Email: 668077 Autolearn: 0 AvgScore: 3.12 AvgScanTime: 3.99 sec Spam: 172737 Autolearn: 0 AvgScore: 14.78 AvgScanTime: 4.70 sec Ham: 495340 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 3.74 sec Time Spent Running SA: 740.69 hours Time Spent Processing Spam: 225.61 hours Time Spent Processing Ham: 515.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160840 90.44 93.11 89.51 2 DCC_CHECK 128790 48.16 74.56 38.96 3 XM_B_Unicode 104899 67.80 60.73 70.26 4 DKIM_SIGNED 100758 71.26 58.33 75.77 5 XM_DK_Pass 96905 69.81 56.10 74.59 6 DKIM_VALID 90894 66.22 52.62 70.96 7 MIME_HTML_ONLY 85241 28.04 49.35 20.61 8 XMListUnsubscribeExists 82409 51.07 47.71 52.24 9 BAYES_50 72538 50.74 41.99 53.79 10 DKIM_VALID_AU 70085 49.77 40.57 52.97 11 XM_B_Unicode3 62322 39.40 36.08 40.56 12 FSL_BULK_SIG 49284 11.80 28.53 5.96 13 HTML_FONT_LOW_CONTRAST 48817 26.97 28.26 26.52 14 XM_DK_Undo_02 44758 11.00 25.91 5.80 15 XM_B_Unsub 44495 14.00 25.76 9.90 16 RELAYCOUNTRY_META 44229 11.20 25.60 6.18 17 LOC_TINY_FONT_1 43966 23.03 25.45 22.18 18 XM_UncommonTLD01 42735 9.54 24.74 4.24 19 XMSubLong 41217 21.41 23.86 20.56 20 DCC_CHECK_NEGATIVE 40277 49.54 23.32 58.69 21 T_TM2_M_HEADER_IN_MSG 38339 28.40 22.20 30.56 22 XM_Body_Dirty_Words 37806 15.38 21.89 13.11 23 BAYES_99 37484 7.44 21.70 2.47 24 BOTNET 36666 6.91 21.23 1.92 25 FVGT_m_MULTI_ODD 33452 21.18 19.37 21.81 26 DKIM_VALID_EF 33101 25.00 19.16 27.04 27 XM_Multi_Part_URI 32136 13.69 18.60 11.98 28 UNTRUSTED_Relay 32106 6.15 18.59 1.81 29 BOTNET_IPINHOSTNAME 30693 7.85 17.77 4.38 30 XMSexyCombo_05 29579 7.18 17.12 3.71 31 TR_DCC_Bayes_99 29547 5.01 17.11 0.79 32 MultiRelay 29481 18.41 17.07 18.88 33 BAYES_999 29448 5.86 17.05 1.95 34 FROM_EXCESS_BASE64 26901 6.50 15.57 3.33 35 HTML_MIME_NO_HTML_TAG 26765 5.92 15.49 2.58 36 KHOP_HELO_FCRDNS 26027 5.33 15.07 1.93 37 HTML_IMAGE_RATIO_02 25953 9.54 15.02 7.63 38 T_KAM_HTML_FONT_INVALID 23872 17.37 13.82 18.60 39 XM_B_Phish_Phrases 21034 7.73 12.18 6.18 40 RDNS_DYNAMIC 20714 3.36 11.99 0.35 41 XM_H_Long_From01 18965 7.52 10.98 6.32 42 RCVD_IN_RP_RNBL 18461 2.83 10.69 0.09 43 RCVD_IN_BL_SPAMCOP_NET 18405 3.83 10.65 1.45 44 LOTS_OF_MONEY 17718 9.09 10.26 8.68 45 SpammyFromTLD_02 16948 2.78 9.81 0.33 46 HTML_SHORT_LINK_IMG_1 16663 2.52 9.65 0.04 47 XM_Evil_Numbers_Gen 16662 9.01 9.65 8.79 48 FROM_SUSPICIOUS_NTLD 15800 2.38 9.15 0.02 49 FROM_SUSPICIOUS_NTLD_FP 15740 2.37 9.11 0.02 50 XM_DIRTYINTL 15551 4.10 9.00 2.39 51 TM2_M_URI_OPT_OUT 15449 3.91 8.94 2.16 52 XM_UB50 15279 3.02 8.85 0.99 53 DKIM_ADSP_NXDOMAIN 15053 3.22 8.71 1.30 54 BAYES_60 14782 5.83 8.56 4.88 55 XM_B_SpammyTLD 13812 3.54 8.00 1.98 56 XMSubMetaSx_00 13735 4.83 7.95 3.74 57 T_REMOTE_IMAGE 13579 5.48 7.86 4.65 58 BAYES_80 13517 3.73 7.83 2.31 59 XM_SPF_SoftFail 13165 3.31 7.62 1.81 60 RCVD_IN_MSPIKE_BL 13137 2.87 7.61 1.22 61 XMPhish11 12450 2.82 7.21 1.29 62 XMHTML_After_End 12371 2.51 7.16 0.89 63 XMNumbers 12262 4.64 7.10 3.78 64 ALL_TRUSTED 12088 11.91 7.00 13.62 65 BOTNET_NORDNS 11711 1.79 6.78 0.04 66 RCVD_IN_PSBL 11567 1.77 6.70 0.05 67 XMBody_78 11556 2.10 6.69 0.51 68 XM_H_PHPMailer 11451 2.06 6.63 0.47 69 BAYES_20 10990 5.27 6.36 4.89 70 RCVD_IN_MSPIKE_H2 10603 9.56 6.14 10.75 71 HTML_FONT_SIZE_LARGE 10567 1.67 6.12 0.12 72 AMAZON_IMG_NOT_RCVD_AMZN 10530 1.61 6.10 0.05 73 XMBdyGiftCard01 10405 2.15 6.02 0.80 74 FROM_NO_USER 10373 1.56 6.01 0.00 75 XM_NotFromAmazon 10365 1.56 6.00 0.01 76 HTML_IMAGE_ONLY_08 10312 1.63 5.97 0.12 77 TR_Mismatch_TLD_02 10179 1.57 5.89 0.07 78 TooManyTo_001 9917 7.74 5.74 8.44 79 DKIM_INVALID 9864 5.04 5.71 4.81 80 MPART_ALT_DIFF 9720 5.08 5.63 4.88 81 RCVD_IN_MSPIKE_L5 9589 1.61 5.55 0.24 82 PDS_OTHER_BAD_TLD 9498 1.74 5.50 0.42 83 LotsOfNums_01 9312 7.53 5.39 8.27 84 BODY_URI_ONLY 9086 1.42 5.26 0.08 85 XM_CamelCaseFrm001 8612 2.77 4.99 2.00 86 BAYES_40 8604 6.07 4.98 6.45 87 HTML_IMAGE_RATIO_04 8407 5.25 4.87 5.38 88 SHORT_IMG_SUSP_NTLD 8312 1.24 4.81 0.00 89 T_XMDrugObfuBody_14 8179 4.01 4.73 3.76 90 HTML_TAG_BALANCE_CENTER 8137 1.29 4.71 0.10 91 HTML_IMAGE_ONLY_12 7877 1.36 4.56 0.25 92 SpammyFromTLD_01 7647 1.76 4.43 0.83 93 XM_SendGrid 7558 5.73 4.38 6.20 94 BAYES_95 7331 2.08 4.24 1.33 95 TO_MALFORMED 6541 1.97 3.79 1.34 96 PLING_QUERY 6436 1.18 3.73 0.29 97 RCVD_IN_MSPIKE_H3 6313 8.34 3.65 9.98 98 RCVD_IN_MSPIKE_WL 6313 8.35 3.65 9.98 99 MIME_HTML_MOSTLY 6216 2.88 3.60 2.63 100 RELAYCOUNTRY_CA 6037 2.30 3.49 1.89 101 NORDNS_LOW_CONTRAST 5890 0.88 3.41 0.00 102 RELAYCOUNTRY_FR 5459 1.04 3.16 0.29 103 NO_DNS_FOR_FROM 5404 2.30 3.13 2.01 104 MIME_QP_LONG_LINE 5260 5.55 3.05 6.42 105 MIME_HTML_ONLY_MULTI 5208 3.15 3.01 3.20 106 T_XMDrugObfuBody_08 5200 1.93 3.01 1.56 107 XM_UB99 5200 0.78 3.01 0.00 108 XMStrtUSub 4900 4.07 2.84 4.50 109 XMSubPhish11 4821 0.83 2.79 0.15 110 HTML_IMAGE_RATIO_06 4807 3.70 2.78 4.03 111 HDRS_LCASE_IMGONLY 4659 0.71 2.70 0.02 112 MultiRelay_Combo 4628 0.87 2.68 0.23 113 MultiRelay_CC 4628 0.87 2.68 0.23 114 XMSubGiftCard1 4583 0.82 2.65 0.18 115 XMSubGiftCard2 4490 0.70 2.60 0.03 116 TR_MetaPhish_Combo_01 4435 1.40 2.57 1.00 117 RELAYCOUNTRY_CN 4363 0.70 2.53 0.07 118 XM_URI_RBL 4328 0.82 2.51 0.24 119 TR_XM_DK_SendGrid 4291 3.18 2.48 3.43 120 URIBL_DBL_ABUSE_REDIR 4247 0.64 2.46 0.00 121 XM_UB999 4190 0.63 2.43 0.00 122 T_TooManySym_01 4175 3.92 2.42 4.44 123 XMSexyCombo_01 4142 1.07 2.40 0.61 124 XM_SPF_Unknown 4135 1.20 2.39 0.78 125 LongTLD 3942 0.72 2.28 0.17 126 BAYES_00 3890 15.84 2.25 20.58 127 MIME_HEADER_CTYPE_ONLY 3810 0.62 2.21 0.07 128 XMDiploma_00 3806 2.25 2.20 2.27 129 HK_RANDOM_FROM 3735 0.67 2.16 0.15 130 CHARSET_FARAWAY_HEADER 3626 0.59 2.10 0.06 131 DATE_IN_PAST_06_12 3540 0.56 2.05 0.04 132 MIME_CHARSET_FARAWAY 3500 0.63 2.03 0.15 133 HTML_IMAGE_RATIO_08 3487 2.69 2.02 2.92 134 HTML_EXTRA_CLOSE 3456 0.58 2.00 0.09 135 XM_B_Unsub2 3412 2.21 1.98 2.29 136 TR_XM_RelayPhish 3324 1.06 1.92 0.76 137 TR_XM_INV_DKIM 3196 0.54 1.85 0.08 138 TVD_SPACE_RATIO_MINFP 3120 0.47 1.81 0.01 139 XMMoneyMeta_00 3051 0.83 1.77 0.51 140 BAYES_05 3040 2.62 1.76 2.91 141 URI_HEX 3040 1.36 1.76 1.22 142 XM_UB60 3024 0.52 1.75 0.08 143 NO_FM_NAME_IP_HOSTN 3020 0.45 1.75 0.00 144 URIBL_RHS_DOB 3003 0.45 1.74 0.00 145 UNPARSEABLE_RELAY 2942 2.15 1.70 2.30 146 XM_OfRef6 2915 1.42 1.69 1.32 147 XMSubMetaI_00 2870 0.83 1.66 0.55 148 T_Symld_Words_02 2797 0.97 1.62 0.75 149 TR_XM_DK_Bayes 2756 11.69 1.60 15.21 150 RELAYCOUNTRY_DE 2733 0.74 1.58 0.45 151 DKIM_ADSP_CUSTOM_MED 2702 1.12 1.56 0.97 152 XMHTMLBadTable_001 2690 0.87 1.56 0.63 153 DATE_IN_PAST_03_06 2677 0.50 1.55 0.13 154 XMGenDplmaNmb 2627 1.52 1.52 1.52 155 DIET_1 2626 0.72 1.52 0.45 156 TR_Symld_Words 2613 1.54 1.51 1.55 157 TR_XM_PHPDW 2555 1.20 1.48 1.10 158 XMStockSpam_06 2507 1.01 1.45 0.86 159 FVGT_m_MULTI_ODD_EMAIL 2507 0.39 1.45 0.02 160 XMSexyCombo_04 2503 0.48 1.45 0.14 161 BODY_SINGLE_WORD 2487 0.38 1.44 0.01 162 TR_XM_DK_Bayes1 2477 11.16 1.43 14.55 163 TR_XM_PHPForged 2464 1.17 1.43 1.07 164 TR_XM_FormFill2 2443 1.16 1.41 1.07 165 XM_H_PHPOS 2436 1.16 1.41 1.07 166 BODY_SINGLE_URI 2431 0.37 1.41 0.01 167 NML_ADSP_CUSTOM_MED 2415 0.83 1.40 0.63 168 MISSING_MIMEOLE 2406 0.41 1.39 0.07 169 XM_H_TOP 2405 0.36 1.39 0.01 170 XMSubNoVowel 2402 1.31 1.39 1.28 171 RCVD_IN_IADB_LISTED 2397 4.38 1.39 5.42 172 TM2_M_VERY_LONG_WORD 2388 1.22 1.38 1.16 173 REPLYTO_WITHOUT_TO_CC 2382 0.39 1.38 0.04 174 SERGIO_SUBJECT_PORN014 2303 0.35 1.33 0.00 175 XM_H_Long_From02 2276 1.22 1.32 1.18 176 RELAYCOUNTRY_IN 2252 0.42 1.30 0.11 177 CHARSET_FARAWAY 2243 0.34 1.30 0.00 178 RCVD_IN_IADB_SPF 2216 3.85 1.28 4.74 179 RELAYCOUNTRY_GB 2200 1.24 1.27 1.23 180 RCVD_IN_IADB_SENDERID 2193 3.41 1.27 4.15 181 FORGED_GMAIL_RCVD 2188 0.70 1.27 0.50 182 RCVD_IN_IADB_DK 2187 3.38 1.27 4.11 183 XM_ProductURIs 2160 0.75 1.25 0.57 184 INVALID_MSGID 2114 1.45 1.22 1.53 185 XM_UB80 2091 0.33 1.21 0.02 186 XMSubject_09 2090 0.32 1.21 0.01 187 URI_TRY_3LD 2082 1.13 1.21 1.11 188 XM_XX_Yahoo 2063 0.36 1.19 0.07 189 FSL_THIS_IS_ADV 2053 0.47 1.19 0.22 190 RELAYCOUNTRY_RU 2042 0.34 1.18 0.05 191 XMBody_17 1988 0.90 1.15 0.82 192 SUBJ_ALL_CAPS 1944 1.51 1.13 1.64 193 RCVD_IN_MSPIKE_L3 1935 0.76 1.12 0.63 194 XMGppyBdWords 1925 0.43 1.11 0.19 195 HDRS_MISSP 1912 0.29 1.11 0.01 196 TR_LOTS_OF_MONEY3 1844 0.60 1.07 0.44 197 XMSlimDrugH 1835 0.58 1.06 0.41 198 TO_EQ_FM_DIRECT_MX 1827 0.28 1.06 0.01 199 MSGID_SHORT 1805 0.27 1.04 0.01 200 RELAYCOUNTRY_NL 1796 0.51 1.04 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 443363 90.44 93.11 89.51 2 DKIM_SIGNED 375314 71.26 58.33 75.77 3 XM_DK_Pass 369479 69.81 56.10 74.59 4 DKIM_VALID 351480 66.22 52.62 70.96 5 XM_B_Unicode 348029 67.80 60.73 70.26 6 DCC_CHECK_NEGATIVE 290720 49.54 23.32 58.69 7 BAYES_50 266447 50.74 41.99 53.79 8 DKIM_VALID_AU 262392 49.77 40.57 52.97 9 XMListUnsubscribeExists 258766 51.07 47.71 52.24 10 XM_B_Unicode3 200903 39.40 36.08 40.56 11 DCC_CHECK 192979 48.16 74.56 38.96 12 T_TM2_M_HEADER_IN_MSG 151369 28.40 22.20 30.56 13 DKIM_VALID_EF 133916 25.00 19.16 27.04 14 HTML_FONT_LOW_CONTRAST 131348 26.97 28.26 26.52 15 LOC_TINY_FONT_1 109860 23.03 25.45 22.18 16 FVGT_m_MULTI_ODD 108027 21.18 19.37 21.81 17 MIME_HTML_ONLY 102091 28.04 49.35 20.61 18 BAYES_00 101954 15.84 2.25 20.58 19 XMSubLong 101823 21.41 23.86 20.56 20 MultiRelay 93528 18.41 17.07 18.88 21 T_KAM_HTML_FONT_INVALID 92153 17.37 13.82 18.60 22 TR_XM_DK_Bayes 75355 11.69 1.60 15.21 23 TR_XM_DK_Bayes1 72063 11.16 1.43 14.55 24 ALL_TRUSTED 67479 11.91 7.00 13.62 25 XM_Body_Dirty_Words 64919 15.38 21.89 13.11 26 TR_XM_DK_Bayes2 63632 9.76 0.93 12.85 27 XM_Multi_Part_URI 59325 13.69 18.60 11.98 28 RCVD_IN_MSPIKE_H2 53243 9.56 6.14 10.75 29 RCVD_IN_MSPIKE_WL 49440 8.35 3.65 9.98 30 RCVD_IN_MSPIKE_H3 49436 8.34 3.65 9.98 31 XM_B_Unsub 49027 14.00 25.76 9.90 32 XM_Evil_Numbers_Gen 43564 9.01 9.65 8.79 33 LOTS_OF_MONEY 43002 9.09 10.26 8.68 34 TooManyTo_001 41817 7.74 5.74 8.44 35 LotsOfNums_01 40967 7.53 5.39 8.27 36 HTML_IMAGE_RATIO_02 37808 9.54 15.02 7.63 37 XM_DKIMWhitelistDomains 34311 5.14 0.01 6.93 38 BAYES_40 31933 6.07 4.98 6.45 39 MIME_QP_LONG_LINE 31798 5.55 3.05 6.42 40 XM_H_Long_From01 31283 7.52 10.98 6.32 41 XM_SendGrid 30725 5.73 4.38 6.20 42 RELAYCOUNTRY_META 30596 11.20 25.60 6.18 43 XM_B_Phish_Phrases 30592 7.73 12.18 6.18 44 FSL_BULK_SIG 29545 11.80 28.53 5.96 45 XM_DK_Undo_02 28748 11.00 25.91 5.80 46 RCVD_IN_IADB_LISTED 26833 4.38 1.39 5.42 47 HTML_IMAGE_RATIO_04 26665 5.25 4.87 5.38 48 BAYES_20 24231 5.27 6.36 4.89 49 MPART_ALT_DIFF 24194 5.08 5.63 4.88 50 BAYES_60 24174 5.83 8.56 4.88 51 DKIM_INVALID 23834 5.04 5.71 4.81 52 RCVD_IN_IADB_SPF 23487 3.85 1.28 4.74 53 T_REMOTE_IMAGE 23051 5.48 7.86 4.65 54 XM_PDF 22625 3.53 0.56 4.57 55 XMStrtUSub 22300 4.07 2.84 4.50 56 T_TooManySym_01 22011 3.92 2.42 4.44 57 BOTNET_IPINHOSTNAME 21720 7.85 17.77 4.38 58 XM_UncommonTLD01 21004 9.54 24.74 4.24 59 RCVD_IN_IADB_SENDERID 20556 3.41 1.27 4.15 60 RCVD_IN_IADB_DK 20365 3.38 1.27 4.11 61 HTML_IMAGE_RATIO_06 19938 3.70 2.78 4.03 62 RCVD_IN_RP_SAFE 19667 3.14 0.75 3.97 63 XMNumbers 18731 4.64 7.10 3.78 64 T_XMDrugObfuBody_14 18629 4.01 4.73 3.76 65 XMSubMetaSx_00 18502 4.83 7.95 3.74 66 XMSexyCombo_05 18365 7.18 17.12 3.71 67 IN_ZIMBRA_NJ_WHITELIST 17848 2.68 0.03 3.60 68 RCVD_IN_RP_CERTIFIED 17544 2.74 0.45 3.54 69 TR_XM_DK_SendGrid 16967 3.18 2.48 3.43 70 FROM_EXCESS_BASE64 16512 6.50 15.57 3.33 71 RCVD_IN_IADB_VOUCHED 16490 2.56 0.36 3.33 72 MIME_HTML_ONLY_MULTI 15832 3.15 3.01 3.20 73 HTML_IMAGE_RATIO_08 14480 2.69 2.02 2.92 74 BAYES_05 14433 2.62 1.76 2.91 75 XM_H_Trusted_IP 13079 1.96 0.00 2.64 76 MIME_HTML_MOSTLY 13026 2.88 3.60 2.63 77 HTML_MIME_NO_HTML_TAG 12782 5.92 15.49 2.58 78 MAILING_LIST_MULTI 12444 2.13 1.04 2.51 79 BAYES_99 12211 7.44 21.70 2.47 80 XM_DIRTYINTL 11860 4.10 9.00 2.39 81 BAYES_80 11426 3.73 7.83 2.31 82 UNPARSEABLE_RELAY 11409 2.15 1.70 2.30 83 XM_B_Unsub2 11335 2.21 1.98 2.29 84 XMDiploma_00 11237 2.25 2.20 2.27 85 T_TooManySym_02 11127 1.81 0.54 2.25 86 TooManyTo_002 11098 1.83 0.67 2.24 87 TM2_M_URI_OPT_OUT 10700 3.91 8.94 2.16 88 RCVD_IN_IADB_OPTIN 10448 1.63 0.26 2.11 89 NO_DNS_FOR_FROM 9976 2.30 3.13 2.01 90 XM_CamelCaseFrm001 9916 2.77 4.99 2.00 91 XM_B_SpammyTLD 9805 3.54 8.00 1.98 92 BAYES_999 9677 5.86 17.05 1.95 93 KHOP_HELO_FCRDNS 9552 5.33 15.07 1.93 94 BOTNET 9527 6.91 21.23 1.92 95 RELAYCOUNTRY_CA 9355 2.30 3.49 1.89 96 TVD_RCVD_IP 9259 1.56 0.66 1.87 97 HELO_NODOT 9165 1.50 0.49 1.85 98 HELO_NO_DOMAIN 9160 1.49 0.48 1.85 99 UNTRUSTED_Relay 8957 6.15 18.59 1.81 100 XM_SPF_SoftFail 8953 3.31 7.62 1.81 101 ANY_BOUNCE_MESSAGE 8533 1.43 0.59 1.72 102 BOUNCE_MESSAGE 8531 1.43 0.59 1.72 103 SUBJ_ALL_CAPS 8143 1.51 1.13 1.64 104 XM_DK_Undo_01 8056 1.41 0.79 1.63 105 T_XMDrugObfuBody_08 7710 1.93 3.01 1.56 106 TR_Symld_Words 7683 1.54 1.51 1.55 107 IN_HORDE_ADDRESS_BOOK 7630 1.17 0.09 1.54 108 INVALID_MSGID 7593 1.45 1.22 1.53 109 XMGenDplmaNmb 7518 1.52 1.52 1.52 110 TooManyTo_003 7289 1.22 0.49 1.47 111 RCVD_IN_BL_SPAMCOP_NET 7165 3.83 10.65 1.45 112 XMCapTrack 6960 1.10 0.21 1.41 113 CK_HELO_DYNAMIC_SPLIT_IP 6722 1.23 0.87 1.36 114 HELO_DYNAMIC_IPADDR2 6707 1.11 0.42 1.35 115 TO_MALFORMED 6626 1.97 3.79 1.34 116 BAYES_95 6590 2.08 4.24 1.33 117 XM_OfRef6 6540 1.42 1.69 1.32 118 DKIM_ADSP_NXDOMAIN 6456 3.22 8.71 1.30 119 XMPhish11 6404 2.82 7.21 1.29 120 XMSubNoVowel 6332 1.31 1.39 1.28 121 RELAYCOUNTRY_GB 6101 1.24 1.27 1.23 122 URI_HEX 6059 1.36 1.76 1.22 123 RCVD_IN_MSPIKE_BL 6022 2.87 7.61 1.22 124 XM_H_Long_From02 5861 1.22 1.32 1.18 125 TM2_M_VERY_LONG_WORD 5740 1.22 1.38 1.16 126 XM_GoogleGroups 5720 0.92 0.26 1.15 127 T_FILL_THIS_FORM_SHORT 5516 1.04 0.84 1.11 128 URI_TRY_3LD 5474 1.13 1.21 1.11 129 TR_XM_PHPDW 5438 1.20 1.48 1.10 130 TR_XM_PHPForged 5321 1.17 1.43 1.07 131 TR_XM_FormFill2 5318 1.16 1.41 1.07 132 TooManyTo_004 5298 0.89 0.36 1.07 133 XM_H_PHPOS 5295 1.16 1.41 1.07 134 USER_IN_DEF_DKIM_WL 5000 0.75 0.00 1.01 135 AC_FROM_MANY_DOTS 4991 0.75 0.01 1.01 136 XMGappySubj_01 4972 0.82 0.29 1.00 137 TR_MetaPhish_Combo_01 4933 1.40 2.57 1.00 138 XM_UB50 4911 3.02 8.85 0.99 139 DKIM_ADSP_CUSTOM_MED 4788 1.12 1.56 0.97 140 XMHTML_After_End 4428 2.51 7.16 0.89 141 TO_NO_BRKTS_HTML_ONLY 4384 0.71 0.22 0.89 142 TooManyTo_005 4316 0.72 0.28 0.87 143 XMStockSpam_06 4257 1.01 1.45 0.86 144 SpammyFromTLD_01 4130 1.76 4.43 0.83 145 XMBody_17 4054 0.90 1.15 0.82 146 XMBdyGiftCard01 3971 2.15 6.02 0.80 147 TR_DCC_Bayes_99 3913 5.01 17.11 0.79 148 XM_SPF_Unknown 3881 1.20 2.39 0.78 149 TR_XM_RelayPhish 3759 1.06 1.92 0.76 150 XMBody_95 3753 0.58 0.09 0.76 151 HTML_FONT_FACE_BAD 3743 0.71 0.59 0.76 152 T_Symld_Words_02 3710 0.97 1.62 0.75 153 XMNoVowels 3694 0.68 0.50 0.75 154 HTTPS_HTTP_MISMATCH 3410 0.67 0.61 0.69 155 T_XMDrugObfuBody_00 3340 0.73 0.87 0.67 156 NML_ADSP_CUSTOM_MED 3145 0.83 1.40 0.63 157 RCVD_IN_MSPIKE_L3 3144 0.76 1.12 0.63 158 XMHTMLBadTable_001 3112 0.87 1.56 0.63 159 XMSexyCombo_01 3022 1.07 2.40 0.61 160 XMBrknScrpt_02 3004 0.69 0.92 0.61 161 T_XMHurry_00 2983 0.67 0.86 0.60 162 T_OBFU_PDF_ATTACH 2980 0.49 0.16 0.60 163 XM_ShortIntro_01 2883 0.49 0.24 0.58 164 XM_ProductURIs 2841 0.75 1.25 0.57 165 RELAYCOUNTRY_AU 2780 0.53 0.45 0.56 166 XMSubMetaI_00 2706 0.83 1.66 0.55 167 FROM_GOV_DKIM_AU 2682 0.47 0.26 0.54 168 XMSubMetaSxObfu_03 2534 0.65 1.04 0.51 169 T_TooManySym_03 2530 0.43 0.21 0.51 170 XMMoneyMeta_00 2524 0.83 1.77 0.51 171 SHORT_HELO_AND_INLINE_IMAGE 2514 0.38 0.03 0.51 172 FILL_THIS_FORM 2507 0.45 0.28 0.51 173 XMBody_78 2506 2.10 6.69 0.51 174 HTML_IMAGE_ONLY_20 2506 0.43 0.22 0.51 175 FORGED_GMAIL_RCVD 2456 0.70 1.27 0.50 176 USER_IN_WHITELIST 2383 0.36 0.00 0.48 177 HTML_TAG_BALANCE_BODY 2372 0.59 0.93 0.48 178 MISSING_HEADERS 2354 0.51 0.59 0.48 179 XM_H_PHPMailer 2323 2.06 6.63 0.47 180 RCVD_IN_SORBS_DUL 2301 0.50 0.61 0.46 181 XMPhish30 2246 0.52 0.70 0.45 182 RELAYCOUNTRY_DE 2241 0.74 1.58 0.45 183 DIET_1 2209 0.72 1.52 0.45 184 HTML_IMAGE_ONLY_32 2202 0.40 0.28 0.44 185 XMDateMe_00 2199 0.42 0.35 0.44 186 TR_LOTS_OF_MONEY3 2187 0.60 1.07 0.44 187 XMLngstWrd_00 2132 0.42 0.38 0.43 188 PDS_OTHER_BAD_TLD 2103 1.74 5.50 0.42 189 HTML_IMAGE_ONLY_28 2091 0.43 0.45 0.42 190 XMPhish14 2065 0.52 0.82 0.42 191 XM_Body_Obfu01 2054 0.39 0.32 0.41 192 XMSlimDrugH 2052 0.58 1.06 0.41 193 AC_DIV_BONANZA 1993 0.32 0.07 0.40 194 FILL_THIS_FORM_LONG 1981 0.36 0.23 0.40 195 TM2_M_BODY_EMPTY 1951 0.31 0.08 0.39 196 XMLngstWrd_01 1944 0.38 0.35 0.39 197 HTML_IMAGE_ONLY_24 1923 0.46 0.66 0.39 198 TR_LOTS_OF_MONEY2 1909 0.54 0.99 0.39 199 T_MONEY_PERCENT 1909 0.54 0.99 0.39 200 T_FILL_THIS_FORM_LOAN 1883 0.30 0.07 0.38 ----------------------------------------------------------------------