Email: 608295 Autolearn: 0 AvgScore: 0.78 AvgScanTime: 2.01 sec Spam: 109982 Autolearn: 0 AvgScore: 12.36 AvgScanTime: 2.71 sec Ham: 498313 Autolearn: 0 AvgScore: -1.78 AvgScanTime: 1.86 sec Time Spent Running SA: 340.36 hours Time Spent Processing Spam: 82.77 hours Time Spent Processing Ham: 257.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102730 90.08 93.41 89.35 2 DKIM_SIGNED 87793 77.65 79.82 77.17 3 DCC_CHECK 85628 47.31 77.86 40.56 4 XM_DK_Pass 84963 76.02 77.25 75.75 5 XM_B_Unicode 84825 71.52 77.13 70.28 6 DKIM_VALID 80219 72.28 72.94 72.13 7 XMListUnsubscribeExists 71983 54.13 65.45 51.63 8 DKIM_VALID_AU 58961 54.37 53.61 54.54 9 XM_B_Unicode3 50683 41.89 46.08 40.96 10 BAYES_50 50323 51.19 45.76 52.39 11 MIME_HTML_ONLY 42768 24.49 38.89 21.31 12 XM_DK_Undo_02 40617 12.19 36.93 6.73 13 HTML_FONT_LOW_CONTRAST 37249 28.84 33.87 27.74 14 LOC_TINY_FONT_1 36606 24.92 33.28 23.08 15 BAYES_99 31118 8.06 28.29 3.60 16 DKIM_VALID_EF 28498 27.81 25.91 28.23 17 FVGT_m_MULTI_ODD 27134 22.00 24.67 21.41 18 XM_Body_Dirty_Words 25114 15.07 22.83 13.36 19 XMSubLong 24950 21.41 22.69 21.13 20 MultiRelay 24528 19.16 22.30 18.46 21 BAYES_999 24427 6.41 22.21 2.92 22 T_KAM_HTML_FONT_INVALID 24340 18.56 22.13 17.77 23 RELAYCOUNTRY_META 23859 8.35 21.69 5.40 24 TR_DCC_Bayes_99 22927 5.22 20.85 1.77 25 DCC_CHECK_NEGATIVE 21911 50.74 19.92 57.54 26 T_TM2_M_HEADER_IN_MSG 20969 27.19 19.07 28.98 27 XM_Multi_Part_URI 20777 13.05 18.89 11.76 28 BOTNET 20380 5.10 18.53 2.13 29 LOTS_OF_MONEY 20275 11.36 18.43 9.80 30 XM_B_Unsub 19811 13.27 18.01 12.22 31 FSL_BULK_SIG 19436 8.95 17.67 7.03 32 XM_UncommonTLD01 18292 6.69 16.63 4.50 33 BOTNET_IPINHOSTNAME 17960 6.55 16.33 4.39 34 XMSexyCombo_05 15232 5.59 13.85 3.76 35 HTML_IMAGE_RATIO_02 15057 9.03 13.69 8.00 36 XM_Evil_Numbers_Gen 14594 9.13 13.27 8.22 37 UNTRUSTED_Relay 13216 3.44 12.02 1.55 38 XMSubMetaSx_00 11177 5.15 10.16 4.04 39 XM_B_Phish_Phrases 10997 7.27 10.00 6.66 40 RCVD_IN_MSPIKE_H2 10968 12.07 9.97 12.54 41 XM_DIRTYINTL 9760 3.60 8.87 2.44 42 MPART_ALT_DIFF 9376 5.56 8.53 4.91 43 SpammyFromTLD_02 8573 1.71 7.79 0.37 44 LotsOfNums_01 8364 7.97 7.60 8.05 45 XM_UB50 8322 2.08 7.57 0.87 46 XMNumbers 8145 4.06 7.41 3.32 47 BAYES_80 7915 3.15 7.20 2.26 48 DKIM_INVALID 7574 5.37 6.89 5.04 49 FROM_EXCESS_BASE64 6940 3.85 6.31 3.31 50 HTML_SHORT_LINK_IMG_1 6845 1.15 6.22 0.03 51 RCVD_IN_BL_SPAMCOP_NET 6805 2.23 6.19 1.35 52 TooManyTo_001 6719 7.45 6.11 7.75 53 XM_H_Long_From01 6505 6.11 5.91 6.15 54 HTML_IMAGE_RATIO_04 6480 6.27 5.89 6.35 55 BAYES_60 6265 4.89 5.70 4.71 56 T_REMOTE_IMAGE 6144 4.67 5.59 4.47 57 MIME_HTML_MOSTLY 5928 3.08 5.39 2.57 58 KHOP_HELO_FCRDNS 5923 2.55 5.39 1.93 59 XM_SendGrid 5906 6.53 5.37 6.79 60 TM2_M_URI_OPT_OUT 5379 2.66 4.89 2.17 61 XMStrtUSub 5337 4.65 4.85 4.60 62 RCVD_IN_MSPIKE_WL 5203 8.79 4.73 9.69 63 RCVD_IN_MSPIKE_H3 5203 8.79 4.73 9.69 64 T_XMDrugObfuBody_08 5187 2.49 4.72 2.00 65 MIME_QP_LONG_LINE 5109 5.42 4.65 5.59 66 XMBody_17 5107 1.73 4.64 1.08 67 FROM_SUSPICIOUS_NTLD 5106 0.87 4.64 0.04 68 FROM_SUSPICIOUS_NTLD_FP 5073 0.87 4.61 0.04 69 RELAYCOUNTRY_CA 5031 2.11 4.57 1.56 70 XMSexyCombo_01 4951 1.35 4.50 0.65 71 HTML_IMAGE_RATIO_06 4867 3.99 4.43 3.90 72 HTML_MIME_NO_HTML_TAG 4745 2.55 4.31 2.16 73 TR_XM_RelayPhish 4724 1.84 4.30 1.30 74 MIME_HTML_ONLY_MULTI 4637 3.39 4.22 3.21 75 SUBJ_ALL_CAPS 4559 2.12 4.15 1.67 76 XM_CamelCaseFrm001 4532 2.58 4.12 2.24 77 REPLYTO_WITHOUT_TO_CC 4316 0.74 3.92 0.04 78 XM_SPF_SoftFail 4289 2.10 3.90 1.70 79 RDNS_DYNAMIC 4237 0.98 3.85 0.34 80 BAYES_95 4228 1.84 3.84 1.39 81 HTML_IMAGE_ONLY_08 4224 0.78 3.84 0.10 82 RELAYCOUNTRY_FR 4096 0.90 3.72 0.28 83 XMStockSpam_06 4085 1.48 3.71 0.99 84 DKIM_ADSP_NXDOMAIN 4063 2.01 3.69 1.64 85 XM_OfRef6 3992 2.14 3.63 1.81 86 RCVD_IN_MSPIKE_BL 3952 1.62 3.59 1.18 87 MIME_HEADER_CTYPE_ONLY 3745 0.77 3.41 0.19 88 XM_URI_RBL 3730 0.86 3.39 0.30 89 XM_B_SpammyTLD 3725 2.31 3.39 2.07 90 HDRS_LCASE_IMGONLY 3644 0.61 3.31 0.01 91 SpammyFromTLD_01 3632 1.21 3.30 0.75 92 TO_EQ_FM_DOM_HTML_IMG 3615 0.60 3.29 0.01 93 T_FILL_THIS_FORM_SHORT 3525 1.49 3.21 1.12 94 T_XMDrugObfuBody_00 3372 1.16 3.07 0.74 95 RCVD_IN_RP_RNBL 3365 0.68 3.06 0.15 96 URI_TRY_3LD 3336 1.79 3.03 1.52 97 RELAYCOUNTRY_GB 3334 1.49 3.03 1.15 98 XMSexyCombo_04 3316 0.72 3.02 0.21 99 BAYES_40 3212 5.50 2.92 6.07 100 PDS_OTHER_BAD_TLD 3120 0.88 2.84 0.45 101 URIBL_SBL_A 3104 0.90 2.82 0.48 102 URI_HEX 3100 1.64 2.82 1.38 103 XMDiploma_00 3095 1.82 2.81 1.60 104 BODY_URI_ONLY 3040 0.57 2.76 0.09 105 MultiRelay_CC 3015 0.64 2.74 0.18 106 MultiRelay_Combo 3015 0.64 2.74 0.18 107 HTML_TAG_BALANCE_CENTER 2984 0.53 2.71 0.05 108 XM_B_Unsub2 2961 3.67 2.69 3.89 109 NO_DNS_FOR_FROM 2883 2.48 2.62 2.45 110 HTML_IMAGE_RATIO_08 2882 2.71 2.62 2.73 111 BOTNET_NORDNS 2831 0.70 2.57 0.29 112 T_XMDrugObfuBody_14 2827 1.78 2.57 1.61 113 TR_XM_DK_SendGrid 2758 3.59 2.51 3.83 114 T_TooManySym_01 2733 4.17 2.48 4.55 115 BAYES_00 2635 17.78 2.40 21.17 116 RCVD_IN_MSPIKE_L3 2568 0.93 2.33 0.61 117 BAYES_20 2542 4.62 2.31 5.13 118 RCVD_IN_PSBL 2484 0.42 2.26 0.01 119 TO_MALFORMED 2405 1.49 2.19 1.34 120 SHORT_IMG_SUSP_NTLD 2396 0.39 2.18 0.00 121 HTML_IMAGE_ONLY_12 2296 0.51 2.09 0.16 122 DATE_IN_PAST_03_06 2266 0.45 2.06 0.09 123 RCVD_IN_IADB_LISTED 2245 4.80 2.04 5.41 124 XMGenDplmaNmb 2188 1.24 1.99 1.08 125 HDRS_MISSP 2182 0.36 1.98 0.00 126 XM_RXBody 2135 0.51 1.94 0.19 127 TM2_M_VERY_LONG_WORD 2109 1.44 1.92 1.34 128 BODY_SINGLE_WORD 2096 0.35 1.91 0.01 129 BODY_SINGLE_URI 2094 0.35 1.90 0.01 130 TR_XM_INV_DKIM 2094 0.47 1.90 0.15 131 TR_XM_DK_Bayes 2083 12.54 1.89 14.89 132 FROM_NTLD_LINKBAIT 2067 0.34 1.88 0.00 133 RCVD_IN_RP_SAFE 2041 7.68 1.86 8.97 134 MONEY_FRAUD_8 2025 0.33 1.84 0.00 135 RCVD_IN_IADB_SPF 2014 4.17 1.83 4.69 136 LongTLD 2013 0.49 1.83 0.20 137 MONEY_FORM_SHORT 1943 0.33 1.77 0.02 138 RCVD_IN_IADB_SENDERID 1941 3.68 1.76 4.11 139 RCVD_IN_IADB_DK 1929 3.61 1.75 4.01 140 XMBdyGiftCard01 1910 1.27 1.74 1.16 141 FORM_FRAUD_5 1887 0.31 1.72 0.00 142 T_XMHurry_00 1882 1.17 1.71 1.05 143 TR_XM_DK_Bayes1 1879 11.91 1.71 14.16 144 RCVD_IN_RP_CERTIFIED 1879 7.00 1.71 8.16 145 TR_Symld_Words 1827 1.57 1.66 1.55 146 TR_LOTS_OF_MONEY3 1797 0.76 1.63 0.56 147 XM_Nigeria_01 1775 0.33 1.61 0.04 148 XM_DKIMWhitelistDomains 1767 5.99 1.61 6.96 149 XMSubMetaI_00 1743 0.83 1.58 0.67 150 XM_JunkDunk 1680 0.28 1.53 0.00 151 TR_XM_PHPDW 1676 0.63 1.52 0.43 152 TR_XM_FormFill2 1608 0.60 1.46 0.42 153 TR_XM_PHPForged 1601 0.60 1.46 0.41 154 XM_H_PHPOS 1585 0.59 1.44 0.41 155 HTML_FONT_FACE_BAD 1556 1.55 1.41 1.58 156 SUBJ_DOLLARS 1543 0.50 1.40 0.30 157 XMPhish11 1522 1.21 1.38 1.17 158 BAYES_05 1494 2.70 1.36 2.99 159 TR_Mismatch_TLD_02 1464 0.30 1.33 0.07 160 XMHTML_After_End 1423 0.78 1.29 0.67 161 ALL_TRUSTED 1415 10.30 1.29 12.29 162 TM2_M_A_HREF_HREF 1398 0.70 1.27 0.57 163 XMMoneyMeta_00 1388 0.57 1.26 0.42 164 HK_RANDOM_FROM 1371 0.33 1.25 0.13 165 RELAYCOUNTRY_JP 1357 0.25 1.23 0.03 166 URIBL_DBL_ABUSE_REDIR 1314 0.22 1.19 0.01 167 HK_RANDOM_REPLYTO 1312 0.37 1.19 0.19 168 DIET_1 1301 0.57 1.18 0.43 169 MAILING_LIST_MULTI 1299 1.99 1.18 2.17 170 LOADSA_MONEY_COMBO 1299 0.24 1.18 0.03 171 T_Symld_Words_02 1291 0.74 1.17 0.64 172 XM_Nigeria_02 1270 0.21 1.15 0.00 173 TVD_APPROVED 1269 0.23 1.15 0.02 174 DATE_IN_PAST_06_12 1256 0.25 1.14 0.05 175 T_MONEY_PERCENT 1250 0.52 1.14 0.38 176 TR_LOTS_OF_MONEY2 1250 0.52 1.14 0.38 177 XMSubMetaSxObfu_03 1225 0.60 1.11 0.48 178 RELAYCOUNTRY_IN 1224 0.28 1.11 0.10 179 RELAYCOUNTRY_DE 1216 0.64 1.11 0.54 180 XM_UB60 1189 0.26 1.08 0.08 181 UNPARSEABLE_RELAY 1171 1.96 1.06 2.15 182 FSL_THIS_IS_ADV 1165 0.43 1.06 0.29 183 TR_XM_DK_Bayes2 1164 10.30 1.06 12.34 184 XM_H_Long_From02 1141 1.12 1.04 1.14 185 TooManyTo_002 1099 1.74 1.00 1.90 186 XMPhish30 1090 0.61 0.99 0.53 187 DKIM_ADSP_CUSTOM_MED 1069 1.05 0.97 1.06 188 THIS_AD 1054 0.34 0.96 0.21 189 MPART_ALT_DIFF_COUNT 1042 0.49 0.95 0.39 190 XM_DK_Undo_01 1042 1.50 0.95 1.63 191 XMBrknScrpt_02 1029 0.70 0.94 0.65 192 DATE_IN_PAST_12_24 1011 0.22 0.92 0.06 193 XMPhish14 1010 0.51 0.92 0.41 194 XM_UB99 1004 0.17 0.91 0.01 195 XM_ProductURIs 1001 0.75 0.91 0.72 196 BILLION_DOLLARS 972 0.17 0.88 0.01 197 XM_H_PHPMailer 961 0.52 0.87 0.44 198 TooManyTo_003 923 1.17 0.84 1.25 199 XMBody_78 921 0.50 0.84 0.42 200 RELAYCOUNTRY_AT 916 0.33 0.83 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 445244 90.08 93.41 89.35 2 DKIM_SIGNED 384548 77.65 79.82 77.17 3 XM_DK_Pass 377479 76.02 77.25 75.75 4 DKIM_VALID 359428 72.28 72.94 72.13 5 XM_B_Unicode 350216 71.52 77.13 70.28 6 DCC_CHECK_NEGATIVE 286716 50.74 19.92 57.54 7 DKIM_VALID_AU 271757 54.37 53.61 54.54 8 BAYES_50 261079 51.19 45.76 52.39 9 XMListUnsubscribeExists 257269 54.13 65.45 51.63 10 XM_B_Unicode3 204127 41.89 46.08 40.96 11 DCC_CHECK 202126 47.31 77.86 40.56 12 T_TM2_M_HEADER_IN_MSG 144409 27.19 19.07 28.98 13 DKIM_VALID_EF 140682 27.81 25.91 28.23 14 HTML_FONT_LOW_CONTRAST 138209 28.84 33.87 27.74 15 LOC_TINY_FONT_1 115000 24.92 33.28 23.08 16 FVGT_m_MULTI_ODD 106674 22.00 24.67 21.41 17 MIME_HTML_ONLY 106178 24.49 38.89 21.31 18 BAYES_00 105495 17.78 2.40 21.17 19 XMSubLong 105305 21.41 22.69 21.13 20 MultiRelay 91994 19.16 22.30 18.46 21 T_KAM_HTML_FONT_INVALID 88574 18.56 22.13 17.77 22 TR_XM_DK_Bayes 74181 12.54 1.89 14.89 23 TR_XM_DK_Bayes1 70555 11.91 1.71 14.16 24 XM_Body_Dirty_Words 66565 15.07 22.83 13.36 25 RCVD_IN_MSPIKE_H2 62479 12.07 9.97 12.54 26 TR_XM_DK_Bayes2 61487 10.30 1.06 12.34 27 ALL_TRUSTED 61244 10.30 1.29 12.29 28 XM_B_Unsub 60885 13.27 18.01 12.22 29 XM_Multi_Part_URI 58584 13.05 18.89 11.76 30 LOTS_OF_MONEY 48855 11.36 18.43 9.80 31 RCVD_IN_MSPIKE_WL 48284 8.79 4.73 9.69 32 RCVD_IN_MSPIKE_H3 48283 8.79 4.73 9.69 33 RCVD_IN_RP_SAFE 44691 7.68 1.86 8.97 34 XM_Evil_Numbers_Gen 40970 9.13 13.27 8.22 35 RCVD_IN_RP_CERTIFIED 40678 7.00 1.71 8.16 36 LotsOfNums_01 40101 7.97 7.60 8.05 37 HTML_IMAGE_RATIO_02 39847 9.03 13.69 8.00 38 TooManyTo_001 38601 7.45 6.11 7.75 39 FSL_BULK_SIG 35025 8.95 17.67 7.03 40 XM_DKIMWhitelistDomains 34670 5.99 1.61 6.96 41 XM_SendGrid 33811 6.53 5.37 6.79 42 XM_DK_Undo_02 33552 12.19 36.93 6.73 43 XM_B_Phish_Phrases 33201 7.27 10.00 6.66 44 HTML_IMAGE_RATIO_04 31634 6.27 5.89 6.35 45 XM_H_Long_From01 30668 6.11 5.91 6.15 46 BAYES_40 30243 5.50 2.92 6.07 47 MIME_QP_LONG_LINE 27856 5.42 4.65 5.59 48 RCVD_IN_IADB_LISTED 26976 4.80 2.04 5.41 49 RELAYCOUNTRY_META 26905 8.35 21.69 5.40 50 BAYES_20 25570 4.62 2.31 5.13 51 DKIM_INVALID 25120 5.37 6.89 5.04 52 MPART_ALT_DIFF 24461 5.56 8.53 4.91 53 BAYES_60 23460 4.89 5.70 4.71 54 RCVD_IN_IADB_SPF 23375 4.17 1.83 4.69 55 XM_PDF 23367 3.96 0.68 4.69 56 XMStrtUSub 22927 4.65 4.85 4.60 57 T_TooManySym_01 22656 4.17 2.48 4.55 58 XM_UncommonTLD01 22409 6.69 16.63 4.50 59 IN_ZIMBRA_NJ_WHITELIST 22381 3.68 0.01 4.49 60 T_REMOTE_IMAGE 22277 4.67 5.59 4.47 61 BOTNET_IPINHOSTNAME 21883 6.55 16.33 4.39 62 RCVD_IN_IADB_SENDERID 20468 3.68 1.76 4.11 63 XMSubMetaSx_00 20153 5.15 10.16 4.04 64 RCVD_IN_IADB_DK 20006 3.61 1.75 4.01 65 HTML_IMAGE_RATIO_06 19410 3.99 4.43 3.90 66 XM_B_Unsub2 19383 3.67 2.69 3.89 67 XM_H_Trusted_IP 19267 3.17 0.00 3.87 68 TR_XM_DK_SendGrid 19106 3.59 2.51 3.83 69 XMSexyCombo_05 18756 5.59 13.85 3.76 70 BAYES_99 17929 8.06 28.29 3.60 71 RCVD_IN_IADB_VOUCHED 17336 2.97 0.69 3.48 72 XMNumbers 16556 4.06 7.41 3.32 73 FROM_EXCESS_BASE64 16488 3.85 6.31 3.31 74 MIME_HTML_ONLY_MULTI 15978 3.39 4.22 3.21 75 BAYES_05 14917 2.70 1.36 2.99 76 BAYES_999 14573 6.41 22.21 2.92 77 HTML_IMAGE_RATIO_08 13582 2.71 2.62 2.73 78 MIME_HTML_MOSTLY 12783 3.08 5.39 2.57 79 NO_DNS_FOR_FROM 12200 2.48 2.62 2.45 80 XM_DIRTYINTL 12166 3.60 8.87 2.44 81 BAYES_80 11266 3.15 7.20 2.26 82 T_TooManySym_02 11224 1.95 0.60 2.25 83 XM_CamelCaseFrm001 11160 2.58 4.12 2.24 84 RCVD_IN_IADB_OPTIN 11111 1.91 0.44 2.23 85 MAILING_LIST_MULTI 10822 1.99 1.18 2.17 86 TM2_M_URI_OPT_OUT 10793 2.66 4.89 2.17 87 HTML_MIME_NO_HTML_TAG 10758 2.55 4.31 2.16 88 UNPARSEABLE_RELAY 10722 1.96 1.06 2.15 89 BOTNET 10620 5.10 18.53 2.13 90 XM_B_SpammyTLD 10324 2.31 3.39 2.07 91 T_XMDrugObfuBody_08 9971 2.49 4.72 2.00 92 ANY_BOUNCE_MESSAGE 9965 1.76 0.67 2.00 93 BOUNCE_MESSAGE 9960 1.76 0.67 2.00 94 KHOP_HELO_FCRDNS 9616 2.55 5.39 1.93 95 TooManyTo_002 9488 1.74 1.00 1.90 96 XM_OfRef6 9027 2.14 3.63 1.81 97 TVD_RCVD_IP 8877 1.52 0.32 1.78 98 TR_DCC_Bayes_99 8801 5.22 20.85 1.77 99 XM_SPF_SoftFail 8468 2.10 3.90 1.70 100 SUBJ_ALL_CAPS 8342 2.12 4.15 1.67 101 DKIM_ADSP_NXDOMAIN 8148 2.01 3.69 1.64 102 XM_DK_Undo_01 8108 1.50 0.95 1.63 103 T_XMDrugObfuBody_14 8014 1.78 2.57 1.61 104 XMDiploma_00 7994 1.82 2.81 1.60 105 HTML_FONT_FACE_BAD 7854 1.55 1.41 1.58 106 RELAYCOUNTRY_CA 7787 2.11 4.57 1.56 107 UNTRUSTED_Relay 7727 3.44 12.02 1.55 108 TR_Symld_Words 7715 1.57 1.66 1.55 109 INVALID_MSGID 7584 1.28 0.18 1.52 110 URI_TRY_3LD 7572 1.79 3.03 1.52 111 IN_HORDE_ADDRESS_BOOK 7446 1.23 0.04 1.49 112 HELO_NODOT 7183 1.28 0.52 1.44 113 HELO_NO_DOMAIN 7139 1.27 0.52 1.43 114 XMSubNoVowel 7082 1.25 0.49 1.42 115 BAYES_95 6950 1.84 3.84 1.39 116 AC_FROM_MANY_DOTS 6943 1.14 0.02 1.39 117 URI_HEX 6853 1.64 2.82 1.38 118 RCVD_IN_BL_SPAMCOP_NET 6736 2.23 6.19 1.35 119 TO_MALFORMED 6671 1.49 2.19 1.34 120 TM2_M_VERY_LONG_WORD 6669 1.44 1.92 1.34 121 CK_HELO_DYNAMIC_SPLIT_IP 6593 1.10 0.10 1.32 122 HELO_DYNAMIC_IPADDR2 6592 1.09 0.05 1.32 123 TR_XM_RelayPhish 6470 1.84 4.30 1.30 124 TooManyTo_003 6204 1.17 0.84 1.25 125 XMCapTrack 5914 1.06 0.49 1.19 126 RCVD_IN_MSPIKE_BL 5876 1.62 3.59 1.18 127 XMPhish11 5822 1.21 1.38 1.17 128 XMBdyGiftCard01 5803 1.27 1.74 1.16 129 RELAYCOUNTRY_GB 5741 1.49 3.03 1.15 130 XM_H_Long_From02 5689 1.12 1.04 1.14 131 T_FILL_THIS_FORM_SHORT 5558 1.49 3.21 1.12 132 XMGappySubj_01 5544 1.01 0.56 1.11 133 XMBody_17 5393 1.73 4.64 1.08 134 XM_GoogleGroups 5384 0.97 0.47 1.08 135 XMGenDplmaNmb 5380 1.24 1.99 1.08 136 DKIM_ADSP_CUSTOM_MED 5296 1.05 0.97 1.06 137 T_XMHurry_00 5228 1.17 1.71 1.05 138 USER_IN_DEF_DKIM_WL 5132 0.84 0.00 1.03 139 XMStockSpam_06 4934 1.48 3.71 0.99 140 FILL_THIS_FORM 4789 0.85 0.32 0.96 141 TooManyTo_004 4563 0.88 0.71 0.92 142 XM_UB50 4334 2.08 7.57 0.87 143 TooManyTo_005 3864 0.74 0.60 0.78 144 SpammyFromTLD_01 3734 1.21 3.30 0.75 145 NML_ADSP_CUSTOM_MED 3720 0.75 0.79 0.75 146 T_XMDrugObfuBody_00 3669 1.16 3.07 0.74 147 TR_MetaPhish_Combo_01 3643 0.69 0.52 0.73 148 XM_ProductURIs 3586 0.75 0.91 0.72 149 HTML_IMAGE_ONLY_20 3570 0.63 0.21 0.72 150 XM_SPF_Unknown 3499 0.71 0.76 0.70 151 T_OBFU_PDF_ATTACH 3468 0.60 0.18 0.70 152 XMBody_95 3409 0.58 0.09 0.68 153 XMHTML_After_End 3334 0.78 1.29 0.67 154 XMSubMetaI_00 3329 0.83 1.58 0.67 155 XMSexyCombo_01 3249 1.35 4.50 0.65 156 XMBrknScrpt_02 3234 0.70 0.94 0.65 157 T_Symld_Words_02 3214 0.74 1.17 0.64 158 HTTPS_HTTP_MISMATCH 3126 0.66 0.80 0.63 159 XM_B_REG_HTML 3098 0.57 0.33 0.62 160 RCVD_IN_MSPIKE_L3 3059 0.93 2.33 0.61 161 TM2_M_A_HREF_HREF 2849 0.70 1.27 0.57 162 REMOVE_BEFORE_LINK 2836 0.57 0.59 0.57 163 USER_IN_WHITELIST 2825 0.46 0.00 0.57 164 TR_LOTS_OF_MONEY3 2805 0.76 1.63 0.56 165 FROM_GOV_DKIM_AU 2779 0.52 0.37 0.56 166 XMSlimDrugH 2767 0.57 0.64 0.56 167 T_TooManySym_03 2733 0.50 0.28 0.55 168 XMNoVowels 2728 0.59 0.77 0.55 169 RELAYCOUNTRY_DE 2686 0.64 1.11 0.54 170 XMPhish30 2643 0.61 0.99 0.53 171 FILL_THIS_FORM_LONG 2642 0.48 0.25 0.53 172 XMHTMLBadTable_001 2614 0.56 0.73 0.52 173 FORGED_GMAIL_RCVD 2608 0.58 0.82 0.52 174 XM_ShortIntro_01 2555 0.54 0.67 0.51 175 PLING_QUERY 2552 0.52 0.57 0.51 176 T_FILL_THIS_FORM_LOAN 2495 0.43 0.10 0.50 177 XMSubMetaSxObfu_03 2415 0.60 1.11 0.48 178 URIBL_SBL_A 2390 0.90 2.82 0.48 179 TVD_SPACE_RATIO 2377 0.41 0.11 0.48 180 HTML_TAG_BALANCE_BODY 2343 0.47 0.47 0.47 181 TM2_M_BODY_EMPTY 2286 0.39 0.09 0.46 182 RELAYCOUNTRY_AU 2265 0.47 0.53 0.45 183 PDS_OTHER_BAD_TLD 2260 0.88 2.84 0.45 184 XM_H_PHPMailer 2201 0.52 0.87 0.44 185 FROM_GOV_SPOOF 2182 0.41 0.27 0.44 186 DIET_1 2148 0.57 1.18 0.43 187 TR_XM_PHPDW 2126 0.63 1.52 0.43 188 XMBody_78 2109 0.50 0.84 0.42 189 MISSING_HEADERS 2108 0.50 0.82 0.42 190 XMMoneyMeta_00 2106 0.57 1.26 0.42 191 TR_XM_FormFill2 2072 0.60 1.46 0.42 192 XMPhish14 2065 0.51 0.92 0.41 193 XMBSHREFv2 2063 0.41 0.41 0.41 194 TR_XM_PHPForged 2057 0.60 1.46 0.41 195 XM_B_COPY_HTML 2036 0.48 0.80 0.41 196 XM_H_PHPOS 2032 0.59 1.44 0.41 197 HTML_IMAGE_ONLY_32 1979 0.36 0.22 0.40 198 XM_Body_Obfu01 1973 0.44 0.66 0.40 199 XMRcvdHeader_15 1940 0.32 0.00 0.39 200 MPART_ALT_DIFF_COUNT 1922 0.49 0.95 0.39 ----------------------------------------------------------------------