Email: 364638 Autolearn: 0 AvgScore: 1.87 AvgScanTime: 2.43 sec Spam: 72175 Autolearn: 0 AvgScore: 12.98 AvgScanTime: 3.17 sec Ham: 292463 Autolearn: 0 AvgScore: -0.87 AvgScanTime: 2.25 sec Time Spent Running SA: 246.29 hours Time Spent Processing Spam: 63.49 hours Time Spent Processing Ham: 182.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 68121 90.24 94.38 89.22 2 DKIM_SIGNED 60091 85.44 83.26 85.97 3 DCC_CHECK 58458 61.46 80.99 56.64 4 XM_DK_Pass 55910 83.52 77.46 85.02 5 DKIM_VALID 52349 80.02 72.53 81.87 6 XM_B_Unicode 52047 75.77 72.11 76.67 7 XMListUnsubscribeExists 51423 65.65 71.25 64.26 8 DKIM_VALID_AU 41821 65.90 57.94 67.87 9 XM_B_Unicode3 36649 49.36 50.78 49.02 10 BAYES_50 36167 55.34 50.11 56.63 11 HTML_FONT_LOW_CONTRAST 29617 38.85 41.03 38.31 12 LOC_TINY_FONT_1 28772 35.14 39.86 33.97 13 XM_DK_Undo_02 27460 14.45 38.05 8.63 14 FVGT_m_MULTI_ODD 23136 24.41 32.06 22.52 15 XM_Body_Dirty_Words 20169 20.00 27.94 18.04 16 MIME_HTML_ONLY 19144 25.83 26.52 25.66 17 XMSubLong 18767 23.92 26.00 23.41 18 BAYES_99 18729 8.91 25.95 4.71 19 BOTNET 17850 6.80 24.73 2.37 20 DKIM_VALID_EF 17303 27.10 23.97 27.87 21 XM_Multi_Part_URI 16413 16.35 22.74 14.77 22 RELAYCOUNTRY_META 16349 8.31 22.65 4.77 23 MultiRelay 16042 16.73 22.23 15.38 24 BAYES_999 15049 7.23 20.85 3.87 25 TR_DCC_Bayes_99 15025 6.12 20.82 2.50 26 XM_UncommonTLD01 13376 6.65 18.53 3.72 27 DCC_CHECK_NEGATIVE 12538 37.30 17.37 42.21 28 T_KAM_HTML_FONT_INVALID 12485 17.17 17.30 17.14 29 BOTNET_IPINHOSTNAME 12141 8.28 16.82 6.17 30 UNTRUSTED_Relay 11986 4.64 16.61 1.69 31 T_TM2_M_HEADER_IN_MSG 11034 20.28 15.29 21.52 32 HTML_IMAGE_RATIO_02 10842 13.85 15.02 13.56 33 XM_Evil_Numbers_Gen 10245 13.09 14.19 12.82 34 FSL_BULK_SIG 10099 9.37 13.99 8.22 35 XM_B_Unsub 10071 11.72 13.95 11.17 36 XMSexyCombo_05 8531 7.56 11.82 6.51 37 TooManyTo_001 8415 7.17 11.66 6.06 38 DKIM_INVALID 7742 5.41 10.73 4.10 39 XM_SendGrid 7708 7.87 10.68 7.18 40 XM_B_SpammyTLD 7669 3.75 10.63 2.05 41 LOTS_OF_MONEY 7572 9.75 10.49 9.57 42 XM_DIRTYINTL 7501 5.09 10.39 3.78 43 XMSubMetaSx_00 7466 5.72 10.34 4.58 44 SpammyFromTLD_02 7439 2.25 10.31 0.27 45 XM_B_Phish_Phrases 6818 8.33 9.45 8.06 46 MIME_HTML_MOSTLY 6722 5.18 9.31 4.16 47 MPART_ALT_DIFF 6603 5.59 9.15 4.71 48 T_XMDrugObfuBody_14 6185 8.67 8.57 8.70 49 HTML_IMAGE_RATIO_04 6080 8.52 8.42 8.54 50 XM_H_Long_From01 5903 7.25 8.18 7.02 51 XM_UB50 5509 2.21 7.63 0.87 52 BOTNET_NORDNS 5481 1.53 7.59 0.03 53 MIME_QP_LONG_LINE 5298 4.88 7.34 4.28 54 LotsOfNums_01 5034 7.80 6.97 8.00 55 FROM_SUSPICIOUS_NTLD 4517 1.27 6.26 0.04 56 FROM_SUSPICIOUS_NTLD_FP 4478 1.26 6.20 0.04 57 BAYES_80 4139 3.33 5.73 2.74 58 KHOP_HELO_FCRDNS 3903 1.82 5.41 0.94 59 T_XMDrugObfuBody_08 3798 2.11 5.26 1.33 60 XM_H_TOP 3730 1.03 5.17 0.01 61 URI_HEX 3636 2.72 5.04 2.15 62 DKIM_ADSP_NXDOMAIN 3395 1.32 4.70 0.48 63 BAYES_60 3306 4.94 4.58 5.03 64 FROM_EXCESS_BASE64 3250 5.14 4.50 5.30 65 T_TooManySym_01 3178 5.07 4.40 5.24 66 XM_B_Unsub2 3165 1.67 4.39 1.00 67 XM_UB99 3014 0.84 4.18 0.01 68 RCVD_IN_MSPIKE_H2 3006 5.46 4.16 5.78 69 UNPARSEABLE_RELAY 2947 3.71 4.08 3.62 70 SUBJ_ALL_CAPS 2879 3.02 3.99 2.78 71 DATE_IN_PAST_06_12 2815 0.83 3.90 0.07 72 HTML_TAG_BALANCE_BODY 2791 1.43 3.87 0.83 73 HTML_MIME_NO_HTML_TAG 2775 2.13 3.84 1.71 74 XM_UB999 2750 0.76 3.81 0.01 75 TR_XM_DK_SendGrid 2744 3.89 3.80 3.91 76 MPART_ALT_DIFF_COUNT 2736 0.98 3.79 0.29 77 XMStrtUSub 2733 5.83 3.79 6.33 78 XMSexyCombo_01 2693 1.15 3.73 0.51 79 MIME_HTML_ONLY_MULTI 2661 2.47 3.69 2.17 80 XMMoneyMeta_00 2655 0.90 3.68 0.22 81 RCVD_IN_BL_SPAMCOP_NET 2555 1.94 3.54 1.54 82 HTML_IMAGE_RATIO_06 2553 3.78 3.54 3.84 83 BAYES_40 2538 4.29 3.52 4.48 84 HTML_FONT_SIZE_HUGE 2497 0.78 3.46 0.12 85 TR_M_TOP_BAYES 2466 0.68 3.42 0.00 86 URIBL_DBL_ABUSE_REDIR 2456 0.68 3.40 0.01 87 XMNumbers 2441 3.60 3.38 3.66 88 XM_SPF_SoftFail 2427 1.58 3.36 1.14 89 XMDiploma_00 2421 1.73 3.35 1.34 90 TM2_M_VERY_LONG_WORD 2420 1.70 3.35 1.30 91 RELAYCOUNTRY_RU 2420 0.68 3.35 0.02 92 T_REMOTE_IMAGE 2415 3.06 3.35 2.99 93 XM_CamelCaseFrm001 2407 2.72 3.33 2.57 94 RCVD_IN_RP_RNBL 2405 0.71 3.33 0.06 95 TR_XM_RelayPhish 2377 1.87 3.29 1.52 96 HTML_TAG_BALANCE_HEAD 2356 0.71 3.26 0.08 97 TM2_M_URI_OPT_OUT 2354 2.15 3.26 1.87 98 RELAYCOUNTRY_CA 2341 2.20 3.24 1.94 99 HTML_IMAGE_RATIO_08 2315 2.55 3.21 2.39 100 XMSubject_69 2264 0.62 3.14 0.00 101 BAYES_95 2194 1.90 3.04 1.62 102 TR_Mismatch_TLD_02 2191 0.64 3.04 0.05 103 XMStockSpam_06 2182 2.56 3.02 2.45 104 NO_DNS_FOR_FROM 2171 1.59 3.01 1.24 105 XMBody_17 2143 1.36 2.97 0.96 106 BAYES_20 2128 3.33 2.95 3.42 107 RDNS_DYNAMIC 2105 0.95 2.92 0.47 108 XMGppyBdWords 2092 0.88 2.90 0.38 109 XM_URI_RBL 2090 0.84 2.90 0.33 110 XMBdyGiftCard01 2078 3.24 2.88 3.33 111 XMSubMetaI_00 1923 1.10 2.66 0.71 112 T_XMDrugObfuBody_00 1904 1.25 2.64 0.91 113 FROM_MISSP_REPLYTO 1901 0.52 2.63 0.00 114 TR_XM_PHPDW 1897 0.99 2.63 0.59 115 XMGenDplmaNmb 1893 1.16 2.62 0.79 116 TR_XM_PHPForged 1848 0.97 2.56 0.58 117 TR_XM_FormFill2 1840 0.97 2.55 0.57 118 XM_H_PHPOS 1835 0.96 2.54 0.57 119 MultiRelay_CC 1752 0.61 2.43 0.16 120 MultiRelay_Combo 1752 0.61 2.43 0.16 121 FROM_MISSP_DYNIP 1688 0.46 2.34 0.00 122 RELAYCOUNTRY_FR 1628 0.65 2.26 0.25 123 RELAYCOUNTRY_GB 1594 0.81 2.21 0.47 124 XM_OfRef6 1583 2.04 2.19 2.00 125 XMSexyCombo_04 1552 0.48 2.15 0.07 126 XM_Lotto 1538 0.63 2.13 0.25 127 DATE_IN_PAST_03_06 1520 0.49 2.11 0.09 128 XMSubMetaSxObfu_03 1520 0.81 2.11 0.49 129 RCVD_IN_RP_SAFE 1478 12.88 2.05 15.55 130 TR_XM_INV_DKIM 1475 0.50 2.04 0.13 131 RELAYCOUNTRY_AT 1457 0.64 2.02 0.30 132 BAYES_05 1435 2.17 1.99 2.21 133 XM_BadFromFormat 1358 0.49 1.88 0.14 134 XM_H_PHPOS_M 1336 0.58 1.85 0.26 135 XMSubMetaSSx_00 1289 0.94 1.79 0.73 136 XM_H_PHPMailer 1285 0.77 1.78 0.52 137 RCVD_IN_MSPIKE_WL 1262 3.67 1.75 4.15 138 BAYES_00 1254 15.39 1.74 18.76 139 T_XMHurry_00 1224 1.09 1.70 0.94 140 REPLYTO_WITHOUT_TO_CC 1223 0.36 1.69 0.03 141 HTML_SHORT_LINK_IMG_1 1222 0.36 1.69 0.03 142 ALL_TRUSTED 1218 8.74 1.69 10.48 143 T_MONEY_PERCENT 1180 0.97 1.63 0.80 144 TR_LOTS_OF_MONEY2 1180 0.97 1.63 0.80 145 RCVD_IN_MSPIKE_BL 1176 0.57 1.63 0.30 146 US_DOLLARS_3 1175 1.17 1.63 1.06 147 NORDNS_LOW_CONTRAST 1164 0.32 1.61 0.01 148 RCVD_IN_IADB_LISTED 1119 3.17 1.55 3.57 149 RCVD_IN_PSBL 1101 0.40 1.53 0.12 150 RCVD_IN_IADB_SPF 1037 2.79 1.44 3.12 151 RCVD_IN_RP_CERTIFIED 1030 11.63 1.43 14.15 152 THIS_AD 1022 0.58 1.42 0.38 153 RCVD_IN_IADB_DK 1018 2.46 1.41 2.72 154 RCVD_IN_IADB_SENDERID 1015 2.53 1.41 2.81 155 XMPhish30 997 1.12 1.38 1.06 156 BOUNCE_MESSAGE 984 1.26 1.36 1.23 157 ANY_BOUNCE_MESSAGE 984 1.26 1.36 1.23 158 HDRS_LCASE_IMGONLY 961 0.28 1.33 0.02 159 RCVD_IN_MSPIKE_H3 944 2.92 1.31 3.31 160 XM_ProductURIs 928 1.53 1.29 1.59 161 RELAYCOUNTRY_DE 920 0.47 1.27 0.28 162 XM_DK_Undo_01 883 1.21 1.22 1.21 163 XMPhish11 880 1.10 1.22 1.07 164 URI_OPTOUT_3LD 865 0.26 1.20 0.03 165 RELAYCOUNTRY_IE 848 0.40 1.17 0.21 166 XM_XX_Yahoo 838 0.33 1.16 0.13 167 SpammyFromTLD_01 837 0.61 1.16 0.47 168 TR_Symld_Words 833 1.60 1.15 1.71 169 HTML_IMAGE_ONLY_12 824 0.31 1.14 0.11 170 XMBrknScrpt_02 807 1.01 1.12 0.98 171 TO_NO_BRKTS_DYNIP 790 0.22 1.09 0.00 172 LOW_PRICE 782 0.38 1.08 0.20 173 TO_NO_BRKTS_FROM_MSSP 777 0.23 1.08 0.03 174 XM_H_Long_From02 760 1.53 1.05 1.64 175 PLING_QUERY 750 1.04 1.04 1.04 176 XM_OfRef7 734 0.32 1.02 0.15 177 RCVD_IN_MSPIKE_L5 728 0.26 1.01 0.07 178 MIME_HEADER_CTYPE_ONLY 723 0.31 1.00 0.13 179 T_HTML_TAG_BALANCE_CENTER 714 0.29 0.99 0.12 180 URI_TRY_3LD 713 1.42 0.99 1.52 181 TR_XM_DK_Bayes 696 14.10 0.96 17.35 182 DKIM_ADSP_CUSTOM_MED 680 1.01 0.94 1.03 183 XM_UB60 678 0.24 0.94 0.07 184 XMSubNoVowel 676 0.35 0.94 0.21 185 RELAYCOUNTRY_PL 672 0.21 0.93 0.03 186 MAILING_LIST_MULTI 652 1.47 0.90 1.62 187 NUMERIC_HTTP_ADDR 638 0.60 0.88 0.53 188 MORE_SEX 634 0.18 0.88 0.00 189 DIET_1 634 0.61 0.88 0.55 190 T_TooManySym_02 621 2.39 0.86 2.77 191 TO_EQ_FM_DOM_HTML_IMG 619 0.17 0.86 0.00 192 HTML_IMAGE_ONLY_08 607 0.24 0.84 0.10 193 NML_ADSP_CUSTOM_MED 603 0.78 0.84 0.77 194 MISSING_HEADERS 602 0.40 0.83 0.30 195 TR_Mismatch_TLD_01 602 0.55 0.83 0.48 196 TR_XM_DK_Bayes1 602 13.58 0.83 16.73 197 URIBL_CSS_A 597 1.30 0.83 1.42 198 URIBL_CSS 597 1.30 0.83 1.42 199 FORGED_GMAIL_RCVD 586 0.68 0.81 0.64 200 SHOPIFY_IMG_NOT_RCVD_SFY 584 0.33 0.81 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 260941 90.24 94.38 89.22 2 DKIM_SIGNED 251443 85.44 83.26 85.97 3 XM_DK_Pass 248642 83.52 77.46 85.02 4 DKIM_VALID 239447 80.02 72.53 81.87 5 XM_B_Unicode 224226 75.77 72.11 76.67 6 DKIM_VALID_AU 198490 65.90 57.94 67.87 7 XMListUnsubscribeExists 187949 65.65 71.25 64.26 8 DCC_CHECK 165648 61.46 80.99 56.64 9 BAYES_50 165609 55.34 50.11 56.63 10 XM_B_Unicode3 143354 49.36 50.78 49.02 11 DCC_CHECK_NEGATIVE 123455 37.30 17.37 42.21 12 HTML_FONT_LOW_CONTRAST 112037 38.85 41.03 38.31 13 LOC_TINY_FONT_1 99350 35.14 39.86 33.97 14 DKIM_VALID_EF 81517 27.10 23.97 27.87 15 MIME_HTML_ONLY 75054 25.83 26.52 25.66 16 XMSubLong 68468 23.92 26.00 23.41 17 FVGT_m_MULTI_ODD 65862 24.41 32.06 22.52 18 T_TM2_M_HEADER_IN_MSG 62924 20.28 15.29 21.52 19 BAYES_00 54859 15.39 1.74 18.76 20 XM_Body_Dirty_Words 52770 20.00 27.94 18.04 21 TR_XM_DK_Bayes 50734 14.10 0.96 17.35 22 T_KAM_HTML_FONT_INVALID 50129 17.17 17.30 17.14 23 TR_XM_DK_Bayes1 48915 13.58 0.83 16.73 24 TR_XM_DK_Bayes2 45712 12.68 0.71 15.63 25 RCVD_IN_RP_SAFE 45489 12.88 2.05 15.55 26 MultiRelay 44976 16.73 22.23 15.38 27 XM_Multi_Part_URI 43209 16.35 22.74 14.77 28 RCVD_IN_RP_CERTIFIED 41373 11.63 1.43 14.15 29 HTML_IMAGE_RATIO_02 39668 13.85 15.02 13.56 30 XM_Evil_Numbers_Gen 37495 13.09 14.19 12.82 31 XM_DKIMWhitelistDomains 37314 10.24 0.05 12.76 32 XM_B_Unsub 32679 11.72 13.95 11.17 33 ALL_TRUSTED 30656 8.74 1.69 10.48 34 LOTS_OF_MONEY 27987 9.75 10.49 9.57 35 T_XMDrugObfuBody_14 25434 8.67 8.57 8.70 36 XM_DK_Undo_02 25228 14.45 38.05 8.63 37 HTML_IMAGE_RATIO_04 24989 8.52 8.42 8.54 38 FSL_BULK_SIG 24051 9.37 13.99 8.22 39 XM_B_Phish_Phrases 23558 8.33 9.45 8.06 40 LotsOfNums_01 23395 7.80 6.97 8.00 41 XM_SendGrid 21005 7.87 10.68 7.18 42 XM_H_Long_From01 20517 7.25 8.18 7.02 43 XMSexyCombo_05 19033 7.56 11.82 6.51 44 XMStrtUSub 18523 5.83 3.79 6.33 45 BOTNET_IPINHOSTNAME 18056 8.28 16.82 6.17 46 TooManyTo_001 17734 7.17 11.66 6.06 47 RCVD_IN_MSPIKE_H2 16918 5.46 4.16 5.78 48 FROM_EXCESS_BASE64 15499 5.14 4.50 5.30 49 T_TooManySym_01 15318 5.07 4.40 5.24 50 BAYES_60 14711 4.94 4.58 5.03 51 RELAYCOUNTRY_META 13946 8.31 22.65 4.77 52 BAYES_99 13774 8.91 25.95 4.71 53 MPART_ALT_DIFF 13772 5.59 9.15 4.71 54 XMSubMetaSx_00 13382 5.72 10.34 4.58 55 BAYES_40 13092 4.29 3.52 4.48 56 MIME_QP_LONG_LINE 12510 4.88 7.34 4.28 57 MIME_HTML_MOSTLY 12179 5.18 9.31 4.16 58 RCVD_IN_MSPIKE_WL 12134 3.67 1.75 4.15 59 DKIM_INVALID 11996 5.41 10.73 4.10 60 TR_XM_DK_SendGrid 11442 3.89 3.80 3.91 61 BAYES_999 11320 7.23 20.85 3.87 62 HTML_IMAGE_RATIO_06 11231 3.78 3.54 3.84 63 XM_DIRTYINTL 11048 5.09 10.39 3.78 64 XM_UncommonTLD01 10875 6.65 18.53 3.72 65 XMNumbers 10692 3.60 3.38 3.66 66 UNPARSEABLE_RELAY 10592 3.71 4.08 3.62 67 RCVD_IN_IADB_LISTED 10442 3.17 1.55 3.57 68 BAYES_20 10006 3.33 2.95 3.42 69 XMBdyGiftCard01 9736 3.24 2.88 3.33 70 RCVD_IN_MSPIKE_H3 9689 2.92 1.31 3.31 71 IN_ZIMBRA_NJ_WHITELIST 9487 2.60 0.01 3.24 72 RCVD_IN_IADB_SPF 9133 2.79 1.44 3.12 73 T_REMOTE_IMAGE 8739 3.06 3.35 2.99 74 TVD_RCVD_IP 8422 2.41 0.49 2.88 75 RCVD_IN_IADB_SENDERID 8205 2.53 1.41 2.81 76 SUBJ_ALL_CAPS 8122 3.02 3.99 2.78 77 T_TooManySym_02 8101 2.39 0.86 2.77 78 BAYES_80 8008 3.33 5.73 2.74 79 RCVD_IN_IADB_DK 7951 2.46 1.41 2.72 80 CK_HELO_DYNAMIC_SPLIT_IP 7610 2.22 0.67 2.60 81 HELO_DYNAMIC_IPADDR2 7607 2.11 0.11 2.60 82 XM_CamelCaseFrm001 7517 2.72 3.33 2.57 83 INVALID_MSGID 7327 2.12 0.55 2.51 84 TR_DCC_Bayes_99 7300 6.12 20.82 2.50 85 XMStockSpam_06 7168 2.56 3.02 2.45 86 HTML_IMAGE_RATIO_08 6980 2.55 3.21 2.39 87 BOTNET 6945 6.80 24.73 2.37 88 TO_MALFORMED 6831 1.93 0.26 2.34 89 RCVD_IN_IADB_VOUCHED 6694 1.94 0.50 2.29 90 BAYES_05 6462 2.17 1.99 2.21 91 MIME_HTML_ONLY_MULTI 6339 2.47 3.69 2.17 92 URI_HEX 6278 2.72 5.04 2.15 93 USER_IN_DEF_DKIM_WL 6251 1.72 0.01 2.14 94 XM_B_SpammyTLD 6006 3.75 10.63 2.05 95 XM_OfRef6 5854 2.04 2.19 2.00 96 RELAYCOUNTRY_CA 5663 2.20 3.24 1.94 97 XM_PDF 5582 1.61 0.40 1.91 98 TM2_M_URI_OPT_OUT 5483 2.15 3.26 1.87 99 IN_HORDE_ADDRESS_BOOK 5008 1.38 0.02 1.71 100 HTML_MIME_NO_HTML_TAG 5007 2.13 3.84 1.71 101 TR_Symld_Words 4990 1.60 1.15 1.71 102 UNTRUSTED_Relay 4946 4.64 16.61 1.69 103 XM_H_Long_From02 4808 1.53 1.05 1.64 104 BAYES_95 4741 1.90 3.04 1.62 105 MAILING_LIST_MULTI 4726 1.47 0.90 1.62 106 XM_ProductURIs 4663 1.53 1.29 1.59 107 RCVD_IN_BL_SPAMCOP_NET 4515 1.94 3.54 1.54 108 URI_TRY_3LD 4453 1.42 0.99 1.52 109 TR_XM_RelayPhish 4436 1.87 3.29 1.52 110 URIBL_CSS 4148 1.30 0.83 1.42 111 URIBL_CSS_A 4148 1.30 0.83 1.42 112 RCVD_IN_IADB_OPTIN 4142 1.22 0.41 1.42 113 XMDiploma_00 3905 1.73 3.35 1.34 114 T_XMDrugObfuBody_08 3887 2.11 5.26 1.33 115 TM2_M_VERY_LONG_WORD 3797 1.70 3.35 1.30 116 NO_DNS_FOR_FROM 3625 1.59 3.01 1.24 117 ANY_BOUNCE_MESSAGE 3607 1.26 1.36 1.23 118 BOUNCE_MESSAGE 3605 1.26 1.36 1.23 119 XM_DK_Undo_01 3538 1.21 1.22 1.21 120 XM_SPF_SoftFail 3324 1.58 3.36 1.14 121 XM_B_REG_HTML 3292 0.96 0.30 1.13 122 XMGappySubj_01 3224 0.94 0.28 1.10 123 TooManyTo_002 3125 1.00 0.73 1.07 124 XMPhish11 3115 1.10 1.22 1.07 125 XM_GoogleGroups 3101 0.95 0.48 1.06 126 XMPhish30 3100 1.12 1.38 1.06 127 US_DOLLARS_3 3086 1.17 1.63 1.06 128 XM_RXBody 3075 0.91 0.36 1.05 129 PLING_QUERY 3031 1.04 1.04 1.04 130 XMHTML_After_End 3023 0.95 0.61 1.03 131 DKIM_ADSP_CUSTOM_MED 3004 1.01 0.94 1.03 132 XM_B_Unsub2 2932 1.67 4.39 1.00 133 XMBrknScrpt_02 2872 1.01 1.12 0.98 134 XMBody_17 2810 1.36 2.97 0.96 135 T_XMHurry_00 2758 1.09 1.70 0.94 136 KHOP_HELO_FCRDNS 2735 1.82 5.41 0.94 137 XMBody_95 2649 0.76 0.15 0.91 138 T_XMDrugObfuBody_00 2648 1.25 2.64 0.91 139 XM_UB50 2539 2.21 7.63 0.87 140 XMSubMetaSxObfu_02 2512 0.76 0.35 0.86 141 HTML_TAG_BALANCE_BODY 2431 1.43 3.87 0.83 142 FILL_THIS_FORM 2363 0.80 0.75 0.81 143 TR_LOTS_OF_MONEY2 2349 0.97 1.63 0.80 144 T_MONEY_PERCENT 2349 0.97 1.63 0.80 145 XMGenDplmaNmb 2319 1.16 2.62 0.79 146 XMHTMLBadTable_001 2264 0.77 0.73 0.77 147 NML_ADSP_CUSTOM_MED 2257 0.78 0.84 0.77 148 TooManyTo_003 2208 0.72 0.60 0.75 149 FILL_THIS_FORM_LONG 2148 0.70 0.56 0.73 150 RCVD_IN_MSPIKE_H4 2145 0.67 0.40 0.73 151 TR_MetaPhish_Combo_01 2129 0.70 0.60 0.73 152 XMSubMetaSSx_00 2124 0.94 1.79 0.73 153 T_FILL_THIS_FORM_LOAN 2097 0.63 0.30 0.72 154 XMSubMetaI_00 2084 1.10 2.66 0.71 155 USER_IN_WHITELIST 2046 0.56 0.00 0.70 156 FSL_THIS_IS_ADV 2032 0.69 0.66 0.69 157 XMBSHREFv2 1999 0.63 0.41 0.68 158 T_TooManySym_03 1954 0.57 0.16 0.67 159 XM_Body_Obfu01 1906 0.65 0.63 0.65 160 FORGED_GMAIL_RCVD 1876 0.68 0.81 0.64 161 URI_NOVOWEL 1873 0.60 0.44 0.64 162 TooManyTo_004 1847 0.61 0.53 0.63 163 XMBody_78 1775 0.55 0.33 0.61 164 TR_XM_PHPDW 1724 0.99 2.63 0.59 165 TR_XM_PHPForged 1691 0.97 2.56 0.58 166 TR_XM_FormFill2 1681 0.97 2.55 0.57 167 XMLngstWrd_00 1672 0.56 0.50 0.57 168 XM_H_PHPOS 1665 0.96 2.54 0.57 169 HTML_FONT_FACE_BAD 1651 0.58 0.66 0.56 170 BODY_ENHANCEMENT 1647 0.46 0.03 0.56 171 XM_B_COPY_HTML 1639 0.56 0.56 0.56 172 TooManyTo_005 1628 0.53 0.44 0.56 173 DIET_1 1601 0.61 0.88 0.55 174 XMLngstWrd_01 1593 0.53 0.45 0.54 175 NUMERIC_HTTP_ADDR 1546 0.60 0.88 0.53 176 XM_H_PHPMailer 1531 0.77 1.78 0.52 177 XMSexyCombo_01 1491 1.15 3.73 0.51 178 XMSubMetaSxObfu_03 1447 0.81 2.11 0.49 179 T_FILL_THIS_FORM_SHORT 1419 0.52 0.64 0.49 180 DKIM_ADSP_NXDOMAIN 1409 1.32 4.70 0.48 181 TR_Mismatch_TLD_01 1408 0.55 0.83 0.48 182 SpammyFromTLD_01 1380 0.61 1.16 0.47 183 RELAYCOUNTRY_GB 1376 0.81 2.21 0.47 184 RDNS_DYNAMIC 1375 0.95 2.92 0.47 185 XM_SPF_Unknown 1369 0.44 0.33 0.47 186 XM_Walgreens_Forge 1309 0.41 0.26 0.45 187 SUBJ_DOLLARS 1230 0.46 0.60 0.42 188 HELO_NODOT 1206 0.43 0.51 0.41 189 T_Symld_Words_02 1192 0.45 0.63 0.41 190 XMCapTrack 1137 0.36 0.22 0.39 191 TM2_M_A_HREF_HREF 1136 0.43 0.62 0.39 192 HELO_NO_DOMAIN 1112 0.41 0.51 0.38 193 THIS_AD 1108 0.58 1.42 0.38 194 XMGppyBdWords 1104 0.88 2.90 0.38 195 HTTPS_HTTP_MISMATCH 1089 0.38 0.40 0.37 196 XMLngstWrd_02 1059 0.37 0.42 0.36 197 FSL_HELO_FAKE 1049 0.30 0.04 0.36 198 T_TooManySym_04 1048 0.30 0.04 0.36 199 XMSubject_48 1036 0.34 0.26 0.35 200 XMNoVowels 982 0.32 0.23 0.34 ----------------------------------------------------------------------