Email: 487612 Autolearn: 0 AvgScore: 0.68 AvgScanTime: 1.73 sec Spam: 66312 Autolearn: 0 AvgScore: 12.66 AvgScanTime: 2.39 sec Ham: 421300 Autolearn: 0 AvgScore: -1.21 AvgScanTime: 1.63 sec Time Spent Running SA: 234.84 hours Time Spent Processing Spam: 44.09 hours Time Spent Processing Ham: 190.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 60498 56.52 91.23 51.05 2 DKIM_SIGNED 51630 52.35 77.86 48.34 3 DCC_CHECK 50956 35.91 76.84 29.47 4 XM_DK_Pass 50405 51.54 76.01 47.69 5 DKIM_VALID 47624 49.24 71.82 45.68 6 XMListUnsubscribeExists 46676 40.30 70.39 35.57 7 DKIM_VALID_AU 40521 39.03 61.11 35.55 8 XM_H_QuotedFrom 32107 27.24 48.42 23.90 9 BAYES_50 31258 51.76 47.14 52.49 10 XM_DK_Undo_02 24618 10.29 37.12 6.07 11 LOC_TINY_FONT_1 23392 19.17 35.28 16.63 12 HTML_FONT_LOW_CONTRAST 22770 21.60 34.34 19.59 13 MIME_HTML_ONLY 22728 16.57 34.27 13.78 14 XMSubLong 18935 15.38 28.55 13.30 15 BAYES_99 18444 7.86 27.81 4.72 16 FVGT_m_MULTI_ODD 16763 15.00 25.28 13.38 17 BAYES_999 15351 6.71 23.15 4.12 18 TR_DCC_Bayes_99 14716 5.21 22.19 2.53 19 DCC_CHECK_NEGATIVE 14473 63.33 21.83 69.87 20 BOTNET 14164 4.18 21.36 1.48 21 RELAYCOUNTRY_META 13997 5.28 21.11 2.79 22 BOTNET_IPINHOSTNAME 13373 6.29 20.17 4.10 23 XM_Body_Dirty_Words 13369 9.93 20.16 8.32 24 DKIM_VALID_EF 13123 18.06 19.79 17.79 25 T_KAM_HTML_FONT_INVALID 11596 11.13 17.49 10.13 26 T_TM2_M_HEADER_IN_MSG 11303 14.10 17.05 13.63 27 XM_Multi_Part_URI 11099 10.05 16.74 8.99 28 HTML_IMAGE_RATIO_02 11072 8.13 16.70 6.78 29 MultiRelay 10349 9.72 15.61 8.79 30 XM_UncommonTLD01 10082 4.19 15.20 2.45 31 UNTRUSTED_Relay 9470 2.64 14.28 0.81 32 XM_Evil_Numbers_Gen 8516 6.48 12.84 5.48 33 XM_H_Long_From01 8406 4.97 12.68 3.75 34 FSL_BULK_SIG 7845 5.45 11.83 4.44 35 XMSexyCombo_05 7612 4.23 11.48 3.09 36 LOTS_OF_MONEY 6997 6.87 10.55 6.29 37 XMSubMetaSx_00 6931 3.91 10.45 2.88 38 MPART_ALT_DIFF 6316 3.36 9.52 2.38 39 BAYES_60 5835 4.04 8.80 3.29 40 T_XMDrugObfuBody_14 5780 5.35 8.72 4.82 41 FROM_EXCESS_BASE64 5747 4.04 8.67 3.32 42 TooManyTo_001 5734 4.07 8.65 3.35 43 HTML_MIME_NO_HTML_TAG 5485 1.82 8.27 0.81 44 XM_UB50 5349 1.44 8.07 0.39 45 HTML_IMAGE_RATIO_04 5288 4.42 7.97 3.86 46 T_REMOTE_IMAGE 5039 2.77 7.60 2.00 47 XMNumbers 4550 2.61 6.86 1.94 48 BAYES_80 4378 2.56 6.60 1.92 49 RCVD_IN_RP_RNBL 4322 0.93 6.52 0.05 50 XM_B_Phish_Phrases 4137 4.35 6.24 4.06 51 DKIM_INVALID 4006 3.11 6.04 2.65 52 MIME_HTML_MOSTLY 3759 2.66 5.67 2.19 53 MIME_HTML_ONLY_MULTI 3667 1.84 5.53 1.26 54 XM_SPF_SoftFail 3610 1.40 5.44 0.77 55 HTML_IMAGE_RATIO_06 3405 2.93 5.13 2.58 56 HTML_SHORT_LINK_IMG_1 3375 0.71 5.09 0.02 57 BODY_URI_ONLY 3338 0.71 5.03 0.03 58 MIME_HEADER_CTYPE_ONLY 3332 0.75 5.02 0.08 59 HTML_SHORT_CENTER 3293 0.75 4.97 0.08 60 HTML_IMAGE_ONLY_04 3275 0.69 4.94 0.02 61 SHORTENER_SHORT_IMG 3241 0.66 4.89 0.00 62 XM_DIRTYINTL 3162 1.68 4.77 1.20 63 RCVD_IN_RP_SAFE 3114 8.42 4.70 9.00 64 XMStrtUSub 2988 3.33 4.51 3.15 65 FROM_SUSPICIOUS_NTLD 2826 0.68 4.26 0.12 66 HTML_IMAGE_RATIO_08 2816 1.84 4.25 1.46 67 LotsOfNums_01 2691 4.79 4.06 4.91 68 MultiRelay_Combo 2635 0.61 3.97 0.08 69 MultiRelay_CC 2635 0.61 3.97 0.08 70 SpammyFromTLD_02 2486 0.59 3.75 0.09 71 RELAYCOUNTRY_CA 2420 1.50 3.65 1.16 72 RCVD_IN_RP_CERTIFIED 2415 7.14 3.64 7.69 73 BOTNET_NORDNS 2293 0.47 3.46 0.01 74 XMSexyCombo_01 2288 0.85 3.45 0.44 75 BAYES_95 2225 1.46 3.36 1.16 76 XM_CamelCaseFrm001 2225 1.46 3.36 1.16 77 URI_HEX 2107 1.43 3.18 1.16 78 XM_OfRef6 2051 1.27 3.09 0.98 79 T_TooManySym_01 2040 4.05 3.08 4.21 80 XM_URI_RBL 2020 0.83 3.05 0.48 81 XMBdyGiftCard01 1987 1.15 3.00 0.86 82 NO_DNS_FOR_FROM 1987 1.18 3.00 0.89 83 TM2_M_URI_OPT_OUT 1959 36.44 2.95 41.71 84 XM_UB60 1830 0.40 2.76 0.03 85 UNPARSEABLE_RELAY 1829 2.68 2.76 2.67 86 T_Symld_Words_02 1787 0.66 2.69 0.34 87 XMSubMetaI_00 1725 0.85 2.60 0.58 88 RCVD_IN_MSPIKE_H2 1678 2.76 2.53 2.80 89 DKIM_ADSP_CUSTOM_MED 1645 0.76 2.48 0.49 90 RCVD_IN_BL_SPAMCOP_NET 1609 0.48 2.43 0.18 91 NML_ADSP_CUSTOM_MED 1607 0.60 2.42 0.32 92 RELAYCOUNTRY_IN 1595 0.36 2.41 0.04 93 SUBJ_ALL_CAPS 1560 1.36 2.35 1.21 94 FORGED_GMAIL_RCVD 1537 0.54 2.32 0.26 95 XM_H_Long_From02 1526 0.95 2.30 0.74 96 XMSexyCombo_04 1523 0.48 2.30 0.20 97 RELAYCOUNTRY_CN 1490 0.32 2.25 0.01 98 MISSING_HEADERS 1448 0.42 2.18 0.14 99 HTML_IMAGE_ONLY_24 1418 0.43 2.14 0.16 100 LongTLD 1395 0.41 2.10 0.14 101 XMBody_78 1382 0.54 2.08 0.29 102 URIBL_BLACK 1356 0.32 2.04 0.05 103 XM_SendGrid 1333 3.45 2.01 3.68 104 DIET_1 1331 0.59 2.01 0.37 105 T_XMDrugObfuBody_08 1321 0.89 1.99 0.72 106 BAYES_40 1306 2.56 1.97 2.66 107 T_XMHurry_00 1289 0.64 1.94 0.43 108 T_FILL_THIS_FORM_SHORT 1280 0.54 1.93 0.32 109 XMDiploma_00 1247 0.84 1.88 0.67 110 TVD_SPACE_RATIO_MINFP 1233 0.26 1.86 0.00 111 XMPhish30 1223 0.56 1.84 0.36 112 TR_Sbj_FN_Bdy 1199 0.32 1.81 0.09 113 XM_RXBody 1184 0.54 1.79 0.34 114 RCVD_IN_PSBL 1161 0.25 1.75 0.02 115 MAILING_LIST_MULTI 1158 1.04 1.75 0.93 116 LONG_JUNK_URI 1147 0.29 1.73 0.06 117 SpammyFromTLD_01 1132 0.43 1.71 0.23 118 XMGppyBdWords 1108 0.31 1.67 0.10 119 MIME_QP_LONG_LINE 1073 2.56 1.62 2.71 120 URI_TRY_3LD 1051 0.97 1.58 0.87 121 BAYES_20 1039 18.55 1.57 21.22 122 XMGenDplmaNmb 1010 0.55 1.52 0.40 123 FORM_FRAUD_5 986 0.20 1.49 0.00 124 BAYES_00 975 9.46 1.47 10.72 125 TR_Mismatch_TLD_02 970 0.23 1.46 0.04 126 XMStockSpam_06 966 0.68 1.46 0.56 127 XM_ProductURIs 955 0.98 1.44 0.91 128 DEAR_SOMETHING 953 0.23 1.44 0.04 129 XM_H_PHPOS 932 0.66 1.41 0.54 130 DATE_IN_PAST_12_24 917 0.26 1.38 0.08 131 BODY_ENHANCEMENT 915 0.20 1.38 0.01 132 TR_XM_RelayPhish 908 0.49 1.37 0.35 133 RELAYCOUNTRY_FR 904 0.30 1.36 0.14 134 ALL_TRUSTED 901 42.54 1.36 49.02 135 XMSubMetaSSx_00 889 0.37 1.34 0.21 136 T_MONEY_PERCENT 887 0.39 1.34 0.25 137 TR_LOTS_OF_MONEY2 887 0.39 1.34 0.25 138 SUBJ_DOLLARS 886 0.79 1.34 0.70 139 XM_salutation2 883 0.49 1.33 0.35 140 FILL_THIS_FORM 880 0.48 1.33 0.34 141 RELAYCOUNTRY_AT 861 0.35 1.30 0.20 142 XMBody_17 852 0.66 1.28 0.56 143 RCVD_IN_IADB_LISTED 851 2.57 1.28 2.77 144 DKIM_ADSP_NXDOMAIN 837 0.43 1.26 0.30 145 TR_Symld_Words 824 1.01 1.24 0.97 146 TR_XM_DK_Bayes 808 8.60 1.22 9.77 147 XMSubMetaSxObfu_03 806 0.38 1.22 0.25 148 TM2_M_VERY_LONG_WORD 804 0.72 1.21 0.65 149 FILL_THIS_FORM_LONG 794 0.43 1.20 0.31 150 XM_B_REG_HTML 778 0.67 1.17 0.59 151 PLING_QUERY 763 0.58 1.15 0.49 152 RELAYCOUNTRY_GB 754 0.39 1.14 0.27 153 XM_XX_Yahoo 752 0.19 1.13 0.04 154 RDNS_DYNAMIC 750 0.49 1.13 0.39 155 RCVD_IN_IADB_SPF 748 2.21 1.13 2.38 156 DATE_IN_PAST_06_12 736 0.20 1.11 0.06 157 RCVD_IN_IADB_SENDERID 732 1.97 1.10 2.11 158 RCVD_IN_IADB_DK 724 1.91 1.09 2.04 159 XMPhish11 722 0.57 1.09 0.49 160 T_FILL_THIS_FORM_FRAUD_PHISH 715 0.18 1.08 0.04 161 THIS_AD 702 0.53 1.06 0.45 162 BAYES_05 699 1.48 1.05 1.55 163 TR_XM_DK_Bayes1 697 8.28 1.05 9.42 164 T_XMDrugObfuBody_00 691 0.66 1.04 0.60 165 XM_UB99 684 0.15 1.03 0.01 166 RELAYCOUNTRY_CL 675 0.14 1.02 0.00 167 XM_B_COPY_HTML 662 0.54 1.00 0.47 168 URI_NOVOWEL 640 0.39 0.97 0.30 169 XM_UB80 638 0.14 0.96 0.01 170 XMPhish14 636 0.34 0.96 0.24 171 URIBL_DBL_SPAM 635 0.14 0.96 0.01 172 FILL_THIS_FORM_LOAN 634 0.39 0.96 0.31 173 TR_XM_DK_Bayes2 627 7.06 0.95 8.02 174 TEQF_USR_POLITE 620 0.13 0.93 0.00 175 ADVANCE_FEE_5_NEW 619 0.13 0.93 0.00 176 XM_Combo_Sbj 606 0.21 0.91 0.10 177 XM_DK_Undo_01 600 0.94 0.90 0.95 178 XM_H_PHPMailer 598 0.46 0.90 0.39 179 XM_H_Undi_Recip 592 0.24 0.89 0.13 180 XMHTMLBadTable_001 586 0.48 0.88 0.42 181 RELAYCOUNTRY_NL 583 0.19 0.88 0.09 182 HK_RANDOM_FROM 579 0.21 0.87 0.10 183 DATE_IN_PAST_03_06 576 0.17 0.87 0.06 184 HK_SCAM_N8 568 0.12 0.86 0.00 185 RCVD_IN_IADB_VOUCHED 563 1.71 0.85 1.85 186 HTML_FONT_FACE_BAD 558 0.38 0.84 0.30 187 XMSlimDrugH 554 0.31 0.84 0.22 188 HTML_TAG_BALANCE_BODY 547 0.35 0.82 0.27 189 RCVD_IN_IADB_OPTIN 546 1.11 0.82 1.16 190 XMClaimOffer 535 0.17 0.81 0.07 191 RELAYCOUNTRY_DE 533 0.24 0.80 0.15 192 XM_UB999 532 0.11 0.80 0.01 193 LONG_HEX_URI 518 0.15 0.78 0.05 194 RELAYCOUNTRY_NG 510 0.10 0.77 0.00 195 TR_XM_Undi_Recip5 492 0.11 0.74 0.00 196 T_TooManySym_02 486 1.48 0.73 1.60 197 XMHTML_After_End 486 0.34 0.73 0.28 198 MONEY_FRAUD_8 481 0.10 0.73 0.00 199 RELAYCOUNTRY_AR 476 0.10 0.72 0.00 200 XM_HighProb1 464 0.14 0.70 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 294355 63.33 21.83 69.87 2 BAYES_50 221150 51.76 47.14 52.49 3 HTML_MESSAGE 215081 56.52 91.23 51.05 4 ALL_TRUSTED 206535 42.54 1.36 49.02 5 DKIM_SIGNED 203639 52.35 77.86 48.34 6 XM_DK_Pass 200927 51.54 76.01 47.69 7 DKIM_VALID 192460 49.24 71.82 45.68 8 ANY_BOUNCE_MESSAGE 177047 36.35 0.27 42.02 9 BOUNCE_MESSAGE 177046 36.35 0.27 42.02 10 TM2_M_URI_OPT_OUT 175712 36.44 2.95 41.71 11 XMListUnsubscribeExists 149845 40.30 70.39 35.57 12 DKIM_VALID_AU 149771 39.03 61.11 35.55 13 DCC_CHECK 124166 35.91 76.84 29.47 14 XM_H_QuotedFrom 100695 27.24 48.42 23.90 15 BAYES_20 89416 18.55 1.57 21.22 16 HTML_FONT_LOW_CONTRAST 82542 21.60 34.34 19.59 17 DKIM_VALID_EF 74938 18.06 19.79 17.79 18 LOC_TINY_FONT_1 70072 19.17 35.28 16.63 19 MIME_HTML_ONLY 58053 16.57 34.27 13.78 20 T_TM2_M_HEADER_IN_MSG 57427 14.10 17.05 13.63 21 FVGT_m_MULTI_ODD 56355 15.00 25.28 13.38 22 XMSubLong 56049 15.38 28.55 13.30 23 BAYES_00 45167 9.46 1.47 10.72 24 T_KAM_HTML_FONT_INVALID 42676 11.13 17.49 10.13 25 TR_XM_DK_Bayes 41151 8.60 1.22 9.77 26 TR_XM_DK_Bayes1 39684 8.28 1.05 9.42 27 XM_DKIMWhitelistDomains 38258 7.85 0.02 9.08 28 RCVD_IN_RP_SAFE 37919 8.42 4.70 9.00 29 XM_Multi_Part_URI 37893 10.05 16.74 8.99 30 MultiRelay 37029 9.72 15.61 8.79 31 XM_Body_Dirty_Words 35042 9.93 20.16 8.32 32 TR_XM_DK_Bayes2 33775 7.06 0.95 8.02 33 RCVD_IN_RP_CERTIFIED 32391 7.14 3.64 7.69 34 HTML_IMAGE_RATIO_02 28576 8.13 16.70 6.78 35 LOTS_OF_MONEY 26497 6.87 10.55 6.29 36 XM_DK_Undo_02 25559 10.29 37.12 6.07 37 XM_Evil_Numbers_Gen 23096 6.48 12.84 5.48 38 LotsOfNums_01 20683 4.79 4.06 4.91 39 T_XMDrugObfuBody_14 20309 5.35 8.72 4.82 40 BAYES_99 19878 7.86 27.81 4.72 41 FSL_BULK_SIG 18709 5.45 11.83 4.44 42 T_TooManySym_01 17724 4.05 3.08 4.21 43 BAYES_999 17365 6.71 23.15 4.12 44 BOTNET_IPINHOSTNAME 17289 6.29 20.17 4.10 45 XM_B_Phish_Phrases 17096 4.35 6.24 4.06 46 HTML_IMAGE_RATIO_04 16252 4.42 7.97 3.86 47 XM_H_Long_From01 15806 4.97 12.68 3.75 48 XM_SendGrid 15510 3.45 2.01 3.68 49 TooManyTo_001 14098 4.07 8.65 3.35 50 FROM_EXCESS_BASE64 13967 4.04 8.67 3.32 51 BAYES_60 13843 4.04 8.80 3.29 52 XMStrtUSub 13257 3.33 4.51 3.15 53 XMSexyCombo_05 13000 4.23 11.48 3.09 54 XMSubMetaSx_00 12151 3.91 10.45 2.88 55 RCVD_IN_MSPIKE_H2 11800 2.76 2.53 2.80 56 RELAYCOUNTRY_META 11758 5.28 21.11 2.79 57 TO_MALFORMED 11708 2.41 0.07 2.78 58 RCVD_IN_IADB_LISTED 11678 2.57 1.28 2.77 59 MIME_QP_LONG_LINE 11424 2.56 1.62 2.71 60 UNPARSEABLE_RELAY 11230 2.68 2.76 2.67 61 BAYES_40 11189 2.56 1.97 2.66 62 DKIM_INVALID 11179 3.11 6.04 2.65 63 HTML_IMAGE_RATIO_06 10872 2.93 5.13 2.58 64 TR_DCC_Bayes_99 10676 5.21 22.19 2.53 65 XM_UncommonTLD01 10327 4.19 15.20 2.45 66 MPART_ALT_DIFF 10048 3.36 9.52 2.38 67 RCVD_IN_IADB_SPF 10038 2.21 1.13 2.38 68 TVD_RCVD_IP 9677 2.02 0.24 2.30 69 MIME_HTML_MOSTLY 9207 2.66 5.67 2.19 70 RCVD_IN_IADB_SENDERID 8869 1.97 1.10 2.11 71 IN_ZIMBRA_NJ_WHITELIST 8757 1.80 0.01 2.08 72 RCVD_IN_IADB_DK 8605 1.91 1.09 2.04 73 T_REMOTE_IMAGE 8444 2.77 7.60 2.00 74 XMNumbers 8184 2.61 6.86 1.94 75 BAYES_80 8096 2.56 6.60 1.92 76 RCVD_IN_IADB_VOUCHED 7778 1.71 0.85 1.85 77 INVALID_MSGID 6883 1.43 0.16 1.63 78 T_TooManySym_02 6745 1.48 0.73 1.60 79 BAYES_05 6523 1.48 1.05 1.55 80 BOTNET 6242 4.18 21.36 1.48 81 HTML_IMAGE_RATIO_08 6163 1.84 4.25 1.46 82 RCVD_IN_MSPIKE_WL 5950 1.27 0.34 1.41 83 RCVD_IN_MSPIKE_H3 5943 1.26 0.34 1.41 84 TR_MetaPhish_Combo_01 5715 1.26 0.68 1.36 85 MIME_HTML_ONLY_MULTI 5326 1.84 5.53 1.26 86 SUBJ_ALL_CAPS 5092 1.36 2.35 1.21 87 XM_DIRTYINTL 5041 1.68 4.77 1.20 88 RELAYCOUNTRY_CA 4908 1.50 3.65 1.16 89 XM_CamelCaseFrm001 4893 1.46 3.36 1.16 90 BAYES_95 4889 1.46 3.36 1.16 91 RCVD_IN_IADB_OPTIN 4879 1.11 0.82 1.16 92 URI_HEX 4876 1.43 3.18 1.16 93 IN_HORDE_ADDRESS_BOOK 4794 0.99 0.04 1.14 94 XM_PDF 4386 0.96 0.41 1.04 95 USER_IN_DEF_DKIM_WL 4339 0.89 0.01 1.03 96 XM_OfRef6 4141 1.27 3.09 0.98 97 TR_Symld_Words 4104 1.01 1.24 0.97 98 XM_DK_Undo_01 3993 0.94 0.90 0.95 99 MAILING_LIST_MULTI 3910 1.04 1.75 0.93 100 XM_ProductURIs 3832 0.98 1.44 0.91 101 NO_DNS_FOR_FROM 3754 1.18 3.00 0.89 102 URI_TRY_3LD 3655 0.97 1.58 0.87 103 XMBdyGiftCard01 3638 1.15 3.00 0.86 104 UNTRUSTED_Relay 3415 2.64 14.28 0.81 105 HTML_MIME_NO_HTML_TAG 3408 1.82 8.27 0.81 106 XM_SPF_SoftFail 3229 1.40 5.44 0.77 107 XM_H_Long_From02 3099 0.95 2.30 0.74 108 T_XMDrugObfuBody_08 3023 0.89 1.99 0.72 109 SUBJ_DOLLARS 2965 0.79 1.34 0.70 110 TooManyTo_002 2922 0.68 0.62 0.69 111 XMDiploma_00 2830 0.84 1.88 0.67 112 XM_GoogleGroups 2816 0.64 0.49 0.67 113 TM2_M_VERY_LONG_WORD 2730 0.72 1.21 0.65 114 USER_IN_WHITELIST 2613 0.54 0.00 0.62 115 XMBody_95 2605 0.55 0.09 0.62 116 TM2_M_A_HREF_HREF 2557 0.58 0.43 0.61 117 T_XMDrugObfuBody_00 2529 0.66 1.04 0.60 118 XM_B_REG_HTML 2487 0.67 1.17 0.59 119 XMSubMetaI_00 2425 0.85 2.60 0.58 120 XMBody_17 2379 0.66 1.28 0.56 121 XMStockSpam_06 2345 0.68 1.46 0.56 122 XM_H_PHPOS 2295 0.66 1.41 0.54 123 T_TooManySym_03 2144 0.45 0.09 0.51 124 TooManyTo_003 2117 0.50 0.52 0.50 125 PLING_QUERY 2073 0.58 1.15 0.49 126 XMPhish11 2072 0.57 1.09 0.49 127 DKIM_ADSP_CUSTOM_MED 2070 0.76 2.48 0.49 128 XM_URI_RBL 2027 0.83 3.05 0.48 129 XM_B_COPY_HTML 1995 0.54 1.00 0.47 130 XMSubMetaSxObfu_02 1911 0.45 0.40 0.45 131 THIS_AD 1876 0.53 1.06 0.45 132 XMSexyCombo_01 1850 0.85 3.45 0.44 133 T_XMHurry_00 1828 0.64 1.94 0.43 134 XMHTMLBadTable_001 1769 0.48 0.88 0.42 135 TooManyTo_004 1696 0.40 0.41 0.40 136 XMGenDplmaNmb 1673 0.55 1.52 0.40 137 XM_UB50 1662 1.44 8.07 0.39 138 RDNS_DYNAMIC 1634 0.49 1.13 0.39 139 XM_H_PHPMailer 1623 0.46 0.90 0.39 140 DIET_1 1546 0.59 2.01 0.37 141 XMLngstWrd_00 1536 0.35 0.23 0.36 142 XMBrknScrpt_02 1525 0.39 0.53 0.36 143 XMPhish30 1517 0.56 1.84 0.36 144 TooManyTo_005 1499 0.35 0.35 0.36 145 XM_salutation2 1486 0.49 1.33 0.35 146 TR_XM_RelayPhish 1480 0.49 1.37 0.35 147 FILL_THIS_FORM 1443 0.48 1.33 0.34 148 XM_RXBody 1442 0.54 1.79 0.34 149 XMLngstWrd_01 1441 0.32 0.21 0.34 150 HELO_NODOT 1427 0.35 0.41 0.34 151 T_Symld_Words_02 1415 0.66 2.69 0.34 152 T_FILL_THIS_FORM_SHORT 1355 0.54 1.93 0.32 153 NML_ADSP_CUSTOM_MED 1341 0.60 2.42 0.32 154 FILL_THIS_FORM_LONG 1312 0.43 1.20 0.31 155 FILL_THIS_FORM_LOAN 1288 0.39 0.96 0.31 156 HTML_FONT_FACE_BAD 1280 0.38 0.84 0.30 157 URI_NOVOWEL 1271 0.39 0.97 0.30 158 DKIM_ADSP_NXDOMAIN 1248 0.43 1.26 0.30 159 XMBody_78 1237 0.54 2.08 0.29 160 XMHTML_After_End 1159 0.34 0.73 0.28 161 RELAYCOUNTRY_GB 1155 0.39 1.14 0.27 162 HTML_TAG_BALANCE_BODY 1152 0.35 0.82 0.27 163 RELAYCOUNTRY_AU 1130 0.29 0.41 0.27 164 BASE64_LENGTH_79_INF 1120 0.26 0.19 0.27 165 XM_D_tchamptons_WL 1119 0.23 0.00 0.27 166 FORGED_GMAIL_RCVD 1089 0.54 2.32 0.26 167 XM_H_PHPOS_M 1083 0.30 0.60 0.26 168 XMSubMetaSxObfu_03 1047 0.38 1.22 0.25 169 T_MONEY_PERCENT 1039 0.39 1.34 0.25 170 TR_LOTS_OF_MONEY2 1039 0.39 1.34 0.25 171 XMPhish14 1027 0.34 0.96 0.24 172 REMOVE_BEFORE_LINK 1014 0.26 0.38 0.24 173 SpammyFromTLD_01 954 0.43 1.71 0.23 174 XMCapTrack 945 0.22 0.18 0.22 175 T_TooManySym_04 938 0.20 0.02 0.22 176 XMSlimDrugH 935 0.31 0.84 0.22 177 XMLngstWrd_02 912 0.21 0.18 0.22 178 XMSubMetaSSx_00 891 0.37 1.34 0.21 179 XMRcvdHeader_15 891 0.18 0.00 0.21 180 XMSolicitRefs_0 876 0.25 0.48 0.21 181 XM_Akamai 869 0.18 0.02 0.21 182 RELAYCOUNTRY_AT 861 0.35 1.30 0.20 183 HTTPS_HTTP_MISMATCH 851 0.25 0.55 0.20 184 XMSexyCombo_04 822 0.48 2.30 0.20 185 XMNoVowels 810 0.20 0.25 0.19 186 XM_Body_Obfu01 791 0.20 0.25 0.19 187 XMSUPPORT 773 0.16 0.00 0.18 188 XM_ShortIntro_01 755 0.24 0.63 0.18 189 RCVD_IN_BL_SPAMCOP_NET 743 0.48 2.43 0.18 190 XMLngstWrd_03 725 0.17 0.14 0.17 191 XM_Walgreens_Forge 713 0.15 0.02 0.17 192 T_XMDrugObfuBody_09 702 0.16 0.13 0.17 193 XM_H_SpoofStaff4 689 0.15 0.06 0.16 194 T_OBFU_PDF_ATTACH 667 0.15 0.09 0.16 195 HTML_IMAGE_ONLY_24 667 0.43 2.14 0.16 196 MPART_ALT_DIFF_COUNT 638 0.19 0.45 0.15 197 XM_B_TRADE_HTML 633 0.18 0.40 0.15 198 RELAYCOUNTRY_DE 632 0.24 0.80 0.15 199 TVD_SPACE_RATIO 632 0.16 0.22 0.15 200 T_HTML_TAG_BALANCE_CENTER 624 0.17 0.31 0.15 ----------------------------------------------------------------------