Email: 595448 Autolearn: 0 AvgScore: 2.72 AvgScanTime: 2.02 sec Spam: 150704 Autolearn: 0 AvgScore: 12.18 AvgScanTime: 2.51 sec Ham: 444744 Autolearn: 0 AvgScore: -0.49 AvgScanTime: 1.85 sec Time Spent Running SA: 333.71 hours Time Spent Processing Spam: 104.89 hours Time Spent Processing Ham: 228.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142588 89.11 94.61 87.24 2 DKIM_SIGNED 128853 78.65 85.50 76.33 3 XM_DK_Pass 124662 76.80 82.72 74.80 4 DKIM_VALID 122014 74.49 80.96 72.30 5 DCC_CHECK 118401 50.86 78.57 41.48 6 XM_B_Unicode 117575 71.50 78.02 69.30 7 XMListUnsubscribeExists 115781 57.45 76.83 50.89 8 DKIM_VALID_AU 93200 54.94 61.84 52.60 9 XM_DK_Undo_02 76350 23.53 50.66 14.34 10 BAYES_99 67792 20.43 44.98 12.11 11 HTML_FONT_LOW_CONTRAST 60534 31.94 40.17 29.16 12 BAYES_999 56881 17.53 37.74 10.69 13 TR_DCC_Bayes_99 54286 13.46 36.02 5.82 14 LOC_TINY_FONT_1 52129 26.20 34.59 23.35 15 MIME_HTML_ONLY 49897 24.24 33.11 21.24 16 BAYES_50 49007 48.29 32.52 53.63 17 FVGT_m_MULTI_ODD 41860 22.72 27.78 21.01 18 RCVD_IN_MSPIKE_H2 37466 23.19 24.86 22.62 19 DKIM_VALID_EF 35904 27.10 23.82 28.21 20 XMSubLong 34914 22.08 23.17 21.71 21 XM_Body_Dirty_Words 33444 15.58 22.19 13.34 22 T_TM2_M_HEADER_IN_MSG 31942 27.75 21.20 29.97 23 T_KAM_HTML_FONT_INVALID 30984 17.96 20.56 17.08 24 DCC_CHECK_NEGATIVE 29772 47.26 19.76 56.58 25 RELAYCOUNTRY_META 28813 8.53 19.12 4.94 26 XM_Multi_Part_URI 26870 13.63 17.83 12.21 27 HTML_IMAGE_RATIO_02 24480 10.25 16.24 8.22 28 MultiRelay 24007 18.70 15.93 19.64 29 LOTS_OF_MONEY 23595 12.15 15.66 10.96 30 BOTNET 22390 5.32 14.86 2.09 31 BOTNET_IPINHOSTNAME 20310 6.79 13.48 4.53 32 XM_Evil_Numbers_Gen 19062 9.91 12.65 8.98 33 UNTRUSTED_Relay 18244 4.08 12.11 1.36 34 XMSexyCombo_05 17782 6.19 11.80 4.29 35 FSL_BULK_SIG 14911 8.60 9.89 8.17 36 LotsOfNums_01 13984 8.23 9.28 7.87 37 T_XMDrugObfuBody_14 13767 8.09 9.14 7.73 38 TooManyTo_001 13485 8.43 8.95 8.25 39 HTML_IMAGE_RATIO_04 13036 6.52 8.65 5.80 40 XM_B_Phish_Phrases 11504 6.49 7.63 6.10 41 XMSubMetaSx_00 11428 4.91 7.58 4.00 42 BAYES_80 11195 4.90 7.43 4.04 43 XM_UncommonTLD01 10894 5.02 7.23 4.27 44 XM_H_Long_From01 10557 6.28 7.01 6.03 45 MPART_ALT_DIFF 10481 4.29 6.95 3.39 46 FROM_EXCESS_BASE64 9800 4.66 6.50 4.03 47 SpammyFromTLD_02 9278 1.88 6.16 0.43 48 BAYES_60 8718 6.12 5.78 6.24 49 MIME_QP_LONG_LINE 8271 5.48 5.49 5.47 50 XM_DIRTYINTL 7994 3.57 5.30 2.98 51 XM_UB50 7922 1.97 5.26 0.85 52 DKIM_INVALID 6839 4.16 4.54 4.03 53 XM_B_SpammyTLD 6657 3.70 4.42 3.45 54 HTML_IMAGE_RATIO_06 6527 3.86 4.33 3.70 55 BAYES_95 6394 3.05 4.24 2.64 56 URI_HEX 6386 2.41 4.24 1.80 57 RELAYCOUNTRY_CA 6294 2.08 4.18 1.37 58 XM_SPF_SoftFail 6278 2.30 4.17 1.67 59 MIME_HTML_MOSTLY 6074 2.66 4.03 2.19 60 US_DOLLARS_3 6072 2.86 4.03 2.46 61 T_REMOTE_IMAGE 5909 4.07 3.92 4.12 62 XM_SendGrid 5906 6.02 3.92 6.73 63 XMNumbers 5880 3.20 3.90 2.96 64 HTML_IMAGE_RATIO_08 5478 2.29 3.63 1.84 65 MIME_HTML_ONLY_MULTI 5452 2.15 3.62 1.65 66 RCVD_IN_BL_SPAMCOP_NET 5266 1.71 3.49 1.11 67 XMStrtUSub 5197 3.92 3.45 4.09 68 TM2_M_URI_OPT_OUT 5042 2.14 3.35 1.74 69 RCVD_IN_RP_SAFE 4991 8.71 3.31 10.54 70 T_XMHurry_00 4698 1.46 3.12 0.90 71 RELAYCOUNTRY_FR 4621 1.00 3.07 0.30 72 XM_CamelCaseFrm001 4469 2.25 2.97 2.00 73 RCVD_IN_IADB_LISTED 4331 4.99 2.87 5.71 74 T_TooManySym_01 4283 4.80 2.84 5.47 75 DATE_IN_PAST_03_06 4173 0.81 2.77 0.15 76 KHOP_HELO_FCRDNS 4163 2.19 2.76 1.99 77 RCVD_IN_RP_CERTIFIED 4011 7.70 2.66 9.41 78 XMBdyGiftCard01 3977 1.49 2.64 1.10 79 NO_DNS_FOR_FROM 3957 1.46 2.63 1.06 80 XM_URI_RBL 3950 0.90 2.62 0.32 81 HTML_MIME_NO_HTML_TAG 3938 2.53 2.61 2.50 82 MultiRelay_CC 3919 0.80 2.60 0.19 83 MultiRelay_Combo 3919 0.80 2.60 0.19 84 XMSubMetaI_00 3829 1.19 2.54 0.74 85 XMDiploma_00 3748 1.79 2.49 1.55 86 TR_Symld_Words 3697 2.16 2.45 2.06 87 XMSexyCombo_01 3690 1.03 2.45 0.55 88 SUBJ_ALL_CAPS 3668 2.28 2.43 2.22 89 XMBody_17 3648 1.03 2.42 0.56 90 RCVD_IN_IADB_SPF 3624 4.29 2.40 4.93 91 FROM_SUSPICIOUS_NTLD 3604 0.63 2.39 0.03 92 XM_OfRef6 3565 2.21 2.37 2.15 93 DKIM_ADSP_NXDOMAIN 3534 1.05 2.34 0.61 94 T_XMDrugObfuBody_08 3489 1.61 2.32 1.37 95 FROM_SUSPICIOUS_NTLD_FP 3417 0.60 2.27 0.03 96 RCVD_IN_IADB_SENDERID 3406 3.74 2.26 4.24 97 RCVD_IN_IADB_DK 3361 3.63 2.23 4.11 98 TR_XM_PHPDW 3239 1.16 2.15 0.83 99 XM_UB99 3203 0.56 2.13 0.03 100 TR_XM_PHPForged 3186 1.14 2.11 0.81 101 TR_XM_FormFill2 3126 1.11 2.07 0.79 102 XM_H_PHPOS 3098 1.11 2.06 0.79 103 URI_TRY_3LD 3081 1.36 2.04 1.12 104 BAYES_40 3080 3.62 2.04 4.15 105 RCVD_IN_PSBL 3052 0.54 2.03 0.04 106 TR_LOTS_OF_MONEY3 2740 0.83 1.82 0.50 107 XM_UB60 2738 0.53 1.82 0.09 108 XMGenDplmaNmb 2650 1.22 1.76 1.04 109 TM2_M_VERY_LONG_WORD 2633 1.28 1.75 1.12 110 T_XMDrugObfuBody_00 2552 0.95 1.69 0.70 111 XM_UB999 2498 0.44 1.66 0.02 112 ALL_TRUSTED 2480 12.04 1.65 15.56 113 RCVD_IN_MSPIKE_BL 2466 1.43 1.64 1.36 114 XM_H_Long_From02 2382 1.19 1.58 1.05 115 T_FILL_THIS_FORM_SHORT 2378 1.40 1.58 1.35 116 TR_XM_DK_SendGrid 2369 2.83 1.57 3.26 117 BAYES_20 2305 2.79 1.53 3.22 118 RCVD_IN_RP_RNBL 2299 0.41 1.53 0.04 119 BOTNET_NORDNS 2296 0.41 1.52 0.03 120 TR_XM_RelayPhish 2274 0.96 1.51 0.78 121 XMBrknScrpt_02 2255 0.94 1.50 0.75 122 XM_ProductURIs 2220 0.88 1.47 0.67 123 XM_UB80 2177 0.38 1.44 0.02 124 XMStockSpam_06 2169 1.36 1.44 1.33 125 RELAYCOUNTRY_DE 2054 0.60 1.36 0.35 126 RCVD_IN_IADB_VOUCHED 2053 3.38 1.36 4.06 127 XMClaimOffer 2039 0.42 1.35 0.10 128 SpammyFromTLD_01 2018 0.90 1.34 0.75 129 XM_H_TOP 2015 0.34 1.34 0.00 130 XMPhish30 1962 0.63 1.30 0.41 131 XMHTML_After_End 1950 0.64 1.29 0.42 132 RELAYCOUNTRY_JP 1950 0.34 1.29 0.02 133 MAILING_LIST_MULTI 1921 1.92 1.27 2.15 134 XMBody_78 1921 0.69 1.27 0.50 135 TR_M_TOP_BAYES 1898 0.32 1.26 0.00 136 HTML_TAG_BALANCE_BODY 1876 0.66 1.24 0.47 137 T_MONEY_PERCENT 1871 0.49 1.24 0.24 138 TR_LOTS_OF_MONEY2 1871 0.49 1.24 0.24 139 XMSlimDrugH 1847 0.63 1.23 0.43 140 RCVD_IN_MSPIKE_L5 1833 1.00 1.22 0.92 141 DATE_IN_PAST_06_12 1818 0.36 1.21 0.07 142 TM2_M_A_HREF_HREF 1772 1.05 1.18 1.01 143 DIET_1 1735 0.48 1.15 0.26 144 RELAYCOUNTRY_IN 1731 0.36 1.15 0.09 145 XMMoneyMeta_00 1724 0.65 1.14 0.48 146 XM_H_PHPMailer 1719 0.75 1.14 0.62 147 URIBL_BLACK 1719 0.34 1.14 0.07 148 XMSexyCombo_04 1710 0.35 1.13 0.09 149 MIME_HEADER_CTYPE_ONLY 1701 0.39 1.13 0.14 150 BODY_QUOTE_MALF_MSGID 1676 0.70 1.11 0.56 151 HK_RANDOM_REPLYTO 1670 0.45 1.11 0.23 152 TR_Mismatch_TLD_02 1667 0.35 1.11 0.09 153 TR_Caps_n_Bayes_99 1654 0.47 1.10 0.25 154 BODY_URI_ONLY 1641 0.35 1.09 0.10 155 XMHTMLBadTable_001 1611 0.73 1.07 0.62 156 TooManyTo_002 1564 1.80 1.04 2.06 157 XMSubMetaSSx_00 1545 0.50 1.03 0.32 158 URIBL_DBL_ABUSE_REDIR 1536 0.28 1.02 0.03 159 RCVD_IN_MSPIKE_WL 1519 2.75 1.01 3.34 160 DKIM_ADSP_CUSTOM_MED 1512 1.03 1.00 1.03 161 XM_DK_Undo_01 1509 1.48 1.00 1.65 162 RCVD_IN_MSPIKE_H3 1479 2.57 0.98 3.11 163 XMPhish11 1474 1.11 0.98 1.16 164 T_Symld_Words_02 1465 0.73 0.97 0.65 165 RELAYCOUNTRY_AT 1404 0.36 0.93 0.17 166 TR_MetaPhish_Combo_01 1376 1.42 0.91 1.59 167 TooManyTo_003 1364 1.24 0.91 1.36 168 XM_H_PHPOS_M 1360 0.36 0.90 0.17 169 URIBL_DBL_SPAM 1352 0.23 0.90 0.01 170 TR_XM_SEO3 1348 0.37 0.89 0.19 171 UNPARSEABLE_RELAY 1337 2.12 0.89 2.53 172 XM_H_Undi_Recip 1334 0.37 0.89 0.19 173 XM_B_REG_HTML 1298 0.49 0.86 0.36 174 NML_ADSP_CUSTOM_MED 1291 0.80 0.86 0.78 175 FORGED_GMAIL_RCVD 1279 0.55 0.85 0.45 176 FILL_THIS_FORM 1251 0.82 0.83 0.82 177 TooManyTo_004 1251 0.95 0.83 0.99 178 HTML_FONT_FACE_BAD 1240 0.76 0.82 0.73 179 BODY_ENHANCEMENT 1231 0.24 0.82 0.05 180 HTML_IMAGE_ONLY_24 1228 0.47 0.81 0.35 181 PDS_TO_EQ_FROM_NAME 1221 0.22 0.81 0.02 182 RDNS_DYNAMIC 1218 0.53 0.81 0.44 183 SUBJ_DOLLARS 1163 0.56 0.77 0.48 184 FROM_MISSP_REPLYTO 1160 0.20 0.77 0.01 185 THIS_AD 1159 0.35 0.77 0.20 186 TR_XM_Undi_Recip5 1154 0.20 0.77 0.01 187 MPART_ALT_DIFF_COUNT 1153 0.42 0.77 0.31 188 RELAYCOUNTRY_GB 1148 1.00 0.76 1.08 189 XM_HighProb1 1143 0.20 0.76 0.01 190 RELAYCOUNTRY_IE 1138 0.33 0.76 0.19 191 TooManyTo_005 1130 0.80 0.75 0.82 192 LongTLD 1099 0.28 0.73 0.13 193 RCVD_IN_IADB_OPTIN 1095 2.16 0.73 2.65 194 FORM_FRAUD_3 1094 0.18 0.73 0.00 195 URI_NOVOWEL 1093 0.53 0.73 0.46 196 XMSubMetaSxObfu_03 1087 0.57 0.72 0.52 197 XM_B_COPY_HTML 1073 0.62 0.71 0.59 198 BAYES_00 1067 8.92 0.71 11.70 199 HTTPS_HTTP_MISMATCH 1053 0.63 0.70 0.61 200 XMSubject_48 1049 0.19 0.70 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 387994 89.11 94.61 87.24 2 DKIM_SIGNED 339485 78.65 85.50 76.33 3 XM_DK_Pass 332659 76.80 82.72 74.80 4 DKIM_VALID 321560 74.49 80.96 72.30 5 XM_B_Unicode 308200 71.50 78.02 69.30 6 DCC_CHECK_NEGATIVE 251653 47.26 19.76 56.58 7 BAYES_50 238525 48.29 32.52 53.63 8 DKIM_VALID_AU 233947 54.94 61.84 52.60 9 XMListUnsubscribeExists 226333 57.45 76.83 50.89 10 DCC_CHECK 184463 50.86 78.57 41.48 11 T_TM2_M_HEADER_IN_MSG 133281 27.75 21.20 29.97 12 HTML_FONT_LOW_CONTRAST 129679 31.94 40.17 29.16 13 DKIM_VALID_EF 125462 27.10 23.82 28.21 14 LOC_TINY_FONT_1 103864 26.20 34.59 23.35 15 RCVD_IN_MSPIKE_H2 100602 23.19 24.86 22.62 16 XMSubLong 96544 22.08 23.17 21.71 17 MIME_HTML_ONLY 94462 24.24 33.11 21.24 18 FVGT_m_MULTI_ODD 93454 22.72 27.78 21.01 19 MultiRelay 87360 18.70 15.93 19.64 20 T_KAM_HTML_FONT_INVALID 75955 17.96 20.56 17.08 21 ALL_TRUSTED 69213 12.04 1.65 15.56 22 XM_DK_Undo_02 63765 23.53 50.66 14.34 23 XM_Body_Dirty_Words 59318 15.58 22.19 13.34 24 XM_Multi_Part_URI 54313 13.63 17.83 12.21 25 BAYES_99 53855 20.43 44.98 12.11 26 BAYES_00 52033 8.92 0.71 11.70 27 LOTS_OF_MONEY 48731 12.15 15.66 10.96 28 BAYES_999 47523 17.53 37.74 10.69 29 RCVD_IN_RP_SAFE 46891 8.71 3.31 10.54 30 TR_XM_DK_Bayes 41875 7.13 0.39 9.42 31 RCVD_IN_RP_CERTIFIED 41859 7.70 2.66 9.41 32 TR_XM_DK_Bayes1 40443 6.89 0.38 9.09 33 XM_Evil_Numbers_Gen 39933 9.91 12.65 8.98 34 XM_DKIMWhitelistDomains 38293 6.44 0.02 8.61 35 TooManyTo_001 36686 8.43 8.95 8.25 36 HTML_IMAGE_RATIO_02 36545 10.25 16.24 8.22 37 FSL_BULK_SIG 36318 8.60 9.89 8.17 38 LotsOfNums_01 35008 8.23 9.28 7.87 39 T_XMDrugObfuBody_14 34391 8.09 9.14 7.73 40 TR_XM_DK_Bayes2 33414 5.68 0.27 7.51 41 XM_SendGrid 29950 6.02 3.92 6.73 42 BAYES_60 27752 6.12 5.78 6.24 43 XM_B_Phish_Phrases 27130 6.49 7.63 6.10 44 XM_H_Long_From01 26825 6.28 7.01 6.03 45 TR_DCC_Bayes_99 25885 13.46 36.02 5.82 46 HTML_IMAGE_RATIO_04 25791 6.52 8.65 5.80 47 RCVD_IN_IADB_LISTED 25404 4.99 2.87 5.71 48 MIME_QP_LONG_LINE 24340 5.48 5.49 5.47 49 T_TooManySym_01 24318 4.80 2.84 5.47 50 TO_MALFORMED 23981 4.05 0.08 5.39 51 XM_PDF 22258 3.88 0.56 5.00 52 RELAYCOUNTRY_META 21962 8.53 19.12 4.94 53 RCVD_IN_IADB_SPF 21919 4.29 2.40 4.93 54 BOTNET_IPINHOSTNAME 20136 6.79 13.48 4.53 55 XMSexyCombo_05 19100 6.19 11.80 4.29 56 XM_UncommonTLD01 18994 5.02 7.23 4.27 57 RCVD_IN_IADB_SENDERID 18871 3.74 2.26 4.24 58 BAYES_40 18461 3.62 2.04 4.15 59 T_REMOTE_IMAGE 18337 4.07 3.92 4.12 60 IN_ZIMBRA_NJ_WHITELIST 18289 3.08 0.02 4.11 61 RCVD_IN_IADB_DK 18268 3.63 2.23 4.11 62 XMStrtUSub 18168 3.92 3.45 4.09 63 RCVD_IN_IADB_VOUCHED 18066 3.38 1.36 4.06 64 BAYES_80 17982 4.90 7.43 4.04 65 DKIM_INVALID 17925 4.16 4.54 4.03 66 FROM_EXCESS_BASE64 17921 4.66 6.50 4.03 67 XMSubMetaSx_00 17795 4.91 7.58 4.00 68 HTML_IMAGE_RATIO_06 16452 3.86 4.33 3.70 69 XM_B_SpammyTLD 15350 3.70 4.42 3.45 70 MPART_ALT_DIFF 15058 4.29 6.95 3.39 71 RCVD_IN_MSPIKE_WL 14852 2.75 1.01 3.34 72 TR_XM_DK_SendGrid 14501 2.83 1.57 3.26 73 BAYES_20 14327 2.79 1.53 3.22 74 RCVD_IN_MSPIKE_H3 13839 2.57 0.98 3.11 75 XM_DIRTYINTL 13263 3.57 5.30 2.98 76 XMNumbers 13174 3.20 3.90 2.96 77 RCVD_IN_IADB_OPTIN 11788 2.16 0.73 2.65 78 BAYES_95 11762 3.05 4.24 2.64 79 UNPARSEABLE_RELAY 11273 2.12 0.89 2.53 80 HTML_MIME_NO_HTML_TAG 11132 2.53 2.61 2.50 81 US_DOLLARS_3 10931 2.86 4.03 2.46 82 INVALID_MSGID 10846 1.85 0.11 2.44 83 SUBJ_ALL_CAPS 9879 2.28 2.43 2.22 84 MIME_HTML_MOSTLY 9761 2.66 4.03 2.19 85 XM_OfRef6 9572 2.21 2.37 2.15 86 MAILING_LIST_MULTI 9541 1.92 1.27 2.15 87 BOTNET 9317 5.32 14.86 2.09 88 TVD_RCVD_IP 9313 1.65 0.33 2.09 89 TooManyTo_002 9163 1.80 1.04 2.06 90 TR_Symld_Words 9142 2.16 2.45 2.06 91 BAYES_05 9133 1.70 0.64 2.05 92 XM_CamelCaseFrm001 8901 2.25 2.97 2.00 93 KHOP_HELO_FCRDNS 8869 2.19 2.76 1.99 94 HTML_IMAGE_RATIO_08 8169 2.29 3.63 1.84 95 URI_HEX 7990 2.41 4.24 1.80 96 IN_HORDE_ADDRESS_BOOK 7857 1.33 0.03 1.77 97 TM2_M_URI_OPT_OUT 7721 2.14 3.35 1.74 98 ANY_BOUNCE_MESSAGE 7637 1.37 0.34 1.72 99 BOUNCE_MESSAGE 7634 1.37 0.33 1.72 100 T_TooManySym_02 7571 1.40 0.50 1.70 101 HELO_NODOT 7486 1.38 0.48 1.68 102 HELO_NO_DOMAIN 7485 1.38 0.48 1.68 103 XM_SPF_SoftFail 7446 2.30 4.17 1.67 104 MIME_HTML_ONLY_MULTI 7350 2.15 3.62 1.65 105 XM_DK_Undo_01 7329 1.48 1.00 1.65 106 TR_MetaPhish_Combo_01 7060 1.42 0.91 1.59 107 XMDiploma_00 6896 1.79 2.49 1.55 108 T_XMDrugObfuBody_08 6102 1.61 2.32 1.37 109 RELAYCOUNTRY_CA 6093 2.08 4.18 1.37 110 RCVD_IN_MSPIKE_BL 6067 1.43 1.64 1.36 111 TooManyTo_003 6039 1.24 0.91 1.36 112 UNTRUSTED_Relay 6028 4.08 12.11 1.36 113 T_FILL_THIS_FORM_SHORT 5988 1.40 1.58 1.35 114 XMStockSpam_06 5905 1.36 1.44 1.33 115 USER_IN_DEF_DKIM_WL 5844 0.98 0.01 1.31 116 XMCapTrack 5588 1.02 0.33 1.26 117 XMPhish11 5163 1.11 0.98 1.16 118 XM_GoogleGroups 5004 0.96 0.46 1.13 119 URI_TRY_3LD 5000 1.36 2.04 1.12 120 TM2_M_VERY_LONG_WORD 4968 1.28 1.75 1.12 121 RCVD_IN_BL_SPAMCOP_NET 4935 1.71 3.49 1.11 122 XMBdyGiftCard01 4906 1.49 2.64 1.10 123 RELAYCOUNTRY_GB 4807 1.00 0.76 1.08 124 NO_DNS_FOR_FROM 4725 1.46 2.63 1.06 125 XM_H_Long_From02 4688 1.19 1.58 1.05 126 XMGenDplmaNmb 4615 1.22 1.76 1.04 127 DKIM_ADSP_CUSTOM_MED 4593 1.03 1.00 1.03 128 TM2_M_A_HREF_HREF 4501 1.05 1.18 1.01 129 TooManyTo_004 4409 0.95 0.83 0.99 130 RCVD_IN_MSPIKE_L5 4108 1.00 1.22 0.92 131 T_XMHurry_00 3990 1.46 3.12 0.90 132 XM_UB50 3798 1.97 5.26 0.85 133 TR_XM_PHPDW 3689 1.16 2.15 0.83 134 TooManyTo_005 3659 0.80 0.75 0.82 135 FILL_THIS_FORM 3645 0.82 0.83 0.82 136 TR_XM_PHPForged 3598 1.14 2.11 0.81 137 XM_D_tchamptons_WL 3506 0.59 0.00 0.79 138 TR_XM_FormFill2 3504 1.11 2.07 0.79 139 XM_H_PHPOS 3495 1.11 2.06 0.79 140 TR_XM_RelayPhish 3470 0.96 1.51 0.78 141 NML_ADSP_CUSTOM_MED 3447 0.80 0.86 0.78 142 XMBrknScrpt_02 3340 0.94 1.50 0.75 143 SpammyFromTLD_01 3334 0.90 1.34 0.75 144 XMSubMetaI_00 3284 1.19 2.54 0.74 145 HTML_FONT_FACE_BAD 3266 0.76 0.82 0.73 146 T_FILL_THIS_FORM_LONG 3212 0.60 0.23 0.72 147 LOW_PRICE 3198 0.69 0.62 0.72 148 T_FILL_THIS_FORM_LOAN 3189 0.66 0.47 0.72 149 T_XMDrugObfuBody_00 3121 0.95 1.69 0.70 150 XMGappySubj_01 3036 0.64 0.50 0.68 151 XM_ProductURIs 2998 0.88 1.47 0.67 152 T_Symld_Words_02 2892 0.73 0.97 0.65 153 XMBody_95 2867 0.53 0.18 0.64 154 T_OBFU_PDF_ATTACH 2775 0.51 0.19 0.62 155 XMHTMLBadTable_001 2757 0.73 1.07 0.62 156 XM_H_PHPMailer 2736 0.75 1.14 0.62 157 HTTPS_HTTP_MISMATCH 2725 0.63 0.70 0.61 158 DKIM_ADSP_NXDOMAIN 2718 1.05 2.34 0.61 159 XM_RXBody 2701 0.57 0.45 0.61 160 XM_B_COPY_HTML 2635 0.62 0.71 0.59 161 XMLngstWrd_00 2630 0.54 0.40 0.59 162 FROM_GOV_SPOOF 2559 0.51 0.30 0.58 163 BODY_QUOTE_MALF_MSGID 2501 0.70 1.11 0.56 164 XMBody_17 2494 1.03 2.42 0.56 165 XMLngstWrd_01 2461 0.51 0.37 0.55 166 XM_ShortIntro_01 2436 0.48 0.28 0.55 167 XMSexyCombo_01 2432 1.03 2.45 0.55 168 T_TooManySym_03 2398 0.45 0.18 0.54 169 PLING_QUERY 2372 0.56 0.66 0.53 170 USER_IN_WHITELIST 2349 0.39 0.00 0.53 171 XMRcvdHeader_15 2323 0.39 0.00 0.52 172 XMSubMetaSxObfu_03 2316 0.57 0.72 0.52 173 SHORT_HELO_AND_INLINE_IMAGE 2298 0.40 0.04 0.52 174 T_MANY_PILL_PRICE 2273 0.38 0.00 0.51 175 RELAYCOUNTRY_AU 2264 0.53 0.61 0.51 176 MISSING_HEADERS 2255 0.49 0.45 0.51 177 TM2_M_BODY_EMPTY 2239 0.40 0.11 0.50 178 TR_LOTS_OF_MONEY3 2213 0.83 1.82 0.50 179 XMBody_78 2206 0.69 1.27 0.50 180 SUBJ_DOLLARS 2146 0.56 0.77 0.48 181 XMMoneyMeta_00 2135 0.65 1.14 0.48 182 HTML_TAG_BALANCE_BODY 2071 0.66 1.24 0.47 183 XMNoVowels 2053 0.46 0.46 0.46 184 URI_NOVOWEL 2045 0.53 0.73 0.46 185 XMSubMetaSxObfu_02 2018 0.44 0.40 0.45 186 FORGED_GMAIL_RCVD 1998 0.55 0.85 0.45 187 RDNS_DYNAMIC 1957 0.53 0.81 0.44 188 XMSUPPORT 1952 0.33 0.00 0.44 189 FROM_GOV_DKIM_AU 1931 0.36 0.14 0.43 190 HTML_IMAGE_ONLY_28 1903 0.43 0.43 0.43 191 SpammyFromTLD_02 1896 1.88 6.16 0.43 192 XMSlimDrugH 1896 0.63 1.23 0.43 193 XMDateMe_00 1892 0.40 0.32 0.43 194 XMHTML_After_End 1874 0.64 1.29 0.42 195 XM_H_SpoofStaff4 1845 0.32 0.04 0.41 196 XMPhish30 1812 0.63 1.30 0.41 197 REMOVE_BEFORE_LINK 1790 0.40 0.41 0.40 198 HTML_IMAGE_ONLY_32 1703 0.41 0.50 0.38 199 XMPhish14 1648 0.42 0.58 0.37 200 XM_B_REG_HTML 1620 0.49 0.86 0.36 ----------------------------------------------------------------------