Email: 362950 Autolearn: 0 AvgScore: -1.15 AvgScanTime: 1.98 sec Spam: 69510 Autolearn: 0 AvgScore: 14.37 AvgScanTime: 2.45 sec Ham: 293440 Autolearn: 0 AvgScore: -4.82 AvgScanTime: 1.87 sec Time Spent Running SA: 199.43 hours Time Spent Processing Spam: 47.21 hours Time Spent Processing Ham: 152.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 63081 89.56 90.75 89.28 2 DCC_CHECK 55747 52.29 80.20 45.67 3 XM_B_Unicode 42949 73.64 61.79 76.44 4 DKIM_SIGNED 41282 66.56 59.39 68.26 5 XM_DK_Pass 38586 65.34 55.51 67.67 6 XMListUnsubscribeExists 36781 52.24 52.91 52.08 7 DKIM_VALID 36149 62.42 52.01 64.89 8 MIME_HTML_ONLY 31299 30.62 45.03 27.20 9 BAYES_50 30229 43.91 43.49 44.01 10 XM_B_Unicode3 29287 49.78 42.13 51.60 11 DKIM_VALID_AU 27914 51.56 40.16 54.26 12 FSL_BULK_SIG 21486 12.47 30.91 8.10 13 XM_DK_Undo_02 21417 11.89 30.81 7.40 14 RELAYCOUNTRY_META 21271 9.21 30.60 4.14 15 BOTNET 21165 7.50 30.45 2.07 16 HTML_FONT_LOW_CONTRAST 18924 29.27 27.22 29.75 17 XM_UncommonTLD01 18761 11.39 26.99 7.69 18 LOC_TINY_FONT_1 17432 26.60 25.08 26.96 19 XM_Body_Dirty_Words 15717 14.55 22.61 12.65 20 FVGT_m_MULTI_ODD 15087 20.23 21.70 19.88 21 BAYES_99 14934 7.83 21.48 4.59 22 HTML_MIME_NO_HTML_TAG 14051 4.75 20.21 1.09 23 BOTNET_IPINHOSTNAME 13690 8.96 19.70 6.42 24 MultiRelay 13647 13.43 19.63 11.96 25 XMSubLong 13644 19.06 19.63 18.92 26 UNTRUSTED_Relay 13555 5.10 19.50 1.69 27 XM_B_Unsub 12916 11.19 18.58 9.44 28 DCC_CHECK_NEGATIVE 12411 46.56 17.85 53.36 29 TR_DCC_Bayes_99 12165 5.01 17.50 2.05 30 BAYES_999 11772 6.34 16.94 3.83 31 HTML_IMAGE_RATIO_02 11392 10.35 16.39 8.92 32 XMSexyCombo_05 10643 6.55 15.31 4.47 33 SpammyFromTLD_02 10507 3.04 15.12 0.18 34 XM_Multi_Part_URI 10326 12.76 14.86 12.26 35 T_REMOTE_IMAGE 10049 7.64 14.46 6.03 36 T_KAM_HTML_FONT_INVALID 9893 14.27 14.23 14.28 37 HTML_SHORT_LINK_IMG_1 9309 2.58 13.39 0.02 38 DKIM_VALID_EF 9296 21.15 13.37 22.99 39 BODY_URI_ONLY 9152 2.54 13.17 0.03 40 DKIM_ADSP_NXDOMAIN 8829 6.05 12.70 4.47 41 XM_H_Long_From01 8690 6.78 12.50 5.43 42 XMSubMetaSx_00 8623 5.30 12.41 3.62 43 HTML_IMAGE_ONLY_08 8526 2.43 12.27 0.10 44 FROM_SUSPICIOUS_NTLD 8224 2.32 11.83 0.07 45 FROM_SUSPICIOUS_NTLD_FP 8185 2.31 11.78 0.07 46 TR_Mismatch_TLD_02 8055 2.27 11.59 0.06 47 XM_SPF_SoftFail 7831 2.76 11.27 0.74 48 KHOP_HELO_FCRDNS 7453 2.74 10.72 0.85 49 T_HTML_TAG_BALANCE_CENTER 7448 2.12 10.72 0.08 50 T_TM2_M_HEADER_IN_MSG 7370 14.89 10.60 15.90 51 RCVD_IN_MSPIKE_H2 7123 12.60 10.25 13.15 52 SHORT_IMG_SUSP_NTLD 6881 1.90 9.90 0.00 53 BAYES_80 6579 4.01 9.46 2.72 54 BAYES_60 6131 5.72 8.82 4.99 55 XM_BadFromFormat 5737 1.62 8.25 0.05 56 XM_UB50 5687 2.23 8.18 0.82 57 XM_Evil_Numbers_Gen 5657 10.59 8.14 11.17 58 T_XMDrugObfuBody_14 5552 6.23 7.99 5.82 59 DKIM_INVALID 5133 4.14 7.38 3.37 60 RDNS_DYNAMIC 5132 1.75 7.38 0.41 61 MPART_ALT_DIFF 4500 10.55 6.47 11.51 62 XMSexyCombo_01 4380 1.71 6.30 0.62 63 RCVD_IN_BL_SPAMCOP_NET 4291 1.91 6.17 0.90 64 LOTS_OF_MONEY 4155 4.66 5.98 4.35 65 XM_DIRTYINTL 4126 3.31 5.94 2.69 66 XM_B_SpammyTLD 3858 2.85 5.55 2.21 67 LotsOfNums_01 3801 6.83 5.47 7.15 68 MIME_QP_LONG_LINE 3741 4.13 5.38 3.84 69 TooManyTo_001 3645 4.57 5.24 4.41 70 HTML_IMAGE_RATIO_04 3528 18.87 5.08 22.13 71 TO_MALFORMED 3528 2.79 5.08 2.24 72 MIME_HTML_MOSTLY 3481 2.94 5.01 2.45 73 BAYES_95 3443 2.21 4.95 1.56 74 RELAYCOUNTRY_CA 3335 2.01 4.80 1.35 75 HTML_IMAGE_RATIO_08 3322 2.62 4.78 2.11 76 FROM_MISSP_REPLYTO 3254 0.90 4.68 0.00 77 XMSexyCombo_04 3244 0.95 4.67 0.07 78 RCVD_IN_RP_RNBL 3163 0.93 4.55 0.07 79 XM_B_Phish_Phrases 3116 5.42 4.48 5.64 80 RELAYCOUNTRY_DE 2987 1.02 4.30 0.25 81 FROM_EXCESS_BASE64 2941 4.43 4.23 4.48 82 XMStrtUSub 2885 10.84 4.15 12.42 83 BAYES_40 2826 4.73 4.07 4.89 84 XMSubMetaSx_01 2819 0.85 4.06 0.09 85 HTML_IMAGE_RATIO_06 2779 5.03 4.00 5.28 86 XMSexyCombo_02 2733 0.77 3.93 0.02 87 XMNumbers 2698 3.05 3.88 2.85 88 TM2_M_URI_OPT_OUT 2672 2.26 3.84 1.89 89 HDRS_MISSP 2661 0.75 3.83 0.02 90 LOCALPART_IN_SUBJECT 2660 0.75 3.83 0.02 91 HDRS_LCASE_IMGONLY 2649 0.74 3.81 0.01 92 URIBL_DBL_ABUSE_REDIR 2605 0.72 3.75 0.01 93 XM_B_Unsub2 2503 2.17 3.60 1.83 94 MORE_SEX 2488 0.69 3.58 0.01 95 XM_CamelCaseFrm001 2405 2.46 3.46 2.22 96 BAYES_20 2394 5.49 3.44 5.98 97 MIME_HTML_ONLY_MULTI 2370 8.54 3.41 9.75 98 RCVD_IN_MSPIKE_WL 2366 8.97 3.40 10.29 99 ALL_TRUSTED 2329 8.94 3.35 10.26 100 UNPARSEABLE_RELAY 2309 3.73 3.32 3.83 101 XM_SendGrid 2296 5.08 3.30 5.51 102 RELAYCOUNTRY_TR 2295 0.67 3.30 0.05 103 MultiRelay_CC 2258 0.84 3.25 0.27 104 MultiRelay_Combo 2258 0.84 3.25 0.27 105 XM_ShortIntro_01 2243 0.85 3.23 0.29 106 MIME_HEADER_CTYPE_ONLY 2176 0.66 3.13 0.07 107 RCVD_IN_MSPIKE_H3 2139 8.79 3.08 10.14 108 XMBody_17 2095 1.16 3.01 0.73 109 SUBJ_ALL_CAPS 2093 1.45 3.01 1.08 110 URI_HEX 2001 1.41 2.88 1.07 111 XM_UB60 1952 0.60 2.81 0.07 112 NO_DNS_FOR_FROM 1945 4.91 2.80 5.41 113 RELAYCOUNTRY_FR 1935 0.77 2.78 0.29 114 HK_RANDOM_FROM 1927 0.58 2.77 0.06 115 T_TooManySym_01 1914 4.11 2.75 4.44 116 XMHTML_After_End 1839 1.05 2.65 0.67 117 HTML_FONT_SIZE_HUGE 1775 0.58 2.55 0.11 118 SUBJECT_NEEDS_ENCODING 1762 0.50 2.53 0.02 119 SUBJ_ILLEGAL_CHARS 1761 0.50 2.53 0.02 120 HTML_TAG_BALANCE_HEAD 1761 0.53 2.53 0.05 121 XM_URI_RBL 1725 0.78 2.48 0.37 122 RCVD_IN_PSBL 1647 0.52 2.37 0.08 123 RELAYCOUNTRY_GB 1631 0.81 2.35 0.44 124 BOTNET_NORDNS 1552 0.44 2.23 0.01 125 BAYES_00 1534 21.89 2.21 26.56 126 LongTLD 1510 0.53 2.17 0.15 127 DATE_IN_FUTURE_03_06 1493 0.41 2.15 0.00 128 XMPhish11 1492 0.99 2.15 0.71 129 NORDNS_LOW_CONTRAST 1479 0.41 2.13 0.01 130 XMSubMetaI_00 1430 1.30 2.06 1.12 131 XM_H_PHPMailer 1428 0.68 2.05 0.35 132 XMSubject_48 1403 0.40 2.02 0.02 133 XM_UB80 1386 0.40 1.99 0.02 134 DIET_1 1323 1.07 1.90 0.87 135 TR_XM_PHPDW 1278 0.67 1.84 0.39 136 BAYES_05 1266 3.95 1.82 4.45 137 TR_XM_PHPForged 1248 0.66 1.80 0.39 138 RCVD_IN_SORBS_DUL 1240 0.38 1.78 0.05 139 TR_XM_FormFill2 1240 0.65 1.78 0.38 140 XM_H_PHPOS 1237 0.65 1.78 0.38 141 XM_UB95 1218 0.36 1.75 0.03 142 RCVD_IN_RP_SAFE 1215 11.39 1.75 13.67 143 REPLYTO_WITHOUT_TO_CC 1214 0.35 1.75 0.02 144 XM_ProductURIs 1197 1.12 1.72 0.97 145 RELAYCOUNTRY_GR 1193 0.33 1.72 0.00 146 TM2_M_VERY_LONG_WORD 1183 1.48 1.70 1.42 147 XMDiploma_00 1178 0.83 1.69 0.63 148 XMStockSpam_06 1160 1.30 1.67 1.22 149 RCVD_IN_IADB_LISTED 1144 2.74 1.65 2.99 150 TR_XM_INV_DKIM 1047 0.37 1.51 0.10 151 RCVD_IN_IADB_SPF 1031 2.40 1.48 2.62 152 RCVD_IN_IADB_DK 1016 2.16 1.46 2.33 153 DATE_IN_PAST_03_06 1010 0.36 1.45 0.10 154 RCVD_IN_IADB_SENDERID 1009 2.19 1.45 2.37 155 XMBdyGiftCard01 1005 2.04 1.45 2.19 156 TR_XM_DK_SendGrid 970 2.65 1.40 2.95 157 RCVD_IN_RP_CERTIFIED 956 10.38 1.38 12.51 158 FROM_GOV_SPOOF 932 0.31 1.34 0.07 159 TR_XM_RelayPhish 927 0.94 1.33 0.84 160 RELAYCOUNTRY_MD 909 0.25 1.31 0.00 161 HTML_IMAGE_ONLY_12 905 0.33 1.30 0.10 162 TO_EQ_FM_DOM_HTML_IMG 904 0.25 1.30 0.00 163 RCVD_IN_MSPIKE_BL 894 0.65 1.29 0.51 164 XMGenDplmaNmb 888 0.53 1.28 0.35 165 IMPOTENCE 885 0.48 1.27 0.30 166 SpammyFromTLD_01 865 0.45 1.24 0.26 167 TR_Symld_Words 839 0.76 1.21 0.66 168 RELAYCOUNTRY_AT 809 0.47 1.16 0.30 169 FROM_LOCAL_NOVOWEL 795 0.24 1.14 0.02 170 XM_OfRef6 775 0.76 1.11 0.67 171 RCVD_IN_MSPIKE_L5 773 0.37 1.11 0.19 172 MISSING_HEADERS 764 0.37 1.10 0.20 173 T_XMDrugObfuBody_08 760 0.85 1.09 0.79 174 URI_TRY_3LD 748 1.24 1.08 1.27 175 XM_DK_Undo_01 746 1.07 1.07 1.07 176 TR_XM_DK_Bayes 736 11.61 1.06 14.12 177 MAILING_LIST_MULTI 710 1.32 1.02 1.39 178 XMHTMLBadTable_001 707 0.69 1.02 0.62 179 RELAYCOUNTRY_ID 702 0.22 1.01 0.03 180 XMBrknScrpt_02 701 0.72 1.01 0.65 181 XM_H_PHPOS_M 697 0.28 1.00 0.11 182 XM_UB99 693 0.19 1.00 0.00 183 CK_HELO_DYNAMIC_SPLIT_IP 677 2.66 0.97 3.06 184 XMSlimDrugH 673 0.40 0.97 0.26 185 XM_H_Long_From02 657 1.34 0.95 1.43 186 TR_XM_DK_Bayes1 656 11.14 0.94 13.56 187 FILL_THIS_FORM 640 0.54 0.92 0.45 188 URI_WP_HACKED_2 632 0.41 0.91 0.30 189 DKIM_ADSP_CUSTOM_MED 625 0.77 0.90 0.74 190 T_Symld_Words_02 624 0.36 0.90 0.23 191 FVGT_m_MULTI_ODD_EMAIL 615 0.19 0.88 0.02 192 XMPhish04 615 0.17 0.88 0.00 193 FILL_THIS_FORM_LONG 615 0.48 0.88 0.38 194 URIBL_DBL_SPAM 611 0.20 0.88 0.04 195 MPART_ALT_DIFF_COUNT 587 0.53 0.84 0.45 196 XM_SPF_Unknown 587 0.31 0.84 0.18 197 XMSubPhish11 574 0.27 0.83 0.14 198 XMSubNoVowel 567 5.46 0.82 6.57 199 T_MONEY_PERCENT 558 0.55 0.80 0.49 200 TR_LOTS_OF_MONEY2 558 0.55 0.80 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 261992 89.56 90.75 89.28 2 XM_B_Unicode 224316 73.64 61.79 76.44 3 DKIM_SIGNED 200313 66.56 59.39 68.26 4 XM_DK_Pass 198557 65.34 55.51 67.67 5 DKIM_VALID 190418 62.42 52.01 64.89 6 DKIM_VALID_AU 159208 51.56 40.16 54.26 7 DCC_CHECK_NEGATIVE 156568 46.56 17.85 53.36 8 XMListUnsubscribeExists 152813 52.24 52.91 52.08 9 XM_B_Unicode3 151403 49.78 42.13 51.60 10 DCC_CHECK 134025 52.29 80.20 45.67 11 BAYES_50 129137 43.91 43.49 44.01 12 HTML_FONT_LOW_CONTRAST 87309 29.27 27.22 29.75 13 MIME_HTML_ONLY 79828 30.62 45.03 27.20 14 LOC_TINY_FONT_1 79122 26.60 25.08 26.96 15 BAYES_00 77928 21.89 2.21 26.56 16 DKIM_VALID_EF 67469 21.15 13.37 22.99 17 HTML_IMAGE_RATIO_04 64943 18.87 5.08 22.13 18 FVGT_m_MULTI_ODD 58333 20.23 21.70 19.88 19 XMSubLong 55519 19.06 19.63 18.92 20 XM_H_Trusted_IP 54540 15.03 0.00 18.59 21 HTML_FONT_FACE_BAD 51441 14.27 0.51 17.53 22 T_TM2_M_HEADER_IN_MSG 46660 14.89 10.60 15.90 23 T_KAM_HTML_FONT_INVALID 41892 14.27 14.23 14.28 24 TR_XM_DK_Bayes 41420 11.61 1.06 14.12 25 RCVD_IN_RP_SAFE 40110 11.39 1.75 13.67 26 TR_XM_DK_Bayes1 39785 11.14 0.94 13.56 27 RCVD_IN_MSPIKE_H2 38594 12.60 10.25 13.15 28 TR_XM_DK_Bayes2 37781 10.54 0.70 12.88 29 XM_Body_Dirty_Words 37110 14.55 22.61 12.65 30 RCVD_IN_RP_CERTIFIED 36720 10.38 1.38 12.51 31 XMStrtUSub 36448 10.84 4.15 12.42 32 XM_Multi_Part_URI 35980 12.76 14.86 12.26 33 MultiRelay 35090 13.43 19.63 11.96 34 MPART_ALT_DIFF 33785 10.55 6.47 11.51 35 XM_Evil_Numbers_Gen 32774 10.59 8.14 11.17 36 XM_DKIMWhitelistDomains 32467 8.96 0.05 11.06 37 RCVD_IN_MSPIKE_WL 30200 8.97 3.40 10.29 38 ALL_TRUSTED 30111 8.94 3.35 10.26 39 RCVD_IN_MSPIKE_H3 29755 8.79 3.08 10.14 40 MIME_HTML_ONLY_MULTI 28608 8.54 3.41 9.75 41 XM_B_Unsub 27694 11.19 18.58 9.44 42 HTML_IMAGE_RATIO_02 26175 10.35 16.39 8.92 43 FSL_BULK_SIG 23760 12.47 30.91 8.10 44 XM_UncommonTLD01 22578 11.39 26.99 7.69 45 XM_DK_Undo_02 21724 11.89 30.81 7.40 46 LotsOfNums_01 20994 6.83 5.47 7.15 47 XMSubNoVowel 19267 5.46 0.82 6.57 48 BOTNET_IPINHOSTNAME 18839 8.96 19.70 6.42 49 T_REMOTE_IMAGE 17681 7.64 14.46 6.03 50 BAYES_20 17543 5.49 3.44 5.98 51 T_XMDrugObfuBody_14 17071 6.23 7.99 5.82 52 XM_B_Phish_Phrases 16540 5.42 4.48 5.64 53 XM_SendGrid 16154 5.08 3.30 5.51 54 XM_H_Long_From01 15936 6.78 12.50 5.43 55 NO_DNS_FOR_FROM 15879 4.91 2.80 5.41 56 HTML_IMAGE_RATIO_06 15484 5.03 4.00 5.28 57 BAYES_60 14633 5.72 8.82 4.99 58 BAYES_40 14348 4.73 4.07 4.89 59 BAYES_99 13482 7.83 21.48 4.59 60 FROM_EXCESS_BASE64 13140 4.43 4.23 4.48 61 XMSexyCombo_05 13117 6.55 15.31 4.47 62 DKIM_ADSP_NXDOMAIN 13116 6.05 12.70 4.47 63 BAYES_05 13069 3.95 1.82 4.45 64 T_TooManySym_01 13021 4.11 2.75 4.44 65 TooManyTo_001 12948 4.57 5.24 4.41 66 LOTS_OF_MONEY 12775 4.66 5.98 4.35 67 AC_FROM_MANY_DOTS 12529 3.45 0.01 4.27 68 RELAYCOUNTRY_META 12146 9.21 30.60 4.14 69 MIME_QP_LONG_LINE 11260 4.13 5.38 3.84 70 UNPARSEABLE_RELAY 11231 3.73 3.32 3.83 71 BAYES_999 11231 6.34 16.94 3.83 72 XMSubMetaSx_00 10621 5.30 12.41 3.62 73 DKIM_INVALID 9895 4.14 7.38 3.37 74 TVD_RCVD_IP 9524 2.74 0.60 3.25 75 CK_HELO_DYNAMIC_SPLIT_IP 8987 2.66 0.97 3.06 76 HELO_DYNAMIC_IPADDR2 8983 2.54 0.36 3.06 77 RCVD_IN_IADB_LISTED 8783 2.74 1.65 2.99 78 TR_XM_DK_SendGrid 8654 2.65 1.40 2.95 79 XMNumbers 8359 3.05 3.88 2.85 80 BAYES_80 7979 4.01 9.46 2.72 81 XM_DIRTYINTL 7880 3.31 5.94 2.69 82 RCVD_IN_IADB_SPF 7695 2.40 1.48 2.62 83 T_TooManySym_02 7484 2.17 0.54 2.55 84 INVALID_MSGID 7298 2.11 0.50 2.49 85 IN_ZIMBRA_NJ_WHITELIST 7185 1.98 0.01 2.45 86 MIME_HTML_MOSTLY 7175 2.94 5.01 2.45 87 RCVD_IN_IADB_SENDERID 6952 2.19 1.45 2.37 88 RCVD_IN_IADB_DK 6838 2.16 1.46 2.33 89 XMSubLongNoVowel 6791 1.94 0.36 2.31 90 XMSubGarbage 6716 1.86 0.05 2.29 91 TO_MALFORMED 6584 2.79 5.08 2.24 92 XM_CamelCaseFrm001 6509 2.46 3.46 2.22 93 XM_B_SpammyTLD 6488 2.85 5.55 2.21 94 XMBdyGiftCard01 6412 2.04 1.45 2.19 95 HTML_IMAGE_RATIO_08 6204 2.62 4.78 2.11 96 BOTNET 6071 7.50 30.45 2.07 97 TR_DCC_Bayes_99 6029 5.01 17.50 2.05 98 TM2_M_URI_OPT_OUT 5544 2.26 3.84 1.89 99 XM_B_Unsub2 5380 2.17 3.60 1.83 100 RCVD_IN_IADB_VOUCHED 5264 1.54 0.49 1.79 101 UNTRUSTED_Relay 4961 5.10 19.50 1.69 102 ANY_BOUNCE_MESSAGE 4774 1.43 0.62 1.63 103 BOUNCE_MESSAGE 4773 1.43 0.62 1.63 104 BAYES_95 4589 2.21 4.95 1.56 105 USER_IN_DEF_DKIM_WL 4332 1.20 0.02 1.48 106 XM_E_Blogspot 4262 1.19 0.11 1.45 107 XM_H_Long_From02 4192 1.34 0.95 1.43 108 TM2_M_VERY_LONG_WORD 4173 1.48 1.70 1.42 109 MAILING_LIST_MULTI 4073 1.32 1.02 1.39 110 RELAYCOUNTRY_CA 3964 2.01 4.80 1.35 111 IN_HORDE_ADDRESS_BOOK 3932 1.09 0.02 1.34 112 URIBL_CSS 3827 1.20 0.75 1.30 113 URIBL_CSS_A 3827 1.20 0.75 1.30 114 URI_TRY_3LD 3741 1.24 1.08 1.27 115 XMStockSpam_06 3571 1.30 1.67 1.22 116 TR_MetaPhish_Combo_01 3455 1.01 0.33 1.18 117 XMBody_95 3300 0.94 0.15 1.12 118 XMSubMetaI_00 3278 1.30 2.06 1.12 119 RCVD_IN_IADB_OPTIN 3218 0.96 0.40 1.10 120 HTML_MIME_NO_HTML_TAG 3201 4.75 20.21 1.09 121 SUBJ_ALL_CAPS 3163 1.45 3.01 1.08 122 XM_DK_Undo_01 3146 1.07 1.07 1.07 123 URI_HEX 3132 1.41 2.88 1.07 124 XMGappySubj_01 3123 0.88 0.12 1.06 125 XM_ProductURIs 2860 1.12 1.72 0.97 126 RCVD_IN_BL_SPAMCOP_NET 2649 1.91 6.17 0.90 127 XM_PDF 2644 0.78 0.26 0.90 128 XM_GoogleGroups 2594 0.79 0.40 0.88 129 DIET_1 2562 1.07 1.90 0.87 130 XM_B_REG_HTML 2535 0.77 0.36 0.86 131 KHOP_HELO_FCRDNS 2494 2.74 10.72 0.85 132 TR_XM_RelayPhish 2476 0.94 1.33 0.84 133 XM_UB50 2392 2.23 8.18 0.82 134 T_XMDrugObfuBody_08 2316 0.85 1.09 0.79 135 USER_IN_WHITELIST 2227 0.61 0.00 0.76 136 DKIM_ADSP_CUSTOM_MED 2183 0.77 0.90 0.74 137 XM_SPF_SoftFail 2181 2.76 11.27 0.74 138 XM_Ancestry_Forge 2163 0.60 0.03 0.74 139 XMPhish30 2146 0.74 0.80 0.73 140 XMBody_17 2130 1.16 3.01 0.73 141 XM_RXBody 2125 0.71 0.64 0.72 142 T_TooManySym_03 2105 0.60 0.11 0.72 143 XMPhish11 2085 0.99 2.15 0.71 144 XMSubMetaSxObfu_02 2037 0.65 0.46 0.69 145 XM_OfRef6 1972 0.76 1.11 0.67 146 XMHTML_After_End 1959 1.05 2.65 0.67 147 TR_Symld_Words 1930 0.76 1.21 0.66 148 TooManyTo_002 1927 0.67 0.73 0.66 149 XMBrknScrpt_02 1903 0.72 1.01 0.65 150 XMDiploma_00 1845 0.83 1.69 0.63 151 XMSexyCombo_01 1834 1.71 6.30 0.62 152 XMHTMLBadTable_001 1809 0.69 1.02 0.62 153 NML_ADSP_CUSTOM_MED 1623 0.60 0.80 0.55 154 XMBody_78 1621 0.52 0.39 0.55 155 XMSubMetaSxObfu_03 1581 0.52 0.45 0.54 156 RCVD_IN_MSPIKE_BL 1482 0.65 1.29 0.51 157 XMLngstWrd_00 1454 0.45 0.27 0.50 158 TR_LOTS_OF_MONEY2 1449 0.55 0.80 0.49 159 T_MONEY_PERCENT 1449 0.55 0.80 0.49 160 TooManyTo_003 1418 0.51 0.62 0.48 161 MPART_ALT_DIFF_COUNT 1335 0.53 0.84 0.45 162 FILL_THIS_FORM 1334 0.54 0.92 0.45 163 RELAYCOUNTRY_GB 1297 0.81 2.35 0.44 164 XMLngstWrd_01 1293 0.40 0.23 0.44 165 HTML_IMAGE_ONLY_20 1288 0.46 0.55 0.44 166 XMOemUri 1284 0.37 0.06 0.44 167 RDNS_DYNAMIC 1209 1.75 7.38 0.41 168 TooManyTo_004 1173 0.42 0.49 0.40 169 TR_XM_PHPDW 1154 0.67 1.84 0.39 170 XM_B_COPY_HTML 1137 0.45 0.72 0.39 171 TR_XM_PHPForged 1135 0.66 1.80 0.39 172 FSL_HELO_FAKE 1132 0.34 0.12 0.39 173 TR_XM_FormFill2 1128 0.65 1.78 0.38 174 XMRcvdHeader_15 1128 0.31 0.00 0.38 175 FILL_THIS_FORM_LONG 1118 0.48 0.88 0.38 176 XM_H_PHPOS 1114 0.65 1.78 0.38 177 URI_NOVOWEL 1109 0.40 0.47 0.38 178 FORGED_GMAIL_RCVD 1108 0.45 0.77 0.38 179 HTML_TAG_BALANCE_BODY 1104 0.40 0.53 0.38 180 XM_URI_RBL 1097 0.78 2.48 0.37 181 REMOVE_BEFORE_LINK 1063 0.32 0.14 0.36 182 XMGenDplmaNmb 1035 0.53 1.28 0.35 183 FILL_THIS_FORM_LOAN 1035 0.32 0.18 0.35 184 XM_H_PHPMailer 1022 0.68 2.05 0.35 185 T_XMDrugObfuBody_00 995 0.39 0.58 0.34 186 XMBSHREFv2 990 0.31 0.21 0.34 187 T_XMHurry_00 988 0.39 0.63 0.34 188 XM_Akamai 971 0.27 0.03 0.33 189 T_TooManySym_04 963 0.27 0.03 0.33 190 TooManyTo_005 939 0.33 0.37 0.32 191 XMLngstWrd_02 927 0.28 0.15 0.32 192 LOW_PRICE 912 0.35 0.52 0.31 193 RELAYCOUNTRY_AT 884 0.47 1.16 0.30 194 IMPOTENCE 875 0.48 1.27 0.30 195 URI_WP_HACKED_2 866 0.41 0.91 0.30 196 HTML_IMAGE_ONLY_32 859 0.26 0.14 0.29 197 AC_DIV_BONANZA 853 0.25 0.06 0.29 198 RELAYCOUNTRY_FR 850 0.77 2.78 0.29 199 TVD_SPACE_RATIO 850 0.25 0.09 0.29 200 XM_ShortIntro_01 846 0.85 3.23 0.29 ----------------------------------------------------------------------