Email: 678783 Autolearn: 0 AvgScore: 1.65 AvgScanTime: 2.20 sec Spam: 132221 Autolearn: 0 AvgScore: 13.10 AvgScanTime: 2.84 sec Ham: 546562 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 2.05 sec Time Spent Running SA: 415.60 hours Time Spent Processing Spam: 104.28 hours Time Spent Processing Ham: 311.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128273 90.78 97.01 89.28 2 DCC_CHECK 108238 51.87 81.86 44.62 3 XM_B_Unicode 96920 72.10 73.30 71.81 4 DKIM_SIGNED 96078 76.71 72.66 77.69 5 XM_DK_Pass 93220 75.42 70.50 76.61 6 DKIM_VALID 87745 71.76 66.36 73.06 7 XMListUnsubscribeExists 81693 55.72 61.79 54.25 8 DKIM_VALID_AU 67641 54.95 51.16 55.87 9 XM_B_Unicode3 61558 43.26 46.56 42.46 10 BAYES_50 59932 53.99 45.33 56.08 11 MIME_HTML_ONLY 55833 25.68 42.23 21.68 12 XM_DK_Undo_02 47292 12.37 35.77 6.71 13 HTML_FONT_LOW_CONTRAST 44260 30.57 33.47 29.87 14 LOC_TINY_FONT_1 42552 26.41 32.18 25.02 15 XMSubLong 34963 22.24 26.44 21.22 16 FVGT_m_MULTI_ODD 31403 21.95 23.75 21.51 17 BAYES_99 31168 7.26 23.57 3.32 18 XM_Body_Dirty_Words 30752 15.97 23.26 14.21 19 FSL_BULK_SIG 29582 9.65 22.37 6.58 20 BOTNET 29433 6.11 22.26 2.21 21 XM_UncommonTLD01 29082 7.08 21.99 3.47 22 DKIM_VALID_EF 28458 25.83 21.52 26.87 23 TR_DCC_Bayes_99 25339 4.81 19.16 1.34 24 RELAYCOUNTRY_META 24755 8.16 18.72 5.61 25 BAYES_999 24623 5.76 18.62 2.64 26 BOTNET_IPINHOSTNAME 24091 7.17 18.22 4.50 27 T_KAM_HTML_FONT_INVALID 23222 17.44 17.56 17.41 28 MultiRelay 21859 18.47 16.53 18.94 29 DCC_CHECK_NEGATIVE 21614 46.14 16.35 53.35 30 XM_Multi_Part_URI 21408 13.46 16.19 12.79 31 HTML_IMAGE_RATIO_02 20811 10.90 15.74 9.72 32 T_TM2_M_HEADER_IN_MSG 20065 26.93 15.18 29.77 33 XM_B_Unsub 19979 10.51 15.11 9.39 34 XMSexyCombo_05 19296 6.54 14.59 4.59 35 SpammyFromTLD_02 17492 2.76 13.23 0.22 36 HTML_MIME_NO_HTML_TAG 16782 4.16 12.69 2.09 37 XM_Evil_Numbers_Gen 16344 10.72 12.36 10.32 38 KHOP_HELO_FCRDNS 15377 3.89 11.63 2.01 39 UNTRUSTED_Relay 15328 3.60 11.59 1.66 40 LOTS_OF_MONEY 14436 8.82 10.92 8.31 41 T_REMOTE_IMAGE 13866 5.34 10.49 4.09 42 XM_H_Long_From01 13643 7.28 10.32 6.54 43 TR_Mismatch_TLD_02 13463 2.03 10.18 0.06 44 HTML_SHORT_LINK_IMG_1 12758 1.90 9.65 0.03 45 MPART_ALT_DIFF 12071 5.20 9.13 4.25 46 HTML_IMAGE_ONLY_08 11948 1.85 9.04 0.11 47 XMSubMetaSx_00 11843 4.71 8.96 3.68 48 RDNS_DYNAMIC 11832 2.04 8.95 0.37 49 FROM_SUSPICIOUS_NTLD 11733 1.76 8.87 0.04 50 FROM_SUSPICIOUS_NTLD_FP 11629 1.74 8.80 0.04 51 RCVD_IN_MSPIKE_H2 11618 11.77 8.79 12.49 52 DKIM_ADSP_NXDOMAIN 10977 2.30 8.30 0.84 53 LotsOfNums_01 10293 8.32 7.78 8.45 54 TooManyTo_001 10194 8.02 7.71 8.10 55 T_XMDrugObfuBody_14 10115 8.61 7.65 8.84 56 BAYES_60 9469 5.12 7.16 4.62 57 BAYES_80 9407 3.33 7.11 2.42 58 XM_UB50 9336 2.13 7.06 0.94 59 HTML_IMAGE_RATIO_04 9121 6.00 6.90 5.78 60 T_HTML_TAG_BALANCE_CENTER 9113 1.43 6.89 0.10 61 TO_NO_BRKTS_DYNIP 9008 1.33 6.81 0.01 62 XM_B_Phish_Phrases 8919 6.36 6.75 6.27 63 XM_DIRTYINTL 8745 3.97 6.61 3.32 64 DKIM_INVALID 8333 4.96 6.30 4.63 65 SHORT_IMG_SUSP_NTLD 8328 1.23 6.30 0.00 66 XM_SPF_SoftFail 8310 2.90 6.28 2.09 67 XMNumbers 8195 3.80 6.20 3.22 68 MIME_HTML_MOSTLY 7995 3.49 6.05 2.87 69 XMStrtUSub 7797 5.11 5.90 4.92 70 RCVD_IN_MSPIKE_WL 7736 10.32 5.85 11.40 71 BODY_URI_ONLY 7547 1.18 5.71 0.08 72 HDRS_MISSP 7132 1.06 5.39 0.01 73 MIME_QP_LONG_LINE 6548 5.93 4.95 6.17 74 XM_SendGrid 6175 6.24 4.67 6.62 75 BAYES_40 6128 5.37 4.63 5.55 76 RCVD_IN_MSPIKE_H3 6039 9.77 4.57 11.03 77 MIME_HEADER_CTYPE_ONLY 5969 0.99 4.51 0.14 78 RCVD_IN_BL_SPAMCOP_NET 5913 1.88 4.47 1.25 79 XM_BadFromFormat 5900 0.95 4.46 0.10 80 MIME_HTML_ONLY_MULTI 5857 3.02 4.43 2.68 81 URI_HEX 5658 2.21 4.28 1.71 82 FROM_MISSP_REPLYTO 5570 0.82 4.21 0.00 83 REPLYTO_WITHOUT_TO_CC 5156 0.80 3.90 0.04 84 HTML_IMAGE_RATIO_06 4910 4.18 3.71 4.29 85 HDRS_LCASE_IMGONLY 4907 0.74 3.71 0.03 86 XM_B_SpammyTLD 4795 2.50 3.63 2.23 87 BAYES_95 4766 1.86 3.60 1.44 88 FROM_EXCESS_BASE64 4684 3.87 3.54 3.95 89 BAYES_20 4675 4.32 3.54 4.51 90 RELAYCOUNTRY_CA 4627 1.98 3.50 1.61 91 T_TooManySym_01 4531 4.75 3.43 5.07 92 XM_URI_RBL 4465 0.93 3.38 0.33 93 TM2_M_URI_OPT_OUT 4438 2.56 3.36 2.37 94 XM_CamelCaseFrm001 4244 2.39 3.21 2.19 95 XMSexyCombo_01 4157 1.36 3.14 0.93 96 XMDiploma_00 3987 1.82 3.02 1.54 97 TO_EQ_FM_DOM_HTML_IMG 3973 0.59 3.00 0.01 98 HTML_IMAGE_RATIO_08 3971 2.33 3.00 2.17 99 BAYES_00 3780 15.81 2.86 18.94 100 RELAYCOUNTRY_GB 3400 1.33 2.57 1.02 101 MultiRelay_Combo 3383 0.73 2.56 0.29 102 MultiRelay_CC 3383 0.73 2.56 0.29 103 RELAYCOUNTRY_FR 3283 0.79 2.48 0.38 104 XMStockSpam_06 3252 1.65 2.46 1.46 105 T_XMHurry_00 3164 1.26 2.39 0.99 106 XMBody_17 3103 1.08 2.35 0.77 107 XMGenDplmaNmb 3096 1.19 2.34 0.91 108 FROM_MISSP_DYNIP 3009 0.44 2.28 0.00 109 XMSubMetaI_00 3002 1.17 2.27 0.91 110 TR_XM_DK_SendGrid 2996 3.40 2.27 3.67 111 XM_B_Unsub2 2918 1.79 2.21 1.69 112 BOTNET_NORDNS 2868 0.57 2.17 0.18 113 RCVD_IN_IADB_LISTED 2783 4.42 2.10 4.98 114 NO_DNS_FOR_FROM 2741 1.59 2.07 1.48 115 XMSexyCombo_04 2738 0.76 2.07 0.44 116 XMBdyGiftCard01 2732 2.00 2.07 1.98 117 URI_TRY_3LD 2732 1.43 2.07 1.27 118 HK_RANDOM_FROM 2722 0.50 2.06 0.12 119 TR_XM_PHPDW 2683 0.86 2.03 0.57 120 TM2_M_VERY_LONG_WORD 2676 1.43 2.02 1.29 121 TR_XM_DK_Bayes 2643 11.91 2.00 14.30 122 RCVD_IN_IADB_SPF 2641 3.90 2.00 4.37 123 TR_XM_PHPForged 2627 0.84 1.99 0.56 124 TR_XM_FormFill2 2614 0.83 1.98 0.55 125 RCVD_IN_IADB_DK 2607 3.43 1.97 3.78 126 RCVD_IN_IADB_SENDERID 2604 3.49 1.97 3.85 127 XM_H_PHPOS 2596 0.82 1.96 0.55 128 TR_XM_RelayPhish 2583 1.27 1.95 1.10 129 T_XMDrugObfuBody_08 2582 1.36 1.95 1.22 130 SUBJ_ALL_CAPS 2581 1.60 1.95 1.52 131 BAYES_05 2566 2.68 1.94 2.85 132 RCVD_IN_RP_SAFE 2548 8.63 1.93 10.25 133 XM_OfRef6 2525 1.48 1.91 1.38 134 TR_XM_DK_Bayes1 2467 11.33 1.87 13.62 135 SpammyFromTLD_01 2430 0.97 1.84 0.76 136 DATE_IN_PAST_03_06 2360 0.44 1.78 0.12 137 T_MONEY_PERCENT 2351 0.59 1.78 0.30 138 TR_LOTS_OF_MONEY2 2351 0.59 1.78 0.30 139 TR_XM_INV_DKIM 2255 0.41 1.71 0.09 140 RCVD_IN_RP_RNBL 2243 0.38 1.70 0.07 141 XMHTML_After_End 2079 1.58 1.57 1.58 142 ALL_TRUSTED 2061 10.65 1.56 12.85 143 XMPhish11 2006 1.17 1.52 1.08 144 LongTLD 1998 0.41 1.51 0.14 145 XM_SPF_Unknown 1943 0.82 1.47 0.66 146 SUBJ_ILLEGAL_CHARS 1931 0.29 1.46 0.01 147 SUBJECT_NEEDS_ENCODING 1928 0.29 1.46 0.01 148 MISSING_HEADERS 1912 0.67 1.45 0.48 149 TR_Symld_Words 1886 1.31 1.43 1.29 150 UNPARSEABLE_RELAY 1875 1.99 1.42 2.13 151 XM_H_Long_From02 1861 1.33 1.41 1.32 152 XMSubMetaSSx_00 1835 0.37 1.39 0.13 153 RCVD_IN_RP_CERTIFIED 1790 7.67 1.35 9.20 154 XM_H_PHPMailer 1789 0.63 1.35 0.45 155 XMSubMetaSxObfu_03 1709 0.91 1.29 0.81 156 RCVD_IN_MSPIKE_H4 1697 0.54 1.28 0.36 157 THIS_AD 1656 0.57 1.25 0.40 158 XMMoneyMeta_00 1650 0.68 1.25 0.55 159 RCVD_IN_MSPIKE_BL 1639 1.44 1.24 1.49 160 XMPhish14 1580 0.57 1.19 0.41 161 DIET_1 1528 0.78 1.16 0.69 162 XMBrknScrpt_02 1508 1.00 1.14 0.97 163 XM_ProductURIs 1505 0.81 1.14 0.73 164 NORDNS_LOW_CONTRAST 1502 0.23 1.14 0.01 165 T_XMDrugObfuBody_00 1430 0.64 1.08 0.54 166 XM_H_PHPOS_M 1401 0.31 1.06 0.13 167 TR_LOTS_OF_MONEY3 1396 0.70 1.06 0.62 168 RELAYCOUNTRY_AT 1386 0.42 1.05 0.26 169 TooManyTo_002 1375 1.96 1.04 2.18 170 RCVD_IN_PSBL 1346 0.23 1.02 0.04 171 RELAYCOUNTRY_IN 1337 0.29 1.01 0.12 172 RELAYCOUNTRY_DE 1327 0.49 1.00 0.37 173 XM_DK_Undo_01 1318 1.41 1.00 1.51 174 XMPhish30 1316 0.67 1.00 0.59 175 FSL_THIS_IS_ADV 1303 0.46 0.99 0.34 176 MAILING_LIST_MULTI 1262 2.21 0.95 2.52 177 DATE_IN_PAST_06_12 1242 0.26 0.94 0.10 178 XMSubMetaSx_01 1241 0.51 0.94 0.41 179 RCVD_IN_MSPIKE_L5 1222 0.47 0.92 0.36 180 URIBL_DBL_ABUSE_REDIR 1220 0.18 0.92 0.01 181 INVALID_DATE 1201 0.23 0.91 0.07 182 TooManyTo_003 1149 1.37 0.87 1.49 183 HTML_IMAGE_ONLY_12 1139 0.31 0.86 0.18 184 XMSexyCombo_02 1137 0.46 0.86 0.37 185 HK_RANDOM_REPLYTO 1116 0.32 0.84 0.19 186 NO_FM_NAME_IP_HOSTN 1107 0.16 0.84 0.00 187 T_Symld_Words_02 1107 0.59 0.84 0.53 188 HTML_FONT_FACE_BAD 1104 1.06 0.83 1.12 189 TR_XM_DK_Bayes2 1096 9.75 0.83 11.91 190 DKIM_ADSP_CUSTOM_MED 1081 1.01 0.82 1.06 191 XMSubject_48 1067 0.18 0.81 0.02 192 FROM_LOCAL_NOVOWEL 1059 0.18 0.80 0.03 193 FVGT_m_MULTI_ODD_EMAIL 1029 0.17 0.78 0.03 194 XM_B_COPY_HTML 1027 0.47 0.78 0.39 195 XMSubject_09 1017 0.39 0.77 0.29 196 HTML_IMAGE_ONLY_28 1016 0.46 0.77 0.39 197 XM_UB99 1015 0.15 0.77 0.01 198 XMHTMLBadTable_001 983 0.57 0.74 0.53 199 XM_PDF 976 3.48 0.74 4.14 200 TooManyTo_004 961 1.03 0.73 1.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 487959 90.78 97.01 89.28 2 DKIM_SIGNED 424646 76.71 72.66 77.69 3 XM_DK_Pass 418702 75.42 70.50 76.61 4 DKIM_VALID 399345 71.76 66.36 73.06 5 XM_B_Unicode 392459 72.10 73.30 71.81 6 BAYES_50 306516 53.99 45.33 56.08 7 DKIM_VALID_AU 305357 54.95 51.16 55.87 8 XMListUnsubscribeExists 296524 55.72 61.79 54.25 9 DCC_CHECK_NEGATIVE 291594 46.14 16.35 53.35 10 DCC_CHECK 243854 51.87 81.86 44.62 11 XM_B_Unicode3 232063 43.26 46.56 42.46 12 HTML_FONT_LOW_CONTRAST 163239 30.57 33.47 29.87 13 T_TM2_M_HEADER_IN_MSG 162735 26.93 15.18 29.77 14 DKIM_VALID_EF 146885 25.83 21.52 26.87 15 LOC_TINY_FONT_1 136738 26.41 32.18 25.02 16 MIME_HTML_ONLY 118495 25.68 42.23 21.68 17 FVGT_m_MULTI_ODD 117592 21.95 23.75 21.51 18 XMSubLong 116006 22.24 26.44 21.22 19 BAYES_00 103535 15.81 2.86 18.94 20 MultiRelay 103503 18.47 16.53 18.94 21 T_KAM_HTML_FONT_INVALID 95149 17.44 17.56 17.41 22 TR_XM_DK_Bayes 78173 11.91 2.00 14.30 23 XM_Body_Dirty_Words 77643 15.97 23.26 14.21 24 TR_XM_DK_Bayes1 74431 11.33 1.87 13.62 25 ALL_TRUSTED 70247 10.65 1.56 12.85 26 XM_Multi_Part_URI 69928 13.46 16.19 12.79 27 RCVD_IN_MSPIKE_H2 68278 11.77 8.79 12.49 28 TR_XM_DK_Bayes2 65105 9.75 0.83 11.91 29 RCVD_IN_MSPIKE_WL 62292 10.32 5.85 11.40 30 RCVD_IN_MSPIKE_H3 60301 9.77 4.57 11.03 31 XM_Evil_Numbers_Gen 56403 10.72 12.36 10.32 32 RCVD_IN_RP_SAFE 56008 8.63 1.93 10.25 33 HTML_IMAGE_RATIO_02 53143 10.90 15.74 9.72 34 XM_B_Unsub 51345 10.51 15.11 9.39 35 RCVD_IN_RP_CERTIFIED 50289 7.67 1.35 9.20 36 T_XMDrugObfuBody_14 48341 8.61 7.65 8.84 37 LotsOfNums_01 46160 8.32 7.78 8.45 38 XM_DKIMWhitelistDomains 45541 6.73 0.13 8.33 39 LOTS_OF_MONEY 45402 8.82 10.92 8.31 40 TooManyTo_001 44271 8.02 7.71 8.10 41 XM_DK_Undo_02 36650 12.37 35.77 6.71 42 XM_SendGrid 36180 6.24 4.67 6.62 43 FSL_BULK_SIG 35954 9.65 22.37 6.58 44 XM_H_Long_From01 35760 7.28 10.32 6.54 45 XM_B_Phish_Phrases 34263 6.36 6.75 6.27 46 MIME_QP_LONG_LINE 33701 5.93 4.95 6.17 47 HTML_IMAGE_RATIO_04 31603 6.00 6.90 5.78 48 RELAYCOUNTRY_META 30646 8.16 18.72 5.61 49 BAYES_40 30337 5.37 4.63 5.55 50 T_TooManySym_01 27714 4.75 3.43 5.07 51 RCVD_IN_IADB_LISTED 27218 4.42 2.10 4.98 52 XMStrtUSub 26881 5.11 5.90 4.92 53 DKIM_INVALID 25301 4.96 6.30 4.63 54 BAYES_60 25254 5.12 7.16 4.62 55 XMSexyCombo_05 25103 6.54 14.59 4.59 56 BAYES_20 24635 4.32 3.54 4.51 57 BOTNET_IPINHOSTNAME 24579 7.17 18.22 4.50 58 RCVD_IN_IADB_SPF 23858 3.90 2.00 4.37 59 HTML_IMAGE_RATIO_06 23465 4.18 3.71 4.29 60 MPART_ALT_DIFF 23231 5.20 9.13 4.25 61 XM_PDF 22639 3.48 0.74 4.14 62 T_REMOTE_IMAGE 22371 5.34 10.49 4.09 63 FROM_EXCESS_BASE64 21616 3.87 3.54 3.95 64 RCVD_IN_IADB_SENDERID 21059 3.49 1.97 3.85 65 RCVD_IN_IADB_DK 20680 3.43 1.97 3.78 66 XMSubMetaSx_00 20099 4.71 8.96 3.68 67 TR_XM_DK_SendGrid 20068 3.40 2.27 3.67 68 IN_ZIMBRA_NJ_WHITELIST 19036 2.81 0.03 3.48 69 XM_UncommonTLD01 18966 7.08 21.99 3.47 70 XM_DIRTYINTL 18171 3.97 6.61 3.32 71 BAYES_99 18125 7.26 23.57 3.32 72 XMNumbers 17610 3.80 6.20 3.22 73 RCVD_IN_IADB_VOUCHED 17023 2.62 0.59 3.11 74 MIME_HTML_MOSTLY 15712 3.49 6.05 2.87 75 BAYES_05 15599 2.68 1.94 2.85 76 MIME_HTML_ONLY_MULTI 14664 3.02 4.43 2.68 77 BAYES_999 14450 5.76 18.62 2.64 78 MAILING_LIST_MULTI 13772 2.21 0.95 2.52 79 BAYES_80 13215 3.33 7.11 2.42 80 TM2_M_URI_OPT_OUT 12961 2.56 3.36 2.37 81 XM_B_SpammyTLD 12208 2.50 3.63 2.23 82 BOTNET 12071 6.11 22.26 2.21 83 XM_CamelCaseFrm001 11987 2.39 3.21 2.19 84 T_TooManySym_02 11982 1.90 0.69 2.19 85 TooManyTo_002 11908 1.96 1.04 2.18 86 HTML_IMAGE_RATIO_08 11868 2.33 3.00 2.17 87 UNPARSEABLE_RELAY 11632 1.99 1.42 2.13 88 HTML_MIME_NO_HTML_TAG 11433 4.16 12.69 2.09 89 XM_H_Trusted_IP 11423 1.68 0.00 2.09 90 XM_SPF_SoftFail 11396 2.90 6.28 2.09 91 KHOP_HELO_FCRDNS 11009 3.89 11.63 2.01 92 XMBdyGiftCard01 10843 2.00 2.07 1.98 93 RCVD_IN_IADB_OPTIN 10791 1.66 0.37 1.97 94 TVD_RCVD_IP 10350 1.61 0.46 1.89 95 ANY_BOUNCE_MESSAGE 10337 1.61 0.44 1.89 96 BOUNCE_MESSAGE 10337 1.61 0.44 1.89 97 URI_HEX 9337 2.21 4.28 1.71 98 XM_B_Unsub2 9260 1.79 2.21 1.69 99 UNTRUSTED_Relay 9080 3.60 11.59 1.66 100 RELAYCOUNTRY_CA 8814 1.98 3.50 1.61 101 XMHTML_After_End 8637 1.58 1.57 1.58 102 XMDiploma_00 8397 1.82 3.02 1.54 103 IN_HORDE_ADDRESS_BOOK 8324 1.23 0.03 1.52 104 SUBJ_ALL_CAPS 8297 1.60 1.95 1.52 105 XM_DK_Undo_01 8248 1.41 1.00 1.51 106 RCVD_IN_MSPIKE_BL 8164 1.44 1.24 1.49 107 TooManyTo_003 8163 1.37 0.87 1.49 108 NO_DNS_FOR_FROM 8081 1.59 2.07 1.48 109 XMStockSpam_06 7971 1.65 2.46 1.46 110 BAYES_95 7885 1.86 3.60 1.44 111 INVALID_MSGID 7828 1.28 0.67 1.43 112 HELO_NODOT 7742 1.27 0.67 1.42 113 HELO_NO_DOMAIN 7740 1.27 0.67 1.42 114 XM_OfRef6 7529 1.48 1.91 1.38 115 CK_HELO_DYNAMIC_SPLIT_IP 7488 1.17 0.35 1.37 116 HELO_DYNAMIC_IPADDR2 7485 1.12 0.11 1.37 117 TR_DCC_Bayes_99 7318 4.81 19.16 1.34 118 XM_H_Long_From02 7198 1.33 1.41 1.32 119 TM2_M_VERY_LONG_WORD 7062 1.43 2.02 1.29 120 TR_Symld_Words 7032 1.31 1.43 1.29 121 TR_MetaPhish_Combo_01 7002 1.14 0.58 1.28 122 URI_TRY_3LD 6942 1.43 2.07 1.27 123 XMCapTrack 6941 1.08 0.28 1.27 124 RCVD_IN_BL_SPAMCOP_NET 6836 1.88 4.47 1.25 125 T_XMDrugObfuBody_08 6677 1.36 1.95 1.22 126 TO_MALFORMED 6610 0.98 0.03 1.21 127 USER_IN_DEF_DKIM_WL 6149 0.91 0.01 1.13 128 HTML_FONT_FACE_BAD 6125 1.06 0.83 1.12 129 TooManyTo_004 6055 1.03 0.73 1.11 130 TR_XM_RelayPhish 6018 1.27 1.95 1.10 131 XMPhish11 5913 1.17 1.52 1.08 132 DKIM_ADSP_CUSTOM_MED 5801 1.01 0.82 1.06 133 XMSubNoVowel 5748 0.90 0.29 1.05 134 RELAYCOUNTRY_GB 5595 1.33 2.57 1.02 135 XM_GoogleGroups 5391 0.86 0.33 0.99 136 T_XMHurry_00 5390 1.26 2.39 0.99 137 XMBrknScrpt_02 5287 1.00 1.14 0.97 138 XMGappySubj_01 5175 0.82 0.30 0.95 139 XM_UB50 5154 2.13 7.06 0.94 140 TooManyTo_005 5075 0.86 0.60 0.93 141 XMSexyCombo_01 5074 1.36 3.14 0.93 142 XMGenDplmaNmb 4953 1.19 2.34 0.91 143 XMSubMetaI_00 4950 1.17 2.27 0.91 144 XM_RXBody 4716 0.82 0.62 0.86 145 DKIM_ADSP_NXDOMAIN 4607 2.30 8.30 0.84 146 XMBody_95 4493 0.71 0.25 0.82 147 XMNoVowels 4465 0.74 0.42 0.82 148 XMSubMetaSxObfu_03 4436 0.91 1.29 0.81 149 XMBody_17 4229 1.08 2.35 0.77 150 NML_ADSP_CUSTOM_MED 4170 0.73 0.60 0.76 151 SpammyFromTLD_01 4145 0.97 1.84 0.76 152 T_FILL_THIS_FORM_SHORT 4132 0.75 0.72 0.76 153 XM_ProductURIs 3964 0.81 1.14 0.73 154 DIET_1 3778 0.78 1.16 0.69 155 T_TooManySym_03 3746 0.59 0.19 0.69 156 XM_SPF_Unknown 3625 0.82 1.47 0.66 157 XM_B_REG_HTML 3540 0.66 0.71 0.65 158 XM_E_Blogspot 3399 0.52 0.11 0.62 159 TR_LOTS_OF_MONEY3 3365 0.70 1.06 0.62 160 XMPhish30 3249 0.67 1.00 0.59 161 T_OBFU_PDF_ATTACH 3182 0.51 0.19 0.58 162 XMBody_78 3170 0.58 0.60 0.58 163 FORGED_GMAIL_RCVD 3167 0.60 0.67 0.58 164 RCVD_IN_MSPIKE_L3 3154 0.50 0.17 0.58 165 XM_ShortIntro_01 3150 0.52 0.27 0.58 166 TR_XM_PHPDW 3139 0.86 2.03 0.57 167 PLING_QUERY 3075 0.53 0.38 0.56 168 HTTPS_HTTP_MISMATCH 3061 0.53 0.39 0.56 169 TR_XM_PHPForged 3041 0.84 1.99 0.56 170 RCVD_IN_MSPIKE_L4 3023 0.47 0.15 0.55 171 TR_XM_FormFill2 3020 0.83 1.98 0.55 172 FILL_THIS_FORM 3020 0.53 0.42 0.55 173 XM_H_PHPOS 2996 0.82 1.96 0.55 174 XMMoneyMeta_00 2985 0.68 1.25 0.55 175 T_XMDrugObfuBody_00 2947 0.64 1.08 0.54 176 T_Symld_Words_02 2894 0.59 0.84 0.53 177 XMHTMLBadTable_001 2893 0.57 0.74 0.53 178 FROM_GOV_DKIM_AU 2789 0.43 0.11 0.51 179 XMLngstWrd_00 2787 0.48 0.38 0.51 180 URI_NOVOWEL 2687 0.49 0.47 0.49 181 AC_FROM_MANY_DOTS 2672 0.39 0.01 0.49 182 MISSING_HEADERS 2618 0.67 1.45 0.48 183 XMLngstWrd_01 2611 0.45 0.36 0.48 184 USER_IN_WHITELIST 2570 0.38 0.00 0.47 185 XMSolicitRefs_0 2483 0.47 0.54 0.45 186 XM_H_PHPMailer 2469 0.63 1.35 0.45 187 RELAYCOUNTRY_NL 2455 0.44 0.41 0.45 188 HTML_IMAGE_ONLY_20 2439 0.43 0.34 0.45 189 XMSexyCombo_04 2418 0.76 2.07 0.44 190 HTML_TAG_BALANCE_BODY 2395 0.48 0.68 0.44 191 AC_DIV_BONANZA 2375 0.37 0.12 0.43 192 FILL_THIS_FORM_LONG 2332 0.41 0.34 0.43 193 RELAYCOUNTRY_AU 2331 0.42 0.38 0.43 194 XMLKML 2276 0.34 0.00 0.42 195 XMPhish14 2268 0.57 1.19 0.41 196 TM2_M_BODY_EMPTY 2247 0.37 0.17 0.41 197 XMSubMetaSx_01 2232 0.51 0.94 0.41 198 THIS_AD 2185 0.57 1.25 0.40 199 SHORT_HELO_AND_INLINE_IMAGE 2176 0.33 0.04 0.40 200 T_FILL_THIS_FORM_LOAN 2168 0.34 0.08 0.40 ----------------------------------------------------------------------