Email: 598396 Autolearn: 0 AvgScore: 2.36 AvgScanTime: 2.12 sec Spam: 124103 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 2.44 sec Ham: 474293 Autolearn: 0 AvgScore: -0.80 AvgScanTime: 2.04 sec Time Spent Running SA: 352.77 hours Time Spent Processing Spam: 84.27 hours Time Spent Processing Ham: 268.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 118996 90.66 95.88 89.29 2 DCC_CHECK 100690 51.61 81.13 43.89 3 XM_B_Unicode 86207 69.92 69.46 70.04 4 DKIM_SIGNED 81481 75.55 65.66 78.14 5 XM_DK_Pass 77393 73.90 62.36 76.92 6 DKIM_VALID 71100 70.00 57.29 73.33 7 XMListUnsubscribeExists 66478 54.59 53.57 54.86 8 MIME_HTML_ONLY 56945 26.06 45.89 20.87 9 DKIM_VALID_AU 51132 53.30 41.20 56.47 10 XM_B_Unicode3 50729 41.62 40.88 41.82 11 BAYES_50 48653 51.59 39.20 54.83 12 XM_UncommonTLD01 40187 9.65 32.38 3.70 13 XM_DK_Undo_02 38791 11.76 31.26 6.66 14 FSL_BULK_SIG 36693 11.61 29.57 6.91 15 HTML_FONT_LOW_CONTRAST 36412 29.51 29.34 29.55 16 LOC_TINY_FONT_1 35563 26.44 28.66 25.86 17 BAYES_99 29694 7.78 23.93 3.56 18 XM_B_Unsub 28659 13.11 23.09 10.50 19 KHOP_HELO_FCRDNS 28061 6.15 22.61 1.84 20 FVGT_m_MULTI_ODD 26795 21.75 21.59 21.79 21 RDNS_DYNAMIC 26617 4.74 21.45 0.37 22 XM_Body_Dirty_Words 24590 14.74 19.81 13.42 23 SpammyFromTLD_02 24547 4.24 19.78 0.18 24 XMSubLong 23716 20.19 19.11 20.47 25 DKIM_VALID_EF 23593 25.79 19.01 27.57 26 HTML_MIME_NO_HTML_TAG 23493 5.84 18.93 2.41 27 FROM_SUSPICIOUS_NTLD 23429 3.99 18.88 0.09 28 FROM_SUSPICIOUS_NTLD_FP 23338 3.97 18.81 0.08 29 TR_DCC_Bayes_99 23239 5.24 18.73 1.72 30 BAYES_999 22697 6.08 18.29 2.89 31 T_KAM_HTML_FONT_INVALID 20475 17.93 16.50 18.31 32 DCC_CHECK_NEGATIVE 20067 46.36 16.17 54.27 33 RELAYCOUNTRY_META 19927 7.38 16.06 5.11 34 XMSexyCombo_05 19634 6.90 15.82 4.57 35 BOTNET 18664 4.70 15.04 2.00 36 DKIM_ADSP_NXDOMAIN 18184 3.99 14.65 1.20 37 T_TM2_M_HEADER_IN_MSG 18014 24.78 14.52 27.46 38 MultiRelay 17875 16.56 14.40 17.13 39 XM_Multi_Part_URI 17816 12.31 14.36 11.78 40 BOTNET_IPINHOSTNAME 17193 6.68 13.85 4.81 41 LOTS_OF_MONEY 16377 10.29 13.20 9.53 42 T_REMOTE_IMAGE 16241 5.86 13.09 3.97 43 XM_H_Long_From01 16123 7.22 12.99 5.71 44 HTML_IMAGE_RATIO_02 15897 9.40 12.81 8.51 45 BAYES_80 14968 4.61 12.06 2.66 46 XMSubMetaSx_00 13883 5.59 11.19 4.13 47 BODY_URI_ONLY 13851 2.37 11.16 0.08 48 BAYES_60 13745 6.50 11.08 5.30 49 XM_SPF_SoftFail 13610 3.61 10.97 1.68 50 HTML_IMAGE_ONLY_08 12821 2.24 10.33 0.12 51 T_HTML_TAG_BALANCE_CENTER 12814 2.26 10.33 0.16 52 HTML_SHORT_LINK_IMG_1 12732 2.15 10.26 0.03 53 XM_Evil_Numbers_Gen 12481 9.85 10.06 9.79 54 UNTRUSTED_Relay 12207 3.41 9.84 1.72 55 TO_NO_BRKTS_DYNIP 11826 1.98 9.53 0.00 56 SHORT_IMG_SUSP_NTLD 11754 1.96 9.47 0.00 57 TR_Mismatch_TLD_02 11617 2.00 9.36 0.07 58 RCVD_IN_MSPIKE_H2 11420 13.19 9.20 14.24 59 DKIM_INVALID 10381 5.55 8.36 4.81 60 TO_MALFORMED 9893 2.76 7.97 1.39 61 SHORTENER_SHORT_IMG 9584 1.61 7.72 0.01 62 LotsOfNums_01 9295 8.49 7.49 8.75 63 HTML_IMAGE_RATIO_04 9176 6.38 7.39 6.11 64 T_XMDrugObfuBody_14 8809 7.60 7.10 7.73 65 TooManyTo_001 8681 7.70 6.99 7.89 66 XMNumbers 8265 4.28 6.66 3.66 67 MPART_ALT_DIFF 7967 4.50 6.42 4.00 68 XMHTML_After_End 7952 2.44 6.41 1.40 69 XMStrtUSub 7228 5.38 5.82 5.26 70 MISSING_HEADERS 7126 1.49 5.74 0.38 71 MIME_HEADER_CTYPE_ONLY 6913 1.22 5.57 0.08 72 XM_DIRTYINTL 6852 3.22 5.52 2.62 73 XM_BadFromFormat 6834 1.23 5.51 0.11 74 HDRS_MISSP 6814 1.16 5.49 0.03 75 XM_B_SpammyTLD 6611 2.52 5.33 1.79 76 XM_B_Phish_Phrases 6268 6.03 5.05 6.29 77 XM_UB50 6075 1.70 4.90 0.86 78 FROM_MISSP_REPLYTO 5971 1.00 4.81 0.01 79 FROM_MISSP_DYNIP 5896 0.99 4.75 0.00 80 MIME_HTML_MOSTLY 5772 3.04 4.65 2.61 81 BAYES_95 5516 2.14 4.44 1.53 82 XM_SendGrid 5443 5.96 4.39 6.38 83 RCVD_IN_BL_SPAMCOP_NET 5385 1.80 4.34 1.14 84 RELAYCOUNTRY_CA 5245 2.19 4.23 1.66 85 DATE_IN_PAST_03_06 5012 0.92 4.04 0.11 86 MIME_QP_LONG_LINE 4755 5.58 3.83 6.03 87 HK_RANDOM_FROM 4736 0.89 3.82 0.12 88 TR_LOTS_OF_MONEY3 4598 2.20 3.70 1.81 89 TM2_M_URI_OPT_OUT 4335 2.20 3.49 1.86 90 XM_URI_RBL 4195 0.99 3.38 0.36 91 T_XMHurry_00 4070 1.97 3.28 1.63 92 TR_XM_INV_DKIM 4012 0.77 3.23 0.12 93 BAYES_40 3776 5.21 3.04 5.78 94 RCVD_IN_RP_RNBL 3725 0.66 3.00 0.04 95 XM_OfRef6 3707 1.58 2.99 1.21 96 MIME_HTML_ONLY_MULTI 3623 2.48 2.92 2.37 97 XMSubMetaSSx_00 3574 0.73 2.88 0.16 98 T_TooManySym_01 3488 4.86 2.81 5.40 99 RCVD_IN_MSPIKE_WL 3482 8.75 2.81 10.31 100 RCVD_IN_MSPIKE_H3 3477 8.74 2.80 10.30 101 XM_CamelCaseFrm001 3466 2.32 2.79 2.19 102 HTML_IMAGE_RATIO_06 3446 3.64 2.78 3.86 103 HTML_IMAGE_RATIO_08 3246 2.68 2.62 2.69 104 URI_HEX 3223 1.45 2.60 1.15 105 NO_DNS_FOR_FROM 3175 2.02 2.56 1.88 106 XMDiploma_00 3085 1.82 2.49 1.64 107 FROM_EXCESS_BASE64 3037 3.50 2.45 3.77 108 XM_B_Unsub2 3007 2.76 2.42 2.85 109 XMSexyCombo_01 2992 1.13 2.41 0.80 110 BAYES_20 2934 3.96 2.36 4.37 111 RCVD_IN_MSPIKE_BL 2912 1.26 2.35 0.97 112 XMBody_17 2880 1.38 2.32 1.14 113 TR_XM_DK_SendGrid 2852 3.29 2.30 3.56 114 BAYES_00 2802 15.48 2.26 18.94 115 XM_H_TOP 2762 0.46 2.23 0.00 116 T_XMDrugObfuBody_08 2694 1.55 2.17 1.38 117 RCVD_IN_PSBL 2644 0.48 2.13 0.05 118 HTML_SHORT_LINK_IMG_2 2448 0.43 1.97 0.03 119 RELAYCOUNTRY_GB 2389 1.09 1.93 0.87 120 BOTNET_NORDNS 2347 0.43 1.89 0.04 121 LongTLD 2316 0.54 1.87 0.20 122 DIET_1 2260 1.06 1.82 0.86 123 UNPARSEABLE_RELAY 2238 2.35 1.80 2.49 124 FVGT_m_MULTI_ODD_EMAIL 2212 0.39 1.78 0.03 125 SUBJ_ALL_CAPS 2186 1.72 1.76 1.71 126 XMGenDplmaNmb 2177 1.09 1.75 0.91 127 TR_XM_PHPDW 2150 0.95 1.73 0.75 128 TM2_M_VERY_LONG_WORD 2144 1.31 1.73 1.20 129 RCVD_IN_IADB_LISTED 2134 4.71 1.72 5.49 130 DKIM_ADSP_CUSTOM_MED 2134 1.24 1.72 1.12 131 XMSubMetaI_00 2114 1.08 1.70 0.92 132 URI_TRY_3LD 2100 1.69 1.69 1.69 133 RCVD_IN_RP_SAFE 2093 8.73 1.69 10.58 134 TR_XM_PHPForged 2077 0.91 1.67 0.71 135 MultiRelay_CC 2052 0.47 1.65 0.16 136 MultiRelay_Combo 2052 0.47 1.65 0.16 137 TR_XM_FormFill2 2044 0.91 1.65 0.71 138 XM_H_PHPOS 2038 0.90 1.64 0.71 139 HTML_FONT_SIZE_HUGE 2012 0.41 1.62 0.09 140 RCVD_IN_IADB_SPF 2001 4.11 1.61 4.76 141 RCVD_IN_IADB_DK 1975 3.60 1.59 4.13 142 RCVD_IN_IADB_SENDERID 1960 3.64 1.58 4.18 143 RELAYCOUNTRY_FR 1954 0.52 1.57 0.24 144 XM_Palau_URI 1953 0.33 1.57 0.00 145 TR_M_TOP_BAYES 1924 0.32 1.55 0.00 146 TR_XM_DK_Bayes 1893 11.84 1.53 14.53 147 NML_ADSP_CUSTOM_MED 1871 0.98 1.51 0.84 148 FROM_LOCAL_NOVOWEL 1870 0.33 1.51 0.02 149 XMSexyCombo_04 1862 0.70 1.50 0.49 150 T_MONEY_PERCENT 1861 0.62 1.50 0.38 151 TR_LOTS_OF_MONEY2 1861 0.62 1.50 0.38 152 SpammyFromTLD_01 1853 0.81 1.49 0.64 153 FORGED_GMAIL_RCVD 1777 0.82 1.43 0.66 154 XM_H_Long_From02 1762 1.04 1.42 0.94 155 XM_SPF_Unknown 1746 0.82 1.41 0.67 156 HTML_IMAGE_ONLY_16 1718 0.47 1.38 0.23 157 XMStockSpam_06 1699 1.27 1.37 1.25 158 TR_XM_DK_Bayes1 1692 11.31 1.36 13.91 159 BAYES_05 1682 2.43 1.36 2.71 160 XM_XX_Yahoo 1675 0.40 1.35 0.15 161 HTML_EXTRA_CLOSE 1666 0.29 1.34 0.01 162 TR_Symld_Words 1644 1.26 1.32 1.24 163 TR_XM_RelayPhish 1616 0.92 1.30 0.82 164 RELAYCOUNTRY_IN 1597 0.35 1.29 0.11 165 RCVD_IN_RP_CERTIFIED 1587 7.69 1.28 9.36 166 ALL_TRUSTED 1552 10.88 1.25 13.40 167 FILL_THIS_FORM 1539 0.58 1.24 0.41 168 NORDNS_LOW_CONTRAST 1527 0.26 1.23 0.00 169 XMPhish11 1501 1.00 1.21 0.95 170 XM_UB99 1482 0.25 1.19 0.00 171 XMSubMetaSxObfu_03 1480 1.06 1.19 1.02 172 XMPhish14 1389 0.61 1.12 0.48 173 XM_OfRef7 1386 0.38 1.12 0.19 174 REPLYTO_WITHOUT_TO_CC 1374 0.25 1.11 0.03 175 MPART_ALT_DIFF_COUNT 1363 0.51 1.10 0.36 176 HTML_IMAGE_ONLY_12 1362 0.38 1.10 0.19 177 XMMoneyMeta_00 1345 0.55 1.08 0.42 178 SUBJECT_NEEDS_ENCODING 1337 0.23 1.08 0.00 179 SUBJ_ILLEGAL_CHARS 1334 0.23 1.07 0.00 180 T_XMDrugObfuBody_00 1279 1.19 1.03 1.24 181 XM_Combo_Sbj 1258 0.50 1.01 0.36 182 RCVD_IN_MSPIKE_L4 1218 0.56 0.98 0.46 183 MAILING_LIST_MULTI 1176 1.70 0.95 1.90 184 HTML_FONT_FACE_BAD 1166 0.83 0.94 0.81 185 PLING_QUERY 1147 0.63 0.92 0.56 186 XMBrknScrpt_02 1142 0.73 0.92 0.69 187 DATE_IN_PAST_24_48 1140 0.19 0.92 0.00 188 XMBdyGiftCard01 1116 1.31 0.90 1.42 189 RCVD_IN_MSPIKE_L5 1074 0.42 0.87 0.30 190 FILL_THIS_FORM_LONG 1069 0.41 0.86 0.29 191 HK_SCAM 1060 0.19 0.85 0.02 192 DATE_IN_PAST_06_12 1057 0.22 0.85 0.06 193 XM_UB60 1053 0.22 0.85 0.05 194 BODY_SINGLE_WORD 1050 0.18 0.85 0.01 195 BODY_SINGLE_URI 1046 0.18 0.84 0.00 196 TVD_RCVD_SPACE_BRACKET 1034 0.18 0.83 0.00 197 TR_MetaPhish_Combo_01 1024 0.92 0.83 0.94 198 XM_H_PHPMailer 1020 0.55 0.82 0.48 199 XMPhish30 1019 0.61 0.82 0.55 200 HTML_IMAGE_ONLY_28 1017 0.42 0.82 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 423498 90.66 95.88 89.29 2 DKIM_SIGNED 370595 75.55 65.66 78.14 3 XM_DK_Pass 364842 73.90 62.36 76.92 4 DKIM_VALID 347790 70.00 57.29 73.33 5 XM_B_Unicode 332201 69.92 69.46 70.04 6 DKIM_VALID_AU 267842 53.30 41.20 56.47 7 XMListUnsubscribeExists 260196 54.59 53.57 54.86 8 BAYES_50 260069 51.59 39.20 54.83 9 DCC_CHECK_NEGATIVE 257379 46.36 16.17 54.27 10 DCC_CHECK 208153 51.61 81.13 43.89 11 XM_B_Unicode3 198332 41.62 40.88 41.82 12 HTML_FONT_LOW_CONTRAST 140157 29.51 29.34 29.55 13 DKIM_VALID_EF 130745 25.79 19.01 27.57 14 T_TM2_M_HEADER_IN_MSG 130261 24.78 14.52 27.46 15 LOC_TINY_FONT_1 122629 26.44 28.66 25.86 16 FVGT_m_MULTI_ODD 103335 21.75 21.59 21.79 17 MIME_HTML_ONLY 98978 26.06 45.89 20.87 18 XMSubLong 97089 20.19 19.11 20.47 19 BAYES_00 89816 15.48 2.26 18.94 20 T_KAM_HTML_FONT_INVALID 86826 17.93 16.50 18.31 21 MultiRelay 81244 16.56 14.40 17.13 22 TR_XM_DK_Bayes 68931 11.84 1.53 14.53 23 RCVD_IN_MSPIKE_H2 67530 13.19 9.20 14.24 24 TR_XM_DK_Bayes1 65979 11.31 1.36 13.91 25 XM_Body_Dirty_Words 63642 14.74 19.81 13.42 26 ALL_TRUSTED 63533 10.88 1.25 13.40 27 TR_XM_DK_Bayes2 59732 10.13 0.72 12.59 28 XM_Multi_Part_URI 55857 12.31 14.36 11.78 29 RCVD_IN_RP_SAFE 50163 8.73 1.69 10.58 30 XM_B_Unsub 49801 13.11 23.09 10.50 31 RCVD_IN_MSPIKE_WL 48888 8.75 2.81 10.31 32 RCVD_IN_MSPIKE_H3 48836 8.74 2.80 10.30 33 XM_Evil_Numbers_Gen 46449 9.85 10.06 9.79 34 LOTS_OF_MONEY 45202 10.29 13.20 9.53 35 RCVD_IN_RP_CERTIFIED 44404 7.69 1.28 9.36 36 LotsOfNums_01 41484 8.49 7.49 8.75 37 HTML_IMAGE_RATIO_02 40344 9.40 12.81 8.51 38 TooManyTo_001 37425 7.70 6.99 7.89 39 XM_DKIMWhitelistDomains 37260 6.24 0.05 7.86 40 T_XMDrugObfuBody_14 36661 7.60 7.10 7.73 41 FSL_BULK_SIG 32764 11.61 29.57 6.91 42 XM_DK_Undo_02 31572 11.76 31.26 6.66 43 XM_SendGrid 30246 5.96 4.39 6.38 44 XM_B_Phish_Phrases 29836 6.03 5.05 6.29 45 HTML_IMAGE_RATIO_04 28991 6.38 7.39 6.11 46 MIME_QP_LONG_LINE 28621 5.58 3.83 6.03 47 BAYES_40 27417 5.21 3.04 5.78 48 XM_H_Long_From01 27094 7.22 12.99 5.71 49 RCVD_IN_IADB_LISTED 26021 4.71 1.72 5.49 50 T_TooManySym_01 25606 4.86 2.81 5.40 51 BAYES_60 25135 6.50 11.08 5.30 52 XMStrtUSub 24969 5.38 5.82 5.26 53 RELAYCOUNTRY_META 24220 7.38 16.06 5.11 54 DKIM_INVALID 22805 5.55 8.36 4.81 55 BOTNET_IPINHOSTNAME 22791 6.68 13.85 4.81 56 RCVD_IN_IADB_SPF 22598 4.11 1.61 4.76 57 XM_PDF 22371 3.85 0.55 4.72 58 XMSexyCombo_05 21671 6.90 15.82 4.57 59 BAYES_20 20744 3.96 2.36 4.37 60 RCVD_IN_IADB_SENDERID 19815 3.64 1.58 4.18 61 XMSubMetaSx_00 19590 5.59 11.19 4.13 62 RCVD_IN_IADB_DK 19589 3.60 1.59 4.13 63 MPART_ALT_DIFF 18955 4.50 6.42 4.00 64 T_REMOTE_IMAGE 18843 5.86 13.09 3.97 65 HTML_IMAGE_RATIO_06 18308 3.64 2.78 3.86 66 FROM_EXCESS_BASE64 17889 3.50 2.45 3.77 67 XM_UncommonTLD01 17568 9.65 32.38 3.70 68 XMNumbers 17340 4.28 6.66 3.66 69 BAYES_99 16865 7.78 23.93 3.56 70 TR_XM_DK_SendGrid 16863 3.29 2.30 3.56 71 RCVD_IN_IADB_VOUCHED 16337 2.83 0.50 3.44 72 IN_ZIMBRA_NJ_WHITELIST 15660 2.62 0.02 3.30 73 BAYES_999 13707 6.08 18.29 2.89 74 XM_B_Unsub2 13510 2.76 2.42 2.85 75 BAYES_05 12836 2.43 1.36 2.71 76 HTML_IMAGE_RATIO_08 12767 2.68 2.62 2.69 77 BAYES_80 12632 4.61 12.06 2.66 78 T_TooManySym_02 12585 2.24 0.64 2.65 79 XM_DIRTYINTL 12412 3.22 5.52 2.62 80 MIME_HTML_MOSTLY 12399 3.04 4.65 2.61 81 UNPARSEABLE_RELAY 11814 2.35 1.80 2.49 82 HTML_MIME_NO_HTML_TAG 11448 5.84 18.93 2.41 83 MIME_HTML_ONLY_MULTI 11240 2.48 2.92 2.37 84 XM_H_Trusted_IP 10487 1.75 0.00 2.21 85 XM_CamelCaseFrm001 10405 2.32 2.79 2.19 86 RCVD_IN_IADB_OPTIN 10147 1.78 0.39 2.14 87 TVD_RCVD_IP 9965 1.74 0.37 2.10 88 BOTNET 9481 4.70 15.04 2.00 89 BOUNCE_MESSAGE 9373 1.66 0.47 1.98 90 ANY_BOUNCE_MESSAGE 9373 1.66 0.47 1.98 91 TooManyTo_002 9092 1.67 0.72 1.92 92 MAILING_LIST_MULTI 9007 1.70 0.95 1.90 93 NO_DNS_FOR_FROM 8910 2.02 2.56 1.88 94 TM2_M_URI_OPT_OUT 8817 2.20 3.49 1.86 95 KHOP_HELO_FCRDNS 8723 6.15 22.61 1.84 96 TR_LOTS_OF_MONEY3 8574 2.20 3.70 1.81 97 XM_B_SpammyTLD 8467 2.52 5.33 1.79 98 UNTRUSTED_Relay 8176 3.41 9.84 1.72 99 TR_DCC_Bayes_99 8139 5.24 18.73 1.72 100 SUBJ_ALL_CAPS 8126 1.72 1.76 1.71 101 URI_TRY_3LD 8019 1.69 1.69 1.69 102 XM_SPF_SoftFail 7981 3.61 10.97 1.68 103 RELAYCOUNTRY_CA 7851 2.19 4.23 1.66 104 XMDiploma_00 7778 1.82 2.49 1.64 105 T_XMHurry_00 7745 1.97 3.28 1.63 106 CK_HELO_DYNAMIC_SPLIT_IP 7667 1.34 0.27 1.62 107 HELO_DYNAMIC_IPADDR2 7665 1.31 0.14 1.62 108 INVALID_MSGID 7394 1.29 0.28 1.56 109 BAYES_95 7266 2.14 4.44 1.53 110 IN_HORDE_ADDRESS_BOOK 7115 1.20 0.04 1.50 111 XM_DK_Undo_01 7041 1.31 0.67 1.48 112 XMBdyGiftCard01 6739 1.31 0.90 1.42 113 XMHTML_After_End 6663 2.44 6.41 1.40 114 TO_MALFORMED 6602 2.76 7.97 1.39 115 T_XMDrugObfuBody_08 6555 1.55 2.17 1.38 116 HELO_NODOT 6418 1.17 0.47 1.35 117 HELO_NO_DOMAIN 6416 1.17 0.47 1.35 118 TooManyTo_003 6115 1.14 0.58 1.29 119 XMStockSpam_06 5912 1.27 1.37 1.25 120 TR_Symld_Words 5887 1.26 1.32 1.24 121 T_XMDrugObfuBody_00 5869 1.19 1.03 1.24 122 XM_OfRef6 5726 1.58 2.99 1.21 123 TM2_M_VERY_LONG_WORD 5715 1.31 1.73 1.20 124 DKIM_ADSP_NXDOMAIN 5708 3.99 14.65 1.20 125 USER_IN_DEF_DKIM_WL 5682 0.95 0.01 1.20 126 URI_HEX 5431 1.45 2.60 1.15 127 RCVD_IN_BL_SPAMCOP_NET 5387 1.80 4.34 1.14 128 XMBody_17 5385 1.38 2.32 1.14 129 XMGappySubj_01 5319 0.95 0.28 1.12 130 DKIM_ADSP_CUSTOM_MED 5292 1.24 1.72 1.12 131 XMSubNoVowel 5241 0.97 0.46 1.11 132 T_FILL_THIS_FORM_SHORT 5080 0.94 0.44 1.07 133 XMCapTrack 4961 0.89 0.31 1.05 134 XMSubMetaSxObfu_03 4856 1.06 1.19 1.02 135 XM_RXBody 4743 0.88 0.42 1.00 136 RCVD_IN_MSPIKE_BL 4616 1.26 2.35 0.97 137 XM_GoogleGroups 4606 0.84 0.32 0.97 138 TooManyTo_004 4515 0.85 0.45 0.95 139 XMPhish11 4487 1.00 1.21 0.95 140 TR_MetaPhish_Combo_01 4468 0.92 0.83 0.94 141 XM_H_Long_From02 4467 1.04 1.42 0.94 142 XMSubMetaI_00 4356 1.08 1.70 0.92 143 XMGenDplmaNmb 4330 1.09 1.75 0.91 144 RELAYCOUNTRY_GB 4104 1.09 1.93 0.87 145 XM_UB50 4097 1.70 4.90 0.86 146 DIET_1 4071 1.06 1.82 0.86 147 NML_ADSP_CUSTOM_MED 3983 0.98 1.51 0.84 148 TR_XM_RelayPhish 3880 0.92 1.30 0.82 149 HTML_FONT_FACE_BAD 3820 0.83 0.94 0.81 150 XMBody_95 3812 0.66 0.12 0.80 151 XMSexyCombo_01 3793 1.13 2.41 0.80 152 TooManyTo_005 3688 0.70 0.39 0.78 153 TR_XM_PHPDW 3554 0.95 1.73 0.75 154 AC_FROM_MANY_DOTS 3537 0.59 0.01 0.75 155 XM_ProductURIs 3517 0.74 0.75 0.74 156 TR_XM_PHPForged 3386 0.91 1.67 0.71 157 TR_XM_FormFill2 3384 0.91 1.65 0.71 158 XM_H_PHPOS 3358 0.90 1.64 0.71 159 XMBrknScrpt_02 3254 0.73 0.92 0.69 160 HTTPS_HTTP_MISMATCH 3167 0.65 0.58 0.67 161 XM_SPF_Unknown 3161 0.82 1.41 0.67 162 FORGED_GMAIL_RCVD 3107 0.82 1.43 0.66 163 SpammyFromTLD_01 3016 0.81 1.49 0.64 164 XM_E_Blogspot 2980 0.51 0.07 0.63 165 XM_B_REG_HTML 2936 0.55 0.30 0.62 166 XMNoVowels 2931 0.63 0.66 0.62 167 RELAYCOUNTRY_DE 2892 0.64 0.73 0.61 168 LOW_PRICE 2892 0.55 0.34 0.61 169 T_OBFU_PDF_ATTACH 2800 0.50 0.15 0.59 170 PLING_QUERY 2652 0.63 0.92 0.56 171 SUBJ_DOLLARS 2625 0.49 0.25 0.55 172 XMPhish30 2606 0.61 0.82 0.55 173 XMBody_78 2585 0.53 0.47 0.55 174 XM_ShortIntro_01 2543 0.47 0.19 0.54 175 XM_B_COPY_HTML 2505 0.51 0.45 0.53 176 USER_IN_WHITELIST 2455 0.41 0.00 0.52 177 HTML_TAG_BALANCE_BODY 2434 0.50 0.44 0.51 178 XM_Body_Obfu01 2328 0.46 0.33 0.49 179 XMSexyCombo_04 2313 0.70 1.50 0.49 180 XM_H_PHPMailer 2299 0.55 0.82 0.48 181 XMHTMLBadTable_001 2280 0.54 0.75 0.48 182 XMPhish14 2276 0.61 1.12 0.48 183 T_TooManySym_03 2205 0.41 0.21 0.46 184 RCVD_IN_MSPIKE_L4 2162 0.56 0.98 0.46 185 TM2_M_BODY_EMPTY 2161 0.39 0.12 0.46 186 XMLngstWrd_00 2158 0.43 0.35 0.45 187 XMBSHREFv2 2124 0.42 0.32 0.45 188 XMSolicitRefs_0 2040 0.39 0.24 0.43 189 XMLngstWrd_01 2019 0.41 0.33 0.43 190 URI_NOVOWEL 2007 0.45 0.56 0.42 191 T_Symld_Words_02 1983 0.49 0.78 0.42 192 XMMoneyMeta_00 1970 0.55 1.08 0.42 193 HTML_IMAGE_ONLY_20 1947 0.48 0.75 0.41 194 FILL_THIS_FORM 1937 0.58 1.24 0.41 195 RELAYCOUNTRY_AU 1877 0.39 0.36 0.40 196 T_MANY_PILL_PRICE 1867 0.32 0.04 0.39 197 AC_DIV_BONANZA 1848 0.34 0.13 0.39 198 TR_LOTS_OF_MONEY2 1821 0.62 1.50 0.38 199 T_MONEY_PERCENT 1821 0.62 1.50 0.38 200 MISSING_HEADERS 1815 1.49 5.74 0.38 ----------------------------------------------------------------------