Email: 669357 Autolearn: 0 AvgScore: 1.76 AvgScanTime: 2.29 sec Spam: 134300 Autolearn: 0 AvgScore: 12.48 AvgScanTime: 2.96 sec Ham: 535057 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 2.12 sec Time Spent Running SA: 425.71 hours Time Spent Processing Spam: 110.41 hours Time Spent Processing Ham: 315.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126095 90.80 93.89 90.02 2 DCC_CHECK 110831 54.43 82.52 47.38 3 DKIM_SIGNED 103129 79.76 76.79 80.51 4 XM_DK_Pass 98735 78.21 73.52 79.39 5 XM_B_Unicode 94900 72.39 70.66 72.82 6 DKIM_VALID 93259 74.79 69.44 76.13 7 XMListUnsubscribeExists 87157 61.00 64.90 60.02 8 DKIM_VALID_AU 71364 55.51 53.14 56.11 9 BAYES_50 63265 54.24 47.11 56.03 10 XM_B_Unicode3 63059 45.05 46.95 44.57 11 MIME_HTML_ONLY 48014 23.35 35.75 20.24 12 XM_DK_Undo_02 47529 12.50 35.39 6.75 13 HTML_FONT_LOW_CONTRAST 46838 31.41 34.88 30.54 14 LOC_TINY_FONT_1 45467 28.39 33.85 27.02 15 FVGT_m_MULTI_ODD 36490 23.39 27.17 22.44 16 XMSubLong 36000 22.35 26.81 21.23 17 RELAYCOUNTRY_META 32933 9.56 24.52 5.81 18 BAYES_99 32195 7.42 23.97 3.26 19 BOTNET 31796 6.53 23.68 2.23 20 DKIM_VALID_EF 30933 25.53 23.03 26.16 21 XM_Body_Dirty_Words 30562 15.80 22.76 14.06 22 MultiRelay 28748 17.60 21.41 16.65 23 XM_Multi_Part_URI 26264 13.49 19.56 11.97 24 T_KAM_HTML_FONT_INVALID 26220 19.88 19.52 19.97 25 FSL_BULK_SIG 26064 8.74 19.41 6.06 26 TR_DCC_Bayes_99 26043 5.05 19.39 1.45 27 BAYES_999 25133 5.84 18.71 2.60 28 BOTNET_IPINHOSTNAME 23773 7.34 17.70 4.74 29 UNTRUSTED_Relay 22776 5.01 16.96 2.01 30 T_TM2_M_HEADER_IN_MSG 21509 23.64 16.02 25.56 31 DCC_CHECK_NEGATIVE 20857 43.59 15.53 50.63 32 XM_B_Unsub 20773 11.49 15.47 10.49 33 XM_UncommonTLD01 19996 5.59 14.89 3.26 34 HTML_IMAGE_RATIO_02 19562 10.75 14.57 9.80 35 LOTS_OF_MONEY 18320 8.65 13.64 7.40 36 XM_Evil_Numbers_Gen 16605 10.59 12.36 10.14 37 XMSexyCombo_05 15320 5.40 11.41 3.89 38 XM_UB50 12427 2.72 9.25 1.08 39 XM_B_Phish_Phrases 12234 6.90 9.11 6.34 40 XM_DIRTYINTL 11768 3.50 8.76 2.18 41 LotsOfNums_01 10956 9.85 8.16 10.27 42 T_XMDrugObfuBody_14 10789 7.95 8.03 7.93 43 XMSubMetaSx_00 10768 4.60 8.02 3.74 44 TooManyTo_001 10759 7.21 8.01 7.01 45 MPART_ALT_DIFF 10739 4.56 8.00 3.70 46 HTML_MIME_NO_HTML_TAG 10543 3.42 7.85 2.31 47 DKIM_INVALID 9870 4.98 7.35 4.38 48 XM_H_Long_From01 9825 6.99 7.32 6.91 49 HTML_SHORT_LINK_IMG_1 9737 1.48 7.25 0.03 50 HTML_IMAGE_RATIO_04 9385 7.59 6.99 7.74 51 SpammyFromTLD_02 9356 1.70 6.97 0.38 52 XM_SendGrid 9109 6.69 6.78 6.66 53 T_REMOTE_IMAGE 8610 4.30 6.41 3.77 54 BAYES_80 8423 3.42 6.27 2.70 55 BAYES_60 8259 5.32 6.15 5.11 56 MIME_HTML_MOSTLY 7709 3.59 5.74 3.05 57 XM_B_SpammyTLD 7687 2.80 5.72 2.06 58 KHOP_HELO_FCRDNS 7284 2.82 5.42 2.16 59 MIME_QP_LONG_LINE 6982 6.60 5.20 6.95 60 XMNumbers 6953 3.52 5.18 3.10 61 BODY_URI_ONLY 6891 1.08 5.13 0.07 62 RELAYCOUNTRY_FR 6762 1.35 5.03 0.42 63 HTML_IMAGE_ONLY_08 6759 1.09 5.03 0.10 64 SUBJ_ALL_CAPS 6732 2.99 5.01 2.48 65 XM_BadFromFormat 6556 1.06 4.88 0.10 66 T_HTML_TAG_BALANCE_CENTER 6505 1.04 4.84 0.09 67 BOTNET_NORDNS 6347 1.01 4.73 0.07 68 URI_HEX 6048 2.57 4.50 2.09 69 RCVD_IN_RP_RNBL 6042 0.95 4.50 0.06 70 TR_XM_DK_SendGrid 6000 3.63 4.47 3.42 71 XM_SPF_SoftFail 5968 2.48 4.44 1.99 72 XMStockSpam_06 5957 1.57 4.44 0.85 73 XM_OfRef6 5931 1.98 4.42 1.36 74 RCVD_IN_BL_SPAMCOP_NET 5738 2.02 4.27 1.46 75 HDRS_LCASE_IMGONLY 5736 0.87 4.27 0.02 76 BAYES_40 5475 5.19 4.08 5.47 77 TR_XM_RelayPhish 5430 1.43 4.04 0.78 78 HTML_IMAGE_RATIO_06 5351 3.72 3.98 3.65 79 MIME_HTML_ONLY_MULTI 5342 2.22 3.98 1.78 80 FROM_SUSPICIOUS_NTLD 5318 0.91 3.96 0.15 81 FROM_SUSPICIOUS_NTLD_FP 5275 0.90 3.93 0.14 82 TM2_M_VERY_LONG_WORD 5250 1.78 3.91 1.25 83 RDNS_DYNAMIC 5211 1.13 3.88 0.44 84 TM2_M_URI_OPT_OUT 5196 2.62 3.87 2.30 85 MultiRelay_Combo 5087 0.94 3.79 0.23 86 MultiRelay_CC 5087 0.94 3.79 0.23 87 FROM_EXCESS_BASE64 4994 4.18 3.72 4.30 88 XMStrtUSub 4787 3.96 3.56 4.06 89 BAYES_20 4753 4.06 3.54 4.18 90 NO_DNS_FOR_FROM 4722 1.53 3.52 1.03 91 BAYES_00 4692 15.72 3.49 18.79 92 FROM_MISSP_REPLYTO 4449 0.67 3.31 0.00 93 BAYES_95 4432 1.85 3.30 1.48 94 RELAYCOUNTRY_GB 4337 1.41 3.23 0.95 95 RCVD_IN_MSPIKE_H2 4306 5.01 3.21 5.46 96 XM_URI_RBL 4301 0.88 3.20 0.30 97 XM_B_Unsub2 3921 2.50 2.92 2.40 98 HDRS_MISSP 3835 0.58 2.86 0.01 99 REPLYTO_WITHOUT_TO_CC 3819 0.60 2.84 0.04 100 T_TooManySym_01 3811 4.04 2.84 4.34 101 RELAYCOUNTRY_CA 3655 1.80 2.72 1.57 102 XMDiploma_00 3606 2.00 2.69 1.82 103 TR_Mismatch_TLD_02 3592 0.66 2.67 0.15 104 XMBody_17 3571 1.16 2.66 0.78 105 XMBdyGiftCard01 3535 1.95 2.63 1.78 106 XMSexyCombo_01 3499 0.97 2.61 0.56 107 FILL_THIS_FORM 3440 0.88 2.56 0.46 108 HTML_IMAGE_ONLY_12 3403 0.63 2.53 0.16 109 MIME_HEADER_CTYPE_ONLY 3379 0.58 2.52 0.09 110 DATE_IN_PAST_03_06 3339 0.63 2.49 0.16 111 XM_OfRef7 3302 0.66 2.46 0.21 112 DKIM_ADSP_NXDOMAIN 3203 1.09 2.38 0.76 113 RCVD_IN_MSPIKE_WL 3103 4.21 2.31 4.69 114 HTML_IMAGE_RATIO_08 3094 2.23 2.30 2.21 115 FILL_THIS_FORM_LONG 3045 0.75 2.27 0.37 116 LongTLD 3038 0.69 2.26 0.29 117 XMSubMetaI_00 3031 1.26 2.26 1.01 118 XM_CamelCaseFrm001 3012 2.38 2.24 2.42 119 XMGenDplmaNmb 2997 1.34 2.23 1.12 120 T_XMDrugObfuBody_00 2937 1.19 2.19 0.94 121 TR_XM_INV_DKIM 2835 0.49 2.11 0.08 122 XM_UB99 2828 0.43 2.11 0.01 123 RCVD_IN_IADB_LISTED 2762 5.62 2.06 6.51 124 T_XMDrugObfuBody_08 2759 1.58 2.05 1.46 125 XMSubMetaSxObfu_03 2757 0.84 2.05 0.54 126 DATE_IN_PAST_06_12 2651 0.48 1.97 0.10 127 RCVD_IN_IADB_SPF 2609 4.93 1.94 5.68 128 BAYES_05 2563 2.59 1.91 2.76 129 RCVD_IN_IADB_DK 2560 4.32 1.91 4.92 130 TR_XM_PHPDW 2559 0.86 1.91 0.60 131 RCVD_IN_IADB_SENDERID 2558 4.40 1.90 5.03 132 HTML_EXTRA_CLOSE 2544 0.39 1.89 0.01 133 US_DOLLARS_3 2501 0.85 1.86 0.59 134 TO_EQ_FM_DOM_HTML_IMG 2498 0.38 1.86 0.01 135 TR_XM_FormFill2 2490 0.84 1.85 0.58 136 TR_XM_PHPForged 2479 0.84 1.85 0.58 137 XM_H_PHPOS 2471 0.83 1.84 0.58 138 RELAYCOUNTRY_IT 2446 0.40 1.82 0.04 139 ADVANCE_FEE_5_NEW_FRM_MNY 2347 0.35 1.75 0.00 140 RCVD_IN_RP_SAFE 2319 9.58 1.73 11.55 141 XM_OfRef8 2289 0.36 1.70 0.02 142 MONEY_FRAUD_5 2285 0.34 1.70 0.00 143 SUBJECT_NEEDS_ENCODING 2273 0.34 1.69 0.01 144 SUBJ_ILLEGAL_CHARS 2261 0.34 1.68 0.01 145 XM_UB60 2236 0.38 1.66 0.06 146 RCVD_IN_PSBL 2219 0.36 1.65 0.04 147 XMMoneyMeta_00 2147 0.76 1.60 0.55 148 XM_OfRef9 2108 0.32 1.57 0.00 149 TR_XM_DK_Bayes 2087 12.92 1.55 15.78 150 RCVD_IN_MSPIKE_H3 2036 3.61 1.52 4.14 151 UNPARSEABLE_RELAY 1979 2.11 1.47 2.27 152 XM_UB999 1949 0.30 1.45 0.01 153 RELAYCOUNTRY_LV 1937 0.30 1.44 0.02 154 SpammyFromTLD_01 1922 0.89 1.43 0.76 155 TR_XM_DK_Bayes1 1907 12.39 1.42 15.14 156 T_MONEY_PERCENT 1789 0.62 1.33 0.45 157 TR_LOTS_OF_MONEY2 1789 0.62 1.33 0.45 158 MAILING_LIST_MULTI 1755 2.36 1.31 2.63 159 RCVD_IN_MSPIKE_BL 1750 0.90 1.30 0.80 160 T_XMHurry_00 1736 0.96 1.29 0.88 161 RELAYCOUNTRY_IN 1724 0.36 1.28 0.13 162 XM_H_Long_From02 1716 1.12 1.28 1.08 163 XM_ProductURIs 1716 0.92 1.28 0.83 164 T_Symld_Words_02 1688 0.64 1.26 0.49 165 TR_Symld_Words 1683 1.26 1.25 1.26 166 XMBrknScrpt_02 1665 1.01 1.24 0.95 167 ALL_TRUSTED 1661 9.94 1.24 12.13 168 URI_TRY_3LD 1634 1.20 1.22 1.20 169 DIET_1 1629 0.59 1.21 0.44 170 XMSexyCombo_04 1622 0.33 1.21 0.11 171 XM_UB80 1597 0.27 1.19 0.04 172 SUBJ_DOLLARS 1585 0.51 1.18 0.34 173 TM2_M_A_HREF_HREF 1562 0.59 1.16 0.44 174 RELAYCOUNTRY_AT 1549 0.43 1.15 0.25 175 XMHTML_After_End 1527 1.04 1.14 1.02 176 XMPhish30 1510 0.72 1.12 0.61 177 XM_H_PHPMailer 1505 0.58 1.12 0.45 178 TR_LOTS_OF_MONEY3 1504 0.59 1.12 0.45 179 RCVD_IN_RP_CERTIFIED 1486 8.43 1.11 10.27 180 FSL_THIS_IS_ADV 1467 0.48 1.09 0.33 181 XMPhish11 1417 0.99 1.06 0.97 182 HK_SCAM 1396 0.22 1.04 0.02 183 RELAYCOUNTRY_TR 1336 0.21 0.99 0.01 184 THIS_AD 1310 0.81 0.98 0.76 185 XM_H_PHPOS_M 1281 0.33 0.95 0.17 186 RELAYCOUNTRY_IE 1264 0.30 0.94 0.14 187 LOW_PRICE 1241 0.42 0.92 0.29 188 HTML_FONT_FACE_BAD 1204 0.79 0.90 0.76 189 XM_Combo_Sbj 1191 0.48 0.89 0.37 190 RELAYCOUNTRY_DE 1166 0.60 0.87 0.53 191 XM_DK_Undo_01 1166 1.31 0.87 1.42 192 LONG_HEX_URI 1141 0.35 0.85 0.23 193 XMHTMLBadTable_001 1126 0.58 0.84 0.51 194 XMClaimOffer 1126 0.27 0.84 0.12 195 TR_XM_DK_Bayes2 1121 10.89 0.83 13.41 196 DKIM_ADSP_CUSTOM_MED 1110 1.10 0.83 1.16 197 XMGppyBdWords 1099 0.36 0.82 0.24 198 XMPhish14 1084 0.49 0.81 0.42 199 XM_SPF_Unknown 1051 0.67 0.78 0.65 200 XM_XX_Yahoo 1039 0.27 0.77 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 481668 90.80 93.89 90.02 2 DKIM_SIGNED 430758 79.76 76.79 80.51 3 XM_DK_Pass 424792 78.21 73.52 79.39 4 DKIM_VALID 407325 74.79 69.44 76.13 5 XM_B_Unicode 389637 72.39 70.66 72.82 6 XMListUnsubscribeExists 321120 61.00 64.90 60.02 7 DKIM_VALID_AU 300211 55.51 53.14 56.11 8 BAYES_50 299766 54.24 47.11 56.03 9 DCC_CHECK_NEGATIVE 270889 43.59 15.53 50.63 10 DCC_CHECK 253526 54.43 82.52 47.38 11 XM_B_Unicode3 238483 45.05 46.95 44.57 12 HTML_FONT_LOW_CONTRAST 163381 31.41 34.88 30.54 13 LOC_TINY_FONT_1 144581 28.39 33.85 27.02 14 DKIM_VALID_EF 139969 25.53 23.03 26.16 15 T_TM2_M_HEADER_IN_MSG 136755 23.64 16.02 25.56 16 FVGT_m_MULTI_ODD 120071 23.39 27.17 22.44 17 XMSubLong 113609 22.35 26.81 21.23 18 MIME_HTML_ONLY 108306 23.35 35.75 20.24 19 T_KAM_HTML_FONT_INVALID 106833 19.88 19.52 19.97 20 BAYES_00 100530 15.72 3.49 18.79 21 MultiRelay 89074 17.60 21.41 16.65 22 TR_XM_DK_Bayes 84422 12.92 1.55 15.78 23 TR_XM_DK_Bayes1 80999 12.39 1.42 15.14 24 XM_Body_Dirty_Words 75217 15.80 22.76 14.06 25 TR_XM_DK_Bayes2 71749 10.89 0.83 13.41 26 ALL_TRUSTED 64893 9.94 1.24 12.13 27 XM_Multi_Part_URI 64030 13.49 19.56 11.97 28 RCVD_IN_RP_SAFE 61798 9.58 1.73 11.55 29 XM_B_Unsub 56150 11.49 15.47 10.49 30 LotsOfNums_01 54970 9.85 8.16 10.27 31 RCVD_IN_RP_CERTIFIED 54936 8.43 1.11 10.27 32 XM_Evil_Numbers_Gen 54280 10.59 12.36 10.14 33 HTML_IMAGE_RATIO_02 52420 10.75 14.57 9.80 34 T_XMDrugObfuBody_14 42446 7.95 8.03 7.93 35 HTML_IMAGE_RATIO_04 41437 7.59 6.99 7.74 36 LOTS_OF_MONEY 39603 8.65 13.64 7.40 37 TooManyTo_001 37510 7.21 8.01 7.01 38 MIME_QP_LONG_LINE 37190 6.60 5.20 6.95 39 XM_DKIMWhitelistDomains 37115 5.56 0.06 6.94 40 XM_H_Long_From01 36980 6.99 7.32 6.91 41 XM_DK_Undo_02 36120 12.50 35.39 6.75 42 XM_SendGrid 35660 6.69 6.78 6.66 43 RCVD_IN_IADB_LISTED 34848 5.62 2.06 6.51 44 XM_B_Phish_Phrases 33945 6.90 9.11 6.34 45 FSL_BULK_SIG 32421 8.74 19.41 6.06 46 RELAYCOUNTRY_META 31076 9.56 24.52 5.81 47 RCVD_IN_IADB_SPF 30375 4.93 1.94 5.68 48 BAYES_40 29252 5.19 4.08 5.47 49 RCVD_IN_MSPIKE_H2 29206 5.01 3.21 5.46 50 BAYES_60 27343 5.32 6.15 5.11 51 RCVD_IN_IADB_SENDERID 26898 4.40 1.90 5.03 52 RCVD_IN_IADB_DK 26342 4.32 1.91 4.92 53 BOTNET_IPINHOSTNAME 25339 7.34 17.70 4.74 54 RCVD_IN_MSPIKE_WL 25075 4.21 2.31 4.69 55 DKIM_INVALID 23433 4.98 7.35 4.38 56 T_TooManySym_01 23221 4.04 2.84 4.34 57 FROM_EXCESS_BASE64 22986 4.18 3.72 4.30 58 BAYES_20 22391 4.06 3.54 4.18 59 RCVD_IN_MSPIKE_H3 22141 3.61 1.52 4.14 60 RCVD_IN_IADB_VOUCHED 22091 3.41 0.56 4.13 61 XMStrtUSub 21746 3.96 3.56 4.06 62 XMSexyCombo_05 20809 5.40 11.41 3.89 63 XM_PDF 20609 3.20 0.59 3.85 64 T_REMOTE_IMAGE 20162 4.30 6.41 3.77 65 XMSubMetaSx_00 20001 4.60 8.02 3.74 66 MPART_ALT_DIFF 19775 4.56 8.00 3.70 67 HTML_IMAGE_RATIO_06 19525 3.72 3.98 3.65 68 TR_XM_DK_SendGrid 18289 3.63 4.47 3.42 69 IN_ZIMBRA_NJ_WHITELIST 18237 2.73 0.02 3.41 70 BAYES_99 17468 7.42 23.97 3.26 71 XM_UncommonTLD01 17420 5.59 14.89 3.26 72 XMNumbers 16578 3.52 5.18 3.10 73 MIME_HTML_MOSTLY 16303 3.59 5.74 3.05 74 BAYES_05 14758 2.59 1.91 2.76 75 BAYES_80 14461 3.42 6.27 2.70 76 MAILING_LIST_MULTI 14071 2.36 1.31 2.63 77 RCVD_IN_IADB_OPTIN 13959 2.18 0.47 2.61 78 BAYES_999 13930 5.84 18.71 2.60 79 SUBJ_ALL_CAPS 13286 2.99 5.01 2.48 80 XM_CamelCaseFrm001 12932 2.38 2.24 2.42 81 XM_B_Unsub2 12839 2.50 2.92 2.40 82 HTML_MIME_NO_HTML_TAG 12363 3.42 7.85 2.31 83 TM2_M_URI_OPT_OUT 12326 2.62 3.87 2.30 84 UNPARSEABLE_RELAY 12126 2.11 1.47 2.27 85 BOTNET 11912 6.53 23.68 2.23 86 HTML_IMAGE_RATIO_08 11809 2.23 2.30 2.21 87 XM_DIRTYINTL 11682 3.50 8.76 2.18 88 KHOP_HELO_FCRDNS 11562 2.82 5.42 2.16 89 TVD_RCVD_IP 11331 1.80 0.52 2.12 90 URI_HEX 11186 2.57 4.50 2.09 91 XM_B_SpammyTLD 11026 2.80 5.72 2.06 92 UNTRUSTED_Relay 10738 5.01 16.96 2.01 93 XM_SPF_SoftFail 10658 2.48 4.44 1.99 94 T_TooManySym_02 10445 1.68 0.61 1.95 95 XMDiploma_00 9764 2.00 2.69 1.82 96 ANY_BOUNCE_MESSAGE 9707 1.59 0.69 1.81 97 BOUNCE_MESSAGE 9705 1.59 0.69 1.81 98 MIME_HTML_ONLY_MULTI 9523 2.22 3.98 1.78 99 XMBdyGiftCard01 9519 1.95 2.63 1.78 100 TooManyTo_002 8712 1.44 0.71 1.63 101 RELAYCOUNTRY_CA 8379 1.80 2.72 1.57 102 CK_HELO_DYNAMIC_SPLIT_IP 8199 1.31 0.43 1.53 103 HELO_DYNAMIC_IPADDR2 8197 1.24 0.06 1.53 104 IN_HORDE_ADDRESS_BOOK 8087 1.21 0.02 1.51 105 BAYES_95 7943 1.85 3.30 1.48 106 T_XMDrugObfuBody_08 7823 1.58 2.05 1.46 107 RCVD_IN_BL_SPAMCOP_NET 7791 2.02 4.27 1.46 108 TR_DCC_Bayes_99 7742 5.05 19.39 1.45 109 XM_DK_Undo_01 7601 1.31 0.87 1.42 110 INVALID_MSGID 7402 1.17 0.34 1.38 111 XM_OfRef6 7291 1.98 4.42 1.36 112 TR_Symld_Words 6755 1.26 1.25 1.26 113 TO_MALFORMED 6697 1.01 0.03 1.25 114 TM2_M_VERY_LONG_WORD 6691 1.78 3.91 1.25 115 URI_TRY_3LD 6421 1.20 1.22 1.20 116 DKIM_ADSP_CUSTOM_MED 6230 1.10 0.83 1.16 117 HELO_NODOT 6090 1.04 0.65 1.14 118 HELO_NO_DOMAIN 6089 1.04 0.65 1.14 119 USER_IN_DEF_DKIM_WL 6050 0.91 0.01 1.13 120 XMGenDplmaNmb 5991 1.34 2.23 1.12 121 XM_UB50 5799 2.72 9.25 1.08 122 XM_H_Long_From02 5774 1.12 1.28 1.08 123 TooManyTo_003 5597 0.95 0.56 1.05 124 NO_DNS_FOR_FROM 5511 1.53 3.52 1.03 125 XMHTML_After_End 5448 1.04 1.14 1.02 126 XMSubMetaI_00 5405 1.26 2.26 1.01 127 XM_GoogleGroups 5362 0.87 0.36 1.00 128 XMGappySubj_01 5199 0.82 0.21 0.97 129 XMPhish11 5178 0.99 1.06 0.97 130 XMCapTrack 5166 0.82 0.25 0.97 131 XMBrknScrpt_02 5082 1.01 1.24 0.95 132 RELAYCOUNTRY_GB 5077 1.41 3.23 0.95 133 T_XMDrugObfuBody_00 5055 1.19 2.19 0.94 134 T_XMHurry_00 4711 0.96 1.29 0.88 135 XMStockSpam_06 4525 1.57 4.44 0.85 136 TR_MetaPhish_Combo_01 4493 0.79 0.57 0.84 137 XM_ProductURIs 4420 0.92 1.28 0.83 138 NML_ADSP_CUSTOM_MED 4395 0.79 0.66 0.82 139 RCVD_IN_MSPIKE_BL 4268 0.90 1.30 0.80 140 TooManyTo_004 4212 0.73 0.48 0.79 141 XMBody_17 4188 1.16 2.66 0.78 142 TR_XM_RelayPhish 4159 1.43 4.04 0.78 143 XMNoVowels 4093 0.67 0.28 0.76 144 THIS_AD 4089 0.81 0.98 0.76 145 HTML_FONT_FACE_BAD 4083 0.79 0.90 0.76 146 SpammyFromTLD_01 4061 0.89 1.43 0.76 147 DKIM_ADSP_NXDOMAIN 4060 1.09 2.38 0.76 148 FORGED_GMAIL_RCVD 3997 0.74 0.71 0.75 149 XMBody_95 3855 0.61 0.17 0.72 150 XM_B_REG_HTML 3829 0.64 0.32 0.72 151 XMBody_78 3659 0.67 0.63 0.68 152 URI_NOVOWEL 3583 0.60 0.34 0.67 153 PLING_QUERY 3546 0.67 0.70 0.66 154 TooManyTo_005 3499 0.60 0.39 0.65 155 XM_SPF_Unknown 3452 0.67 0.78 0.65 156 XMPhish30 3287 0.72 1.12 0.61 157 T_FILL_THIS_FORM_SHORT 3281 0.63 0.69 0.61 158 TR_XM_PHPDW 3202 0.86 1.91 0.60 159 US_DOLLARS_3 3157 0.85 1.86 0.59 160 TR_XM_FormFill2 3130 0.84 1.85 0.58 161 TR_XM_PHPForged 3127 0.84 1.85 0.58 162 XM_H_PHPOS 3094 0.83 1.84 0.58 163 XMLngstWrd_00 3080 0.54 0.38 0.58 164 XMSexyCombo_01 3000 0.97 2.61 0.56 165 HTTPS_HTTP_MISMATCH 2984 0.55 0.52 0.56 166 XMMoneyMeta_00 2956 0.76 1.60 0.55 167 XMSubMetaSxObfu_03 2896 0.84 2.05 0.54 168 XMLngstWrd_01 2886 0.50 0.34 0.54 169 RELAYCOUNTRY_DE 2860 0.60 0.87 0.53 170 RELAYCOUNTRY_NL 2849 0.50 0.36 0.53 171 T_OBFU_PDF_ATTACH 2789 0.46 0.19 0.52 172 XMHTMLBadTable_001 2730 0.58 0.84 0.51 173 RELAYCOUNTRY_AU 2720 0.49 0.44 0.51 174 XM_Body_Obfu01 2694 0.50 0.47 0.50 175 XMBody_29 2632 0.48 0.43 0.49 176 T_Symld_Words_02 2615 0.64 1.26 0.49 177 FROM_GOV_DKIM_AU 2609 0.42 0.17 0.49 178 USER_IN_WHITELIST 2608 0.39 0.00 0.49 179 XM_ShortIntro_01 2604 0.45 0.29 0.49 180 T_TooManySym_03 2562 0.42 0.18 0.48 181 RCVD_IN_MSPIKE_L3 2558 0.48 0.47 0.48 182 FILL_THIS_FORM 2439 0.88 2.56 0.46 183 TR_MetaPhish_Combo_01b 2423 0.38 0.07 0.45 184 TR_LOTS_OF_MONEY3 2423 0.59 1.12 0.45 185 TM2_M_BODY_EMPTY 2413 0.39 0.15 0.45 186 XM_H_PHPMailer 2409 0.58 1.12 0.45 187 REMOVE_BEFORE_LINK 2400 0.47 0.58 0.45 188 RCVD_IN_MSPIKE_H4 2390 0.49 0.68 0.45 189 T_MONEY_PERCENT 2387 0.62 1.33 0.45 190 TR_LOTS_OF_MONEY2 2387 0.62 1.33 0.45 191 RDNS_DYNAMIC 2376 1.13 3.88 0.44 192 TM2_M_A_HREF_HREF 2365 0.59 1.16 0.44 193 XMSubMetaSxObfu_02 2354 0.40 0.26 0.44 194 DIET_1 2332 0.59 1.21 0.44 195 XM_B_COPY_HTML 2320 0.49 0.73 0.43 196 XMSolicitRefs_0 2273 0.41 0.36 0.42 197 RELAYCOUNTRY_FR 2267 1.35 5.03 0.42 198 XMPhish14 2224 0.49 0.81 0.42 199 FROM_GOV_SPOOF 2223 0.39 0.27 0.42 200 XM_shorewaves_Whitelist 2212 0.33 0.00 0.41 ----------------------------------------------------------------------