Email: 637389 Autolearn: 0 AvgScore: 2.53 AvgScanTime: 2.05 sec Spam: 157775 Autolearn: 0 AvgScore: 15.89 AvgScanTime: 2.49 sec Ham: 479614 Autolearn: 0 AvgScore: -1.87 AvgScanTime: 1.91 sec Time Spent Running SA: 363.36 hours Time Spent Processing Spam: 109.05 hours Time Spent Processing Ham: 254.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146583 89.86 92.91 88.86 2 DCC_CHECK 121683 48.80 77.12 39.49 3 XM_B_Unicode 99347 68.66 62.97 70.53 4 DKIM_SIGNED 81440 69.06 51.62 74.80 5 MIME_HTML_ONLY 77865 29.57 49.35 23.07 6 XM_DK_Pass 77213 67.50 48.94 73.60 7 BAYES_50 75565 52.37 47.89 53.84 8 DKIM_VALID 71630 63.83 45.40 69.90 9 XMListUnsubscribeExists 66076 48.68 41.88 50.92 10 XM_B_Unicode3 58736 39.91 37.23 40.79 11 FSL_BULK_SIG 53099 13.00 33.65 6.21 12 DKIM_VALID_AU 52100 48.17 33.02 53.16 13 XM_UncommonTLD01 49028 11.24 31.07 4.72 14 HTML_FONT_LOW_CONTRAST 45106 27.56 28.59 27.22 15 RELAYCOUNTRY_META 41066 10.80 26.03 5.79 16 XM_Body_Dirty_Words 39226 16.97 24.86 14.37 17 XM_DK_Undo_02 36920 11.06 23.40 7.01 18 BOTNET 34874 6.99 22.10 2.02 19 LOC_TINY_FONT_1 34738 23.21 22.02 23.60 20 DCC_CHECK_NEGATIVE 33409 49.29 21.18 58.54 21 KHOP_HELO_FCRDNS 32801 6.90 20.79 2.33 22 XMSubLong 32050 21.42 20.31 21.78 23 SpammyFromTLD_02 31458 5.26 19.94 0.43 24 BAYES_99 31075 7.85 19.70 3.95 25 XM_B_Unsub 29912 13.86 18.96 12.18 26 HTML_MIME_NO_HTML_TAG 28788 7.61 18.25 4.12 27 HTML_SHORT_LINK_IMG_1 28091 4.44 17.80 0.04 28 UNTRUSTED_Relay 27974 5.66 17.73 1.69 29 FROM_SUSPICIOUS_NTLD 27268 4.30 17.28 0.03 30 FROM_SUSPICIOUS_NTLD_FP 27227 4.29 17.26 0.02 31 XM_H_Long_From01 27107 8.83 17.18 6.08 32 FVGT_m_MULTI_ODD 27006 19.45 17.12 20.22 33 MultiRelay 26899 18.15 17.05 18.52 34 XMSexyCombo_05 26713 7.65 16.93 4.60 35 RDNS_DYNAMIC 26081 4.37 16.53 0.37 36 T_REMOTE_IMAGE 25976 7.52 16.46 4.58 37 BOTNET_IPINHOSTNAME 25776 7.47 16.34 4.55 38 DKIM_VALID_EF 25341 24.20 16.06 26.88 39 T_KAM_HTML_FONT_INVALID 24439 16.60 15.49 16.97 40 T_TM2_M_HEADER_IN_MSG 23564 25.86 14.94 29.46 41 TR_DCC_Bayes_99 23440 5.21 14.86 2.03 42 BAYES_999 23348 6.14 14.80 3.29 43 DKIM_ADSP_NXDOMAIN 23013 4.83 14.59 1.62 44 XM_Multi_Part_URI 22914 12.40 14.52 11.71 45 XM_SPF_SoftFail 20468 4.80 12.97 2.11 46 SHORT_IMG_SUSP_NTLD 20385 3.20 12.92 0.00 47 HTML_IMAGE_ONLY_08 19779 3.19 12.54 0.12 48 BODY_URI_ONLY 19154 3.11 12.14 0.14 49 RCVD_IN_BL_SPAMCOP_NET 18771 3.90 11.90 1.27 50 T_HTML_TAG_BALANCE_CENTER 18312 2.95 11.61 0.10 51 HTML_IMAGE_RATIO_02 17742 8.71 11.25 7.87 52 LOTS_OF_MONEY 17183 9.88 10.89 9.55 53 XM_DIRTYINTL 16642 4.70 10.55 2.78 54 RCVD_IN_RP_RNBL 16507 2.66 10.46 0.09 55 FROM_MISSP_REPLYTO 16216 2.55 10.28 0.00 56 XM_BadFromFormat 16212 2.63 10.28 0.11 57 TooManyTo_001 16008 8.55 10.15 8.03 58 HTML_FONT_SIZE_LARGE 15899 2.58 10.08 0.11 59 FROM_MISSP_DYNIP 15697 2.46 9.95 0.00 60 TO_MALFORMED 15422 3.46 9.77 1.38 61 FROM_OFFERS 14621 2.31 9.27 0.02 62 FROM_EXCESS_BASE64 14198 4.63 9.00 3.19 63 HDRS_MISSP 14131 2.23 8.96 0.01 64 XMNumbers 14038 4.95 8.90 3.66 65 XM_UB50 13853 2.88 8.78 0.94 66 XM_B_Phish_Phrases 13489 6.21 8.55 5.45 67 RCVD_IN_PSBL 13156 2.10 8.34 0.05 68 ALL_TRUSTED 13019 12.88 8.25 14.40 69 XMSubMetaSx_00 12442 4.83 7.89 3.82 70 XM_Evil_Numbers_Gen 12156 8.60 7.70 8.90 71 HTML_IMAGE_ONLY_12 11445 1.94 7.25 0.19 72 MIME_HEADER_CTYPE_ONLY 11378 1.84 7.21 0.07 73 BAYES_60 11196 5.08 7.10 4.41 74 BOTNET_NORDNS 10666 1.80 6.76 0.16 75 XM_B_SpammyTLD 10567 3.13 6.70 1.96 76 BAYES_80 10419 3.39 6.60 2.33 77 T_XMDrugObfuBody_14 10214 8.11 6.47 8.65 78 DKIM_INVALID 9810 5.23 6.22 4.90 79 TM2_M_URI_OPT_OUT 9763 3.11 6.19 2.10 80 RCVD_IN_MSPIKE_BL 9147 2.18 5.80 0.99 81 MPART_ALT_DIFF 9106 5.27 5.77 5.10 82 BAYES_40 8555 5.72 5.42 5.82 83 XM_B_Unsub2 8462 3.44 5.36 2.80 84 LotsOfNums_01 8171 7.18 5.18 7.84 85 XMHTML_After_End 7434 1.85 4.71 0.91 86 HK_RANDOM_FROM 7079 1.21 4.49 0.13 87 XM_H_PHPMailer 6869 1.43 4.35 0.47 88 RCVD_IN_MSPIKE_L5 6810 1.27 4.32 0.27 89 HDRS_LCASE_IMGONLY 6696 1.08 4.24 0.03 90 RCVD_IN_MSPIKE_H2 6685 7.57 4.24 8.66 91 BAYES_20 6669 4.47 4.23 4.55 92 BAYES_95 6286 2.10 3.98 1.49 93 HTML_IMAGE_RATIO_04 6272 5.88 3.98 6.51 94 XMStrtUSub 6248 4.34 3.96 4.46 95 RELAYCOUNTRY_CA 6072 2.21 3.85 1.67 96 XMEqualsVooDoo_00 6038 0.96 3.83 0.01 97 SpammyFromTLD_01 6025 1.53 3.82 0.77 98 XMEqualsVooDoo_01 5997 0.94 3.80 0.00 99 XMEqualsVooDoo_02 5994 0.94 3.80 0.00 100 FROM_NO_USER 5886 0.93 3.73 0.01 101 TooManyTo_002 5867 2.58 3.72 2.20 102 MIME_HTML_MOSTLY 5763 2.79 3.65 2.50 103 REPLYTO_WITHOUT_TO_CC 5630 0.91 3.57 0.04 104 XM_SendGrid 5571 5.29 3.53 5.87 105 NO_DNS_FOR_FROM 5510 2.75 3.49 2.50 106 MIME_QP_LONG_LINE 5321 5.15 3.37 5.73 107 TR_Mismatch_TLD_02 5174 0.89 3.28 0.10 108 DIET_1 4995 1.18 3.17 0.53 109 XM_SPF_Unknown 4987 1.34 3.16 0.74 110 TO_EQ_FM_DOM_HTML_IMG 4983 0.79 3.16 0.01 111 TooManyTo_003 4908 1.85 3.11 1.44 112 MISSING_HEADERS 4884 1.12 3.10 0.48 113 RCVD_IN_MSPIKE_WL 4825 7.94 3.06 9.54 114 RCVD_IN_MSPIKE_H3 4824 7.93 3.06 9.53 115 XM_CamelCaseFrm001 4631 2.39 2.94 2.21 116 RELAYCOUNTRY_FR 4588 1.01 2.91 0.39 117 BAYES_00 4582 16.24 2.90 20.63 118 HTML_IMAGE_RATIO_06 4421 3.59 2.80 3.85 119 MIME_HTML_ONLY_MULTI 4390 3.19 2.78 3.32 120 XM_OfRef6 4377 1.63 2.77 1.26 121 XMSexyCombo_01 4366 1.09 2.77 0.54 122 MultiRelay_CC 4351 0.86 2.76 0.23 123 MultiRelay_Combo 4351 0.86 2.76 0.23 124 DATE_IN_PAST_03_06 4258 0.76 2.70 0.12 125 XMSlimDrugH 4217 0.93 2.67 0.36 126 XMMoneyMeta_00 4075 0.99 2.58 0.47 127 FVGT_m_MULTI_ODD_EMAIL 4055 0.66 2.57 0.03 128 TooManyTo_004 3837 1.40 2.43 1.06 129 TR_XM_INV_DKIM 3735 0.72 2.37 0.18 130 MISSING_MIMEOLE 3728 0.64 2.36 0.07 131 RELAYCOUNTRY_CN 3612 0.60 2.29 0.04 132 XM_URI_RBL 3589 0.79 2.27 0.30 133 XM_H_TOP 3500 0.56 2.22 0.01 134 RELAYCOUNTRY_DE 3422 0.86 2.17 0.43 135 RELAYCOUNTRY_GB 3413 1.55 2.16 1.35 136 TR_XM_RelayPhish 3186 1.08 2.02 0.77 137 XMSexyCombo_04 3184 0.56 2.02 0.08 138 SUBJ_ALL_CAPS 3181 1.83 2.02 1.78 139 UNPARSEABLE_RELAY 3134 2.23 1.99 2.31 140 XMWghtMeta_00 3123 0.51 1.98 0.02 141 BAYES_05 3036 2.52 1.92 2.72 142 LongTLD 3034 0.61 1.92 0.17 143 XM_UB60 2816 0.49 1.78 0.06 144 TVD_SPACE_RATIO_MINFP 2773 0.44 1.76 0.01 145 HTML_IMAGE_RATIO_08 2708 2.34 1.72 2.55 146 T_XMDrugObfuBody_08 2702 1.65 1.71 1.63 147 TooManyTo_005 2696 1.10 1.71 0.89 148 URI_HEX 2634 1.42 1.67 1.33 149 XM_H_Long_From02 2633 1.20 1.67 1.05 150 XMSubMetaI_00 2601 1.04 1.65 0.84 151 T_TooManySym_01 2595 4.00 1.64 4.77 152 RCVD_IN_RP_SAFE 2539 7.35 1.61 9.24 153 FROM_LOCAL_NOVOWEL 2533 0.41 1.61 0.02 154 NORDNS_LOW_CONTRAST 2483 0.40 1.57 0.01 155 DKIM_ADSP_CUSTOM_MED 2478 1.16 1.57 1.02 156 TR_XM_DK_SendGrid 2444 2.75 1.55 3.14 157 DATE_IN_PAST_06_12 2389 0.43 1.51 0.07 158 T_FILL_THIS_FORM_SHORT 2385 1.21 1.51 1.11 159 TR_M_TOP_BAYES 2374 0.37 1.50 0.00 160 SERGIO_SUBJECT_PORN014 2315 0.36 1.47 0.00 161 XMDiploma_00 2299 1.60 1.46 1.64 162 NML_ADSP_CUSTOM_MED 2298 0.92 1.46 0.75 163 XM_UB99 2286 0.36 1.45 0.01 164 XM_UB80 2279 0.38 1.44 0.02 165 CHARSET_FARAWAY_HEADER 2257 0.38 1.43 0.03 166 RCVD_IN_IADB_LISTED 2248 4.03 1.42 4.88 167 XMPhish11 2141 1.23 1.36 1.19 168 TR_XM_PHPDW 2139 0.71 1.36 0.50 169 XMBody_17 2048 0.86 1.30 0.72 170 RCVD_IN_IADB_SPF 2037 3.48 1.29 4.20 171 TR_XM_PHPForged 2030 0.68 1.29 0.48 172 TR_XM_FormFill2 2018 0.68 1.28 0.48 173 XM_H_PHPOS 2017 0.67 1.28 0.47 174 URI_NOVOWEL 2008 0.58 1.27 0.35 175 RCVD_IN_IADB_SENDERID 2007 3.05 1.27 3.63 176 RCVD_IN_IADB_DK 2002 2.99 1.27 3.56 177 TVD_RCVD_SPACE_BRACKET 1996 0.32 1.27 0.01 178 MIME_CHARSET_FARAWAY 1987 0.38 1.26 0.09 179 TR_MetaPhish_Combo_01 1985 1.02 1.26 0.95 180 TR_Symld_Words 1956 1.56 1.24 1.67 181 HTML_SHORT_LINK_IMG_2 1941 0.33 1.23 0.04 182 FORGED_GMAIL_RCVD 1937 0.67 1.23 0.49 183 HK_RANDOM_REPLYTO 1897 0.50 1.20 0.27 184 RELAYCOUNTRY_IN 1896 0.38 1.20 0.10 185 XMStockSpam_06 1891 1.18 1.20 1.17 186 BODY_SINGLE_WORD 1890 0.30 1.20 0.01 187 XMBody_78 1883 0.67 1.19 0.50 188 BODY_SINGLE_URI 1829 0.29 1.16 0.00 189 XM_OfRef7 1817 0.39 1.15 0.14 190 XMBdyGiftCard01 1748 1.29 1.11 1.35 191 RCVD_IN_RP_CERTIFIED 1737 6.51 1.10 8.28 192 TR_LOTS_OF_MONEY2 1711 0.57 1.08 0.41 193 T_MONEY_PERCENT 1711 0.57 1.08 0.41 194 RELAYCOUNTRY_PL 1706 0.29 1.08 0.03 195 RCVD_IN_MSPIKE_L3 1695 0.58 1.07 0.42 196 TR_XM_DK_Bayes 1694 11.35 1.07 14.73 197 RELAYCOUNTRY_RU 1660 0.27 1.05 0.02 198 SUSPICIOUS_RECIPS 1641 0.27 1.04 0.02 199 TVD_SPACE_RATIO 1638 0.49 1.04 0.31 200 XMGenDplmaNmb 1628 1.15 1.03 1.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 426204 89.86 92.91 88.86 2 DKIM_SIGNED 358749 69.06 51.62 74.80 3 XM_DK_Pass 353015 67.50 48.94 73.60 4 XM_B_Unicode 338266 68.66 62.97 70.53 5 DKIM_VALID 335238 63.83 45.40 69.90 6 DCC_CHECK_NEGATIVE 280788 49.29 21.18 58.54 7 BAYES_50 258219 52.37 47.89 53.84 8 DKIM_VALID_AU 254948 48.17 33.02 53.16 9 XMListUnsubscribeExists 244222 48.68 41.88 50.92 10 XM_B_Unicode3 195618 39.91 37.23 40.79 11 DCC_CHECK 189379 48.80 77.12 39.49 12 T_TM2_M_HEADER_IN_MSG 141275 25.86 14.94 29.46 13 HTML_FONT_LOW_CONTRAST 130572 27.56 28.59 27.22 14 DKIM_VALID_EF 128901 24.20 16.06 26.88 15 LOC_TINY_FONT_1 113196 23.21 22.02 23.60 16 MIME_HTML_ONLY 110629 29.57 49.35 23.07 17 XMSubLong 104477 21.42 20.31 21.78 18 BAYES_00 98931 16.24 2.90 20.63 19 FVGT_m_MULTI_ODD 96975 19.45 17.12 20.22 20 MultiRelay 88814 18.15 17.05 18.52 21 T_KAM_HTML_FONT_INVALID 81387 16.60 15.49 16.97 22 TR_XM_DK_Bayes 70652 11.35 1.07 14.73 23 ALL_TRUSTED 69058 12.88 8.25 14.40 24 XM_Body_Dirty_Words 68913 16.97 24.86 14.37 25 TR_XM_DK_Bayes1 67272 10.80 0.97 14.03 26 TR_XM_DK_Bayes2 60263 9.58 0.49 12.56 27 XM_B_Unsub 58431 13.86 18.96 12.18 28 XM_Multi_Part_URI 56142 12.40 14.52 11.71 29 LOTS_OF_MONEY 45805 9.88 10.89 9.55 30 RCVD_IN_MSPIKE_WL 45767 7.94 3.06 9.54 31 RCVD_IN_MSPIKE_H3 45727 7.93 3.06 9.53 32 RCVD_IN_RP_SAFE 44326 7.35 1.61 9.24 33 XM_Evil_Numbers_Gen 42677 8.60 7.70 8.90 34 RCVD_IN_MSPIKE_H2 41534 7.57 4.24 8.66 35 T_XMDrugObfuBody_14 41479 8.11 6.47 8.65 36 RCVD_IN_RP_CERTIFIED 39732 6.51 1.10 8.28 37 TooManyTo_001 38508 8.55 10.15 8.03 38 HTML_IMAGE_RATIO_02 37764 8.71 11.25 7.87 39 LotsOfNums_01 37578 7.18 5.18 7.84 40 XM_DKIMWhitelistDomains 35598 5.59 0.01 7.42 41 XM_DK_Undo_02 33604 11.06 23.40 7.01 42 HTML_IMAGE_RATIO_04 31207 5.88 3.98 6.51 43 FSL_BULK_SIG 29773 13.00 33.65 6.21 44 XM_H_Long_From01 29167 8.83 17.18 6.08 45 XM_SendGrid 28168 5.29 3.53 5.87 46 BAYES_40 27892 5.72 5.42 5.82 47 RELAYCOUNTRY_META 27768 10.80 26.03 5.79 48 MIME_QP_LONG_LINE 27491 5.15 3.37 5.73 49 XM_B_Phish_Phrases 26121 6.21 8.55 5.45 50 MPART_ALT_DIFF 24473 5.27 5.77 5.10 51 DKIM_INVALID 23511 5.23 6.22 4.90 52 RCVD_IN_IADB_LISTED 23408 4.03 1.42 4.88 53 XM_PDF 23044 3.77 0.64 4.80 54 T_TooManySym_01 22875 4.00 1.64 4.77 55 XM_UncommonTLD01 22645 11.24 31.07 4.72 56 XMSexyCombo_05 22076 7.65 16.93 4.60 57 T_REMOTE_IMAGE 21957 7.52 16.46 4.58 58 BAYES_20 21843 4.47 4.23 4.55 59 BOTNET_IPINHOSTNAME 21818 7.47 16.34 4.55 60 XMStrtUSub 21401 4.34 3.96 4.46 61 BAYES_60 21170 5.08 7.10 4.41 62 RCVD_IN_IADB_SPF 20166 3.48 1.29 4.20 63 HTML_MIME_NO_HTML_TAG 19739 7.61 18.25 4.12 64 BAYES_99 18929 7.85 19.70 3.95 65 HTML_IMAGE_RATIO_06 18469 3.59 2.80 3.85 66 XMSubMetaSx_00 18339 4.83 7.89 3.82 67 XMNumbers 17534 4.95 8.90 3.66 68 IN_ZIMBRA_NJ_WHITELIST 17528 2.75 0.01 3.65 69 RCVD_IN_IADB_SENDERID 17424 3.05 1.27 3.63 70 RCVD_IN_IADB_DK 17070 2.99 1.27 3.56 71 MIME_HTML_ONLY_MULTI 15945 3.19 2.78 3.32 72 BAYES_999 15802 6.14 14.80 3.29 73 RCVD_IN_IADB_VOUCHED 15354 2.51 0.41 3.20 74 XM_H_Trusted_IP 15353 2.41 0.00 3.20 75 FROM_EXCESS_BASE64 15300 4.63 9.00 3.19 76 TR_XM_DK_SendGrid 15059 2.75 1.55 3.14 77 XM_B_Unsub2 13438 3.44 5.36 2.80 78 XM_DIRTYINTL 13346 4.70 10.55 2.78 79 BAYES_05 13036 2.52 1.92 2.72 80 T_TooManySym_02 12434 2.05 0.41 2.59 81 MAILING_LIST_MULTI 12229 2.17 1.01 2.55 82 HTML_IMAGE_RATIO_08 12220 2.34 1.72 2.55 83 MIME_HTML_MOSTLY 12005 2.79 3.65 2.50 84 NO_DNS_FOR_FROM 11987 2.75 3.49 2.50 85 BAYES_80 11177 3.39 6.60 2.33 86 KHOP_HELO_FCRDNS 11167 6.90 20.79 2.33 87 UNPARSEABLE_RELAY 11090 2.23 1.99 2.31 88 XM_CamelCaseFrm001 10580 2.39 2.94 2.21 89 TooManyTo_002 10574 2.58 3.72 2.20 90 TVD_RCVD_IP 10550 1.81 0.64 2.20 91 XM_SPF_SoftFail 10136 4.80 12.97 2.11 92 TM2_M_URI_OPT_OUT 10082 3.11 6.19 2.10 93 RCVD_IN_IADB_OPTIN 9998 1.64 0.29 2.08 94 TR_DCC_Bayes_99 9752 5.21 14.86 2.03 95 BOTNET 9703 6.99 22.10 2.02 96 XM_B_SpammyTLD 9413 3.13 6.70 1.96 97 XM_DK_Undo_01 8662 1.55 0.78 1.81 98 SUBJ_ALL_CAPS 8514 1.83 2.02 1.78 99 UNTRUSTED_Relay 8112 5.66 17.73 1.69 100 RELAYCOUNTRY_CA 8023 2.21 3.85 1.67 101 TR_Symld_Words 7999 1.56 1.24 1.67 102 XMDiploma_00 7879 1.60 1.46 1.64 103 T_XMDrugObfuBody_08 7826 1.65 1.71 1.63 104 DKIM_ADSP_NXDOMAIN 7766 4.83 14.59 1.62 105 INVALID_MSGID 7519 1.31 0.51 1.57 106 HELO_NODOT 7311 1.25 0.42 1.52 107 HELO_NO_DOMAIN 7305 1.25 0.41 1.52 108 BAYES_95 7131 2.10 3.98 1.49 109 IN_HORDE_ADDRESS_BOOK 7097 1.12 0.02 1.48 110 XMSubNoVowel 6996 1.30 0.81 1.46 111 T_XMDrugObfuBody_00 6990 1.35 1.02 1.46 112 BOUNCE_MESSAGE 6901 1.17 0.36 1.44 113 ANY_BOUNCE_MESSAGE 6901 1.17 0.36 1.44 114 TooManyTo_003 6895 1.85 3.11 1.44 115 CK_HELO_DYNAMIC_SPLIT_IP 6868 1.28 0.81 1.43 116 HELO_DYNAMIC_IPADDR2 6863 1.17 0.39 1.43 117 AC_FROM_MANY_DOTS 6741 1.06 0.02 1.41 118 TO_MALFORMED 6607 3.46 9.77 1.38 119 XMBdyGiftCard01 6472 1.29 1.11 1.35 120 RELAYCOUNTRY_GB 6460 1.55 2.16 1.35 121 URI_HEX 6397 1.42 1.67 1.33 122 HTML_FONT_FACE_BAD 6326 1.14 0.61 1.32 123 RCVD_IN_BL_SPAMCOP_NET 6096 3.90 11.90 1.27 124 XMCapTrack 6069 1.03 0.32 1.27 125 XM_OfRef6 6025 1.63 2.77 1.26 126 USER_IN_DEF_DKIM_WL 5756 0.90 0.01 1.20 127 XMGenDplmaNmb 5709 1.15 1.03 1.19 128 XMPhish11 5708 1.23 1.36 1.19 129 TM2_M_VERY_LONG_WORD 5693 1.15 1.03 1.19 130 XMStockSpam_06 5628 1.18 1.20 1.17 131 XM_GoogleGroups 5551 0.94 0.29 1.16 132 XMGappySubj_01 5455 0.93 0.31 1.14 133 URI_TRY_3LD 5334 1.08 0.97 1.11 134 T_FILL_THIS_FORM_SHORT 5302 1.21 1.51 1.11 135 TooManyTo_004 5097 1.40 2.43 1.06 136 XM_H_Long_From02 5038 1.20 1.67 1.05 137 DKIM_ADSP_CUSTOM_MED 4897 1.16 1.57 1.02 138 RCVD_IN_MSPIKE_BL 4772 2.18 5.80 0.99 139 TR_MetaPhish_Combo_01 4536 1.02 1.26 0.95 140 XM_UB50 4497 2.88 8.78 0.94 141 XMHTML_After_End 4352 1.85 4.71 0.91 142 TooManyTo_005 4285 1.10 1.71 0.89 143 XMSubMetaI_00 4024 1.04 1.65 0.84 144 HTML_IMAGE_ONLY_20 3879 0.67 0.23 0.81 145 XMBody_95 3716 0.60 0.07 0.77 146 TR_XM_RelayPhish 3705 1.08 2.02 0.77 147 SpammyFromTLD_01 3699 1.53 3.82 0.77 148 NML_ADSP_CUSTOM_MED 3591 0.92 1.46 0.75 149 XM_SPF_Unknown 3534 1.34 3.16 0.74 150 XMBody_17 3439 0.86 1.30 0.72 151 XM_ProductURIs 3416 0.69 0.61 0.71 152 XMBrknScrpt_02 3314 0.74 0.88 0.69 153 T_XMHurry_00 3268 0.76 1.00 0.68 154 USER_IN_WHITELIST 3236 0.51 0.00 0.67 155 FROM_GOV_DKIM_AU 3053 0.53 0.23 0.64 156 T_OBFU_PDF_ATTACH 2973 0.52 0.20 0.62 157 T_TooManySym_03 2970 0.49 0.10 0.62 158 XMHTMLBadTable_001 2944 0.61 0.59 0.61 159 XMNoVowels 2940 0.57 0.44 0.61 160 XM_B_REG_HTML 2801 0.51 0.30 0.58 161 PLING_QUERY 2793 0.58 0.56 0.58 162 HTTPS_HTTP_MISMATCH 2739 0.65 0.87 0.57 163 XMSubMetaSxObfu_03 2665 0.61 0.79 0.56 164 XM_ShortIntro_01 2621 0.50 0.34 0.55 165 XMSexyCombo_01 2602 1.09 2.77 0.54 166 FILL_THIS_FORM 2584 0.65 0.98 0.54 167 XM_shorewaves_Whitelist 2560 0.40 0.00 0.53 168 DIET_1 2547 1.18 3.17 0.53 169 XMPhish30 2532 0.56 0.67 0.53 170 XMBody_78 2418 0.67 1.19 0.50 171 TR_XM_PHPDW 2417 0.71 1.36 0.50 172 FORGED_GMAIL_RCVD 2364 0.67 1.23 0.49 173 HTML_TAG_BALANCE_BODY 2335 0.59 0.90 0.49 174 TR_XM_PHPForged 2298 0.68 1.29 0.48 175 TR_XM_FormFill2 2291 0.68 1.28 0.48 176 MISSING_HEADERS 2280 1.12 3.10 0.48 177 XM_H_PHPOS 2271 0.67 1.28 0.47 178 XMMoneyMeta_00 2257 0.99 2.58 0.47 179 XM_H_PHPMailer 2246 1.43 4.35 0.47 180 TM2_M_BODY_EMPTY 2161 0.37 0.12 0.45 181 AC_DIV_BONANZA 2142 0.36 0.09 0.45 182 TM2_M_A_HREF_HREF 2084 0.54 0.87 0.43 183 SpammyFromTLD_02 2072 5.26 19.94 0.43 184 T_Symld_Words_02 2072 0.58 1.03 0.43 185 RELAYCOUNTRY_DE 2062 0.86 2.17 0.43 186 RELAYCOUNTRY_AU 2059 0.46 0.54 0.43 187 RCVD_IN_MSPIKE_L3 2022 0.58 1.07 0.42 188 FROM_GOV_SPOOF 1998 0.48 0.66 0.42 189 XM_Body_Obfu01 1994 0.37 0.23 0.42 190 SHORT_HELO_AND_INLINE_IMAGE 1954 0.31 0.02 0.41 191 T_MONEY_PERCENT 1943 0.57 1.08 0.41 192 TR_LOTS_OF_MONEY2 1943 0.57 1.08 0.41 193 REMOVE_BEFORE_LINK 1942 0.41 0.42 0.40 194 RELAYCOUNTRY_FR 1881 1.01 2.91 0.39 195 XMRcvdHeader_15 1867 0.29 0.00 0.39 196 HTML_IMAGE_ONLY_28 1866 0.42 0.51 0.39 197 HTML_IMAGE_ONLY_32 1810 0.42 0.56 0.38 198 RCVD_IN_SORBS_DUL 1805 0.41 0.51 0.38 199 XMLngstWrd_00 1781 0.40 0.47 0.37 200 XMSubGiftCard1 1767 0.30 0.09 0.37 ----------------------------------------------------------------------