Email: 634058 Autolearn: 0 AvgScore: 2.09 AvgScanTime: 2.03 sec Spam: 137677 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 2.55 sec Ham: 496381 Autolearn: 0 AvgScore: -1.33 AvgScanTime: 1.89 sec Time Spent Running SA: 357.53 hours Time Spent Processing Spam: 97.47 hours Time Spent Processing Ham: 260.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127018 89.93 92.26 89.28 2 DCC_CHECK 105901 47.85 76.92 39.78 3 XM_B_Unicode 93610 68.10 67.99 68.13 4 DKIM_SIGNED 86118 71.92 62.55 74.52 5 XM_DK_Pass 82897 70.49 60.21 73.34 6 DKIM_VALID 77449 66.78 56.25 69.69 7 XMListUnsubscribeExists 68323 50.28 49.63 50.46 8 MIME_HTML_ONLY 62305 26.80 45.25 21.68 9 DKIM_VALID_AU 59219 50.95 43.01 53.15 10 BAYES_50 58443 50.10 42.45 52.22 11 XM_B_Unicode3 49155 38.72 35.70 39.55 12 RELAYCOUNTRY_META 41166 10.83 29.90 5.54 13 XM_UncommonTLD01 40932 9.61 29.73 4.03 14 FSL_BULK_SIG 40002 10.58 29.05 5.46 15 HTML_FONT_LOW_CONTRAST 38640 27.45 28.07 27.28 16 XMSubLong 38385 22.06 27.88 20.45 17 XM_Body_Dirty_Words 38153 16.79 27.71 13.76 18 XM_DK_Undo_02 37388 10.63 27.16 6.04 19 LOC_TINY_FONT_1 36143 23.65 26.25 22.93 20 BAYES_99 35673 8.10 25.91 3.16 21 UNTRUSTED_Relay 31438 6.23 22.83 1.63 22 DKIM_VALID_EF 30721 26.94 22.31 28.22 23 BOTNET 30459 6.38 22.12 2.01 24 XMSexyCombo_05 30147 8.02 21.90 4.17 25 XM_B_Unsub 29423 12.19 21.37 9.64 26 DCC_CHECK_NEGATIVE 28388 49.99 20.62 58.14 27 TR_DCC_Bayes_99 28275 5.53 20.54 1.37 28 BAYES_999 28220 6.42 20.50 2.51 29 MultiRelay 27860 18.60 20.24 18.15 30 FVGT_m_MULTI_ODD 25255 20.71 18.34 21.37 31 BOTNET_IPINHOSTNAME 23484 7.71 17.06 5.12 32 T_TM2_M_HEADER_IN_MSG 22930 28.42 16.65 31.69 33 KHOP_HELO_FCRDNS 20997 5.01 15.25 2.17 34 T_KAM_HTML_FONT_INVALID 20688 16.90 15.03 17.42 35 HTML_MIME_NO_HTML_TAG 20162 5.25 14.64 2.65 36 HTML_IMAGE_RATIO_02 19677 9.35 14.29 7.98 37 XM_H_Long_From01 19580 7.72 14.22 5.91 38 XM_DIRTYINTL 18213 4.79 13.23 2.45 39 XM_Multi_Part_URI 17519 11.65 12.72 11.35 40 LOTS_OF_MONEY 16447 9.56 11.95 8.89 41 RCVD_IN_BL_SPAMCOP_NET 15947 3.22 11.58 0.89 42 XM_UB50 15660 3.17 11.37 0.89 43 RDNS_DYNAMIC 15514 2.74 11.27 0.37 44 RCVD_IN_RP_RNBL 14774 2.41 10.73 0.10 45 SpammyFromTLD_02 14305 2.43 10.39 0.22 46 FROM_EXCESS_BASE64 13771 4.83 10.00 3.39 47 XM_Evil_Numbers_Gen 13175 8.52 9.57 8.23 48 BAYES_60 11976 5.40 8.70 4.48 49 TR_Mismatch_TLD_02 11823 1.97 8.59 0.13 50 XMSubMetaSx_00 11769 5.14 8.55 4.19 51 HTML_SHORT_LINK_IMG_1 11245 1.80 8.17 0.03 52 T_XMDrugObfuBody_14 11195 8.04 8.13 8.01 53 T_REMOTE_IMAGE 11076 5.01 8.04 4.17 54 RCVD_IN_PSBL 10946 1.77 7.95 0.05 55 MPART_ALT_DIFF 10939 4.84 7.95 3.99 56 BAYES_80 10711 3.44 7.78 2.24 57 FROM_SUSPICIOUS_NTLD 10166 1.63 7.38 0.03 58 RCVD_IN_MSPIKE_BL 10122 2.29 7.35 0.89 59 FROM_SUSPICIOUS_NTLD_FP 10089 1.62 7.33 0.03 60 BOTNET_NORDNS 9405 1.52 6.83 0.05 61 XMNumbers 9304 4.15 6.76 3.43 62 RCVD_IN_MSPIKE_H2 9133 9.12 6.63 9.81 63 HTML_IMAGE_RATIO_06 9019 4.24 6.55 3.60 64 DKIM_INVALID 8669 5.15 6.30 4.83 65 XM_B_Phish_Phrases 8625 6.46 6.26 6.51 66 LotsOfNums_01 8238 6.97 5.98 7.25 67 TooManyTo_001 8112 7.94 5.89 8.51 68 HTML_IMAGE_RATIO_04 8048 6.00 5.85 6.05 69 XM_SPF_SoftFail 7665 2.78 5.57 2.01 70 SpammyFromTLD_01 7478 1.75 5.43 0.73 71 T_TooManySym_01 7311 5.28 5.31 5.27 72 HTML_IMAGE_ONLY_12 7232 1.35 5.25 0.27 73 XM_SendGrid 6934 5.55 5.04 5.69 74 NO_DNS_FOR_FROM 6618 2.55 4.81 1.92 75 XM_B_SpammyTLD 6556 2.60 4.76 2.01 76 RCVD_IN_MSPIKE_L5 6438 1.21 4.68 0.25 77 MIME_HTML_MOSTLY 6419 2.95 4.66 2.47 78 T_HTML_TAG_BALANCE_CENTER 6242 1.05 4.53 0.08 79 RELAYCOUNTRY_FR 6059 1.24 4.40 0.36 80 MIME_HEADER_CTYPE_ONLY 5954 1.00 4.32 0.08 81 BODY_URI_ONLY 5891 1.03 4.28 0.12 82 XMStrtUSub 5767 5.16 4.19 5.43 83 BAYES_40 5592 6.54 4.06 7.23 84 RCVD_IN_MSPIKE_H3 5527 8.23 4.01 9.40 85 RCVD_IN_MSPIKE_WL 5527 8.24 4.01 9.41 86 HTML_IMAGE_ONLY_08 5441 0.95 3.95 0.11 87 BAYES_95 5276 1.93 3.83 1.40 88 DKIM_ADSP_NXDOMAIN 5217 1.71 3.79 1.13 89 T_XMDrugObfuBody_08 5151 1.89 3.74 1.37 90 MIME_QP_LONG_LINE 5116 5.25 3.72 5.68 91 SUBJECT_NEEDS_ENCODING 4974 0.79 3.61 0.00 92 RELAYCOUNTRY_CA 4949 2.11 3.59 1.70 93 SUBJ_ILLEGAL_CHARS 4908 0.78 3.56 0.00 94 TM2_M_URI_OPT_OUT 4728 3.06 3.43 2.96 95 MIME_HTML_ONLY_MULTI 4689 2.68 3.41 2.48 96 DATE_IN_PAST_03_06 4596 0.78 3.34 0.07 97 XMSexyCombo_01 4488 1.19 3.26 0.61 98 HTML_IMAGE_RATIO_08 4284 2.46 3.11 2.28 99 XM_CamelCaseFrm001 4212 2.42 3.06 2.24 100 BAYES_20 4124 5.37 3.00 6.03 101 LongTLD 4036 0.73 2.93 0.13 102 XM_UB60 4012 0.68 2.91 0.07 103 MultiRelay_CC 3881 0.79 2.82 0.23 104 MultiRelay_Combo 3881 0.79 2.82 0.23 105 XMDiploma_00 3839 2.20 2.79 2.04 106 XM_URI_RBL 3838 0.80 2.79 0.25 107 XMStockSpam_06 3831 1.25 2.78 0.83 108 NORDNS_LOW_CONTRAST 3718 0.59 2.70 0.01 109 HTML_FONT_SIZE_LARGE 3615 0.67 2.63 0.13 110 T_XMDrugObfuBody_00 3605 1.79 2.62 1.57 111 RELAYCOUNTRY_CN 3589 0.62 2.61 0.07 112 XM_UB99 3581 0.57 2.60 0.00 113 TR_XM_DK_SendGrid 3536 2.93 2.57 3.02 114 REPLYTO_WITHOUT_TO_CC 3472 0.59 2.52 0.05 115 RELAYCOUNTRY_IN 3431 0.62 2.49 0.11 116 MISSING_HEADERS 3413 0.92 2.48 0.49 117 RELAYCOUNTRY_IT 3330 0.55 2.42 0.03 118 XMSexyCombo_04 3303 0.68 2.40 0.20 119 HDRS_LCASE_IMGONLY 3279 0.55 2.38 0.04 120 TR_XM_RelayPhish 3218 1.12 2.34 0.78 121 XM_SPF_Unknown 3205 1.11 2.33 0.78 122 BAYES_00 3172 16.07 2.30 19.89 123 TO_EQ_FM_DOM_HTML_IMG 3130 0.51 2.27 0.02 124 TR_Symld_Words 3112 1.62 2.26 1.45 125 UNPARSEABLE_RELAY 3046 2.22 2.21 2.22 126 XM_B_Unsub2 3042 2.81 2.21 2.97 127 RCVD_IN_MSPIKE_L3 3015 0.75 2.19 0.35 128 XM_UB999 2993 0.47 2.17 0.00 129 T_XMHurry_00 2980 0.90 2.16 0.55 130 T_Symld_Words_02 2962 1.09 2.15 0.79 131 TO_MALFORMED 2871 1.50 2.09 1.33 132 HDRS_MISSP 2825 0.46 2.05 0.02 133 SHORT_IMG_SUSP_NTLD 2820 0.45 2.05 0.00 134 URI_HEX 2780 1.32 2.02 1.13 135 XMGenDplmaNmb 2724 1.31 1.98 1.13 136 DATE_IN_PAST_06_12 2669 0.46 1.94 0.04 137 MISSING_MIMEOLE 2652 0.47 1.93 0.06 138 XM_OfRef6 2569 1.44 1.87 1.33 139 XMMoneyMeta_00 2524 0.78 1.83 0.49 140 XM_UB80 2503 0.41 1.82 0.01 141 SHORT_SHORTNER 2474 0.39 1.80 0.00 142 XMSolicitRefs_0 2372 0.63 1.72 0.33 143 URI_BUFFLY 2353 0.37 1.71 0.00 144 SHORTENER_SHORT_IMG 2345 0.37 1.70 0.00 145 SERGIO_SUBJECT_PORN014 2335 0.37 1.70 0.00 146 BAYES_05 2319 2.71 1.68 3.00 147 TR_XM_PHPDW 2317 0.78 1.68 0.53 148 XMHTML_After_End 2247 1.41 1.63 1.35 149 TR_XM_PHPForged 2237 0.75 1.62 0.51 150 TR_XM_FormFill2 2227 0.75 1.62 0.50 151 XM_H_PHPOS 2222 0.74 1.61 0.50 152 XMPhish11 2128 1.25 1.55 1.16 153 TM2_M_VERY_LONG_WORD 2095 1.16 1.52 1.06 154 SUBJ_ALL_CAPS 2086 1.80 1.52 1.87 155 XM_H_Long_From02 2067 1.31 1.50 1.26 156 TR_XM_INV_DKIM 2008 0.40 1.46 0.10 157 DIET_1 2002 0.79 1.45 0.60 158 ALL_TRUSTED 1996 12.20 1.45 15.18 159 RCVD_IN_IADB_LISTED 1994 3.81 1.45 4.47 160 NO_FM_NAME_IP_HOSTN 1929 0.31 1.40 0.00 161 XM_RXBody 1918 0.48 1.39 0.22 162 RELAYCOUNTRY_GB 1905 1.15 1.38 1.09 163 CHARSET_FARAWAY_HEADER 1899 0.34 1.38 0.06 164 RCVD_IN_IADB_SPF 1880 3.34 1.37 3.88 165 RCVD_IN_IADB_DK 1853 2.92 1.35 3.36 166 RCVD_IN_RP_SAFE 1849 7.18 1.34 8.79 167 RCVD_IN_IADB_SENDERID 1848 2.93 1.34 3.37 168 TVD_SPACE_RATIO_MINFP 1836 0.30 1.33 0.01 169 TVD_RCVD_SPACE_BRACKET 1834 0.29 1.33 0.00 170 HK_RANDOM_FROM 1832 0.39 1.33 0.13 171 NO_MEDICAL 1791 0.28 1.30 0.00 172 XM_H_TOP 1787 0.29 1.30 0.01 173 DKIM_ADSP_CUSTOM_MED 1736 1.09 1.26 1.04 174 XMSubMetaI_00 1721 0.78 1.25 0.65 175 XMhairloss01 1721 0.31 1.25 0.05 176 XMSubject_72 1704 0.29 1.24 0.03 177 XM_DKIMWhitelistDomains 1704 5.78 1.24 7.04 178 RELAYCOUNTRY_TR 1703 0.28 1.24 0.01 179 T_MANY_PILL_PRICE 1692 0.30 1.23 0.04 180 MIME_CHARSET_FARAWAY 1676 0.37 1.22 0.14 181 URIBL_DBL_ABUSE_REDIR 1656 0.27 1.20 0.01 182 XMSubMetaSxObfu_03 1654 1.26 1.20 1.28 183 HTML_SHORT_LINK_IMG_2 1646 0.35 1.20 0.12 184 PLING_QUERY 1636 0.74 1.19 0.61 185 TR_XM_DK_Bayes 1589 11.65 1.15 14.56 186 RELAYCOUNTRY_RU 1547 0.27 1.12 0.03 187 XMGppyBdWords 1533 0.34 1.11 0.13 188 NML_ADSP_CUSTOM_MED 1508 0.83 1.10 0.76 189 PDS_OTHER_BAD_TLD 1485 0.25 1.08 0.02 190 MAILING_LIST_MULTI 1461 2.08 1.06 2.36 191 XMBody_17 1448 0.86 1.05 0.81 192 FORGED_GMAIL_RCVD 1442 0.65 1.05 0.54 193 XMSlimDrugH 1410 0.46 1.02 0.30 194 TR_XM_DK_Bayes1 1406 11.11 1.02 13.90 195 XMSubject_09 1387 0.23 1.01 0.01 196 XM_H_PHPMailer 1365 0.67 0.99 0.58 197 RELAYCOUNTRY_DE 1361 0.51 0.99 0.38 198 TVD_SPACE_RATIO 1351 0.45 0.98 0.31 199 URI_NO_WWW_INFO_CGI 1320 0.23 0.96 0.03 200 RELAYCOUNTRY_BR 1317 0.22 0.96 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 443171 89.93 92.26 89.28 2 DKIM_SIGNED 369925 71.92 62.55 74.52 3 XM_DK_Pass 364038 70.49 60.21 73.34 4 DKIM_VALID 345952 66.78 56.25 69.69 5 XM_B_Unicode 338181 68.10 67.99 68.13 6 DCC_CHECK_NEGATIVE 288582 49.99 20.62 58.14 7 DKIM_VALID_AU 263811 50.95 43.01 53.15 8 BAYES_50 259221 50.10 42.45 52.22 9 XMListUnsubscribeExists 250487 50.28 49.63 50.46 10 DCC_CHECK 197475 47.85 76.92 39.78 11 XM_B_Unicode3 196331 38.72 35.70 39.55 12 T_TM2_M_HEADER_IN_MSG 157292 28.42 16.65 31.69 13 DKIM_VALID_EF 140069 26.94 22.31 28.22 14 HTML_FONT_LOW_CONTRAST 135388 27.45 28.07 27.28 15 LOC_TINY_FONT_1 113814 23.65 26.25 22.93 16 MIME_HTML_ONLY 107636 26.80 45.25 21.68 17 FVGT_m_MULTI_ODD 106055 20.71 18.34 21.37 18 XMSubLong 101510 22.06 27.88 20.45 19 BAYES_00 98733 16.07 2.30 19.89 20 MultiRelay 90087 18.60 20.24 18.15 21 T_KAM_HTML_FONT_INVALID 86460 16.90 15.03 17.42 22 ALL_TRUSTED 75340 12.20 1.45 15.18 23 TR_XM_DK_Bayes 72283 11.65 1.15 14.56 24 TR_XM_DK_Bayes1 69021 11.11 1.02 13.90 25 XM_Body_Dirty_Words 68308 16.79 27.71 13.76 26 TR_XM_DK_Bayes2 60965 9.75 0.63 12.28 27 XM_Multi_Part_URI 56359 11.65 12.72 11.35 28 RCVD_IN_MSPIKE_H2 48698 9.12 6.63 9.81 29 XM_B_Unsub 47851 12.19 21.37 9.64 30 RCVD_IN_MSPIKE_WL 46696 8.24 4.01 9.41 31 RCVD_IN_MSPIKE_H3 46666 8.23 4.01 9.40 32 LOTS_OF_MONEY 44145 9.56 11.95 8.89 33 RCVD_IN_RP_SAFE 43649 7.18 1.34 8.79 34 TooManyTo_001 42235 7.94 5.89 8.51 35 XM_Evil_Numbers_Gen 40854 8.52 9.57 8.23 36 T_XMDrugObfuBody_14 39781 8.04 8.13 8.01 37 HTML_IMAGE_RATIO_02 39624 9.35 14.29 7.98 38 RCVD_IN_RP_CERTIFIED 39344 6.41 0.94 7.93 39 LotsOfNums_01 35982 6.97 5.98 7.25 40 BAYES_40 35899 6.54 4.06 7.23 41 XM_DKIMWhitelistDomains 34921 5.78 1.24 7.04 42 XM_B_Phish_Phrases 32339 6.46 6.26 6.51 43 HTML_IMAGE_RATIO_04 30022 6.00 5.85 6.05 44 XM_DK_Undo_02 29998 10.63 27.16 6.04 45 BAYES_20 29950 5.37 3.00 6.03 46 XM_H_Long_From01 29347 7.72 14.22 5.91 47 XM_SendGrid 28257 5.55 5.04 5.69 48 MIME_QP_LONG_LINE 28171 5.25 3.72 5.68 49 RELAYCOUNTRY_META 27477 10.83 29.90 5.54 50 FSL_BULK_SIG 27087 10.58 29.05 5.46 51 XMStrtUSub 26969 5.16 4.19 5.43 52 T_TooManySym_01 26176 5.28 5.31 5.27 53 BOTNET_IPINHOSTNAME 25392 7.71 17.06 5.12 54 XM_PDF 24072 3.97 0.78 4.85 55 DKIM_INVALID 23973 5.15 6.30 4.83 56 BAYES_60 22238 5.40 8.70 4.48 57 RCVD_IN_IADB_LISTED 22168 3.81 1.45 4.47 58 XMSubMetaSx_00 20791 5.14 8.55 4.19 59 XMSexyCombo_05 20715 8.02 21.90 4.17 60 T_REMOTE_IMAGE 20694 5.01 8.04 4.17 61 XM_UncommonTLD01 20011 9.61 29.73 4.03 62 MPART_ALT_DIFF 19781 4.84 7.95 3.99 63 RCVD_IN_IADB_SPF 19276 3.34 1.37 3.88 64 HTML_IMAGE_RATIO_06 17854 4.24 6.55 3.60 65 IN_ZIMBRA_NJ_WHITELIST 17478 2.77 0.05 3.52 66 XMNumbers 17028 4.15 6.76 3.43 67 FROM_EXCESS_BASE64 16840 4.83 10.00 3.39 68 RCVD_IN_IADB_SENDERID 16730 2.93 1.34 3.37 69 RCVD_IN_IADB_DK 16675 2.92 1.35 3.36 70 BAYES_99 15702 8.10 25.91 3.16 71 TR_XM_DK_SendGrid 15015 2.93 2.57 3.02 72 BAYES_05 14878 2.71 1.68 3.00 73 XM_B_Unsub2 14762 2.81 2.21 2.97 74 TM2_M_URI_OPT_OUT 14694 3.06 3.43 2.96 75 RCVD_IN_IADB_VOUCHED 14283 2.36 0.48 2.88 76 HTML_MIME_NO_HTML_TAG 13149 5.25 14.64 2.65 77 BAYES_999 12463 6.42 20.50 2.51 78 MIME_HTML_ONLY_MULTI 12320 2.68 3.41 2.48 79 MIME_HTML_MOSTLY 12273 2.95 4.66 2.47 80 XM_DIRTYINTL 12166 4.79 13.23 2.45 81 TooManyTo_002 11716 2.04 0.87 2.36 82 MAILING_LIST_MULTI 11710 2.08 1.06 2.36 83 XM_H_Trusted_IP 11571 1.82 0.00 2.33 84 HTML_IMAGE_RATIO_08 11335 2.46 3.11 2.28 85 BAYES_80 11127 3.44 7.78 2.24 86 XM_CamelCaseFrm001 11105 2.42 3.06 2.24 87 UNPARSEABLE_RELAY 11037 2.22 2.21 2.22 88 KHOP_HELO_FCRDNS 10754 5.01 15.25 2.17 89 HTML_TAG_BALANCE_BODY 10750 1.83 0.64 2.17 90 T_TooManySym_02 10539 1.80 0.62 2.12 91 XMDiploma_00 10128 2.20 2.79 2.04 92 BOTNET 9993 6.38 22.12 2.01 93 XM_B_SpammyTLD 9960 2.60 4.76 2.01 94 XM_SPF_SoftFail 9957 2.78 5.57 2.01 95 TVD_RCVD_IP 9657 1.68 0.73 1.95 96 NO_DNS_FOR_FROM 9537 2.55 4.81 1.92 97 SUBJ_ALL_CAPS 9298 1.80 1.52 1.87 98 T_HTML_ATTACH 9048 1.45 0.13 1.82 99 RCVD_IN_IADB_OPTIN 8987 1.51 0.41 1.81 100 HELO_NODOT 8886 1.56 0.74 1.79 101 HELO_NO_DOMAIN 8880 1.56 0.73 1.79 102 XM_DK_Undo_01 8666 1.55 0.84 1.75 103 RELAYCOUNTRY_CA 8451 2.11 3.59 1.70 104 UNTRUSTED_Relay 8075 6.23 22.83 1.63 105 XMBdyGiftCard01 8036 1.45 0.83 1.62 106 ANY_BOUNCE_MESSAGE 7907 1.35 0.48 1.59 107 BOUNCE_MESSAGE 7907 1.35 0.48 1.59 108 TooManyTo_003 7878 1.39 0.68 1.59 109 T_XMDrugObfuBody_00 7776 1.79 2.62 1.57 110 INVALID_MSGID 7560 1.35 0.74 1.52 111 IN_HORDE_ADDRESS_BOOK 7365 1.19 0.14 1.48 112 XMCapTrack 7231 1.20 0.29 1.46 113 TR_Symld_Words 7176 1.62 2.26 1.45 114 BAYES_95 6962 1.93 3.83 1.40 115 CK_HELO_DYNAMIC_SPLIT_IP 6861 1.29 0.95 1.38 116 HELO_DYNAMIC_IPADDR2 6858 1.20 0.54 1.38 117 T_XMDrugObfuBody_08 6825 1.89 3.74 1.37 118 TR_DCC_Bayes_99 6776 5.53 20.54 1.37 119 XMHTML_After_End 6678 1.41 1.63 1.35 120 TO_MALFORMED 6609 1.50 2.09 1.33 121 XM_OfRef6 6586 1.44 1.87 1.33 122 XMSubNoVowel 6584 1.23 0.90 1.33 123 USER_IN_DEF_DKIM_WL 6354 1.00 0.01 1.28 124 XMSubMetaSxObfu_03 6331 1.26 1.20 1.28 125 XM_H_Long_From02 6261 1.31 1.50 1.26 126 URI_TRY_3LD 6010 1.13 0.84 1.21 127 TooManyTo_004 5873 1.04 0.53 1.18 128 XMPhish11 5780 1.25 1.55 1.16 129 XM_GoogleGroups 5684 0.96 0.29 1.15 130 DKIM_ADSP_NXDOMAIN 5624 1.71 3.79 1.13 131 URI_HEX 5611 1.32 2.02 1.13 132 XMGenDplmaNmb 5587 1.31 1.98 1.13 133 RELAYCOUNTRY_GB 5396 1.15 1.38 1.09 134 T_FILL_THIS_FORM_SHORT 5316 1.03 0.89 1.07 135 TM2_M_VERY_LONG_WORD 5265 1.16 1.52 1.06 136 TR_MetaPhish_Combo_01 5163 0.94 0.60 1.04 137 DKIM_ADSP_CUSTOM_MED 5153 1.09 1.26 1.04 138 TooManyTo_005 4968 0.88 0.45 1.00 139 RCVD_IN_BL_SPAMCOP_NET 4439 3.22 11.58 0.89 140 XM_UB50 4434 3.17 11.37 0.89 141 RCVD_IN_MSPIKE_BL 4405 2.29 7.35 0.89 142 AC_FROM_MANY_DOTS 4392 0.70 0.02 0.88 143 XM_ProductURIs 4306 0.88 0.91 0.87 144 XMBrknScrpt_02 4181 0.81 0.69 0.84 145 XMStockSpam_06 4111 1.25 2.78 0.83 146 XMBody_17 4034 0.86 1.05 0.81 147 T_Symld_Words_02 3938 1.09 2.15 0.79 148 XM_GRM 3936 0.62 0.00 0.79 149 HTML_FONT_FACE_BAD 3928 0.76 0.65 0.79 150 TR_XM_RelayPhish 3867 1.12 2.34 0.78 151 XM_SPF_Unknown 3850 1.11 2.33 0.78 152 XMBody_95 3835 0.62 0.06 0.77 153 NML_ADSP_CUSTOM_MED 3775 0.83 1.10 0.76 154 SpammyFromTLD_01 3599 1.75 5.43 0.73 155 XMGappySubj_01 3432 0.59 0.23 0.69 156 XM_ShortIntro_01 3368 0.61 0.34 0.68 157 XMSubMetaI_00 3212 0.78 1.25 0.65 158 XM_E_Blogspot 3124 0.51 0.07 0.63 159 XM_B_REG_HTML 3108 0.55 0.26 0.63 160 XMSexyCombo_01 3046 1.19 3.26 0.61 161 PLING_QUERY 3034 0.74 1.19 0.61 162 DIET_1 2994 0.79 1.45 0.60 163 XMHTMLBadTable_001 2978 0.66 0.89 0.60 164 T_OBFU_PDF_ATTACH 2971 0.51 0.21 0.60 165 HTTPS_HTTP_MISMATCH 2964 0.57 0.49 0.60 166 XMNoVowels 2910 0.55 0.40 0.59 167 XM_H_PHPMailer 2877 0.67 0.99 0.58 168 T_XMHurry_00 2731 0.90 2.16 0.55 169 HTML_IMAGE_ONLY_20 2674 0.48 0.28 0.54 170 FORGED_GMAIL_RCVD 2667 0.65 1.05 0.54 171 TR_XM_PHPDW 2653 0.78 1.68 0.53 172 TR_XM_PHPForged 2547 0.75 1.62 0.51 173 TR_XM_FormFill2 2503 0.75 1.62 0.50 174 SHORT_HELO_AND_INLINE_IMAGE 2497 0.40 0.05 0.50 175 XM_H_PHPOS 2482 0.74 1.61 0.50 176 USER_IN_WHITELIST 2476 0.39 0.00 0.50 177 T_TooManySym_03 2459 0.44 0.23 0.50 178 MISSING_HEADERS 2427 0.92 2.48 0.49 179 XMMoneyMeta_00 2416 0.78 1.83 0.49 180 HTML_IMAGE_ONLY_32 2376 0.43 0.27 0.48 181 XMPhish30 2363 0.53 0.72 0.48 182 TR_LOTS_OF_MONEY3 2356 0.54 0.79 0.47 183 TM2_M_BODY_EMPTY 2308 0.45 0.38 0.46 184 XMSubEmpty 2267 0.40 0.18 0.46 185 RCVD_IN_SORBS_DUL 2252 0.54 0.84 0.45 186 FROM_GOV_SPOOF 2251 0.40 0.20 0.45 187 FILL_THIS_FORM 2243 0.47 0.56 0.45 188 XM_B_COPY_HTML 2155 0.47 0.59 0.43 189 RELAYCOUNTRY_AU 2083 0.44 0.50 0.42 190 XMDateMe_00 2054 0.40 0.36 0.41 191 HTML_IMAGE_ONLY_28 2026 0.50 0.85 0.41 192 XM_Body_Obfu01 2019 0.40 0.37 0.41 193 XMLngstWrd_00 1987 0.42 0.49 0.40 194 XMBody_78 1961 0.50 0.88 0.40 195 RELAYCOUNTRY_DE 1875 0.51 0.99 0.38 196 RDNS_DYNAMIC 1854 2.74 11.27 0.37 197 AC_DIV_BONANZA 1835 0.31 0.10 0.37 198 TM2_M_A_HREF_HREF 1821 0.42 0.62 0.37 199 XMLngstWrd_01 1803 0.39 0.47 0.36 200 FSL_THIS_IS_ADV 1795 0.46 0.80 0.36 ----------------------------------------------------------------------