Email: 372451 Autolearn: 0 AvgScore: 0.97 AvgScanTime: 2.02 sec Spam: 68942 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 3.65 sec Ham: 303509 Autolearn: 0 AvgScore: -1.59 AvgScanTime: 1.65 sec Time Spent Running SA: 208.93 hours Time Spent Processing Spam: 69.85 hours Time Spent Processing Ham: 139.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 63708 82.23 92.41 79.91 2 DKIM_SIGNED 54101 74.08 78.47 73.08 3 DCC_CHECK 53260 50.38 77.25 44.27 4 XM_DK_Pass 52718 72.98 76.47 72.19 5 XM_B_Unicode 52062 69.56 75.52 68.20 6 XMListUnsubscribeExists 46772 56.57 67.84 54.01 7 DKIM_VALID 45852 68.64 66.51 69.12 8 DKIM_VALID_AU 33956 54.45 49.25 55.63 9 XM_B_Unicode3 31363 45.03 45.49 44.93 10 BAYES_50 29411 45.73 42.66 46.43 11 XM_DK_Undo_02 28428 13.97 41.23 7.78 12 MIME_HTML_ONLY 24443 24.70 35.45 22.26 13 LOC_TINY_FONT_1 22920 28.46 33.25 27.37 14 HTML_FONT_LOW_CONTRAST 20580 29.53 29.85 29.46 15 BAYES_99 19004 8.55 27.57 4.23 16 XMSubLong 17983 21.47 26.08 20.42 17 FVGT_m_MULTI_ODD 17919 21.09 25.99 19.97 18 BOTNET 17694 6.89 25.67 2.62 19 DKIM_VALID_EF 15975 25.10 23.17 25.54 20 XM_Body_Dirty_Words 15885 15.64 23.04 13.95 21 BAYES_999 14804 6.63 21.47 3.26 22 MultiRelay 14745 15.81 21.39 14.55 23 DCC_CHECK_NEGATIVE 14742 48.46 21.38 54.61 24 TR_DCC_Bayes_99 14120 5.58 20.48 2.20 25 T_KAM_HTML_FONT_INVALID 13992 16.25 20.30 15.33 26 XM_Multi_Part_URI 13895 17.50 20.15 16.90 27 RELAYCOUNTRY_META 13479 7.28 19.55 4.49 28 T_TM2_M_HEADER_IN_MSG 13430 20.38 19.48 20.58 29 BOTNET_IPINHOSTNAME 11638 7.69 16.88 5.60 30 XM_UncommonTLD01 10818 5.64 15.69 3.35 31 HTML_IMAGE_RATIO_02 10610 10.84 15.39 9.81 32 FSL_BULK_SIG 10489 8.48 15.21 6.95 33 XM_B_Unsub 10466 10.55 15.18 9.50 34 LOTS_OF_MONEY 9659 11.29 14.01 10.68 35 XMSexyCombo_05 8732 6.43 12.67 5.02 36 DKIM_INVALID 8249 5.44 11.97 3.95 37 XM_Evil_Numbers_Gen 7383 9.87 10.71 9.68 38 UNTRUSTED_Relay 7261 2.85 10.53 1.11 39 XMSubMetaSx_00 6799 6.23 9.86 5.41 40 NO_DNS_FOR_FROM 6465 3.71 9.38 2.42 41 RCVD_IN_MSPIKE_H2 5908 10.89 8.57 11.41 42 XMPhish08 5863 3.24 8.50 2.04 43 XM_H_Long_From01 5714 6.46 8.29 6.04 44 MPART_ALT_DIFF 5505 4.96 7.98 4.27 45 XM_DIRTYINTL 5300 3.58 7.69 2.65 46 BAYES_60 5252 5.20 7.62 4.66 47 BAYES_80 4941 3.38 7.17 2.52 48 XM_B_Phish_Phrases 4826 6.71 7.00 6.65 49 LotsOfNums_01 4673 7.08 6.78 7.15 50 XMNumbers 4166 4.28 6.04 3.88 51 RCVD_IN_BL_SPAMCOP_NET 4058 2.11 5.89 1.25 52 T_REMOTE_IMAGE 4057 3.61 5.88 3.09 53 HTML_IMAGE_RATIO_04 4012 6.10 5.82 6.16 54 MIME_HTML_MOSTLY 3992 2.96 5.79 2.32 55 TooManyTo_001 3958 5.68 5.74 5.67 56 RELAYCOUNTRY_CA 3832 2.63 5.56 1.96 57 XM_UB50 3550 1.44 5.15 0.60 58 SpammyFromTLD_02 3519 1.10 5.10 0.19 59 XMStrtUSub 3408 4.38 4.94 4.26 60 XM_SendGrid 3399 5.94 4.93 6.17 61 KHOP_HELO_FCRDNS 3242 1.58 4.70 0.87 62 HTML_MIME_NO_HTML_TAG 3029 2.06 4.39 1.53 63 FROM_EXCESS_BASE64 2901 4.16 4.21 4.16 64 TR_Mismatch_TLD_02 2896 0.84 4.20 0.07 65 XM_SPF_SoftFail 2846 1.60 4.13 1.03 66 MIME_HTML_ONLY_MULTI 2837 2.93 4.12 2.67 67 BAYES_95 2804 2.04 4.07 1.59 68 RCVD_IN_RP_SAFE 2791 10.62 4.05 12.11 69 HTML_IMAGE_RATIO_06 2664 3.61 3.86 3.55 70 REPLYTO_WITHOUT_TO_CC 2598 0.73 3.77 0.04 71 HTML_SHORT_LINK_IMG_1 2591 0.71 3.76 0.02 72 BAYES_00 2517 23.93 3.65 28.53 73 RCVD_IN_RP_CERTIFIED 2462 9.85 3.57 11.28 74 XM_CamelCaseFrm001 2451 2.49 3.56 2.25 75 HTML_IMAGE_ONLY_12 2435 0.76 3.53 0.13 76 XMHTML_After_End 2430 1.54 3.52 1.09 77 XMBody_17 2392 1.42 3.47 0.96 78 MIME_HEADER_CTYPE_ONLY 2352 0.78 3.41 0.19 79 RDNS_DYNAMIC 2298 0.95 3.33 0.40 80 HDRS_LCASE_IMGONLY 2264 0.61 3.28 0.01 81 XMSexyCombo_01 2257 1.89 3.27 1.58 82 TO_EQ_FM_DOM_HTML_IMG 2238 0.60 3.25 0.00 83 RCVD_IN_RP_RNBL 2224 0.68 3.23 0.10 84 MIME_QP_LONG_LINE 2109 3.91 3.06 4.10 85 RCVD_IN_MSPIKE_WL 2080 7.77 3.02 8.85 86 RCVD_IN_MSPIKE_H3 2080 7.77 3.02 8.85 87 BAYES_40 2065 4.24 3.00 4.53 88 TR_Mismatch_TLD_01 2065 0.83 3.00 0.34 89 TR_XM_DK_Bayes 2058 14.84 2.99 17.53 90 TR_XM_PHPDW 2056 1.34 2.98 0.97 91 RCVD_IN_MSPIKE_BL 2024 1.37 2.94 1.02 92 TR_XM_PHPForged 2015 1.32 2.92 0.96 93 TR_XM_FormFill2 1998 1.32 2.90 0.96 94 HTML_IMAGE_RATIO_08 1997 2.19 2.90 2.03 95 XM_H_PHPOS 1996 1.31 2.90 0.95 96 ALL_TRUSTED 1982 17.91 2.87 21.33 97 URI_HEX 1959 1.54 2.84 1.24 98 T_TooManySym_01 1930 5.14 2.80 5.68 99 XM_B_SpammyTLD 1910 2.05 2.77 1.88 100 XMSubMetaI_00 1802 1.31 2.61 1.02 101 TM2_M_URI_OPT_OUT 1783 9.33 2.59 10.86 102 PDS_OTHER_BAD_TLD 1747 1.03 2.53 0.69 103 BAYES_20 1706 3.58 2.47 3.83 104 TR_XM_INV_DKIM 1705 0.65 2.47 0.24 105 XM_URI_RBL 1704 0.70 2.47 0.30 106 XMStockSpam_06 1690 1.20 2.45 0.92 107 URI_TRY_3LD 1683 1.55 2.44 1.35 108 BOTNET_NORDNS 1671 0.47 2.42 0.03 109 URIBL_SBL_A 1617 0.64 2.35 0.26 110 T_FILL_THIS_FORM_SHORT 1617 1.13 2.35 0.86 111 MultiRelay_CC 1587 0.52 2.30 0.11 112 MultiRelay_Combo 1587 0.52 2.30 0.11 113 SpammyFromTLD_01 1582 0.71 2.29 0.35 114 SUBJ_ALL_CAPS 1579 2.32 2.29 2.33 115 TR_XM_RelayPhish 1572 1.44 2.28 1.25 116 XM_H_PHPMailer 1565 0.85 2.27 0.53 117 RELAYCOUNTRY_FR 1527 0.59 2.21 0.22 118 TR_XM_DK_Bayes1 1456 14.08 2.11 16.80 119 TR_XM_DK_SendGrid 1441 3.32 2.09 3.60 120 T_XMDrugObfuBody_14 1435 1.83 2.08 1.77 121 XM_H_PHPOS_M 1403 0.93 2.04 0.67 122 XM_B_Unsub2 1368 1.39 1.98 1.25 123 XM_OfRef6 1353 1.48 1.96 1.37 124 FROM_SUSPICIOUS_NTLD 1334 0.38 1.93 0.02 125 FROM_SUSPICIOUS_NTLD_FP 1326 0.37 1.92 0.02 126 XMDiploma_00 1295 1.66 1.88 1.62 127 TM2_M_VERY_LONG_WORD 1279 1.47 1.86 1.38 128 TR_LOTS_OF_MONEY2 1278 0.70 1.85 0.44 129 T_XMDrugObfuBody_08 1278 1.22 1.85 1.07 130 T_MONEY_PERCENT 1278 0.70 1.85 0.44 131 HK_RANDOM_REPLYTO 1263 0.51 1.83 0.21 132 TR_XM_DK_Bayes2 1223 13.18 1.77 15.77 133 DIET_1 1223 0.82 1.77 0.60 134 REMOVE_BEFORE_LINK 1141 0.54 1.66 0.29 135 DATE_IN_PAST_03_06 1128 0.39 1.64 0.11 136 BODY_URI_ONLY 1106 0.32 1.60 0.03 137 T_XMHurry_00 1064 0.76 1.54 0.58 138 LongTLD 1063 0.40 1.54 0.14 139 RCVD_IN_PSBL 1057 0.32 1.53 0.05 140 TR_Symld_Words 1033 1.62 1.50 1.65 141 RELAYCOUNTRY_AT 1023 0.39 1.48 0.15 142 XMSexyCombo_04 1019 0.70 1.48 0.52 143 HTML_TAG_BALANCE_CENTER 1017 0.31 1.48 0.04 144 DATE_IN_PAST_12_24 1001 0.36 1.45 0.12 145 XM_ProductURIs 986 0.86 1.43 0.74 146 BAYES_05 984 3.14 1.43 3.53 147 XMHTMLBadTable_001 960 0.64 1.39 0.47 148 MPART_ALT_DIFF_COUNT 942 0.52 1.37 0.32 149 XMSubMetaSxObfu_03 928 0.58 1.35 0.40 150 DKIM_ADSP_CUSTOM_MED 911 0.94 1.32 0.85 151 RCVD_IN_MSPIKE_L5 910 0.39 1.32 0.18 152 RELAYCOUNTRY_DE 886 0.47 1.29 0.28 153 RCVD_IN_IADB_LISTED 871 3.10 1.26 3.52 154 MAILING_LIST_MULTI 842 1.63 1.22 1.72 155 T_XMDrugObfuBody_00 831 0.89 1.21 0.82 156 XMPhish14 829 0.50 1.20 0.34 157 NML_ADSP_CUSTOM_MED 824 0.72 1.20 0.61 158 THIS_AD 818 0.59 1.19 0.46 159 FORGED_GMAIL_RCVD 811 0.62 1.18 0.49 160 URIBL_BLACK 810 0.23 1.17 0.01 161 XM_UB60 807 0.25 1.17 0.04 162 RELAYCOUNTRY_PL 807 0.23 1.17 0.02 163 RCVD_IN_MSPIKE_L3 798 0.74 1.16 0.64 164 XM_B_COPY_HTML 795 0.68 1.15 0.57 165 XM_DK_Undo_01 795 1.27 1.15 1.29 166 LOW_PRICE 794 0.35 1.15 0.17 167 RCVD_IN_IADB_SPF 789 2.70 1.14 3.05 168 XM_UB99 788 0.21 1.14 0.00 169 RCVD_IN_IADB_DK 773 2.32 1.12 2.59 170 RCVD_IN_IADB_SENDERID 765 2.40 1.11 2.70 171 RELAYCOUNTRY_GB 758 0.87 1.10 0.82 172 XMSubMetaSSx_00 756 0.58 1.10 0.46 173 XM_H_Long_From02 741 1.08 1.07 1.08 174 PLING_QUERY 733 0.95 1.06 0.92 175 SUBJ_DOLLARS 714 0.78 1.04 0.72 176 TM2_M_A_HREF_HREF 702 0.84 1.02 0.80 177 RELAYCOUNTRY_IN 700 0.24 1.02 0.07 178 XMBdyGiftCard01 694 1.84 1.01 2.03 179 UNPARSEABLE_RELAY 693 2.79 1.01 3.19 180 TooManyTo_002 682 1.05 0.99 1.06 181 XMGenDplmaNmb 655 0.71 0.95 0.65 182 URIBL_DBL_SPAM 644 0.20 0.93 0.04 183 XMPhish11 638 0.85 0.93 0.83 184 HTML_FONT_FACE_BAD 627 0.81 0.91 0.79 185 HTML_TAG_BALANCE_BODY 623 0.65 0.90 0.59 186 XMPhish30 619 0.72 0.90 0.68 187 XM_UB999 616 0.17 0.89 0.00 188 TR_LOTS_OF_MONEY3 613 0.52 0.89 0.44 189 XMSubject_48 604 0.19 0.88 0.03 190 TR_Caps_n_Bayes_99 582 0.22 0.84 0.08 191 RELAYCOUNTRY_TW 581 0.21 0.84 0.06 192 XM_RXBody 571 1.08 0.83 1.14 193 XM_UB80 566 0.16 0.82 0.01 194 XM_B_REG_HTML 543 0.83 0.79 0.84 195 XMGppyBdWords 536 0.26 0.78 0.14 196 XMSlimDrugH 532 0.44 0.77 0.37 197 XM_ShortIntro_01 528 0.38 0.77 0.30 198 DATE_IN_FUTURE_06_12 527 0.15 0.76 0.00 199 FORM_FRAUD 524 0.18 0.76 0.05 200 TR_MetaPhish_Combo_01 520 0.77 0.75 0.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 242540 82.23 92.41 79.91 2 DKIM_SIGNED 221795 74.08 78.47 73.08 3 XM_DK_Pass 219114 72.98 76.47 72.19 4 DKIM_VALID 209799 68.64 66.51 69.12 5 XM_B_Unicode 207001 69.56 75.52 68.20 6 DKIM_VALID_AU 168848 54.45 49.25 55.63 7 DCC_CHECK_NEGATIVE 165752 48.46 21.38 54.61 8 XMListUnsubscribeExists 163913 56.57 67.84 54.01 9 BAYES_50 140906 45.73 42.66 46.43 10 XM_B_Unicode3 136362 45.03 45.49 44.93 11 DCC_CHECK 134378 50.38 77.25 44.27 12 HTML_FONT_LOW_CONTRAST 89408 29.53 29.85 29.46 13 BAYES_00 86594 23.93 3.65 28.53 14 LOC_TINY_FONT_1 83061 28.46 33.25 27.37 15 DKIM_VALID_EF 77507 25.10 23.17 25.54 16 MIME_HTML_ONLY 67557 24.70 35.45 22.26 17 ALL_TRUSTED 64731 17.91 2.87 21.33 18 T_TM2_M_HEADER_IN_MSG 62474 20.38 19.48 20.58 19 XMSubLong 61990 21.47 26.08 20.42 20 FVGT_m_MULTI_ODD 60624 21.09 25.99 19.97 21 TR_XM_DK_Bayes 53205 14.84 2.99 17.53 22 XM_Multi_Part_URI 51290 17.50 20.15 16.90 23 TR_XM_DK_Bayes1 50996 14.08 2.11 16.80 24 TR_XM_DK_Bayes2 47865 13.18 1.77 15.77 25 T_KAM_HTML_FONT_INVALID 46536 16.25 20.30 15.33 26 MultiRelay 44153 15.81 21.39 14.55 27 XM_Body_Dirty_Words 42350 15.64 23.04 13.95 28 RCVD_IN_RP_SAFE 36755 10.62 4.05 12.11 29 RCVD_IN_MSPIKE_H2 34636 10.89 8.57 11.41 30 RCVD_IN_RP_CERTIFIED 34242 9.85 3.57 11.28 31 ANY_BOUNCE_MESSAGE 33176 8.96 0.30 10.93 32 BOUNCE_MESSAGE 33174 8.96 0.29 10.93 33 TM2_M_URI_OPT_OUT 32972 9.33 2.59 10.86 34 LOTS_OF_MONEY 32407 11.29 14.01 10.68 35 HTML_IMAGE_RATIO_02 29772 10.84 15.39 9.81 36 XM_Evil_Numbers_Gen 29375 9.87 10.71 9.68 37 XM_B_Unsub 28823 10.55 15.18 9.50 38 RCVD_IN_MSPIKE_H3 26862 7.77 3.02 8.85 39 RCVD_IN_MSPIKE_WL 26862 7.77 3.02 8.85 40 XM_DKIMWhitelistDomains 26603 7.15 0.03 8.77 41 XM_DK_Undo_02 23604 13.97 41.23 7.78 42 LotsOfNums_01 21713 7.08 6.78 7.15 43 FSL_BULK_SIG 21102 8.48 15.21 6.95 44 XM_B_Phish_Phrases 20183 6.71 7.00 6.65 45 XM_SendGrid 18723 5.94 4.93 6.17 46 HTML_IMAGE_RATIO_04 18693 6.10 5.82 6.16 47 XM_H_Long_From01 18334 6.46 8.29 6.04 48 T_TooManySym_01 17227 5.14 2.80 5.68 49 TooManyTo_001 17212 5.68 5.74 5.67 50 BOTNET_IPINHOSTNAME 16995 7.69 16.88 5.60 51 XMSubMetaSx_00 16420 6.23 9.86 5.41 52 XMSexyCombo_05 15234 6.43 12.67 5.02 53 BAYES_60 14129 5.20 7.62 4.66 54 BAYES_40 13743 4.24 3.00 4.53 55 RELAYCOUNTRY_META 13628 7.28 19.55 4.49 56 MPART_ALT_DIFF 12962 4.96 7.98 4.27 57 XMStrtUSub 12917 4.38 4.94 4.26 58 BAYES_99 12826 8.55 27.57 4.23 59 FROM_EXCESS_BASE64 12611 4.16 4.21 4.16 60 MIME_QP_LONG_LINE 12454 3.91 3.06 4.10 61 DKIM_INVALID 11996 5.44 11.97 3.95 62 XMNumbers 11780 4.28 6.04 3.88 63 BAYES_20 11625 3.58 2.47 3.83 64 TR_XM_DK_SendGrid 10925 3.32 2.09 3.60 65 HTML_IMAGE_RATIO_06 10765 3.61 3.86 3.55 66 BAYES_05 10709 3.14 1.43 3.53 67 RCVD_IN_IADB_LISTED 10683 3.10 1.26 3.52 68 XM_UncommonTLD01 10176 5.64 15.69 3.35 69 BAYES_999 9880 6.63 21.47 3.26 70 UNPARSEABLE_RELAY 9697 2.79 1.01 3.19 71 T_REMOTE_IMAGE 9390 3.61 5.88 3.09 72 RCVD_IN_IADB_SPF 9251 2.70 1.14 3.05 73 IN_ZIMBRA_NJ_WHITELIST 8986 2.42 0.02 2.96 74 T_TooManySym_02 8740 2.48 0.71 2.88 75 RCVD_IN_IADB_SENDERID 8184 2.40 1.11 2.70 76 MIME_HTML_ONLY_MULTI 8090 2.93 4.12 2.67 77 XM_DIRTYINTL 8038 3.58 7.69 2.65 78 BOTNET 7951 6.89 25.67 2.62 79 RCVD_IN_IADB_DK 7859 2.32 1.12 2.59 80 INVALID_MSGID 7788 2.14 0.29 2.57 81 BAYES_80 7663 3.38 7.17 2.52 82 NO_DNS_FOR_FROM 7358 3.71 9.38 2.42 83 TVD_RCVD_IP 7157 2.02 0.51 2.36 84 SUBJ_ALL_CAPS 7060 2.32 2.29 2.33 85 MIME_HTML_MOSTLY 7049 2.96 5.79 2.32 86 RCVD_IN_IADB_VOUCHED 6910 1.94 0.43 2.28 87 XM_CamelCaseFrm001 6820 2.49 3.56 2.25 88 TO_MALFORMED 6815 1.83 0.00 2.25 89 TR_DCC_Bayes_99 6665 5.58 20.48 2.20 90 XM_H_Trusted_IP 6542 1.76 0.00 2.16 91 CK_HELO_DYNAMIC_SPLIT_IP 6451 1.76 0.16 2.13 92 HELO_DYNAMIC_IPADDR2 6449 1.75 0.09 2.12 93 XM_PDF 6383 1.79 0.43 2.10 94 XMPhish08 6189 3.24 8.50 2.04 95 XMBdyGiftCard01 6156 1.84 1.01 2.03 96 HTML_IMAGE_RATIO_08 6147 2.19 2.90 2.03 97 RELAYCOUNTRY_CA 5963 2.63 5.56 1.96 98 XM_B_SpammyTLD 5710 2.05 2.77 1.88 99 T_XMDrugObfuBody_14 5365 1.83 2.08 1.77 100 MAILING_LIST_MULTI 5231 1.63 1.22 1.72 101 USER_IN_DEF_DKIM_WL 5187 1.40 0.03 1.71 102 TR_Symld_Words 5005 1.62 1.50 1.65 103 XMDiploma_00 4906 1.66 1.88 1.62 104 BAYES_95 4812 2.04 4.07 1.59 105 XMSexyCombo_01 4790 1.89 3.27 1.58 106 RCVD_IN_IADB_OPTIN 4659 1.33 0.41 1.54 107 IN_HORDE_ADDRESS_BOOK 4656 1.26 0.04 1.53 108 HTML_MIME_NO_HTML_TAG 4633 2.06 4.39 1.53 109 XMSubNoVowel 4252 1.24 0.55 1.40 110 TM2_M_VERY_LONG_WORD 4201 1.47 1.86 1.38 111 XM_OfRef6 4157 1.48 1.96 1.37 112 URI_TRY_3LD 4087 1.55 2.44 1.35 113 XM_DK_Undo_01 3929 1.27 1.15 1.29 114 TR_XM_RelayPhish 3793 1.44 2.28 1.25 115 XM_B_Unsub2 3792 1.39 1.98 1.25 116 RCVD_IN_BL_SPAMCOP_NET 3783 2.11 5.89 1.25 117 URI_HEX 3766 1.54 2.84 1.24 118 XM_GoogleGroups 3539 1.03 0.45 1.17 119 XM_RXBody 3470 1.08 0.83 1.14 120 XMGappySubj_01 3465 1.00 0.40 1.14 121 UNTRUSTED_Relay 3365 2.85 10.53 1.11 122 XMHTML_After_End 3303 1.54 3.52 1.09 123 XM_H_Long_From02 3291 1.08 1.07 1.08 124 T_XMDrugObfuBody_08 3255 1.22 1.85 1.07 125 TooManyTo_002 3220 1.05 0.99 1.06 126 XM_SPF_SoftFail 3119 1.60 4.13 1.03 127 XMSubMetaI_00 3091 1.31 2.61 1.02 128 RCVD_IN_MSPIKE_BL 3087 1.37 2.94 1.02 129 TR_XM_PHPDW 2951 1.34 2.98 0.97 130 XMBody_17 2910 1.42 3.47 0.96 131 TR_XM_PHPForged 2909 1.32 2.92 0.96 132 TR_XM_FormFill2 2908 1.32 2.90 0.96 133 XM_H_PHPOS 2898 1.31 2.90 0.95 134 PLING_QUERY 2791 0.95 1.06 0.92 135 XMStockSpam_06 2789 1.20 2.45 0.92 136 XMBody_95 2726 0.76 0.15 0.90 137 KHOP_HELO_FCRDNS 2629 1.58 4.70 0.87 138 T_FILL_THIS_FORM_SHORT 2601 1.13 2.35 0.86 139 DKIM_ADSP_CUSTOM_MED 2573 0.94 1.32 0.85 140 XM_B_REG_HTML 2557 0.83 0.79 0.84 141 XMPhish11 2524 0.85 0.93 0.83 142 RELAYCOUNTRY_GB 2494 0.87 1.10 0.82 143 T_XMDrugObfuBody_00 2489 0.89 1.21 0.82 144 TM2_M_A_HREF_HREF 2437 0.84 1.02 0.80 145 HTML_FONT_FACE_BAD 2397 0.81 0.91 0.79 146 TR_MetaPhish_Combo_01 2355 0.77 0.75 0.78 147 TooManyTo_003 2244 0.74 0.75 0.74 148 XM_ProductURIs 2235 0.86 1.43 0.74 149 USER_IN_WHITELIST 2193 0.59 0.00 0.72 150 SUBJ_DOLLARS 2184 0.78 1.04 0.72 151 PDS_OTHER_BAD_TLD 2084 1.03 2.53 0.69 152 XMPhish30 2066 0.72 0.90 0.68 153 XM_H_PHPOS_M 2046 0.93 2.04 0.67 154 SHORT_SHORTNER 2012 0.58 0.20 0.66 155 XMBrknScrpt_02 1999 0.68 0.75 0.66 156 HTML_IMAGE_ONLY_20 1984 0.59 0.28 0.65 157 XMGenDplmaNmb 1979 0.71 0.95 0.65 158 RCVD_IN_MSPIKE_L3 1955 0.74 1.16 0.64 159 FILL_THIS_FORM 1871 0.59 0.46 0.62 160 NML_ADSP_CUSTOM_MED 1860 0.72 1.20 0.61 161 XM_UB50 1827 1.44 5.15 0.60 162 DIET_1 1820 0.82 1.77 0.60 163 TooManyTo_004 1814 0.60 0.64 0.60 164 HTML_TAG_BALANCE_BODY 1787 0.65 0.90 0.59 165 XMSubMetaSxObfu_02 1786 0.59 0.58 0.59 166 T_XMHurry_00 1765 0.76 1.54 0.58 167 XM_B_COPY_HTML 1743 0.68 1.15 0.57 168 T_TooManySym_03 1646 0.48 0.23 0.54 169 T_Symld_Words_02 1627 0.58 0.75 0.54 170 HELO_NODOT 1623 0.53 0.50 0.53 171 FILL_THIS_FORM_LONG 1607 0.50 0.37 0.53 172 XM_H_PHPMailer 1603 0.85 2.27 0.53 173 XMSexyCombo_04 1582 0.70 1.48 0.52 174 HELO_NO_DOMAIN 1577 0.52 0.50 0.52 175 T_FILL_THIS_FORM_LOAN 1572 0.45 0.13 0.52 176 TooManyTo_005 1556 0.51 0.52 0.51 177 XMNoVowels 1528 0.48 0.40 0.50 178 FORGED_GMAIL_RCVD 1487 0.62 1.18 0.49 179 XMHTMLBadTable_001 1426 0.64 1.39 0.47 180 XMSubMetaSSx_00 1397 0.58 1.10 0.46 181 THIS_AD 1397 0.59 1.19 0.46 182 XMBSHREFv2 1357 0.42 0.29 0.45 183 DKIM_ADSP_NXDOMAIN 1334 0.48 0.65 0.44 184 TR_LOTS_OF_MONEY3 1332 0.52 0.89 0.44 185 TR_LOTS_OF_MONEY2 1327 0.70 1.85 0.44 186 T_MONEY_PERCENT 1327 0.70 1.85 0.44 187 FROM_GOV_DKIM_AU 1298 0.36 0.08 0.43 188 RDNS_DYNAMIC 1229 0.95 3.33 0.40 189 XMCapTrack 1224 0.38 0.26 0.40 190 XMSubMetaSxObfu_03 1222 0.58 1.35 0.40 191 XMBody_78 1202 0.41 0.45 0.40 192 XMRcvdHeader_15 1183 0.32 0.00 0.39 193 HTTPS_HTTP_MISMATCH 1155 0.41 0.56 0.38 194 XM_D_tchamptons_WL 1116 0.30 0.00 0.37 195 XMSlimDrugH 1116 0.44 0.77 0.37 196 SpammyFromTLD_01 1063 0.71 2.29 0.35 197 BASE64_LENGTH_79_INF 1063 0.39 0.54 0.35 198 URI_NOVOWEL 1046 0.41 0.71 0.34 199 T_TooManySym_04 1035 0.29 0.07 0.34 200 XMPhish14 1035 0.50 1.20 0.34 ----------------------------------------------------------------------