Email: 664123 Autolearn: 0 AvgScore: 1.96 AvgScanTime: 2.34 sec Spam: 126854 Autolearn: 0 AvgScore: 12.34 AvgScanTime: 3.06 sec Ham: 537269 Autolearn: 0 AvgScore: -0.49 AvgScanTime: 2.17 sec Time Spent Running SA: 431.38 hours Time Spent Processing Spam: 107.81 hours Time Spent Processing Ham: 323.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 121420 91.28 95.72 90.23 2 DCC_CHECK 103943 52.54 81.94 45.60 3 DKIM_SIGNED 98453 79.08 77.61 79.42 4 XM_DK_Pass 94659 77.43 74.62 78.10 5 XM_B_Unicode 91714 71.78 72.30 71.66 6 DKIM_VALID 89159 73.62 70.28 74.41 7 XMListUnsubscribeExists 82895 57.73 65.35 55.93 8 DKIM_VALID_AU 68652 55.39 54.12 55.69 9 XM_B_Unicode3 63768 43.68 50.27 42.13 10 BAYES_50 60823 53.90 47.95 55.30 11 MIME_HTML_ONLY 47113 24.36 37.14 21.34 12 HTML_FONT_LOW_CONTRAST 45890 30.79 36.18 29.52 13 LOC_TINY_FONT_1 44242 27.43 34.88 25.67 14 XM_DK_Undo_02 42403 11.76 33.43 6.64 15 FVGT_m_MULTI_ODD 33273 23.31 26.23 22.62 16 XMSubLong 31800 22.74 25.07 22.19 17 XM_Body_Dirty_Words 30001 15.47 23.65 13.53 18 DKIM_VALID_EF 29996 26.31 23.65 26.94 19 BOTNET 29169 6.27 22.99 2.32 20 RELAYCOUNTRY_META 28542 9.21 22.50 6.07 21 BAYES_99 28305 6.62 22.31 2.92 22 MultiRelay 28041 18.92 22.10 18.17 23 FSL_BULK_SIG 25536 9.19 20.13 6.61 24 T_KAM_HTML_FONT_INVALID 24612 19.17 19.40 19.12 25 XM_Multi_Part_URI 24444 13.64 19.27 12.31 26 TR_DCC_Bayes_99 22950 4.45 18.09 1.23 27 BAYES_999 21595 5.13 17.02 2.33 28 BOTNET_IPINHOSTNAME 21100 7.11 16.63 4.87 29 DCC_CHECK_NEGATIVE 20415 45.51 16.09 52.45 30 T_TM2_M_HEADER_IN_MSG 20218 26.70 15.94 29.24 31 HTML_IMAGE_RATIO_02 19424 11.31 15.31 10.36 32 XMSexyCombo_05 18282 5.99 14.41 4.00 33 XM_B_Unsub 17841 10.98 14.06 10.25 34 XM_UncommonTLD01 17176 5.21 13.54 3.24 35 XM_Evil_Numbers_Gen 17109 10.45 13.49 9.74 36 UNTRUSTED_Relay 16086 4.15 12.68 2.14 37 LOTS_OF_MONEY 15254 9.28 12.02 8.63 38 XMSubMetaSx_00 13446 5.38 10.60 4.15 39 MPART_ALT_DIFF 11349 4.95 8.95 4.01 40 HTML_SHORT_LINK_IMG_1 11192 1.70 8.82 0.02 41 HTML_MIME_NO_HTML_TAG 11048 3.69 8.71 2.51 42 LotsOfNums_01 10886 8.88 8.58 8.96 43 T_XMDrugObfuBody_14 10884 7.98 8.58 7.84 44 XM_B_Phish_Phrases 10636 6.11 8.38 5.58 45 SpammyFromTLD_02 10043 1.89 7.92 0.47 46 XM_DIRTYINTL 9921 3.64 7.82 2.65 47 XM_H_Long_From01 9794 7.06 7.72 6.90 48 TooManyTo_001 9576 8.22 7.55 8.37 49 XM_UB50 9308 2.33 7.34 1.14 50 DKIM_INVALID 9294 5.45 7.33 5.01 51 HTML_IMAGE_RATIO_04 8863 6.39 6.99 6.24 52 BOTNET_NORDNS 8861 1.36 6.99 0.04 53 T_REMOTE_IMAGE 8813 4.24 6.95 3.61 54 BAYES_80 8505 3.36 6.70 2.57 55 XMNumbers 7823 3.69 6.17 3.11 56 BODY_URI_ONLY 7764 1.25 6.12 0.10 57 XM_SendGrid 7729 6.41 6.09 6.49 58 MIME_QP_LONG_LINE 7716 6.35 6.08 6.41 59 MIME_HTML_MOSTLY 7647 3.40 6.03 2.78 60 T_HTML_TAG_BALANCE_CENTER 7633 1.31 6.02 0.19 61 BAYES_60 7623 5.06 6.01 4.84 62 XM_B_SpammyTLD 7122 2.55 5.61 1.83 63 HTML_IMAGE_ONLY_08 6990 1.19 5.51 0.17 64 KHOP_HELO_FCRDNS 6488 2.52 5.11 1.91 65 XM_SPF_SoftFail 6486 2.56 5.11 1.96 66 BAYES_40 6154 5.54 4.85 5.70 67 RELAYCOUNTRY_GB 5982 1.88 4.72 1.21 68 HDRS_LCASE_IMGONLY 5699 0.89 4.49 0.04 69 MIME_HTML_ONLY_MULTI 5649 2.49 4.45 2.02 70 XM_BadFromFormat 5373 0.91 4.24 0.12 71 HTML_IMAGE_RATIO_06 5170 3.87 4.08 3.82 72 FROM_MISSP_REPLYTO 5081 0.77 4.01 0.00 73 URI_HEX 5018 2.36 3.96 1.99 74 TM2_M_URI_OPT_OUT 4980 2.56 3.93 2.23 75 RCVD_IN_MSPIKE_H2 4828 5.94 3.81 6.44 76 HTML_IMAGE_ONLY_12 4674 0.88 3.68 0.22 77 XM_URI_RBL 4629 0.94 3.65 0.30 78 FROM_EXCESS_BASE64 4624 3.91 3.65 3.97 79 HTML_EXTRA_CLOSE 4605 0.70 3.63 0.01 80 REPLYTO_WITHOUT_TO_CC 4584 0.72 3.61 0.04 81 TR_XM_DK_SendGrid 4552 3.29 3.59 3.22 82 BAYES_20 4489 4.39 3.54 4.59 83 MIME_HEADER_CTYPE_ONLY 4468 0.77 3.52 0.12 84 XMStrtUSub 4357 4.09 3.43 4.24 85 FROM_SUSPICIOUS_NTLD 4348 0.71 3.43 0.07 86 BAYES_00 4275 16.47 3.37 19.57 87 FROM_SUSPICIOUS_NTLD_FP 4259 0.70 3.36 0.07 88 XMSexyCombo_01 4208 1.33 3.32 0.86 89 BAYES_95 4207 1.76 3.32 1.39 90 RDNS_DYNAMIC 3964 0.88 3.12 0.35 91 XMDiploma_00 3929 1.96 3.10 1.69 92 XM_B_Unsub2 3924 1.91 3.09 1.63 93 TR_XM_RelayPhish 3914 1.20 3.09 0.76 94 RCVD_IN_RP_RNBL 3902 0.69 3.08 0.13 95 HTML_IMAGE_RATIO_08 3858 2.17 3.04 1.96 96 T_XMDrugObfuBody_08 3797 1.69 2.99 1.39 97 TM2_M_VERY_LONG_WORD 3746 1.57 2.95 1.24 98 RELAYCOUNTRY_CA 3713 1.94 2.93 1.70 99 RCVD_IN_BL_SPAMCOP_NET 3628 1.73 2.86 1.46 100 NO_DNS_FOR_FROM 3601 1.47 2.84 1.15 101 XM_CamelCaseFrm001 3362 2.39 2.65 2.32 102 XMSubMetaI_00 3343 1.38 2.64 1.09 103 T_TooManySym_01 3244 3.63 2.56 3.89 104 TO_EQ_FM_DOM_HTML_IMG 3227 0.50 2.54 0.01 105 TR_Mismatch_TLD_02 3153 0.53 2.49 0.07 106 HDRS_MISSP 3136 0.48 2.47 0.01 107 RCVD_IN_IADB_LISTED 3135 4.86 2.47 5.43 108 XMBdyGiftCard01 3083 1.76 2.43 1.60 109 XMBody_17 3082 1.03 2.43 0.70 110 TR_XM_PHPDW 3032 0.97 2.39 0.64 111 TR_XM_PHPForged 3008 0.96 2.37 0.63 112 RCVD_IN_IADB_SPF 3001 4.32 2.37 4.78 113 TR_XM_FormFill2 2992 0.95 2.36 0.62 114 XM_H_PHPOS 2986 0.95 2.35 0.62 115 RCVD_IN_IADB_SENDERID 2959 3.87 2.33 4.23 116 RCVD_IN_IADB_DK 2953 3.82 2.33 4.17 117 RELAYCOUNTRY_FR 2882 0.80 2.27 0.45 118 XMStockSpam_06 2845 1.45 2.24 1.26 119 XM_OfRef6 2837 1.48 2.24 1.30 120 MultiRelay_CC 2718 0.60 2.14 0.23 121 MultiRelay_Combo 2718 0.60 2.14 0.23 122 XMGenDplmaNmb 2630 1.23 2.07 1.03 123 T_XMDrugObfuBody_00 2611 1.06 2.06 0.82 124 SpammyFromTLD_01 2411 1.09 1.90 0.90 125 SUBJ_ALL_CAPS 2375 1.87 1.87 1.87 126 RCVD_IN_RP_SAFE 2268 8.42 1.79 9.98 127 BAYES_05 2207 2.66 1.74 2.88 128 TR_XM_INV_DKIM 2177 0.39 1.72 0.08 129 DKIM_ADSP_NXDOMAIN 2153 0.69 1.70 0.45 130 XMHTML_After_End 2128 1.30 1.68 1.21 131 XMSubMetaSxObfu_03 2122 1.03 1.67 0.88 132 RCVD_IN_MSPIKE_WL 2098 4.18 1.65 4.78 133 SUBJ_DOLLARS 2094 0.76 1.65 0.55 134 T_XMHurry_00 2056 0.98 1.62 0.83 135 RELAYCOUNTRY_IN 2055 0.53 1.62 0.27 136 MAILING_LIST_MULTI 2015 2.03 1.59 2.13 137 T_Symld_Words_02 1966 0.78 1.55 0.60 138 TR_LOTS_OF_MONEY3 1966 0.75 1.55 0.56 139 XM_H_Long_From02 1957 1.44 1.54 1.41 140 FSL_THIS_IS_ADV 1934 0.50 1.52 0.26 141 RELAYCOUNTRY_NL 1913 0.43 1.51 0.17 142 XMSexyCombo_04 1901 0.42 1.50 0.16 143 URI_TRY_3LD 1894 1.76 1.49 1.82 144 XMGppyBdWords 1833 0.50 1.44 0.28 145 XM_DK_Undo_01 1769 1.47 1.39 1.49 146 ALL_TRUSTED 1761 10.85 1.39 13.08 147 XMBrknScrpt_02 1761 0.91 1.39 0.80 148 XM_Combo_Sbj 1752 0.48 1.38 0.26 149 T_FILL_THIS_FORM_SHORT 1741 0.88 1.37 0.77 150 DATE_IN_PAST_03_06 1737 0.44 1.37 0.22 151 RCVD_IN_RP_CERTIFIED 1713 7.47 1.35 8.91 152 RELAYCOUNTRY_AT 1696 0.43 1.34 0.21 153 TR_XM_DK_Bayes 1641 13.46 1.29 16.34 154 XMPhish11 1606 1.13 1.27 1.10 155 T_MONEY_PERCENT 1594 1.34 1.26 1.36 156 TR_LOTS_OF_MONEY2 1594 1.34 1.26 1.36 157 XM_H_PHPMailer 1557 0.65 1.23 0.52 158 RCVD_IN_MSPIKE_H3 1551 3.38 1.22 3.89 159 RCVD_IN_MSPIKE_BL 1530 0.75 1.21 0.64 160 DATE_IN_PAST_12_24 1518 0.30 1.20 0.09 161 XM_H_TOP 1501 0.23 1.18 0.01 162 TO_NO_BRKTS_DYNIP 1499 0.23 1.18 0.00 163 RELAYCOUNTRY_IE 1489 0.38 1.17 0.20 164 XM_H_PHPOS_M 1476 0.39 1.16 0.20 165 US_DOLLARS_3 1475 0.57 1.16 0.42 166 XMPhish14 1475 0.69 1.16 0.58 167 HTML_FONT_FACE_BAD 1453 0.76 1.15 0.67 168 TR_XM_DK_Bayes1 1446 12.85 1.14 15.61 169 FROM_MISSP_DYNIP 1420 0.21 1.12 0.00 170 XMPhish30 1409 0.66 1.11 0.56 171 UNPARSEABLE_RELAY 1394 1.92 1.10 2.11 172 XMBody_78 1385 0.62 1.09 0.50 173 DATE_IN_PAST_06_12 1373 0.34 1.08 0.17 174 XM_XX_Yahoo 1368 0.31 1.08 0.13 175 XM_UB60 1332 0.29 1.05 0.11 176 RCVD_IN_PSBL 1325 0.24 1.04 0.05 177 XM_UB99 1316 0.20 1.04 0.01 178 LongTLD 1304 0.34 1.03 0.18 179 PLING_QUERY 1302 0.54 1.03 0.43 180 HK_RANDOM_REPLYTO 1259 0.42 0.99 0.28 181 TR_Symld_Words 1251 1.20 0.99 1.25 182 HELO_NODOT 1246 1.45 0.98 1.56 183 HELO_NO_DOMAIN 1242 1.45 0.98 1.56 184 DIET_1 1222 0.57 0.96 0.47 185 LOW_PRICE 1140 0.68 0.90 0.63 186 THIS_AD 1138 0.36 0.90 0.24 187 TM2_M_A_HREF_HREF 1110 0.46 0.88 0.36 188 RCVD_IN_IADB_VOUCHED 1104 2.90 0.87 3.39 189 XM_UB80 1091 0.18 0.86 0.02 190 DKIM_ADSP_CUSTOM_MED 1074 1.14 0.85 1.20 191 XM_ProductURIs 1049 0.92 0.83 0.95 192 XM_SPF_Unknown 1036 0.74 0.82 0.73 193 ANY_BOUNCE_MESSAGE 990 1.63 0.78 1.83 194 BOUNCE_MESSAGE 990 1.63 0.78 1.83 195 RELAYCOUNTRY_DE 984 0.60 0.78 0.56 196 URIBL_BLACK 967 0.17 0.76 0.03 197 HTML_FONT_SIZE_HUGE 935 0.21 0.74 0.09 198 TooManyTo_002 908 1.79 0.72 2.04 199 XM_PDF 901 3.84 0.71 4.58 200 URIBL_CSS 900 1.08 0.71 1.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 484799 91.28 95.72 90.23 2 DKIM_SIGNED 426709 79.08 77.61 79.42 3 XM_DK_Pass 419586 77.43 74.62 78.10 4 DKIM_VALID 399800 73.62 70.28 74.41 5 XM_B_Unicode 385018 71.78 72.30 71.66 6 XMListUnsubscribeExists 300499 57.73 65.35 55.93 7 DKIM_VALID_AU 299221 55.39 54.12 55.69 8 BAYES_50 297116 53.90 47.95 55.30 9 DCC_CHECK_NEGATIVE 281812 45.51 16.09 52.45 10 DCC_CHECK 244987 52.54 81.94 45.60 11 XM_B_Unicode3 226334 43.68 50.27 42.13 12 HTML_FONT_LOW_CONTRAST 158611 30.79 36.18 29.52 13 T_TM2_M_HEADER_IN_MSG 157119 26.70 15.94 29.24 14 DKIM_VALID_EF 144738 26.31 23.65 26.94 15 LOC_TINY_FONT_1 137929 27.43 34.88 25.67 16 FVGT_m_MULTI_ODD 121510 23.31 26.23 22.62 17 XMSubLong 119229 22.74 25.07 22.19 18 MIME_HTML_ONLY 114651 24.36 37.14 21.34 19 BAYES_00 105129 16.47 3.37 19.57 20 T_KAM_HTML_FONT_INVALID 102721 19.17 19.40 19.12 21 MultiRelay 97598 18.92 22.10 18.17 22 TR_XM_DK_Bayes 87767 13.46 1.29 16.34 23 TR_XM_DK_Bayes1 83889 12.85 1.14 15.61 24 XM_Body_Dirty_Words 72717 15.47 23.65 13.53 25 TR_XM_DK_Bayes2 72084 10.96 0.58 13.42 26 ALL_TRUSTED 70291 10.85 1.39 13.08 27 XM_Multi_Part_URI 66117 13.64 19.27 12.31 28 HTML_IMAGE_RATIO_02 55678 11.31 15.31 10.36 29 XM_B_Unsub 55066 10.98 14.06 10.25 30 RCVD_IN_RP_SAFE 53629 8.42 1.79 9.98 31 XM_Evil_Numbers_Gen 52304 10.45 13.49 9.74 32 LotsOfNums_01 48118 8.88 8.58 8.96 33 RCVD_IN_RP_CERTIFIED 47867 7.47 1.35 8.91 34 LOTS_OF_MONEY 46383 9.28 12.02 8.63 35 TooManyTo_001 44995 8.22 7.55 8.37 36 XM_DKIMWhitelistDomains 43952 6.63 0.08 8.18 37 T_XMDrugObfuBody_14 42141 7.98 8.58 7.84 38 XM_H_Long_From01 37091 7.06 7.72 6.90 39 XM_DK_Undo_02 35670 11.76 33.43 6.64 40 FSL_BULK_SIG 35499 9.19 20.13 6.61 41 XM_SendGrid 34864 6.41 6.09 6.49 42 RCVD_IN_MSPIKE_H2 34617 5.94 3.81 6.44 43 MIME_QP_LONG_LINE 34454 6.35 6.08 6.41 44 HTML_IMAGE_RATIO_04 33546 6.39 6.99 6.24 45 RELAYCOUNTRY_META 32630 9.21 22.50 6.07 46 BAYES_40 30630 5.54 4.85 5.70 47 XM_B_Phish_Phrases 29968 6.11 8.38 5.58 48 RCVD_IN_IADB_LISTED 29172 4.86 2.47 5.43 49 DKIM_INVALID 26909 5.45 7.33 5.01 50 BOTNET_IPINHOSTNAME 26146 7.11 16.63 4.87 51 BAYES_60 25997 5.06 6.01 4.84 52 RCVD_IN_MSPIKE_WL 25682 4.18 1.65 4.78 53 RCVD_IN_IADB_SPF 25674 4.32 2.37 4.78 54 BAYES_20 24663 4.39 3.54 4.59 55 XM_PDF 24630 3.84 0.71 4.58 56 XMStrtUSub 22798 4.09 3.43 4.24 57 RCVD_IN_IADB_SENDERID 22748 3.87 2.33 4.23 58 RCVD_IN_IADB_DK 22420 3.82 2.33 4.17 59 XMSubMetaSx_00 22289 5.38 10.60 4.15 60 MPART_ALT_DIFF 21537 4.95 8.95 4.01 61 XMSexyCombo_05 21470 5.99 14.41 4.00 62 FROM_EXCESS_BASE64 21311 3.91 3.65 3.97 63 T_TooManySym_01 20876 3.63 2.56 3.89 64 RCVD_IN_MSPIKE_H3 20876 3.38 1.22 3.89 65 HTML_IMAGE_RATIO_06 20539 3.87 4.08 3.82 66 T_REMOTE_IMAGE 19375 4.24 6.95 3.61 67 IN_ZIMBRA_NJ_WHITELIST 19235 2.90 0.03 3.58 68 RCVD_IN_IADB_VOUCHED 18188 2.90 0.87 3.39 69 XM_UncommonTLD01 17410 5.21 13.54 3.24 70 TR_XM_DK_SendGrid 17325 3.29 3.59 3.22 71 XMNumbers 16693 3.69 6.17 3.11 72 BAYES_99 15673 6.62 22.31 2.92 73 BAYES_05 15458 2.66 1.74 2.88 74 MIME_HTML_MOSTLY 14957 3.40 6.03 2.78 75 XM_DIRTYINTL 14221 3.64 7.82 2.65 76 BAYES_80 13829 3.36 6.70 2.57 77 HTML_MIME_NO_HTML_TAG 13482 3.69 8.71 2.51 78 BAYES_999 12495 5.13 17.02 2.33 79 XM_CamelCaseFrm001 12481 2.39 2.65 2.32 80 BOTNET 12477 6.27 22.99 2.32 81 TM2_M_URI_OPT_OUT 11996 2.56 3.93 2.23 82 UNTRUSTED_Relay 11472 4.15 12.68 2.14 83 MAILING_LIST_MULTI 11452 2.03 1.59 2.13 84 RCVD_IN_IADB_OPTIN 11446 1.82 0.52 2.13 85 UNPARSEABLE_RELAY 11351 1.92 1.10 2.11 86 TooManyTo_002 10987 1.79 0.72 2.04 87 MIME_HTML_ONLY_MULTI 10873 2.49 4.45 2.02 88 URI_HEX 10669 2.36 3.96 1.99 89 XM_SPF_SoftFail 10541 2.56 5.11 1.96 90 HTML_IMAGE_RATIO_08 10524 2.17 3.04 1.96 91 T_TooManySym_02 10388 1.67 0.54 1.93 92 KHOP_HELO_FCRDNS 10274 2.52 5.11 1.91 93 SUBJ_ALL_CAPS 10071 1.87 1.87 1.87 94 XM_B_SpammyTLD 9846 2.55 5.61 1.83 95 ANY_BOUNCE_MESSAGE 9816 1.63 0.78 1.83 96 BOUNCE_MESSAGE 9813 1.63 0.78 1.83 97 URI_TRY_3LD 9773 1.76 1.49 1.82 98 TVD_RCVD_IP 9327 1.49 0.46 1.74 99 RELAYCOUNTRY_CA 9152 1.94 2.93 1.70 100 XMDiploma_00 9065 1.96 3.10 1.69 101 XM_B_Unsub2 8772 1.91 3.09 1.63 102 XMBdyGiftCard01 8596 1.76 2.43 1.60 103 IN_HORDE_ADDRESS_BOOK 8431 1.28 0.03 1.57 104 HELO_NODOT 8373 1.45 0.98 1.56 105 HELO_NO_DOMAIN 8371 1.45 0.98 1.56 106 XM_DK_Undo_01 7996 1.47 1.39 1.49 107 RCVD_IN_BL_SPAMCOP_NET 7860 1.73 2.86 1.46 108 INVALID_MSGID 7813 1.22 0.22 1.45 109 XM_H_Long_From02 7577 1.44 1.54 1.41 110 CK_HELO_DYNAMIC_SPLIT_IP 7566 1.22 0.45 1.41 111 HELO_DYNAMIC_IPADDR2 7563 1.16 0.09 1.41 112 XMCapTrack 7493 1.19 0.33 1.39 113 BAYES_95 7478 1.76 3.32 1.39 114 T_XMDrugObfuBody_08 7452 1.69 2.99 1.39 115 TooManyTo_003 7369 1.22 0.56 1.37 116 USER_IN_DEF_DKIM_WL 7326 1.11 0.01 1.36 117 TR_LOTS_OF_MONEY2 7292 1.34 1.26 1.36 118 T_MONEY_PERCENT 7292 1.34 1.26 1.36 119 XM_OfRef6 7005 1.48 2.24 1.30 120 TO_MALFORMED 6848 1.04 0.04 1.27 121 XMStockSpam_06 6779 1.45 2.24 1.26 122 TR_Symld_Words 6703 1.20 0.99 1.25 123 TM2_M_VERY_LONG_WORD 6676 1.57 2.95 1.24 124 TR_DCC_Bayes_99 6607 4.45 18.09 1.23 125 RELAYCOUNTRY_GB 6509 1.88 4.72 1.21 126 XMHTML_After_End 6477 1.30 1.68 1.21 127 DKIM_ADSP_CUSTOM_MED 6466 1.14 0.85 1.20 128 URIBL_CSS 6264 1.08 0.71 1.17 129 URIBL_CSS_A 6264 1.08 0.71 1.17 130 NO_DNS_FOR_FROM 6155 1.47 2.84 1.15 131 XM_UB50 6140 2.33 7.34 1.14 132 XMPhish11 5890 1.13 1.27 1.10 133 XMSubMetaI_00 5842 1.38 2.64 1.09 134 TR_MetaPhish_Combo_01 5795 0.98 0.56 1.08 135 TooManyTo_004 5630 0.94 0.46 1.05 136 XMGenDplmaNmb 5517 1.23 2.07 1.03 137 XM_GoogleGroups 5300 0.89 0.47 0.99 138 XM_ProductURIs 5079 0.92 0.83 0.95 139 XMGappySubj_01 4977 0.81 0.30 0.93 140 SpammyFromTLD_01 4815 1.09 1.90 0.90 141 XMSubMetaSxObfu_03 4709 1.03 1.67 0.88 142 TooManyTo_005 4695 0.78 0.40 0.87 143 XMSexyCombo_01 4635 1.33 3.32 0.86 144 NML_ADSP_CUSTOM_MED 4493 0.81 0.70 0.84 145 T_XMHurry_00 4471 0.98 1.62 0.83 146 T_XMDrugObfuBody_00 4406 1.06 2.06 0.82 147 XMBrknScrpt_02 4277 0.91 1.39 0.80 148 T_FILL_THIS_FORM_SHORT 4130 0.88 1.37 0.77 149 TR_XM_RelayPhish 4066 1.20 3.09 0.76 150 FORGED_GMAIL_RCVD 3947 0.73 0.69 0.73 151 XM_SPF_Unknown 3903 0.74 0.82 0.73 152 XMBody_17 3777 1.03 2.43 0.70 153 XMBody_95 3767 0.60 0.19 0.70 154 HTML_FONT_FACE_BAD 3599 0.76 1.15 0.67 155 URI_NOVOWEL 3587 0.64 0.51 0.67 156 XM_RXBody 3445 0.58 0.31 0.64 157 RCVD_IN_MSPIKE_BL 3421 0.75 1.21 0.64 158 TR_XM_PHPDW 3420 0.97 2.39 0.64 159 LOW_PRICE 3405 0.68 0.90 0.63 160 TR_XM_PHPForged 3371 0.96 2.37 0.63 161 HTTPS_HTTP_MISMATCH 3340 0.60 0.50 0.62 162 TR_XM_FormFill2 3335 0.95 2.36 0.62 163 XM_H_PHPOS 3309 0.95 2.35 0.62 164 XM_B_REG_HTML 3252 0.57 0.40 0.61 165 T_Symld_Words_02 3237 0.78 1.55 0.60 166 XMMoneyMeta_00 3190 0.61 0.68 0.59 167 XM_ShortIntro_01 3125 0.53 0.32 0.58 168 XMPhish14 3104 0.69 1.16 0.58 169 XMLngstWrd_00 3093 0.56 0.49 0.58 170 TR_LOTS_OF_MONEY3 3029 0.75 1.55 0.56 171 RELAYCOUNTRY_DE 3001 0.60 0.78 0.56 172 MISSING_HEADERS 2993 0.57 0.65 0.56 173 XMPhish30 2987 0.66 1.11 0.56 174 SUBJ_DOLLARS 2980 0.76 1.65 0.55 175 XMBody_29 2958 0.55 0.57 0.55 176 FROM_GOV_DKIM_AU 2913 0.47 0.15 0.54 177 RCVD_IN_MSPIKE_H4 2861 0.49 0.33 0.53 178 XMLngstWrd_01 2819 0.51 0.46 0.52 179 XM_H_PHPMailer 2782 0.65 1.23 0.52 180 T_OBFU_PDF_ATTACH 2770 0.46 0.22 0.52 181 XMNoVowels 2751 0.48 0.36 0.51 182 AC_DIV_BONANZA 2720 0.44 0.15 0.51 183 XMBody_78 2707 0.62 1.09 0.50 184 HTML_TAG_BALANCE_BODY 2686 0.54 0.70 0.50 185 RELAYCOUNTRY_AU 2648 0.49 0.49 0.49 186 HTML_IMAGE_ONLY_20 2623 0.47 0.41 0.49 187 REMOVE_BEFORE_LINK 2552 0.48 0.49 0.47 188 DIET_1 2544 0.57 0.96 0.47 189 SpammyFromTLD_02 2504 1.89 7.92 0.47 190 TM2_M_BODY_EMPTY 2498 0.40 0.10 0.46 191 T_TooManySym_03 2485 0.41 0.18 0.46 192 XMHTMLBadTable_001 2478 0.47 0.52 0.46 193 HTML_IMAGE_ONLY_32 2469 0.42 0.25 0.46 194 RELAYCOUNTRY_FR 2442 0.80 2.27 0.45 195 USER_IN_WHITELIST 2430 0.37 0.00 0.45 196 DKIM_ADSP_NXDOMAIN 2412 0.69 1.70 0.45 197 FILL_THIS_FORM 2306 0.44 0.48 0.43 198 RCVD_IN_MSPIKE_L3 2290 0.48 0.68 0.43 199 PLING_QUERY 2284 0.54 1.03 0.43 200 US_DOLLARS_3 2280 0.57 1.16 0.42 ----------------------------------------------------------------------