Email: 604831 Autolearn: 0 AvgScore: 2.27 AvgScanTime: 2.14 sec Spam: 125630 Autolearn: 0 AvgScore: 13.96 AvgScanTime: 2.67 sec Ham: 479201 Autolearn: 0 AvgScore: -0.80 AvgScanTime: 2.00 sec Time Spent Running SA: 359.51 hours Time Spent Processing Spam: 93.00 hours Time Spent Processing Ham: 266.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 116967 89.58 93.10 88.66 2 DCC_CHECK 99219 50.09 78.98 42.51 3 XM_B_Unicode 83188 69.06 66.22 69.80 4 DKIM_SIGNED 81194 74.00 64.63 76.46 5 XM_DK_Pass 78238 72.44 62.28 75.10 6 DKIM_VALID 73099 68.96 58.19 71.78 7 XMListUnsubscribeExists 67678 52.07 53.87 51.60 8 BAYES_50 55903 52.99 44.50 55.22 9 DKIM_VALID_AU 54309 52.05 43.23 54.37 10 MIME_HTML_ONLY 51420 25.51 40.93 21.47 11 XM_B_Unicode3 45867 39.69 36.51 40.52 12 XM_DK_Undo_02 36838 11.65 29.32 7.02 13 HTML_FONT_LOW_CONTRAST 35521 27.70 28.27 27.55 14 LOC_TINY_FONT_1 33786 24.84 26.89 24.30 15 BAYES_99 31496 8.22 25.07 3.80 16 RELAYCOUNTRY_META 31079 9.64 24.74 5.69 17 XMSubLong 29256 22.34 23.29 22.09 18 XM_Body_Dirty_Words 29184 17.33 23.23 15.78 19 XM_UncommonTLD01 28931 7.55 23.03 3.49 20 FVGT_m_MULTI_ODD 28390 21.57 22.60 21.30 21 BOTNET 27812 6.17 22.14 1.98 22 FSL_BULK_SIG 27238 9.81 21.68 6.69 23 T_KAM_HTML_FONT_INVALID 26758 19.49 21.30 19.01 24 DKIM_VALID_EF 26483 27.04 21.08 28.60 25 TR_DCC_Bayes_99 24114 5.39 19.19 1.78 26 DCC_CHECK_NEGATIVE 23904 47.94 19.03 55.53 27 BAYES_999 22957 6.31 18.27 3.17 28 XM_B_Unsub 22393 13.81 17.82 12.76 29 UNTRUSTED_Relay 22228 4.77 17.69 1.38 30 BOTNET_IPINHOSTNAME 21743 7.11 17.31 4.44 31 MultiRelay 20961 18.51 16.68 18.98 32 T_TM2_M_HEADER_IN_MSG 20603 26.50 16.40 29.14 33 HTML_IMAGE_RATIO_02 18798 9.61 14.96 8.20 34 XM_Multi_Part_URI 18621 12.64 14.82 12.07 35 HTML_MIME_NO_HTML_TAG 18053 5.04 14.37 2.59 36 T_REMOTE_IMAGE 16486 5.94 13.12 4.06 37 KHOP_HELO_FCRDNS 15025 3.76 11.96 1.61 38 XMSexyCombo_05 14871 6.10 11.84 4.60 39 LOTS_OF_MONEY 14754 9.93 11.74 9.46 40 HTML_SHORT_LINK_IMG_1 14577 2.44 11.60 0.03 41 SpammyFromTLD_02 14318 2.71 11.40 0.44 42 TooManyTo_001 13586 9.49 10.81 9.14 43 XM_UB50 12657 2.69 10.07 0.75 44 BODY_URI_ONLY 11705 2.01 9.32 0.10 45 RCVD_IN_MSPIKE_H2 11508 11.43 9.16 12.03 46 BAYES_80 11311 3.81 9.00 2.44 47 XM_Evil_Numbers_Gen 11163 8.77 8.89 8.74 48 DKIM_ADSP_NXDOMAIN 11140 2.39 8.87 0.69 49 XM_H_Long_From01 10994 6.64 8.75 6.09 50 HTML_IMAGE_ONLY_08 10947 1.89 8.71 0.10 51 XMSubMetaSx_00 10695 5.61 8.51 4.85 52 BAYES_60 10400 6.00 8.28 5.41 53 RCVD_IN_MSPIKE_BL 10224 3.06 8.14 1.73 54 FROM_SUSPICIOUS_NTLD 10190 1.71 8.11 0.03 55 FROM_SUSPICIOUS_NTLD_FP 10150 1.70 8.08 0.02 56 HDRS_LCASE_IMGONLY 10021 1.67 7.98 0.01 57 RCVD_IN_BL_SPAMCOP_NET 10015 2.72 7.97 1.34 58 RDNS_DYNAMIC 9648 1.84 7.68 0.32 59 XM_B_Unsub2 9358 5.46 7.45 4.94 60 XMNumbers 9191 4.45 7.32 3.70 61 MPART_ALT_DIFF 8794 5.24 7.00 4.78 62 ALL_TRUSTED 8677 12.73 6.91 14.25 63 RCVD_IN_RP_RNBL 8610 1.50 6.85 0.10 64 XM_DIRTYINTL 8520 3.62 6.78 2.79 65 LotsOfNums_01 8466 7.56 6.74 7.78 66 HTML_TAG_BALANCE_CENTER 8186 1.43 6.52 0.10 67 DKIM_INVALID 8095 5.05 6.44 4.68 68 XM_B_Phish_Phrases 7738 6.31 6.16 6.35 69 FROM_EXCESS_BASE64 7599 3.80 6.05 3.22 70 TooManyTo_002 7259 3.51 5.78 2.91 71 NO_DNS_FOR_FROM 7000 2.32 5.57 1.47 72 SHORT_IMG_SUSP_NTLD 6431 1.06 5.12 0.00 73 TooManyTo_003 6349 2.56 5.05 1.91 74 HTML_IMAGE_RATIO_04 6289 5.60 5.01 5.76 75 XM_SendGrid 6219 5.88 4.95 6.12 76 BAYES_95 5996 2.18 4.77 1.50 77 MIME_HEADER_CTYPE_ONLY 5949 1.11 4.74 0.16 78 TR_Mismatch_TLD_02 5796 1.01 4.61 0.06 79 MIME_HTML_MOSTLY 5771 3.03 4.59 2.61 80 XM_SPF_SoftFail 5624 2.18 4.48 1.57 81 XM_B_SpammyTLD 5437 2.61 4.33 2.16 82 RCVD_IN_MSPIKE_L3 5334 1.84 4.25 1.21 83 XM_BadFromFormat 5279 0.95 4.20 0.10 84 TooManyTo_004 5277 1.95 4.20 1.36 85 SpammyFromTLD_01 5160 1.48 4.11 0.79 86 BOTNET_NORDNS 5145 0.90 4.10 0.07 87 RELAYCOUNTRY_FR 5123 1.07 4.08 0.28 88 MIME_QP_LONG_LINE 4817 5.14 3.83 5.48 89 RELAYCOUNTRY_CA 4792 2.12 3.81 1.67 90 PDS_OTHER_BAD_TLD 4439 1.09 3.53 0.45 91 XMStrtUSub 4409 4.77 3.51 5.10 92 MIME_HTML_ONLY_MULTI 4395 3.13 3.50 3.03 93 RCVD_IN_PSBL 4388 0.73 3.49 0.01 94 BODY_SINGLE_WORD 4380 0.73 3.49 0.01 95 XM_CamelCaseFrm001 4377 2.38 3.48 2.09 96 BODY_SINGLE_URI 4377 0.73 3.48 0.01 97 HDRS_MISSP 4285 0.71 3.41 0.01 98 TM2_M_URI_OPT_OUT 4245 2.34 3.38 2.07 99 RCVD_IN_MSPIKE_WL 4089 8.87 3.25 10.34 100 RCVD_IN_MSPIKE_H3 4089 8.87 3.25 10.34 101 HTML_FONT_SIZE_LARGE 3879 0.73 3.09 0.11 102 FROM_NTLD_LINKBAIT 3771 0.62 3.00 0.00 103 T_XMDrugObfuBody_08 3759 1.66 2.99 1.31 104 TooManyTo_005 3756 1.45 2.99 1.05 105 BAYES_40 3746 4.89 2.98 5.39 106 XMSexyCombo_01 3695 1.53 2.94 1.16 107 CANT_SEE_AD 3663 0.61 2.92 0.01 108 XM_URI_RBL 3633 0.80 2.89 0.25 109 TO_MALFORMED 3607 1.69 2.87 1.38 110 REPLYTO_WITHOUT_TO_CC 3600 0.63 2.87 0.05 111 HTML_IMAGE_RATIO_06 3520 3.76 2.80 4.01 112 URI_NOVOWEL 3430 0.82 2.73 0.32 113 RELAYCOUNTRY_DE 3366 0.86 2.68 0.38 114 XM_UB60 3216 0.59 2.56 0.07 115 XM_OfRef6 3211 1.82 2.56 1.62 116 XMDiploma_00 3189 1.76 2.54 1.56 117 RCVD_IN_MSPIKE_L5 3183 0.70 2.53 0.22 118 RELAYCOUNTRY_IN 3180 0.60 2.53 0.09 119 HTML_IMAGE_RATIO_08 3164 2.76 2.52 2.83 120 HTML_IMAGE_ONLY_12 3149 0.64 2.51 0.14 121 TR_Symld_Words 3093 1.83 2.46 1.67 122 MultiRelay_CC 3043 0.63 2.42 0.16 123 MultiRelay_Combo 3043 0.63 2.42 0.16 124 TO_EQ_FM_DOM_HTML_IMG 2964 0.49 2.36 0.00 125 SUSPICIOUS_RECIPS 2859 0.48 2.28 0.01 126 RELAYCOUNTRY_GB 2856 1.45 2.27 1.24 127 URI_HEX 2853 1.49 2.27 1.28 128 TR_LOTS_OF_MONEY2 2788 0.95 2.22 0.62 129 T_MONEY_PERCENT 2788 0.95 2.22 0.62 130 T_TooManySym_01 2747 5.25 2.19 6.05 131 DATE_IN_PAST_03_06 2733 0.54 2.18 0.12 132 TR_XM_DK_SendGrid 2647 3.06 2.11 3.31 133 TR_XM_INV_DKIM 2625 0.59 2.09 0.20 134 BAYES_20 2625 3.73 2.09 4.16 135 DIET_1 2461 0.72 1.96 0.39 136 TR_XM_RelayPhish 2454 1.10 1.95 0.88 137 XMGenDplmaNmb 2308 1.25 1.84 1.10 138 RCVD_IN_IADB_LISTED 2220 4.35 1.77 5.03 139 LongTLD 2215 0.50 1.76 0.16 140 TR_XM_PHPDW 2208 0.77 1.76 0.52 141 BAYES_00 2169 15.61 1.73 19.25 142 TM2_M_VERY_LONG_WORD 2157 1.42 1.72 1.35 143 TR_XM_PHPForged 2153 0.75 1.71 0.49 144 XMSexyCombo_04 2152 0.76 1.71 0.51 145 TR_XM_FormFill2 2140 0.74 1.70 0.49 146 XM_H_PHPOS 2128 0.74 1.69 0.48 147 XMSlimDrugH 2105 0.61 1.68 0.34 148 XM_UB99 2089 0.35 1.66 0.01 149 RCVD_IN_IADB_SPF 2055 3.78 1.64 4.34 150 RCVD_IN_RP_SAFE 2052 8.06 1.63 9.75 151 T_XMDrugObfuBody_14 2023 1.68 1.61 1.69 152 RCVD_IN_IADB_SENDERID 2016 3.33 1.60 3.78 153 URI_TRY_3LD 2008 1.33 1.60 1.26 154 RCVD_IN_IADB_DK 2008 3.28 1.60 3.72 155 SUBJ_ALL_CAPS 1987 1.65 1.58 1.67 156 XMSubMetaI_00 1960 0.86 1.56 0.68 157 XM_JunkDunk 1952 0.32 1.55 0.00 158 NO_FM_NAME_IP_HOSTN 1946 0.32 1.55 0.00 159 XMBody_17 1832 0.75 1.46 0.57 160 XM_SPF_Unknown 1731 0.81 1.38 0.67 161 HK_RANDOM_FROM 1707 0.37 1.36 0.11 162 RCVD_IN_MSPIKE_L4 1707 0.52 1.36 0.30 163 RCVD_IN_RP_CERTIFIED 1705 7.23 1.36 8.76 164 XMStockSpam_06 1691 1.18 1.35 1.13 165 XMHTML_After_End 1668 0.93 1.33 0.83 166 T_Symld_Words_02 1649 0.69 1.31 0.53 167 XM_Combo_Sbj 1637 0.54 1.30 0.34 168 T_XMDrugObfuBody_00 1623 0.82 1.29 0.70 169 XM_ProductURIs 1596 1.06 1.27 1.01 170 MPART_ALT_DIFF_COUNT 1595 0.54 1.27 0.34 171 NORDNS_LOW_CONTRAST 1585 0.27 1.26 0.00 172 XM_UB999 1583 0.27 1.26 0.01 173 BAYES_05 1579 2.29 1.26 2.56 174 TR_XM_DK_Bayes 1569 11.83 1.25 14.60 175 XMPhish11 1534 1.13 1.22 1.10 176 XM_UB80 1503 0.26 1.20 0.01 177 MAILING_LIST_MULTI 1488 2.40 1.18 2.72 178 XMSubMetaSx_01 1417 0.66 1.13 0.53 179 TR_XM_DK_Bayes1 1388 11.30 1.10 13.97 180 XMBdyGiftCard01 1366 1.31 1.09 1.37 181 URIBL_DBL_ABUSE_REDIR 1364 0.23 1.09 0.00 182 T_XMHurry_00 1342 0.66 1.07 0.56 183 RELAYCOUNTRY_SE 1342 0.24 1.07 0.03 184 DATE_IN_PAST_06_12 1335 0.27 1.06 0.06 185 DEAR_SOMETHING 1331 0.29 1.06 0.09 186 TR_Mismatch_TLD_01 1318 0.40 1.05 0.23 187 DKIM_ADSP_CUSTOM_MED 1306 0.92 1.04 0.89 188 HTML_EXTRA_CLOSE 1303 0.25 1.04 0.04 189 XMSubMetaSSx_00 1282 0.41 1.02 0.25 190 XMWghtMeta_00 1278 0.25 1.02 0.04 191 XM_DK_Undo_01 1267 1.43 1.01 1.55 192 XMPhish30 1259 0.56 1.00 0.45 193 XMPhish14 1259 0.57 1.00 0.46 194 XM_H_PHPMailer 1233 0.57 0.98 0.46 195 SUBJECT_NEEDS_ENCODING 1224 0.24 0.97 0.05 196 SUBJ_ILLEGAL_CHARS 1215 0.24 0.97 0.05 197 TR_XM_DK_Bayes2 1207 10.09 0.96 12.48 198 XMBrknScrpt_02 1189 0.89 0.95 0.88 199 FORGED_GMAIL_RCVD 1169 0.58 0.93 0.49 200 FVGT_m_MULTI_ODD_EMAIL 1168 0.21 0.93 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 424842 89.58 93.10 88.66 2 DKIM_SIGNED 366397 74.00 64.63 76.46 3 XM_DK_Pass 359889 72.44 62.28 75.10 4 DKIM_VALID 343971 68.96 58.19 71.78 5 XM_B_Unicode 334482 69.06 66.22 69.80 6 DCC_CHECK_NEGATIVE 266078 47.94 19.03 55.53 7 BAYES_50 264607 52.99 44.50 55.22 8 DKIM_VALID_AU 260530 52.05 43.23 54.37 9 XMListUnsubscribeExists 247258 52.07 53.87 51.60 10 DCC_CHECK 203732 50.09 78.98 42.51 11 XM_B_Unicode3 194188 39.69 36.51 40.52 12 T_TM2_M_HEADER_IN_MSG 139660 26.50 16.40 29.14 13 DKIM_VALID_EF 137042 27.04 21.08 28.60 14 HTML_FONT_LOW_CONTRAST 132043 27.70 28.27 27.55 15 LOC_TINY_FONT_1 116450 24.84 26.89 24.30 16 XMSubLong 105847 22.34 23.29 22.09 17 MIME_HTML_ONLY 102893 25.51 40.93 21.47 18 FVGT_m_MULTI_ODD 102065 21.57 22.60 21.30 19 BAYES_00 92235 15.61 1.73 19.25 20 T_KAM_HTML_FONT_INVALID 91108 19.49 21.30 19.01 21 MultiRelay 90968 18.51 16.68 18.98 22 XM_Body_Dirty_Words 75622 17.33 23.23 15.78 23 TR_XM_DK_Bayes 69974 11.83 1.25 14.60 24 ALL_TRUSTED 68308 12.73 6.91 14.25 25 TR_XM_DK_Bayes1 66962 11.30 1.10 13.97 26 XM_B_Unsub 61151 13.81 17.82 12.76 27 TR_XM_DK_Bayes2 59811 10.09 0.96 12.48 28 XM_Multi_Part_URI 57855 12.64 14.82 12.07 29 RCVD_IN_MSPIKE_H2 57641 11.43 9.16 12.03 30 RCVD_IN_MSPIKE_WL 49570 8.87 3.25 10.34 31 RCVD_IN_MSPIKE_H3 49568 8.87 3.25 10.34 32 RCVD_IN_RP_SAFE 46710 8.06 1.63 9.75 33 LOTS_OF_MONEY 45319 9.93 11.74 9.46 34 TooManyTo_001 43816 9.49 10.81 9.14 35 RCVD_IN_RP_CERTIFIED 42001 7.23 1.36 8.76 36 XM_Evil_Numbers_Gen 41883 8.77 8.89 8.74 37 HTML_IMAGE_RATIO_02 39298 9.61 14.96 8.20 38 LotsOfNums_01 37264 7.56 6.74 7.78 39 XM_DKIMWhitelistDomains 34555 5.72 0.05 7.21 40 XM_DK_Undo_02 33616 11.65 29.32 7.02 41 FSL_BULK_SIG 32082 9.81 21.68 6.69 42 XM_B_Phish_Phrases 30443 6.31 6.16 6.35 43 XM_SendGrid 29350 5.88 4.95 6.12 44 XM_H_Long_From01 29192 6.64 8.75 6.09 45 T_TooManySym_01 28987 5.25 2.19 6.05 46 HTML_IMAGE_RATIO_04 27591 5.60 5.01 5.76 47 RELAYCOUNTRY_META 27250 9.64 24.74 5.69 48 MIME_QP_LONG_LINE 26256 5.14 3.83 5.48 49 BAYES_60 25911 6.00 8.28 5.41 50 BAYES_40 25807 4.89 2.98 5.39 51 XMStrtUSub 24427 4.77 3.51 5.10 52 RCVD_IN_IADB_LISTED 24086 4.35 1.77 5.03 53 XM_B_Unsub2 23673 5.46 7.45 4.94 54 XMSubMetaSx_00 23255 5.61 8.51 4.85 55 MPART_ALT_DIFF 22921 5.24 7.00 4.78 56 DKIM_INVALID 22426 5.05 6.44 4.68 57 XMSexyCombo_05 22020 6.10 11.84 4.60 58 XM_PDF 22013 3.77 0.61 4.59 59 BOTNET_IPINHOSTNAME 21253 7.11 17.31 4.44 60 RCVD_IN_IADB_SPF 20780 3.78 1.64 4.34 61 BAYES_20 19922 3.73 2.09 4.16 62 T_REMOTE_IMAGE 19439 5.94 13.12 4.06 63 HTML_IMAGE_RATIO_06 19239 3.76 2.80 4.01 64 BAYES_99 18229 8.22 25.07 3.80 65 RCVD_IN_IADB_SENDERID 18121 3.33 1.60 3.78 66 RCVD_IN_IADB_DK 17813 3.28 1.60 3.72 67 XMNumbers 17716 4.45 7.32 3.70 68 IN_ZIMBRA_NJ_WHITELIST 16743 2.77 0.02 3.49 69 XM_UncommonTLD01 16733 7.55 23.03 3.49 70 TR_XM_DK_SendGrid 15860 3.06 2.11 3.31 71 RCVD_IN_IADB_VOUCHED 15620 2.69 0.50 3.26 72 FROM_EXCESS_BASE64 15411 3.80 6.05 3.22 73 BAYES_999 15201 6.31 18.27 3.17 74 T_TooManySym_02 15156 2.63 0.58 3.16 75 MIME_HTML_ONLY_MULTI 14507 3.13 3.50 3.03 76 TooManyTo_002 13958 3.51 5.78 2.91 77 HTML_IMAGE_RATIO_08 13552 2.76 2.52 2.83 78 XM_DIRTYINTL 13365 3.62 6.78 2.79 79 MAILING_LIST_MULTI 13038 2.40 1.18 2.72 80 MIME_HTML_MOSTLY 12527 3.03 4.59 2.61 81 HTML_MIME_NO_HTML_TAG 12406 5.04 14.37 2.59 82 BAYES_05 12248 2.29 1.26 2.56 83 BAYES_80 11714 3.81 9.00 2.44 84 UNPARSEABLE_RELAY 10731 1.93 0.77 2.24 85 XM_B_SpammyTLD 10332 2.61 4.33 2.16 86 XM_H_Trusted_IP 10072 1.67 0.00 2.10 87 XM_CamelCaseFrm001 10038 2.38 3.48 2.09 88 RCVD_IN_IADB_OPTIN 9978 1.72 0.35 2.08 89 TM2_M_URI_OPT_OUT 9923 2.34 3.38 2.07 90 BOTNET 9507 6.17 22.14 1.98 91 TooManyTo_003 9162 2.56 5.05 1.91 92 TR_DCC_Bayes_99 8510 5.39 19.19 1.78 93 ANY_BOUNCE_MESSAGE 8303 1.45 0.40 1.73 94 BOUNCE_MESSAGE 8294 1.45 0.39 1.73 95 RCVD_IN_MSPIKE_BL 8278 3.06 8.14 1.73 96 T_XMDrugObfuBody_14 8118 1.68 1.61 1.69 97 SUBJ_ALL_CAPS 8021 1.65 1.58 1.67 98 RELAYCOUNTRY_CA 8018 2.12 3.81 1.67 99 TR_Symld_Words 8001 1.83 2.46 1.67 100 XM_OfRef6 7787 1.82 2.56 1.62 101 KHOP_HELO_FCRDNS 7734 3.76 11.96 1.61 102 INVALID_MSGID 7599 1.31 0.26 1.59 103 TVD_RCVD_IP 7541 1.35 0.47 1.57 104 XM_SPF_SoftFail 7540 2.18 4.48 1.57 105 XMDiploma_00 7474 1.76 2.54 1.56 106 IN_HORDE_ADDRESS_BOOK 7412 1.24 0.09 1.55 107 XM_DK_Undo_01 7411 1.43 1.01 1.55 108 HELO_NODOT 7264 1.30 0.50 1.52 109 HELO_NO_DOMAIN 7221 1.30 0.50 1.51 110 BAYES_95 7205 2.18 4.77 1.50 111 NO_DNS_FOR_FROM 7029 2.32 5.57 1.47 112 TO_MALFORMED 6615 1.69 2.87 1.38 113 XMGappySubj_01 6606 1.16 0.31 1.38 114 UNTRUSTED_Relay 6598 4.77 17.69 1.38 115 XMBdyGiftCard01 6542 1.31 1.09 1.37 116 TooManyTo_004 6521 1.95 4.20 1.36 117 TM2_M_VERY_LONG_WORD 6453 1.42 1.72 1.35 118 RCVD_IN_BL_SPAMCOP_NET 6445 2.72 7.97 1.34 119 CK_HELO_DYNAMIC_SPLIT_IP 6345 1.08 0.15 1.32 120 HELO_DYNAMIC_IPADDR2 6343 1.07 0.09 1.32 121 T_XMDrugObfuBody_08 6300 1.66 2.99 1.31 122 URI_HEX 6129 1.49 2.27 1.28 123 URI_TRY_3LD 6057 1.33 1.60 1.26 124 RELAYCOUNTRY_GB 5929 1.45 2.27 1.24 125 RCVD_IN_MSPIKE_L3 5800 1.84 4.25 1.21 126 XMCapTrack 5603 0.98 0.25 1.17 127 XM_GoogleGroups 5600 1.00 0.35 1.17 128 XM_H_Long_From02 5578 1.11 0.90 1.16 129 USER_IN_DEF_DKIM_WL 5565 0.92 0.01 1.16 130 XMSexyCombo_01 5542 1.53 2.94 1.16 131 XMStockSpam_06 5428 1.18 1.35 1.13 132 T_FILL_THIS_FORM_SHORT 5382 1.06 0.82 1.12 133 XMPhish11 5272 1.13 1.22 1.10 134 XMGenDplmaNmb 5258 1.25 1.84 1.10 135 HTML_FONT_FACE_BAD 5189 1.01 0.75 1.08 136 TooManyTo_005 5038 1.45 2.99 1.05 137 TR_MetaPhish_Combo_01 4933 0.90 0.40 1.03 138 XMSubMetaSxObfu_03 4887 0.98 0.85 1.02 139 XM_ProductURIs 4836 1.06 1.27 1.01 140 XMNoVowels 4772 0.91 0.58 1.00 141 DKIM_ADSP_CUSTOM_MED 4281 0.92 1.04 0.89 142 TR_XM_RelayPhish 4226 1.10 1.95 0.88 143 XMBrknScrpt_02 4208 0.89 0.95 0.88 144 XMHTML_After_End 3974 0.93 1.33 0.83 145 SpammyFromTLD_01 3791 1.48 4.11 0.79 146 XM_UB50 3586 2.69 10.07 0.75 147 TM2_M_A_HREF_HREF 3402 0.75 0.92 0.71 148 T_XMDrugObfuBody_00 3336 0.82 1.29 0.70 149 DKIM_ADSP_NXDOMAIN 3309 2.39 8.87 0.69 150 T_TooManySym_03 3302 0.59 0.19 0.69 151 XMBody_95 3277 0.57 0.13 0.68 152 XMSubMetaI_00 3240 0.86 1.56 0.68 153 XM_SPF_Unknown 3196 0.81 1.38 0.67 154 FROM_GOV_DKIM_AU 3181 0.59 0.29 0.66 155 FILL_THIS_FORM 3170 0.65 0.63 0.66 156 NML_ADSP_CUSTOM_MED 3083 0.70 0.90 0.64 157 RELAYCOUNTRY_NL 3068 0.59 0.42 0.64 158 PLING_QUERY 3037 0.69 0.93 0.63 159 XM_B_REG_HTML 2992 0.57 0.37 0.62 160 T_OBFU_PDF_ATTACH 2951 0.52 0.18 0.62 161 TR_LOTS_OF_MONEY2 2949 0.95 2.22 0.62 162 T_MONEY_PERCENT 2949 0.95 2.22 0.62 163 AC_DIV_BONANZA 2940 0.50 0.07 0.61 164 XMHTMLBadTable_001 2885 0.56 0.40 0.60 165 HTTPS_HTTP_MISMATCH 2787 0.56 0.46 0.58 166 HTML_TAG_BALANCE_BODY 2748 0.57 0.54 0.57 167 XMBody_17 2726 0.75 1.46 0.57 168 T_XMHurry_00 2674 0.66 1.07 0.56 169 XMBody_78 2646 0.60 0.77 0.55 170 FROM_GOV_SPOOF 2631 0.48 0.21 0.55 171 FILL_THIS_FORM_LONG 2600 0.55 0.57 0.54 172 XMSubMetaSx_01 2560 0.66 1.13 0.53 173 XMSubNoVowel 2559 0.51 0.40 0.53 174 T_Symld_Words_02 2553 0.69 1.31 0.53 175 XMMoneyMeta_00 2548 0.59 0.79 0.53 176 REMOVE_BEFORE_LINK 2530 0.56 0.69 0.53 177 T_FILL_THIS_FORM_LOAN 2476 0.49 0.40 0.52 178 TR_XM_PHPDW 2471 0.77 1.76 0.52 179 XM_ShortIntro_01 2455 0.50 0.45 0.51 180 XMSexyCombo_04 2442 0.76 1.71 0.51 181 XMSubMetaSxObfu_02 2364 0.50 0.50 0.49 182 USER_IN_WHITELIST 2355 0.39 0.00 0.49 183 TR_XM_FormFill2 2354 0.74 1.70 0.49 184 TR_XM_PHPForged 2353 0.75 1.71 0.49 185 FORGED_GMAIL_RCVD 2339 0.58 0.93 0.49 186 XM_H_PHPOS 2322 0.74 1.69 0.48 187 XM_H_PHPMailer 2213 0.57 0.98 0.46 188 XMBSHREFv2 2196 0.44 0.37 0.46 189 XMPhish14 2194 0.57 1.00 0.46 190 PDS_OTHER_BAD_TLD 2160 1.09 3.53 0.45 191 XMPhish30 2138 0.56 1.00 0.45 192 XMLKML 2131 0.35 0.00 0.44 193 SpammyFromTLD_02 2100 2.71 11.40 0.44 194 TM2_M_BODY_EMPTY 2085 0.36 0.07 0.44 195 RELAYCOUNTRY_AU 2068 0.42 0.38 0.43 196 XMLngstWrd_00 2045 0.43 0.44 0.43 197 AC_FROM_MANY_DOTS 2021 0.34 0.02 0.42 198 XM_B_COPY_HTML 2020 0.51 0.86 0.42 199 MISSING_HEADERS 1998 0.48 0.73 0.42 200 FSL_THIS_IS_ADV 1970 0.39 0.33 0.41 ----------------------------------------------------------------------