Email: 748225 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 2.20 sec Spam: 133713 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 2.84 sec Ham: 614512 Autolearn: 0 AvgScore: -2.58 AvgScanTime: 2.06 sec Time Spent Running SA: 457.17 hours Time Spent Processing Spam: 105.45 hours Time Spent Processing Ham: 351.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128243 92.11 95.91 91.28 2 DCC_CHECK 110227 48.79 82.44 41.46 3 DKIM_SIGNED 100927 71.16 75.48 70.22 4 XM_B_Unicode 98710 74.36 73.82 74.48 5 XM_DK_Pass 97718 69.79 73.08 69.08 6 DKIM_VALID 91929 66.58 68.75 66.11 7 XMListUnsubscribeExists 86117 52.88 64.40 50.37 8 DKIM_VALID_AU 70188 50.83 52.49 50.46 9 XM_B_Unicode3 65198 45.97 48.76 45.36 10 BAYES_50 59055 49.02 44.17 50.07 11 MIME_HTML_ONLY 55264 26.67 41.33 23.48 12 XM_DK_Undo_02 51379 12.02 38.42 6.28 13 HTML_FONT_LOW_CONTRAST 46492 28.22 34.77 26.79 14 LOC_TINY_FONT_1 43179 24.36 32.29 22.64 15 XMSubLong 38190 21.63 28.56 20.12 16 BAYES_99 34918 7.36 26.11 3.28 17 BOTNET 31984 5.84 23.92 1.90 18 FVGT_m_MULTI_ODD 31662 20.45 23.68 19.75 19 DKIM_VALID_EF 28581 23.04 21.37 23.40 20 XM_Body_Dirty_Words 27858 14.86 20.83 13.56 21 TR_DCC_Bayes_99 27810 4.89 20.80 1.43 22 RELAYCOUNTRY_META 27071 7.41 20.25 4.61 23 BAYES_999 26989 5.77 20.18 2.63 24 XM_UncommonTLD01 26254 6.26 19.63 3.35 25 T_KAM_HTML_FONT_INVALID 26146 16.83 19.55 16.24 26 BOTNET_IPINHOSTNAME 25436 6.72 19.02 4.04 27 T_TM2_M_HEADER_IN_MSG 25206 24.34 18.85 25.54 28 XM_B_Unsub 24763 10.30 18.52 8.51 29 XM_Multi_Part_URI 24653 12.54 18.44 11.26 30 FSL_BULK_SIG 24410 8.61 18.26 6.51 31 MultiRelay 23708 16.67 17.73 16.44 32 DCC_CHECK_NEGATIVE 20923 49.41 15.65 56.76 33 HTML_IMAGE_RATIO_02 20008 9.80 14.96 8.68 34 XM_Evil_Numbers_Gen 18199 11.09 13.61 10.55 35 LOTS_OF_MONEY 17584 9.07 13.15 8.18 36 UNTRUSTED_Relay 17061 3.50 12.76 1.49 37 XMSexyCombo_05 16724 5.88 12.51 4.44 38 HTML_MIME_NO_HTML_TAG 14649 3.98 10.96 2.46 39 RCVD_IN_MSPIKE_H2 13852 11.41 10.36 11.64 40 XM_H_Long_From01 12408 6.65 9.28 6.08 41 MPART_ALT_DIFF 12382 8.11 9.26 7.86 42 SpammyFromTLD_02 12183 1.89 9.11 0.31 43 XM_B_Phish_Phrases 11723 6.40 8.77 5.88 44 LotsOfNums_01 11060 7.84 8.27 7.74 45 KHOP_HELO_FCRDNS 10890 2.79 8.14 1.63 46 TR_Mismatch_TLD_02 10825 1.50 8.10 0.07 47 HTML_IMAGE_RATIO_04 10623 13.30 7.94 14.46 48 T_XMDrugObfuBody_14 10037 7.98 7.51 8.09 49 XMSubMetaSx_00 10022 3.95 7.50 3.18 50 FROM_SUSPICIOUS_NTLD 9892 1.39 7.40 0.08 51 FROM_SUSPICIOUS_NTLD_FP 9828 1.38 7.35 0.08 52 XM_UB50 9566 1.90 7.15 0.76 53 HTML_IMAGE_ONLY_08 9284 1.31 6.94 0.09 54 BAYES_80 9267 3.49 6.93 2.74 55 HTML_SHORT_LINK_IMG_1 9235 1.26 6.91 0.03 56 DKIM_ADSP_NXDOMAIN 9079 2.17 6.79 1.16 57 DKIM_INVALID 8998 4.57 6.73 4.11 58 TooManyTo_001 8887 6.61 6.65 6.61 59 T_REMOTE_IMAGE 8858 4.50 6.62 4.04 60 BAYES_60 8688 5.35 6.50 5.10 61 XM_DIRTYINTL 8472 3.52 6.34 2.91 62 RCVD_IN_MSPIKE_WL 7470 9.07 5.59 9.83 63 MIME_QP_LONG_LINE 7255 5.78 5.43 5.86 64 MIME_HTML_MOSTLY 6998 2.86 5.23 2.34 65 RCVD_IN_MSPIKE_H3 6686 8.80 5.00 9.63 66 SHORT_IMG_SUSP_NTLD 6601 0.88 4.94 0.00 67 MIME_HTML_ONLY_MULTI 6371 6.13 4.76 6.43 68 XMNumbers 6366 3.19 4.76 2.85 69 RCVD_IN_BL_SPAMCOP_NET 6362 1.83 4.76 1.19 70 MIME_HEADER_CTYPE_ONLY 6356 0.89 4.75 0.05 71 BAYES_40 6286 5.10 4.70 5.19 72 FROM_EXCESS_BASE64 6148 3.55 4.60 3.32 73 XM_SendGrid 6100 5.62 4.56 5.85 74 RDNS_DYNAMIC 6015 1.06 4.50 0.31 75 HDRS_MISSP 6005 0.81 4.49 0.01 76 HTML_IMAGE_RATIO_06 5994 4.63 4.48 4.66 77 URI_HEX 5960 2.29 4.46 1.82 78 XM_SPF_SoftFail 5808 2.06 4.34 1.56 79 XMStrtUSub 5740 8.36 4.29 9.25 80 LongTLD 5368 0.87 4.01 0.19 81 RELAYCOUNTRY_GB 5254 1.38 3.93 0.82 82 HDRS_LCASE_IMGONLY 5224 0.72 3.91 0.02 83 TM2_M_URI_OPT_OUT 4880 2.25 3.65 1.94 84 BAYES_95 4825 1.98 3.61 1.63 85 REPLYTO_WITHOUT_TO_CC 4773 0.66 3.57 0.02 86 RELAYCOUNTRY_CA 4712 1.69 3.52 1.29 87 BAYES_20 4668 4.96 3.49 5.28 88 MultiRelay_Combo 4599 0.78 3.44 0.21 89 MultiRelay_CC 4599 0.78 3.44 0.21 90 FROM_MISSP_REPLYTO 4589 0.62 3.43 0.00 91 XM_URI_RBL 4479 0.83 3.35 0.28 92 XM_B_SpammyTLD 4430 2.42 3.31 2.23 93 T_HTML_TAG_BALANCE_CENTER 4337 0.66 3.24 0.10 94 BODY_URI_ONLY 4118 0.60 3.08 0.06 95 T_TooManySym_01 4103 4.04 3.07 4.25 96 XM_CamelCaseFrm001 4001 2.41 2.99 2.28 97 XMBody_17 3948 1.15 2.95 0.76 98 XM_OfRef6 3744 1.51 2.80 1.23 99 RELAYCOUNTRY_DE 3704 0.78 2.77 0.34 100 T_XMDrugObfuBody_08 3654 1.68 2.73 1.45 101 XMBdyGiftCard01 3562 2.02 2.66 1.88 102 XM_B_Unsub2 3501 1.55 2.62 1.32 103 RCVD_IN_MSPIKE_BL 3394 1.52 2.54 1.30 104 XMPhish11 3214 1.24 2.40 0.99 105 BAYES_00 3203 18.89 2.40 22.48 106 HTML_IMAGE_RATIO_08 3191 2.20 2.39 2.16 107 XMDiploma_00 3140 1.51 2.35 1.33 108 XMStockSpam_06 3060 1.71 2.29 1.58 109 MISSING_HEADERS 2930 0.70 2.19 0.37 110 URI_TRY_3LD 2894 1.48 2.16 1.33 111 XMSexyCombo_01 2837 0.96 2.12 0.70 112 TR_XM_DK_SendGrid 2824 3.11 2.11 3.33 113 RCVD_IN_IADB_LISTED 2775 4.12 2.08 4.57 114 SUBJ_ILLEGAL_CHARS 2770 0.37 2.07 0.01 115 SUBJECT_NEEDS_ENCODING 2769 0.37 2.07 0.01 116 NO_DNS_FOR_FROM 2762 1.66 2.07 1.58 117 SUBJ_ALL_CAPS 2752 1.71 2.06 1.63 118 RELAYCOUNTRY_FR 2735 0.59 2.05 0.27 119 FROM_MISSP_DYNIP 2705 0.36 2.02 0.00 120 RCVD_IN_IADB_SPF 2631 3.63 1.97 3.99 121 TR_XM_INV_DKIM 2599 0.44 1.94 0.12 122 RCVD_IN_IADB_SENDERID 2588 3.25 1.94 3.54 123 RCVD_IN_IADB_DK 2585 3.20 1.93 3.47 124 TR_LOTS_OF_MONEY3 2573 0.97 1.92 0.76 125 T_XMHurry_00 2549 0.93 1.91 0.72 126 BAYES_05 2523 3.64 1.89 4.02 127 TR_XM_PHPDW 2515 0.79 1.88 0.56 128 RCVD_IN_RP_SAFE 2479 8.38 1.85 9.80 129 XM_SPF_Unknown 2463 0.88 1.84 0.66 130 TR_XM_PHPForged 2452 0.78 1.83 0.55 131 TR_XM_FormFill2 2439 0.77 1.82 0.55 132 XM_H_PHPOS 2431 0.77 1.82 0.54 133 XMSubMetaI_00 2386 0.81 1.78 0.60 134 RCVD_IN_RP_RNBL 2345 0.35 1.75 0.04 135 XMGenDplmaNmb 2315 0.99 1.73 0.83 136 XMHTML_After_End 2310 2.24 1.73 2.35 137 XM_BadFromFormat 2299 0.38 1.72 0.08 138 TO_EQ_FM_DOM_HTML_IMG 2286 0.31 1.71 0.01 139 DATE_IN_PAST_06_12 2198 0.38 1.64 0.10 140 T_XMDrugObfuBody_00 2172 0.82 1.62 0.65 141 TR_XM_DK_Bayes 2157 10.85 1.61 12.86 142 DIET_1 2127 0.69 1.59 0.49 143 TR_LOTS_OF_MONEY2 2122 0.67 1.59 0.47 144 T_MONEY_PERCENT 2122 0.67 1.59 0.47 145 TR_XM_RelayPhish 2073 1.13 1.55 1.03 146 ALL_TRUSTED 2062 10.25 1.54 12.14 147 TM2_M_VERY_LONG_WORD 2044 1.27 1.53 1.22 148 BOTNET_NORDNS 2026 0.32 1.52 0.06 149 TR_LOTS_OF_MONEY1 2020 0.28 1.51 0.02 150 TR_Symld_Words 2011 1.43 1.50 1.41 151 SpammyFromTLD_01 1983 0.82 1.48 0.67 152 TR_XM_DK_Bayes1 1957 10.40 1.46 12.34 153 RCVD_IN_RP_CERTIFIED 1945 7.51 1.45 8.82 154 RCVD_IN_MSPIKE_L4 1942 0.69 1.45 0.52 155 XM_Nigeria_01 1923 0.28 1.44 0.03 156 RELAYCOUNTRY_NG_I 1883 0.25 1.41 0.00 157 XM_OfRef7 1877 0.33 1.40 0.09 158 XMMoneyMeta_00 1862 0.64 1.39 0.48 159 XM_DK_Undo_01 1841 1.33 1.38 1.32 160 DATE_IN_PAST_03_06 1783 0.34 1.33 0.12 161 UNPARSEABLE_RELAY 1721 1.77 1.29 1.88 162 TO_NO_BRKTS_DYNIP 1717 0.23 1.28 0.00 163 XMBrknScrpt_02 1717 0.84 1.28 0.74 164 XMPhish14 1601 0.59 1.20 0.45 165 MAILING_LIST_MULTI 1601 1.93 1.20 2.09 166 THIS_AD 1581 0.52 1.18 0.38 167 XM_UB99 1576 0.21 1.18 0.00 168 FILL_THIS_FORM 1575 0.57 1.18 0.44 169 FILL_THIS_FORM_LONG 1534 0.48 1.15 0.34 170 HK_RANDOM_FROM 1505 0.29 1.13 0.11 171 MONEY_FORM 1501 0.21 1.12 0.01 172 RELAYCOUNTRY_IN 1482 0.31 1.11 0.13 173 URIBL_DBL_SPAM 1479 0.22 1.11 0.03 174 XMSlimDrugH 1469 0.43 1.10 0.29 175 XM_H_PHPMailer 1467 0.53 1.10 0.41 176 XM_OfRef8 1427 0.20 1.07 0.01 177 RELAYCOUNTRY_AT 1386 0.38 1.04 0.23 178 HTML_TAG_BALANCE_BODY 1343 0.68 1.00 0.60 179 XMSexyCombo_04 1334 0.50 1.00 0.39 180 ADVANCE_FEE_5_NEW_FRM_MNY 1324 0.18 0.99 0.00 181 SUBJ_DOLLARS 1319 0.53 0.99 0.43 182 TR_XM_DK_Bayes2 1267 9.23 0.95 11.04 183 T_FILL_THIS_FORM_SHORT 1264 0.70 0.95 0.64 184 XM_ProductURIs 1241 0.68 0.93 0.63 185 ADMITS_SPAM 1205 0.20 0.90 0.05 186 NORDNS_LOW_CONTRAST 1203 0.16 0.90 0.00 187 XM_UB999 1200 0.16 0.90 0.00 188 DKIM_ADSP_CUSTOM_MED 1187 0.84 0.89 0.83 189 HK_RANDOM_REPLYTO 1186 0.34 0.89 0.23 190 T_Symld_Words_02 1179 0.70 0.88 0.66 191 XMSubMetaSxObfu_03 1140 0.45 0.85 0.36 192 XM_H_PHPOS_M 1137 0.25 0.85 0.12 193 TooManyTo_002 1108 1.43 0.83 1.56 194 XM_H_Long_From02 1101 1.07 0.82 1.12 195 RCVD_IN_PSBL 1090 0.17 0.82 0.03 196 T_TooManySym_02 1066 1.54 0.80 1.71 197 FSL_THIS_IS_ADV 1059 0.39 0.79 0.30 198 FORGED_GMAIL_RCVD 1055 0.53 0.79 0.47 199 HTML_FONT_FACE_BAD 1044 9.21 0.78 11.05 200 XMPhish30 1043 0.56 0.78 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 560947 92.11 95.91 91.28 2 XM_B_Unicode 457665 74.36 73.82 74.48 3 DKIM_SIGNED 431493 71.16 75.48 70.22 4 XM_DK_Pass 424501 69.79 73.08 69.08 5 DKIM_VALID 406266 66.58 68.75 66.11 6 DCC_CHECK_NEGATIVE 348797 49.41 15.65 56.76 7 DKIM_VALID_AU 310100 50.83 52.49 50.46 8 XMListUnsubscribeExists 309511 52.88 64.40 50.37 9 BAYES_50 307688 49.02 44.17 50.07 10 XM_B_Unicode3 278768 45.97 48.76 45.36 11 DCC_CHECK 254805 48.79 82.44 41.46 12 HTML_FONT_LOW_CONTRAST 164645 28.22 34.77 26.79 13 T_TM2_M_HEADER_IN_MSG 156939 24.34 18.85 25.54 14 MIME_HTML_ONLY 144297 26.67 41.33 23.48 15 DKIM_VALID_EF 143805 23.04 21.37 23.40 16 LOC_TINY_FONT_1 139108 24.36 32.29 22.64 17 BAYES_00 138164 18.89 2.40 22.48 18 XMSubLong 123643 21.63 28.56 20.12 19 FVGT_m_MULTI_ODD 121345 20.45 23.68 19.75 20 MultiRelay 100998 16.67 17.73 16.44 21 T_KAM_HTML_FONT_INVALID 99777 16.83 19.55 16.24 22 HTML_IMAGE_RATIO_04 88889 13.30 7.94 14.46 23 XM_Body_Dirty_Words 83327 14.86 20.83 13.56 24 TR_XM_DK_Bayes 79043 10.85 1.61 12.86 25 TR_XM_DK_Bayes1 75827 10.40 1.46 12.34 26 ALL_TRUSTED 74604 10.25 1.54 12.14 27 RCVD_IN_MSPIKE_H2 71510 11.41 10.36 11.64 28 XM_H_Trusted_IP 70008 9.36 0.00 11.39 29 XM_Multi_Part_URI 69166 12.54 18.44 11.26 30 HTML_FONT_FACE_BAD 67875 9.21 0.78 11.05 31 TR_XM_DK_Bayes2 67829 9.23 0.95 11.04 32 XM_Evil_Numbers_Gen 64810 11.09 13.61 10.55 33 RCVD_IN_MSPIKE_WL 60428 9.07 5.59 9.83 34 RCVD_IN_RP_SAFE 60247 8.38 1.85 9.80 35 RCVD_IN_MSPIKE_H3 59160 8.80 5.00 9.63 36 XMStrtUSub 56820 8.36 4.29 9.25 37 RCVD_IN_RP_CERTIFIED 54221 7.51 1.45 8.82 38 HTML_IMAGE_RATIO_02 53343 9.80 14.96 8.68 39 XM_B_Unsub 52272 10.30 18.52 8.51 40 LOTS_OF_MONEY 50244 9.07 13.15 8.18 41 T_XMDrugObfuBody_14 49703 7.98 7.51 8.09 42 MPART_ALT_DIFF 48306 8.11 9.26 7.86 43 LotsOfNums_01 47588 7.84 8.27 7.74 44 XM_DKIMWhitelistDomains 45440 6.08 0.06 7.39 45 TooManyTo_001 40607 6.61 6.65 6.61 46 FSL_BULK_SIG 39982 8.61 18.26 6.51 47 MIME_HTML_ONLY_MULTI 39526 6.13 4.76 6.43 48 XM_DK_Undo_02 38595 12.02 38.42 6.28 49 XM_H_Long_From01 37346 6.65 9.28 6.08 50 XM_B_Phish_Phrases 36137 6.40 8.77 5.88 51 MIME_QP_LONG_LINE 36023 5.78 5.43 5.86 52 XM_SendGrid 35960 5.62 4.56 5.85 53 BAYES_20 32436 4.96 3.49 5.28 54 BAYES_40 31880 5.10 4.70 5.19 55 BAYES_60 31352 5.35 6.50 5.10 56 HTML_IMAGE_RATIO_06 28665 4.63 4.48 4.66 57 RELAYCOUNTRY_META 28356 7.41 20.25 4.61 58 RCVD_IN_IADB_LISTED 28077 4.12 2.08 4.57 59 XMSexyCombo_05 27269 5.88 12.51 4.44 60 T_TooManySym_01 26115 4.04 3.07 4.25 61 DKIM_INVALID 25227 4.57 6.73 4.11 62 BOTNET_IPINHOSTNAME 24831 6.72 19.02 4.04 63 T_REMOTE_IMAGE 24818 4.50 6.62 4.04 64 BAYES_05 24725 3.64 1.89 4.02 65 RCVD_IN_IADB_SPF 24538 3.63 1.97 3.99 66 XMSubNoVowel 23482 3.22 0.46 3.82 67 RCVD_IN_IADB_SENDERID 21752 3.25 1.94 3.54 68 RCVD_IN_IADB_DK 21324 3.20 1.93 3.47 69 XM_UncommonTLD01 20610 6.26 19.63 3.35 70 TR_XM_DK_SendGrid 20464 3.11 2.11 3.33 71 FROM_EXCESS_BASE64 20405 3.55 4.60 3.32 72 XM_PDF 20325 2.84 0.68 3.31 73 BAYES_99 20165 7.36 26.11 3.28 74 XMSubMetaSx_00 19527 3.95 7.50 3.18 75 IN_ZIMBRA_NJ_WHITELIST 19218 2.57 0.01 3.13 76 XM_DIRTYINTL 17858 3.52 6.34 2.91 77 RCVD_IN_IADB_VOUCHED 17577 2.45 0.57 2.86 78 XMNumbers 17490 3.19 4.76 2.85 79 BAYES_80 16844 3.49 6.93 2.74 80 BAYES_999 16158 5.77 20.18 2.63 81 HTML_MIME_NO_HTML_TAG 15136 3.98 10.96 2.46 82 XMHTML_After_End 14418 2.24 1.73 2.35 83 MIME_HTML_MOSTLY 14368 2.86 5.23 2.34 84 XM_CamelCaseFrm001 13997 2.41 2.99 2.28 85 XM_B_SpammyTLD 13712 2.42 3.31 2.23 86 HTML_IMAGE_RATIO_08 13285 2.20 2.39 2.16 87 MAILING_LIST_MULTI 12872 1.93 1.20 2.09 88 TM2_M_URI_OPT_OUT 11929 2.25 3.65 1.94 89 BOTNET 11690 5.84 23.92 1.90 90 XMBdyGiftCard01 11550 2.02 2.66 1.88 91 UNPARSEABLE_RELAY 11533 1.77 1.29 1.88 92 URI_HEX 11168 2.29 4.46 1.82 93 RCVD_IN_IADB_OPTIN 11122 1.55 0.36 1.81 94 T_TooManySym_02 10480 1.54 0.80 1.71 95 SUBJ_ALL_CAPS 10012 1.71 2.06 1.63 96 KHOP_HELO_FCRDNS 9996 2.79 8.14 1.63 97 BAYES_95 9993 1.98 3.61 1.63 98 XMStockSpam_06 9713 1.71 2.29 1.58 99 NO_DNS_FOR_FROM 9695 1.66 2.07 1.58 100 XM_SPF_SoftFail 9600 2.06 4.34 1.56 101 TooManyTo_002 9569 1.43 0.83 1.56 102 TVD_RCVD_IP 9476 1.34 0.41 1.54 103 ANY_BOUNCE_MESSAGE 9389 1.32 0.36 1.53 104 BOUNCE_MESSAGE 9387 1.32 0.35 1.53 105 UNTRUSTED_Relay 9152 3.50 12.76 1.49 106 T_XMDrugObfuBody_08 8905 1.68 2.73 1.45 107 TR_DCC_Bayes_99 8776 4.89 20.80 1.43 108 TR_Symld_Words 8667 1.43 1.50 1.41 109 XMDiploma_00 8193 1.51 2.35 1.33 110 IN_HORDE_ADDRESS_BOOK 8178 1.10 0.03 1.33 111 URI_TRY_3LD 8153 1.48 2.16 1.33 112 XM_B_Unsub2 8121 1.55 2.62 1.32 113 XM_DK_Undo_01 8121 1.33 1.38 1.32 114 RCVD_IN_MSPIKE_BL 8013 1.52 2.54 1.30 115 RELAYCOUNTRY_CA 7918 1.69 3.52 1.29 116 INVALID_MSGID 7639 1.05 0.18 1.24 117 CK_HELO_DYNAMIC_SPLIT_IP 7617 1.06 0.24 1.24 118 HELO_DYNAMIC_IPADDR2 7613 1.02 0.04 1.24 119 XM_OfRef6 7536 1.51 2.80 1.23 120 TM2_M_VERY_LONG_WORD 7482 1.27 1.53 1.22 121 HELO_NODOT 7375 1.09 0.60 1.20 122 HELO_NO_DOMAIN 7374 1.09 0.59 1.20 123 RCVD_IN_BL_SPAMCOP_NET 7306 1.83 4.76 1.19 124 DKIM_ADSP_NXDOMAIN 7155 2.17 6.79 1.16 125 XMSubLongNoVowel 7063 0.98 0.22 1.15 126 XMSubGarbage 7012 0.94 0.02 1.14 127 XM_H_Long_From02 6887 1.07 0.82 1.12 128 XMCapTrack 6768 0.95 0.28 1.10 129 TO_MALFORMED 6587 0.91 0.14 1.07 130 USER_IN_DEF_DKIM_WL 6534 0.88 0.01 1.06 131 TooManyTo_003 6365 0.97 0.67 1.04 132 TR_XM_RelayPhish 6356 1.13 1.55 1.03 133 XM_GoogleGroups 6180 0.90 0.40 1.01 134 XMPhish11 6054 1.24 2.40 0.99 135 XMBody_95 5295 0.75 0.21 0.86 136 XM_E_Blogspot 5271 0.72 0.08 0.86 137 XMGappySubj_01 5141 0.73 0.24 0.84 138 DKIM_ADSP_CUSTOM_MED 5091 0.84 0.89 0.83 139 XMGenDplmaNmb 5071 0.99 1.73 0.83 140 TR_MetaPhish_Combo_01 5054 0.78 0.59 0.82 141 RELAYCOUNTRY_GB 5053 1.38 3.93 0.82 142 XMBody_17 4689 1.15 2.95 0.76 143 TR_LOTS_OF_MONEY3 4651 0.97 1.92 0.76 144 XM_UB50 4648 1.90 7.15 0.76 145 TooManyTo_004 4601 0.72 0.57 0.75 146 XMBrknScrpt_02 4555 0.84 1.28 0.74 147 T_XMHurry_00 4400 0.93 1.91 0.72 148 XMSexyCombo_01 4311 0.96 2.12 0.70 149 SpammyFromTLD_01 4120 0.82 1.48 0.67 150 XM_SPF_Unknown 4084 0.88 1.84 0.66 151 XM_B_REG_HTML 4057 0.58 0.20 0.66 152 T_Symld_Words_02 4037 0.70 0.88 0.66 153 T_XMDrugObfuBody_00 3994 0.82 1.62 0.65 154 T_FILL_THIS_FORM_SHORT 3941 0.70 0.95 0.64 155 XM_ProductURIs 3849 0.68 0.93 0.63 156 TooManyTo_005 3755 0.59 0.47 0.61 157 NML_ADSP_CUSTOM_MED 3720 0.62 0.67 0.61 158 HTML_TAG_BALANCE_BODY 3714 0.68 1.00 0.60 159 XMSubMetaI_00 3694 0.81 1.78 0.60 160 AC_FROM_MANY_DOTS 3664 0.49 0.02 0.60 161 TR_XM_PHPDW 3428 0.79 1.88 0.56 162 TR_XM_PHPForged 3367 0.78 1.83 0.55 163 FROM_GOV_DKIM_AU 3359 0.47 0.14 0.55 164 TR_XM_FormFill2 3355 0.77 1.82 0.55 165 PLING_QUERY 3337 0.57 0.69 0.54 166 XM_H_PHPOS 3331 0.77 1.82 0.54 167 RCVD_IN_MSPIKE_L4 3205 0.69 1.45 0.52 168 XM_Body_Obfu01 3204 0.51 0.44 0.52 169 XM_RXBody 3195 0.48 0.28 0.52 170 XMPhish30 3129 0.56 0.78 0.51 171 DIET_1 3009 0.69 1.59 0.49 172 XMMoneyMeta_00 2964 0.64 1.39 0.48 173 XMBody_78 2955 0.50 0.58 0.48 174 RCVD_IN_MSPIKE_L3 2942 0.49 0.56 0.48 175 XMHTMLBadTable_001 2919 0.53 0.78 0.48 176 TR_LOTS_OF_MONEY2 2897 0.67 1.59 0.47 177 T_MONEY_PERCENT 2897 0.67 1.59 0.47 178 FORGED_GMAIL_RCVD 2882 0.53 0.79 0.47 179 HTTPS_HTTP_MISMATCH 2875 0.47 0.50 0.47 180 URI_NOVOWEL 2816 0.48 0.55 0.46 181 XMPhish14 2786 0.59 1.20 0.45 182 XMLngstWrd_00 2770 0.45 0.46 0.45 183 RELAYCOUNTRY_AU 2767 0.44 0.41 0.45 184 T_OBFU_PDF_ATTACH 2760 0.41 0.23 0.45 185 XM_ShortIntro_01 2686 0.40 0.21 0.44 186 FILL_THIS_FORM 2683 0.57 1.18 0.44 187 SUBJ_DOLLARS 2643 0.53 0.99 0.43 188 AC_DIV_BONANZA 2618 0.37 0.10 0.43 189 FROM_GOV_SPOOF 2612 0.38 0.18 0.43 190 XMLngstWrd_01 2589 0.42 0.44 0.42 191 USER_IN_WHITELIST 2531 0.34 0.00 0.41 192 REMOVE_BEFORE_LINK 2519 0.39 0.29 0.41 193 XM_H_PHPMailer 2503 0.53 1.10 0.41 194 T_TooManySym_03 2459 0.36 0.19 0.40 195 XMNoVowels 2416 0.44 0.64 0.39 196 HTML_IMAGE_ONLY_20 2407 0.37 0.26 0.39 197 XMSexyCombo_04 2387 0.50 1.00 0.39 198 THIS_AD 2325 0.52 1.18 0.38 199 HTML_IMAGE_ONLY_32 2283 0.36 0.29 0.37 200 MISSING_HEADERS 2274 0.70 2.19 0.37 ----------------------------------------------------------------------