Email: 625599 Autolearn: 0 AvgScore: 3.03 AvgScanTime: 2.15 sec Spam: 157603 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 2.62 sec Ham: 467996 Autolearn: 0 AvgScore: -0.18 AvgScanTime: 1.99 sec Time Spent Running SA: 373.40 hours Time Spent Processing Spam: 114.58 hours Time Spent Processing Ham: 258.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150259 89.37 95.34 87.36 2 DKIM_SIGNED 125961 76.61 79.92 75.49 3 DCC_CHECK 124974 50.85 79.30 41.27 4 XM_DK_Pass 121559 74.84 77.13 74.07 5 XM_B_Unicode 118364 70.34 75.10 68.73 6 DKIM_VALID 118212 72.41 75.01 71.54 7 XMListUnsubscribeExists 113987 56.05 72.33 50.58 8 DKIM_VALID_AU 89883 54.13 57.03 53.15 9 XM_DK_Undo_02 75337 22.40 47.80 13.85 10 BAYES_99 67307 19.12 42.71 11.18 11 HTML_FONT_LOW_CONTRAST 56501 30.14 35.85 28.22 12 BAYES_999 55087 16.15 34.95 9.82 13 TR_DCC_Bayes_99 54265 12.86 34.43 5.60 14 BAYES_50 53401 48.99 33.88 54.08 15 MIME_HTML_ONLY 52619 23.46 33.39 20.12 16 LOC_TINY_FONT_1 51005 25.28 32.36 22.89 17 FVGT_m_MULTI_ODD 42451 23.14 26.94 21.86 18 XMSubLong 39727 23.26 25.21 22.60 19 DKIM_VALID_EF 35458 26.53 22.50 27.89 20 T_KAM_HTML_FONT_INVALID 34517 18.57 21.90 17.45 21 XM_Body_Dirty_Words 33950 15.38 21.54 13.31 22 RELAYCOUNTRY_META 32464 9.27 20.60 5.45 23 DCC_CHECK_NEGATIVE 29578 47.16 18.77 56.72 24 T_TM2_M_HEADER_IN_MSG 29278 27.67 18.58 30.73 25 MultiRelay 26844 19.47 17.03 20.29 26 XM_Multi_Part_URI 26545 13.29 16.84 12.09 27 BOTNET 25995 5.91 16.49 2.35 28 BOTNET_IPINHOSTNAME 24348 7.51 15.45 4.83 29 UNTRUSTED_Relay 23426 4.89 14.86 1.53 30 FSL_BULK_SIG 21109 9.42 13.39 8.08 31 HTML_IMAGE_RATIO_02 20589 8.90 13.06 7.50 32 RCVD_IN_MSPIKE_H2 20011 13.26 12.70 13.45 33 XM_Evil_Numbers_Gen 18917 9.86 12.00 9.13 34 LOTS_OF_MONEY 18289 9.80 11.60 9.20 35 XM_UncommonTLD01 18014 6.05 11.43 4.24 36 XMSexyCombo_05 16987 5.60 10.78 3.86 37 T_XMDrugObfuBody_14 15222 8.80 9.66 8.51 38 LotsOfNums_01 14388 8.00 9.13 7.62 39 XM_B_Phish_Phrases 12847 7.07 8.15 6.70 40 HTML_IMAGE_RATIO_04 12824 6.34 8.14 5.73 41 BAYES_80 12670 5.02 8.04 4.00 42 XMSubMetaSx_00 11628 4.70 7.38 3.80 43 XM_H_Long_From01 11623 6.64 7.37 6.39 44 TooManyTo_001 11031 8.07 7.00 8.43 45 XM_UB50 10189 2.32 6.46 0.93 46 BAYES_60 9999 6.47 6.34 6.52 47 MPART_ALT_DIFF 9489 3.93 6.02 3.22 48 MIME_QP_LONG_LINE 9237 5.67 5.86 5.61 49 XM_DIRTYINTL 7917 3.61 5.02 3.14 50 BAYES_95 7763 3.17 4.93 2.58 51 DKIM_INVALID 7749 4.19 4.92 3.95 52 XMNumbers 7619 3.20 4.83 2.65 53 XM_SPF_SoftFail 7613 2.70 4.83 1.99 54 RCVD_IN_PSBL 6882 1.13 4.37 0.04 55 HTML_IMAGE_RATIO_06 6689 3.62 4.24 3.41 56 MultiRelay_Combo 6653 1.27 4.22 0.28 57 MultiRelay_CC 6653 1.27 4.22 0.28 58 HTML_MIME_NO_HTML_TAG 6572 3.04 4.17 2.66 59 T_REMOTE_IMAGE 6303 4.11 4.00 4.15 60 SpammyFromTLD_02 6289 1.27 3.99 0.35 61 FROM_EXCESS_BASE64 6235 3.83 3.96 3.78 62 MIME_HTML_ONLY_MULTI 6154 2.21 3.90 1.65 63 HTML_IMAGE_RATIO_08 6128 2.73 3.89 2.34 64 BOTNET_NORDNS 5958 1.00 3.78 0.06 65 XM_SendGrid 5703 5.99 3.62 6.79 66 MIME_HTML_MOSTLY 5606 2.53 3.56 2.18 67 XM_B_SpammyTLD 5530 3.45 3.51 3.42 68 RELAYCOUNTRY_CA 5526 2.01 3.51 1.51 69 RCVD_IN_BL_SPAMCOP_NET 5473 1.82 3.47 1.26 70 XM_OfRef6 5371 2.38 3.41 2.03 71 XM_CamelCaseFrm001 5371 2.32 3.41 1.95 72 XM_URI_RBL 5352 1.09 3.40 0.31 73 TM2_M_URI_OPT_OUT 5047 2.07 3.20 1.69 74 DKIM_ADSP_NXDOMAIN 4988 1.35 3.16 0.74 75 URI_HEX 4925 2.00 3.12 1.62 76 TR_XM_PHPDW 4876 1.42 3.09 0.86 77 XMStrtUSub 4855 4.08 3.08 4.42 78 TR_XM_PHPForged 4855 1.40 3.08 0.84 79 TR_XM_FormFill2 4818 1.38 3.06 0.82 80 XM_H_PHPOS 4794 1.38 3.04 0.82 81 SpammyFromTLD_01 4763 1.45 3.02 0.92 82 XM_UB99 4750 0.77 3.01 0.02 83 RCVD_IN_IADB_LISTED 4670 4.62 2.96 5.17 84 NO_DNS_FOR_FROM 4583 1.47 2.91 0.99 85 RCVD_IN_RP_SAFE 4581 8.87 2.91 10.88 86 RELAYCOUNTRY_FR 4505 0.93 2.86 0.29 87 XMPhish11 4479 1.79 2.84 1.44 88 RCVD_IN_IADB_SPF 4258 4.06 2.70 4.52 89 US_DOLLARS_3 4203 1.71 2.67 1.39 90 NUMERIC_HTTP_ADDR 4107 0.89 2.61 0.31 91 FROM_SUSPICIOUS_NTLD 4099 0.68 2.60 0.03 92 RCVD_IN_IADB_DK 4063 3.55 2.58 3.87 93 RCVD_IN_IADB_SENDERID 4039 3.60 2.56 3.95 94 T_XMDrugObfuBody_08 4011 1.75 2.55 1.48 95 FROM_SUSPICIOUS_NTLD_FP 4008 0.66 2.54 0.03 96 T_TooManySym_01 3982 4.71 2.53 5.44 97 XMBdyGiftCard01 3934 1.76 2.50 1.51 98 XMSexyCombo_01 3910 1.09 2.48 0.62 99 XMDiploma_00 3779 2.04 2.40 1.92 100 MIME_HEADER_CTYPE_ONLY 3724 0.69 2.36 0.13 101 RCVD_IN_RP_CERTIFIED 3720 7.90 2.36 9.77 102 XM_ProductURIs 3699 1.21 2.35 0.83 103 TM2_M_VERY_LONG_WORD 3697 1.57 2.35 1.31 104 RCVD_IN_MSPIKE_BL 3694 1.92 2.34 1.78 105 NORMAL_HTTP_TO_IP 3667 0.62 2.33 0.04 106 TR_XM_RelayPhish 3593 1.24 2.28 0.89 107 RELAYCOUNTRY_RO 3290 0.53 2.09 0.01 108 SUBJ_ALL_CAPS 3203 1.73 2.03 1.63 109 XM_UB999 3094 0.51 1.96 0.02 110 KHOP_HELO_FCRDNS 3000 2.12 1.90 2.19 111 ALL_TRUSTED 2988 12.10 1.90 15.54 112 T_FILL_THIS_FORM_SHORT 2980 1.31 1.89 1.11 113 TR_Mismatch_TLD_02 2953 0.52 1.87 0.06 114 XM_H_Long_From02 2902 1.24 1.84 1.04 115 UNPARSEABLE_RELAY 2870 2.39 1.82 2.58 116 TR_LOTS_OF_MONEY3 2855 0.78 1.81 0.43 117 XM_UB60 2815 0.54 1.79 0.13 118 HDRS_LCASE_IMGONLY 2814 0.49 1.79 0.05 119 RELAYCOUNTRY_IN 2742 0.54 1.74 0.14 120 RCVD_IN_RP_RNBL 2740 0.46 1.74 0.03 121 XM_UB80 2738 0.47 1.74 0.04 122 DATE_IN_PAST_03_06 2735 0.53 1.74 0.12 123 T_XMDrugObfuBody_00 2723 1.02 1.73 0.78 124 TR_Symld_Words 2723 1.74 1.73 1.74 125 TR_XM_DK_SendGrid 2712 3.25 1.72 3.77 126 XMMoneyMeta_00 2667 0.91 1.69 0.65 127 XMSubMetaI_00 2663 0.75 1.69 0.43 128 XMBody_78 2614 0.91 1.66 0.65 129 URI_TRY_3LD 2593 1.29 1.65 1.17 130 RCVD_IN_MSPIKE_WL 2588 4.48 1.64 5.44 131 RELAYCOUNTRY_DE 2581 0.80 1.64 0.52 132 XMGenDplmaNmb 2546 1.33 1.62 1.24 133 HTML_OFF_PAGE 2528 0.41 1.60 0.01 134 T_HTML_TAG_BALANCE_CENTER 2456 0.50 1.56 0.14 135 RCVD_IN_MSPIKE_H3 2418 4.01 1.53 4.84 136 XMBody_17 2405 0.86 1.53 0.64 137 XM_H_PHPMailer 2380 0.89 1.51 0.68 138 XMHTML_After_End 2245 0.64 1.42 0.38 139 BAYES_40 2206 3.37 1.40 4.03 140 DIET_1 2187 0.63 1.39 0.38 141 MAILING_LIST_MULTI 2173 2.12 1.38 2.37 142 DATE_IN_PAST_06_12 2164 0.37 1.37 0.03 143 XM_DK_Undo_01 2164 1.59 1.37 1.66 144 RCVD_IN_MSPIKE_L5 2155 0.95 1.37 0.81 145 XMStockSpam_06 2128 1.37 1.35 1.37 146 BAYES_20 2000 2.64 1.27 3.10 147 XMPhish30 1998 0.73 1.27 0.55 148 XMLngstWrd_00 1910 0.73 1.21 0.57 149 DKIM_ADSP_CUSTOM_MED 1909 1.06 1.21 1.01 150 T_XMHurry_00 1906 0.78 1.21 0.64 151 NORDNS_LOW_CONTRAST 1899 0.31 1.20 0.01 152 XMNoVowels 1874 0.66 1.19 0.49 153 XM_H_PHPOS_M 1867 0.45 1.18 0.21 154 XMSexyCombo_04 1852 0.36 1.18 0.08 155 XMLngstWrd_01 1850 0.69 1.17 0.53 156 RCVD_IN_IADB_VOUCHED 1815 2.82 1.15 3.38 157 XM_UB95 1807 0.30 1.15 0.02 158 XMLngstWrd_02 1766 0.47 1.12 0.25 159 XM_HighProb1 1765 0.29 1.12 0.01 160 XMBrknScrpt_02 1714 0.89 1.09 0.83 161 RELAYCOUNTRY_GB 1708 1.18 1.08 1.21 162 TR_LOTS_OF_MONEY2 1706 0.93 1.08 0.87 163 T_MONEY_PERCENT 1706 0.93 1.08 0.87 164 XMLngstWrd_03 1691 0.39 1.07 0.16 165 URIBL_BLACK 1687 0.31 1.07 0.06 166 HTML_FONT_FACE_BAD 1687 0.82 1.07 0.73 167 HTML_IMAGE_ONLY_20 1683 0.50 1.07 0.31 168 XMSubMetaSSx_00 1632 0.37 1.04 0.14 169 FORGED_GMAIL_RCVD 1627 0.60 1.03 0.45 170 XMLngstWrd_04 1618 0.35 1.03 0.12 171 HTML_TITLE_SUBJ_DIFF 1603 0.29 1.02 0.05 172 NML_ADSP_CUSTOM_MED 1583 0.81 1.00 0.75 173 HTML_IMAGE_ONLY_08 1578 0.35 1.00 0.13 174 XM_B_REG_HTML 1576 0.53 1.00 0.37 175 HTML_IMAGE_ONLY_24 1542 0.53 0.98 0.38 176 HTML_SHORT_LINK_IMG_1 1526 0.26 0.97 0.02 177 THIS_AD 1518 0.33 0.96 0.12 178 RDNS_DYNAMIC 1499 0.55 0.95 0.42 179 HTML_SHORT_LINK_IMG_3 1497 0.30 0.95 0.08 180 XMHTMLBadTable_001 1495 0.60 0.95 0.48 181 LongTLD 1486 0.37 0.94 0.18 182 XMSubNoVowel 1470 0.56 0.93 0.43 183 RELAYCOUNTRY_AT 1468 0.38 0.93 0.20 184 BODY_ENHANCEMENT 1417 0.25 0.90 0.03 185 HTML_TAG_BALANCE_BODY 1405 0.66 0.89 0.59 186 XM_OneSimpleTrick 1350 0.22 0.86 0.00 187 XMSubMetaSx_01 1300 0.26 0.82 0.07 188 BODY_QUOTE_MALF_MSGID 1294 0.62 0.82 0.56 189 T_Symld_Words_02 1284 0.75 0.81 0.72 190 LOW_PRICE 1269 0.58 0.81 0.51 191 XMSubGiftCard1 1227 0.54 0.78 0.46 192 HTML_IMAGE_ONLY_12 1188 0.37 0.75 0.24 193 XMSexyCombo_02 1181 0.21 0.75 0.03 194 XM_BadFromFormat 1177 0.25 0.75 0.09 195 URI_NOVOWEL 1168 0.52 0.74 0.45 196 TooManyTo_002 1162 1.82 0.74 2.19 197 HTML_IMAGE_ONLY_32 1161 0.52 0.74 0.45 198 XMCmmnCold 1150 0.21 0.73 0.04 199 HTTPS_HTTP_MISMATCH 1150 0.60 0.73 0.56 200 HK_RANDOM_REPLYTO 1130 0.35 0.72 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 408820 89.37 95.34 87.36 2 DKIM_SIGNED 353291 76.61 79.92 75.49 3 XM_DK_Pass 346640 74.84 77.13 74.07 4 DKIM_VALID 334813 72.41 75.01 71.54 5 XM_B_Unicode 321658 70.34 75.10 68.73 6 DCC_CHECK_NEGATIVE 265465 47.16 18.77 56.72 7 BAYES_50 253081 48.99 33.88 54.08 8 DKIM_VALID_AU 248761 54.13 57.03 53.15 9 XMListUnsubscribeExists 236691 56.05 72.33 50.58 10 DCC_CHECK 193153 50.85 79.30 41.27 11 T_TM2_M_HEADER_IN_MSG 143834 27.67 18.58 30.73 12 HTML_FONT_LOW_CONTRAST 132082 30.14 35.85 28.22 13 DKIM_VALID_EF 130506 26.53 22.50 27.89 14 LOC_TINY_FONT_1 107132 25.28 32.36 22.89 15 XMSubLong 105779 23.26 25.21 22.60 16 FVGT_m_MULTI_ODD 102319 23.14 26.94 21.86 17 MultiRelay 94972 19.47 17.03 20.29 18 MIME_HTML_ONLY 94177 23.46 33.39 20.12 19 T_KAM_HTML_FONT_INVALID 81688 18.57 21.90 17.45 20 ALL_TRUSTED 72723 12.10 1.90 15.54 21 XM_DK_Undo_02 64795 22.40 47.80 13.85 22 RCVD_IN_MSPIKE_H2 62958 13.26 12.70 13.45 23 XM_Body_Dirty_Words 62269 15.38 21.54 13.31 24 BAYES_00 57371 9.31 0.57 12.26 25 XM_Multi_Part_URI 56594 13.29 16.84 12.09 26 BAYES_99 52329 19.12 42.71 11.18 27 RCVD_IN_RP_SAFE 50895 8.87 2.91 10.88 28 BAYES_999 45975 16.15 34.95 9.82 29 TR_XM_DK_Bayes 45947 7.42 0.29 9.82 30 RCVD_IN_RP_CERTIFIED 45723 7.90 2.36 9.77 31 TR_XM_DK_Bayes1 44578 7.19 0.27 9.53 32 LOTS_OF_MONEY 43037 9.80 11.60 9.20 33 XM_Evil_Numbers_Gen 42750 9.86 12.00 9.13 34 T_XMDrugObfuBody_14 39844 8.80 9.66 8.51 35 TooManyTo_001 39441 8.07 7.00 8.43 36 TR_XM_DK_Bayes2 38588 6.23 0.23 8.25 37 FSL_BULK_SIG 37816 9.42 13.39 8.08 38 XM_DKIMWhitelistDomains 37061 5.94 0.08 7.92 39 LotsOfNums_01 35663 8.00 9.13 7.62 40 HTML_IMAGE_RATIO_02 35080 8.90 13.06 7.50 41 XM_SendGrid 31784 5.99 3.62 6.79 42 XM_B_Phish_Phrases 31374 7.07 8.15 6.70 43 BAYES_60 30500 6.47 6.34 6.52 44 XM_H_Long_From01 29913 6.64 7.37 6.39 45 HTML_IMAGE_RATIO_04 26835 6.34 8.14 5.73 46 MIME_QP_LONG_LINE 26233 5.67 5.86 5.61 47 TR_DCC_Bayes_99 26216 12.86 34.43 5.60 48 RELAYCOUNTRY_META 25511 9.27 20.60 5.45 49 T_TooManySym_01 25457 4.71 2.53 5.44 50 RCVD_IN_MSPIKE_WL 25449 4.48 1.64 5.44 51 RCVD_IN_IADB_LISTED 24216 4.62 2.96 5.17 52 TO_MALFORMED 24182 3.93 0.26 5.17 53 XM_PDF 23961 3.98 0.59 5.12 54 RCVD_IN_MSPIKE_H3 22669 4.01 1.53 4.84 55 BOTNET_IPINHOSTNAME 22624 7.51 15.45 4.83 56 RCVD_IN_IADB_SPF 21134 4.06 2.70 4.52 57 XMStrtUSub 20681 4.08 3.08 4.42 58 XM_UncommonTLD01 19866 6.05 11.43 4.24 59 T_REMOTE_IMAGE 19411 4.11 4.00 4.15 60 IN_ZIMBRA_NJ_WHITELIST 19313 3.09 0.02 4.13 61 BAYES_40 18875 3.37 1.40 4.03 62 BAYES_80 18727 5.02 8.04 4.00 63 RCVD_IN_IADB_SENDERID 18506 3.60 2.56 3.95 64 DKIM_INVALID 18478 4.19 4.92 3.95 65 RCVD_IN_IADB_DK 18130 3.55 2.58 3.87 66 XMSexyCombo_05 18057 5.60 10.78 3.86 67 XMSubMetaSx_00 17766 4.70 7.38 3.80 68 FROM_EXCESS_BASE64 17702 3.83 3.96 3.78 69 TR_XM_DK_SendGrid 17626 3.25 1.72 3.77 70 XM_B_SpammyTLD 16027 3.45 3.51 3.42 71 HTML_IMAGE_RATIO_06 15941 3.62 4.24 3.41 72 RCVD_IN_IADB_VOUCHED 15825 2.82 1.15 3.38 73 MPART_ALT_DIFF 15072 3.93 6.02 3.22 74 XM_DIRTYINTL 14672 3.61 5.02 3.14 75 BAYES_20 14527 2.64 1.27 3.10 76 HTML_MIME_NO_HTML_TAG 12432 3.04 4.17 2.66 77 XMNumbers 12421 3.20 4.83 2.65 78 UNPARSEABLE_RELAY 12096 2.39 1.82 2.58 79 BAYES_95 12092 3.17 4.93 2.58 80 MAILING_LIST_MULTI 11089 2.12 1.38 2.37 81 BOTNET 10991 5.91 16.49 2.35 82 HTML_IMAGE_RATIO_08 10969 2.73 3.89 2.34 83 INVALID_MSGID 10957 1.78 0.13 2.34 84 TVD_RCVD_IP 10639 1.79 0.37 2.27 85 KHOP_HELO_FCRDNS 10246 2.12 1.90 2.19 86 TooManyTo_002 10240 1.82 0.74 2.19 87 MIME_HTML_MOSTLY 10210 2.53 3.56 2.18 88 RCVD_IN_IADB_OPTIN 10101 1.78 0.65 2.16 89 XM_OfRef6 9515 2.38 3.41 2.03 90 XM_SPF_SoftFail 9300 2.70 4.83 1.99 91 T_TooManySym_02 9294 1.65 0.66 1.99 92 XM_CamelCaseFrm001 9122 2.32 3.41 1.95 93 BAYES_05 9087 1.62 0.67 1.94 94 XMDiploma_00 8985 2.04 2.40 1.92 95 HELO_NODOT 8879 1.56 0.55 1.90 96 HELO_NO_DOMAIN 8878 1.56 0.55 1.90 97 TR_MetaPhish_Combo_01 8692 1.55 0.63 1.86 98 ANY_BOUNCE_MESSAGE 8587 1.49 0.47 1.83 99 BOUNCE_MESSAGE 8585 1.49 0.47 1.83 100 RCVD_IN_MSPIKE_BL 8320 1.92 2.34 1.78 101 TR_Symld_Words 8134 1.74 1.73 1.74 102 TM2_M_URI_OPT_OUT 7918 2.07 3.20 1.69 103 IN_HORDE_ADDRESS_BOOK 7862 1.26 0.03 1.68 104 XM_DK_Undo_01 7786 1.59 1.37 1.66 105 MIME_HTML_ONLY_MULTI 7703 2.21 3.90 1.65 106 SUBJ_ALL_CAPS 7613 1.73 2.03 1.63 107 URI_HEX 7592 2.00 3.12 1.62 108 XMCapTrack 7232 1.23 0.30 1.55 109 UNTRUSTED_Relay 7147 4.89 14.86 1.53 110 RELAYCOUNTRY_CA 7062 2.01 3.51 1.51 111 XMBdyGiftCard01 7054 1.76 2.50 1.51 112 T_XMDrugObfuBody_08 6942 1.75 2.55 1.48 113 TooManyTo_003 6855 1.25 0.60 1.46 114 XMPhish11 6747 1.79 2.84 1.44 115 USER_IN_DEF_DKIM_WL 6564 1.05 0.02 1.40 116 US_DOLLARS_3 6521 1.71 2.67 1.39 117 XMStockSpam_06 6412 1.37 1.35 1.37 118 TM2_M_VERY_LONG_WORD 6110 1.57 2.35 1.31 119 RCVD_IN_BL_SPAMCOP_NET 5884 1.82 3.47 1.26 120 XMGenDplmaNmb 5785 1.33 1.62 1.24 121 RELAYCOUNTRY_GB 5650 1.18 1.08 1.21 122 URI_TRY_3LD 5477 1.29 1.65 1.17 123 XM_GoogleGroups 5354 0.99 0.53 1.14 124 T_FILL_THIS_FORM_SHORT 5186 1.31 1.89 1.11 125 TooManyTo_004 5044 0.94 0.51 1.08 126 XM_H_Long_From02 4865 1.24 1.84 1.04 127 DKIM_ADSP_CUSTOM_MED 4720 1.06 1.21 1.01 128 NO_DNS_FOR_FROM 4610 1.47 2.91 0.99 129 XM_UB50 4352 2.32 6.46 0.93 130 SpammyFromTLD_01 4297 1.45 3.02 0.92 131 TooManyTo_005 4179 0.78 0.44 0.89 132 TR_XM_RelayPhish 4153 1.24 2.28 0.89 133 T_MONEY_PERCENT 4086 0.93 1.08 0.87 134 TR_LOTS_OF_MONEY2 4086 0.93 1.08 0.87 135 TR_XM_PHPDW 4022 1.42 3.09 0.86 136 TR_XM_PHPForged 3930 1.40 3.08 0.84 137 XMBrknScrpt_02 3885 0.89 1.09 0.83 138 XM_ProductURIs 3877 1.21 2.35 0.83 139 TR_XM_FormFill2 3841 1.38 3.06 0.82 140 XM_H_PHPOS 3828 1.38 3.04 0.82 141 RCVD_IN_MSPIKE_L5 3808 0.95 1.37 0.81 142 T_XMDrugObfuBody_00 3652 1.02 1.73 0.78 143 NML_ADSP_CUSTOM_MED 3504 0.81 1.00 0.75 144 DKIM_ADSP_NXDOMAIN 3460 1.35 3.16 0.74 145 HTML_FONT_FACE_BAD 3425 0.82 1.07 0.73 146 T_Symld_Words_02 3382 0.75 0.81 0.72 147 T_OBFU_PDF_ATTACH 3252 0.56 0.15 0.69 148 XM_H_PHPMailer 3198 0.89 1.51 0.68 149 XMBody_78 3062 0.91 1.66 0.65 150 XMMoneyMeta_00 3050 0.91 1.69 0.65 151 XMBody_17 2984 0.86 1.53 0.64 152 XMBody_95 2983 0.52 0.18 0.64 153 T_XMHurry_00 2978 0.78 1.21 0.64 154 XM_ShortIntro_01 2902 0.56 0.40 0.62 155 XM_B_COPY_HTML 2891 0.63 0.65 0.62 156 XMSexyCombo_01 2891 1.09 2.48 0.62 157 USER_IN_WHITELIST 2842 0.45 0.00 0.61 158 FILL_THIS_FORM 2832 0.58 0.49 0.61 159 FROM_GOV_DKIM_AU 2824 0.50 0.18 0.60 160 PLING_QUERY 2801 0.61 0.65 0.60 161 TM2_M_A_HREF_HREF 2790 0.57 0.47 0.60 162 HTML_TAG_BALANCE_BODY 2745 0.66 0.89 0.59 163 T_TooManySym_03 2703 0.48 0.20 0.58 164 XMLngstWrd_00 2678 0.73 1.21 0.57 165 SHORT_HELO_AND_INLINE_IMAGE 2619 0.43 0.04 0.56 166 BODY_QUOTE_MALF_MSGID 2610 0.62 0.82 0.56 167 HTTPS_HTTP_MISMATCH 2605 0.60 0.73 0.56 168 AC_DIV_BONANZA 2604 0.43 0.07 0.56 169 XMPhish30 2555 0.73 1.27 0.55 170 XM_RXBody 2551 0.58 0.70 0.55 171 XMLngstWrd_01 2461 0.69 1.17 0.53 172 XMGappySubj_01 2461 0.46 0.26 0.53 173 T_FILL_THIS_FORM_LONG 2454 0.47 0.30 0.52 174 RELAYCOUNTRY_DE 2440 0.80 1.64 0.52 175 LOW_PRICE 2381 0.58 0.81 0.51 176 T_FILL_THIS_FORM_LOAN 2367 0.40 0.10 0.51 177 RCVD_IN_MSPIKE_L4 2300 0.47 0.40 0.49 178 XMNoVowels 2281 0.66 1.19 0.49 179 MISSING_HEADERS 2276 0.53 0.66 0.49 180 XMHTMLBadTable_001 2232 0.60 0.95 0.48 181 RCVD_IN_MSPIKE_L3 2212 0.50 0.58 0.47 182 T_MANY_PILL_PRICE 2192 0.36 0.05 0.47 183 XMSubGiftCard1 2143 0.54 0.78 0.46 184 TM2_M_BODY_EMPTY 2141 0.37 0.11 0.46 185 FORGED_GMAIL_RCVD 2124 0.60 1.03 0.45 186 RELAYCOUNTRY_AU 2122 0.51 0.67 0.45 187 URI_NOVOWEL 2104 0.52 0.74 0.45 188 HTML_IMAGE_ONLY_32 2098 0.52 0.74 0.45 189 FROM_GOV_SPOOF 2068 0.39 0.24 0.44 190 RCVD_IN_SORBS_DUL 2030 0.39 0.25 0.43 191 XMSubMetaI_00 2023 0.75 1.69 0.43 192 TR_LOTS_OF_MONEY3 2014 0.78 1.81 0.43 193 XMSubNoVowel 2003 0.56 0.93 0.43 194 REMOVE_BEFORE_LINK 2001 0.44 0.47 0.43 195 RDNS_DYNAMIC 1963 0.55 0.95 0.42 196 SUBJ_DOLLARS 1947 0.45 0.54 0.42 197 XMSubMetaSxObfu_03 1939 0.47 0.64 0.41 198 XMPhish14 1901 0.44 0.56 0.41 199 XMSolicitRefs_0 1878 0.38 0.31 0.40 200 XMSubMetaSxObfu_02 1877 0.40 0.40 0.40 ----------------------------------------------------------------------