Email: 330588 Autolearn: 0 AvgScore: 3.00 AvgScanTime: 2.92 sec Spam: 96581 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 3.41 sec Ham: 234007 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 2.72 sec Time Spent Running SA: 268.42 hours Time Spent Processing Spam: 91.41 hours Time Spent Processing Ham: 177.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89394 86.49 92.56 83.99 2 DKIM_SIGNED 84326 81.60 87.31 79.25 3 XM_DK_Pass 80889 79.66 83.75 77.97 4 DCC_CHECK 79939 58.74 82.77 48.82 5 DKIM_VALID 77992 76.87 80.75 75.27 6 XMListUnsubscribeExists 71678 62.46 74.22 57.61 7 DKIM_VALID_AU 66322 63.10 68.67 60.80 8 XM_H_QuotedFrom 56427 44.37 58.42 38.57 9 XM_DK_Undo_02 39491 21.58 40.89 13.61 10 LOC_TINY_FONT_1 38464 32.16 39.83 28.99 11 BAYES_50 37745 49.99 39.08 54.49 12 HTML_FONT_LOW_CONTRAST 37248 35.39 38.57 34.08 13 BAYES_99 34342 18.84 35.56 11.94 14 MIME_HTML_ONLY 29199 24.60 30.23 22.27 15 TR_DCC_Bayes_99 28457 13.30 29.46 6.63 16 BAYES_999 28430 15.75 29.44 10.10 17 FVGT_m_MULTI_ODD 26781 23.77 27.73 22.13 18 XMSubLong 20952 22.02 21.69 22.15 19 XM_Body_Dirty_Words 20399 15.37 21.12 13.00 20 DKIM_VALID_EF 20372 27.81 21.09 30.58 21 HTML_IMAGE_RATIO_02 19868 13.47 20.57 10.54 22 T_TM2_M_HEADER_IN_MSG 19227 22.58 19.91 23.68 23 T_KAM_HTML_FONT_INVALID 16724 15.03 17.32 14.08 24 XM_Multi_Part_URI 16279 15.72 16.86 15.26 25 MultiRelay 16152 14.68 16.72 13.83 26 RELAYCOUNTRY_META 15527 7.70 16.08 4.24 27 XM_Evil_Numbers_Gen 15251 11.00 15.79 9.02 28 DCC_CHECK_NEGATIVE 15204 40.09 15.74 50.13 29 BOTNET_IPINHOSTNAME 13290 9.72 13.76 8.05 30 BOTNET 13142 5.45 13.61 2.08 31 HTML_IMAGE_RATIO_04 10932 8.49 11.32 7.32 32 FSL_BULK_SIG 10907 8.94 11.29 7.97 33 TR_XM_DocInvoice 10610 6.30 10.99 4.37 34 XMSexyCombo_05 9923 6.36 10.27 4.75 35 LOTS_OF_MONEY 9616 8.57 9.96 8.00 36 UNTRUSTED_Relay 9473 3.76 9.81 1.27 37 MPART_ALT_DIFF 8850 4.74 9.16 2.92 38 FROM_EXCESS_BASE64 8630 6.64 8.94 5.69 39 XM_B_Phish_Phrases 8525 8.04 8.83 7.72 40 TooManyTo_001 8269 6.72 8.56 5.96 41 XM_H_Long_From01 8239 7.07 8.53 6.46 42 T_XMDrugObfuBody_14 8040 8.14 8.32 8.06 43 BAYES_80 7467 5.10 7.73 4.01 44 XMSubMetaSx_00 6917 5.02 7.16 4.14 45 XM_UncommonTLD01 6371 4.73 6.60 3.96 46 DKIM_INVALID 6334 4.73 6.56 3.97 47 BAYES_60 6104 6.18 6.32 6.12 48 MIME_HTML_MOSTLY 5713 4.04 5.92 3.26 49 LotsOfNums_01 5471 7.33 5.66 8.02 50 XMStrtUSub 5127 5.42 5.31 5.47 51 XM_OfRef6 4470 2.27 4.63 1.30 52 XM_DIRTYINTL 4466 2.52 4.62 1.66 53 XMNumbers 4431 4.69 4.59 4.74 54 HTML_IMAGE_RATIO_06 4374 4.12 4.53 3.96 55 BAYES_95 4355 3.26 4.51 2.75 56 XM_UB50 3994 1.64 4.14 0.61 57 MIME_HTML_ONLY_MULTI 3953 2.02 4.09 1.17 58 TM2_M_URI_OPT_OUT 3785 2.44 3.92 1.82 59 MultiRelay_CC 3693 1.22 3.82 0.15 60 MultiRelay_Combo 3693 1.22 3.82 0.15 61 XM_SendGrid 3490 4.96 3.61 5.51 62 XMDiploma_00 3296 2.05 3.41 1.49 63 XM_CamelCaseFrm001 3189 2.42 3.30 2.05 64 RELAYCOUNTRY_CA 3174 2.07 3.29 1.57 65 URI_HEX 3131 2.17 3.24 1.73 66 XMSubMetaI_00 3034 1.66 3.14 1.04 67 RCVD_IN_MSPIKE_H2 2948 4.55 3.05 5.17 68 T_REMOTE_IMAGE 2909 3.34 3.01 3.48 69 FILL_THIS_FORM 2888 1.33 2.99 0.64 70 XM_SPF_SoftFail 2717 1.50 2.81 0.96 71 SUBJ_ALL_CAPS 2710 1.69 2.81 1.23 72 RCVD_IN_RP_RNBL 2680 0.86 2.77 0.08 73 HTML_IMAGE_RATIO_08 2604 2.79 2.70 2.83 74 FILL_THIS_FORM_LOAN 2577 1.17 2.67 0.55 75 XMBody_17 2573 1.50 2.66 1.02 76 RCVD_IN_BL_SPAMCOP_NET 2563 0.89 2.65 0.16 77 RCVD_IN_RP_SAFE 2524 12.12 2.61 16.05 78 MIME_QP_LONG_LINE 2458 3.86 2.55 4.40 79 XM_BadFromFormat 2335 0.94 2.42 0.33 80 HTML_MIME_NO_HTML_TAG 2292 1.82 2.37 1.58 81 URI_TRY_3LD 2245 1.56 2.32 1.24 82 XMPhish11 2179 1.39 2.26 1.03 83 XMGenDplmaNmb 2136 1.30 2.21 0.92 84 XMBdyGiftCard01 2129 2.35 2.20 2.41 85 DKIM_ADSP_CUSTOM_MED 2057 1.24 2.13 0.88 86 XM_OfRef7 2057 0.70 2.13 0.11 87 UNPARSEABLE_RELAY 2044 4.54 2.12 5.54 88 XMSexyCombo_01 2031 0.91 2.10 0.42 89 NML_ADSP_CUSTOM_MED 1996 1.01 2.07 0.58 90 XMLngstWrd_00 1942 0.91 2.01 0.45 91 BAYES_20 1932 2.40 2.00 2.57 92 RCVD_IN_RP_CERTIFIED 1921 11.16 1.99 14.95 93 T_XMHurry_00 1906 1.24 1.97 0.94 94 BAYES_40 1903 3.03 1.97 3.47 95 XMLngstWrd_01 1873 0.85 1.94 0.40 96 BOTNET_NORDNS 1848 0.56 1.91 0.01 97 XM_H_Long_From02 1833 1.40 1.90 1.19 98 DIET_1 1832 0.95 1.90 0.56 99 XMLngstWrd_02 1831 0.74 1.90 0.26 100 TR_Mismatch_TLD_02 1810 0.59 1.87 0.05 101 XMLngstWrd_03 1791 0.68 1.85 0.19 102 XM_UB99 1778 0.55 1.84 0.02 103 US_DOLLARS_3 1770 1.83 1.83 1.83 104 T_FILL_THIS_FORM_LONG 1767 0.94 1.83 0.57 105 T_XMDrugObfuBody_08 1742 1.55 1.80 1.44 106 T_TooManySym_01 1690 5.69 1.75 7.32 107 SUBJ_DOLLARS 1687 0.81 1.75 0.42 108 T_TVD_MIME_EPI 1634 0.51 1.69 0.02 109 TR_LOTS_OF_MONEY2 1631 0.73 1.69 0.34 110 T_MONEY_PERCENT 1631 0.73 1.69 0.34 111 ALL_TRUSTED 1630 12.22 1.69 16.57 112 URIBL_BLACK 1616 0.58 1.67 0.14 113 RELAYCOUNTRY_CN 1540 0.51 1.59 0.07 114 TM2_M_VERY_LONG_WORD 1502 1.16 1.56 1.00 115 HTML_IMAGE_ONLY_12 1474 0.58 1.53 0.19 116 XM_URI_RBL 1465 0.81 1.52 0.51 117 XMHTML_After_End 1447 0.62 1.50 0.26 118 SpammyFromTLD_02 1443 0.57 1.49 0.18 119 LOADSA_MONEY_COMBO 1412 0.48 1.46 0.08 120 BAYES_00 1375 9.64 1.42 13.03 121 BAYES_05 1358 1.55 1.41 1.61 122 RELAYCOUNTRY_AT 1350 0.66 1.40 0.35 123 XMPhish30 1304 0.66 1.35 0.38 124 FROM_MISSP_REPLYTO 1298 0.41 1.34 0.02 125 MONEY_FRAUD_8 1293 0.39 1.34 0.00 126 XM_UB60 1291 0.44 1.34 0.07 127 LongTLD 1286 0.51 1.33 0.17 128 XFER_LOTSA_MONEY 1283 0.41 1.33 0.04 129 URIBL_DBL_SPAM 1275 0.43 1.32 0.06 130 HTML_FONT_SIZE_LARGE 1270 0.47 1.31 0.12 131 MISSING_HEADERS 1267 0.67 1.31 0.41 132 XM_Nigeria_01 1237 0.42 1.28 0.06 133 HTML_SHORT_LINK_IMG_1 1208 0.39 1.25 0.04 134 XM_DK_Undo_01 1207 1.42 1.25 1.48 135 ADVANCE_FEE_5_NEW_FRM_MNY 1199 0.36 1.24 0.00 136 HTML_TAG_BALANCE_BODY 1199 0.66 1.24 0.43 137 SpammyFromTLD_01 1192 0.57 1.23 0.30 138 XM_ProductURIs 1178 1.08 1.22 1.02 139 RELAYCOUNTRY_FR 1138 0.46 1.18 0.17 140 XMStockSpam_06 1137 0.94 1.18 0.84 141 MAILING_LIST_MULTI 1134 1.56 1.17 1.72 142 TR_XM_RelayPhish 1127 0.61 1.17 0.38 143 PLING_QUERY 1123 1.16 1.16 1.15 144 REPLYTO_WITHOUT_TO_CC 1112 0.38 1.15 0.06 145 FOUND_YOU 1061 0.32 1.10 0.00 146 XM_H_PHPOS 1049 1.01 1.09 0.98 147 XM_UB80 1038 0.33 1.07 0.02 148 RDNS_DYNAMIC 1033 0.76 1.07 0.63 149 XMSlimDrugH 1009 0.54 1.04 0.33 150 FROM_MISSP_EH_MATCH 993 0.30 1.03 0.00 151 XM_Body_Obfu01 981 0.40 1.02 0.15 152 TO_NO_BRKTS_FROM_MSSP 970 0.33 1.00 0.06 153 BODY_ENHANCEMENT 964 0.30 1.00 0.02 154 RCVD_IN_IADB_LISTED 963 3.29 1.00 4.23 155 T_XMDrugObfuBody_00 955 0.71 0.99 0.59 156 XM_UB999 941 0.29 0.97 0.01 157 TR_XM_DK_Bayes 934 7.59 0.97 10.32 158 TR_XM_DK_Bayes1 920 7.35 0.95 9.99 159 XMBody_78 906 0.68 0.94 0.57 160 XMSubMetaSxObfu_03 902 0.54 0.93 0.38 161 T_HTML_TAG_BALANCE_CENTER 895 0.41 0.93 0.20 162 RELAYCOUNTRY_NL 894 0.41 0.93 0.20 163 BODY_URI_ONLY 888 0.29 0.92 0.03 164 FROM_SUSPICIOUS_NTLD 887 0.28 0.92 0.02 165 RELAYCOUNTRY_DE 885 0.46 0.92 0.27 166 XM_B_COPY_HTML 878 0.71 0.91 0.63 167 XM_Hitman 872 0.28 0.90 0.02 168 XMHTMLBadTable_001 870 1.04 0.90 1.10 169 XMGppyBdWords 868 0.36 0.90 0.13 170 ACT_NOW_CAPS 851 0.42 0.88 0.23 171 TO_NO_BRKTS_MSFT 835 0.25 0.86 0.00 172 T_Symld_Words_02 823 0.52 0.85 0.38 173 XM_H_PHPMailer 820 0.73 0.85 0.68 174 FROM_MISSPACED 818 0.25 0.85 0.00 175 LOW_PRICE 816 0.34 0.84 0.13 176 FROM_MISSP_XPRIO 813 0.25 0.84 0.00 177 FROM_MISSP_MSFT 813 0.25 0.84 0.00 178 FSL_CTYPE_WIN1251 813 0.25 0.84 0.00 179 TR_XM_DK_Bayes2 804 6.83 0.83 9.30 180 FORGED_MUA_OUTLOOK 802 0.28 0.83 0.05 181 RCVD_IN_IADB_SPF 786 2.86 0.81 3.71 182 RCVD_IN_MSPIKE_WL 778 1.81 0.81 2.22 183 HTML_SHORT_LINK_IMG_2 771 0.28 0.80 0.07 184 TR_Symld_Words 764 1.23 0.79 1.42 185 HTML_IMAGE_ONLY_28 758 0.41 0.78 0.25 186 RCVD_IN_MSPIKE_H3 757 1.80 0.78 2.22 187 FSL_NEW_HELO_USER 751 0.23 0.78 0.00 188 URI_NOVOWEL 746 0.42 0.77 0.27 189 FROM_MISSP_USER 741 0.22 0.77 0.00 190 NSL_RCVD_FROM_USER 741 0.22 0.77 0.00 191 HTML_FONT_FACE_BAD 738 0.66 0.76 0.61 192 RCVD_IN_IADB_SENDERID 738 2.58 0.76 3.32 193 XM_OverStock_LProb 737 0.34 0.76 0.17 194 RELAYCOUNTRY_GB 734 0.56 0.76 0.48 195 NO_DNS_FOR_FROM 733 0.68 0.76 0.64 196 XMPhish14 724 0.68 0.75 0.66 197 RCVD_IN_IADB_DK 723 2.53 0.75 3.27 198 RELAYCOUNTRY_KH 715 0.22 0.74 0.00 199 T_FILL_THIS_FORM_SHORT 712 0.55 0.74 0.47 200 RELAYCOUNTRY_NO 709 0.22 0.73 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 196535 86.49 92.56 83.99 2 DKIM_SIGNED 185442 81.60 87.31 79.25 3 XM_DK_Pass 182449 79.66 83.75 77.97 4 DKIM_VALID 176142 76.87 80.75 75.27 5 DKIM_VALID_AU 142273 63.10 68.67 60.80 6 XMListUnsubscribeExists 134810 62.46 74.22 57.61 7 BAYES_50 127518 49.99 39.08 54.49 8 DCC_CHECK_NEGATIVE 117313 40.09 15.74 50.13 9 DCC_CHECK 114238 58.74 82.77 48.82 10 XM_H_QuotedFrom 90262 44.37 58.42 38.57 11 HTML_FONT_LOW_CONTRAST 79759 35.39 38.57 34.08 12 DKIM_VALID_EF 71550 27.81 21.09 30.58 13 LOC_TINY_FONT_1 67849 32.16 39.83 28.99 14 T_TM2_M_HEADER_IN_MSG 55408 22.58 19.91 23.68 15 MIME_HTML_ONLY 52117 24.60 30.23 22.27 16 XMSubLong 51844 22.02 21.69 22.15 17 FVGT_m_MULTI_ODD 51796 23.77 27.73 22.13 18 XM_DKIMWhitelistDomains 39664 12.00 0.02 16.95 19 ALL_TRUSTED 38778 12.22 1.69 16.57 20 RCVD_IN_RP_SAFE 37551 12.12 2.61 16.05 21 XM_Multi_Part_URI 35699 15.72 16.86 15.26 22 RCVD_IN_RP_CERTIFIED 34979 11.16 1.99 14.95 23 T_KAM_HTML_FONT_INVALID 32952 15.03 17.32 14.08 24 MultiRelay 32364 14.68 16.72 13.83 25 XM_DK_Undo_02 31856 21.58 40.89 13.61 26 BAYES_00 30490 9.64 1.42 13.03 27 XM_Body_Dirty_Words 30419 15.37 21.12 13.00 28 BAYES_99 27947 18.84 35.56 11.94 29 HTML_IMAGE_RATIO_02 24668 13.47 20.57 10.54 30 TR_XM_DK_Bayes 24154 7.59 0.97 10.32 31 BAYES_999 23626 15.75 29.44 10.10 32 TR_XM_DK_Bayes1 23366 7.35 0.95 9.99 33 TR_XM_DK_Bayes2 21773 6.83 0.83 9.30 34 XM_Evil_Numbers_Gen 21101 11.00 15.79 9.02 35 T_XMDrugObfuBody_14 18872 8.14 8.32 8.06 36 BOTNET_IPINHOSTNAME 18848 9.72 13.76 8.05 37 LotsOfNums_01 18769 7.33 5.66 8.02 38 LOTS_OF_MONEY 18720 8.57 9.96 8.00 39 FSL_BULK_SIG 18645 8.94 11.29 7.97 40 XM_B_Phish_Phrases 18070 8.04 8.83 7.72 41 T_TooManySym_01 17136 5.69 1.75 7.32 42 HTML_IMAGE_RATIO_04 17129 8.49 11.32 7.32 43 TR_DCC_Bayes_99 15513 13.30 29.46 6.63 44 XM_H_Long_From01 15126 7.07 8.53 6.46 45 BAYES_60 14332 6.18 6.32 6.12 46 TooManyTo_001 13953 6.72 8.56 5.96 47 TO_MALFORMED 13371 4.06 0.07 5.71 48 FROM_EXCESS_BASE64 13325 6.64 8.94 5.69 49 UNPARSEABLE_RELAY 12969 4.54 2.12 5.54 50 XM_SendGrid 12893 4.96 3.61 5.51 51 XMStrtUSub 12792 5.42 5.31 5.47 52 RCVD_IN_MSPIKE_H2 12105 4.55 3.05 5.17 53 TVD_RCVD_IP 11599 3.61 0.34 4.96 54 XMSexyCombo_05 11107 6.36 10.27 4.75 55 XMNumbers 11082 4.69 4.59 4.74 56 MIME_QP_LONG_LINE 10297 3.86 2.55 4.40 57 TR_XM_DocInvoice 10229 6.30 10.99 4.37 58 RELAYCOUNTRY_META 9917 7.70 16.08 4.24 59 RCVD_IN_IADB_LISTED 9910 3.29 1.00 4.23 60 XMSubMetaSx_00 9692 5.02 7.16 4.14 61 BAYES_80 9389 5.10 7.73 4.01 62 DKIM_INVALID 9300 4.73 6.56 3.97 63 XM_UncommonTLD01 9274 4.73 6.60 3.96 64 HTML_IMAGE_RATIO_06 9262 4.12 4.53 3.96 65 RCVD_IN_IADB_SPF 8671 2.86 0.81 3.71 66 IN_ZIMBRA_NJ_WHITELIST 8163 2.47 0.02 3.49 67 T_REMOTE_IMAGE 8138 3.34 3.01 3.48 68 BAYES_40 8122 3.03 1.97 3.47 69 ANY_BOUNCE_MESSAGE 7842 2.47 0.32 3.35 70 BOUNCE_MESSAGE 7841 2.47 0.32 3.35 71 RCVD_IN_IADB_SENDERID 7780 2.58 0.76 3.32 72 RCVD_IN_IADB_DK 7646 2.53 0.75 3.27 73 MIME_HTML_MOSTLY 7628 4.04 5.92 3.26 74 MPART_ALT_DIFF 6830 4.74 9.16 2.92 75 HTML_IMAGE_RATIO_08 6630 2.79 2.70 2.83 76 BAYES_95 6435 3.26 4.51 2.75 77 RCVD_IN_IADB_VOUCHED 6368 2.13 0.69 2.72 78 INVALID_MSGID 6346 1.99 0.24 2.71 79 BAYES_20 6012 2.40 2.00 2.57 80 XMBdyGiftCard01 5646 2.35 2.20 2.41 81 RCVD_IN_MSPIKE_WL 5191 1.81 0.81 2.22 82 RCVD_IN_MSPIKE_H3 5187 1.80 0.78 2.22 83 TR_MetaPhish_Combo_01 5077 1.71 0.61 2.17 84 T_TooManySym_02 5055 1.68 0.52 2.16 85 BOTNET 4877 5.45 13.61 2.08 86 XM_CamelCaseFrm001 4807 2.42 3.30 2.05 87 USER_IN_DEF_DKIM_WL 4701 1.43 0.01 2.01 88 IN_HORDE_ADDRESS_BOOK 4671 1.42 0.04 2.00 89 XM_PDF 4664 1.59 0.60 1.99 90 US_DOLLARS_3 4272 1.83 1.83 1.83 91 TM2_M_URI_OPT_OUT 4265 2.44 3.92 1.82 92 URI_HEX 4046 2.17 3.24 1.73 93 MAILING_LIST_MULTI 4030 1.56 1.17 1.72 94 XM_DIRTYINTL 3881 2.52 4.62 1.66 95 RCVD_IN_IADB_OPTIN 3828 1.31 0.52 1.64 96 BAYES_05 3762 1.55 1.41 1.61 97 HTML_MIME_NO_HTML_TAG 3709 1.82 2.37 1.58 98 RELAYCOUNTRY_CA 3674 2.07 3.29 1.57 99 XMDiploma_00 3493 2.05 3.41 1.49 100 XM_DK_Undo_01 3473 1.42 1.25 1.48 101 T_XMDrugObfuBody_08 3368 1.55 1.80 1.44 102 TooManyTo_002 3328 1.20 0.65 1.42 103 TR_Symld_Words 3313 1.23 0.79 1.42 104 XM_OfRef6 3038 2.27 4.63 1.30 105 XM_B_REG_HTML 2978 1.02 0.42 1.27 106 UNTRUSTED_Relay 2963 3.76 9.81 1.27 107 URI_TRY_3LD 2905 1.56 2.32 1.24 108 SUBJ_ALL_CAPS 2867 1.69 2.81 1.23 109 XM_GoogleGroups 2802 0.97 0.44 1.20 110 XM_H_Long_From02 2783 1.40 1.90 1.19 111 MIME_HTML_ONLY_MULTI 2734 2.02 4.09 1.17 112 PLING_QUERY 2698 1.16 1.16 1.15 113 XMBody_95 2666 0.86 0.19 1.14 114 XMHTMLBadTable_001 2567 1.04 0.90 1.10 115 TooManyTo_003 2458 0.91 0.57 1.05 116 XMSubMetaI_00 2439 1.66 3.14 1.04 117 XMPhish11 2411 1.39 2.26 1.03 118 XMBody_17 2393 1.50 2.66 1.02 119 XM_ProductURIs 2387 1.08 1.22 1.02 120 TM2_M_VERY_LONG_WORD 2335 1.16 1.56 1.00 121 USER_IN_WHITELIST 2312 0.70 0.00 0.99 122 XM_H_PHPOS 2283 1.01 1.09 0.98 123 XM_SPF_SoftFail 2240 1.50 2.81 0.96 124 T_XMHurry_00 2197 1.24 1.97 0.94 125 XMGenDplmaNmb 2152 1.30 2.21 0.92 126 TooManyTo_004 2053 0.73 0.39 0.88 127 DKIM_ADSP_CUSTOM_MED 2048 1.24 2.13 0.88 128 XMStockSpam_06 1958 0.94 1.18 0.84 129 XMSubMetaSxObfu_02 1944 0.67 0.29 0.83 130 TM2_M_A_HREF_HREF 1913 0.73 0.53 0.82 131 T_TooManySym_03 1906 0.61 0.11 0.81 132 TooManyTo_005 1816 0.64 0.31 0.78 133 XMBSHREFv2 1811 0.64 0.32 0.77 134 XM_H_PHPMailer 1596 0.73 0.85 0.68 135 XMPhish14 1538 0.68 0.75 0.66 136 FILL_THIS_FORM 1507 1.33 2.99 0.64 137 NO_DNS_FOR_FROM 1504 0.68 0.76 0.64 138 HELO_NODOT 1490 0.52 0.25 0.64 139 XM_B_COPY_HTML 1476 0.71 0.91 0.63 140 RDNS_DYNAMIC 1465 0.76 1.07 0.63 141 XM_UB50 1437 1.64 4.14 0.61 142 HTML_FONT_FACE_BAD 1430 0.66 0.76 0.61 143 T_XMDrugObfuBody_00 1391 0.71 0.99 0.59 144 TR_LOTS_OF_MONEY3 1366 0.57 0.53 0.58 145 DKIM_ADSP_NXDOMAIN 1363 0.57 0.55 0.58 146 XM_D_tchamptons_WL 1360 0.41 0.00 0.58 147 NML_ADSP_CUSTOM_MED 1358 1.01 2.07 0.58 148 T_FILL_THIS_FORM_LONG 1342 0.94 1.83 0.57 149 XMBody_78 1341 0.68 0.94 0.57 150 DIET_1 1301 0.95 1.90 0.56 151 FILL_THIS_FORM_LOAN 1285 1.17 2.67 0.55 152 XM_URI_RBL 1203 0.81 1.52 0.51 153 XMBrknScrpt_02 1165 0.54 0.65 0.50 154 RELAYCOUNTRY_GB 1121 0.56 0.76 0.48 155 XM_Akamai 1104 0.35 0.04 0.47 156 T_FILL_THIS_FORM_SHORT 1100 0.55 0.74 0.47 157 T_TooManySym_04 1095 0.34 0.02 0.47 158 XM_RXBody 1085 0.53 0.68 0.46 159 XMLngstWrd_00 1050 0.91 2.01 0.45 160 XMCapTrack 1036 0.36 0.16 0.44 161 FORGED_GMAIL_RCVD 1033 0.49 0.60 0.44 162 HTML_TAG_BALANCE_BODY 998 0.66 1.24 0.43 163 SUBJ_DOLLARS 992 0.81 1.75 0.42 164 XM_H_PHPOS_M 986 0.47 0.58 0.42 165 XMSexyCombo_01 982 0.91 2.10 0.42 166 XM_Walgreens_Forge 966 0.34 0.15 0.41 167 MISSING_HEADERS 952 0.67 1.31 0.41 168 XMNoVowels 948 0.38 0.32 0.41 169 XMLngstWrd_01 942 0.85 1.94 0.40 170 TR_XM_RelayPhish 897 0.61 1.17 0.38 171 XMPhish30 888 0.66 1.35 0.38 172 XMSubMetaSxObfu_03 887 0.54 0.93 0.38 173 T_Symld_Words_02 882 0.52 0.85 0.38 174 MPART_ALT_DIFF_COUNT 876 0.44 0.62 0.37 175 SUBJ_BUY 857 0.35 0.33 0.37 176 XMSubMetaD_03 849 0.41 0.51 0.36 177 RELAYCOUNTRY_AT 817 0.66 1.40 0.35 178 XMSolicitRefs_0 793 0.35 0.36 0.34 179 TR_LOTS_OF_MONEY2 788 0.73 1.69 0.34 180 T_MONEY_PERCENT 788 0.73 1.69 0.34 181 XM_BadFromFormat 777 0.94 2.42 0.33 182 XMSubMetaSSx_00 766 0.40 0.59 0.33 183 XMSlimDrugH 765 0.54 1.04 0.33 184 XMRcvdHeader_15 762 0.23 0.00 0.33 185 HTTPS_HTTP_MISMATCH 719 0.41 0.65 0.31 186 XMMoneyMeta_00 714 0.39 0.60 0.31 187 RELAYCOUNTRY_AU 708 0.39 0.61 0.30 188 SpammyFromTLD_01 698 0.57 1.23 0.30 189 XM_ShortIntro_01 679 0.32 0.40 0.29 190 TM2_M_BODY_EMPTY 668 0.23 0.11 0.29 191 XMBody_29 663 0.27 0.24 0.28 192 XMSUPPORT 648 0.20 0.00 0.28 193 XMGappySubj_01 647 0.35 0.51 0.28 194 XMDateMe_00 643 0.29 0.31 0.27 195 XMSubNoVowel 630 0.33 0.46 0.27 196 FROM_EGROUPS 629 0.19 0.00 0.27 197 RELAYCOUNTRY_DE 628 0.46 0.92 0.27 198 URI_NOVOWEL 627 0.42 0.77 0.27 199 XMHTML_After_End 616 0.62 1.50 0.26 200 XMLngstWrd_02 614 0.74 1.90 0.26 ----------------------------------------------------------------------