Email: 563073 Autolearn: 0 AvgScore: 3.49 AvgScanTime: 4.06 sec Spam: 157351 Autolearn: 0 AvgScore: 16.01 AvgScanTime: 4.82 sec Ham: 405722 Autolearn: 0 AvgScore: -1.37 AvgScanTime: 3.76 sec Time Spent Running SA: 635.11 hours Time Spent Processing Spam: 210.86 hours Time Spent Processing Ham: 424.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140938 88.37 89.57 87.91 2 DCC_CHECK 124046 51.76 78.83 41.25 3 XM_B_Unicode 98633 66.44 62.68 67.89 4 DKIM_SIGNED 90369 71.69 57.43 77.21 5 XM_DK_Pass 87450 70.42 55.58 76.18 6 DKIM_VALID 82139 66.76 52.20 72.41 7 XMListUnsubscribeExists 80330 51.60 51.05 51.81 8 MIME_HTML_ONLY 71574 27.64 45.49 20.72 9 BAYES_50 67255 51.06 42.74 54.28 10 DKIM_VALID_AU 63307 52.51 40.23 57.28 11 XM_B_Unicode3 56287 39.40 35.77 40.81 12 RELAYCOUNTRY_META 46395 12.21 29.49 5.51 13 FSL_BULK_SIG 45774 12.69 29.09 6.33 14 HTML_FONT_LOW_CONTRAST 43263 27.75 27.49 27.85 15 BOTNET 41147 8.74 26.15 1.99 16 XM_UncommonTLD01 39233 9.84 24.93 3.98 17 XM_DK_Undo_02 39216 11.24 24.92 5.93 18 LOC_TINY_FONT_1 39095 23.66 24.85 23.20 19 BAYES_99 37621 8.86 23.91 3.02 20 UNTRUSTED_Relay 35668 7.64 22.67 1.81 21 FVGT_m_MULTI_ODD 32117 20.79 20.41 20.94 22 URIBL_RHS_DOB 31887 15.71 20.26 13.94 23 XM_Body_Dirty_Words 31487 15.23 20.01 13.38 24 DCC_CHECK_NEGATIVE 29988 46.51 19.06 57.15 25 BOTNET_IPINHOSTNAME 29365 8.63 18.66 4.74 26 BAYES_999 29033 6.93 18.45 2.47 27 T_TM2_M_HEADER_IN_MSG 28880 26.32 18.35 29.41 28 DKIM_VALID_EF 28630 26.05 18.19 29.10 29 XMSubLong 28262 20.50 17.96 21.48 30 T_KAM_HTML_FONT_INVALID 27471 16.91 17.46 16.70 31 TR_DCC_Bayes_99 25767 5.47 16.38 1.24 32 XM_B_Unsub 24204 12.51 15.38 11.40 33 MultiRelay 23854 16.84 15.16 17.49 34 KHOP_HELO_FCRDNS 23816 5.84 15.14 2.23 35 XMSexyCombo_05 23496 7.32 14.93 4.36 36 HTML_MIME_NO_HTML_TAG 23398 5.93 14.87 2.46 37 XM_Multi_Part_URI 20673 12.60 13.14 12.39 38 HTML_SHORT_LINK_IMG_1 20118 3.61 12.79 0.05 39 HTML_IMAGE_RATIO_02 19630 10.22 12.48 9.34 40 RCVD_IN_RP_RNBL 19204 3.51 12.20 0.14 41 RDNS_DYNAMIC 18336 3.55 11.65 0.40 42 SpammyFromTLD_02 18155 3.39 11.54 0.24 43 RCVD_IN_BL_SPAMCOP_NET 18132 3.92 11.52 0.97 44 T_REMOTE_IMAGE 17713 5.89 11.26 3.81 45 XM_H_Long_From01 17399 7.22 11.06 5.74 46 XM_SPF_SoftFail 16537 4.34 10.51 1.94 47 LOTS_OF_MONEY 16512 8.39 10.49 7.57 48 XMNumbers 16457 5.69 10.46 3.84 49 XMSubMetaSx_00 15092 5.17 9.59 3.45 50 XM_Evil_Numbers_Gen 14729 9.59 9.36 9.68 51 HTML_IMAGE_ONLY_08 14293 2.62 9.08 0.11 52 XM_UB50 14098 3.16 8.96 0.91 53 FROM_EXCESS_BASE64 13424 5.08 8.53 3.74 54 RCVD_IN_MSPIKE_H2 13085 10.87 8.32 11.86 55 BAYES_60 12982 5.71 8.25 4.73 56 FROM_SUSPICIOUS_NTLD 12515 2.25 7.95 0.03 57 FROM_SUSPICIOUS_NTLD_FP 12425 2.23 7.90 0.03 58 BAYES_80 12360 3.85 7.86 2.30 59 DKIM_ADSP_NXDOMAIN 12343 2.78 7.84 0.82 60 XM_B_Phish_Phrases 11973 5.82 7.61 5.13 61 RCVD_IN_MSPIKE_BL 11589 3.02 7.37 1.33 62 MPART_ALT_DIFF 11326 4.99 7.20 4.13 63 HDRS_LCASE_IMGONLY 10641 1.90 6.76 0.01 64 BOTNET_NORDNS 10404 1.88 6.61 0.05 65 REPLYTO_WITHOUT_TO_CC 10260 1.86 6.52 0.05 66 XM_DIRTYINTL 10181 3.59 6.47 2.47 67 T_XMDrugObfuBody_08 10132 2.71 6.44 1.26 68 LotsOfNums_01 10088 7.37 6.41 7.74 69 BODY_URI_ONLY 10029 1.85 6.37 0.09 70 RCVD_IN_PSBL 9850 1.79 6.26 0.05 71 HTML_TAG_BALANCE_CENTER 9752 1.82 6.20 0.12 72 HTML_IMAGE_RATIO_04 9290 6.43 5.90 6.63 73 TR_Mismatch_TLD_02 9233 1.71 5.87 0.10 74 SHORT_IMG_SUSP_NTLD 8344 1.48 5.30 0.00 75 DKIM_INVALID 8230 4.92 5.23 4.81 76 XM_UB99 8175 1.46 5.20 0.01 77 RELAYCOUNTRY_CA 8134 2.68 5.17 1.71 78 TooManyTo_001 8006 7.45 5.09 8.36 79 BAYES_95 7970 2.45 5.07 1.43 80 RELAYCOUNTRY_FR 7604 1.57 4.83 0.30 81 XMSexyCombo_01 7165 1.58 4.55 0.43 82 XM_UB999 6966 1.24 4.43 0.00 83 HTML_IMAGE_RATIO_08 6956 2.79 4.42 2.15 84 XM_SendGrid 6865 5.49 4.36 5.93 85 RCVD_IN_MSPIKE_L5 6849 1.35 4.35 0.19 86 PDS_FROM_2_EMAILS 6721 1.22 4.27 0.04 87 FROM_2_EMAILS_SHORT 6693 1.19 4.25 0.01 88 SpammyFromTLD_01 6650 1.66 4.23 0.67 89 XMSubMetaD_00 6619 1.22 4.21 0.06 90 MIME_HEADER_CTYPE_ONLY 6575 1.25 4.18 0.11 91 XMStrtUSub 6554 5.50 4.17 6.02 92 SUBJ_BUY 6372 1.20 4.05 0.09 93 PDS_TO_EQ_FROM_NAME 6340 1.14 4.03 0.01 94 T_XMDrugObfuBody_00 6236 1.51 3.96 0.55 95 XMObfuSubjects 6200 1.11 3.94 0.02 96 TO_MALFORMED 6186 2.25 3.93 1.60 97 XMGppyBdWords 6178 1.19 3.93 0.12 98 NO_DNS_FOR_FROM 6110 2.31 3.88 1.70 99 BAYES_00 6088 15.88 3.87 20.54 100 NO_FM_NAME_IP_HOSTN 6024 1.08 3.83 0.01 101 XMSexyCombo_04 6022 1.16 3.83 0.12 102 XM_BadFromFormat 5876 1.12 3.73 0.10 103 ALL_TRUSTED 5843 10.71 3.71 13.42 104 MIME_HTML_MOSTLY 5832 3.06 3.71 2.81 105 DATE_IN_PAST_03_06 5794 1.15 3.68 0.17 106 TO_EQ_FM_DOM_HTML_IMG 5618 1.00 3.57 0.01 107 DRUGS_ERECTILE 5591 1.00 3.55 0.01 108 TR_XM_RelayPhish 5568 1.50 3.54 0.71 109 XM_CamelCaseFrm001 5437 2.43 3.46 2.03 110 XMDiploma_00 5408 1.89 3.44 1.29 111 DKIM_ADSP_CUSTOM_MED 5369 1.83 3.41 1.21 112 RCVD_IN_MSPIKE_WL 5362 7.96 3.41 9.73 113 RCVD_IN_MSPIKE_H3 5362 7.96 3.41 9.73 114 XMSubMetaD_01 5200 0.93 3.30 0.01 115 HTML_FONT_SIZE_LARGE 5181 1.01 3.29 0.12 116 XM_B_SpammyTLD 5086 2.24 3.23 1.85 117 BAYES_40 5074 5.20 3.22 5.97 118 MIME_QP_LONG_LINE 5071 4.59 3.22 5.12 119 NML_ADSP_CUSTOM_MED 5032 1.52 3.20 0.87 120 MISSING_HEADERS 4921 1.19 3.13 0.44 121 TR_Mismatch_TLD_01 4847 1.01 3.08 0.21 122 FORGED_GMAIL_RCVD 4802 1.33 3.05 0.66 123 XMSubMetaSSx_00 4786 0.97 3.04 0.17 124 XMGenDplmaNmb 4665 1.42 2.96 0.82 125 TM2_M_A_HREF_HREF 4501 1.07 2.86 0.37 126 HDRS_MISSP 4443 0.79 2.82 0.01 127 BAYES_20 4374 4.03 2.78 4.51 128 XMSpoofStaff2 4196 0.76 2.67 0.02 129 MIME_HTML_ONLY_MULTI 4146 2.63 2.63 2.62 130 WEIRD_PORT 4082 0.78 2.59 0.07 131 BODY_SINGLE_WORD 4030 0.72 2.56 0.01 132 PDS_OTHER_BAD_TLD 4029 1.00 2.56 0.39 133 DRUGS_ERECTILE_OBFU 3997 0.71 2.54 0.00 134 BODY_SINGLE_URI 3967 0.71 2.52 0.01 135 HTML_IMAGE_RATIO_06 3914 3.08 2.49 3.31 136 LongTLD 3767 0.79 2.39 0.16 137 T_XMDrugObfuBody_09 3721 0.70 2.36 0.05 138 FUZZY_PHARMACY 3709 0.66 2.36 0.00 139 TM2_M_URI_OPT_OUT 3703 2.18 2.35 2.11 140 T_TooManySym_01 3667 4.89 2.33 5.88 141 HTML_IMAGE_ONLY_04 3663 0.70 2.33 0.07 142 FROM_NTLD_LINKBAIT 3650 0.65 2.32 0.00 143 RELAYCOUNTRY_GB 3636 1.35 2.31 0.98 144 HTML_SHORT_CENTER 3567 0.64 2.27 0.00 145 MultiRelay_Combo 3545 0.78 2.25 0.22 146 MultiRelay_CC 3545 0.78 2.25 0.22 147 SUBJ_ALL_CAPS 3512 1.99 2.23 1.89 148 URI_HEX 3482 1.33 2.21 0.99 149 XM_URI_RBL 3418 0.80 2.17 0.27 150 HTML_IMAGE_ONLY_12 3310 0.72 2.10 0.19 151 XM_UB60 3310 0.64 2.10 0.08 152 HK_RANDOM_FROM 3245 0.70 2.06 0.17 153 XMSubMetaI_00 3239 1.42 2.06 1.17 154 XM_H_SpoofStaff4 3202 0.70 2.03 0.18 155 XMSlimDrugH 3197 0.83 2.03 0.37 156 DIET_1 3180 0.92 2.02 0.49 157 RCVD_IN_MSPIKE_L3 3039 1.20 1.93 0.91 158 MIMEOLE_DIRECT_TO_MX 3021 0.54 1.92 0.01 159 RELAYCOUNTRY_CN 3010 0.57 1.91 0.05 160 BAYES_05 2962 2.51 1.88 2.75 161 DATE_IN_PAST_06_12 2929 0.57 1.86 0.08 162 XM_Sft_Brands_C01 2927 0.54 1.86 0.03 163 XMBody_17 2917 1.18 1.85 0.91 164 NORDNS_LOW_CONTRAST 2897 0.52 1.84 0.01 165 RELAYCOUNTRY_IN 2853 0.61 1.81 0.15 166 TR_XM_DK_SendGrid 2849 2.84 1.81 3.24 167 MISSING_MIMEOLE 2746 0.55 1.75 0.09 168 XM_H_Long_From02 2725 1.35 1.73 1.21 169 URIBL_DBL_ABUSE_REDIR 2690 0.49 1.71 0.01 170 HK_RANDOM_REPLYTO 2677 0.68 1.70 0.28 171 URI_ONLY_MSGID_MALF 2652 0.48 1.69 0.01 172 XM_B_Unsub2 2627 3.41 1.67 4.08 173 TR_XM_DK_Bayes 2615 11.66 1.66 15.53 174 XMSubMetaSxObfu_03 2612 0.79 1.66 0.46 175 LONG_JUNK_URI 2546 0.48 1.62 0.04 176 HDR_ORDER_FTSDMCXX_DIRECT 2526 0.45 1.61 0.01 177 URI_NOVOWEL 2491 0.70 1.58 0.35 178 SUBJECT_DRUG_GAP_L 2483 0.44 1.58 0.00 179 XMSubMetaD_02 2447 0.44 1.56 0.00 180 FUZZY_PRICES 2437 0.44 1.55 0.00 181 HTML_EXTRA_CLOSE 2405 0.45 1.53 0.04 182 TM2_M_VERY_LONG_WORD 2396 1.38 1.52 1.33 183 XMPhish11 2368 1.15 1.50 1.01 184 RELAYCOUNTRY_DE 2323 0.82 1.48 0.57 185 TR_XM_DK_Bayes1 2319 11.11 1.47 14.85 186 SUBJECT_DRUG_GAP_C 2307 0.41 1.47 0.00 187 SUBJ_DOLLARS 2297 0.71 1.46 0.42 188 CHARSET_FARAWAY_HEADER 2292 0.44 1.46 0.05 189 XM_UB80 2250 0.42 1.43 0.02 190 XMMoneyMeta_00 2236 0.70 1.42 0.43 191 TR_XM_INV_DKIM 2184 0.45 1.39 0.08 192 TVD_SPACE_RATIO_MINFP 2170 0.39 1.38 0.01 193 TR_XM_PHPDW 2159 0.84 1.37 0.63 194 TR_Symld_Words 2156 1.30 1.37 1.28 195 MIME_CHARSET_FARAWAY 2148 0.48 1.37 0.14 196 DATE_IN_FUTURE_06_12 2143 0.39 1.36 0.01 197 THIS_AD 2128 0.76 1.35 0.54 198 TR_XM_PHPForged 2122 0.81 1.35 0.61 199 TR_XM_FormFill2 2103 0.76 1.34 0.54 200 XM_H_PHPOS 2095 0.75 1.33 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 356659 88.37 89.57 87.91 2 DKIM_SIGNED 313272 71.69 57.43 77.21 3 XM_DK_Pass 309094 70.42 55.58 76.18 4 DKIM_VALID 293776 66.76 52.20 72.41 5 XM_B_Unicode 275464 66.44 62.68 67.89 6 DKIM_VALID_AU 232382 52.51 40.23 57.28 7 DCC_CHECK_NEGATIVE 231874 46.51 19.06 57.15 8 BAYES_50 220242 51.06 42.74 54.28 9 XMListUnsubscribeExists 210221 51.60 51.05 51.81 10 DCC_CHECK 167380 51.76 78.83 41.25 11 XM_B_Unicode3 165558 39.40 35.77 40.81 12 T_TM2_M_HEADER_IN_MSG 119323 26.32 18.35 29.41 13 DKIM_VALID_EF 118067 26.05 18.19 29.10 14 HTML_FONT_LOW_CONTRAST 112998 27.75 27.49 27.85 15 LOC_TINY_FONT_1 94127 23.66 24.85 23.20 16 XMSubLong 87163 20.50 17.96 21.48 17 FVGT_m_MULTI_ODD 84961 20.79 20.41 20.94 18 MIME_HTML_ONLY 84066 27.64 45.49 20.72 19 BAYES_00 83337 15.88 3.87 20.54 20 MultiRelay 70972 16.84 15.16 17.49 21 T_KAM_HTML_FONT_INVALID 67745 16.91 17.46 16.70 22 TR_XM_DK_Bayes 63023 11.66 1.66 15.53 23 TR_XM_DK_Bayes1 60251 11.11 1.47 14.85 24 URIBL_RHS_DOB 56560 15.71 20.26 13.94 25 TR_XM_DK_Bayes2 55441 10.17 1.15 13.66 26 ALL_TRUSTED 54446 10.71 3.71 13.42 27 XM_Body_Dirty_Words 54282 15.23 20.01 13.38 28 XM_Multi_Part_URI 50287 12.60 13.14 12.39 29 RCVD_IN_MSPIKE_H2 48127 10.87 8.32 11.86 30 XM_B_Unsub 46235 12.51 15.38 11.40 31 RCVD_IN_MSPIKE_WL 39482 7.96 3.41 9.73 32 RCVD_IN_MSPIKE_H3 39480 7.96 3.41 9.73 33 XM_Evil_Numbers_Gen 39258 9.59 9.36 9.68 34 HTML_IMAGE_RATIO_02 37914 10.22 12.48 9.34 35 XM_DKIMWhitelistDomains 34057 6.06 0.03 8.39 36 TooManyTo_001 33917 7.45 5.09 8.36 37 LotsOfNums_01 31392 7.37 6.41 7.74 38 LOTS_OF_MONEY 30714 8.39 10.49 7.57 39 HTML_IMAGE_RATIO_04 26917 6.43 5.90 6.63 40 FSL_BULK_SIG 25695 12.69 29.09 6.33 41 XMStrtUSub 24413 5.50 4.17 6.02 42 BAYES_40 24222 5.20 3.22 5.97 43 XM_DK_Undo_02 24078 11.24 24.92 5.93 44 XM_SendGrid 24043 5.49 4.36 5.93 45 T_TooManySym_01 23859 4.89 2.33 5.88 46 XM_H_Long_From01 23276 7.22 11.06 5.74 47 RELAYCOUNTRY_META 22368 12.21 29.49 5.51 48 RCVD_IN_RP_SAFE 20938 4.03 1.12 5.16 49 XM_B_Phish_Phrases 20819 5.82 7.61 5.13 50 MIME_QP_LONG_LINE 20769 4.59 3.22 5.12 51 DKIM_INVALID 19496 4.92 5.23 4.81 52 BOTNET_IPINHOSTNAME 19238 8.63 18.66 4.74 53 BAYES_60 19184 5.71 8.25 4.73 54 RCVD_IN_RP_CERTIFIED 19132 3.61 0.77 4.72 55 BAYES_20 18309 4.03 2.78 4.51 56 RCVD_IN_IADB_LISTED 18098 3.56 1.24 4.46 57 XM_PDF 17722 3.28 0.46 4.37 58 XMSexyCombo_05 17697 7.32 14.93 4.36 59 MPART_ALT_DIFF 16764 4.99 7.20 4.13 60 XM_B_Unsub2 16554 3.41 1.67 4.08 61 XM_UncommonTLD01 16163 9.84 24.93 3.98 62 RCVD_IN_IADB_SPF 15651 3.11 1.18 3.86 63 XMNumbers 15578 5.69 10.46 3.84 64 T_REMOTE_IMAGE 15446 5.89 11.26 3.81 65 FROM_EXCESS_BASE64 15158 5.08 8.53 3.74 66 IN_ZIMBRA_NJ_WHITELIST 14183 2.55 0.10 3.50 67 XMSubMetaSx_00 14014 5.17 9.59 3.45 68 RCVD_IN_IADB_SENDERID 13594 2.74 1.16 3.35 69 RCVD_IN_IADB_DK 13458 2.72 1.16 3.32 70 HTML_IMAGE_RATIO_06 13442 3.08 2.49 3.31 71 T_TooManySym_02 13195 2.50 0.56 3.25 72 TR_XM_DK_SendGrid 13138 2.84 1.81 3.24 73 BAYES_99 12271 8.86 23.91 3.02 74 RCVD_IN_IADB_VOUCHED 12247 2.26 0.31 3.02 75 MIME_HTML_MOSTLY 11382 3.06 3.71 2.81 76 BAYES_05 11143 2.51 1.88 2.75 77 MIME_HTML_ONLY_MULTI 10645 2.63 2.63 2.62 78 XM_H_Trusted_IP 10254 1.82 0.00 2.53 79 TVD_RCVD_IP 10175 2.03 0.82 2.51 80 XM_DIRTYINTL 10032 3.59 6.47 2.47 81 BAYES_999 10009 6.93 18.45 2.47 82 HTML_MIME_NO_HTML_TAG 9975 5.93 14.87 2.46 83 UNPARSEABLE_RELAY 9691 2.08 1.28 2.39 84 BAYES_80 9322 3.85 7.86 2.30 85 KHOP_HELO_FCRDNS 9045 5.84 15.14 2.23 86 MAILING_LIST_MULTI 8888 1.90 1.15 2.19 87 TooManyTo_002 8856 1.74 0.61 2.18 88 HTML_IMAGE_RATIO_08 8729 2.79 4.42 2.15 89 TM2_M_URI_OPT_OUT 8549 2.18 2.35 2.11 90 XM_CamelCaseFrm001 8221 2.43 3.46 2.03 91 BOTNET 8078 8.74 26.15 1.99 92 XM_SPF_SoftFail 7873 4.34 10.51 1.94 93 SUBJ_ALL_CAPS 7671 1.99 2.23 1.89 94 RCVD_IN_IADB_OPTIN 7609 1.43 0.27 1.88 95 ANY_BOUNCE_MESSAGE 7549 1.46 0.42 1.86 96 BOUNCE_MESSAGE 7548 1.46 0.42 1.86 97 XM_B_SpammyTLD 7505 2.24 3.23 1.85 98 UNTRUSTED_Relay 7324 7.64 22.67 1.81 99 INVALID_MSGID 7260 1.56 0.95 1.79 100 T_XMDrugObfuBody_14 7132 1.63 1.30 1.76 101 RELAYCOUNTRY_CA 6944 2.68 5.17 1.71 102 NO_DNS_FOR_FROM 6914 2.31 3.88 1.70 103 CK_HELO_DYNAMIC_SPLIT_IP 6578 1.46 1.04 1.62 104 HELO_DYNAMIC_IPADDR2 6576 1.36 0.70 1.62 105 TO_MALFORMED 6506 2.25 3.93 1.60 106 IN_HORDE_ADDRESS_BOOK 6464 1.35 0.72 1.59 107 XM_DK_Undo_01 6403 1.34 0.72 1.58 108 HELO_NODOT 6253 1.26 0.52 1.54 109 HELO_NO_DOMAIN 6210 1.24 0.48 1.53 110 TooManyTo_003 6107 1.22 0.49 1.51 111 XMBdyGiftCard01 5984 1.31 0.88 1.47 112 BAYES_95 5803 2.45 5.07 1.43 113 URI_TRY_3LD 5468 1.32 1.25 1.35 114 USER_IN_DEF_DKIM_WL 5467 0.98 0.03 1.35 115 RCVD_IN_MSPIKE_BL 5402 3.02 7.37 1.33 116 TM2_M_VERY_LONG_WORD 5401 1.38 1.52 1.33 117 TR_MetaPhish_Combo_01 5258 1.06 0.46 1.30 118 XMDiploma_00 5241 1.89 3.44 1.29 119 TR_Symld_Words 5189 1.30 1.37 1.28 120 T_XMDrugObfuBody_08 5111 2.71 6.44 1.26 121 XM_OfRef6 5083 1.17 0.95 1.25 122 TR_DCC_Bayes_99 5019 5.47 16.38 1.24 123 DKIM_ADSP_CUSTOM_MED 4911 1.83 3.41 1.21 124 XM_H_Long_From02 4902 1.35 1.73 1.21 125 XM_GoogleGroups 4811 0.93 0.26 1.19 126 XMStockSpam_06 4793 1.19 1.20 1.18 127 XMSubMetaI_00 4767 1.42 2.06 1.17 128 T_XMHurry_00 4698 1.12 1.03 1.16 129 XMCapTrack 4619 0.88 0.21 1.14 130 TooManyTo_004 4586 0.93 0.42 1.13 131 XMGappySubj_01 4556 0.91 0.36 1.12 132 XMSubNoVowel 4305 1.01 0.89 1.06 133 XM_RXBody 4269 1.03 0.97 1.05 134 XMPhish11 4081 1.15 1.50 1.01 135 URI_HEX 4014 1.33 2.21 0.99 136 RELAYCOUNTRY_GB 3957 1.35 2.31 0.98 137 RCVD_IN_BL_SPAMCOP_NET 3926 3.92 11.52 0.97 138 XMHTML_After_End 3866 0.99 1.09 0.95 139 TooManyTo_005 3808 0.78 0.38 0.94 140 XMBody_95 3798 0.73 0.21 0.94 141 HTML_FONT_FACE_BAD 3781 0.83 0.57 0.93 142 RCVD_IN_MSPIKE_L3 3708 1.20 1.93 0.91 143 XM_UB50 3705 3.16 8.96 0.91 144 XMBody_17 3701 1.18 1.85 0.91 145 T_FILL_THIS_FORM_SHORT 3658 0.83 0.64 0.90 146 XM_ProductURIs 3527 0.97 1.22 0.87 147 NML_ADSP_CUSTOM_MED 3510 1.52 3.20 0.87 148 DKIM_ADSP_NXDOMAIN 3313 2.78 7.84 0.82 149 XMGenDplmaNmb 3310 1.42 2.96 0.82 150 XMSolicitRefs_0 3277 0.70 0.42 0.81 151 XM_E_Blogspot 3162 0.59 0.09 0.78 152 FILL_THIS_FORM 3001 0.59 0.19 0.74 153 TR_XM_RelayPhish 2881 1.50 3.54 0.71 154 T_TooManySym_03 2862 0.56 0.17 0.71 155 XM_H_PHPMailer 2791 0.74 0.87 0.69 156 SpammyFromTLD_01 2711 1.66 4.23 0.67 157 XMBrknScrpt_02 2695 0.69 0.77 0.66 158 FORGED_GMAIL_RCVD 2689 1.33 3.05 0.66 159 HTML_TAG_BALANCE_BODY 2608 0.59 0.47 0.64 160 TR_XM_PHPDW 2570 0.84 1.37 0.63 161 AC_FROM_MANY_DOTS 2490 0.45 0.02 0.61 162 XM_ShortIntro_01 2468 0.58 0.50 0.61 163 TR_XM_PHPForged 2463 0.81 1.35 0.61 164 USER_IN_WHITELIST 2455 0.44 0.00 0.61 165 XM_shorewaves_Whitelist 2438 0.43 0.00 0.60 166 T_OBFU_PDF_ATTACH 2409 0.46 0.12 0.59 167 FILL_THIS_FORM_LONG 2383 0.47 0.15 0.59 168 XM_SPF_Unknown 2377 0.63 0.74 0.59 169 XMNoVowels 2365 0.53 0.39 0.58 170 T_FILL_THIS_FORM_LOAN 2350 0.44 0.07 0.58 171 RELAYCOUNTRY_DE 2312 0.82 1.48 0.57 172 T_XMDrugObfuBody_00 2248 1.51 3.96 0.55 173 XM_B_REG_HTML 2240 0.60 0.72 0.55 174 TR_XM_FormFill2 2192 0.76 1.34 0.54 175 THIS_AD 2171 0.76 1.35 0.54 176 XM_H_PHPOS 2153 0.75 1.33 0.53 177 T_Symld_Words_02 2079 0.68 1.11 0.51 178 AC_DIV_BONANZA 2034 0.40 0.13 0.50 179 XMHTMLBadTable_001 2027 0.61 0.91 0.50 180 HTTPS_HTTP_MISMATCH 2023 0.48 0.44 0.50 181 DIET_1 1983 0.92 2.02 0.49 182 XMSubMetaSxObfu_02 1939 0.45 0.38 0.48 183 T_MANY_PILL_PRICE 1903 0.34 0.00 0.47 184 XMSubMetaSxObfu_03 1855 0.79 1.66 0.46 185 TM2_M_BODY_EMPTY 1802 0.41 0.33 0.44 186 FSL_THIS_IS_ADV 1789 0.53 0.76 0.44 187 XM_Body_Obfu01 1784 0.39 0.26 0.44 188 MISSING_HEADERS 1769 1.19 3.13 0.44 189 XMPhish30 1768 0.54 0.81 0.44 190 XMSexyCombo_01 1752 1.58 4.55 0.43 191 PLING_QUERY 1751 0.42 0.39 0.43 192 XMMoneyMeta_00 1728 0.70 1.42 0.43 193 SUBJ_DOLLARS 1711 0.71 1.46 0.42 194 XMBody_78 1692 0.45 0.53 0.42 195 TR_LOTS_OF_MONEY2 1653 0.46 0.58 0.41 196 T_MONEY_PERCENT 1653 0.46 0.58 0.41 197 SHORT_HELO_AND_INLINE_IMAGE 1652 0.30 0.04 0.41 198 XM_B_COPY_HTML 1643 0.51 0.79 0.40 199 RDNS_DYNAMIC 1636 3.55 11.65 0.40 200 RCVD_IN_SORBS_DUL 1614 0.58 1.05 0.40 ----------------------------------------------------------------------