Email: 610302 Autolearn: 0 AvgScore: 2.94 AvgScanTime: 1.96 sec Spam: 144508 Autolearn: 0 AvgScore: 16.80 AvgScanTime: 2.34 sec Ham: 465794 Autolearn: 0 AvgScore: -1.36 AvgScanTime: 1.85 sec Time Spent Running SA: 333.04 hours Time Spent Processing Spam: 93.84 hours Time Spent Processing Ham: 239.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135629 89.34 93.86 87.94 2 DCC_CHECK 119384 50.85 82.61 41.00 3 XM_B_Unicode 83309 66.11 57.65 68.73 4 MIME_HTML_ONLY 82322 29.98 56.97 21.61 5 DKIM_SIGNED 71457 68.70 49.45 74.67 6 XM_DK_Pass 69232 67.44 47.91 73.50 7 BAYES_50 64873 50.56 44.89 52.32 8 DKIM_VALID 64752 64.01 44.81 69.97 9 BOTNET 61350 11.55 42.45 1.96 10 FSL_BULK_SIG 58417 14.67 40.42 6.68 11 XMListUnsubscribeExists 56832 48.34 39.33 51.13 12 XM_B_Unicode3 53595 40.03 37.09 40.95 13 RELAYCOUNTRY_META 48196 12.00 33.35 5.38 14 DKIM_VALID_AU 47896 48.67 33.14 53.49 15 UNTRUSTED_Relay 47255 8.93 32.70 1.56 16 T_REMOTE_IMAGE 38664 9.74 26.76 4.45 17 HTML_MIME_NO_HTML_TAG 38556 8.24 26.68 2.52 18 DKIM_ADSP_NXDOMAIN 36509 6.89 25.26 1.19 19 XM_UncommonTLD01 36399 9.02 25.19 4.01 20 HTML_SHORT_LINK_IMG_1 35812 5.89 24.78 0.02 21 HTML_FONT_LOW_CONTRAST 32937 26.88 22.79 28.15 22 XM_DK_Undo_02 32870 11.06 22.75 7.43 23 XMSubLong 30323 20.71 20.98 20.62 24 XM_B_Unsub 29653 11.82 20.52 9.12 25 BODY_URI_ONLY 29078 4.81 20.12 0.06 26 HDRS_LCASE_IMGONLY 28966 4.79 20.04 0.05 27 LOC_TINY_FONT_1 28959 22.99 20.04 23.90 28 T_HTML_TAG_BALANCE_CENTER 28436 4.89 19.68 0.30 29 BAYES_99 27882 7.95 19.29 4.44 30 XM_UB50 26698 5.02 18.48 0.85 31 XM_BadFromFormat 26244 4.39 18.16 0.12 32 XM_Body_Dirty_Words 25594 14.18 17.71 13.09 33 FROM_SUSPICIOUS_NTLD 25171 4.17 17.42 0.06 34 BOTNET_IPINHOSTNAME 25126 7.58 17.39 4.53 35 FROM_SUSPICIOUS_NTLD_FP 25031 4.14 17.32 0.05 36 MultiRelay 24943 17.92 17.26 18.13 37 HTML_IMAGE_ONLY_12 24847 4.21 17.19 0.18 38 DKIM_VALID_EF 23984 23.87 16.60 26.13 39 NO_DNS_FOR_FROM 23697 5.40 16.40 1.98 40 DCC_CHECK_NEGATIVE 23409 47.45 16.20 57.14 41 FVGT_m_MULTI_ODD 23328 19.39 16.14 20.40 42 TR_DCC_Bayes_99 21886 5.31 15.15 2.26 43 T_TM2_M_HEADER_IN_MSG 21726 26.37 15.03 29.89 44 XMSexyCombo_05 21502 7.02 14.88 4.58 45 SpammyFromTLD_02 20818 3.55 14.41 0.18 46 RCVD_IN_RP_RNBL 20023 3.33 13.86 0.06 47 BAYES_999 19411 5.92 13.43 3.59 48 T_KAM_HTML_FONT_INVALID 19145 16.24 13.25 17.17 49 RCVD_IN_MSPIKE_BL 17677 3.51 12.23 0.81 50 KHOP_HELO_FCRDNS 17642 4.49 12.21 2.09 51 XM_SPF_SoftFail 16687 4.15 11.55 1.86 52 HTML_IMAGE_ONLY_08 16445 2.77 11.38 0.10 53 RCVD_IN_BL_SPAMCOP_NET 16294 3.60 11.28 1.22 54 MIME_HEADER_CTYPE_ONLY 16294 2.73 11.28 0.07 55 XM_Multi_Part_URI 15707 11.59 10.87 11.81 56 HTML_IMAGE_RATIO_02 13487 9.11 9.33 9.04 57 SHORT_IMG_SUSP_NTLD 13316 2.18 9.21 0.00 58 LOTS_OF_MONEY 13242 8.94 9.16 8.87 59 BAYES_60 12619 5.66 8.73 4.71 60 RCVD_IN_MSPIKE_H2 12420 12.49 8.59 13.69 61 RCVD_IN_MSPIKE_L5 12339 2.23 8.54 0.27 62 XMSubMetaSx_00 12317 4.77 8.52 3.61 63 XM_DIRTYINTL 12265 4.09 8.49 2.73 64 BAYES_80 12179 3.80 8.43 2.36 65 XM_Evil_Numbers_Gen 11743 9.91 8.13 10.46 66 BOTNET_NORDNS 11083 1.86 7.67 0.06 67 XMNumbers 10984 4.72 7.60 3.83 68 MISSING_HEADERS 9594 1.91 6.64 0.44 69 RDNS_DYNAMIC 9198 1.74 6.37 0.31 70 RCVD_IN_PSBL 9083 1.52 6.29 0.05 71 T_XMDrugObfuBody_14 8994 7.70 6.22 8.16 72 SUBJECT_NEEDS_ENCODING 8550 1.41 5.92 0.01 73 SUBJ_ILLEGAL_CHARS 8535 1.40 5.91 0.01 74 RELAYCOUNTRY_FR 8265 1.59 5.72 0.31 75 XM_H_Long_From01 8252 6.18 5.71 6.32 76 MPART_ALT_DIFF 8149 4.89 5.64 4.66 77 SHORTENER_SHORT_IMG 7693 1.27 5.32 0.01 78 LongTLD 7655 1.42 5.30 0.22 79 LotsOfNums_01 7650 7.49 5.29 8.18 80 BAYES_95 7088 2.32 4.90 1.52 81 TooManyTo_001 6849 7.28 4.74 8.07 82 DKIM_INVALID 6705 4.69 4.64 4.70 83 FROM_EXCESS_BASE64 6610 4.17 4.57 4.04 84 HDRS_MISSP 6594 1.11 4.56 0.03 85 BAYES_40 6532 5.63 4.52 5.97 86 TO_MALFORMED 6295 2.11 4.36 1.42 87 XM_CamelCaseFrm001 5835 2.63 4.04 2.20 88 HTML_IMAGE_RATIO_04 5818 6.02 4.03 6.63 89 XM_B_Phish_Phrases 5454 5.12 3.77 5.53 90 MIME_HTML_MOSTLY 5338 2.73 3.69 2.43 91 XM_SendGrid 5303 5.46 3.67 6.02 92 BAYES_00 5243 16.69 3.63 20.74 93 HK_RANDOM_FROM 5149 0.94 3.56 0.13 94 XMHTML_After_End 4948 1.93 3.42 1.46 95 XM_B_SpammyTLD 4866 2.14 3.37 1.76 96 FROM_MISSP_REPLYTO 4853 0.80 3.36 0.00 97 RCVD_IN_MSPIKE_L3 4821 0.97 3.34 0.24 98 RELAYCOUNTRY_CA 4532 1.98 3.14 1.62 99 URI_NOVOWEL 4522 0.99 3.13 0.33 100 MIME_HTML_ONLY_MULTI 4481 2.90 3.10 2.84 101 BAYES_20 4368 4.34 3.02 4.75 102 XM_UB60 4336 0.76 3.00 0.07 103 RELAYCOUNTRY_DE 4268 1.06 2.95 0.47 104 HTML_SHORT_LINK_IMG_2 4216 0.71 2.92 0.03 105 XMStrtUSub 4198 4.51 2.91 5.00 106 XMMoneyMeta_00 4091 1.04 2.83 0.48 107 RELAYCOUNTRY_CN 4074 0.71 2.82 0.06 108 RCVD_IN_MSPIKE_WL 4057 8.70 2.81 10.52 109 RCVD_IN_MSPIKE_H3 4046 8.67 2.80 10.50 110 HTML_IMAGE_RATIO_06 3960 3.61 2.74 3.88 111 MIME_QP_LONG_LINE 3928 5.01 2.72 5.72 112 URIBL_RHS_DOB 3880 0.65 2.68 0.02 113 TM2_M_URI_OPT_OUT 3818 2.23 2.64 2.10 114 MultiRelay_CC 3635 0.73 2.52 0.18 115 MultiRelay_Combo 3635 0.73 2.52 0.18 116 SpammyFromTLD_01 3612 1.15 2.50 0.74 117 T_XMDrugObfuBody_08 3611 1.47 2.50 1.14 118 XM_URI_RBL 3496 0.83 2.42 0.34 119 RELAYCOUNTRY_NZ 3419 0.57 2.37 0.01 120 XM_Palau_URI 3324 0.55 2.30 0.01 121 HTML_IMAGE_RATIO_08 3265 2.66 2.26 2.79 122 BAYES_05 3232 2.77 2.24 2.94 123 RELAYCOUNTRY_IN 3189 0.58 2.21 0.08 124 REPLYTO_WITHOUT_TO_CC 3145 0.54 2.18 0.04 125 FVGT_m_MULTI_ODD_EMAIL 3125 0.53 2.16 0.03 126 MIME_CHARSET_FARAWAY 3108 0.62 2.15 0.15 127 DATE_IN_PAST_06_12 3098 0.54 2.14 0.05 128 UNPARSEABLE_RELAY 2991 2.32 2.07 2.39 129 XM_UB99 2881 0.48 1.99 0.01 130 URI_HEX 2774 1.40 1.92 1.24 131 T_TooManySym_01 2745 4.40 1.90 5.18 132 XMSexyCombo_01 2685 0.75 1.86 0.41 133 FROM_STARTS_WITH_NUMS 2657 0.50 1.84 0.08 134 XMCapTrack 2627 1.35 1.82 1.20 135 RELAYCOUNTRY_GB 2622 1.15 1.81 0.95 136 CHARSET_FARAWAY_HEADER 2555 0.47 1.77 0.06 137 XM_OfRef6 2518 1.37 1.74 1.25 138 TR_XM_PHPDW 2500 0.90 1.73 0.65 139 TR_XM_PHPForged 2445 0.88 1.69 0.63 140 XM_B_Unsub2 2425 1.45 1.68 1.38 141 TR_XM_DK_SendGrid 2423 2.92 1.68 3.31 142 XMDiploma_00 2422 1.45 1.68 1.38 143 TR_XM_FormFill2 2422 0.87 1.68 0.63 144 XM_H_PHPOS 2414 0.87 1.67 0.62 145 XM_UB80 2341 0.40 1.62 0.02 146 XMSubMetaI_00 2326 1.23 1.61 1.12 147 XMBdyGiftCard01 2311 1.43 1.60 1.38 148 URIBL_DBL_SPAM 2233 0.39 1.55 0.03 149 XMStockSpam_06 2223 1.30 1.54 1.22 150 TO_EQ_FM_DOM_HTML_IMG 2186 0.36 1.51 0.00 151 XMSubMetaSxObfu_03 2143 1.01 1.48 0.86 152 T_XMDrugObfuBody_00 2122 0.80 1.47 0.59 153 DATE_IN_PAST_03_06 2122 0.44 1.47 0.12 154 DOS_RCVD_IP_TWICE_B 2121 0.40 1.47 0.07 155 RELAYCOUNTRY_SG 2110 0.41 1.46 0.08 156 XM_UB999 2101 0.35 1.45 0.00 157 NO_FM_NAME_IP_HOSTN 2095 0.34 1.45 0.00 158 XMGppyBdWords 2057 0.43 1.42 0.12 159 DKIM_ADSP_CUSTOM_MED 2054 1.19 1.42 1.12 160 SUBJ_OBFU_PUNCT_FEW 2051 0.40 1.42 0.08 161 RCVD_IN_IADB_LISTED 2048 3.98 1.42 4.78 162 SUBJ_ALL_CAPS 2019 1.38 1.40 1.37 163 XMSubMetaSSx_00 2017 0.46 1.40 0.17 164 TO_EQ_FM_DIRECT_MX 1985 0.36 1.37 0.04 165 XMSubMetaD_00 1978 0.37 1.37 0.06 166 TVD_SPACE_RATIO_MINFP 1974 0.33 1.37 0.01 167 SERGIO_SUBJECT_PORN014 1964 0.32 1.36 0.00 168 DIET_1 1927 1.19 1.33 1.15 169 XM_SPF_Unknown 1925 0.82 1.33 0.66 170 FORGED_GMAIL_RCVD 1924 0.77 1.33 0.60 171 ALL_TRUSTED 1903 12.26 1.32 15.66 172 NML_ADSP_CUSTOM_MED 1893 0.96 1.31 0.86 173 T_FILL_THIS_FORM_SHORT 1891 1.17 1.31 1.13 174 RCVD_IN_RP_SAFE 1883 8.36 1.30 10.55 175 TM2_M_VERY_LONG_WORD 1874 1.22 1.30 1.20 176 XMSubGiftCard1 1872 0.34 1.30 0.05 177 TR_XM_DK_Bayes 1857 11.87 1.29 15.15 178 RCVD_IN_IADB_SPF 1847 3.48 1.28 4.16 179 RCVD_IN_IADB_SENDERID 1815 3.06 1.26 3.62 180 TR_XM_INV_DKIM 1812 0.43 1.25 0.17 181 XMSubGiftCard2 1804 0.30 1.25 0.01 182 RCVD_IN_IADB_DK 1803 3.03 1.25 3.58 183 TR_Mismatch_TLD_01 1801 0.50 1.25 0.27 184 FROM_LOCAL_NOVOWEL 1798 0.31 1.24 0.02 185 DRUGS_ERECTILE 1774 0.30 1.23 0.01 186 TO_NO_BRKTS_HTML_ONLY 1748 0.47 1.21 0.24 187 TR_Symld_Words 1737 1.33 1.20 1.37 188 INVALID_MSGID 1718 1.51 1.19 1.61 189 TVD_RCVD_SPACE_BRACKET 1651 0.30 1.14 0.04 190 CHARSET_FARAWAY 1650 0.27 1.14 0.00 191 TR_XM_DK_Bayes1 1648 11.32 1.14 14.47 192 TR_XM_RelayPhish 1643 0.97 1.14 0.91 193 XMGenDplmaNmb 1631 0.95 1.13 0.89 194 RELAYCOUNTRY_RU 1605 0.27 1.11 0.01 195 XM_JunkDunk 1593 0.26 1.10 0.00 196 HK_RANDOM_REPLYTO 1577 0.49 1.09 0.30 197 CK_HELO_DYNAMIC_SPLIT_IP 1569 1.40 1.09 1.49 198 RELAYCOUNTRY_FI 1553 0.28 1.07 0.03 199 XMBrknScrpt_02 1553 1.10 1.07 1.11 200 FROM_NTLD_LINKBAIT 1529 0.25 1.06 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 409619 89.34 93.86 87.94 2 DKIM_SIGNED 347797 68.70 49.45 74.67 3 XM_DK_Pass 342342 67.44 47.91 73.50 4 DKIM_VALID 325907 64.01 44.81 69.97 5 XM_B_Unicode 320160 66.11 57.65 68.73 6 DCC_CHECK_NEGATIVE 266156 47.45 16.20 57.14 7 DKIM_VALID_AU 249131 48.67 33.14 53.49 8 BAYES_50 243703 50.56 44.89 52.32 9 XMListUnsubscribeExists 238182 48.34 39.33 51.13 10 DCC_CHECK 190953 50.85 82.61 41.00 11 XM_B_Unicode3 190728 40.03 37.09 40.95 12 T_TM2_M_HEADER_IN_MSG 139214 26.37 15.03 29.89 13 HTML_FONT_LOW_CONTRAST 131112 26.88 22.79 28.15 14 DKIM_VALID_EF 121689 23.87 16.60 26.13 15 LOC_TINY_FONT_1 111329 22.99 20.04 23.90 16 MIME_HTML_ONLY 100651 29.98 56.97 21.61 17 BAYES_00 96605 16.69 3.63 20.74 18 XMSubLong 96070 20.71 20.98 20.62 19 FVGT_m_MULTI_ODD 95025 19.39 16.14 20.40 20 MultiRelay 84432 17.92 17.26 18.13 21 T_KAM_HTML_FONT_INVALID 79954 16.24 13.25 17.17 22 ALL_TRUSTED 72948 12.26 1.32 15.66 23 TR_XM_DK_Bayes 70564 11.87 1.29 15.15 24 TR_XM_DK_Bayes1 67411 11.32 1.14 14.47 25 RCVD_IN_MSPIKE_H2 63788 12.49 8.59 13.69 26 XM_Body_Dirty_Words 60967 14.18 17.71 13.09 27 TR_XM_DK_Bayes2 60659 10.07 0.57 13.02 28 XM_Multi_Part_URI 55020 11.59 10.87 11.81 29 RCVD_IN_RP_SAFE 49137 8.36 1.30 10.55 30 RCVD_IN_MSPIKE_WL 49009 8.70 2.81 10.52 31 RCVD_IN_MSPIKE_H3 48892 8.67 2.80 10.50 32 XM_Evil_Numbers_Gen 48708 9.91 8.13 10.46 33 RCVD_IN_RP_CERTIFIED 43373 7.33 0.96 9.31 34 XM_B_Unsub 42470 11.82 20.52 9.12 35 HTML_IMAGE_RATIO_02 42117 9.11 9.33 9.04 36 LOTS_OF_MONEY 41308 8.94 9.16 8.87 37 LotsOfNums_01 38079 7.49 5.29 8.18 38 T_XMDrugObfuBody_14 38015 7.70 6.22 8.16 39 TooManyTo_001 37611 7.28 4.74 8.07 40 XM_DKIMWhitelistDomains 36596 6.08 0.37 7.86 41 XM_DK_Undo_02 34623 11.06 22.75 7.43 42 FSL_BULK_SIG 31113 14.67 40.42 6.68 43 HTML_IMAGE_RATIO_04 30892 6.02 4.03 6.63 44 XM_H_Long_From01 29458 6.18 5.71 6.32 45 XM_SendGrid 28018 5.46 3.67 6.02 46 BAYES_40 27831 5.63 4.52 5.97 47 MIME_QP_LONG_LINE 26631 5.01 2.72 5.72 48 XM_B_Phish_Phrases 25768 5.12 3.77 5.53 49 RELAYCOUNTRY_META 25056 12.00 33.35 5.38 50 T_TooManySym_01 24117 4.40 1.90 5.18 51 XM_PDF 23490 4.03 0.76 5.04 52 XMStrtUSub 23312 4.51 2.91 5.00 53 RCVD_IN_IADB_LISTED 22258 3.98 1.42 4.78 54 BAYES_20 22103 4.34 3.02 4.75 55 BAYES_60 21938 5.66 8.73 4.71 56 DKIM_INVALID 21890 4.69 4.64 4.70 57 MPART_ALT_DIFF 21713 4.89 5.64 4.66 58 XMSexyCombo_05 21349 7.02 14.88 4.58 59 BOTNET_IPINHOSTNAME 21114 7.58 17.39 4.53 60 T_REMOTE_IMAGE 20750 9.74 26.76 4.45 61 BAYES_99 20662 7.95 19.29 4.44 62 RCVD_IN_IADB_SPF 19372 3.48 1.28 4.16 63 FROM_EXCESS_BASE64 18840 4.17 4.57 4.04 64 XM_UncommonTLD01 18670 9.02 25.19 4.01 65 HTML_IMAGE_RATIO_06 18066 3.61 2.74 3.88 66 XMNumbers 17837 4.72 7.60 3.83 67 RCVD_IN_IADB_SENDERID 16876 3.06 1.26 3.62 68 XMSubMetaSx_00 16804 4.77 8.52 3.61 69 BAYES_999 16722 5.92 13.43 3.59 70 RCVD_IN_IADB_DK 16683 3.03 1.25 3.58 71 IN_ZIMBRA_NJ_WHITELIST 16450 2.70 0.02 3.53 72 TR_XM_DK_SendGrid 15424 2.92 1.68 3.31 73 RCVD_IN_IADB_VOUCHED 14067 2.41 0.44 3.02 74 BAYES_05 13679 2.77 2.24 2.94 75 MIME_HTML_ONLY_MULTI 13219 2.90 3.10 2.84 76 HTML_IMAGE_RATIO_08 12987 2.66 2.26 2.79 77 XM_DIRTYINTL 12697 4.09 8.49 2.73 78 HTML_MIME_NO_HTML_TAG 11720 8.24 26.68 2.52 79 MIME_HTML_MOSTLY 11313 2.73 3.69 2.43 80 T_TooManySym_02 11162 1.97 0.58 2.40 81 UNPARSEABLE_RELAY 11138 2.32 2.07 2.39 82 BAYES_80 11010 3.80 8.43 2.36 83 MAILING_LIST_MULTI 10789 2.01 1.00 2.32 84 TR_DCC_Bayes_99 10505 5.31 15.15 2.26 85 XM_CamelCaseFrm001 10232 2.63 4.04 2.20 86 XM_H_Trusted_IP 10148 1.66 0.00 2.18 87 TooManyTo_002 10021 1.85 0.90 2.15 88 TM2_M_URI_OPT_OUT 9762 2.23 2.64 2.10 89 KHOP_HELO_FCRDNS 9757 4.49 12.21 2.09 90 ANY_BOUNCE_MESSAGE 9343 1.63 0.44 2.01 91 BOUNCE_MESSAGE 9340 1.63 0.44 2.01 92 NO_DNS_FOR_FROM 9243 5.40 16.40 1.98 93 BOTNET 9120 11.55 42.45 1.96 94 RCVD_IN_IADB_OPTIN 8784 1.51 0.30 1.89 95 TVD_RCVD_IP 8669 1.59 0.72 1.86 96 XM_SPF_SoftFail 8644 4.15 11.55 1.86 97 XM_B_SpammyTLD 8199 2.14 3.37 1.76 98 RELAYCOUNTRY_CA 7528 1.98 3.14 1.62 99 INVALID_MSGID 7497 1.51 1.19 1.61 100 HELO_NODOT 7463 1.37 0.63 1.60 101 HELO_NO_DOMAIN 7458 1.36 0.60 1.60 102 IN_HORDE_ADDRESS_BOOK 7438 1.25 0.14 1.60 103 XM_DK_Undo_01 7383 1.42 0.89 1.59 104 UNTRUSTED_Relay 7256 8.93 32.70 1.56 105 BAYES_95 7057 2.32 4.90 1.52 106 CK_HELO_DYNAMIC_SPLIT_IP 6947 1.40 1.09 1.49 107 HELO_DYNAMIC_IPADDR2 6943 1.26 0.52 1.49 108 XMHTML_After_End 6811 1.93 3.42 1.46 109 TooManyTo_003 6656 1.25 0.67 1.43 110 XM_H_Long_From02 6608 1.32 1.01 1.42 111 TO_MALFORMED 6592 2.11 4.36 1.42 112 USER_IN_DEF_DKIM_WL 6577 1.08 0.01 1.41 113 XM_B_Unsub2 6442 1.45 1.68 1.38 114 XMDiploma_00 6442 1.45 1.68 1.38 115 XMBdyGiftCard01 6429 1.43 1.60 1.38 116 TR_Symld_Words 6404 1.33 1.20 1.37 117 SUBJ_ALL_CAPS 6402 1.38 1.40 1.37 118 XM_OfRef6 5826 1.37 1.74 1.25 119 URI_HEX 5761 1.40 1.92 1.24 120 XMStockSpam_06 5691 1.30 1.54 1.22 121 RCVD_IN_BL_SPAMCOP_NET 5680 3.60 11.28 1.22 122 XMCapTrack 5607 1.35 1.82 1.20 123 TM2_M_VERY_LONG_WORD 5598 1.22 1.30 1.20 124 DKIM_ADSP_NXDOMAIN 5541 6.89 25.26 1.19 125 URI_TRY_3LD 5513 1.08 0.76 1.18 126 DIET_1 5335 1.19 1.33 1.15 127 T_XMDrugObfuBody_08 5333 1.47 2.50 1.14 128 T_FILL_THIS_FORM_SHORT 5260 1.17 1.31 1.13 129 DKIM_ADSP_CUSTOM_MED 5215 1.19 1.42 1.12 130 XMSubMetaI_00 5208 1.23 1.61 1.12 131 XMGappySubj_01 5182 0.99 0.60 1.11 132 XMBrknScrpt_02 5149 1.10 1.07 1.11 133 XMPhish11 5107 1.05 0.89 1.10 134 XMSubNoVowel 5035 1.03 0.86 1.08 135 XM_GoogleGroups 4809 0.85 0.27 1.03 136 TooManyTo_004 4780 0.90 0.50 1.03 137 RELAYCOUNTRY_GB 4411 1.15 1.81 0.95 138 AC_FROM_MANY_DOTS 4408 0.73 0.02 0.95 139 TR_MetaPhish_Combo_01 4278 0.78 0.32 0.92 140 TR_XM_RelayPhish 4261 0.97 1.14 0.91 141 XMGenDplmaNmb 4161 0.95 1.13 0.89 142 XMSubMetaSxObfu_03 4016 1.01 1.48 0.86 143 XMBody_95 3996 0.67 0.07 0.86 144 NML_ADSP_CUSTOM_MED 3986 0.96 1.31 0.86 145 HTML_FONT_FACE_BAD 3958 0.79 0.61 0.85 146 XM_UB50 3941 5.02 18.48 0.85 147 TooManyTo_005 3917 0.74 0.40 0.84 148 RCVD_IN_MSPIKE_BL 3773 3.51 12.23 0.81 149 T_OBFU_PDF_ATTACH 3739 0.67 0.25 0.80 150 XMNoVowels 3582 0.65 0.27 0.77 151 XM_ProductURIs 3455 0.76 0.81 0.74 152 SpammyFromTLD_01 3425 1.15 2.50 0.74 153 T_XMHurry_00 3249 0.78 1.03 0.70 154 PLING_QUERY 3166 0.70 0.77 0.68 155 XMPhish30 3090 0.74 0.97 0.66 156 XM_SPF_Unknown 3066 0.82 1.33 0.66 157 TR_XM_PHPDW 3011 0.90 1.73 0.65 158 XMBody_17 2990 0.67 0.75 0.64 159 TR_XM_PHPForged 2925 0.88 1.69 0.63 160 TR_XM_FormFill2 2912 0.87 1.68 0.63 161 XMHTMLBadTable_001 2889 0.59 0.50 0.62 162 XM_H_PHPOS 2880 0.87 1.67 0.62 163 XMBody_78 2819 0.68 0.91 0.61 164 FORGED_GMAIL_RCVD 2787 0.77 1.33 0.60 165 HTML_IMAGE_ONLY_20 2770 0.50 0.21 0.59 166 T_XMDrugObfuBody_00 2767 0.80 1.47 0.59 167 XM_ShortIntro_01 2731 0.51 0.25 0.59 168 HTTPS_HTTP_MISMATCH 2660 0.51 0.33 0.57 169 XM_B_REG_HTML 2619 0.48 0.23 0.56 170 USER_IN_WHITELIST 2611 0.43 0.00 0.56 171 SUBJ_DOLLARS 2607 0.53 0.45 0.56 172 MPART_ALT_DIFF_COUNT 2599 0.56 0.55 0.56 173 T_TooManySym_03 2449 0.45 0.18 0.53 174 HTML_TAG_BALANCE_BODY 2375 0.50 0.48 0.51 175 FILL_THIS_FORM 2366 0.57 0.76 0.51 176 T_MONEY_PERCENT 2360 0.59 0.85 0.51 177 TR_LOTS_OF_MONEY2 2360 0.59 0.85 0.51 178 FSL_THIS_IS_ADV 2353 0.50 0.47 0.51 179 XM_H_PHPMailer 2333 0.60 0.90 0.50 180 XMMoneyMeta_00 2244 1.04 2.83 0.48 181 SHORT_HELO_AND_INLINE_IMAGE 2236 0.38 0.06 0.48 182 TR_LOTS_OF_MONEY3 2173 0.48 0.53 0.47 183 RELAYCOUNTRY_DE 2173 1.06 2.95 0.47 184 AC_DIV_BONANZA 2170 0.38 0.10 0.47 185 RELAYCOUNTRY_AU 2166 0.46 0.46 0.47 186 RELAYCOUNTRY_NL 2051 0.42 0.36 0.44 187 MISSING_HEADERS 2045 1.91 6.64 0.44 188 RCVD_IN_SORBS_DUL 2033 0.55 0.91 0.44 189 XM_B_COPY_HTML 2012 0.47 0.57 0.43 190 XM_Body_Obfu01 1996 0.38 0.24 0.43 191 XMLngstWrd_00 1956 0.43 0.44 0.42 192 TM2_M_BODY_EMPTY 1955 0.35 0.13 0.42 193 XMPhish14 1940 0.50 0.75 0.42 194 XMSexyCombo_01 1919 0.75 1.86 0.41 195 XMSlimDrugH 1916 0.55 0.98 0.41 196 XMSolicitRefs_0 1885 0.40 0.37 0.40 197 XMSubMetaSxObfu_02 1875 0.38 0.31 0.40 198 XMUrgent 1851 0.36 0.23 0.40 199 HTML_IMAGE_ONLY_28 1840 0.44 0.58 0.40 200 HTML_IMAGE_ONLY_32 1835 0.35 0.23 0.39 ----------------------------------------------------------------------