Email: 382747 Autolearn: 0 AvgScore: 1.40 AvgScanTime: 1.76 sec Spam: 73463 Autolearn: 0 AvgScore: 12.70 AvgScanTime: 2.93 sec Ham: 309284 Autolearn: 0 AvgScore: -1.28 AvgScanTime: 1.48 sec Time Spent Running SA: 187.14 hours Time Spent Processing Spam: 59.79 hours Time Spent Processing Ham: 127.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 66777 87.81 90.90 87.08 2 DKIM_SIGNED 60571 81.70 82.45 81.52 3 XM_DK_Pass 57603 79.96 78.41 80.33 4 DCC_CHECK 57579 53.78 78.38 47.94 5 XM_B_Unicode 56672 74.39 77.14 73.74 6 RELAYCOUNTRY_US 56597 82.04 77.04 83.23 7 XMListUnsubscribeExists 51605 60.10 70.25 57.68 8 DKIM_VALID 50536 75.61 68.79 77.23 9 DKIM_VALID_AU 38942 59.74 53.01 61.34 10 XM_B_Unicode3 33942 45.96 46.20 45.90 11 XM_DK_Undo_02 30922 15.62 42.09 9.34 12 BAYES_50 30811 48.80 41.94 50.43 13 LOC_TINY_FONT_1 27156 30.94 36.97 29.51 14 MIME_HTML_ONLY 24956 25.48 33.97 23.47 15 HTML_FONT_LOW_CONTRAST 21883 30.29 29.79 30.41 16 DKIM_VALID_EF 20748 27.82 28.24 27.72 17 BAYES_99 20305 9.80 27.64 5.56 18 FVGT_m_MULTI_ODD 18539 22.32 25.24 21.63 19 XMSubLong 18157 21.56 24.72 20.82 20 RELAYCOUNTRY_META 17527 8.80 23.86 5.22 21 T_KAM_HTML_FONT_INVALID 16688 18.15 22.72 17.06 22 BOTNET 16101 6.54 21.92 2.88 23 BAYES_999 15605 7.71 21.24 4.50 24 TR_DCC_Bayes_99 15221 6.25 20.72 2.82 25 XM_Multi_Part_URI 14607 14.95 19.88 13.78 26 DCC_CHECK_NEGATIVE 14279 44.79 19.44 50.81 27 XM_Body_Dirty_Words 14167 15.51 19.28 14.61 28 T_TM2_M_HEADER_IN_MSG 13523 21.58 18.41 22.34 29 XM_UncommonTLD01 13265 6.40 18.06 3.63 30 HTML_IMAGE_RATIO_02 12829 11.17 17.46 9.67 31 LOTS_OF_MONEY 12049 10.94 16.40 9.64 32 UNTRUSTED_Relay 11918 4.38 16.22 1.56 33 BOTNET_IPINHOSTNAME 11037 7.70 15.02 5.96 34 DKIM_INVALID 10035 6.09 13.66 4.30 35 FSL_BULK_SIG 9779 9.25 13.31 8.29 36 XM_Evil_Numbers_Gen 9210 11.23 12.54 10.92 37 XM_B_Unsub 8514 11.30 11.59 11.23 38 XM_UB50 7442 2.64 10.13 0.86 39 XMSexyCombo_05 6991 6.14 9.52 5.34 40 XM_B_Phish_Phrases 6844 8.92 9.32 8.83 41 NO_DNS_FOR_FROM 6815 3.54 9.28 2.17 42 LotsOfNums_01 6738 8.11 9.17 7.86 43 RCVD_IN_MSPIKE_H2 6033 11.39 8.21 12.14 44 XM_H_Long_From01 5506 7.17 7.49 7.09 45 PDS_OTHER_BAD_TLD 5490 1.98 7.47 0.68 46 BAYES_60 5452 5.89 7.42 5.53 47 MPART_ALT_DIFF 5426 6.18 7.39 5.90 48 TooManyTo_001 5337 7.19 7.26 7.18 49 RCVD_IN_MSPIKE_BL 5274 2.39 7.18 1.25 50 BAYES_80 5186 3.98 7.06 3.25 51 RCVD_IN_MSPIKE_L3 5069 2.12 6.90 0.98 52 XMSubMetaSx_00 4976 4.26 6.77 3.67 53 XMStrtUSub 4643 5.33 6.32 5.10 54 XM_CamelCaseFrm001 4584 3.23 6.24 2.51 55 FROM_SUSPICIOUS_NTLD 4582 1.22 6.24 0.03 56 FROM_SUSPICIOUS_NTLD_FP 4573 1.22 6.22 0.03 57 MIME_HTML_MOSTLY 4418 3.34 6.01 2.70 58 HTML_IMAGE_RATIO_04 4318 6.23 5.88 6.32 59 SUBJ_ALL_CAPS 4050 2.66 5.51 1.98 60 RCVD_IN_BL_SPAMCOP_NET 4011 2.00 5.46 1.18 61 SpammyFromTLD_02 4008 1.25 5.46 0.25 62 RELAYCOUNTRY_CA 3777 2.80 5.14 2.25 63 LongTLD 3744 1.09 5.10 0.14 64 RELAYCOUNTRY_FR 3656 1.16 4.98 0.25 65 XM_SPF_SoftFail 3598 1.81 4.90 1.07 66 MIME_QP_LONG_LINE 3535 4.99 4.81 5.03 67 XMBody_17 3496 1.87 4.76 1.19 68 XM_SendGrid 3452 6.51 4.70 6.94 69 XMNumbers 3347 4.15 4.56 4.05 70 KHOP_HELO_FCRDNS 3225 1.80 4.39 1.19 71 TR_Mismatch_TLD_02 3201 0.89 4.36 0.06 72 RCVD_IN_RP_SAFE 3201 11.00 4.36 12.58 73 DKIM_ADSP_CUSTOM_MED 3115 1.64 4.24 1.02 74 FORGED_GMAIL_RCVD 3072 1.24 4.18 0.54 75 NML_ADSP_CUSTOM_MED 3017 1.33 4.11 0.67 76 TR_XM_PHPDW 3015 1.10 4.10 0.38 77 TR_XM_PHPForged 2957 1.08 4.03 0.38 78 TR_XM_FormFill2 2942 1.07 4.00 0.38 79 XM_H_PHPOS 2937 1.06 4.00 0.37 80 XMHTML_After_End 2916 1.29 3.97 0.65 81 BAYES_40 2855 4.88 3.89 5.12 82 BAYES_95 2812 2.37 3.83 2.03 83 FROM_EXCESS_BASE64 2755 3.84 3.75 3.86 84 XM_B_SpammyTLD 2714 2.30 3.69 1.97 85 XM_DIRTYINTL 2696 1.22 3.67 0.64 86 HTML_MIME_NO_HTML_TAG 2634 2.17 3.59 1.84 87 RCVD_IN_RP_RNBL 2575 0.73 3.51 0.07 88 URIBL_SBL_A 2556 0.80 3.48 0.16 89 T_XMDrugObfuBody_08 2541 2.26 3.46 1.97 90 TR_LOTS_OF_MONEY3 2535 0.99 3.45 0.40 91 BAYES_00 2412 17.61 3.28 21.01 92 T_FILL_THIS_FORM_SHORT 2393 1.41 3.26 0.97 93 TR_Sbj_FN_Bdy 2382 0.73 3.24 0.13 94 HK_SCAM 2365 0.64 3.22 0.03 95 T_TooManySym_01 2356 5.32 3.21 5.83 96 RCVD_IN_RP_CERTIFIED 2239 9.95 3.05 11.59 97 BOTNET_NORDNS 2158 0.58 2.94 0.02 98 HTML_IMAGE_RATIO_06 2148 3.71 2.92 3.90 99 BAYES_20 2133 3.84 2.90 4.06 100 BODY_URI_ONLY 2099 0.57 2.86 0.03 101 URI_HEX 2094 1.71 2.85 1.44 102 MIME_HTML_ONLY_MULTI 2072 3.28 2.82 3.39 103 DATE_IN_PAST_03_06 2063 0.61 2.81 0.09 104 TR_XM_MaxBayes 2043 0.55 2.78 0.01 105 RDNS_DYNAMIC 1979 0.89 2.69 0.46 106 RELAYCOUNTRY_DE 1963 0.75 2.67 0.29 107 T_XMDrugObfuBody_14 1948 1.91 2.65 1.73 108 TR_Symld_Words 1935 1.88 2.63 1.71 109 TR_XM_DK_Bayes 1906 14.37 2.59 17.16 110 XMSexyCombo_01 1882 1.15 2.56 0.82 111 XMNoVowels 1879 1.69 2.56 1.48 112 TM2_M_VERY_LONG_WORD 1862 1.53 2.53 1.29 113 REPLYTO_WITHOUT_TO_CC 1818 0.59 2.47 0.15 114 SpammyFromTLD_01 1788 0.85 2.43 0.47 115 HTML_IMAGE_RATIO_08 1763 2.15 2.40 2.09 116 TM2_M_URI_OPT_OUT 1734 2.84 2.36 2.95 117 MISSING_HEADERS 1694 0.75 2.31 0.38 118 NO_FM_NAME_IP_HOSTN 1686 0.44 2.30 0.00 119 FROM_ADDR_WS 1673 0.44 2.28 0.00 120 FROM_NO_USER 1662 0.44 2.26 0.00 121 MONEY_FORM_SHORT 1656 0.44 2.25 0.01 122 RCVD_IN_MSPIKE_WL 1632 8.61 2.22 10.13 123 RCVD_IN_MSPIKE_H3 1632 8.61 2.22 10.13 124 T_FILL_THIS_FORM_FRAUD_PHISH 1630 0.46 2.22 0.04 125 XM_B_Unsub2 1574 1.52 2.14 1.37 126 XMBdyGiftCard01 1571 2.37 2.14 2.43 127 XM_RXBody 1565 1.41 2.13 1.24 128 DATE_IN_PAST_06_12 1542 0.69 2.10 0.35 129 TR_XM_INV_DKIM 1524 0.56 2.07 0.20 130 XM_URI_RBL 1516 0.55 2.06 0.19 131 T_REMOTE_IMAGE 1494 3.39 2.03 3.72 132 XMDiploma_00 1491 1.75 2.03 1.69 133 TR_LOTS_OF_MONEY1 1474 0.44 2.01 0.06 134 DIET_1 1471 0.95 2.00 0.70 135 TR_XM_DK_Bayes1 1423 13.59 1.94 16.35 136 XM_OfRef6 1419 1.57 1.93 1.48 137 RELAYCOUNTRY_NG 1418 0.37 1.93 0.00 138 XMSubMetaI_00 1367 0.99 1.86 0.78 139 BAYES_05 1352 2.70 1.84 2.91 140 TR_XM_DK_SendGrid 1342 3.57 1.83 3.98 141 URG_BIZ 1313 0.42 1.79 0.10 142 XM_H_PHPMailer 1306 0.70 1.78 0.44 143 TR_XM_DK_Bayes2 1305 12.61 1.78 15.19 144 ALL_TRUSTED 1268 10.74 1.73 12.88 145 XMStockSpam_06 1266 1.67 1.72 1.66 146 RELAYCOUNTRY_IT 1225 0.35 1.67 0.04 147 T_MONEY_PERCENT 1210 0.78 1.65 0.58 148 TR_LOTS_OF_MONEY2 1210 0.78 1.65 0.58 149 NORDNS_LOW_CONTRAST 1198 0.32 1.63 0.00 150 RCVD_IN_PSBL 1194 0.36 1.63 0.06 151 MONEY_FRAUD_8 1182 0.32 1.61 0.01 152 XM_H_PHPOS_M 1176 0.46 1.60 0.19 153 PLING_QUERY 1162 0.76 1.58 0.57 154 XMGppyBdWords 1140 0.46 1.55 0.20 155 XMReplyNow 1117 0.38 1.52 0.11 156 XMSlimDrugH 1065 0.48 1.45 0.25 157 RCVD_IN_IADB_LISTED 1056 3.86 1.44 4.44 158 UPPERCASE_75_100 1054 0.33 1.43 0.06 159 XM_ProductURIs 1047 1.08 1.43 1.00 160 T_XMHurry_00 1022 0.67 1.39 0.50 161 XMGenDplmaNmb 1014 1.22 1.38 1.18 162 MAILING_LIST_MULTI 1012 1.94 1.38 2.08 163 URI_TRY_3LD 1011 1.70 1.38 1.78 164 T_XMDrugObfuBody_00 1007 1.48 1.37 1.50 165 RCVD_IN_IADB_SPF 985 3.34 1.34 3.82 166 XMSexyCombo_04 970 0.43 1.32 0.22 167 RCVD_IN_IADB_DK 967 2.87 1.32 3.24 168 RCVD_IN_IADB_SENDERID 967 2.97 1.32 3.36 169 XM_DK_Undo_01 962 1.69 1.31 1.78 170 XMHTMLBadTable_001 951 0.69 1.29 0.55 171 XM_UB60 942 0.30 1.28 0.06 172 TR_XM_MaxSPIKE 887 0.27 1.21 0.05 173 T_TooManySym_02 853 2.71 1.16 3.08 174 XM_ShortIntro_01 837 0.48 1.14 0.33 175 MPART_ALT_DIFF_COUNT 834 0.55 1.14 0.41 176 TR_XM_RelayPhish 823 0.35 1.12 0.17 177 XMBody_78 815 0.45 1.11 0.30 178 XMPhish30 802 0.93 1.09 0.90 179 UNPARSEABLE_RELAY 799 3.11 1.09 3.59 180 XMBrknScrpt_02 793 1.23 1.08 1.27 181 XM_H_TOP 790 0.21 1.08 0.00 182 TR_Mismatch_TLD_01 768 0.41 1.05 0.26 183 XMSubMetaSxObfu_03 759 0.44 1.03 0.29 184 XMPhish08 740 0.78 1.01 0.72 185 URIBL_DBL_SPAM 734 0.22 1.00 0.03 186 DKIM_ADSP_NXDOMAIN 729 0.41 0.99 0.27 187 URIBL_BLACK 727 0.20 0.99 0.01 188 RELAYCOUNTRY_AT 720 0.42 0.98 0.28 189 XM_UB99 707 0.19 0.96 0.01 190 HTML_TAG_BALANCE_CENTER 695 0.27 0.95 0.11 191 FORM_FRAUD_3 693 0.18 0.94 0.00 192 XM_B_COPY_HTML 689 0.51 0.94 0.41 193 XMSubMetaSSx_00 688 0.50 0.94 0.39 194 HK_RANDOM_REPLYTO 681 0.44 0.93 0.33 195 TR_MetaPhish_Combo_01 679 1.07 0.92 1.10 196 SUBJECT_NEEDS_ENCODING 665 0.18 0.91 0.01 197 SUBJ_ILLEGAL_CHARS 662 0.18 0.90 0.01 198 XM_BadFromFormat 653 0.31 0.89 0.17 199 RELAYCOUNTRY_GB 652 0.84 0.89 0.83 200 REMOVE_BEFORE_LINK 650 0.35 0.88 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 269320 87.81 90.90 87.08 2 RELAYCOUNTRY_US 257421 82.04 77.04 83.23 3 DKIM_SIGNED 252133 81.70 82.45 81.52 4 XM_DK_Pass 248453 79.96 78.41 80.33 5 DKIM_VALID 238845 75.61 68.79 77.23 6 XM_B_Unicode 228061 74.39 77.14 73.74 7 DKIM_VALID_AU 189720 59.74 53.01 61.34 8 XMListUnsubscribeExists 178410 60.10 70.25 57.68 9 DCC_CHECK_NEGATIVE 157162 44.79 19.44 50.81 10 BAYES_50 155987 48.80 41.94 50.43 11 DCC_CHECK 148261 53.78 78.38 47.94 12 XM_B_Unicode3 141950 45.96 46.20 45.90 13 HTML_FONT_LOW_CONTRAST 94058 30.29 29.79 30.41 14 LOC_TINY_FONT_1 91273 30.94 36.97 29.51 15 DKIM_VALID_EF 85747 27.82 28.24 27.72 16 MIME_HTML_ONLY 72575 25.48 33.97 23.47 17 T_TM2_M_HEADER_IN_MSG 69084 21.58 18.41 22.34 18 FVGT_m_MULTI_ODD 66887 22.32 25.24 21.63 19 BAYES_00 64985 17.61 3.28 21.01 20 XMSubLong 64379 21.56 24.72 20.82 21 TR_XM_DK_Bayes 53086 14.37 2.59 17.16 22 T_KAM_HTML_FONT_INVALID 52762 18.15 22.72 17.06 23 TR_XM_DK_Bayes1 50574 13.59 1.94 16.35 24 TR_XM_DK_Bayes2 46971 12.61 1.78 15.19 25 XM_Body_Dirty_Words 45201 15.51 19.28 14.61 26 XM_Multi_Part_URI 42632 14.95 19.88 13.78 27 ALL_TRUSTED 39829 10.74 1.73 12.88 28 RCVD_IN_RP_SAFE 38907 11.00 4.36 12.58 29 RCVD_IN_MSPIKE_H2 37547 11.39 8.21 12.14 30 RCVD_IN_RP_CERTIFIED 35848 9.95 3.05 11.59 31 XM_B_Unsub 34734 11.30 11.59 11.23 32 XM_Evil_Numbers_Gen 33776 11.23 12.54 10.92 33 XM_DKIMWhitelistDomains 31630 8.28 0.11 10.23 34 RCVD_IN_MSPIKE_WL 31331 8.61 2.22 10.13 35 RCVD_IN_MSPIKE_H3 31331 8.61 2.22 10.13 36 HTML_IMAGE_RATIO_02 29915 11.17 17.46 9.67 37 LOTS_OF_MONEY 29825 10.94 16.40 9.64 38 XM_DK_Undo_02 28879 15.62 42.09 9.34 39 XM_B_Phish_Phrases 27301 8.92 9.32 8.83 40 FSL_BULK_SIG 25640 9.25 13.31 8.29 41 LotsOfNums_01 24296 8.11 9.17 7.86 42 TooManyTo_001 22193 7.19 7.26 7.18 43 XM_H_Long_From01 21933 7.17 7.49 7.09 44 XM_SendGrid 21452 6.51 4.70 6.94 45 HTML_IMAGE_RATIO_04 19532 6.23 5.88 6.32 46 BOTNET_IPINHOSTNAME 18425 7.70 15.02 5.96 47 MPART_ALT_DIFF 18237 6.18 7.39 5.90 48 T_TooManySym_01 18022 5.32 3.21 5.83 49 BAYES_99 17186 9.80 27.64 5.56 50 BAYES_60 17109 5.89 7.42 5.53 51 XMSexyCombo_05 16522 6.14 9.52 5.34 52 RELAYCOUNTRY_META 16141 8.80 23.86 5.22 53 BAYES_40 15837 4.88 3.89 5.12 54 XMStrtUSub 15765 5.33 6.32 5.10 55 MIME_QP_LONG_LINE 15549 4.99 4.81 5.03 56 BAYES_999 13909 7.71 21.24 4.50 57 RCVD_IN_IADB_LISTED 13725 3.86 1.44 4.44 58 DKIM_INVALID 13288 6.09 13.66 4.30 59 BAYES_20 12559 3.84 2.90 4.06 60 XMNumbers 12538 4.15 4.56 4.05 61 TR_XM_DK_SendGrid 12322 3.57 1.83 3.98 62 HTML_IMAGE_RATIO_06 12069 3.71 2.92 3.90 63 FROM_EXCESS_BASE64 11935 3.84 3.75 3.86 64 RCVD_IN_IADB_SPF 11804 3.34 1.34 3.82 65 T_REMOTE_IMAGE 11498 3.39 2.03 3.72 66 XMSubMetaSx_00 11344 4.26 6.77 3.67 67 XM_UncommonTLD01 11239 6.40 18.06 3.63 68 UNPARSEABLE_RELAY 11108 3.11 1.09 3.59 69 MIME_HTML_ONLY_MULTI 10471 3.28 2.82 3.39 70 RCVD_IN_IADB_SENDERID 10390 2.97 1.32 3.36 71 BAYES_80 10041 3.98 7.06 3.25 72 RCVD_IN_IADB_DK 10018 2.87 1.32 3.24 73 T_TooManySym_02 9524 2.71 1.16 3.08 74 IN_ZIMBRA_NJ_WHITELIST 9520 2.49 0.01 3.08 75 TM2_M_URI_OPT_OUT 9127 2.84 2.36 2.95 76 BAYES_05 8995 2.70 1.84 2.91 77 BOTNET 8914 6.54 21.92 2.88 78 RCVD_IN_IADB_VOUCHED 8769 2.36 0.35 2.84 79 TR_DCC_Bayes_99 8712 6.25 20.72 2.82 80 INVALID_MSGID 8665 2.33 0.33 2.80 81 MIME_HTML_MOSTLY 8357 3.34 6.01 2.70 82 TVD_RCVD_IP 7829 2.15 0.52 2.53 83 XM_CamelCaseFrm001 7767 3.23 6.24 2.51 84 XMBdyGiftCard01 7511 2.37 2.14 2.43 85 XM_PDF 7154 1.94 0.39 2.31 86 TO_MALFORMED 7059 2.00 0.83 2.28 87 RELAYCOUNTRY_CA 6957 2.80 5.14 2.25 88 ANY_BOUNCE_MESSAGE 6837 1.83 0.25 2.21 89 BOUNCE_MESSAGE 6822 1.83 0.25 2.21 90 CK_HELO_DYNAMIC_SPLIT_IP 6808 1.84 0.33 2.20 91 HELO_DYNAMIC_IPADDR2 6802 1.79 0.07 2.20 92 NO_DNS_FOR_FROM 6716 3.54 9.28 2.17 93 HTML_IMAGE_RATIO_08 6452 2.15 2.40 2.09 94 MAILING_LIST_MULTI 6422 1.94 1.38 2.08 95 BAYES_95 6267 2.37 3.83 2.03 96 SUBJ_ALL_CAPS 6115 2.66 5.51 1.98 97 XM_B_SpammyTLD 6102 2.30 3.69 1.97 98 T_XMDrugObfuBody_08 6101 2.26 3.46 1.97 99 RCVD_IN_IADB_OPTIN 5751 1.57 0.33 1.86 100 HTML_MIME_NO_HTML_TAG 5684 2.17 3.59 1.84 101 IN_HORDE_ADDRESS_BOOK 5641 1.48 0.04 1.82 102 XM_DK_Undo_01 5513 1.69 1.31 1.78 103 URI_TRY_3LD 5494 1.70 1.38 1.78 104 TooManyTo_002 5465 1.53 0.53 1.77 105 T_XMDrugObfuBody_14 5363 1.91 2.65 1.73 106 XM_H_Trusted_IP 5318 1.39 0.00 1.72 107 TR_Symld_Words 5278 1.88 2.63 1.71 108 XMDiploma_00 5214 1.75 2.03 1.69 109 XMStockSpam_06 5119 1.67 1.72 1.66 110 UNTRUSTED_Relay 4835 4.38 16.22 1.56 111 USER_IN_DEF_DKIM_WL 4692 1.23 0.02 1.52 112 T_XMDrugObfuBody_00 4646 1.48 1.37 1.50 113 XMNoVowels 4577 1.69 2.56 1.48 114 XM_OfRef6 4575 1.57 1.93 1.48 115 URI_HEX 4469 1.71 2.85 1.44 116 XM_GoogleGroups 4451 1.23 0.36 1.44 117 XM_B_Unsub2 4235 1.52 2.14 1.37 118 TooManyTo_003 4145 1.17 0.46 1.34 119 TM2_M_VERY_LONG_WORD 3991 1.53 2.53 1.29 120 XMBrknScrpt_02 3916 1.23 1.08 1.27 121 RCVD_IN_MSPIKE_BL 3880 2.39 7.18 1.25 122 XMGappySubj_01 3853 1.02 0.09 1.25 123 XM_RXBody 3834 1.41 2.13 1.24 124 KHOP_HELO_FCRDNS 3676 1.80 4.39 1.19 125 XMBody_17 3676 1.87 4.76 1.19 126 RCVD_IN_BL_SPAMCOP_NET 3654 2.00 5.46 1.18 127 XMGenDplmaNmb 3643 1.22 1.38 1.18 128 HTML_FONT_FACE_BAD 3629 1.10 0.78 1.17 129 TooManyTo_004 3509 0.99 0.40 1.13 130 XM_H_Long_From02 3421 1.06 0.85 1.11 131 TR_MetaPhish_Combo_01 3401 1.07 0.92 1.10 132 XM_SPF_SoftFail 3319 1.81 4.90 1.07 133 DKIM_ADSP_CUSTOM_MED 3165 1.64 4.24 1.02 134 XM_ProductURIs 3085 1.08 1.43 1.00 135 TooManyTo_005 3062 0.87 0.36 0.99 136 RCVD_IN_MSPIKE_L3 3039 2.12 6.90 0.98 137 T_FILL_THIS_FORM_SHORT 3015 1.41 3.26 0.97 138 XMPhish30 2772 0.93 1.09 0.90 139 XM_UB50 2646 2.64 10.13 0.86 140 XM_B_REG_HTML 2635 0.83 0.73 0.85 141 RELAYCOUNTRY_GB 2579 0.84 0.89 0.83 142 TR_MSPIKEBAYES00 2561 0.67 0.00 0.83 143 XMSexyCombo_01 2523 1.15 2.56 0.82 144 XMBody_95 2469 0.66 0.06 0.80 145 XMSubMetaI_00 2417 0.99 1.86 0.78 146 SUBJ_DOLLARS 2298 0.67 0.39 0.74 147 XMPhish08 2242 0.78 1.01 0.72 148 T_TooManySym_03 2230 0.65 0.37 0.72 149 XMSubNoVowel 2183 0.63 0.31 0.71 150 DIET_1 2177 0.95 2.00 0.70 151 PDS_OTHER_BAD_TLD 2096 1.98 7.47 0.68 152 XMAntiAgingB 2090 0.57 0.13 0.68 153 NML_ADSP_CUSTOM_MED 2079 1.33 4.11 0.67 154 TM2_M_A_HREF_HREF 2064 0.69 0.76 0.67 155 HTML_TAG_BALANCE_BODY 2042 0.65 0.61 0.66 156 XMHTML_After_End 2020 1.29 3.97 0.65 157 XM_DIRTYINTL 1965 1.22 3.67 0.64 158 HELO_NODOT 1938 0.61 0.55 0.63 159 HELO_NO_DOMAIN 1934 0.61 0.55 0.63 160 FILL_THIS_FORM 1893 0.55 0.30 0.61 161 USER_IN_WHITELIST 1892 0.49 0.00 0.61 162 XM_Superlative01 1880 0.51 0.10 0.61 163 HTTPS_HTTP_MISMATCH 1803 0.58 0.57 0.58 164 XMCapTrack 1796 0.57 0.53 0.58 165 TR_LOTS_OF_MONEY2 1782 0.78 1.65 0.58 166 T_MONEY_PERCENT 1782 0.78 1.65 0.58 167 PLING_QUERY 1754 0.76 1.58 0.57 168 XMHTMLBadTable_001 1691 0.69 1.29 0.55 169 FORGED_GMAIL_RCVD 1682 1.24 4.18 0.54 170 T_XMHurry_00 1536 0.67 1.39 0.50 171 HTML_IMAGE_ONLY_20 1502 0.46 0.36 0.49 172 SpammyFromTLD_01 1458 0.85 2.43 0.47 173 FILL_THIS_FORM_LONG 1447 0.42 0.23 0.47 174 RDNS_DYNAMIC 1424 0.89 2.69 0.46 175 T_FILL_THIS_FORM_LOAN 1388 0.37 0.06 0.45 176 XM_H_PHPMailer 1376 0.70 1.78 0.44 177 XM_D_tchamptons_WL 1350 0.35 0.00 0.44 178 XMLngstWrd_00 1339 0.40 0.26 0.43 179 XMSubMetaSxObfu_02 1307 0.40 0.33 0.42 180 XMPhish14 1290 0.47 0.70 0.42 181 MPART_ALT_DIFF_COUNT 1266 0.55 1.14 0.41 182 XM_B_COPY_HTML 1255 0.51 0.94 0.41 183 TR_LOTS_OF_MONEY3 1242 0.99 3.45 0.40 184 HTML_OBFUSCATE_05_10 1239 0.35 0.13 0.40 185 XMSubMetaSSx_00 1220 0.50 0.94 0.39 186 XMLngstWrd_01 1199 0.36 0.24 0.39 187 XMRcvdHeader_15 1192 0.31 0.00 0.39 188 TR_XM_PHPDW 1188 1.10 4.10 0.38 189 MISSING_HEADERS 1168 0.75 2.31 0.38 190 TR_XM_PHPForged 1166 1.08 4.03 0.38 191 TR_XM_FormFill2 1161 1.07 4.00 0.38 192 XM_Body_Dirty_Words_01 1140 0.33 0.16 0.37 193 XM_H_PHPOS 1132 1.06 4.00 0.37 194 URI_NOVOWEL 1132 0.43 0.68 0.37 195 BASE64_LENGTH_79_INF 1120 0.37 0.43 0.36 196 FROM_GOV_DKIM_AU 1118 0.32 0.13 0.36 197 DATE_IN_PAST_06_12 1087 0.69 2.10 0.35 198 XM_Akamai 1014 0.27 0.02 0.33 199 XM_ShortIntro_01 1010 0.48 1.14 0.33 200 HK_RANDOM_REPLYTO 1010 0.44 0.93 0.33 ----------------------------------------------------------------------