Email: 685795 Autolearn: 0 AvgScore: 3.03 AvgScanTime: 2.82 sec Spam: 156431 Autolearn: 0 AvgScore: 12.17 AvgScanTime: 3.40 sec Ham: 529364 Autolearn: 0 AvgScore: 0.33 AvgScanTime: 2.65 sec Time Spent Running SA: 536.80 hours Time Spent Processing Spam: 147.69 hours Time Spent Processing Ham: 389.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151326 93.31 96.74 92.30 2 DKIM_SIGNED 134449 88.21 85.95 88.87 3 DCC_CHECK 133429 65.59 85.30 59.76 4 XM_DK_Pass 130425 86.84 83.38 87.86 5 DKIM_VALID 122521 83.20 78.32 84.64 6 XMListUnsubscribeExists 120670 73.30 77.14 72.16 7 XM_B_Unicode 116536 78.91 74.50 80.21 8 DKIM_VALID_AU 97472 63.74 62.31 64.17 9 XM_B_Unicode3 83113 52.25 53.13 51.99 10 LOC_TINY_FONT_1 71274 37.44 45.56 35.04 11 BAYES_50 70170 52.93 44.86 55.31 12 XM_DK_Undo_02 64122 16.04 40.99 8.67 13 HTML_FONT_LOW_CONTRAST 62948 36.55 40.24 35.46 14 MIME_HTML_ONLY 47035 24.30 30.07 22.59 15 FVGT_m_MULTI_ODD 46847 25.89 29.95 24.69 16 BAYES_99 42711 9.85 27.30 4.69 17 DKIM_VALID_EF 41144 25.15 26.30 24.81 18 XMSubLong 36758 20.92 23.50 20.16 19 TR_DCC_Bayes_99 36137 7.35 23.10 2.69 20 BAYES_999 34164 7.93 21.84 3.82 21 T_KAM_HTML_FONT_INVALID 33250 21.43 21.26 21.49 22 XM_Body_Dirty_Words 32422 15.86 20.73 14.42 23 BOTNET 32364 6.65 20.69 2.50 24 XM_Multi_Part_URI 31540 16.63 20.16 15.59 25 MultiRelay 30925 16.52 19.77 15.56 26 BOTNET_IPINHOSTNAME 29314 8.35 18.74 5.28 27 RELAYCOUNTRY_META 26920 7.98 17.21 5.26 28 HTML_IMAGE_RATIO_02 26206 15.47 16.75 15.09 29 XM_UncommonTLD01 25036 5.87 16.00 2.87 30 XM_Evil_Numbers_Gen 22329 13.34 14.27 13.07 31 TooManyTo_001 21363 7.65 13.66 5.87 32 DCC_CHECK_NEGATIVE 20727 32.84 13.25 38.62 33 T_TM2_M_HEADER_IN_MSG 20508 18.02 13.11 19.47 34 FSL_BULK_SIG 20118 7.29 12.86 5.64 35 XM_B_SpammyTLD 16826 3.92 10.76 1.90 36 XM_B_Unsub 16793 9.54 10.74 9.19 37 LOTS_OF_MONEY 16542 8.39 10.57 7.75 38 SpammyFromTLD_02 16187 2.55 10.35 0.25 39 UNTRUSTED_Relay 15496 3.87 9.91 2.09 40 XMSexyCombo_05 15182 5.47 9.71 4.22 41 MPART_ALT_DIFF 14802 5.77 9.46 4.68 42 XM_B_Phish_Phrases 14580 7.06 9.32 6.39 43 LotsOfNums_01 12586 11.13 8.05 12.04 44 FROM_SUSPICIOUS_NTLD 12577 1.90 8.04 0.08 45 XM_SendGrid 12467 8.85 7.97 9.11 46 FROM_SUSPICIOUS_NTLD_FP 12391 1.87 7.92 0.08 47 T_XMDrugObfuBody_14 12380 7.63 7.91 7.55 48 HTML_IMAGE_RATIO_04 12262 8.20 7.84 8.31 49 DKIM_INVALID 11928 5.01 7.63 4.24 50 XM_DIRTYINTL 11799 3.53 7.54 2.34 51 XM_H_Long_From01 11625 7.43 7.43 7.43 52 MIME_HTML_MOSTLY 11501 4.62 7.35 3.81 53 XM_H_TOP 10775 1.57 6.89 0.00 54 BAYES_80 10715 3.91 6.85 3.05 55 BAYES_60 9459 6.12 6.05 6.14 56 MIME_QP_LONG_LINE 9017 7.20 5.76 7.62 57 XMNumbers 8637 3.67 5.52 3.13 58 XMSubMetaSx_00 8621 4.22 5.51 3.84 59 MIME_HTML_ONLY_MULTI 8188 3.14 5.23 2.52 60 XM_UB50 8183 1.94 5.23 0.97 61 FROM_EXCESS_BASE64 7385 5.09 4.72 5.20 62 RCVD_IN_MSPIKE_H2 7347 6.64 4.70 7.21 63 SUBJ_ALL_CAPS 7188 3.88 4.59 3.67 64 HTML_MIME_NO_HTML_TAG 7187 1.75 4.59 0.91 65 URI_HEX 7119 2.89 4.55 2.40 66 XMSubMetaI_00 6708 2.77 4.29 2.32 67 HTML_SHORT_LINK_IMG_1 6646 0.98 4.25 0.02 68 DATE_IN_PAST_12_24 6617 1.04 4.23 0.10 69 RCVD_IN_BL_SPAMCOP_NET 6598 2.43 4.22 1.90 70 HTML_IMAGE_RATIO_06 6454 4.02 4.13 3.99 71 T_REMOTE_IMAGE 6437 3.72 4.11 3.61 72 TR_XM_DK_SendGrid 6307 4.29 4.03 4.37 73 TM2_M_URI_OPT_OUT 5961 2.68 3.81 2.35 74 BAYES_95 5919 2.29 3.78 1.85 75 XM_SPF_SoftFail 5839 1.66 3.73 1.05 76 BAYES_40 5767 4.45 3.69 4.68 77 KHOP_HELO_FCRDNS 5597 1.53 3.58 0.93 78 BODY_URI_ONLY 5433 0.85 3.47 0.07 79 TM2_M_VERY_LONG_WORD 5367 1.77 3.43 1.28 80 RELAYCOUNTRY_GB 5235 1.29 3.35 0.69 81 FROM_MISSP_REPLYTO 4998 0.73 3.20 0.00 82 TR_XM_RelayPhish 4975 1.40 3.18 0.87 83 BAYES_20 4658 3.41 2.98 3.54 84 BOTNET_NORDNS 4574 0.68 2.92 0.02 85 T_HTML_TAG_BALANCE_CENTER 4445 0.72 2.84 0.09 86 HTML_IMAGE_ONLY_08 4433 0.71 2.83 0.08 87 HTML_IMAGE_RATIO_08 4402 2.40 2.81 2.28 88 XM_BadFromFormat 4375 0.73 2.80 0.11 89 XM_URI_RBL 4368 0.86 2.79 0.29 90 RELAYCOUNTRY_CA 4332 1.92 2.77 1.67 91 BAYES_00 4145 14.66 2.65 18.21 92 XMBody_17 4027 1.36 2.57 1.00 93 XM_CamelCaseFrm001 4021 2.43 2.57 2.39 94 XMBdyGiftCard01 3828 2.39 2.45 2.37 95 NO_DNS_FOR_FROM 3788 1.30 2.42 0.97 96 RELAYCOUNTRY_AT 3759 0.88 2.40 0.43 97 XMStrtUSub 3709 3.61 2.37 3.97 98 MultiRelay_CC 3708 0.67 2.37 0.16 99 MultiRelay_Combo 3708 0.67 2.37 0.16 100 XMDiploma_00 3661 1.36 2.34 1.07 101 TR_Mismatch_TLD_02 3651 0.59 2.33 0.08 102 XMStockSpam_06 3541 1.22 2.26 0.91 103 TR_M_TOP_BAYES 3453 0.50 2.21 0.00 104 T_XMHurry_00 3441 2.04 2.20 2.00 105 DATE_IN_PAST_24_48 3430 0.50 2.19 0.01 106 RCVD_IN_IADB_LISTED 3426 5.69 2.19 6.73 107 RCVD_IN_IADB_SPF 3307 5.03 2.11 5.89 108 SpammyFromTLD_01 3283 0.89 2.10 0.53 109 RCVD_IN_IADB_SENDERID 3269 4.55 2.09 5.28 110 RCVD_IN_IADB_DK 3266 4.44 2.09 5.13 111 HDRS_LCASE_IMGONLY 3259 0.49 2.08 0.02 112 XM_OfRef6 3240 1.35 2.07 1.14 113 HDRS_MISSP 3222 0.49 2.06 0.03 114 HTML_EXTRA_CLOSE 3208 0.47 2.05 0.01 115 LOW_PRICE 3161 1.08 2.02 0.80 116 TR_XM_INV_DKIM 3048 0.61 1.95 0.22 117 T_TooManySym_01 2873 3.62 1.84 4.14 118 REPLYTO_WITHOUT_TO_CC 2846 0.43 1.82 0.02 119 XM_B_Unsub2 2845 1.19 1.82 1.00 120 XMGenDplmaNmb 2827 0.92 1.81 0.66 121 RDNS_DYNAMIC 2813 0.70 1.80 0.38 122 TR_XM_DK_Bayes 2813 13.68 1.80 17.19 123 RCVD_IN_RP_SAFE 2668 11.85 1.71 14.84 124 BAYES_05 2578 2.16 1.65 2.31 125 TR_XM_DK_Bayes1 2547 13.15 1.63 16.56 126 RCVD_IN_RP_RNBL 2542 0.41 1.62 0.04 127 T_MONEY_PERCENT 2523 1.04 1.61 0.88 128 TR_LOTS_OF_MONEY2 2523 1.04 1.61 0.88 129 MIME_HEADER_CTYPE_ONLY 2512 0.40 1.61 0.05 130 HTML_IMAGE_ONLY_12 2486 0.44 1.59 0.11 131 RELAYCOUNTRY_FR 2454 0.61 1.57 0.33 132 T_XMDrugObfuBody_08 2413 1.51 1.54 1.50 133 XMSexyCombo_01 2406 0.82 1.54 0.61 134 RCVD_IN_PSBL 2379 0.36 1.52 0.01 135 LOCALPART_IN_SUBJECT 2257 0.34 1.44 0.01 136 UNPARSEABLE_RELAY 2237 2.10 1.43 2.29 137 RCVD_IN_MSPIKE_WL 2215 4.18 1.42 5.00 138 T_XMDrugObfuBody_00 2167 0.81 1.39 0.63 139 FSL_THIS_IS_ADV 2161 0.61 1.38 0.38 140 DATE_IN_PAST_06_12 2160 0.37 1.38 0.08 141 URI_TRY_3LD 2118 1.87 1.35 2.03 142 TR_XM_PHPDW 2031 0.70 1.30 0.52 143 XMPhish14 2011 0.71 1.29 0.54 144 TR_XM_PHPForged 2010 0.68 1.28 0.50 145 TR_XM_FormFill2 1995 0.68 1.28 0.50 146 XM_H_PHPOS 1993 0.67 1.27 0.50 147 RELAYCOUNTRY_DE 1987 0.53 1.27 0.31 148 THIS_AD 1982 0.77 1.27 0.62 149 XMPhish30 1911 0.76 1.22 0.63 150 ALL_TRUSTED 1909 5.90 1.22 7.29 151 XM_ProductURIs 1902 1.58 1.22 1.68 152 XMPhish11 1886 1.00 1.21 0.93 153 RCVD_IN_MSPIKE_H3 1885 3.74 1.21 4.49 154 XMSubMetaSxObfu_03 1846 1.25 1.18 1.27 155 LONG_HEX_URI 1838 0.55 1.17 0.36 156 RCVD_IN_MSPIKE_BL 1834 1.05 1.17 1.01 157 RCVD_IN_RP_CERTIFIED 1833 10.72 1.17 13.55 158 T_Symld_Words_02 1831 0.57 1.17 0.40 159 FROM_MISSP_DYNIP 1820 0.27 1.16 0.00 160 PLING_QUERY 1816 0.67 1.16 0.52 161 XMSubMetaI_01 1807 0.41 1.16 0.20 162 DKIM_ADSP_NXDOMAIN 1796 0.45 1.15 0.25 163 US_DOLLARS_3 1772 1.14 1.13 1.14 164 XMSubMetaD_03 1758 0.41 1.12 0.20 165 XM_H_PHPMailer 1733 0.60 1.11 0.45 166 XMMoneyMeta_00 1690 0.39 1.08 0.19 167 XMHTMLBadTable_001 1674 0.66 1.07 0.54 168 XM_B_COPY_HTML 1605 0.64 1.03 0.53 169 XM_DK_Undo_01 1592 1.10 1.02 1.12 170 XMBrknScrpt_02 1580 1.38 1.01 1.50 171 XM_OfRef7 1571 0.30 1.00 0.10 172 TR_LOTS_OF_MONEY3 1562 0.66 1.00 0.56 173 SHOPIFY_IMG_NOT_RCVD_SFY 1506 0.54 0.96 0.42 174 TR_Caps_n_Bayes_99 1501 0.33 0.96 0.14 175 XM_XX_Yahoo 1454 0.33 0.93 0.15 176 XM_H_Long_From02 1409 1.27 0.90 1.38 177 TR_Symld_Words 1377 1.04 0.88 1.09 178 MAILING_LIST_MULTI 1370 1.69 0.88 1.93 179 TR_XM_DK_Bayes2 1364 11.59 0.87 14.75 180 FILL_THIS_FORM 1363 0.49 0.87 0.38 181 XMHTML_After_End 1359 1.07 0.87 1.12 182 MPART_ALT_DIFF_COUNT 1315 0.47 0.84 0.36 183 TO_NAME_SUBJ_NO_RDNS 1309 0.19 0.84 0.00 184 LongTLD 1285 0.32 0.82 0.17 185 TM2_M_A_HREF_HREF 1283 0.66 0.82 0.62 186 XMClaimOffer 1278 0.30 0.82 0.15 187 HTML_TAG_BALANCE_BODY 1259 0.66 0.80 0.62 188 XM_H_PHPOS_M 1258 0.35 0.80 0.21 189 TRACKER_ID 1242 0.26 0.79 0.10 190 FILL_THIS_FORM_LONG 1221 0.41 0.78 0.30 191 XMBody_78 1217 0.66 0.78 0.63 192 HTML_FONT_FACE_BAD 1214 0.60 0.78 0.55 193 DATE_IN_PAST_03_06 1211 0.26 0.77 0.10 194 DIET_1 1141 0.59 0.73 0.55 195 XMSexyCombo_04 1114 0.29 0.71 0.17 196 TO_EQ_FM_DOM_HTML_IMG 1100 0.16 0.70 0.00 197 RELAYCOUNTRY_IN 1098 0.23 0.70 0.09 198 XM_UB60 1096 0.22 0.70 0.08 199 MONEY_ATM_CARD 1087 0.16 0.69 0.00 200 T_FILL_THIS_FORM_LOAN 1084 0.38 0.69 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 488600 93.31 96.74 92.30 2 DKIM_SIGNED 470472 88.21 85.95 88.87 3 XM_DK_Pass 465124 86.84 83.38 87.86 4 DKIM_VALID 448034 83.20 78.32 84.64 5 XM_B_Unicode 424613 78.91 74.50 80.21 6 XMListUnsubscribeExists 382008 73.30 77.14 72.16 7 DKIM_VALID_AU 339675 63.74 62.31 64.17 8 DCC_CHECK 316352 65.59 85.30 59.76 9 BAYES_50 292791 52.93 44.86 55.31 10 XM_B_Unicode3 275207 52.25 53.13 51.99 11 DCC_CHECK_NEGATIVE 204456 32.84 13.25 38.62 12 HTML_FONT_LOW_CONTRAST 187723 36.55 40.24 35.46 13 LOC_TINY_FONT_1 185511 37.44 45.56 35.04 14 DKIM_VALID_EF 131356 25.15 26.30 24.81 15 FVGT_m_MULTI_ODD 130683 25.89 29.95 24.69 16 MIME_HTML_ONLY 119609 24.30 30.07 22.59 17 T_KAM_HTML_FONT_INVALID 113740 21.43 21.26 21.49 18 XMSubLong 106735 20.92 23.50 20.16 19 T_TM2_M_HEADER_IN_MSG 103084 18.02 13.11 19.47 20 BAYES_00 96384 14.66 2.65 18.21 21 TR_XM_DK_Bayes 90995 13.68 1.80 17.19 22 TR_XM_DK_Bayes1 87651 13.15 1.63 16.56 23 XM_Multi_Part_URI 82503 16.63 20.16 15.59 24 MultiRelay 82392 16.52 19.77 15.56 25 HTML_IMAGE_RATIO_02 79889 15.47 16.75 15.09 26 RCVD_IN_RP_SAFE 78575 11.85 1.71 14.84 27 TR_XM_DK_Bayes2 78098 11.59 0.87 14.75 28 XM_Body_Dirty_Words 76342 15.86 20.73 14.42 29 RCVD_IN_RP_CERTIFIED 71707 10.72 1.17 13.55 30 XM_Evil_Numbers_Gen 69184 13.34 14.27 13.07 31 LotsOfNums_01 63744 11.13 8.05 12.04 32 XM_B_Unsub 48662 9.54 10.74 9.19 33 XM_SendGrid 48222 8.85 7.97 9.11 34 XM_DKIMWhitelistDomains 47337 6.91 0.02 8.94 35 XM_DK_Undo_02 45901 16.04 40.99 8.67 36 HTML_IMAGE_RATIO_04 44003 8.20 7.84 8.31 37 LOTS_OF_MONEY 41019 8.39 10.57 7.75 38 MIME_QP_LONG_LINE 40326 7.20 5.76 7.62 39 T_XMDrugObfuBody_14 39957 7.63 7.91 7.55 40 XM_H_Long_From01 39325 7.43 7.43 7.43 41 ALL_TRUSTED 38575 5.90 1.22 7.29 42 RCVD_IN_MSPIKE_H2 38165 6.64 4.70 7.21 43 RCVD_IN_IADB_LISTED 35630 5.69 2.19 6.73 44 XM_B_Phish_Phrases 33828 7.06 9.32 6.39 45 BAYES_60 32507 6.12 6.05 6.14 46 RCVD_IN_IADB_SPF 31192 5.03 2.11 5.89 47 TooManyTo_001 31081 7.65 13.66 5.87 48 FSL_BULK_SIG 29875 7.29 12.86 5.64 49 RCVD_IN_IADB_SENDERID 27958 4.55 2.09 5.28 50 BOTNET_IPINHOSTNAME 27934 8.35 18.74 5.28 51 RELAYCOUNTRY_META 27832 7.98 17.21 5.26 52 FROM_EXCESS_BASE64 27512 5.09 4.72 5.20 53 RCVD_IN_IADB_DK 27160 4.44 2.09 5.13 54 RCVD_IN_MSPIKE_WL 26443 4.18 1.42 5.00 55 BAYES_99 24809 9.85 27.30 4.69 56 MPART_ALT_DIFF 24799 5.77 9.46 4.68 57 BAYES_40 24767 4.45 3.69 4.68 58 RCVD_IN_MSPIKE_H3 23751 3.74 1.21 4.49 59 TR_XM_DK_SendGrid 23139 4.29 4.03 4.37 60 DKIM_INVALID 22438 5.01 7.63 4.24 61 XMSexyCombo_05 22330 5.47 9.71 4.22 62 T_TooManySym_01 21938 3.62 1.84 4.14 63 RCVD_IN_IADB_VOUCHED 21672 3.28 0.53 4.09 64 HTML_IMAGE_RATIO_06 21121 4.02 4.13 3.99 65 XMStrtUSub 21038 3.61 2.37 3.97 66 XMSubMetaSx_00 20308 4.22 5.51 3.84 67 BAYES_999 20221 7.93 21.84 3.82 68 MIME_HTML_MOSTLY 20177 4.62 7.35 3.81 69 SUBJ_ALL_CAPS 19433 3.88 4.59 3.67 70 T_REMOTE_IMAGE 19101 3.72 4.11 3.61 71 BAYES_20 18726 3.41 2.98 3.54 72 XMNumbers 16548 3.67 5.52 3.13 73 BAYES_80 16133 3.91 6.85 3.05 74 IN_ZIMBRA_NJ_WHITELIST 15991 2.34 0.02 3.02 75 XM_UncommonTLD01 15213 5.87 16.00 2.87 76 TR_DCC_Bayes_99 14260 7.35 23.10 2.69 77 RCVD_IN_IADB_OPTIN 13626 2.10 0.48 2.57 78 MIME_HTML_ONLY_MULTI 13330 3.14 5.23 2.52 79 BOTNET 13230 6.65 20.69 2.50 80 URI_HEX 12700 2.89 4.55 2.40 81 XM_CamelCaseFrm001 12666 2.43 2.57 2.39 82 XMBdyGiftCard01 12552 2.39 2.45 2.37 83 TM2_M_URI_OPT_OUT 12419 2.68 3.81 2.35 84 XM_DIRTYINTL 12388 3.53 7.54 2.34 85 XMSubMetaI_00 12277 2.77 4.29 2.32 86 BAYES_05 12206 2.16 1.65 2.31 87 UNPARSEABLE_RELAY 12138 2.10 1.43 2.29 88 HTML_IMAGE_RATIO_08 12052 2.40 2.81 2.28 89 UNTRUSTED_Relay 11068 3.87 9.91 2.09 90 URI_TRY_3LD 10722 1.87 1.35 2.03 91 T_XMHurry_00 10565 2.04 2.20 2.00 92 MAILING_LIST_MULTI 10217 1.69 0.88 1.93 93 RCVD_IN_BL_SPAMCOP_NET 10060 2.43 4.22 1.90 94 XM_B_SpammyTLD 10056 3.92 10.76 1.90 95 BAYES_95 9817 2.29 3.78 1.85 96 XM_ProductURIs 8911 1.58 1.22 1.68 97 RELAYCOUNTRY_CA 8824 1.92 2.77 1.67 98 TVD_RCVD_IP 8324 1.27 0.25 1.57 99 T_TooManySym_02 8139 1.29 0.47 1.54 100 T_XMDrugObfuBody_08 7958 1.51 1.54 1.50 101 XMBrknScrpt_02 7915 1.38 1.01 1.50 102 IN_HORDE_ADDRESS_BOOK 7825 1.14 0.02 1.48 103 CK_HELO_DYNAMIC_SPLIT_IP 7666 1.20 0.37 1.45 104 HELO_DYNAMIC_IPADDR2 7664 1.13 0.07 1.45 105 USER_IN_DEF_DKIM_WL 7637 1.12 0.01 1.44 106 XM_RXBody 7619 1.19 0.34 1.44 107 XM_PDF 7389 1.13 0.25 1.40 108 XM_H_Long_From02 7331 1.27 0.90 1.38 109 INVALID_MSGID 7041 1.08 0.22 1.33 110 TM2_M_VERY_LONG_WORD 6782 1.77 3.43 1.28 111 ANY_BOUNCE_MESSAGE 6750 1.11 0.57 1.28 112 BOUNCE_MESSAGE 6748 1.11 0.57 1.27 113 XMSubMetaSxObfu_03 6745 1.25 1.18 1.27 114 TO_MALFORMED 6523 0.95 0.01 1.23 115 XMBody_95 6416 0.97 0.14 1.21 116 US_DOLLARS_3 6045 1.14 1.13 1.14 117 DKIM_ADSP_CUSTOM_MED 6028 1.03 0.68 1.14 118 XM_OfRef6 6017 1.35 2.07 1.14 119 XMHTML_After_End 5953 1.07 0.87 1.12 120 XM_DK_Undo_01 5936 1.10 1.02 1.12 121 TR_Symld_Words 5751 1.04 0.88 1.09 122 XMDiploma_00 5659 1.36 2.34 1.07 123 XM_SPF_SoftFail 5549 1.66 3.73 1.05 124 RCVD_IN_MSPIKE_BL 5336 1.05 1.17 1.01 125 XM_B_Unsub2 5291 1.19 1.82 1.00 126 XMBody_17 5282 1.36 2.57 1.00 127 NO_DNS_FOR_FROM 5157 1.30 2.42 0.97 128 XM_UB50 5125 1.94 5.23 0.97 129 XMPhish11 4942 1.00 1.21 0.93 130 KHOP_HELO_FCRDNS 4897 1.53 3.58 0.93 131 XMStockSpam_06 4837 1.22 2.26 0.91 132 HTML_MIME_NO_HTML_TAG 4811 1.75 4.59 0.91 133 T_MONEY_PERCENT 4641 1.04 1.61 0.88 134 TR_LOTS_OF_MONEY2 4641 1.04 1.61 0.88 135 TR_XM_RelayPhish 4627 1.40 3.18 0.87 136 XM_GoogleGroups 4270 0.70 0.32 0.81 137 LOW_PRICE 4226 1.08 2.02 0.80 138 NML_ADSP_CUSTOM_MED 4173 0.73 0.52 0.79 139 TooManyTo_002 3993 0.70 0.50 0.75 140 FORGED_GMAIL_RCVD 3988 0.71 0.58 0.75 141 XMUrgent 3885 0.70 0.59 0.73 142 TR_MetaPhish_Combo_01 3831 0.68 0.53 0.72 143 SUBJ_DOLLARS 3809 0.71 0.68 0.72 144 XMGappySubj_01 3809 0.60 0.21 0.72 145 RELAYCOUNTRY_GB 3639 1.29 3.35 0.69 146 URI_NOVOWEL 3623 0.68 0.65 0.68 147 NUMERIC_HTTP_ADDR 3528 0.62 0.45 0.67 148 XMGenDplmaNmb 3511 0.92 1.81 0.66 149 T_XMDrugObfuBody_00 3354 0.81 1.39 0.63 150 XMBody_78 3318 0.66 0.78 0.63 151 XMPhish30 3316 0.76 1.22 0.63 152 THIS_AD 3300 0.77 1.27 0.62 153 HTML_TAG_BALANCE_BODY 3285 0.66 0.80 0.62 154 TM2_M_A_HREF_HREF 3272 0.66 0.82 0.62 155 XMSexyCombo_01 3236 0.82 1.54 0.61 156 XMSubMetaSxObfu_02 3197 0.52 0.25 0.60 157 XMLngstWrd_00 2957 0.48 0.23 0.56 158 TR_LOTS_OF_MONEY3 2953 0.66 1.00 0.56 159 XMOemUri 2935 0.47 0.17 0.55 160 DIET_1 2912 0.59 0.73 0.55 161 REMOVE_BEFORE_LINK 2898 0.53 0.48 0.55 162 HTML_FONT_FACE_BAD 2893 0.60 0.78 0.55 163 XMPhish14 2870 0.71 1.29 0.54 164 XMBSHREFv2 2862 0.50 0.38 0.54 165 XMHTMLBadTable_001 2862 0.66 1.07 0.54 166 XMLngstWrd_01 2821 0.46 0.21 0.53 167 XM_B_COPY_HTML 2806 0.64 1.03 0.53 168 SpammyFromTLD_01 2799 0.89 2.10 0.53 169 PLING_QUERY 2756 0.67 1.16 0.52 170 TR_XM_PHPDW 2751 0.70 1.30 0.52 171 TooManyTo_003 2713 0.49 0.42 0.51 172 TR_XM_PHPForged 2660 0.68 1.28 0.50 173 XM_Ancestry_Forge 2660 0.39 0.01 0.50 174 TR_XM_FormFill2 2641 0.68 1.28 0.50 175 XM_H_PHPOS 2621 0.67 1.27 0.50 176 XM_D_tchamptons_WL 2536 0.38 0.03 0.48 177 XMSolicitRefs_0 2482 0.43 0.32 0.47 178 RELAYCOUNTRY_AU 2470 0.45 0.39 0.47 179 XM_H_PHPMailer 2364 0.60 1.11 0.45 180 BODY_ENHANCEMENT 2317 0.34 0.02 0.44 181 RCVD_IN_MSPIKE_L3 2286 0.40 0.31 0.43 182 XM_Body_Obfu01 2281 0.44 0.48 0.43 183 RELAYCOUNTRY_AT 2280 0.88 2.40 0.43 184 RCVD_IN_MSPIKE_H4 2224 0.37 0.18 0.42 185 TooManyTo_004 2222 0.41 0.37 0.42 186 SHOPIFY_IMG_NOT_RCVD_SFY 2222 0.54 0.96 0.42 187 T_FILL_THIS_FORM_SHORT 2214 0.42 0.42 0.42 188 XM_B_TRADE_HTML 2178 0.35 0.13 0.41 189 PP_MIME_FAKE_ASCII_TEXT 2149 0.36 0.18 0.41 190 T_Symld_Words_02 2109 0.57 1.17 0.40 191 HELO_NODOT 2059 0.36 0.27 0.39 192 HELO_NO_DOMAIN 2058 0.36 0.27 0.39 193 USER_IN_WHITELIST 2056 0.30 0.00 0.39 194 FSL_THIS_IS_ADV 2028 0.61 1.38 0.38 195 XMCapTrack 2008 0.32 0.12 0.38 196 FILL_THIS_FORM 2000 0.49 0.87 0.38 197 XMGppyBdWords 1998 0.42 0.58 0.38 198 HTTPS_HTTP_MISMATCH 1991 0.39 0.42 0.38 199 RDNS_DYNAMIC 1988 0.70 1.80 0.38 200 XM_SPF_Unknown 1953 0.44 0.69 0.37 ----------------------------------------------------------------------