Email: 731380 Autolearn: 0 AvgScore: 1.48 AvgScanTime: 4.07 sec Spam: 164752 Autolearn: 0 AvgScore: 14.70 AvgScanTime: 4.82 sec Ham: 566628 Autolearn: 0 AvgScore: -2.36 AvgScanTime: 3.86 sec Time Spent Running SA: 827.60 hours Time Spent Processing Spam: 220.39 hours Time Spent Processing Ham: 607.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155205 88.79 94.21 87.22 2 DCC_CHECK 122185 44.55 74.16 35.94 3 XM_B_Unicode 97253 67.75 59.03 70.29 4 DKIM_SIGNED 93997 64.66 57.05 66.88 5 XM_DK_Pass 90410 63.24 54.88 65.68 6 MIME_HTML_ONLY 85841 29.78 52.10 23.29 7 DKIM_VALID 85262 60.53 51.75 63.08 8 XMListUnsubscribeExists 77303 45.44 46.92 45.01 9 DKIM_VALID_AU 66270 45.67 40.22 47.25 10 BAYES_50 66007 45.20 40.06 46.69 11 XM_B_Unicode3 54857 39.84 33.30 41.74 12 FSL_BULK_SIG 47378 11.72 28.76 6.77 13 XM_UncommonTLD01 43761 10.22 26.56 5.47 14 XM_DK_Undo_02 43227 10.05 26.24 5.34 15 XM_B_Unsub 43219 13.57 26.23 9.89 16 HTML_FONT_LOW_CONTRAST 42289 24.63 25.67 24.33 17 RELAYCOUNTRY_META 41738 9.78 25.33 5.26 18 LOC_TINY_FONT_1 40898 21.33 24.82 20.31 19 DCC_CHECK_NEGATIVE 38359 53.34 23.28 62.08 20 T_TM2_M_HEADER_IN_MSG 38134 26.43 23.15 27.38 21 BOTNET 36953 6.58 22.43 1.98 22 BAYES_99 33951 6.47 20.61 2.37 23 XM_Multi_Part_URI 32507 12.22 19.73 10.03 24 XMSubLong 32064 19.60 19.46 19.64 25 DKIM_VALID_EF 31278 23.05 18.98 24.23 26 XM_Body_Dirty_Words 30167 13.52 18.31 12.13 27 BOTNET_IPINHOSTNAME 29249 7.12 17.75 4.03 28 FVGT_m_MULTI_ODD 29111 19.40 17.67 19.90 29 MultiRelay 27600 17.37 16.75 17.55 30 UNTRUSTED_Relay 27284 4.80 16.56 1.38 31 TR_DCC_Bayes_99 26741 4.28 16.23 0.81 32 KHOP_HELO_FCRDNS 26381 4.95 16.01 1.73 33 BAYES_999 26331 5.08 15.98 1.91 34 HTML_MIME_NO_HTML_TAG 25832 5.23 15.68 2.19 35 XMSexyCombo_05 24933 6.58 15.13 4.09 36 FROM_EXCESS_BASE64 24819 5.48 15.06 2.70 37 T_KAM_HTML_FONT_INVALID 22869 14.96 13.88 15.27 38 XM_B_Phish_Phrases 22204 7.43 13.48 5.68 39 HTML_SHORT_LINK_IMG_1 21988 3.03 13.35 0.03 40 SpammyFromTLD_02 20530 3.03 12.46 0.29 41 T_REMOTE_IMAGE 20244 7.26 12.29 5.79 42 RDNS_DYNAMIC 19929 2.97 12.10 0.32 43 XM_H_Long_From01 18510 6.57 11.24 5.21 44 HTML_IMAGE_RATIO_02 16691 7.54 10.13 6.79 45 TM2_M_URI_OPT_OUT 16410 4.61 9.96 3.05 46 FROM_SUSPICIOUS_NTLD 15705 2.16 9.53 0.02 47 FROM_SUSPICIOUS_NTLD_FP 15619 2.15 9.48 0.02 48 XMSubMetaSx_00 15599 5.03 9.47 3.74 49 DKIM_ADSP_NXDOMAIN 15569 4.44 9.45 2.99 50 LOTS_OF_MONEY 15500 8.39 9.41 8.09 51 XM_Evil_Numbers_Gen 15320 9.14 9.30 9.10 52 RCVD_IN_BL_SPAMCOP_NET 14910 2.89 9.05 1.10 53 XMPhish11 14314 2.74 8.69 1.02 54 XMHTML_After_End 14257 2.68 8.65 0.94 55 ALL_TRUSTED 13891 13.33 8.43 14.76 56 BAYES_60 13773 5.34 8.36 4.47 57 RCVD_IN_RP_RNBL 13500 1.93 8.19 0.11 58 XMBody_78 13337 2.04 8.10 0.28 59 BAYES_20 13262 7.14 8.05 6.87 60 XM_H_PHPMailer 13242 2.16 8.04 0.45 61 XM_UB50 13124 2.43 7.97 0.82 62 BAYES_80 13089 3.50 7.94 2.21 63 XM_SPF_SoftFail 12775 2.96 7.75 1.57 64 XM_DIRTYINTL 12751 3.86 7.74 2.74 65 HTML_IMAGE_ONLY_12 12618 1.85 7.66 0.16 66 AMAZON_IMG_NOT_RCVD_AMZN 12446 1.72 7.55 0.03 67 XM_NotFromAmazon 12253 1.69 7.44 0.03 68 FROM_NO_USER 12164 1.67 7.38 0.00 69 URIBL_RHS_DOB 12123 1.66 7.36 0.00 70 TR_Mismatch_TLD_02 10793 1.53 6.55 0.06 71 HTML_FONT_SIZE_LARGE 10650 1.53 6.46 0.10 72 XMNumbers 10613 4.40 6.44 3.80 73 RCVD_IN_MSPIKE_H2 10423 8.98 6.33 9.75 74 RCVD_IN_MSPIKE_BL 10126 2.15 6.15 0.98 75 XM_B_SpammyTLD 10029 2.89 6.09 1.96 76 LotsOfNums_01 9971 6.84 6.05 7.07 77 BODY_URI_ONLY 9771 1.39 5.93 0.07 78 TooManyTo_001 9696 6.80 5.89 7.07 79 PDS_OTHER_BAD_TLD 9604 1.63 5.83 0.40 80 HTML_IMAGE_ONLY_08 9529 1.38 5.78 0.10 81 MPART_ALT_DIFF 9484 8.07 5.76 8.74 82 BOTNET_NORDNS 8853 1.25 5.37 0.05 83 DKIM_INVALID 8735 4.13 5.30 3.79 84 RCVD_IN_PSBL 8723 1.23 5.29 0.04 85 BAYES_40 8346 6.91 5.07 7.45 86 HDRS_LCASE_IMGONLY 8284 1.14 5.03 0.01 87 MIME_HEADER_CTYPE_ONLY 8168 1.16 4.96 0.06 88 T_TooManySym_01 8008 4.29 4.86 4.13 89 HTML_TAG_BALANCE_CENTER 7792 1.14 4.73 0.10 90 SHORT_IMG_SUSP_NTLD 7645 1.05 4.64 0.00 91 TO_MALFORMED 7109 1.88 4.31 1.18 92 DIET_1 6756 1.33 4.10 0.52 93 BAYES_95 6752 1.87 4.10 1.22 94 RCVD_IN_MSPIKE_L5 6454 1.01 3.92 0.17 95 SpammyFromTLD_01 6388 1.41 3.88 0.69 96 HTML_IMAGE_RATIO_04 6371 10.76 3.87 12.77 97 XMStrtUSub 6215 7.27 3.77 8.28 98 NO_DNS_FOR_FROM 6133 3.60 3.72 3.56 99 RELAYCOUNTRY_GB 6113 1.69 3.71 1.10 100 REPLYTO_WITHOUT_TO_CC 6041 0.86 3.67 0.04 101 XM_SendGrid 5784 5.02 3.51 5.46 102 TO_EQ_FM_DOM_HTML_IMG 5695 0.79 3.46 0.01 103 XM_CamelCaseFrm001 5591 2.18 3.39 1.83 104 BAYES_00 5478 19.50 3.32 24.20 105 MIME_QP_LONG_LINE 5452 4.99 3.31 5.48 106 RELAYCOUNTRY_CA 5429 2.06 3.30 1.70 107 RELAYCOUNTRY_FR 5380 1.00 3.27 0.35 108 XM_BadFromFormat 5368 0.81 3.26 0.10 109 MultiRelay_CC 5358 0.90 3.25 0.21 110 MultiRelay_Combo 5358 0.90 3.25 0.21 111 MIME_HTML_ONLY_MULTI 5344 6.31 3.24 7.20 112 XM_URI_RBL 5183 0.87 3.15 0.20 113 MIME_HTML_MOSTLY 5088 2.58 3.09 2.44 114 XMSubMetaSSx_00 4961 0.76 3.01 0.10 115 XMSubPhish11 4879 0.77 2.96 0.13 116 FROM_MISSP_REPLYTO 4764 0.66 2.89 0.01 117 URIBL_DBL_ABUSE_REDIR 4685 0.64 2.84 0.00 118 HTML_EXTRA_CLOSE 4412 0.62 2.68 0.02 119 RCVD_IN_MSPIKE_H3 4399 7.55 2.67 8.97 120 RCVD_IN_MSPIKE_WL 4399 7.55 2.67 8.97 121 FROM_MISSP_DYNIP 4278 0.59 2.60 0.00 122 RELAYCOUNTRY_DE 4225 0.86 2.56 0.37 123 DATE_IN_PAST_03_06 3934 1.57 2.39 1.33 124 LongTLD 3846 0.63 2.33 0.13 125 HK_RANDOM_FROM 3839 0.63 2.33 0.13 126 BODY_SINGLE_WORD 3808 0.53 2.31 0.01 127 T_XMDrugObfuBody_08 3790 1.56 2.30 1.35 128 BODY_SINGLE_URI 3742 0.52 2.27 0.01 129 HTML_IMAGE_RATIO_06 3717 3.84 2.26 4.29 130 XMSexyCombo_01 3669 1.38 2.23 1.14 131 HDRS_MISSP 3627 0.50 2.20 0.01 132 RELAYCOUNTRY_CN 3606 0.54 2.19 0.06 133 XM_B_Unsub2 3521 1.88 2.14 1.81 134 XM_UB99 3423 0.47 2.08 0.00 135 NORDNS_LOW_CONTRAST 3387 0.47 2.06 0.00 136 BAYES_05 3385 3.65 2.05 4.11 137 TR_XM_RelayPhish 3376 1.07 2.05 0.78 138 UNPARSEABLE_RELAY 3282 2.07 1.99 2.09 139 HTML_IMAGE_RATIO_08 3263 2.30 1.98 2.39 140 URI_TRY_3LD 3039 1.08 1.84 0.86 141 URI_HEX 2958 1.40 1.80 1.29 142 T_XMDrugObfuBody_14 2932 2.15 1.78 2.26 143 XM_H_TOP 2912 0.40 1.77 0.01 144 TR_XM_DK_SendGrid 2911 2.81 1.77 3.11 145 TR_MetaPhish_Combo_01 2819 1.06 1.71 0.88 146 XMDiploma_00 2817 1.50 1.71 1.44 147 RELAYCOUNTRY_IN 2788 0.45 1.69 0.09 148 CHARSET_FARAWAY_HEADER 2779 0.42 1.69 0.05 149 XM_UB999 2765 0.38 1.68 0.00 150 XM_SPF_Unknown 2648 0.95 1.61 0.75 151 MIME_CHARSET_FARAWAY 2552 0.45 1.55 0.13 152 TR_XM_INV_DKIM 2524 0.45 1.53 0.13 153 T_Symld_Words_02 2513 0.80 1.53 0.58 154 RCVD_IN_MSPIKE_L3 2496 0.74 1.52 0.52 155 TR_LOTS_OF_MONEY2 2453 0.50 1.49 0.21 156 T_MONEY_PERCENT 2453 0.50 1.49 0.21 157 DKIM_ADSP_CUSTOM_MED 2393 0.99 1.45 0.86 158 XM_OfRef6 2376 1.21 1.44 1.14 159 DATE_IN_PAST_06_12 2364 0.37 1.43 0.07 160 FVGT_m_MULTI_ODD_EMAIL 2320 0.33 1.41 0.02 161 TR_Symld_Words 2315 1.65 1.41 1.72 162 XM_UB60 2232 0.35 1.35 0.05 163 RELAYCOUNTRY_RU 2195 0.32 1.33 0.02 164 NML_ADSP_CUSTOM_MED 2182 0.76 1.32 0.59 165 TVD_SPACE_RATIO_MINFP 2171 0.30 1.32 0.01 166 SERGIO_SUBJECT_PORN014 2132 0.29 1.29 0.00 167 FORGED_GMAIL_RCVD 2109 0.64 1.28 0.46 168 TR_XM_PHPDW 2107 0.66 1.28 0.48 169 XMSlimDrugH 2075 0.50 1.26 0.28 170 XMBody_17 2038 0.97 1.24 0.89 171 XMSubNoVowel 2030 3.46 1.23 4.10 172 TR_XM_DK_Bayes 2022 11.09 1.23 13.96 173 RCVD_IN_IADB_LISTED 2021 3.61 1.23 4.31 174 XMStockSpam_06 2020 1.29 1.23 1.31 175 XMSubMetaI_00 2004 0.70 1.22 0.54 176 FROM_MISSP_EH_MATCH 1996 0.28 1.21 0.01 177 TR_XM_PHPForged 1987 0.64 1.21 0.47 178 SUBJ_ALL_CAPS 1984 1.28 1.20 1.30 179 TR_XM_FormFill2 1964 0.63 1.19 0.47 180 XM_H_PHPOS 1955 0.63 1.19 0.46 181 TM2_M_VERY_LONG_WORD 1906 1.10 1.16 1.08 182 XM_DK_Undo_01 1897 1.40 1.15 1.47 183 TR_XM_DK_Bayes1 1880 10.68 1.14 13.46 184 XMGenDplmaNmb 1874 1.01 1.14 0.98 185 XM_ProductURIs 1854 0.66 1.13 0.52 186 HK_RANDOM_REPLYTO 1852 0.39 1.12 0.18 187 XMMoneyMeta_00 1850 0.61 1.12 0.46 188 XMSubMetaSxObfu_03 1845 0.84 1.12 0.76 189 MAILING_LIST_MULTI 1842 1.96 1.12 2.21 190 RCVD_IN_IADB_SPF 1822 3.16 1.11 3.75 191 XM_UB80 1800 0.26 1.09 0.01 192 RCVD_IN_IADB_SENDERID 1757 2.77 1.07 3.26 193 RCVD_IN_IADB_DK 1747 2.75 1.06 3.24 194 TVD_RCVD_SPACE_BRACKET 1730 0.24 1.05 0.00 195 CK_HELO_GENERIC 1701 0.25 1.03 0.02 196 CHARSET_FARAWAY 1681 0.23 1.02 0.00 197 TR_XM_DK_Bayes2 1642 9.47 1.00 11.93 198 INVALID_MSGID 1638 1.25 0.99 1.32 199 NO_FM_NAME_IP_HOSTN 1629 0.22 0.99 0.00 200 T_XMDrugObfuBody_00 1616 0.75 0.98 0.69 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 494203 88.79 94.21 87.22 2 XM_B_Unicode 398269 67.75 59.03 70.29 3 DKIM_SIGNED 378944 64.66 57.05 66.88 4 XM_DK_Pass 372150 63.24 54.88 65.68 5 DKIM_VALID 357456 60.53 51.75 63.08 6 DCC_CHECK_NEGATIVE 351771 53.34 23.28 62.08 7 DKIM_VALID_AU 267737 45.67 40.22 47.25 8 BAYES_50 264585 45.20 40.06 46.69 9 XMListUnsubscribeExists 255062 45.44 46.92 45.01 10 XM_B_Unicode3 236500 39.84 33.30 41.74 11 DCC_CHECK 203652 44.55 74.16 35.94 12 T_TM2_M_HEADER_IN_MSG 155164 26.43 23.15 27.38 13 HTML_FONT_LOW_CONTRAST 137868 24.63 25.67 24.33 14 DKIM_VALID_EF 137293 23.05 18.98 24.23 15 BAYES_00 137124 19.50 3.32 24.20 16 MIME_HTML_ONLY 131969 29.78 52.10 23.29 17 LOC_TINY_FONT_1 115100 21.33 24.82 20.31 18 FVGT_m_MULTI_ODD 112745 19.40 17.67 19.90 19 XMSubLong 111259 19.60 19.46 19.64 20 MultiRelay 99415 17.37 16.75 17.55 21 T_KAM_HTML_FONT_INVALID 86529 14.96 13.88 15.27 22 ALL_TRUSTED 83627 13.33 8.43 14.76 23 TR_XM_DK_Bayes 79081 11.09 1.23 13.96 24 TR_XM_DK_Bayes1 76254 10.68 1.14 13.46 25 HTML_IMAGE_RATIO_04 72354 10.76 3.87 12.77 26 XM_Body_Dirty_Words 68752 13.52 18.31 12.13 27 TR_XM_DK_Bayes2 67603 9.47 1.00 11.93 28 XM_H_Trusted_IP 65675 8.98 0.00 11.59 29 XM_Multi_Part_URI 56833 12.22 19.73 10.03 30 XM_B_Unsub 56039 13.57 26.23 9.89 31 RCVD_IN_MSPIKE_H2 55272 8.98 6.33 9.75 32 HTML_FONT_FACE_BAD 54009 7.57 0.82 9.53 33 XM_Evil_Numbers_Gen 51564 9.14 9.30 9.10 34 RCVD_IN_MSPIKE_WL 50811 7.55 2.67 8.97 35 RCVD_IN_MSPIKE_H3 50810 7.55 2.67 8.97 36 MPART_ALT_DIFF 49502 8.07 5.76 8.74 37 XMStrtUSub 46930 7.27 3.77 8.28 38 LOTS_OF_MONEY 45857 8.39 9.41 8.09 39 BAYES_40 42202 6.91 5.07 7.45 40 MIME_HTML_ONLY_MULTI 40797 6.31 3.24 7.20 41 TooManyTo_001 40064 6.80 5.89 7.07 42 LotsOfNums_01 40063 6.84 6.05 7.07 43 BAYES_20 38928 7.14 8.05 6.87 44 HTML_IMAGE_RATIO_02 38476 7.54 10.13 6.79 45 FSL_BULK_SIG 38365 11.72 28.76 6.77 46 XM_DKIMWhitelistDomains 37550 5.15 0.07 6.63 47 T_REMOTE_IMAGE 32831 7.26 12.29 5.79 48 XM_B_Phish_Phrases 32158 7.43 13.48 5.68 49 MIME_QP_LONG_LINE 31031 4.99 3.31 5.48 50 XM_UncommonTLD01 30979 10.22 26.56 5.47 51 XM_SendGrid 30940 5.02 3.51 5.46 52 XM_DK_Undo_02 30286 10.05 26.24 5.34 53 RELAYCOUNTRY_META 29814 9.78 25.33 5.26 54 XM_H_Long_From01 29549 6.57 11.24 5.21 55 BAYES_60 25304 5.34 8.36 4.47 56 ANY_BOUNCE_MESSAGE 25252 3.55 0.45 4.46 57 BOUNCE_MESSAGE 25250 3.55 0.45 4.46 58 RCVD_IN_IADB_LISTED 24405 3.61 1.23 4.31 59 HTML_IMAGE_RATIO_06 24334 3.84 2.26 4.29 60 T_TooManySym_01 23387 4.29 4.86 4.13 61 BAYES_05 23278 3.65 2.05 4.11 62 XMSubNoVowel 23249 3.46 1.23 4.10 63 XMSexyCombo_05 23168 6.58 15.13 4.09 64 XM_PDF 22922 3.30 0.75 4.05 65 BOTNET_IPINHOSTNAME 22848 7.12 17.75 4.03 66 XMNumbers 21540 4.40 6.44 3.80 67 DKIM_INVALID 21488 4.13 5.30 3.79 68 RCVD_IN_IADB_SPF 21261 3.16 1.11 3.75 69 XMSubMetaSx_00 21217 5.03 9.47 3.74 70 NO_DNS_FOR_FROM 20177 3.60 3.72 3.56 71 RCVD_IN_IADB_SENDERID 18487 2.77 1.07 3.26 72 RCVD_IN_IADB_DK 18334 2.75 1.06 3.24 73 RCVD_IN_RP_SAFE 17726 2.59 0.75 3.13 74 IN_ZIMBRA_NJ_WHITELIST 17680 2.42 0.02 3.12 75 TR_XM_DK_SendGrid 17624 2.81 1.77 3.11 76 TM2_M_URI_OPT_OUT 17286 4.61 9.96 3.05 77 DKIM_ADSP_NXDOMAIN 16932 4.44 9.45 2.99 78 RCVD_IN_RP_CERTIFIED 16580 2.37 0.47 2.93 79 XM_DIRTYINTL 15512 3.86 7.74 2.74 80 RCVD_IN_IADB_VOUCHED 15446 2.20 0.40 2.73 81 FROM_EXCESS_BASE64 15271 5.48 15.06 2.70 82 AC_FROM_MANY_DOTS 15217 2.09 0.03 2.69 83 MIME_HTML_MOSTLY 13814 2.58 3.09 2.44 84 HTML_IMAGE_RATIO_08 13543 2.30 1.98 2.39 85 BAYES_99 13403 6.47 20.61 2.37 86 T_XMDrugObfuBody_14 12787 2.15 1.78 2.26 87 BAYES_80 12542 3.50 7.94 2.21 88 MAILING_LIST_MULTI 12513 1.96 1.12 2.21 89 HTML_MIME_NO_HTML_TAG 12434 5.23 15.68 2.19 90 UNPARSEABLE_RELAY 11822 2.07 1.99 2.09 91 BOTNET 11207 6.58 22.43 1.98 92 XM_B_SpammyTLD 11132 2.89 6.09 1.96 93 T_TooManySym_02 11116 1.65 0.57 1.96 94 TooManyTo_002 10847 1.63 0.66 1.91 95 BAYES_999 10798 5.08 15.98 1.91 96 XM_CamelCaseFrm001 10382 2.18 3.39 1.83 97 XM_B_Unsub2 10264 1.88 2.14 1.81 98 KHOP_HELO_FCRDNS 9800 4.95 16.01 1.73 99 TR_Symld_Words 9771 1.65 1.41 1.72 100 RCVD_IN_IADB_OPTIN 9766 1.40 0.28 1.72 101 RELAYCOUNTRY_CA 9629 2.06 3.30 1.70 102 XM_SPF_SoftFail 8869 2.96 7.75 1.57 103 TVD_RCVD_IP 8777 1.32 0.54 1.55 104 HELO_NODOT 8407 1.26 0.51 1.48 105 HELO_NO_DOMAIN 8397 1.26 0.50 1.48 106 XM_DK_Undo_01 8337 1.40 1.15 1.47 107 XMDiploma_00 8173 1.50 1.71 1.44 108 UNTRUSTED_Relay 7831 4.80 16.56 1.38 109 T_XMDrugObfuBody_08 7647 1.56 2.30 1.35 110 IN_HORDE_ADDRESS_BOOK 7557 1.04 0.02 1.33 111 DATE_IN_PAST_03_06 7545 1.57 2.39 1.33 112 INVALID_MSGID 7482 1.25 0.99 1.32 113 XMStockSpam_06 7437 1.29 1.23 1.31 114 SUBJ_ALL_CAPS 7390 1.28 1.20 1.30 115 URI_HEX 7295 1.40 1.80 1.29 116 TooManyTo_003 7221 1.10 0.51 1.27 117 CK_HELO_DYNAMIC_SPLIT_IP 7115 1.12 0.67 1.26 118 HELO_DYNAMIC_IPADDR2 7104 1.04 0.31 1.25 119 XMSubLongNoVowel 7002 1.00 0.18 1.24 120 BAYES_95 6938 1.87 4.10 1.22 121 XMSubGarbage 6937 0.96 0.06 1.22 122 XMCapTrack 6747 0.99 0.28 1.19 123 USER_IN_DEF_DKIM_WL 6742 0.93 0.03 1.19 124 TO_MALFORMED 6664 1.88 4.31 1.18 125 XM_OfRef6 6480 1.21 1.44 1.14 126 XMSexyCombo_01 6455 1.38 2.23 1.14 127 RCVD_IN_BL_SPAMCOP_NET 6241 2.89 9.05 1.10 128 RELAYCOUNTRY_GB 6236 1.69 3.71 1.10 129 TM2_M_VERY_LONG_WORD 6124 1.10 1.16 1.08 130 XMGappySubj_01 6011 0.92 0.45 1.06 131 XM_H_Long_From02 5939 0.96 0.67 1.05 132 XM_GoogleGroups 5896 0.87 0.30 1.04 133 XMPhish11 5753 2.74 8.69 1.02 134 XM_E_Blogspot 5599 0.78 0.05 0.99 135 RCVD_IN_MSPIKE_BL 5575 2.15 6.15 0.98 136 XMGenDplmaNmb 5539 1.01 1.14 0.98 137 XMHTML_After_End 5334 2.68 8.65 0.94 138 XMBody_17 5029 0.97 1.24 0.89 139 TR_MetaPhish_Combo_01 4964 1.06 1.71 0.88 140 XMBdyGiftCard01 4936 0.82 0.66 0.87 141 TooManyTo_004 4928 0.77 0.41 0.87 142 T_FILL_THIS_FORM_SHORT 4925 0.89 0.95 0.87 143 URI_TRY_3LD 4882 1.08 1.84 0.86 144 DKIM_ADSP_CUSTOM_MED 4866 0.99 1.45 0.86 145 XM_UB50 4667 2.43 7.97 0.82 146 TR_DCC_Bayes_99 4564 4.28 16.23 0.81 147 TR_XM_RelayPhish 4440 1.07 2.05 0.78 148 XMSubMetaSxObfu_03 4325 0.84 1.12 0.76 149 XM_SPF_Unknown 4278 0.95 1.61 0.75 150 XMSexyCombo_04 4213 0.78 0.92 0.74 151 TooManyTo_005 4071 0.64 0.36 0.72 152 SpammyFromTLD_01 3917 1.41 3.88 0.69 153 T_XMDrugObfuBody_00 3890 0.75 0.98 0.69 154 FROM_GOV_DKIM_AU 3824 0.57 0.21 0.67 155 XMNoVowels 3712 0.59 0.37 0.66 156 XMBody_95 3538 0.51 0.12 0.62 157 XM_ShortIntro_01 3367 0.53 0.31 0.59 158 NML_ADSP_CUSTOM_MED 3347 0.76 1.32 0.59 159 T_Symld_Words_02 3309 0.80 1.53 0.58 160 XMBrknScrpt_02 3217 0.62 0.81 0.57 161 HTTPS_HTTP_MISMATCH 3192 0.59 0.67 0.56 162 XMSubMetaI_00 3087 0.70 1.22 0.54 163 RCVD_IN_MSPIKE_L3 2952 0.74 1.52 0.52 164 XM_ProductURIs 2946 0.66 1.13 0.52 165 DIET_1 2944 1.33 4.10 0.52 166 T_OBFU_PDF_ATTACH 2809 0.44 0.24 0.50 167 TR_XM_PHPDW 2742 0.66 1.28 0.48 168 AC_DIV_BONANZA 2737 0.40 0.12 0.48 169 T_XMHurry_00 2718 0.56 0.83 0.48 170 XM_Body_Obfu01 2691 0.47 0.43 0.47 171 FILL_THIS_FORM 2676 0.44 0.34 0.47 172 TR_XM_PHPForged 2661 0.64 1.21 0.47 173 XMSubMetaSx_01 2657 0.48 0.53 0.47 174 TR_XM_FormFill2 2652 0.63 1.19 0.47 175 XM_H_PHPOS 2624 0.63 1.19 0.46 176 T_TooManySym_03 2616 0.40 0.18 0.46 177 XMMoneyMeta_00 2614 0.61 1.12 0.46 178 FORGED_GMAIL_RCVD 2583 0.64 1.28 0.46 179 XM_H_PHPMailer 2562 2.16 8.04 0.45 180 RELAYCOUNTRY_AU 2526 0.45 0.48 0.45 181 USER_IN_WHITELIST 2459 0.34 0.00 0.43 182 HTML_IMAGE_ONLY_20 2433 0.38 0.22 0.43 183 HTML_TAG_BALANCE_BODY 2423 0.49 0.70 0.43 184 HTML_IMAGE_ONLY_32 2353 0.36 0.19 0.42 185 TR_LOTS_OF_MONEY3 2351 0.48 0.70 0.41 186 PLING_QUERY 2327 0.40 0.36 0.41 187 XMHTMLBadTable_001 2309 0.45 0.62 0.41 188 MISSING_HEADERS 2303 0.41 0.41 0.41 189 PDS_OTHER_BAD_TLD 2281 1.63 5.83 0.40 190 HTML_IMAGE_ONLY_28 2257 0.45 0.62 0.40 191 XM_B_REG_HTML 2234 0.52 0.95 0.39 192 XMDateMe_00 2222 0.38 0.35 0.39 193 SHORT_HELO_AND_INLINE_IMAGE 2212 0.31 0.03 0.39 194 XMPhish30 2199 0.48 0.81 0.39 195 XMLngstWrd_00 2088 0.37 0.40 0.37 196 HTML_IMAGE_ONLY_24 2078 0.38 0.42 0.37 197 RELAYCOUNTRY_DE 2076 0.86 2.56 0.37 198 FILL_THIS_FORM_LONG 2067 0.35 0.28 0.36 199 XMSolicitRefs_0 2050 0.36 0.34 0.36 200 FSL_THIS_IS_ADV 2045 0.32 0.20 0.36 ----------------------------------------------------------------------