Email: 407312 Autolearn: 0 AvgScore: 0.65 AvgScanTime: 2.33 sec Spam: 77588 Autolearn: 0 AvgScore: 12.09 AvgScanTime: 2.93 sec Ham: 329724 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 2.19 sec Time Spent Running SA: 263.89 hours Time Spent Processing Spam: 63.25 hours Time Spent Processing Ham: 200.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 74153 89.76 95.57 88.39 2 DKIM_SIGNED 61782 82.72 79.63 83.45 3 DCC_CHECK 61121 59.72 78.78 55.24 4 XM_B_Unicode 58586 76.12 75.51 76.27 5 XM_DK_Pass 57825 80.72 74.53 82.18 6 XMListUnsubscribeExists 54835 63.81 70.67 62.20 7 DKIM_VALID 54023 77.47 69.63 79.31 8 DKIM_VALID_AU 44993 64.71 57.99 66.29 9 XM_B_Unicode3 38124 49.07 49.14 49.05 10 BAYES_50 31834 52.72 41.03 55.47 11 XM_DK_Undo_02 29935 14.54 38.58 8.88 12 LOC_TINY_FONT_1 29619 33.61 38.17 32.54 13 HTML_FONT_LOW_CONTRAST 27438 35.39 35.36 35.39 14 MIME_HTML_ONLY 27236 25.69 35.10 23.47 15 FVGT_m_MULTI_ODD 22508 23.03 29.01 21.62 16 BAYES_99 22222 9.45 28.64 4.94 17 BAYES_999 18263 7.84 23.54 4.15 18 TR_DCC_Bayes_99 17490 6.33 22.54 2.51 19 XMSubLong 17447 21.66 22.49 21.46 20 RELAYCOUNTRY_META 17436 7.91 22.47 4.48 21 XM_Body_Dirty_Words 17224 18.58 22.20 17.73 22 BOTNET 16689 6.66 21.51 3.17 23 HTML_IMAGE_RATIO_02 16624 14.75 21.43 13.18 24 DKIM_VALID_EF 16138 26.55 20.80 27.90 25 DCC_CHECK_NEGATIVE 15341 39.09 19.77 43.63 26 BOTNET_IPINHOSTNAME 15092 8.93 19.45 6.45 27 MultiRelay 15036 16.45 19.38 15.76 28 T_KAM_HTML_FONT_INVALID 14572 16.63 18.78 16.13 29 XM_Multi_Part_URI 14513 16.02 18.71 15.38 30 XM_UncommonTLD01 14170 6.75 18.26 4.05 31 XM_B_Unsub 12288 11.88 15.84 10.95 32 T_TM2_M_HEADER_IN_MSG 11865 21.14 15.29 22.51 33 FSL_BULK_SIG 10575 8.98 13.63 7.88 34 XMSexyCombo_05 10193 7.53 13.14 6.22 35 MPART_ALT_DIFF 9445 6.43 12.17 5.08 36 UNTRUSTED_Relay 9430 3.67 12.15 1.68 37 XM_Evil_Numbers_Gen 9304 12.15 11.99 12.18 38 DKIM_INVALID 7759 5.25 10.00 4.14 39 LOTS_OF_MONEY 7667 8.97 9.88 8.76 40 XMSubMetaSx_00 7398 4.78 9.53 3.66 41 RCVD_IN_MSPIKE_H2 7159 12.01 9.23 12.67 42 XM_H_Long_From01 6770 7.17 8.73 6.80 43 BAYES_80 6701 3.89 8.64 2.78 44 MIME_HTML_MOSTLY 6669 5.08 8.60 4.25 45 TooManyTo_001 6653 6.43 8.57 5.93 46 T_XMDrugObfuBody_14 6408 7.96 8.26 7.88 47 KHOP_HELO_FCRDNS 6028 3.04 7.77 1.93 48 XMNumbers 5929 4.50 7.64 3.76 49 XM_B_Phish_Phrases 5914 8.44 7.62 8.63 50 HTML_MIME_NO_HTML_TAG 5880 2.58 7.58 1.40 51 XM_UB50 5657 2.10 7.29 0.88 52 XM_SendGrid 5365 7.64 6.91 7.82 53 SpammyFromTLD_02 5333 1.46 6.87 0.19 54 BAYES_60 5120 5.99 6.60 5.85 55 LotsOfNums_01 5039 7.84 6.49 8.16 56 XM_DIRTYINTL 4926 4.83 6.35 4.48 57 HTML_IMAGE_RATIO_04 4880 8.07 6.29 8.49 58 RCVD_IN_MSPIKE_WL 4681 10.65 6.03 11.74 59 DKIM_ADSP_NXDOMAIN 4284 2.02 5.52 1.19 60 URI_HEX 4070 3.03 5.25 2.51 61 RELAYCOUNTRY_FR 3989 1.22 5.14 0.30 62 MIME_HEADER_CTYPE_ONLY 3902 1.02 5.03 0.08 63 MIME_HTML_ONLY_MULTI 3868 2.98 4.99 2.51 64 TR_Mismatch_TLD_02 3866 1.01 4.98 0.08 65 T_REMOTE_IMAGE 3750 3.53 4.83 3.22 66 XMStrtUSub 3651 5.72 4.71 5.96 67 MIME_QP_LONG_LINE 3603 4.82 4.64 4.86 68 BAYES_40 3570 4.62 4.60 4.62 69 FROM_EXCESS_BASE64 3493 4.69 4.50 4.73 70 RCVD_IN_MSPIKE_H3 3322 10.07 4.28 11.44 71 HTML_IMAGE_ONLY_08 3244 0.86 4.18 0.08 72 HTML_SHORT_LINK_IMG_1 3207 0.80 4.13 0.02 73 XM_SPF_SoftFail 3181 2.48 4.10 2.10 74 XM_CamelCaseFrm001 3154 2.81 4.07 2.51 75 FROM_SUSPICIOUS_NTLD 2956 0.76 3.81 0.05 76 RCVD_IN_BL_SPAMCOP_NET 2930 1.52 3.78 0.98 77 FROM_SUSPICIOUS_NTLD_FP 2908 0.75 3.75 0.04 78 RDNS_DYNAMIC 2888 1.08 3.72 0.45 79 HDRS_LCASE_IMGONLY 2846 0.71 3.67 0.02 80 HTML_IMAGE_RATIO_06 2804 3.15 3.61 3.04 81 RELAYCOUNTRY_CA 2799 2.01 3.61 1.63 82 XMSexyCombo_01 2792 1.22 3.60 0.66 83 BAYES_95 2764 1.92 3.56 1.53 84 XM_B_SpammyTLD 2675 2.97 3.45 2.86 85 REPLYTO_WITHOUT_TO_CC 2640 0.69 3.40 0.05 86 UNPARSEABLE_RELAY 2535 3.30 3.27 3.30 87 BAYES_20 2466 3.90 3.18 4.06 88 TR_XM_INV_DKIM 2449 0.74 3.16 0.17 89 RCVD_IN_RP_SAFE 2397 14.62 3.09 17.34 90 RELAYCOUNTRY_GB 2385 0.94 3.07 0.43 91 TM2_M_URI_OPT_OUT 2374 2.26 3.06 2.08 92 SUBJ_ALL_CAPS 2350 2.49 3.03 2.36 93 NO_DNS_FOR_FROM 2311 2.13 2.98 1.93 94 URIBL_DBL_ABUSE_REDIR 2295 0.58 2.96 0.02 95 T_TooManySym_01 2249 5.67 2.90 6.33 96 TR_XM_DK_SendGrid 2236 4.46 2.88 4.83 97 ALL_TRUSTED 2202 9.27 2.84 10.78 98 XMSubMetaI_00 2161 2.11 2.79 1.94 99 XMBdyGiftCard01 2125 3.12 2.74 3.21 100 XMDiploma_00 2110 1.60 2.72 1.34 101 TO_EQ_FM_DOM_HTML_IMG 2067 0.51 2.66 0.00 102 XM_URI_RBL 2028 0.85 2.61 0.44 103 BOTNET_NORDNS 2008 0.66 2.59 0.21 104 XMBody_17 1993 1.70 2.57 1.49 105 SpammyFromTLD_01 1975 0.79 2.55 0.38 106 XMStockSpam_06 1974 2.09 2.54 1.98 107 LongTLD 1914 0.58 2.47 0.14 108 URI_TRY_3LD 1890 1.57 2.44 1.37 109 TM2_M_VERY_LONG_WORD 1873 2.16 2.41 2.10 110 TR_Symld_Words 1856 2.05 2.39 1.97 111 RCVD_IN_RP_RNBL 1841 0.50 2.37 0.06 112 RCVD_IN_RP_CERTIFIED 1833 13.17 2.36 15.72 113 XM_OfRef6 1788 1.82 2.30 1.71 114 MultiRelay_Combo 1718 0.54 2.21 0.15 115 MultiRelay_CC 1718 0.54 2.21 0.15 116 DATE_IN_PAST_03_06 1710 0.49 2.20 0.09 117 XMGenDplmaNmb 1703 0.95 2.19 0.66 118 HTML_IMAGE_RATIO_08 1670 2.41 2.15 2.47 119 MPART_ALT_DIFF_COUNT 1639 0.69 2.11 0.36 120 TR_XM_PHPDW 1605 0.85 2.07 0.56 121 RELAYCOUNTRY_RU 1530 0.39 1.97 0.01 122 TR_XM_PHPForged 1527 0.82 1.97 0.55 123 TR_XM_FormFill2 1523 0.82 1.96 0.55 124 T_XMDrugObfuBody_08 1523 2.15 1.96 2.20 125 XM_H_PHPOS 1518 0.81 1.96 0.54 126 HTML_FONT_SIZE_HUGE 1512 0.44 1.95 0.09 127 XMSexyCombo_04 1432 0.46 1.85 0.13 128 T_XMHurry_00 1424 1.05 1.84 0.87 129 RCVD_IN_MSPIKE_BL 1408 1.25 1.81 1.12 130 BAYES_05 1405 2.43 1.81 2.58 131 XM_H_PHPMailer 1403 0.73 1.81 0.48 132 TR_XM_RelayPhish 1387 1.75 1.79 1.74 133 RCVD_IN_MSPIKE_H4 1359 0.58 1.75 0.30 134 XM_B_Unsub2 1346 1.66 1.73 1.65 135 BAYES_00 1305 14.75 1.68 17.82 136 SUBJECT_NEEDS_ENCODING 1251 0.31 1.61 0.01 137 SUBJ_ILLEGAL_CHARS 1251 0.31 1.61 0.01 138 XMSubMetaSSx_00 1232 0.50 1.59 0.24 139 T_MONEY_PERCENT 1217 0.65 1.57 0.43 140 TR_LOTS_OF_MONEY2 1217 0.65 1.57 0.43 141 RCVD_IN_IADB_LISTED 1213 3.16 1.56 3.54 142 RCVD_IN_MSPIKE_L5 1205 0.47 1.55 0.21 143 RCVD_IN_PSBL 1146 0.34 1.48 0.07 144 XM_H_PHPOS_M 1119 0.44 1.44 0.21 145 XM_ProductURIs 1114 1.47 1.44 1.48 146 URI_NO_WWW_INFO_CGI 1109 0.30 1.43 0.03 147 RCVD_IN_IADB_SPF 1096 2.78 1.41 3.10 148 RCVD_IN_IADB_SENDERID 1079 2.53 1.39 2.80 149 RCVD_IN_IADB_DK 1079 2.47 1.39 2.73 150 T_XMDrugObfuBody_00 1075 0.71 1.39 0.55 151 DIET_1 1048 0.83 1.35 0.70 152 THIS_AD 1026 0.62 1.32 0.45 153 MAILING_LIST_MULTI 1015 1.46 1.31 1.49 154 HK_SCAM 1014 0.27 1.31 0.02 155 RELAYCOUNTRY_DE 987 0.53 1.27 0.35 156 SHORT_URI_3 929 0.27 1.20 0.05 157 XMBrknScrpt_02 913 1.12 1.18 1.11 158 XMSubMetaSxObfu_03 909 0.51 1.17 0.36 159 XM_DK_Undo_01 893 1.13 1.15 1.13 160 HDRS_MISSP 885 0.22 1.14 0.00 161 XMPhish11 883 1.06 1.14 1.04 162 XMSubject_09 849 0.48 1.09 0.33 163 RELAYCOUNTRY_AT 836 0.50 1.08 0.36 164 DATE_IN_PAST_06_12 836 0.24 1.08 0.05 165 HTML_FONT_FACE_BAD 830 1.05 1.07 1.05 166 XM_B_COPY_HTML 803 0.58 1.03 0.48 167 XMHTML_After_End 799 1.54 1.03 1.66 168 XMPhish30 791 0.78 1.02 0.72 169 XM_H_Long_From02 776 1.04 1.00 1.05 170 TooManyTo_002 775 1.00 1.00 1.00 171 SHORT_IMG_SUSP_NTLD 773 0.19 1.00 0.00 172 XMPhish14 771 0.41 0.99 0.27 173 DATE_IN_PAST_12_24 734 0.20 0.95 0.03 174 XM_UB60 729 0.24 0.94 0.07 175 XMGppyBdWords 719 0.31 0.93 0.16 176 TR_XM_DK_Bayes 707 12.18 0.91 14.83 177 URIBL_DBL_SPAM 694 0.21 0.89 0.05 178 TR_LOTS_OF_MONEY3 690 0.83 0.89 0.81 179 TooManyTo_003 681 0.75 0.88 0.72 180 XMSubMetaSx_01 673 0.30 0.87 0.16 181 T_TooManySym_02 658 2.12 0.85 2.42 182 DKIM_ADSP_CUSTOM_MED 657 0.96 0.85 0.98 183 TM2_M_A_HREF_HREF 656 0.57 0.85 0.51 184 XM_BadFromFormat 634 0.24 0.82 0.11 185 URIBL_BLACK 626 0.16 0.81 0.01 186 TR_XM_DK_Bayes1 613 11.71 0.79 14.28 187 XM_UB99 612 0.16 0.79 0.01 188 HK_RANDOM_REPLYTO 592 0.33 0.76 0.23 189 LOW_PRICE 592 0.29 0.76 0.17 190 NML_ADSP_CUSTOM_MED 580 0.75 0.75 0.75 191 TooManyTo_004 575 0.60 0.74 0.57 192 RELAYCOUNTRY_IE 572 0.29 0.74 0.18 193 FORGED_GMAIL_RCVD 568 0.62 0.73 0.60 194 TR_Mismatch_TLD_01 567 0.42 0.73 0.35 195 XMSexyCombo_02 553 0.20 0.71 0.08 196 TR_Caps_n_Bayes_99 536 0.19 0.69 0.07 197 XM_OfRef7 529 0.20 0.68 0.08 198 NORDNS_LOW_CONTRAST 526 0.13 0.68 0.00 199 PLING_QUERY 522 0.62 0.67 0.61 200 PP_MIME_FAKE_ASCII_TEXT 508 0.40 0.65 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 291437 89.76 95.57 88.39 2 DKIM_SIGNED 275144 82.72 79.63 83.45 3 XM_DK_Pass 270972 80.72 74.53 82.18 4 DKIM_VALID 261509 77.47 69.63 79.31 5 XM_B_Unicode 251468 76.12 75.51 76.27 6 DKIM_VALID_AU 218588 64.71 57.99 66.29 7 XMListUnsubscribeExists 205091 63.81 70.67 62.20 8 BAYES_50 182905 52.72 41.03 55.47 9 DCC_CHECK 182145 59.72 78.78 55.24 10 XM_B_Unicode3 161745 49.07 49.14 49.05 11 DCC_CHECK_NEGATIVE 143864 39.09 19.77 43.63 12 HTML_FONT_LOW_CONTRAST 116702 35.39 35.36 35.39 13 LOC_TINY_FONT_1 107294 33.61 38.17 32.54 14 DKIM_VALID_EF 91992 26.55 20.80 27.90 15 MIME_HTML_ONLY 77384 25.69 35.10 23.47 16 T_TM2_M_HEADER_IN_MSG 74233 21.14 15.29 22.51 17 FVGT_m_MULTI_ODD 71283 23.03 29.01 21.62 18 XMSubLong 70759 21.66 22.49 21.46 19 BAYES_00 58763 14.75 1.68 17.82 20 XM_Body_Dirty_Words 58466 18.58 22.20 17.73 21 RCVD_IN_RP_SAFE 57164 14.62 3.09 17.34 22 T_KAM_HTML_FONT_INVALID 53178 16.63 18.78 16.13 23 MultiRelay 51968 16.45 19.38 15.76 24 RCVD_IN_RP_CERTIFIED 51830 13.17 2.36 15.72 25 XM_Multi_Part_URI 50728 16.02 18.71 15.38 26 TR_XM_DK_Bayes 48898 12.18 0.91 14.83 27 TR_XM_DK_Bayes1 47101 11.71 0.79 14.28 28 TR_XM_DK_Bayes2 44229 10.98 0.64 13.41 29 HTML_IMAGE_RATIO_02 43472 14.75 21.43 13.18 30 RCVD_IN_MSPIKE_H2 41774 12.01 9.23 12.67 31 XM_DKIMWhitelistDomains 40226 9.92 0.24 12.20 32 XM_Evil_Numbers_Gen 40165 12.15 11.99 12.18 33 RCVD_IN_MSPIKE_WL 38703 10.65 6.03 11.74 34 RCVD_IN_MSPIKE_H3 37710 10.07 4.28 11.44 35 XM_B_Unsub 36111 11.88 15.84 10.95 36 ALL_TRUSTED 35558 9.27 2.84 10.78 37 XM_DK_Undo_02 29283 14.54 38.58 8.88 38 LOTS_OF_MONEY 28883 8.97 9.88 8.76 39 XM_B_Phish_Phrases 28463 8.44 7.62 8.63 40 HTML_IMAGE_RATIO_04 27993 8.07 6.29 8.49 41 LotsOfNums_01 26913 7.84 6.49 8.16 42 T_XMDrugObfuBody_14 25994 7.96 8.26 7.88 43 FSL_BULK_SIG 25992 8.98 13.63 7.88 44 XM_SendGrid 25773 7.64 6.91 7.82 45 XM_H_Long_From01 22421 7.17 8.73 6.80 46 BOTNET_IPINHOSTNAME 21271 8.93 19.45 6.45 47 T_TooManySym_01 20856 5.67 2.90 6.33 48 XMSexyCombo_05 20493 7.53 13.14 6.22 49 XMStrtUSub 19664 5.72 4.71 5.96 50 TooManyTo_001 19551 6.43 8.57 5.93 51 BAYES_60 19279 5.99 6.60 5.85 52 MPART_ALT_DIFF 16745 6.43 12.17 5.08 53 BAYES_99 16280 9.45 28.64 4.94 54 MIME_QP_LONG_LINE 16040 4.82 4.64 4.86 55 TR_XM_DK_SendGrid 15935 4.46 2.88 4.83 56 FROM_EXCESS_BASE64 15607 4.69 4.50 4.73 57 BAYES_40 15241 4.62 4.60 4.62 58 XM_DIRTYINTL 14767 4.83 6.35 4.48 59 RELAYCOUNTRY_META 14765 7.91 22.47 4.48 60 MIME_HTML_MOSTLY 14022 5.08 8.60 4.25 61 BAYES_999 13684 7.84 23.54 4.15 62 DKIM_INVALID 13635 5.25 10.00 4.14 63 BAYES_20 13403 3.90 3.18 4.06 64 XM_UncommonTLD01 13338 6.75 18.26 4.05 65 XMNumbers 12409 4.50 7.64 3.76 66 TVD_RCVD_IP 12145 3.10 0.60 3.68 67 XMSubMetaSx_00 12057 4.78 9.53 3.66 68 RCVD_IN_IADB_LISTED 11677 3.16 1.56 3.54 69 UNPARSEABLE_RELAY 10893 3.30 3.27 3.30 70 IN_ZIMBRA_NJ_WHITELIST 10661 2.62 0.01 3.23 71 T_REMOTE_IMAGE 10632 3.53 4.83 3.22 72 XMBdyGiftCard01 10572 3.12 2.74 3.21 73 BOTNET 10451 6.66 21.51 3.17 74 RCVD_IN_IADB_SPF 10229 2.78 1.41 3.10 75 HTML_IMAGE_RATIO_06 10014 3.15 3.61 3.04 76 XM_B_SpammyTLD 9414 2.97 3.45 2.86 77 RCVD_IN_IADB_SENDERID 9218 2.53 1.39 2.80 78 BAYES_80 9153 3.89 8.64 2.78 79 RCVD_IN_IADB_DK 8992 2.47 1.39 2.73 80 BAYES_05 8513 2.43 1.81 2.58 81 XM_CamelCaseFrm001 8290 2.81 4.07 2.51 82 MIME_HTML_ONLY_MULTI 8285 2.98 4.99 2.51 83 TR_DCC_Bayes_99 8276 6.33 22.54 2.51 84 URI_HEX 8268 3.03 5.25 2.51 85 HTML_IMAGE_RATIO_08 8150 2.41 2.15 2.47 86 CK_HELO_DYNAMIC_SPLIT_IP 7994 2.04 0.41 2.42 87 HELO_DYNAMIC_IPADDR2 7992 1.98 0.07 2.42 88 T_TooManySym_02 7992 2.12 0.85 2.42 89 SUBJ_ALL_CAPS 7778 2.49 3.03 2.36 90 INVALID_MSGID 7340 1.84 0.18 2.23 91 T_XMDrugObfuBody_08 7247 2.15 1.96 2.20 92 RCVD_IN_IADB_VOUCHED 7152 1.83 0.40 2.17 93 TM2_M_VERY_LONG_WORD 6924 2.16 2.41 2.10 94 XM_SPF_SoftFail 6912 2.48 4.10 2.10 95 TM2_M_URI_OPT_OUT 6851 2.26 3.06 2.08 96 TO_MALFORMED 6552 1.61 0.01 1.99 97 XMStockSpam_06 6542 2.09 2.54 1.98 98 XM_RXBody 6529 1.72 0.60 1.98 99 TR_Symld_Words 6488 2.05 2.39 1.97 100 XMSubMetaI_00 6413 2.11 2.79 1.94 101 NO_DNS_FOR_FROM 6371 2.13 2.98 1.93 102 KHOP_HELO_FCRDNS 6368 3.04 7.77 1.93 103 TR_XM_RelayPhish 5734 1.75 1.79 1.74 104 XM_H_Trusted_IP 5720 1.40 0.00 1.73 105 XM_OfRef6 5642 1.82 2.30 1.71 106 UNTRUSTED_Relay 5524 3.67 12.15 1.68 107 XMHTML_After_End 5457 1.54 1.03 1.66 108 XM_B_Unsub2 5435 1.66 1.73 1.65 109 RELAYCOUNTRY_CA 5379 2.01 3.61 1.63 110 IN_HORDE_ADDRESS_BOOK 5317 1.31 0.03 1.61 111 ANY_BOUNCE_MESSAGE 5219 1.32 0.19 1.58 112 BOUNCE_MESSAGE 5217 1.32 0.19 1.58 113 BAYES_95 5043 1.92 3.56 1.53 114 XM_PDF 5016 1.28 0.24 1.52 115 USER_IN_DEF_DKIM_WL 4968 1.22 0.01 1.51 116 XMBody_17 4928 1.70 2.57 1.49 117 MAILING_LIST_MULTI 4920 1.46 1.31 1.49 118 XM_ProductURIs 4885 1.47 1.44 1.48 119 HTML_MIME_NO_HTML_TAG 4625 2.58 7.58 1.40 120 URI_TRY_3LD 4502 1.57 2.44 1.37 121 RCVD_IN_IADB_OPTIN 4475 1.16 0.30 1.36 122 XMDiploma_00 4417 1.60 2.72 1.34 123 XMGappySubj_01 4222 1.12 0.43 1.28 124 DKIM_ADSP_NXDOMAIN 3924 2.02 5.52 1.19 125 XM_DK_Undo_01 3710 1.13 1.15 1.13 126 RCVD_IN_MSPIKE_BL 3678 1.25 1.81 1.12 127 XMBrknScrpt_02 3650 1.12 1.18 1.11 128 XM_shorewaves_Whitelist 3495 0.86 0.00 1.06 129 XM_H_Long_From02 3473 1.04 1.00 1.05 130 HTML_FONT_FACE_BAD 3453 1.05 1.07 1.05 131 XMPhish11 3424 1.06 1.14 1.04 132 TR_MetaPhish_Combo_01 3347 0.93 0.55 1.02 133 TooManyTo_002 3300 1.00 1.00 1.00 134 RCVD_IN_BL_SPAMCOP_NET 3247 1.52 3.78 0.98 135 DKIM_ADSP_CUSTOM_MED 3242 0.96 0.85 0.98 136 XMBody_95 3112 0.79 0.15 0.94 137 XMSubNoVowel 2972 0.80 0.38 0.90 138 XM_GoogleGroups 2917 0.80 0.45 0.88 139 XM_UB50 2909 2.10 7.29 0.88 140 FILL_THIS_FORM 2886 0.82 0.56 0.88 141 T_XMHurry_00 2865 1.05 1.84 0.87 142 FROM_GOV_DKIM_AU 2858 0.71 0.06 0.87 143 XM_B_REG_HTML 2852 0.80 0.55 0.86 144 HTML_TAG_BALANCE_BODY 2776 0.80 0.63 0.84 145 TR_LOTS_OF_MONEY3 2675 0.83 0.89 0.81 146 FILL_THIS_FORM_LONG 2520 0.71 0.46 0.76 147 XMHTMLBadTable_001 2479 0.73 0.64 0.75 148 NML_ADSP_CUSTOM_MED 2464 0.75 0.75 0.75 149 T_FILL_THIS_FORM_LOAN 2454 0.62 0.11 0.74 150 XMPhish30 2373 0.78 1.02 0.72 151 TooManyTo_003 2359 0.75 0.88 0.72 152 DIET_1 2318 0.83 1.35 0.70 153 AC_FROM_MANY_DOTS 2269 0.56 0.00 0.69 154 XMSexyCombo_01 2184 1.22 3.60 0.66 155 XMGenDplmaNmb 2183 0.95 2.19 0.66 156 SUBJ_DOLLARS 2166 0.64 0.57 0.66 157 USER_IN_WHITELIST 2139 0.53 0.00 0.65 158 PLING_QUERY 2017 0.62 0.67 0.61 159 FORGED_GMAIL_RCVD 1966 0.62 0.73 0.60 160 TooManyTo_004 1870 0.60 0.74 0.57 161 TR_XM_PHPDW 1844 0.85 2.07 0.56 162 T_TooManySym_03 1830 0.49 0.20 0.56 163 TR_XM_PHPForged 1820 0.82 1.97 0.55 164 T_XMDrugObfuBody_00 1819 0.71 1.39 0.55 165 TR_XM_FormFill2 1797 0.82 1.96 0.55 166 T_Symld_Words_02 1793 0.54 0.54 0.54 167 XM_H_PHPOS 1790 0.81 1.96 0.54 168 XMSubMetaSxObfu_02 1688 0.51 0.49 0.51 169 TM2_M_A_HREF_HREF 1667 0.57 0.85 0.51 170 XM_Walgreens_Forge 1662 0.42 0.07 0.50 171 URI_NOVOWEL 1654 0.48 0.39 0.50 172 XMLngstWrd_00 1641 0.47 0.37 0.50 173 TooManyTo_005 1612 0.51 0.63 0.49 174 XMBody_78 1592 0.51 0.64 0.48 175 NUMERIC_HTTP_ADDR 1581 0.47 0.44 0.48 176 XM_B_COPY_HTML 1579 0.58 1.03 0.48 177 XM_H_PHPMailer 1574 0.73 1.81 0.48 178 RCVD_IN_MSPIKE_L3 1563 0.42 0.19 0.47 179 XMLngstWrd_01 1550 0.44 0.33 0.47 180 RDNS_DYNAMIC 1497 1.08 3.72 0.45 181 THIS_AD 1493 0.62 1.32 0.45 182 T_FILL_THIS_FORM_SHORT 1476 0.46 0.53 0.45 183 XM_URI_RBL 1435 0.85 2.61 0.44 184 HTML_IMAGE_ONLY_20 1434 0.41 0.28 0.43 185 TR_LOTS_OF_MONEY2 1430 0.65 1.57 0.43 186 RELAYCOUNTRY_GB 1430 0.94 3.07 0.43 187 T_MONEY_PERCENT 1430 0.65 1.57 0.43 188 RCVD_IN_MSPIKE_L4 1412 0.36 0.07 0.43 189 XM_Body_Obfu01 1351 0.44 0.56 0.41 190 XM_D_tchamptons_WL 1344 0.33 0.00 0.41 191 BODY_ENHANCEMENT 1310 0.33 0.02 0.40 192 HELO_NODOT 1282 0.41 0.49 0.39 193 HELO_NO_DOMAIN 1277 0.41 0.49 0.39 194 SpammyFromTLD_01 1260 0.79 2.55 0.38 195 XM_Ancestry_Forge 1255 0.32 0.05 0.38 196 XMBSHREFv2 1227 0.35 0.26 0.37 197 REMOVE_BEFORE_LINK 1218 0.37 0.39 0.37 198 RELAYCOUNTRY_AT 1192 0.50 1.08 0.36 199 XMCapTrack 1177 0.33 0.21 0.36 200 MPART_ALT_DIFF_COUNT 1176 0.69 2.11 0.36 ----------------------------------------------------------------------