Email: 340322 Autolearn: 0 AvgScore: 2.16 AvgScanTime: 2.21 sec Spam: 79517 Autolearn: 0 AvgScore: 15.52 AvgScanTime: 2.97 sec Ham: 260805 Autolearn: 0 AvgScore: -1.92 AvgScanTime: 1.97 sec Time Spent Running SA: 208.51 hours Time Spent Processing Spam: 65.66 hours Time Spent Processing Ham: 142.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 69164 87.41 86.98 87.54 2 DCC_CHECK 62683 57.76 78.83 51.33 3 XM_B_Unicode 45706 69.90 57.48 73.68 4 DKIM_SIGNED 45629 75.86 57.38 81.49 5 XM_DK_Pass 43687 74.52 54.94 80.48 6 DKIM_VALID 40743 71.15 51.24 77.22 7 XMListUnsubscribeExists 36516 56.30 45.92 59.47 8 BAYES_50 34216 49.24 43.03 51.13 9 MIME_HTML_ONLY 32584 28.44 40.98 24.62 10 DKIM_VALID_AU 32045 59.22 40.30 64.99 11 RELAYCOUNTRY_META 31546 13.26 39.67 5.21 12 XM_B_Unicode3 29010 45.18 36.48 47.83 13 BOTNET 26501 9.43 33.33 2.15 14 UNTRUSTED_Relay 24357 8.49 30.63 1.75 15 HTML_FONT_LOW_CONTRAST 23013 33.23 28.94 34.54 16 FSL_BULK_SIG 22661 12.47 28.50 7.59 17 XM_UncommonTLD01 22565 10.61 28.38 5.19 18 XM_DK_Undo_02 22174 13.58 27.89 9.21 19 BOTNET_IPINHOSTNAME 19000 10.52 23.89 6.44 20 MultiRelay 18852 17.71 23.71 15.89 21 LOC_TINY_FONT_1 18203 29.29 22.89 31.24 22 FVGT_m_MULTI_ODD 17735 20.98 22.30 20.58 23 BAYES_99 16333 9.36 20.54 5.96 24 XMSubLong 16122 21.61 20.27 22.02 25 DCC_CHECK_NEGATIVE 15662 40.99 19.70 47.48 26 XM_Body_Dirty_Words 15610 17.42 19.63 16.75 27 RCVD_IN_BL_SPAMCOP_NET 15350 5.50 19.30 1.29 28 DKIM_VALID_EF 14702 26.02 18.49 28.32 29 T_TM2_M_HEADER_IN_MSG 13261 21.43 16.68 22.87 30 BAYES_999 12761 7.35 16.05 4.70 31 XM_B_Unsub 12622 11.45 15.87 10.10 32 T_REMOTE_IMAGE 12563 6.49 15.80 3.65 33 TR_DCC_Bayes_99 12204 6.30 15.35 3.54 34 SpammyFromTLD_02 11381 3.47 14.31 0.17 35 XMSexyCombo_05 11226 7.98 14.12 6.10 36 HTML_SHORT_LINK_IMG_1 11078 3.31 13.93 0.07 37 RCVD_IN_RP_RNBL 10959 3.30 13.78 0.10 38 XM_UB50 10751 3.78 13.52 0.81 39 LOTS_OF_MONEY 10684 9.34 13.44 8.09 40 T_KAM_HTML_FONT_INVALID 10635 15.09 13.37 15.61 41 XM_Multi_Part_URI 10427 15.07 13.11 15.67 42 MIME_HEADER_CTYPE_ONLY 9909 2.99 12.46 0.10 43 HDRS_LCASE_IMGONLY 9788 2.89 12.31 0.01 44 KHOP_HELO_FCRDNS 9309 3.79 11.71 1.37 45 HTML_IMAGE_RATIO_02 9049 12.20 11.38 12.45 46 XMNumbers 8809 6.47 11.08 5.07 47 BOTNET_NORDNS 8028 2.37 10.10 0.02 48 REPLYTO_WITHOUT_TO_CC 7877 2.33 9.91 0.02 49 FROM_SUSPICIOUS_NTLD 7778 2.36 9.78 0.09 50 FROM_SUSPICIOUS_NTLD_FP 7695 2.33 9.68 0.09 51 HTML_IMAGE_ONLY_12 7514 2.34 9.45 0.17 52 HTML_MIME_NO_HTML_TAG 7480 3.21 9.41 1.32 53 RCVD_IN_PSBL 7244 2.21 9.11 0.10 54 XM_SPF_SoftFail 7152 3.19 8.99 1.42 55 XM_DIRTYINTL 6978 4.54 8.78 3.25 56 XMSubMetaSx_00 6603 5.60 8.30 4.77 57 XM_Evil_Numbers_Gen 6236 10.72 7.84 11.60 58 TO_EQ_FM_DOM_HTML_IMG 5874 1.73 7.39 0.00 59 DKIM_ADSP_NXDOMAIN 5667 2.96 7.13 1.69 60 TooManyTo_001 5513 6.68 6.93 6.60 61 BAYES_80 5456 3.74 6.86 2.78 62 XM_H_Long_From01 5402 6.37 6.79 6.24 63 BAYES_60 5392 5.58 6.78 5.21 64 BAYES_40 5358 5.32 6.74 4.89 65 LongTLD 5350 1.71 6.73 0.18 66 RCVD_IN_MSPIKE_BL 5265 2.16 6.62 0.80 67 T_XMDrugObfuBody_14 5086 7.50 6.40 7.84 68 MPART_ALT_DIFF 4987 5.28 6.27 4.97 69 XM_B_SpammyTLD 4913 3.05 6.18 2.09 70 MultiRelay_CC 4891 1.58 6.15 0.19 71 MultiRelay_Combo 4891 1.58 6.15 0.19 72 DKIM_INVALID 4886 4.71 6.14 4.27 73 DIET_1 4344 2.06 5.46 1.02 74 MIME_HTML_MOSTLY 4287 3.98 5.39 3.55 75 RCVD_IN_MSPIKE_H2 4217 8.61 5.30 9.62 76 LotsOfNums_01 4208 6.94 5.29 7.44 77 RCVD_IN_MSPIKE_L5 4193 1.34 5.27 0.14 78 BAYES_20 4109 4.41 5.17 4.18 79 FROM_EXCESS_BASE64 4073 4.98 5.12 4.93 80 HDRS_MISSP 3947 1.19 4.96 0.04 81 SHORT_IMG_SUSP_NTLD 3883 1.14 4.88 0.00 82 XM_B_Phish_Phrases 3837 7.32 4.83 8.08 83 HTML_IMAGE_RATIO_04 3795 7.24 4.77 7.99 84 XM_CamelCaseFrm001 3636 3.04 4.57 2.58 85 HTML_IMAGE_ONLY_08 3535 1.15 4.45 0.14 86 RELAYCOUNTRY_CA 3489 2.63 4.39 2.10 87 XMStrtUSub 3270 6.18 4.11 6.81 88 RELAYCOUNTRY_CN 3251 1.00 4.09 0.06 89 XM_SendGrid 3225 6.29 4.06 6.97 90 RELAYCOUNTRY_FI 3043 0.91 3.83 0.02 91 NORDNS_LOW_CONTRAST 2895 0.85 3.64 0.00 92 BAYES_95 2877 2.25 3.62 1.83 93 NO_DNS_FOR_FROM 2798 2.85 3.52 2.65 94 BAYES_00 2789 17.12 3.51 21.27 95 BAYES_05 2774 2.72 3.49 2.48 96 XM_UB60 2633 0.83 3.31 0.08 97 T_TooManySym_01 2627 6.11 3.30 6.97 98 RELAYCOUNTRY_FR 2574 1.01 3.24 0.33 99 URI_NOVOWEL 2568 0.96 3.23 0.27 100 XM_OfRef6 2490 1.81 3.13 1.41 101 RELAYCOUNTRY_IN 2390 0.74 3.01 0.05 102 NO_FM_NAME_IP_HOSTN 2324 0.68 2.92 0.00 103 RELAYCOUNTRY_GB 2273 1.04 2.86 0.49 104 URIBL_RHS_DOB 2241 0.69 2.82 0.04 105 CHARSET_FARAWAY_HEADER 2224 0.70 2.80 0.06 106 DOS_RCVD_IP_TWICE_B 2213 0.71 2.78 0.08 107 DKIM_ADSP_CUSTOM_MED 2213 1.51 2.78 1.12 108 HTML_IMAGE_RATIO_06 2211 4.38 2.78 4.87 109 SpammyFromTLD_01 2148 0.93 2.70 0.38 110 TM2_M_URI_OPT_OUT 2116 2.40 2.66 2.32 111 NML_ADSP_CUSTOM_MED 2112 1.25 2.66 0.82 112 T_XMDrugObfuBody_08 2059 1.46 2.59 1.11 113 T_Symld_Words_02 2057 0.92 2.59 0.41 114 HTML_IMAGE_RATIO_08 2031 2.74 2.55 2.80 115 MIME_CHARSET_FARAWAY 2029 0.67 2.55 0.10 116 XM_UB99 1985 0.59 2.50 0.01 117 DATE_IN_PAST_03_06 1978 0.67 2.49 0.11 118 FORGED_GMAIL_RCVD 1949 1.05 2.45 0.62 119 MIME_QP_LONG_LINE 1903 3.93 2.39 4.40 120 RCVD_IN_MSPIKE_WL 1900 8.97 2.39 10.97 121 RCVD_IN_MSPIKE_H3 1895 8.96 2.38 10.96 122 MISSING_HEADERS 1771 0.80 2.23 0.36 123 MIME_HTML_ONLY_MULTI 1749 2.70 2.20 2.85 124 RELAYCOUNTRY_DE 1743 0.76 2.19 0.33 125 HK_RANDOM_REPLYTO 1726 0.71 2.17 0.26 126 INVALID_MSGID 1720 2.69 2.16 2.85 127 XMSexyCombo_01 1705 1.00 2.14 0.64 128 SUBJ_DOLLARS 1699 0.84 2.14 0.44 129 FILL_THIS_FORM 1689 0.96 2.12 0.61 130 TR_XM_DK_SendGrid 1649 3.61 2.07 4.08 131 XM_UB80 1631 0.50 2.05 0.03 132 SUBJ_ALL_CAPS 1624 1.59 2.04 1.45 133 XMMoneyMeta_00 1619 0.62 2.04 0.19 134 FILL_THIS_FORM_LONG 1619 0.86 2.04 0.50 135 URI_HEX 1611 1.44 2.03 1.26 136 RCVD_IN_RP_SAFE 1605 11.77 2.02 14.75 137 XMDiploma_00 1563 1.42 1.97 1.25 138 TR_Mismatch_TLD_02 1550 0.50 1.95 0.06 139 UNPARSEABLE_RELAY 1533 3.53 1.93 4.02 140 TR_XM_PHPDW 1529 0.83 1.92 0.50 141 LOADSA_MONEY_COMBO 1496 0.48 1.88 0.05 142 XMSlimDrugH 1488 0.78 1.87 0.45 143 TR_XM_PHPForged 1426 0.79 1.79 0.48 144 TR_XM_FormFill2 1424 0.78 1.79 0.48 145 XM_H_PHPOS 1421 0.78 1.79 0.47 146 TM2_M_VERY_LONG_WORD 1415 1.55 1.78 1.48 147 XM_UB999 1405 0.42 1.77 0.01 148 XM_URI_RBL 1395 0.70 1.75 0.38 149 ALL_TRUSTED 1393 9.77 1.75 12.22 150 XM_Attn_01 1377 0.43 1.73 0.04 151 DATE_IN_PAST_06_12 1374 0.46 1.73 0.07 152 XM_B_Unsub2 1365 1.06 1.72 0.86 153 T_FILL_THIS_FORM_SHORT 1335 1.20 1.68 1.05 154 TooManyTo_002 1323 1.42 1.66 1.35 155 XM_H_PHPMailer 1309 0.80 1.65 0.54 156 TR_XM_INV_DKIM 1300 0.51 1.63 0.17 157 TR_XM_RelayPhish 1292 1.25 1.62 1.14 158 XMStockSpam_06 1286 1.58 1.62 1.56 159 XMWghtMeta_00 1267 0.41 1.59 0.05 160 HK_RANDOM_FROM 1257 0.47 1.58 0.13 161 T_XMDrugObfuBody_00 1240 0.82 1.56 0.59 162 XMGenDplmaNmb 1240 0.92 1.56 0.73 163 RCVD_IN_RP_CERTIFIED 1219 10.54 1.53 13.29 164 HTML_IMAGE_ONLY_04 1184 0.39 1.49 0.06 165 FORGED_MUA_OUTLOOK 1183 0.38 1.49 0.04 166 RELAYCOUNTRY_PL 1181 0.37 1.49 0.03 167 XMBody_17 1172 1.17 1.47 1.07 168 URIBL_DBL_SPAM 1160 0.37 1.46 0.04 169 TR_Symld_Words 1154 1.14 1.45 1.05 170 TR_LOTS_OF_MONEY3 1145 0.57 1.44 0.31 171 RELAYCOUNTRY_VN 1125 0.34 1.41 0.01 172 TooManyTo_003 1122 1.10 1.41 1.01 173 TR_Mismatch_TLD_01 1111 0.62 1.40 0.38 174 TVD_SPACE_RATIO_MINFP 1108 0.33 1.39 0.01 175 CHARSET_FARAWAY 1098 0.32 1.38 0.00 176 XM_H_TOP 1097 0.32 1.38 0.00 177 BODY_URI_ONLY 1094 0.35 1.38 0.04 178 RDNS_DYNAMIC 1085 0.72 1.36 0.53 179 MSGID_SHORT 1083 0.32 1.36 0.01 180 TO_EQ_FM_DIRECT_MX 1079 0.33 1.36 0.01 181 SUSPNTLD_EXPIRATION_EXTORT 1064 0.31 1.34 0.00 182 XMPhish11 1052 1.07 1.32 0.99 183 XMBdyGiftCard01 1042 2.06 1.31 2.29 184 TR_XM_DK_Bayes 1033 13.92 1.30 17.77 185 XM_H_Long_From02 1008 1.27 1.27 1.27 186 XMSubNoVowel 993 1.40 1.25 1.45 187 XMSlimDrugs 989 0.35 1.24 0.08 188 XMSubMetaI_00 987 0.92 1.24 0.82 189 FROM_MISSP_REPLYTO 986 0.29 1.24 0.00 190 SUBJECT_DIET 983 0.30 1.24 0.01 191 XMHTML_After_End 983 0.97 1.24 0.89 192 RELAYCOUNTRY_BR 979 0.30 1.23 0.02 193 XM_ProductURIs 956 1.36 1.20 1.41 194 T_TooManySym_02 925 3.04 1.16 3.62 195 RELAYCOUNTRY_IT 924 0.29 1.16 0.03 196 RELAYCOUNTRY_TR 905 0.27 1.14 0.01 197 XMSexyCombo_04 903 0.34 1.14 0.10 198 TooManyTo_004 900 0.90 1.13 0.83 199 MAILING_LIST_MULTI 894 1.56 1.12 1.70 200 HTML_SHORT_LINK_IMG_2 892 0.29 1.12 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 228304 87.41 86.98 87.54 2 DKIM_SIGNED 212532 75.86 57.38 81.49 3 XM_DK_Pass 209905 74.52 54.94 80.48 4 DKIM_VALID 201402 71.15 51.24 77.22 5 XM_B_Unicode 192170 69.90 57.48 73.68 6 DKIM_VALID_AU 169487 59.22 40.30 64.99 7 XMListUnsubscribeExists 155097 56.30 45.92 59.47 8 DCC_CHECK 133882 57.76 78.83 51.33 9 BAYES_50 133342 49.24 43.03 51.13 10 XM_B_Unicode3 124740 45.18 36.48 47.83 11 DCC_CHECK_NEGATIVE 123829 40.99 19.70 47.48 12 HTML_FONT_LOW_CONTRAST 90082 33.23 28.94 34.54 13 LOC_TINY_FONT_1 81468 29.29 22.89 31.24 14 DKIM_VALID_EF 73857 26.02 18.49 28.32 15 MIME_HTML_ONLY 64213 28.44 40.98 24.62 16 T_TM2_M_HEADER_IN_MSG 59654 21.43 16.68 22.87 17 XMSubLong 57428 21.61 20.27 22.02 18 BAYES_00 55479 17.12 3.51 21.27 19 FVGT_m_MULTI_ODD 53661 20.98 22.30 20.58 20 TR_XM_DK_Bayes 46345 13.92 1.30 17.77 21 TR_XM_DK_Bayes1 44543 13.35 1.12 17.08 22 XM_Body_Dirty_Words 43685 17.42 19.63 16.75 23 TR_XM_DK_Bayes2 42183 12.61 0.93 16.17 24 MultiRelay 41435 17.71 23.71 15.89 25 XM_Multi_Part_URI 40861 15.07 13.11 15.67 26 T_KAM_HTML_FONT_INVALID 40723 15.09 13.37 15.61 27 RCVD_IN_RP_SAFE 38456 11.77 2.02 14.75 28 RCVD_IN_RP_CERTIFIED 34656 10.54 1.53 13.29 29 HTML_IMAGE_RATIO_02 32458 12.20 11.38 12.45 30 ALL_TRUSTED 31870 9.77 1.75 12.22 31 XM_DKIMWhitelistDomains 31116 9.20 0.23 11.93 32 XM_Evil_Numbers_Gen 30244 10.72 7.84 11.60 33 RCVD_IN_MSPIKE_WL 28615 8.97 2.39 10.97 34 RCVD_IN_MSPIKE_H3 28581 8.96 2.38 10.96 35 XM_B_Unsub 26352 11.45 15.87 10.10 36 RCVD_IN_MSPIKE_H2 25089 8.61 5.30 9.62 37 XM_DK_Undo_02 24029 13.58 27.89 9.21 38 LOTS_OF_MONEY 21094 9.34 13.44 8.09 39 XM_B_Phish_Phrases 21068 7.32 4.83 8.08 40 HTML_IMAGE_RATIO_04 20839 7.24 4.77 7.99 41 T_XMDrugObfuBody_14 20453 7.50 6.40 7.84 42 FSL_BULK_SIG 19794 12.47 28.50 7.59 43 LotsOfNums_01 19403 6.94 5.29 7.44 44 XM_SendGrid 18184 6.29 4.06 6.97 45 T_TooManySym_01 18171 6.11 3.30 6.97 46 XMStrtUSub 17752 6.18 4.11 6.81 47 TooManyTo_001 17217 6.68 6.93 6.60 48 BOTNET_IPINHOSTNAME 16791 10.52 23.89 6.44 49 XM_H_Long_From01 16263 6.37 6.79 6.24 50 XMSexyCombo_05 15920 7.98 14.12 6.10 51 BAYES_99 15534 9.36 20.54 5.96 52 BAYES_60 13597 5.58 6.78 5.21 53 RELAYCOUNTRY_META 13583 13.26 39.67 5.21 54 XM_UncommonTLD01 13535 10.61 28.38 5.19 55 XMNumbers 13223 6.47 11.08 5.07 56 MPART_ALT_DIFF 12966 5.28 6.27 4.97 57 FROM_EXCESS_BASE64 12866 4.98 5.12 4.93 58 BAYES_40 12741 5.32 6.74 4.89 59 HTML_IMAGE_RATIO_06 12689 4.38 2.78 4.87 60 XMSubMetaSx_00 12447 5.60 8.30 4.77 61 BAYES_999 12256 7.35 16.05 4.70 62 MIME_QP_LONG_LINE 11469 3.93 2.39 4.40 63 DKIM_INVALID 11130 4.71 6.14 4.27 64 BAYES_20 10902 4.41 5.17 4.18 65 TR_XM_DK_SendGrid 10629 3.61 2.07 4.08 66 UNPARSEABLE_RELAY 10483 3.53 1.93 4.02 67 T_REMOTE_IMAGE 9508 6.49 15.80 3.65 68 T_TooManySym_02 9432 3.04 1.16 3.62 69 MIME_HTML_MOSTLY 9247 3.98 5.39 3.55 70 TR_DCC_Bayes_99 9239 6.30 15.35 3.54 71 XM_DIRTYINTL 8486 4.54 8.78 3.25 72 IN_ZIMBRA_NJ_WHITELIST 8482 2.50 0.02 3.25 73 TVD_RCVD_IP 8429 2.67 0.85 3.23 74 RCVD_IN_IADB_LISTED 8103 2.63 1.06 3.11 75 MIME_HTML_ONLY_MULTI 7444 2.70 2.20 2.85 76 INVALID_MSGID 7428 2.69 2.16 2.85 77 HTML_IMAGE_RATIO_08 7310 2.74 2.55 2.80 78 BAYES_80 7257 3.74 6.86 2.78 79 CK_HELO_DYNAMIC_SPLIT_IP 7115 2.28 0.80 2.73 80 HELO_DYNAMIC_IPADDR2 7113 2.17 0.33 2.73 81 RCVD_IN_IADB_SPF 7032 2.29 0.94 2.70 82 NO_DNS_FOR_FROM 6906 2.85 3.52 2.65 83 XM_CamelCaseFrm001 6723 3.04 4.57 2.58 84 TO_MALFORMED 6575 1.94 0.02 2.52 85 BAYES_05 6467 2.72 3.49 2.48 86 XM_H_Trusted_IP 6310 1.85 0.00 2.42 87 RCVD_IN_IADB_SENDERID 6284 2.06 0.93 2.41 88 RCVD_IN_IADB_DK 6126 2.02 0.92 2.35 89 TM2_M_URI_OPT_OUT 6047 2.40 2.66 2.32 90 XMBdyGiftCard01 5982 2.06 1.31 2.29 91 BOTNET 5607 9.43 33.33 2.15 92 RELAYCOUNTRY_CA 5465 2.63 4.39 2.10 93 XM_B_SpammyTLD 5452 3.05 6.18 2.09 94 RCVD_IN_IADB_VOUCHED 4978 1.53 0.30 1.91 95 XM_PDF 4920 1.55 0.44 1.89 96 BAYES_95 4768 2.25 3.62 1.83 97 UNTRUSTED_Relay 4552 8.49 30.63 1.75 98 IN_HORDE_ADDRESS_BOOK 4490 1.32 0.02 1.72 99 MAILING_LIST_MULTI 4427 1.56 1.12 1.70 100 DKIM_ADSP_NXDOMAIN 4405 2.96 7.13 1.69 101 USER_IN_DEF_DKIM_WL 4352 1.28 0.00 1.67 102 XMStockSpam_06 4078 1.58 1.62 1.56 103 XM_DK_Undo_01 3908 1.30 0.63 1.50 104 TM2_M_VERY_LONG_WORD 3868 1.55 1.78 1.48 105 XMSubNoVowel 3782 1.40 1.25 1.45 106 SUBJ_ALL_CAPS 3773 1.59 2.04 1.45 107 XM_SPF_SoftFail 3710 3.19 8.99 1.42 108 XMBrknScrpt_02 3700 1.25 0.71 1.42 109 XM_ProductURIs 3687 1.36 1.20 1.41 110 XM_OfRef6 3683 1.81 3.13 1.41 111 KHOP_HELO_FCRDNS 3577 3.79 11.71 1.37 112 URI_TRY_3LD 3533 1.16 0.53 1.35 113 TooManyTo_002 3525 1.42 1.66 1.35 114 HTML_MIME_NO_HTML_TAG 3451 3.21 9.41 1.32 115 AC_FROM_MANY_DOTS 3413 1.01 0.02 1.31 116 RCVD_IN_BL_SPAMCOP_NET 3373 5.50 19.30 1.29 117 XM_H_Long_From02 3323 1.27 1.27 1.27 118 URI_HEX 3291 1.44 2.03 1.26 119 XMGappySubj_01 3271 1.02 0.27 1.25 120 XMDiploma_00 3254 1.42 1.97 1.25 121 RCVD_IN_IADB_OPTIN 3121 0.97 0.24 1.20 122 XM_GoogleGroups 3001 0.95 0.31 1.15 123 TR_XM_RelayPhish 2972 1.25 1.62 1.14 124 ANY_BOUNCE_MESSAGE 2945 0.92 0.22 1.13 125 BOUNCE_MESSAGE 2943 0.92 0.22 1.13 126 DKIM_ADSP_CUSTOM_MED 2919 1.51 2.78 1.12 127 T_XMDrugObfuBody_08 2893 1.46 2.59 1.11 128 XMBody_17 2800 1.17 1.47 1.07 129 XMBody_95 2776 0.83 0.04 1.06 130 T_FILL_THIS_FORM_SHORT 2736 1.20 1.68 1.05 131 TR_Symld_Words 2736 1.14 1.45 1.05 132 DIET_1 2654 2.06 5.46 1.02 133 HTML_FONT_FACE_BAD 2636 0.92 0.62 1.01 134 TooManyTo_003 2627 1.10 1.41 1.01 135 XMPhish11 2588 1.07 1.32 0.99 136 XM_B_REG_HTML 2565 0.86 0.45 0.98 137 XM_RXBody 2534 0.85 0.45 0.97 138 XMHTML_After_End 2326 0.97 1.24 0.89 139 XM_B_Unsub2 2231 1.06 1.72 0.86 140 TooManyTo_004 2175 0.90 1.13 0.83 141 NML_ADSP_CUSTOM_MED 2151 1.25 2.66 0.82 142 XMSubMetaI_00 2147 0.92 1.24 0.82 143 XM_UB50 2107 3.78 13.52 0.81 144 USER_IN_WHITELIST 2092 0.61 0.00 0.80 145 RCVD_IN_MSPIKE_BL 2086 2.16 6.62 0.80 146 T_XMHurry_00 2043 0.85 1.09 0.78 147 TooManyTo_005 1909 0.78 0.92 0.73 148 XMGenDplmaNmb 1893 0.92 1.56 0.73 149 XMBody_78 1861 0.72 0.73 0.71 150 TR_MetaPhish_Combo_01 1820 0.64 0.43 0.70 151 XM_Body_Dirty_Words_01 1800 0.66 0.56 0.69 152 XMBSHREFv2 1745 0.55 0.18 0.67 153 XMHTMLBadTable_001 1742 0.64 0.53 0.67 154 XM_B_SexDrugs1 1740 0.63 0.52 0.67 155 XMSexyCombo_01 1682 1.00 2.14 0.64 156 HTML_TAG_BALANCE_BODY 1651 0.60 0.48 0.63 157 FORGED_GMAIL_RCVD 1616 1.05 2.45 0.62 158 FILL_THIS_FORM 1589 0.96 2.12 0.61 159 MPART_ALT_DIFF_COUNT 1588 0.64 0.75 0.61 160 HTML_IMAGE_ONLY_20 1568 0.49 0.15 0.60 161 T_XMDrugObfuBody_00 1548 0.82 1.56 0.59 162 T_TooManySym_03 1542 0.47 0.09 0.59 163 HELO_NODOT 1532 0.57 0.53 0.59 164 HELO_NO_DOMAIN 1524 0.57 0.52 0.58 165 XMLngstWrd_00 1495 0.54 0.43 0.57 166 XMSubMetaSxObfu_02 1485 0.48 0.18 0.57 167 XMPhish30 1453 0.61 0.77 0.56 168 PLING_QUERY 1431 0.54 0.52 0.55 169 XMLngstWrd_01 1417 0.51 0.40 0.54 170 XM_H_PHPMailer 1411 0.80 1.65 0.54 171 XM_B_COPY_HTML 1403 0.55 0.60 0.54 172 RDNS_DYNAMIC 1372 0.72 1.36 0.53 173 XMSubMetaSxObfu_03 1361 0.60 0.87 0.52 174 XMSubGiftCard1 1342 0.43 0.15 0.51 175 TR_XM_PHPDW 1308 0.83 1.92 0.50 176 FILL_THIS_FORM_LONG 1293 0.86 2.04 0.50 177 RELAYCOUNTRY_GB 1272 1.04 2.86 0.49 178 TR_XM_PHPForged 1253 0.79 1.79 0.48 179 TR_XM_FormFill2 1246 0.78 1.79 0.48 180 XM_H_PHPOS 1230 0.78 1.79 0.47 181 XMRcvdHeader_15 1214 0.36 0.00 0.47 182 TR_LOTS_OF_MONEY2 1204 0.57 0.92 0.46 183 T_MONEY_PERCENT 1204 0.57 0.92 0.46 184 XMCapTrack 1196 0.41 0.27 0.46 185 FILL_THIS_FORM_LOAN 1176 0.55 0.89 0.45 186 XMSlimDrugH 1171 0.78 1.87 0.45 187 SUBJ_DOLLARS 1154 0.84 2.14 0.44 188 XM_Body_Obfu01 1118 0.36 0.13 0.43 189 XMPhish14 1094 0.43 0.48 0.42 190 T_Symld_Words_02 1081 0.92 2.59 0.41 191 XMNoVowels 1059 0.41 0.40 0.41 192 XMLngstWrd_02 1040 0.39 0.35 0.40 193 T_TooManySym_04 1019 0.31 0.03 0.39 194 SpammyFromTLD_01 1003 0.93 2.70 0.38 195 TR_Mismatch_TLD_01 993 0.62 1.40 0.38 196 RCVD_IN_MSPIKE_L3 990 0.51 0.94 0.38 197 XM_URI_RBL 979 0.70 1.75 0.38 198 FSL_HELO_FAKE 962 0.48 0.85 0.37 199 XM_Walgreens_Forge 947 0.30 0.08 0.36 200 MISSING_HEADERS 942 0.80 2.23 0.36 ----------------------------------------------------------------------