Email: 792540 Autolearn: 0 AvgScore: 4.70 AvgScanTime: 4.57 sec Spam: 253920 Autolearn: 0 AvgScore: 13.60 AvgScanTime: 5.48 sec Ham: 538620 Autolearn: 0 AvgScore: 0.50 AvgScanTime: 4.15 sec Time Spent Running SA: 1006.80 hours Time Spent Processing Spam: 386.45 hours Time Spent Processing Ham: 620.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 241791 82.86 95.22 77.04 2 DKIM_SIGNED 196524 65.58 77.40 60.02 3 DCC_CHECK 195065 44.59 76.82 29.40 4 XM_DK_Pass 192721 64.45 75.90 59.05 5 DKIM_VALID 182606 60.44 71.91 55.04 6 XMListUnsubscribeExists 169330 48.49 66.69 39.91 7 DKIM_VALID_AU 139807 43.85 55.06 38.57 8 XM_H_QuotedFrom 121453 35.18 47.83 29.22 9 XM_DK_Undo_02 114750 21.67 45.19 10.58 10 BAYES_99 109953 20.74 43.30 10.11 11 MIME_HTML_ONLY 95225 22.64 37.50 15.64 12 BAYES_999 90336 17.30 35.58 8.69 13 TR_DCC_Bayes_99 86698 13.99 34.14 4.48 14 LOC_TINY_FONT_1 85493 22.99 33.67 17.95 15 HTML_FONT_LOW_CONTRAST 84060 26.00 33.10 22.65 16 BAYES_50 75548 50.96 29.75 60.96 17 XMSubLong 61276 19.44 24.13 17.23 18 FVGT_m_MULTI_ODD 60291 22.46 23.74 21.86 19 DKIM_VALID_EF 54380 21.90 21.42 22.12 20 DCC_CHECK_NEGATIVE 54327 53.69 21.40 68.91 21 T_KAM_HTML_FONT_INVALID 50163 15.03 19.76 12.80 22 XM_Body_Dirty_Words 46639 12.24 18.37 9.35 23 BOTNET 43831 6.17 17.26 0.94 24 T_TM2_M_HEADER_IN_MSG 43073 25.26 16.96 29.18 25 XM_Multi_Part_URI 39666 11.13 15.62 9.01 26 HTML_IMAGE_RATIO_02 38004 8.97 14.97 6.15 27 FROM_EXCESS_BASE64 35925 6.39 14.15 2.73 28 RELAYCOUNTRY_META 35506 7.45 13.98 4.37 29 FSL_BULK_SIG 33173 8.13 13.06 5.80 30 MultiRelay 32258 14.66 12.70 15.59 31 XM_Evil_Numbers_Gen 31236 8.20 12.30 6.26 32 LOTS_OF_MONEY 29912 10.32 11.78 9.63 33 BOTNET_IPINHOSTNAME 29379 6.67 11.57 4.35 34 MIME_HEADER_CTYPE_ONLY 28168 3.67 11.09 0.17 35 HTML_MIME_NO_HTML_TAG 25725 4.77 10.13 2.25 36 XMSexyCombo_05 25107 4.71 9.89 2.27 37 BAYES_80 24464 5.79 9.63 3.98 38 XM_BadFromFormat 22146 2.92 8.72 0.19 39 UNTRUSTED_Relay 21736 3.48 8.56 1.09 40 T_XMDrugObfuBody_14 21454 7.20 8.45 6.61 41 XM_UncommonTLD01 21410 4.55 8.43 2.72 42 MISSING_HEADERS 21129 2.97 8.32 0.45 43 HTML_IMAGE_RATIO_04 21064 5.99 8.30 4.90 44 LotsOfNums_01 20302 7.73 8.00 7.60 45 XM_B_Phish_Phrases 20029 5.32 7.89 4.11 46 HTML_FONT_SIZE_HUGE 19678 3.70 7.75 1.79 47 HTML_IMAGE_ONLY_08 19282 3.66 7.59 1.81 48 HTML_SHORT_LINK_IMG_1 19234 3.60 7.57 1.72 49 BAYES_60 18756 6.68 7.39 6.34 50 SHORTENER_SHORT_IMG 18742 3.52 7.38 1.70 51 URI_BUFFLY 18672 3.51 7.35 1.70 52 XM_H_Long_From01 18666 5.68 7.35 4.89 53 BOTNET_NORDNS 18077 2.29 7.12 0.02 54 XMSubMetaSx_00 17644 4.58 6.95 3.46 55 TR_XM_DocInvoice 17222 4.22 6.78 3.01 56 BODY_URI_ONLY 17007 2.18 6.70 0.04 57 TooManyTo_001 16511 7.41 6.50 7.84 58 MPART_ALT_DIFF 16170 3.66 6.37 2.39 59 XMStrtUSub 15370 4.14 6.05 3.24 60 BAYES_95 15115 3.75 5.95 2.71 61 DKIM_INVALID 13918 5.14 5.48 4.98 62 RCVD_IN_RP_SAFE 13212 6.09 5.20 6.51 63 XMNumbers 12536 3.52 4.94 2.86 64 HTML_IMAGE_RATIO_06 11914 3.37 4.69 2.74 65 XM_URI_RBL 11296 1.53 4.45 0.15 66 SpammyFromTLD_02 11066 1.62 4.36 0.34 67 MIME_HTML_MOSTLY 11020 2.80 4.34 2.07 68 TM2_M_URI_OPT_OUT 10872 2.57 4.28 1.76 69 RCVD_IN_RP_RNBL 10787 1.38 4.25 0.03 70 MIME_QP_LONG_LINE 10214 4.63 4.02 4.92 71 RCVD_IN_RP_CERTIFIED 10071 5.14 3.97 5.69 72 FILL_THIS_FORM 9898 1.54 3.90 0.43 73 HTML_IMAGE_RATIO_08 9602 2.63 3.78 2.08 74 URIBL_BLACK 9128 1.18 3.59 0.04 75 RDNS_DYNAMIC 9101 1.45 3.58 0.45 76 XM_SendGrid 8915 4.24 3.51 4.58 77 XM_DIRTYINTL 8895 2.07 3.50 1.40 78 XMMoneyMeta_00 8736 1.39 3.44 0.43 79 XM_CamelCaseFrm001 8681 2.11 3.42 1.50 80 RCVD_IN_MSPIKE_H2 8083 3.81 3.18 4.11 81 XM_UB50 8073 1.52 3.18 0.74 82 XM_SPF_SoftFail 7883 2.15 3.10 1.70 83 MIME_HTML_ONLY_MULTI 7850 1.66 3.09 0.98 84 STYLE_GIBBERISH 7602 1.01 2.99 0.08 85 XM_OfRef6 7590 1.87 2.99 1.34 86 URIBL_CSS_A 7585 0.98 2.99 0.04 87 URIBL_CSS 7585 0.98 2.99 0.04 88 RELAYCOUNTRY_CA 7552 1.73 2.97 1.15 89 XMDiploma_00 6876 1.97 2.71 1.62 90 ALL_TRUSTED 6750 22.14 2.66 31.33 91 T_REMOTE_IMAGE 6749 3.69 2.66 4.18 92 XM_JunkDunk 6684 0.84 2.63 0.00 93 URI_HEX 6544 1.70 2.58 1.28 94 T_TooManySym_01 5810 2.91 2.29 3.20 95 XMSubMetaI_00 5709 1.06 2.25 0.50 96 T_XMDrugObfuBody_08 5514 1.62 2.17 1.37 97 MultiRelay_Combo 5236 0.77 2.06 0.16 98 MultiRelay_CC 5236 0.77 2.06 0.16 99 RCVD_IN_IADB_LISTED 5198 4.20 2.05 5.22 100 DIET_1 5177 0.96 2.04 0.45 101 SUBJ_ALL_CAPS 4773 2.11 1.88 2.22 102 RCVD_IN_IADB_SPF 4736 3.68 1.87 4.54 103 XMMoneyMeta_01 4678 0.62 1.84 0.05 104 XM_H_Long_From02 4629 1.23 1.82 0.95 105 SpammyFromTLD_01 4594 1.06 1.81 0.70 106 XMSexyCombo_01 4562 0.85 1.80 0.40 107 XMNoVowels 4561 1.68 1.80 1.62 108 RCVD_IN_IADB_SENDERID 4560 3.28 1.80 3.98 109 RCVD_IN_IADB_DK 4495 3.21 1.77 3.89 110 XM_UB99 4426 0.58 1.74 0.03 111 RCVD_IN_BL_SPAMCOP_NET 4399 0.73 1.73 0.25 112 T_XMDrugObfuBody_00 4347 1.01 1.71 0.68 113 XMBody_17 4287 0.78 1.69 0.35 114 XM_HighProb1 4257 0.55 1.68 0.01 115 T_XMHurry_00 4159 0.87 1.64 0.50 116 XMStockSpam_06 4146 1.02 1.63 0.73 117 RELAYCOUNTRY_RO 4141 0.52 1.63 0.00 118 XMGenDplmaNmb 4060 1.17 1.60 0.96 119 XM_ProductURIs 3628 1.45 1.43 1.46 120 URIBL_DBL_SPAM 3592 0.49 1.41 0.06 121 TM2_M_VERY_LONG_WORD 3533 1.21 1.39 1.12 122 TR_XM_RelayPhish 3503 0.72 1.38 0.40 123 XM_DK_Undo_01 3479 1.57 1.37 1.66 124 XMBrknScrpt_02 3438 0.76 1.35 0.48 125 URI_TRY_3LD 3372 1.49 1.33 1.57 126 XM_RXBody 3367 0.56 1.33 0.20 127 XMHTML_After_End 3321 0.67 1.31 0.37 128 BAYES_40 3315 3.70 1.31 4.83 129 MAILING_LIST_MULTI 3129 1.68 1.23 1.90 130 RELAYCOUNTRY_FR 3114 0.52 1.23 0.19 131 TR_Symld_Words 2916 1.36 1.15 1.47 132 XM_UB60 2882 0.40 1.14 0.06 133 BAYES_00 2879 4.97 1.13 6.78 134 RELAYCOUNTRY_GB 2849 1.02 1.12 0.98 135 XM_UB80 2849 0.40 1.12 0.07 136 HTML_FONT_FACE_BAD 2839 0.71 1.12 0.52 137 UNPARSEABLE_RELAY 2817 2.64 1.11 3.36 138 XM_H_PHPOS 2808 1.19 1.11 1.23 139 XM_UB999 2795 0.36 1.10 0.01 140 T_FILL_THIS_FORM_SHORT 2790 0.94 1.10 0.86 141 NO_DNS_FOR_FROM 2784 0.78 1.10 0.64 142 BOUNCE_MESSAGE 2763 5.48 1.09 7.55 143 ANY_BOUNCE_MESSAGE 2763 5.48 1.09 7.55 144 XMPhish30 2757 0.56 1.09 0.31 145 TO_NO_BRKTS_FROM_MSSP 2695 0.39 1.06 0.07 146 TR_LOTS_OF_MONEY3 2591 0.54 1.02 0.32 147 XMPhish11 2540 0.99 1.00 0.98 148 XMBdyGiftCard01 2501 0.66 0.98 0.50 149 XM_H_PHPMailer 2448 0.74 0.96 0.64 150 T_TooManySym_02 2394 1.23 0.94 1.37 151 BAYES_20 2390 2.19 0.94 2.78 152 RELAYCOUNTRY_CN 2385 0.34 0.94 0.05 153 XMGppyBdWords 2383 0.37 0.94 0.10 154 XMHTMLBadTable_001 2380 0.53 0.94 0.33 155 TM2_M_BODY_EMPTY 2335 0.55 0.92 0.37 156 URIBL_ABUSE_SURBL 2242 0.32 0.88 0.06 157 XM_OfRef7 2241 0.39 0.88 0.15 158 DKIM_ADSP_CUSTOM_MED 2219 0.95 0.87 0.98 159 XMEmptyBody_01 2215 0.36 0.87 0.12 160 XM_B_REG_HTML 2208 0.47 0.87 0.28 161 TM2_M_A_HREF_HREF 2193 0.59 0.86 0.46 162 TR_XM_DK_Bayes 2183 3.09 0.86 4.14 163 T_FILL_THIS_FORM_LONG 2119 0.48 0.83 0.31 164 XMPhish14 2118 0.43 0.83 0.24 165 REMOVE_BEFORE_LINK 2107 0.41 0.83 0.21 166 HTTPS_HTTP_MISMATCH 2099 0.59 0.83 0.47 167 HTML_TAG_BALANCE_BODY 2092 0.56 0.82 0.43 168 TooManyTo_002 2089 2.33 0.82 3.04 169 XMBody_78 2055 0.44 0.81 0.27 170 LOW_PRICE 2032 0.55 0.80 0.44 171 TR_XM_DK_Bayes1 2002 2.74 0.79 3.65 172 T_MONEY_PERCENT 1965 0.55 0.77 0.45 173 TR_LOTS_OF_MONEY2 1965 0.55 0.77 0.45 174 RELAYCOUNTRY_AT 1960 0.31 0.77 0.09 175 URI_WP_DIRINDEX 1948 2.64 0.77 3.53 176 RCVD_IN_IADB_VOUCHED 1940 2.59 0.76 3.45 177 PLING_QUERY 1922 0.38 0.76 0.21 178 XMSlimDrugH 1919 0.62 0.76 0.56 179 XM_UB95 1916 0.25 0.75 0.01 180 LongTLD 1911 0.33 0.75 0.13 181 TR_XM_DK_Bayes2 1904 2.26 0.75 2.97 182 T_Symld_Words_02 1897 0.57 0.75 0.49 183 URI_NOVOWEL 1887 0.50 0.74 0.38 184 TooManyTo_003 1882 1.77 0.74 2.25 185 RCVD_IN_MSPIKE_WL 1871 1.50 0.74 1.86 186 RCVD_IN_MSPIKE_H3 1831 1.50 0.72 1.86 187 XM_H_PHPOS_M 1816 0.57 0.72 0.50 188 NML_ADSP_CUSTOM_MED 1814 0.74 0.71 0.76 189 FORGED_GMAIL_RCVD 1804 0.57 0.71 0.51 190 SUBJ_DOLLARS 1801 0.36 0.71 0.20 191 XM_PDF 1714 3.20 0.68 4.39 192 RELAYCOUNTRY_IN 1647 0.26 0.65 0.08 193 XM_DKIMWhitelistDomains 1642 5.92 0.65 8.40 194 XMLngstWrd_00 1620 2.00 0.64 2.65 195 DKIM_ADSP_NXDOMAIN 1613 0.42 0.64 0.32 196 BODY_ENHANCEMENT 1609 0.22 0.63 0.02 197 XMAntiAgingB 1576 0.30 0.62 0.15 198 TRACKER_ID 1546 0.31 0.61 0.17 199 XMSubMetaD_03 1541 0.23 0.61 0.06 200 MILLION_USD 1522 0.21 0.60 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 414937 82.86 95.22 77.04 2 DCC_CHECK_NEGATIVE 371150 53.69 21.40 68.91 3 BAYES_50 328337 50.96 29.75 60.96 4 DKIM_SIGNED 323260 65.58 77.40 60.02 5 XM_DK_Pass 318070 64.45 75.90 59.05 6 DKIM_VALID 296434 60.44 71.91 55.04 7 XMListUnsubscribeExists 214973 48.49 66.69 39.91 8 DKIM_VALID_AU 207756 43.85 55.06 38.57 9 ALL_TRUSTED 168757 22.14 2.66 31.33 10 DCC_CHECK 158361 44.59 76.82 29.40 11 XM_H_QuotedFrom 157381 35.18 47.83 29.22 12 T_TM2_M_HEADER_IN_MSG 157154 25.26 16.96 29.18 13 HTML_FONT_LOW_CONTRAST 121987 26.00 33.10 22.65 14 DKIM_VALID_EF 119153 21.90 21.42 22.12 15 FVGT_m_MULTI_ODD 117741 22.46 23.74 21.86 16 LOC_TINY_FONT_1 96686 22.99 33.67 17.95 17 XMSubLong 92778 19.44 24.13 17.23 18 MIME_HTML_ONLY 84245 22.64 37.50 15.64 19 MultiRelay 83962 14.66 12.70 15.59 20 T_KAM_HTML_FONT_INVALID 68956 15.03 19.76 12.80 21 XM_DK_Undo_02 56960 21.67 45.19 10.58 22 BAYES_99 54441 20.74 43.30 10.11 23 LOTS_OF_MONEY 51844 10.32 11.78 9.63 24 XM_Body_Dirty_Words 50368 12.24 18.37 9.35 25 XM_Multi_Part_URI 48534 11.13 15.62 9.01 26 BAYES_999 46803 17.30 35.58 8.69 27 XM_DKIMWhitelistDomains 45261 5.92 0.65 8.40 28 TooManyTo_001 42209 7.41 6.50 7.84 29 LotsOfNums_01 40947 7.73 8.00 7.60 30 ANY_BOUNCE_MESSAGE 40659 5.48 1.09 7.55 31 BOUNCE_MESSAGE 40656 5.48 1.09 7.55 32 BAYES_00 36494 4.97 1.13 6.78 33 T_XMDrugObfuBody_14 35606 7.20 8.45 6.61 34 RCVD_IN_RP_SAFE 35049 6.09 5.20 6.51 35 BAYES_60 34168 6.68 7.39 6.34 36 XM_Evil_Numbers_Gen 33714 8.20 12.30 6.26 37 HTML_IMAGE_RATIO_02 33114 8.97 14.97 6.15 38 FSL_BULK_SIG 31263 8.13 13.06 5.80 39 RCVD_IN_RP_CERTIFIED 30640 5.14 3.97 5.69 40 RCVD_IN_IADB_LISTED 28090 4.20 2.05 5.22 41 DKIM_INVALID 26826 5.14 5.48 4.98 42 MIME_QP_LONG_LINE 26501 4.63 4.02 4.92 43 HTML_IMAGE_RATIO_04 26388 5.99 8.30 4.90 44 XM_H_Long_From01 26328 5.68 7.35 4.89 45 BAYES_40 26026 3.70 1.31 4.83 46 XM_SendGrid 24676 4.24 3.51 4.58 47 RCVD_IN_IADB_SPF 24461 3.68 1.87 4.54 48 TR_DCC_Bayes_99 24154 13.99 34.14 4.48 49 IN_ZIMBRA_NJ_WHITELIST 24047 3.04 0.03 4.46 50 XM_PDF 23630 3.20 0.68 4.39 51 RELAYCOUNTRY_META 23529 7.45 13.98 4.37 52 BOTNET_IPINHOSTNAME 23451 6.67 11.57 4.35 53 T_REMOTE_IMAGE 22522 3.69 2.66 4.18 54 TR_XM_DK_Bayes 22322 3.09 0.86 4.14 55 XM_B_Phish_Phrases 22147 5.32 7.89 4.11 56 RCVD_IN_MSPIKE_H2 22138 3.81 3.18 4.11 57 RCVD_IN_IADB_SENDERID 21417 3.28 1.80 3.98 58 BAYES_80 21416 5.79 9.63 3.98 59 RCVD_IN_IADB_DK 20976 3.21 1.77 3.89 60 TR_XM_DK_Bayes1 19685 2.74 0.79 3.65 61 URI_WP_DIRINDEX 19007 2.64 0.77 3.53 62 XMSubMetaSx_00 18654 4.58 6.95 3.46 63 RCVD_IN_IADB_VOUCHED 18600 2.59 0.76 3.45 64 UNPARSEABLE_RELAY 18077 2.64 1.11 3.36 65 XMStrtUSub 17465 4.14 6.05 3.24 66 T_TooManySym_01 17261 2.91 2.29 3.20 67 TVD_RCVD_IP 16636 2.16 0.19 3.09 68 TooManyTo_002 16349 2.33 0.82 3.04 69 TR_XM_DocInvoice 16191 4.22 6.78 3.01 70 TR_XM_DK_Bayes2 16021 2.26 0.75 2.97 71 XMNumbers 15397 3.52 4.94 2.86 72 BAYES_20 14985 2.19 0.94 2.78 73 HTML_IMAGE_RATIO_06 14757 3.37 4.69 2.74 74 FROM_EXCESS_BASE64 14686 6.39 14.15 2.73 75 XM_UncommonTLD01 14643 4.55 8.43 2.72 76 BAYES_95 14619 3.75 5.95 2.71 77 XMLngstWrd_00 14269 2.00 0.64 2.65 78 XMLngstWrd_01 13306 1.87 0.59 2.47 79 MPART_ALT_DIFF 12866 3.66 6.37 2.39 80 XMSexyCombo_05 12226 4.71 9.89 2.27 81 TooManyTo_003 12127 1.77 0.74 2.25 82 HTML_MIME_NO_HTML_TAG 12096 4.77 10.13 2.25 83 NORMAL_HTTP_TO_IP 11981 1.59 0.25 2.22 84 SUBJ_ALL_CAPS 11960 2.11 1.88 2.22 85 RCVD_IN_IADB_OPTIN 11681 1.62 0.47 2.17 86 HTML_IMAGE_RATIO_08 11207 2.63 3.78 2.08 87 XMLngstWrd_02 11184 1.57 0.50 2.08 88 MIME_HTML_MOSTLY 11171 2.80 4.34 2.07 89 MAILING_LIST_MULTI 10222 1.68 1.23 1.90 90 RCVD_IN_MSPIKE_WL 10044 1.50 0.74 1.86 91 RCVD_IN_MSPIKE_H3 10035 1.50 0.72 1.86 92 XMLngstWrd_03 9939 1.38 0.39 1.85 93 HTML_IMAGE_ONLY_08 9753 3.66 7.59 1.81 94 HELO_NODOT 9683 1.31 0.26 1.80 95 HTML_FONT_SIZE_HUGE 9650 3.70 7.75 1.79 96 TM2_M_URI_OPT_OUT 9500 2.57 4.28 1.76 97 HTML_SHORT_LINK_IMG_1 9289 3.60 7.57 1.72 98 XMLngstWrd_04 9145 1.25 0.31 1.70 99 XM_SPF_SoftFail 9136 2.15 3.10 1.70 100 URI_BUFFLY 9135 3.51 7.35 1.70 101 SHORTENER_SHORT_IMG 9135 3.52 7.38 1.70 102 XM_DK_Undo_01 8949 1.57 1.37 1.66 103 XMDiploma_00 8722 1.97 2.71 1.62 104 XMNoVowels 8715 1.68 1.80 1.62 105 URI_TRY_3LD 8462 1.49 1.33 1.57 106 IN_HORDE_ADDRESS_BOOK 8369 1.07 0.04 1.55 107 XM_CamelCaseFrm001 8073 2.11 3.42 1.50 108 BAYES_05 8000 1.19 0.58 1.49 109 TR_Symld_Words 7892 1.36 1.15 1.47 110 XM_ProductURIs 7875 1.45 1.43 1.46 111 XM_DIRTYINTL 7518 2.07 3.50 1.40 112 T_XMDrugObfuBody_08 7358 1.62 2.17 1.37 113 T_TooManySym_02 7355 1.23 0.94 1.37 114 XM_OfRef6 7232 1.87 2.99 1.34 115 INVALID_MSGID 7100 0.96 0.20 1.32 116 URI_HEX 6917 1.70 2.58 1.28 117 XMCapTrack 6727 1.01 0.51 1.25 118 XM_H_PHPOS 6631 1.19 1.11 1.23 119 URIBL_DBL_ABUSE_MALW 6491 0.96 0.45 1.21 120 TO_MALFORMED 6378 0.81 0.00 1.18 121 USER_IN_DEF_DKIM_WL 6215 0.80 0.03 1.15 122 RELAYCOUNTRY_CA 6194 1.73 2.97 1.15 123 TM2_M_VERY_LONG_WORD 6019 1.21 1.39 1.12 124 UNTRUSTED_Relay 5868 3.48 8.56 1.09 125 TooManyTo_004 5741 0.89 0.51 1.07 126 XM_GoogleGroups 5702 0.85 0.42 1.06 127 MIME_HTML_ONLY_MULTI 5293 1.66 3.09 0.98 128 XMPhish11 5280 0.99 1.00 0.98 129 DKIM_ADSP_CUSTOM_MED 5274 0.95 0.87 0.98 130 RELAYCOUNTRY_GB 5252 1.02 1.12 0.98 131 XMGenDplmaNmb 5194 1.17 1.60 0.96 132 XM_H_Long_From02 5107 1.23 1.82 0.95 133 BOTNET 5038 6.17 17.26 0.94 134 URIBL_MW_SURBL 4976 0.77 0.43 0.92 135 XM_H_SpoofStaff4 4863 0.64 0.07 0.90 136 URI_WP_HACKED_2 4777 0.78 0.55 0.89 137 XMGappySubj_01 4723 0.69 0.29 0.88 138 T_FILL_THIS_FORM_SHORT 4659 0.94 1.10 0.86 139 TooManyTo_005 4643 0.73 0.45 0.86 140 NML_ADSP_CUSTOM_MED 4073 0.74 0.71 0.76 141 XM_UB50 3965 1.52 3.18 0.74 142 XMStockSpam_06 3925 1.02 1.63 0.73 143 SpammyFromTLD_01 3797 1.06 1.81 0.70 144 T_XMDrugObfuBody_00 3689 1.01 1.71 0.68 145 TR_MetaPhish_Combo_01 3597 0.61 0.48 0.67 146 T_OBFU_PDF_ATTACH 3549 0.50 0.18 0.66 147 XM_H_PHPMailer 3445 0.74 0.96 0.64 148 NO_DNS_FOR_FROM 3435 0.78 1.10 0.64 149 USER_IN_WHITELIST 3215 0.41 0.00 0.60 150 XMSlimDrugH 3025 0.62 0.76 0.56 151 KHOP_DYNAMIC 3006 0.52 0.45 0.56 152 T_TooManySym_03 2816 0.44 0.26 0.52 153 HTML_FONT_FACE_BAD 2808 0.71 1.12 0.52 154 FORGED_GMAIL_RCVD 2723 0.57 0.71 0.51 155 T_XMHurry_00 2719 0.87 1.64 0.50 156 XMSubMetaI_00 2698 1.06 2.25 0.50 157 XMBdyGiftCard01 2698 0.66 0.98 0.50 158 XM_H_PHPOS_M 2694 0.57 0.72 0.50 159 RELAYCOUNTRY_DE 2669 0.50 0.52 0.50 160 T_Symld_Words_02 2619 0.57 0.75 0.49 161 XMBrknScrpt_02 2587 0.76 1.35 0.48 162 HTTPS_HTTP_MISMATCH 2557 0.59 0.83 0.47 163 XMSubMetaSxObfu_02 2527 0.43 0.36 0.47 164 TM2_M_A_HREF_HREF 2479 0.59 0.86 0.46 165 XMBody_95 2476 0.35 0.12 0.46 166 XM_ShortIntro_01 2459 0.41 0.32 0.46 167 DIET_1 2443 0.96 2.04 0.45 168 MISSING_HEADERS 2430 2.97 8.32 0.45 169 RDNS_DYNAMIC 2416 1.45 3.58 0.45 170 T_MONEY_PERCENT 2412 0.55 0.77 0.45 171 TR_LOTS_OF_MONEY2 2412 0.55 0.77 0.45 172 MPART_ALT_DIFF_COUNT 2376 0.49 0.59 0.44 173 LOW_PRICE 2355 0.55 0.80 0.44 174 SHORT_HELO_AND_INLINE_IMAGE 2354 0.31 0.05 0.44 175 RELAYCOUNTRY_AU 2337 0.49 0.59 0.43 176 HTML_TAG_BALANCE_BODY 2324 0.56 0.82 0.43 177 XMMoneyMeta_00 2311 1.39 3.44 0.43 178 FILL_THIS_FORM 2290 1.54 3.90 0.43 179 TR_XM_RelayPhish 2180 0.72 1.38 0.40 180 HTML_IMAGE_ONLY_32 2162 0.34 0.22 0.40 181 XMSexyCombo_01 2136 0.85 1.80 0.40 182 HTML_IMAGE_ONLY_28 2057 0.40 0.42 0.38 183 URI_NOVOWEL 2037 0.50 0.74 0.38 184 T_PDS_FROM_2_EMAILS 2018 0.26 0.03 0.37 185 XMHTML_After_End 2004 0.67 1.31 0.37 186 TM2_M_BODY_EMPTY 1994 0.55 0.92 0.37 187 URIBL_RHS_DOB 1979 0.29 0.14 0.37 188 XMGappySubj_02 1928 0.26 0.06 0.36 189 RCVD_IN_SORBS_DUL 1909 0.29 0.16 0.35 190 XMBody_17 1881 0.78 1.69 0.35 191 XMSubMetaSxObfu_03 1850 0.41 0.56 0.34 192 TVD_SPACE_RATIO 1840 0.39 0.50 0.34 193 XMDateMe_00 1810 0.32 0.28 0.34 194 SpammyFromTLD_02 1809 1.62 4.36 0.34 195 XMHTMLBadTable_001 1788 0.53 0.94 0.33 196 HTML_IMAGE_ONLY_16 1788 0.27 0.15 0.33 197 AC_DIV_BONANZA 1755 0.25 0.09 0.33 198 DKIM_ADSP_NXDOMAIN 1750 0.42 0.64 0.32 199 XM_B_COPY_HTML 1729 0.39 0.55 0.32 200 TR_LOTS_OF_MONEY3 1726 0.54 1.02 0.32 ----------------------------------------------------------------------