Email: 469128 Autolearn: 0 AvgScore: 1.55 AvgScanTime: 2.28 sec Spam: 94672 Autolearn: 0 AvgScore: 11.54 AvgScanTime: 2.88 sec Ham: 374456 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 2.13 sec Time Spent Running SA: 297.13 hours Time Spent Processing Spam: 75.76 hours Time Spent Processing Ham: 221.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87942 90.37 92.89 89.73 2 DKIM_SIGNED 80660 85.43 85.20 85.48 3 XM_DK_Pass 77967 84.13 82.35 84.58 4 DCC_CHECK 75847 61.76 80.12 57.11 5 XM_B_Unicode 75565 76.88 79.82 76.14 6 DKIM_VALID 73200 80.59 77.32 81.42 7 XMListUnsubscribeExists 70668 67.41 74.65 65.58 8 DKIM_VALID_AU 60280 65.32 63.67 65.74 9 XM_B_Unicode3 54737 52.13 57.82 50.69 10 BAYES_50 43515 52.08 45.96 53.63 11 LOC_TINY_FONT_1 37144 35.35 39.23 34.37 12 XM_DK_Undo_02 37094 14.01 39.18 7.65 13 HTML_FONT_LOW_CONTRAST 33540 36.05 35.43 36.21 14 FVGT_m_MULTI_ODD 32001 24.88 33.80 22.62 15 MIME_HTML_ONLY 27325 24.81 28.86 23.79 16 BAYES_99 25597 8.57 27.04 3.90 17 XM_Body_Dirty_Words 24319 18.10 25.69 16.18 18 XMSubLong 23061 20.60 24.36 19.65 19 XM_Multi_Part_URI 22078 17.25 23.32 15.72 20 TR_DCC_Bayes_99 21358 6.22 22.56 2.09 21 BAYES_999 20657 6.94 21.82 3.18 22 RELAYCOUNTRY_META 20078 8.21 21.21 4.92 23 T_KAM_HTML_FONT_INVALID 19137 18.50 20.21 18.07 24 MultiRelay 18781 16.43 19.84 15.57 25 HTML_IMAGE_RATIO_02 18703 15.48 19.76 14.40 26 DKIM_VALID_EF 18539 24.84 19.58 26.16 27 BOTNET 18036 5.95 19.05 2.63 28 DCC_CHECK_NEGATIVE 17713 36.92 18.71 41.52 29 BOTNET_IPINHOSTNAME 17097 8.56 18.06 6.16 30 XM_Evil_Numbers_Gen 14977 14.13 15.82 13.71 31 T_TM2_M_HEADER_IN_MSG 13832 19.87 14.61 21.20 32 UNTRUSTED_Relay 13456 4.48 14.21 2.02 33 XM_B_Unsub 12219 10.66 12.91 10.09 34 XM_B_Phish_Phrases 11363 8.24 12.00 7.29 35 T_XMDrugObfuBody_14 10468 8.23 11.06 7.51 36 LOTS_OF_MONEY 9997 7.82 10.56 7.12 37 MPART_ALT_DIFF 9517 5.67 10.05 4.57 38 XMSexyCombo_05 9445 6.60 9.98 5.75 39 FSL_BULK_SIG 9442 8.49 9.97 8.11 40 XM_UB50 9402 2.73 9.93 0.91 41 XM_DIRTYINTL 9376 4.75 9.90 3.44 42 XM_SendGrid 9358 8.47 9.88 8.12 43 XM_UncommonTLD01 8610 5.11 9.09 4.10 44 HTML_IMAGE_RATIO_04 7839 9.34 8.28 9.61 45 MIME_HTML_MOSTLY 7503 4.89 7.93 4.12 46 DKIM_INVALID 7460 4.83 7.88 4.06 47 LotsOfNums_01 7057 9.11 7.45 9.53 48 TooManyTo_001 6916 6.48 7.31 6.27 49 XMSubMetaSx_00 6908 4.76 7.30 4.12 50 XM_H_Long_From01 6772 7.31 7.15 7.35 51 XM_B_SpammyTLD 6561 2.98 6.93 1.99 52 TR_XM_DK_SendGrid 6246 4.76 6.60 4.29 53 BAYES_80 5700 3.28 6.02 2.59 54 TR_XM_RelayPhish 5635 1.95 5.95 0.94 55 FROM_EXCESS_BASE64 5502 5.43 5.81 5.33 56 BAYES_60 5250 5.30 5.55 5.23 57 TM2_M_VERY_LONG_WORD 5143 2.12 5.43 1.29 58 RCVD_IN_MSPIKE_H2 5017 7.26 5.30 7.76 59 MIME_HTML_ONLY_MULTI 4887 2.57 5.16 1.91 60 RCVD_IN_RP_RNBL 4866 1.14 5.14 0.12 61 XMStockSpam_06 4729 2.16 5.00 1.45 62 MIME_QP_LONG_LINE 4487 5.54 4.74 5.75 63 URI_HEX 4313 3.10 4.56 2.73 64 XMNumbers 4049 3.77 4.28 3.64 65 XMBdyGiftCard01 4024 3.48 4.25 3.29 66 TM2_M_URI_OPT_OUT 4023 2.29 4.25 1.79 67 BAYES_40 3707 5.03 3.92 5.32 68 SpammyFromTLD_02 3572 0.97 3.77 0.26 69 RCVD_IN_BL_SPAMCOP_NET 3539 1.75 3.74 1.25 70 BOTNET_NORDNS 3488 0.76 3.68 0.02 71 XMStrtUSub 3401 5.15 3.59 5.54 72 T_TooManySym_01 3360 4.77 3.55 5.08 73 HTML_IMAGE_RATIO_06 3317 3.20 3.50 3.12 74 BAYES_95 3295 1.96 3.48 1.57 75 RELAYCOUNTRY_FR 3269 1.14 3.45 0.55 76 XMSubMetaI_00 3095 2.38 3.27 2.16 77 RELAYCOUNTRY_CA 3085 1.97 3.26 1.65 78 BAYES_20 3039 3.87 3.21 4.03 79 KHOP_HELO_FCRDNS 2946 1.77 3.11 1.43 80 XMSexyCombo_01 2894 1.08 3.06 0.58 81 NO_DNS_FOR_FROM 2889 1.67 3.05 1.32 82 HELO_NODOT 2878 0.93 3.04 0.39 83 XM_URI_RBL 2853 0.89 3.01 0.35 84 XMBody_17 2835 1.20 2.99 0.75 85 XM_SPF_SoftFail 2734 1.84 2.89 1.57 86 FSL_HELO_NON_FQDN_1 2731 0.61 2.88 0.03 87 XM_CamelCaseFrm001 2699 2.42 2.85 2.31 88 HTML_IMAGE_RATIO_08 2682 2.45 2.83 2.35 89 ADVANCE_FEE_2_NEW_MONEY 2571 0.55 2.72 0.00 90 T_REMOTE_IMAGE 2554 2.84 2.70 2.88 91 RELAYCOUNTRY_PS 2514 0.54 2.66 0.00 92 HELO_LOCALHOST 2512 0.56 2.65 0.03 93 BAYES_00 2439 17.03 2.58 20.69 94 SUBJ_ALL_CAPS 2266 2.46 2.39 2.48 95 XM_B_Unsub2 2229 1.30 2.35 1.04 96 T_XMHurry_00 2225 1.51 2.35 1.29 97 TR_XM_PHPDW 2169 0.90 2.29 0.55 98 SpammyFromTLD_01 2122 0.99 2.24 0.67 99 XMDiploma_00 2104 1.45 2.22 1.25 100 TR_XM_PHPForged 2085 0.87 2.20 0.54 101 RCVD_IN_RP_SAFE 2079 13.02 2.20 15.75 102 TR_XM_FormFill2 2071 0.86 2.19 0.53 103 XM_H_PHPOS 2064 0.86 2.18 0.53 104 RELAYCOUNTRY_AT 2050 0.68 2.17 0.30 105 HTML_MIME_NO_HTML_TAG 1992 1.56 2.10 1.43 106 RCVD_IN_MSPIKE_WL 1991 3.99 2.10 4.46 107 T_XMDrugObfuBody_08 1980 1.28 2.09 1.07 108 RCVD_IN_IADB_LISTED 1911 3.91 2.02 4.39 109 HTML_FONT_FACE_BAD 1882 0.97 1.99 0.71 110 BAYES_05 1862 2.56 1.97 2.71 111 RDNS_DYNAMIC 1797 0.73 1.90 0.44 112 RCVD_IN_IADB_SPF 1784 3.50 1.88 3.91 113 TR_XM_DK_Bayes 1780 15.57 1.88 19.04 114 RCVD_IN_IADB_DK 1769 3.14 1.87 3.47 115 RCVD_IN_IADB_SENDERID 1765 3.22 1.86 3.56 116 FROM_SUSPICIOUS_NTLD 1756 0.50 1.85 0.16 117 XMSubMetaSxObfu_03 1748 1.38 1.85 1.27 118 RCVD_IN_MSPIKE_H3 1728 3.33 1.83 3.71 119 LOW_PRICE 1726 0.90 1.82 0.66 120 FROM_SUSPICIOUS_NTLD_FP 1721 0.49 1.82 0.16 121 MultiRelay_CC 1711 0.48 1.81 0.15 122 MultiRelay_Combo 1711 0.48 1.81 0.15 123 XM_OfRef6 1685 1.52 1.78 1.46 124 TR_XM_INV_DKIM 1613 0.46 1.70 0.14 125 THIS_AD 1604 1.00 1.69 0.82 126 XMGenDplmaNmb 1585 0.97 1.67 0.80 127 RELAYCOUNTRY_GB 1558 0.80 1.65 0.59 128 TR_LOTS_OF_MONEY2 1557 1.21 1.64 1.10 129 TR_XM_DK_Bayes1 1557 14.98 1.64 18.36 130 T_MONEY_PERCENT 1557 1.21 1.64 1.10 131 TR_Mismatch_TLD_02 1522 0.38 1.61 0.07 132 DKIM_ADSP_NXDOMAIN 1507 0.74 1.59 0.53 133 RCVD_IN_MSPIKE_BL 1506 0.85 1.59 0.66 134 ALL_TRUSTED 1462 8.45 1.54 10.20 135 XM_H_PHPOS_M 1460 0.53 1.54 0.27 136 XM_H_PHPMailer 1443 0.72 1.52 0.52 137 URI_TRY_3LD 1430 1.61 1.51 1.63 138 XM_DK_Undo_01 1403 1.37 1.48 1.34 139 XMSexyCombo_04 1382 0.38 1.46 0.10 140 XM_ProductURIs 1333 1.71 1.41 1.79 141 TR_Symld_Words 1293 1.01 1.37 0.91 142 RCVD_IN_RP_CERTIFIED 1284 11.69 1.36 14.31 143 LongTLD 1241 0.49 1.31 0.28 144 XM_H_Long_From02 1212 1.76 1.28 1.89 145 T_TooManySym_02 1167 2.16 1.23 2.40 146 DATE_IN_PAST_03_06 1165 0.42 1.23 0.21 147 BOUNCE_MESSAGE 1144 1.33 1.21 1.37 148 ANY_BOUNCE_MESSAGE 1144 1.33 1.21 1.37 149 HTML_SHORT_LINK_IMG_1 1126 0.26 1.19 0.03 150 RELAYCOUNTRY_DE 1124 0.47 1.19 0.28 151 XM_B_COPY_HTML 1093 0.59 1.15 0.45 152 RCVD_IN_PSBL 1084 0.27 1.15 0.05 153 DIET_1 1080 0.64 1.14 0.52 154 TR_XM_DK_Bayes2 1080 13.58 1.14 16.72 155 LONG_HEX_URI 1070 0.37 1.13 0.17 156 T_XMDrugObfuBody_00 1041 0.66 1.10 0.55 157 XM_XX_Yahoo 1029 0.36 1.09 0.17 158 XMHTML_After_End 1027 1.03 1.08 1.02 159 XMBrknScrpt_02 1026 0.78 1.08 0.71 160 HTML_TAG_BALANCE_BODY 1024 0.99 1.08 0.97 161 URIBL_DBL_SPAM 1011 0.26 1.07 0.06 162 RCVD_IN_MSPIKE_L5 984 0.34 1.04 0.16 163 XMPhish30 978 0.76 1.03 0.69 164 PLING_QUERY 939 1.06 0.99 1.07 165 FSL_THIS_IS_ADV 928 0.52 0.98 0.41 166 XMSubMetaSSx_00 917 0.31 0.97 0.14 167 UNPARSEABLE_RELAY 914 2.52 0.97 2.92 168 XMPhish11 897 0.82 0.95 0.79 169 RELAYCOUNTRY_PL 873 0.23 0.92 0.05 170 XMPhish14 863 0.52 0.91 0.42 171 XMSubMetaSx_01 860 0.25 0.91 0.08 172 US_DOLLARS_3 832 0.55 0.88 0.47 173 DKIM_ADSP_CUSTOM_MED 819 1.06 0.87 1.11 174 MAILING_LIST_MULTI 805 1.70 0.85 1.91 175 TM2_M_A_HREF_HREF 795 0.53 0.84 0.46 176 XMSubNoVowel 793 0.31 0.84 0.18 177 TR_MetaPhish_Combo_01 791 0.71 0.84 0.68 178 SHOPIFY_IMG_NOT_RCVD_SFY 788 0.46 0.83 0.36 179 T_Symld_Words_02 760 0.54 0.80 0.47 180 XMSexyCombo_02 753 0.18 0.80 0.02 181 HTML_COMMENT_SAVED_URL 750 0.22 0.79 0.08 182 XMGppyBdWords 750 0.41 0.79 0.32 183 XMLngstWrd_00 723 0.56 0.76 0.50 184 XMSolicitRefs_0 707 0.37 0.75 0.27 185 TR_LOTS_OF_MONEY3 705 0.45 0.74 0.37 186 XMHTMLBadTable_001 698 0.60 0.74 0.57 187 XMLngstWrd_01 694 0.53 0.73 0.47 188 REPLYTO_WITHOUT_TO_CC 689 0.17 0.73 0.02 189 XMBody_78 687 0.68 0.73 0.67 190 FORGED_GMAIL_RCVD 673 0.74 0.71 0.74 191 NML_ADSP_CUSTOM_MED 672 0.78 0.71 0.79 192 XMBody_29 668 0.31 0.71 0.21 193 URI_NO_WWW_INFO_CGI 667 0.32 0.70 0.23 194 HTML_IMAGE_ONLY_08 667 0.21 0.70 0.09 195 MIME_CHARSET_FARAWAY 664 0.22 0.70 0.09 196 XM_OfRef7 663 0.24 0.70 0.12 197 CK_HELO_DYNAMIC_SPLIT_IP 661 1.81 0.70 2.09 198 HTML_IMAGE_ONLY_12 656 0.22 0.69 0.10 199 XM_BadFromFormat 645 0.21 0.68 0.09 200 MIME_HEADER_CTYPE_ONLY 644 0.21 0.68 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 335989 90.37 92.89 89.73 2 DKIM_SIGNED 320101 85.43 85.20 85.48 3 XM_DK_Pass 316705 84.13 82.35 84.58 4 DKIM_VALID 304892 80.59 77.32 81.42 5 XM_B_Unicode 285106 76.88 79.82 76.14 6 DKIM_VALID_AU 246158 65.32 63.67 65.74 7 XMListUnsubscribeExists 245562 67.41 74.65 65.58 8 DCC_CHECK 213868 61.76 80.12 57.11 9 BAYES_50 200816 52.08 45.96 53.63 10 XM_B_Unicode3 189830 52.13 57.82 50.69 11 DCC_CHECK_NEGATIVE 155468 36.92 18.71 41.52 12 HTML_FONT_LOW_CONTRAST 135593 36.05 35.43 36.21 13 LOC_TINY_FONT_1 128692 35.35 39.23 34.37 14 DKIM_VALID_EF 97969 24.84 19.58 26.16 15 MIME_HTML_ONLY 89082 24.81 28.86 23.79 16 FVGT_m_MULTI_ODD 84707 24.88 33.80 22.62 17 T_TM2_M_HEADER_IN_MSG 79401 19.87 14.61 21.20 18 BAYES_00 77473 17.03 2.58 20.69 19 XMSubLong 73591 20.60 24.36 19.65 20 TR_XM_DK_Bayes 71285 15.57 1.88 19.04 21 TR_XM_DK_Bayes1 68738 14.98 1.64 18.36 22 T_KAM_HTML_FONT_INVALID 67674 18.50 20.21 18.07 23 TR_XM_DK_Bayes2 62624 13.58 1.14 16.72 24 XM_Body_Dirty_Words 60598 18.10 25.69 16.18 25 RCVD_IN_RP_SAFE 58990 13.02 2.20 15.75 26 XM_Multi_Part_URI 58862 17.25 23.32 15.72 27 MultiRelay 58288 16.43 19.84 15.57 28 HTML_IMAGE_RATIO_02 53908 15.48 19.76 14.40 29 RCVD_IN_RP_CERTIFIED 53575 11.69 1.36 14.31 30 XM_Evil_Numbers_Gen 51332 14.13 15.82 13.71 31 XM_DKIMWhitelistDomains 39629 8.46 0.05 10.58 32 ALL_TRUSTED 38189 8.45 1.54 10.20 33 XM_B_Unsub 37784 10.66 12.91 10.09 34 HTML_IMAGE_RATIO_04 35970 9.34 8.28 9.61 35 LotsOfNums_01 35700 9.11 7.45 9.53 36 XM_SendGrid 30393 8.47 9.88 8.12 37 FSL_BULK_SIG 30374 8.49 9.97 8.11 38 RCVD_IN_MSPIKE_H2 29051 7.26 5.30 7.76 39 XM_DK_Undo_02 28648 14.01 39.18 7.65 40 T_XMDrugObfuBody_14 28118 8.23 11.06 7.51 41 XM_H_Long_From01 27539 7.31 7.15 7.35 42 XM_B_Phish_Phrases 27308 8.24 12.00 7.29 43 LOTS_OF_MONEY 26677 7.82 10.56 7.12 44 TooManyTo_001 23479 6.48 7.31 6.27 45 BOTNET_IPINHOSTNAME 23066 8.56 18.06 6.16 46 MIME_QP_LONG_LINE 21521 5.54 4.74 5.75 47 XMSexyCombo_05 21520 6.60 9.98 5.75 48 XMStrtUSub 20756 5.15 3.59 5.54 49 FROM_EXCESS_BASE64 19970 5.43 5.81 5.33 50 BAYES_40 19912 5.03 3.92 5.32 51 BAYES_60 19597 5.30 5.55 5.23 52 T_TooManySym_01 19013 4.77 3.55 5.08 53 RELAYCOUNTRY_META 18430 8.21 21.21 4.92 54 MPART_ALT_DIFF 17106 5.67 10.05 4.57 55 RCVD_IN_MSPIKE_WL 16713 3.99 2.10 4.46 56 RCVD_IN_IADB_LISTED 16430 3.91 2.02 4.39 57 TR_XM_DK_SendGrid 16075 4.76 6.60 4.29 58 MIME_HTML_MOSTLY 15441 4.89 7.93 4.12 59 XMSubMetaSx_00 15429 4.76 7.30 4.12 60 XM_UncommonTLD01 15350 5.11 9.09 4.10 61 DKIM_INVALID 15209 4.83 7.88 4.06 62 BAYES_20 15098 3.87 3.21 4.03 63 RCVD_IN_IADB_SPF 14649 3.50 1.88 3.91 64 BAYES_99 14592 8.57 27.04 3.90 65 RCVD_IN_MSPIKE_H3 13905 3.33 1.83 3.71 66 XMNumbers 13637 3.77 4.28 3.64 67 RCVD_IN_IADB_SENDERID 13345 3.22 1.86 3.56 68 RCVD_IN_IADB_DK 12981 3.14 1.87 3.47 69 XM_DIRTYINTL 12889 4.75 9.90 3.44 70 XMBdyGiftCard01 12324 3.48 4.25 3.29 71 IN_ZIMBRA_NJ_WHITELIST 12241 2.61 0.01 3.27 72 BAYES_999 11919 6.94 21.82 3.18 73 HTML_IMAGE_RATIO_06 11678 3.20 3.50 3.12 74 UNPARSEABLE_RELAY 10919 2.52 0.97 2.92 75 T_REMOTE_IMAGE 10783 2.84 2.70 2.88 76 TVD_RCVD_IP 10492 2.31 0.39 2.80 77 URI_HEX 10207 3.10 4.56 2.73 78 BAYES_05 10156 2.56 1.97 2.71 79 BOTNET 9861 5.95 19.05 2.63 80 BAYES_80 9687 3.28 6.02 2.59 81 SUBJ_ALL_CAPS 9285 2.46 2.39 2.48 82 RCVD_IN_IADB_VOUCHED 9242 2.07 0.49 2.47 83 T_TooManySym_02 8986 2.16 1.23 2.40 84 HTML_IMAGE_RATIO_08 8816 2.45 2.83 2.35 85 XM_CamelCaseFrm001 8665 2.42 2.85 2.31 86 XMSubMetaI_00 8072 2.38 3.27 2.16 87 XM_PDF 7883 1.74 0.28 2.11 88 TR_DCC_Bayes_99 7827 6.22 22.56 2.09 89 CK_HELO_DYNAMIC_SPLIT_IP 7823 1.81 0.70 2.09 90 HELO_DYNAMIC_IPADDR2 7819 1.69 0.09 2.09 91 UNTRUSTED_Relay 7558 4.48 14.21 2.02 92 INVALID_MSGID 7458 1.62 0.16 1.99 93 XM_B_SpammyTLD 7437 2.98 6.93 1.99 94 MIME_HTML_ONLY_MULTI 7163 2.57 5.16 1.91 95 MAILING_LIST_MULTI 7148 1.70 0.85 1.91 96 XM_H_Long_From02 7065 1.76 1.28 1.89 97 TM2_M_URI_OPT_OUT 6712 2.29 4.25 1.79 98 XM_ProductURIs 6693 1.71 1.41 1.79 99 TO_MALFORMED 6560 1.40 0.01 1.75 100 RELAYCOUNTRY_CA 6160 1.97 3.26 1.65 101 URI_TRY_3LD 6112 1.61 1.51 1.63 102 IN_HORDE_ADDRESS_BOOK 6029 1.29 0.01 1.61 103 BAYES_95 5895 1.96 3.48 1.57 104 XM_SPF_SoftFail 5884 1.84 2.89 1.57 105 RCVD_IN_IADB_OPTIN 5865 1.37 0.61 1.57 106 USER_IN_DEF_DKIM_WL 5784 1.23 0.00 1.54 107 XM_OfRef6 5466 1.52 1.78 1.46 108 XMStockSpam_06 5411 2.16 5.00 1.45 109 KHOP_HELO_FCRDNS 5350 1.77 3.11 1.43 110 HTML_MIME_NO_HTML_TAG 5346 1.56 2.10 1.43 111 BOUNCE_MESSAGE 5114 1.33 1.21 1.37 112 ANY_BOUNCE_MESSAGE 5114 1.33 1.21 1.37 113 XM_DK_Undo_01 5002 1.37 1.48 1.34 114 NO_DNS_FOR_FROM 4928 1.67 3.05 1.32 115 T_XMHurry_00 4840 1.51 2.35 1.29 116 TM2_M_VERY_LONG_WORD 4823 2.12 5.43 1.29 117 XMSubMetaSxObfu_03 4741 1.38 1.85 1.27 118 XMDiploma_00 4690 1.45 2.22 1.25 119 RCVD_IN_BL_SPAMCOP_NET 4671 1.75 3.74 1.25 120 DKIM_ADSP_CUSTOM_MED 4165 1.06 0.87 1.11 121 T_MONEY_PERCENT 4122 1.21 1.64 1.10 122 TR_LOTS_OF_MONEY2 4122 1.21 1.64 1.10 123 T_XMDrugObfuBody_08 4018 1.28 2.09 1.07 124 PLING_QUERY 4013 1.06 0.99 1.07 125 XM_B_Unsub2 3881 1.30 2.35 1.04 126 XMHTML_After_End 3803 1.03 1.08 1.02 127 XMBody_95 3788 0.84 0.18 1.01 128 XM_RXBody 3629 0.85 0.40 0.97 129 HTML_TAG_BALANCE_BODY 3628 0.99 1.08 0.97 130 FILL_THIS_FORM 3592 0.86 0.44 0.96 131 TR_XM_RelayPhish 3504 1.95 5.95 0.94 132 TR_Symld_Words 3422 1.01 1.37 0.91 133 XM_UB50 3419 2.73 9.93 0.91 134 XMGappySubj_01 3351 0.76 0.21 0.89 135 TooManyTo_002 3334 0.85 0.68 0.89 136 SUBJ_DOLLARS 3328 0.83 0.58 0.89 137 FILL_THIS_FORM_LONG 3309 0.78 0.35 0.88 138 XM_GoogleGroups 3259 0.76 0.34 0.87 139 T_FILL_THIS_FORM_LOAN 3224 0.72 0.14 0.86 140 XM_SPF_Unknown 3191 0.80 0.57 0.85 141 THIS_AD 3078 1.00 1.69 0.82 142 XMGenDplmaNmb 2987 0.97 1.67 0.80 143 NML_ADSP_CUSTOM_MED 2965 0.78 0.71 0.79 144 XMPhish11 2942 0.82 0.95 0.79 145 XMBody_17 2796 1.20 2.99 0.75 146 FORGED_GMAIL_RCVD 2778 0.74 0.71 0.74 147 T_TooManySym_03 2749 0.62 0.15 0.73 148 HTML_FONT_FACE_BAD 2659 0.97 1.99 0.71 149 XMBrknScrpt_02 2644 0.78 1.08 0.71 150 XMPhish30 2581 0.76 1.03 0.69 151 TR_MetaPhish_Combo_01 2544 0.71 0.84 0.68 152 SpammyFromTLD_01 2525 0.99 2.24 0.67 153 XMBSHREFv2 2524 0.63 0.43 0.67 154 XMBody_78 2508 0.68 0.73 0.67 155 LOW_PRICE 2473 0.90 1.82 0.66 156 RCVD_IN_MSPIKE_BL 2459 0.85 1.59 0.66 157 URIBL_CSS 2410 0.61 0.46 0.64 158 URIBL_CSS_A 2410 0.61 0.46 0.64 159 TooManyTo_003 2333 0.62 0.59 0.62 160 HTML_FONT_SIZE_LARGE 2297 0.57 0.39 0.61 161 XM_B_REG_HTML 2284 0.61 0.62 0.61 162 URI_NOVOWEL 2279 0.57 0.42 0.61 163 RELAYCOUNTRY_GB 2211 0.80 1.65 0.59 164 XMSexyCombo_01 2163 1.08 3.06 0.58 165 XMHTMLBadTable_001 2135 0.60 0.74 0.57 166 XM_shorewaves_Whitelist 2107 0.45 0.00 0.56 167 RELAYCOUNTRY_FR 2077 1.14 3.45 0.55 168 TR_XM_PHPDW 2067 0.90 2.29 0.55 169 T_XMDrugObfuBody_00 2054 0.66 1.10 0.55 170 USER_IN_WHITELIST 2025 0.43 0.00 0.54 171 TR_XM_PHPForged 2005 0.87 2.20 0.54 172 TR_XM_FormFill2 1986 0.86 2.19 0.53 173 RCVD_IN_MSPIKE_H4 1984 0.46 0.20 0.53 174 DKIM_ADSP_NXDOMAIN 1973 0.74 1.59 0.53 175 XM_H_PHPOS 1972 0.86 2.18 0.53 176 DIET_1 1939 0.64 1.14 0.52 177 XM_H_PHPMailer 1936 0.72 1.52 0.52 178 XMSubMetaSxObfu_02 1935 0.51 0.49 0.52 179 TooManyTo_004 1928 0.52 0.52 0.51 180 REMOVE_BEFORE_LINK 1917 0.50 0.44 0.51 181 XMLngstWrd_00 1889 0.56 0.76 0.50 182 XMOemUri 1855 0.43 0.19 0.50 183 XMLngstWrd_01 1776 0.53 0.73 0.47 184 T_Symld_Words_02 1771 0.54 0.80 0.47 185 US_DOLLARS_3 1761 0.55 0.88 0.47 186 XMUrgent 1751 0.45 0.40 0.47 187 TM2_M_A_HREF_HREF 1714 0.53 0.84 0.46 188 MISSING_HEADERS 1701 0.42 0.29 0.45 189 TooManyTo_005 1700 0.45 0.46 0.45 190 XM_B_COPY_HTML 1678 0.59 1.15 0.45 191 RDNS_DYNAMIC 1629 0.73 1.90 0.44 192 BODY_ENHANCEMENT 1580 0.34 0.02 0.42 193 XMPhish14 1565 0.52 0.91 0.42 194 FSL_THIS_IS_ADV 1527 0.52 0.98 0.41 195 T_FILL_THIS_FORM_SHORT 1524 0.43 0.53 0.41 196 HELO_NODOT 1478 0.93 3.04 0.39 197 TR_Mismatch_TLD_01 1466 0.45 0.67 0.39 198 XM_Ancestry_Forge 1458 0.32 0.02 0.39 199 RELAYCOUNTRY_AU 1446 0.40 0.46 0.39 200 NUMERIC_HTTP_ADDR 1414 0.37 0.35 0.38 ----------------------------------------------------------------------