Email: 733387 Autolearn: 0 AvgScore: 1.45 AvgScanTime: 2.19 sec Spam: 166717 Autolearn: 0 AvgScore: 16.66 AvgScanTime: 2.87 sec Ham: 566670 Autolearn: 0 AvgScore: -3.03 AvgScanTime: 2.00 sec Time Spent Running SA: 447.08 hours Time Spent Processing Spam: 132.81 hours Time Spent Processing Ham: 314.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150749 90.42 90.42 90.42 2 DCC_CHECK 117221 43.74 70.31 35.92 3 XM_B_Unicode 106515 71.48 63.89 73.71 4 MIME_HTML_ONLY 86430 29.10 51.84 22.40 5 DKIM_SIGNED 80238 61.93 48.13 65.99 6 XM_DK_Pass 77446 60.77 46.45 64.99 7 BAYES_50 74882 47.28 44.92 47.98 8 DKIM_VALID 72709 57.68 43.61 61.82 9 XM_B_Unicode3 68618 43.55 41.16 44.25 10 XMListUnsubscribeExists 65095 43.87 39.05 45.29 11 HTML_FONT_LOW_CONTRAST 54107 25.92 32.45 24.00 12 DKIM_VALID_AU 53706 43.74 32.21 47.13 13 FSL_BULK_SIG 52247 11.85 31.34 6.11 14 RELAYCOUNTRY_META 49878 10.83 29.92 5.22 15 XM_UncommonTLD01 48845 11.73 29.30 6.57 16 DCC_CHECK_NEGATIVE 46905 54.50 28.13 62.26 17 BOTNET 46617 7.66 27.96 1.69 18 XMSubLong 38229 21.45 22.93 21.01 19 XM_DK_Undo_02 36430 9.10 21.85 5.35 20 UNTRUSTED_Relay 35885 6.14 21.52 1.61 21 SpammyFromTLD_02 35584 5.08 21.34 0.29 22 BOTNET_IPINHOSTNAME 34232 7.74 20.53 3.97 23 XM_Multi_Part_URI 33445 12.45 20.06 10.22 24 LOC_TINY_FONT_1 31887 20.54 19.13 20.95 25 XM_B_Unsub 31558 10.83 18.93 8.44 26 XM_Body_Dirty_Words 30621 13.39 18.37 11.93 27 BAYES_99 30521 6.30 18.31 2.77 28 FVGT_m_MULTI_ODD 29816 18.50 17.88 18.67 29 MultiRelay 27704 16.57 16.62 16.55 30 KHOP_HELO_FCRDNS 27169 5.17 16.30 1.90 31 T_TM2_M_HEADER_IN_MSG 27046 25.43 16.22 28.14 32 DKIM_VALID_EF 26634 22.11 15.98 23.92 33 XMSexyCombo_05 25785 6.48 15.47 3.84 34 T_REMOTE_IMAGE 24976 8.43 14.98 6.50 35 HTML_SHORT_LINK_IMG_1 24264 3.33 14.55 0.03 36 RCVD_IN_BL_SPAMCOP_NET 22983 3.87 13.79 0.95 37 BAYES_999 22657 4.81 13.59 2.23 38 FROM_EXCESS_BASE64 22030 5.00 13.21 2.59 39 XM_B_Phish_Phrases 22028 7.12 13.21 5.32 40 TR_DCC_Bayes_99 21597 3.83 12.95 1.15 41 FROM_SUSPICIOUS_NTLD 21521 2.96 12.91 0.03 42 FROM_SUSPICIOUS_NTLD_FP 21376 2.93 12.82 0.03 43 RCVD_IN_RP_RNBL 21185 2.97 12.71 0.11 44 MIME_HEADER_CTYPE_ONLY 20904 2.90 12.54 0.06 45 T_KAM_HTML_FONT_INVALID 19936 14.48 11.96 15.22 46 DKIM_ADSP_NXDOMAIN 19794 5.72 11.87 3.92 47 RDNS_DYNAMIC 19753 2.94 11.85 0.32 48 LOTS_OF_MONEY 18548 9.50 11.13 9.02 49 TM2_M_URI_OPT_OUT 18270 3.97 10.96 1.91 50 XMHTML_After_End 18186 3.33 10.91 1.10 51 XMNumbers 17270 4.95 10.36 3.36 52 XM_SPF_SoftFail 16742 3.66 10.04 1.78 53 HTML_MIME_NO_HTML_TAG 16681 3.87 10.01 2.06 54 ALL_TRUSTED 15993 12.84 9.59 13.80 55 XM_H_PHPMailer 15897 2.53 9.54 0.46 56 XMSubMetaSx_00 15344 4.70 9.20 3.38 57 XM_UB50 15113 2.81 9.07 0.97 58 XMEqualsVooDoo_00 14506 2.03 8.70 0.07 59 XMEqualsVooDoo_01 14475 1.97 8.68 0.00 60 XMEqualsVooDoo_02 14470 1.97 8.68 0.00 61 HTML_IMAGE_ONLY_12 14419 2.10 8.65 0.18 62 FROM_NO_USER 14259 1.95 8.55 0.01 63 BAYES_40 14183 6.95 8.51 6.49 64 XM_DIRTYINTL 14156 3.78 8.49 2.39 65 XM_Evil_Numbers_Gen 14149 9.17 8.49 9.37 66 HTML_IMAGE_RATIO_02 13926 7.14 8.35 6.78 67 RCVD_IN_PSBL 13923 1.94 8.35 0.06 68 BODY_URI_ONLY 13220 1.84 7.93 0.05 69 REPLYTO_WITHOUT_TO_CC 12919 1.79 7.75 0.04 70 HDRS_LCASE_IMGONLY 12746 1.76 7.65 0.03 71 BAYES_80 12321 3.34 7.39 2.15 72 HTML_IMAGE_ONLY_08 12231 1.74 7.34 0.10 73 BOTNET_NORDNS 11997 1.67 7.20 0.04 74 BAYES_60 11589 4.82 6.95 4.20 75 T_XMDrugObfuBody_14 11430 7.24 6.86 7.35 76 RCVD_IN_MSPIKE_BL 11257 2.22 6.75 0.88 77 TO_EQ_FM_DOM_HTML_IMG 11061 1.52 6.63 0.01 78 MISSING_HEADERS 10636 1.77 6.38 0.41 79 HDRS_MISSP 10284 1.41 6.17 0.02 80 SHORT_IMG_SUSP_NTLD 10206 1.39 6.12 0.00 81 HTML_FONT_SIZE_LARGE 10032 1.47 6.02 0.13 82 XM_H_Long_From01 9835 5.25 5.90 5.06 83 LotsOfNums_01 9819 6.88 5.89 7.17 84 T_HTML_TAG_BALANCE_CENTER 9813 1.41 5.89 0.10 85 XM_BadFromFormat 9379 1.36 5.63 0.10 86 FROM_MISSP_REPLYTO 9283 1.27 5.57 0.00 87 NO_DNS_FOR_FROM 9226 4.82 5.53 4.61 88 TooManyTo_001 9093 6.67 5.45 7.03 89 RCVD_IN_MSPIKE_L5 8925 1.39 5.35 0.22 90 XM_B_SpammyTLD 8884 2.50 5.33 1.67 91 FROM_MISSP_DYNIP 8621 1.18 5.17 0.00 92 TO_MALFORMED 8558 2.07 5.13 1.17 93 URIBL_RHS_DOB 8237 1.14 4.94 0.02 94 MPART_ALT_DIFF 7747 7.74 4.65 8.65 95 DKIM_INVALID 7529 4.25 4.52 4.17 96 T_XMDrugObfuBody_08 7265 1.93 4.36 1.21 97 SpammyFromTLD_01 7213 1.53 4.33 0.71 98 HTML_IMAGE_RATIO_04 6702 12.81 4.02 15.39 99 BAYES_20 6506 5.97 3.90 6.58 100 FROM_OFFERS 6489 0.91 3.89 0.03 101 BAYES_00 6441 19.16 3.86 23.67 102 XMStrtUSub 6380 8.33 3.83 9.66 103 HK_RANDOM_FROM 6229 0.94 3.74 0.12 104 RCVD_IN_MSPIKE_H2 6166 6.97 3.70 7.93 105 BAYES_95 6136 1.86 3.68 1.32 106 RELAYCOUNTRY_GB 5933 1.67 3.56 1.11 107 XM_UB99 5885 0.81 3.53 0.01 108 XMSubMetaD_00 5862 0.86 3.52 0.08 109 XMGppyBdWords 5791 0.94 3.47 0.19 110 RELAYCOUNTRY_CA 5615 1.96 3.37 1.55 111 MIME_QP_LONG_LINE 5476 4.94 3.28 5.43 112 MultiRelay_Combo 5432 0.93 3.26 0.24 113 MultiRelay_CC 5432 0.93 3.26 0.24 114 XMPhish11 5399 1.58 3.24 1.10 115 NO_FM_NAME_IP_HOSTN 5346 0.73 3.21 0.01 116 XM_SendGrid 5244 4.64 3.15 5.08 117 DRUGS_ERECTILE 5184 0.72 3.11 0.02 118 PDS_FROM_2_EMAILS 5143 0.75 3.08 0.06 119 FROM_2_EMAILS_SHORT 5083 0.70 3.05 0.01 120 T_XMDrugObfuBody_00 5057 1.61 3.03 1.19 121 MIME_HTML_MOSTLY 5042 2.17 3.02 1.92 122 RCVD_IN_MSPIKE_H3 4966 7.22 2.98 8.47 123 RCVD_IN_MSPIKE_WL 4966 7.23 2.98 8.48 124 XM_CamelCaseFrm001 4909 2.08 2.94 1.82 125 PDS_TO_EQ_FROM_NAME 4785 0.66 2.87 0.01 126 FVGT_m_MULTI_ODD_EMAIL 4692 0.65 2.81 0.02 127 DIET_1 4588 1.12 2.75 0.64 128 URI_BUFFLY 4565 0.62 2.74 0.00 129 NORDNS_LOW_CONTRAST 4515 0.62 2.71 0.01 130 XM_UB999 4506 0.62 2.70 0.00 131 DATE_IN_PAST_03_06 4341 0.69 2.60 0.12 132 RELAYCOUNTRY_CN 4312 0.64 2.59 0.06 133 SUBJ_BUY 4268 0.63 2.56 0.06 134 XMObfuSubjects 4161 0.58 2.50 0.02 135 RELAYCOUNTRY_FR 4107 0.85 2.46 0.38 136 HTML_IMAGE_RATIO_06 4091 4.10 2.45 4.58 137 XM_URI_RBL 4076 0.76 2.44 0.26 138 MIME_HTML_ONLY_MULTI 4065 6.06 2.44 7.13 139 XMMoneyMeta_00 4053 0.93 2.43 0.49 140 T_TooManySym_01 3947 3.82 2.37 4.25 141 TR_MetaPhish_Combo_01 3836 1.35 2.30 1.07 142 RELAYCOUNTRY_IN 3669 0.58 2.20 0.10 143 XMSlimDrugH 3667 0.79 2.20 0.37 144 XMSubMetaSSx_00 3652 0.63 2.19 0.17 145 HTML_SHORT_LINK_IMG_2 3629 0.52 2.18 0.03 146 TR_Symld_Words 3618 1.64 2.17 1.48 147 BAYES_05 3556 3.94 2.13 4.47 148 XMDiploma_00 3530 1.57 2.12 1.40 149 XM_UB60 3430 0.52 2.06 0.07 150 XMSubMetaD_01 3415 0.47 2.05 0.01 151 HK_RANDOM_REPLYTO 3389 0.62 2.03 0.20 152 XM_B_Unsub2 3296 1.84 1.98 1.79 153 T_Symld_Words_02 3262 0.87 1.96 0.55 154 XMSexyCombo_01 3256 0.92 1.95 0.62 155 XMSpoofStaff2 3125 0.45 1.87 0.03 156 TR_XM_RelayPhish 3109 1.05 1.86 0.81 157 BODY_SINGLE_WORD 3079 0.43 1.85 0.01 158 TR_XM_PHPDW 3072 0.83 1.84 0.53 159 UNPARSEABLE_RELAY 3056 2.04 1.83 2.10 160 MIMEOLE_DIRECT_TO_MX 3045 0.42 1.83 0.00 161 BODY_SINGLE_URI 3017 0.42 1.81 0.01 162 HTML_IMAGE_RATIO_08 3004 2.17 1.80 2.28 163 DRUGS_ERECTILE_OBFU 2994 0.41 1.80 0.01 164 XMSubMetaSxObfu_03 2956 0.87 1.77 0.60 165 TR_XM_PHPForged 2954 0.80 1.77 0.52 166 XM_UB80 2949 0.41 1.77 0.02 167 TR_XM_FormFill2 2935 0.80 1.76 0.51 168 XM_H_PHPOS 2925 0.79 1.75 0.51 169 DKIM_ADSP_CUSTOM_MED 2876 1.11 1.73 0.93 170 XM_OfRef6 2829 1.19 1.70 1.04 171 URI_HEX 2783 1.37 1.67 1.29 172 T_FILL_THIS_FORM_SHORT 2645 1.07 1.59 0.92 173 XM_SPF_Unknown 2600 0.86 1.56 0.66 174 RELAYCOUNTRY_TR 2588 0.37 1.55 0.02 175 HDR_ORDER_FTSDMCXX_DIRECT 2585 0.35 1.55 0.00 176 TR_XM_DK_SendGrid 2576 2.51 1.55 2.80 177 NML_ADSP_CUSTOM_MED 2555 0.85 1.53 0.65 178 T_XMDrugObfuBody_09 2525 0.36 1.51 0.01 179 HTML_IMAGE_ONLY_16 2463 0.51 1.48 0.22 180 DOS_RCVD_IP_TWICE_B 2378 0.40 1.43 0.10 181 FORGED_GMAIL_RCVD 2378 0.70 1.43 0.49 182 LongTLD 2368 0.46 1.42 0.17 183 XMWghtMeta_00 2346 0.34 1.41 0.02 184 SERGIO_SUBJECT_PORN014 2340 0.32 1.40 0.00 185 RCVD_IN_IADB_LISTED 2337 3.64 1.40 4.30 186 FUZZY_PHARMACY 2319 0.32 1.39 0.00 187 XM_B_Crypto 2310 0.36 1.39 0.06 188 XM_H_SpoofStaff4 2235 0.42 1.34 0.15 189 URI_ONLY_MSGID_MALF 2207 0.30 1.32 0.00 190 XMSlimDrugs 2206 0.32 1.32 0.02 191 PDS_BTC_ID 2191 0.33 1.31 0.04 192 RELAYCOUNTRY_VN 2180 0.30 1.31 0.01 193 RCVD_IN_SORBS_DUL 2177 0.57 1.31 0.36 194 RCVD_IN_IADB_SPF 2142 3.17 1.28 3.73 195 XMBody_17 2117 0.80 1.27 0.66 196 XMPhish04 2112 0.29 1.27 0.00 197 RCVD_IN_RP_SAFE 2111 7.27 1.27 9.04 198 RCVD_IN_IADB_SENDERID 2099 2.77 1.26 3.21 199 RCVD_IN_IADB_DK 2097 2.76 1.26 3.21 200 TVD_SPACE_RATIO_MINFP 2090 0.30 1.25 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 512408 90.42 90.42 90.42 2 XM_B_Unicode 417681 71.48 63.89 73.71 3 DKIM_SIGNED 373958 61.93 48.13 65.99 4 XM_DK_Pass 368258 60.77 46.45 64.99 5 DCC_CHECK_NEGATIVE 352809 54.50 28.13 62.26 6 DKIM_VALID 350324 57.68 43.61 61.82 7 BAYES_50 271881 47.28 44.92 47.98 8 DKIM_VALID_AU 267052 43.74 32.21 47.13 9 XMListUnsubscribeExists 256628 43.87 39.05 45.29 10 XM_B_Unicode3 250776 43.55 41.16 44.25 11 DCC_CHECK 203570 43.74 70.31 35.92 12 T_TM2_M_HEADER_IN_MSG 159433 25.43 16.22 28.14 13 HTML_FONT_LOW_CONTRAST 135996 25.92 32.45 24.00 14 DKIM_VALID_EF 135553 22.11 15.98 23.92 15 BAYES_00 134104 19.16 3.86 23.67 16 MIME_HTML_ONLY 126958 29.10 51.84 22.40 17 XMSubLong 119050 21.45 22.93 21.01 18 LOC_TINY_FONT_1 118735 20.54 19.13 20.95 19 FVGT_m_MULTI_ODD 105825 18.50 17.88 18.67 20 MultiRelay 93808 16.57 16.62 16.55 21 HTML_IMAGE_RATIO_04 87228 12.81 4.02 15.39 22 T_KAM_HTML_FONT_INVALID 86228 14.48 11.96 15.22 23 ALL_TRUSTED 78194 12.84 9.59 13.80 24 XM_H_Trusted_IP 76597 10.44 0.00 13.52 25 TR_XM_DK_Bayes 73347 10.27 1.19 12.94 26 HTML_FONT_FACE_BAD 70639 9.75 0.51 12.47 27 TR_XM_DK_Bayes1 69899 9.77 1.06 12.34 28 XM_Body_Dirty_Words 67582 13.39 18.37 11.93 29 TR_XM_DK_Bayes2 61716 8.56 0.62 10.89 30 XM_Multi_Part_URI 57897 12.45 20.06 10.22 31 XMStrtUSub 54726 8.33 3.83 9.66 32 XM_Evil_Numbers_Gen 53080 9.17 8.49 9.37 33 RCVD_IN_RP_SAFE 51221 7.27 1.27 9.04 34 LOTS_OF_MONEY 51089 9.50 11.13 9.02 35 MPART_ALT_DIFF 49020 7.74 4.65 8.65 36 RCVD_IN_MSPIKE_WL 48060 7.23 2.98 8.48 37 RCVD_IN_MSPIKE_H3 48021 7.22 2.98 8.47 38 XM_B_Unsub 47843 10.83 18.93 8.44 39 RCVD_IN_RP_CERTIFIED 46118 6.51 0.97 8.14 40 RCVD_IN_MSPIKE_H2 44915 6.97 3.70 7.93 41 T_XMDrugObfuBody_14 41641 7.24 6.86 7.35 42 LotsOfNums_01 40634 6.88 5.89 7.17 43 MIME_HTML_ONLY_MULTI 40409 6.06 2.44 7.13 44 TooManyTo_001 39855 6.67 5.45 7.03 45 HTML_IMAGE_RATIO_02 38421 7.14 8.35 6.78 46 BAYES_20 37296 5.97 3.90 6.58 47 XM_UncommonTLD01 37206 11.73 29.30 6.57 48 XM_DKIMWhitelistDomains 37017 5.05 0.01 6.53 49 T_REMOTE_IMAGE 36840 8.43 14.98 6.50 50 BAYES_40 36793 6.95 8.51 6.49 51 FSL_BULK_SIG 34650 11.85 31.34 6.11 52 XMSubNoVowel 31952 4.53 0.75 5.64 53 MIME_QP_LONG_LINE 30742 4.94 3.28 5.43 54 XM_DK_Undo_02 30325 9.10 21.85 5.35 55 XM_B_Phish_Phrases 30159 7.12 13.21 5.32 56 RELAYCOUNTRY_META 29572 10.83 29.92 5.22 57 XM_SendGrid 28764 4.64 3.15 5.08 58 XM_H_Long_From01 28651 5.25 5.90 5.06 59 NO_DNS_FOR_FROM 26126 4.82 5.53 4.61 60 HTML_IMAGE_RATIO_06 25951 4.10 2.45 4.58 61 BAYES_05 25309 3.94 2.13 4.47 62 RCVD_IN_IADB_LISTED 24379 3.64 1.40 4.30 63 T_TooManySym_01 24060 3.82 2.37 4.25 64 BAYES_60 23785 4.82 6.95 4.20 65 DKIM_INVALID 23634 4.25 4.52 4.17 66 XM_PDF 22862 3.24 0.56 4.03 67 BOTNET_IPINHOSTNAME 22497 7.74 20.53 3.97 68 DKIM_ADSP_NXDOMAIN 22190 5.72 11.87 3.92 69 XMSexyCombo_05 21769 6.48 15.47 3.84 70 RCVD_IN_IADB_SPF 21120 3.17 1.28 3.73 71 AC_FROM_MANY_DOTS 20782 2.84 0.03 3.67 72 XMSubMetaSx_00 19157 4.70 9.20 3.38 73 XMNumbers 19034 4.95 10.36 3.36 74 RCVD_IN_IADB_SENDERID 18201 2.77 1.26 3.21 75 RCVD_IN_IADB_DK 18180 2.76 1.26 3.21 76 IN_ZIMBRA_NJ_WHITELIST 17808 2.46 0.12 3.14 77 TR_XM_DK_SendGrid 15840 2.51 1.55 2.80 78 BAYES_99 15700 6.30 18.31 2.77 79 RCVD_IN_IADB_VOUCHED 15544 2.21 0.38 2.74 80 FROM_EXCESS_BASE64 14658 5.00 13.21 2.59 81 T_XMHurry_00 14381 2.19 1.01 2.54 82 XM_DIRTYINTL 13561 3.78 8.49 2.39 83 XMSubGarbage 13152 1.81 0.08 2.32 84 XMSubLongNoVowel 13101 1.84 0.23 2.31 85 HTML_IMAGE_RATIO_08 12904 2.17 1.80 2.28 86 MAILING_LIST_MULTI 12700 1.97 1.03 2.24 87 BAYES_999 12637 4.81 13.59 2.23 88 BAYES_80 12185 3.34 7.39 2.15 89 UNPARSEABLE_RELAY 11876 2.04 1.83 2.10 90 HTML_MIME_NO_HTML_TAG 11682 3.87 10.01 2.06 91 T_TooManySym_02 11592 1.69 0.47 2.05 92 MIME_HTML_MOSTLY 10901 2.17 3.02 1.92 93 TM2_M_URI_OPT_OUT 10820 3.97 10.96 1.91 94 KHOP_HELO_FCRDNS 10767 5.17 16.30 1.90 95 TooManyTo_002 10619 1.61 0.72 1.87 96 XM_CamelCaseFrm001 10337 2.08 2.94 1.82 97 TVD_RCVD_IP 10319 1.61 0.91 1.82 98 XM_B_Unsub2 10168 1.84 1.98 1.79 99 XM_SPF_SoftFail 10096 3.66 10.04 1.78 100 BOTNET 9588 7.66 27.96 1.69 101 RCVD_IN_IADB_OPTIN 9491 1.35 0.24 1.67 102 XM_B_SpammyTLD 9474 2.50 5.33 1.67 103 ANY_BOUNCE_MESSAGE 9282 1.48 0.93 1.64 104 BOUNCE_MESSAGE 9281 1.48 0.93 1.64 105 UNTRUSTED_Relay 9110 6.14 21.52 1.61 106 RELAYCOUNTRY_CA 8792 1.96 3.37 1.55 107 SUBJ_ALL_CAPS 8757 1.46 1.15 1.55 108 XM_DK_Undo_01 8677 1.36 0.78 1.53 109 HELO_NODOT 8453 1.33 0.76 1.49 110 HELO_NO_DOMAIN 8429 1.31 0.71 1.49 111 TR_Symld_Words 8408 1.64 2.17 1.48 112 XMDiploma_00 7950 1.57 2.12 1.40 113 INVALID_MSGID 7641 1.15 0.46 1.35 114 CK_HELO_DYNAMIC_SPLIT_IP 7528 1.31 1.24 1.33 115 HELO_DYNAMIC_IPADDR2 7523 1.20 0.77 1.33 116 BAYES_95 7482 1.86 3.68 1.32 117 IN_HORDE_ADDRESS_BOOK 7402 1.14 0.59 1.31 118 URI_HEX 7298 1.37 1.67 1.29 119 TooManyTo_003 6947 1.08 0.57 1.23 120 URI_TRY_3LD 6906 1.18 1.03 1.22 121 T_XMDrugObfuBody_08 6857 1.93 4.36 1.21 122 T_XMDrugObfuBody_00 6738 1.61 3.03 1.19 123 XMCapTrack 6730 0.96 0.20 1.19 124 TO_MALFORMED 6630 2.07 5.13 1.17 125 TR_DCC_Bayes_99 6514 3.83 12.95 1.15 126 RELAYCOUNTRY_GB 6295 1.67 3.56 1.11 127 TM2_M_VERY_LONG_WORD 6272 1.14 1.23 1.11 128 XMHTML_After_End 6241 3.33 10.91 1.10 129 XMPhish11 6210 1.58 3.24 1.10 130 TR_MetaPhish_Combo_01 6082 1.35 2.30 1.07 131 XM_GoogleGroups 5993 0.88 0.26 1.06 132 XMStockSpam_06 5967 1.06 1.08 1.05 133 USER_IN_DEF_DKIM_WL 5894 0.81 0.01 1.04 134 XM_OfRef6 5893 1.19 1.70 1.04 135 XMGenDplmaNmb 5679 1.00 1.00 1.00 136 XM_H_Long_From02 5550 0.92 0.72 0.98 137 XM_UB50 5469 2.81 9.07 0.97 138 XM_E_Blogspot 5363 0.75 0.08 0.95 139 RCVD_IN_BL_SPAMCOP_NET 5363 3.87 13.79 0.95 140 DKIM_ADSP_CUSTOM_MED 5297 1.11 1.73 0.93 141 XMGappySubj_01 5197 0.79 0.36 0.92 142 T_FILL_THIS_FORM_SHORT 5189 1.07 1.59 0.92 143 TooManyTo_004 5095 0.80 0.46 0.90 144 RCVD_IN_MSPIKE_BL 5003 2.22 6.75 0.88 145 XMBdyGiftCard01 4775 0.82 0.75 0.84 146 TR_XM_RelayPhish 4569 1.05 1.86 0.81 147 TooManyTo_005 4328 0.68 0.38 0.76 148 SpammyFromTLD_01 3998 1.53 4.33 0.71 149 XMPhish30 3907 0.68 0.66 0.69 150 XMBody_95 3845 0.53 0.04 0.68 151 XMBody_17 3768 0.80 1.27 0.66 152 XM_SPF_Unknown 3720 0.86 1.56 0.66 153 NML_ADSP_CUSTOM_MED 3708 0.85 1.53 0.65 154 XM_ProductURIs 3707 0.64 0.61 0.65 155 XMBrknScrpt_02 3690 0.68 0.76 0.65 156 DIET_1 3618 1.12 2.75 0.64 157 XMSexyCombo_01 3524 0.92 1.95 0.62 158 HTTPS_HTTP_MISMATCH 3419 0.58 0.48 0.60 159 XMSubMetaSxObfu_03 3390 0.87 1.77 0.60 160 T_Symld_Words_02 3123 0.87 1.96 0.55 161 TR_XM_PHPDW 3029 0.83 1.84 0.53 162 T_OBFU_PDF_ATTACH 2983 0.44 0.14 0.53 163 XMNoVowels 2971 0.54 0.58 0.52 164 XM_B_REG_HTML 2966 0.45 0.20 0.52 165 TR_XM_PHPForged 2922 0.80 1.77 0.52 166 HTML_IMAGE_ONLY_20 2921 0.56 0.72 0.52 167 TR_XM_FormFill2 2917 0.80 1.76 0.51 168 FROM_GOV_DKIM_AU 2900 0.45 0.22 0.51 169 XM_H_PHPOS 2887 0.79 1.75 0.51 170 XMMoneyMeta_00 2789 0.93 2.43 0.49 171 FORGED_GMAIL_RCVD 2785 0.70 1.43 0.49 172 AC_DIV_BONANZA 2774 0.40 0.11 0.49 173 XMSubMetaI_00 2705 0.54 0.77 0.48 174 XM_ShortIntro_01 2674 0.46 0.43 0.47 175 XM_H_PHPMailer 2626 2.53 9.54 0.46 176 PLING_QUERY 2614 0.45 0.42 0.46 177 HTML_TAG_BALANCE_BODY 2599 0.57 0.96 0.46 178 XMLngstWrd_00 2567 0.47 0.53 0.45 179 XMHTMLBadTable_001 2492 0.49 0.67 0.44 180 RELAYCOUNTRY_AU 2429 0.44 0.47 0.43 181 TVD_PH_BODY_ACCOUNTS_PRE 2418 0.36 0.15 0.43 182 RCVD_IN_MSPIKE_L3 2414 0.52 0.84 0.43 183 XMLngstWrd_01 2344 0.44 0.51 0.41 184 MISSING_HEADERS 2330 1.77 6.38 0.41 185 SHORT_HELO_AND_INLINE_IMAGE 2293 0.32 0.03 0.40 186 T_TooManySym_03 2291 0.35 0.17 0.40 187 TM2_M_BODY_EMPTY 2234 0.33 0.09 0.39 188 RELAYCOUNTRY_DE 2209 0.52 0.96 0.39 189 XMBody_78 2205 0.49 0.84 0.39 190 TR_LOTS_OF_MONEY3 2197 0.42 0.54 0.39 191 T_MONEY_PERCENT 2161 0.50 0.90 0.38 192 TR_LOTS_OF_MONEY2 2161 0.50 0.90 0.38 193 RELAYCOUNTRY_FR 2147 0.85 2.46 0.38 194 XMSlimDrugH 2116 0.79 2.20 0.37 195 HTML_IMAGE_ONLY_32 2099 0.33 0.19 0.37 196 XMDateMe_00 2075 0.36 0.33 0.37 197 XM_B_COPY_HTML 2034 0.45 0.76 0.36 198 RCVD_IN_SORBS_DUL 2034 0.57 1.31 0.36 199 T_MANY_PILL_PRICE 2012 0.28 0.02 0.36 200 FILL_THIS_FORM 1988 0.45 0.79 0.35 ----------------------------------------------------------------------