Email: 339538 Autolearn: 0 AvgScore: 1.38 AvgScanTime: 2.15 sec Spam: 67851 Autolearn: 0 AvgScore: 12.77 AvgScanTime: 2.62 sec Ham: 271687 Autolearn: 0 AvgScore: -1.46 AvgScanTime: 2.03 sec Time Spent Running SA: 202.60 hours Time Spent Processing Spam: 49.32 hours Time Spent Processing Ham: 153.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 63491 88.59 93.57 87.34 2 DCC_CHECK 53699 59.34 79.14 54.40 3 XM_B_Unicode 51245 74.43 75.53 74.15 4 DKIM_SIGNED 49263 80.92 72.60 82.99 5 XM_DK_Pass 46706 79.25 68.84 81.86 6 DKIM_VALID 44050 75.90 64.92 78.64 7 XMListUnsubscribeExists 40507 62.55 59.70 63.27 8 DKIM_VALID_AU 34626 62.52 51.03 65.39 9 XM_B_Unicode3 34360 47.12 50.64 46.24 10 BAYES_50 30918 50.73 45.57 52.02 11 XM_DK_Undo_02 23586 14.25 34.76 9.13 12 MIME_HTML_ONLY 22568 25.87 33.26 24.03 13 HTML_FONT_LOW_CONTRAST 22567 35.37 33.26 35.90 14 LOC_TINY_FONT_1 21671 32.16 31.94 32.22 15 XM_Body_Dirty_Words 19416 19.20 28.62 16.85 16 BAYES_99 17276 9.76 25.46 5.84 17 FVGT_m_MULTI_ODD 17231 22.45 25.40 21.71 18 RELAYCOUNTRY_META 16800 9.43 24.76 5.60 19 XMSubLong 16539 21.73 24.38 21.07 20 HTML_IMAGE_RATIO_02 16490 14.13 24.30 11.59 21 XM_UncommonTLD01 16416 8.92 24.19 5.10 22 XM_B_Unsub 15770 11.71 23.24 8.83 23 DKIM_VALID_EF 14697 27.17 21.66 28.55 24 FSL_BULK_SIG 14696 10.05 21.66 7.15 25 BAYES_999 13721 8.02 20.22 4.97 26 TR_DCC_Bayes_99 13392 6.72 19.74 3.47 27 MultiRelay 13377 15.70 19.72 14.69 28 T_KAM_HTML_FONT_INVALID 12670 16.69 18.67 16.19 29 DCC_CHECK_NEGATIVE 12422 39.23 18.31 44.45 30 XMSexyCombo_05 12408 8.22 18.29 5.70 31 BOTNET_IPINHOSTNAME 12294 8.85 18.12 6.54 32 T_TM2_M_HEADER_IN_MSG 11275 20.30 16.62 21.22 33 BOTNET 10870 4.99 16.02 2.23 34 UNTRUSTED_Relay 10531 4.61 15.52 1.88 35 XM_H_Long_From01 10336 8.27 15.23 6.54 36 KHOP_HELO_FCRDNS 9467 3.70 13.95 1.14 37 LOTS_OF_MONEY 9420 9.50 13.88 8.41 38 XM_Multi_Part_URI 9390 14.49 13.84 14.65 39 RCVD_IN_MSPIKE_H2 8048 14.83 11.86 15.57 40 RDNS_DYNAMIC 7411 2.62 10.92 0.54 41 TR_Mismatch_TLD_02 7381 2.22 10.88 0.06 42 XMSubMetaSx_00 7181 5.08 10.58 3.71 43 HTML_MIME_NO_HTML_TAG 6695 3.10 9.87 1.41 44 XM_UB50 6339 2.54 9.34 0.84 45 MIME_HTML_MOSTLY 6181 5.08 9.11 4.08 46 XM_Evil_Numbers_Gen 6090 10.56 8.98 10.96 47 MPART_ALT_DIFF 5904 5.77 8.70 5.04 48 XM_DIRTYINTL 5538 3.86 8.16 2.79 49 T_XMDrugObfuBody_14 5309 7.72 7.82 7.69 50 DKIM_INVALID 5213 5.02 7.68 4.35 51 BAYES_80 5172 3.74 7.62 2.77 52 RCVD_IN_BL_SPAMCOP_NET 5130 2.49 7.56 1.22 53 SpammyFromTLD_02 4687 1.59 6.91 0.26 54 BAYES_60 4681 5.63 6.90 5.31 55 XMSexyCombo_01 4631 1.93 6.83 0.70 56 HTML_IMAGE_RATIO_04 4615 7.24 6.80 7.35 57 TooManyTo_001 4411 6.02 6.50 5.90 58 LotsOfNums_01 4043 7.08 5.96 7.36 59 RELAYCOUNTRY_CA 3823 2.57 5.63 1.80 60 XM_SendGrid 3810 6.78 5.62 7.06 61 XMSexyCombo_04 3757 1.25 5.54 0.18 62 XM_B_Phish_Phrases 3605 7.04 5.31 7.47 63 RCVD_IN_RP_RNBL 3587 1.11 5.29 0.07 64 XMBody_17 3412 2.27 5.03 1.59 65 TR_LOTS_OF_MONEY3 3344 2.47 4.93 1.85 66 XM_SPF_SoftFail 3283 1.94 4.84 1.22 67 XMStrtUSub 3273 5.29 4.82 5.40 68 T_REMOTE_IMAGE 3249 3.80 4.79 3.56 69 XM_OfRef6 3167 2.22 4.67 1.61 70 XM_B_SpammyTLD 3148 2.61 4.64 2.10 71 XM_CamelCaseFrm001 3125 2.76 4.61 2.30 72 RELAYCOUNTRY_FR 2724 1.14 4.01 0.42 73 MultiRelay_Combo 2690 0.90 3.96 0.14 74 MultiRelay_CC 2690 0.90 3.96 0.14 75 PLING_QUERY 2618 1.32 3.86 0.69 76 HTML_IMAGE_RATIO_06 2566 4.11 3.78 4.19 77 FROM_SUSPICIOUS_NTLD 2375 0.77 3.50 0.09 78 SpammyFromTLD_01 2360 1.02 3.48 0.41 79 XM_URI_RBL 2357 0.97 3.47 0.34 80 NO_DNS_FOR_FROM 2346 2.61 3.46 2.39 81 FROM_SUSPICIOUS_NTLD_FP 2335 0.76 3.44 0.09 82 XMNumbers 2329 4.22 3.43 4.42 83 RCVD_IN_RP_SAFE 2282 13.23 3.36 15.69 84 RCVD_IN_MSPIKE_WL 2274 9.39 3.35 10.90 85 RCVD_IN_MSPIKE_H3 2262 9.37 3.33 10.88 86 BAYES_40 2234 4.55 3.29 4.86 87 BAYES_95 2232 2.05 3.29 1.74 88 BAYES_20 2215 3.91 3.26 4.07 89 ADMITS_SPAM 2180 0.74 3.21 0.12 90 RCVD_IN_PSBL 2162 0.70 3.19 0.08 91 TR_XM_DK_SendGrid 2127 3.99 3.13 4.20 92 T_XMHurry_00 2114 1.83 3.12 1.50 93 TM2_M_URI_OPT_OUT 2094 2.34 3.09 2.15 94 RCVD_IN_MSPIKE_BL 1986 1.05 2.93 0.58 95 T_XMDrugObfuBody_08 1963 1.31 2.89 0.92 96 FROM_EXCESS_BASE64 1904 4.47 2.81 4.89 97 HTML_IMAGE_RATIO_08 1902 2.59 2.80 2.54 98 BOTNET_NORDNS 1887 0.57 2.78 0.01 99 T_XMDrugObfuBody_00 1831 0.93 2.70 0.49 100 DATE_IN_PAST_03_06 1823 0.63 2.69 0.11 101 DIET_1 1806 1.35 2.66 1.02 102 MIME_QP_LONG_LINE 1747 4.16 2.57 4.55 103 TR_XM_INV_DKIM 1720 0.63 2.53 0.16 104 HTML_IMAGE_ONLY_08 1711 0.59 2.52 0.11 105 XMDiploma_00 1709 1.57 2.52 1.33 106 T_TooManySym_01 1693 5.64 2.50 6.43 107 FILL_THIS_FORM 1663 1.03 2.45 0.68 108 URI_HEX 1658 1.45 2.44 1.21 109 DKIM_ADSP_NXDOMAIN 1631 1.88 2.40 1.75 110 XMSolicitRefs_0 1623 0.82 2.39 0.43 111 XMHTML_After_End 1604 1.37 2.36 1.13 112 FILL_THIS_FORM_LONG 1570 0.93 2.31 0.58 113 XMSubMetaI_00 1562 1.53 2.30 1.34 114 XM_B_Unsub2 1544 1.16 2.28 0.88 115 BAYES_00 1535 16.93 2.26 20.59 116 MIME_HTML_ONLY_MULTI 1510 2.57 2.23 2.66 117 URI_NO_WWW_INFO_CGI 1438 0.44 2.12 0.02 118 XM_OfRef7 1426 0.53 2.10 0.14 119 NORDNS_LOW_CONTRAST 1400 0.41 2.06 0.00 120 MIME_HEADER_CTYPE_ONLY 1387 0.46 2.04 0.07 121 HTML_SHORT_LINK_IMG_1 1365 0.43 2.01 0.03 122 BAYES_05 1362 2.35 2.01 2.43 123 TR_XM_PHPDW 1342 0.83 1.98 0.54 124 LongTLD 1342 0.55 1.98 0.19 125 MISSING_HEADERS 1341 0.63 1.98 0.30 126 DATE_IN_PAST_06_12 1335 0.44 1.97 0.06 127 RELAYCOUNTRY_GB 1328 0.80 1.96 0.51 128 TM2_M_VERY_LONG_WORD 1328 1.59 1.96 1.50 129 TR_XM_PHPForged 1280 0.79 1.89 0.52 130 TR_XM_FormFill2 1271 0.78 1.87 0.51 131 XM_H_PHPOS 1268 0.78 1.87 0.51 132 RCVD_IN_RP_CERTIFIED 1257 11.76 1.85 14.23 133 TR_Mismatch_TLD_01 1211 0.58 1.78 0.28 134 REPLYTO_WITHOUT_TO_CC 1198 0.37 1.77 0.02 135 XMStockSpam_06 1190 1.32 1.75 1.22 136 XMGenDplmaNmb 1141 0.97 1.68 0.79 137 T_HTML_TAG_BALANCE_CENTER 1138 0.45 1.68 0.15 138 DATE_IN_PAST_12_24 1123 0.37 1.66 0.05 139 SUBJ_ALL_CAPS 1120 1.25 1.65 1.15 140 DKIM_ADSP_CUSTOM_MED 1113 1.02 1.64 0.87 141 MILLION_USD 1091 0.32 1.61 0.00 142 RELAYCOUNTRY_IN 1079 0.35 1.59 0.04 143 NML_ADSP_CUSTOM_MED 1056 0.83 1.56 0.65 144 FORGED_GMAIL_RCVD 1039 0.69 1.53 0.48 145 URI_TRY_3LD 1034 1.87 1.52 1.96 146 RCVD_IN_MSPIKE_L5 1016 0.48 1.50 0.23 147 TR_XM_RelayPhish 1005 1.11 1.48 1.01 148 TR_XM_DK_Bayes 995 14.45 1.47 17.69 149 XMBrknScrpt_02 976 0.94 1.44 0.81 150 MONEY_FRAUD_8 976 0.29 1.44 0.00 151 XM_ProductURIs 957 1.49 1.41 1.51 152 XM_XX_Yahoo 922 0.38 1.36 0.13 153 XMCmmnCold 890 0.28 1.31 0.03 154 TR_XM_DK_Bayes1 881 13.93 1.30 17.09 155 ALL_TRUSTED 878 9.74 1.29 11.85 156 HTML_FONT_SIZE_HUGE 871 0.36 1.28 0.13 157 XMPhish11 869 1.14 1.28 1.11 158 FILL_THIS_FORM_LOAN 867 0.71 1.28 0.57 159 TR_Symld_Words 849 0.98 1.25 0.91 160 RCVD_IN_IADB_LISTED 840 2.81 1.24 3.20 161 TooManyTo_002 840 1.08 1.24 1.04 162 RELAYCOUNTRY_KR 824 0.25 1.21 0.01 163 XMBdyGiftCard01 812 2.16 1.20 2.40 164 DEAR_FRIEND 809 0.33 1.19 0.11 165 XM_UB99 807 0.25 1.19 0.02 166 MONEY_FORM 797 0.24 1.17 0.01 167 HTML_FONT_FACE_BAD 796 1.24 1.17 1.25 168 RELAYCOUNTRY_AT 784 0.51 1.16 0.35 169 XM_B_COPY_HTML 782 0.61 1.15 0.48 170 RCVD_IN_SORBS_DUL 774 0.32 1.14 0.12 171 RCVD_IN_MSPIKE_L4 771 0.40 1.14 0.22 172 ADVANCE_FEE_5_NEW_FRM_MNY 770 0.23 1.13 0.00 173 URIBL_DBL_SPAM 768 0.27 1.13 0.05 174 T_MONEY_PERCENT 764 0.62 1.13 0.49 175 TR_LOTS_OF_MONEY2 764 0.62 1.13 0.49 176 LOW_PRICE 761 0.44 1.12 0.26 177 XM_UB60 758 0.27 1.12 0.06 178 RCVD_IN_IADB_SPF 757 2.45 1.12 2.79 179 RCVD_IN_IADB_DK 750 2.18 1.11 2.45 180 XM_OfRef8 750 0.23 1.11 0.02 181 RCVD_IN_IADB_SENDERID 745 2.23 1.10 2.51 182 XM_H_PHPOS_M 744 0.34 1.10 0.15 183 RELAYCOUNTRY_IE 741 0.34 1.09 0.16 184 TooManyTo_003 733 0.82 1.08 0.76 185 TR_XM_DK_Bayes2 727 13.22 1.07 16.25 186 XMLngstWrd_00 716 0.59 1.06 0.47 187 XMLngstWrd_01 703 0.56 1.04 0.44 188 MPART_ALT_DIFF_COUNT 698 0.64 1.03 0.54 189 MAILING_LIST_MULTI 687 2.06 1.01 2.33 190 UNPARSEABLE_RELAY 686 3.11 1.01 3.64 191 XMLngstWrd_02 683 0.48 1.01 0.35 192 XM_UB80 674 0.22 0.99 0.03 193 XMSubNoVowel 669 1.18 0.99 1.23 194 XMSolicitRefs_4 663 0.32 0.98 0.16 195 HTML_TAG_BALANCE_BODY 663 0.66 0.98 0.58 196 XMLngstWrd_03 660 0.44 0.97 0.31 197 URIBL_BLACK 645 0.20 0.95 0.01 198 XM_H_Long_From02 641 1.06 0.94 1.09 199 HDRS_LCASE_IMGONLY 639 0.20 0.94 0.01 200 XM_H_PHPMailer 634 0.53 0.93 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 237298 88.59 93.57 87.34 2 DKIM_SIGNED 225480 80.92 72.60 82.99 3 XM_DK_Pass 222394 79.25 68.84 81.86 4 DKIM_VALID 213660 75.90 64.92 78.64 5 XM_B_Unicode 201468 74.43 75.53 74.15 6 DKIM_VALID_AU 177644 62.52 51.03 65.39 7 XMListUnsubscribeExists 171883 62.55 59.70 63.27 8 DCC_CHECK 147792 59.34 79.14 54.40 9 BAYES_50 141337 50.73 45.57 52.02 10 XM_B_Unicode3 125635 47.12 50.64 46.24 11 DCC_CHECK_NEGATIVE 120768 39.23 18.31 44.45 12 HTML_FONT_LOW_CONTRAST 97524 35.37 33.26 35.90 13 LOC_TINY_FONT_1 87527 32.16 31.94 32.22 14 DKIM_VALID_EF 77560 27.17 21.66 28.55 15 MIME_HTML_ONLY 65274 25.87 33.26 24.03 16 FVGT_m_MULTI_ODD 58996 22.45 25.40 21.71 17 T_TM2_M_HEADER_IN_MSG 57639 20.30 16.62 21.22 18 XMSubLong 57246 21.73 24.38 21.07 19 BAYES_00 55951 16.93 2.26 20.59 20 TR_XM_DK_Bayes 48069 14.45 1.47 17.69 21 TR_XM_DK_Bayes1 46423 13.93 1.30 17.09 22 XM_Body_Dirty_Words 45778 19.20 28.62 16.85 23 TR_XM_DK_Bayes2 44159 13.22 1.07 16.25 24 T_KAM_HTML_FONT_INVALID 43995 16.69 18.67 16.19 25 RCVD_IN_RP_SAFE 42626 13.23 3.36 15.69 26 RCVD_IN_MSPIKE_H2 42298 14.83 11.86 15.57 27 MultiRelay 39918 15.70 19.72 14.69 28 XM_Multi_Part_URI 39797 14.49 13.84 14.65 29 RCVD_IN_RP_CERTIFIED 38666 11.76 1.85 14.23 30 ALL_TRUSTED 32188 9.74 1.29 11.85 31 HTML_IMAGE_RATIO_02 31501 14.13 24.30 11.59 32 XM_Evil_Numbers_Gen 29766 10.56 8.98 10.96 33 XM_DKIMWhitelistDomains 29637 8.74 0.04 10.91 34 RCVD_IN_MSPIKE_WL 29619 9.39 3.35 10.90 35 RCVD_IN_MSPIKE_H3 29554 9.37 3.33 10.88 36 XM_DK_Undo_02 24801 14.25 34.76 9.13 37 XM_B_Unsub 23977 11.71 23.24 8.83 38 LOTS_OF_MONEY 22843 9.50 13.88 8.41 39 T_XMDrugObfuBody_14 20905 7.72 7.82 7.69 40 XM_B_Phish_Phrases 20299 7.04 5.31 7.47 41 LotsOfNums_01 19998 7.08 5.96 7.36 42 HTML_IMAGE_RATIO_04 19982 7.24 6.80 7.35 43 FSL_BULK_SIG 19423 10.05 21.66 7.15 44 XM_SendGrid 19194 6.78 5.62 7.06 45 BOTNET_IPINHOSTNAME 17765 8.85 18.12 6.54 46 XM_H_Long_From01 17755 8.27 15.23 6.54 47 T_TooManySym_01 17470 5.64 2.50 6.43 48 TooManyTo_001 16040 6.02 6.50 5.90 49 BAYES_99 15866 9.76 25.46 5.84 50 XMSexyCombo_05 15491 8.22 18.29 5.70 51 RELAYCOUNTRY_META 15219 9.43 24.76 5.60 52 XMStrtUSub 14678 5.29 4.82 5.40 53 BAYES_60 14429 5.63 6.90 5.31 54 XM_UncommonTLD01 13855 8.92 24.19 5.10 55 MPART_ALT_DIFF 13698 5.77 8.70 5.04 56 BAYES_999 13497 8.02 20.22 4.97 57 FROM_EXCESS_BASE64 13275 4.47 2.81 4.89 58 BAYES_40 13201 4.55 3.29 4.86 59 MIME_QP_LONG_LINE 12372 4.16 2.57 4.55 60 XMNumbers 11999 4.22 3.43 4.42 61 DKIM_INVALID 11820 5.02 7.68 4.35 62 TR_XM_DK_SendGrid 11418 3.99 3.13 4.20 63 HTML_IMAGE_RATIO_06 11379 4.11 3.78 4.19 64 MIME_HTML_MOSTLY 11084 5.08 9.11 4.08 65 BAYES_20 11047 3.91 3.26 4.07 66 T_TooManySym_02 10076 3.07 0.50 3.71 67 XMSubMetaSx_00 10073 5.08 10.58 3.71 68 UNPARSEABLE_RELAY 9881 3.11 1.01 3.64 69 T_REMOTE_IMAGE 9662 3.80 4.79 3.56 70 TR_DCC_Bayes_99 9419 6.72 19.74 3.47 71 TVD_RCVD_IP 8693 2.73 0.85 3.20 72 RCVD_IN_IADB_LISTED 8687 2.81 1.24 3.20 73 IN_ZIMBRA_NJ_WHITELIST 8326 2.46 0.02 3.06 74 XM_DIRTYINTL 7582 3.86 8.16 2.79 75 RCVD_IN_IADB_SPF 7578 2.45 1.12 2.79 76 BAYES_80 7533 3.74 7.62 2.77 77 CK_HELO_DYNAMIC_SPLIT_IP 7526 2.32 0.49 2.77 78 HELO_DYNAMIC_IPADDR2 7524 2.25 0.16 2.77 79 MIME_HTML_ONLY_MULTI 7233 2.57 2.23 2.66 80 INVALID_MSGID 7196 2.23 0.54 2.65 81 HTML_IMAGE_RATIO_08 6906 2.59 2.80 2.54 82 RCVD_IN_IADB_SENDERID 6832 2.23 1.10 2.51 83 RCVD_IN_IADB_DK 6653 2.18 1.11 2.45 84 BAYES_05 6603 2.35 2.01 2.43 85 TO_MALFORMED 6583 1.95 0.06 2.42 86 XMBdyGiftCard01 6511 2.16 1.20 2.40 87 NO_DNS_FOR_FROM 6502 2.61 3.46 2.39 88 MAILING_LIST_MULTI 6320 2.06 1.01 2.33 89 XM_CamelCaseFrm001 6249 2.76 4.61 2.30 90 BOTNET 6059 4.99 16.02 2.23 91 TM2_M_URI_OPT_OUT 5840 2.34 3.09 2.15 92 XM_B_SpammyTLD 5713 2.61 4.64 2.10 93 XM_H_Trusted_IP 5376 1.58 0.00 1.98 94 URI_TRY_3LD 5330 1.87 1.52 1.96 95 UNTRUSTED_Relay 5117 4.61 15.52 1.88 96 RCVD_IN_IADB_VOUCHED 5097 1.57 0.35 1.88 97 TR_LOTS_OF_MONEY3 5029 2.47 4.93 1.85 98 RELAYCOUNTRY_CA 4890 2.57 5.63 1.80 99 DKIM_ADSP_NXDOMAIN 4767 1.88 2.40 1.75 100 BAYES_95 4729 2.05 3.29 1.74 101 XM_PDF 4665 1.43 0.27 1.72 102 IN_HORDE_ADDRESS_BOOK 4554 1.35 0.02 1.68 103 XM_OfRef6 4362 2.22 4.67 1.61 104 XMBody_17 4308 2.27 5.03 1.59 105 XM_ProductURIs 4090 1.49 1.41 1.51 106 T_XMHurry_00 4088 1.83 3.12 1.50 107 TM2_M_VERY_LONG_WORD 4074 1.59 1.96 1.50 108 USER_IN_DEF_DKIM_WL 4010 1.18 0.01 1.48 109 HTML_MIME_NO_HTML_TAG 3829 3.10 9.87 1.41 110 BOUNCE_MESSAGE 3762 1.15 0.19 1.38 111 ANY_BOUNCE_MESSAGE 3762 1.15 0.19 1.38 112 XMSubMetaI_00 3643 1.53 2.30 1.34 113 XMDiploma_00 3611 1.57 2.52 1.33 114 XM_B_REG_HTML 3547 1.12 0.39 1.31 115 XM_DK_Undo_01 3415 1.13 0.64 1.26 116 HTML_FONT_FACE_BAD 3408 1.24 1.17 1.25 117 XMSubNoVowel 3330 1.18 0.99 1.23 118 RCVD_IN_BL_SPAMCOP_NET 3326 2.49 7.56 1.22 119 XMStockSpam_06 3308 1.32 1.75 1.22 120 XM_SPF_SoftFail 3302 1.94 4.84 1.22 121 XMGappySubj_01 3298 1.03 0.31 1.21 122 URI_HEX 3281 1.45 2.44 1.21 123 RCVD_IN_IADB_OPTIN 3170 0.99 0.27 1.17 124 SUBJ_ALL_CAPS 3115 1.25 1.65 1.15 125 KHOP_HELO_FCRDNS 3105 3.70 13.95 1.14 126 XMHTML_After_End 3061 1.37 2.36 1.13 127 XMPhish11 3009 1.14 1.28 1.11 128 XM_H_Long_From02 2949 1.06 0.94 1.09 129 AC_FROM_MANY_DOTS 2940 0.87 0.01 1.08 130 XMBody_95 2868 0.86 0.08 1.06 131 TooManyTo_002 2819 1.08 1.24 1.04 132 DIET_1 2780 1.35 2.66 1.02 133 TR_XM_RelayPhish 2751 1.11 1.48 1.01 134 XM_GoogleGroups 2680 0.86 0.34 0.99 135 XMNoVowels 2600 0.84 0.37 0.96 136 T_FILL_THIS_FORM_SHORT 2513 0.86 0.59 0.92 137 T_XMDrugObfuBody_08 2490 1.31 2.89 0.92 138 TR_Symld_Words 2484 0.98 1.25 0.91 139 XM_RXBody 2436 0.86 0.73 0.90 140 URIBL_CSS 2412 0.84 0.67 0.89 141 URIBL_CSS_A 2412 0.84 0.67 0.89 142 XM_B_Unsub2 2389 1.16 2.28 0.88 143 DKIM_ADSP_CUSTOM_MED 2353 1.02 1.64 0.87 144 XM_UB50 2285 2.54 9.34 0.84 145 XMBrknScrpt_02 2209 0.94 1.44 0.81 146 RELAYCOUNTRY_NL 2199 0.75 0.50 0.81 147 XMGenDplmaNmb 2156 0.97 1.68 0.79 148 USER_IN_WHITELIST 2108 0.62 0.00 0.78 149 T_TooManySym_03 2085 0.63 0.10 0.77 150 THIS_AD 2068 0.79 0.90 0.76 151 TooManyTo_003 2068 0.82 1.08 0.76 152 XMSexyCombo_01 1911 1.93 6.83 0.70 153 PLING_QUERY 1878 1.32 3.86 0.69 154 XMBSHREFv2 1860 0.62 0.34 0.68 155 FILL_THIS_FORM 1837 1.03 2.45 0.68 156 NML_ADSP_CUSTOM_MED 1775 0.83 1.56 0.65 157 TR_MetaPhish_Combo_01 1746 0.61 0.50 0.64 158 XMHTMLBadTable_001 1743 0.61 0.50 0.64 159 TooManyTo_004 1712 0.67 0.85 0.63 160 XMPhish30 1675 0.65 0.80 0.62 161 XMSubMetaSxObfu_02 1657 0.60 0.54 0.61 162 XMBody_78 1603 0.66 0.92 0.59 163 FILL_THIS_FORM_LONG 1582 0.93 2.31 0.58 164 RCVD_IN_MSPIKE_BL 1579 1.05 2.93 0.58 165 HTML_TAG_BALANCE_BODY 1576 0.66 0.98 0.58 166 RELAYCOUNTRY_DE 1544 0.62 0.81 0.57 167 XM_Body_Obfu01 1542 0.53 0.36 0.57 168 FILL_THIS_FORM_LOAN 1542 0.71 1.28 0.57 169 TooManyTo_005 1482 0.58 0.70 0.55 170 MPART_ALT_DIFF_COUNT 1470 0.64 1.03 0.54 171 RDNS_DYNAMIC 1468 2.62 10.92 0.54 172 TR_XM_PHPDW 1468 0.83 1.98 0.54 173 SUBJ_DOLLARS 1430 0.51 0.46 0.53 174 TR_XM_PHPForged 1404 0.79 1.89 0.52 175 HTML_IMAGE_ONLY_20 1397 0.44 0.13 0.51 176 RELAYCOUNTRY_GB 1393 0.80 1.96 0.51 177 TR_XM_FormFill2 1393 0.78 1.87 0.51 178 XM_Ancestry_Forge 1386 0.43 0.10 0.51 179 XM_SPF_Unknown 1383 0.47 0.31 0.51 180 XM_H_PHPOS 1381 0.78 1.87 0.51 181 T_MONEY_PERCENT 1342 0.62 1.13 0.49 182 T_XMDrugObfuBody_00 1342 0.93 2.70 0.49 183 TR_LOTS_OF_MONEY2 1342 0.62 1.13 0.49 184 FORGED_GMAIL_RCVD 1311 0.69 1.53 0.48 185 XM_B_COPY_HTML 1304 0.61 1.15 0.48 186 XMLngstWrd_00 1281 0.59 1.06 0.47 187 T_TooManySym_04 1274 0.38 0.04 0.47 188 XMSubMetaSxObfu_03 1265 0.51 0.67 0.47 189 XMLngstWrd_01 1195 0.56 1.04 0.44 190 XMSolicitRefs_0 1175 0.82 2.39 0.43 191 XM_H_PHPMailer 1164 0.53 0.93 0.43 192 RELAYCOUNTRY_FR 1145 1.14 4.01 0.42 193 SpammyFromTLD_01 1119 1.02 3.48 0.41 194 HELO_NODOT 1118 0.39 0.29 0.41 195 HELO_NO_DOMAIN 1113 0.38 0.28 0.41 196 FSL_HELO_FAKE 1097 0.36 0.20 0.40 197 XMOemUri 1071 0.34 0.11 0.39 198 XMLKML 1069 0.31 0.00 0.39 199 FSL_THIS_IS_ADV 1050 0.34 0.14 0.39 200 XMUrgent 1032 0.47 0.83 0.38 ----------------------------------------------------------------------