Email: 363780 Autolearn: 0 AvgScore: 1.66 AvgScanTime: 2.02 sec Spam: 61576 Autolearn: 0 AvgScore: 14.87 AvgScanTime: 2.55 sec Ham: 302204 Autolearn: 0 AvgScore: -1.03 AvgScanTime: 1.91 sec Time Spent Running SA: 204.22 hours Time Spent Processing Spam: 43.61 hours Time Spent Processing Ham: 160.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 54262 88.00 88.12 87.98 2 DCC_CHECK 45795 56.14 74.37 52.43 3 XM_B_Unicode 42860 72.14 69.61 72.65 4 DKIM_SIGNED 40796 76.90 66.25 79.07 5 XMListUnsubscribeExists 39308 59.51 63.84 58.63 6 XM_DK_Pass 38883 75.35 63.15 77.84 7 DKIM_VALID 36448 72.21 59.19 74.86 8 BAYES_50 30537 51.18 49.59 51.50 9 DKIM_VALID_AU 28673 56.97 46.57 59.09 10 XM_B_Unicode3 26816 44.75 43.55 44.99 11 MIME_HTML_ONLY 22502 27.97 36.54 26.22 12 LOC_TINY_FONT_1 18391 30.44 29.87 30.55 13 HTML_FONT_LOW_CONTRAST 18275 33.42 29.68 34.18 14 XM_DK_Undo_02 18005 9.62 29.24 5.62 15 BOTNET 17610 6.77 28.60 2.32 16 RELAYCOUNTRY_META 17297 9.01 28.09 5.12 17 XM_Body_Dirty_Words 14830 17.02 24.08 15.58 18 DCC_CHECK_NEGATIVE 14715 42.63 23.90 46.45 19 FVGT_m_MULTI_ODD 14411 22.35 23.40 22.14 20 XMSubLong 13847 23.84 22.49 24.12 21 FSL_BULK_SIG 12992 12.19 21.10 10.38 22 MultiRelay 12818 16.09 20.82 15.13 23 BOTNET_IPINHOSTNAME 12107 8.48 19.66 6.20 24 UNTRUSTED_Relay 12037 4.71 19.55 1.68 25 BAYES_99 11959 5.96 19.42 3.22 26 T_TM2_M_HEADER_IN_MSG 11450 21.97 18.59 22.65 27 XM_Multi_Part_URI 10498 14.53 17.05 14.02 28 DKIM_VALID_EF 10452 26.23 16.97 28.12 29 HTML_IMAGE_RATIO_02 9856 12.21 16.01 11.44 30 LOTS_OF_MONEY 9285 11.95 15.08 11.31 31 BAYES_999 9278 4.68 15.07 2.56 32 TR_DCC_Bayes_99 9069 3.85 14.73 1.64 33 XMSexyCombo_05 9023 6.89 14.65 5.30 34 T_KAM_HTML_FONT_INVALID 8635 16.44 14.02 16.93 35 XM_H_Long_From01 7522 7.38 12.22 6.40 36 XM_DIRTYINTL 7026 4.04 11.41 2.54 37 RCVD_IN_MSPIKE_H2 6988 7.97 11.35 7.28 38 XM_UB50 6702 2.48 10.88 0.77 39 XM_Evil_Numbers_Gen 6603 11.00 10.72 11.06 40 TooManyTo_001 6562 6.31 10.66 5.42 41 T_REMOTE_IMAGE 6498 6.07 10.55 5.15 42 XM_UncommonTLD01 6465 4.86 10.50 3.71 43 XMSubMetaSx_00 5928 5.58 9.63 4.76 44 T_XMDrugObfuBody_14 5147 7.94 8.36 7.86 45 RCVD_IN_PSBL 5112 1.46 8.30 0.07 46 HTML_IMAGE_RATIO_04 5082 7.27 8.25 7.08 47 MPART_ALT_DIFF 4829 4.73 7.84 4.10 48 XM_SPF_SoftFail 4791 2.19 7.78 1.05 49 RELAYCOUNTRY_FR 4569 1.64 7.42 0.46 50 RCVD_IN_BL_SPAMCOP_NET 4414 1.79 7.17 0.70 51 DKIM_INVALID 4348 4.69 7.06 4.21 52 XM_B_SpammyTLD 4229 4.65 6.87 4.20 53 RCVD_IN_RP_RNBL 4046 1.16 6.57 0.06 54 XM_URI_RBL 4008 1.45 6.51 0.42 55 MultiRelay_CC 3967 1.24 6.44 0.18 56 MultiRelay_Combo 3967 1.24 6.44 0.18 57 HTML_MIME_NO_HTML_TAG 3944 4.00 6.41 3.51 58 BOTNET_NORDNS 3901 1.09 6.34 0.02 59 DKIM_ADSP_NXDOMAIN 3858 1.62 6.27 0.67 60 BAYES_80 3762 2.70 6.11 2.01 61 XMNumbers 3582 3.96 5.82 3.58 62 LotsOfNums_01 3392 7.37 5.51 7.75 63 BAYES_60 3282 4.41 5.33 4.23 64 XM_B_Phish_Phrases 3199 6.30 5.20 6.53 65 MIME_HTML_ONLY_MULTI 3154 2.76 5.12 2.28 66 BAYES_40 3142 5.31 5.10 5.36 67 RELAYCOUNTRY_CA 2999 2.50 4.87 2.01 68 HTML_IMAGE_ONLY_12 2996 2.44 4.87 1.94 69 BAYES_20 2945 4.28 4.78 4.18 70 ALL_TRUSTED 2910 14.85 4.73 16.92 71 XM_OfRef6 2905 2.11 4.72 1.58 72 URIBL_DBL_ABUSE_REDIR 2833 0.80 4.60 0.03 73 SUBJ_ALL_CAPS 2784 2.91 4.52 2.59 74 HTML_IMAGE_ONLY_24 2763 2.81 4.49 2.47 75 XMBody_17 2758 1.51 4.48 0.91 76 US_DOLLARS_3 2708 3.32 4.40 3.10 77 MIME_HTML_MOSTLY 2689 3.12 4.37 2.87 78 FORM_FRAUD_3 2585 0.71 4.20 0.00 79 MIME_QP_LONG_LINE 2503 4.39 4.06 4.45 80 ALIBABA_IMG_NOT_RCVD_ALI 2476 0.68 4.02 0.00 81 XM_DrugUnitList 2461 0.68 4.00 0.00 82 HOSTED_IMG_MULTI 2461 0.68 4.00 0.00 83 EBAY_IMG_NOT_RCVD_EBAY 2443 0.67 3.97 0.00 84 FROM_EXCESS_BASE64 2365 4.53 3.84 4.67 85 BAYES_95 2288 1.62 3.72 1.19 86 FILL_THIS_FORM 2201 1.08 3.57 0.57 87 FROM_MISSP_REPLYTO 2173 0.60 3.53 0.01 88 FILL_THIS_FORM_LONG 2141 1.00 3.48 0.50 89 XM_SendGrid 2128 6.08 3.46 6.61 90 RELAYCOUNTRY_CN 2114 0.61 3.43 0.03 91 URI_HEX 2110 2.35 3.43 2.12 92 HOSTED_IMG_DIRECT_MX 2094 0.58 3.40 0.00 93 XM_OfRef7 2087 0.76 3.39 0.22 94 MISSING_HEADERS 2085 0.76 3.39 0.22 95 XMSexyCombo_01 2057 1.16 3.34 0.71 96 BAYES_00 2024 21.59 3.29 25.32 97 HELO_NODOT 2022 1.03 3.28 0.57 98 HELO_NO_DOMAIN 2015 1.03 3.27 0.57 99 XMStrtUSub 1952 4.66 3.17 4.97 100 DATE_IN_PAST_24_48 1939 0.54 3.15 0.01 101 FSL_HELO_NON_FQDN_1 1926 0.54 3.13 0.01 102 REPLYTO_WITHOUT_TO_CC 1924 0.56 3.12 0.04 103 RELAYCOUNTRY_NG 1898 0.52 3.08 0.00 104 TM2_M_URI_OPT_OUT 1858 1.64 3.02 1.36 105 TR_LOTS_OF_MONEY1 1855 0.52 3.01 0.01 106 XM_CamelCaseFrm001 1846 2.25 3.00 2.10 107 MONEY_FORM 1841 0.52 2.99 0.01 108 HTML_IMAGE_RATIO_06 1840 3.90 2.99 4.08 109 SpammyFromTLD_02 1839 0.73 2.99 0.27 110 T_FILL_THIS_FORM_SHORT 1815 1.29 2.95 0.95 111 KHOP_HELO_FCRDNS 1813 1.30 2.94 0.96 112 TO_NO_BRKTS_FROM_MSSP 1794 0.50 2.91 0.01 113 FROM_MISSP_EH_MATCH 1793 0.50 2.91 0.00 114 DKIM_ADSP_CUSTOM_MED 1762 1.05 2.86 0.68 115 XM_Lotto 1751 0.54 2.84 0.07 116 FILL_THIS_FORM_LOAN 1750 0.89 2.84 0.49 117 XMEmptySub 1738 0.52 2.82 0.05 118 MONEY_FROM_41 1733 0.48 2.81 0.00 119 TO_NO_BRKTS_MSFT 1725 0.48 2.80 0.01 120 NML_ADSP_CUSTOM_MED 1715 0.86 2.79 0.47 121 FORGED_MUA_OUTLOOK 1712 0.50 2.78 0.04 122 FROM_MISSPACED 1696 0.47 2.75 0.00 123 MONEY_FRAUD_3 1692 0.47 2.75 0.00 124 FROM_MISSP_MSFT 1690 0.46 2.74 0.00 125 FROM_MISSP_XPRIO 1690 0.46 2.74 0.00 126 FSL_NEW_HELO_USER 1688 0.46 2.74 0.00 127 NSL_RCVD_FROM_USER 1686 0.46 2.74 0.00 128 FROM_MISSP_USER 1685 0.46 2.74 0.00 129 XPRIO_SHORT_SUBJ 1677 0.46 2.72 0.00 130 HK_WIN 1666 0.46 2.71 0.00 131 FAKE_REPLY_C 1661 0.46 2.70 0.00 132 HTML_IMAGE_RATIO_08 1606 2.19 2.61 2.11 133 T_FILL_THIS_FORM_FRAUD_PHISH 1583 0.48 2.57 0.05 134 MONEY_FROM_MISSP 1581 0.44 2.57 0.00 135 TR_XM_PHPDW 1573 0.86 2.55 0.52 136 TooManyTo_002 1565 1.29 2.54 1.03 137 FORGED_GMAIL_RCVD 1562 0.76 2.54 0.40 138 TR_XM_PHPForged 1557 0.85 2.53 0.51 139 T_XMHurry_00 1547 1.19 2.51 0.92 140 NO_DNS_FOR_FROM 1533 1.53 2.49 1.33 141 TR_XM_FormFill2 1530 0.84 2.48 0.50 142 XM_H_PHPOS 1528 0.84 2.48 0.50 143 T_XMDrugObfuBody_08 1524 1.44 2.47 1.23 144 URI_PHP_REDIR 1509 0.61 2.45 0.23 145 RCVD_IN_MSPIKE_WL 1509 4.31 2.45 4.68 146 FROM_SUSPICIOUS_NTLD 1495 0.47 2.43 0.07 147 FROM_SUSPICIOUS_NTLD_FP 1490 0.47 2.42 0.07 148 BAYES_05 1479 2.71 2.40 2.77 149 TooManyTo_003 1443 0.99 2.34 0.71 150 XMSubMetaI_00 1438 1.32 2.34 1.11 151 XM_H_Long_From02 1428 1.43 2.32 1.24 152 T_TooManySym_01 1361 6.40 2.21 7.25 153 TooManyTo_004 1324 0.85 2.15 0.58 154 TR_XM_DK_SendGrid 1300 3.21 2.11 3.43 155 SpammyFromTLD_01 1288 0.83 2.09 0.58 156 BODY_URI_ONLY 1278 0.39 2.08 0.04 157 TooManyTo_005 1253 0.77 2.03 0.51 158 DIET_1 1249 0.80 2.03 0.55 159 TR_XM_RelayPhish 1246 1.04 2.02 0.84 160 XMDiploma_00 1228 1.61 1.99 1.53 161 HTML_SHORT_LINK_IMG_1 1208 0.36 1.96 0.03 162 TM2_M_VERY_LONG_WORD 1177 1.46 1.91 1.36 163 XMBdyGiftCard01 1164 2.68 1.89 2.84 164 TR_XM_DK_Bayes 1127 19.80 1.83 23.47 165 DATE_IN_PAST_03_06 1123 0.48 1.82 0.20 166 URI_TRY_3LD 1096 1.84 1.78 1.86 167 RELAYCOUNTRY_GB 1081 0.75 1.76 0.55 168 TR_Symld_Words 1078 1.86 1.75 1.88 169 RCVD_IN_RP_SAFE 1070 11.58 1.74 13.58 170 T_Symld_Words_02 1023 0.67 1.66 0.47 171 TR_Sbj_FN_Bdy 999 0.37 1.62 0.11 172 XMSubEmpty 998 0.39 1.62 0.14 173 TR_Mismatch_TLD_02 991 0.35 1.61 0.09 174 MAILING_LIST_MULTI 970 1.53 1.58 1.52 175 T_XMDrugObfuBody_00 964 0.90 1.57 0.77 176 XM_H_PHPMailer 951 0.67 1.54 0.49 177 URIBL_BLACK 950 0.29 1.54 0.03 178 TR_XM_DK_Bayes1 943 19.08 1.53 22.66 179 XMPhish11 917 0.98 1.49 0.87 180 ADVANCE_FEE_3_NEW 916 0.25 1.49 0.00 181 MISSING_SUBJECT 903 0.28 1.47 0.04 182 XMNoSubject 903 0.28 1.47 0.04 183 MISSING_FROM 884 0.24 1.44 0.00 184 RCVD_IN_MSPIKE_H5 865 0.36 1.40 0.14 185 RDNS_DYNAMIC 857 0.65 1.39 0.50 186 MPART_ALT_DIFF_COUNT 849 0.60 1.38 0.44 187 XMSexyCombo_04 847 0.41 1.38 0.22 188 XM_BadFromFormat 842 0.34 1.37 0.13 189 SUBJ_DOLLARS 833 0.98 1.35 0.91 190 XM_H_PHPOS_M 830 0.41 1.35 0.22 191 XM_UB60 826 0.26 1.34 0.04 192 RELAYCOUNTRY_AT 823 0.51 1.34 0.35 193 XMBrknScrpt_02 814 0.77 1.32 0.66 194 TM2_M_A_HREF_HREF 798 1.25 1.30 1.24 195 XMGenDplmaNmb 780 0.94 1.27 0.87 196 XM_H_TOP 772 0.26 1.25 0.05 197 XMPhish30 764 0.80 1.24 0.71 198 URIBL_SBL_A 753 0.34 1.22 0.16 199 UNPARSEABLE_RELAY 747 3.37 1.21 3.82 200 RCVD_IN_IADB_LISTED 743 3.54 1.21 4.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 265873 88.00 88.12 87.98 2 DKIM_SIGNED 238945 76.90 66.25 79.07 3 XM_DK_Pass 235223 75.35 63.15 77.84 4 DKIM_VALID 226223 72.21 59.19 74.86 5 XM_B_Unicode 219556 72.14 69.61 72.65 6 DKIM_VALID_AU 178567 56.97 46.57 59.09 7 XMListUnsubscribeExists 177182 59.51 63.84 58.63 8 DCC_CHECK 158440 56.14 74.37 52.43 9 BAYES_50 155649 51.18 49.59 51.50 10 DCC_CHECK_NEGATIVE 140370 42.63 23.90 46.45 11 XM_B_Unicode3 135971 44.75 43.55 44.99 12 HTML_FONT_LOW_CONTRAST 103294 33.42 29.68 34.18 13 LOC_TINY_FONT_1 92328 30.44 29.87 30.55 14 DKIM_VALID_EF 84977 26.23 16.97 28.12 15 MIME_HTML_ONLY 79237 27.97 36.54 26.22 16 BAYES_00 76503 21.59 3.29 25.32 17 XMSubLong 72894 23.84 22.49 24.12 18 TR_XM_DK_Bayes 70919 19.80 1.83 23.47 19 TR_XM_DK_Bayes1 68474 19.08 1.53 22.66 20 T_TM2_M_HEADER_IN_MSG 68463 21.97 18.59 22.65 21 FVGT_m_MULTI_ODD 66893 22.35 23.40 22.14 22 TR_XM_DK_Bayes2 60960 16.89 0.78 20.17 23 T_KAM_HTML_FONT_INVALID 51177 16.44 14.02 16.93 24 ALL_TRUSTED 51126 14.85 4.73 16.92 25 XM_Body_Dirty_Words 47090 17.02 24.08 15.58 26 MultiRelay 45730 16.09 20.82 15.13 27 XM_Multi_Part_URI 42358 14.53 17.05 14.02 28 RCVD_IN_RP_SAFE 41051 11.58 1.74 13.58 29 RCVD_IN_RP_CERTIFIED 35536 9.88 0.65 11.76 30 HTML_IMAGE_RATIO_02 34570 12.21 16.01 11.44 31 LOTS_OF_MONEY 34171 11.95 15.08 11.31 32 XM_Evil_Numbers_Gen 33410 11.00 10.72 11.06 33 FSL_BULK_SIG 31366 12.19 21.10 10.38 34 XM_DKIMWhitelistDomains 28902 7.95 0.04 9.56 35 T_XMDrugObfuBody_14 23755 7.94 8.36 7.86 36 LotsOfNums_01 23407 7.37 5.51 7.75 37 RCVD_IN_MSPIKE_H2 22000 7.97 11.35 7.28 38 T_TooManySym_01 21924 6.40 2.21 7.25 39 HTML_IMAGE_RATIO_04 21381 7.27 8.25 7.08 40 XM_SendGrid 19987 6.08 3.46 6.61 41 XM_B_Phish_Phrases 19725 6.30 5.20 6.53 42 XM_H_Long_From01 19328 7.38 12.22 6.40 43 BOTNET_IPINHOSTNAME 18739 8.48 19.66 6.20 44 XM_DK_Undo_02 16989 9.62 29.24 5.62 45 TooManyTo_001 16375 6.31 10.66 5.42 46 BAYES_40 16184 5.31 5.10 5.36 47 XMSexyCombo_05 16024 6.89 14.65 5.30 48 T_REMOTE_IMAGE 15571 6.07 10.55 5.15 49 RELAYCOUNTRY_META 15481 9.01 28.09 5.12 50 XMStrtUSub 15017 4.66 3.17 4.97 51 XMSubMetaSx_00 14377 5.58 9.63 4.76 52 RCVD_IN_MSPIKE_WL 14156 4.31 2.45 4.68 53 FROM_EXCESS_BASE64 14107 4.53 3.84 4.67 54 TO_MALFORMED 13737 3.81 0.20 4.55 55 RCVD_IN_MSPIKE_H3 13577 3.90 1.02 4.49 56 MIME_QP_LONG_LINE 13458 4.39 4.06 4.45 57 BAYES_60 12773 4.41 5.33 4.23 58 DKIM_INVALID 12722 4.69 7.06 4.21 59 XM_B_SpammyTLD 12700 4.65 6.87 4.20 60 BAYES_20 12628 4.28 4.78 4.18 61 MPART_ALT_DIFF 12395 4.73 7.84 4.10 62 HTML_IMAGE_RATIO_06 12330 3.90 2.99 4.08 63 RCVD_IN_IADB_LISTED 12118 3.54 1.21 4.01 64 UNPARSEABLE_RELAY 11530 3.37 1.21 3.82 65 XM_UncommonTLD01 11221 4.86 10.50 3.71 66 XMNumbers 10820 3.96 5.82 3.58 67 HTML_MIME_NO_HTML_TAG 10605 4.00 6.41 3.51 68 RCVD_IN_IADB_SPF 10452 3.04 0.96 3.46 69 TR_XM_DK_SendGrid 10364 3.21 2.11 3.43 70 BAYES_99 9721 5.96 19.42 3.22 71 US_DOLLARS_3 9375 3.32 4.40 3.10 72 IN_ZIMBRA_NJ_WHITELIST 9348 2.57 0.01 3.09 73 TVD_RCVD_IP 9243 2.67 0.74 3.06 74 RCVD_IN_IADB_SENDERID 9232 2.70 0.95 3.05 75 T_TooManySym_02 9081 2.56 0.36 3.00 76 RCVD_IN_IADB_DK 8941 2.62 0.94 2.96 77 MIME_HTML_MOSTLY 8661 3.12 4.37 2.87 78 XMBdyGiftCard01 8591 2.68 1.89 2.84 79 CK_HELO_DYNAMIC_SPLIT_IP 8493 2.41 0.43 2.81 80 HELO_DYNAMIC_IPADDR2 8444 2.34 0.12 2.79 81 BAYES_05 8382 2.71 2.40 2.77 82 RCVD_IN_IADB_VOUCHED 7875 2.24 0.43 2.61 83 SUBJ_ALL_CAPS 7813 2.91 4.52 2.59 84 BAYES_999 7730 4.68 15.07 2.56 85 XM_DIRTYINTL 7685 4.04 11.41 2.54 86 INVALID_MSGID 7563 2.12 0.23 2.50 87 HTML_IMAGE_ONLY_24 7474 2.81 4.49 2.47 88 BOTNET 7005 6.77 28.60 2.32 89 MIME_HTML_ONLY_MULTI 6895 2.76 5.12 2.28 90 URI_HEX 6421 2.35 3.43 2.12 91 HTML_IMAGE_RATIO_08 6367 2.19 2.61 2.11 92 XM_CamelCaseFrm001 6342 2.25 3.00 2.10 93 RELAYCOUNTRY_CA 6086 2.50 4.87 2.01 94 BAYES_80 6072 2.70 6.11 2.01 95 TR_MetaPhish_Combo_01 5978 1.79 0.85 1.98 96 HTML_IMAGE_ONLY_12 5876 2.44 4.87 1.94 97 TR_Symld_Words 5696 1.86 1.75 1.88 98 URI_TRY_3LD 5613 1.84 1.78 1.86 99 USER_IN_DEF_DKIM_WL 5192 1.43 0.02 1.72 100 UNTRUSTED_Relay 5086 4.71 19.55 1.68 101 RCVD_IN_IADB_OPTIN 5067 1.44 0.29 1.68 102 TR_DCC_Bayes_99 4951 3.85 14.73 1.64 103 XM_OfRef6 4782 2.11 4.72 1.58 104 IN_HORDE_ADDRESS_BOOK 4772 1.32 0.03 1.58 105 XM_PDF 4764 1.36 0.33 1.58 106 XMDiploma_00 4630 1.61 1.99 1.53 107 MAILING_LIST_MULTI 4591 1.53 1.58 1.52 108 TM2_M_VERY_LONG_WORD 4116 1.46 1.91 1.36 109 XM_DK_Undo_01 4115 1.27 0.84 1.36 110 TM2_M_URI_OPT_OUT 4101 1.64 3.02 1.36 111 ANY_BOUNCE_MESSAGE 4037 1.20 0.51 1.34 112 BOUNCE_MESSAGE 4034 1.19 0.50 1.33 113 NO_DNS_FOR_FROM 4017 1.53 2.49 1.33 114 XM_H_Long_From02 3757 1.43 2.32 1.24 115 TM2_M_A_HREF_HREF 3739 1.25 1.30 1.24 116 T_XMDrugObfuBody_08 3723 1.44 2.47 1.23 117 PLING_QUERY 3678 1.18 1.02 1.22 118 BAYES_95 3604 1.62 3.72 1.19 119 XMSubMetaI_00 3363 1.32 2.34 1.11 120 XM_GoogleGroups 3261 1.08 1.07 1.08 121 XMGappySubj_01 3258 0.94 0.26 1.08 122 XM_SPF_SoftFail 3177 2.19 7.78 1.05 123 TooManyTo_002 3117 1.29 2.54 1.03 124 XM_B_REG_HTML 3069 0.87 0.18 1.02 125 XM_ProductURIs 3031 0.97 0.84 1.00 126 KHOP_HELO_FCRDNS 2911 1.30 2.94 0.96 127 T_FILL_THIS_FORM_SHORT 2881 1.29 2.95 0.95 128 XMStockSpam_06 2876 0.99 1.17 0.95 129 T_XMHurry_00 2767 1.19 2.51 0.92 130 XMBody_17 2753 1.51 4.48 0.91 131 SUBJ_DOLLARS 2740 0.98 1.35 0.91 132 XMPhish11 2640 0.98 1.49 0.87 133 XMGenDplmaNmb 2632 0.94 1.27 0.87 134 TR_XM_RelayPhish 2552 1.04 2.02 0.84 135 HTML_TAG_BALANCE_BODY 2539 0.82 0.70 0.84 136 XMBody_95 2512 0.73 0.25 0.83 137 T_XMDrugObfuBody_00 2323 0.90 1.57 0.77 138 XM_UB50 2322 2.48 10.88 0.77 139 XMPhish30 2160 0.80 1.24 0.71 140 TooManyTo_003 2151 0.99 2.34 0.71 141 XMSexyCombo_01 2150 1.16 3.34 0.71 142 USER_IN_WHITELIST 2139 0.59 0.00 0.71 143 XM_D_tchamptons_WL 2133 0.59 0.00 0.71 144 TR_LOTS_OF_MONEY2 2120 0.76 1.04 0.70 145 T_MONEY_PERCENT 2120 0.76 1.04 0.70 146 XM_B_COPY_HTML 2111 0.67 0.56 0.70 147 RCVD_IN_BL_SPAMCOP_NET 2109 1.79 7.17 0.70 148 XMBody_78 2102 0.72 0.86 0.70 149 HTML_FONT_FACE_BAD 2100 0.73 0.91 0.69 150 XMSubMetaSxObfu_02 2093 0.75 1.01 0.69 151 DKIM_ADSP_CUSTOM_MED 2054 1.05 2.86 0.68 152 DKIM_ADSP_NXDOMAIN 2027 1.62 6.27 0.67 153 XMBrknScrpt_02 2001 0.77 1.32 0.66 154 XMHTMLBadTable_001 1996 0.62 0.44 0.66 155 XMSlimDrugH 1908 0.71 1.07 0.63 156 T_TooManySym_03 1900 0.54 0.12 0.63 157 TooManyTo_004 1757 0.85 2.15 0.58 158 SpammyFromTLD_01 1741 0.83 2.09 0.58 159 FILL_THIS_FORM 1731 1.08 3.57 0.57 160 HELO_NODOT 1726 1.03 3.28 0.57 161 HELO_NO_DOMAIN 1725 1.03 3.27 0.57 162 DIET_1 1675 0.80 2.03 0.55 163 RELAYCOUNTRY_GB 1655 0.75 1.76 0.55 164 XM_RXBody 1596 0.49 0.32 0.53 165 TR_XM_PHPDW 1568 0.86 2.55 0.52 166 TooManyTo_005 1538 0.77 2.03 0.51 167 TR_XM_PHPForged 1537 0.85 2.53 0.51 168 URI_NOVOWEL 1523 0.51 0.56 0.50 169 TR_XM_FormFill2 1519 0.84 2.48 0.50 170 XM_H_PHPOS 1510 0.84 2.48 0.50 171 RDNS_DYNAMIC 1504 0.65 1.39 0.50 172 FILL_THIS_FORM_LONG 1502 1.00 3.48 0.50 173 FILL_THIS_FORM_LOAN 1488 0.89 2.84 0.49 174 XM_H_PHPMailer 1483 0.67 1.54 0.49 175 XMHTML_After_End 1447 0.51 0.65 0.48 176 BODY_ENHANCEMENT 1431 0.40 0.02 0.47 177 XM_Combo_Sbj 1422 0.46 0.43 0.47 178 T_Symld_Words_02 1421 0.67 1.66 0.47 179 NML_ADSP_CUSTOM_MED 1409 0.86 2.79 0.47 180 XMPhish14 1398 0.52 0.80 0.46 181 RELAYCOUNTRY_FR 1389 1.64 7.42 0.46 182 MPART_ALT_DIFF_COUNT 1317 0.60 1.38 0.44 183 HTTPS_HTTP_MISMATCH 1261 0.49 0.83 0.42 184 TR_LOTS_OF_MONEY3 1260 0.48 0.80 0.42 185 XMBody_29 1259 0.37 0.15 0.42 186 XM_URI_RBL 1255 1.45 6.51 0.42 187 RELAYCOUNTRY_AU 1242 0.41 0.41 0.41 188 FORGED_GMAIL_RCVD 1205 0.76 2.54 0.40 189 UPPERCASE_50_75 1198 0.36 0.17 0.40 190 XMBSHREFv2 1182 0.37 0.26 0.39 191 XMLngstWrd_00 1166 0.38 0.38 0.39 192 TM2_M_BODY_EMPTY 1086 0.31 0.06 0.36 193 XMCapTrack 1086 0.33 0.17 0.36 194 XMLngstWrd_01 1072 0.35 0.35 0.35 195 RELAYCOUNTRY_DE 1062 0.46 0.99 0.35 196 RELAYCOUNTRY_AT 1046 0.51 1.34 0.35 197 AC_DIV_BONANZA 1022 0.29 0.08 0.34 198 XMNoVowels 1020 0.34 0.35 0.34 199 XMManySubDom_06 1006 0.30 0.15 0.33 200 HTML_IMAGE_ONLY_20 1005 0.35 0.43 0.33 ----------------------------------------------------------------------