Email: 591710 Autolearn: 0 AvgScore: 3.03 AvgScanTime: 1.87 sec Spam: 149317 Autolearn: 0 AvgScore: 16.00 AvgScanTime: 2.20 sec Ham: 442393 Autolearn: 0 AvgScore: -1.35 AvgScanTime: 1.77 sec Time Spent Running SA: 308.15 hours Time Spent Processing Spam: 91.18 hours Time Spent Processing Ham: 216.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139795 90.50 93.62 89.45 2 DCC_CHECK 121329 55.18 81.26 46.38 3 XM_B_Unicode 85761 68.40 57.44 72.10 4 DKIM_SIGNED 81808 73.73 54.79 80.13 5 XM_DK_Pass 77260 72.08 51.74 78.95 6 MIME_HTML_ONLY 75499 28.94 50.56 21.64 7 DKIM_VALID 71682 68.60 48.01 75.55 8 XMListUnsubscribeExists 66278 55.16 44.39 58.80 9 BAYES_50 65340 51.33 43.76 53.88 10 DKIM_VALID_AU 52594 52.10 35.22 57.80 11 FSL_BULK_SIG 52181 13.50 34.95 6.26 12 XM_B_Unicode3 51335 40.11 34.38 42.05 13 RELAYCOUNTRY_META 48544 12.32 32.51 5.51 14 BOTNET 47924 9.59 32.10 1.99 15 HTML_MIME_NO_HTML_TAG 41666 8.94 27.90 2.54 16 XM_UncommonTLD01 40523 9.79 27.14 3.94 17 XM_DK_Undo_02 38601 11.96 25.85 7.28 18 UNTRUSTED_Relay 36528 7.85 24.46 2.24 19 HTML_FONT_LOW_CONTRAST 35706 28.92 23.91 30.61 20 HTML_SHORT_LINK_IMG_1 33434 5.67 22.39 0.03 21 LOC_TINY_FONT_1 33047 24.67 22.13 25.52 22 DKIM_ADSP_NXDOMAIN 32850 6.61 22.00 1.42 23 XMSubLong 32511 19.11 21.77 18.21 24 XM_B_Unsub 32080 13.52 21.48 10.84 25 T_REMOTE_IMAGE 32009 8.19 21.44 3.72 26 BAYES_99 31532 8.25 21.12 3.91 27 HTML_IMAGE_ONLY_08 30591 5.25 20.49 0.10 28 FVGT_m_MULTI_ODD 29053 21.92 19.46 22.75 29 BODY_URI_ONLY 28045 4.79 18.78 0.07 30 T_HTML_TAG_BALANCE_CENTER 27867 4.87 18.66 0.21 31 BOTNET_IPINHOSTNAME 26882 8.45 18.00 5.22 32 KHOP_HELO_FCRDNS 26486 5.98 17.74 2.01 33 FROM_SUSPICIOUS_NTLD 26082 4.43 17.47 0.02 34 FROM_SUSPICIOUS_NTLD_FP 26050 4.42 17.45 0.02 35 DCC_CHECK_NEGATIVE 25812 43.10 17.29 51.82 36 TR_DCC_Bayes_99 24648 5.41 16.51 1.67 37 BAYES_999 23964 6.40 16.05 3.15 38 DKIM_VALID_EF 23696 25.07 15.87 28.17 39 T_TM2_M_HEADER_IN_MSG 23102 22.78 15.47 25.24 40 RCVD_IN_MSPIKE_BL 22214 4.49 14.88 0.99 41 XM_Body_Dirty_Words 22197 13.77 14.87 13.40 42 T_KAM_HTML_FONT_INVALID 21856 18.35 14.64 19.61 43 HDRS_LCASE_IMGONLY 21295 3.63 14.26 0.04 44 MultiRelay 20784 15.52 13.92 16.06 45 SpammyFromTLD_02 20525 3.63 13.75 0.21 46 SHORT_IMG_SUSP_NTLD 19760 3.34 13.23 0.00 47 XM_BadFromFormat 19652 3.41 13.16 0.12 48 LOTS_OF_MONEY 19624 11.42 13.14 10.84 49 RDNS_DYNAMIC 19187 3.60 12.85 0.47 50 RCVD_IN_RP_RNBL 19163 3.29 12.83 0.07 51 HTML_IMAGE_RATIO_02 18539 9.28 12.42 8.22 52 RCVD_IN_BL_SPAMCOP_NET 18280 4.21 12.24 1.50 53 HDRS_MISSP 17727 3.01 11.87 0.01 54 RCVD_IN_MSPIKE_L5 17724 3.16 11.87 0.23 55 XM_Multi_Part_URI 17488 12.28 11.71 12.48 56 NO_DNS_FOR_FROM 17277 4.40 11.57 1.98 57 XM_UB50 16795 3.92 11.25 1.44 58 XMSexyCombo_05 16268 5.74 10.89 4.00 59 XM_SPF_SoftFail 14595 3.84 9.77 1.84 60 BAYES_60 14184 6.49 9.50 5.47 61 XM_H_Long_From01 12978 7.01 8.69 6.44 62 BAYES_80 12864 4.25 8.62 2.77 63 RCVD_IN_MSPIKE_H2 12471 12.54 8.35 13.96 64 XMNumbers 11629 4.52 7.79 3.42 65 XM_Evil_Numbers_Gen 11475 9.15 7.68 9.65 66 TR_Mismatch_TLD_02 11316 2.01 7.58 0.13 67 XMSubMetaSx_00 10940 4.54 7.33 3.60 68 BOTNET_NORDNS 10312 1.79 6.91 0.07 69 SHORTENER_SHORT_IMG 10182 1.72 6.82 0.00 70 DKIM_INVALID 10126 5.13 6.78 4.57 71 RCVD_IN_PSBL 9998 1.73 6.70 0.05 72 MIME_HEADER_CTYPE_ONLY 9300 1.62 6.23 0.07 73 LotsOfNums_01 9048 8.01 6.06 8.67 74 XMStrtUSub 9027 5.27 6.05 5.01 75 XM_DIRTYINTL 8780 3.36 5.88 2.51 76 T_XMDrugObfuBody_14 8551 6.74 5.73 7.08 77 LongTLD 7900 1.44 5.29 0.14 78 TooManyTo_001 7659 6.39 5.13 6.81 79 RELAYCOUNTRY_NL 7548 1.42 5.06 0.20 80 TO_MALFORMED 7322 2.35 4.90 1.49 81 MPART_ALT_DIFF 7222 4.31 4.84 4.14 82 BAYES_40 7192 5.64 4.82 5.91 83 BAYES_95 7034 2.40 4.71 1.62 84 TR_LOTS_OF_MONEY3 6844 3.21 4.58 2.74 85 HTML_IMAGE_RATIO_04 6732 5.60 4.51 5.96 86 XM_B_Phish_Phrases 6702 5.00 4.49 5.17 87 HTML_IMAGE_ONLY_12 6529 1.25 4.37 0.20 88 MIME_HTML_MOSTLY 6424 3.30 4.30 2.96 89 FROM_MISSP_REPLYTO 6193 1.05 4.15 0.00 90 SUBJECT_NEEDS_ENCODING 6172 1.05 4.13 0.01 91 SUBJ_ILLEGAL_CHARS 6159 1.05 4.12 0.01 92 URI_NOVOWEL 6122 1.35 4.10 0.42 93 FROM_MISSP_DYNIP 6022 1.02 4.03 0.00 94 RELAYCOUNTRY_CA 5846 2.25 3.92 1.68 95 MIME_QP_LONG_LINE 5825 5.72 3.90 6.34 96 HK_RANDOM_FROM 5812 1.07 3.89 0.12 97 RELAYCOUNTRY_FR 5658 1.22 3.79 0.35 98 XM_SendGrid 5629 5.96 3.77 6.70 99 XM_B_SpammyTLD 5203 2.15 3.48 1.70 100 XM_CamelCaseFrm001 5010 2.57 3.36 2.30 101 FROM_EXCESS_BASE64 4924 3.57 3.30 3.67 102 BAYES_20 4699 4.15 3.15 4.49 103 RELAYCOUNTRY_GB 4664 1.40 3.12 0.82 104 XM_UB60 4560 0.82 3.05 0.06 105 T_TooManySym_01 4490 4.13 3.01 4.51 106 URI_HEX 4451 1.63 2.98 1.17 107 XM_OfRef6 4306 1.88 2.88 1.54 108 RCVD_IN_MSPIKE_WL 4282 8.40 2.87 10.27 109 RCVD_IN_MSPIKE_H3 4277 8.40 2.86 10.26 110 T_XMHurry_00 4179 2.24 2.80 2.05 111 RELAYCOUNTRY_IN 4146 0.74 2.78 0.05 112 TM2_M_URI_OPT_OUT 4072 2.19 2.73 2.01 113 XMSexyCombo_01 3956 1.22 2.65 0.74 114 HTML_IMAGE_RATIO_06 3941 3.95 2.64 4.40 115 XMMoneyMeta_00 3896 0.89 2.61 0.31 116 TR_Mismatch_TLD_01 3639 0.82 2.44 0.27 117 RELAYCOUNTRY_CN 3396 0.60 2.27 0.04 118 SpammyFromTLD_01 3285 1.15 2.20 0.80 119 BAYES_00 3212 14.87 2.15 19.17 120 T_XMDrugObfuBody_08 3201 1.52 2.14 1.31 121 TR_XM_INV_DKIM 3138 0.60 2.10 0.09 122 MIME_HTML_ONLY_MULTI 3100 2.36 2.08 2.46 123 BAYES_05 3017 2.47 2.02 2.62 124 MISSING_HEADERS 3003 0.75 2.01 0.32 125 MultiRelay_CC 2981 0.61 2.00 0.15 126 MultiRelay_Combo 2981 0.61 2.00 0.15 127 XMBody_17 2959 1.45 1.98 1.27 128 XMHTML_After_End 2939 1.34 1.97 1.12 129 XM_URI_RBL 2904 0.72 1.94 0.30 130 XMSexyCombo_04 2888 0.56 1.93 0.10 131 TR_XM_DK_SendGrid 2872 3.13 1.92 3.54 132 URI_TRY_3LD 2848 1.76 1.91 1.71 133 RCVD_IN_MSPIKE_L4 2847 0.87 1.91 0.53 134 RELAYCOUNTRY_DE 2829 1.22 1.89 1.00 135 DATE_IN_PAST_03_06 2774 0.62 1.86 0.20 136 T_Symld_Words_02 2709 0.80 1.81 0.45 137 XMDiploma_00 2637 1.57 1.77 1.51 138 XMSubMetaI_00 2572 0.93 1.72 0.66 139 HTML_IMAGE_RATIO_08 2569 2.13 1.72 2.26 140 SUBJ_ALL_CAPS 2552 1.38 1.71 1.27 141 XM_UB80 2505 0.44 1.68 0.02 142 RCVD_IN_IADB_LISTED 2504 4.38 1.68 5.29 143 CHARSET_FARAWAY_HEADER 2449 0.44 1.64 0.03 144 DRUGS_ERECTILE 2409 0.43 1.61 0.03 145 RCVD_IN_IADB_SPF 2385 3.87 1.60 4.64 146 XMSubMetaD_00 2356 0.43 1.58 0.04 147 TR_Symld_Words 2349 1.19 1.57 1.06 148 TR_XM_PHPDW 2347 1.27 1.57 1.16 149 RCVD_IN_IADB_DK 2342 3.42 1.57 4.05 150 RCVD_IN_RP_SAFE 2335 7.98 1.56 10.15 151 RCVD_IN_IADB_SENDERID 2333 3.50 1.56 4.15 152 XM_B_Unsub2 2306 2.29 1.54 2.54 153 NORDNS_LOW_CONTRAST 2296 0.39 1.54 0.00 154 FVGT_m_MULTI_ODD_EMAIL 2289 0.41 1.53 0.03 155 TR_XM_PHPForged 2283 1.24 1.53 1.15 156 TR_XM_FormFill2 2265 1.24 1.52 1.15 157 XM_H_PHPOS 2259 1.23 1.51 1.14 158 UNPARSEABLE_RELAY 2254 2.44 1.51 2.76 159 T_XMDrugObfuBody_00 2215 0.79 1.48 0.55 160 MIME_CHARSET_FARAWAY 2214 0.44 1.48 0.08 161 REPLYTO_WITHOUT_TO_CC 2205 0.40 1.48 0.03 162 MISSING_MIMEOLE 2164 0.40 1.45 0.04 163 XM_UB99 2138 0.37 1.43 0.01 164 TVD_SPACE_RATIO_MINFP 2094 0.36 1.40 0.01 165 FROM_LOCAL_NOVOWEL 2089 0.37 1.40 0.02 166 XM_H_TOP 2078 0.35 1.39 0.00 167 TM2_M_VERY_LONG_WORD 2042 1.22 1.37 1.17 168 ONLINE_PHARMACY 2029 0.35 1.36 0.00 169 TVD_VISIT_PHARMA 2022 0.34 1.35 0.00 170 INVALID_MSGID 1978 1.55 1.32 1.62 171 DOS_RCVD_IP_TWICE_B 1971 0.38 1.32 0.06 172 DKIM_ADSP_CUSTOM_MED 1873 1.04 1.25 0.97 173 XMSubMetaSx_01 1853 0.59 1.24 0.37 174 SUBJ_DOLLARS 1846 0.52 1.24 0.27 175 XMStockSpam_06 1799 1.07 1.20 1.03 176 XM_XX_Yahoo 1758 0.39 1.18 0.13 177 RCVD_IN_RP_CERTIFIED 1758 7.14 1.18 9.15 178 FILL_THIS_FORM 1739 0.57 1.16 0.36 179 XMSubMetaSxObfu_03 1710 0.89 1.15 0.81 180 FORGED_GMAIL_RCVD 1695 0.78 1.14 0.67 181 TR_XM_RelayPhish 1654 0.88 1.11 0.81 182 RCVD_IN_MSPIKE_L3 1643 0.45 1.10 0.24 183 URIBL_DBL_SPAM 1639 0.29 1.10 0.02 184 CHARSET_FARAWAY 1618 0.27 1.08 0.00 185 XM_SPF_Unknown 1614 0.65 1.08 0.51 186 NML_ADSP_CUSTOM_MED 1614 0.77 1.08 0.66 187 RCVD_IN_SORBS_DUL 1606 0.43 1.08 0.22 188 RELAYCOUNTRY_FI 1577 0.28 1.06 0.02 189 NO_FM_NAME_IP_HOSTN 1574 0.27 1.05 0.00 190 XMGenDplmaNmb 1531 0.87 1.03 0.82 191 FSL_THIS_IS_ADV 1510 0.53 1.01 0.37 192 TR_LOTS_OF_MONEY2 1500 0.60 1.00 0.47 193 T_MONEY_PERCENT 1500 0.60 1.00 0.47 194 DATE_IN_PAST_06_12 1494 0.29 1.00 0.05 195 ALL_TRUSTED 1475 9.10 0.99 11.83 196 XMSubGiftCard1 1464 0.28 0.98 0.04 197 XMSpecificSbj 1444 0.24 0.97 0.00 198 RELAYCOUNTRY_RU 1431 0.25 0.96 0.01 199 MSGID_SHORT 1415 0.25 0.95 0.01 200 TO_EQ_FM_DIRECT_MX 1405 0.25 0.94 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 395700 90.50 93.62 89.45 2 DKIM_SIGNED 354470 73.73 54.79 80.13 3 XM_DK_Pass 349266 72.08 51.74 78.95 4 DKIM_VALID 334242 68.60 48.01 75.55 5 XM_B_Unicode 318984 68.40 57.44 72.10 6 XMListUnsubscribeExists 260107 55.16 44.39 58.80 7 DKIM_VALID_AU 255713 52.10 35.22 57.80 8 BAYES_50 238368 51.33 43.76 53.88 9 DCC_CHECK_NEGATIVE 229228 43.10 17.29 51.82 10 DCC_CHECK 205187 55.18 81.26 46.38 11 XM_B_Unicode3 186005 40.11 34.38 42.05 12 HTML_FONT_LOW_CONTRAST 135435 28.92 23.91 30.61 13 DKIM_VALID_EF 124641 25.07 15.87 28.17 14 LOC_TINY_FONT_1 112908 24.67 22.13 25.52 15 T_TM2_M_HEADER_IN_MSG 111682 22.78 15.47 25.24 16 FVGT_m_MULTI_ODD 100657 21.92 19.46 22.75 17 MIME_HTML_ONLY 95747 28.94 50.56 21.64 18 T_KAM_HTML_FONT_INVALID 86749 18.35 14.64 19.61 19 BAYES_00 84787 14.87 2.15 19.17 20 XMSubLong 80557 19.11 21.77 18.21 21 MultiRelay 71047 15.52 13.92 16.06 22 TR_XM_DK_Bayes 65824 11.34 0.87 14.88 23 TR_XM_DK_Bayes1 63210 10.87 0.73 14.29 24 RCVD_IN_MSPIKE_H2 61736 12.54 8.35 13.96 25 XM_Body_Dirty_Words 59302 13.77 14.87 13.40 26 TR_XM_DK_Bayes2 57356 9.85 0.60 12.96 27 XM_Multi_Part_URI 55192 12.28 11.71 12.48 28 ALL_TRUSTED 52352 9.10 0.99 11.83 29 LOTS_OF_MONEY 47946 11.42 13.14 10.84 30 XM_B_Unsub 47939 13.52 21.48 10.84 31 RCVD_IN_MSPIKE_WL 45441 8.40 2.87 10.27 32 RCVD_IN_MSPIKE_H3 45409 8.40 2.86 10.26 33 RCVD_IN_RP_SAFE 44911 7.98 1.56 10.15 34 XM_Evil_Numbers_Gen 42671 9.15 7.68 9.65 35 RCVD_IN_RP_CERTIFIED 40493 7.14 1.18 9.15 36 LotsOfNums_01 38340 8.01 6.06 8.67 37 HTML_IMAGE_RATIO_02 36369 9.28 12.42 8.22 38 XM_DKIMWhitelistDomains 33026 5.58 0.01 7.47 39 XM_DK_Undo_02 32197 11.96 25.85 7.28 40 T_XMDrugObfuBody_14 31332 6.74 5.73 7.08 41 TooManyTo_001 30144 6.39 5.13 6.81 42 XM_SendGrid 29654 5.96 3.77 6.70 43 XM_H_Long_From01 28508 7.01 8.69 6.44 44 MIME_QP_LONG_LINE 28045 5.72 3.90 6.34 45 FSL_BULK_SIG 27700 13.50 34.95 6.26 46 HTML_IMAGE_RATIO_04 26388 5.60 4.51 5.96 47 BAYES_40 26162 5.64 4.82 5.91 48 RELAYCOUNTRY_META 24377 12.32 32.51 5.51 49 BAYES_60 24218 6.49 9.50 5.47 50 RCVD_IN_IADB_LISTED 23411 4.38 1.68 5.29 51 BOTNET_IPINHOSTNAME 23100 8.45 18.00 5.22 52 XM_B_Phish_Phrases 22858 5.00 4.49 5.17 53 XMStrtUSub 22164 5.27 6.05 5.01 54 RCVD_IN_IADB_SPF 20505 3.87 1.60 4.64 55 DKIM_INVALID 20228 5.13 6.78 4.57 56 T_TooManySym_01 19954 4.13 3.01 4.51 57 BAYES_20 19868 4.15 3.15 4.49 58 HTML_IMAGE_RATIO_06 19457 3.95 2.64 4.40 59 RCVD_IN_IADB_SENDERID 18354 3.50 1.56 4.15 60 MPART_ALT_DIFF 18293 4.31 4.84 4.14 61 RCVD_IN_IADB_DK 17923 3.42 1.57 4.05 62 XMSexyCombo_05 17710 5.74 10.89 4.00 63 XM_UncommonTLD01 17411 9.79 27.14 3.94 64 BAYES_99 17299 8.25 21.12 3.91 65 T_REMOTE_IMAGE 16448 8.19 21.44 3.72 66 FROM_EXCESS_BASE64 16224 3.57 3.30 3.67 67 XMSubMetaSx_00 15928 4.54 7.33 3.60 68 TR_XM_DK_SendGrid 15658 3.13 1.92 3.54 69 IN_ZIMBRA_NJ_WHITELIST 15358 2.60 0.03 3.47 70 XMNumbers 15110 4.52 7.79 3.42 71 XM_PDF 15092 2.68 0.50 3.41 72 BAYES_999 13929 6.40 16.05 3.15 73 RCVD_IN_IADB_VOUCHED 13904 2.45 0.42 3.14 74 MIME_HTML_MOSTLY 13103 3.30 4.30 2.96 75 BAYES_80 12257 4.25 8.62 2.77 76 UNPARSEABLE_RELAY 12211 2.44 1.51 2.76 77 TR_LOTS_OF_MONEY3 12121 3.21 4.58 2.74 78 XM_H_Trusted_IP 11791 1.99 0.00 2.67 79 ANY_BOUNCE_MESSAGE 11611 2.08 0.47 2.62 80 BOUNCE_MESSAGE 11610 2.08 0.47 2.62 81 BAYES_05 11608 2.47 2.02 2.62 82 XM_B_Unsub2 11241 2.29 1.54 2.54 83 HTML_MIME_NO_HTML_TAG 11220 8.94 27.90 2.54 84 TVD_RCVD_IP 11134 2.04 0.61 2.52 85 XM_DIRTYINTL 11099 3.36 5.88 2.51 86 MIME_HTML_ONLY_MULTI 10886 2.36 2.08 2.46 87 T_TooManySym_02 10357 1.84 0.35 2.34 88 XM_CamelCaseFrm001 10186 2.57 3.36 2.30 89 HTML_IMAGE_RATIO_08 10014 2.13 1.72 2.26 90 UNTRUSTED_Relay 9898 7.85 24.46 2.24 91 MAILING_LIST_MULTI 9214 1.79 0.93 2.08 92 T_XMHurry_00 9087 2.24 2.80 2.05 93 KHOP_HELO_FCRDNS 8909 5.98 17.74 2.01 94 TM2_M_URI_OPT_OUT 8878 2.19 2.73 2.01 95 BOTNET 8813 9.59 32.10 1.99 96 NO_DNS_FOR_FROM 8781 4.40 11.57 1.98 97 RCVD_IN_IADB_OPTIN 8614 1.52 0.26 1.95 98 CK_HELO_DYNAMIC_SPLIT_IP 8321 1.62 0.87 1.88 99 HELO_DYNAMIC_IPADDR2 8319 1.50 0.37 1.88 100 XM_SPF_SoftFail 8142 3.84 9.77 1.84 101 URI_TRY_3LD 7556 1.76 1.91 1.71 102 XM_B_SpammyTLD 7535 2.15 3.48 1.70 103 RELAYCOUNTRY_CA 7438 2.25 3.92 1.68 104 TR_DCC_Bayes_99 7382 5.41 16.51 1.67 105 INVALID_MSGID 7178 1.55 1.32 1.62 106 BAYES_95 7147 2.40 4.71 1.62 107 IN_HORDE_ADDRESS_BOOK 7055 1.20 0.05 1.59 108 XM_OfRef6 6807 1.88 2.88 1.54 109 XMDiploma_00 6661 1.57 1.77 1.51 110 RCVD_IN_BL_SPAMCOP_NET 6652 4.21 12.24 1.50 111 TO_MALFORMED 6585 2.35 4.90 1.49 112 XMBdyGiftCard01 6493 1.30 0.82 1.47 113 TR_MetaPhish_Combo_01 6425 1.24 0.60 1.45 114 XM_UB50 6389 3.92 11.25 1.44 115 TooManyTo_002 6317 1.23 0.64 1.43 116 DKIM_ADSP_NXDOMAIN 6279 6.61 22.00 1.42 117 XM_DK_Undo_01 6044 1.19 0.65 1.37 118 T_XMDrugObfuBody_08 5795 1.52 2.14 1.31 119 SUBJ_ALL_CAPS 5634 1.38 1.71 1.27 120 XMBody_17 5615 1.45 1.98 1.27 121 URI_HEX 5172 1.63 2.98 1.17 122 TM2_M_VERY_LONG_WORD 5164 1.22 1.37 1.17 123 TR_XM_PHPDW 5147 1.27 1.57 1.16 124 TR_XM_PHPForged 5073 1.24 1.53 1.15 125 TR_XM_FormFill2 5066 1.24 1.52 1.15 126 XM_H_PHPOS 5035 1.23 1.51 1.14 127 XMHTML_After_End 4969 1.34 1.97 1.12 128 TR_Symld_Words 4688 1.19 1.57 1.06 129 XM_H_Long_From02 4667 0.95 0.66 1.05 130 USER_IN_DEF_DKIM_WL 4622 0.78 0.00 1.04 131 XMStockSpam_06 4559 1.07 1.20 1.03 132 XMSubNoVowel 4496 0.98 0.85 1.02 133 RELAYCOUNTRY_DE 4415 1.22 1.89 1.00 134 RCVD_IN_MSPIKE_BL 4373 4.49 14.88 0.99 135 HELO_NODOT 4315 0.91 0.73 0.98 136 DIET_1 4292 0.95 0.88 0.97 137 DKIM_ADSP_CUSTOM_MED 4284 1.04 1.25 0.97 138 HELO_NO_DOMAIN 4263 0.90 0.72 0.96 139 XM_GoogleGroups 4207 0.78 0.27 0.95 140 TooManyTo_003 4176 0.83 0.49 0.94 141 XMPhish11 4172 0.91 0.81 0.94 142 XM_ProductURIs 4102 0.89 0.79 0.93 143 T_FILL_THIS_FORM_SHORT 4072 0.80 0.45 0.92 144 XMGappySubj_01 4061 0.74 0.23 0.92 145 XMCapTrack 3652 0.65 0.13 0.83 146 XMGenDplmaNmb 3624 0.87 1.03 0.82 147 RELAYCOUNTRY_GB 3614 1.40 3.12 0.82 148 HTTPS_HTTP_MISMATCH 3595 0.76 0.61 0.81 149 XMSubMetaSxObfu_03 3574 0.89 1.15 0.81 150 TR_XM_RelayPhish 3564 0.88 1.11 0.81 151 SpammyFromTLD_01 3547 1.15 2.20 0.80 152 XMBounce_01 3500 0.66 0.26 0.79 153 XMBody_95 3487 0.61 0.07 0.79 154 AC_FROM_MANY_DOTS 3463 0.59 0.01 0.78 155 TO_NO_BRKTS_HTML_ONLY 3368 0.62 0.19 0.76 156 XMBrknScrpt_02 3320 0.71 0.61 0.75 157 XMSexyCombo_01 3257 1.22 2.65 0.74 158 XM_D_omniadmin_Whitelist 3230 0.55 0.00 0.73 159 TooManyTo_004 3094 0.62 0.38 0.70 160 XMHTMLBadTable_001 3006 0.69 0.74 0.68 161 HTML_FONT_FACE_BAD 2965 0.70 0.79 0.67 162 FORGED_GMAIL_RCVD 2947 0.78 1.14 0.67 163 XMSubMetaI_00 2940 0.93 1.72 0.66 164 NML_ADSP_CUSTOM_MED 2917 0.77 1.08 0.66 165 TooManyTo_005 2607 0.51 0.29 0.59 166 XM_B_REG_HTML 2565 0.49 0.23 0.58 167 XMPhish30 2533 0.60 0.69 0.57 168 T_XMDrugObfuBody_00 2441 0.79 1.48 0.55 169 XM_RXBody 2382 0.48 0.30 0.54 170 USER_IN_WHITELIST 2373 0.40 0.00 0.54 171 RCVD_IN_MSPIKE_L4 2323 0.87 1.91 0.53 172 T_OBFU_PDF_ATTACH 2248 0.43 0.21 0.51 173 XM_SPF_Unknown 2244 0.65 1.08 0.51 174 T_TooManySym_03 2213 0.41 0.13 0.50 175 XMBody_78 2199 0.54 0.67 0.50 176 PLING_QUERY 2190 0.51 0.56 0.50 177 HTML_TAG_BALANCE_BODY 2172 0.49 0.49 0.49 178 RELAYCOUNTRY_AU 2171 0.46 0.35 0.49 179 XM_Body_Obfu01 2121 0.42 0.23 0.48 180 RDNS_DYNAMIC 2090 3.60 12.85 0.47 181 T_MONEY_PERCENT 2064 0.60 1.00 0.47 182 TR_LOTS_OF_MONEY2 2064 0.60 1.00 0.47 183 T_Symld_Words_02 2006 0.80 1.81 0.45 184 XM_shorewaves_Whitelist 1996 0.34 0.00 0.45 185 XMBSHREFv2 1932 0.43 0.42 0.44 186 XM_H_PHPMailer 1887 0.50 0.74 0.43 187 XMLngstWrd_00 1871 0.40 0.32 0.42 188 URI_NOVOWEL 1848 1.35 4.10 0.42 189 XM_B_COPY_HTML 1767 0.43 0.50 0.40 190 XMLngstWrd_01 1717 0.37 0.31 0.39 191 XM_ShortIntro_01 1717 0.33 0.17 0.39 192 MPART_ALT_DIFF_COUNT 1705 0.44 0.61 0.39 193 HTML_IMAGE_ONLY_20 1694 0.41 0.47 0.38 194 REMOVE_BEFORE_LINK 1677 0.36 0.30 0.38 195 FSL_THIS_IS_ADV 1626 0.53 1.01 0.37 196 XMSubMetaSx_01 1623 0.59 1.24 0.37 197 TM2_M_BODY_EMPTY 1622 0.31 0.14 0.37 198 FILL_THIS_FORM 1608 0.57 1.16 0.36 199 TM2_M_A_HREF_HREF 1578 0.34 0.30 0.36 200 T_XMDrugObfuBody_12 1574 0.32 0.20 0.36 ----------------------------------------------------------------------