5413 2.17 5.45 0.87 52 XMStrtUSub 5196 5.28 5.24 5.29 53 XM_DIRTYINTL 5178 3.66 5.22 3.05 54 RELAYCOUNTRY_FR 4909 1.63 4.95 0.32 55 T_REMOTE_IMAGE 4821 3.45 4.86 2.89 56 SpammyFromTLD_02 4569 1.43 4.60 0.17 57 BOTNET_NORDNS 4556 1.31 4.59 0.01 58 RCVD_IN_MSPIKE_BL 4514 2.32 4.55 1.44 59 MIME_HTML_MOSTLY 4448 3.80 4.48 3.53 60 FROM_SUSPICIOUS_NTLD 4280 1.24 4.31 0.02 61 RCVD_IN_RP_CERTIFIED 4223 11.22 4.25 13.97 62 MIME_HEADER_CTYPE_ONLY 4213 1.30 4.24 0.14 63 RCVD_IN_MSPIKE_L5 4062 1.62 4.09 0.65 64 ALL_TRUSTED 4011 12.42 4.04 15.73 65 XM_SendGrid 3953 6.21 3.98 7.08 66 RCVD_IN_MSPIKE_WL 3855 5.93 3.88 6.74 67 HTML_IMAGE_RATIO_06 3809 3.48 3.84 3.34 68 RELAYCOUNTRY_CA 3769 2.13 3.80 1.47 69 HTML_IMAGE_RATIO_08 3761 2.65 3.79 2.20 70 RELAYCOUNTRY_DE 3747 1.29 3.78 0.31 71 URI_HEX 3529 2.43 3.56 1.99 72 XM_SPF_SoftFail 3456 1.83 3.48 1.18 73 RCVD_IN_PSBL 3408 1.06 3.43 0.12 74 MIME_QP_LONG_LINE 3387 3.80 3.41 3.95 75 HDRS_LCASE_IMGONLY 3350 0.99 3.38 0.05 76 BAYES_95 3325 3.09 3.35 2.99 77 XMDiploma_00 3274 2.37 3.30 2.01 78 XM_CamelCaseFrm001 3267 2.15 3.29 1.70 79 TM2_M_URI_OPT_OUT 3230 2.09 3.25 1.63 80 BODY_URI_ONLY 3138 0.92 3.16 0.04 81 XM_ProductURIs 3123 2.16 3.15 1.77 82 XM_B_SpammyTLD 3120 4.15 3.14 4.54 83 FROM_SUSPICIOUS_NTLD_FP 3074 0.89 3.10 0.02 84 KHOP_HELO_FCRDNS 3067 1.75 3.09 1.23 85 HTML_SHORT_LINK_IMG_1 3056 0.89 3.08 0.03 86 RCVD_IN_MSPIKE_H3 3044 5.33 3.07 6.22 87 XMBdyGiftCard01 2984 2.62 3.01 2.47 88 TR_XM_PHPDW 2958 2.57 2.98 2.41 89 XM_OfRef6 2956 2.10 2.98 1.75 90 BAYES_40 2937 3.19 2.96 3.28 91 TR_XM_PHPForged 2911 2.40 2.93 2.20 92 TR_XM_FormFill2 2895 1.55 2.92 1.01 93 XM_H_PHPOS 2872 1.54 2.89 1.01 94 PDS_TO_EQ_FROM_NAME 2813 0.90 2.83 0.14 95 MIME_HTML_ONLY_MULTI 2803 1.94 2.82 1.59 96 MultiRelay_CC 2772 0.92 2.79 0.18 97 MultiRelay_Combo 2772 0.92 2.79 0.18 98 SpammyFromTLD_01 2675 1.37 2.70 0.85 99 T_TooManySym_01 2567 6.50 2.59 8.05 100 HK_SCAM 2548 0.74 2.57 0.02 101 SUBJ_ALL_CAPS 2512 1.94 2.53 1.70 102 HTML_IMAGE_ONLY_04 2443 0.72 2.46 0.03 103 RCVD_IN_BL_SPAMCOP_NET 2414 0.98 2.43 0.41 104 XMSexyCombo_01 2413 1.25 2.43 0.79 105 MISSING_HEADERS 2369 0.92 2.39 0.34 106 URIBL_DBL_ABUSE_REDIR 2354 0.71 2.37 0.06 107 XMNumbers 2342 2.81 2.36 2.99 108 BODY_EMPTY 2337 0.67 2.35 0.00 109 HTML_SHORT_CENTER 2330 0.67 2.35 0.01 110 NO_DNS_FOR_FROM 2317 1.67 2.33 1.41 111 XM_UB99 2291 0.69 2.31 0.05 112 US_DOLLARS_3 2282 2.15 2.30 2.09 113 BAYES_20 2246 2.42 2.26 2.48 114 XM_URI_RBL 2221 0.97 2.24 0.47 115 XM_B_Crypto 2219 0.67 2.24 0.05 116 XM_ShortIntro_01 2192 0.86 2.21 0.33 117 TRACKER_ID 2142 0.71 2.16 0.13 118 REPLYTO_WITHOUT_TO_CC 2134 0.68 2.15 0.10 119 RCVD_IN_RP_RNBL 2122 0.64 2.14 0.05 120 XMGenDplmaNmb 2070 1.51 2.09 1.29 121 TR_LOTS_OF_MONEY1 2020 0.59 2.04 0.02 122 PDS_BTC_NTLD 1971 0.56 1.99 0.00 123 XMDateMe_00 1969 0.72 1.98 0.22 124 T_XMDrugObfuBody_08 1967 1.42 1.98 1.20 125 XM_B_REG_HTML 1860 0.92 1.87 0.55 126 XM_UB999 1855 0.56 1.87 0.04 127 ADVANCE_FEE_3_NEW_MONEY 1841 0.53 1.85 0.01 128 XMSubMetaI_00 1831 0.89 1.84 0.51 129 Ebola_Prevention_Initiative_Frm02 1815 0.53 1.83 0.01 130 XMBody_17 1725 0.96 1.74 0.66 131 TR_Mismatch_TLD_02 1722 0.57 1.74 0.11 132 XM_H_PHPMailer 1678 1.86 1.69 1.93 133 XMStockSpam_06 1673 1.80 1.69 1.84 134 RCVD_IN_IADB_LISTED 1613 3.17 1.63 3.77 135 XM_UB60 1607 0.51 1.62 0.07 136 TR_XM_DK_SendGrid 1574 3.34 1.59 4.03 137 FILL_THIS_FORM 1564 0.96 1.58 0.71 138 RCVD_IN_IADB_SPF 1491 2.77 1.50 3.26 139 SUBJ_DOLLARS 1485 1.39 1.50 1.35 140 RELAYCOUNTRY_NL 1482 0.58 1.49 0.22 141 XM_H_Long_From02 1473 1.15 1.48 1.02 142 TM2_M_VERY_LONG_WORD 1442 1.43 1.45 1.41 143 T_HTML_TAG_BALANCE_CENTER 1441 0.56 1.45 0.20 144 XMPhish11 1439 1.13 1.45 1.00 145 T_XMHurry_00 1438 1.16 1.45 1.05 146 HTML_FONT_SIZE_LARGE 1435 0.48 1.45 0.10 147 BODY_ENHANCEMENT 1431 0.45 1.44 0.05 148 FILL_THIS_FORM_LONG 1419 0.87 1.43 0.65 149 RCVD_IN_IADB_SENDERID 1415 2.49 1.43 2.91 150 RCVD_IN_IADB_DK 1393 2.42 1.40 2.83 151 HTML_TAG_BALANCE_BODY 1346 0.81 1.36 0.60 152 XMBrknScrpt_02 1324 0.88 1.33 0.69 153 MAILING_LIST_MULTI 1311 1.64 1.32 1.77 154 URIBL_BLACK 1311 0.43 1.32 0.08 155 XM_H_PHPOS_M 1247 0.52 1.26 0.23 156 NO_FM_NAME_IP_HOSTN 1228 0.35 1.24 0.00 157 XMMoneyMeta_00 1221 0.51 1.23 0.23 158 T_Symld_Words_02 1214 0.81 1.22 0.65 159 SHORT_IMG_SUSP_NTLD 1187 0.34 1.20 0.00 160 RELAYCOUNTRY_PL 1187 0.35 1.20 0.02 161 HTML_IMAGE_ONLY_12 1176 0.46 1.18 0.17 162 XMPhish30 1176 0.72 1.18 0.54 163 FROM_NTLD_LINKBAIT 1170 0.33 1.18 0.00 164 DIET_1 1168 0.71 1.18 0.52 165 XMSubMetaSSx_00 1162 0.48 1.17 0.21 166 PLING_QUERY 1162 0.76 1.17 0.59 167 LOW_PRICE 1154 0.49 1.16 0.22 168 RELAYCOUNTRY_AT 1149 0.44 1.16 0.16 169 DATE_IN_PAST_03_06 1138 0.39 1.15 0.10 170 FILL_THIS_FORM_LOAN 1137 0.79 1.15 0.65 171 URI_TRY_3LD 1113 1.52 1.12 1.68 172 XM_UB80 1113 0.33 1.12 0.02 173 TR_Symld_Words 1100 1.51 1.11 1.67 174 TR_XM_RelayPhish 1091 0.98 1.10 0.93 175 SHORT_URI_3 1021 0.42 1.03 0.18 176 DKIM_ADSP_CUSTOM_MED 1015 1.68 1.02 1.94 177 XMSexyCombo_04 1011 0.35 1.02 0.09 178 RELAYCOUNTRY_UA 982 0.28 0.99 0.00 179 TM2_M_A_HREF_HREF 981 0.87 0.99 0.82 180 XMSubMetaSxObfu_03 972 0.68 0.98 0.56 181 XMSubMetaSx_01 961 0.43 0.97 0.22 182 XM_DK_Undo_01 958 1.43 0.97 1.61 183 XMHTMLBadTable_001 929 0.80 0.94 0.74 184 DATE_IN_PAST_06_12 913 0.31 0.92 0.07 185 TR_LOTS_OF_MONEY2 900 0.63 0.91 0.52 186 T_MONEY_PERCENT 900 0.63 0.91 0.52 187 NML_ADSP_CUSTOM_MED 895 1.43 0.90 1.64 188 XMBody_78 883 0.69 0.89 0.62 189 BAYES_00 866 8.35 0.87 11.31 190 UNPARSEABLE_RELAY 865 3.37 0.87 4.36 191 HK_RANDOM_FROM 852 0.33 0.86 0.11 192 TR_Caps_n_Bayes_99 849 0.41 0.86 0.24 193 T_TooManySym_02 835 2.59 0.84 3.28 194 T_XMDrugObfuBody_00 828 0.88 0.83 0.90 195 XM_HighProb1 824 0.25 0.83 0.02 196 FORGED_GMAIL_RCVD 821 1.16 0.83 1.29 197 XM_B_COPY_HTML 816 0.74 0.82 0.71 198 XMHTML_After_End 803 0.52 0.81 0.41 199 FROM_DOMAIN_NOVOWEL 802 0.27 0.81 0.06 200 TR_LOTS_OF_MONEY3 793 0.61 0.80 0.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 209589 85.11 89.51 83.37 2 DKIM_SIGNED 201418 80.20 80.41 80.12 3 XM_DK_Pass 197933 77.89 75.73 78.74 4 DKIM_VALID 189777 74.25 71.11 75.49 5 DKIM_VALID_AU 153875 60.51 58.75 61.21 6 XMListUnsubscribeExists 142711 61.60 73.85 56.77 7 BAYES_50 124865 45.15 33.71 49.67 8 DCC_CHECK 124810 56.77 74.81 49.65 9 DCC_CHECK_NEGATIVE 123404 41.92 23.76 49.09 10 HTML_FONT_LOW_CONTRAST 83427 33.47 34.19 33.19 11 DKIM_VALID_EF 74688 26.18 17.26 29.71 12 LOC_TINY_FONT_1 73507 29.97 31.81 29.24 13 XMSubLong 59325 22.62 20.14 23.60 14 T_TM2_M_HEADER_IN_MSG 57480 21.11 16.66 22.87 15 MIME_HTML_ONLY 55456 25.10 32.80 22.06 16 FVGT_m_MULTI_ODD 52550 22.48 26.46 20.90 17 XM_DK_Undo_02 49393 27.68 48.04 19.65 18 BAYES_99 44989 24.67 41.84 17.90 19 BAYES_999 40733 21.68 35.57 16.20 20 MultiRelay 40338 15.97 15.77 16.05 21 XM_Body_Dirty_Words 40038 18.19 23.93 15.93 22 RCVD_IN_RP_SAFE 39703 12.87 5.47 15.79 23 ALL_TRUSTED 39537 12.42 4.04 15.73 24 XM_Multi_Part_URI 37988 14.69 13.61 15.11 25 RCVD_IN_RP_CERTIFIED 35122 11.22 4.25 13.97 26 T_KAM_HTML_FONT_INVALID 34460 14.90 17.91 13.71 27 XM_DKIMWhitelistDomains 34076 9.74 0.07 13.56 28 HTML_IMAGE_RATIO_02 28706 12.33 14.65 11.42 29 BAYES_00 28424 8.35 0.87 11.31 30 XM_Evil_Numbers_Gen 27601 10.85 10.53 10.98 31 TR_XM_DK_Bayes 25405 7.31 0.23 10.11 32 FSL_BULK_SIG 25399 10.15 10.28 10.10 33 TO_MALFORMED 24697 7.07 0.10 9.82 34 TR_XM_DK_Bayes1 24492 7.03 0.16 9.74 35 TR_DCC_Bayes_99 24118 16.37 33.52 9.59 36 LOTS_OF_MONEY 23123 10.15 12.56 9.20 37 TR_XM_DK_Bayes2 22456 6.44 0.12 8.93 38 RCVD_IN_MSPIKE_H2 20572 7.47 5.65 8.18 39 T_TooManySym_01 20241 6.50 2.59 8.05 40 XM_B_Phish_Phrases 19698 7.45 6.48 7.84 41 T_XMDrugObfuBody_14 19224 7.46 6.99 7.65 42 HTML_IMAGE_RATIO_04 18576 7.59 8.10 7.39 43 LotsOfNums_01 18495 7.33 7.26 7.36 44 XM_SendGrid 17804 6.21 3.98 7.08 45 XM_H_Long_From01 17101 7.33 8.67 6.80 46 RCVD_IN_MSPIKE_WL 16955 5.93 3.88 6.74 47 BOTNET_IPINHOSTNAME 16744 9.68 17.32 6.66 48 RCVD_IN_MSPIKE_H3 15636 5.33 3.07 6.22 49 BAYES_60 15581 6.51 7.29 6.20 50 TooManyTo_001 15169 6.62 8.11 6.03 51 XM_UncommonTLD01 14895 8.13 13.71 5.93 52 FROM_EXCESS_BASE64 14160 6.24 7.79 5.63 53 XMStrtUSub 13309 5.28 5.24 5.29 54 XMSexyCombo_05 12141 6.42 10.45 4.83 55 DKIM_INVALID 11641 5.95 9.30 4.63 56 XM_B_SpammyTLD 11415 4.15 3.14 4.54 57 UNPARSEABLE_RELAY 10950 3.37 0.87 4.36 58 RELAYCOUNTRY_META 10783 9.29 21.97 4.29 59 INVALID_MSGID 10770 3.13 0.20 4.28 60 BAYES_80 10482 4.94 6.88 4.17 61 TR_XM_DK_SendGrid 10130 3.34 1.59 4.03 62 XMSubMetaSx_00 10121 4.73 6.53 4.03 63 MIME_QP_LONG_LINE 9925 3.80 3.41 3.95 64 TVD_RCVD_IP 9811 2.92 0.42 3.90 65 RCVD_IN_IADB_LISTED 9485 3.17 1.63 3.77 66 MPART_ALT_DIFF 9405 4.26 5.59 3.74 67 IN_ZIMBRA_NJ_WHITELIST 8996 2.57 0.02 3.58 68 MIME_HTML_MOSTLY 8872 3.80 4.48 3.53 69 HTML_IMAGE_RATIO_06 8408 3.48 3.84 3.34 70 BAYES_40 8256 3.19 2.96 3.28 71 T_TooManySym_02 8241 2.59 0.84 3.28 72 RCVD_IN_IADB_SPF 8205 2.77 1.50 3.26 73 XM_DIRTYINTL 7662 3.66 5.22 3.05 74 XMNumbers 7510 2.81 2.36 2.99 75 BAYES_95 7504 3.09 3.35 2.99 76 RCVD_IN_IADB_SENDERID 7309 2.49 1.43 2.91 77 T_REMOTE_IMAGE 7267 3.45 4.86 2.89 78 RCVD_IN_IADB_DK 7109 2.42 1.40 2.83 79 BAYES_20 6245 2.42 2.26 2.48 80 XMBdyGiftCard01 6207 2.62 3.01 2.47 81 TR_XM_PHPDW 6069 2.57 2.98 2.41 82 TR_MetaPhish_Combo_01 6047 1.87 0.53 2.41 83 RCVD_IN_IADB_VOUCHED 5954 1.87 0.61 2.37 84 HTML_IMAGE_RATIO_08 5527 2.65 3.79 2.20 85 TR_XM_PHPForged 5519 2.40 2.93 2.20 86 BOTNET 5279 7.46 21.03 2.10 87 US_DOLLARS_3 5262 2.15 2.30 2.09 88 XMDiploma_00 5048 2.37 3.30 2.01 89 IN_HORDE_ADDRESS_BOOK 5007 1.45 0.06 1.99 90 URI_HEX 5005 2.43 3.56 1.99 91 USER_IN_DEF_DKIM_WL 4979 1.42 0.01 1.98 92 DKIM_ADSP_CUSTOM_MED 4881 1.68 1.02 1.94 93 XM_H_PHPMailer 4858 1.86 1.69 1.93 94 XMStockSpam_06 4624 1.80 1.69 1.84 95 XM_ProductURIs 4454 2.16 3.15 1.77 96 MAILING_LIST_MULTI 4453 1.64 1.32 1.77 97 XM_OfRef6 4396 2.10 2.98 1.75 98 BAYES_05 4312 1.42 0.66 1.72 99 SUBJ_ALL_CAPS 4281 1.94 2.53 1.70 100 XM_CamelCaseFrm001 4270 2.15 3.29 1.70 101 XM_PDF 4255 1.28 0.25 1.69 102 URI_TRY_3LD 4220 1.52 1.12 1.68 103 TR_Symld_Words 4189 1.51 1.11 1.67 104 NML_ADSP_CUSTOM_MED 4133 1.43 0.90 1.64 105 TM2_M_URI_OPT_OUT 4099 2.09 3.25 1.63 106 XM_DK_Undo_01 4056 1.43 0.97 1.61 107 MIME_HTML_ONLY_MULTI 4008 1.94 2.82 1.59 108 RCVD_IN_IADB_OPTIN 3808 1.21 0.45 1.51 109 RELAYCOUNTRY_CA 3689 2.13 3.80 1.47 110 UNTRUSTED_Relay 3649 5.87 17.04 1.45 111 RCVD_IN_MSPIKE_BL 3612 2.32 4.55 1.44 112 TM2_M_VERY_LONG_WORD 3556 1.43 1.45 1.41 113 NO_DNS_FOR_FROM 3543 1.67 2.33 1.41 114 SUBJ_DOLLARS 3402 1.39 1.50 1.35 115 XM_GoogleGroups 3384 1.08 0.42 1.35 116 HTML_MIME_NO_HTML_TAG 3375 2.85 6.67 1.34 117 FORGED_GMAIL_RCVD 3255 1.16 0.83 1.29 118 TooManyTo_002 3251 1.07 0.49 1.29 119 XMGenDplmaNmb 3240 1.51 2.09 1.29 120 KHOP_HELO_FCRDNS 3080 1.75 3.09 1.23 121 XM_RXBody 3038 1.05 0.65 1.21 122 ANY_BOUNCE_MESSAGE 3017 0.92 0.22 1.20 123 BOUNCE_MESSAGE 3016 0.92 0.22 1.20 124 T_XMDrugObfuBody_08 3011 1.42 1.98 1.20 125 XM_SPF_SoftFail 2956 1.83 3.48 1.18 126 T_XMHurry_00 2631 1.16 1.45 1.05 127 XMBody_95 2577 0.76 0.09 1.03 128 XM_H_Long_From02 2556 1.15 1.48 1.02 129 T_FILL_THIS_FORM_SHORT 2541 0.87 0.52 1.01 130 TR_XM_FormFill2 2533 1.55 2.92 1.01 131 XM_H_PHPOS 2528 1.54 2.89 1.01 132 XMPhish11 2506 1.13 1.45 1.00 133 TR_XM_RelayPhish 2329 0.98 1.10 0.93 134 TooManyTo_003 2318 0.78 0.42 0.92 135 T_XMDrugObfuBody_00 2263 0.88 0.83 0.90 136 DKIM_ADSP_NXDOMAIN 2197 2.17 5.45 0.87 137 SpammyFromTLD_01 2145 1.37 2.70 0.85 138 USER_IN_WHITELIST 2090 0.60 0.00 0.83 139 TM2_M_A_HREF_HREF 2072 0.87 0.99 0.82 140 XMSubMetaSxObfu_02 1989 0.68 0.41 0.79 141 XMSexyCombo_01 1977 1.25 2.43 0.79 142 TooManyTo_004 1962 0.66 0.36 0.78 143 HTML_FONT_FACE_BAD 1911 0.71 0.59 0.76 144 XMHTMLBadTable_001 1866 0.80 0.94 0.74 145 XM_UB50 1804 3.00 8.77 0.72 146 FILL_THIS_FORM 1793 0.96 1.58 0.71 147 XM_B_COPY_HTML 1773 0.74 0.82 0.71 148 XMBrknScrpt_02 1747 0.88 1.33 0.69 149 TooManyTo_005 1711 0.58 0.32 0.68 150 XMBody_17 1650 0.96 1.74 0.66 151 FILL_THIS_FORM_LOAN 1627 0.79 1.15 0.65 152 T_Symld_Words_02 1627 0.81 1.22 0.65 153 RCVD_IN_MSPIKE_L5 1623 1.62 4.09 0.65 154 FILL_THIS_FORM_LONG 1622 0.87 1.43 0.65 155 T_TooManySym_03 1619 0.49 0.10 0.64 156 XMBody_78 1553 0.69 0.89 0.62 157 HTML_TAG_BALANCE_BODY 1505 0.81 1.36 0.60 158 PLING_QUERY 1494 0.76 1.17 0.59 159 RDNS_DYNAMIC 1473 0.63 0.73 0.59 160 HELO_NODOT 1470 0.51 0.33 0.58 161 XMSubMetaSxObfu_03 1418 0.68 0.98 0.56 162 HELO_NO_DOMAIN 1377 0.49 0.33 0.55 163 XM_B_REG_HTML 1376 0.92 1.87 0.55 164 XMPhish30 1365 0.72 1.18 0.54 165 XMBSHREFv2 1356 0.57 0.65 0.54 166 TR_LOTS_OF_MONEY3 1351 0.61 0.80 0.54 167 XMLngstWrd_00 1336 0.49 0.37 0.53 168 TR_LOTS_OF_MONEY2 1319 0.63 0.91 0.52 169 T_MONEY_PERCENT 1319 0.63 0.91 0.52 170 DIET_1 1307 0.71 1.18 0.52 171 XMSubMetaI_00 1291 0.89 1.84 0.51 172 XMCapTrack 1282 0.42 0.20 0.51 173 XMGappySubj_01 1261 0.39 0.12 0.50 174 XMLngstWrd_01 1230 0.45 0.34 0.49 175 RELAYCOUNTRY_GB 1199 0.54 0.70 0.48 176 XM_URI_RBL 1191 0.97 2.24 0.47 177 XM_Body_Obfu01 1183 0.40 0.21 0.47 178 HTTPS_HTTP_MISMATCH 1122 0.43 0.40 0.45 179 ACT_NOW_CAPS 1096 0.36 0.16 0.44 180 XMHTML_After_End 1027 0.52 0.81 0.41 181 RCVD_IN_BL_SPAMCOP_NET 1026 0.98 2.43 0.41 182 RCVD_IN_MSPIKE_L4 1025 0.35 0.19 0.41 183 XMNoVowels 1020 0.41 0.43 0.41 184 RCVD_IN_MSPIKE_H5 1019 0.33 0.16 0.41 185 XM_D_tchamptons_WL 976 0.28 0.00 0.39 186 RCVD_IN_MSPIKE_L3 964 0.35 0.27 0.38 187 URI_NOVOWEL 935 0.49 0.79 0.37 188 T_TooManySym_04 906 0.26 0.02 0.36 189 XM_Walgreens_Forge 896 0.38 0.45 0.36 190 TM2_M_BODY_EMPTY 880 0.28 0.10 0.35 191 XM_Akamai 871 0.25 0.01 0.35 192 MISSING_HEADERS 861 0.92 2.39 0.34 193 NUMERIC_HTTP_ADDR 855 0.34 0.35 0.34 194 RELAYCOUNTRY_AU 827 0.32 0.31 0.33 195 XM_ShortIntro_01 824 0.86 2.21 0.33 196 RELAYCOUNTRY_FR 806 1.63 4.95 0.32 197 XM_OfRef7 799 0.45 0.78 0.32 198 XMSlimDrugH 796 0.39 0.58 0.32 199 RELAYCOUNTRY_DE 789 1.29 3.78 0.31 200 XMLngstWrd_02 774 0.30 0.28 0.31 ----------------------------------------------------------------------