Email: 549205 Autolearn: 0 AvgScore: 2.41 AvgScanTime: 2.00 sec Spam: 141827 Autolearn: 0 AvgScore: 11.66 AvgScanTime: 3.04 sec Ham: 407378 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 1.64 sec Time Spent Running SA: 305.31 hours Time Spent Processing Spam: 119.72 hours Time Spent Processing Ham: 185.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136257 90.03 96.07 87.93 2 RELAYCOUNTRY_US 95264 78.52 67.17 82.47 3 XM_B_Unicode 94528 69.72 66.65 70.79 4 DKIM_SIGNED 92497 74.68 65.22 77.97 5 DCC_CHECK 90653 48.97 63.92 43.76 6 XM_DK_Pass 89320 73.26 62.98 76.84 7 BAYES_50 79416 51.74 55.99 50.26 8 XMListUnsubscribeExists 78170 54.55 55.12 54.36 9 DKIM_VALID 78001 68.32 55.00 72.95 10 DKIM_VALID_AU 58061 53.05 40.94 57.26 11 XM_B_Unicode3 53901 41.65 38.00 42.92 12 DCC_CHECK_NEGATIVE 49052 49.51 34.59 54.70 13 MIME_HTML_ONLY 42853 23.96 30.21 21.78 14 LOC_TINY_FONT_1 39805 25.94 28.07 25.20 15 XM_DK_Undo_02 39302 12.62 27.71 7.37 16 UNTRUSTED_Relay 39016 8.40 27.51 1.74 17 HTML_FONT_LOW_CONTRAST 35317 27.75 24.90 28.74 18 FVGT_m_MULTI_ODD 33553 22.33 23.66 21.87 19 XM_B_Phish_Phrases 33386 11.12 23.54 6.79 20 MIME_QP_LONG_LINE 32593 9.98 22.98 5.45 21 XM_UB50 32275 6.55 22.76 0.90 22 TM2_M_URI_OPT_OUT 30866 7.72 21.76 2.83 23 DKIM_VALID_EF 30447 25.79 21.47 27.30 24 XMSubLong 28189 20.12 19.88 20.21 25 T_TM2_M_HEADER_IN_MSG 27430 25.71 19.34 27.93 26 RELAYCOUNTRY_META 25926 9.15 18.28 5.98 27 XM_B_Illumintati 25877 4.72 18.25 0.01 28 BAYES_99 25283 7.33 17.83 3.67 29 T_KAM_HTML_FONT_INVALID 24333 17.19 17.16 17.20 30 XM_B_Unsub 23861 11.62 16.82 9.81 31 BOTNET 23599 6.45 16.64 2.90 32 XM_Body_Dirty_Words 22385 14.11 15.78 13.53 33 HTML_IMAGE_RATIO_02 21217 11.03 14.96 9.66 34 HELO_NODOT 21092 4.93 14.87 1.46 35 MISSING_HEADERS 21071 4.16 14.86 0.44 36 HELO_NO_DOMAIN 21055 4.92 14.85 1.46 37 XM_Evil_Numbers_Gen 20854 11.42 14.70 10.28 38 RELAYCOUNTRY_NG_I 20290 3.69 14.31 0.00 39 XMSubNoVowel 20147 4.66 14.21 1.34 40 XMSubEmpty 19933 3.80 14.05 0.23 41 XM_Multi_Part_URI 19495 12.82 13.75 12.50 42 BAYES_999 19223 5.75 13.55 3.03 43 XM_UncommonTLD01 19061 5.96 13.44 3.35 44 FSL_BULK_SIG 19060 8.79 13.44 7.17 45 TR_DCC_Bayes_99 18456 4.99 13.01 2.19 46 LotsOfNums_01 16443 9.02 11.59 8.12 47 BOTNET_IPINHOSTNAME 15733 6.54 11.09 4.96 48 DKIM_INVALID 14496 6.36 10.22 5.01 49 KHOP_HELO_FCRDNS 13879 3.66 9.79 1.53 50 XMSexyCombo_05 12243 5.60 8.63 4.54 51 LOTS_OF_MONEY 12119 8.03 8.54 7.85 52 RCVD_IN_MSPIKE_H2 11666 11.25 8.23 12.31 53 XM_H_Long_From01 11191 6.60 7.89 6.16 54 NO_DNS_FOR_FROM 10949 3.92 7.72 2.60 55 MPART_ALT_DIFF 10018 4.99 7.06 4.27 56 XMSubMetaSx_00 9161 4.38 6.46 3.66 57 BAYES_80 8911 3.36 6.28 2.34 58 BAYES_60 8722 5.02 6.15 4.62 59 T_REMOTE_IMAGE 8548 4.05 6.03 3.36 60 HTML_IMAGE_RATIO_04 7365 6.50 5.19 6.96 61 XM_SendGrid 6956 6.22 4.90 6.68 62 MIME_HTML_MOSTLY 6810 2.97 4.80 2.33 63 ANY_BOUNCE_MESSAGE 6798 3.20 4.79 2.64 64 BOUNCE_MESSAGE 6794 3.20 4.79 2.64 65 HTML_MIME_NO_HTML_TAG 6682 2.65 4.71 1.93 66 XMLngstWrd_00 6594 1.48 4.65 0.38 67 XMLngstWrd_01 6560 1.44 4.63 0.34 68 XMNumbers 6530 4.24 4.60 4.11 69 URI_OPTOUT_3LD 6263 1.18 4.42 0.06 70 TooManyTo_001 6223 7.37 4.39 8.40 71 RELAYCOUNTRY_FR 6066 1.35 4.28 0.33 72 XMStrtUSub 5802 5.53 4.09 6.03 73 TR_Mismatch_TLD_02 5753 1.09 4.06 0.06 74 XM_SPF_SoftFail 5739 2.18 4.05 1.53 75 RDNS_DYNAMIC 5572 1.27 3.93 0.35 76 RCVD_IN_MSPIKE_BL 5484 1.85 3.87 1.15 77 PDS_OTHER_BAD_TLD 5196 1.33 3.66 0.52 78 BAYES_40 5141 5.37 3.62 5.97 79 SpammyFromTLD_02 5015 1.07 3.54 0.21 80 BAYES_95 4996 1.91 3.52 1.35 81 BODY_URI_ONLY 4953 0.96 3.49 0.07 82 XM_B_SpammyTLD 4636 2.45 3.27 2.16 83 DATE_IN_PAST_03_06 4581 0.93 3.23 0.14 84 HTML_IMAGE_RATIO_06 4476 3.41 3.16 3.49 85 XM_DIRTYINTL 4469 1.25 3.15 0.58 86 RCVD_IN_BL_SPAMCOP_NET 4354 1.50 3.07 0.95 87 HTML_IMAGE_ONLY_08 4347 0.88 3.07 0.12 88 RELAYCOUNTRY_CA 4306 2.16 3.04 1.86 89 DIET_1 4278 1.16 3.02 0.52 90 MIME_HTML_ONLY_MULTI 4233 2.87 2.98 2.83 91 FROM_SUSPICIOUS_NTLD 4024 0.74 2.84 0.02 92 HTML_IMAGE_RATIO_08 3979 2.57 2.81 2.49 93 FROM_SUSPICIOUS_NTLD_FP 3951 0.73 2.79 0.01 94 RCVD_IN_MSPIKE_WL 3935 8.21 2.77 10.10 95 RCVD_IN_MSPIKE_H3 3935 8.21 2.77 10.10 96 T_TooManySym_01 3748 4.82 2.64 5.58 97 XM_CamelCaseFrm001 3658 2.52 2.58 2.49 98 RCVD_IN_RP_RNBL 3625 0.74 2.56 0.11 99 LongTLD 3599 0.75 2.54 0.13 100 FROM_EXCESS_BASE64 3578 3.62 2.52 4.00 101 BAYES_20 3577 4.23 2.52 4.82 102 HDRS_LCASE_IMGONLY 3486 0.65 2.46 0.03 103 HTML_SHORT_LINK_IMG_1 3460 0.65 2.44 0.02 104 RCVD_IN_MSPIKE_L3 3455 1.12 2.44 0.66 105 TR_XM_RelayPhish 3404 0.77 2.40 0.20 106 URI_HEX 3363 1.70 2.37 1.46 107 BAYES_00 3340 18.03 2.35 23.48 108 SpammyFromTLD_01 3268 1.05 2.30 0.61 109 XMSexyCombo_01 3216 1.07 2.27 0.65 110 XM_URI_RBL 3157 0.73 2.23 0.21 111 TR_XM_INV_DKIM 3060 0.65 2.16 0.12 112 XMDiploma_00 3002 1.66 2.12 1.51 113 TR_XM_PHPDW 2956 0.96 2.08 0.56 114 TR_XM_PHPForged 2926 0.94 2.06 0.54 115 TR_XM_FormFill2 2909 0.93 2.05 0.54 116 XM_H_PHPOS 2901 0.92 2.05 0.53 117 HTML_TAG_BALANCE_CENTER 2861 0.58 2.02 0.08 118 T_XMDrugObfuBody_08 2825 1.40 1.99 1.20 119 FROM_MISSP_REPLYTO 2811 0.52 1.98 0.02 120 TR_XM_DK_SendGrid 2762 3.10 1.95 3.50 121 XM_B_Unsub2 2755 2.14 1.94 2.20 122 XMSubMetaI_00 2735 1.47 1.93 1.30 123 TR_XM_DK_Bayes 2702 14.04 1.91 18.26 124 XMSlimDrugH 2697 0.79 1.90 0.40 125 XM_BadFromFormat 2686 0.57 1.89 0.11 126 RCVD_IN_RP_SAFE 2677 8.96 1.89 11.43 127 RCVD_IN_IADB_LISTED 2637 3.77 1.86 4.44 128 XMBounce_01 2529 0.53 1.78 0.09 129 DATE_IN_PAST_06_12 2529 0.49 1.78 0.05 130 RCVD_IN_IADB_SPF 2509 3.30 1.77 3.84 131 RCVD_IN_IADB_DK 2471 2.90 1.74 3.30 132 RCVD_IN_IADB_SENDERID 2464 2.94 1.74 3.36 133 BOTNET_NORDNS 2370 0.48 1.67 0.07 134 RCVD_IN_RP_CERTIFIED 2276 8.18 1.60 10.47 135 XMGenDplmaNmb 2258 1.07 1.59 0.88 136 RELAYCOUNTRY_GB 2256 1.37 1.59 1.29 137 SUBJ_ALL_CAPS 2245 1.66 1.58 1.68 138 XMWghtMeta_00 2199 0.42 1.55 0.02 139 TM2_M_VERY_LONG_WORD 2174 1.37 1.53 1.31 140 T_XMHurry_00 2165 1.10 1.53 0.95 141 FROM_MISSP_DYNIP 2158 0.39 1.52 0.00 142 RELAYCOUNTRY_IN 2146 0.50 1.51 0.15 143 ALL_TRUSTED 2052 10.56 1.45 13.73 144 LONG_JUNK_URI2 2019 0.43 1.42 0.09 145 SUBJECT_DIET 2006 0.37 1.41 0.00 146 REPLYTO_WITHOUT_TO_CC 1985 0.39 1.40 0.04 147 XMHTML_After_End 1976 0.94 1.39 0.79 148 T_XMDrugObfuBody_14 1961 1.48 1.38 1.51 149 XM_OfRef6 1939 1.49 1.37 1.53 150 BAYES_05 1934 2.79 1.36 3.28 151 URI_TRY_3LD 1904 1.39 1.34 1.40 152 XMStockSpam_06 1894 1.36 1.34 1.36 153 TR_XM_DK_Bayes1 1862 13.18 1.31 17.31 154 XM_H_Long_From02 1810 1.27 1.28 1.27 155 RELAYCOUNTRY_AT 1785 0.56 1.26 0.32 156 XMBody_17 1784 0.85 1.26 0.71 157 XMMoneyMeta_00 1760 0.57 1.24 0.34 158 RELAYCOUNTRY_DE 1745 0.69 1.23 0.50 159 XM_ProductURIs 1731 1.01 1.22 0.94 160 XM_H_PHPMailer 1720 0.79 1.21 0.64 161 TR_XM_DK_Bayes2 1694 11.92 1.19 15.66 162 XM_H_PHPOS_M 1689 0.52 1.19 0.29 163 XM_UB60 1674 0.35 1.18 0.07 164 TR_Symld_Words 1662 1.15 1.17 1.14 165 HTML_IMAGE_ONLY_12 1642 0.44 1.16 0.19 166 T_XMDrugObfuBody_00 1601 0.71 1.13 0.56 167 XMNoVowels 1597 0.85 1.13 0.76 168 XMHTMLBadTable_001 1530 0.68 1.08 0.54 169 TR_MetaPhish_Combo_01 1482 0.78 1.04 0.68 170 MIME_HEADER_CTYPE_ONLY 1461 0.44 1.03 0.23 171 XMSexyCombo_04 1456 0.35 1.03 0.12 172 DKIM_ADSP_CUSTOM_MED 1440 1.19 1.02 1.26 173 THIS_AD 1408 0.82 0.99 0.76 174 MAILING_LIST_MULTI 1397 2.01 0.99 2.37 175 RCVD_IN_MSPIKE_L5 1353 0.37 0.95 0.17 176 XMBdyGiftCard01 1331 1.45 0.94 1.63 177 TO_EQ_FM_DOM_HTML_IMG 1302 0.24 0.92 0.01 178 UNPARSEABLE_RELAY 1289 2.05 0.91 2.44 179 T_Symld_Words_02 1241 0.52 0.88 0.40 180 DATE_IN_PAST_12_24 1239 0.25 0.87 0.03 181 RCVD_IN_PSBL 1237 0.23 0.87 0.00 182 MPART_ALT_DIFF_COUNT 1232 0.53 0.87 0.41 183 TR_LOTS_OF_MONEY2 1206 0.40 0.85 0.25 184 T_MONEY_PERCENT 1206 0.40 0.85 0.25 185 XMBrknScrpt_02 1203 0.64 0.85 0.56 186 SUBJ_DOLLARS 1181 0.56 0.83 0.47 187 XM_B_COPY_HTML 1179 0.57 0.83 0.48 188 XM_H_MailChimp 1172 0.31 0.83 0.13 189 FORGED_GMAIL_RCVD 1168 0.68 0.82 0.63 190 XM_DK_Undo_01 1154 1.47 0.81 1.70 191 NML_ADSP_CUSTOM_MED 1130 0.90 0.80 0.93 192 TR_Mismatch_TLD_01 1119 0.41 0.79 0.28 193 DKIM_ADSP_NXDOMAIN 1086 0.44 0.77 0.32 194 XMPhish08 1073 0.67 0.76 0.64 195 XM_SPF_Unknown 1069 0.53 0.75 0.46 196 XMPhish30 1042 0.55 0.73 0.48 197 HTML_COMMENT_SAVED_URL 997 0.22 0.70 0.05 198 HK_RANDOM_REPLYTO 993 0.37 0.70 0.26 199 XMSubMetaSxObfu_03 983 0.49 0.69 0.42 200 TR_LOTS_OF_MONEY1 981 0.19 0.69 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 358215 90.03 96.07 87.93 2 RELAYCOUNTRY_US 335950 78.52 67.17 82.47 3 DKIM_SIGNED 317625 74.68 65.22 77.97 4 XM_DK_Pass 313037 73.26 62.98 76.84 5 DKIM_VALID 297198 68.32 55.00 72.95 6 XM_B_Unicode 288394 69.72 66.65 70.79 7 DKIM_VALID_AU 233276 53.05 40.94 57.26 8 DCC_CHECK_NEGATIVE 222836 49.51 34.59 54.70 9 XMListUnsubscribeExists 221438 54.55 55.12 54.36 10 BAYES_50 204750 51.74 55.99 50.26 11 DCC_CHECK 178269 48.97 63.92 43.76 12 XM_B_Unicode3 174865 41.65 38.00 42.92 13 HTML_FONT_LOW_CONTRAST 117073 27.75 24.90 28.74 14 T_TM2_M_HEADER_IN_MSG 113765 25.71 19.34 27.93 15 DKIM_VALID_EF 111216 25.79 21.47 27.30 16 LOC_TINY_FONT_1 102641 25.94 28.07 25.20 17 BAYES_00 95667 18.03 2.35 23.48 18 FVGT_m_MULTI_ODD 89101 22.33 23.66 21.87 19 MIME_HTML_ONLY 88743 23.96 30.21 21.78 20 XMSubLong 82312 20.12 19.88 20.21 21 TR_XM_DK_Bayes 74400 14.04 1.91 18.26 22 TR_XM_DK_Bayes1 70535 13.18 1.31 17.31 23 T_KAM_HTML_FONT_INVALID 70051 17.19 17.16 17.20 24 TR_XM_DK_Bayes2 63782 11.92 1.19 15.66 25 ALL_TRUSTED 55934 10.56 1.45 13.73 26 XM_Body_Dirty_Words 55109 14.11 15.78 13.53 27 XM_Multi_Part_URI 50906 12.82 13.75 12.50 28 RCVD_IN_MSPIKE_H2 50142 11.25 8.23 12.31 29 RCVD_IN_RP_SAFE 46559 8.96 1.89 11.43 30 RCVD_IN_RP_CERTIFIED 42637 8.18 1.60 10.47 31 XM_Evil_Numbers_Gen 41867 11.42 14.70 10.28 32 RCVD_IN_MSPIKE_H3 41156 8.21 2.77 10.10 33 RCVD_IN_MSPIKE_WL 41156 8.21 2.77 10.10 34 XM_B_Unsub 39973 11.62 16.82 9.81 35 HTML_IMAGE_RATIO_02 39347 11.03 14.96 9.66 36 XM_DKIMWhitelistDomains 34485 6.28 0.02 8.47 37 TooManyTo_001 34239 7.37 4.39 8.40 38 LotsOfNums_01 33090 9.02 11.59 8.12 39 LOTS_OF_MONEY 31968 8.03 8.54 7.85 40 XM_DK_Undo_02 30028 12.62 27.71 7.37 41 FSL_BULK_SIG 29199 8.79 13.44 7.17 42 HTML_IMAGE_RATIO_04 28348 6.50 5.19 6.96 43 XM_B_Phish_Phrases 27679 11.12 23.54 6.79 44 XM_SendGrid 27194 6.22 4.90 6.68 45 XM_H_Long_From01 25080 6.60 7.89 6.16 46 XMStrtUSub 24565 5.53 4.09 6.03 47 RELAYCOUNTRY_META 24347 9.15 18.28 5.98 48 BAYES_40 24325 5.37 3.62 5.97 49 T_TooManySym_01 22737 4.82 2.64 5.58 50 MIME_QP_LONG_LINE 22202 9.98 22.98 5.45 51 DKIM_INVALID 20427 6.36 10.22 5.01 52 BOTNET_IPINHOSTNAME 20190 6.54 11.09 4.96 53 BAYES_20 19644 4.23 2.52 4.82 54 BAYES_60 18826 5.02 6.15 4.62 55 XMSexyCombo_05 18512 5.60 8.63 4.54 56 RCVD_IN_IADB_LISTED 18070 3.77 1.86 4.44 57 MPART_ALT_DIFF 17391 4.99 7.06 4.27 58 XMNumbers 16747 4.24 4.60 4.11 59 XM_PDF 16472 3.15 0.57 4.04 60 FROM_EXCESS_BASE64 16298 3.62 2.52 4.00 61 IN_ZIMBRA_NJ_WHITELIST 15968 2.91 0.01 3.92 62 RCVD_IN_IADB_SPF 15641 3.30 1.77 3.84 63 BAYES_99 14968 7.33 17.83 3.67 64 XMSubMetaSx_00 14891 4.38 6.46 3.66 65 TR_XM_DK_SendGrid 14249 3.10 1.95 3.50 66 HTML_IMAGE_RATIO_06 14234 3.41 3.16 3.49 67 RCVD_IN_IADB_SENDERID 13679 2.94 1.74 3.36 68 T_REMOTE_IMAGE 13670 4.05 6.03 3.36 69 XM_UncommonTLD01 13647 5.96 13.44 3.35 70 RCVD_IN_IADB_DK 13461 2.90 1.74 3.30 71 BAYES_05 13369 2.79 1.36 3.28 72 BAYES_999 12355 5.75 13.55 3.03 73 BOTNET 11829 6.45 16.64 2.90 74 RCVD_IN_IADB_VOUCHED 11791 2.26 0.43 2.89 75 MIME_HTML_ONLY_MULTI 11533 2.87 2.98 2.83 76 TM2_M_URI_OPT_OUT 11511 7.72 21.76 2.83 77 T_TooManySym_02 11067 2.19 0.67 2.72 78 ANY_BOUNCE_MESSAGE 10769 3.20 4.79 2.64 79 BOUNCE_MESSAGE 10767 3.20 4.79 2.64 80 NO_DNS_FOR_FROM 10605 3.92 7.72 2.60 81 XM_CamelCaseFrm001 10157 2.52 2.58 2.49 82 HTML_IMAGE_RATIO_08 10133 2.57 2.81 2.49 83 UNPARSEABLE_RELAY 9960 2.05 0.91 2.44 84 XM_H_Trusted_IP 9939 1.81 0.00 2.44 85 MAILING_LIST_MULTI 9661 2.01 0.99 2.37 86 BAYES_80 9515 3.36 6.28 2.34 87 MIME_HTML_MOSTLY 9484 2.97 4.80 2.33 88 XM_B_Unsub2 8979 2.14 1.94 2.20 89 TR_DCC_Bayes_99 8934 4.99 13.01 2.19 90 XM_B_SpammyTLD 8805 2.45 3.27 2.16 91 HTML_MIME_NO_HTML_TAG 7879 2.65 4.71 1.93 92 TooManyTo_002 7871 1.57 0.54 1.93 93 TVD_RCVD_IP 7784 1.55 0.51 1.91 94 RELAYCOUNTRY_CA 7577 2.16 3.04 1.86 95 RCVD_IN_IADB_OPTIN 7498 1.45 0.34 1.84 96 INVALID_MSGID 7360 1.38 0.15 1.81 97 UNTRUSTED_Relay 7099 8.40 27.51 1.74 98 XM_DK_Undo_01 6934 1.47 0.81 1.70 99 TO_MALFORMED 6863 1.26 0.03 1.68 100 SUBJ_ALL_CAPS 6850 1.66 1.58 1.68 101 XMBdyGiftCard01 6635 1.45 0.94 1.63 102 IN_HORDE_ADDRESS_BOOK 6482 1.19 0.03 1.59 103 XM_RXBody 6399 1.27 0.41 1.57 104 CK_HELO_DYNAMIC_SPLIT_IP 6251 1.17 0.13 1.53 105 HELO_DYNAMIC_IPADDR2 6249 1.15 0.04 1.53 106 XM_SPF_SoftFail 6233 2.18 4.05 1.53 107 XM_OfRef6 6226 1.49 1.37 1.53 108 KHOP_HELO_FCRDNS 6215 3.66 9.79 1.53 109 T_XMDrugObfuBody_14 6149 1.48 1.38 1.51 110 XMDiploma_00 6134 1.66 2.12 1.51 111 URI_HEX 5965 1.70 2.37 1.46 112 HELO_NODOT 5964 4.93 14.87 1.46 113 HELO_NO_DOMAIN 5955 4.92 14.85 1.46 114 URI_TRY_3LD 5706 1.39 1.34 1.40 115 XMStockSpam_06 5555 1.36 1.34 1.36 116 TooManyTo_003 5536 1.11 0.41 1.36 117 BAYES_95 5504 1.91 3.52 1.35 118 XMSubNoVowel 5463 4.66 14.21 1.34 119 USER_IN_DEF_DKIM_WL 5357 0.98 0.00 1.31 120 TM2_M_VERY_LONG_WORD 5327 1.37 1.53 1.31 121 XMSubMetaI_00 5313 1.47 1.93 1.30 122 RELAYCOUNTRY_GB 5253 1.37 1.59 1.29 123 XM_H_Long_From02 5169 1.27 1.28 1.27 124 DKIM_ADSP_CUSTOM_MED 5114 1.19 1.02 1.26 125 T_XMDrugObfuBody_08 4870 1.40 1.99 1.20 126 XM_GoogleGroups 4796 0.96 0.35 1.18 127 TR_MSPIKEBAYES00 4712 0.86 0.02 1.16 128 RCVD_IN_MSPIKE_BL 4671 1.85 3.87 1.15 129 TR_Symld_Words 4661 1.15 1.17 1.14 130 XMCapTrack 4506 0.91 0.36 1.11 131 TooManyTo_004 4260 0.87 0.35 1.05 132 XMGappySubj_01 4111 0.80 0.20 1.01 133 T_FILL_THIS_FORM_SHORT 4025 0.91 0.68 0.99 134 T_XMHurry_00 3885 1.10 1.53 0.95 135 RCVD_IN_BL_SPAMCOP_NET 3859 1.50 3.07 0.95 136 XM_ProductURIs 3828 1.01 1.22 0.94 137 NML_ADSP_CUSTOM_MED 3804 0.90 0.80 0.93 138 XM_UB50 3676 6.55 22.76 0.90 139 TooManyTo_005 3653 0.74 0.30 0.90 140 XMGenDplmaNmb 3594 1.07 1.59 0.88 141 HTML_FONT_FACE_BAD 3313 0.75 0.55 0.81 142 XMBody_95 3223 0.61 0.10 0.79 143 XMHTML_After_End 3208 0.94 1.39 0.79 144 FILL_THIS_FORM 3202 0.63 0.18 0.79 145 THIS_AD 3098 0.82 0.99 0.76 146 XMNoVowels 3086 0.85 1.13 0.76 147 XM_E_Blogspot 3054 0.58 0.10 0.75 148 XMBody_17 2908 0.85 1.26 0.71 149 TR_MetaPhish_Combo_01 2775 0.78 1.04 0.68 150 RCVD_IN_MSPIKE_L3 2701 1.12 2.44 0.66 151 FILL_THIS_FORM_LONG 2694 0.52 0.12 0.66 152 XMSexyCombo_01 2666 1.07 2.27 0.65 153 XMPhish08 2622 0.67 0.76 0.64 154 T_FILL_THIS_FORM_LOAN 2617 0.50 0.09 0.64 155 XM_H_PHPMailer 2592 0.79 1.21 0.64 156 FORGED_GMAIL_RCVD 2576 0.68 0.82 0.63 157 XM_B_REG_HTML 2564 0.59 0.49 0.63 158 T_OBFU_PDF_ATTACH 2555 0.50 0.14 0.63 159 SpammyFromTLD_01 2504 1.05 2.30 0.61 160 XM_DIRTYINTL 2371 1.25 3.15 0.58 161 TR_XM_PHPDW 2300 0.96 2.08 0.56 162 T_XMDrugObfuBody_00 2298 0.71 1.13 0.56 163 USER_IN_WHITELIST 2294 0.42 0.00 0.56 164 XMBrknScrpt_02 2292 0.64 0.85 0.56 165 XMOemUri 2238 0.49 0.33 0.55 166 HTML_TAG_BALANCE_BODY 2222 0.57 0.63 0.55 167 TR_XM_PHPForged 2215 0.94 2.06 0.54 168 TR_XM_FormFill2 2210 0.93 2.05 0.54 169 XMHTMLBadTable_001 2185 0.68 1.08 0.54 170 XM_H_PHPOS 2179 0.92 2.05 0.53 171 PDS_OTHER_BAD_TLD 2121 1.33 3.66 0.52 172 DIET_1 2114 1.16 3.02 0.52 173 FSL_THIS_IS_ADV 2057 0.43 0.21 0.50 174 RELAYCOUNTRY_DE 2026 0.69 1.23 0.50 175 XM_ShortIntro_01 2010 0.48 0.43 0.49 176 XMPhish30 1974 0.55 0.73 0.48 177 T_TooManySym_03 1965 0.40 0.18 0.48 178 XM_B_COPY_HTML 1961 0.57 0.83 0.48 179 HTTPS_HTTP_MISMATCH 1923 0.47 0.46 0.47 180 SUBJ_DOLLARS 1895 0.56 0.83 0.47 181 T_MANY_PILL_PRICE 1883 0.35 0.01 0.46 182 XM_SPF_Unknown 1865 0.53 0.75 0.46 183 MISSING_HEADERS 1798 4.16 14.86 0.44 184 TM2_M_BODY_EMPTY 1798 0.34 0.06 0.44 185 XMBSHREFv2 1732 0.40 0.32 0.43 186 XMSubMetaSxObfu_03 1731 0.49 0.69 0.42 187 HTML_IMAGE_ONLY_20 1729 0.43 0.45 0.42 188 XMGppyBdWords 1711 0.45 0.52 0.42 189 MPART_ALT_DIFF_COUNT 1658 0.53 0.87 0.41 190 T_Symld_Words_02 1641 0.52 0.88 0.40 191 HTML_IMAGE_ONLY_28 1637 0.42 0.45 0.40 192 SHORT_HELO_AND_INLINE_IMAGE 1636 0.32 0.10 0.40 193 XMSlimDrugH 1627 0.79 1.90 0.40 194 RELAYCOUNTRY_AU 1571 0.36 0.29 0.39 195 XMLngstWrd_00 1556 1.48 4.65 0.38 196 PLING_QUERY 1517 0.39 0.45 0.37 197 HTML_IMAGE_ONLY_32 1513 0.31 0.13 0.37 198 URI_NOVOWEL 1498 0.40 0.49 0.37 199 RCVD_IN_SORBS_DUL 1452 0.34 0.29 0.36 200 TM2_M_A_HREF_HREF 1450 0.40 0.53 0.36 ----------------------------------------------------------------------