Email: 622794 Autolearn: 0 AvgScore: 1.14 AvgScanTime: 2.12 sec Spam: 98095 Autolearn: 0 AvgScore: 12.57 AvgScanTime: 2.86 sec Ham: 524699 Autolearn: 0 AvgScore: -1.00 AvgScanTime: 1.98 sec Time Spent Running SA: 366.86 hours Time Spent Processing Spam: 77.94 hours Time Spent Processing Ham: 288.92 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 92547 87.99 94.34 86.80 2 DCC_CHECK 78109 48.86 79.63 43.11 3 DKIM_SIGNED 74495 76.84 75.94 77.01 4 XM_DK_Pass 72187 75.42 73.59 75.77 5 DKIM_VALID 68304 72.13 69.63 72.60 6 XM_B_Unicode 67941 69.94 69.26 70.07 7 XMListUnsubscribeExists 66732 55.55 68.03 53.22 8 DKIM_VALID_AU 52428 52.56 53.45 52.40 9 BAYES_50 48368 53.15 49.31 53.87 10 XM_B_Unicode3 46356 42.53 47.26 41.65 11 MIME_HTML_ONLY 37727 24.06 38.46 21.37 12 HTML_FONT_LOW_CONTRAST 36040 30.92 36.74 29.83 13 LOC_TINY_FONT_1 35822 26.13 36.52 24.19 14 XM_DK_Undo_02 34839 10.85 35.52 6.24 15 XMSubLong 25191 23.06 25.68 22.57 16 FVGT_m_MULTI_ODD 23878 22.88 24.34 22.60 17 RELAYCOUNTRY_META 23073 8.28 23.52 5.43 18 BOTNET 22725 5.73 23.17 2.48 19 DKIM_VALID_EF 22503 26.69 22.94 27.40 20 XM_Body_Dirty_Words 21721 16.02 22.14 14.88 21 BAYES_99 20827 5.66 21.23 2.75 22 BOTNET_IPINHOSTNAME 19888 8.15 20.27 5.88 23 MultiRelay 19168 19.12 19.54 19.05 24 DCC_CHECK_NEGATIVE 18375 49.40 18.73 55.13 25 XM_UncommonTLD01 18340 5.57 18.70 3.11 26 FSL_BULK_SIG 17032 8.81 17.36 7.21 27 T_KAM_HTML_FONT_INVALID 16684 17.63 17.01 17.74 28 TR_DCC_Bayes_99 16335 3.62 16.65 1.18 29 BAYES_999 16245 4.45 16.56 2.19 30 XM_Multi_Part_URI 15932 13.23 16.24 12.66 31 T_TM2_M_HEADER_IN_MSG 15883 27.36 16.19 29.45 32 HTML_IMAGE_RATIO_02 15025 9.95 15.32 8.94 33 XM_Evil_Numbers_Gen 14262 10.19 14.54 9.38 34 LOTS_OF_MONEY 13064 10.34 13.32 9.79 35 XMSexyCombo_05 12790 5.71 13.04 4.34 36 UNTRUSTED_Relay 12645 3.49 12.89 1.73 37 SpammyFromTLD_02 10278 2.01 10.48 0.43 38 MPART_ALT_DIFF 10204 4.63 10.40 3.55 39 TooManyTo_001 10162 8.17 10.36 7.76 40 XM_H_Long_From01 9628 6.96 9.81 6.42 41 T_XMDrugObfuBody_14 9561 8.55 9.75 8.32 42 XMSubMetaSx_00 9040 5.39 9.22 4.68 43 T_REMOTE_IMAGE 8493 4.74 8.66 4.00 44 HTML_IMAGE_RATIO_04 7854 6.73 8.01 6.49 45 XM_B_Phish_Phrases 7590 5.92 7.74 5.58 46 LotsOfNums_01 7337 8.28 7.48 8.43 47 XM_UB50 7146 1.99 7.28 1.00 48 XM_B_SpammyTLD 6580 3.93 6.71 3.42 49 MIME_HTML_ONLY_MULTI 6407 2.48 6.53 1.72 50 XMNumbers 6407 4.43 6.53 4.04 51 XM_DIRTYINTL 6209 3.60 6.33 3.09 52 DKIM_INVALID 6191 4.71 6.31 4.41 53 MIME_HTML_MOSTLY 5838 3.18 5.95 2.67 54 KHOP_HELO_FCRDNS 5765 2.65 5.88 2.04 55 HTML_MIME_NO_HTML_TAG 5719 2.64 5.83 2.04 56 BAYES_40 5589 6.48 5.70 6.63 57 TR_Mismatch_TLD_02 5294 0.92 5.40 0.08 58 XM_SPF_SoftFail 5104 2.46 5.20 1.95 59 RCVD_IN_MSPIKE_H2 5075 6.61 5.17 6.88 60 DATE_IN_PAST_03_06 4972 0.88 5.07 0.10 61 RELAYCOUNTRY_GB 4915 1.61 5.01 0.97 62 BAYES_80 4841 2.45 4.94 1.98 63 FROM_SUSPICIOUS_NTLD 4789 0.79 4.88 0.03 64 FROM_SUSPICIOUS_NTLD_FP 4764 0.78 4.86 0.02 65 MIME_QP_LONG_LINE 4657 5.50 4.75 5.64 66 BAYES_00 4638 18.39 4.73 20.94 67 RCVD_IN_BL_SPAMCOP_NET 4484 1.62 4.57 1.06 68 HTML_SHORT_LINK_IMG_1 4333 0.72 4.42 0.03 69 BAYES_60 4203 3.88 4.28 3.80 70 HTML_IMAGE_RATIO_06 4145 4.77 4.23 4.88 71 XM_URI_RBL 4143 1.00 4.22 0.40 72 BAYES_20 4095 5.18 4.17 5.37 73 XMSexyCombo_01 4049 1.92 4.13 1.50 74 XM_SendGrid 4015 6.50 4.09 6.95 75 RELAYCOUNTRY_CA 4012 1.87 4.09 1.46 76 MultiRelay_Combo 3886 0.79 3.96 0.20 77 MultiRelay_CC 3886 0.79 3.96 0.20 78 TM2_M_URI_OPT_OUT 3876 2.89 3.95 2.70 79 REPLYTO_WITHOUT_TO_CC 3728 0.63 3.80 0.04 80 RELAYCOUNTRY_FR 3463 0.87 3.53 0.37 81 RCVD_IN_RP_RNBL 3401 0.58 3.47 0.04 82 HTML_IMAGE_RATIO_08 3346 2.30 3.41 2.09 83 HDRS_LCASE_IMGONLY 3340 0.57 3.40 0.04 84 XMDiploma_00 3265 1.99 3.33 1.74 85 FROM_EXCESS_BASE64 3212 3.17 3.27 3.15 86 RCVD_IN_PSBL 3194 0.52 3.26 0.01 87 SpammyFromTLD_01 3146 1.19 3.21 0.81 88 XM_BadFromFormat 3091 0.59 3.15 0.11 89 FROM_MISSP_REPLYTO 3088 0.50 3.15 0.00 90 XMSubMetaI_00 3070 1.19 3.13 0.83 91 HTML_IMAGE_ONLY_12 3028 0.62 3.09 0.15 92 XMStrtUSub 3011 4.32 3.07 4.56 93 XM_H_TOP 3009 0.49 3.07 0.00 94 XM_CamelCaseFrm001 2969 2.15 3.03 1.98 95 URI_HEX 2948 2.33 3.01 2.21 96 T_XMDrugObfuBody_08 2937 2.18 2.99 2.03 97 T_TooManySym_01 2890 5.27 2.95 5.71 98 MIME_HEADER_CTYPE_ONLY 2864 0.53 2.92 0.08 99 BOTNET_NORDNS 2784 0.48 2.84 0.04 100 BAYES_95 2738 1.41 2.79 1.16 101 TO_EQ_FM_DOM_HTML_IMG 2738 0.44 2.79 0.00 102 NO_DNS_FOR_FROM 2705 1.35 2.76 1.09 103 HTML_IMAGE_ONLY_28 2622 0.74 2.67 0.38 104 BAYES_05 2528 3.11 2.58 3.21 105 TR_XM_DK_Bayes 2524 15.24 2.57 17.61 106 RDNS_DYNAMIC 2417 0.67 2.46 0.33 107 TR_XM_DK_Bayes1 2353 14.58 2.40 16.86 108 XMGenDplmaNmb 2299 1.23 2.34 1.02 109 ALIBABA_IMG_NOT_RCVD_ALI 2291 0.37 2.34 0.00 110 XM_DrugUnitList 2288 0.37 2.33 0.00 111 XM_OfRef6 2274 1.53 2.32 1.39 112 TR_M_TOP_BAYES 2237 0.36 2.28 0.00 113 TR_Symld_Words 2232 2.04 2.28 2.00 114 TM2_M_VERY_LONG_WORD 2223 1.60 2.27 1.47 115 T_HTML_TAG_BALANCE_CENTER 2204 0.43 2.25 0.09 116 ALL_TRUSTED 2204 13.46 2.25 15.56 117 TR_XM_PHPDW 2183 0.82 2.23 0.55 118 SUBJ_ALL_CAPS 2173 2.52 2.22 2.58 119 TR_XM_PHPForged 2159 0.83 2.20 0.57 120 TR_XM_FormFill2 2147 0.80 2.19 0.54 121 XM_H_PHPOS 2137 0.79 2.18 0.54 122 XMSexyCombo_04 2123 0.43 2.16 0.11 123 RCVD_IN_IADB_LISTED 2021 4.96 2.06 5.51 124 DKIM_ADSP_NXDOMAIN 2012 0.76 2.05 0.52 125 BODY_URI_ONLY 2004 0.42 2.04 0.12 126 T_XMDrugObfuBody_00 1978 2.02 2.02 2.02 127 HTML_EXTRA_CLOSE 1966 0.33 2.00 0.01 128 TR_XM_DK_SendGrid 1955 3.21 1.99 3.44 129 RCVD_IN_IADB_SPF 1935 4.27 1.97 4.70 130 HOSTED_IMG_DIRECT_MX 1914 0.31 1.95 0.00 131 RCVD_IN_IADB_DK 1889 3.66 1.93 3.99 132 RCVD_IN_IADB_SENDERID 1886 3.73 1.92 4.07 133 XM_H_Long_From02 1862 1.25 1.90 1.13 134 XMStockSpam_06 1832 1.43 1.87 1.34 135 DOS_RCVD_IP_TWICE_B 1781 0.34 1.82 0.06 136 XMMoneyMeta_00 1768 0.62 1.80 0.40 137 RCVD_IN_RP_SAFE 1710 8.72 1.74 10.03 138 TR_XM_RelayPhish 1650 1.09 1.68 0.97 139 HTML_IMAGE_ONLY_08 1641 0.35 1.67 0.11 140 XMBdyGiftCard01 1586 1.80 1.62 1.84 141 DIET_1 1561 0.69 1.59 0.52 142 XMPhish14 1558 0.50 1.59 0.30 143 RELAYCOUNTRY_AT 1538 0.44 1.57 0.22 144 TR_XM_DK_Bayes2 1509 12.14 1.54 14.12 145 URI_NOVOWEL 1499 0.65 1.53 0.49 146 TR_MetaPhish_Combo_01 1470 1.57 1.50 1.59 147 FROM_MISSP_DYNIP 1468 0.24 1.50 0.00 148 XMPhish30 1404 0.67 1.43 0.53 149 TR_XM_INV_DKIM 1390 0.33 1.42 0.12 150 XMPhish11 1379 1.31 1.41 1.29 151 MAILING_LIST_MULTI 1375 2.23 1.40 2.39 152 SUBJ_OBFU_PUNCT_FEW 1371 0.31 1.40 0.10 153 T_XMHurry_00 1365 0.94 1.39 0.85 154 DATE_IN_PAST_06_12 1309 0.25 1.33 0.05 155 URI_TRY_3LD 1297 1.54 1.32 1.58 156 TR_LOTS_OF_MONEY3 1294 0.64 1.32 0.51 157 XM_DK_Undo_01 1278 1.67 1.30 1.74 158 TM2_M_A_HREF_HREF 1270 1.01 1.29 0.95 159 XMSubMetaSx_01 1250 0.25 1.27 0.06 160 RCVD_IN_MSPIKE_WL 1233 4.54 1.26 5.15 161 XMHTML_After_End 1230 1.13 1.25 1.11 162 T_Symld_Words_02 1225 0.64 1.25 0.52 163 HTML_FONT_FACE_BAD 1224 0.64 1.25 0.53 164 XMBrknScrpt_02 1196 0.71 1.22 0.61 165 RELAYCOUNTRY_IN 1192 0.29 1.22 0.11 166 XMSubMetaSxObfu_03 1171 1.32 1.19 1.34 167 T_MONEY_PERCENT 1150 0.51 1.17 0.39 168 TR_LOTS_OF_MONEY2 1150 0.51 1.17 0.39 169 XM_ProductURIs 1106 0.96 1.13 0.93 170 NORDNS_LOW_CONTRAST 1099 0.18 1.12 0.00 171 XMBody_17 1074 0.73 1.09 0.66 172 XM_H_PHPMailer 1057 0.58 1.08 0.49 173 HK_RANDOM_REPLYTO 1048 0.37 1.07 0.23 174 T_FILL_THIS_FORM_SHORT 1029 0.83 1.05 0.79 175 XMSubMetaSSx_00 972 0.35 0.99 0.23 176 URIBL_DBL_SPAM 972 0.20 0.99 0.05 177 RCVD_IN_MSPIKE_H3 971 4.08 0.99 4.65 178 HTML_TAG_BALANCE_BODY 970 0.65 0.99 0.58 179 XM_H_PHPOS_M 953 0.31 0.97 0.18 180 TVD_APPROVED 952 0.27 0.97 0.14 181 T_XMDrugObfuBody_12 929 0.30 0.95 0.18 182 XM_PDF 926 3.41 0.94 3.87 183 XMSexyCombo_02 917 0.16 0.93 0.02 184 TO_NO_BRKTS_FROM_MSSP 894 0.15 0.91 0.01 185 UNPARSEABLE_RELAY 885 2.08 0.90 2.30 186 DKIM_ADSP_CUSTOM_MED 875 1.00 0.89 1.02 187 XMClaimOffer 857 0.22 0.87 0.10 188 XMHTMLBadTable_001 847 0.64 0.86 0.60 189 DATE_IN_PAST_12_24 846 0.19 0.86 0.06 190 XM_B_COPY_HTML 837 0.46 0.85 0.39 191 XM_UB60 834 0.18 0.85 0.06 192 URIBL_DBL_ABUSE_REDIR 833 0.14 0.85 0.00 193 PLING_QUERY 831 0.62 0.85 0.58 194 HTML_FONT_SIZE_HUGE 820 0.22 0.84 0.11 195 THIS_AD 818 0.27 0.83 0.17 196 HELO_NODOT 816 1.23 0.83 1.31 197 XM_Lotto 807 0.24 0.82 0.13 198 RELAYCOUNTRY_DE 790 0.45 0.81 0.39 199 URIBL_BLACK 788 0.14 0.80 0.02 200 HELO_NO_DOMAIN 779 1.23 0.79 1.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 455453 87.99 94.34 86.80 2 DKIM_SIGNED 404076 76.84 75.94 77.01 3 XM_DK_Pass 397548 75.42 73.59 75.77 4 DKIM_VALID 380946 72.13 69.63 72.60 5 XM_B_Unicode 367667 69.94 69.26 70.07 6 DCC_CHECK_NEGATIVE 289262 49.40 18.73 55.13 7 BAYES_50 282672 53.15 49.31 53.87 8 XMListUnsubscribeExists 279244 55.55 68.03 53.22 9 DKIM_VALID_AU 274936 52.56 53.45 52.40 10 DCC_CHECK 226205 48.86 79.63 43.11 11 XM_B_Unicode3 218528 42.53 47.26 41.65 12 HTML_FONT_LOW_CONTRAST 156520 30.92 36.74 29.83 13 T_TM2_M_HEADER_IN_MSG 154516 27.36 16.19 29.45 14 DKIM_VALID_EF 143745 26.69 22.94 27.40 15 LOC_TINY_FONT_1 126929 26.13 36.52 24.19 16 FVGT_m_MULTI_ODD 118602 22.88 24.34 22.60 17 XMSubLong 118440 23.06 25.68 22.57 18 MIME_HTML_ONLY 112118 24.06 38.46 21.37 19 BAYES_00 109864 18.39 4.73 20.94 20 MultiRelay 99932 19.12 19.54 19.05 21 T_KAM_HTML_FONT_INVALID 93106 17.63 17.01 17.74 22 TR_XM_DK_Bayes 92375 15.24 2.57 17.61 23 TR_XM_DK_Bayes1 88439 14.58 2.40 16.86 24 ALL_TRUSTED 81617 13.46 2.25 15.56 25 XM_Body_Dirty_Words 78059 16.02 22.14 14.88 26 TR_XM_DK_Bayes2 74082 12.14 1.54 14.12 27 XM_Multi_Part_URI 66435 13.23 16.24 12.66 28 RCVD_IN_RP_SAFE 52626 8.72 1.74 10.03 29 LOTS_OF_MONEY 51358 10.34 13.32 9.79 30 XM_Evil_Numbers_Gen 49202 10.19 14.54 9.38 31 HTML_IMAGE_RATIO_02 46916 9.95 15.32 8.94 32 RCVD_IN_RP_CERTIFIED 44897 7.32 0.71 8.56 33 LotsOfNums_01 44254 8.28 7.48 8.43 34 T_XMDrugObfuBody_14 43676 8.55 9.75 8.32 35 TooManyTo_001 40726 8.17 10.36 7.76 36 XM_DKIMWhitelistDomains 38661 6.22 0.06 7.37 37 FSL_BULK_SIG 37844 8.81 17.36 7.21 38 XM_SendGrid 36490 6.50 4.09 6.95 39 RCVD_IN_MSPIKE_H2 36075 6.61 5.17 6.88 40 BAYES_40 34762 6.48 5.70 6.63 41 HTML_IMAGE_RATIO_04 34063 6.73 8.01 6.49 42 XM_H_Long_From01 33706 6.96 9.81 6.42 43 XM_DK_Undo_02 32724 10.85 35.52 6.24 44 BOTNET_IPINHOSTNAME 30854 8.15 20.27 5.88 45 T_TooManySym_01 29952 5.27 2.95 5.71 46 MIME_QP_LONG_LINE 29613 5.50 4.75 5.64 47 XM_B_Phish_Phrases 29270 5.92 7.74 5.58 48 RCVD_IN_IADB_LISTED 28890 4.96 2.06 5.51 49 RELAYCOUNTRY_META 28498 8.28 23.52 5.43 50 BAYES_20 28186 5.18 4.17 5.37 51 RCVD_IN_MSPIKE_WL 27017 4.54 1.26 5.15 52 HTML_IMAGE_RATIO_06 25591 4.77 4.23 4.88 53 RCVD_IN_IADB_SPF 24680 4.27 1.97 4.70 54 XMSubMetaSx_00 24540 5.39 9.22 4.68 55 RCVD_IN_MSPIKE_H3 24422 4.08 0.99 4.65 56 XMStrtUSub 23906 4.32 3.07 4.56 57 DKIM_INVALID 23130 4.71 6.31 4.41 58 XMSexyCombo_05 22754 5.71 13.04 4.34 59 RCVD_IN_IADB_SENDERID 21351 3.73 1.92 4.07 60 XMNumbers 21180 4.43 6.53 4.04 61 T_REMOTE_IMAGE 21010 4.74 8.66 4.00 62 RCVD_IN_IADB_DK 20930 3.66 1.93 3.99 63 XM_PDF 20298 3.41 0.94 3.87 64 RCVD_IN_IADB_VOUCHED 20067 3.30 0.52 3.82 65 BAYES_60 19944 3.88 4.28 3.80 66 MPART_ALT_DIFF 18643 4.63 10.40 3.55 67 TR_XM_DK_SendGrid 18028 3.21 1.99 3.44 68 XM_B_SpammyTLD 17925 3.93 6.71 3.42 69 IN_ZIMBRA_NJ_WHITELIST 17817 2.86 0.01 3.40 70 BAYES_05 16825 3.11 2.58 3.21 71 FROM_EXCESS_BASE64 16517 3.17 3.27 3.15 72 ANY_BOUNCE_MESSAGE 16404 2.73 0.58 3.13 73 BOUNCE_MESSAGE 16390 2.72 0.58 3.12 74 XM_UncommonTLD01 16342 5.57 18.70 3.11 75 XM_DIRTYINTL 16239 3.60 6.33 3.09 76 BAYES_99 14451 5.66 21.23 2.75 77 TM2_M_URI_OPT_OUT 14142 2.89 3.95 2.70 78 MIME_HTML_MOSTLY 13997 3.18 5.95 2.67 79 TO_MALFORMED 13904 2.24 0.02 2.65 80 SUBJ_ALL_CAPS 13514 2.52 2.22 2.58 81 BOTNET 12991 5.73 23.17 2.48 82 RCVD_IN_IADB_OPTIN 12518 2.07 0.39 2.39 83 MAILING_LIST_MULTI 12515 2.23 1.40 2.39 84 UNPARSEABLE_RELAY 12078 2.08 0.90 2.30 85 URI_HEX 11589 2.33 3.01 2.21 86 T_TooManySym_02 11585 1.98 0.75 2.21 87 BAYES_999 11485 4.45 16.56 2.19 88 TVD_RCVD_IP 10997 1.82 0.35 2.10 89 HTML_IMAGE_RATIO_08 10966 2.30 3.41 2.09 90 HTML_MIME_NO_HTML_TAG 10720 2.64 5.83 2.04 91 KHOP_HELO_FCRDNS 10719 2.65 5.88 2.04 92 T_XMDrugObfuBody_08 10633 2.18 2.99 2.03 93 T_XMDrugObfuBody_00 10600 2.02 2.02 2.02 94 TR_Symld_Words 10485 2.04 2.28 2.00 95 XM_CamelCaseFrm001 10401 2.15 3.03 1.98 96 BAYES_80 10392 2.45 4.94 1.98 97 XM_SPF_SoftFail 10221 2.46 5.20 1.95 98 TooManyTo_002 9761 1.69 0.77 1.86 99 XMBdyGiftCard01 9637 1.80 1.62 1.84 100 XMDiploma_00 9140 1.99 3.33 1.74 101 XM_DK_Undo_01 9110 1.67 1.30 1.74 102 UNTRUSTED_Relay 9068 3.49 12.89 1.73 103 MIME_HTML_ONLY_MULTI 9015 2.48 6.53 1.72 104 CK_HELO_DYNAMIC_SPLIT_IP 8483 1.44 0.48 1.62 105 HELO_DYNAMIC_IPADDR2 8441 1.37 0.11 1.61 106 TR_MetaPhish_Combo_01 8326 1.57 1.50 1.59 107 URI_TRY_3LD 8267 1.54 1.32 1.58 108 XMSexyCombo_01 7894 1.92 4.13 1.50 109 IN_HORDE_ADDRESS_BOOK 7755 1.25 0.05 1.48 110 TM2_M_VERY_LONG_WORD 7730 1.60 2.27 1.47 111 RELAYCOUNTRY_CA 7644 1.87 4.09 1.46 112 INVALID_MSGID 7459 1.23 0.19 1.42 113 XM_OfRef6 7283 1.53 2.32 1.39 114 XMSubMetaSxObfu_03 7057 1.32 1.19 1.34 115 XMStockSpam_06 7051 1.43 1.87 1.34 116 HELO_NODOT 6861 1.23 0.83 1.31 117 HELO_NO_DOMAIN 6855 1.23 0.79 1.31 118 XMPhish11 6750 1.31 1.41 1.29 119 TooManyTo_003 6401 1.12 0.60 1.22 120 USER_IN_DEF_DKIM_WL 6328 1.02 0.01 1.21 121 TR_DCC_Bayes_99 6189 3.62 16.65 1.18 122 XMGappySubj_01 6144 1.05 0.38 1.17 123 BAYES_95 6070 1.41 2.79 1.16 124 XM_H_Long_From02 5923 1.25 1.90 1.13 125 XMCapTrack 5862 0.99 0.28 1.12 126 XMHTML_After_End 5800 1.13 1.25 1.11 127 NO_DNS_FOR_FROM 5696 1.35 2.76 1.09 128 XM_GoogleGroups 5622 0.98 0.47 1.07 129 RCVD_IN_BL_SPAMCOP_NET 5586 1.62 4.57 1.06 130 XMGenDplmaNmb 5374 1.23 2.34 1.02 131 DKIM_ADSP_CUSTOM_MED 5359 1.00 0.89 1.02 132 XM_UB50 5243 1.99 7.28 1.00 133 TR_XM_RelayPhish 5115 1.09 1.68 0.97 134 RELAYCOUNTRY_GB 5103 1.61 5.01 0.97 135 XM_RXBody 5042 0.88 0.47 0.96 136 TM2_M_A_HREF_HREF 5002 1.01 1.29 0.95 137 XM_ProductURIs 4903 0.96 1.13 0.93 138 TooManyTo_004 4657 0.83 0.49 0.89 139 XM_GRM 4592 0.74 0.00 0.88 140 T_XMHurry_00 4459 0.94 1.39 0.85 141 XMSubMetaI_00 4371 1.19 3.13 0.83 142 SpammyFromTLD_01 4241 1.19 3.21 0.81 143 T_FILL_THIS_FORM_SHORT 4128 0.83 1.05 0.79 144 NML_ADSP_CUSTOM_MED 4064 0.77 0.72 0.77 145 SUBJ_DOLLARS 3913 0.71 0.52 0.75 146 TooManyTo_005 3844 0.69 0.45 0.73 147 XMNoVowels 3621 0.67 0.59 0.69 148 XMBody_17 3466 0.73 1.09 0.66 149 XM_SPF_Unknown 3343 0.62 0.53 0.64 150 XMBody_95 3233 0.53 0.09 0.62 151 XMBrknScrpt_02 3225 0.71 1.22 0.61 152 XMBody_78 3155 0.62 0.72 0.60 153 XMHTMLBadTable_001 3142 0.64 0.86 0.60 154 HTML_TAG_BALANCE_BODY 3051 0.65 0.99 0.58 155 PLING_QUERY 3025 0.62 0.85 0.58 156 TR_XM_PHPForged 2991 0.83 2.20 0.57 157 HTTPS_HTTP_MISMATCH 2967 0.57 0.58 0.57 158 FILL_THIS_FORM 2934 0.56 0.59 0.56 159 TR_XM_PHPDW 2903 0.82 2.23 0.55 160 RELAYCOUNTRY_AU 2897 0.55 0.53 0.55 161 T_OBFU_PDF_ATTACH 2891 0.50 0.23 0.55 162 XMLngstWrd_00 2841 0.52 0.43 0.54 163 USER_IN_WHITELIST 2835 0.46 0.00 0.54 164 TR_XM_FormFill2 2825 0.80 2.19 0.54 165 XM_B_REG_HTML 2822 0.51 0.38 0.54 166 XM_H_PHPOS 2811 0.79 2.18 0.54 167 T_TooManySym_03 2811 0.49 0.27 0.54 168 HTML_FONT_FACE_BAD 2775 0.64 1.25 0.53 169 XMPhish30 2772 0.67 1.43 0.53 170 T_Symld_Words_02 2747 0.64 1.25 0.52 171 DIET_1 2742 0.69 1.59 0.52 172 DKIM_ADSP_NXDOMAIN 2732 0.76 2.05 0.52 173 TR_LOTS_OF_MONEY3 2689 0.64 1.32 0.51 174 XMLngstWrd_01 2647 0.49 0.40 0.50 175 FROM_GOV_SPOOF 2593 0.48 0.41 0.49 176 XM_H_PHPMailer 2576 0.58 1.08 0.49 177 FORGED_GMAIL_RCVD 2576 0.54 0.79 0.49 178 URI_NOVOWEL 2547 0.65 1.53 0.49 179 FILL_THIS_FORM_LONG 2505 0.48 0.51 0.48 180 XMOemUri 2503 0.43 0.15 0.48 181 XM_ShortIntro_01 2487 0.47 0.44 0.47 182 REMOVE_BEFORE_LINK 2362 0.45 0.47 0.45 183 FILL_THIS_FORM_LOAN 2361 0.41 0.23 0.45 184 TM2_M_BODY_EMPTY 2342 0.40 0.15 0.45 185 SpammyFromTLD_02 2269 2.01 10.48 0.43 186 URIBL_SBL_A 2236 0.48 0.79 0.43 187 MISSING_HEADERS 2184 0.47 0.77 0.42 188 XM_B_TRADE_HTML 2165 0.38 0.19 0.41 189 XMSubMetaSxObfu_02 2160 0.46 0.74 0.41 190 XM_URI_RBL 2103 1.00 4.22 0.40 191 XMMoneyMeta_00 2074 0.62 1.80 0.40 192 T_MONEY_PERCENT 2038 0.51 1.17 0.39 193 TR_LOTS_OF_MONEY2 2038 0.51 1.17 0.39 194 XM_B_COPY_HTML 2035 0.46 0.85 0.39 195 RELAYCOUNTRY_DE 2025 0.45 0.81 0.39 196 NUMERIC_HTTP_ADDR 2014 0.41 0.54 0.38 197 HTML_IMAGE_ONLY_28 1992 0.74 2.67 0.38 198 RELAYCOUNTRY_FR 1952 0.87 3.53 0.37 199 RELAYCOUNTRY_NL 1901 0.37 0.44 0.36 200 XMSolicitRefs_0 1893 0.38 0.46 0.36 ----------------------------------------------------------------------