Email: 614798 Autolearn: 0 AvgScore: 1.28 AvgScanTime: 2.27 sec Spam: 105171 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 3.08 sec Ham: 509627 Autolearn: 0 AvgScore: -0.99 AvgScanTime: 2.11 sec Time Spent Running SA: 388.40 hours Time Spent Processing Spam: 89.92 hours Time Spent Processing Ham: 298.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 99092 89.00 94.22 87.93 2 DCC_CHECK 83220 50.91 79.13 45.08 3 DKIM_SIGNED 80318 78.24 76.37 78.63 4 XM_DK_Pass 76953 76.52 73.17 77.21 5 XM_B_Unicode 76778 71.01 73.00 70.59 6 DKIM_VALID 71678 72.75 68.15 73.69 7 XMListUnsubscribeExists 69695 56.29 66.27 54.23 8 DKIM_VALID_AU 53292 54.10 50.67 54.80 9 BAYES_50 52708 53.76 50.12 54.51 10 XM_B_Unicode3 51532 43.85 49.00 42.79 11 MIME_HTML_ONLY 38603 24.60 36.70 22.10 12 HTML_FONT_LOW_CONTRAST 36948 30.94 35.13 30.08 13 XM_DK_Undo_02 35726 11.20 33.97 6.50 14 LOC_TINY_FONT_1 33575 26.74 31.92 25.67 15 XMSubLong 28907 23.87 27.49 23.12 16 RELAYCOUNTRY_META 27661 8.98 26.30 5.41 17 FVGT_m_MULTI_ODD 25898 22.96 24.62 22.61 18 XM_Body_Dirty_Words 24779 16.52 23.56 15.07 19 BOTNET_IPINHOSTNAME 24302 7.94 23.11 4.81 20 BOTNET 23973 5.66 22.79 2.13 21 DKIM_VALID_EF 22373 26.13 21.27 27.13 22 T_KAM_HTML_FONT_INVALID 21796 18.43 20.72 17.95 23 BAYES_99 21340 6.19 20.29 3.28 24 T_TM2_M_HEADER_IN_MSG 20307 27.33 19.31 28.98 25 DCC_CHECK_NEGATIVE 19593 47.02 18.63 52.88 26 FSL_BULK_SIG 19566 9.29 18.60 7.37 27 XM_Multi_Part_URI 19045 13.56 18.11 12.62 28 MultiRelay 18295 19.25 17.40 19.63 29 BAYES_999 16756 4.89 15.93 2.61 30 TR_DCC_Bayes_99 16661 3.93 15.84 1.47 31 UNTRUSTED_Relay 16031 3.96 15.24 1.63 32 XM_UncommonTLD01 15302 5.40 14.55 3.51 33 LOTS_OF_MONEY 15239 11.14 14.49 10.44 34 HTML_IMAGE_RATIO_02 14314 10.14 13.61 9.42 35 XMSexyCombo_05 14183 6.16 13.49 4.65 36 XM_Evil_Numbers_Gen 12943 10.39 12.31 9.99 37 MPART_ALT_DIFF 10475 4.74 9.96 3.66 38 T_XMDrugObfuBody_14 10319 9.12 9.81 8.98 39 XM_UB50 9677 2.32 9.20 0.90 40 XMSubMetaSx_00 9297 4.93 8.84 4.12 41 LotsOfNums_01 8875 8.68 8.44 8.72 42 XM_B_Phish_Phrases 8737 6.75 8.31 6.43 43 DKIM_INVALID 8640 5.49 8.22 4.93 44 HTML_IMAGE_RATIO_04 8245 7.34 7.84 7.23 45 T_REMOTE_IMAGE 8068 4.44 7.67 3.77 46 XM_H_Long_From01 8018 7.02 7.62 6.90 47 SpammyFromTLD_02 7797 1.67 7.41 0.48 48 TooManyTo_001 7642 7.68 7.27 7.77 49 HTML_MIME_NO_HTML_TAG 7460 3.23 7.09 2.43 50 KHOP_HELO_FCRDNS 7091 3.25 6.74 2.53 51 BAYES_80 6505 2.78 6.19 2.08 52 XMNumbers 6345 3.87 6.03 3.43 53 XM_DIRTYINTL 6189 3.88 5.88 3.47 54 MIME_QP_LONG_LINE 6177 5.73 5.87 5.70 55 HTML_SHORT_LINK_IMG_1 6059 1.01 5.76 0.03 56 MIME_HTML_MOSTLY 6056 3.16 5.76 2.62 57 XM_B_Unsub 5962 4.72 5.67 4.53 58 RCVD_IN_MSPIKE_H2 5747 7.07 5.46 7.40 59 BAYES_60 5745 4.33 5.46 4.10 60 HDRS_LCASE_IMGONLY 5503 0.93 5.23 0.05 61 MIME_HTML_ONLY_MULTI 5440 2.42 5.17 1.86 62 BAYES_40 5390 6.01 5.12 6.20 63 RCVD_IN_BL_SPAMCOP_NET 5183 1.79 4.93 1.14 64 URI_HEX 4866 2.38 4.63 1.91 65 XM_BadFromFormat 4781 0.89 4.55 0.13 66 XM_URI_RBL 4711 1.05 4.48 0.35 67 RDNS_DYNAMIC 4676 1.04 4.45 0.34 68 NO_DNS_FOR_FROM 4664 1.71 4.43 1.15 69 RELAYCOUNTRY_GB 4659 1.63 4.43 1.05 70 XM_SPF_SoftFail 4468 2.45 4.25 2.07 71 XM_SendGrid 4458 6.27 4.24 6.69 72 RCVD_IN_RP_RNBL 4331 0.81 4.12 0.12 73 HTML_IMAGE_RATIO_06 4306 3.59 4.09 3.48 74 TM2_M_URI_OPT_OUT 4257 2.07 4.05 1.67 75 XMStrtUSub 4191 4.64 3.98 4.78 76 XMSexyCombo_01 4105 1.64 3.90 1.18 77 DKIM_ADSP_NXDOMAIN 4089 1.10 3.89 0.53 78 RELAYCOUNTRY_CA 4089 2.04 3.89 1.66 79 XM_OfRef6 4026 2.05 3.83 1.69 80 BAYES_20 3997 4.69 3.80 4.88 81 HTML_IMAGE_ONLY_12 3699 0.74 3.52 0.16 82 BAYES_00 3674 17.43 3.49 20.30 83 FROM_EXCESS_BASE64 3603 3.68 3.43 3.73 84 REPLYTO_WITHOUT_TO_CC 3589 0.61 3.41 0.04 85 MIME_HEADER_CTYPE_ONLY 3583 0.67 3.41 0.10 86 XM_B_SpammyTLD 3536 3.71 3.36 3.78 87 T_XMDrugObfuBody_08 3518 2.57 3.35 2.41 88 XMBody_17 3474 1.22 3.30 0.79 89 XMDiploma_00 3423 1.86 3.25 1.58 90 TO_EQ_FM_DOM_HTML_IMG 3384 0.55 3.22 0.01 91 SUBJ_ALL_CAPS 3301 2.15 3.14 1.94 92 TR_Mismatch_TLD_02 3286 0.62 3.12 0.11 93 T_HTML_TAG_BALANCE_CENTER 3172 0.69 3.02 0.20 94 BAYES_95 2993 1.52 2.85 1.25 95 T_TooManySym_01 2969 5.36 2.82 5.88 96 MultiRelay_Combo 2943 0.66 2.80 0.22 97 MultiRelay_CC 2943 0.66 2.80 0.22 98 RELAYCOUNTRY_FR 2777 0.74 2.64 0.35 99 XM_CamelCaseFrm001 2776 2.11 2.64 2.00 100 XMGenDplmaNmb 2677 1.29 2.55 1.03 101 HTML_IMAGE_ONLY_08 2625 0.52 2.50 0.11 102 FROM_SUSPICIOUS_NTLD 2615 0.45 2.49 0.03 103 HTML_IMAGE_RATIO_08 2590 2.35 2.46 2.33 104 FROM_SUSPICIOUS_NTLD_FP 2580 0.45 2.45 0.03 105 FROM_MISSP_REPLYTO 2568 0.42 2.44 0.00 106 TR_XM_PHPDW 2558 0.97 2.43 0.67 107 XMSexyCombo_04 2535 0.78 2.41 0.44 108 BAYES_05 2461 2.96 2.34 3.09 109 TR_XM_PHPForged 2435 0.93 2.32 0.65 110 TR_XM_FormFill2 2433 0.93 2.31 0.64 111 XM_H_PHPOS 2424 0.92 2.30 0.64 112 FROM_MISSP_DYNIP 2366 0.39 2.25 0.00 113 RCVD_IN_IADB_LISTED 2342 4.85 2.23 5.39 114 BODY_URI_ONLY 2333 0.44 2.22 0.07 115 XMStockSpam_06 2331 1.80 2.22 1.72 116 HELO_NODOT 2314 1.51 2.20 1.37 117 HELO_NO_DOMAIN 2313 1.51 2.20 1.37 118 RELAYCOUNTRY_DE 2291 0.67 2.18 0.36 119 XMMoneyMeta_00 2173 0.73 2.07 0.45 120 RCVD_IN_IADB_SPF 2139 4.18 2.03 4.62 121 SpammyFromTLD_01 2127 1.28 2.02 1.13 122 TR_Symld_Words 2118 1.76 2.01 1.70 123 DATE_IN_PAST_03_06 2111 0.42 2.01 0.09 124 TM2_M_VERY_LONG_WORD 2081 1.55 1.98 1.47 125 RCVD_IN_IADB_SENDERID 2078 3.68 1.98 4.03 126 RCVD_IN_IADB_DK 2073 3.59 1.97 3.93 127 NORDNS_LOW_CONTRAST 2064 0.35 1.96 0.02 128 XMSubMetaI_00 2054 1.06 1.95 0.87 129 DKIM_ADSP_CUSTOM_MED 2017 1.21 1.92 1.07 130 TR_LOTS_OF_MONEY2 1976 0.71 1.88 0.47 131 T_MONEY_PERCENT 1976 0.71 1.88 0.47 132 RCVD_IN_RP_SAFE 1969 9.11 1.87 10.60 133 ALL_TRUSTED 1953 11.51 1.86 13.51 134 TR_XM_DK_SendGrid 1947 3.18 1.85 3.45 135 RELAYCOUNTRY_IT 1934 0.35 1.84 0.05 136 FSL_HELO_NON_FQDN_1 1923 0.33 1.83 0.02 137 TR_XM_INV_DKIM 1921 0.51 1.83 0.24 138 XMBdyGiftCard01 1916 1.83 1.82 1.83 139 NML_ADSP_CUSTOM_MED 1880 0.98 1.79 0.81 140 T_XMDrugObfuBody_00 1859 1.00 1.77 0.84 141 FORGED_GMAIL_RCVD 1853 0.69 1.76 0.46 142 US_DOLLARS_3 1832 1.11 1.74 0.98 143 BOTNET_NORDNS 1751 0.31 1.66 0.02 144 TR_MetaPhish_Combo_01b 1747 0.50 1.66 0.26 145 URI_TRY_3LD 1712 1.78 1.63 1.81 146 RCVD_IN_PSBL 1706 0.34 1.62 0.08 147 TR_XM_DK_Bayes 1703 14.14 1.62 16.72 148 TR_XM_RelayPhish 1702 1.40 1.62 1.35 149 TR_Mismatch_TLD_01 1677 0.54 1.59 0.33 150 RELAYCOUNTRY_AT 1667 0.44 1.59 0.20 151 T_XMHurry_00 1654 0.73 1.57 0.56 152 TO_NO_BRKTS_FROM_MSSP 1648 0.28 1.57 0.02 153 XMPhish11 1647 1.13 1.57 1.04 154 XM_H_PHPMailer 1618 0.74 1.54 0.57 155 FILL_THIS_FORM 1600 0.76 1.52 0.61 156 RCVD_IN_MSPIKE_WL 1570 4.84 1.49 5.53 157 XM_DK_Undo_01 1553 1.39 1.48 1.37 158 TR_XM_DK_Bayes1 1538 13.46 1.46 15.93 159 T_Symld_Words_02 1498 0.84 1.42 0.72 160 UNPARSEABLE_RELAY 1476 2.29 1.40 2.47 161 RELAYCOUNTRY_AU 1442 0.59 1.37 0.43 162 MAILING_LIST_MULTI 1435 1.85 1.36 1.95 163 XMBrknScrpt_02 1424 0.76 1.35 0.64 164 XMHTML_After_End 1368 0.98 1.30 0.91 165 LongTLD 1348 0.34 1.28 0.14 166 XM_UB99 1340 0.23 1.27 0.02 167 TR_LOTS_OF_MONEY3 1338 0.71 1.27 0.60 168 FILL_THIS_FORM_LONG 1322 0.65 1.26 0.52 169 XM_H_PHPOS_M 1319 0.40 1.25 0.22 170 XMPhish30 1302 0.69 1.24 0.57 171 XM_OfRef7 1294 0.38 1.23 0.21 172 XM_H_Long_From02 1242 1.08 1.18 1.05 173 MONEY_FORM 1227 0.21 1.17 0.01 174 XMSubMetaSxObfu_03 1203 1.04 1.14 1.02 175 HTML_FONT_FACE_BAD 1196 0.84 1.14 0.78 176 RELAYCOUNTRY_IN 1189 0.28 1.13 0.11 177 XMSubMetaSSx_00 1161 0.38 1.10 0.23 178 HTML_TAG_BALANCE_BODY 1120 0.64 1.06 0.56 179 TM2_M_A_HREF_HREF 1104 0.75 1.05 0.69 180 XMGppyBdWords 1098 0.29 1.04 0.13 181 XM_ProductURIs 1091 1.19 1.04 1.22 182 PLING_QUERY 1075 0.85 1.02 0.82 183 HK_RANDOM_REPLYTO 1072 0.40 1.02 0.27 184 RCVD_IN_RP_CERTIFIED 1046 7.87 0.99 9.28 185 URIBL_DBL_ABUSE_REDIR 1033 0.17 0.98 0.00 186 XM_UB60 1030 0.22 0.98 0.06 187 RCVD_IN_MSPIKE_BL 1026 0.20 0.98 0.04 188 XMNoVowels 1021 0.73 0.97 0.68 189 T_FILL_THIS_FORM_SHORT 1005 0.87 0.96 0.85 190 XMHTMLBadTable_001 1002 0.68 0.95 0.62 191 TR_Sbj_FN_Bdy 997 0.34 0.95 0.22 192 XM_UB999 997 0.17 0.95 0.01 193 RCVD_IN_MSPIKE_H3 984 3.84 0.94 4.44 194 XM_Body_Obfu01 980 0.59 0.93 0.52 195 DATE_IN_PAST_06_12 970 0.20 0.92 0.05 196 XMSlimDrugH 970 0.40 0.92 0.29 197 TooManyTo_002 962 1.69 0.91 1.85 198 FORM_FRAUD 958 0.16 0.91 0.00 199 LOW_PRICE 917 0.36 0.87 0.26 200 DIET_1 894 0.46 0.85 0.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 448100 89.00 94.22 87.93 2 DKIM_SIGNED 400695 78.24 76.37 78.63 3 XM_DK_Pass 393502 76.52 73.17 77.21 4 DKIM_VALID 375564 72.75 68.15 73.69 5 XM_B_Unicode 359760 71.01 73.00 70.59 6 DKIM_VALID_AU 279287 54.10 50.67 54.80 7 BAYES_50 277805 53.76 50.12 54.51 8 XMListUnsubscribeExists 276381 56.29 66.27 54.23 9 DCC_CHECK_NEGATIVE 269473 47.02 18.63 52.88 10 DCC_CHECK 229754 50.91 79.13 45.08 11 XM_B_Unicode3 218086 43.85 49.00 42.79 12 HTML_FONT_LOW_CONTRAST 153274 30.94 35.13 30.08 13 T_TM2_M_HEADER_IN_MSG 147693 27.33 19.31 28.98 14 DKIM_VALID_EF 138247 26.13 21.27 27.13 15 LOC_TINY_FONT_1 130804 26.74 31.92 25.67 16 XMSubLong 117821 23.87 27.49 23.12 17 FVGT_m_MULTI_ODD 115245 22.96 24.62 22.61 18 MIME_HTML_ONLY 112611 24.60 36.70 22.10 19 BAYES_00 103458 17.43 3.49 20.30 20 MultiRelay 100047 19.25 17.40 19.63 21 T_KAM_HTML_FONT_INVALID 91492 18.43 20.72 17.95 22 TR_XM_DK_Bayes 85218 14.14 1.62 16.72 23 TR_XM_DK_Bayes1 81191 13.46 1.46 15.93 24 XM_Body_Dirty_Words 76792 16.52 23.56 15.07 25 TR_XM_DK_Bayes2 69234 11.40 0.81 13.59 26 ALL_TRUSTED 68830 11.51 1.86 13.51 27 XM_Multi_Part_URI 64300 13.56 18.11 12.62 28 RCVD_IN_RP_SAFE 54037 9.11 1.87 10.60 29 LOTS_OF_MONEY 53230 11.14 14.49 10.44 30 XM_Evil_Numbers_Gen 50923 10.39 12.31 9.99 31 HTML_IMAGE_RATIO_02 48031 10.14 13.61 9.42 32 RCVD_IN_RP_CERTIFIED 47313 7.87 0.99 9.28 33 T_XMDrugObfuBody_14 45776 9.12 9.81 8.98 34 LotsOfNums_01 44462 8.68 8.44 8.72 35 XM_DKIMWhitelistDomains 43761 7.14 0.11 8.59 36 TooManyTo_001 39598 7.68 7.27 7.77 37 RCVD_IN_MSPIKE_H2 37709 7.07 5.46 7.40 38 FSL_BULK_SIG 37560 9.29 18.60 7.37 39 HTML_IMAGE_RATIO_04 36855 7.34 7.84 7.23 40 XM_H_Long_From01 35156 7.02 7.62 6.90 41 XM_SendGrid 34081 6.27 4.24 6.69 42 XM_DK_Undo_02 33136 11.20 33.97 6.50 43 XM_B_Phish_Phrases 32767 6.75 8.31 6.43 44 BAYES_40 31577 6.01 5.12 6.20 45 T_TooManySym_01 29965 5.36 2.82 5.88 46 MIME_QP_LONG_LINE 29066 5.73 5.87 5.70 47 RCVD_IN_MSPIKE_WL 28185 4.84 1.49 5.53 48 RELAYCOUNTRY_META 27576 8.98 26.30 5.41 49 RCVD_IN_IADB_LISTED 27472 4.85 2.23 5.39 50 DKIM_INVALID 25131 5.49 8.22 4.93 51 BAYES_20 24851 4.69 3.80 4.88 52 BOTNET_IPINHOSTNAME 24519 7.94 23.11 4.81 53 XMStrtUSub 24352 4.64 3.98 4.78 54 XMSexyCombo_05 23682 6.16 13.49 4.65 55 RCVD_IN_IADB_SPF 23552 4.18 2.03 4.62 56 XM_B_Unsub 23077 4.72 5.67 4.53 57 RCVD_IN_MSPIKE_H3 22611 3.84 0.94 4.44 58 XM_PDF 22024 3.72 0.80 4.32 59 XMSubMetaSx_00 21002 4.93 8.84 4.12 60 BAYES_60 20891 4.33 5.46 4.10 61 RCVD_IN_IADB_SENDERID 20540 3.68 1.98 4.03 62 RCVD_IN_IADB_DK 20011 3.59 1.97 3.93 63 XM_B_SpammyTLD 19253 3.71 3.36 3.78 64 T_REMOTE_IMAGE 19209 4.44 7.67 3.77 65 FROM_EXCESS_BASE64 19025 3.68 3.43 3.73 66 MPART_ALT_DIFF 18647 4.74 9.96 3.66 67 RCVD_IN_IADB_VOUCHED 18194 3.08 0.69 3.57 68 IN_ZIMBRA_NJ_WHITELIST 17982 2.93 0.02 3.53 69 XM_UncommonTLD01 17893 5.40 14.55 3.51 70 HTML_IMAGE_RATIO_06 17741 3.59 4.09 3.48 71 XM_DIRTYINTL 17692 3.88 5.88 3.47 72 TR_XM_DK_SendGrid 17580 3.18 1.85 3.45 73 XMNumbers 17461 3.87 6.03 3.43 74 BAYES_99 16715 6.19 20.29 3.28 75 BAYES_05 15757 2.96 2.34 3.09 76 TO_MALFORMED 14496 2.36 0.01 2.84 77 MIME_HTML_MOSTLY 13362 3.16 5.76 2.62 78 BAYES_999 13304 4.89 15.93 2.61 79 KHOP_HELO_FCRDNS 12883 3.25 6.74 2.53 80 UNPARSEABLE_RELAY 12577 2.29 1.40 2.47 81 HTML_MIME_NO_HTML_TAG 12376 3.23 7.09 2.43 82 T_XMDrugObfuBody_08 12287 2.57 3.35 2.41 83 T_TooManySym_02 12045 2.09 0.74 2.36 84 HTML_IMAGE_RATIO_08 11886 2.35 2.46 2.33 85 RCVD_IN_IADB_OPTIN 11644 1.98 0.48 2.28 86 TVD_RCVD_IP 11219 1.91 0.50 2.20 87 BOTNET 10854 5.66 22.79 2.13 88 BAYES_80 10587 2.78 6.19 2.08 89 XM_SPF_SoftFail 10573 2.45 4.25 2.07 90 XM_CamelCaseFrm001 10193 2.11 2.64 2.00 91 MAILING_LIST_MULTI 9958 1.85 1.36 1.95 92 SUBJ_ALL_CAPS 9905 2.15 3.14 1.94 93 URI_HEX 9737 2.38 4.63 1.91 94 MIME_HTML_ONLY_MULTI 9459 2.42 5.17 1.86 95 TooManyTo_002 9417 1.69 0.91 1.85 96 XMBdyGiftCard01 9320 1.83 1.82 1.83 97 URI_TRY_3LD 9222 1.78 1.63 1.81 98 XMStockSpam_06 8747 1.80 2.22 1.72 99 TR_Symld_Words 8672 1.76 2.01 1.70 100 TR_MetaPhish_Combo_01 8654 1.49 0.48 1.70 101 XM_OfRef6 8595 2.05 3.83 1.69 102 TM2_M_URI_OPT_OUT 8494 2.07 4.05 1.67 103 RELAYCOUNTRY_CA 8472 2.04 3.89 1.66 104 UNTRUSTED_Relay 8324 3.96 15.24 1.63 105 CK_HELO_DYNAMIC_SPLIT_IP 8147 1.45 0.75 1.60 106 HELO_DYNAMIC_IPADDR2 8112 1.34 0.12 1.59 107 XMDiploma_00 8031 1.86 3.25 1.58 108 ANY_BOUNCE_MESSAGE 7981 1.41 0.67 1.57 109 BOUNCE_MESSAGE 7979 1.41 0.65 1.57 110 IN_HORDE_ADDRESS_BOOK 7937 1.30 0.05 1.56 111 TR_DCC_Bayes_99 7480 3.93 15.84 1.47 112 TM2_M_VERY_LONG_WORD 7472 1.55 1.98 1.47 113 INVALID_MSGID 7418 1.28 0.43 1.46 114 XM_DK_Undo_01 6999 1.39 1.48 1.37 115 HELO_NODOT 6967 1.51 2.20 1.37 116 HELO_NO_DOMAIN 6966 1.51 2.20 1.37 117 TR_XM_RelayPhish 6888 1.40 1.62 1.35 118 USER_IN_DEF_DKIM_WL 6786 1.11 0.01 1.33 119 BAYES_95 6366 1.52 2.85 1.25 120 XM_ProductURIs 6207 1.19 1.04 1.22 121 TooManyTo_003 6182 1.13 0.74 1.21 122 XMCapTrack 6103 1.04 0.27 1.20 123 XMGappySubj_01 6061 1.04 0.31 1.19 124 XMSexyCombo_01 6000 1.64 3.90 1.18 125 NO_DNS_FOR_FROM 5850 1.71 4.43 1.15 126 RCVD_IN_BL_SPAMCOP_NET 5825 1.79 4.93 1.14 127 SpammyFromTLD_01 5745 1.28 2.02 1.13 128 DKIM_ADSP_CUSTOM_MED 5438 1.21 1.92 1.07 129 XM_H_Long_From02 5373 1.08 1.18 1.05 130 RELAYCOUNTRY_GB 5371 1.63 4.43 1.05 131 XMPhish11 5289 1.13 1.57 1.04 132 XMGenDplmaNmb 5263 1.29 2.55 1.03 133 XM_GoogleGroups 5181 0.93 0.48 1.02 134 XMSubMetaSxObfu_03 5181 1.04 1.14 1.02 135 US_DOLLARS_3 4986 1.11 1.74 0.98 136 XMHTML_After_End 4663 0.98 1.30 0.91 137 XM_UB50 4586 2.32 9.20 0.90 138 TooManyTo_004 4584 0.86 0.64 0.90 139 XMSubMetaI_00 4444 1.06 1.95 0.87 140 T_FILL_THIS_FORM_SHORT 4322 0.87 0.96 0.85 141 T_XMDrugObfuBody_00 4272 1.00 1.77 0.84 142 PLING_QUERY 4179 0.85 1.02 0.82 143 NML_ADSP_CUSTOM_MED 4149 0.98 1.79 0.81 144 XMBody_17 4002 1.22 3.30 0.79 145 HTML_FONT_FACE_BAD 3952 0.84 1.14 0.78 146 TooManyTo_005 3861 0.72 0.56 0.76 147 T_Symld_Words_02 3685 0.84 1.42 0.72 148 XM_SPF_Unknown 3550 0.67 0.55 0.70 149 TM2_M_A_HREF_HREF 3494 0.75 1.05 0.69 150 XMNoVowels 3476 0.73 0.97 0.68 151 TR_XM_PHPDW 3396 0.97 2.43 0.67 152 TR_XM_PHPForged 3293 0.93 2.32 0.65 153 XMBrknScrpt_02 3279 0.76 1.35 0.64 154 T_OBFU_PDF_ATTACH 3269 0.57 0.20 0.64 155 TR_XM_FormFill2 3262 0.93 2.31 0.64 156 XM_H_PHPOS 3243 0.92 2.30 0.64 157 XMHTMLBadTable_001 3165 0.68 0.95 0.62 158 XMBody_95 3149 0.53 0.11 0.62 159 FILL_THIS_FORM 3084 0.76 1.52 0.61 160 TR_LOTS_OF_MONEY3 3040 0.71 1.27 0.60 161 FROM_GOV_SPOOF 3009 0.56 0.44 0.59 162 XMBody_78 2969 0.60 0.71 0.58 163 XMPhish30 2925 0.69 1.24 0.57 164 XM_H_PHPMailer 2909 0.74 1.54 0.57 165 RCVD_IN_MSPIKE_H5 2894 0.50 0.16 0.57 166 XM_B_REG_HTML 2854 0.56 0.57 0.56 167 HTML_TAG_BALANCE_BODY 2841 0.64 1.06 0.56 168 T_XMHurry_00 2833 0.73 1.57 0.56 169 SUBJ_DOLLARS 2821 0.60 0.81 0.55 170 DKIM_ADSP_NXDOMAIN 2704 1.10 3.89 0.53 171 RCVD_IN_MSPIKE_H4 2680 0.50 0.40 0.53 172 XM_Body_Obfu01 2673 0.59 0.93 0.52 173 XM_D_tchamptons_WL 2669 0.43 0.00 0.52 174 FILL_THIS_FORM_LONG 2667 0.65 1.26 0.52 175 T_TooManySym_03 2644 0.47 0.25 0.52 176 HTTPS_HTTP_MISMATCH 2642 0.52 0.55 0.52 177 TM2_M_BODY_EMPTY 2579 0.44 0.11 0.51 178 USER_IN_WHITELIST 2547 0.41 0.00 0.50 179 XM_ShortIntro_01 2512 0.47 0.34 0.49 180 SpammyFromTLD_02 2445 1.67 7.41 0.48 181 URI_NOVOWEL 2429 0.49 0.58 0.48 182 T_MONEY_PERCENT 2395 0.71 1.88 0.47 183 TR_LOTS_OF_MONEY2 2395 0.71 1.88 0.47 184 XMLngstWrd_00 2371 0.45 0.37 0.47 185 FROM_GOV_DKIM_AU 2371 0.42 0.17 0.47 186 FORGED_GMAIL_RCVD 2369 0.69 1.76 0.46 187 XMSubMetaSx_01 2338 0.49 0.67 0.46 188 FSL_THIS_IS_ADV 2328 0.46 0.48 0.46 189 XMMoneyMeta_00 2297 0.73 2.07 0.45 190 HTML_IMAGE_ONLY_28 2288 0.42 0.29 0.45 191 XMLngstWrd_01 2253 0.43 0.35 0.44 192 XMSexyCombo_04 2248 0.78 2.41 0.44 193 RELAYCOUNTRY_AU 2187 0.59 1.37 0.43 194 XMPhish14 2133 0.47 0.70 0.42 195 XM_RXBody 2132 0.38 0.21 0.42 196 XMOemUri 2127 0.37 0.15 0.42 197 XM_B_COPY_HTML 2073 0.48 0.82 0.41 198 REMOVE_BEFORE_LINK 2060 0.41 0.45 0.40 199 MISSING_HEADERS 2055 0.42 0.47 0.40 200 XMBSHREFv2 2035 0.41 0.45 0.40 ----------------------------------------------------------------------