Email: 818466 Autolearn: 0 AvgScore: 2.61 AvgScanTime: 2.30 sec Spam: 170282 Autolearn: 0 AvgScore: 11.37 AvgScanTime: 2.86 sec Ham: 648184 Autolearn: 0 AvgScore: 0.31 AvgScanTime: 2.16 sec Time Spent Running SA: 523.90 hours Time Spent Processing Spam: 135.22 hours Time Spent Processing Ham: 388.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 165309 92.57 97.08 91.38 2 DCC_CHECK 140928 58.74 82.76 52.44 3 XM_B_Unicode 134258 77.28 78.84 76.87 4 DKIM_SIGNED 101274 65.94 59.47 67.64 5 XM_DK_Pass 97932 64.81 57.51 66.73 6 DKIM_VALID 90675 61.51 53.25 63.68 7 XMListUnsubscribeExists 89184 48.84 52.37 47.91 8 DKIM_VALID_AU 72174 46.53 42.38 47.62 9 BAYES_50 65909 49.35 38.71 52.15 10 XM_B_Unicode3 65351 37.05 38.38 36.70 11 T_KAM_HTML_FONT_INVALID 62466 31.65 36.68 30.33 12 XM_B_Unsub 54882 24.26 32.23 22.16 13 MIME_HTML_ONLY 49714 20.56 29.20 18.29 14 XM_DK_Undo_02 45227 10.16 26.56 5.85 15 TooManyTo_001 45194 19.56 26.54 17.72 16 LOC_TINY_FONT_1 45044 22.82 26.45 21.86 17 HTML_FONT_LOW_CONTRAST 44883 25.23 26.36 24.93 18 XM_B_Unsub2 40094 16.86 23.55 15.11 19 ALL_TRUSTED 38015 24.68 22.32 25.30 20 TooManyTo_002 36168 12.41 21.24 10.09 21 FVGT_m_MULTI_ODD 35941 19.16 21.11 18.65 22 XMSubLong 35023 18.80 20.57 18.34 23 TooManyTo_003 34800 9.75 20.44 6.94 24 XM_Body_Dirty_Words 32304 13.96 18.97 12.64 25 BAYES_99 32102 6.25 18.85 2.94 26 BAYES_80 31848 7.71 18.70 4.82 27 BOTNET 30214 5.73 17.74 2.57 28 DKIM_VALID_EF 29059 21.72 17.07 22.94 29 RELAYCOUNTRY_META 28625 7.28 16.81 4.78 30 TooManyTo_004 27677 7.31 16.25 4.97 31 DCC_CHECK_NEGATIVE 26921 39.62 15.81 45.88 32 TR_DCC_Bayes_99 26042 4.27 15.29 1.37 33 XM_Multi_Part_URI 25612 11.43 15.04 10.48 34 BAYES_999 24342 4.85 14.30 2.37 35 MultiRelay 23160 15.54 13.60 16.05 36 BOTNET_IPINHOSTNAME 23068 6.01 13.55 4.03 37 T_TM2_M_HEADER_IN_MSG 22597 22.27 13.27 24.64 38 HTML_IMAGE_RATIO_02 22135 9.40 13.00 8.45 39 FSL_BULK_SIG 21119 7.49 12.40 6.20 40 XM_UncommonTLD01 20055 4.58 11.78 2.69 41 TooManyTo_005 18865 4.98 11.08 3.38 42 XM_Evil_Numbers_Gen 18403 9.37 10.81 8.99 43 XMSexyCombo_05 16323 5.04 9.59 3.84 44 UNTRUSTED_Relay 15347 3.21 9.01 1.69 45 LOTS_OF_MONEY 14977 8.21 8.80 8.06 46 MPART_ALT_DIFF 13883 4.76 8.15 3.87 47 XM_B_Phish_Phrases 13306 5.92 7.81 5.42 48 T_XMDrugObfuBody_14 13202 7.58 7.75 7.54 49 XM_B_SpammyTLD 11832 4.23 6.95 3.51 50 XMSubMetaSx_00 11693 3.71 6.87 2.88 51 XM_H_Long_From01 11191 5.91 6.57 5.73 52 T_REMOTE_IMAGE 10899 3.99 6.40 3.36 53 DKIM_INVALID 10599 4.43 6.22 3.96 54 HTML_IMAGE_RATIO_04 10588 5.70 6.22 5.56 55 XM_DIRTYINTL 10202 3.40 5.99 2.72 56 LotsOfNums_01 9968 7.46 5.85 7.88 57 BAYES_60 9656 9.32 5.67 10.28 58 BAYES_95 9386 2.80 5.51 2.09 59 XM_UB50 8981 1.81 5.27 0.90 60 XMNumbers 8576 3.19 5.04 2.70 61 MIME_HTML_ONLY_MULTI 7741 2.86 4.55 2.41 62 MIME_HTML_MOSTLY 7667 2.78 4.50 2.33 63 BOTNET_NORDNS 7596 1.43 4.46 0.63 64 SpammyFromTLD_02 7481 1.15 4.39 0.29 65 KHOP_HELO_FCRDNS 7469 2.23 4.39 1.67 66 HTML_MIME_NO_HTML_TAG 7329 2.40 4.30 1.90 67 XM_SendGrid 7247 5.55 4.26 5.89 68 BAYES_00 7138 14.22 4.19 16.85 69 BAYES_40 6764 4.49 3.97 4.63 70 MIME_QP_LONG_LINE 6401 6.14 3.76 6.76 71 RCVD_IN_RP_RNBL 6381 1.01 3.75 0.29 72 RELAYCOUNTRY_GB 6289 1.46 3.69 0.87 73 NO_DNS_FOR_FROM 6082 1.44 3.57 0.88 74 FROM_EXCESS_BASE64 5893 2.69 3.46 2.49 75 RCVD_IN_BL_SPAMCOP_NET 5780 1.53 3.39 1.04 76 URI_HEX 5645 2.01 3.32 1.67 77 DKIM_ADSP_NXDOMAIN 5574 0.98 3.27 0.38 78 TM2_M_URI_OPT_OUT 5517 2.08 3.24 1.77 79 HTML_IMAGE_RATIO_06 5444 3.35 3.20 3.38 80 HTML_SHORT_LINK_IMG_1 5415 0.70 3.18 0.04 81 XM_SPF_SoftFail 5328 1.95 3.13 1.65 82 RCVD_IN_MSPIKE_H2 5281 5.77 3.10 6.47 83 XMStrtUSub 5189 3.36 3.05 3.44 84 MIME_HEADER_CTYPE_ONLY 5176 0.69 3.04 0.07 85 RELAYCOUNTRY_FR 4986 0.92 2.93 0.40 86 XMDiploma_00 4975 1.91 2.92 1.64 87 TR_XM_DK_SendGrid 4862 3.20 2.86 3.28 88 BAYES_20 4764 3.42 2.80 3.58 89 HDRS_LCASE_IMGONLY 4728 0.61 2.78 0.04 90 TR_XM_RelayPhish 4717 1.50 2.77 1.16 91 RDNS_DYNAMIC 4641 0.80 2.73 0.29 92 XM_URI_RBL 4596 0.77 2.70 0.27 93 FROM_SUSPICIOUS_NTLD 4522 0.65 2.66 0.12 94 FROM_SUSPICIOUS_NTLD_FP 4453 0.63 2.62 0.11 95 TM2_M_VERY_LONG_WORD 4438 1.41 2.61 1.10 96 RELAYCOUNTRY_CA 4382 1.62 2.57 1.37 97 XMSexyCombo_01 4164 0.87 2.45 0.46 98 XM_CamelCaseFrm001 3959 2.10 2.32 2.05 99 XMGenDplmaNmb 3929 1.20 2.31 0.91 100 SUSPICIOUS_RECIPS 3925 0.49 2.30 0.01 101 REPLYTO_WITHOUT_TO_CC 3833 0.49 2.25 0.03 102 XM_Combo_Sbj 3788 0.92 2.22 0.58 103 XMSubNoVowel 3701 0.67 2.17 0.28 104 XMSubMetaI_00 3691 0.95 2.17 0.63 105 HTML_IMAGE_ONLY_20 3589 0.63 2.11 0.24 106 XMStockSpam_06 3522 1.53 2.07 1.39 107 XM_OfRef6 3461 1.52 2.03 1.39 108 PDS_BTC_ID 3363 1.42 1.97 1.27 109 SpammyFromTLD_01 3289 0.92 1.93 0.66 110 RCVD_IN_MSPIKE_BL 3257 1.37 1.91 1.22 111 MultiRelay_CC 3255 0.56 1.91 0.20 112 MultiRelay_Combo 3255 0.56 1.91 0.20 113 HTML_IMAGE_ONLY_12 3254 0.51 1.91 0.14 114 T_TooManySym_01 3235 3.36 1.90 3.74 115 T_XMDrugObfuBody_08 3156 1.26 1.85 1.11 116 RCVD_IN_PSBL 3136 0.42 1.84 0.04 117 HTML_IMAGE_RATIO_08 3118 2.20 1.83 2.30 118 AC_FROM_MANY_DOTS 3113 0.41 1.83 0.04 119 XMHTML_After_End 3043 1.20 1.79 1.05 120 TR_XM_PHPDW 2770 0.75 1.63 0.51 121 BODY_URI_ONLY 2719 0.41 1.60 0.10 122 TR_XM_PHPForged 2719 0.73 1.60 0.50 123 TR_XM_FormFill2 2702 0.72 1.59 0.50 124 XM_H_PHPOS 2687 0.72 1.58 0.49 125 TR_Mismatch_TLD_02 2622 0.36 1.54 0.05 126 XMBdyGiftCard01 2615 1.38 1.54 1.34 127 RCVD_IN_MSPIKE_L5 2554 0.48 1.50 0.21 128 XM_BadFromFormat 2542 0.40 1.49 0.11 129 TR_XM_DK_Bayes 2515 11.07 1.48 13.60 130 LongTLD 2510 0.47 1.47 0.20 131 TO_EQ_FM_DOM_HTML_IMG 2412 0.30 1.42 0.01 132 DATE_IN_PAST_03_06 2407 0.40 1.41 0.13 133 T_XMDrugObfuBody_00 2402 0.81 1.41 0.65 134 TR_XM_INV_DKIM 2396 0.36 1.41 0.09 135 T_HTML_TAG_BALANCE_CENTER 2392 0.37 1.40 0.10 136 HTML_IMAGE_ONLY_08 2392 0.39 1.40 0.12 137 SUBJ_ALL_CAPS 2339 1.53 1.37 1.58 138 RCVD_IN_MSPIKE_WL 2336 3.39 1.37 3.92 139 BAYES_05 2321 2.12 1.36 2.32 140 RCVD_IN_IADB_LISTED 2312 3.98 1.36 4.67 141 TR_XM_DK_Bayes1 2293 10.55 1.35 12.97 142 XM_DK_Undo_01 2249 1.33 1.32 1.33 143 MISSING_HEADERS 2219 0.58 1.30 0.38 144 T_MONEY_PERCENT 2193 1.07 1.29 1.02 145 TR_LOTS_OF_MONEY2 2193 1.07 1.29 1.02 146 RCVD_IN_IADB_SPF 2157 3.47 1.27 4.05 147 DATE_IN_PAST_24_48 2139 0.27 1.26 0.01 148 XM_DrugUnitList 2119 0.26 1.24 0.00 149 ALIBABA_IMG_NOT_RCVD_ALI 2119 0.26 1.24 0.00 150 FROM_MISSP_REPLYTO 2109 0.26 1.24 0.00 151 RCVD_IN_IADB_DK 2092 3.00 1.23 3.47 152 RCVD_IN_IADB_SENDERID 2091 3.04 1.23 3.52 153 XMBody_17 2088 0.69 1.23 0.55 154 DIET_1 2049 0.53 1.20 0.35 155 RCVD_IN_RP_SAFE 2005 7.44 1.18 9.08 156 FSL_THIS_IS_ADV 1984 0.37 1.17 0.17 157 FROM_MISSP_DYNIP 1917 0.23 1.13 0.00 158 URI_TRY_3LD 1888 1.29 1.11 1.34 159 XMPhish11 1862 1.14 1.09 1.16 160 HTML_FONT_FACE_BAD 1844 0.82 1.08 0.76 161 TBIRD_SUSP_MIME_BDRY 1842 0.36 1.08 0.17 162 T_XMHurry_00 1837 0.75 1.08 0.66 163 XMBrknScrpt_02 1833 0.72 1.08 0.63 164 HOSTED_IMG_DIRECT_MX 1817 0.22 1.07 0.00 165 MAILING_LIST_MULTI 1791 1.62 1.05 1.77 166 TR_XM_DK_Bayes2 1689 9.23 0.99 11.40 167 XMSexyCombo_04 1671 0.29 0.98 0.10 168 XM_H_PHPMailer 1640 0.55 0.96 0.44 169 XM_H_TOP 1610 0.20 0.95 0.00 170 BITCOIN_SPAM_01 1605 0.28 0.94 0.10 171 URIBL_CSS_A 1593 0.79 0.94 0.75 172 URIBL_CSS 1593 0.79 0.94 0.75 173 RCVD_IN_MSPIKE_H3 1550 2.85 0.91 3.36 174 XM_ProductURIs 1530 0.76 0.90 0.72 175 RELAYCOUNTRY_AT 1522 0.30 0.89 0.15 176 XMSubMetaSSx_00 1513 0.28 0.89 0.12 177 TR_Symld_Words 1511 1.23 0.89 1.32 178 RELAYCOUNTRY_DE 1500 0.49 0.88 0.38 179 TM2_M_A_HREF_HREF 1471 0.51 0.86 0.42 180 UNPARSEABLE_RELAY 1453 1.57 0.85 1.75 181 XM_H_Long_From02 1410 1.16 0.83 1.24 182 SORTED_RECIPS 1399 0.17 0.82 0.00 183 THIS_AD 1382 0.28 0.81 0.14 184 XMSubMetaSxObfu_03 1370 0.47 0.80 0.38 185 XM_H_PHPOS_M 1338 0.29 0.79 0.16 186 LOW_PRICE 1332 0.37 0.78 0.26 187 RCVD_IN_RP_CERTIFIED 1323 6.63 0.78 8.16 188 URIBL_DBL_SPAM 1323 0.20 0.78 0.05 189 URIBL_DBL_ABUSE_REDIR 1291 0.16 0.76 0.00 190 TR_Mismatch_TLD_01 1290 0.39 0.76 0.29 191 XM_UB99 1285 0.16 0.75 0.01 192 DKIM_ADSP_CUSTOM_MED 1276 0.93 0.75 0.98 193 TO_NO_BRKTS_FROM_MSSP 1273 0.16 0.75 0.01 194 XMHTMLBadTable_001 1241 0.51 0.73 0.45 195 XMPhish30 1230 0.57 0.72 0.53 196 XMPhish14 1227 0.44 0.72 0.36 197 T_Symld_Words_02 1215 0.52 0.71 0.47 198 RELAYCOUNTRY_AU 1194 0.48 0.70 0.42 199 TR_LOTS_OF_MONEY3 1161 0.57 0.68 0.53 200 FORGED_GMAIL_RCVD 1098 0.55 0.64 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 592322 92.57 97.08 91.38 2 XM_B_Unicode 498261 77.28 78.84 76.87 3 DKIM_SIGNED 438424 65.94 59.47 67.64 4 XM_DK_Pass 432513 64.81 57.51 66.73 5 DKIM_VALID 412773 61.51 53.25 63.68 6 DCC_CHECK 339877 58.74 82.76 52.44 7 BAYES_50 338010 49.35 38.71 52.15 8 XMListUnsubscribeExists 310572 48.84 52.37 47.91 9 DKIM_VALID_AU 308675 46.53 42.38 47.62 10 DCC_CHECK_NEGATIVE 297373 39.62 15.81 45.88 11 XM_B_Unicode3 237907 37.05 38.38 36.70 12 T_KAM_HTML_FONT_INVALID 196583 31.65 36.68 30.33 13 ALL_TRUSTED 163985 24.68 22.32 25.30 14 HTML_FONT_LOW_CONTRAST 161595 25.23 26.36 24.93 15 T_TM2_M_HEADER_IN_MSG 159697 22.27 13.27 24.64 16 DKIM_VALID_EF 148709 21.72 17.07 22.94 17 XM_B_Unsub 143656 24.26 32.23 22.16 18 LOC_TINY_FONT_1 141716 22.82 26.45 21.86 19 FVGT_m_MULTI_ODD 120893 19.16 21.11 18.65 20 XMSubLong 118873 18.80 20.57 18.34 21 MIME_HTML_ONLY 118569 20.56 29.20 18.29 22 TooManyTo_001 114888 19.56 26.54 17.72 23 BAYES_00 109238 14.22 4.19 16.85 24 MultiRelay 104017 15.54 13.60 16.05 25 XM_B_Unsub2 97932 16.86 23.55 15.11 26 TR_XM_DK_Bayes 88127 11.07 1.48 13.60 27 TR_XM_DK_Bayes1 84090 10.55 1.35 12.97 28 XM_Body_Dirty_Words 81930 13.96 18.97 12.64 29 TR_XM_DK_Bayes2 73872 9.23 0.99 11.40 30 XM_Multi_Part_URI 67958 11.43 15.04 10.48 31 BAYES_60 66657 9.32 5.67 10.28 32 TooManyTo_002 65395 12.41 21.24 10.09 33 RCVD_IN_RP_SAFE 58857 7.44 1.18 9.08 34 XM_Evil_Numbers_Gen 58304 9.37 10.81 8.99 35 HTML_IMAGE_RATIO_02 54782 9.40 13.00 8.45 36 RCVD_IN_RP_CERTIFIED 52913 6.63 0.78 8.16 37 LOTS_OF_MONEY 52257 8.21 8.80 8.06 38 LotsOfNums_01 51090 7.46 5.85 7.88 39 T_XMDrugObfuBody_14 48846 7.58 7.75 7.54 40 TooManyTo_003 45014 9.75 20.44 6.94 41 XM_DKIMWhitelistDomains 44439 5.43 0.02 6.86 42 MIME_QP_LONG_LINE 43815 6.14 3.76 6.76 43 RCVD_IN_MSPIKE_H2 41922 5.77 3.10 6.47 44 FSL_BULK_SIG 40194 7.49 12.40 6.20 45 XM_SendGrid 38158 5.55 4.26 5.89 46 XM_DK_Undo_02 37891 10.16 26.56 5.85 47 XM_H_Long_From01 37173 5.91 6.57 5.73 48 HTML_IMAGE_RATIO_04 36024 5.70 6.22 5.56 49 XM_B_Phish_Phrases 35155 5.92 7.81 5.42 50 TooManyTo_004 32186 7.31 16.25 4.97 51 BAYES_80 31260 7.71 18.70 4.82 52 RELAYCOUNTRY_META 30965 7.28 16.81 4.78 53 RCVD_IN_IADB_LISTED 30239 3.98 1.36 4.67 54 BAYES_40 30003 4.49 3.97 4.63 55 RCVD_IN_IADB_SPF 26224 3.47 1.27 4.05 56 BOTNET_IPINHOSTNAME 26135 6.01 13.55 4.03 57 DKIM_INVALID 25651 4.43 6.22 3.96 58 RCVD_IN_MSPIKE_WL 25420 3.39 1.37 3.92 59 MPART_ALT_DIFF 25107 4.76 8.15 3.87 60 XMSexyCombo_05 24913 5.04 9.59 3.84 61 T_TooManySym_01 24235 3.36 1.90 3.74 62 XM_PDF 23583 3.00 0.57 3.64 63 BAYES_20 23227 3.42 2.80 3.58 64 RCVD_IN_IADB_SENDERID 22790 3.04 1.23 3.52 65 XM_B_SpammyTLD 22780 4.23 6.95 3.51 66 RCVD_IN_IADB_DK 22478 3.00 1.23 3.47 67 XMStrtUSub 22287 3.36 3.05 3.44 68 HTML_IMAGE_RATIO_06 21936 3.35 3.20 3.38 69 TooManyTo_005 21931 4.98 11.08 3.38 70 RCVD_IN_MSPIKE_H3 21789 2.85 0.91 3.36 71 T_REMOTE_IMAGE 21760 3.99 6.40 3.36 72 TR_XM_DK_SendGrid 21289 3.20 2.86 3.28 73 RCVD_IN_IADB_VOUCHED 20382 2.60 0.55 3.14 74 IN_ZIMBRA_NJ_WHITELIST 19845 2.43 0.01 3.06 75 BAYES_99 19041 6.25 18.85 2.94 76 XMSubMetaSx_00 18661 3.71 6.87 2.88 77 XM_DIRTYINTL 17619 3.40 5.99 2.72 78 XMNumbers 17501 3.19 5.04 2.70 79 XM_UncommonTLD01 17412 4.58 11.78 2.69 80 BOTNET 16689 5.73 17.74 2.57 81 FROM_EXCESS_BASE64 16135 2.69 3.46 2.49 82 MIME_HTML_ONLY_MULTI 15646 2.86 4.55 2.41 83 BAYES_999 15351 4.85 14.30 2.37 84 MIME_HTML_MOSTLY 15092 2.78 4.50 2.33 85 BAYES_05 15012 2.12 1.36 2.32 86 HTML_IMAGE_RATIO_08 14914 2.20 1.83 2.30 87 BAYES_95 13565 2.80 5.51 2.09 88 XM_CamelCaseFrm001 13260 2.10 2.32 2.05 89 RCVD_IN_IADB_OPTIN 12898 1.66 0.42 1.99 90 HTML_MIME_NO_HTML_TAG 12284 2.40 4.30 1.90 91 TM2_M_URI_OPT_OUT 11501 2.08 3.24 1.77 92 MAILING_LIST_MULTI 11498 1.62 1.05 1.77 93 UNPARSEABLE_RELAY 11356 1.57 0.85 1.75 94 UNTRUSTED_Relay 10922 3.21 9.01 1.69 95 URI_HEX 10820 2.01 3.32 1.67 96 KHOP_HELO_FCRDNS 10807 2.23 4.39 1.67 97 XM_SPF_SoftFail 10663 1.95 3.13 1.65 98 XMDiploma_00 10618 1.91 2.92 1.64 99 SUBJ_ALL_CAPS 10220 1.53 1.37 1.58 100 T_TooManySym_02 10006 1.33 0.50 1.54 101 TVD_RCVD_IP 9844 1.26 0.30 1.52 102 XMStockSpam_06 9029 1.53 2.07 1.39 103 XM_OfRef6 9001 1.52 2.03 1.39 104 TR_DCC_Bayes_99 8898 4.27 15.29 1.37 105 RELAYCOUNTRY_CA 8859 1.62 2.57 1.37 106 URI_TRY_3LD 8694 1.29 1.11 1.34 107 XMBdyGiftCard01 8691 1.38 1.54 1.34 108 XM_DK_Undo_01 8621 1.33 1.32 1.33 109 TR_Symld_Words 8535 1.23 0.89 1.32 110 ANY_BOUNCE_MESSAGE 8316 1.13 0.53 1.28 111 BOUNCE_MESSAGE 8314 1.13 0.53 1.28 112 IN_HORDE_ADDRESS_BOOK 8311 1.02 0.02 1.28 113 PDS_BTC_ID 8219 1.42 1.97 1.27 114 XM_H_Long_From02 8050 1.16 0.83 1.24 115 RCVD_IN_MSPIKE_BL 7923 1.37 1.91 1.22 116 HELO_NODOT 7793 1.05 0.48 1.20 117 HELO_NO_DOMAIN 7792 1.05 0.48 1.20 118 INVALID_MSGID 7615 1.02 0.44 1.17 119 CK_HELO_DYNAMIC_SPLIT_IP 7584 0.99 0.31 1.17 120 HELO_DYNAMIC_IPADDR2 7581 0.94 0.06 1.17 121 TR_XM_RelayPhish 7532 1.50 2.77 1.16 122 XMPhish11 7507 1.14 1.09 1.16 123 T_XMDrugObfuBody_08 7167 1.26 1.85 1.11 124 TM2_M_VERY_LONG_WORD 7116 1.41 2.61 1.10 125 USER_IN_DEF_DKIM_WL 7036 0.86 0.01 1.09 126 XMHTML_After_End 6807 1.20 1.79 1.05 127 RCVD_IN_BL_SPAMCOP_NET 6711 1.53 3.39 1.04 128 TO_MALFORMED 6602 0.81 0.01 1.02 129 T_MONEY_PERCENT 6600 1.07 1.29 1.02 130 TR_LOTS_OF_MONEY2 6600 1.07 1.29 1.02 131 XMGappySubj_01 6516 0.87 0.34 1.01 132 XMCapTrack 6515 0.85 0.24 1.01 133 DKIM_ADSP_CUSTOM_MED 6334 0.93 0.75 0.98 134 XM_GoogleGroups 6017 0.81 0.34 0.93 135 XMGenDplmaNmb 5927 1.20 2.31 0.91 136 XM_UB50 5818 1.81 5.27 0.90 137 NO_DNS_FOR_FROM 5680 1.44 3.57 0.88 138 RELAYCOUNTRY_GB 5665 1.46 3.69 0.87 139 T_FILL_THIS_FORM_SHORT 4982 0.73 0.58 0.77 140 HTML_FONT_FACE_BAD 4895 0.82 1.08 0.76 141 URIBL_CSS_A 4891 0.79 0.94 0.75 142 URIBL_CSS 4891 0.79 0.94 0.75 143 NML_ADSP_CUSTOM_MED 4721 0.69 0.55 0.73 144 XM_ProductURIs 4655 0.76 0.90 0.72 145 TR_MetaPhish_Combo_01 4459 0.64 0.45 0.69 146 XM_RXBody 4383 0.60 0.32 0.68 147 T_XMHurry_00 4297 0.75 1.08 0.66 148 SpammyFromTLD_01 4260 0.92 1.93 0.66 149 T_XMDrugObfuBody_00 4200 0.81 1.41 0.65 150 BOTNET_NORDNS 4115 1.43 4.46 0.63 151 XMSubMetaI_00 4090 0.95 2.17 0.63 152 XMBrknScrpt_02 4053 0.72 1.08 0.63 153 XMBody_95 3985 0.54 0.24 0.61 154 XM_SPF_Unknown 3776 0.58 0.55 0.58 155 XM_Combo_Sbj 3772 0.92 2.22 0.58 156 HTML_TAG_BALANCE_BODY 3674 0.54 0.44 0.57 157 XMBody_17 3571 0.69 1.23 0.55 158 RCVD_IN_MSPIKE_L3 3491 0.48 0.23 0.54 159 TR_LOTS_OF_MONEY3 3465 0.57 0.68 0.53 160 XMPhish30 3422 0.57 0.72 0.53 161 FORGED_GMAIL_RCVD 3410 0.55 0.64 0.53 162 HTTPS_HTTP_MISMATCH 3400 0.55 0.62 0.52 163 PLING_QUERY 3353 0.51 0.48 0.52 164 XMNoVowels 3348 0.47 0.29 0.52 165 TR_XM_PHPDW 3328 0.75 1.63 0.51 166 USER_IN_WHITELIST 3265 0.40 0.00 0.50 167 FROM_GOV_DKIM_AU 3231 0.42 0.14 0.50 168 TR_XM_PHPForged 3223 0.73 1.60 0.50 169 TR_XM_FormFill2 3215 0.72 1.59 0.50 170 XM_H_PHPOS 3187 0.72 1.58 0.49 171 FILL_THIS_FORM 3137 0.47 0.43 0.48 172 URI_NOVOWEL 3090 0.45 0.36 0.48 173 RCVD_IN_MSPIKE_L4 3082 0.41 0.18 0.48 174 T_Symld_Words_02 3052 0.52 0.71 0.47 175 SUBJ_DOLLARS 3050 0.48 0.53 0.47 176 XMBody_78 3030 0.47 0.50 0.47 177 XMSexyCombo_01 2989 0.87 2.45 0.46 178 XMHTMLBadTable_001 2934 0.51 0.73 0.45 179 XM_H_PHPMailer 2870 0.55 0.96 0.44 180 XMLngstWrd_00 2851 0.42 0.34 0.44 181 XMMoneyMeta_00 2839 0.46 0.55 0.44 182 T_OBFU_PDF_ATTACH 2822 0.37 0.14 0.44 183 XM_ShortIntro_01 2771 0.38 0.19 0.43 184 RELAYCOUNTRY_AU 2740 0.48 0.70 0.42 185 TM2_M_A_HREF_HREF 2720 0.51 0.86 0.42 186 XMLngstWrd_01 2647 0.39 0.31 0.41 187 RELAYCOUNTRY_FR 2561 0.92 2.93 0.40 188 XM_B_REG_HTML 2521 0.33 0.12 0.39 189 MISSING_HEADERS 2491 0.58 1.30 0.38 190 AC_DIV_BONANZA 2487 0.33 0.12 0.38 191 RELAYCOUNTRY_DE 2470 0.49 0.88 0.38 192 XMSubMetaSxObfu_03 2470 0.47 0.80 0.38 193 T_TooManySym_03 2449 0.32 0.12 0.38 194 DKIM_ADSP_NXDOMAIN 2443 0.98 3.27 0.38 195 FILL_THIS_FORM_LONG 2429 0.39 0.46 0.37 196 XMPhish14 2355 0.44 0.72 0.36 197 T_FILL_THIS_FORM_LOAN 2346 0.30 0.06 0.36 198 RCVD_IN_MSPIKE_H4 2346 0.33 0.19 0.36 199 TM2_M_BODY_EMPTY 2321 0.31 0.13 0.36 200 XMGappySubj_02 2287 0.30 0.12 0.35 ----------------------------------------------------------------------