Email: 486970 Autolearn: 0 AvgScore: 2.75 AvgScanTime: 2.43 sec Spam: 108243 Autolearn: 0 AvgScore: 12.71 AvgScanTime: 3.03 sec Ham: 378727 Autolearn: 0 AvgScore: -0.10 AvgScanTime: 2.25 sec Time Spent Running SA: 328.21 hours Time Spent Processing Spam: 91.04 hours Time Spent Processing Ham: 237.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102182 91.66 94.40 90.87 2 DCC_CHECK 90055 64.27 83.20 58.86 3 DKIM_SIGNED 84353 85.85 77.93 88.11 4 XM_DK_Pass 82060 84.61 75.81 87.13 5 XM_B_Unicode 77240 77.71 71.36 79.53 6 DKIM_VALID 76711 80.89 70.87 83.75 7 XMListUnsubscribeExists 72138 69.87 66.64 70.79 8 DKIM_VALID_AU 62178 63.67 57.44 65.45 9 XM_B_Unicode3 53405 52.65 49.34 53.59 10 BAYES_50 50623 53.48 46.77 55.40 11 XM_DK_Undo_02 39965 14.40 36.92 7.97 12 LOC_TINY_FONT_1 39242 34.84 36.25 34.43 13 HTML_FONT_LOW_CONTRAST 38129 35.46 35.23 35.53 14 MIME_HTML_ONLY 38054 25.08 35.16 22.20 15 FVGT_m_MULTI_ODD 29585 26.62 27.33 26.42 16 XMSubLong 28453 21.78 26.29 20.49 17 BAYES_99 27801 8.77 25.68 3.94 18 RELAYCOUNTRY_META 24544 9.42 22.67 5.63 19 BOTNET 24266 6.91 22.42 2.47 20 DKIM_VALID_EF 23666 25.39 21.86 26.40 21 TR_DCC_Bayes_99 22698 6.31 20.97 2.12 22 BAYES_999 22158 7.01 20.47 3.16 23 XM_Multi_Part_URI 21912 17.24 20.24 16.38 24 XM_Body_Dirty_Words 21820 17.41 20.16 16.63 25 FSL_BULK_SIG 21461 9.68 19.83 6.78 26 MultiRelay 20775 16.01 19.19 15.10 27 HTML_IMAGE_RATIO_02 19892 15.76 18.38 15.01 28 T_KAM_HTML_FONT_INVALID 19850 20.11 18.34 20.61 29 BOTNET_IPINHOSTNAME 17988 8.27 16.62 5.88 30 XM_UncommonTLD01 16922 6.46 15.63 3.84 31 DCC_CHECK_NEGATIVE 16291 34.33 15.05 39.84 32 UNTRUSTED_Relay 15176 5.06 14.02 2.50 33 T_TM2_M_HEADER_IN_MSG 15101 18.51 13.95 19.81 34 XM_Evil_Numbers_Gen 14306 13.08 13.22 13.04 35 XM_B_Unsub 12248 10.14 11.32 9.81 36 LOTS_OF_MONEY 10337 7.44 9.55 6.84 37 XMSexyCombo_05 9946 5.71 9.19 4.71 38 SpammyFromTLD_02 9833 2.41 9.08 0.51 39 HTML_MIME_NO_HTML_TAG 9752 2.95 9.01 1.22 40 XM_UB50 9704 3.02 8.97 1.32 41 HTML_SHORT_LINK_IMG_1 9524 2.00 8.80 0.05 42 TooManyTo_001 9163 6.49 8.47 5.92 43 HTML_IMAGE_RATIO_04 8938 8.86 8.26 9.03 44 XM_H_Long_From01 8725 7.92 8.06 7.88 45 XM_B_SpammyTLD 8361 3.57 7.72 2.38 46 MPART_ALT_DIFF 8360 4.74 7.72 3.89 47 XM_B_Phish_Phrases 8123 7.73 7.50 7.80 48 T_XMDrugObfuBody_14 7791 7.48 7.20 7.55 49 MIME_HTML_MOSTLY 7791 4.39 7.20 3.58 50 DKIM_INVALID 7642 4.96 7.06 4.36 51 XM_SendGrid 7413 8.42 6.85 8.86 52 XMSubMetaSx_00 7339 4.51 6.78 3.86 53 LotsOfNums_01 7319 9.73 6.76 10.58 54 T_REMOTE_IMAGE 7298 3.63 6.74 2.74 55 XM_DIRTYINTL 7023 3.71 6.49 2.91 56 FROM_MISSP_REPLYTO 6807 1.40 6.29 0.00 57 BAYES_80 6696 3.99 6.19 3.36 58 T_HTML_TAG_BALANCE_CENTER 6510 1.48 6.01 0.18 59 BOTNET_NORDNS 6282 1.31 5.80 0.03 60 HTML_IMAGE_ONLY_08 6112 1.35 5.65 0.12 61 BODY_URI_ONLY 6107 1.29 5.64 0.05 62 KHOP_HELO_FCRDNS 6107 2.05 5.64 1.02 63 MIME_QP_LONG_LINE 6071 6.74 5.61 7.06 64 XM_BadFromFormat 6046 1.34 5.59 0.13 65 BAYES_60 5963 6.24 5.51 6.44 66 XMNumbers 5840 3.60 5.40 3.09 67 FROM_EXCESS_BASE64 5747 5.24 5.31 5.22 68 FROM_SUSPICIOUS_NTLD 5593 1.24 5.17 0.11 69 RCVD_IN_MSPIKE_H2 5379 6.37 4.97 6.77 70 FROM_SUSPICIOUS_NTLD_FP 5298 1.18 4.89 0.11 71 XM_SPF_SoftFail 5225 1.94 4.83 1.12 72 HDRS_LCASE_IMGONLY 5193 1.09 4.80 0.03 73 REPLYTO_WITHOUT_TO_CC 5022 1.05 4.64 0.02 74 BAYES_40 4827 4.44 4.46 4.44 75 RELAYCOUNTRY_GB 4665 1.53 4.31 0.73 76 URI_HEX 4482 3.00 4.14 2.68 77 TR_XM_DK_SendGrid 4438 4.46 4.10 4.56 78 HDRS_MISSP 4395 0.92 4.06 0.03 79 SUBJ_ALL_CAPS 4326 3.15 4.00 2.91 80 RCVD_IN_BL_SPAMCOP_NET 4257 2.43 3.93 2.00 81 TM2_M_VERY_LONG_WORD 4196 1.92 3.88 1.36 82 HTML_IMAGE_RATIO_06 3966 3.75 3.66 3.78 83 MIME_HEADER_CTYPE_ONLY 3916 0.87 3.62 0.08 84 BAYES_95 3715 2.10 3.43 1.72 85 MIME_HTML_ONLY_MULTI 3701 1.98 3.42 1.57 86 HTML_IMAGE_ONLY_12 3650 0.85 3.37 0.13 87 RDNS_DYNAMIC 3590 1.10 3.32 0.47 88 RCVD_IN_RP_RNBL 3516 0.77 3.25 0.06 89 BAYES_20 3447 3.34 3.18 3.38 90 TO_EQ_FM_DOM_HTML_IMG 3437 0.71 3.18 0.00 91 NO_DNS_FOR_FROM 3420 1.52 3.16 1.06 92 TM2_M_URI_OPT_OUT 3414 2.07 3.15 1.75 93 TR_XM_RelayPhish 3378 1.84 3.12 1.47 94 TR_Mismatch_TLD_02 3268 0.84 3.02 0.22 95 XM_URI_RBL 3058 0.89 2.83 0.33 96 XMSubMetaSxObfu_03 3037 1.74 2.81 1.43 97 RELAYCOUNTRY_FR 2851 0.94 2.63 0.46 98 XMSubMetaI_00 2764 1.29 2.55 0.93 99 XM_OfRef6 2713 1.27 2.51 0.91 100 BAYES_00 2661 15.11 2.46 18.73 101 RELAYCOUNTRY_CA 2648 1.77 2.45 1.58 102 MultiRelay_CC 2628 0.75 2.43 0.27 103 MultiRelay_Combo 2628 0.75 2.43 0.27 104 T_TooManySym_01 2556 3.59 2.36 3.94 105 XM_CamelCaseFrm001 2472 2.20 2.28 2.18 106 RCVD_IN_IADB_LISTED 2399 4.98 2.22 5.76 107 LongTLD 2390 0.67 2.21 0.23 108 XMStrtUSub 2374 3.29 2.19 3.60 109 DATE_IN_PAST_12_24 2369 0.52 2.19 0.04 110 XMBody_17 2368 1.15 2.19 0.85 111 TR_XM_PHPDW 2352 0.85 2.17 0.48 112 XMBdyGiftCard01 2336 3.00 2.16 3.25 113 TR_XM_PHPForged 2334 0.84 2.16 0.46 114 TR_XM_FormFill2 2320 0.83 2.14 0.46 115 XM_H_PHPOS 2317 0.83 2.14 0.46 116 RCVD_IN_IADB_SPF 2311 4.50 2.14 5.17 117 RCVD_IN_IADB_SENDERID 2286 4.14 2.11 4.72 118 RCVD_IN_IADB_DK 2283 4.07 2.11 4.63 119 SUBJECT_NEEDS_ENCODING 2269 0.52 2.10 0.07 120 SUBJ_ILLEGAL_CHARS 2227 0.51 2.06 0.07 121 XM_H_TOP 2217 0.46 2.05 0.01 122 XMDiploma_00 2123 1.19 1.96 0.97 123 BAYES_05 2094 2.13 1.93 2.19 124 DKIM_ADSP_NXDOMAIN 2080 0.72 1.92 0.38 125 TO_NO_BRKTS_DYNIP 2071 0.43 1.91 0.00 126 XM_B_Unsub2 2046 1.28 1.89 1.10 127 HTML_IMAGE_RATIO_08 2043 2.47 1.89 2.63 128 RCVD_IN_PSBL 2025 0.43 1.87 0.02 129 RELAYCOUNTRY_AT 2022 0.66 1.87 0.31 130 XMSexyCombo_01 1988 1.20 1.84 1.02 131 TR_XM_INV_DKIM 1964 0.46 1.81 0.07 132 FROM_MISSP_DYNIP 1963 0.40 1.81 0.00 133 T_FILL_THIS_FORM_SHORT 1920 0.66 1.77 0.34 134 RELAYCOUNTRY_IN 1915 0.51 1.77 0.15 135 XMStockSpam_06 1889 1.51 1.75 1.44 136 PLING_QUERY 1808 1.44 1.67 1.38 137 MISSING_HEADERS 1759 0.64 1.63 0.36 138 XM_Combo_Sbj 1721 0.62 1.59 0.35 139 RCVD_IN_MSPIKE_WL 1713 3.94 1.58 4.61 140 XMPhish11 1712 0.91 1.58 0.72 141 TO_NO_BRKTS_FROM_MSSP 1668 0.35 1.54 0.01 142 XM_ProductURIs 1639 2.17 1.51 2.36 143 TR_LOTS_OF_MONEY2 1593 1.21 1.47 1.14 144 T_MONEY_PERCENT 1593 1.21 1.47 1.14 145 T_XMDrugObfuBody_00 1588 1.08 1.47 0.97 146 XMGenDplmaNmb 1567 0.78 1.45 0.59 147 FORM_FRAUD_5 1548 0.32 1.43 0.00 148 MONEY_FORM_SHORT 1529 0.32 1.41 0.01 149 TR_LOTS_OF_MONEY1 1521 0.32 1.41 0.01 150 URI_TRY_3LD 1518 1.54 1.40 1.57 151 XM_H_PHPMailer 1505 0.74 1.39 0.56 152 SpammyFromTLD_01 1491 0.74 1.38 0.56 153 RCVD_IN_RP_SAFE 1476 13.08 1.36 16.43 154 XMHTMLBadTable_001 1470 0.69 1.36 0.50 155 XM_DK_Undo_01 1467 1.39 1.36 1.39 156 RCVD_IN_MSPIKE_H3 1451 3.44 1.34 4.03 157 XMBrknScrpt_02 1451 1.00 1.34 0.91 158 HTML_EXTRA_CLOSE 1403 0.31 1.30 0.03 159 T_XMHurry_00 1382 1.54 1.28 1.61 160 T_XMDrugObfuBody_08 1371 1.01 1.27 0.94 161 RELAYCOUNTRY_DE 1343 0.73 1.24 0.58 162 FSL_THIS_IS_ADV 1339 0.61 1.24 0.44 163 TVD_PH_BODY_ACCOUNTS_PRE 1307 0.37 1.21 0.13 164 DATE_IN_PAST_03_06 1283 0.38 1.19 0.14 165 XMMoneyMeta_00 1266 0.38 1.17 0.15 166 US_DOLLARS_3 1252 0.49 1.16 0.31 167 XM_H_PHPOS_M 1249 0.45 1.15 0.25 168 TR_XM_DK_Bayes 1248 14.05 1.15 17.74 169 XM_H_Long_From02 1240 1.29 1.15 1.33 170 ALL_TRUSTED 1236 6.47 1.14 7.99 171 XMBody_78 1231 0.78 1.14 0.68 172 XMPhish30 1222 0.77 1.13 0.67 173 RCVD_IN_MSPIKE_BL 1170 0.73 1.08 0.63 174 UNPARSEABLE_RELAY 1167 2.34 1.08 2.70 175 LOW_PRICE 1149 0.80 1.06 0.72 176 XM_H_Undi_Recip 1133 0.36 1.05 0.16 177 TR_M_TOP_BAYES 1124 0.23 1.04 0.00 178 XM_Body_Obfu01 1117 0.58 1.03 0.45 179 XM_UB60 1114 0.30 1.03 0.10 180 MAILING_LIST_MULTI 1102 1.89 1.02 2.15 181 SUBJ_YOUR_FAMILY 1095 0.29 1.01 0.09 182 HK_SCAM 1093 0.24 1.01 0.02 183 TR_XM_DK_Bayes1 1069 13.54 0.99 17.13 184 TR_Symld_Words 1069 0.89 0.99 0.86 185 RELAYCOUNTRY_PL 1060 0.27 0.98 0.07 186 DKIM_ADSP_CUSTOM_MED 1048 1.06 0.97 1.09 187 XM_OfRef7 1043 0.27 0.96 0.07 188 URIBL_CSS_A 1036 1.43 0.96 1.56 189 URIBL_CSS 1036 1.43 0.96 1.56 190 XM_B_COPY_HTML 1035 0.54 0.96 0.42 191 TR_Sbj_FN_Bdy 992 0.36 0.92 0.20 192 XMSubMetaSSx_00 986 0.37 0.91 0.22 193 RCVD_IN_RP_CERTIFIED 970 11.93 0.90 15.09 194 TR_Caps_n_Bayes_99 966 0.27 0.89 0.10 195 XMSubNoVowel 961 0.36 0.89 0.21 196 LONG_HEX_URI 954 0.38 0.88 0.23 197 RCVD_IN_MSPIKE_L5 920 0.32 0.85 0.17 198 RELAYCOUNTRY_IE 919 0.30 0.85 0.14 199 MONEY_FROM_MISSP 918 0.19 0.85 0.00 200 THIS_AD 911 0.84 0.84 0.84 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 344163 91.66 94.40 90.87 2 DKIM_SIGNED 333694 85.85 77.93 88.11 3 XM_DK_Pass 329967 84.61 75.81 87.13 4 DKIM_VALID 317196 80.89 70.87 83.75 5 XM_B_Unicode 301202 77.71 71.36 79.53 6 XMListUnsubscribeExists 268091 69.87 66.64 70.79 7 DKIM_VALID_AU 247867 63.67 57.44 65.45 8 DCC_CHECK 222931 64.27 83.20 58.86 9 BAYES_50 209798 53.48 46.77 55.40 10 XM_B_Unicode3 202969 52.65 49.34 53.59 11 DCC_CHECK_NEGATIVE 150890 34.33 15.05 39.84 12 HTML_FONT_LOW_CONTRAST 134565 35.46 35.23 35.53 13 LOC_TINY_FONT_1 130413 34.84 36.25 34.43 14 FVGT_m_MULTI_ODD 100052 26.62 27.33 26.42 15 DKIM_VALID_EF 100000 25.39 21.86 26.40 16 MIME_HTML_ONLY 84064 25.08 35.16 22.20 17 T_KAM_HTML_FONT_INVALID 78064 20.11 18.34 20.61 18 XMSubLong 77614 21.78 26.29 20.49 19 T_TM2_M_HEADER_IN_MSG 75029 18.51 13.95 19.81 20 BAYES_00 70944 15.11 2.46 18.73 21 TR_XM_DK_Bayes 67192 14.05 1.15 17.74 22 TR_XM_DK_Bayes1 64868 13.54 0.99 17.13 23 XM_Body_Dirty_Words 62964 17.41 20.16 16.63 24 RCVD_IN_RP_SAFE 62209 13.08 1.36 16.43 25 XM_Multi_Part_URI 62021 17.24 20.24 16.38 26 TR_XM_DK_Bayes2 59292 12.35 0.78 15.66 27 MultiRelay 57192 16.01 19.19 15.10 28 RCVD_IN_RP_CERTIFIED 57133 11.93 0.90 15.09 29 HTML_IMAGE_RATIO_02 56837 15.76 18.38 15.01 30 XM_Evil_Numbers_Gen 49402 13.08 13.22 13.04 31 LotsOfNums_01 40086 9.73 6.76 10.58 32 XM_B_Unsub 37148 10.14 11.32 9.81 33 XM_DKIMWhitelistDomains 35630 7.34 0.11 9.41 34 HTML_IMAGE_RATIO_04 34214 8.86 8.26 9.03 35 XM_SendGrid 33567 8.42 6.85 8.86 36 ALL_TRUSTED 30250 6.47 1.14 7.99 37 XM_DK_Undo_02 30171 14.40 36.92 7.97 38 XM_H_Long_From01 29861 7.92 8.06 7.88 39 XM_B_Phish_Phrases 29534 7.73 7.50 7.80 40 T_XMDrugObfuBody_14 28611 7.48 7.20 7.55 41 MIME_QP_LONG_LINE 26739 6.74 5.61 7.06 42 LOTS_OF_MONEY 25910 7.44 9.55 6.84 43 FSL_BULK_SIG 25662 9.68 19.83 6.78 44 RCVD_IN_MSPIKE_H2 25643 6.37 4.97 6.77 45 BAYES_60 24404 6.24 5.51 6.44 46 TooManyTo_001 22429 6.49 8.47 5.92 47 BOTNET_IPINHOSTNAME 22271 8.27 16.62 5.88 48 RCVD_IN_IADB_LISTED 21830 4.98 2.22 5.76 49 RELAYCOUNTRY_META 21316 9.42 22.67 5.63 50 FROM_EXCESS_BASE64 19753 5.24 5.31 5.22 51 RCVD_IN_IADB_SPF 19579 4.50 2.14 5.17 52 RCVD_IN_IADB_SENDERID 17877 4.14 2.11 4.72 53 XMSexyCombo_05 17842 5.71 9.19 4.71 54 RCVD_IN_IADB_DK 17524 4.07 2.11 4.63 55 RCVD_IN_MSPIKE_WL 17475 3.94 1.58 4.61 56 TR_XM_DK_SendGrid 17267 4.46 4.10 4.56 57 BAYES_40 16816 4.44 4.46 4.44 58 DKIM_INVALID 16498 4.96 7.06 4.36 59 RCVD_IN_MSPIKE_H3 15279 3.44 1.34 4.03 60 BAYES_99 14927 8.77 25.68 3.94 61 T_TooManySym_01 14908 3.59 2.36 3.94 62 MPART_ALT_DIFF 14715 4.74 7.72 3.89 63 XMSubMetaSx_00 14628 4.51 6.78 3.86 64 XM_UncommonTLD01 14548 6.46 15.63 3.84 65 HTML_IMAGE_RATIO_06 14306 3.75 3.66 3.78 66 XMStrtUSub 13643 3.29 2.19 3.60 67 MIME_HTML_MOSTLY 13565 4.39 7.20 3.58 68 BAYES_20 12813 3.34 3.18 3.38 69 BAYES_80 12712 3.99 6.19 3.36 70 XMBdyGiftCard01 12292 3.00 2.16 3.25 71 RCVD_IN_IADB_VOUCHED 12070 2.60 0.56 3.19 72 BAYES_999 11972 7.01 20.47 3.16 73 XMNumbers 11693 3.60 5.40 3.09 74 IN_ZIMBRA_NJ_WHITELIST 11640 2.39 0.01 3.07 75 XM_DIRTYINTL 11033 3.71 6.49 2.91 76 SUBJ_ALL_CAPS 11022 3.15 4.00 2.91 77 T_REMOTE_IMAGE 10364 3.63 6.74 2.74 78 UNPARSEABLE_RELAY 10243 2.34 1.08 2.70 79 URI_HEX 10146 3.00 4.14 2.68 80 HTML_IMAGE_RATIO_08 9979 2.47 1.89 2.63 81 UNTRUSTED_Relay 9471 5.06 14.02 2.50 82 BOTNET 9373 6.91 22.42 2.47 83 XM_B_SpammyTLD 9013 3.57 7.72 2.38 84 XM_ProductURIs 8934 2.17 1.51 2.36 85 BAYES_05 8298 2.13 1.93 2.19 86 XM_CamelCaseFrm001 8257 2.20 2.28 2.18 87 MAILING_LIST_MULTI 8125 1.89 1.02 2.15 88 TR_DCC_Bayes_99 8025 6.31 20.97 2.12 89 TVD_RCVD_IP 7971 1.71 0.33 2.10 90 T_TooManySym_02 7953 1.76 0.58 2.10 91 RCVD_IN_BL_SPAMCOP_NET 7568 2.43 3.93 2.00 92 INVALID_MSGID 7496 1.59 0.25 1.98 93 RCVD_IN_IADB_OPTIN 7427 1.65 0.56 1.96 94 CK_HELO_DYNAMIC_SPLIT_IP 7279 1.60 0.49 1.92 95 HELO_DYNAMIC_IPADDR2 7275 1.51 0.08 1.92 96 TM2_M_URI_OPT_OUT 6646 2.07 3.15 1.75 97 TO_MALFORMED 6554 1.35 0.02 1.73 98 BAYES_95 6531 2.10 3.43 1.72 99 T_XMHurry_00 6116 1.54 1.28 1.61 100 RELAYCOUNTRY_CA 5981 1.77 2.45 1.58 101 URI_TRY_3LD 5963 1.54 1.40 1.57 102 MIME_HTML_ONLY_MULTI 5952 1.98 3.42 1.57 103 URIBL_CSS 5916 1.43 0.96 1.56 104 URIBL_CSS_A 5916 1.43 0.96 1.56 105 XMGappySubj_01 5884 1.27 0.30 1.55 106 ANY_BOUNCE_MESSAGE 5779 1.35 0.73 1.53 107 BOUNCE_MESSAGE 5778 1.35 0.73 1.53 108 TR_XM_RelayPhish 5581 1.84 3.12 1.47 109 IN_HORDE_ADDRESS_BOOK 5501 1.14 0.02 1.45 110 XMStockSpam_06 5472 1.51 1.75 1.44 111 USER_IN_DEF_DKIM_WL 5436 1.12 0.00 1.44 112 XMSubMetaSxObfu_03 5416 1.74 2.81 1.43 113 XM_DK_Undo_01 5279 1.39 1.36 1.39 114 PLING_QUERY 5211 1.44 1.67 1.38 115 TM2_M_VERY_LONG_WORD 5164 1.92 3.88 1.36 116 XM_H_Long_From02 5037 1.29 1.15 1.33 117 XM_UB50 4989 3.02 8.97 1.32 118 HTML_MIME_NO_HTML_TAG 4616 2.95 9.01 1.22 119 T_MONEY_PERCENT 4321 1.21 1.47 1.14 120 TR_LOTS_OF_MONEY2 4321 1.21 1.47 1.14 121 TooManyTo_002 4314 1.02 0.59 1.14 122 XM_RXBody 4261 0.94 0.31 1.13 123 XM_SPF_SoftFail 4233 1.94 4.83 1.12 124 XM_B_Unsub2 4178 1.28 1.89 1.10 125 XM_GoogleGroups 4132 0.93 0.37 1.09 126 DKIM_ADSP_CUSTOM_MED 4116 1.06 0.97 1.09 127 NO_DNS_FOR_FROM 4005 1.52 3.16 1.06 128 KHOP_HELO_FCRDNS 3864 2.05 5.64 1.02 129 XMSexyCombo_01 3861 1.20 1.84 1.02 130 XMOemUri 3830 0.83 0.19 1.01 131 T_XMDrugObfuBody_00 3668 1.08 1.47 0.97 132 XMDiploma_00 3664 1.19 1.96 0.97 133 T_XMDrugObfuBody_08 3551 1.01 1.27 0.94 134 XMSubMetaI_00 3509 1.29 2.55 0.93 135 XM_OfRef6 3455 1.27 2.51 0.91 136 XMBrknScrpt_02 3437 1.00 1.34 0.91 137 XM_PDF 3361 0.74 0.22 0.89 138 HTML_TAG_BALANCE_BODY 3307 0.86 0.81 0.87 139 TR_Symld_Words 3262 0.89 0.99 0.86 140 XMBody_17 3209 1.15 2.19 0.85 141 XMHTML_After_End 3179 0.78 0.59 0.84 142 THIS_AD 3164 0.84 0.84 0.84 143 NML_ADSP_CUSTOM_MED 3105 0.81 0.79 0.82 144 T_Symld_Words_02 2986 0.71 0.44 0.79 145 TooManyTo_003 2926 0.71 0.48 0.77 146 RELAYCOUNTRY_GB 2774 1.53 4.31 0.73 147 XMPhish11 2737 0.91 1.58 0.72 148 LOW_PRICE 2732 0.80 1.06 0.72 149 XMBody_78 2580 0.78 1.14 0.68 150 FORGED_GMAIL_RCVD 2575 0.71 0.80 0.68 151 URI_NOVOWEL 2572 0.61 0.35 0.68 152 SUBJ_DOLLARS 2546 0.65 0.57 0.67 153 XMPhish30 2542 0.77 1.13 0.67 154 XMBSHREFv2 2504 0.64 0.56 0.66 155 TR_MetaPhish_Combo_01 2495 0.63 0.53 0.66 156 RCVD_IN_MSPIKE_BL 2380 0.73 1.08 0.63 157 HTML_FONT_FACE_BAD 2278 0.64 0.77 0.60 158 TooManyTo_004 2272 0.56 0.41 0.60 159 XMGenDplmaNmb 2248 0.78 1.45 0.59 160 RELAYCOUNTRY_DE 2189 0.73 1.24 0.58 161 XMLngstWrd_00 2135 0.50 0.29 0.56 162 SpammyFromTLD_01 2121 0.74 1.38 0.56 163 XMGappySubj_02 2119 0.45 0.09 0.56 164 XM_H_PHPMailer 2105 0.74 1.39 0.56 165 XMGppyBdWords 2068 0.54 0.51 0.55 166 XMLngstWrd_01 2019 0.48 0.28 0.53 167 DIET_1 1970 0.56 0.68 0.52 168 USER_IN_WHITELIST 1969 0.40 0.00 0.52 169 REMOVE_BEFORE_LINK 1956 0.50 0.43 0.52 170 NUMERIC_HTTP_ADDR 1947 0.46 0.28 0.51 171 XM_B_REG_HTML 1918 0.50 0.50 0.51 172 SpammyFromTLD_02 1914 2.41 9.08 0.51 173 XMHTMLBadTable_001 1901 0.69 1.36 0.50 174 XM_Sams_Club_Forge 1896 0.46 0.30 0.50 175 RCVD_IN_MSPIKE_H4 1878 0.43 0.21 0.50 176 XMAntiAgingB 1851 0.40 0.10 0.49 177 TR_XM_PHPDW 1801 0.85 2.17 0.48 178 RDNS_DYNAMIC 1771 1.10 3.32 0.47 179 TR_XM_PHPForged 1761 0.84 2.16 0.46 180 TR_XM_FormFill2 1745 0.83 2.14 0.46 181 TooManyTo_005 1741 0.44 0.35 0.46 182 RELAYCOUNTRY_FR 1733 0.94 2.63 0.46 183 XM_H_PHPOS 1733 0.83 2.14 0.46 184 XM_Body_Obfu01 1719 0.58 1.03 0.45 185 BODY_ENHANCEMENT 1719 0.36 0.02 0.45 186 XM_Ancestry_Forge 1717 0.36 0.01 0.45 187 XMSubMetaSxObfu_02 1672 0.40 0.27 0.44 188 T_TooManySym_03 1668 0.37 0.10 0.44 189 FSL_THIS_IS_ADV 1655 0.61 1.24 0.44 190 PP_MIME_FAKE_ASCII_TEXT 1636 0.41 0.34 0.43 191 RELAYCOUNTRY_AU 1613 0.41 0.36 0.43 192 XM_B_COPY_HTML 1582 0.54 0.96 0.42 193 XMBody_29 1580 0.43 0.47 0.42 194 XMSolicitRefs_0 1554 0.36 0.17 0.41 195 XMBody_95 1533 0.38 0.30 0.40 196 TR_Mismatch_TLD_01 1466 0.44 0.61 0.39 197 XMLngstWrd_02 1447 0.34 0.19 0.38 198 DKIM_ADSP_NXDOMAIN 1442 0.72 1.92 0.38 199 MISSING_HEADERS 1368 0.64 1.63 0.36 200 MPART_ALT_DIFF_COUNT 1361 0.38 0.44 0.36 ----------------------------------------------------------------------