Email: 432650 Autolearn: 0 AvgScore: 1.95 AvgScanTime: 2.08 sec Spam: 87212 Autolearn: 0 AvgScore: 14.60 AvgScanTime: 2.59 sec Ham: 345438 Autolearn: 0 AvgScore: -1.24 AvgScanTime: 1.95 sec Time Spent Running SA: 250.26 hours Time Spent Processing Spam: 62.76 hours Time Spent Processing Ham: 187.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 83253 90.57 95.46 89.33 2 DCC_CHECK 71551 55.12 82.04 48.32 3 XM_B_Unicode 58638 70.30 67.24 71.07 4 DKIM_SIGNED 56925 75.48 65.27 78.06 5 XM_DK_Pass 54668 74.17 62.68 77.07 6 DKIM_VALID 50983 70.81 58.46 73.93 7 XMListUnsubscribeExists 50210 57.93 57.57 58.02 8 MIME_HTML_ONLY 37549 28.43 43.05 24.73 9 DKIM_VALID_AU 37488 55.42 42.98 58.56 10 BAYES_50 35573 51.28 40.79 53.93 11 XM_B_Unicode3 35094 43.80 40.24 44.70 12 XM_DK_Undo_02 30146 12.83 34.57 7.34 13 BOTNET 25318 7.45 29.03 2.00 14 HTML_FONT_LOW_CONTRAST 24771 30.23 28.40 30.69 15 LOC_TINY_FONT_1 24672 27.51 28.29 27.31 16 BAYES_99 23467 8.71 26.91 4.12 17 RELAYCOUNTRY_META 22660 9.19 25.98 4.95 18 FVGT_m_MULTI_ODD 20179 22.25 23.14 22.03 19 XM_UncommonTLD01 20070 8.26 23.01 4.54 20 TR_DCC_Bayes_99 19428 5.74 22.28 1.57 21 FSL_BULK_SIG 19047 10.19 21.84 7.25 22 BAYES_999 18149 6.85 20.81 3.32 23 XMSubLong 18116 20.48 20.77 20.41 24 XM_B_Unsub 18021 14.67 20.66 13.16 25 XM_Body_Dirty_Words 17774 16.43 20.38 15.44 26 T_KAM_HTML_FONT_INVALID 17218 18.67 19.74 18.40 27 BOTNET_IPINHOSTNAME 16801 8.49 19.26 5.77 28 UNTRUSTED_Relay 16540 5.18 18.97 1.71 29 DKIM_VALID_EF 16508 25.49 18.93 27.15 30 HTML_IMAGE_RATIO_02 16126 11.89 18.49 10.23 31 XM_Multi_Part_URI 15584 13.99 17.87 13.02 32 MultiRelay 14890 16.20 17.07 15.98 33 DCC_CHECK_NEGATIVE 14084 43.26 16.15 50.11 34 HTML_MIME_NO_HTML_TAG 14012 6.17 16.07 3.67 35 T_TM2_M_HEADER_IN_MSG 12468 19.34 14.30 20.61 36 RCVD_IN_MSPIKE_H2 10565 14.58 12.11 15.20 37 XM_H_Long_From01 9403 7.35 10.78 6.49 38 XM_Evil_Numbers_Gen 9297 10.70 10.66 10.71 39 DKIM_ADSP_NXDOMAIN 9284 3.32 10.65 1.48 40 SpammyFromTLD_02 9237 2.44 10.59 0.38 41 HTML_SHORT_LINK_IMG_1 9236 2.15 10.59 0.02 42 FROM_SUSPICIOUS_NTLD 8958 2.14 10.27 0.09 43 FROM_SUSPICIOUS_NTLD_FP 8914 2.13 10.22 0.09 44 XMSexyCombo_05 8869 5.99 10.17 4.93 45 LOTS_OF_MONEY 8363 7.41 9.59 6.86 46 KHOP_HELO_FCRDNS 8345 3.08 9.57 1.44 47 T_REMOTE_IMAGE 8316 5.19 9.54 4.09 48 TooManyTo_001 8265 7.37 9.48 6.84 49 XM_UB50 8006 2.65 9.18 1.00 50 HTML_IMAGE_ONLY_08 7955 1.93 9.12 0.11 51 SHORT_IMG_SUSP_NTLD 6973 1.61 8.00 0.00 52 T_XMDrugObfuBody_14 6497 7.35 7.45 7.33 53 MPART_ALT_DIFF 6458 5.00 7.40 4.39 54 BAYES_60 6424 6.16 7.37 5.86 55 HTML_IMAGE_RATIO_04 6371 7.42 7.31 7.44 56 BAYES_80 6359 3.92 7.29 3.07 57 XMSubMetaSx_00 6060 4.30 6.95 3.63 58 DKIM_INVALID 5942 4.67 6.81 4.13 59 XM_SPF_SoftFail 5882 2.37 6.74 1.26 60 LotsOfNums_01 5814 8.03 6.67 8.37 61 TR_Mismatch_TLD_02 5605 1.35 6.43 0.07 62 BODY_URI_ONLY 5569 1.33 6.39 0.06 63 RDNS_DYNAMIC 5531 1.62 6.34 0.43 64 T_HTML_TAG_BALANCE_CENTER 5130 1.25 5.88 0.08 65 RCVD_IN_BL_SPAMCOP_NET 4982 2.22 5.71 1.34 66 XM_DIRTYINTL 4794 3.69 5.50 3.24 67 MIME_HEADER_CTYPE_ONLY 4790 1.17 5.49 0.08 68 MIME_HTML_MOSTLY 4700 3.59 5.39 3.14 69 FROM_MISSP_REPLYTO 4663 1.08 5.35 0.00 70 XM_B_Unsub2 4637 3.06 5.32 2.50 71 ALL_TRUSTED 4611 12.66 5.29 14.52 72 RCVD_IN_MSPIKE_WL 4523 9.95 5.19 11.15 73 MIME_QP_LONG_LINE 4338 5.27 4.97 5.35 74 BAYES_40 4144 4.91 4.75 4.95 75 HDRS_LCASE_IMGONLY 4138 0.98 4.74 0.03 76 T_TooManySym_01 3943 5.42 4.52 5.64 77 RCVD_IN_MSPIKE_H3 3925 9.64 4.50 10.94 78 TO_MALFORMED 3867 2.41 4.43 1.90 79 MIME_HTML_ONLY_MULTI 3778 3.12 4.33 2.81 80 XM_B_Phish_Phrases 3701 6.36 4.24 6.89 81 XMNumbers 3670 3.24 4.21 2.99 82 RCVD_IN_RP_RNBL 3602 0.90 4.13 0.09 83 XM_B_SpammyTLD 3514 3.02 4.03 2.77 84 BAYES_95 3427 2.27 3.93 1.85 85 TooManyTo_002 3397 1.87 3.90 1.36 86 FROM_EXCESS_BASE64 3371 4.21 3.87 4.29 87 LongTLD 3348 0.93 3.84 0.20 88 RELAYCOUNTRY_CA 3344 2.03 3.83 1.58 89 XM_SendGrid 3339 6.31 3.83 6.94 90 XMStrtUSub 3281 4.66 3.76 4.89 91 HDRS_MISSP 3244 0.76 3.72 0.01 92 DATE_IN_PAST_03_06 3156 0.90 3.62 0.21 93 BAYES_20 3131 4.05 3.59 4.16 94 RELAYCOUNTRY_DE 3107 0.97 3.56 0.32 95 XM_BadFromFormat 3086 0.82 3.54 0.13 96 HTML_IMAGE_RATIO_06 2992 4.25 3.43 4.45 97 TM2_M_URI_OPT_OUT 2979 2.06 3.42 1.71 98 TooManyTo_003 2871 1.39 3.29 0.91 99 URI_HEX 2859 1.62 3.28 1.21 100 XM_URI_RBL 2851 0.97 3.27 0.39 101 RCVD_IN_PSBL 2762 0.69 3.17 0.07 102 BAYES_00 2748 16.03 3.15 19.28 103 RELAYCOUNTRY_FR 2728 1.02 3.13 0.48 104 BOTNET_NORDNS 2714 0.65 3.11 0.02 105 RCVD_IN_SORBS_DUL 2679 0.74 3.07 0.15 106 XM_OfRef6 2595 1.48 2.98 1.10 107 MultiRelay_CC 2488 0.79 2.85 0.27 108 MultiRelay_Combo 2488 0.79 2.85 0.27 109 XMSubMetaI_00 2410 1.15 2.76 0.74 110 TO_NO_BRKTS_DYNIP 2271 0.53 2.60 0.00 111 RELAYCOUNTRY_GB 2204 1.05 2.53 0.68 112 TooManyTo_004 2184 1.05 2.50 0.68 113 XM_CamelCaseFrm001 2178 2.54 2.50 2.56 114 NO_DNS_FOR_FROM 2171 2.26 2.49 2.20 115 REPLYTO_WITHOUT_TO_CC 2122 0.52 2.43 0.04 116 RELAYCOUNTRY_GR 2118 0.49 2.43 0.00 117 URIBL_DBL_SPAM 2015 0.49 2.31 0.03 118 DIET_1 1897 0.84 2.18 0.50 119 HTML_IMAGE_RATIO_08 1890 2.47 2.17 2.55 120 RCVD_IN_MSPIKE_BL 1880 0.95 2.16 0.65 121 FROM_MISSP_DYNIP 1787 0.41 2.05 0.00 122 XM_SPF_Unknown 1783 0.80 2.04 0.48 123 TO_EQ_FM_DOM_HTML_IMG 1754 0.41 2.01 0.00 124 HK_RANDOM_FROM 1736 0.49 1.99 0.11 125 BAYES_05 1731 2.36 1.98 2.46 126 XM_UB99 1723 0.41 1.98 0.01 127 RCVD_IN_IADB_LISTED 1703 4.14 1.95 4.69 128 URI_TRY_3LD 1686 1.39 1.93 1.26 129 TR_XM_INV_DKIM 1656 0.47 1.90 0.11 130 XMSexyCombo_01 1642 0.77 1.88 0.49 131 T_XMDrugObfuBody_08 1635 1.25 1.87 1.09 132 XMHTML_After_End 1601 1.34 1.84 1.22 133 TR_XM_PHPDW 1598 1.41 1.83 1.30 134 TR_XM_DK_Bayes 1597 12.63 1.83 15.36 135 RCVD_IN_IADB_SPF 1590 3.67 1.82 4.14 136 RCVD_IN_RP_SAFE 1573 11.10 1.80 13.44 137 RCVD_IN_IADB_SENDERID 1572 3.34 1.80 3.73 138 RCVD_IN_IADB_DK 1562 3.27 1.79 3.65 139 TM2_M_VERY_LONG_WORD 1535 1.73 1.76 1.72 140 TR_XM_PHPForged 1532 1.38 1.76 1.28 141 TooManyTo_005 1523 0.80 1.75 0.56 142 TR_XM_FormFill2 1516 1.37 1.74 1.28 143 XM_H_PHPOS 1511 1.37 1.73 1.27 144 XMMoneyMeta_00 1507 0.64 1.73 0.37 145 MAILING_LIST_MULTI 1500 1.67 1.72 1.66 146 SpammyFromTLD_01 1493 0.78 1.71 0.54 147 XMDiploma_00 1488 1.24 1.71 1.12 148 FILL_THIS_FORM 1473 0.64 1.69 0.38 149 TR_XM_DK_Bayes1 1465 12.11 1.68 14.74 150 TR_XM_DK_SendGrid 1434 3.52 1.64 3.99 151 HTML_IMAGE_ONLY_12 1428 0.45 1.64 0.15 152 URIBL_DBL_ABUSE_REDIR 1402 0.33 1.61 0.01 153 DOS_RCVD_IP_TWICE_B 1400 0.38 1.61 0.06 154 TR_Symld_Words 1394 1.18 1.60 1.08 155 XMBdyGiftCard01 1359 2.56 1.56 2.81 156 XM_UB60 1345 0.38 1.54 0.08 157 NORDNS_LOW_CONTRAST 1334 0.31 1.53 0.00 158 XM_UB999 1324 0.31 1.52 0.01 159 XMPhish11 1308 1.03 1.50 0.91 160 DKIM_ADSP_CUSTOM_MED 1298 0.99 1.49 0.86 161 XMStockSpam_06 1290 1.30 1.48 1.25 162 T_Symld_Words_02 1288 0.59 1.48 0.37 163 UNPARSEABLE_RELAY 1275 2.92 1.46 3.29 164 SUBJ_ALL_CAPS 1274 1.19 1.46 1.12 165 RCVD_IN_RP_CERTIFIED 1274 9.96 1.46 12.11 166 XM_OfRef7 1215 0.34 1.39 0.07 167 TR_LOTS_OF_MONEY3 1180 0.59 1.35 0.39 168 FORGED_GMAIL_RCVD 1176 0.71 1.35 0.54 169 XM_H_PHPMailer 1148 0.59 1.32 0.40 170 XMSlimDrugH 1136 0.47 1.30 0.26 171 NUMERIC_HTTP_ADDR 1134 0.54 1.30 0.34 172 TR_XM_RelayPhish 1101 1.30 1.26 1.31 173 URG_BIZ 1084 0.27 1.24 0.03 174 MPART_ALT_DIFF_COUNT 1078 0.62 1.24 0.47 175 T_XMHurry_00 1070 0.79 1.23 0.68 176 XMSubject_48 1069 0.28 1.23 0.04 177 MISSING_HEADERS 1062 0.50 1.22 0.31 178 RELAYCOUNTRY_CN 1034 0.30 1.19 0.08 179 XMGenDplmaNmb 1014 0.66 1.16 0.54 180 NML_ADSP_CUSTOM_MED 1000 0.72 1.15 0.61 181 XM_DK_Undo_01 993 1.24 1.14 1.26 182 TR_LOTS_OF_MONEY2 991 1.09 1.14 1.08 183 T_MONEY_PERCENT 991 1.09 1.14 1.08 184 MONEY_FORM 991 0.23 1.14 0.00 185 RELAYCOUNTRY_AT 988 0.35 1.13 0.15 186 FSL_THIS_IS_ADV 985 0.46 1.13 0.29 187 XM_UB80 973 0.25 1.12 0.03 188 RCVD_IN_MSPIKE_L3 941 0.28 1.08 0.08 189 ADMITS_SPAM 938 0.25 1.08 0.04 190 NORMAL_HTTP_TO_IP 898 0.24 1.03 0.04 191 ADVANCE_FEE_5_NEW_FRM_MNY 868 0.20 1.00 0.00 192 XM_H_PHPOS_M 865 0.31 0.99 0.14 193 XM_ProductURIs 849 0.96 0.97 0.95 194 TR_MetaPhish_Combo_01 847 0.96 0.97 0.96 195 XMGappySubj_01 846 1.21 0.97 1.27 196 XMPhish30 846 0.72 0.97 0.66 197 RCVD_IN_MSPIKE_L5 845 0.44 0.97 0.31 198 XM_Lotto 831 0.22 0.95 0.04 199 XMLngstWrd_00 829 0.61 0.95 0.52 200 XMBody_17 828 0.72 0.95 0.67 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 308588 90.57 95.46 89.33 2 DKIM_SIGNED 269645 75.48 65.27 78.06 3 XM_DK_Pass 266215 74.17 62.68 77.07 4 DKIM_VALID 255373 70.81 58.46 73.93 5 XM_B_Unicode 245500 70.30 67.24 71.07 6 DKIM_VALID_AU 202301 55.42 42.98 58.56 7 XMListUnsubscribeExists 200428 57.93 57.57 58.02 8 BAYES_50 186303 51.28 40.79 53.93 9 DCC_CHECK_NEGATIVE 173083 43.26 16.15 50.11 10 DCC_CHECK 166908 55.12 82.04 48.32 11 XM_B_Unicode3 154399 43.80 40.24 44.70 12 HTML_FONT_LOW_CONTRAST 106030 30.23 28.40 30.69 13 LOC_TINY_FONT_1 94331 27.51 28.29 27.31 14 DKIM_VALID_EF 93790 25.49 18.93 27.15 15 MIME_HTML_ONLY 85438 28.43 43.05 24.73 16 FVGT_m_MULTI_ODD 76090 22.25 23.14 22.03 17 T_TM2_M_HEADER_IN_MSG 71192 19.34 14.30 20.61 18 XMSubLong 70497 20.48 20.77 20.41 19 BAYES_00 66590 16.03 3.15 19.28 20 T_KAM_HTML_FONT_INVALID 63557 18.67 19.74 18.40 21 MultiRelay 55186 16.20 17.07 15.98 22 XM_Body_Dirty_Words 53330 16.43 20.38 15.44 23 TR_XM_DK_Bayes 53048 12.63 1.83 15.36 24 RCVD_IN_MSPIKE_H2 52494 14.58 12.11 15.20 25 TR_XM_DK_Bayes1 50928 12.11 1.68 14.74 26 ALL_TRUSTED 50164 12.66 5.29 14.52 27 TR_XM_DK_Bayes2 46922 11.01 0.82 13.58 28 RCVD_IN_RP_SAFE 46441 11.10 1.80 13.44 29 XM_B_Unsub 45469 14.67 20.66 13.16 30 XM_Multi_Part_URI 44965 13.99 17.87 13.02 31 RCVD_IN_RP_CERTIFIED 41820 9.96 1.46 12.11 32 RCVD_IN_MSPIKE_WL 38511 9.95 5.19 11.15 33 RCVD_IN_MSPIKE_H3 37802 9.64 4.50 10.94 34 XM_Evil_Numbers_Gen 36995 10.70 10.66 10.71 35 HTML_IMAGE_RATIO_02 35323 11.89 18.49 10.23 36 XM_DKIMWhitelistDomains 33956 7.87 0.12 9.83 37 LotsOfNums_01 28923 8.03 6.67 8.37 38 HTML_IMAGE_RATIO_04 25711 7.42 7.31 7.44 39 XM_DK_Undo_02 25348 12.83 34.57 7.34 40 T_XMDrugObfuBody_14 25307 7.35 7.45 7.33 41 FSL_BULK_SIG 25031 10.19 21.84 7.25 42 XM_SendGrid 23959 6.31 3.83 6.94 43 XM_B_Phish_Phrases 23814 6.36 4.24 6.89 44 LOTS_OF_MONEY 23697 7.41 9.59 6.86 45 TooManyTo_001 23636 7.37 9.48 6.84 46 XM_H_Long_From01 22402 7.35 10.78 6.49 47 BAYES_60 20247 6.16 7.37 5.86 48 BOTNET_IPINHOSTNAME 19944 8.49 19.26 5.77 49 T_TooManySym_01 19491 5.42 4.52 5.64 50 MIME_QP_LONG_LINE 18474 5.27 4.97 5.35 51 RELAYCOUNTRY_META 17104 9.19 25.98 4.95 52 BAYES_40 17089 4.91 4.75 4.95 53 XMSexyCombo_05 17028 5.99 10.17 4.93 54 XMStrtUSub 16884 4.66 3.76 4.89 55 RCVD_IN_IADB_LISTED 16213 4.14 1.95 4.69 56 XM_UncommonTLD01 15687 8.26 23.01 4.54 57 HTML_IMAGE_RATIO_06 15375 4.25 3.43 4.45 58 MPART_ALT_DIFF 15174 5.00 7.40 4.39 59 FROM_EXCESS_BASE64 14834 4.21 3.87 4.29 60 BAYES_20 14386 4.05 3.59 4.16 61 RCVD_IN_IADB_SPF 14298 3.67 1.82 4.14 62 DKIM_INVALID 14272 4.67 6.81 4.13 63 BAYES_99 14230 8.71 26.91 4.12 64 T_REMOTE_IMAGE 14132 5.19 9.54 4.09 65 TR_XM_DK_SendGrid 13793 3.52 1.64 3.99 66 RCVD_IN_IADB_SENDERID 12896 3.34 1.80 3.73 67 HTML_MIME_NO_HTML_TAG 12693 6.17 16.07 3.67 68 RCVD_IN_IADB_DK 12594 3.27 1.79 3.65 69 XMSubMetaSx_00 12552 4.30 6.95 3.63 70 BAYES_999 11483 6.85 20.81 3.32 71 UNPARSEABLE_RELAY 11357 2.92 1.46 3.29 72 XM_DIRTYINTL 11179 3.69 5.50 3.24 73 MIME_HTML_MOSTLY 10837 3.59 5.39 3.14 74 IN_ZIMBRA_NJ_WHITELIST 10805 2.50 0.02 3.13 75 BAYES_80 10621 3.92 7.29 3.07 76 XM_PDF 10390 2.49 0.46 3.01 77 XMNumbers 10340 3.24 4.21 2.99 78 MIME_HTML_ONLY_MULTI 9703 3.12 4.33 2.81 79 XMBdyGiftCard01 9697 2.56 1.56 2.81 80 RCVD_IN_IADB_VOUCHED 9639 2.34 0.54 2.79 81 XM_B_SpammyTLD 9555 3.02 4.03 2.77 82 TVD_RCVD_IP 9499 2.32 0.61 2.75 83 T_TooManySym_02 8957 2.21 0.68 2.59 84 XM_CamelCaseFrm001 8832 2.54 2.50 2.56 85 HTML_IMAGE_RATIO_08 8812 2.47 2.17 2.55 86 XM_H_Trusted_IP 8729 2.02 0.00 2.53 87 XM_B_Unsub2 8619 3.06 5.32 2.50 88 BAYES_05 8485 2.36 1.98 2.46 89 CK_HELO_DYNAMIC_SPLIT_IP 8387 2.07 0.63 2.43 90 HELO_DYNAMIC_IPADDR2 8383 2.00 0.29 2.43 91 NO_DNS_FOR_FROM 7593 2.26 2.49 2.20 92 HTML_IMAGE_ONLY_20 7314 1.73 0.22 2.12 93 INVALID_MSGID 7005 1.69 0.35 2.03 94 BOTNET 6913 7.45 29.03 2.00 95 ANY_BOUNCE_MESSAGE 6614 1.64 0.54 1.91 96 BOUNCE_MESSAGE 6613 1.64 0.54 1.91 97 TO_MALFORMED 6562 2.41 4.43 1.90 98 BAYES_95 6375 2.27 3.93 1.85 99 XMOffer 5996 1.39 0.02 1.74 100 RCVD_IN_IADB_OPTIN 5942 1.45 0.36 1.72 101 TM2_M_VERY_LONG_WORD 5936 1.73 1.76 1.72 102 TM2_M_URI_OPT_OUT 5924 2.06 3.42 1.71 103 UNTRUSTED_Relay 5891 5.18 18.97 1.71 104 MAILING_LIST_MULTI 5721 1.67 1.72 1.66 105 PLING_QUERY 5692 1.49 0.88 1.65 106 RELAYCOUNTRY_CA 5441 2.03 3.83 1.58 107 TR_DCC_Bayes_99 5409 5.74 22.28 1.57 108 IN_HORDE_ADDRESS_BOOK 5338 1.24 0.03 1.55 109 DKIM_ADSP_NXDOMAIN 5099 3.32 10.65 1.48 110 KHOP_HELO_FCRDNS 4959 3.08 9.57 1.44 111 USER_IN_DEF_DKIM_WL 4923 1.14 0.01 1.43 112 TooManyTo_002 4709 1.87 3.90 1.36 113 RCVD_IN_BL_SPAMCOP_NET 4624 2.22 5.71 1.34 114 XMSubNoVowel 4575 1.14 0.39 1.32 115 TR_XM_RelayPhish 4508 1.30 1.26 1.31 116 TR_XM_PHPDW 4483 1.41 1.83 1.30 117 TR_XM_PHPForged 4419 1.38 1.76 1.28 118 TR_XM_FormFill2 4410 1.37 1.74 1.28 119 XM_H_PHPOS 4401 1.37 1.73 1.27 120 XMGappySubj_01 4376 1.21 0.97 1.27 121 XM_DK_Undo_01 4359 1.24 1.14 1.26 122 XM_SPF_SoftFail 4357 2.37 6.74 1.26 123 URI_TRY_3LD 4341 1.39 1.93 1.26 124 XMStockSpam_06 4316 1.30 1.48 1.25 125 XMHTML_After_End 4207 1.34 1.84 1.22 126 URI_HEX 4164 1.62 3.28 1.21 127 SUBJ_ALL_CAPS 3870 1.19 1.46 1.12 128 XMDiploma_00 3869 1.24 1.71 1.12 129 XM_RXBody 3862 0.97 0.39 1.12 130 XM_OfRef6 3817 1.48 2.98 1.10 131 T_XMDrugObfuBody_08 3762 1.25 1.87 1.09 132 T_MONEY_PERCENT 3746 1.09 1.14 1.08 133 TR_LOTS_OF_MONEY2 3746 1.09 1.14 1.08 134 TR_Symld_Words 3721 1.18 1.60 1.08 135 AC_FROM_MANY_DOTS 3664 0.85 0.02 1.06 136 XM_H_Long_From02 3515 1.00 0.93 1.02 137 XM_UB50 3460 2.65 9.18 1.00 138 XM_GoogleGroups 3368 0.86 0.39 0.97 139 TR_MetaPhish_Combo_01 3300 0.96 0.97 0.96 140 XM_ProductURIs 3297 0.96 0.97 0.95 141 TO_NO_BRKTS_HTML_ONLY 3266 0.83 0.37 0.95 142 XMBody_95 3262 0.78 0.15 0.94 143 XMPhish11 3146 1.03 1.50 0.91 144 TooManyTo_003 3135 1.39 3.29 0.91 145 DKIM_ADSP_CUSTOM_MED 2986 0.99 1.49 0.86 146 HTML_FONT_FACE_BAD 2972 0.84 0.75 0.86 147 HTML_TAG_BALANCE_BODY 2823 0.75 0.50 0.82 148 XMGppyBdWords 2812 0.78 0.64 0.81 149 XMBrknScrpt_02 2764 0.76 0.62 0.80 150 XMSubMetaI_00 2573 1.15 2.76 0.74 151 XM_B_REG_HTML 2425 0.62 0.28 0.70 152 RELAYCOUNTRY_GB 2349 1.05 2.53 0.68 153 T_XMHurry_00 2346 0.79 1.23 0.68 154 TooManyTo_004 2345 1.05 2.50 0.68 155 USER_IN_WHITELIST 2310 0.53 0.00 0.67 156 XMBody_17 2308 0.72 0.95 0.67 157 XMPhish30 2287 0.72 0.97 0.66 158 THIS_AD 2239 0.70 0.91 0.65 159 RCVD_IN_MSPIKE_BL 2234 0.95 2.16 0.65 160 XMHTMLBadTable_001 2129 0.56 0.35 0.62 161 NML_ADSP_CUSTOM_MED 2099 0.72 1.15 0.61 162 TM2_M_BODY_EMPTY 2017 0.49 0.12 0.58 163 XMCapTrack 2011 0.53 0.32 0.58 164 T_TooManySym_03 1995 0.50 0.17 0.58 165 HELO_NODOT 1964 0.55 0.50 0.57 166 HELO_NO_DOMAIN 1959 0.55 0.49 0.57 167 TooManyTo_005 1945 0.80 1.75 0.56 168 XM_B_COPY_HTML 1920 0.54 0.49 0.56 169 FORGED_GMAIL_RCVD 1880 0.71 1.35 0.54 170 SpammyFromTLD_01 1867 0.78 1.71 0.54 171 XMGenDplmaNmb 1852 0.66 1.16 0.54 172 XMSubMetaSxObfu_02 1845 0.48 0.26 0.53 173 XMBody_78 1801 0.55 0.69 0.52 174 XMLngstWrd_00 1790 0.61 0.95 0.52 175 URIBL_CSS 1727 0.50 0.48 0.50 176 URIBL_CSS_A 1727 0.50 0.48 0.50 177 DIET_1 1716 0.84 2.18 0.50 178 REMOVE_BEFORE_LINK 1708 0.52 0.61 0.49 179 XMSexyCombo_01 1698 0.77 1.88 0.49 180 XMBSHREFv2 1696 0.44 0.25 0.49 181 RELAYCOUNTRY_FR 1670 1.02 3.13 0.48 182 XM_SPF_Unknown 1658 0.80 2.04 0.48 183 T_XMDrugObfuBody_00 1645 0.53 0.76 0.48 184 MPART_ALT_DIFF_COUNT 1619 0.62 1.24 0.47 185 XMLngstWrd_01 1608 0.56 0.93 0.47 186 URI_NOVOWEL 1593 0.45 0.39 0.46 187 RELAYCOUNTRY_AU 1556 0.44 0.39 0.45 188 XMNoVowels 1548 0.40 0.18 0.45 189 T_OBFU_PDF_ATTACH 1497 0.38 0.19 0.43 190 RDNS_DYNAMIC 1483 1.62 6.34 0.43 191 XM_H_PHPMailer 1394 0.59 1.32 0.40 192 T_FILL_THIS_FORM_SHORT 1374 0.40 0.41 0.40 193 FROM_GOV_SPOOF 1367 0.45 0.67 0.40 194 TR_LOTS_OF_MONEY3 1362 0.59 1.35 0.39 195 XM_URI_RBL 1349 0.97 3.27 0.39 196 XM_Walgreens_Forge 1347 0.31 0.01 0.39 197 FILL_THIS_FORM 1311 0.64 1.69 0.38 198 SpammyFromTLD_02 1308 2.44 10.59 0.38 199 XMSubMetaSxObfu_03 1304 0.47 0.82 0.38 200 BODY_ENHANCEMENT 1291 0.30 0.02 0.37 ----------------------------------------------------------------------