Email: 584185 Autolearn: 0 AvgScore: 0.78 AvgScanTime: 2.09 sec Spam: 93636 Autolearn: 0 AvgScore: 12.19 AvgScanTime: 2.76 sec Ham: 490549 Autolearn: 0 AvgScore: -1.40 AvgScanTime: 1.96 sec Time Spent Running SA: 339.16 hours Time Spent Processing Spam: 71.69 hours Time Spent Processing Ham: 267.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87903 88.14 93.88 87.05 2 DCC_CHECK 73839 50.66 78.86 45.28 3 DKIM_SIGNED 72465 78.32 77.39 78.50 4 XM_DK_Pass 69283 76.93 73.99 77.49 5 XM_B_Unicode 65963 70.61 70.45 70.64 6 DKIM_VALID 64829 73.11 69.24 73.85 7 XMListUnsubscribeExists 64668 57.31 69.06 55.07 8 DKIM_VALID_AU 48773 54.74 52.09 55.25 9 BAYES_50 45236 52.42 48.31 53.20 10 XM_B_Unicode3 44577 42.82 47.61 41.90 11 HTML_FONT_LOW_CONTRAST 33782 30.25 36.08 29.14 12 XM_DK_Undo_02 33448 10.21 35.72 5.34 13 MIME_HTML_ONLY 33275 22.71 35.54 20.26 14 LOC_TINY_FONT_1 31980 27.25 34.15 25.93 15 XMSubLong 24541 22.39 26.21 21.66 16 FVGT_m_MULTI_ODD 24143 23.30 25.78 22.82 17 RELAYCOUNTRY_META 24064 9.04 25.70 5.86 18 BOTNET 21974 5.56 23.47 2.14 19 BAYES_99 21499 5.87 22.96 2.61 20 DKIM_VALID_EF 21194 26.33 22.63 27.04 21 XM_Body_Dirty_Words 19988 15.16 21.35 13.98 22 MultiRelay 18601 19.07 19.87 18.92 23 BOTNET_IPINHOSTNAME 17553 7.21 18.75 5.01 24 TR_DCC_Bayes_99 17451 3.95 18.64 1.15 25 DCC_CHECK_NEGATIVE 17362 47.52 18.54 53.05 26 XM_Multi_Part_URI 17187 14.36 18.36 13.60 27 BAYES_999 17064 4.67 18.22 2.08 28 T_KAM_HTML_FONT_INVALID 16089 18.16 17.18 18.34 29 T_TM2_M_HEADER_IN_MSG 15849 28.62 16.93 30.86 30 FSL_BULK_SIG 14624 7.96 15.62 6.50 31 UNTRUSTED_Relay 14462 4.05 15.44 1.88 32 XM_UncommonTLD01 12883 5.00 13.76 3.32 33 HTML_IMAGE_RATIO_02 12672 10.93 13.53 10.44 34 XM_Evil_Numbers_Gen 12656 10.54 13.52 9.97 35 XMSexyCombo_05 10761 5.48 11.49 4.33 36 MPART_ALT_DIFF 9734 4.89 10.40 3.84 37 LOTS_OF_MONEY 9103 8.47 9.72 8.23 38 XM_UB50 7917 2.22 8.46 1.03 39 HTML_MIME_NO_HTML_TAG 7897 2.96 8.43 1.92 40 LotsOfNums_01 7884 8.53 8.42 8.55 41 DKIM_INVALID 7636 5.21 8.15 4.65 42 T_XMDrugObfuBody_14 7393 8.57 7.90 8.70 43 HTML_IMAGE_RATIO_04 7245 6.47 7.74 6.23 44 XM_H_Long_From01 7224 6.70 7.71 6.51 45 XMSubMetaSx_00 7188 4.03 7.68 3.34 46 TooManyTo_001 6798 8.01 7.26 8.16 47 XM_B_Phish_Phrases 6549 6.40 6.99 6.28 48 MIME_HTML_MOSTLY 6392 3.41 6.83 2.76 49 RCVD_IN_MSPIKE_H2 5996 7.34 6.40 7.52 50 SpammyFromTLD_02 5775 1.22 6.17 0.27 51 XM_DIRTYINTL 5526 3.53 5.90 3.08 52 BOTNET_NORDNS 5493 0.98 5.87 0.05 53 XM_SPF_SoftFail 5253 2.89 5.61 2.37 54 BAYES_80 5142 2.54 5.49 1.98 55 MIME_HTML_ONLY_MULTI 5090 2.49 5.44 1.92 56 XMNumbers 4979 4.05 5.32 3.81 57 XMStrtUSub 4971 4.14 5.31 3.91 58 BAYES_60 4830 4.07 5.16 3.86 59 KHOP_HELO_FCRDNS 4595 2.80 4.91 2.40 60 HTML_IMAGE_RATIO_06 4568 3.82 4.88 3.61 61 MIME_QP_LONG_LINE 4396 5.84 4.69 6.06 62 RELAYCOUNTRY_CA 4385 2.06 4.68 1.56 63 BAYES_40 4301 6.27 4.59 6.59 64 BAYES_00 4054 19.15 4.33 21.98 65 RDNS_DYNAMIC 4022 1.01 4.30 0.38 66 RCVD_IN_BL_SPAMCOP_NET 3972 1.18 4.24 0.59 67 T_REMOTE_IMAGE 3940 3.82 4.21 3.74 68 HTML_SHORT_LINK_IMG_1 3885 0.70 4.15 0.04 69 XM_URI_RBL 3834 0.95 4.09 0.34 70 MultiRelay_Combo 3666 0.81 3.92 0.22 71 MultiRelay_CC 3666 0.81 3.92 0.22 72 XM_SendGrid 3562 6.58 3.80 7.11 73 FROM_MISSP_REPLYTO 3555 0.61 3.80 0.01 74 T_TooManySym_01 3532 5.93 3.77 6.34 75 BAYES_20 3531 4.91 3.77 5.13 76 HTML_IMAGE_RATIO_08 3413 2.62 3.64 2.43 77 FROM_EXCESS_BASE64 3345 3.90 3.57 3.96 78 URI_HEX 3324 2.48 3.55 2.27 79 TM2_M_URI_OPT_OUT 3321 2.25 3.55 2.00 80 XM_B_SpammyTLD 3289 3.65 3.51 3.68 81 XM_CamelCaseFrm001 3288 2.31 3.51 2.08 82 RELAYCOUNTRY_GB 3101 1.45 3.31 1.10 83 BODY_URI_ONLY 3035 0.61 3.24 0.11 84 RELAYCOUNTRY_FR 2965 0.83 3.17 0.39 85 XMDiploma_00 2963 1.96 3.16 1.73 86 NO_DNS_FOR_FROM 2937 1.51 3.14 1.20 87 FROM_SUSPICIOUS_NTLD 2933 0.52 3.13 0.02 88 T_HTML_TAG_BALANCE_CENTER 2881 0.68 3.08 0.22 89 TR_Mismatch_TLD_02 2875 0.62 3.07 0.15 90 FROM_SUSPICIOUS_NTLD_FP 2871 0.51 3.07 0.02 91 RCVD_IN_RP_RNBL 2830 0.54 3.02 0.07 92 XM_BadFromFormat 2782 0.59 2.97 0.13 93 HTML_IMAGE_ONLY_08 2760 0.57 2.95 0.12 94 DOS_RCVD_IP_TWICE_B 2723 0.53 2.91 0.08 95 XMSexyCombo_01 2695 0.89 2.88 0.51 96 XMSubMetaI_00 2663 1.43 2.84 1.16 97 DKIM_ADSP_NXDOMAIN 2636 0.91 2.82 0.54 98 TR_XM_PHPDW 2623 0.85 2.80 0.48 99 BAYES_95 2612 1.41 2.79 1.15 100 TR_XM_PHPForged 2606 0.85 2.78 0.48 101 TR_XM_FormFill2 2578 0.82 2.75 0.45 102 XM_H_PHPOS 2571 0.82 2.75 0.45 103 T_XMDrugObfuBody_08 2465 1.64 2.63 1.45 104 XM_OfRef6 2438 1.70 2.60 1.53 105 SpammyFromTLD_01 2355 1.06 2.52 0.78 106 XMGenDplmaNmb 2295 1.27 2.45 1.04 107 BAYES_05 2136 3.05 2.28 3.20 108 REPLYTO_WITHOUT_TO_CC 1999 0.38 2.13 0.05 109 TR_XM_RelayPhish 1992 1.18 2.13 1.00 110 XMBdyGiftCard01 1983 1.66 2.12 1.57 111 TR_XM_DK_Bayes 1916 15.69 2.05 18.29 112 TM2_M_VERY_LONG_WORD 1912 1.55 2.04 1.45 113 TR_XM_INV_DKIM 1902 0.38 2.03 0.07 114 HELO_NODOT 1895 1.51 2.02 1.42 115 HELO_NO_DOMAIN 1895 1.51 2.02 1.42 116 SUBJ_ALL_CAPS 1890 1.86 2.02 1.83 117 TR_Symld_Words 1863 1.37 1.99 1.26 118 HTML_EXTRA_CLOSE 1860 0.35 1.99 0.04 119 ALL_TRUSTED 1843 12.04 1.97 13.96 120 RCVD_IN_IADB_LISTED 1768 4.59 1.89 5.11 121 TR_XM_DK_Bayes1 1726 14.95 1.84 17.46 122 XMBrknScrpt_02 1703 0.86 1.82 0.68 123 RCVD_IN_IADB_SPF 1702 4.04 1.82 4.46 124 XM_H_PHPMailer 1685 0.76 1.80 0.57 125 RCVD_IN_IADB_SENDERID 1661 3.62 1.77 3.97 126 RCVD_IN_IADB_DK 1655 3.53 1.77 3.87 127 XMPhish11 1618 1.33 1.73 1.26 128 XMBody_17 1598 0.91 1.71 0.76 129 FROM_MISSP_DYNIP 1549 0.27 1.65 0.00 130 HTML_IMAGE_ONLY_12 1536 0.44 1.64 0.21 131 RCVD_IN_RP_SAFE 1519 9.39 1.62 10.87 132 XM_H_PHPOS_M 1498 0.42 1.60 0.19 133 RCVD_IN_MSPIKE_WL 1498 4.61 1.60 5.18 134 RELAYCOUNTRY_AT 1493 0.47 1.59 0.26 135 XMSexyCombo_04 1474 0.36 1.57 0.13 136 XMSubMetaSxObfu_03 1455 0.52 1.55 0.32 137 RCVD_IN_PSBL 1412 0.28 1.51 0.05 138 FSL_HELO_NON_FQDN_1 1412 0.25 1.51 0.01 139 TR_XM_DK_SendGrid 1407 3.32 1.50 3.67 140 XM_UB99 1406 0.24 1.50 0.00 141 RELAYCOUNTRY_IE 1348 0.39 1.44 0.19 142 XM_DK_Undo_01 1342 1.59 1.43 1.62 143 MAILING_LIST_MULTI 1318 2.23 1.41 2.39 144 TR_LOTS_OF_MONEY2 1298 0.86 1.39 0.76 145 T_MONEY_PERCENT 1298 0.86 1.39 0.76 146 T_XMHurry_00 1294 0.67 1.38 0.54 147 XMStockSpam_06 1282 1.24 1.37 1.22 148 T_TooManySym_02 1276 2.19 1.36 2.35 149 URI_TRY_3LD 1275 1.32 1.36 1.31 150 HDRS_LCASE_IMGONLY 1269 0.25 1.36 0.03 151 LOW_PRICE 1255 0.77 1.34 0.66 152 T_Symld_Words_02 1248 0.63 1.33 0.49 153 XMPhish30 1219 0.70 1.30 0.58 154 PLING_QUERY 1211 0.57 1.29 0.44 155 URIBL_DBL_SPAM 1205 0.27 1.29 0.08 156 XMHTML_After_End 1188 1.04 1.27 0.99 157 XMMoneyMeta_00 1187 0.53 1.27 0.38 158 MIME_HEADER_CTYPE_ONLY 1177 0.29 1.26 0.10 159 URI_NOVOWEL 1169 0.67 1.25 0.56 160 XM_B_REG_HTML 1166 0.66 1.25 0.55 161 TooManyTo_002 1160 1.95 1.24 2.09 162 XM_H_Long_From02 1158 1.22 1.24 1.22 163 DATE_IN_PAST_03_06 1157 0.30 1.24 0.13 164 RCVD_IN_MSPIKE_H3 1130 3.96 1.21 4.49 165 RELAYCOUNTRY_IN 1121 0.29 1.20 0.12 166 URIBL_DBL_ABUSE_REDIR 1104 0.19 1.18 0.00 167 TO_EQ_FM_DOM_HTML_IMG 1078 0.20 1.15 0.01 168 T_XMDrugObfuBody_00 1078 0.87 1.15 0.82 169 DIET_1 1071 0.66 1.14 0.56 170 URIBL_SBL_A 1058 0.62 1.13 0.53 171 XM_UB60 1050 0.22 1.12 0.05 172 XMBody_78 1033 0.55 1.10 0.44 173 TR_XM_SEO3 1030 0.48 1.10 0.36 174 XM_Combo_Sbj 1017 0.36 1.09 0.22 175 THIS_AD 1012 0.50 1.08 0.39 176 XM_H_Undi_Recip 992 0.47 1.06 0.35 177 XM_UB999 985 0.17 1.05 0.00 178 UNPARSEABLE_RELAY 980 2.25 1.05 2.48 179 TooManyTo_003 969 1.40 1.03 1.47 180 XMPhish14 954 0.50 1.02 0.40 181 DKIM_ADSP_CUSTOM_MED 925 1.05 0.99 1.06 182 URIBL_BLACK 912 0.17 0.97 0.02 183 HDRS_MISSP 907 0.17 0.97 0.01 184 HTML_FONT_FACE_BAD 874 0.59 0.93 0.52 185 XMSlimDrugH 874 0.35 0.93 0.24 186 NORDNS_LOW_CONTRAST 865 0.15 0.92 0.01 187 TooManyTo_004 863 1.10 0.92 1.14 188 MISSING_HEADERS 855 0.57 0.91 0.51 189 HK_RANDOM_REPLYTO 851 0.37 0.91 0.27 190 TO_NO_BRKTS_FROM_MSSP 842 0.15 0.90 0.01 191 TM2_M_A_HREF_HREF 836 0.42 0.89 0.32 192 XM_ShortIntro_01 834 0.68 0.89 0.64 193 T_FILL_THIS_FORM_SHORT 826 0.67 0.88 0.63 194 DATE_IN_PAST_06_12 811 0.19 0.87 0.06 195 TR_XM_DK_Bayes2 808 12.71 0.86 14.97 196 SUBJ_OBFU_PUNCT_FEW 796 0.23 0.85 0.12 197 XMSubMetaI_01 787 0.19 0.84 0.06 198 XM_B_COPY_HTML 786 0.48 0.84 0.41 199 XMSubNoVowel 785 0.37 0.84 0.28 200 RELAYCOUNTRY_DE 782 0.57 0.84 0.52 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 427006 88.14 93.88 87.05 2 DKIM_SIGNED 385087 78.32 77.39 78.50 3 XM_DK_Pass 380138 76.93 73.99 77.49 4 DKIM_VALID 362265 73.11 69.24 73.85 5 XM_B_Unicode 346513 70.61 70.45 70.64 6 DKIM_VALID_AU 271037 54.74 52.09 55.25 7 XMListUnsubscribeExists 270150 57.31 69.06 55.07 8 BAYES_50 260983 52.42 48.31 53.20 9 DCC_CHECK_NEGATIVE 260231 47.52 18.54 53.05 10 DCC_CHECK 222111 50.66 78.86 45.28 11 XM_B_Unicode3 205547 42.82 47.61 41.90 12 T_TM2_M_HEADER_IN_MSG 151361 28.62 16.93 30.86 13 HTML_FONT_LOW_CONTRAST 142942 30.25 36.08 29.14 14 DKIM_VALID_EF 132638 26.33 22.63 27.04 15 LOC_TINY_FONT_1 127205 27.25 34.15 25.93 16 FVGT_m_MULTI_ODD 111967 23.30 25.78 22.82 17 BAYES_00 107816 19.15 4.33 21.98 18 XMSubLong 106263 22.39 26.21 21.66 19 MIME_HTML_ONLY 99382 22.71 35.54 20.26 20 MultiRelay 92827 19.07 19.87 18.92 21 T_KAM_HTML_FONT_INVALID 89976 18.16 17.18 18.34 22 TR_XM_DK_Bayes 89732 15.69 2.05 18.29 23 TR_XM_DK_Bayes1 85636 14.95 1.84 17.46 24 TR_XM_DK_Bayes2 73439 12.71 0.86 14.97 25 XM_Body_Dirty_Words 68586 15.16 21.35 13.98 26 ALL_TRUSTED 68467 12.04 1.97 13.96 27 XM_Multi_Part_URI 66702 14.36 18.36 13.60 28 RCVD_IN_RP_SAFE 53325 9.39 1.62 10.87 29 HTML_IMAGE_RATIO_02 51192 10.93 13.53 10.44 30 XM_Evil_Numbers_Gen 48893 10.54 13.52 9.97 31 RCVD_IN_RP_CERTIFIED 45620 7.91 0.62 9.30 32 T_XMDrugObfuBody_14 42679 8.57 7.90 8.70 33 LotsOfNums_01 41958 8.53 8.42 8.55 34 LOTS_OF_MONEY 40372 8.47 9.72 8.23 35 TooManyTo_001 40017 8.01 7.26 8.16 36 XM_DKIMWhitelistDomains 37568 6.44 0.03 7.66 37 RCVD_IN_MSPIKE_H2 36888 7.34 6.40 7.52 38 XM_SendGrid 34866 6.58 3.80 7.11 39 BAYES_40 32347 6.27 4.59 6.59 40 XM_H_Long_From01 31917 6.70 7.71 6.51 41 FSL_BULK_SIG 31902 7.96 15.62 6.50 42 T_TooManySym_01 31100 5.93 3.77 6.34 43 XM_B_Phish_Phrases 30822 6.40 6.99 6.28 44 HTML_IMAGE_RATIO_04 30573 6.47 7.74 6.23 45 MIME_QP_LONG_LINE 29712 5.84 4.69 6.06 46 RELAYCOUNTRY_META 28770 9.04 25.70 5.86 47 XM_DK_Undo_02 26182 10.21 35.72 5.34 48 RCVD_IN_MSPIKE_WL 25434 4.61 1.60 5.18 49 BAYES_20 25155 4.91 3.77 5.13 50 RCVD_IN_IADB_LISTED 25069 4.59 1.89 5.11 51 BOTNET_IPINHOSTNAME 24592 7.21 18.75 5.01 52 DKIM_INVALID 22822 5.21 8.15 4.65 53 RCVD_IN_MSPIKE_H3 22008 3.96 1.21 4.49 54 RCVD_IN_IADB_SPF 21870 4.04 1.82 4.46 55 XMSexyCombo_05 21224 5.48 11.49 4.33 56 RCVD_IN_IADB_SENDERID 19460 3.62 1.77 3.97 57 FROM_EXCESS_BASE64 19447 3.90 3.57 3.96 58 XMStrtUSub 19190 4.14 5.31 3.91 59 RCVD_IN_IADB_DK 18960 3.53 1.77 3.87 60 BAYES_60 18953 4.07 5.16 3.86 61 MPART_ALT_DIFF 18824 4.89 10.40 3.84 62 XMNumbers 18690 4.05 5.32 3.81 63 XM_PDF 18582 3.29 0.70 3.79 64 T_REMOTE_IMAGE 18362 3.82 4.21 3.74 65 XM_B_SpammyTLD 18061 3.65 3.51 3.68 66 TR_XM_DK_SendGrid 18011 3.32 1.50 3.67 67 HTML_IMAGE_RATIO_06 17720 3.82 4.88 3.61 68 IN_ZIMBRA_NJ_WHITELIST 16888 2.89 0.02 3.44 69 XMSubMetaSx_00 16372 4.03 7.68 3.34 70 XM_UncommonTLD01 16300 5.00 13.76 3.32 71 RCVD_IN_IADB_VOUCHED 15994 2.82 0.51 3.26 72 BAYES_05 15695 3.05 2.28 3.20 73 XM_DIRTYINTL 15095 3.53 5.90 3.08 74 TO_MALFORMED 14132 2.43 0.05 2.88 75 MIME_HTML_MOSTLY 13535 3.41 6.83 2.76 76 TVD_RCVD_IP 13019 2.32 0.55 2.65 77 BAYES_99 12790 5.87 22.96 2.61 78 UNPARSEABLE_RELAY 12150 2.25 1.05 2.48 79 HTML_IMAGE_RATIO_08 11911 2.62 3.64 2.43 80 KHOP_HELO_FCRDNS 11771 2.80 4.91 2.40 81 MAILING_LIST_MULTI 11721 2.23 1.41 2.39 82 XM_SPF_SoftFail 11622 2.89 5.61 2.37 83 T_TooManySym_02 11544 2.19 1.36 2.35 84 URI_HEX 11144 2.48 3.55 2.27 85 BOTNET 10490 5.56 23.47 2.14 86 ANY_BOUNCE_MESSAGE 10395 1.86 0.50 2.12 87 BOUNCE_MESSAGE 10394 1.86 0.50 2.12 88 TooManyTo_002 10246 1.95 1.24 2.09 89 XM_CamelCaseFrm001 10216 2.31 3.51 2.08 90 BAYES_999 10194 4.67 18.22 2.08 91 RCVD_IN_IADB_OPTIN 10012 1.78 0.41 2.04 92 TM2_M_URI_OPT_OUT 9825 2.25 3.55 2.00 93 BAYES_80 9715 2.54 5.49 1.98 94 MIME_HTML_ONLY_MULTI 9432 2.49 5.44 1.92 95 HTML_MIME_NO_HTML_TAG 9403 2.96 8.43 1.92 96 UNTRUSTED_Relay 9213 4.05 15.44 1.88 97 SUBJ_ALL_CAPS 8979 1.86 2.02 1.83 98 TR_MetaPhish_Combo_01 8670 1.61 0.77 1.77 99 XMDiploma_00 8476 1.96 3.16 1.73 100 CK_HELO_DYNAMIC_SPLIT_IP 8459 1.54 0.60 1.72 101 HELO_DYNAMIC_IPADDR2 8417 1.46 0.13 1.72 102 XM_DK_Undo_01 7963 1.59 1.43 1.62 103 XMBdyGiftCard01 7710 1.66 2.12 1.57 104 RELAYCOUNTRY_CA 7675 2.06 4.68 1.56 105 IN_HORDE_ADDRESS_BOOK 7670 1.32 0.04 1.56 106 XM_OfRef6 7481 1.70 2.60 1.53 107 INVALID_MSGID 7469 1.35 0.43 1.52 108 TooManyTo_003 7191 1.40 1.03 1.47 109 TM2_M_VERY_LONG_WORD 7116 1.55 2.04 1.45 110 T_XMDrugObfuBody_08 7094 1.64 2.63 1.45 111 USER_IN_DEF_DKIM_WL 7050 1.21 0.02 1.44 112 HELO_NODOT 6943 1.51 2.02 1.42 113 HELO_NO_DOMAIN 6942 1.51 2.02 1.42 114 URI_TRY_3LD 6442 1.32 1.36 1.31 115 XMCapTrack 6284 1.20 0.80 1.28 116 TR_Symld_Words 6168 1.37 1.99 1.26 117 XMPhish11 6158 1.33 1.73 1.26 118 XMStockSpam_06 5990 1.24 1.37 1.22 119 XM_H_Long_From02 5988 1.22 1.24 1.22 120 XM_RXBody 5885 1.11 0.66 1.20 121 NO_DNS_FOR_FROM 5864 1.51 3.14 1.20 122 XMSubMetaI_00 5687 1.43 2.84 1.16 123 TR_DCC_Bayes_99 5651 3.95 18.64 1.15 124 BAYES_95 5631 1.41 2.79 1.15 125 TooManyTo_004 5583 1.10 0.92 1.14 126 RELAYCOUNTRY_GB 5374 1.45 3.31 1.10 127 XM_GoogleGroups 5248 0.98 0.51 1.07 128 DKIM_ADSP_CUSTOM_MED 5202 1.05 0.99 1.06 129 XMGenDplmaNmb 5108 1.27 2.45 1.04 130 XM_UB50 5053 2.22 8.46 1.03 131 XM_ProductURIs 4991 0.98 0.77 1.02 132 TR_XM_RelayPhish 4927 1.18 2.13 1.00 133 XMHTML_After_End 4872 1.04 1.27 0.99 134 XMGappySubj_01 4652 0.85 0.35 0.95 135 TooManyTo_005 4631 0.88 0.53 0.94 136 T_XMDrugObfuBody_00 4030 0.87 1.15 0.82 137 SpammyFromTLD_01 3815 1.06 2.52 0.78 138 T_MONEY_PERCENT 3709 0.86 1.39 0.76 139 TR_LOTS_OF_MONEY2 3709 0.86 1.39 0.76 140 XMBody_17 3704 0.91 1.71 0.76 141 NML_ADSP_CUSTOM_MED 3568 0.74 0.80 0.73 142 XMNoVowels 3436 0.66 0.44 0.70 143 XMBrknScrpt_02 3330 0.86 1.82 0.68 144 XMBody_95 3309 0.59 0.13 0.67 145 XM_shorewaves_Whitelist 3288 0.56 0.00 0.67 146 LOW_PRICE 3232 0.77 1.34 0.66 147 XM_ShortIntro_01 3137 0.68 0.89 0.64 148 T_TooManySym_03 3085 0.56 0.19 0.63 149 T_FILL_THIS_FORM_SHORT 3067 0.67 0.88 0.63 150 XM_SPF_Unknown 3065 0.65 0.76 0.62 151 RCVD_IN_BL_SPAMCOP_NET 2898 1.18 4.24 0.59 152 XMPhish30 2863 0.70 1.30 0.58 153 XM_H_PHPMailer 2777 0.76 1.80 0.57 154 FILL_THIS_FORM 2773 0.59 0.71 0.57 155 DIET_1 2768 0.66 1.14 0.56 156 HTTPS_HTTP_MISMATCH 2748 0.60 0.81 0.56 157 URI_NOVOWEL 2741 0.67 1.25 0.56 158 FORGED_GMAIL_RCVD 2710 0.59 0.81 0.55 159 XMHTMLBadTable_001 2702 0.58 0.75 0.55 160 XM_B_REG_HTML 2698 0.66 1.25 0.55 161 DKIM_ADSP_NXDOMAIN 2653 0.91 2.82 0.54 162 T_XMHurry_00 2629 0.67 1.38 0.54 163 URIBL_SBL_A 2581 0.62 1.13 0.53 164 HTML_FONT_FACE_BAD 2546 0.59 0.93 0.52 165 RELAYCOUNTRY_DE 2528 0.57 0.84 0.52 166 HTML_IMAGE_ONLY_32 2519 0.49 0.40 0.51 167 XMSexyCombo_01 2501 0.89 2.88 0.51 168 MISSING_HEADERS 2498 0.57 0.91 0.51 169 USER_IN_WHITELIST 2445 0.42 0.00 0.50 170 T_Symld_Words_02 2406 0.63 1.33 0.49 171 RELAYCOUNTRY_AU 2405 0.49 0.47 0.49 172 HTML_TAG_BALANCE_BODY 2371 0.49 0.53 0.48 173 TR_XM_PHPDW 2363 0.85 2.80 0.48 174 FILL_THIS_FORM_LONG 2360 0.50 0.59 0.48 175 TR_XM_PHPForged 2343 0.85 2.78 0.48 176 T_OBFU_PDF_ATTACH 2325 0.43 0.20 0.47 177 AC_DIV_BONANZA 2301 0.42 0.16 0.47 178 FILL_THIS_FORM_LOAN 2280 0.44 0.29 0.46 179 REMOVE_BEFORE_LINK 2260 0.47 0.53 0.46 180 TR_XM_FormFill2 2228 0.82 2.75 0.45 181 SUBJ_DOLLARS 2223 0.45 0.46 0.45 182 XM_H_PHPOS 2196 0.82 2.75 0.45 183 XMBody_78 2182 0.55 1.10 0.44 184 XMLngstWrd_00 2162 0.45 0.48 0.44 185 PLING_QUERY 2137 0.57 1.29 0.44 186 RCVD_IN_MSPIKE_H5 2058 0.37 0.14 0.42 187 XM_B_COPY_HTML 1989 0.48 0.84 0.41 188 XMSolicitRefs_0 1989 0.44 0.60 0.41 189 XMLngstWrd_01 1977 0.41 0.45 0.40 190 XMSubMetaSxObfu_02 1974 0.39 0.34 0.40 191 XMPhish14 1946 0.50 1.02 0.40 192 HTML_IMAGE_ONLY_28 1930 0.41 0.52 0.39 193 RELAYCOUNTRY_FR 1912 0.83 3.17 0.39 194 SHORT_HELO_AND_INLINE_IMAGE 1903 0.35 0.16 0.39 195 RELAYCOUNTRY_NL 1903 0.42 0.59 0.39 196 THIS_AD 1895 0.50 1.08 0.39 197 XMMoneyMeta_00 1885 0.53 1.27 0.38 198 XMOemUri 1881 0.35 0.15 0.38 199 T_MANY_PILL_PRICE 1862 0.32 0.00 0.38 200 RDNS_DYNAMIC 1857 1.01 4.30 0.38 ----------------------------------------------------------------------