Email: 352206 Autolearn: 0 AvgScore: 1.59 AvgScanTime: 2.17 sec Spam: 72291 Autolearn: 0 AvgScore: 12.89 AvgScanTime: 2.59 sec Ham: 279915 Autolearn: 0 AvgScore: -1.33 AvgScanTime: 2.07 sec Time Spent Running SA: 212.51 hours Time Spent Processing Spam: 51.93 hours Time Spent Processing Ham: 160.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 69818 90.00 96.58 88.30 2 DCC_CHECK 56150 58.03 77.67 52.95 3 XM_B_Unicode 50626 73.25 70.03 74.08 4 DKIM_SIGNED 48514 79.79 67.11 83.07 5 XM_DK_Pass 46163 78.26 63.86 81.98 6 DKIM_VALID 43624 75.15 60.34 78.97 7 XMListUnsubscribeExists 40534 61.64 56.07 63.08 8 DKIM_VALID_AU 32916 61.31 45.53 65.39 9 BAYES_50 32826 51.08 45.41 52.55 10 XM_B_Unicode3 30802 45.73 42.61 46.54 11 MIME_HTML_ONLY 28728 27.55 39.74 24.40 12 XM_DK_Undo_02 24867 14.04 34.40 8.79 13 HTML_FONT_LOW_CONTRAST 24260 34.31 33.56 34.50 14 LOC_TINY_FONT_1 19842 30.66 27.45 31.49 15 FSL_BULK_SIG 18984 11.54 26.26 7.74 16 FVGT_m_MULTI_ODD 18720 23.95 25.90 23.45 17 XM_B_Unsub 18202 13.08 25.18 9.96 18 XMSubLong 18030 21.61 24.94 20.75 19 XM_UncommonTLD01 17513 8.54 24.23 4.49 20 BAYES_99 17486 9.25 24.19 5.39 21 XM_Body_Dirty_Words 14481 17.22 20.03 16.50 22 RELAYCOUNTRY_META 14470 7.98 20.02 4.87 23 DCC_CHECK_NEGATIVE 14373 40.59 19.88 45.94 24 BAYES_999 13428 7.42 18.57 4.53 25 MultiRelay 13200 15.60 18.26 14.91 26 BOTNET_IPINHOSTNAME 13127 8.70 18.16 6.25 27 TR_DCC_Bayes_99 13117 5.69 18.14 2.47 28 DKIM_VALID_EF 12845 25.96 17.77 28.07 29 XM_Multi_Part_URI 12790 15.59 17.69 15.04 30 HTML_IMAGE_RATIO_02 12372 12.34 17.11 11.11 31 T_KAM_HTML_FONT_INVALID 11993 17.93 16.59 18.28 32 T_TM2_M_HEADER_IN_MSG 11586 20.42 16.03 21.55 33 BOTNET 11340 5.00 15.69 2.23 34 KHOP_HELO_FCRDNS 11266 4.03 15.58 1.05 35 RDNS_DYNAMIC 9917 3.26 13.72 0.56 36 SpammyFromTLD_02 9449 2.82 13.07 0.17 37 LOTS_OF_MONEY 9438 10.63 13.06 10.01 38 XM_H_Long_From01 9098 7.70 12.59 6.43 39 HTML_MIME_NO_HTML_TAG 8797 3.92 12.17 1.79 40 UNTRUSTED_Relay 8303 3.66 11.49 1.64 41 XMSexyCombo_05 8079 6.52 11.18 5.32 42 RCVD_IN_MSPIKE_H2 7641 14.09 10.57 14.99 43 XM_Evil_Numbers_Gen 6714 11.08 9.29 11.54 44 BAYES_80 6608 4.33 9.14 3.09 45 BAYES_60 6326 6.14 8.75 5.46 46 XMSubMetaSx_00 6166 5.00 8.53 4.08 47 DKIM_ADSP_NXDOMAIN 5983 2.64 8.28 1.19 48 TR_Mismatch_TLD_02 5689 1.68 7.87 0.08 49 FROM_SUSPICIOUS_NTLD 5531 1.62 7.65 0.07 50 FROM_SUSPICIOUS_NTLD_FP 5517 1.62 7.63 0.06 51 HTML_IMAGE_ONLY_08 5446 1.65 7.53 0.13 52 XMNumbers 5403 4.95 7.47 4.30 53 XM_DIRTYINTL 5319 4.00 7.36 3.14 54 RCVD_IN_BL_SPAMCOP_NET 5140 2.46 7.11 1.26 55 T_XMDrugObfuBody_14 5131 7.72 7.10 7.88 56 MIME_HEADER_CTYPE_ONLY 5128 1.52 7.09 0.08 57 MPART_ALT_DIFF 5051 5.83 6.99 5.53 58 DKIM_INVALID 4890 4.64 6.76 4.09 59 MISSING_HEADERS 4826 1.53 6.68 0.20 60 T_REMOTE_IMAGE 4818 4.38 6.66 3.79 61 XM_UB50 4794 2.00 6.63 0.80 62 TooManyTo_001 4732 5.89 6.55 5.72 63 HTML_IMAGE_RATIO_04 4564 6.96 6.31 7.13 64 MIME_HTML_MOSTLY 4559 4.00 6.31 3.40 65 T_HTML_TAG_BALANCE_CENTER 4557 1.43 6.30 0.18 66 XM_B_Phish_Phrases 4544 7.78 6.29 8.16 67 LotsOfNums_01 4458 7.48 6.17 7.81 68 RCVD_IN_MSPIKE_BL 4273 1.73 5.91 0.64 69 XM_B_SpammyTLD 4236 3.26 5.86 2.58 70 XM_SPF_SoftFail 4075 2.11 5.64 1.20 71 XMHTML_After_End 3993 1.95 5.52 1.02 72 HTML_SHORT_LINK_IMG_1 3908 1.14 5.41 0.04 73 RCVD_IN_MSPIKE_L5 3604 1.26 4.99 0.30 74 XM_SendGrid 3530 6.86 4.88 7.37 75 RELAYCOUNTRY_CA 3344 2.66 4.63 2.15 76 TR_LOTS_OF_MONEY3 3277 2.22 4.53 1.62 77 XMStrtUSub 3221 4.68 4.46 4.74 78 HTML_FONT_SIZE_HUGE 2903 0.91 4.02 0.10 79 HDRS_LCASE_IMGONLY 2895 0.83 4.00 0.01 80 BODY_URI_ONLY 2801 0.83 3.87 0.04 81 XM_SPF_Unknown 2768 1.06 3.83 0.35 82 XM_URI_RBL 2715 1.08 3.76 0.39 83 MIME_QP_LONG_LINE 2705 4.54 3.74 4.74 84 XMBody_17 2627 1.76 3.63 1.28 85 XM_CamelCaseFrm001 2546 2.74 3.52 2.53 86 XM_BadFromFormat 2507 0.83 3.47 0.15 87 RCVD_IN_MSPIKE_WL 2445 9.08 3.38 10.56 88 RCVD_IN_MSPIKE_H3 2436 9.06 3.37 10.53 89 URI_HEX 2417 1.78 3.34 1.38 90 BAYES_95 2382 2.18 3.30 1.89 91 NORDNS_LOW_CONTRAST 2379 0.68 3.29 0.00 92 XM_OfRef6 2376 1.70 3.29 1.29 93 TM2_M_URI_OPT_OUT 2267 2.02 3.14 1.73 94 MultiRelay_Combo 2235 0.76 3.09 0.16 95 MultiRelay_CC 2235 0.76 3.09 0.16 96 NO_DNS_FOR_FROM 2177 2.17 3.01 1.95 97 BAYES_40 2165 4.42 2.99 4.79 98 HTML_IMAGE_RATIO_06 2153 3.76 2.98 3.97 99 RCVD_IN_RP_RNBL 2151 0.65 2.98 0.05 100 T_TooManySym_01 2113 5.38 2.92 6.01 101 TR_LOTS_OF_MONEY2 2026 0.80 2.80 0.28 102 T_MONEY_PERCENT 2026 0.80 2.80 0.28 103 TR_XM_DK_SendGrid 1971 4.23 2.73 4.62 104 XMDiploma_00 1957 2.08 2.71 1.92 105 MIME_HTML_ONLY_MULTI 1940 2.87 2.68 2.92 106 RELAYCOUNTRY_FR 1868 0.75 2.58 0.27 107 RCVD_IN_PSBL 1831 0.58 2.53 0.07 108 XMSexyCombo_01 1830 1.08 2.53 0.70 109 RELAYCOUNTRY_DE 1808 0.82 2.50 0.39 110 RCVD_IN_RP_SAFE 1799 13.16 2.49 15.91 111 BAYES_20 1799 3.61 2.49 3.90 112 FROM_EXCESS_BASE64 1765 4.28 2.44 4.76 113 T_XMDrugObfuBody_08 1756 1.70 2.43 1.51 114 DATE_IN_PAST_03_06 1740 0.60 2.41 0.13 115 T_XMHurry_00 1644 1.48 2.27 1.28 116 SHORTENER_SHORT_IMG 1643 0.47 2.27 0.00 117 SHORT_IMG_SUSP_NTLD 1643 0.47 2.27 0.00 118 HTML_TAG_BALANCE_BODY 1608 0.91 2.22 0.58 119 TR_XM_INV_DKIM 1585 0.60 2.19 0.19 120 DATE_IN_PAST_12_24 1564 0.48 2.16 0.04 121 XM_Palau_URI 1544 0.44 2.14 0.00 122 TR_XM_RelayPhish 1525 1.74 2.11 1.64 123 HTML_IMAGE_RATIO_08 1522 2.30 2.11 2.35 124 HK_RANDOM_FROM 1428 0.54 1.98 0.17 125 SUBJ_ALL_CAPS 1377 1.92 1.90 1.93 126 XMSubMetaI_00 1366 1.38 1.89 1.25 127 BAYES_00 1344 16.41 1.86 20.17 128 SHORT_SHORTNER 1324 0.38 1.83 0.01 129 XMGenDplmaNmb 1316 1.15 1.82 0.98 130 RELAYCOUNTRY_GB 1312 0.72 1.81 0.44 131 RCVD_IN_IADB_LISTED 1301 3.51 1.80 3.95 132 TR_XM_PHPDW 1300 0.83 1.80 0.58 133 TM2_M_VERY_LONG_WORD 1243 1.89 1.72 1.93 134 TR_XM_PHPForged 1237 0.80 1.71 0.56 135 TR_XM_FormFill2 1216 0.78 1.68 0.55 136 XM_H_PHPOS 1210 0.78 1.67 0.55 137 DATE_IN_PAST_24_48 1208 0.35 1.67 0.01 138 SpammyFromTLD_01 1184 0.72 1.64 0.48 139 URI_TRY_3LD 1180 1.95 1.63 2.03 140 RCVD_IN_RP_CERTIFIED 1150 11.56 1.59 14.13 141 BAYES_05 1143 2.24 1.58 2.41 142 XM_B_Unsub2 1128 1.41 1.56 1.37 143 BOTNET_NORDNS 1114 0.34 1.54 0.02 144 RCVD_IN_IADB_SPF 1089 3.02 1.51 3.42 145 RCVD_IN_IADB_DK 1071 2.64 1.48 2.93 146 RCVD_IN_IADB_SENDERID 1069 2.70 1.48 3.01 147 XM_Combo_Sbj 1032 0.40 1.43 0.14 148 RELAYCOUNTRY_AT 1020 0.54 1.41 0.32 149 FVGT_m_MULTI_ODD_EMAIL 1005 0.31 1.39 0.03 150 DIET_1 992 1.23 1.37 1.20 151 TR_XM_DK_Bayes 955 14.41 1.32 17.79 152 REPLYTO_WITHOUT_TO_CC 953 0.32 1.32 0.06 153 HTML_IMAGE_ONLY_28 950 0.44 1.31 0.21 154 TR_Mismatch_TLD_01 948 0.50 1.31 0.29 155 XMStockSpam_06 934 0.97 1.29 0.88 156 LOW_PRICE 912 0.57 1.26 0.39 157 ALL_TRUSTED 905 9.79 1.25 12.00 158 XM_ProductURIs 903 1.48 1.25 1.54 159 TooManyTo_002 900 1.07 1.24 1.03 160 XM_OfRef7 899 0.33 1.24 0.10 161 DKIM_ADSP_CUSTOM_MED 861 0.90 1.19 0.82 162 DEAR_FRIEND 854 0.37 1.18 0.15 163 XM_ShortIntro_01 841 0.51 1.16 0.34 164 XM_Nigeria_01 840 0.25 1.16 0.02 165 TR_XM_DK_Bayes1 837 13.90 1.16 17.19 166 TR_Symld_Words 814 1.23 1.13 1.26 167 MAILING_LIST_MULTI 810 1.48 1.12 1.57 168 HTML_IMAGE_ONLY_12 792 0.32 1.10 0.12 169 FORGED_GMAIL_RCVD 791 0.64 1.09 0.52 170 HK_SCAM 789 0.23 1.09 0.01 171 URIBL_DBL_ABUSE_REDIR 780 0.23 1.08 0.01 172 NML_ADSP_CUSTOM_MED 771 0.69 1.07 0.60 173 T_XMDrugObfuBody_00 767 0.58 1.06 0.45 174 XMReplyNow 754 0.28 1.04 0.09 175 HTML_EXTRA_CLOSE 751 0.24 1.04 0.03 176 TooManyTo_003 750 0.77 1.04 0.70 177 XM_H_PHPMailer 731 0.61 1.01 0.50 178 SUBJECT_NEEDS_ENCODING 715 0.21 0.99 0.00 179 SUBJ_ILLEGAL_CHARS 712 0.21 0.98 0.00 180 HTML_FONT_FACE_BAD 694 0.99 0.96 0.99 181 HK_RANDOM_REPLYTO 687 0.49 0.95 0.37 182 XMSexyCombo_04 685 0.33 0.95 0.17 183 XMSubMetaSSx_00 683 0.33 0.94 0.17 184 XMSlimDrugH 676 0.54 0.94 0.44 185 XMSubMetaSxObfu_03 671 0.58 0.93 0.49 186 LongTLD 664 0.35 0.92 0.21 187 TR_XM_DK_Bayes2 663 13.14 0.92 16.29 188 XM_UB60 658 0.24 0.91 0.06 189 URIBL_BLACK 658 0.19 0.91 0.01 190 XM_UB99 655 0.19 0.91 0.01 191 XMPhish11 649 0.94 0.90 0.96 192 UNPARSEABLE_RELAY 645 3.25 0.89 3.86 193 MPART_ALT_DIFF_COUNT 626 0.50 0.87 0.41 194 XMBdyGiftCard01 624 2.11 0.86 2.43 195 MILLION_USD 616 0.18 0.85 0.00 196 XM_H_PHPOS_M 609 0.31 0.84 0.17 197 XM_H_Long_From02 608 1.08 0.84 1.14 198 XMBrknScrpt_02 605 0.85 0.84 0.85 199 TooManyTo_004 599 0.60 0.83 0.54 200 HTML_IMAGE_ONLY_32 595 0.35 0.82 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 247173 90.00 96.58 88.30 2 DKIM_SIGNED 232512 79.79 67.11 83.07 3 XM_DK_Pass 229473 78.26 63.86 81.98 4 DKIM_VALID 221057 75.15 60.34 78.97 5 XM_B_Unicode 207372 73.25 70.03 74.08 6 DKIM_VALID_AU 183029 61.31 45.53 65.39 7 XMListUnsubscribeExists 176569 61.64 56.07 63.08 8 DCC_CHECK 148221 58.03 77.67 52.95 9 BAYES_50 147098 51.08 45.41 52.55 10 XM_B_Unicode3 130267 45.73 42.61 46.54 11 DCC_CHECK_NEGATIVE 128593 40.59 19.88 45.94 12 HTML_FONT_LOW_CONTRAST 96583 34.31 33.56 34.50 13 LOC_TINY_FONT_1 88136 30.66 27.45 31.49 14 DKIM_VALID_EF 78582 25.96 17.77 28.07 15 MIME_HTML_ONLY 68296 27.55 39.74 24.40 16 FVGT_m_MULTI_ODD 65638 23.95 25.90 23.45 17 T_TM2_M_HEADER_IN_MSG 60333 20.42 16.03 21.55 18 XMSubLong 58084 21.61 24.94 20.75 19 BAYES_00 56459 16.41 1.86 20.17 20 T_KAM_HTML_FONT_INVALID 51163 17.93 16.59 18.28 21 TR_XM_DK_Bayes 49785 14.41 1.32 17.79 22 TR_XM_DK_Bayes1 48105 13.90 1.16 17.19 23 XM_Body_Dirty_Words 46172 17.22 20.03 16.50 24 TR_XM_DK_Bayes2 45606 13.14 0.92 16.29 25 RCVD_IN_RP_SAFE 44542 13.16 2.49 15.91 26 XM_Multi_Part_URI 42102 15.59 17.69 15.04 27 RCVD_IN_MSPIKE_H2 41971 14.09 10.57 14.99 28 MultiRelay 41741 15.60 18.26 14.91 29 RCVD_IN_RP_CERTIFIED 39548 11.56 1.59 14.13 30 ALL_TRUSTED 33576 9.79 1.25 12.00 31 XM_Evil_Numbers_Gen 32294 11.08 9.29 11.54 32 HTML_IMAGE_RATIO_02 31093 12.34 17.11 11.11 33 XM_DKIMWhitelistDomains 30430 8.65 0.04 10.87 34 RCVD_IN_MSPIKE_WL 29548 9.08 3.38 10.56 35 RCVD_IN_MSPIKE_H3 29487 9.06 3.37 10.53 36 LOTS_OF_MONEY 28011 10.63 13.06 10.01 37 XM_B_Unsub 27884 13.08 25.18 9.96 38 XM_DK_Undo_02 24600 14.04 34.40 8.79 39 XM_B_Phish_Phrases 22847 7.78 6.29 8.16 40 T_XMDrugObfuBody_14 22071 7.72 7.10 7.88 41 LotsOfNums_01 21874 7.48 6.17 7.81 42 FSL_BULK_SIG 21661 11.54 26.26 7.74 43 XM_SendGrid 20640 6.86 4.88 7.37 44 HTML_IMAGE_RATIO_04 19960 6.96 6.31 7.13 45 XM_H_Long_From01 18011 7.70 12.59 6.43 46 BOTNET_IPINHOSTNAME 17508 8.70 18.16 6.25 47 T_TooManySym_01 16836 5.38 2.92 6.01 48 TooManyTo_001 16022 5.89 6.55 5.72 49 MPART_ALT_DIFF 15484 5.83 6.99 5.53 50 BAYES_60 15297 6.14 8.75 5.46 51 BAYES_99 15086 9.25 24.19 5.39 52 XMSexyCombo_05 14885 6.52 11.18 5.32 53 RELAYCOUNTRY_META 13621 7.98 20.02 4.87 54 BAYES_40 13407 4.42 2.99 4.79 55 FROM_EXCESS_BASE64 13319 4.28 2.44 4.76 56 MIME_QP_LONG_LINE 13279 4.54 3.74 4.74 57 XMStrtUSub 13278 4.68 4.46 4.74 58 TR_XM_DK_SendGrid 12923 4.23 2.73 4.62 59 BAYES_999 12689 7.42 18.57 4.53 60 XM_UncommonTLD01 12568 8.54 24.23 4.49 61 XMNumbers 12042 4.95 7.47 4.30 62 DKIM_INVALID 11455 4.64 6.76 4.09 63 XMSubMetaSx_00 11429 5.00 8.53 4.08 64 HTML_IMAGE_RATIO_06 11103 3.76 2.98 3.97 65 RCVD_IN_IADB_LISTED 11065 3.51 1.80 3.95 66 BAYES_20 10908 3.61 2.49 3.90 67 UNPARSEABLE_RELAY 10815 3.25 0.89 3.86 68 T_REMOTE_IMAGE 10618 4.38 6.66 3.79 69 T_TooManySym_02 9615 2.85 0.56 3.43 70 RCVD_IN_IADB_SPF 9565 3.02 1.51 3.42 71 MIME_HTML_MOSTLY 9522 4.00 6.31 3.40 72 XM_DIRTYINTL 8782 4.00 7.36 3.14 73 BAYES_80 8643 4.33 9.14 3.09 74 IN_ZIMBRA_NJ_WHITELIST 8523 2.42 0.01 3.04 75 RCVD_IN_IADB_SENDERID 8439 2.70 1.48 3.01 76 RCVD_IN_IADB_DK 8212 2.64 1.48 2.93 77 MIME_HTML_ONLY_MULTI 8179 2.87 2.68 2.92 78 TVD_RCVD_IP 8138 2.38 0.35 2.91 79 CK_HELO_DYNAMIC_SPLIT_IP 7402 2.20 0.50 2.64 80 HELO_DYNAMIC_IPADDR2 7399 2.13 0.17 2.64 81 RCVD_IN_IADB_VOUCHED 7366 2.21 0.58 2.63 82 XM_B_SpammyTLD 7233 3.26 5.86 2.58 83 INVALID_MSGID 7201 2.20 0.74 2.57 84 XM_CamelCaseFrm001 7093 2.74 3.52 2.53 85 TR_DCC_Bayes_99 6925 5.69 18.14 2.47 86 XMBdyGiftCard01 6799 2.11 0.86 2.43 87 BAYES_05 6752 2.24 1.58 2.41 88 TO_MALFORMED 6586 1.90 0.13 2.35 89 HTML_IMAGE_RATIO_08 6584 2.30 2.11 2.35 90 XM_PDF 6425 1.87 0.21 2.30 91 BOTNET 6254 5.00 15.69 2.23 92 RELAYCOUNTRY_CA 6014 2.66 4.63 2.15 93 URI_TRY_3LD 5671 1.95 1.63 2.03 94 NO_DNS_FOR_FROM 5451 2.17 3.01 1.95 95 TM2_M_VERY_LONG_WORD 5416 1.89 1.72 1.93 96 SUBJ_ALL_CAPS 5394 1.92 1.90 1.93 97 XMDiploma_00 5366 2.08 2.71 1.92 98 BAYES_95 5304 2.18 3.30 1.89 99 HTML_MIME_NO_HTML_TAG 5009 3.92 12.17 1.79 100 TM2_M_URI_OPT_OUT 4845 2.02 3.14 1.73 101 IN_HORDE_ADDRESS_BOOK 4726 1.35 0.03 1.69 102 TR_XM_RelayPhish 4594 1.74 2.11 1.64 103 UNTRUSTED_Relay 4585 3.66 11.49 1.64 104 RCVD_IN_IADB_OPTIN 4558 1.36 0.32 1.63 105 TR_LOTS_OF_MONEY3 4526 2.22 4.53 1.62 106 MAILING_LIST_MULTI 4408 1.48 1.12 1.57 107 USER_IN_DEF_DKIM_WL 4373 1.24 0.00 1.56 108 XM_ProductURIs 4299 1.48 1.25 1.54 109 ANY_BOUNCE_MESSAGE 4262 1.27 0.27 1.52 110 BOUNCE_MESSAGE 4262 1.27 0.27 1.52 111 T_XMDrugObfuBody_08 4229 1.70 2.43 1.51 112 XM_H_Trusted_IP 3976 1.13 0.00 1.42 113 URI_HEX 3849 1.78 3.34 1.38 114 XM_B_Unsub2 3839 1.41 1.56 1.37 115 XM_OfRef6 3618 1.70 3.29 1.29 116 T_XMHurry_00 3571 1.48 2.27 1.28 117 XMBody_17 3570 1.76 3.63 1.28 118 RCVD_IN_BL_SPAMCOP_NET 3535 2.46 7.11 1.26 119 TR_Symld_Words 3528 1.23 1.13 1.26 120 XMSubMetaI_00 3487 1.38 1.89 1.25 121 XM_SPF_SoftFail 3356 2.11 5.64 1.20 122 DIET_1 3348 1.23 1.37 1.20 123 DKIM_ADSP_NXDOMAIN 3328 2.64 8.28 1.19 124 XM_H_Long_From02 3200 1.08 0.84 1.14 125 XMGappySubj_01 3183 0.97 0.30 1.14 126 XM_DK_Undo_01 3164 1.03 0.66 1.13 127 TR_MetaPhish_Combo_01 3132 0.95 0.32 1.12 128 XMBody_95 2958 0.86 0.10 1.06 129 KHOP_HELO_FCRDNS 2936 4.03 15.58 1.05 130 TooManyTo_002 2875 1.07 1.24 1.03 131 XMHTML_After_End 2869 1.95 5.52 1.02 132 XM_GoogleGroups 2827 0.87 0.31 1.01 133 HTML_FONT_FACE_BAD 2781 0.99 0.96 0.99 134 XMGenDplmaNmb 2750 1.15 1.82 0.98 135 T_FILL_THIS_FORM_SHORT 2684 0.88 0.59 0.96 136 XMPhish11 2678 0.94 0.90 0.96 137 XM_RXBody 2559 0.85 0.60 0.91 138 XMStockSpam_06 2471 0.97 1.29 0.88 139 PLING_QUERY 2418 0.76 0.36 0.86 140 XMBrknScrpt_02 2381 0.85 0.84 0.85 141 XM_B_REG_HTML 2325 0.70 0.18 0.83 142 DKIM_ADSP_CUSTOM_MED 2292 0.90 1.19 0.82 143 XM_UB50 2253 2.00 6.63 0.80 144 XMHTMLBadTable_001 2180 0.73 0.52 0.78 145 USER_IN_WHITELIST 2167 0.62 0.00 0.77 146 XMSubNoVowel 2064 0.67 0.40 0.74 147 SUBJ_DOLLARS 2060 0.71 0.63 0.74 148 AC_FROM_MANY_DOTS 2012 0.57 0.00 0.72 149 XMSexyCombo_01 1957 1.08 2.53 0.70 150 TooManyTo_003 1952 0.77 1.04 0.70 151 XMPhish30 1925 0.70 0.72 0.69 152 RCVD_IN_MSPIKE_BL 1803 1.73 5.91 0.64 153 THIS_AD 1798 0.62 0.51 0.64 154 XMBody_78 1777 0.59 0.42 0.63 155 XMPhish14 1767 0.60 0.50 0.63 156 XM_D_tchamptons_WL 1757 0.50 0.00 0.63 157 T_TooManySym_03 1754 0.53 0.14 0.63 158 XMSubMetaSxObfu_02 1678 0.54 0.31 0.60 159 NML_ADSP_CUSTOM_MED 1672 0.69 1.07 0.60 160 XM_B_COPY_HTML 1639 0.62 0.74 0.59 161 TR_XM_PHPDW 1627 0.83 1.80 0.58 162 HTML_TAG_BALANCE_BODY 1610 0.91 2.22 0.58 163 FILL_THIS_FORM 1601 0.55 0.48 0.57 164 XMSolicitRefs_0 1592 0.53 0.37 0.57 165 TR_XM_PHPForged 1567 0.80 1.71 0.56 166 RDNS_DYNAMIC 1559 3.26 13.72 0.56 167 XM_UCStrings02 1557 0.45 0.04 0.56 168 TR_XM_FormFill2 1547 0.78 1.68 0.55 169 XM_H_PHPOS 1531 0.78 1.67 0.55 170 TooManyTo_004 1515 0.60 0.83 0.54 171 HELO_NODOT 1509 0.50 0.33 0.54 172 HELO_NO_DOMAIN 1507 0.50 0.33 0.54 173 FORGED_GMAIL_RCVD 1466 0.64 1.09 0.52 174 XMBSHREFv2 1413 0.45 0.24 0.50 175 XM_H_PHPMailer 1410 0.61 1.01 0.50 176 HTML_IMAGE_ONLY_20 1395 0.43 0.17 0.50 177 XMSubMetaSxObfu_03 1367 0.58 0.93 0.49 178 SpammyFromTLD_01 1343 0.72 1.64 0.48 179 FILL_THIS_FORM_LONG 1337 0.46 0.40 0.48 180 TooManyTo_005 1313 0.52 0.69 0.47 181 FILL_THIS_FORM_LOAN 1280 0.41 0.21 0.46 182 T_XMDrugObfuBody_00 1267 0.58 1.06 0.45 183 XM_Body_Obfu01 1247 0.41 0.30 0.45 184 XMSlimDrugH 1243 0.54 0.94 0.44 185 RELAYCOUNTRY_GB 1229 0.72 1.81 0.44 186 T_TooManySym_04 1211 0.35 0.04 0.43 187 XMNoVowels 1182 0.42 0.40 0.42 188 MPART_ALT_DIFF_COUNT 1146 0.50 0.87 0.41 189 HTTPS_HTTP_MISMATCH 1117 0.41 0.44 0.40 190 T_Symld_Words_02 1102 0.45 0.69 0.39 191 LOW_PRICE 1098 0.57 1.26 0.39 192 RELAYCOUNTRY_DE 1092 0.82 2.50 0.39 193 XM_URI_RBL 1088 1.08 3.76 0.39 194 XM_Walgreens_Forge 1087 0.43 0.59 0.39 195 TM2_M_A_HREF_HREF 1083 0.41 0.50 0.39 196 XMLngstWrd_00 1078 0.38 0.36 0.39 197 FSL_HELO_FAKE 1064 0.36 0.28 0.38 198 HK_RANDOM_REPLYTO 1043 0.49 0.95 0.37 199 URIBL_CSS_A 1018 0.46 0.81 0.36 200 URIBL_CSS 1018 0.46 0.81 0.36 ----------------------------------------------------------------------