Email: 638914 Autolearn: 0 AvgScore: 1.99 AvgScanTime: 2.25 sec Spam: 119704 Autolearn: 0 AvgScore: 12.34 AvgScanTime: 3.06 sec Ham: 519210 Autolearn: 0 AvgScore: -0.40 AvgScanTime: 2.07 sec Time Spent Running SA: 399.70 hours Time Spent Processing Spam: 101.67 hours Time Spent Processing Ham: 298.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 115355 90.86 96.37 89.59 2 DCC_CHECK 96876 53.40 80.93 47.06 3 DKIM_SIGNED 87066 76.69 72.73 77.60 4 XM_DK_Pass 82875 75.09 69.23 76.45 5 DKIM_VALID 79560 72.61 66.46 74.03 6 XM_B_Unicode 79083 69.79 66.07 70.65 7 XMListUnsubscribeExists 75031 55.70 62.68 54.10 8 DKIM_VALID_AU 61012 54.19 50.97 54.93 9 BAYES_50 56490 54.77 47.19 56.52 10 XM_B_Unicode3 54670 42.98 45.67 42.36 11 MIME_HTML_ONLY 44506 24.36 37.18 21.40 12 HTML_FONT_LOW_CONTRAST 40614 30.06 33.93 29.17 13 LOC_TINY_FONT_1 38834 27.75 32.44 26.67 14 XM_DK_Undo_02 37249 10.98 31.12 6.34 15 FVGT_m_MULTI_ODD 35730 25.97 29.85 25.08 16 XMSubLong 31310 22.82 26.16 22.05 17 RELAYCOUNTRY_META 27279 9.01 22.79 5.84 18 DKIM_VALID_EF 26902 26.14 22.47 26.98 19 BOTNET 26830 5.93 22.41 2.13 20 MultiRelay 26796 19.74 22.39 19.13 21 FSL_BULK_SIG 25698 12.13 21.47 9.97 22 XM_Body_Dirty_Words 25062 15.56 20.94 14.32 23 BAYES_99 24058 6.29 20.10 3.10 24 T_TM2_M_HEADER_IN_MSG 22562 26.92 18.85 28.78 25 XM_Multi_Part_URI 21685 13.45 18.12 12.37 26 BOTNET_IPINHOSTNAME 20511 6.98 17.13 4.63 27 DCC_CHECK_NEGATIVE 20448 44.65 17.08 51.01 28 T_KAM_HTML_FONT_INVALID 19853 17.86 16.59 18.15 29 XM_UncommonTLD01 19792 5.86 16.53 3.40 30 TR_DCC_Bayes_99 18865 4.16 15.76 1.48 31 BAYES_999 18105 4.84 15.12 2.46 32 XM_B_Unsub 15378 11.10 12.85 10.70 33 HTML_IMAGE_RATIO_02 15378 10.02 12.85 9.37 34 UNTRUSTED_Relay 15321 3.80 12.80 1.73 35 LOTS_OF_MONEY 13837 10.01 11.56 9.65 36 XM_Evil_Numbers_Gen 13431 10.86 11.22 10.78 37 XMSexyCombo_05 12729 5.61 10.63 4.46 38 XM_B_Phish_Phrases 11311 6.59 9.45 5.94 39 SpammyFromTLD_02 11279 2.18 9.42 0.51 40 TooManyTo_001 11158 8.17 9.32 7.90 41 HTML_MIME_NO_HTML_TAG 10490 3.68 8.76 2.51 42 XM_H_Long_From01 10459 7.59 8.74 7.32 43 XM_SPF_SoftFail 10221 4.71 8.54 3.82 44 T_XMDrugObfuBody_14 10062 8.41 8.41 8.41 45 MPART_ALT_DIFF 9755 4.56 8.15 3.74 46 XM_B_SpammyTLD 9597 3.38 8.02 2.31 47 XM_DIRTYINTL 9126 4.36 7.62 3.61 48 XMSubMetaSx_00 8955 4.80 7.48 4.19 49 BAYES_80 8794 3.27 7.35 2.33 50 XMNumbers 8596 4.71 7.18 4.14 51 HTML_SHORT_LINK_IMG_1 8465 1.35 7.07 0.03 52 LotsOfNums_01 8313 8.61 6.94 8.99 53 XM_UB50 8049 2.11 6.72 1.05 54 BAYES_60 7687 5.35 6.42 5.10 55 DKIM_INVALID 7506 4.08 6.27 3.57 56 HTML_IMAGE_RATIO_04 7499 7.12 6.26 7.31 57 XM_SendGrid 7462 6.59 6.23 6.68 58 T_REMOTE_IMAGE 7430 4.24 6.21 3.79 59 KHOP_HELO_FCRDNS 7121 2.72 5.95 1.97 60 FROM_MISSP_REPLYTO 6984 1.09 5.83 0.00 61 ALL_TRUSTED 6819 13.10 5.70 14.80 62 MIME_HTML_MOSTLY 6558 3.17 5.48 2.64 63 BOTNET_NORDNS 6428 1.04 5.37 0.05 64 FROM_SUSPICIOUS_NTLD 6074 0.99 5.07 0.05 65 BAYES_40 6004 5.46 5.02 5.56 66 XM_BadFromFormat 5806 0.99 4.85 0.10 67 FROM_SUSPICIOUS_NTLD_FP 5660 0.92 4.73 0.05 68 MIME_QP_LONG_LINE 5622 5.57 4.70 5.77 69 BODY_URI_ONLY 5616 0.96 4.69 0.10 70 HTML_IMAGE_ONLY_08 5248 0.91 4.38 0.11 71 MIME_HTML_ONLY_MULTI 5199 2.44 4.34 2.00 72 BAYES_20 5031 4.33 4.20 4.36 73 URI_HEX 4963 2.49 4.15 2.11 74 T_HTML_TAG_BALANCE_CENTER 4890 0.84 4.09 0.10 75 RELAYCOUNTRY_GB 4692 1.73 3.92 1.23 76 HDRS_LCASE_IMGONLY 4617 0.75 3.86 0.03 77 TR_XM_RelayPhish 4543 1.48 3.80 0.95 78 RCVD_IN_MSPIKE_H2 4487 5.49 3.75 5.89 79 DATE_IN_PAST_03_06 4480 0.76 3.74 0.08 80 BAYES_00 4447 15.76 3.71 18.54 81 RCVD_IN_BL_SPAMCOP_NET 4323 1.69 3.61 1.24 82 TR_XM_DK_SendGrid 4289 3.38 3.58 3.33 83 FROM_EXCESS_BASE64 4226 3.29 3.53 3.23 84 MIME_HEADER_CTYPE_ONLY 4216 0.72 3.52 0.08 85 BAYES_95 4173 1.73 3.49 1.33 86 TM2_M_URI_OPT_OUT 4153 2.16 3.47 1.85 87 RCVD_IN_RP_RNBL 4143 0.69 3.46 0.05 88 XMDiploma_00 4116 1.78 3.44 1.40 89 HTML_IMAGE_RATIO_06 4009 3.42 3.35 3.44 90 REPLYTO_WITHOUT_TO_CC 3966 0.65 3.31 0.03 91 NO_DNS_FOR_FROM 3951 1.41 3.30 0.97 92 XM_URI_RBL 3936 0.85 3.29 0.29 93 URIBL_DBL_ABUSE_REDIR 3925 1.78 3.28 1.44 94 DKIM_ADSP_CUSTOM_MED 3892 2.18 3.25 1.93 95 XM_H_TOP 3873 0.61 3.24 0.01 96 HDRS_MISSP 3841 0.60 3.21 0.00 97 XMStrtUSub 3796 3.89 3.17 4.05 98 TR_Mismatch_TLD_02 3774 0.71 3.15 0.14 99 RDNS_DYNAMIC 3727 0.84 3.11 0.32 100 RELAYCOUNTRY_CA 3656 1.88 3.05 1.61 101 HTML_IMAGE_ONLY_12 3623 0.68 3.03 0.14 102 TM2_M_VERY_LONG_WORD 3590 1.70 3.00 1.40 103 NML_ADSP_CUSTOM_MED 3582 1.90 2.99 1.65 104 XM_CamelCaseFrm001 3488 2.34 2.91 2.20 105 DKIM_ADSP_NXDOMAIN 3392 0.85 2.83 0.39 106 TO_EQ_FM_DOM_HTML_IMG 3293 0.52 2.75 0.00 107 T_TooManySym_01 3152 4.08 2.63 4.41 108 HTML_IMAGE_RATIO_08 3068 2.20 2.56 2.11 109 XMSexyCombo_01 3046 1.23 2.54 0.93 110 TR_XM_PHPDW 2960 0.95 2.47 0.60 111 FROM_MISSP_DYNIP 2926 0.46 2.44 0.00 112 SUBJ_ALL_CAPS 2918 2.69 2.44 2.75 113 MultiRelay_CC 2917 0.66 2.44 0.25 114 MultiRelay_Combo 2917 0.66 2.44 0.25 115 TR_XM_PHPForged 2909 0.93 2.43 0.58 116 HTML_FONT_SIZE_HUGE 2899 0.52 2.42 0.08 117 TR_XM_FormFill2 2892 0.93 2.42 0.58 118 XM_H_PHPOS 2888 0.92 2.41 0.58 119 XM_B_Unsub2 2872 1.80 2.40 1.66 120 US_DOLLARS_3 2834 1.90 2.37 1.80 121 FORGED_GMAIL_RCVD 2818 1.07 2.35 0.77 122 TR_Symld_Words 2725 1.54 2.28 1.37 123 XMBody_17 2708 0.97 2.26 0.67 124 RELAYCOUNTRY_LT 2683 0.45 2.24 0.04 125 XMStockSpam_06 2645 1.84 2.21 1.76 126 BAYES_05 2631 2.69 2.20 2.81 127 T_XMDrugObfuBody_08 2629 1.49 2.20 1.33 128 T_XMDrugObfuBody_00 2622 1.40 2.19 1.22 129 TO_NO_BRKTS_DYNIP 2549 0.40 2.13 0.00 130 XM_OfRef6 2532 2.30 2.12 2.34 131 XMGenDplmaNmb 2495 1.12 2.08 0.89 132 RCVD_IN_PSBL 2445 0.46 2.04 0.10 133 T_XMHurry_00 2442 1.09 2.04 0.88 134 RCVD_IN_IADB_LISTED 2302 4.89 1.92 5.58 135 HTML_EXTRA_CLOSE 2299 0.38 1.92 0.03 136 RELAYCOUNTRY_FR 2184 0.58 1.82 0.29 137 RCVD_IN_IADB_SPF 2141 4.28 1.79 4.85 138 RCVD_IN_IADB_SENDERID 2113 3.77 1.77 4.23 139 RCVD_IN_IADB_DK 2107 3.71 1.76 4.16 140 UNPARSEABLE_RELAY 2105 2.20 1.76 2.30 141 XMSubMetaI_00 2101 0.92 1.76 0.73 142 TR_XM_INV_DKIM 1963 0.43 1.64 0.16 143 XM_UB60 1930 0.36 1.61 0.07 144 RCVD_IN_RP_SAFE 1908 9.02 1.59 10.73 145 TM2_M_A_HREF_HREF 1891 0.81 1.58 0.63 146 RELAYCOUNTRY_AT 1858 0.46 1.55 0.21 147 XMSubMetaSxObfu_03 1857 0.87 1.55 0.71 148 XMBdyGiftCard01 1765 1.89 1.47 1.98 149 XM_H_Long_From02 1755 1.50 1.47 1.51 150 SpammyFromTLD_01 1752 0.98 1.46 0.87 151 TR_XM_DK_Bayes 1744 12.53 1.46 15.08 152 TO_NO_BRKTS_FROM_MSSP 1723 0.28 1.44 0.01 153 XM_UB80 1723 0.29 1.44 0.02 154 T_Symld_Words_02 1713 1.03 1.43 0.93 155 SUBJ_DOLLARS 1690 0.98 1.41 0.89 156 TR_XM_DK_Bayes1 1681 12.11 1.40 14.57 157 T_FILL_THIS_FORM_SHORT 1674 0.81 1.40 0.68 158 RCVD_IN_MSPIKE_WL 1653 3.85 1.38 4.42 159 XMPhish11 1621 1.15 1.35 1.10 160 XMPhish30 1611 0.69 1.35 0.54 161 XM_DK_Undo_01 1556 1.39 1.30 1.41 162 XMBody_78 1445 0.69 1.21 0.57 163 XMMoneyMeta_00 1420 0.59 1.19 0.45 164 RELAYCOUNTRY_IE 1398 0.39 1.17 0.21 165 URI_TRY_3LD 1369 1.47 1.14 1.54 166 PLING_QUERY 1357 0.75 1.13 0.66 167 XM_H_PHPMailer 1323 0.60 1.11 0.48 168 XMSexyCombo_04 1293 0.27 1.08 0.09 169 MAILING_LIST_MULTI 1276 2.11 1.07 2.35 170 RCVD_IN_MSPIKE_BL 1274 0.29 1.06 0.11 171 T_MONEY_PERCENT 1273 0.62 1.06 0.51 172 TR_LOTS_OF_MONEY2 1273 0.62 1.06 0.51 173 DATE_IN_PAST_06_12 1260 0.24 1.05 0.06 174 RCVD_IN_RP_CERTIFIED 1250 8.06 1.04 9.67 175 XMBrknScrpt_02 1242 0.72 1.04 0.65 176 MPART_ALT_DIFF_COUNT 1242 0.43 1.04 0.29 177 TR_XM_DK_Bayes2 1235 10.39 1.03 12.54 178 XM_XX_Yahoo 1211 0.34 1.01 0.18 179 RCVD_IN_MSPIKE_H3 1203 3.22 1.00 3.73 180 XM_ProductURIs 1157 0.72 0.97 0.66 181 TR_Mismatch_TLD_01 1149 0.44 0.96 0.32 182 HTML_FONT_FACE_BAD 1148 0.64 0.96 0.56 183 XMHTMLBadTable_001 1144 0.66 0.96 0.59 184 LongTLD 1136 0.30 0.95 0.15 185 TR_LOTS_OF_MONEY3 1132 0.47 0.95 0.36 186 RELAYCOUNTRY_IN 1111 0.27 0.93 0.12 187 RELAYCOUNTRY_KR 1104 0.19 0.92 0.02 188 XMLngstWrd_00 1077 0.51 0.90 0.42 189 XMLngstWrd_01 1055 0.50 0.88 0.41 190 HK_RANDOM_REPLYTO 1050 0.49 0.88 0.40 191 XM_Combo_Sbj 1046 0.38 0.87 0.27 192 XM_H_PHPOS_M 1045 0.33 0.87 0.21 193 RELAYCOUNTRY_RU 1045 0.18 0.87 0.02 194 RELAYCOUNTRY_DE 1026 0.47 0.86 0.38 195 RCVD_IN_MSPIKE_L5 1015 0.18 0.85 0.03 196 NUMERIC_HTTP_ADDR 1001 0.53 0.84 0.45 197 NORDNS_LOW_CONTRAST 995 0.16 0.83 0.01 198 XMLngstWrd_02 994 0.39 0.83 0.29 199 THIS_AD 964 0.52 0.81 0.45 200 XM_UB99 950 0.16 0.79 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 465182 90.86 96.37 89.59 2 DKIM_SIGNED 402898 76.69 72.73 77.60 3 XM_DK_Pass 396916 75.09 69.23 76.45 4 DKIM_VALID 384358 72.61 66.46 74.03 5 XM_B_Unicode 366807 69.79 66.07 70.65 6 BAYES_50 293446 54.77 47.19 56.52 7 DKIM_VALID_AU 285205 54.19 50.97 54.93 8 XMListUnsubscribeExists 280871 55.70 62.68 54.10 9 DCC_CHECK_NEGATIVE 264835 44.65 17.08 51.01 10 DCC_CHECK 244315 53.40 80.93 47.06 11 XM_B_Unicode3 219953 42.98 45.67 42.36 12 HTML_FONT_LOW_CONTRAST 151458 30.06 33.93 29.17 13 T_TM2_M_HEADER_IN_MSG 149448 26.92 18.85 28.78 14 DKIM_VALID_EF 140095 26.14 22.47 26.98 15 LOC_TINY_FONT_1 138462 27.75 32.44 26.67 16 FVGT_m_MULTI_ODD 130195 25.97 29.85 25.08 17 XMSubLong 114509 22.82 26.16 22.05 18 MIME_HTML_ONLY 111118 24.36 37.18 21.40 19 MultiRelay 99303 19.74 22.39 19.13 20 BAYES_00 96246 15.76 3.71 18.54 21 T_KAM_HTML_FONT_INVALID 94231 17.86 16.59 18.15 22 TR_XM_DK_Bayes 78301 12.53 1.46 15.08 23 ALL_TRUSTED 76857 13.10 5.70 14.80 24 TR_XM_DK_Bayes1 75673 12.11 1.40 14.57 25 XM_Body_Dirty_Words 74367 15.56 20.94 14.32 26 TR_XM_DK_Bayes2 65124 10.39 1.03 12.54 27 XM_Multi_Part_URI 64250 13.45 18.12 12.37 28 XM_Evil_Numbers_Gen 55973 10.86 11.22 10.78 29 RCVD_IN_RP_SAFE 55703 9.02 1.59 10.73 30 XM_B_Unsub 55539 11.10 12.85 10.70 31 FSL_BULK_SIG 51784 12.13 21.47 9.97 32 RCVD_IN_RP_CERTIFIED 50223 8.06 1.04 9.67 33 LOTS_OF_MONEY 50094 10.01 11.56 9.65 34 HTML_IMAGE_RATIO_02 48627 10.02 12.85 9.37 35 LotsOfNums_01 46689 8.61 6.94 8.99 36 T_XMDrugObfuBody_14 43661 8.41 8.41 8.41 37 XM_DKIMWhitelistDomains 42668 6.69 0.05 8.22 38 TooManyTo_001 41019 8.17 9.32 7.90 39 XM_H_Long_From01 38022 7.59 8.74 7.32 40 HTML_IMAGE_RATIO_04 37960 7.12 6.26 7.31 41 XM_SendGrid 34667 6.59 6.23 6.68 42 XM_DK_Undo_02 32925 10.98 31.12 6.34 43 XM_B_Phish_Phrases 30816 6.59 9.45 5.94 44 RCVD_IN_MSPIKE_H2 30596 5.49 3.75 5.89 45 RELAYCOUNTRY_META 30305 9.01 22.79 5.84 46 MIME_QP_LONG_LINE 29935 5.57 4.70 5.77 47 RCVD_IN_IADB_LISTED 28964 4.89 1.92 5.58 48 BAYES_40 28892 5.46 5.02 5.56 49 BAYES_60 26497 5.35 6.42 5.10 50 RCVD_IN_IADB_SPF 25202 4.28 1.79 4.85 51 BOTNET_IPINHOSTNAME 24064 6.98 17.13 4.63 52 XMSexyCombo_05 23140 5.61 10.63 4.46 53 XM_PDF 23068 3.74 0.71 4.44 54 RCVD_IN_MSPIKE_WL 22943 3.85 1.38 4.42 55 T_TooManySym_01 22895 4.08 2.63 4.41 56 BAYES_20 22650 4.33 4.20 4.36 57 RCVD_IN_IADB_SENDERID 21948 3.77 1.77 4.23 58 XMSubMetaSx_00 21731 4.80 7.48 4.19 59 RCVD_IN_IADB_DK 21603 3.71 1.76 4.16 60 XMNumbers 21470 4.71 7.18 4.14 61 XMStrtUSub 21040 3.89 3.17 4.05 62 XM_SPF_SoftFail 19855 4.71 8.54 3.82 63 T_REMOTE_IMAGE 19675 4.24 6.21 3.79 64 MPART_ALT_DIFF 19406 4.56 8.15 3.74 65 RCVD_IN_MSPIKE_H3 19379 3.22 1.00 3.73 66 RCVD_IN_IADB_VOUCHED 19052 3.09 0.57 3.67 67 XM_DIRTYINTL 18732 4.36 7.62 3.61 68 DKIM_INVALID 18540 4.08 6.27 3.57 69 HTML_IMAGE_RATIO_06 17852 3.42 3.35 3.44 70 IN_ZIMBRA_NJ_WHITELIST 17678 2.77 0.02 3.40 71 XM_UncommonTLD01 17654 5.86 16.53 3.40 72 TR_XM_DK_SendGrid 17279 3.38 3.58 3.33 73 FROM_EXCESS_BASE64 16779 3.29 3.53 3.23 74 BAYES_99 16105 6.29 20.10 3.10 75 BAYES_05 14584 2.69 2.20 2.81 76 SUBJ_ALL_CAPS 14263 2.69 2.44 2.75 77 MIME_HTML_MOSTLY 13690 3.17 5.48 2.64 78 HTML_MIME_NO_HTML_TAG 13016 3.68 8.76 2.51 79 BAYES_999 12796 4.84 15.12 2.46 80 MAILING_LIST_MULTI 12227 2.11 1.07 2.35 81 XM_OfRef6 12137 2.30 2.12 2.34 82 BAYES_80 12122 3.27 7.35 2.33 83 RCVD_IN_IADB_OPTIN 12076 1.96 0.37 2.33 84 XM_B_SpammyTLD 11979 3.38 8.02 2.31 85 UNPARSEABLE_RELAY 11954 2.20 1.76 2.30 86 XM_CamelCaseFrm001 11441 2.34 2.91 2.20 87 BOTNET 11068 5.93 22.41 2.13 88 HTML_IMAGE_RATIO_08 10966 2.20 2.56 2.11 89 URI_HEX 10951 2.49 4.15 2.11 90 T_TooManySym_02 10893 1.83 0.66 2.10 91 MIME_HTML_ONLY_MULTI 10407 2.44 4.34 2.00 92 TVD_RCVD_IP 10353 1.70 0.41 1.99 93 XMBdyGiftCard01 10288 1.89 1.47 1.98 94 KHOP_HELO_FCRDNS 10233 2.72 5.95 1.97 95 DKIM_ADSP_CUSTOM_MED 10009 2.18 3.25 1.93 96 TM2_M_URI_OPT_OUT 9620 2.16 3.47 1.85 97 US_DOLLARS_3 9332 1.90 2.37 1.80 98 XMStockSpam_06 9117 1.84 2.21 1.76 99 TooManyTo_002 8993 1.54 0.72 1.73 100 UNTRUSTED_Relay 8961 3.80 12.80 1.73 101 XM_B_Unsub2 8609 1.80 2.40 1.66 102 NML_ADSP_CUSTOM_MED 8551 1.90 2.99 1.65 103 RELAYCOUNTRY_CA 8378 1.88 3.05 1.61 104 URI_TRY_3LD 8014 1.47 1.14 1.54 105 CK_HELO_DYNAMIC_SPLIT_IP 7883 1.37 0.72 1.52 106 HELO_DYNAMIC_IPADDR2 7862 1.25 0.12 1.51 107 XM_H_Long_From02 7825 1.50 1.47 1.51 108 IN_HORDE_ADDRESS_BOOK 7743 1.22 0.02 1.49 109 TR_DCC_Bayes_99 7698 4.16 15.76 1.48 110 INVALID_MSGID 7495 1.25 0.39 1.44 111 URIBL_DBL_ABUSE_REDIR 7469 1.78 3.28 1.44 112 XM_DK_Undo_01 7319 1.39 1.30 1.41 113 TM2_M_VERY_LONG_WORD 7259 1.70 3.00 1.40 114 XMDiploma_00 7246 1.78 3.44 1.40 115 ANY_BOUNCE_MESSAGE 7218 1.20 0.39 1.39 116 BOUNCE_MESSAGE 7210 1.20 0.39 1.39 117 TR_Symld_Words 7116 1.54 2.28 1.37 118 HELO_NODOT 6913 1.21 0.69 1.33 119 HELO_NO_DOMAIN 6912 1.21 0.68 1.33 120 BAYES_95 6895 1.73 3.49 1.33 121 T_XMDrugObfuBody_08 6887 1.49 2.20 1.33 122 TO_MALFORMED 6784 1.07 0.04 1.31 123 RCVD_IN_BL_SPAMCOP_NET 6460 1.69 3.61 1.24 124 RELAYCOUNTRY_GB 6382 1.73 3.92 1.23 125 T_XMDrugObfuBody_00 6341 1.40 2.19 1.22 126 USER_IN_DEF_DKIM_WL 6295 0.99 0.00 1.21 127 XMHTML_After_End 6271 1.13 0.78 1.21 128 XMCapTrack 6055 1.01 0.34 1.17 129 TooManyTo_003 5983 1.04 0.57 1.15 130 XMPhish11 5712 1.15 1.35 1.10 131 XMGappySubj_01 5568 0.94 0.39 1.07 132 XM_GoogleGroups 5562 0.96 0.46 1.07 133 XM_UB50 5427 2.11 6.72 1.05 134 NO_DNS_FOR_FROM 5050 1.41 3.30 0.97 135 TR_XM_RelayPhish 4921 1.48 3.80 0.95 136 T_Symld_Words_02 4847 1.03 1.43 0.93 137 XMSexyCombo_01 4834 1.23 2.54 0.93 138 XMGenDplmaNmb 4629 1.12 2.08 0.89 139 SUBJ_DOLLARS 4599 0.98 1.41 0.89 140 T_XMHurry_00 4546 1.09 2.04 0.88 141 SpammyFromTLD_01 4511 0.98 1.46 0.87 142 TooManyTo_004 4478 0.79 0.47 0.86 143 XMNoVowels 4023 0.74 0.57 0.77 144 FORGED_GMAIL_RCVD 4008 1.07 2.35 0.77 145 XM_RXBody 3788 0.63 0.20 0.73 146 XMSubMetaI_00 3772 0.92 1.76 0.73 147 XMSubMetaSxObfu_03 3697 0.87 1.55 0.71 148 TR_MetaPhish_Combo_01 3684 0.68 0.55 0.71 149 TooManyTo_005 3657 0.65 0.41 0.70 150 T_FILL_THIS_FORM_SHORT 3520 0.81 1.40 0.68 151 XMBody_17 3490 0.97 2.26 0.67 152 XM_SPF_Unknown 3428 0.67 0.73 0.66 153 XM_ProductURIs 3427 0.72 0.97 0.66 154 PLING_QUERY 3410 0.75 1.13 0.66 155 XMBrknScrpt_02 3375 0.72 1.04 0.65 156 FILL_THIS_FORM 3308 0.61 0.48 0.64 157 TM2_M_A_HREF_HREF 3268 0.81 1.58 0.63 158 XMBody_95 3136 0.52 0.18 0.60 159 XM_B_REG_HTML 3130 0.55 0.34 0.60 160 TR_XM_PHPDW 3100 0.95 2.47 0.60 161 RCVD_IN_MSPIKE_H4 3067 0.54 0.32 0.59 162 XMHTMLBadTable_001 3062 0.66 0.96 0.59 163 TR_XM_PHPForged 3032 0.93 2.43 0.58 164 HTTPS_HTTP_MISMATCH 3027 0.57 0.51 0.58 165 TR_XM_FormFill2 3024 0.93 2.42 0.58 166 XM_H_PHPOS 3009 0.92 2.41 0.58 167 XMBody_78 2978 0.69 1.21 0.57 168 HTML_FONT_FACE_BAD 2930 0.64 0.96 0.56 169 URI_NOVOWEL 2890 0.53 0.41 0.56 170 XM_ShortIntro_01 2845 0.51 0.33 0.55 171 XMPhish30 2829 0.69 1.35 0.54 172 FORGED_YAHOO_RCVD 2777 0.52 0.46 0.53 173 T_OBFU_PDF_ATTACH 2772 0.47 0.17 0.53 174 HTML_TAG_BALANCE_BODY 2757 0.56 0.67 0.53 175 FILL_THIS_FORM_LONG 2754 0.49 0.34 0.53 176 SpammyFromTLD_02 2665 2.18 9.42 0.51 177 T_MONEY_PERCENT 2658 0.62 1.06 0.51 178 TR_LOTS_OF_MONEY2 2658 0.62 1.06 0.51 179 T_TooManySym_03 2653 0.45 0.19 0.51 180 T_FILL_THIS_FORM_LOAN 2642 0.44 0.13 0.51 181 RELAYCOUNTRY_NL 2584 0.53 0.67 0.50 182 XM_H_PHPMailer 2504 0.60 1.11 0.48 183 FROM_GOV_SPOOF 2452 0.43 0.26 0.47 184 USER_IN_WHITELIST 2378 0.37 0.00 0.46 185 NUMERIC_HTTP_ADDR 2354 0.53 0.84 0.45 186 THIS_AD 2346 0.52 0.81 0.45 187 REMOVE_BEFORE_LINK 2324 0.41 0.24 0.45 188 XMMoneyMeta_00 2320 0.59 1.19 0.45 189 TM2_M_BODY_EMPTY 2304 0.38 0.10 0.44 190 XMOemUri 2210 0.46 0.58 0.43 191 DIET_1 2207 0.49 0.76 0.43 192 XMLngstWrd_00 2202 0.51 0.90 0.42 193 XM_B_COPY_HTML 2196 0.47 0.66 0.42 194 XMBSHREFv2 2188 0.42 0.42 0.42 195 XMSlimDrugH 2158 0.47 0.69 0.42 196 MISSING_HEADERS 2140 0.42 0.48 0.41 197 XMLngstWrd_01 2112 0.50 0.88 0.41 198 RELAYCOUNTRY_AU 2093 0.40 0.39 0.40 199 HTML_IMAGE_ONLY_32 2072 0.37 0.26 0.40 200 HK_RANDOM_REPLYTO 2053 0.49 0.88 0.40 ----------------------------------------------------------------------