Email: 388304 Autolearn: 0 AvgScore: 1.55 AvgScanTime: 2.32 sec Spam: 80182 Autolearn: 0 AvgScore: 12.39 AvgScanTime: 3.08 sec Ham: 308122 Autolearn: 0 AvgScore: -1.27 AvgScanTime: 2.12 sec Time Spent Running SA: 250.04 hours Time Spent Processing Spam: 68.58 hours Time Spent Processing Ham: 181.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 76426 90.35 95.32 89.06 2 DCC_CHECK 64915 61.12 80.96 55.95 3 DKIM_SIGNED 62587 83.69 78.06 85.16 4 XM_DK_Pass 60654 82.40 75.65 84.16 5 XM_B_Unicode 59098 75.19 73.70 75.57 6 DKIM_VALID 56399 78.74 70.34 80.93 7 XMListUnsubscribeExists 53173 64.81 66.32 64.42 8 DKIM_VALID_AU 47198 65.90 58.86 67.73 9 XM_B_Unicode3 38198 48.65 47.64 48.91 10 BAYES_50 35439 53.33 44.20 55.70 11 LOC_TINY_FONT_1 32069 34.51 40.00 33.08 12 HTML_FONT_LOW_CONTRAST 31333 35.24 39.08 34.24 13 XM_DK_Undo_02 30630 14.44 38.20 8.26 14 MIME_HTML_ONLY 28098 25.67 35.04 23.23 15 BAYES_99 23345 9.85 29.12 4.84 16 FVGT_m_MULTI_ODD 22100 23.66 27.56 22.64 17 XM_Body_Dirty_Words 20136 19.16 25.11 17.61 18 XMSubLong 19862 21.86 24.77 21.11 19 BAYES_999 19142 8.13 23.87 4.03 20 TR_DCC_Bayes_99 19089 7.04 23.81 2.68 21 RELAYCOUNTRY_META 18342 8.63 22.88 4.92 22 DKIM_VALID_EF 17740 26.83 22.12 28.05 23 BOTNET_IPINHOSTNAME 17032 9.15 21.24 6.01 24 XM_UncommonTLD01 16523 7.17 20.61 3.67 25 FSL_BULK_SIG 16008 10.10 19.96 7.53 26 XM_B_Unsub 14854 12.34 18.53 10.73 27 BOTNET 14703 5.58 18.34 2.26 28 MultiRelay 14544 16.31 18.14 15.83 29 XM_Multi_Part_URI 14256 16.18 17.78 15.76 30 DCC_CHECK_NEGATIVE 14188 37.64 17.69 42.83 31 T_KAM_HTML_FONT_INVALID 14012 16.85 17.48 16.69 32 HTML_IMAGE_RATIO_02 13302 14.64 16.59 14.13 33 XM_Evil_Numbers_Gen 11964 12.96 14.92 12.45 34 XMSexyCombo_05 11663 7.63 14.55 5.83 35 SpammyFromTLD_02 11530 3.18 14.38 0.27 36 T_TM2_M_HEADER_IN_MSG 11473 20.00 14.31 21.48 37 LOTS_OF_MONEY 10022 9.10 12.50 8.22 38 UNTRUSTED_Relay 9527 4.02 11.88 1.97 39 XMSubMetaSx_00 9367 5.76 11.68 4.22 40 HTML_IMAGE_RATIO_04 9132 9.18 11.39 8.61 41 XM_B_Phish_Phrases 8923 9.95 11.13 9.64 42 T_XMDrugObfuBody_14 8632 9.43 10.77 9.09 43 TooManyTo_001 7851 6.93 9.79 6.19 44 MPART_ALT_DIFF 7346 5.53 9.16 4.58 45 XM_B_SpammyTLD 7168 4.10 8.94 2.84 46 XM_DIRTYINTL 6943 4.88 8.66 3.90 47 DKIM_INVALID 6188 4.95 7.72 4.23 48 MIME_HTML_MOSTLY 5826 4.89 7.27 4.27 49 XM_H_Long_From01 5770 6.78 7.20 6.67 50 XMNumbers 5431 4.44 6.77 3.83 51 T_REMOTE_IMAGE 5195 3.60 6.48 2.86 52 XM_UB50 5191 2.09 6.47 0.95 53 KHOP_HELO_FCRDNS 5101 2.35 6.36 1.31 54 BAYES_80 4962 3.58 6.19 2.90 55 URI_HEX 4768 3.12 5.95 2.38 56 RELAYCOUNTRY_GB 4714 1.69 5.88 0.60 57 LotsOfNums_01 4651 8.05 5.80 8.64 58 REPLYTO_WITHOUT_TO_CC 4358 1.14 5.44 0.02 59 FROM_EXCESS_BASE64 4348 5.02 5.42 4.92 60 XMSexyCombo_01 4298 1.61 5.36 0.64 61 HTML_SHORT_LINK_IMG_1 4204 1.11 5.24 0.03 62 RCVD_IN_MSPIKE_H2 3859 7.47 4.81 8.16 63 TR_XM_RelayPhish 3785 2.42 4.72 1.82 64 HTML_IMAGE_ONLY_12 3730 1.05 4.65 0.11 65 MIME_HEADER_CTYPE_ONLY 3698 1.09 4.61 0.18 66 FROM_SUSPICIOUS_NTLD 3686 1.00 4.60 0.06 67 FROM_SUSPICIOUS_NTLD_FP 3652 0.99 4.55 0.06 68 HDRS_LCASE_IMGONLY 3629 0.95 4.53 0.02 69 XM_SendGrid 3617 7.21 4.51 7.92 70 XMDiploma_00 3617 2.15 4.51 1.54 71 TO_EQ_FM_DOM_HTML_IMG 3607 0.93 4.50 0.00 72 BAYES_40 3547 4.70 4.42 4.77 73 BAYES_60 3502 5.07 4.37 5.26 74 XMStockSpam_06 3460 2.14 4.32 1.57 75 T_MONEY_PERCENT 3188 2.06 3.98 1.56 76 TR_LOTS_OF_MONEY2 3188 2.06 3.98 1.56 77 T_TooManySym_01 3166 5.10 3.95 5.40 78 XMSexyCombo_04 3142 0.91 3.92 0.13 79 HTML_IMAGE_RATIO_06 3106 3.00 3.87 2.77 80 MIME_QP_LONG_LINE 3091 4.32 3.85 4.45 81 MIME_HTML_ONLY_MULTI 3054 2.51 3.81 2.17 82 BAYES_20 3051 3.75 3.81 3.74 83 XM_CamelCaseFrm001 3016 2.75 3.76 2.49 84 RCVD_IN_BL_SPAMCOP_NET 2903 1.71 3.62 1.22 85 XMStrtUSub 2855 5.33 3.56 5.79 86 BAYES_95 2846 2.09 3.55 1.71 87 XM_ProductURIs 2835 2.39 3.54 2.09 88 RELAYCOUNTRY_FR 2767 0.98 3.45 0.34 89 XMSubMetaI_00 2747 1.81 3.43 1.39 90 NORDNS_LOW_CONTRAST 2747 0.71 3.43 0.01 91 TM2_M_URI_OPT_OUT 2737 2.05 3.41 1.69 92 HTML_MIME_NO_HTML_TAG 2689 1.85 3.35 1.45 93 XMBdyGiftCard01 2680 3.54 3.34 3.59 94 DATE_IN_PAST_03_06 2671 0.81 3.33 0.16 95 RELAYCOUNTRY_CA 2644 1.91 3.30 1.55 96 NO_DNS_FOR_FROM 2415 1.67 3.01 1.33 97 LOW_PRICE 2409 1.03 3.00 0.51 98 SpammyFromTLD_01 2375 1.00 2.96 0.49 99 XMSubMetaSxObfu_03 2328 1.07 2.90 0.60 100 XM_B_Unsub2 2270 2.11 2.83 1.92 101 XM_SPF_SoftFail 2215 1.70 2.76 1.43 102 DKIM_ADSP_NXDOMAIN 2188 0.92 2.73 0.45 103 HTML_IMAGE_RATIO_08 2152 3.40 2.68 3.59 104 TR_XM_DK_SendGrid 2075 4.45 2.59 4.94 105 XM_URI_RBL 2066 0.88 2.58 0.44 106 TR_XM_INV_DKIM 2028 0.64 2.53 0.14 107 RCVD_IN_RP_RNBL 2024 0.57 2.52 0.06 108 TM2_M_VERY_LONG_WORD 2000 1.88 2.49 1.71 109 XM_DKIMWhitelistDomains 1976 9.70 2.46 11.58 110 XMBody_17 1965 1.00 2.45 0.62 111 BAYES_05 1964 2.48 2.45 2.48 112 SUBJ_OBFU_PUNCT_FEW 1915 0.53 2.39 0.05 113 RCVD_IN_RP_SAFE 1848 15.01 2.30 18.32 114 RDNS_DYNAMIC 1829 0.83 2.28 0.46 115 MultiRelay_CC 1774 0.59 2.21 0.17 116 MultiRelay_Combo 1774 0.59 2.21 0.17 117 T_XMDrugObfuBody_08 1772 1.33 2.21 1.10 118 TR_XM_PHPDW 1722 0.87 2.15 0.53 119 TR_XM_PHPForged 1680 0.85 2.10 0.52 120 TR_XM_FormFill2 1671 0.84 2.08 0.52 121 XM_H_PHPOS 1668 0.84 2.08 0.51 122 TR_Mismatch_TLD_02 1612 0.46 2.01 0.06 123 XMGenDplmaNmb 1595 1.07 1.99 0.83 124 RCVD_IN_PSBL 1583 0.45 1.97 0.05 125 SUBJ_ALL_CAPS 1542 2.24 1.92 2.33 126 TVD_SPACE_RATIO 1492 0.60 1.86 0.28 127 T_TooManySym_02 1438 2.47 1.79 2.64 128 XM_H_Long_From02 1432 1.30 1.79 1.17 129 DATE_IN_PAST_06_12 1429 0.46 1.78 0.12 130 URI_TRY_3LD 1382 1.52 1.72 1.46 131 XM_OfRef6 1377 1.93 1.72 1.99 132 RCVD_IN_MSPIKE_WL 1369 3.85 1.71 4.40 133 SUBJ_DOLLARS 1357 0.96 1.69 0.77 134 BAYES_00 1320 14.85 1.65 18.29 135 XM_H_PHPMailer 1312 0.71 1.64 0.47 136 FROM_MISSP_REPLYTO 1296 0.34 1.62 0.00 137 RCVD_IN_MSPIKE_BL 1284 1.07 1.60 0.94 138 TVD_SPACE_RATIO_MINFP 1270 0.33 1.58 0.01 139 RCVD_IN_RP_CERTIFIED 1250 13.56 1.56 16.68 140 RELAYCOUNTRY_DE 1239 0.67 1.55 0.44 141 BOTNET_NORDNS 1234 0.33 1.54 0.01 142 RCVD_IN_MSPIKE_H3 1180 3.33 1.47 3.81 143 RELAYCOUNTRY_AT 1158 0.58 1.44 0.36 144 URIBL_DBL_ABUSE_REDIR 1128 0.30 1.41 0.01 145 XM_H_PHPOS_M 1125 0.45 1.40 0.21 146 TR_Mismatch_TLD_01 1123 0.59 1.40 0.38 147 RCVD_IN_IADB_LISTED 1114 3.11 1.39 3.56 148 ALL_TRUSTED 1097 8.38 1.37 10.20 149 FROM_MISSP_DYNIP 1087 0.28 1.36 0.00 150 T_XMHurry_00 1074 0.85 1.34 0.72 151 RCVD_IN_IADB_SPF 1025 2.73 1.28 3.11 152 TR_Symld_Words 1013 1.14 1.26 1.11 153 RCVD_IN_MSPIKE_L5 1001 0.42 1.25 0.20 154 XMSubMetaSSx_00 998 0.39 1.24 0.17 155 RCVD_IN_IADB_SENDERID 996 2.45 1.24 2.76 156 RCVD_IN_IADB_DK 993 2.38 1.24 2.68 157 ANY_BOUNCE_MESSAGE 955 1.81 1.19 1.98 158 BOUNCE_MESSAGE 955 1.81 1.19 1.98 159 XMGppyBdWords 944 0.37 1.18 0.16 160 XMPhish30 901 1.32 1.12 1.37 161 XMPhish11 897 1.01 1.12 0.99 162 THIS_AD 884 0.86 1.10 0.79 163 LongTLD 883 0.35 1.10 0.16 164 XMSubMetaI_01 873 0.27 1.09 0.05 165 XMSubMetaD_03 870 0.26 1.09 0.04 166 DIET_1 841 0.77 1.05 0.70 167 UNPARSEABLE_RELAY 838 2.79 1.05 3.25 168 TM2_M_A_HREF_HREF 833 0.49 1.04 0.35 169 BODY_SINGLE_URI 830 0.23 1.04 0.03 170 BODY_SINGLE_WORD 830 0.24 1.04 0.03 171 T_XMDrugObfuBody_00 821 0.61 1.02 0.50 172 DKIM_ADSP_CUSTOM_MED 813 1.00 1.01 0.99 173 XMGappySubj_01 812 1.18 1.01 1.22 174 HK_RANDOM_REPLYTO 792 0.37 0.99 0.21 175 XM_BadFromFormat 767 0.27 0.96 0.09 176 XMSubNoVowel 748 0.36 0.93 0.22 177 NML_ADSP_CUSTOM_MED 745 0.77 0.93 0.73 178 XMSubMetaSxObfu_02 726 0.87 0.91 0.86 179 MAILING_LIST_MULTI 704 1.56 0.88 1.74 180 XM_DK_Undo_01 702 1.12 0.88 1.18 181 XMSlimDrugH 695 0.55 0.87 0.46 182 FORGED_GMAIL_RCVD 688 0.62 0.86 0.56 183 XMGappySubj_02 686 0.30 0.86 0.16 184 XMBrknScrpt_02 671 0.71 0.84 0.68 185 CK_HELO_DYNAMIC_SPLIT_IP 659 2.12 0.82 2.46 186 T_Symld_Words_02 659 0.52 0.82 0.44 187 URIBL_BLACK 656 0.18 0.82 0.01 188 DATE_IN_PAST_12_24 655 0.19 0.82 0.03 189 SUBJ_OBFU_PUNCT_MANY 644 0.17 0.80 0.00 190 XM_UB99 637 0.17 0.79 0.01 191 HTML_IMAGE_ONLY_08 626 0.24 0.78 0.10 192 TR_MetaPhish_Combo_01 621 0.79 0.77 0.80 193 RELAYCOUNTRY_IE 618 0.29 0.77 0.16 194 HELO_MISC_IP 612 0.16 0.76 0.00 195 XM_OfRef7 611 0.23 0.76 0.09 196 XM_B_COPY_HTML 606 0.50 0.76 0.44 197 RELAYCOUNTRY_IN 604 0.21 0.75 0.07 198 HTML_TAG_BALANCE_BODY 587 0.93 0.73 0.99 199 DEAR_FRIEND 564 0.18 0.70 0.04 200 TR_XM_DK_Bayes 552 13.26 0.69 16.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 274423 90.35 95.32 89.06 2 DKIM_SIGNED 262399 83.69 78.06 85.16 3 XM_DK_Pass 259304 82.40 75.65 84.16 4 DKIM_VALID 249363 78.74 70.34 80.93 5 XM_B_Unicode 232849 75.19 73.70 75.57 6 DKIM_VALID_AU 208685 65.90 58.86 67.73 7 XMListUnsubscribeExists 198489 64.81 66.32 64.42 8 DCC_CHECK 172405 61.12 80.96 55.95 9 BAYES_50 171626 53.33 44.20 55.70 10 XM_B_Unicode3 150693 48.65 47.64 48.91 11 DCC_CHECK_NEGATIVE 131984 37.64 17.69 42.83 12 HTML_FONT_LOW_CONTRAST 105505 35.24 39.08 34.24 13 LOC_TINY_FONT_1 101920 34.51 40.00 33.08 14 DKIM_VALID_EF 86429 26.83 22.12 28.05 15 MIME_HTML_ONLY 71588 25.67 35.04 23.23 16 FVGT_m_MULTI_ODD 69770 23.66 27.56 22.64 17 T_TM2_M_HEADER_IN_MSG 66177 20.00 14.31 21.48 18 XMSubLong 65035 21.86 24.77 21.11 19 RCVD_IN_RP_SAFE 56437 15.01 2.30 18.32 20 BAYES_00 56345 14.85 1.65 18.29 21 XM_Body_Dirty_Words 54254 19.16 25.11 17.61 22 T_KAM_HTML_FONT_INVALID 51420 16.85 17.48 16.69 23 RCVD_IN_RP_CERTIFIED 51392 13.56 1.56 16.68 24 TR_XM_DK_Bayes 50942 13.26 0.69 16.53 25 TR_XM_DK_Bayes1 48973 12.72 0.52 15.89 26 MultiRelay 48781 16.31 18.14 15.83 27 XM_Multi_Part_URI 48554 16.18 17.78 15.76 28 TR_XM_DK_Bayes2 45913 11.90 0.37 14.90 29 HTML_IMAGE_RATIO_02 43548 14.64 16.59 14.13 30 XM_Evil_Numbers_Gen 38376 12.96 14.92 12.45 31 XM_DKIMWhitelistDomains 35687 9.70 2.46 11.58 32 XM_B_Unsub 33074 12.34 18.53 10.73 33 ALL_TRUSTED 31428 8.38 1.37 10.20 34 XM_B_Phish_Phrases 29705 9.95 11.13 9.64 35 T_XMDrugObfuBody_14 27998 9.43 10.77 9.09 36 LotsOfNums_01 26624 8.05 5.80 8.64 37 HTML_IMAGE_RATIO_04 26520 9.18 11.39 8.61 38 XM_DK_Undo_02 25457 14.44 38.20 8.26 39 LOTS_OF_MONEY 25332 9.10 12.50 8.22 40 RCVD_IN_MSPIKE_H2 25156 7.47 4.81 8.16 41 XM_SendGrid 24390 7.21 4.51 7.92 42 FSL_BULK_SIG 23213 10.10 19.96 7.53 43 XM_H_Long_From01 20563 6.78 7.20 6.67 44 TooManyTo_001 19069 6.93 9.79 6.19 45 BOTNET_IPINHOSTNAME 18508 9.15 21.24 6.01 46 XMSexyCombo_05 17953 7.63 14.55 5.83 47 XMStrtUSub 17843 5.33 3.56 5.79 48 T_TooManySym_01 16645 5.10 3.95 5.40 49 BAYES_60 16198 5.07 4.37 5.26 50 TR_XM_DK_SendGrid 15211 4.45 2.59 4.94 51 RELAYCOUNTRY_META 15153 8.63 22.88 4.92 52 FROM_EXCESS_BASE64 15145 5.02 5.42 4.92 53 BAYES_99 14909 9.85 29.12 4.84 54 BAYES_40 14708 4.70 4.42 4.77 55 MPART_ALT_DIFF 14121 5.53 9.16 4.58 56 MIME_QP_LONG_LINE 13698 4.32 3.85 4.45 57 RCVD_IN_MSPIKE_WL 13566 3.85 1.71 4.40 58 MIME_HTML_MOSTLY 13164 4.89 7.27 4.27 59 DKIM_INVALID 13036 4.95 7.72 4.23 60 XMSubMetaSx_00 13011 5.76 11.68 4.22 61 BAYES_999 12409 8.13 23.87 4.03 62 XM_DIRTYINTL 12025 4.88 8.66 3.90 63 XMNumbers 11813 4.44 6.77 3.83 64 RCVD_IN_MSPIKE_H3 11742 3.33 1.47 3.81 65 BAYES_20 11526 3.75 3.81 3.74 66 XM_UncommonTLD01 11308 7.17 20.61 3.67 67 XMBdyGiftCard01 11068 3.54 3.34 3.59 68 HTML_IMAGE_RATIO_08 11051 3.40 2.68 3.59 69 RCVD_IN_IADB_LISTED 10966 3.11 1.39 3.56 70 IN_ZIMBRA_NJ_WHITELIST 10168 2.62 0.01 3.30 71 UNPARSEABLE_RELAY 10014 2.79 1.05 3.25 72 TVD_RCVD_IP 9679 2.62 0.60 3.14 73 RCVD_IN_IADB_SPF 9578 2.73 1.28 3.11 74 BAYES_80 8921 3.58 6.19 2.90 75 T_REMOTE_IMAGE 8797 3.60 6.48 2.86 76 XM_B_SpammyTLD 8758 4.10 8.94 2.84 77 HTML_IMAGE_RATIO_06 8545 3.00 3.87 2.77 78 RCVD_IN_IADB_SENDERID 8506 2.45 1.24 2.76 79 RCVD_IN_IADB_DK 8251 2.38 1.24 2.68 80 TR_DCC_Bayes_99 8251 7.04 23.81 2.68 81 T_TooManySym_02 8137 2.47 1.79 2.64 82 XM_CamelCaseFrm001 7676 2.75 3.76 2.49 83 BAYES_05 7655 2.48 2.45 2.48 84 CK_HELO_DYNAMIC_SPLIT_IP 7577 2.12 0.82 2.46 85 HELO_DYNAMIC_IPADDR2 7574 1.97 0.09 2.46 86 URI_HEX 7335 3.12 5.95 2.38 87 INVALID_MSGID 7325 1.93 0.21 2.38 88 SUBJ_ALL_CAPS 7173 2.24 1.92 2.33 89 BOTNET 6975 5.58 18.34 2.26 90 RCVD_IN_IADB_VOUCHED 6869 1.86 0.42 2.23 91 MIME_HTML_ONLY_MULTI 6676 2.51 3.81 2.17 92 TO_MALFORMED 6602 1.71 0.07 2.14 93 XM_ProductURIs 6451 2.39 3.54 2.09 94 USER_IN_DEF_DKIM_WL 6221 1.60 0.01 2.02 95 XM_OfRef6 6122 1.93 1.72 1.99 96 ANY_BOUNCE_MESSAGE 6090 1.81 1.19 1.98 97 BOUNCE_MESSAGE 6087 1.81 1.19 1.98 98 UNTRUSTED_Relay 6070 4.02 11.88 1.97 99 XM_B_Unsub2 5916 2.11 2.83 1.92 100 TR_XM_RelayPhish 5604 2.42 4.72 1.82 101 MAILING_LIST_MULTI 5353 1.56 0.88 1.74 102 TM2_M_VERY_LONG_WORD 5283 1.88 2.49 1.71 103 BAYES_95 5262 2.09 3.55 1.71 104 TM2_M_URI_OPT_OUT 5214 2.05 3.41 1.69 105 IN_HORDE_ADDRESS_BOOK 5104 1.32 0.03 1.66 106 XM_RXBody 4964 1.39 0.55 1.61 107 XMStockSpam_06 4833 2.14 4.32 1.57 108 TR_LOTS_OF_MONEY2 4807 2.06 3.98 1.56 109 T_MONEY_PERCENT 4807 2.06 3.98 1.56 110 RELAYCOUNTRY_CA 4775 1.91 3.30 1.55 111 XMDiploma_00 4738 2.15 4.51 1.54 112 XM_PDF 4687 1.29 0.40 1.52 113 URI_TRY_3LD 4503 1.52 1.72 1.46 114 HTML_MIME_NO_HTML_TAG 4480 1.85 3.35 1.45 115 XM_SPF_SoftFail 4395 1.70 2.76 1.43 116 RCVD_IN_IADB_OPTIN 4320 1.18 0.33 1.40 117 XMSubMetaI_00 4269 1.81 3.43 1.39 118 XMPhish30 4235 1.32 1.12 1.37 119 NO_DNS_FOR_FROM 4088 1.67 3.01 1.33 120 KHOP_HELO_FCRDNS 4041 2.35 6.36 1.31 121 XMHTML_After_End 3809 1.12 0.68 1.24 122 XMGappySubj_01 3772 1.18 1.01 1.22 123 RCVD_IN_BL_SPAMCOP_NET 3751 1.71 3.62 1.22 124 XM_DK_Undo_01 3635 1.12 0.88 1.18 125 XM_H_Long_From02 3608 1.30 1.79 1.17 126 XM_GoogleGroups 3433 0.97 0.43 1.11 127 TR_Symld_Words 3432 1.14 1.26 1.11 128 T_XMDrugObfuBody_08 3377 1.33 2.21 1.10 129 TooManyTo_002 3309 0.98 0.63 1.07 130 DKIM_ADSP_CUSTOM_MED 3061 1.00 1.01 0.99 131 HTML_TAG_BALANCE_BODY 3042 0.93 0.73 0.99 132 XMPhish11 3040 1.01 1.12 0.99 133 XM_B_REG_HTML 3022 0.84 0.28 0.98 134 XM_UB50 2913 2.09 6.47 0.95 135 RCVD_IN_MSPIKE_BL 2886 1.07 1.60 0.94 136 XMBody_95 2683 0.74 0.22 0.87 137 XMSubMetaSxObfu_02 2647 0.87 0.91 0.86 138 FILL_THIS_FORM 2638 0.81 0.64 0.86 139 XMLngstWrd_00 2595 0.77 0.51 0.84 140 XMGenDplmaNmb 2553 1.07 1.99 0.83 141 XMSubGiftCard1 2505 0.72 0.38 0.81 142 TR_MetaPhish_Combo_01 2456 0.79 0.77 0.80 143 THIS_AD 2447 0.86 1.10 0.79 144 XMLngstWrd_01 2435 0.73 0.49 0.79 145 FILL_THIS_FORM_LONG 2409 0.73 0.54 0.78 146 TooManyTo_003 2374 0.72 0.53 0.77 147 SUBJ_DOLLARS 2374 0.96 1.69 0.77 148 T_FILL_THIS_FORM_LOAN 2353 0.64 0.17 0.76 149 USER_IN_WHITELIST 2296 0.59 0.00 0.75 150 NML_ADSP_CUSTOM_MED 2256 0.77 0.93 0.73 151 T_XMHurry_00 2213 0.85 1.34 0.72 152 HTML_FONT_FACE_BAD 2156 0.70 0.68 0.70 153 DIET_1 2146 0.77 1.05 0.70 154 XMHTMLBadTable_001 2113 0.67 0.59 0.69 155 XMBrknScrpt_02 2104 0.71 0.84 0.68 156 XMBody_78 2001 0.61 0.47 0.65 157 TooManyTo_004 1974 0.60 0.42 0.64 158 XMBSHREFv2 1968 0.59 0.40 0.64 159 XMSexyCombo_01 1966 1.61 5.36 0.64 160 XMBody_17 1903 1.00 2.45 0.62 161 RELAYCOUNTRY_GB 1850 1.69 5.88 0.60 162 XMLngstWrd_02 1838 0.57 0.45 0.60 163 XMSubMetaSxObfu_03 1836 1.07 2.90 0.60 164 PLING_QUERY 1818 0.60 0.64 0.59 165 T_TooManySym_03 1794 0.48 0.11 0.58 166 XMClaimOffer 1786 0.55 0.42 0.58 167 TooManyTo_005 1729 0.52 0.35 0.56 168 FORGED_GMAIL_RCVD 1726 0.62 0.86 0.56 169 TR_XM_PHPDW 1638 0.87 2.15 0.53 170 TR_XM_PHPForged 1610 0.85 2.10 0.52 171 TR_XM_FormFill2 1593 0.84 2.08 0.52 172 XM_H_PHPOS 1586 0.84 2.08 0.51 173 LOW_PRICE 1585 1.03 3.00 0.51 174 XMLngstWrd_03 1558 0.48 0.40 0.51 175 T_FILL_THIS_FORM_SHORT 1550 0.51 0.53 0.50 176 URI_NOVOWEL 1543 0.47 0.34 0.50 177 T_XMDrugObfuBody_00 1540 0.61 1.02 0.50 178 SpammyFromTLD_01 1508 1.00 2.96 0.49 179 HELO_NODOT 1486 0.46 0.39 0.48 180 XMPhish14 1483 0.51 0.62 0.48 181 HELO_NO_DOMAIN 1478 0.46 0.38 0.48 182 BODY_ENHANCEMENT 1455 0.38 0.02 0.47 183 XM_H_PHPMailer 1450 0.71 1.64 0.47 184 XMSlimDrugH 1425 0.55 0.87 0.46 185 RDNS_DYNAMIC 1402 0.83 2.28 0.46 186 DKIM_ADSP_NXDOMAIN 1381 0.92 2.73 0.45 187 T_Symld_Words_02 1352 0.52 0.82 0.44 188 RELAYCOUNTRY_DE 1351 0.67 1.55 0.44 189 XM_B_COPY_HTML 1350 0.50 0.76 0.44 190 XM_Ancestry_Forge 1348 0.35 0.01 0.44 191 XM_URI_RBL 1343 0.88 2.58 0.44 192 RCVD_IN_MSPIKE_H4 1336 0.39 0.21 0.43 193 RCVD_IN_MSPIKE_L3 1329 0.36 0.10 0.43 194 XM_Walgreens_Forge 1328 0.39 0.25 0.43 195 XMLngstWrd_04 1327 0.41 0.31 0.43 196 XM_shorewaves_Whitelist 1322 0.34 0.00 0.43 197 XMOemUri 1313 0.36 0.11 0.43 198 XMCapTrack 1296 0.38 0.22 0.42 199 REMOVE_BEFORE_LINK 1253 0.37 0.25 0.41 200 XMNoVowels 1189 0.37 0.30 0.39 ----------------------------------------------------------------------