Email: 746612 Autolearn: 0 AvgScore: 4.59 AvgScanTime: 4.13 sec Spam: 241998 Autolearn: 0 AvgScore: 14.34 AvgScanTime: 5.06 sec Ham: 504614 Autolearn: 0 AvgScore: -0.08 AvgScanTime: 3.69 sec Time Spent Running SA: 856.39 hours Time Spent Processing Spam: 339.81 hours Time Spent Processing Ham: 516.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 233183 89.96 96.36 86.90 2 DKIM_SIGNED 174894 66.37 72.27 63.54 3 XM_DK_Pass 170737 65.09 70.55 62.47 4 DCC_CHECK 170344 43.43 70.39 30.50 5 DKIM_VALID 160578 60.67 66.36 57.94 6 XMListUnsubscribeExists 146035 46.26 60.35 39.51 7 DKIM_VALID_AU 123227 44.12 50.92 40.86 8 XM_H_QuotedFrom 111522 37.91 46.08 33.98 9 MIME_HTML_ONLY 99266 26.43 41.02 19.44 10 XM_DK_Undo_02 98057 20.71 40.52 11.21 11 BAYES_99 89687 19.38 37.06 10.90 12 BAYES_999 74840 16.31 30.93 9.30 13 BAYES_50 74170 49.28 30.65 58.21 14 HTML_FONT_LOW_CONTRAST 72473 25.53 29.95 23.41 15 LOC_TINY_FONT_1 71365 22.69 29.49 19.43 16 TR_DCC_Bayes_99 68125 12.32 28.15 4.73 17 DCC_CHECK_NEGATIVE 68058 54.89 28.12 67.73 18 RELAYCOUNTRY_META 59409 12.18 24.55 6.24 19 BOTNET 56577 8.26 23.38 1.01 20 XMSubLong 55467 19.03 22.92 17.17 21 BOTNET_IPINHOSTNAME 53546 10.22 22.13 4.52 22 FVGT_m_MULTI_ODD 52982 20.11 21.89 19.25 23 DKIM_VALID_EF 50345 22.69 20.80 23.60 24 T_TM2_M_HEADER_IN_MSG 49358 27.21 20.40 30.47 25 UNTRUSTED_Relay 48245 8.08 19.94 2.40 26 FROM_EXCESS_BASE64 43693 7.62 18.06 2.62 27 T_REMOTE_IMAGE 42545 8.29 17.58 3.83 28 HTML_MIME_NO_HTML_TAG 40983 7.26 16.94 2.61 29 T_KAM_HTML_FONT_INVALID 40367 14.48 16.68 13.42 30 HTML_IMAGE_RATIO_02 39099 9.67 16.16 6.56 31 XM_Body_Dirty_Words 38364 11.17 15.85 8.93 32 MIME_HEADER_CTYPE_ONLY 38130 5.22 15.76 0.17 33 HTML_SHORT_LINK_IMG_1 37377 7.29 15.45 3.38 34 XM_Multi_Part_URI 37059 11.27 15.31 9.34 35 BODY_URI_ONLY 37034 5.01 15.30 0.07 36 MISSING_HEADERS 36227 5.24 14.97 0.57 37 MultiRelay 36107 17.01 14.92 18.01 38 SHORTENED_URL_SRC 34577 6.73 14.29 3.11 39 SHORTENER_SHORT_IMG 34526 6.72 14.27 3.10 40 URI_BUFFLY 34515 6.72 14.26 3.10 41 FSL_BULK_SIG 34502 9.85 14.26 7.74 42 XM_Evil_Numbers_Gen 29966 9.93 12.38 8.75 43 BAYES_80 28299 6.26 11.69 3.66 44 XM_UncommonTLD01 26429 5.81 10.92 3.36 45 HTML_IMAGE_ONLY_08 25685 4.99 10.61 2.29 46 BAYES_60 23083 7.34 9.54 6.29 47 LOTS_OF_MONEY 22856 8.06 9.44 7.39 48 RELAYCOUNTRY_TH 22791 3.07 9.42 0.02 49 T_XMDrugObfuBody_14 21244 8.08 8.78 7.75 50 XMSexyCombo_05 21010 4.31 8.68 2.21 51 XMNumbers 20064 4.67 8.29 2.93 52 XM_H_Long_From01 18663 5.89 7.71 5.02 53 XM_B_Phish_Phrases 18064 6.31 7.46 5.76 54 MPART_ALT_DIFF 16880 6.05 6.98 5.60 55 HTML_IMAGE_RATIO_04 16537 4.86 6.83 3.92 56 LotsOfNums_01 16123 7.46 6.66 7.85 57 TooManyTo_001 16002 8.70 6.61 9.70 58 TR_XM_DocInvoice 15821 5.55 6.54 5.07 59 BAYES_95 15669 3.86 6.47 2.60 60 DKIM_INVALID 14316 5.71 5.92 5.60 61 XMSubMetaSx_00 13803 4.49 5.70 3.91 62 XM_UB50 13538 3.20 5.59 2.05 63 HTML_IMAGE_ONLY_04 12219 2.46 5.05 1.21 64 MIME_HTML_MOSTLY 11745 3.10 4.85 2.27 65 RCVD_IN_RP_RNBL 11039 1.52 4.56 0.06 66 XMStrtUSub 10954 4.71 4.53 4.80 67 RCVD_IN_RP_SAFE 10668 5.98 4.41 6.74 68 RCVD_IN_MSPIKE_H2 10527 4.51 4.35 4.59 69 XM_UB60 10524 1.46 4.35 0.08 70 XM_UB80 10256 1.39 4.24 0.03 71 SpammyFromTLD_02 10063 1.47 4.16 0.18 72 XM_SPF_SoftFail 9618 2.70 3.97 2.09 73 MIME_QP_LONG_LINE 9387 4.87 3.88 5.35 74 HTML_IMAGE_RATIO_06 8848 3.37 3.66 3.23 75 T_TooManySym_01 8764 3.81 3.62 3.90 76 XM_SendGrid 8717 4.28 3.60 4.60 77 TM2_M_URI_OPT_OUT 8371 4.31 3.46 4.72 78 XM_DIRTYINTL 8096 2.19 3.35 1.64 79 RCVD_IN_RP_CERTIFIED 8045 5.18 3.32 6.08 80 BOTNET_NORDNS 7785 1.06 3.22 0.02 81 URI_HEX 7748 1.89 3.20 1.26 82 DIET_1 7722 1.29 3.19 0.38 83 HTML_IMAGE_RATIO_08 7407 2.30 3.06 1.93 84 MultiRelay_Combo 6902 1.08 2.85 0.22 85 MultiRelay_CC 6902 1.08 2.85 0.22 86 RELAYCOUNTRY_CA 6846 1.80 2.83 1.31 87 XM_URI_RBL 6745 0.99 2.79 0.13 88 XM_CamelCaseFrm001 6527 1.86 2.70 1.46 89 XM_UB95 6493 0.88 2.68 0.02 90 MIME_HTML_ONLY_MULTI 6350 3.65 2.62 4.14 91 XMSubMetaI_00 6102 1.03 2.52 0.32 92 XM_OfRef6 5917 1.83 2.45 1.54 93 XMSlimDrugH 5805 1.01 2.40 0.35 94 SUBJ_ALL_CAPS 5701 1.67 2.36 1.34 95 T_XMDrugObfuBody_08 5483 1.55 2.27 1.21 96 RCVD_IN_BL_SPAMCOP_NET 5046 0.85 2.09 0.25 97 XMDiploma_00 4880 1.80 2.02 1.69 98 XM_UB99 4804 0.66 1.99 0.02 99 RCVD_IN_IADB_LISTED 4781 3.99 1.98 4.95 100 HTML_FONT_SIZE_LARGE 4717 1.26 1.95 0.93 101 ALL_TRUSTED 4583 16.11 1.89 22.92 102 RCVD_IN_IADB_SPF 4509 3.55 1.86 4.35 103 RCVD_IN_IADB_SENDERID 4285 3.15 1.77 3.82 104 URIBL_BLACK 4234 0.60 1.75 0.04 105 RCVD_IN_IADB_DK 4214 3.10 1.74 3.76 106 HTML_SHORT_CENTER 4202 0.85 1.74 0.43 107 BAYES_40 3511 3.10 1.45 3.89 108 MAILING_LIST_MULTI 3503 2.10 1.45 2.42 109 XMBdyGiftCard01 3459 1.03 1.43 0.84 110 RELAYCOUNTRY_FR 3425 0.59 1.42 0.19 111 TR_Mismatch_TLD_02 3417 0.50 1.41 0.06 112 XM_DK_Undo_01 3382 1.70 1.40 1.85 113 URIBL_DBL_SPAM 3278 0.46 1.35 0.03 114 URI_TRY_3LD 3277 1.38 1.35 1.40 115 XM_ProductURIs 3227 1.15 1.33 1.06 116 XMBody_17 3225 0.72 1.33 0.42 117 XM_BadFromFormat 3147 0.53 1.30 0.17 118 TR_XM_RelayPhish 3133 0.73 1.29 0.46 119 XMStockSpam_06 3107 1.21 1.28 1.18 120 PLING_QUERY 3106 0.57 1.28 0.23 121 XM_UB999 3094 0.42 1.28 0.02 122 LOW_PRICE 3064 0.53 1.27 0.17 123 SpammyFromTLD_01 3016 0.90 1.25 0.74 124 XMSubMetaSSx_00 3005 0.52 1.24 0.17 125 BAYES_00 3002 6.99 1.24 9.74 126 URI_NOVOWEL 2989 0.71 1.24 0.46 127 XMSexyCombo_01 2952 1.02 1.22 0.93 128 XMHTML_After_End 2946 0.62 1.22 0.34 129 XM_HighProb1 2939 0.40 1.21 0.01 130 TM2_M_VERY_LONG_WORD 2911 0.90 1.20 0.76 131 TooManyTo_002 2883 2.36 1.19 2.92 132 T_FILL_THIS_FORM_SHORT 2878 1.04 1.19 0.97 133 XMSubMetaI_01 2867 0.40 1.18 0.02 134 DKIM_ADSP_CUSTOM_MED 2821 1.04 1.17 0.98 135 TR_Caps_n_Bayes_99 2805 0.39 1.16 0.03 136 XM_H_Long_From02 2802 1.91 1.16 2.27 137 UNPARSEABLE_RELAY 2794 2.83 1.15 3.63 138 XMGenDplmaNmb 2782 1.14 1.15 1.13 139 ANY_BOUNCE_MESSAGE 2766 6.40 1.14 8.92 140 BOUNCE_MESSAGE 2766 6.40 1.14 8.92 141 BAYES_20 2752 2.31 1.14 2.87 142 T_XMHurry_00 2629 0.57 1.09 0.33 143 TooManyTo_003 2592 1.77 1.07 2.11 144 T_XMDrugObfuBody_00 2554 0.67 1.06 0.49 145 RELAYCOUNTRY_PL 2524 0.35 1.04 0.01 146 XM_JunkDunk 2512 0.34 1.04 0.00 147 NML_ADSP_CUSTOM_MED 2485 0.81 1.03 0.70 148 T_MONEY_PERCENT 2478 0.59 1.02 0.38 149 TR_LOTS_OF_MONEY2 2478 0.59 1.02 0.38 150 FROM_MISSP_REPLYTO 2427 0.34 1.00 0.02 151 RELAYCOUNTRY_AT 2417 0.40 1.00 0.11 152 RELAYCOUNTRY_DE 2390 0.64 0.99 0.48 153 XMPhish11 2388 1.02 0.99 1.04 154 FORGED_GMAIL_RCVD 2376 0.65 0.98 0.49 155 XMPhish30 2347 0.48 0.97 0.24 156 KHOP_DYNAMIC 2337 0.73 0.97 0.61 157 NO_DNS_FOR_FROM 2324 0.73 0.96 0.61 158 RELAYCOUNTRY_IN 2305 0.38 0.95 0.10 159 TO_NO_BRKTS_FROM_MSSP 2300 0.33 0.95 0.03 160 XM_H_PHPOS 2290 1.20 0.95 1.33 161 TR_Symld_Words 2285 1.17 0.94 1.27 162 FROM_MISSP_EH_MATCH 2258 0.31 0.93 0.01 163 RELAYCOUNTRY_CN 2216 0.34 0.92 0.06 164 T_Symld_Words_02 2214 0.67 0.91 0.55 165 HTML_FONT_FACE_BAD 2207 0.57 0.91 0.41 166 XM_PDF 2173 4.21 0.90 5.80 167 TR_XM_DK_Bayes 2149 3.47 0.89 4.71 168 XMWghtMeta_00 2142 0.29 0.89 0.01 169 RELAYCOUNTRY_GB 2128 0.94 0.88 0.97 170 ADVANCE_FEE_3_NEW 2097 0.30 0.87 0.03 171 RCVD_IN_IADB_VOUCHED 2077 2.52 0.86 3.32 172 RELAYCOUNTRY_RU 2016 0.28 0.83 0.02 173 TooManyTo_004 1999 1.11 0.83 1.25 174 TR_XM_DK_Bayes1 1986 3.08 0.82 4.17 175 T_TooManySym_02 1926 1.32 0.80 1.58 176 XM_RXBody 1908 0.59 0.79 0.49 177 NORDNS_LOW_CONTRAST 1850 0.26 0.76 0.01 178 DATE_IN_PAST_06_12 1819 0.27 0.75 0.04 179 TR_XM_DK_Bayes2 1815 2.61 0.75 3.50 180 TVD_SPACE_RATIO_MINFP 1779 0.24 0.74 0.01 181 BAYES_05 1765 1.45 0.73 1.80 182 FVGT_m_MULTI_ODD_EMAIL 1764 0.29 0.73 0.08 183 TooManyTo_005 1763 0.96 0.73 1.07 184 HTTPS_HTTP_MISMATCH 1762 0.53 0.73 0.44 185 URIBL_DBL_ABUSE_REDIR 1762 0.36 0.73 0.19 186 MPART_ALT_DIFF_COUNT 1735 0.44 0.72 0.31 187 REMOVE_BEFORE_LINK 1734 0.41 0.72 0.26 188 XMBody_78 1707 0.41 0.71 0.28 189 XMHTMLBadTable_001 1666 0.44 0.69 0.32 190 XM_B_REG_HTML 1632 0.49 0.67 0.41 191 RELAYCOUNTRY_LT 1628 0.24 0.67 0.03 192 XMBrknScrpt_02 1621 0.59 0.67 0.55 193 XMNoVowels 1591 0.97 0.66 1.13 194 XMMoneyMeta_00 1588 0.55 0.66 0.50 195 TR_XM_FormFill 1587 0.23 0.66 0.02 196 XMCapTrack 1581 1.22 0.65 1.49 197 XMPhish14 1566 0.39 0.65 0.26 198 SUBJ_DOLLARS 1526 0.30 0.63 0.15 199 XM_H_PHPMailer 1515 0.72 0.63 0.76 200 HTML_TAG_BALANCE_BODY 1502 0.49 0.62 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 438491 89.96 96.36 86.90 2 DCC_CHECK_NEGATIVE 341787 54.89 28.12 67.73 3 DKIM_SIGNED 320644 66.37 72.27 63.54 4 XM_DK_Pass 315211 65.09 70.55 62.47 5 BAYES_50 293737 49.28 30.65 58.21 6 DKIM_VALID 292361 60.67 66.36 57.94 7 DKIM_VALID_AU 206180 44.12 50.92 40.86 8 XMListUnsubscribeExists 199348 46.26 60.35 39.51 9 XM_H_QuotedFrom 171485 37.91 46.08 33.98 10 DCC_CHECK 153899 43.43 70.39 30.50 11 T_TM2_M_HEADER_IN_MSG 153779 27.21 20.40 30.47 12 DKIM_VALID_EF 119094 22.69 20.80 23.60 13 HTML_FONT_LOW_CONTRAST 118139 25.53 29.95 23.41 14 ALL_TRUSTED 115675 16.11 1.89 22.92 15 MIME_HTML_ONLY 98099 26.43 41.02 19.44 16 LOC_TINY_FONT_1 98056 22.69 29.49 19.43 17 FVGT_m_MULTI_ODD 97148 20.11 21.89 19.25 18 MultiRelay 90867 17.01 14.92 18.01 19 XMSubLong 86627 19.03 22.92 17.17 20 T_KAM_HTML_FONT_INVALID 67736 14.48 16.68 13.42 21 XM_DK_Undo_02 56570 20.71 40.52 11.21 22 BAYES_99 55012 19.38 37.06 10.90 23 BAYES_00 49158 6.99 1.24 9.74 24 TooManyTo_001 48960 8.70 6.61 9.70 25 XM_Multi_Part_URI 47116 11.27 15.31 9.34 26 BAYES_999 46927 16.31 30.93 9.30 27 XM_DKIMWhitelistDomains 46708 6.28 0.08 9.26 28 XM_Body_Dirty_Words 45044 11.17 15.85 8.93 29 BOUNCE_MESSAGE 45033 6.40 1.14 8.92 30 ANY_BOUNCE_MESSAGE 45033 6.40 1.14 8.92 31 XM_Evil_Numbers_Gen 44169 9.93 12.38 8.75 32 LotsOfNums_01 39593 7.46 6.66 7.85 33 T_XMDrugObfuBody_14 39084 8.08 8.78 7.75 34 FSL_BULK_SIG 39062 9.85 14.26 7.74 35 LOTS_OF_MONEY 37285 8.06 9.44 7.39 36 IN_ZIMBRA_NJ_WHITELIST 36953 4.96 0.03 7.32 37 RCVD_IN_RP_SAFE 34006 5.98 4.41 6.74 38 HTML_IMAGE_RATIO_02 33082 9.67 16.16 6.56 39 BAYES_60 31728 7.34 9.54 6.29 40 RELAYCOUNTRY_META 31507 12.18 24.55 6.24 41 RCVD_IN_RP_CERTIFIED 30657 5.18 3.32 6.08 42 XM_PDF 29275 4.21 0.90 5.80 43 XM_B_Phish_Phrases 29051 6.31 7.46 5.76 44 DKIM_INVALID 28283 5.71 5.92 5.60 45 MPART_ALT_DIFF 28281 6.05 6.98 5.60 46 MIME_QP_LONG_LINE 26980 4.87 3.88 5.35 47 TR_XM_DocInvoice 25592 5.55 6.54 5.07 48 XM_H_Long_From01 25340 5.89 7.71 5.02 49 RCVD_IN_IADB_LISTED 24984 3.99 1.98 4.95 50 XMStrtUSub 24210 4.71 4.53 4.80 51 TR_DCC_Bayes_99 23868 12.32 28.15 4.73 52 TM2_M_URI_OPT_OUT 23824 4.31 3.46 4.72 53 TR_XM_DK_Bayes 23755 3.47 0.89 4.71 54 XM_SendGrid 23227 4.28 3.60 4.60 55 RCVD_IN_MSPIKE_H2 23149 4.51 4.35 4.59 56 BOTNET_IPINHOSTNAME 22792 10.22 22.13 4.52 57 RCVD_IN_IADB_SPF 21963 3.55 1.86 4.35 58 TR_XM_DK_Bayes1 21030 3.08 0.82 4.17 59 MIME_HTML_ONLY_MULTI 20903 3.65 2.62 4.14 60 HTML_IMAGE_RATIO_04 19770 4.86 6.83 3.92 61 XMSubMetaSx_00 19753 4.49 5.70 3.91 62 T_TooManySym_01 19673 3.81 3.62 3.90 63 BAYES_40 19645 3.10 1.45 3.89 64 T_REMOTE_IMAGE 19330 8.29 17.58 3.83 65 RCVD_IN_IADB_SENDERID 19266 3.15 1.77 3.82 66 RCVD_IN_IADB_DK 18961 3.10 1.74 3.76 67 BAYES_80 18458 6.26 11.69 3.66 68 UNPARSEABLE_RELAY 18324 2.83 1.15 3.63 69 TR_XM_DK_Bayes2 17653 2.61 0.75 3.50 70 HTML_SHORT_LINK_IMG_1 17043 7.29 15.45 3.38 71 XM_UncommonTLD01 16975 5.81 10.92 3.36 72 TVD_RCVD_IP 16963 2.37 0.29 3.36 73 RCVD_IN_IADB_VOUCHED 16748 2.52 0.86 3.32 74 HTML_IMAGE_RATIO_06 16306 3.37 3.66 3.23 75 SHORTENED_URL_SRC 15674 6.73 14.29 3.11 76 SHORTENER_SHORT_IMG 15662 6.72 14.27 3.10 77 URI_BUFFLY 15662 6.72 14.26 3.10 78 XMNumbers 14801 4.67 8.29 2.93 79 TooManyTo_002 14739 2.36 1.19 2.92 80 BAYES_20 14492 2.31 1.14 2.87 81 FROM_EXCESS_BASE64 13204 7.62 18.06 2.62 82 HTML_MIME_NO_HTML_TAG 13185 7.26 16.94 2.61 83 BAYES_95 13135 3.86 6.47 2.60 84 MAILING_LIST_MULTI 12208 2.10 1.45 2.42 85 UNTRUSTED_Relay 12110 8.08 19.94 2.40 86 HTML_IMAGE_ONLY_08 11545 4.99 10.61 2.29 87 XM_H_Long_From02 11442 1.91 1.16 2.27 88 MIME_HTML_MOSTLY 11434 3.10 4.85 2.27 89 XMSexyCombo_05 11166 4.31 8.68 2.21 90 TooManyTo_003 10626 1.77 1.07 2.11 91 XM_SPF_SoftFail 10564 2.70 3.97 2.09 92 RCVD_IN_IADB_OPTIN 10505 1.58 0.52 2.08 93 XM_UB50 10337 3.20 5.59 2.05 94 RCVD_IN_MSPIKE_WL 9850 1.48 0.50 1.95 95 RCVD_IN_MSPIKE_H3 9847 1.48 0.49 1.95 96 HTML_IMAGE_RATIO_08 9755 2.30 3.06 1.93 97 XM_DK_Undo_01 9315 1.70 1.40 1.85 98 HELO_NODOT 9312 1.34 0.28 1.85 99 BAYES_05 9068 1.45 0.73 1.80 100 XMDiploma_00 8531 1.80 2.02 1.69 101 IN_HORDE_ADDRESS_BOOK 8381 1.14 0.05 1.66 102 XM_DIRTYINTL 8255 2.19 3.35 1.64 103 T_TooManySym_02 7953 1.32 0.80 1.58 104 XM_OfRef6 7765 1.83 2.45 1.54 105 INVALID_MSGID 7544 1.08 0.21 1.50 106 XMCapTrack 7494 1.22 0.65 1.49 107 RELAYCOUNTRY_PH 7361 0.99 0.02 1.46 108 XM_CamelCaseFrm001 7358 1.86 2.70 1.46 109 URI_TRY_3LD 7043 1.38 1.35 1.40 110 USER_IN_DEF_DKIM_WL 6863 0.94 0.07 1.36 111 SUBJ_ALL_CAPS 6752 1.67 2.36 1.34 112 XM_H_PHPOS 6697 1.20 0.95 1.33 113 RELAYCOUNTRY_CA 6615 1.80 2.83 1.31 114 TR_Symld_Words 6418 1.17 0.94 1.27 115 TO_MALFORMED 6407 0.87 0.04 1.27 116 URI_HEX 6336 1.89 3.20 1.26 117 TooManyTo_004 6299 1.11 0.83 1.25 118 HTML_IMAGE_ONLY_04 6127 2.46 5.05 1.21 119 T_XMDrugObfuBody_08 6088 1.55 2.27 1.21 120 XMStockSpam_06 5940 1.21 1.28 1.18 121 XMSubNoVowel 5870 0.90 0.34 1.16 122 XMGenDplmaNmb 5717 1.14 1.15 1.13 123 XMNoVowels 5681 0.97 0.66 1.13 124 XMLngstWrd_00 5589 0.85 0.30 1.11 125 XM_GoogleGroups 5502 0.87 0.41 1.09 126 TooManyTo_005 5418 0.96 0.73 1.07 127 XM_ProductURIs 5359 1.15 1.33 1.06 128 XMPhish11 5251 1.02 0.99 1.04 129 BOTNET 5080 8.26 23.38 1.01 130 T_OBFU_PDF_ATTACH 5005 0.77 0.30 0.99 131 DKIM_ADSP_CUSTOM_MED 4946 1.04 1.17 0.98 132 RELAYCOUNTRY_GB 4916 0.94 0.88 0.97 133 T_FILL_THIS_FORM_SHORT 4909 1.04 1.19 0.97 134 XMLngstWrd_01 4822 0.73 0.27 0.96 135 HTML_FONT_SIZE_LARGE 4699 1.26 1.95 0.93 136 XMSexyCombo_01 4682 1.02 1.22 0.93 137 XMBdyGiftCard01 4251 1.03 1.43 0.84 138 XM_H_PHPMailer 3851 0.72 0.63 0.76 139 TM2_M_VERY_LONG_WORD 3830 0.90 1.20 0.76 140 SpammyFromTLD_01 3718 0.90 1.25 0.74 141 NML_ADSP_CUSTOM_MED 3529 0.81 1.03 0.70 142 XMSolicitRefs_0 3405 0.55 0.29 0.67 143 TR_MetaPhish_Combo_01 3290 0.62 0.55 0.65 144 USER_IN_WHITELIST 3203 0.43 0.00 0.63 145 NO_DNS_FOR_FROM 3103 0.73 0.96 0.61 146 KHOP_DYNAMIC 3079 0.73 0.97 0.61 147 T_TooManySym_03 2878 0.43 0.15 0.57 148 MISSING_HEADERS 2872 5.24 14.97 0.57 149 T_Symld_Words_02 2791 0.67 0.91 0.55 150 XMBrknScrpt_02 2779 0.59 0.67 0.55 151 XM_ShortIntro_01 2695 0.46 0.32 0.53 152 XMLngstWrd_02 2671 0.43 0.24 0.53 153 HTML_IMAGE_ONLY_32 2556 0.42 0.24 0.51 154 XMSubMetaSxObfu_03 2517 0.53 0.59 0.50 155 XMMoneyMeta_00 2508 0.55 0.66 0.50 156 RCVD_IN_SORBS_DUL 2497 0.41 0.22 0.49 157 T_XMDrugObfuBody_00 2475 0.67 1.06 0.49 158 FORGED_GMAIL_RCVD 2467 0.65 0.98 0.49 159 XM_RXBody 2460 0.59 0.79 0.49 160 AC_DIV_BONANZA 2452 0.37 0.13 0.49 161 XMSexyCombo_04 2439 0.47 0.43 0.48 162 XMSubMetaSxObfu_02 2414 0.38 0.16 0.48 163 RELAYCOUNTRY_DE 2409 0.64 0.99 0.48 164 SHORT_HELO_AND_INLINE_IMAGE 2407 0.34 0.06 0.48 165 TR_XM_RelayPhish 2340 0.73 1.29 0.46 166 XMBody_95 2340 0.35 0.10 0.46 167 TM2_M_BODY_EMPTY 2328 0.36 0.15 0.46 168 URI_NOVOWEL 2316 0.71 1.24 0.46 169 RELAYCOUNTRY_NL 2299 0.45 0.44 0.46 170 XM_E_Blogspot 2292 0.33 0.08 0.45 171 XMGappySubj_01 2286 0.39 0.27 0.45 172 HTML_IMAGE_ONLY_28 2265 0.48 0.56 0.45 173 HTTPS_HTTP_MISMATCH 2196 0.53 0.73 0.44 174 HTML_SHORT_CENTER 2175 0.85 1.74 0.43 175 RELAYCOUNTRY_AU 2164 0.45 0.49 0.43 176 HTML_TAG_BALANCE_BODY 2146 0.49 0.62 0.43 177 XMBody_17 2115 0.72 1.33 0.42 178 XMDateMe_00 2106 0.36 0.24 0.42 179 FILL_THIS_FORM 2105 0.48 0.61 0.42 180 HTML_FONT_FACE_BAD 2063 0.57 0.91 0.41 181 XM_B_REG_HTML 2057 0.49 0.67 0.41 182 DKIM_ADSP_NXDOMAIN 2027 0.40 0.39 0.40 183 XM_B_COPY_HTML 1953 0.45 0.59 0.39 184 DIET_1 1917 1.29 3.19 0.38 185 T_MONEY_PERCENT 1916 0.59 1.02 0.38 186 TR_LOTS_OF_MONEY2 1916 0.59 1.02 0.38 187 RDNS_DYNAMIC 1853 0.44 0.59 0.37 188 XM_Body_Obfu01 1795 0.37 0.41 0.36 189 TM2_M_A_HREF_HREF 1761 0.39 0.49 0.35 190 XMLngstWrd_03 1758 0.28 0.14 0.35 191 XMSlimDrugH 1742 1.01 2.40 0.35 192 XMHTML_After_End 1692 0.62 1.22 0.34 193 T_XMHurry_00 1642 0.57 1.09 0.33 194 XM_H_PHPOS_M 1631 0.35 0.41 0.32 195 XMLKML 1626 0.22 0.00 0.32 196 XMSubMetaI_00 1617 1.03 2.52 0.32 197 XMRcvdHeader_15 1611 0.22 0.00 0.32 198 XMHTMLBadTable_001 1609 0.44 0.69 0.32 199 HTML_IMAGE_ONLY_24 1608 0.35 0.41 0.32 200 FUZZY_CREDIT 1601 0.23 0.06 0.32 ----------------------------------------------------------------------