Email: 680337 Autolearn: 0 AvgScore: 1.80 AvgScanTime: 2.40 sec Spam: 132815 Autolearn: 0 AvgScore: 12.66 AvgScanTime: 3.17 sec Ham: 547522 Autolearn: 0 AvgScore: -0.84 AvgScanTime: 2.21 sec Time Spent Running SA: 453.38 hours Time Spent Processing Spam: 116.78 hours Time Spent Processing Ham: 336.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127416 90.14 95.93 88.74 2 DCC_CHECK 104719 52.05 78.85 45.55 3 XM_B_Unicode 100166 71.93 75.42 71.08 4 DKIM_SIGNED 98361 77.28 74.06 78.06 5 XM_DK_Pass 95003 75.82 71.53 76.86 6 DKIM_VALID 89270 72.25 67.21 73.47 7 XMListUnsubscribeExists 85448 57.04 64.34 55.27 8 DKIM_VALID_AU 70799 55.37 53.31 55.87 9 XM_B_Unicode3 66997 43.91 50.44 42.32 10 BAYES_50 59060 52.73 44.47 54.73 11 HTML_FONT_LOW_CONTRAST 48400 30.63 36.44 29.22 12 MIME_HTML_ONLY 47829 23.32 36.01 20.24 13 XM_DK_Undo_02 45132 11.72 33.98 6.32 14 LOC_TINY_FONT_1 44074 26.77 33.18 25.22 15 XMSubLong 37777 22.77 28.44 21.39 16 FVGT_m_MULTI_ODD 34658 23.33 26.09 22.66 17 BOTNET 32605 6.82 24.55 2.52 18 BAYES_99 32195 7.16 24.24 3.01 19 MultiRelay 29953 19.41 22.55 18.64 20 DKIM_VALID_EF 29560 26.43 22.26 27.44 21 RELAYCOUNTRY_META 29388 9.02 22.13 5.84 22 XM_Body_Dirty_Words 28684 15.38 21.60 13.88 23 TR_DCC_Bayes_99 26150 4.97 19.69 1.39 24 XM_Multi_Part_URI 26031 13.49 19.60 12.01 25 DCC_CHECK_NEGATIVE 25806 46.03 19.43 52.48 26 BAYES_999 24855 5.59 18.71 2.41 27 FSL_BULK_SIG 23482 9.08 17.68 6.99 28 T_KAM_HTML_FONT_INVALID 22751 18.06 17.13 18.29 29 T_TM2_M_HEADER_IN_MSG 22102 26.46 16.64 28.84 30 BOTNET_IPINHOSTNAME 21048 6.73 15.85 4.52 31 XM_UncommonTLD01 19928 5.51 15.00 3.21 32 XM_Evil_Numbers_Gen 18949 10.91 14.27 10.10 33 XM_B_Unsub 16987 10.03 12.79 9.36 34 HTML_IMAGE_RATIO_02 15508 9.86 11.68 9.42 35 LOTS_OF_MONEY 13903 9.10 10.47 8.77 36 XMSexyCombo_05 13859 5.44 10.43 4.23 37 TooManyTo_001 13768 8.37 10.37 7.89 38 MPART_ALT_DIFF 13579 5.09 10.22 3.85 39 UNTRUSTED_Relay 13554 3.54 10.21 1.92 40 BOTNET_NORDNS 13041 2.31 9.82 0.49 41 XM_B_Phish_Phrases 12835 6.96 9.66 6.31 42 HTML_IMAGE_RATIO_04 12144 7.42 9.14 7.00 43 T_XMDrugObfuBody_14 11896 8.27 8.96 8.11 44 XM_B_SpammyTLD 10966 3.21 8.26 1.99 45 SpammyFromTLD_02 10432 1.82 7.85 0.36 46 XM_DIRTYINTL 10301 3.70 7.76 2.71 47 RCVD_IN_RP_RNBL 9699 1.82 7.30 0.49 48 HTML_MIME_NO_HTML_TAG 9456 3.00 7.12 2.01 49 DKIM_INVALID 9091 5.03 6.84 4.59 50 XMSubMetaSx_00 9065 4.45 6.83 3.87 51 XM_H_Long_From01 8848 6.75 6.66 6.77 52 LotsOfNums_01 8547 8.19 6.44 8.62 53 HTML_SHORT_LINK_IMG_1 8243 1.23 6.21 0.02 54 XM_SendGrid 8166 6.36 6.15 6.41 55 MIME_HTML_ONLY_MULTI 8085 2.78 6.09 1.98 56 BAYES_80 7860 3.07 5.92 2.38 57 RELAYCOUNTRY_GB 7752 2.06 5.84 1.15 58 XM_UB50 7721 1.86 5.81 0.90 59 MIME_HTML_MOSTLY 7528 3.27 5.67 2.69 60 URI_HEX 7398 2.65 5.57 1.94 61 T_REMOTE_IMAGE 7374 4.26 5.55 3.94 62 BAYES_60 7100 4.83 5.35 4.70 63 XMNumbers 7061 3.98 5.32 3.66 64 MultiRelay_Combo 7051 1.22 5.31 0.23 65 MultiRelay_CC 7051 1.22 5.31 0.23 66 BAYES_00 6799 17.11 5.12 20.02 67 FROM_SUSPICIOUS_NTLD 6674 1.02 5.03 0.05 68 XM_BadFromFormat 6669 1.07 5.02 0.11 69 XMStrtUSub 6664 4.62 5.02 4.53 70 XM_SPF_SoftFail 6647 2.54 5.00 1.95 71 FROM_SUSPICIOUS_NTLD_FP 6561 1.00 4.94 0.05 72 HTML_IMAGE_RATIO_06 6346 3.58 4.78 3.29 73 BODY_URI_ONLY 6271 1.00 4.72 0.10 74 RCVD_IN_MSPIKE_H2 6141 6.89 4.62 7.44 75 TM2_M_URI_OPT_OUT 6053 2.50 4.56 2.00 76 BAYES_40 6026 5.61 4.54 5.87 77 MIME_QP_LONG_LINE 5988 6.26 4.51 6.69 78 T_HTML_TAG_BALANCE_CENTER 5944 0.97 4.48 0.12 79 KHOP_HELO_FCRDNS 5796 2.61 4.36 2.19 80 BAYES_20 5781 4.60 4.35 4.66 81 FROM_EXCESS_BASE64 5577 4.01 4.20 3.96 82 HTML_IMAGE_ONLY_08 5500 0.88 4.14 0.09 83 TR_XM_DK_SendGrid 5447 3.65 4.10 3.54 84 RCVD_IN_BL_SPAMCOP_NET 5383 1.83 4.05 1.30 85 TM2_M_VERY_LONG_WORD 5119 1.67 3.85 1.14 86 XM_H_TOP 4966 0.73 3.74 0.00 87 DATE_IN_PAST_03_06 4882 0.79 3.68 0.09 88 RELAYCOUNTRY_CA 4844 1.93 3.65 1.51 89 FROM_MISSP_REPLYTO 4697 0.69 3.54 0.00 90 BAYES_95 4598 1.75 3.46 1.34 91 TR_XM_RelayPhish 4593 1.37 3.46 0.86 92 XM_URI_RBL 4518 0.88 3.40 0.26 93 NO_DNS_FOR_FROM 4431 1.44 3.34 0.98 94 HTML_IMAGE_RATIO_08 4011 2.52 3.02 2.40 95 HDRS_LCASE_IMGONLY 3980 0.62 3.00 0.04 96 TR_M_TOP_BAYES 3708 0.55 2.79 0.00 97 HTML_FONT_FACE_BAD 3693 1.22 2.78 0.85 98 T_XMDrugObfuBody_08 3648 1.74 2.75 1.50 99 RELAYCOUNTRY_FR 3625 0.82 2.73 0.36 100 XM_CamelCaseFrm001 3581 2.30 2.70 2.20 101 XM_B_Unsub2 3537 2.01 2.66 1.85 102 REPLYTO_WITHOUT_TO_CC 3499 0.54 2.63 0.03 103 XMStockSpam_06 3496 1.51 2.63 1.23 104 XMDiploma_00 3463 1.93 2.61 1.76 105 DKIM_ADSP_NXDOMAIN 3381 0.87 2.55 0.46 106 TR_XM_PHPDW 3333 1.11 2.51 0.77 107 SUBJ_ALL_CAPS 3298 2.04 2.48 1.93 108 MIME_HEADER_CTYPE_ONLY 3296 0.56 2.48 0.10 109 TR_XM_PHPForged 3265 1.09 2.46 0.75 110 TR_XM_FormFill2 3236 1.08 2.44 0.75 111 XM_H_PHPOS 3225 1.08 2.43 0.75 112 XMBdyGiftCard01 3181 1.50 2.40 1.29 113 DATE_IN_PAST_06_12 3176 0.58 2.39 0.14 114 T_TooManySym_01 3138 4.22 2.36 4.67 115 HTML_IMAGE_ONLY_12 3100 0.60 2.33 0.18 116 XMSexyCombo_01 3029 0.89 2.28 0.55 117 SpammyFromTLD_01 3027 1.08 2.28 0.79 118 BAYES_05 2902 2.76 2.18 2.90 119 XMSubMetaI_00 2867 1.30 2.16 1.09 120 XM_OfRef6 2817 1.79 2.12 1.71 121 RCVD_IN_MSPIKE_BL 2677 1.37 2.02 1.21 122 RDNS_DYNAMIC 2609 0.64 1.96 0.32 123 TR_XM_INV_DKIM 2493 0.44 1.88 0.09 124 XMGenDplmaNmb 2394 1.31 1.80 1.19 125 XMMoneyMeta_00 2381 0.72 1.79 0.46 126 RCVD_IN_IADB_LISTED 2375 4.27 1.79 4.87 127 RCVD_IN_IADB_SPF 2287 3.75 1.72 4.24 128 URI_TRY_3LD 2268 1.41 1.71 1.33 129 XMSubNoVowel 2266 0.61 1.71 0.34 130 RCVD_IN_IADB_DK 2226 3.27 1.68 3.66 131 RCVD_IN_IADB_SENDERID 2210 3.28 1.66 3.68 132 XMBody_17 2190 0.91 1.65 0.73 133 T_XMHurry_00 2184 1.01 1.64 0.86 134 ALL_TRUSTED 2176 11.08 1.64 13.36 135 TO_EQ_FM_DOM_HTML_IMG 2127 0.32 1.60 0.01 136 TR_LOTS_OF_MONEY2 2091 0.82 1.57 0.63 137 T_MONEY_PERCENT 2091 0.82 1.57 0.63 138 RCVD_IN_RP_SAFE 2021 8.69 1.52 10.43 139 HDRS_MISSP 2015 0.30 1.52 0.00 140 THIS_AD 1944 0.82 1.46 0.66 141 PDS_BTC_ID 1941 1.54 1.46 1.56 142 TR_Mismatch_TLD_02 1941 0.34 1.46 0.07 143 UNPARSEABLE_RELAY 1916 1.96 1.44 2.08 144 RCVD_IN_MSPIKE_L5 1893 0.45 1.43 0.21 145 XMPhish11 1883 1.37 1.42 1.36 146 HTML_EXTRA_CLOSE 1853 0.29 1.40 0.02 147 XM_H_PHPMailer 1851 0.69 1.39 0.53 148 T_XMDrugObfuBody_00 1828 0.77 1.38 0.63 149 DIET_1 1807 0.60 1.36 0.42 150 XMHTML_After_End 1760 1.45 1.33 1.49 151 TR_Symld_Words 1703 1.38 1.28 1.40 152 ACT_NOW_CAPS 1693 0.29 1.27 0.05 153 TR_LOTS_OF_MONEY3 1683 0.70 1.27 0.56 154 XM_DK_Undo_01 1656 1.44 1.25 1.48 155 SUBJ_DOLLARS 1635 0.60 1.23 0.45 156 PLING_QUERY 1628 0.91 1.23 0.83 157 RCVD_IN_PSBL 1624 0.28 1.22 0.05 158 AC_FROM_MANY_DOTS 1608 0.28 1.21 0.05 159 TR_XM_DK_Bayes 1533 13.21 1.15 16.14 160 RELAYCOUNTRY_NG 1515 0.22 1.14 0.00 161 XM_H_PHPOS_M 1501 0.38 1.13 0.19 162 XM_ProductURIs 1498 0.93 1.13 0.88 163 RCVD_IN_RP_CERTIFIED 1496 7.73 1.13 9.33 164 RCVD_IN_MSPIKE_WL 1464 3.87 1.10 4.54 165 MAILING_LIST_MULTI 1451 2.16 1.09 2.42 166 XMBrknScrpt_02 1449 0.81 1.09 0.74 167 LOW_PRICE 1446 0.39 1.09 0.22 168 XM_UB99 1434 0.22 1.08 0.01 169 XM_XX_Yahoo 1404 0.34 1.06 0.16 170 RELAYCOUNTRY_IE 1399 0.35 1.05 0.18 171 HELO_NODOT 1371 1.46 1.03 1.56 172 HELO_NO_DOMAIN 1365 1.46 1.03 1.56 173 TR_XM_DK_Bayes1 1352 12.63 1.02 15.45 174 XMMoneyMeta_01 1347 0.22 1.01 0.03 175 FSL_THIS_IS_ADV 1309 0.48 0.99 0.36 176 XM_H_Long_From02 1281 1.21 0.96 1.27 177 XMSexyCombo_04 1272 0.30 0.96 0.13 178 MPART_ALT_DIFF_COUNT 1268 0.46 0.95 0.34 179 FILL_THIS_FORM_LONG 1213 0.49 0.91 0.39 180 TO_NO_BRKTS_FROM_MSSP 1201 0.19 0.90 0.01 181 FROM_MISSP_DYNIP 1190 0.17 0.90 0.00 182 RCVD_IN_MSPIKE_H3 1184 3.45 0.89 4.07 183 MISSING_HEADERS 1168 0.54 0.88 0.45 184 DKIM_ADSP_CUSTOM_MED 1164 0.87 0.88 0.87 185 RELAYCOUNTRY_AT 1158 0.39 0.87 0.27 186 XMHTMLBadTable_001 1138 0.57 0.86 0.50 187 XM_SPF_Unknown 1136 1.16 0.86 1.23 188 LongTLD 1133 0.31 0.85 0.18 189 TR_Mismatch_TLD_01 1128 0.38 0.85 0.27 190 NUMERIC_HTTP_ADDR 1127 0.47 0.85 0.38 191 XMPhish30 1121 0.69 0.84 0.65 192 FSL_HELO_NON_FQDN_1 1120 0.17 0.84 0.01 193 TR_MetaPhish_Combo_01 1118 0.83 0.84 0.82 194 LONG_HEX_URI 1071 0.32 0.81 0.20 195 T_Symld_Words_02 1056 0.64 0.80 0.60 196 T_FILL_THIS_FORM_SHORT 1048 0.92 0.79 0.96 197 XM_UB999 1040 0.16 0.78 0.01 198 XM_OfRef7 1039 0.26 0.78 0.14 199 XMSubMetaSxObfu_03 1032 0.49 0.78 0.42 200 TooManyTo_002 1019 1.67 0.77 1.89 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 485855 90.14 95.93 88.74 2 DKIM_SIGNED 427389 77.28 74.06 78.06 3 XM_DK_Pass 420812 75.82 71.53 76.86 4 DKIM_VALID 402273 72.25 67.21 73.47 5 XM_B_Unicode 389205 71.93 75.42 71.08 6 DKIM_VALID_AU 305922 55.37 53.31 55.87 7 XMListUnsubscribeExists 302620 57.04 64.34 55.27 8 BAYES_50 299664 52.73 44.47 54.73 9 DCC_CHECK_NEGATIVE 287359 46.03 19.43 52.48 10 DCC_CHECK 249392 52.05 78.85 45.55 11 XM_B_Unicode3 231727 43.91 50.44 42.32 12 HTML_FONT_LOW_CONTRAST 160002 30.63 36.44 29.22 13 T_TM2_M_HEADER_IN_MSG 157885 26.46 16.64 28.84 14 DKIM_VALID_EF 150261 26.43 22.26 27.44 15 LOC_TINY_FONT_1 138062 26.77 33.18 25.22 16 FVGT_m_MULTI_ODD 124049 23.33 26.09 22.66 17 XMSubLong 117108 22.77 28.44 21.39 18 MIME_HTML_ONLY 110831 23.32 36.01 20.24 19 BAYES_00 109590 17.11 5.12 20.02 20 MultiRelay 102079 19.41 22.55 18.64 21 T_KAM_HTML_FONT_INVALID 100139 18.06 17.13 18.29 22 TR_XM_DK_Bayes 88368 13.21 1.15 16.14 23 TR_XM_DK_Bayes1 84568 12.63 1.02 15.45 24 XM_Body_Dirty_Words 75977 15.38 21.60 13.88 25 TR_XM_DK_Bayes2 74663 11.06 0.45 13.64 26 ALL_TRUSTED 73176 11.08 1.64 13.36 27 XM_Multi_Part_URI 65733 13.49 19.60 12.01 28 RCVD_IN_RP_SAFE 57080 8.69 1.52 10.43 29 XM_Evil_Numbers_Gen 55286 10.91 14.27 10.10 30 HTML_IMAGE_RATIO_02 51558 9.86 11.68 9.42 31 XM_B_Unsub 51232 10.03 12.79 9.36 32 RCVD_IN_RP_CERTIFIED 51082 7.73 1.13 9.33 33 LOTS_OF_MONEY 47991 9.10 10.47 8.77 34 LotsOfNums_01 47189 8.19 6.44 8.62 35 T_XMDrugObfuBody_14 44394 8.27 8.96 8.11 36 TooManyTo_001 43173 8.37 10.37 7.89 37 XM_DKIMWhitelistDomains 42231 6.21 0.02 7.71 38 RCVD_IN_MSPIKE_H2 40748 6.89 4.62 7.44 39 HTML_IMAGE_RATIO_04 38331 7.42 9.14 7.00 40 FSL_BULK_SIG 38298 9.08 17.68 6.99 41 XM_H_Long_From01 37055 6.75 6.66 6.77 42 MIME_QP_LONG_LINE 36614 6.26 4.51 6.69 43 XM_SendGrid 35096 6.36 6.15 6.41 44 XM_DK_Undo_02 34588 11.72 33.98 6.32 45 XM_B_Phish_Phrases 34541 6.96 9.66 6.31 46 BAYES_40 32142 5.61 4.54 5.87 47 RELAYCOUNTRY_META 31970 9.02 22.13 5.84 48 RCVD_IN_IADB_LISTED 26688 4.27 1.79 4.87 49 BAYES_60 25752 4.83 5.35 4.70 50 T_TooManySym_01 25543 4.22 2.36 4.67 51 BAYES_20 25505 4.60 4.35 4.66 52 DKIM_INVALID 25116 5.03 6.84 4.59 53 RCVD_IN_MSPIKE_WL 24857 3.87 1.10 4.54 54 XMStrtUSub 24790 4.62 5.02 4.53 55 BOTNET_IPINHOSTNAME 24723 6.73 15.85 4.52 56 XM_PDF 23474 3.60 0.75 4.29 57 RCVD_IN_IADB_SPF 23210 3.75 1.72 4.24 58 XMSexyCombo_05 23177 5.44 10.43 4.23 59 RCVD_IN_MSPIKE_H3 22294 3.45 0.89 4.07 60 FROM_EXCESS_BASE64 21693 4.01 4.20 3.96 61 T_REMOTE_IMAGE 21576 4.26 5.55 3.94 62 XMSubMetaSx_00 21187 4.45 6.83 3.87 63 MPART_ALT_DIFF 21053 5.09 10.22 3.85 64 RCVD_IN_IADB_SENDERID 20128 3.28 1.66 3.68 65 RCVD_IN_IADB_DK 20031 3.27 1.68 3.66 66 XMNumbers 20013 3.98 5.32 3.66 67 IN_ZIMBRA_NJ_WHITELIST 19536 2.87 0.01 3.57 68 TR_XM_DK_SendGrid 19375 3.65 4.10 3.54 69 HTML_IMAGE_RATIO_06 18014 3.58 4.78 3.29 70 XM_UncommonTLD01 17586 5.51 15.00 3.21 71 RCVD_IN_IADB_VOUCHED 17482 2.67 0.52 3.19 72 BAYES_99 16505 7.16 24.24 3.01 73 BAYES_05 15870 2.76 2.18 2.90 74 XM_DIRTYINTL 14842 3.70 7.76 2.71 75 MIME_HTML_MOSTLY 14743 3.27 5.67 2.69 76 BOTNET 13811 6.82 24.55 2.52 77 MAILING_LIST_MULTI 13257 2.16 1.09 2.42 78 BAYES_999 13173 5.59 18.71 2.41 79 HTML_IMAGE_RATIO_08 13119 2.52 3.02 2.40 80 BAYES_80 13032 3.07 5.92 2.38 81 XM_CamelCaseFrm001 12057 2.30 2.70 2.20 82 KHOP_HELO_FCRDNS 11968 2.61 4.36 2.19 83 ANY_BOUNCE_MESSAGE 11936 1.84 0.45 2.18 84 BOUNCE_MESSAGE 11934 1.84 0.45 2.18 85 UNPARSEABLE_RELAY 11398 1.96 1.44 2.08 86 T_TooManySym_02 11007 1.76 0.72 2.01 87 HTML_MIME_NO_HTML_TAG 10985 3.00 7.12 2.01 88 TM2_M_URI_OPT_OUT 10935 2.50 4.56 2.00 89 XM_B_SpammyTLD 10875 3.21 8.26 1.99 90 RCVD_IN_IADB_OPTIN 10856 1.67 0.40 1.98 91 MIME_HTML_ONLY_MULTI 10820 2.78 6.09 1.98 92 XM_SPF_SoftFail 10656 2.54 5.00 1.95 93 URI_HEX 10619 2.65 5.57 1.94 94 SUBJ_ALL_CAPS 10553 2.04 2.48 1.93 95 UNTRUSTED_Relay 10517 3.54 10.21 1.92 96 TVD_RCVD_IP 10457 1.60 0.33 1.91 97 TooManyTo_002 10347 1.67 0.77 1.89 98 XM_B_Unsub2 10134 2.01 2.66 1.85 99 XMDiploma_00 9661 1.93 2.61 1.76 100 XM_OfRef6 9366 1.79 2.12 1.71 101 HELO_NODOT 8556 1.46 1.03 1.56 102 HELO_NO_DOMAIN 8555 1.46 1.03 1.56 103 PDS_BTC_ID 8518 1.54 1.46 1.56 104 IN_HORDE_ADDRESS_BOOK 8513 1.26 0.03 1.55 105 RELAYCOUNTRY_CA 8290 1.93 3.65 1.51 106 T_XMDrugObfuBody_08 8188 1.74 2.75 1.50 107 XMHTML_After_End 8132 1.45 1.33 1.49 108 XM_DK_Undo_01 8129 1.44 1.25 1.48 109 CK_HELO_DYNAMIC_SPLIT_IP 7831 1.21 0.30 1.43 110 HELO_DYNAMIC_IPADDR2 7827 1.16 0.05 1.43 111 TR_Symld_Words 7678 1.38 1.28 1.40 112 TR_DCC_Bayes_99 7636 4.97 19.69 1.39 113 INVALID_MSGID 7611 1.17 0.25 1.39 114 XMPhish11 7453 1.37 1.42 1.36 115 BAYES_95 7341 1.75 3.46 1.34 116 URI_TRY_3LD 7304 1.41 1.71 1.33 117 RCVD_IN_BL_SPAMCOP_NET 7099 1.83 4.05 1.30 118 XMCapTrack 7067 1.09 0.26 1.29 119 XMBdyGiftCard01 7049 1.50 2.40 1.29 120 XM_H_Long_From02 6980 1.21 0.96 1.27 121 TooManyTo_003 6825 1.13 0.63 1.25 122 XMStockSpam_06 6746 1.51 2.63 1.23 123 XM_SPF_Unknown 6743 1.16 0.86 1.23 124 TO_MALFORMED 6640 0.98 0.03 1.21 125 RCVD_IN_MSPIKE_BL 6619 1.37 2.02 1.21 126 XMGenDplmaNmb 6503 1.31 1.80 1.19 127 USER_IN_DEF_DKIM_WL 6374 0.94 0.02 1.16 128 RELAYCOUNTRY_GB 6273 2.06 5.84 1.15 129 TM2_M_VERY_LONG_WORD 6242 1.67 3.85 1.14 130 XM_GoogleGroups 6182 0.99 0.39 1.13 131 XMSubMetaI_00 5945 1.30 2.16 1.09 132 XMGappySubj_01 5432 0.85 0.25 0.99 133 NO_DNS_FOR_FROM 5378 1.44 3.34 0.98 134 T_FILL_THIS_FORM_SHORT 5243 0.92 0.79 0.96 135 TooManyTo_004 5089 0.85 0.53 0.93 136 XMNoVowels 5045 0.83 0.46 0.92 137 XM_UB50 4922 1.86 5.81 0.90 138 XM_ProductURIs 4822 0.93 1.13 0.88 139 DKIM_ADSP_CUSTOM_MED 4762 0.87 0.88 0.87 140 TR_XM_RelayPhish 4732 1.37 3.46 0.86 141 T_XMHurry_00 4702 1.01 1.64 0.86 142 HTML_FONT_FACE_BAD 4633 1.22 2.78 0.85 143 PLING_QUERY 4550 0.91 1.23 0.83 144 TR_MetaPhish_Combo_01 4512 0.83 0.84 0.82 145 TooManyTo_005 4351 0.73 0.47 0.79 146 SpammyFromTLD_01 4325 1.08 2.28 0.79 147 TR_XM_PHPDW 4237 1.11 2.51 0.77 148 TR_XM_PHPForged 4133 1.09 2.46 0.75 149 TR_XM_FormFill2 4128 1.08 2.44 0.75 150 XM_H_PHPOS 4105 1.08 2.43 0.75 151 XMBody_95 4079 0.65 0.26 0.74 152 XMBrknScrpt_02 4041 0.81 1.09 0.74 153 XMBody_17 3990 0.91 1.65 0.73 154 XMLngstWrd_00 3924 0.73 0.76 0.72 155 XMLngstWrd_01 3734 0.69 0.75 0.68 156 HTML_TAG_BALANCE_BODY 3654 0.66 0.60 0.67 157 THIS_AD 3625 0.82 1.46 0.66 158 USER_IN_WHITELIST 3607 0.53 0.00 0.66 159 XMPhish30 3557 0.69 0.84 0.65 160 NML_ADSP_CUSTOM_MED 3501 0.66 0.75 0.64 161 TR_LOTS_OF_MONEY2 3458 0.82 1.57 0.63 162 T_MONEY_PERCENT 3458 0.82 1.57 0.63 163 T_XMDrugObfuBody_00 3434 0.77 1.38 0.63 164 HTTPS_HTTP_MISMATCH 3309 0.57 0.43 0.60 165 T_Symld_Words_02 3305 0.64 0.80 0.60 166 FROM_GOV_DKIM_AU 3133 0.48 0.10 0.57 167 TR_LOTS_OF_MONEY3 3081 0.70 1.27 0.56 168 FILL_THIS_FORM 3074 0.59 0.69 0.56 169 XMSexyCombo_01 3038 0.89 2.28 0.55 170 XM_B_REG_HTML 3027 0.48 0.19 0.55 171 RCVD_IN_MSPIKE_L3 3021 0.52 0.37 0.55 172 XM_ShortIntro_01 3007 0.50 0.29 0.55 173 T_OBFU_PDF_ATTACH 2995 0.49 0.23 0.55 174 RELAYCOUNTRY_AU 2922 0.54 0.54 0.53 175 URI_NOVOWEL 2878 0.50 0.39 0.53 176 XM_H_PHPMailer 2875 0.69 1.39 0.53 177 TM2_M_A_HREF_HREF 2763 0.53 0.65 0.50 178 XMPhish14 2755 0.55 0.74 0.50 179 XMHTMLBadTable_001 2712 0.57 0.86 0.50 180 BOTNET_NORDNS 2700 2.31 9.82 0.49 181 RCVD_IN_RP_RNBL 2696 1.82 7.30 0.49 182 XMSubMetaSxObfu_02 2657 0.48 0.45 0.49 183 T_TooManySym_03 2626 0.42 0.16 0.48 184 REMOVE_BEFORE_LINK 2589 0.44 0.30 0.47 185 XMMoneyMeta_00 2530 0.72 1.79 0.46 186 XMBody_78 2524 0.51 0.73 0.46 187 DKIM_ADSP_NXDOMAIN 2522 0.87 2.55 0.46 188 AC_DIV_BONANZA 2503 0.39 0.13 0.46 189 MISSING_HEADERS 2489 0.54 0.88 0.45 190 FROM_GOV_SPOOF 2466 0.42 0.29 0.45 191 RCVD_IN_MSPIKE_L4 2463 0.40 0.22 0.45 192 SUBJ_DOLLARS 2440 0.60 1.23 0.45 193 XMOemUri 2340 0.37 0.16 0.43 194 SHORT_HELO_AND_INLINE_IMAGE 2337 0.35 0.03 0.43 195 TM2_M_BODY_EMPTY 2335 0.37 0.14 0.43 196 XMSubMetaSxObfu_03 2315 0.49 0.78 0.42 197 XMSolicitRefs_0 2313 0.42 0.42 0.42 198 FORGED_GMAIL_RCVD 2308 0.49 0.75 0.42 199 DIET_1 2287 0.60 1.36 0.42 200 RELAYCOUNTRY_DE 2233 0.47 0.73 0.41 ----------------------------------------------------------------------