Email: 773255 Autolearn: 0 AvgScore: 2.26 AvgScanTime: 2.49 sec Spam: 150127 Autolearn: 0 AvgScore: 12.25 AvgScanTime: 3.47 sec Ham: 623128 Autolearn: 0 AvgScore: -0.15 AvgScanTime: 2.25 sec Time Spent Running SA: 534.21 hours Time Spent Processing Spam: 144.61 hours Time Spent Processing Ham: 389.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144083 92.18 95.97 91.26 2 DCC_CHECK 124519 54.57 82.94 47.74 3 DKIM_SIGNED 121067 81.36 80.64 81.54 4 XM_DK_Pass 116450 79.82 77.57 80.37 5 DKIM_VALID 109623 76.19 73.02 76.95 6 XM_B_Unicode 107701 73.91 71.74 74.44 7 XMListUnsubscribeExists 103259 61.66 68.78 59.94 8 DKIM_VALID_AU 86802 56.90 57.82 56.68 9 XM_B_Unicode3 72590 44.36 48.35 43.39 10 BAYES_50 69023 54.28 45.98 56.28 11 LOC_TINY_FONT_1 55034 28.78 36.66 26.88 12 HTML_FONT_LOW_CONTRAST 54766 32.10 36.48 31.04 13 XM_DK_Undo_02 52391 12.31 34.90 6.87 14 MIME_HTML_ONLY 51453 23.61 34.27 21.04 15 FVGT_m_MULTI_ODD 42793 23.48 28.50 22.27 16 BAYES_99 38702 7.49 25.78 3.09 17 XMSubLong 37886 21.36 25.24 20.42 18 DKIM_VALID_EF 35984 26.12 23.97 26.64 19 RELAYCOUNTRY_META 33945 9.20 22.61 5.97 20 TR_DCC_Bayes_99 31550 5.26 21.02 1.47 21 MultiRelay 31270 18.59 20.83 18.05 22 XM_Body_Dirty_Words 30948 14.94 20.61 13.58 23 BOTNET 30711 5.75 20.46 2.21 24 BAYES_999 30137 5.85 20.07 2.42 25 T_KAM_HTML_FONT_INVALID 29666 20.10 19.76 20.18 26 XM_Multi_Part_URI 28224 13.60 18.80 12.34 27 FSL_BULK_SIG 26329 8.81 17.54 6.70 28 T_TM2_M_HEADER_IN_MSG 24787 25.76 16.51 27.99 29 DCC_CHECK_NEGATIVE 23531 43.45 15.67 50.14 30 BOTNET_IPINHOSTNAME 23400 6.85 15.59 4.75 31 LOTS_OF_MONEY 23109 11.55 15.39 10.62 32 XM_Evil_Numbers_Gen 20432 11.38 13.61 10.84 33 XM_B_Unsub 20216 9.86 13.47 8.99 34 HTML_IMAGE_RATIO_02 19526 10.39 13.01 9.76 35 XM_UncommonTLD01 19201 4.87 12.79 2.96 36 UNTRUSTED_Relay 17529 3.77 11.68 1.87 37 XMSexyCombo_05 15118 5.50 10.07 4.40 38 TooManyTo_001 14665 7.83 9.77 7.36 39 XM_B_Phish_Phrases 14387 6.77 9.58 6.09 40 T_XMDrugObfuBody_14 14215 8.64 9.47 8.44 41 LotsOfNums_01 12657 9.19 8.43 9.37 42 MPART_ALT_DIFF 12118 4.65 8.07 3.83 43 XM_B_SpammyTLD 11642 3.06 7.75 1.92 44 HTML_SHORT_LINK_IMG_1 11635 1.53 7.75 0.03 45 SpammyFromTLD_02 11626 1.79 7.74 0.35 46 DKIM_INVALID 11444 5.17 7.62 4.58 47 XMSubMetaSx_00 11251 4.24 7.49 3.46 48 HTML_MIME_NO_HTML_TAG 11136 3.11 7.42 2.07 49 HTML_IMAGE_RATIO_04 11134 6.60 7.42 6.40 50 XM_DIRTYINTL 10437 3.47 6.95 2.63 51 RELAYCOUNTRY_GB 9821 2.20 6.54 1.15 52 XM_SendGrid 9753 6.59 6.50 6.61 53 XM_UB50 9700 2.01 6.46 0.94 54 BAYES_80 9655 3.34 6.43 2.59 55 MIME_HTML_MOSTLY 9556 3.68 6.37 3.03 56 BOTNET_NORDNS 9246 1.22 6.16 0.03 57 T_REMOTE_IMAGE 9099 4.55 6.06 4.18 58 BODY_URI_ONLY 8986 1.22 5.99 0.07 59 MIME_QP_LONG_LINE 8902 6.72 5.93 6.92 60 T_HTML_TAG_BALANCE_CENTER 8630 1.32 5.75 0.25 61 BAYES_60 8611 5.24 5.74 5.12 62 XM_H_Long_From01 8240 6.87 5.49 7.20 63 XMNumbers 8154 3.52 5.43 3.05 64 HTML_IMAGE_ONLY_08 8077 1.14 5.38 0.12 65 XM_SPF_SoftFail 8060 2.45 5.37 1.75 66 XM_BadFromFormat 7938 1.13 5.29 0.12 67 TR_LOTS_OF_MONEY3 7820 3.10 5.21 2.59 68 MultiRelay_Combo 7771 1.18 5.18 0.22 69 MultiRelay_CC 7771 1.18 5.18 0.22 70 FROM_SUSPICIOUS_NTLD 7481 1.07 4.98 0.12 71 FROM_SUSPICIOUS_NTLD_FP 7396 1.05 4.93 0.12 72 HTML_IMAGE_RATIO_06 7269 4.09 4.84 3.90 73 URI_HEX 6853 2.67 4.56 2.21 74 BAYES_40 6642 5.34 4.42 5.56 75 RCVD_IN_MSPIKE_H2 6610 6.92 4.40 7.53 76 HDRS_LCASE_IMGONLY 6494 0.87 4.33 0.04 77 BAYES_95 6384 2.07 4.25 1.54 78 XMStrtUSub 6344 5.05 4.23 5.25 79 TR_XM_DK_SendGrid 6273 3.56 4.18 3.41 80 RELAYCOUNTRY_CA 6177 2.09 4.11 1.60 81 TM2_M_URI_OPT_OUT 6129 2.60 4.08 2.25 82 FROM_EXCESS_BASE64 5872 3.83 3.91 3.81 83 MIME_HTML_ONLY_MULTI 5780 2.41 3.85 2.07 84 SUBJ_ALL_CAPS 5732 2.20 3.82 1.82 85 RCVD_IN_BL_SPAMCOP_NET 5722 2.06 3.81 1.64 86 FROM_MISSP_REPLYTO 5317 0.69 3.54 0.00 87 HTML_EXTRA_CLOSE 5304 0.70 3.53 0.02 88 XM_URI_RBL 5192 0.90 3.46 0.29 89 TR_XM_RelayPhish 5058 1.27 3.37 0.77 90 XM_H_TOP 5043 0.66 3.36 0.01 91 TM2_M_VERY_LONG_WORD 4983 1.65 3.32 1.25 92 KHOP_HELO_FCRDNS 4900 2.00 3.26 1.70 93 BAYES_20 4723 3.97 3.15 4.17 94 DATE_IN_PAST_03_06 4654 0.72 3.10 0.15 95 XM_CamelCaseFrm001 4442 2.33 2.96 2.18 96 REPLYTO_WITHOUT_TO_CC 4394 0.60 2.93 0.03 97 XM_B_Unsub2 4314 1.98 2.87 1.76 98 XMStockSpam_06 4188 1.45 2.79 1.13 99 RCVD_IN_MSPIKE_BL 4139 1.64 2.76 1.37 100 T_XMHurry_00 4055 1.53 2.70 1.24 101 T_TooManySym_01 4042 3.70 2.69 3.94 102 XMDiploma_00 4035 2.04 2.69 1.89 103 HTML_IMAGE_ONLY_12 4014 0.67 2.67 0.18 104 MIME_HEADER_CTYPE_ONLY 3979 0.58 2.65 0.08 105 T_XMDrugObfuBody_08 3933 1.72 2.62 1.51 106 XMBdyGiftCard01 3672 1.80 2.45 1.65 107 SpammyFromTLD_01 3659 1.10 2.44 0.78 108 XMBody_17 3474 1.01 2.31 0.69 109 RELAYCOUNTRY_FR 3447 0.72 2.30 0.34 110 TR_XM_INV_DKIM 3329 0.51 2.22 0.10 111 RCVD_IN_RP_RNBL 3328 0.47 2.22 0.05 112 BAYES_00 3309 15.46 2.20 18.65 113 NO_DNS_FOR_FROM 3292 1.23 2.19 1.00 114 HTML_IMAGE_RATIO_08 3237 2.44 2.16 2.51 115 XMGenDplmaNmb 3160 1.39 2.10 1.21 116 RCVD_IN_MSPIKE_L5 3106 0.61 2.07 0.26 117 RCVD_IN_IADB_SPF 3105 4.76 2.07 5.41 118 RCVD_IN_IADB_SENDERID 3055 4.21 2.03 4.73 119 RCVD_IN_IADB_DK 3045 4.12 2.03 4.62 120 TR_XM_PHPDW 3043 1.21 2.03 1.02 121 RCVD_IN_IADB_LISTED 3037 5.43 2.02 6.25 122 TR_XM_PHPForged 2967 1.19 1.98 1.00 123 TR_XM_FormFill2 2954 1.18 1.97 0.99 124 XM_H_PHPOS 2939 1.18 1.96 0.99 125 XM_OfRef6 2935 1.33 1.96 1.18 126 XMSubMetaI_00 2857 1.32 1.90 1.18 127 XMSexyCombo_01 2747 0.66 1.83 0.38 128 BAYES_05 2746 2.56 1.83 2.73 129 T_MONEY_PERCENT 2713 1.01 1.81 0.82 130 TR_LOTS_OF_MONEY2 2713 1.01 1.81 0.82 131 HDRS_MISSP 2701 0.36 1.80 0.02 132 XMBrknScrpt_02 2450 0.93 1.63 0.76 133 T_XMDrugObfuBody_00 2435 0.89 1.62 0.72 134 XMHTML_After_End 2379 1.35 1.58 1.30 135 TO_EQ_FM_DOM_HTML_IMG 2375 0.31 1.58 0.01 136 RCVD_IN_RP_SAFE 2332 8.66 1.55 10.37 137 RCVD_IN_MSPIKE_WL 2126 4.18 1.42 4.85 138 XM_DK_Undo_01 2110 1.38 1.41 1.37 139 MAILING_LIST_MULTI 2063 2.04 1.37 2.20 140 TR_Symld_Words 2058 1.20 1.37 1.16 141 DKIM_ADSP_NXDOMAIN 2042 0.53 1.36 0.33 142 ALL_TRUSTED 2040 9.42 1.36 11.36 143 UNPARSEABLE_RELAY 2016 1.88 1.34 2.01 144 RELAYCOUNTRY_AT 2011 0.43 1.34 0.21 145 XMPhish11 2001 1.14 1.33 1.10 146 XM_H_Long_From02 1994 1.08 1.33 1.02 147 T_Symld_Words_02 1892 0.83 1.26 0.72 148 XMMoneyMeta_00 1876 0.68 1.25 0.54 149 XM_H_PHPMailer 1831 0.63 1.22 0.48 150 LongTLD 1815 0.42 1.21 0.24 151 RDNS_DYNAMIC 1796 0.48 1.20 0.31 152 THIS_AD 1793 0.61 1.19 0.47 153 XM_ProductURIs 1758 1.53 1.17 1.62 154 T_FILL_THIS_FORM_SHORT 1754 0.78 1.17 0.69 155 TR_Caps_n_Bayes_99 1697 0.24 1.13 0.02 156 XMPhish30 1684 0.68 1.12 0.57 157 XM_UB99 1684 0.22 1.12 0.01 158 RCVD_IN_PSBL 1636 0.25 1.09 0.04 159 RCVD_IN_RP_CERTIFIED 1620 7.75 1.08 9.36 160 SUBJ_DOLLARS 1612 0.69 1.07 0.60 161 TR_XM_DK_Bayes 1599 12.96 1.07 15.83 162 URI_TRY_3LD 1582 1.61 1.05 1.74 163 XM_H_PHPOS_M 1529 0.35 1.02 0.19 164 RCVD_IN_MSPIKE_H3 1506 3.70 1.00 4.35 165 XMSubNoVowel 1501 0.40 1.00 0.26 166 XM_B_COPY_HTML 1470 0.49 0.98 0.37 167 RELAYCOUNTRY_VN 1455 0.20 0.97 0.01 168 RELAYCOUNTRY_DE 1428 0.59 0.95 0.50 169 MPART_ALT_DIFF_COUNT 1412 0.42 0.94 0.29 170 DATE_IN_PAST_06_12 1411 0.27 0.94 0.11 171 PLING_QUERY 1409 0.60 0.94 0.52 172 DKIM_ADSP_CUSTOM_MED 1407 0.94 0.94 0.94 173 XMSubMetaSSx_00 1407 0.36 0.94 0.22 174 XM_XX_Yahoo 1397 0.28 0.93 0.13 175 TR_XM_DK_Bayes1 1394 12.44 0.93 15.21 176 HTTPS_HTTP_MISMATCH 1340 0.66 0.89 0.60 177 LOW_PRICE 1329 0.54 0.89 0.46 178 XM_UB60 1317 0.21 0.88 0.05 179 XM_SPF_Unknown 1285 0.74 0.86 0.71 180 TooManyTo_002 1276 1.51 0.85 1.67 181 DEAR_FRIEND 1272 0.28 0.85 0.15 182 XMSubMetaSxObfu_03 1257 0.48 0.84 0.40 183 US_DOLLARS_3 1235 0.47 0.82 0.39 184 TR_Mismatch_TLD_02 1223 0.20 0.81 0.06 185 FORGED_GMAIL_RCVD 1218 0.59 0.81 0.54 186 TM2_M_A_HREF_HREF 1211 0.43 0.81 0.34 187 HK_RANDOM_REPLYTO 1172 0.35 0.78 0.24 188 REMOVE_BEFORE_LINK 1146 0.50 0.76 0.44 189 XMPhish14 1119 0.60 0.75 0.57 190 TR_XM_DK_Bayes2 1097 10.87 0.73 13.31 191 XMHTMLBadTable_001 1080 0.56 0.72 0.52 192 XM_UB999 1080 0.14 0.72 0.01 193 NML_ADSP_CUSTOM_MED 1074 0.65 0.72 0.64 194 XM_PDF 1067 3.36 0.71 4.00 195 TooManyTo_003 1059 1.04 0.71 1.12 196 DIET_1 1051 0.49 0.70 0.44 197 XMSexyCombo_04 1041 0.18 0.69 0.06 198 XMBSHREFv2 1040 0.65 0.69 0.64 199 XM_UB80 1027 0.15 0.68 0.02 200 TR_MetaPhish_Combo_01 1020 0.81 0.68 0.84 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 568675 92.18 95.97 91.26 2 DKIM_SIGNED 508073 81.36 80.64 81.54 3 XM_DK_Pass 500790 79.82 77.57 80.37 4 DKIM_VALID 479519 76.19 73.02 76.95 5 XM_B_Unicode 463836 73.91 71.74 74.44 6 XMListUnsubscribeExists 373502 61.66 68.78 59.94 7 DKIM_VALID_AU 353212 56.90 57.82 56.68 8 BAYES_50 350707 54.28 45.98 56.28 9 DCC_CHECK_NEGATIVE 312451 43.45 15.67 50.14 10 DCC_CHECK 297475 54.57 82.94 47.74 11 XM_B_Unicode3 270393 44.36 48.35 43.39 12 HTML_FONT_LOW_CONTRAST 193427 32.10 36.48 31.04 13 T_TM2_M_HEADER_IN_MSG 174434 25.76 16.51 27.99 14 LOC_TINY_FONT_1 167477 28.78 36.66 26.88 15 DKIM_VALID_EF 166013 26.12 23.97 26.64 16 FVGT_m_MULTI_ODD 138752 23.48 28.50 22.27 17 MIME_HTML_ONLY 131099 23.61 34.27 21.04 18 XMSubLong 127260 21.36 25.24 20.42 19 T_KAM_HTML_FONT_INVALID 125759 20.10 19.76 20.18 20 BAYES_00 116218 15.46 2.20 18.65 21 MultiRelay 112498 18.59 20.83 18.05 22 TR_XM_DK_Bayes 98631 12.96 1.07 15.83 23 TR_XM_DK_Bayes1 94772 12.44 0.93 15.21 24 XM_Body_Dirty_Words 84612 14.94 20.61 13.58 25 TR_XM_DK_Bayes2 82951 10.87 0.73 13.31 26 XM_Multi_Part_URI 76910 13.60 18.80 12.34 27 ALL_TRUSTED 70766 9.42 1.36 11.36 28 XM_Evil_Numbers_Gen 67559 11.38 13.61 10.84 29 LOTS_OF_MONEY 66191 11.55 15.39 10.62 30 RCVD_IN_RP_SAFE 64644 8.66 1.55 10.37 31 HTML_IMAGE_RATIO_02 60798 10.39 13.01 9.76 32 LotsOfNums_01 58405 9.19 8.43 9.37 33 RCVD_IN_RP_CERTIFIED 58327 7.75 1.08 9.36 34 XM_B_Unsub 55999 9.86 13.47 8.99 35 T_XMDrugObfuBody_14 52565 8.64 9.47 8.44 36 RCVD_IN_MSPIKE_H2 46891 6.92 4.40 7.53 37 XM_DKIMWhitelistDomains 45997 5.96 0.03 7.38 38 TooManyTo_001 45855 7.83 9.77 7.36 39 XM_H_Long_From01 44861 6.87 5.49 7.20 40 MIME_QP_LONG_LINE 43094 6.72 5.93 6.92 41 XM_DK_Undo_02 42806 12.31 34.90 6.87 42 FSL_BULK_SIG 41771 8.81 17.54 6.70 43 XM_SendGrid 41184 6.59 6.50 6.61 44 HTML_IMAGE_RATIO_04 39892 6.60 7.42 6.40 45 RCVD_IN_IADB_LISTED 38917 5.43 2.02 6.25 46 XM_B_Phish_Phrases 37935 6.77 9.58 6.09 47 RELAYCOUNTRY_META 37174 9.20 22.61 5.97 48 BAYES_40 34658 5.34 4.42 5.56 49 RCVD_IN_IADB_SPF 33712 4.76 2.07 5.41 50 XMStrtUSub 32731 5.05 4.23 5.25 51 BAYES_60 31918 5.24 5.74 5.12 52 RCVD_IN_MSPIKE_WL 30210 4.18 1.42 4.85 53 BOTNET_IPINHOSTNAME 29590 6.85 15.59 4.75 54 RCVD_IN_IADB_SENDERID 29481 4.21 2.03 4.73 55 RCVD_IN_IADB_DK 28787 4.12 2.03 4.62 56 DKIM_INVALID 28554 5.17 7.62 4.58 57 XMSexyCombo_05 27426 5.50 10.07 4.40 58 RCVD_IN_MSPIKE_H3 27111 3.70 1.00 4.35 59 T_REMOTE_IMAGE 26066 4.55 6.06 4.18 60 BAYES_20 26010 3.97 3.15 4.17 61 RCVD_IN_IADB_VOUCHED 25428 3.40 0.58 4.08 62 XM_PDF 24951 3.36 0.71 4.00 63 T_TooManySym_01 24571 3.70 2.69 3.94 64 HTML_IMAGE_RATIO_06 24319 4.09 4.84 3.90 65 MPART_ALT_DIFF 23841 4.65 8.07 3.83 66 FROM_EXCESS_BASE64 23720 3.83 3.91 3.81 67 IN_ZIMBRA_NJ_WHITELIST 21744 2.82 0.02 3.49 68 XMSubMetaSx_00 21535 4.24 7.49 3.46 69 TR_XM_DK_SendGrid 21255 3.56 4.18 3.41 70 BAYES_99 19238 7.49 25.78 3.09 71 XMNumbers 19026 3.52 5.43 3.05 72 MIME_HTML_MOSTLY 18902 3.68 6.37 3.03 73 XM_UncommonTLD01 18475 4.87 12.79 2.96 74 BAYES_05 17025 2.56 1.83 2.73 75 XM_DIRTYINTL 16384 3.47 6.95 2.63 76 RCVD_IN_IADB_OPTIN 16276 2.19 0.43 2.61 77 BAYES_80 16144 3.34 6.43 2.59 78 TR_LOTS_OF_MONEY3 16134 3.10 5.21 2.59 79 HTML_IMAGE_RATIO_08 15657 2.44 2.16 2.51 80 BAYES_999 15069 5.85 20.07 2.42 81 TM2_M_URI_OPT_OUT 13996 2.60 4.08 2.25 82 BOTNET 13774 5.75 20.46 2.21 83 URI_HEX 13755 2.67 4.56 2.21 84 MAILING_LIST_MULTI 13708 2.04 1.37 2.20 85 XM_CamelCaseFrm001 13582 2.33 2.96 2.18 86 HTML_MIME_NO_HTML_TAG 12918 3.11 7.42 2.07 87 MIME_HTML_ONLY_MULTI 12880 2.41 3.85 2.07 88 UNPARSEABLE_RELAY 12537 1.88 1.34 2.01 89 XM_B_SpammyTLD 11982 3.06 7.75 1.92 90 XMDiploma_00 11759 2.04 2.69 1.89 91 UNTRUSTED_Relay 11642 3.77 11.68 1.87 92 SUBJ_ALL_CAPS 11314 2.20 3.82 1.82 93 XM_B_Unsub2 10969 1.98 2.87 1.76 94 XM_SPF_SoftFail 10896 2.45 5.37 1.75 95 URI_TRY_3LD 10871 1.61 1.05 1.74 96 TVD_RCVD_IP 10588 1.43 0.34 1.70 97 KHOP_HELO_FCRDNS 10587 2.00 3.26 1.70 98 TooManyTo_002 10434 1.51 0.85 1.67 99 T_TooManySym_02 10383 1.46 0.61 1.67 100 XMBdyGiftCard01 10272 1.80 2.45 1.65 101 RCVD_IN_BL_SPAMCOP_NET 10212 2.06 3.81 1.64 102 XM_ProductURIs 10078 1.53 1.17 1.62 103 RELAYCOUNTRY_CA 10001 2.09 4.11 1.60 104 BAYES_95 9623 2.07 4.25 1.54 105 IN_HORDE_ADDRESS_BOOK 9550 1.24 0.03 1.53 106 T_XMDrugObfuBody_08 9390 1.72 2.62 1.51 107 TR_DCC_Bayes_99 9142 5.26 21.02 1.47 108 HELO_NODOT 8828 1.26 0.62 1.42 109 HELO_NO_DOMAIN 8825 1.26 0.62 1.42 110 XM_DK_Undo_01 8553 1.38 1.41 1.37 111 RCVD_IN_MSPIKE_BL 8514 1.64 2.76 1.37 112 ANY_BOUNCE_MESSAGE 8163 1.12 0.33 1.31 113 BOUNCE_MESSAGE 8159 1.12 0.33 1.31 114 CK_HELO_DYNAMIC_SPLIT_IP 8139 1.12 0.35 1.31 115 HELO_DYNAMIC_IPADDR2 8135 1.06 0.06 1.31 116 XMHTML_After_End 8097 1.35 1.58 1.30 117 TM2_M_VERY_LONG_WORD 7795 1.65 3.32 1.25 118 T_XMHurry_00 7755 1.53 2.70 1.24 119 XMGenDplmaNmb 7566 1.39 2.10 1.21 120 INVALID_MSGID 7524 1.05 0.39 1.21 121 XMCapTrack 7483 1.01 0.22 1.20 122 XM_OfRef6 7343 1.33 1.96 1.18 123 XMSubMetaI_00 7327 1.32 1.90 1.18 124 TR_Symld_Words 7229 1.20 1.37 1.16 125 RELAYCOUNTRY_GB 7180 2.20 6.54 1.15 126 XMStockSpam_06 7036 1.45 2.79 1.13 127 TooManyTo_003 6961 1.04 0.71 1.12 128 XMPhish11 6841 1.14 1.33 1.10 129 TO_MALFORMED 6619 0.86 0.01 1.06 130 TR_XM_PHPDW 6332 1.21 2.03 1.02 131 XM_H_Long_From02 6329 1.08 1.33 1.02 132 XM_GoogleGroups 6257 0.89 0.42 1.00 133 NO_DNS_FOR_FROM 6216 1.23 2.19 1.00 134 TR_XM_PHPForged 6215 1.19 1.98 1.00 135 TR_XM_FormFill2 6190 1.18 1.97 0.99 136 XM_H_PHPOS 6169 1.18 1.96 0.99 137 XM_UB50 5879 2.01 6.46 0.94 138 DKIM_ADSP_CUSTOM_MED 5829 0.94 0.94 0.94 139 USER_IN_DEF_DKIM_WL 5758 0.75 0.00 0.92 140 XMGappySubj_01 5512 0.78 0.34 0.88 141 XM_RXBody 5312 0.75 0.34 0.85 142 TR_MetaPhish_Combo_01 5209 0.81 0.68 0.84 143 TooManyTo_004 5192 0.79 0.62 0.83 144 T_MONEY_PERCENT 5097 1.01 1.81 0.82 145 TR_LOTS_OF_MONEY2 5097 1.01 1.81 0.82 146 SpammyFromTLD_01 4830 1.10 2.44 0.78 147 TR_XM_RelayPhish 4779 1.27 3.37 0.77 148 XMBrknScrpt_02 4748 0.93 1.63 0.76 149 T_Symld_Words_02 4488 0.83 1.26 0.72 150 T_XMDrugObfuBody_00 4480 0.89 1.62 0.72 151 XM_SPF_Unknown 4401 0.74 0.86 0.71 152 XMBody_17 4315 1.01 2.31 0.69 153 T_FILL_THIS_FORM_SHORT 4286 0.78 1.17 0.69 154 TooManyTo_005 4257 0.65 0.54 0.68 155 PDS_BTC_ID 4191 0.66 0.61 0.67 156 RCVD_IN_MSPIKE_L3 4180 0.65 0.56 0.67 157 T_OBFU_PDF_ATTACH 4134 0.57 0.20 0.66 158 NML_ADSP_CUSTOM_MED 3980 0.65 0.72 0.64 159 XM_Body_Obfu01 3979 0.62 0.54 0.64 160 XMBSHREFv2 3979 0.65 0.69 0.64 161 XMNoVowels 3942 0.58 0.36 0.63 162 HTTPS_HTTP_MISMATCH 3765 0.66 0.89 0.60 163 SUBJ_DOLLARS 3723 0.69 1.07 0.60 164 RELAYCOUNTRY_AU 3717 0.61 0.65 0.60 165 HTML_FONT_FACE_BAD 3582 0.58 0.59 0.57 166 XMPhish30 3572 0.68 1.12 0.57 167 URI_NOVOWEL 3559 0.57 0.58 0.57 168 XMPhish14 3551 0.60 0.75 0.57 169 TO_NO_BRKTS_HTML_ONLY 3543 0.50 0.20 0.57 170 HTML_TAG_BALANCE_BODY 3483 0.57 0.62 0.56 171 FROM_GOV_DKIM_AU 3475 0.47 0.11 0.56 172 FORGED_GMAIL_RCVD 3358 0.59 0.81 0.54 173 XMMoneyMeta_00 3349 0.68 1.25 0.54 174 XMHTMLBadTable_001 3242 0.56 0.72 0.52 175 XMBody_95 3224 0.44 0.12 0.52 176 PLING_QUERY 3220 0.60 0.94 0.52 177 RELAYCOUNTRY_DE 3125 0.59 0.95 0.50 178 XMBody_78 3035 0.49 0.48 0.49 179 XMOemUri 3031 0.44 0.24 0.49 180 XM_H_PHPMailer 3010 0.63 1.22 0.48 181 XM_ShortIntro_01 2973 0.43 0.25 0.48 182 THIS_AD 2911 0.61 1.19 0.47 183 LOW_PRICE 2878 0.54 0.89 0.46 184 MISSING_HEADERS 2806 0.45 0.46 0.45 185 FSL_THIS_IS_ADV 2763 0.40 0.24 0.44 186 USER_IN_WHITELIST 2751 0.36 0.00 0.44 187 RCVD_IN_MSPIKE_L4 2740 0.38 0.13 0.44 188 XMLngstWrd_00 2728 0.40 0.26 0.44 189 DIET_1 2726 0.49 0.70 0.44 190 REMOVE_BEFORE_LINK 2724 0.50 0.76 0.44 191 FILL_THIS_FORM 2541 0.41 0.43 0.41 192 XMLngstWrd_01 2512 0.37 0.24 0.40 193 T_TooManySym_03 2510 0.35 0.15 0.40 194 XMSolicitRefs_0 2490 0.41 0.43 0.40 195 XMSubMetaSxObfu_03 2466 0.48 0.84 0.40 196 URIBL_CSS 2447 0.40 0.43 0.39 197 URIBL_CSS_A 2447 0.40 0.43 0.39 198 SHORT_HELO_AND_INLINE_IMAGE 2416 0.32 0.06 0.39 199 US_DOLLARS_3 2410 0.47 0.82 0.39 200 XMSexyCombo_01 2395 0.66 1.83 0.38 ----------------------------------------------------------------------