Email: 667044 Autolearn: 0 AvgScore: 1.45 AvgScanTime: 3.94 sec Spam: 120165 Autolearn: 0 AvgScore: 11.73 AvgScanTime: 5.84 sec Ham: 546879 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 3.52 sec Time Spent Running SA: 729.65 hours Time Spent Processing Spam: 195.02 hours Time Spent Processing Ham: 534.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114326 90.25 95.14 89.18 2 DKIM_SIGNED 102358 77.83 85.18 76.21 3 XM_DK_Pass 98755 76.25 82.18 74.95 4 RELAYCOUNTRY_US 94798 82.44 78.89 83.23 5 DCC_CHECK 93957 47.26 78.19 40.46 6 XM_B_Unicode 92723 72.43 77.16 71.39 7 XMListUnsubscribeExists 84277 55.04 70.13 51.73 8 DKIM_VALID 82858 70.50 68.95 70.84 9 DKIM_VALID_AU 59952 50.73 49.89 50.92 10 XM_DK_Undo_02 54371 13.93 45.25 7.05 11 XM_B_Unicode3 53801 40.87 44.77 40.02 12 BAYES_50 51544 51.95 42.89 53.94 13 LOC_TINY_FONT_1 44794 25.40 37.28 22.79 14 HTML_FONT_LOW_CONTRAST 38844 27.04 32.33 25.88 15 MIME_HTML_ONLY 38687 22.88 32.19 20.84 16 FVGT_m_MULTI_ODD 34852 23.23 29.00 21.96 17 BAYES_99 34628 7.76 28.82 3.14 18 XMSubLong 34534 21.24 28.74 19.60 19 DKIM_VALID_EF 33313 26.60 27.72 26.35 20 T_KAM_HTML_FONT_INVALID 29486 19.76 24.54 18.71 21 BOTNET 27523 6.57 22.90 2.98 22 BAYES_999 27131 6.03 22.58 2.39 23 TR_DCC_Bayes_99 26734 5.22 22.25 1.48 24 RELAYCOUNTRY_META 25344 8.52 21.09 5.75 25 T_TM2_M_HEADER_IN_MSG 24454 27.37 20.35 28.91 26 DCC_CHECK_NEGATIVE 24163 50.52 20.11 57.20 27 XM_Body_Dirty_Words 23434 13.02 19.50 11.59 28 XM_Multi_Part_URI 22070 12.09 18.37 10.71 29 BOTNET_IPINHOSTNAME 20616 6.71 17.16 4.41 30 DKIM_INVALID 19500 7.32 16.23 5.37 31 XM_B_Unsub 17055 11.39 14.19 10.77 32 XM_UncommonTLD01 16534 5.09 13.76 3.18 33 XM_Evil_Numbers_Gen 15429 10.62 12.84 10.13 34 HTML_IMAGE_RATIO_02 15311 7.46 12.74 6.30 35 UNTRUSTED_Relay 15183 3.56 12.64 1.56 36 FSL_BULK_SIG 14898 8.44 12.40 7.57 37 XM_B_Phish_Phrases 14657 9.24 12.20 8.58 38 LOTS_OF_MONEY 13716 7.94 11.41 7.17 39 NO_DNS_FOR_FROM 13365 4.36 11.12 2.87 40 LotsOfNums_01 13119 9.19 10.92 8.81 41 XMSexyCombo_05 11746 4.54 9.77 3.39 42 RCVD_IN_MSPIKE_H2 11164 11.47 9.29 11.95 43 TooManyTo_001 9831 8.85 8.18 8.99 44 XM_UB50 8377 1.97 6.97 0.88 45 BAYES_80 8372 3.65 6.97 2.93 46 MPART_ALT_DIFF 8125 5.52 6.76 5.25 47 XM_H_Long_From01 7732 6.05 6.43 5.97 48 HTML_IMAGE_RATIO_04 7603 4.99 6.33 4.70 49 MIME_QP_LONG_LINE 7529 6.58 6.27 6.65 50 XM_SendGrid 7464 6.64 6.21 6.73 51 XMSubMetaSx_00 7122 3.31 5.93 2.74 52 XMNumbers 6813 3.51 5.67 3.03 53 BAYES_60 6602 5.48 5.49 5.47 54 PDS_OTHER_BAD_TLD 6408 1.11 5.33 0.18 55 XM_SPF_SoftFail 5678 2.42 4.73 1.91 56 XM_CamelCaseFrm001 5659 2.53 4.71 2.05 57 MIME_HTML_MOSTLY 5626 2.59 4.68 2.14 58 RELAYCOUNTRY_CA 5596 2.30 4.66 1.79 59 T_TooManySym_01 5587 4.38 4.65 4.32 60 RCVD_IN_MSPIKE_BL 5456 2.11 4.54 1.57 61 FROM_SUSPICIOUS_NTLD 5406 0.84 4.50 0.03 62 XM_B_SpammyTLD 5392 2.09 4.49 1.56 63 SpammyFromTLD_02 5302 1.07 4.41 0.33 64 FROM_SUSPICIOUS_NTLD_FP 5292 0.81 4.40 0.03 65 RCVD_IN_MSPIKE_L3 5200 1.81 4.33 1.25 66 TM2_M_URI_OPT_OUT 5135 3.08 4.27 2.81 67 KHOP_HELO_FCRDNS 4625 2.45 3.85 2.14 68 RCVD_IN_MSPIKE_WL 4513 8.78 3.76 9.89 69 RCVD_IN_MSPIKE_H3 4513 8.78 3.76 9.89 70 XM_DIRTYINTL 4455 1.16 3.71 0.60 71 RCVD_IN_BL_SPAMCOP_NET 4377 1.64 3.64 1.21 72 BAYES_95 4363 2.09 3.63 1.75 73 XM_URI_RBL 4300 0.78 3.58 0.17 74 T_XMDrugObfuBody_08 4096 1.92 3.41 1.59 75 HTML_MIME_NO_HTML_TAG 4010 2.40 3.34 2.20 76 XMStrtUSub 3968 4.02 3.30 4.18 77 HTML_IMAGE_RATIO_06 3937 3.79 3.28 3.91 78 MIME_HTML_ONLY_MULTI 3901 3.33 3.25 3.35 79 BAYES_40 3878 4.87 3.23 5.23 80 DATE_IN_PAST_06_12 3696 0.71 3.08 0.19 81 RELAYCOUNTRY_FR 3674 0.77 3.06 0.26 82 XM_B_Unsub2 3596 2.14 2.99 1.95 83 FROM_EXCESS_BASE64 3550 2.91 2.95 2.90 84 TR_XM_INV_DKIM 3432 0.59 2.86 0.10 85 RELAYCOUNTRY_GB 3405 1.48 2.83 1.18 86 T_REMOTE_IMAGE 3375 3.78 2.81 4.00 87 BAYES_20 3335 3.96 2.78 4.22 88 XMNoVowels 3292 2.15 2.74 2.02 89 RCVD_IN_RP_SAFE 3235 6.97 2.69 7.91 90 T_XMDrugObfuBody_14 3176 2.13 2.64 2.02 91 LongTLD 3166 0.62 2.63 0.18 92 RCVD_IN_RP_RNBL 3052 0.50 2.54 0.06 93 XM_OfRef6 2997 1.42 2.49 1.19 94 HTML_IMAGE_RATIO_08 2856 2.30 2.38 2.28 95 SpammyFromTLD_01 2855 1.08 2.38 0.80 96 TR_XM_PHPDW 2814 1.19 2.34 0.94 97 TR_XM_PHPForged 2757 1.17 2.29 0.93 98 TR_XM_FormFill2 2749 1.17 2.29 0.93 99 XM_H_PHPOS 2740 1.17 2.28 0.92 100 URI_HEX 2699 1.46 2.25 1.29 101 BAYES_00 2698 14.53 2.25 17.22 102 TM2_M_VERY_LONG_WORD 2674 1.28 2.23 1.08 103 RCVD_IN_IADB_LISTED 2516 5.23 2.09 5.92 104 TR_XM_DK_SendGrid 2494 3.15 2.08 3.38 105 XMDiploma_00 2429 1.54 2.02 1.44 106 SUBJ_ALL_CAPS 2407 1.68 2.00 1.61 107 XMSexyCombo_01 2391 0.89 1.99 0.64 108 RCVD_IN_IADB_SPF 2353 4.57 1.96 5.14 109 URIBL_SBL_A 2342 0.43 1.95 0.09 110 ALL_TRUSTED 2321 11.02 1.93 13.02 111 MAILING_LIST_MULTI 2315 2.68 1.93 2.84 112 RCVD_IN_IADB_SENDERID 2294 4.00 1.91 4.46 113 RCVD_IN_IADB_DK 2292 3.98 1.91 4.43 114 RCVD_IN_RP_CERTIFIED 2253 6.13 1.87 7.06 115 TR_Mismatch_TLD_02 2231 0.41 1.86 0.09 116 URI_TRY_3LD 2140 1.41 1.78 1.33 117 XM_DK_Undo_01 2067 1.99 1.72 2.05 118 TR_XM_DK_Bayes 2009 10.07 1.67 11.92 119 XMStockSpam_06 1990 0.88 1.66 0.71 120 XMPhish08 1891 0.78 1.57 0.60 121 XM_H_PHPMailer 1881 0.72 1.57 0.54 122 TR_XM_MaxBayes 1880 0.29 1.56 0.01 123 XMPhish30 1852 0.61 1.54 0.40 124 TR_XM_RelayPhish 1847 0.47 1.54 0.23 125 BAYES_05 1835 2.45 1.53 2.65 126 RDNS_DYNAMIC 1819 0.55 1.51 0.34 127 XM_H_TOP 1813 0.27 1.51 0.00 128 XMGenDplmaNmb 1800 1.08 1.50 0.99 129 XMHTML_After_End 1782 0.87 1.48 0.73 130 TR_MetaPhish_Combo_01 1763 1.39 1.47 1.37 131 BOTNET_NORDNS 1760 0.29 1.46 0.03 132 DKIM_ADSP_CUSTOM_MED 1754 1.19 1.46 1.14 133 XM_H_PHPOS_M 1743 0.39 1.45 0.16 134 XMBody_17 1735 0.66 1.44 0.49 135 TR_Symld_Words 1715 1.20 1.43 1.15 136 RCVD_IN_PSBL 1692 0.29 1.41 0.04 137 DATE_IN_PAST_03_06 1675 0.36 1.39 0.13 138 TR_Mismatch_TLD_01 1651 0.46 1.37 0.26 139 DKIM_ADSP_NXDOMAIN 1634 0.45 1.36 0.25 140 MISSING_HEADERS 1627 0.77 1.35 0.64 141 XMBdyGiftCard01 1619 1.04 1.35 0.98 142 RELAYCOUNTRY_IN 1614 0.32 1.34 0.10 143 XMSubMetaI_00 1593 0.87 1.33 0.77 144 RELAYCOUNTRY_DE 1587 0.57 1.32 0.40 145 FORGED_GMAIL_RCVD 1580 0.69 1.31 0.55 146 T_XMHurry_00 1560 0.67 1.30 0.54 147 XM_ProductURIs 1540 0.70 1.28 0.57 148 XMMoneyMeta_00 1431 0.69 1.19 0.58 149 NML_ADSP_CUSTOM_MED 1421 0.85 1.18 0.77 150 UNPARSEABLE_RELAY 1405 1.94 1.17 2.11 151 HTTPS_HTTP_MISMATCH 1403 1.02 1.17 0.99 152 TR_XM_DK_Bayes1 1398 9.45 1.16 11.27 153 XM_H_MailChimp 1393 0.41 1.16 0.24 154 XM_UB99 1379 0.21 1.15 0.00 155 T_XMDrugObfuBody_00 1355 0.76 1.13 0.67 156 HTML_IMAGE_ONLY_04 1349 0.24 1.12 0.05 157 HTML_SHORT_LINK_IMG_1 1308 0.21 1.09 0.01 158 HTML_TAG_BALANCE_CENTER 1307 0.32 1.09 0.15 159 RELAYCOUNTRY_UA 1300 0.20 1.08 0.01 160 XM_UB60 1279 0.24 1.06 0.06 161 TR_XM_DK_Bayes2 1262 8.28 1.05 9.87 162 XM_H_Long_From02 1234 1.17 1.03 1.20 163 TR_XM_MaxSPIKE 1229 0.23 1.02 0.05 164 XM_PDF 1199 3.71 1.00 4.31 165 TR_LOTS_OF_MONEY3 1194 0.47 0.99 0.36 166 TR_LOTS_OF_MONEY1 1161 0.20 0.97 0.04 167 XMHTMLBadTable_001 1142 0.56 0.95 0.48 168 REMOVE_BEFORE_LINK 1140 0.39 0.95 0.27 169 HTML_SHORT_CENTER 1126 0.17 0.94 0.00 170 T_Symld_Words_02 1126 0.51 0.94 0.42 171 T_TooManySym_02 1123 1.98 0.93 2.21 172 DATE_IN_PAST_12_24 1082 0.20 0.90 0.05 173 RELAYCOUNTRY_AT 1081 0.29 0.90 0.15 174 DIET_1 1079 0.42 0.90 0.32 175 T_MONEY_PERCENT 1069 0.44 0.89 0.35 176 TR_LOTS_OF_MONEY2 1069 0.44 0.89 0.35 177 XM_UB80 1065 0.18 0.89 0.02 178 XMBrknScrpt_02 1063 0.72 0.88 0.69 179 URIBL_BLACK 1043 0.18 0.87 0.03 180 XM_SPF_Unknown 1035 0.68 0.86 0.65 181 T_FILL_THIS_FORM_SHORT 1005 0.80 0.84 0.80 182 THIS_AD 1000 0.33 0.83 0.22 183 HELO_STATIC_HOST 999 0.26 0.83 0.14 184 MPART_ALT_DIFF_COUNT 989 0.44 0.82 0.36 185 XM_UB999 982 0.15 0.82 0.00 186 HK_RANDOM_REPLYTO 979 0.33 0.81 0.22 187 TM2_M_A_HREF_HREF 970 0.43 0.81 0.35 188 XMSexyCombo_04 931 0.23 0.77 0.12 189 HTML_TAG_BALANCE_BODY 930 0.51 0.77 0.45 190 XMPhish14 927 0.42 0.77 0.34 191 NORDNS_LOW_CONTRAST 917 0.14 0.76 0.00 192 XMBody_78 886 0.42 0.74 0.35 193 URIBL_DBL_SPAM 879 0.14 0.73 0.01 194 RELAYCOUNTRY_AU 875 0.59 0.73 0.56 195 HTML_IMAGE_ONLY_28 874 0.50 0.73 0.45 196 TooManyTo_002 854 2.16 0.71 2.47 197 RELAYCOUNTRY_NL 850 0.36 0.71 0.28 198 NUMERIC_HTTP_ADDR 835 0.38 0.69 0.31 199 XM_BadFromFormat 819 0.25 0.68 0.15 200 RELAYCOUNTRY_CZ 798 0.14 0.66 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 487714 90.25 95.14 89.18 2 RELAYCOUNTRY_US 455146 82.44 78.89 83.23 3 DKIM_SIGNED 416777 77.83 85.18 76.21 4 XM_DK_Pass 409867 76.25 82.18 74.95 5 XM_B_Unicode 390413 72.43 77.16 71.39 6 DKIM_VALID 387425 70.50 68.95 70.84 7 DCC_CHECK_NEGATIVE 312802 50.52 20.11 57.20 8 BAYES_50 295008 51.95 42.89 53.94 9 XMListUnsubscribeExists 282882 55.04 70.13 51.73 10 DKIM_VALID_AU 278461 50.73 49.89 50.92 11 DCC_CHECK 221281 47.26 78.19 40.46 12 XM_B_Unicode3 218844 40.87 44.77 40.02 13 T_TM2_M_HEADER_IN_MSG 158092 27.37 20.35 28.91 14 DKIM_VALID_EF 144113 26.60 27.72 26.35 15 HTML_FONT_LOW_CONTRAST 141533 27.04 32.33 25.88 16 LOC_TINY_FONT_1 124660 25.40 37.28 22.79 17 FVGT_m_MULTI_ODD 120114 23.23 29.00 21.96 18 MIME_HTML_ONLY 113958 22.88 32.19 20.84 19 XMSubLong 107173 21.24 28.74 19.60 20 T_KAM_HTML_FONT_INVALID 102334 19.76 24.54 18.71 21 BAYES_00 94196 14.53 2.25 17.22 22 ALL_TRUSTED 71182 11.02 1.93 13.02 23 RCVD_IN_MSPIKE_H2 65340 11.47 9.29 11.95 24 TR_XM_DK_Bayes 65181 10.07 1.67 11.92 25 XM_Body_Dirty_Words 63390 13.02 19.50 11.59 26 TR_XM_DK_Bayes1 61624 9.45 1.16 11.27 27 XM_B_Unsub 58901 11.39 14.19 10.77 28 XM_Multi_Part_URI 58581 12.09 18.37 10.71 29 XM_Evil_Numbers_Gen 55404 10.62 12.84 10.13 30 RCVD_IN_MSPIKE_WL 54059 8.78 3.76 9.89 31 RCVD_IN_MSPIKE_H3 54059 8.78 3.76 9.89 32 TR_XM_DK_Bayes2 53983 8.28 1.05 9.87 33 TooManyTo_001 49172 8.85 8.18 8.99 34 LotsOfNums_01 48153 9.19 10.92 8.81 35 XM_B_Phish_Phrases 46945 9.24 12.20 8.58 36 RCVD_IN_RP_SAFE 43269 6.97 2.69 7.91 37 FSL_BULK_SIG 41383 8.44 12.40 7.57 38 LOTS_OF_MONEY 39234 7.94 11.41 7.17 39 RCVD_IN_RP_CERTIFIED 38604 6.13 1.87 7.06 40 XM_DK_Undo_02 38529 13.93 45.25 7.05 41 XM_SendGrid 36823 6.64 6.21 6.73 42 MIME_QP_LONG_LINE 36348 6.58 6.27 6.65 43 HTML_IMAGE_RATIO_02 34432 7.46 12.74 6.30 44 XM_DKIMWhitelistDomains 34411 5.16 0.02 6.29 45 XM_H_Long_From01 32647 6.05 6.43 5.97 46 RCVD_IN_IADB_LISTED 32359 5.23 2.09 5.92 47 RELAYCOUNTRY_META 31465 8.52 21.09 5.75 48 BAYES_60 29929 5.48 5.49 5.47 49 DKIM_INVALID 29352 7.32 16.23 5.37 50 MPART_ALT_DIFF 28698 5.52 6.76 5.25 51 BAYES_40 28578 4.87 3.23 5.23 52 RCVD_IN_IADB_SPF 28122 4.57 1.96 5.14 53 HTML_IMAGE_RATIO_04 25708 4.99 6.33 4.70 54 RCVD_IN_IADB_SENDERID 24383 4.00 1.91 4.46 55 RCVD_IN_IADB_DK 24232 3.98 1.91 4.43 56 BOTNET_IPINHOSTNAME 24117 6.71 17.16 4.41 57 T_TooManySym_01 23612 4.38 4.65 4.32 58 XM_PDF 23580 3.71 1.00 4.31 59 BAYES_20 23093 3.96 2.78 4.22 60 XMStrtUSub 22858 4.02 3.30 4.18 61 T_REMOTE_IMAGE 21858 3.78 2.81 4.00 62 HTML_IMAGE_RATIO_06 21374 3.79 3.28 3.91 63 RCVD_IN_IADB_VOUCHED 21091 3.27 0.58 3.86 64 IN_ZIMBRA_NJ_WHITELIST 19591 2.94 0.01 3.58 65 XMSexyCombo_05 18561 4.54 9.77 3.39 66 TR_XM_DK_SendGrid 18490 3.15 2.08 3.38 67 MIME_HTML_ONLY_MULTI 18303 3.33 3.25 3.35 68 XM_UncommonTLD01 17395 5.09 13.76 3.18 69 BAYES_99 17145 7.76 28.82 3.14 70 XMNumbers 16570 3.51 5.67 3.03 71 BOTNET 16286 6.57 22.90 2.98 72 BAYES_80 16002 3.65 6.97 2.93 73 FROM_EXCESS_BASE64 15865 2.91 2.95 2.90 74 NO_DNS_FOR_FROM 15708 4.36 11.12 2.87 75 MAILING_LIST_MULTI 15551 2.68 1.93 2.84 76 TM2_M_URI_OPT_OUT 15388 3.08 4.27 2.81 77 XMSubMetaSx_00 14970 3.31 5.93 2.74 78 BAYES_05 14510 2.45 1.53 2.65 79 TooManyTo_002 13532 2.16 0.71 2.47 80 XM_H_Trusted_IP 13305 1.99 0.00 2.43 81 ANY_BOUNCE_MESSAGE 13173 2.07 0.52 2.41 82 RCVD_IN_IADB_OPTIN 13162 2.05 0.42 2.41 83 BOUNCE_MESSAGE 13157 2.07 0.52 2.41 84 BAYES_999 13067 6.03 22.58 2.39 85 HTML_IMAGE_RATIO_08 12461 2.30 2.38 2.28 86 T_TooManySym_02 12090 1.98 0.93 2.21 87 HTML_MIME_NO_HTML_TAG 12006 2.40 3.34 2.20 88 KHOP_HELO_FCRDNS 11706 2.45 3.85 2.14 89 MIME_HTML_MOSTLY 11676 2.59 4.68 2.14 90 UNPARSEABLE_RELAY 11528 1.94 1.17 2.11 91 XM_CamelCaseFrm001 11215 2.53 4.71 2.05 92 XM_DK_Undo_01 11190 1.99 1.72 2.05 93 T_XMDrugObfuBody_14 11049 2.13 2.64 2.02 94 XMNoVowels 11042 2.15 2.74 2.02 95 XM_B_Unsub2 10683 2.14 2.99 1.95 96 XM_SPF_SoftFail 10468 2.42 4.73 1.91 97 RELAYCOUNTRY_CA 9769 2.30 4.66 1.79 98 TooManyTo_003 9744 1.56 0.58 1.78 99 TVD_RCVD_IP 9683 1.55 0.53 1.77 100 BAYES_95 9595 2.09 3.63 1.75 101 HELO_NODOT 9149 1.48 0.58 1.67 102 HELO_NO_DOMAIN 9146 1.47 0.57 1.67 103 SUBJ_ALL_CAPS 8798 1.68 2.00 1.61 104 T_XMDrugObfuBody_08 8681 1.92 3.41 1.59 105 RCVD_IN_MSPIKE_BL 8606 2.11 4.54 1.57 106 UNTRUSTED_Relay 8551 3.56 12.64 1.56 107 XM_B_SpammyTLD 8538 2.09 4.49 1.56 108 INVALID_MSGID 8515 1.33 0.28 1.56 109 IN_HORDE_ADDRESS_BOOK 8420 1.27 0.03 1.54 110 TR_DCC_Bayes_99 8070 5.22 22.25 1.48 111 XM_GoogleGroups 8045 1.30 0.51 1.47 112 XMDiploma_00 7856 1.54 2.02 1.44 113 XMCapTrack 7854 1.28 0.59 1.44 114 TooManyTo_004 7727 1.25 0.50 1.41 115 TR_MetaPhish_Combo_01 7479 1.39 1.47 1.37 116 TO_MALFORMED 7329 1.20 0.59 1.34 117 URI_TRY_3LD 7269 1.41 1.78 1.33 118 URI_HEX 7036 1.46 2.25 1.29 119 RCVD_IN_MSPIKE_L3 6850 1.81 4.33 1.25 120 CK_HELO_DYNAMIC_SPLIT_IP 6827 1.07 0.27 1.25 121 HELO_DYNAMIC_IPADDR2 6818 1.05 0.18 1.25 122 TooManyTo_005 6708 1.08 0.44 1.23 123 RCVD_IN_BL_SPAMCOP_NET 6595 1.64 3.64 1.21 124 XM_H_Long_From02 6577 1.17 1.03 1.20 125 XM_OfRef6 6508 1.42 2.49 1.19 126 RELAYCOUNTRY_GB 6464 1.48 2.83 1.18 127 TR_Symld_Words 6281 1.20 1.43 1.15 128 DKIM_ADSP_CUSTOM_MED 6216 1.19 1.46 1.14 129 TM2_M_VERY_LONG_WORD 5897 1.28 2.23 1.08 130 USER_IN_DEF_DKIM_WL 5811 0.87 0.00 1.06 131 HTML_FONT_FACE_BAD 5478 0.93 0.61 1.00 132 HTTPS_HTTP_MISMATCH 5426 1.02 1.17 0.99 133 XMGenDplmaNmb 5398 1.08 1.50 0.99 134 XMBdyGiftCard01 5333 1.04 1.35 0.98 135 XMGappySubj_01 5281 0.84 0.29 0.97 136 XMSubNoVowel 5191 0.87 0.51 0.95 137 TR_XM_PHPDW 5142 1.19 2.34 0.94 138 TR_XM_FormFill2 5086 1.17 2.29 0.93 139 TR_XM_PHPForged 5072 1.17 2.29 0.93 140 XM_H_PHPOS 5045 1.17 2.28 0.92 141 XM_UB50 4787 1.97 6.97 0.88 142 SpammyFromTLD_01 4378 1.08 2.38 0.80 143 T_FILL_THIS_FORM_SHORT 4356 0.80 0.84 0.80 144 NML_ADSP_CUSTOM_MED 4238 0.85 1.18 0.77 145 TR_MSPIKEBAYES00 4233 0.64 0.01 0.77 146 XMSubMetaI_00 4185 0.87 1.33 0.77 147 T_TooManySym_03 4181 0.69 0.36 0.76 148 XMHTML_After_End 4006 0.87 1.48 0.73 149 XMStockSpam_06 3869 0.88 1.66 0.71 150 XMBrknScrpt_02 3766 0.72 0.88 0.69 151 T_XMDrugObfuBody_00 3687 0.76 1.13 0.67 152 TO_NO_BRKTS_HTML_ONLY 3535 0.57 0.22 0.65 153 XM_SPF_Unknown 3528 0.68 0.86 0.65 154 XMSexyCombo_01 3519 0.89 1.99 0.64 155 MISSING_HEADERS 3495 0.77 1.35 0.64 156 XMPhish08 3302 0.78 1.57 0.60 157 T_OBFU_PDF_ATTACH 3277 0.52 0.18 0.60 158 XM_DIRTYINTL 3256 1.16 3.71 0.60 159 XMMoneyMeta_00 3180 0.69 1.19 0.58 160 FROM_GOV_DKIM_AU 3140 0.54 0.40 0.57 161 XM_ProductURIs 3135 0.70 1.28 0.57 162 RELAYCOUNTRY_AU 3085 0.59 0.73 0.56 163 FORGED_GMAIL_RCVD 3031 0.69 1.31 0.55 164 XMSolicitRefs_0 3004 0.51 0.36 0.55 165 XM_H_PHPMailer 2952 0.72 1.57 0.54 166 T_XMHurry_00 2936 0.67 1.30 0.54 167 XM_ShortIntro_01 2826 0.48 0.33 0.52 168 HTML_IMAGE_ONLY_32 2728 0.45 0.21 0.50 169 XM_B_REG_HTML 2703 0.51 0.56 0.49 170 XMBody_17 2664 0.66 1.44 0.49 171 RCVD_IN_SORBS_DUL 2645 0.42 0.14 0.48 172 XMHTMLBadTable_001 2619 0.56 0.95 0.48 173 TM2_M_BODY_EMPTY 2587 0.41 0.10 0.47 174 HTML_IMAGE_ONLY_28 2453 0.50 0.73 0.45 175 HTML_TAG_BALANCE_BODY 2451 0.51 0.77 0.45 176 FROM_GOV_SPOOF 2309 0.40 0.31 0.42 177 T_Symld_Words_02 2299 0.51 0.94 0.42 178 SHORT_HELO_AND_INLINE_IMAGE 2277 0.35 0.03 0.42 179 HTML_IMAGE_ONLY_20 2258 0.41 0.40 0.41 180 XMPhish30 2209 0.61 1.54 0.40 181 RELAYCOUNTRY_DE 2194 0.57 1.32 0.40 182 XM_Body_Obfu01 2141 0.40 0.46 0.39 183 XMSlimDrugH 2068 0.41 0.56 0.38 184 AC_DIV_BONANZA 2048 0.32 0.09 0.37 185 USER_IN_WHITELIST 2047 0.31 0.00 0.37 186 TVD_SPACE_RATIO 1981 0.35 0.32 0.36 187 TR_LOTS_OF_MONEY3 1956 0.47 0.99 0.36 188 MPART_ALT_DIFF_COUNT 1955 0.44 0.82 0.36 189 FILL_THIS_FORM 1939 0.35 0.35 0.35 190 PLING_QUERY 1931 0.39 0.55 0.35 191 URI_NOVOWEL 1929 0.39 0.54 0.35 192 BASE64_LENGTH_79_INF 1917 0.34 0.28 0.35 193 TM2_M_A_HREF_HREF 1889 0.43 0.81 0.35 194 XMBody_78 1888 0.42 0.74 0.35 195 T_MONEY_PERCENT 1888 0.44 0.89 0.35 196 TR_LOTS_OF_MONEY2 1888 0.44 0.89 0.35 197 MSGID_FROM_MTA_HEADER 1883 0.37 0.50 0.34 198 XMPhish14 1859 0.42 0.77 0.34 199 XM_E_Blogspot 1855 0.32 0.23 0.34 200 RDNS_DYNAMIC 1855 0.55 1.51 0.34 ----------------------------------------------------------------------