Email: 396112 Autolearn: 0 AvgScore: 3.34 AvgScanTime: 2.74 sec Spam: 111264 Autolearn: 0 AvgScore: 16.76 AvgScanTime: 3.08 sec Ham: 284848 Autolearn: 0 AvgScore: -1.90 AvgScanTime: 2.61 sec Time Spent Running SA: 301.93 hours Time Spent Processing Spam: 95.27 hours Time Spent Processing Ham: 206.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102022 88.40 91.69 87.11 2 DCC_CHECK 86140 57.74 77.42 50.05 3 XM_B_Unicode 61661 68.90 55.42 74.17 4 MIME_HTML_ONLY 55759 30.96 50.11 23.48 5 DKIM_SIGNED 55504 69.27 49.88 76.85 6 XM_DK_Pass 54374 68.34 48.87 75.94 7 DKIM_VALID 51172 65.30 45.99 72.84 8 XMListUnsubscribeExists 47804 52.99 42.96 56.91 9 BAYES_50 46379 49.43 41.68 52.46 10 DKIM_VALID_AU 39095 52.16 35.14 58.80 11 XM_UncommonTLD01 37069 12.44 33.32 4.29 12 FSL_BULK_SIG 36750 14.34 33.03 7.04 13 RELAYCOUNTRY_META 36201 12.64 32.54 4.87 14 XM_B_Unicode3 34781 40.07 31.26 43.51 15 XM_B_Unsub 30621 18.24 27.52 14.61 16 BOTNET 30573 9.30 27.48 2.20 17 HTML_FONT_LOW_CONTRAST 26053 28.59 23.42 30.61 18 BAYES_99 24747 9.50 22.24 4.53 19 XM_DK_Undo_02 24609 11.92 22.12 7.93 20 XM_Body_Dirty_Words 24351 16.73 21.89 14.71 21 HTML_MIME_NO_HTML_TAG 23801 7.48 21.39 2.05 22 LOC_TINY_FONT_1 23451 25.80 21.08 27.65 23 UNTRUSTED_Relay 22726 6.86 20.43 1.56 24 MultiRelay 22321 16.65 20.06 15.32 25 DCC_CHECK_NEGATIVE 21851 40.66 19.64 48.87 26 RCVD_IN_BL_SPAMCOP_NET 21835 6.44 19.62 1.29 27 HTML_IMAGE_RATIO_02 21570 12.55 19.39 9.89 28 XMSubLong 21001 20.58 18.87 21.25 29 BOTNET_IPINHOSTNAME 20879 9.42 18.77 5.77 30 KHOP_HELO_FCRDNS 19866 6.32 17.85 1.82 31 FVGT_m_MULTI_ODD 19231 20.24 17.28 21.39 32 BAYES_999 19153 7.54 17.21 3.76 33 XMSexyCombo_05 19100 8.84 17.17 5.59 34 T_TM2_M_HEADER_IN_MSG 18988 25.00 17.07 28.10 35 RDNS_DYNAMIC 18856 5.14 16.95 0.53 36 DKIM_VALID_EF 18621 24.68 16.74 27.78 37 RCVD_IN_RP_RNBL 17622 4.59 15.84 0.20 38 T_KAM_HTML_FONT_INVALID 17621 20.69 15.84 22.58 39 XM_H_Long_From01 16502 8.80 14.83 6.45 40 SpammyFromTLD_02 16336 4.36 14.68 0.33 41 TR_DCC_Bayes_99 16166 5.45 14.53 1.90 42 RCVD_IN_MSPIKE_BL 16029 4.99 14.41 1.31 43 TR_Mismatch_TLD_02 15090 3.87 13.56 0.09 44 RCVD_IN_PSBL 14014 3.59 12.60 0.07 45 FROM_SUSPICIOUS_NTLD 13711 3.49 12.32 0.04 46 FROM_SUSPICIOUS_NTLD_FP 13687 3.48 12.30 0.03 47 XM_Multi_Part_URI 13578 13.70 12.20 14.28 48 XM_SPF_SoftFail 12686 4.51 11.40 1.82 49 BAYES_60 12508 8.96 11.24 8.07 50 RCVD_IN_MSPIKE_L5 12404 3.24 11.15 0.15 51 XM_DIRTYINTL 12329 4.77 11.08 2.31 52 HTML_SHORT_LINK_IMG_1 12002 3.06 10.79 0.05 53 LOTS_OF_MONEY 11147 9.76 10.02 9.66 54 XM_UB50 10890 3.33 9.79 0.81 55 TooManyTo_001 10589 9.71 9.52 9.79 56 FROM_EXCESS_BASE64 10559 5.84 9.49 4.41 57 T_REMOTE_IMAGE 10545 5.44 9.48 3.86 58 BOTNET_NORDNS 10293 2.61 9.25 0.02 59 XM_CamelCaseFrm001 10087 4.43 9.07 2.63 60 XMSubMetaSx_00 9829 5.74 8.83 4.53 61 BAYES_80 9374 4.38 8.43 2.80 62 XM_Evil_Numbers_Gen 8844 9.24 7.95 9.74 63 XMNumbers 8649 5.37 7.77 4.44 64 MIME_HEADER_CTYPE_ONLY 8224 2.14 7.39 0.08 65 MPART_ALT_DIFF 7238 5.26 6.51 4.78 66 SHORT_IMG_SUSP_NTLD 6749 1.70 6.07 0.00 67 DKIM_ADSP_NXDOMAIN 6710 2.31 6.03 0.86 68 HTML_TAG_BALANCE_CENTER 6507 1.70 5.85 0.07 69 ALL_TRUSTED 6457 13.96 5.80 17.14 70 DRUGS_ERECTILE 6456 1.64 5.80 0.02 71 HTML_IMAGE_ONLY_12 6433 1.73 5.78 0.15 72 BODY_URI_ONLY 6371 1.63 5.73 0.03 73 RCVD_IN_MSPIKE_H2 6361 10.11 5.72 11.82 74 URIBL_RHS_DOB 6104 2.77 5.49 1.71 75 XM_B_Unsub2 5938 5.99 5.34 6.25 76 XMBdyGiftCard01 5838 3.03 5.25 2.16 77 XMSubMetaD_00 5801 1.51 5.21 0.07 78 TooManyTo_002 5743 4.58 5.16 4.35 79 RELAYCOUNTRY_CA 5630 2.75 5.06 1.84 80 XM_B_Phish_Phrases 5486 5.81 4.93 6.16 81 SpammyFromTLD_01 5470 1.71 4.92 0.46 82 PDS_OTHER_BAD_TLD 5359 1.75 4.82 0.55 83 DATE_IN_PAST_03_06 5210 1.39 4.68 0.10 84 TooManyTo_003 5186 3.53 4.66 3.09 85 BAYES_95 5085 2.45 4.57 1.62 86 HTML_IMAGE_RATIO_04 5070 5.77 4.56 6.24 87 BODY_SINGLE_WORD 5007 1.27 4.50 0.02 88 BODY_SINGLE_URI 4999 1.27 4.49 0.01 89 XM_UB99 4953 1.25 4.45 0.00 90 HDRS_MISSP 4920 1.24 4.42 0.00 91 FROM_NTLD_LINKBAIT 4902 1.24 4.41 0.00 92 XMStrtUSub 4879 4.93 4.39 5.15 93 RELAYCOUNTRY_CN 4870 1.26 4.38 0.05 94 TO_MALFORMED 4837 2.88 4.35 2.30 95 BAYES_40 4728 4.69 4.25 4.86 96 XMSubGiftCard1 4663 1.65 4.19 0.65 97 RELAYCOUNTRY_FR 4658 1.37 4.19 0.28 98 LotsOfNums_01 4548 6.21 4.09 7.04 99 TooManyTo_004 4495 2.69 4.04 2.16 100 MultiRelay_Combo 4456 1.23 4.00 0.15 101 MultiRelay_CC 4456 1.23 4.00 0.15 102 DKIM_INVALID 4332 3.98 3.89 4.01 103 HTML_IMAGE_ONLY_04 4308 1.12 3.87 0.04 104 MIME_HTML_MOSTLY 4263 3.47 3.83 3.33 105 HTML_SHORT_CENTER 4230 1.07 3.80 0.00 106 UNPARSEABLE_RELAY 4118 3.37 3.70 3.24 107 XM_SendGrid 4085 5.89 3.67 6.75 108 XM_B_SpammyTLD 4068 2.71 3.66 2.35 109 XM_UB999 3957 1.00 3.56 0.00 110 XMSubGiftCard2 3950 1.01 3.55 0.02 111 MIME_BASE64_TEXT 3885 1.04 3.49 0.08 112 HDRS_LCASE_IMGONLY 3543 0.90 3.18 0.01 113 BAYES_20 3400 3.66 3.06 3.90 114 MIME_HTML_ONLY_MULTI 3399 2.79 3.05 2.69 115 HTML_IMAGE_ONLY_08 3396 0.92 3.05 0.09 116 RELAYCOUNTRY_RU 3372 0.86 3.03 0.01 117 REPLYTO_WITHOUT_TO_CC 3159 0.84 2.84 0.06 118 TooManyTo_005 3154 1.92 2.83 1.56 119 MALF_HTML_B64 3124 0.79 2.81 0.01 120 PLING_QUERY 3112 1.30 2.80 0.71 121 BAYES_00 3022 14.48 2.72 19.07 122 NO_DNS_FOR_FROM 2995 2.06 2.69 1.81 123 HK_RANDOM_FROM 2921 0.82 2.63 0.11 124 TO_EQ_FM_DOM_HTML_IMG 2791 0.71 2.51 0.00 125 XMDiploma_00 2754 1.78 2.48 1.51 126 TVD_RCVD_SPACE_BRACKET 2737 0.69 2.46 0.00 127 TR_XM_RelayPhish 2640 1.28 2.37 0.85 128 XMSexyCombo_01 2627 1.22 2.36 0.78 129 SUSPICIOUS_RECIPS 2621 0.67 2.36 0.01 130 URI_HEX 2617 1.54 2.35 1.22 131 T_XMDrugObfuBody_08 2595 1.68 2.33 1.43 132 XMSlimDrugH 2593 1.04 2.33 0.54 133 RELAYCOUNTRY_GB 2442 1.14 2.19 0.73 134 CHARSET_FARAWAY_HEADER 2409 0.62 2.17 0.02 135 LongTLD 2380 0.70 2.14 0.13 136 XM_OfRef6 2379 1.47 2.14 1.21 137 RCVD_IN_MSPIKE_L3 2341 1.26 2.10 0.94 138 NO_FM_NAME_IP_HOSTN 2340 0.59 2.10 0.00 139 DKIM_ADSP_CUSTOM_MED 2337 1.20 2.10 0.85 140 MIME_QP_LONG_LINE 2317 3.88 2.08 4.59 141 DIET_1 2317 1.14 2.08 0.78 142 KB_FORGED_MOZ4 2302 0.58 2.07 0.00 143 HTML_IMAGE_RATIO_06 2297 3.23 2.06 3.68 144 HK_SCAM 2287 0.58 2.06 0.01 145 HTML_SHORT_LINK_IMG_2 2284 0.60 2.05 0.03 146 CK_HELO_DYNAMIC_SPLIT_IP 2280 2.25 2.05 2.33 147 XMGenDplmaNmb 2237 1.19 2.01 0.87 148 NML_ADSP_CUSTOM_MED 2216 1.00 1.99 0.62 149 FROM_GOV_SPOOF 2209 0.67 1.99 0.15 150 MIME_CHARSET_FARAWAY 2204 0.60 1.98 0.06 151 SUBJECT_DRUG_GAP_C 2191 0.55 1.97 0.00 152 SERGIO_SUBJECT_VIAGRA01 2187 0.55 1.97 0.00 153 SERGIO_SUBJECT_PORN014 2167 0.55 1.95 0.00 154 FORGED_GMAIL_RCVD 2159 0.92 1.94 0.52 155 T_TooManySym_01 2113 4.88 1.90 6.05 156 RCVD_IN_MSPIKE_WL 2028 7.49 1.82 9.71 157 RCVD_IN_MSPIKE_H3 2028 7.49 1.82 9.71 158 T_XMDrugObfuBody_14 1990 1.62 1.79 1.55 159 FVGT_m_MULTI_ODD_EMAIL 1961 0.52 1.76 0.03 160 TR_XM_PHPDW 1954 0.95 1.76 0.64 161 HTML_IMAGE_RATIO_08 1927 2.37 1.73 2.62 162 TR_XM_PHPForged 1911 0.91 1.72 0.59 163 TR_XM_FormFill2 1897 0.83 1.70 0.49 164 XM_H_PHPOS 1891 0.83 1.70 0.49 165 TR_XM_DK_SendGrid 1887 3.26 1.70 3.87 166 TM2_M_URI_OPT_OUT 1885 1.71 1.69 1.72 167 XM_UB60 1868 0.51 1.68 0.05 168 RELAYCOUNTRY_DE 1845 0.74 1.66 0.39 169 XM_ShortIntro_01 1818 0.73 1.63 0.37 170 RELAYCOUNTRY_BR 1780 0.45 1.60 0.01 171 XMHTML_After_End 1763 0.85 1.58 0.56 172 RELAYCOUNTRY_JP 1758 0.45 1.58 0.01 173 SUBJ_ALL_CAPS 1743 1.62 1.57 1.64 174 CK_HELO_GENERIC 1728 0.44 1.55 0.01 175 XMSubMetaI_00 1723 1.47 1.55 1.44 176 T_MONEY_PERCENT 1693 0.67 1.52 0.34 177 TR_LOTS_OF_MONEY2 1693 0.67 1.52 0.34 178 FILL_THIS_FORM 1678 0.87 1.51 0.61 179 URI_TRY_3LD 1675 1.35 1.51 1.29 180 TO_NO_BRKTS_HTML_ONLY 1674 0.55 1.50 0.17 181 URG_BIZ 1651 0.43 1.48 0.01 182 XMBody_17 1644 1.32 1.48 1.26 183 BAYES_05 1635 2.08 1.47 2.32 184 XMWghtMeta_00 1616 0.47 1.45 0.08 185 MONEY_FORM 1616 0.44 1.45 0.04 186 FILL_THIS_FORM_LONG 1613 0.76 1.45 0.49 187 ADVANCE_FEE_5_NEW_FRM_MNY 1608 0.41 1.45 0.00 188 HK_RANDOM_REPLYTO 1568 0.62 1.41 0.31 189 TM2_M_VERY_LONG_WORD 1527 1.61 1.37 1.70 190 XM_URI_RBL 1523 0.65 1.37 0.38 191 HELO_MISC_IP 1515 0.38 1.36 0.00 192 NORDNS_LOW_CONTRAST 1500 0.38 1.35 0.00 193 XMSubMetaSxObfu_03 1490 0.73 1.34 0.49 194 INVALID_MSGID 1489 2.31 1.34 2.69 195 XMSubMetaSSx_00 1452 0.51 1.31 0.20 196 XM_H_PHPMailer 1430 0.82 1.29 0.63 197 TM2_M_A_HREF_HREF 1421 0.86 1.28 0.70 198 RELAYCOUNTRY_UA 1416 0.36 1.27 0.00 199 RCVD_IN_RP_SAFE 1412 8.64 1.27 11.52 200 DATE_IN_PAST_12_24 1404 0.41 1.26 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 248128 88.40 91.69 87.11 2 DKIM_SIGNED 218895 69.27 49.88 76.85 3 XM_DK_Pass 216324 68.34 48.87 75.94 4 XM_B_Unicode 211264 68.90 55.42 74.17 5 DKIM_VALID 207481 65.30 45.99 72.84 6 DKIM_VALID_AU 167498 52.16 35.14 58.80 7 XMListUnsubscribeExists 162103 52.99 42.96 56.91 8 BAYES_50 149427 49.43 41.68 52.46 9 DCC_CHECK 142562 57.74 77.42 50.05 10 DCC_CHECK_NEGATIVE 139209 40.66 19.64 48.87 11 XM_B_Unicode3 123946 40.07 31.26 43.51 12 HTML_FONT_LOW_CONTRAST 87179 28.59 23.42 30.61 13 T_TM2_M_HEADER_IN_MSG 80047 25.00 17.07 28.10 14 DKIM_VALID_EF 79124 24.68 16.74 27.78 15 LOC_TINY_FONT_1 78751 25.80 21.08 27.65 16 MIME_HTML_ONLY 66876 30.96 50.11 23.48 17 T_KAM_HTML_FONT_INVALID 64315 20.69 15.84 22.58 18 FVGT_m_MULTI_ODD 60943 20.24 17.28 21.39 19 XMSubLong 60532 20.58 18.87 21.25 20 BAYES_00 54327 14.48 2.72 19.07 21 ALL_TRUSTED 48823 13.96 5.80 17.14 22 TR_XM_DK_Bayes 46201 11.96 1.07 16.22 23 TR_XM_DK_Bayes1 44490 11.50 0.95 15.62 24 MultiRelay 43625 16.65 20.06 15.32 25 XM_Body_Dirty_Words 41908 16.73 21.89 14.71 26 XM_B_Unsub 41623 18.24 27.52 14.61 27 TR_XM_DK_Bayes2 41553 10.73 0.84 14.59 28 XM_Multi_Part_URI 40674 13.70 12.20 14.28 29 RCVD_IN_MSPIKE_H2 33681 10.11 5.72 11.82 30 RCVD_IN_RP_SAFE 32813 8.64 1.27 11.52 31 RCVD_IN_RP_CERTIFIED 30098 7.82 0.80 10.57 32 XM_DKIMWhitelistDomains 28524 7.23 0.09 10.01 33 HTML_IMAGE_RATIO_02 28158 12.55 19.39 9.89 34 TooManyTo_001 27877 9.71 9.52 9.79 35 XM_Evil_Numbers_Gen 27742 9.24 7.95 9.74 36 RCVD_IN_MSPIKE_WL 27652 7.49 1.82 9.71 37 RCVD_IN_MSPIKE_H3 27650 7.49 1.82 9.71 38 LOTS_OF_MONEY 27523 9.76 10.02 9.66 39 BAYES_60 22982 8.96 11.24 8.07 40 XM_DK_Undo_02 22591 11.92 22.12 7.93 41 FSL_BULK_SIG 20064 14.34 33.03 7.04 42 LotsOfNums_01 20050 6.21 4.09 7.04 43 XM_SendGrid 19227 5.89 3.67 6.75 44 XM_H_Long_From01 18372 8.80 14.83 6.45 45 XM_B_Unsub2 17797 5.99 5.34 6.25 46 HTML_IMAGE_RATIO_04 17782 5.77 4.56 6.24 47 XM_B_Phish_Phrases 17534 5.81 4.93 6.16 48 T_TooManySym_01 17232 4.88 1.90 6.05 49 BOTNET_IPINHOSTNAME 16429 9.42 18.77 5.77 50 XMSexyCombo_05 15929 8.84 17.17 5.59 51 XMStrtUSub 14668 4.93 4.39 5.15 52 RELAYCOUNTRY_META 13874 12.64 32.54 4.87 53 BAYES_40 13848 4.69 4.25 4.86 54 MPART_ALT_DIFF 13609 5.26 6.51 4.78 55 MIME_QP_LONG_LINE 13064 3.88 2.08 4.59 56 XMSubMetaSx_00 12914 5.74 8.83 4.53 57 BAYES_99 12895 9.50 22.24 4.53 58 XMNumbers 12637 5.37 7.77 4.44 59 FROM_EXCESS_BASE64 12560 5.84 9.49 4.41 60 TooManyTo_002 12401 4.58 5.16 4.35 61 XM_UncommonTLD01 12207 12.44 33.32 4.29 62 DKIM_INVALID 11414 3.98 3.89 4.01 63 RCVD_IN_IADB_LISTED 11354 3.13 0.96 3.99 64 BAYES_20 11108 3.66 3.06 3.90 65 TR_XM_DK_SendGrid 11037 3.26 1.70 3.87 66 T_REMOTE_IMAGE 10996 5.44 9.48 3.86 67 BAYES_999 10705 7.54 17.21 3.76 68 HTML_IMAGE_RATIO_06 10486 3.23 2.06 3.68 69 RCVD_IN_IADB_SPF 9743 2.72 0.91 3.42 70 TVD_RCVD_IP 9553 2.68 0.97 3.35 71 MIME_HTML_MOSTLY 9479 3.47 3.83 3.33 72 IN_ZIMBRA_NJ_WHITELIST 9328 2.36 0.02 3.27 73 UNPARSEABLE_RELAY 9238 3.37 3.70 3.24 74 T_TooManySym_02 8806 2.36 0.50 3.09 75 TooManyTo_003 8798 3.53 4.66 3.09 76 RCVD_IN_IADB_SENDERID 8584 2.42 0.90 3.01 77 RCVD_IN_IADB_DK 8240 2.33 0.90 2.89 78 BAYES_80 7985 4.38 8.43 2.80 79 MIME_HTML_ONLY_MULTI 7671 2.79 3.05 2.69 80 INVALID_MSGID 7657 2.31 1.34 2.69 81 RCVD_IN_IADB_VOUCHED 7554 1.97 0.24 2.65 82 XM_CamelCaseFrm001 7479 4.43 9.07 2.63 83 HTML_IMAGE_RATIO_08 7452 2.37 1.73 2.62 84 XM_PDF 7173 1.87 0.20 2.52 85 XM_B_SpammyTLD 6685 2.71 3.66 2.35 86 CK_HELO_DYNAMIC_SPLIT_IP 6647 2.25 2.05 2.33 87 HELO_DYNAMIC_IPADDR2 6644 1.93 0.91 2.33 88 BAYES_05 6600 2.08 1.47 2.32 89 XM_DIRTYINTL 6576 4.77 11.08 2.31 90 TO_MALFORMED 6559 2.88 4.35 2.30 91 BOTNET 6275 9.30 27.48 2.20 92 XMBdyGiftCard01 6161 3.03 5.25 2.16 93 TooManyTo_004 6154 2.69 4.04 2.16 94 HTML_MIME_NO_HTML_TAG 5826 7.48 21.39 2.05 95 MAILING_LIST_MULTI 5648 1.70 0.96 1.98 96 TR_DCC_Bayes_99 5419 5.45 14.53 1.90 97 RELAYCOUNTRY_CA 5255 2.75 5.06 1.84 98 XM_SPF_SoftFail 5190 4.51 11.40 1.82 99 KHOP_HELO_FCRDNS 5182 6.32 17.85 1.82 100 NO_DNS_FOR_FROM 5150 2.06 2.69 1.81 101 RCVD_IN_IADB_OPTIN 4906 1.30 0.22 1.72 102 TM2_M_URI_OPT_OUT 4899 1.71 1.69 1.72 103 URIBL_RHS_DOB 4880 2.77 5.49 1.71 104 TM2_M_VERY_LONG_WORD 4840 1.61 1.37 1.70 105 USER_IN_DEF_DKIM_WL 4718 1.19 0.01 1.66 106 TR_Symld_Words 4706 1.53 1.23 1.65 107 SUBJ_ALL_CAPS 4665 1.62 1.57 1.64 108 ANY_BOUNCE_MESSAGE 4650 1.37 0.70 1.63 109 BOUNCE_MESSAGE 4650 1.37 0.70 1.63 110 BAYES_95 4619 2.45 4.57 1.62 111 IN_HORDE_ADDRESS_BOOK 4527 1.15 0.02 1.59 112 TooManyTo_005 4432 1.92 2.83 1.56 113 UNTRUSTED_Relay 4430 6.86 20.43 1.56 114 T_XMDrugObfuBody_14 4428 1.62 1.79 1.55 115 XMDiploma_00 4291 1.78 2.48 1.51 116 XMGappySubj_01 4152 1.18 0.46 1.46 117 XMSubMetaI_00 4095 1.47 1.55 1.44 118 T_XMDrugObfuBody_08 4067 1.68 2.33 1.43 119 XM_H_Trusted_IP 3987 1.01 0.00 1.40 120 XM_DK_Undo_01 3930 1.19 0.69 1.38 121 XM_ProductURIs 3814 1.21 0.88 1.34 122 RCVD_IN_MSPIKE_BL 3738 4.99 14.41 1.31 123 URI_TRY_3LD 3681 1.35 1.51 1.29 124 RCVD_IN_BL_SPAMCOP_NET 3677 6.44 19.62 1.29 125 XMBody_17 3595 1.32 1.48 1.26 126 URI_HEX 3474 1.54 2.35 1.22 127 XM_OfRef6 3444 1.47 2.14 1.21 128 XM_H_Long_From02 3400 1.14 0.99 1.19 129 XMBody_95 3258 0.87 0.15 1.14 130 XM_GoogleGroups 3207 0.90 0.34 1.13 131 XMStockSpam_06 3141 1.11 1.14 1.10 132 T_XMDrugObfuBody_00 2987 0.94 0.68 1.05 133 XM_B_REG_HTML 2689 0.73 0.17 0.94 134 RCVD_IN_MSPIKE_L3 2667 1.26 2.10 0.94 135 T_FILL_THIS_FORM_SHORT 2653 0.82 0.54 0.93 136 XMPhish11 2560 1.00 1.25 0.90 137 XMGenDplmaNmb 2466 1.19 2.01 0.87 138 DKIM_ADSP_NXDOMAIN 2444 2.31 6.03 0.86 139 TR_XM_RelayPhish 2434 1.28 2.37 0.85 140 DKIM_ADSP_CUSTOM_MED 2426 1.20 2.10 0.85 141 XM_shorewaves_Whitelist 2348 0.59 0.00 0.82 142 USER_IN_WHITELIST 2305 0.58 0.00 0.81 143 XM_UB50 2294 3.33 9.79 0.81 144 TR_MetaPhish_Combo_01 2285 0.68 0.36 0.80 145 HTML_FONT_FACE_BAD 2284 0.67 0.34 0.80 146 XMSexyCombo_01 2223 1.22 2.36 0.78 147 DIET_1 2214 1.14 2.08 0.78 148 HTML_TAG_BALANCE_BODY 2159 0.67 0.44 0.76 149 XMBrknScrpt_02 2130 0.68 0.50 0.75 150 RELAYCOUNTRY_GB 2069 1.14 2.19 0.73 151 PLING_QUERY 2020 1.30 2.80 0.71 152 TM2_M_A_HREF_HREF 1986 0.86 1.28 0.70 153 XMSubGiftCard1 1860 1.65 4.19 0.65 154 XMSubNoVowel 1833 0.68 0.78 0.64 155 TR_XM_PHPDW 1810 0.95 1.76 0.64 156 XM_H_PHPMailer 1801 0.82 1.29 0.63 157 T_TooManySym_03 1775 0.48 0.10 0.62 158 NML_ADSP_CUSTOM_MED 1760 1.00 1.99 0.62 159 THIS_AD 1756 0.65 0.73 0.62 160 FILL_THIS_FORM 1750 0.87 1.51 0.61 161 AC_FROM_MANY_DOTS 1722 0.44 0.01 0.60 162 TR_XM_PHPForged 1675 0.91 1.72 0.59 163 HELO_NODOT 1670 0.55 0.46 0.59 164 XMPhish30 1656 0.65 0.83 0.58 165 XMBSHREFv2 1649 0.48 0.24 0.58 166 HELO_NO_DOMAIN 1641 0.54 0.44 0.58 167 T_XMHurry_00 1605 0.60 0.69 0.56 168 XMHTML_After_End 1590 0.85 1.58 0.56 169 T_Symld_Words_02 1586 0.72 1.13 0.56 170 SUBJ_DOLLARS 1577 0.62 0.78 0.55 171 PDS_OTHER_BAD_TLD 1564 1.75 4.82 0.55 172 XMSlimDrugH 1530 1.04 2.33 0.54 173 XMHTMLBadTable_001 1509 0.50 0.43 0.53 174 RDNS_DYNAMIC 1500 5.14 16.95 0.53 175 XMPhish14 1498 0.49 0.39 0.53 176 XMSubMetaSxObfu_02 1490 0.46 0.31 0.52 177 LOW_PRICE 1488 0.53 0.56 0.52 178 FORGED_GMAIL_RCVD 1485 0.92 1.94 0.52 179 XM_D_tchamptons_WL 1445 0.36 0.00 0.51 180 TR_XM_FormFill2 1406 0.83 1.70 0.49 181 XM_H_PHPOS 1396 0.83 1.70 0.49 182 XMSubMetaSxObfu_03 1388 0.73 1.34 0.49 183 FILL_THIS_FORM_LONG 1384 0.76 1.45 0.49 184 T_FILL_THIS_FORM_LOAN 1351 0.48 0.49 0.47 185 XM_B_COPY_HTML 1350 0.53 0.68 0.47 186 HTML_IMAGE_ONLY_20 1330 0.60 0.96 0.47 187 XM_RXBody 1311 0.39 0.22 0.46 188 SpammyFromTLD_01 1304 1.71 4.92 0.46 189 XMNoVowels 1267 0.47 0.54 0.44 190 XM_Combo_Sbj 1265 0.52 0.73 0.44 191 XM_SPF_Unknown 1260 0.60 1.00 0.44 192 HTTPS_HTTP_MISMATCH 1215 0.38 0.28 0.43 193 XMRcvdHeader_15 1184 0.30 0.00 0.42 194 XMBody_78 1139 0.41 0.43 0.40 195 RELAYCOUNTRY_DE 1102 0.74 1.66 0.39 196 XMSolicitRefs_0 1098 0.37 0.33 0.39 197 XMCapTrack 1082 0.32 0.16 0.38 198 XM_Body_Obfu01 1080 0.30 0.08 0.38 199 RELAYCOUNTRY_AU 1072 0.37 0.34 0.38 200 XM_URI_RBL 1069 0.65 1.37 0.38 ----------------------------------------------------------------------