Email: 675441 Autolearn: 0 AvgScore: 1.71 AvgScanTime: 3.18 sec Spam: 134307 Autolearn: 0 AvgScore: 12.48 AvgScanTime: 3.51 sec Ham: 541134 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 3.10 sec Time Spent Running SA: 596.59 hours Time Spent Processing Spam: 130.81 hours Time Spent Processing Ham: 465.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130151 91.05 96.91 89.59 2 DCC_CHECK 110454 52.53 82.24 45.16 3 DKIM_SIGNED 101860 77.30 75.84 77.66 4 XM_B_Unicode 101744 72.33 75.75 71.48 5 XM_DK_Pass 98829 75.90 73.58 76.47 6 DKIM_VALID 93266 72.45 69.44 73.19 7 XMListUnsubscribeExists 87267 58.12 64.98 56.42 8 DKIM_VALID_AU 72129 55.16 53.70 55.52 9 XM_B_Unicode3 64320 43.70 47.89 42.67 10 BAYES_50 59298 52.66 44.15 54.78 11 MIME_HTML_ONLY 49714 24.01 37.02 20.78 12 XM_DK_Undo_02 48673 12.75 36.24 6.92 13 LOC_TINY_FONT_1 47218 27.49 35.16 25.59 14 HTML_FONT_LOW_CONTRAST 44676 29.53 33.26 28.61 15 BAYES_99 35697 8.38 26.58 3.86 16 FVGT_m_MULTI_ODD 34885 22.75 25.97 21.95 17 XMSubLong 34500 22.70 25.69 21.95 18 XM_Body_Dirty_Words 30315 15.78 22.57 14.10 19 DKIM_VALID_EF 28952 25.66 21.56 26.68 20 TR_DCC_Bayes_99 28806 5.68 21.45 1.77 21 T_KAM_HTML_FONT_INVALID 27837 19.53 20.73 19.23 22 BAYES_999 27798 6.65 20.70 3.16 23 FSL_BULK_SIG 27600 9.39 20.55 6.61 24 XM_Multi_Part_URI 27215 13.92 20.26 12.35 25 HTML_IMAGE_RATIO_02 25351 10.68 18.88 8.64 26 BOTNET 25218 5.30 18.78 1.96 27 XM_UncommonTLD01 23556 6.40 17.54 3.64 28 BOTNET_IPINHOSTNAME 23346 7.03 17.38 4.46 29 RELAYCOUNTRY_META 22721 7.88 16.92 5.63 30 T_TM2_M_HEADER_IN_MSG 22718 25.27 16.91 27.34 31 MultiRelay 21599 17.43 16.08 17.76 32 DCC_CHECK_NEGATIVE 21575 45.54 16.06 52.85 33 XM_B_Unsub 20600 10.30 15.34 9.05 34 XMSexyCombo_05 18150 6.18 13.51 4.37 35 LOTS_OF_MONEY 17254 9.29 12.85 8.41 36 XM_Evil_Numbers_Gen 16427 10.69 12.23 10.31 37 RCVD_IN_MSPIKE_H2 15092 13.20 11.24 13.68 38 XM_H_Long_From01 14062 7.19 10.47 6.38 39 UNTRUSTED_Relay 13821 3.42 10.29 1.72 40 MPART_ALT_DIFF 13467 5.31 10.03 4.13 41 HTML_MIME_NO_HTML_TAG 12488 3.69 9.30 2.29 42 KHOP_HELO_FCRDNS 12154 3.46 9.05 2.08 43 T_XMDrugObfuBody_14 11354 8.81 8.45 8.90 44 T_REMOTE_IMAGE 10856 4.82 8.08 4.01 45 XMSubMetaSx_00 10625 4.09 7.91 3.14 46 LotsOfNums_01 10457 8.49 7.79 8.67 47 BAYES_80 10409 3.82 7.75 2.85 48 RDNS_DYNAMIC 10060 1.78 7.49 0.37 49 XM_B_Phish_Phrases 10048 6.67 7.48 6.47 50 SpammyFromTLD_02 9144 1.60 6.81 0.31 51 MIME_HTML_MOSTLY 9067 3.53 6.75 2.73 52 TR_Mismatch_TLD_02 9029 1.39 6.72 0.06 53 HTML_IMAGE_RATIO_04 8904 7.34 6.63 7.52 54 TooManyTo_001 8856 7.39 6.59 7.59 55 DKIM_INVALID 8594 4.85 6.40 4.46 56 BAYES_60 8142 5.53 6.06 5.40 57 XM_DIRTYINTL 7945 3.42 5.92 2.80 58 MIME_QP_LONG_LINE 7140 6.37 5.32 6.63 59 XM_UB50 7007 1.79 5.22 0.95 60 RCVD_IN_MSPIKE_WL 6919 9.93 5.15 11.12 61 XMNumbers 6385 3.36 4.75 3.01 62 XM_SPF_SoftFail 6384 2.46 4.75 1.90 63 RCVD_IN_MSPIKE_H3 6087 9.65 4.53 10.92 64 HTML_IMAGE_RATIO_06 6082 3.77 4.53 3.59 65 MIME_HTML_ONLY_MULTI 5996 2.79 4.46 2.38 66 XM_SendGrid 5961 6.01 4.44 6.40 67 TO_NO_BRKTS_DYNIP 5865 0.87 4.37 0.00 68 BAYES_40 5632 5.29 4.19 5.56 69 BAYES_95 5585 2.16 4.16 1.67 70 HTML_SHORT_LINK_IMG_1 5407 0.82 4.03 0.02 71 TM2_M_URI_OPT_OUT 5271 2.65 3.92 2.33 72 FROM_SUSPICIOUS_NTLD 5190 0.87 3.86 0.12 73 RCVD_IN_BL_SPAMCOP_NET 5181 1.80 3.86 1.29 74 HTML_IMAGE_ONLY_08 5160 0.85 3.84 0.11 75 XMStrtUSub 5147 4.56 3.83 4.74 76 FROM_SUSPICIOUS_NTLD_FP 5137 0.86 3.82 0.12 77 DKIM_ADSP_NXDOMAIN 5126 1.51 3.82 0.94 78 XM_CamelCaseFrm001 5051 2.76 3.76 2.51 79 URI_HEX 4973 2.12 3.70 1.73 80 RELAYCOUNTRY_CA 4887 2.04 3.64 1.64 81 HTML_IMAGE_RATIO_08 4716 2.93 3.51 2.78 82 FROM_EXCESS_BASE64 4698 3.49 3.50 3.48 83 SpammyFromTLD_01 4492 1.26 3.34 0.74 84 XM_B_SpammyTLD 4387 2.45 3.27 2.25 85 BAYES_20 4140 4.13 3.08 4.39 86 XM_URI_RBL 4033 0.84 3.00 0.31 87 URI_TRY_3LD 3825 2.05 2.85 1.85 88 T_TooManySym_01 3780 4.21 2.81 4.56 89 XMBody_17 3763 1.47 2.80 1.14 90 MIME_HEADER_CTYPE_ONLY 3657 0.60 2.72 0.07 91 RELAYCOUNTRY_FR 3573 0.82 2.66 0.36 92 XMDiploma_00 3544 1.77 2.64 1.55 93 XMBdyGiftCard01 3507 1.91 2.61 1.74 94 NORDNS_LOW_CONTRAST 3362 0.50 2.50 0.00 95 REPLYTO_WITHOUT_TO_CC 3327 0.52 2.48 0.03 96 T_XMDrugObfuBody_08 3319 1.64 2.47 1.43 97 T_HTML_TAG_BALANCE_CENTER 3195 0.57 2.38 0.13 98 XM_OfRef6 3103 1.51 2.31 1.31 99 XM_B_Unsub2 3072 1.69 2.29 1.54 100 RCVD_IN_RP_RNBL 3029 0.52 2.26 0.09 101 TR_XM_DK_SendGrid 2994 3.20 2.23 3.44 102 RCVD_IN_IADB_LISTED 2943 4.74 2.19 5.38 103 T_XMHurry_00 2942 1.15 2.19 0.89 104 MultiRelay_CC 2938 0.66 2.19 0.28 105 MultiRelay_Combo 2938 0.66 2.19 0.28 106 RELAYCOUNTRY_GB 2928 1.20 2.18 0.96 107 RCVD_IN_PSBL 2924 0.46 2.18 0.03 108 BODY_URI_ONLY 2916 0.49 2.17 0.07 109 XMSexyCombo_01 2852 0.82 2.12 0.50 110 NO_DNS_FOR_FROM 2769 1.63 2.06 1.52 111 TR_LOTS_OF_MONEY3 2763 1.04 2.06 0.78 112 RCVD_IN_IADB_SPF 2702 4.19 2.01 4.73 113 XMGenDplmaNmb 2697 1.19 2.01 0.99 114 RCVD_IN_IADB_DK 2656 3.71 1.98 4.14 115 BAYES_00 2650 14.96 1.97 18.18 116 XMStockSpam_06 2649 1.50 1.97 1.38 117 RCVD_IN_IADB_SENDERID 2646 3.75 1.97 4.20 118 HDRS_LCASE_IMGONLY 2642 0.41 1.97 0.02 119 DATE_IN_PAST_03_06 2604 0.55 1.94 0.20 120 TO_EQ_FM_DOM_HTML_IMG 2598 0.39 1.93 0.01 121 HTML_IMAGE_ONLY_20 2430 0.73 1.81 0.46 122 RCVD_IN_RP_SAFE 2409 9.02 1.79 10.81 123 HDRS_MISSP 2387 0.36 1.78 0.00 124 TR_XM_PHPDW 2341 1.62 1.74 1.59 125 SHORT_IMG_SUSP_NTLD 2320 0.34 1.73 0.00 126 TM2_M_VERY_LONG_WORD 2316 1.41 1.72 1.34 127 TR_XM_RelayPhish 2257 1.19 1.68 1.07 128 TR_XM_INV_DKIM 2250 0.45 1.68 0.15 129 TR_XM_PHPForged 2232 1.60 1.66 1.58 130 TR_XM_FormFill2 2219 1.59 1.65 1.58 131 XM_H_PHPOS 2212 1.59 1.65 1.58 132 XMHTML_After_End 2206 1.37 1.64 1.31 133 BOTNET_NORDNS 2190 0.37 1.63 0.05 134 TR_Symld_Words 2188 1.73 1.63 1.76 135 XMSubMetaI_00 2150 0.85 1.60 0.66 136 BAYES_05 2122 2.46 1.58 2.68 137 XM_DrugUnitList 2107 0.31 1.57 0.00 138 ALIBABA_IMG_NOT_RCVD_ALI 2099 0.31 1.56 0.00 139 T_XMDrugObfuBody_00 2013 0.87 1.50 0.71 140 XMPhish14 1839 0.62 1.37 0.43 141 XM_UB99 1830 0.28 1.36 0.01 142 PLING_QUERY 1798 0.87 1.34 0.76 143 UNPARSEABLE_RELAY 1769 1.97 1.32 2.14 144 XMBrknScrpt_02 1766 0.91 1.31 0.81 145 HOSTED_IMG_DIRECT_MX 1763 0.26 1.31 0.00 146 RCVD_IN_RP_CERTIFIED 1763 7.89 1.31 9.52 147 MAILING_LIST_MULTI 1727 2.39 1.29 2.66 148 HOSTED_IMG_MULTI 1712 0.25 1.27 0.00 149 URIBL_DBL_SPAM 1697 0.28 1.26 0.04 150 XM_DK_Undo_01 1697 1.43 1.26 1.47 151 XM_H_Long_From02 1680 1.44 1.25 1.49 152 SUBJ_ALL_CAPS 1679 1.37 1.25 1.40 153 T_MONEY_PERCENT 1656 0.62 1.23 0.47 154 TR_LOTS_OF_MONEY2 1656 0.62 1.23 0.47 155 XMSubMetaSSx_00 1651 0.37 1.23 0.15 156 XM_BadFromFormat 1649 0.32 1.23 0.09 157 TR_XM_DK_Bayes 1647 11.68 1.23 14.28 158 TR_MetaPhish_Combo_01 1582 0.98 1.18 0.93 159 T_Symld_Words_02 1570 0.62 1.17 0.49 160 DATE_IN_PAST_06_12 1504 0.43 1.12 0.26 161 ALL_TRUSTED 1498 10.74 1.12 13.13 162 TR_XM_DK_Bayes1 1496 11.21 1.11 13.72 163 LongTLD 1479 0.37 1.10 0.18 164 FROM_MISSP_DYNIP 1479 0.22 1.10 0.00 165 XMPhish11 1444 1.11 1.08 1.12 166 DIET_1 1432 0.60 1.07 0.49 167 XM_ProductURIs 1411 1.13 1.05 1.15 168 XM_UB999 1392 0.21 1.04 0.00 169 FROM_MISSP_REPLYTO 1370 0.21 1.02 0.00 170 RELAYCOUNTRY_AT 1369 0.38 1.02 0.23 171 XM_H_PHPMailer 1350 1.37 1.01 1.47 172 HK_RANDOM_FROM 1340 0.29 1.00 0.11 173 MISSING_HEADERS 1334 0.54 0.99 0.43 174 RCVD_IN_MSPIKE_BL 1330 1.37 0.99 1.47 175 HK_RANDOM_REPLYTO 1318 0.40 0.98 0.25 176 SUBJECT_NEEDS_ENCODING 1296 0.20 0.96 0.01 177 SUBJ_ILLEGAL_CHARS 1296 0.20 0.96 0.01 178 THIS_AD 1268 0.43 0.94 0.30 179 XMNoVowels 1250 0.77 0.93 0.74 180 RELAYCOUNTRY_IN 1250 0.30 0.93 0.14 181 HTML_FONT_FACE_BAD 1248 0.88 0.93 0.87 182 XMSubGiftCard1 1243 0.32 0.93 0.17 183 FILL_THIS_FORM 1162 0.52 0.87 0.43 184 XMBody_78 1162 0.64 0.87 0.58 185 LONG_HEX_URI 1142 0.35 0.85 0.22 186 XMPhish30 1116 0.61 0.83 0.56 187 XMSexyCombo_04 1115 0.26 0.83 0.12 188 XM_UB60 1101 0.25 0.82 0.11 189 AMAZON_IMG_NOT_RCVD_AMZN 1101 0.19 0.82 0.04 190 XM_OfRef7 1091 0.26 0.81 0.12 191 MONEY_BACK 1087 0.24 0.81 0.10 192 DATE_IN_PAST_12_24 1075 0.23 0.80 0.08 193 XMSlimDrugH 1073 0.55 0.80 0.49 194 T_FILL_THIS_FORM_SHORT 1061 0.71 0.79 0.69 195 HTML_IMAGE_ONLY_32 1037 0.51 0.77 0.45 196 TR_XM_DK_Bayes2 1007 10.04 0.75 12.34 197 BANG_GUAR 1004 0.17 0.75 0.03 198 XMSubMetaSxObfu_03 1004 0.47 0.75 0.40 199 URIBL_DBL_ABUSE_REDIR 1002 0.15 0.75 0.00 200 LOW_PRICE 1001 0.26 0.75 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 484814 91.05 96.91 89.59 2 DKIM_SIGNED 420240 77.30 75.84 77.66 3 XM_DK_Pass 413821 75.90 73.58 76.47 4 DKIM_VALID 396083 72.45 69.44 73.19 5 XM_B_Unicode 386814 72.33 75.75 71.48 6 XMListUnsubscribeExists 305300 58.12 64.98 56.42 7 DKIM_VALID_AU 300445 55.16 53.70 55.52 8 BAYES_50 296422 52.66 44.15 54.78 9 DCC_CHECK_NEGATIVE 286013 45.54 16.06 52.85 10 DCC_CHECK 244381 52.53 82.24 45.16 11 XM_B_Unicode3 230881 43.70 47.89 42.67 12 HTML_FONT_LOW_CONTRAST 154801 29.53 33.26 28.61 13 T_TM2_M_HEADER_IN_MSG 147955 25.27 16.91 27.34 14 DKIM_VALID_EF 144393 25.66 21.56 26.68 15 LOC_TINY_FONT_1 138488 27.49 35.16 25.59 16 XMSubLong 118800 22.70 25.69 21.95 17 FVGT_m_MULTI_ODD 118795 22.75 25.97 21.95 18 MIME_HTML_ONLY 112434 24.01 37.02 20.78 19 T_KAM_HTML_FONT_INVALID 104065 19.53 20.73 19.23 20 BAYES_00 98399 14.96 1.97 18.18 21 MultiRelay 96131 17.43 16.08 17.76 22 TR_XM_DK_Bayes 77255 11.68 1.23 14.28 23 XM_Body_Dirty_Words 76299 15.78 22.57 14.10 24 TR_XM_DK_Bayes1 74225 11.21 1.11 13.72 25 RCVD_IN_MSPIKE_H2 74034 13.20 11.24 13.68 26 ALL_TRUSTED 71054 10.74 1.12 13.13 27 XM_Multi_Part_URI 66820 13.92 20.26 12.35 28 TR_XM_DK_Bayes2 66790 10.04 0.75 12.34 29 RCVD_IN_MSPIKE_WL 60182 9.93 5.15 11.12 30 RCVD_IN_MSPIKE_H3 59088 9.65 4.53 10.92 31 RCVD_IN_RP_SAFE 58515 9.02 1.79 10.81 32 XM_Evil_Numbers_Gen 55775 10.69 12.23 10.31 33 RCVD_IN_RP_CERTIFIED 51530 7.89 1.31 9.52 34 XM_B_Unsub 48995 10.30 15.34 9.05 35 T_XMDrugObfuBody_14 48134 8.81 8.45 8.90 36 LotsOfNums_01 46919 8.49 7.79 8.67 37 HTML_IMAGE_RATIO_02 46773 10.68 18.88 8.64 38 LOTS_OF_MONEY 45492 9.29 12.85 8.41 39 XM_DKIMWhitelistDomains 43936 6.51 0.02 8.12 40 TooManyTo_001 41087 7.39 6.59 7.59 41 HTML_IMAGE_RATIO_04 40688 7.34 6.63 7.52 42 XM_DK_Undo_02 37461 12.75 36.24 6.92 43 MIME_QP_LONG_LINE 35877 6.37 5.32 6.63 44 FSL_BULK_SIG 35795 9.39 20.55 6.61 45 XM_B_Phish_Phrases 35025 6.67 7.48 6.47 46 XM_SendGrid 34654 6.01 4.44 6.40 47 XM_H_Long_From01 34498 7.19 10.47 6.38 48 RELAYCOUNTRY_META 30481 7.88 16.92 5.63 49 BAYES_40 30103 5.29 4.19 5.56 50 BAYES_60 29228 5.53 6.06 5.40 51 RCVD_IN_IADB_LISTED 29094 4.74 2.19 5.38 52 XMStrtUSub 25627 4.56 3.83 4.74 53 RCVD_IN_IADB_SPF 25574 4.19 2.01 4.73 54 T_TooManySym_01 24663 4.21 2.81 4.56 55 DKIM_INVALID 24157 4.85 6.40 4.46 56 BOTNET_IPINHOSTNAME 24111 7.03 17.38 4.46 57 BAYES_20 23742 4.13 3.08 4.39 58 XMSexyCombo_05 23626 6.18 13.51 4.37 59 RCVD_IN_IADB_SENDERID 22709 3.75 1.97 4.20 60 RCVD_IN_IADB_DK 22399 3.71 1.98 4.14 61 MPART_ALT_DIFF 22367 5.31 10.03 4.13 62 T_REMOTE_IMAGE 21711 4.82 8.08 4.01 63 XM_PDF 21616 3.34 0.70 3.99 64 BAYES_99 20887 8.38 26.58 3.86 65 XM_UncommonTLD01 19682 6.40 17.54 3.64 66 HTML_IMAGE_RATIO_06 19414 3.77 4.53 3.59 67 IN_ZIMBRA_NJ_WHITELIST 18986 2.81 0.02 3.51 68 FROM_EXCESS_BASE64 18845 3.49 3.50 3.48 69 TR_XM_DK_SendGrid 18640 3.20 2.23 3.44 70 RCVD_IN_IADB_VOUCHED 17879 2.78 0.68 3.30 71 BAYES_999 17115 6.65 20.70 3.16 72 XMSubMetaSx_00 16974 4.09 7.91 3.14 73 XMNumbers 16288 3.36 4.75 3.01 74 BAYES_80 15412 3.82 7.75 2.85 75 XM_DIRTYINTL 15165 3.42 5.92 2.80 76 HTML_IMAGE_RATIO_08 15045 2.93 3.51 2.78 77 MIME_HTML_MOSTLY 14777 3.53 6.75 2.73 78 BAYES_05 14492 2.46 1.58 2.68 79 MAILING_LIST_MULTI 14411 2.39 1.29 2.66 80 XM_CamelCaseFrm001 13570 2.76 3.76 2.51 81 MIME_HTML_ONLY_MULTI 12870 2.79 4.46 2.38 82 TM2_M_URI_OPT_OUT 12605 2.65 3.92 2.33 83 HTML_MIME_NO_HTML_TAG 12415 3.69 9.30 2.29 84 XM_B_SpammyTLD 12182 2.45 3.27 2.25 85 UNPARSEABLE_RELAY 11559 1.97 1.32 2.14 86 T_TooManySym_02 11300 1.80 0.63 2.09 87 KHOP_HELO_FCRDNS 11240 3.46 9.05 2.08 88 RCVD_IN_IADB_OPTIN 11098 1.72 0.40 2.05 89 TooManyTo_002 10971 1.76 0.70 2.03 90 TVD_RCVD_IP 10824 1.67 0.35 2.00 91 BOTNET 10592 5.30 18.78 1.96 92 XM_SPF_SoftFail 10265 2.46 4.75 1.90 93 URI_TRY_3LD 10011 2.05 2.85 1.85 94 TR_DCC_Bayes_99 9577 5.68 21.45 1.77 95 TR_Symld_Words 9527 1.73 1.63 1.76 96 BOUNCE_MESSAGE 9469 1.48 0.40 1.75 97 ANY_BOUNCE_MESSAGE 9469 1.48 0.40 1.75 98 XMBdyGiftCard01 9420 1.91 2.61 1.74 99 URI_HEX 9373 2.12 3.70 1.73 100 XM_H_Trusted_IP 9343 1.38 0.00 1.73 101 UNTRUSTED_Relay 9282 3.42 10.29 1.72 102 BAYES_95 9029 2.16 4.16 1.67 103 RELAYCOUNTRY_CA 8883 2.04 3.64 1.64 104 TR_XM_PHPDW 8629 1.62 1.74 1.59 105 TR_XM_PHPForged 8554 1.60 1.66 1.58 106 TR_XM_FormFill2 8544 1.59 1.65 1.58 107 XM_H_PHPOS 8524 1.59 1.65 1.58 108 XMDiploma_00 8393 1.77 2.64 1.55 109 XM_B_Unsub2 8316 1.69 2.29 1.54 110 NO_DNS_FOR_FROM 8226 1.63 2.06 1.52 111 IN_HORDE_ADDRESS_BOOK 8167 1.22 0.05 1.51 112 XM_H_Long_From02 8061 1.44 1.25 1.49 113 RCVD_IN_MSPIKE_BL 7944 1.37 0.99 1.47 114 XM_DK_Undo_01 7931 1.43 1.26 1.47 115 XM_H_PHPMailer 7929 1.37 1.01 1.47 116 INVALID_MSGID 7926 1.22 0.22 1.46 117 T_XMDrugObfuBody_08 7746 1.64 2.47 1.43 118 SUBJ_ALL_CAPS 7601 1.37 1.25 1.40 119 CK_HELO_DYNAMIC_SPLIT_IP 7454 1.18 0.36 1.38 120 XMStockSpam_06 7454 1.50 1.97 1.38 121 HELO_DYNAMIC_IPADDR2 7447 1.11 0.05 1.38 122 TM2_M_VERY_LONG_WORD 7236 1.41 1.72 1.34 123 TooManyTo_003 7234 1.19 0.58 1.34 124 XMHTML_After_End 7071 1.37 1.64 1.31 125 XM_OfRef6 7066 1.51 2.31 1.31 126 RCVD_IN_BL_SPAMCOP_NET 6985 1.80 3.86 1.29 127 USER_IN_DEF_DKIM_WL 6894 1.02 0.02 1.27 128 HELO_NODOT 6784 1.11 0.53 1.25 129 HELO_NO_DOMAIN 6783 1.11 0.53 1.25 130 XMGappySubj_01 6695 1.04 0.26 1.24 131 XM_GoogleGroups 6693 1.07 0.41 1.24 132 TO_MALFORMED 6510 0.97 0.03 1.20 133 XM_H_PHPOS_M 6303 1.06 0.65 1.16 134 XMCapTrack 6277 0.99 0.30 1.16 135 XM_ProductURIs 6235 1.13 1.05 1.15 136 XMBody_17 6186 1.47 2.80 1.14 137 XMPhish11 6082 1.11 1.08 1.12 138 TR_XM_RelayPhish 5790 1.19 1.68 1.07 139 DKIM_ADSP_CUSTOM_MED 5379 0.94 0.73 0.99 140 XMGenDplmaNmb 5337 1.19 2.01 0.99 141 TooManyTo_004 5279 0.87 0.47 0.98 142 RELAYCOUNTRY_GB 5188 1.20 2.18 0.96 143 XM_UB50 5115 1.79 5.22 0.95 144 DKIM_ADSP_NXDOMAIN 5069 1.51 3.82 0.94 145 TR_MetaPhish_Combo_01 5025 0.98 1.18 0.93 146 XMSubNoVowel 4984 0.79 0.28 0.92 147 T_XMHurry_00 4817 1.15 2.19 0.89 148 HTML_FONT_FACE_BAD 4711 0.88 0.93 0.87 149 XMBrknScrpt_02 4406 0.91 1.31 0.81 150 TR_LOTS_OF_MONEY3 4235 1.04 2.06 0.78 151 TooManyTo_005 4182 0.70 0.39 0.77 152 PLING_QUERY 4089 0.87 1.34 0.76 153 SpammyFromTLD_01 4008 1.26 3.34 0.74 154 XMBody_95 3989 0.63 0.22 0.74 155 XMNoVowels 3984 0.77 0.93 0.74 156 T_XMDrugObfuBody_00 3831 0.87 1.50 0.71 157 XM_SPF_Unknown 3825 0.68 0.57 0.71 158 HTML_TAG_BALANCE_BODY 3802 0.65 0.44 0.70 159 NML_ADSP_CUSTOM_MED 3766 0.67 0.57 0.70 160 T_FILL_THIS_FORM_SHORT 3748 0.71 0.79 0.69 161 XMSubMetaI_00 3569 0.85 1.60 0.66 162 URI_NOVOWEL 3250 0.59 0.56 0.60 163 XMBody_78 3160 0.64 0.87 0.58 164 XM_B_REG_HTML 3018 0.50 0.27 0.56 165 XMPhish30 3016 0.61 0.83 0.56 166 HTTPS_HTTP_MISMATCH 2985 0.54 0.52 0.55 167 FORGED_GMAIL_RCVD 2985 0.57 0.65 0.55 168 RELAYCOUNTRY_AU 2922 0.56 0.64 0.54 169 XMHTMLBadTable_001 2865 0.51 0.43 0.53 170 RCVD_IN_MSPIKE_L3 2836 0.48 0.28 0.52 171 USER_IN_WHITELIST 2826 0.42 0.00 0.52 172 AC_FROM_MANY_DOTS 2816 0.42 0.02 0.52 173 AC_DIV_BONANZA 2810 0.44 0.11 0.52 174 T_TooManySym_03 2785 0.44 0.13 0.51 175 RCVD_IN_MSPIKE_L4 2745 0.43 0.11 0.51 176 XMSexyCombo_01 2684 0.82 2.12 0.50 177 T_OBFU_PDF_ATTACH 2682 0.43 0.19 0.50 178 T_Symld_Words_02 2644 0.62 1.17 0.49 179 XMSlimDrugH 2639 0.55 0.80 0.49 180 DIET_1 2632 0.60 1.07 0.49 181 XM_ShortIntro_01 2591 0.44 0.29 0.48 182 XM_B_COPY_HTML 2583 0.53 0.74 0.48 183 T_MONEY_PERCENT 2545 0.62 1.23 0.47 184 TR_LOTS_OF_MONEY2 2545 0.62 1.23 0.47 185 HTML_IMAGE_ONLY_20 2485 0.73 1.81 0.46 186 XMGappySubj_02 2437 0.38 0.07 0.45 187 FROM_GOV_SPOOF 2416 0.39 0.19 0.45 188 HTML_IMAGE_ONLY_32 2411 0.51 0.77 0.45 189 XMBSHREFv2 2382 0.43 0.37 0.44 190 RCVD_IN_MSPIKE_L5 2364 0.47 0.60 0.44 191 XMPhish14 2348 0.62 1.37 0.43 192 MISSING_HEADERS 2347 0.54 0.99 0.43 193 FILL_THIS_FORM 2342 0.52 0.87 0.43 194 REMOVE_BEFORE_LINK 2307 0.47 0.66 0.43 195 XMOemUri 2263 0.38 0.24 0.42 196 RELAYCOUNTRY_DE 2263 0.46 0.64 0.42 197 XM_RXBody 2260 0.39 0.27 0.42 198 XMSubMetaSxObfu_02 2227 0.41 0.41 0.41 199 FROM_GOV_DKIM_AU 2219 0.37 0.20 0.41 200 XMSolicitRefs_0 2218 0.41 0.41 0.41 ----------------------------------------------------------------------