Email: 392251 Autolearn: 0 AvgScore: 1.01 AvgScanTime: 2.05 sec Spam: 75073 Autolearn: 0 AvgScore: 13.10 AvgScanTime: 2.61 sec Ham: 317178 Autolearn: 0 AvgScore: -1.85 AvgScanTime: 1.92 sec Time Spent Running SA: 223.25 hours Time Spent Processing Spam: 54.52 hours Time Spent Processing Ham: 168.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 68673 88.03 91.47 87.21 2 DCC_CHECK 58144 54.10 77.45 48.58 3 DKIM_SIGNED 54048 77.03 71.99 78.22 4 XM_DK_Pass 52688 75.88 70.18 77.23 5 XM_B_Unicode 52087 72.32 69.38 73.01 6 DKIM_VALID 49617 72.55 66.09 74.08 7 XMListUnsubscribeExists 47094 57.80 62.73 56.63 8 DKIM_VALID_AU 36401 57.01 48.49 59.02 9 BAYES_50 32978 50.65 43.93 52.24 10 XM_B_Unicode3 31701 45.94 42.23 46.82 11 MIME_HTML_ONLY 28645 28.59 38.16 26.32 12 XM_DK_Undo_02 24241 12.54 32.29 7.86 13 LOC_TINY_FONT_1 22826 28.68 30.41 28.27 14 HTML_FONT_LOW_CONTRAST 21153 30.34 28.18 30.85 15 XMSubLong 19627 21.27 26.14 20.11 16 DKIM_VALID_EF 18830 26.60 25.08 26.96 17 BAYES_99 18822 8.52 25.07 4.61 18 FVGT_m_MULTI_ODD 17353 22.70 23.11 22.60 19 XM_Body_Dirty_Words 17247 16.14 22.97 14.52 20 MultiRelay 16175 16.97 21.55 15.88 21 RELAYCOUNTRY_META 15981 7.89 21.29 4.72 22 FSL_BULK_SIG 15825 11.93 21.08 9.77 23 DCC_CHECK_NEGATIVE 15638 44.61 20.83 50.24 24 XM_UncommonTLD01 15596 8.31 20.77 5.36 25 BOTNET 14913 5.38 19.86 1.95 26 T_KAM_HTML_FONT_INVALID 14470 18.44 19.27 18.24 27 BAYES_999 13980 6.65 18.62 3.81 28 TR_DCC_Bayes_99 13807 5.27 18.39 2.16 29 XM_Multi_Part_URI 13653 14.31 18.19 13.39 30 XM_B_Unsub 12800 14.36 17.05 13.73 31 HTML_IMAGE_RATIO_02 11406 11.20 15.19 10.26 32 T_TM2_M_HEADER_IN_MSG 11230 19.45 14.96 20.51 33 BOTNET_IPINHOSTNAME 11091 7.09 14.77 5.27 34 LOTS_OF_MONEY 10491 11.00 13.97 10.29 35 XMSexyCombo_05 10373 7.08 13.82 5.49 36 UNTRUSTED_Relay 10154 3.78 13.53 1.47 37 SpammyFromTLD_02 8695 2.37 11.58 0.19 38 BAYES_60 8067 6.03 10.75 4.92 39 XM_Evil_Numbers_Gen 7592 10.58 10.11 10.68 40 XM_UB50 6908 2.41 9.20 0.80 41 HTML_SHORT_LINK_IMG_1 6839 1.77 9.11 0.03 42 RCVD_IN_MSPIKE_H2 6818 11.49 9.08 12.07 43 XMSubMetaSx_00 6743 5.94 8.98 5.22 44 HTML_IMAGE_ONLY_08 6730 1.80 8.96 0.10 45 FROM_EXCESS_BASE64 6555 4.98 8.73 4.09 46 XM_DIRTYINTL 6502 4.13 8.66 3.06 47 FROM_SUSPICIOUS_NTLD 6198 1.69 8.26 0.14 48 FROM_SUSPICIOUS_NTLD_FP 6189 1.69 8.24 0.14 49 KHOP_HELO_FCRDNS 5963 3.75 7.94 2.76 50 BAYES_80 5506 3.45 7.33 2.53 51 HTML_MIME_NO_HTML_TAG 5453 2.62 7.26 1.52 52 RCVD_IN_BL_SPAMCOP_NET 5400 2.63 7.19 1.55 53 LotsOfNums_01 5136 7.45 6.84 7.59 54 MPART_ALT_DIFF 5106 7.45 6.80 7.60 55 XMNumbers 5086 4.20 6.77 3.60 56 TooManyTo_001 4985 5.66 6.64 5.43 57 ALL_TRUSTED 4930 11.00 6.57 12.04 58 RDNS_DYNAMIC 4793 1.57 6.38 0.43 59 DKIM_ADSP_NXDOMAIN 4741 2.74 6.32 1.89 60 HTML_TAG_BALANCE_CENTER 4604 1.24 6.13 0.08 61 XM_B_Phish_Phrases 4601 8.13 6.13 8.60 62 XM_H_Long_From01 4548 6.00 6.06 5.98 63 HTML_IMAGE_RATIO_04 4534 7.03 6.04 7.27 64 DKIM_INVALID 4431 4.48 5.90 4.14 65 BODY_URI_ONLY 4327 1.14 5.76 0.04 66 MIME_HTML_MOSTLY 4310 3.39 5.74 2.83 67 HDRS_MISSP 4160 1.06 5.54 0.00 68 TO_MALFORMED 4132 2.74 5.50 2.09 69 FROM_NTLD_LINKBAIT 4111 1.05 5.48 0.00 70 RELAYCOUNTRY_CA 4107 2.76 5.47 2.12 71 BODY_SINGLE_URI 4101 1.05 5.46 0.00 72 BODY_SINGLE_WORD 4101 1.05 5.46 0.01 73 SHORT_IMG_SUSP_NTLD 4077 1.04 5.43 0.00 74 T_REMOTE_IMAGE 3956 4.99 5.27 4.92 75 XM_SPF_SoftFail 3899 1.85 5.19 1.06 76 XM_SendGrid 3840 6.51 5.12 6.84 77 RCVD_IN_RP_RNBL 3798 1.04 5.06 0.09 78 DEAR_FRIEND 3632 1.01 4.84 0.10 79 HK_SCAM 3533 0.91 4.71 0.02 80 TEQF_USR_POLITE 3306 0.85 4.40 0.00 81 BAYES_95 3228 2.10 4.30 1.58 82 REPLYTO_WITHOUT_TO_CC 3160 0.83 4.21 0.03 83 XM_CamelCaseFrm001 2897 2.73 3.86 2.46 84 XM_B_SpammyTLD 2876 2.21 3.83 1.82 85 SpammyFromTLD_01 2875 1.02 3.83 0.35 86 MIME_QP_LONG_LINE 2798 4.56 3.73 4.76 87 MultiRelay_CC 2781 0.79 3.70 0.11 88 MultiRelay_Combo 2781 0.79 3.70 0.11 89 MIME_HTML_ONLY_MULTI 2727 5.13 3.63 5.48 90 MIME_HEADER_CTYPE_ONLY 2717 0.83 3.62 0.17 91 HTML_IMAGE_RATIO_06 2698 3.80 3.59 3.85 92 PDS_OTHER_BAD_TLD 2696 1.28 3.59 0.74 93 HDRS_LCASE_IMGONLY 2664 0.68 3.55 0.01 94 TO_EQ_FM_DOM_HTML_IMG 2642 0.70 3.52 0.03 95 BOTNET_NORDNS 2572 0.68 3.43 0.03 96 URI_HEX 2529 1.77 3.37 1.40 97 RELAYCOUNTRY_FR 2520 0.93 3.36 0.35 98 RCVD_IN_MSPIKE_BL 2460 1.73 3.28 1.36 99 XMSexyCombo_01 2416 1.63 3.22 1.25 100 URIBL_SBL_A 2336 0.80 3.11 0.25 101 DATE_IN_PAST_03_06 2184 0.70 2.91 0.17 102 NO_DNS_FOR_FROM 2170 2.69 2.89 2.65 103 XM_JunkDunk 2144 0.55 2.86 0.00 104 BAYES_40 2118 4.52 2.82 4.93 105 RCVD_IN_MSPIKE_H3 2060 8.60 2.74 9.98 106 RCVD_IN_MSPIKE_WL 2060 8.60 2.74 9.98 107 TR_XM_DK_SendGrid 2015 3.47 2.68 3.66 108 RCVD_IN_PSBL 2008 0.52 2.67 0.01 109 XM_URI_RBL 2000 0.86 2.66 0.43 110 XMStrtUSub 1990 5.02 2.65 5.58 111 PLING_QUERY 1886 1.14 2.51 0.81 112 RCVD_IN_RP_SAFE 1878 10.51 2.50 12.40 113 TR_Mismatch_TLD_01 1859 0.66 2.48 0.23 114 RELAYCOUNTRY_IN 1852 0.52 2.47 0.06 115 TM2_M_URI_OPT_OUT 1845 3.93 2.46 4.28 116 TR_XM_PHPDW 1785 0.82 2.38 0.45 117 HTML_IMAGE_RATIO_08 1781 2.57 2.37 2.61 118 T_TooManySym_01 1765 4.80 2.35 5.38 119 RCVD_IN_RP_CERTIFIED 1757 9.72 2.34 11.47 120 TR_XM_PHPForged 1711 0.78 2.28 0.43 121 TR_XM_FormFill2 1694 0.78 2.26 0.43 122 XM_H_PHPOS 1686 0.77 2.25 0.42 123 BAYES_00 1682 18.38 2.24 22.20 124 TR_LOTS_OF_MONEY3 1678 0.84 2.24 0.52 125 TR_XM_RelayPhish 1676 1.45 2.23 1.27 126 LongTLD 1656 0.64 2.21 0.27 127 XMStockSpam_06 1646 1.80 2.19 1.70 128 BAYES_20 1646 3.84 2.19 4.23 129 T_XMDrugObfuBody_08 1611 1.57 2.15 1.43 130 RCVD_IN_MSPIKE_L3 1605 1.13 2.14 0.89 131 URI_TRY_3LD 1599 1.70 2.13 1.60 132 TR_Symld_Words 1498 1.51 2.00 1.40 133 RCVD_IN_IADB_LISTED 1494 4.01 1.99 4.49 134 XM_B_Unsub2 1436 2.93 1.91 3.17 135 DKIM_ADSP_CUSTOM_MED 1419 1.14 1.89 0.97 136 TM2_M_VERY_LONG_WORD 1418 1.67 1.89 1.62 137 RCVD_IN_IADB_SPF 1346 3.44 1.79 3.84 138 XM_H_PHPMailer 1337 0.72 1.78 0.47 139 HK_RANDOM_REPLYTO 1334 0.53 1.78 0.24 140 HK_RANDOM_FROM 1324 0.44 1.76 0.12 141 XMBody_17 1321 0.84 1.76 0.62 142 TR_XM_DK_Bayes 1309 14.27 1.74 17.23 143 FORGED_GMAIL_RCVD 1305 0.85 1.74 0.64 144 RCVD_IN_IADB_SENDERID 1301 3.09 1.73 3.41 145 NML_ADSP_CUSTOM_MED 1299 0.86 1.73 0.66 146 RCVD_IN_IADB_DK 1294 2.98 1.72 3.27 147 URI_NO_WWW_INFO_CGI 1287 0.35 1.71 0.02 148 T_XMHurry_00 1197 0.86 1.59 0.68 149 XM_OfRef6 1187 1.60 1.58 1.60 150 T_XMDrugObfuBody_00 1169 1.15 1.56 1.06 151 DATE_IN_PAST_06_12 1169 0.35 1.56 0.06 152 XM_H_PHPOS_M 1167 0.46 1.55 0.21 153 T_XMDrugObfuBody_14 1145 1.77 1.53 1.83 154 TR_XM_DK_Bayes1 1136 13.68 1.51 16.56 155 SUBJ_ALL_CAPS 1114 1.36 1.48 1.33 156 TR_XM_INV_DKIM 1073 0.46 1.43 0.23 157 XMDiploma_00 1056 1.19 1.41 1.14 158 XMSexyCombo_04 1046 0.93 1.39 0.82 159 MPART_ALT_DIFF_COUNT 1023 0.52 1.36 0.32 160 MAILING_LIST_MULTI 1017 1.70 1.35 1.78 161 T_MONEY_PERCENT 1010 0.57 1.35 0.39 162 TR_LOTS_OF_MONEY2 1010 0.57 1.35 0.39 163 XMBdyGiftCard01 998 2.14 1.33 2.33 164 XMPhish11 995 1.03 1.33 0.96 165 XMHTML_After_End 981 0.74 1.31 0.60 166 T_FILL_THIS_FORM_SHORT 968 1.09 1.29 1.04 167 XM_ProductURIs 962 1.04 1.28 0.99 168 XMSubMetaI_00 961 0.77 1.28 0.65 169 DIET_1 959 0.92 1.28 0.83 170 DATE_IN_PAST_12_24 959 0.29 1.28 0.06 171 BAYES_05 880 2.28 1.17 2.54 172 THIS_AD 844 0.46 1.12 0.30 173 XMSlimDrugH 839 0.43 1.12 0.27 174 XM_H_Long_From02 838 1.15 1.12 1.15 175 RELAYCOUNTRY_GB 837 0.63 1.11 0.52 176 TooManyTo_002 830 1.03 1.11 1.02 177 XM_UB60 811 0.26 1.08 0.07 178 TR_XM_DK_Bayes2 795 12.65 1.06 15.40 179 RCVD_IN_MSPIKE_L5 776 0.36 1.03 0.20 180 XMHTMLBadTable_001 775 0.60 1.03 0.50 181 RELAYCOUNTRY_DE 775 0.40 1.03 0.26 182 RELAYCOUNTRY_IE 757 0.28 1.01 0.10 183 LONG_HEX_URI 749 0.30 1.00 0.14 184 RELAYCOUNTRY_AT 742 0.43 0.99 0.30 185 XMSubMetaSSx_00 739 0.63 0.98 0.54 186 HTML_TEXT_INVISIBLE_STYLE 735 0.44 0.98 0.31 187 URIBL_DBL_SPAM 729 0.22 0.97 0.04 188 TR_Mismatch_TLD_02 728 0.24 0.97 0.07 189 XM_DK_Undo_01 728 1.44 0.97 1.55 190 TM2_M_A_HREF_HREF 722 0.79 0.96 0.75 191 XM_SPF_Unknown 720 0.99 0.96 1.00 192 XMPhish30 718 0.70 0.96 0.64 193 T_TooManySym_02 717 2.57 0.96 2.95 194 URIBL_BLACK 715 0.19 0.95 0.01 195 TooManyTo_003 690 0.73 0.92 0.68 196 XMSubMetaSx_01 690 0.24 0.92 0.08 197 XMGenDplmaNmb 681 0.74 0.91 0.71 198 HELO_LH_HOME 661 0.17 0.88 0.00 199 XMBody_78 622 0.49 0.83 0.41 200 LOW_PRICE 598 0.24 0.80 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276616 88.03 91.47 87.21 2 DKIM_SIGNED 248101 77.03 71.99 78.22 3 XM_DK_Pass 244964 75.88 70.18 77.23 4 DKIM_VALID 234960 72.55 66.09 74.08 5 XM_B_Unicode 231570 72.32 69.38 73.01 6 DKIM_VALID_AU 187212 57.01 48.49 59.02 7 XMListUnsubscribeExists 179613 57.80 62.73 56.63 8 BAYES_50 165691 50.65 43.93 52.24 9 DCC_CHECK_NEGATIVE 159343 44.61 20.83 50.24 10 DCC_CHECK 154082 54.10 77.45 48.58 11 XM_B_Unicode3 148499 45.94 42.23 46.82 12 HTML_FONT_LOW_CONTRAST 97850 30.34 28.18 30.85 13 LOC_TINY_FONT_1 89663 28.68 30.41 28.27 14 DKIM_VALID_EF 85505 26.60 25.08 26.96 15 MIME_HTML_ONLY 83483 28.59 38.16 26.32 16 FVGT_m_MULTI_ODD 71695 22.70 23.11 22.60 17 BAYES_00 70425 18.38 2.24 22.20 18 T_TM2_M_HEADER_IN_MSG 65045 19.45 14.96 20.51 19 XMSubLong 63794 21.27 26.14 20.11 20 T_KAM_HTML_FONT_INVALID 57867 18.44 19.27 18.24 21 TR_XM_DK_Bayes 54658 14.27 1.74 17.23 22 TR_XM_DK_Bayes1 52510 13.68 1.51 16.56 23 MultiRelay 50381 16.97 21.55 15.88 24 TR_XM_DK_Bayes2 48839 12.65 1.06 15.40 25 XM_Body_Dirty_Words 46070 16.14 22.97 14.52 26 XM_B_Unsub 43537 14.36 17.05 13.73 27 XM_Multi_Part_URI 42473 14.31 18.19 13.39 28 RCVD_IN_RP_SAFE 39332 10.51 2.50 12.40 29 RCVD_IN_MSPIKE_H2 38269 11.49 9.08 12.07 30 ALL_TRUSTED 38203 11.00 6.57 12.04 31 RCVD_IN_RP_CERTIFIED 36374 9.72 2.34 11.47 32 XM_Evil_Numbers_Gen 33889 10.58 10.11 10.68 33 XM_DKIMWhitelistDomains 33382 8.51 0.02 10.52 34 LOTS_OF_MONEY 32649 11.00 13.97 10.29 35 HTML_IMAGE_RATIO_02 32539 11.20 15.19 10.26 36 RCVD_IN_MSPIKE_WL 31657 8.60 2.74 9.98 37 RCVD_IN_MSPIKE_H3 31654 8.60 2.74 9.98 38 FSL_BULK_SIG 30976 11.93 21.08 9.77 39 XM_B_Phish_Phrases 27289 8.13 6.13 8.60 40 XM_DK_Undo_02 24934 12.54 32.29 7.86 41 MPART_ALT_DIFF 24110 7.45 6.80 7.60 42 LotsOfNums_01 24080 7.45 6.84 7.59 43 HTML_IMAGE_RATIO_04 23050 7.03 6.04 7.27 44 XM_SendGrid 21684 6.51 5.12 6.84 45 XM_H_Long_From01 18970 6.00 6.06 5.98 46 XMStrtUSub 17699 5.02 2.65 5.58 47 XMSexyCombo_05 17398 7.08 13.82 5.49 48 MIME_HTML_ONLY_MULTI 17387 5.13 3.63 5.48 49 TooManyTo_001 17231 5.66 6.64 5.43 50 T_TooManySym_01 17069 4.80 2.35 5.38 51 XM_UncommonTLD01 17007 8.31 20.77 5.36 52 BOTNET_IPINHOSTNAME 16714 7.09 14.77 5.27 53 XMSubMetaSx_00 16563 5.94 8.98 5.22 54 BAYES_40 15630 4.52 2.82 4.93 55 BAYES_60 15604 6.03 10.75 4.92 56 T_REMOTE_IMAGE 15600 4.99 5.27 4.92 57 MIME_QP_LONG_LINE 15089 4.56 3.73 4.76 58 RELAYCOUNTRY_META 14975 7.89 21.29 4.72 59 BAYES_99 14607 8.52 25.07 4.61 60 RCVD_IN_IADB_LISTED 14233 4.01 1.99 4.49 61 TM2_M_URI_OPT_OUT 13568 3.93 2.46 4.28 62 BAYES_20 13409 3.84 2.19 4.23 63 XM_H_Trusted_IP 13294 3.39 0.00 4.19 64 DKIM_INVALID 13141 4.48 5.90 4.14 65 FROM_EXCESS_BASE64 12966 4.98 8.73 4.09 66 HTML_IMAGE_RATIO_06 12213 3.80 3.59 3.85 67 RCVD_IN_IADB_SPF 12166 3.44 1.79 3.84 68 BAYES_999 12100 6.65 18.62 3.81 69 TR_XM_DK_SendGrid 11594 3.47 2.68 3.66 70 XMNumbers 11404 4.20 6.77 3.60 71 RCVD_IN_IADB_SENDERID 10817 3.09 1.73 3.41 72 RCVD_IN_IADB_DK 10385 2.98 1.72 3.27 73 UNPARSEABLE_RELAY 10066 2.71 0.74 3.17 74 XM_B_Unsub2 10053 2.93 1.91 3.17 75 ANY_BOUNCE_MESSAGE 9804 2.56 0.34 3.09 76 BOUNCE_MESSAGE 9801 2.56 0.34 3.09 77 IN_ZIMBRA_NJ_WHITELIST 9778 2.50 0.02 3.08 78 XM_DIRTYINTL 9713 4.13 8.66 3.06 79 RCVD_IN_IADB_VOUCHED 9477 2.54 0.62 2.99 80 T_TooManySym_02 9360 2.57 0.96 2.95 81 XM_PDF 9256 2.43 0.38 2.92 82 MIME_HTML_MOSTLY 8974 3.39 5.74 2.83 83 KHOP_HELO_FCRDNS 8744 3.75 7.94 2.76 84 NO_DNS_FOR_FROM 8391 2.69 2.89 2.65 85 HTML_IMAGE_RATIO_08 8289 2.57 2.37 2.61 86 BAYES_05 8068 2.28 1.17 2.54 87 BAYES_80 8030 3.45 7.33 2.53 88 INVALID_MSGID 7815 2.04 0.25 2.46 89 XM_CamelCaseFrm001 7792 2.73 3.86 2.46 90 XMBdyGiftCard01 7380 2.14 1.33 2.33 91 TVD_RCVD_IP 7219 1.93 0.45 2.28 92 TR_DCC_Bayes_99 6851 5.27 18.39 2.16 93 RELAYCOUNTRY_CA 6731 2.76 5.47 2.12 94 TO_MALFORMED 6618 2.74 5.50 2.09 95 CK_HELO_DYNAMIC_SPLIT_IP 6533 1.68 0.08 2.06 96 HELO_DYNAMIC_IPADDR2 6531 1.67 0.03 2.06 97 RCVD_IN_IADB_OPTIN 6243 1.68 0.48 1.97 98 XMLngstWrd_00 6225 1.72 0.72 1.96 99 BOTNET 6177 5.38 19.86 1.95 100 DKIM_ADSP_NXDOMAIN 6000 2.74 6.32 1.89 101 T_XMDrugObfuBody_14 5805 1.77 1.53 1.83 102 XM_B_SpammyTLD 5782 2.21 3.83 1.82 103 XMSubNoVowel 5759 1.59 0.65 1.82 104 MAILING_LIST_MULTI 5642 1.70 1.35 1.78 105 USER_IN_DEF_DKIM_WL 5516 1.41 0.01 1.74 106 XMStockSpam_06 5400 1.80 2.19 1.70 107 TM2_M_VERY_LONG_WORD 5129 1.67 1.89 1.62 108 URI_TRY_3LD 5076 1.70 2.13 1.60 109 XM_OfRef6 5075 1.60 1.58 1.60 110 IN_HORDE_ADDRESS_BOOK 5050 1.30 0.04 1.59 111 BAYES_95 5013 2.10 4.30 1.58 112 XMLngstWrd_01 4979 1.40 0.69 1.57 113 RCVD_IN_BL_SPAMCOP_NET 4930 2.63 7.19 1.55 114 XM_DK_Undo_01 4921 1.44 0.97 1.55 115 HTML_MIME_NO_HTML_TAG 4816 2.62 7.26 1.52 116 UNTRUSTED_Relay 4677 3.78 13.53 1.47 117 T_XMDrugObfuBody_08 4544 1.57 2.15 1.43 118 URI_HEX 4433 1.77 3.37 1.40 119 TR_Symld_Words 4426 1.51 2.00 1.40 120 AC_FROM_MANY_DOTS 4349 1.11 0.01 1.37 121 RCVD_IN_MSPIKE_BL 4318 1.73 3.28 1.36 122 SUBJ_ALL_CAPS 4214 1.36 1.48 1.33 123 TR_XM_RelayPhish 4026 1.45 2.23 1.27 124 XMSexyCombo_01 3968 1.63 3.22 1.25 125 XMGappySubj_01 3821 1.03 0.29 1.20 126 XM_H_Long_From02 3661 1.15 1.12 1.15 127 XMDiploma_00 3621 1.19 1.41 1.14 128 XMLngstWrd_02 3593 1.03 0.60 1.13 129 XM_GoogleGroups 3455 0.96 0.43 1.09 130 XM_SPF_SoftFail 3368 1.85 5.19 1.06 131 T_XMDrugObfuBody_00 3347 1.15 1.56 1.06 132 XMSubMetaSxObfu_03 3330 0.95 0.52 1.05 133 T_FILL_THIS_FORM_SHORT 3293 1.09 1.29 1.04 134 TooManyTo_002 3223 1.03 1.11 1.02 135 XMBody_95 3181 0.83 0.11 1.00 136 XM_SPF_Unknown 3156 0.99 0.96 1.00 137 XM_ProductURIs 3129 1.04 1.28 0.99 138 DKIM_ADSP_CUSTOM_MED 3072 1.14 1.89 0.97 139 XMPhish11 3055 1.03 1.33 0.96 140 TR_MetaPhish_Combo_01 3009 0.90 0.71 0.95 141 RCVD_IN_MSPIKE_L3 2809 1.13 2.14 0.89 142 DIET_1 2641 0.92 1.28 0.83 143 XMSexyCombo_04 2593 0.93 1.39 0.82 144 PLING_QUERY 2569 1.14 2.51 0.81 145 XM_UB50 2545 2.41 9.20 0.80 146 XM_B_REG_HTML 2539 0.70 0.28 0.80 147 USER_IN_WHITELIST 2444 0.62 0.00 0.77 148 TM2_M_A_HREF_HREF 2385 0.79 0.96 0.75 149 HTML_FONT_FACE_BAD 2362 0.75 0.76 0.74 150 PDS_OTHER_BAD_TLD 2339 1.28 3.59 0.74 151 XMGenDplmaNmb 2241 0.74 0.91 0.71 152 TooManyTo_003 2170 0.73 0.92 0.68 153 T_XMHurry_00 2161 0.86 1.59 0.68 154 NML_ADSP_CUSTOM_MED 2086 0.86 1.73 0.66 155 XMSubMetaI_00 2071 0.77 1.28 0.65 156 XMPhish30 2029 0.70 0.96 0.64 157 FORGED_GMAIL_RCVD 2015 0.85 1.74 0.64 158 XMBody_17 1964 0.84 1.76 0.62 159 FILL_THIS_FORM 1925 0.60 0.59 0.61 160 XMHTML_After_End 1913 0.74 1.31 0.60 161 XMBrknScrpt_02 1813 0.61 0.76 0.57 162 HTML_TAG_BALANCE_BODY 1811 0.61 0.79 0.57 163 XM_Body_Obfu01 1802 0.52 0.30 0.57 164 XM_E_Blogspot 1802 0.47 0.08 0.57 165 TooManyTo_004 1773 0.60 0.77 0.56 166 SUBJ_DOLLARS 1729 0.54 0.50 0.55 167 HTML_IMAGE_ONLY_20 1721 0.49 0.25 0.54 168 XMSubMetaSSx_00 1714 0.63 0.98 0.54 169 XM_D_tchamptons_WL 1691 0.43 0.01 0.53 170 HELO_NODOT 1681 0.51 0.45 0.53 171 RELAYCOUNTRY_GB 1642 0.63 1.11 0.52 172 TR_LOTS_OF_MONEY3 1636 0.84 2.24 0.52 173 XMBSHREFv2 1636 0.46 0.24 0.52 174 HELO_NO_DOMAIN 1631 0.50 0.45 0.51 175 XMHTMLBadTable_001 1584 0.60 1.03 0.50 176 T_TooManySym_03 1575 0.43 0.14 0.50 177 TooManyTo_005 1550 0.52 0.63 0.49 178 FILL_THIS_FORM_LONG 1526 0.49 0.51 0.48 179 XM_H_PHPMailer 1505 0.72 1.78 0.47 180 T_OBFU_PDF_ATTACH 1489 0.41 0.16 0.47 181 XMNoVowels 1489 0.49 0.58 0.47 182 XMSubMetaSxObfu_02 1421 0.43 0.35 0.45 183 TR_XM_PHPDW 1417 0.82 2.38 0.45 184 FSL_THIS_IS_ADV 1412 0.43 0.38 0.45 185 XM_B_COPY_HTML 1374 0.49 0.74 0.43 186 XM_URI_RBL 1369 0.86 2.66 0.43 187 RDNS_DYNAMIC 1369 1.57 6.38 0.43 188 TR_XM_FormFill2 1361 0.78 2.26 0.43 189 TR_XM_PHPForged 1360 0.78 2.28 0.43 190 T_FILL_THIS_FORM_LOAN 1347 0.40 0.28 0.42 191 XM_H_PHPOS 1331 0.77 2.25 0.42 192 XMOemUri 1308 0.37 0.20 0.41 193 XMBody_78 1286 0.49 0.83 0.41 194 URI_NOVOWEL 1257 0.43 0.58 0.40 195 RELAYCOUNTRY_AU 1251 0.41 0.46 0.39 196 T_MONEY_PERCENT 1235 0.57 1.35 0.39 197 TR_LOTS_OF_MONEY2 1235 0.57 1.35 0.39 198 REMOVE_BEFORE_LINK 1229 0.38 0.36 0.39 199 XMGetyour 1213 0.32 0.06 0.38 200 HTTPS_HTTP_MISMATCH 1212 0.40 0.48 0.38 ----------------------------------------------------------------------