Email: 801423 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 2.27 sec Spam: 137828 Autolearn: 0 AvgScore: 12.27 AvgScanTime: 3.07 sec Ham: 663595 Autolearn: 0 AvgScore: -3.63 AvgScanTime: 2.10 sec Time Spent Running SA: 504.39 hours Time Spent Processing Spam: 117.39 hours Time Spent Processing Ham: 387.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131382 92.24 95.32 91.60 2 DCC_CHECK 110178 47.06 79.94 40.24 3 DKIM_SIGNED 102430 68.28 74.32 67.03 4 XM_B_Unicode 99462 74.59 72.16 75.09 5 XM_DK_Pass 98912 67.01 71.76 66.03 6 DKIM_VALID 92754 63.91 67.30 63.21 7 XMListUnsubscribeExists 87843 51.17 63.73 48.57 8 DKIM_VALID_AU 73520 48.42 53.34 47.40 9 XM_B_Unicode3 65068 47.25 47.21 47.25 10 BAYES_50 64343 46.65 46.68 46.64 11 MIME_HTML_ONLY 50032 25.91 36.30 23.76 12 XM_DK_Undo_02 46485 10.89 33.73 6.15 13 HTML_FONT_LOW_CONTRAST 46483 27.85 33.73 26.63 14 LOC_TINY_FONT_1 45663 23.93 33.13 22.02 15 FVGT_m_MULTI_ODD 35051 20.08 25.43 18.97 16 XMSubLong 34310 21.23 24.89 20.47 17 BAYES_99 31925 6.46 23.16 2.99 18 DKIM_VALID_EF 31881 22.71 23.13 22.63 19 XM_Body_Dirty_Words 31128 13.88 22.58 12.07 20 RELAYCOUNTRY_META 30220 7.57 21.93 4.58 21 XM_UncommonTLD01 30217 8.61 21.92 5.84 22 BOTNET 29747 6.15 21.58 2.94 23 FSL_BULK_SIG 25974 8.63 18.85 6.51 24 TR_DCC_Bayes_99 25885 4.42 18.78 1.43 25 BAYES_999 25264 5.19 18.33 2.45 26 DCC_CHECK_NEGATIVE 25230 51.21 18.31 58.04 27 T_KAM_HTML_FONT_INVALID 25064 16.67 18.18 16.35 28 BOTNET_IPINHOSTNAME 24436 6.46 17.73 4.12 29 T_TM2_M_HEADER_IN_MSG 23988 23.91 17.40 25.26 30 XM_Multi_Part_URI 22760 11.82 16.51 10.85 31 XM_B_Unsub 21424 10.20 15.54 9.10 32 MultiRelay 21380 15.30 15.51 15.26 33 HTML_IMAGE_RATIO_02 20431 9.53 14.82 8.42 34 LOTS_OF_MONEY 20373 10.05 14.78 9.07 35 UNTRUSTED_Relay 18340 3.48 13.31 1.44 36 XMSexyCombo_05 17826 5.47 12.93 3.92 37 XM_Evil_Numbers_Gen 17020 9.96 12.35 9.47 38 SpammyFromTLD_02 12975 1.81 9.41 0.23 39 T_REMOTE_IMAGE 12910 5.90 9.37 5.18 40 T_XMDrugObfuBody_14 12843 8.17 9.32 7.93 41 XMNumbers 12621 3.90 9.16 2.80 42 TooManyTo_001 12621 7.11 9.16 6.69 43 MPART_ALT_DIFF 11892 9.47 8.63 9.65 44 XM_UB50 11010 2.04 7.99 0.81 45 XM_H_Long_From01 10681 6.12 7.75 5.78 46 XMSubMetaSx_00 10627 4.00 7.71 3.23 47 LotsOfNums_01 10235 7.52 7.43 7.54 48 HTML_IMAGE_RATIO_04 10221 13.76 7.42 15.07 49 DKIM_INVALID 9676 4.37 7.02 3.82 50 XM_B_Phish_Phrases 9609 6.33 6.97 6.20 51 FROM_SUSPICIOUS_NTLD 9579 1.24 6.95 0.06 52 MIME_HEADER_CTYPE_ONLY 9526 1.24 6.91 0.06 53 FROM_SUSPICIOUS_NTLD_FP 9521 1.23 6.91 0.05 54 KHOP_HELO_FCRDNS 9093 2.65 6.60 1.84 55 BAYES_80 8977 2.86 6.51 2.10 56 REPLYTO_WITHOUT_TO_CC 8720 1.12 6.33 0.03 57 HTML_SHORT_LINK_IMG_1 8267 1.05 6.00 0.02 58 XM_DIRTYINTL 8110 3.20 5.88 2.65 59 RCVD_IN_BL_SPAMCOP_NET 8076 2.03 5.86 1.24 60 MIME_HTML_MOSTLY 7999 2.73 5.80 2.09 61 HDRS_LCASE_IMGONLY 7984 1.02 5.79 0.03 62 RCVD_IN_MSPIKE_H2 7736 6.85 5.61 7.10 63 BAYES_60 7626 4.46 5.53 4.23 64 DKIM_ADSP_NXDOMAIN 7057 3.82 5.12 3.55 65 MIME_QP_LONG_LINE 6744 5.35 4.89 5.45 66 HTML_MIME_NO_HTML_TAG 6695 2.41 4.86 1.90 67 BAYES_40 6688 5.05 4.85 5.09 68 XM_SendGrid 6418 5.38 4.66 5.53 69 TR_Mismatch_TLD_02 6328 0.84 4.59 0.07 70 XMStrtUSub 6150 7.63 4.46 8.28 71 MIME_HTML_ONLY_MULTI 6138 7.64 4.45 8.30 72 TM2_M_URI_OPT_OUT 6067 3.54 4.40 3.36 73 TO_EQ_FM_DOM_HTML_IMG 5895 0.74 4.28 0.01 74 HTML_IMAGE_ONLY_12 5841 0.85 4.24 0.15 75 RELAYCOUNTRY_GB 5617 1.43 4.08 0.88 76 FROM_EXCESS_BASE64 5607 2.98 4.07 2.75 77 HTML_IMAGE_RATIO_06 5205 5.72 3.78 6.12 78 BAYES_00 5112 23.54 3.71 27.66 79 XM_SPF_SoftFail 5066 2.13 3.68 1.81 80 BAYES_20 5010 5.42 3.63 5.79 81 BOTNET_NORDNS 4887 1.43 3.55 0.99 82 MISSING_HEADERS 4747 0.92 3.44 0.40 83 URI_HEX 4704 1.93 3.41 1.62 84 NO_DNS_FOR_FROM 4669 4.11 3.39 4.26 85 XM_URI_RBL 4517 0.77 3.28 0.25 86 RDNS_DYNAMIC 4511 0.80 3.27 0.29 87 BAYES_95 4461 1.56 3.24 1.22 88 T_TooManySym_01 4413 3.80 3.20 3.92 89 RELAYCOUNTRY_CA 4233 1.66 3.07 1.36 90 XM_CamelCaseFrm001 4229 2.16 3.07 1.97 91 T_XMDrugObfuBody_08 4073 1.71 2.96 1.45 92 XMDiploma_00 3844 1.79 2.79 1.58 93 XMSexyCombo_01 3779 1.21 2.74 0.89 94 RELAYCOUNTRY_FR 3757 0.71 2.73 0.30 95 DATE_IN_PAST_06_12 3667 0.51 2.66 0.06 96 XM_B_SpammyTLD 3661 2.02 2.66 1.89 97 DATE_IN_PAST_03_06 3630 0.54 2.63 0.11 98 TR_XM_DK_SendGrid 3573 2.94 2.59 3.01 99 ALL_TRUSTED 3453 8.62 2.51 9.89 100 HELO_NODOT 3422 1.36 2.48 1.13 101 HELO_NO_DOMAIN 3416 1.36 2.48 1.13 102 MultiRelay_CC 3389 0.59 2.46 0.21 103 MultiRelay_Combo 3389 0.59 2.46 0.21 104 XMHTML_After_End 3355 1.38 2.43 1.16 105 XM_B_Unsub2 3348 1.78 2.43 1.65 106 BAYES_05 3323 3.69 2.41 3.95 107 XMStockSpam_06 3279 1.62 2.38 1.46 108 TM2_M_VERY_LONG_WORD 3153 1.29 2.29 1.09 109 TR_XM_INV_DKIM 3124 0.47 2.27 0.09 110 LongTLD 3097 0.51 2.25 0.15 111 XMSubNoVowel 3049 5.20 2.21 5.82 112 SpammyFromTLD_01 3048 0.90 2.21 0.63 113 TR_LOTS_OF_MONEY3 3040 0.76 2.21 0.47 114 HTML_IMAGE_ONLY_08 2973 0.44 2.16 0.09 115 XMGenDplmaNmb 2920 1.22 2.12 1.04 116 XM_OfRef6 2896 1.35 2.10 1.19 117 RCVD_IN_PSBL 2850 0.38 2.07 0.03 118 SUBJ_ALL_CAPS 2828 1.93 2.05 1.90 119 XMBody_17 2684 0.82 1.95 0.59 120 XMSubMetaI_00 2657 1.03 1.93 0.85 121 RCVD_IN_IADB_LISTED 2633 4.24 1.91 4.73 122 HTML_IMAGE_RATIO_08 2579 2.62 1.87 2.78 123 TR_LOTS_OF_MONEY1 2544 0.33 1.85 0.01 124 XMBdyGiftCard01 2528 1.38 1.83 1.29 125 RCVD_IN_RP_RNBL 2464 0.34 1.79 0.04 126 RCVD_IN_IADB_SPF 2452 3.76 1.78 4.17 127 TR_XM_PHPDW 2429 0.79 1.76 0.59 128 RCVD_IN_IADB_DK 2398 3.32 1.74 3.64 129 TR_XM_PHPForged 2393 0.78 1.74 0.58 130 RCVD_IN_IADB_SENDERID 2388 3.35 1.73 3.69 131 TR_XM_FormFill2 2367 0.77 1.72 0.57 132 RCVD_IN_RP_SAFE 2365 7.90 1.72 9.19 133 XM_H_PHPOS 2358 0.77 1.71 0.57 134 RCVD_IN_MSPIKE_WL 2218 3.27 1.61 3.61 135 RELAYCOUNTRY_DE 2193 0.59 1.59 0.38 136 URI_TRY_3LD 2126 1.14 1.54 1.06 137 RCVD_IN_MSPIKE_BL 2107 1.24 1.53 1.18 138 AC_FROM_MANY_DOTS 2103 3.06 1.53 3.38 139 XMBrknScrpt_02 2099 0.79 1.52 0.63 140 XMPhish11 2098 1.02 1.52 0.92 141 XM_H_Long_From02 2040 1.27 1.48 1.23 142 TR_Symld_Words 2035 1.19 1.48 1.13 143 SHORT_IMG_SUSP_NTLD 2021 0.25 1.47 0.00 144 TR_XM_RelayPhish 1969 1.22 1.43 1.18 145 HTML_IMAGE_ONLY_20 1964 1.07 1.42 1.00 146 MAILING_LIST_MULTI 1936 1.83 1.40 1.91 147 TR_LOTS_OF_MONEY2 1934 1.09 1.40 1.02 148 T_MONEY_PERCENT 1934 1.09 1.40 1.02 149 FSL_THIS_IS_ADV 1894 0.43 1.37 0.23 150 T_XMHurry_00 1868 0.98 1.36 0.90 151 RCVD_IN_MSPIKE_H3 1866 2.91 1.35 3.24 152 RELAYCOUNTRY_IN 1863 0.31 1.35 0.09 153 RELAYCOUNTRY_MX 1845 0.24 1.34 0.01 154 XMSexyCombo_04 1803 0.54 1.31 0.39 155 HDRS_MISSP 1767 0.22 1.28 0.00 156 XM_DK_Undo_01 1758 1.28 1.28 1.28 157 FROM_MISSP_REPLYTO 1753 0.22 1.27 0.00 158 DEAR_BENEFICIARY 1746 0.22 1.27 0.00 159 XM_DrugUnitList 1701 0.21 1.23 0.00 160 ALIBABA_IMG_NOT_RCVD_ALI 1700 0.21 1.23 0.00 161 FROM_MISSP_DYNIP 1698 0.21 1.23 0.00 162 HK_RANDOM_REPLYTO 1652 0.39 1.20 0.22 163 RCVD_IN_RP_CERTIFIED 1645 7.08 1.19 8.30 164 LONG_HEX_URI 1644 0.36 1.19 0.18 165 UNPARSEABLE_RELAY 1644 1.69 1.19 1.79 166 XMSubMetaSSx_00 1638 0.30 1.19 0.11 167 XM_H_PHPMailer 1602 0.54 1.16 0.41 168 TR_XM_DK_Bayes 1595 10.83 1.16 12.84 169 LOW_PRICE 1583 0.37 1.15 0.21 170 RELAYCOUNTRY_IE 1559 0.31 1.13 0.14 171 TR_MetaPhish_Combo_01 1520 1.02 1.10 1.00 172 T_TooManySym_02 1473 1.71 1.07 1.84 173 RELAYCOUNTRY_AT 1454 0.33 1.05 0.18 174 HOSTED_IMG_DIRECT_MX 1453 0.18 1.05 0.00 175 HTML_FONT_FACE_BAD 1448 8.78 1.05 10.39 176 XM_UB99 1443 0.18 1.05 0.00 177 RCVD_IN_MSPIKE_L5 1433 0.39 1.04 0.25 178 TR_XM_DK_Bayes1 1413 10.36 1.03 12.30 179 T_XMDrugObfuBody_00 1406 0.64 1.02 0.56 180 DATE_IN_PAST_12_24 1384 0.20 1.00 0.03 181 XM_H_PHPOS_M 1337 0.26 0.97 0.11 182 T_FILL_THIS_FORM_SHORT 1331 0.61 0.97 0.54 183 HK_RANDOM_FROM 1323 0.25 0.96 0.10 184 TM2_M_A_HREF_HREF 1313 0.57 0.95 0.49 185 XMSubMetaSxObfu_03 1307 0.68 0.95 0.62 186 T_Symld_Words_02 1288 0.75 0.93 0.71 187 DIET_1 1272 0.50 0.92 0.41 188 THIS_AD 1259 0.45 0.91 0.35 189 XMPhish30 1249 0.59 0.91 0.52 190 HTML_TAG_BALANCE_BODY 1210 0.53 0.88 0.45 191 XMBody_78 1202 0.51 0.87 0.44 192 HTML_IMAGE_ONLY_24 1192 0.37 0.86 0.27 193 BODY_URI_ONLY 1179 0.18 0.86 0.05 194 XM_UB60 1152 0.21 0.84 0.09 195 T_HTML_TAG_BALANCE_CENTER 1152 0.23 0.84 0.11 196 DKIM_ADSP_CUSTOM_MED 1143 0.79 0.83 0.79 197 XM_ProductURIs 1123 0.73 0.81 0.71 198 TooManyTo_002 1110 1.39 0.81 1.51 199 XMPhish14 1104 0.47 0.80 0.40 200 PLING_QUERY 1091 0.67 0.79 0.64 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 607821 92.24 95.32 91.60 2 XM_B_Unicode 498313 74.59 72.16 75.09 3 DKIM_SIGNED 444787 68.28 74.32 67.03 4 XM_DK_Pass 438144 67.01 71.76 66.03 5 DKIM_VALID 419437 63.91 67.30 63.21 6 DCC_CHECK_NEGATIVE 385148 51.21 18.31 58.04 7 XMListUnsubscribeExists 322278 51.17 63.73 48.57 8 DKIM_VALID_AU 314512 48.42 53.34 47.40 9 XM_B_Unicode3 313569 47.25 47.21 47.25 10 BAYES_50 309521 46.65 46.68 46.64 11 DCC_CHECK 267005 47.06 79.94 40.24 12 BAYES_00 183570 23.54 3.71 27.66 13 HTML_FONT_LOW_CONTRAST 176745 27.85 33.73 26.63 14 T_TM2_M_HEADER_IN_MSG 167653 23.91 17.40 25.26 15 MIME_HTML_ONLY 157652 25.91 36.30 23.76 16 DKIM_VALID_EF 150162 22.71 23.13 22.63 17 LOC_TINY_FONT_1 146109 23.93 33.13 22.02 18 XMSubLong 135850 21.23 24.89 20.47 19 FVGT_m_MULTI_ODD 125898 20.08 25.43 18.97 20 T_KAM_HTML_FONT_INVALID 108514 16.67 18.18 16.35 21 XM_H_Trusted_IP 105647 13.18 0.00 15.92 22 MultiRelay 101243 15.30 15.51 15.26 23 HTML_IMAGE_RATIO_04 100034 13.76 7.42 15.07 24 TR_XM_DK_Bayes 85189 10.83 1.16 12.84 25 TR_XM_DK_Bayes1 81603 10.36 1.03 12.30 26 XM_Body_Dirty_Words 80070 13.88 22.58 12.07 27 XM_Multi_Part_URI 71992 11.82 16.51 10.85 28 TR_XM_DK_Bayes2 71018 8.98 0.67 10.70 29 HTML_FONT_FACE_BAD 68957 8.78 1.05 10.39 30 ALL_TRUSTED 65632 8.62 2.51 9.89 31 MPART_ALT_DIFF 64018 9.47 8.63 9.65 32 XM_Evil_Numbers_Gen 62827 9.96 12.35 9.47 33 RCVD_IN_RP_SAFE 60957 7.90 1.72 9.19 34 XM_B_Unsub 60360 10.20 15.54 9.10 35 LOTS_OF_MONEY 60207 10.05 14.78 9.07 36 HTML_IMAGE_RATIO_02 55905 9.53 14.82 8.42 37 MIME_HTML_ONLY_MULTI 55072 7.64 4.45 8.30 38 RCVD_IN_RP_CERTIFIED 55063 7.08 1.19 8.30 39 XMStrtUSub 54960 7.63 4.46 8.28 40 T_XMDrugObfuBody_14 52628 8.17 9.32 7.93 41 LotsOfNums_01 50067 7.52 7.43 7.54 42 RCVD_IN_MSPIKE_H2 47145 6.85 5.61 7.10 43 XM_DKIMWhitelistDomains 46797 5.86 0.15 7.05 44 TooManyTo_001 44400 7.11 9.16 6.69 45 FSL_BULK_SIG 43212 8.63 18.85 6.51 46 XM_B_Phish_Phrases 41139 6.33 6.97 6.20 47 XM_DK_Undo_02 40785 10.89 33.73 6.15 48 HTML_IMAGE_RATIO_06 40598 5.72 3.78 6.12 49 XM_UncommonTLD01 38765 8.61 21.92 5.84 50 XMSubNoVowel 38647 5.20 2.21 5.82 51 BAYES_20 38392 5.42 3.63 5.79 52 XM_H_Long_From01 38355 6.12 7.75 5.78 53 XM_SendGrid 36697 5.38 4.66 5.53 54 MIME_QP_LONG_LINE 36157 5.35 4.89 5.45 55 T_REMOTE_IMAGE 34373 5.90 9.37 5.18 56 BAYES_40 33755 5.05 4.85 5.09 57 RCVD_IN_IADB_LISTED 31376 4.24 1.91 4.73 58 RELAYCOUNTRY_META 30425 7.57 21.93 4.58 59 NO_DNS_FOR_FROM 28236 4.11 3.39 4.26 60 BAYES_60 28096 4.46 5.53 4.23 61 RCVD_IN_IADB_SPF 27650 3.76 1.78 4.17 62 BOTNET_IPINHOSTNAME 27328 6.46 17.73 4.12 63 BAYES_05 26235 3.69 2.41 3.95 64 T_TooManySym_01 26035 3.80 3.20 3.92 65 XMSexyCombo_05 26032 5.47 12.93 3.92 66 DKIM_INVALID 25350 4.37 7.02 3.82 67 IN_ZIMBRA_NJ_WHITELIST 25040 3.13 0.02 3.77 68 RCVD_IN_IADB_SENDERID 24465 3.35 1.73 3.69 69 RCVD_IN_IADB_DK 24176 3.32 1.74 3.64 70 RCVD_IN_MSPIKE_WL 23949 3.27 1.61 3.61 71 XM_PDF 23665 3.06 0.64 3.57 72 DKIM_ADSP_NXDOMAIN 23589 3.82 5.12 3.55 73 AC_FROM_MANY_DOTS 22438 3.06 1.53 3.38 74 TM2_M_URI_OPT_OUT 22282 3.54 4.40 3.36 75 RCVD_IN_MSPIKE_H3 21488 2.91 1.35 3.24 76 XMSubMetaSx_00 21407 4.00 7.71 3.23 77 TR_XM_DK_SendGrid 19975 2.94 2.59 3.01 78 BAYES_99 19854 6.46 23.16 2.99 79 BOTNET 19508 6.15 21.58 2.94 80 RCVD_IN_IADB_VOUCHED 19278 2.50 0.53 2.91 81 XMNumbers 18599 3.90 9.16 2.80 82 HTML_IMAGE_RATIO_08 18457 2.62 1.87 2.78 83 FROM_EXCESS_BASE64 18259 2.98 4.07 2.75 84 XM_DIRTYINTL 17563 3.20 5.88 2.65 85 BAYES_999 16290 5.19 18.33 2.45 86 BAYES_80 13955 2.86 6.51 2.10 87 MIME_HTML_MOSTLY 13888 2.73 5.80 2.09 88 XM_CamelCaseFrm001 13061 2.16 3.07 1.97 89 MAILING_LIST_MULTI 12701 1.83 1.40 1.91 90 SUBJ_ALL_CAPS 12613 1.93 2.05 1.90 91 HTML_MIME_NO_HTML_TAG 12613 2.41 4.86 1.90 92 XM_B_SpammyTLD 12533 2.02 2.66 1.89 93 T_TooManySym_02 12220 1.71 1.07 1.84 94 KHOP_HELO_FCRDNS 12182 2.65 6.60 1.84 95 XM_SPF_SoftFail 12031 2.13 3.68 1.81 96 RCVD_IN_IADB_OPTIN 11998 1.57 0.40 1.81 97 UNPARSEABLE_RELAY 11902 1.69 1.19 1.79 98 TVD_RCVD_IP 11682 1.52 0.37 1.76 99 XM_B_Unsub2 10926 1.78 2.43 1.65 100 XM_E_Blogspot 10899 1.40 0.21 1.64 101 URI_HEX 10770 1.93 3.41 1.62 102 XMDiploma_00 10515 1.79 2.79 1.58 103 TooManyTo_002 10009 1.39 0.81 1.51 104 XMStockSpam_06 9666 1.62 2.38 1.46 105 T_XMDrugObfuBody_08 9593 1.71 2.96 1.45 106 UNTRUSTED_Relay 9552 3.48 13.31 1.44 107 TR_DCC_Bayes_99 9519 4.42 18.78 1.43 108 BOUNCE_MESSAGE 9392 1.25 0.44 1.42 109 ANY_BOUNCE_MESSAGE 9392 1.25 0.44 1.42 110 XMSubGarbage 9141 1.15 0.08 1.38 111 RELAYCOUNTRY_CA 9053 1.66 3.07 1.36 112 XMBdyGiftCard01 8551 1.38 1.83 1.29 113 XM_DK_Undo_01 8490 1.28 1.28 1.28 114 IN_HORDE_ADDRESS_BOOK 8339 1.05 0.03 1.26 115 RCVD_IN_BL_SPAMCOP_NET 8227 2.03 5.86 1.24 116 XM_H_Long_From02 8163 1.27 1.48 1.23 117 BAYES_95 8074 1.56 3.24 1.22 118 USER_IN_DEF_DKIM_WL 8000 1.00 0.01 1.21 119 XM_OfRef6 7885 1.35 2.10 1.19 120 RCVD_IN_MSPIKE_BL 7839 1.24 1.53 1.18 121 TR_XM_RelayPhish 7831 1.22 1.43 1.18 122 CK_HELO_DYNAMIC_SPLIT_IP 7812 1.03 0.32 1.18 123 HELO_DYNAMIC_IPADDR2 7807 0.99 0.08 1.18 124 XMHTML_After_End 7711 1.38 2.43 1.16 125 XMSubLongNoVowel 7584 0.96 0.10 1.14 126 INVALID_MSGID 7581 0.97 0.15 1.14 127 HELO_NODOT 7496 1.36 2.48 1.13 128 HELO_NO_DOMAIN 7494 1.36 2.48 1.13 129 TR_Symld_Words 7481 1.19 1.48 1.13 130 TM2_M_VERY_LONG_WORD 7215 1.29 2.29 1.09 131 URI_TRY_3LD 7035 1.14 1.54 1.06 132 XMGenDplmaNmb 6871 1.22 2.12 1.04 133 TR_LOTS_OF_MONEY2 6772 1.09 1.40 1.02 134 T_MONEY_PERCENT 6772 1.09 1.40 1.02 135 TooManyTo_003 6678 0.94 0.63 1.01 136 TR_MetaPhish_Combo_01 6652 1.02 1.10 1.00 137 TO_MALFORMED 6622 0.84 0.07 1.00 138 HTML_IMAGE_ONLY_20 6613 1.07 1.42 1.00 139 BOTNET_NORDNS 6596 1.43 3.55 0.99 140 XMCapTrack 6403 0.84 0.26 0.96 141 XM_GoogleGroups 6366 0.86 0.38 0.96 142 XMPhish11 6111 1.02 1.52 0.92 143 T_XMHurry_00 5946 0.98 1.36 0.90 144 XMSexyCombo_01 5928 1.21 2.74 0.89 145 RELAYCOUNTRY_GB 5869 1.43 4.08 0.88 146 XMSubMetaI_00 5625 1.03 1.93 0.85 147 XMBody_95 5546 0.73 0.21 0.84 148 XM_UB50 5366 2.04 7.99 0.81 149 DKIM_ADSP_CUSTOM_MED 5216 0.79 0.83 0.79 150 XMGappySubj_01 5193 0.70 0.32 0.78 151 TooManyTo_004 4899 0.70 0.51 0.74 152 XM_ProductURIs 4716 0.73 0.81 0.71 153 T_Symld_Words_02 4687 0.75 0.93 0.71 154 FILL_THIS_FORM 4596 0.71 0.78 0.69 155 PLING_QUERY 4278 0.67 0.79 0.64 156 XM_RXBody 4216 0.57 0.27 0.64 157 XMBrknScrpt_02 4211 0.79 1.52 0.63 158 SpammyFromTLD_01 4178 0.90 2.21 0.63 159 XMSubMetaSxObfu_03 4123 0.68 0.95 0.62 160 TooManyTo_005 4051 0.58 0.42 0.61 161 FROM_GOV_DKIM_AU 4049 0.53 0.14 0.61 162 TR_XM_PHPDW 3932 0.79 1.76 0.59 163 XMBody_17 3891 0.82 1.95 0.59 164 TR_XM_PHPForged 3828 0.78 1.74 0.58 165 TR_XM_FormFill2 3795 0.77 1.72 0.57 166 XM_H_PHPOS 3779 0.77 1.71 0.57 167 T_XMDrugObfuBody_00 3726 0.64 1.02 0.56 168 T_FILL_THIS_FORM_SHORT 3595 0.61 0.97 0.54 169 NML_ADSP_CUSTOM_MED 3540 0.56 0.68 0.53 170 XMPhish30 3453 0.59 0.91 0.52 171 XM_SPF_Unknown 3374 0.51 0.50 0.51 172 TM2_M_A_HREF_HREF 3269 0.57 0.95 0.49 173 HTTPS_HTTP_MISMATCH 3259 0.52 0.67 0.49 174 RELAYCOUNTRY_AU 3183 0.50 0.60 0.48 175 RCVD_IN_MSPIKE_L3 3112 0.43 0.26 0.47 176 TR_LOTS_OF_MONEY3 3089 0.76 2.21 0.47 177 RCVD_IN_MSPIKE_L4 3040 0.42 0.23 0.46 178 HTML_TAG_BALANCE_BODY 2999 0.53 0.88 0.45 179 URI_NOVOWEL 2979 0.45 0.48 0.45 180 FORGED_GMAIL_RCVD 2964 0.50 0.76 0.45 181 XMSolicitRefs_0 2944 0.44 0.42 0.44 182 XMBody_78 2901 0.51 0.87 0.44 183 XMMoneyMeta_00 2882 0.49 0.77 0.43 184 XMNoVowels 2855 0.43 0.42 0.43 185 SUBJ_DOLLARS 2821 0.47 0.69 0.43 186 XM_ShortIntro_01 2801 0.38 0.20 0.42 187 T_OBFU_PDF_ATTACH 2796 0.38 0.16 0.42 188 XMHTMLBadTable_001 2762 0.47 0.74 0.42 189 XMLngstWrd_00 2741 0.44 0.59 0.41 190 DIET_1 2738 0.50 0.92 0.41 191 XM_shorewaves_Whitelist 2735 0.34 0.00 0.41 192 XM_H_PHPMailer 2725 0.54 1.16 0.41 193 XM_B_REG_HTML 2685 0.39 0.34 0.40 194 XM_Body_Obfu01 2681 0.44 0.59 0.40 195 FILL_THIS_FORM_LONG 2672 0.46 0.72 0.40 196 MISSING_HEADERS 2655 0.92 3.44 0.40 197 T_TooManySym_03 2649 0.36 0.18 0.40 198 XMPhish14 2647 0.47 0.80 0.40 199 USER_IN_WHITELIST 2645 0.33 0.00 0.40 200 XMLngstWrd_01 2570 0.42 0.55 0.39 ----------------------------------------------------------------------