Email: 617781 Autolearn: 0 AvgScore: 2.12 AvgScanTime: 1.67 sec Spam: 129649 Autolearn: 0 AvgScore: 12.26 AvgScanTime: 2.59 sec Ham: 488132 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 1.42 sec Time Spent Running SA: 286.10 hours Time Spent Processing Spam: 93.11 hours Time Spent Processing Ham: 192.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123875 89.75 95.55 88.21 2 DKIM_SIGNED 103450 76.15 79.79 75.19 3 RELAYCOUNTRY_US 102256 79.98 78.87 80.28 4 DCC_CHECK 101680 48.11 78.43 40.06 5 XM_DK_Pass 98978 74.44 76.34 73.94 6 XM_B_Unicode 97047 70.02 74.85 68.74 7 DKIM_VALID 88892 70.45 68.56 70.96 8 XMListUnsubscribeExists 86149 54.44 66.45 51.26 9 DKIM_VALID_AU 66065 52.54 50.96 52.95 10 BAYES_50 60956 50.90 47.02 51.93 11 XM_B_Unicode3 56815 40.49 43.82 39.60 12 MIME_HTML_ONLY 47758 23.82 36.84 20.36 13 LOC_TINY_FONT_1 46687 25.35 36.01 22.52 14 HTML_FONT_LOW_CONTRAST 44867 28.59 34.61 27.00 15 XM_DK_Undo_02 41620 11.77 32.10 6.37 16 XMSubLong 37125 22.85 28.64 21.32 17 FVGT_m_MULTI_ODD 33508 22.04 25.85 21.03 18 DKIM_VALID_EF 32673 26.36 25.20 26.66 19 T_KAM_HTML_FONT_INVALID 28274 18.66 21.81 17.82 20 RELAYCOUNTRY_META 28227 9.51 21.77 6.25 21 BAYES_99 27514 7.04 21.22 3.27 22 XM_Body_Dirty_Words 26738 14.85 20.62 13.32 23 DCC_CHECK_NEGATIVE 25718 49.76 19.84 57.70 24 T_TM2_M_HEADER_IN_MSG 25271 27.95 19.49 30.20 25 BOTNET 24008 5.68 18.52 2.28 26 XM_Multi_Part_URI 23317 12.58 17.98 11.14 27 BAYES_999 21126 5.57 16.29 2.72 28 FSL_BULK_SIG 20472 8.44 15.79 6.49 29 TR_DCC_Bayes_99 20085 4.83 15.49 2.00 30 XM_B_Unsub 19881 11.35 15.33 10.29 31 UNTRUSTED_Relay 18175 4.41 14.02 1.86 32 BOTNET_IPINHOSTNAME 17817 6.28 13.74 4.29 33 XMSexyCombo_05 17782 6.04 13.72 4.00 34 XM_UncommonTLD01 16576 5.14 12.79 3.11 35 HTML_IMAGE_RATIO_02 16458 8.42 12.69 7.29 36 LOTS_OF_MONEY 16153 8.97 12.46 8.04 37 XM_Evil_Numbers_Gen 14970 9.64 11.55 9.13 38 RCVD_IN_MSPIKE_H2 14631 13.12 11.29 13.61 39 DKIM_INVALID 14558 5.70 11.23 4.23 40 XMSubMetaSx_00 13512 5.22 10.42 3.84 41 LotsOfNums_01 11798 8.34 9.10 8.13 42 MPART_ALT_DIFF 11270 5.03 8.69 4.06 43 BAYES_80 10887 3.39 8.40 2.05 44 XM_B_Phish_Phrases 10745 7.15 8.29 6.85 45 XMNumbers 10633 4.65 8.20 3.71 46 T_REMOTE_IMAGE 10492 4.56 8.09 3.62 47 TooManyTo_001 9624 8.36 7.42 8.61 48 XM_UB50 9469 2.29 7.30 0.95 49 NO_DNS_FOR_FROM 9328 2.71 7.19 1.52 50 BAYES_60 9327 5.03 7.19 4.45 51 XM_H_Long_From01 8989 6.45 6.93 6.33 52 HTML_IMAGE_RATIO_04 8527 5.06 6.58 4.66 53 HTML_MIME_NO_HTML_TAG 8068 3.13 6.22 2.31 54 MIME_QP_LONG_LINE 7701 5.81 5.94 5.78 55 MIME_HTML_MOSTLY 7245 3.08 5.59 2.41 56 BODY_URI_ONLY 7188 1.24 5.54 0.10 57 HTML_IMAGE_ONLY_08 6901 1.20 5.32 0.10 58 KHOP_HELO_FCRDNS 6810 2.52 5.25 1.80 59 XM_SendGrid 6603 5.77 5.09 5.95 60 XM_B_SpammyTLD 6468 3.10 4.99 2.60 61 HTML_SHORT_LINK_IMG_1 6170 1.02 4.76 0.02 62 XM_CamelCaseFrm001 6049 2.82 4.67 2.33 63 HDRS_LCASE_IMGONLY 5929 0.99 4.57 0.03 64 XM_SPF_SoftFail 5915 2.39 4.56 1.81 65 HTML_TAG_BALANCE_CENTER 5801 0.98 4.47 0.05 66 BAYES_40 5756 5.84 4.44 6.21 67 XM_BadFromFormat 5750 1.01 4.44 0.10 68 SpammyFromTLD_02 5731 1.08 4.42 0.19 69 PDS_OTHER_BAD_TLD 5612 1.80 4.33 1.13 70 RELAYCOUNTRY_CA 5602 2.40 4.32 1.89 71 BAYES_95 5264 1.80 4.06 1.19 72 RCVD_IN_BL_SPAMCOP_NET 5235 1.64 4.04 1.00 73 TM2_M_URI_OPT_OUT 5171 2.77 3.99 2.44 74 MIME_HTML_ONLY_MULTI 5154 2.82 3.98 2.52 75 XMStrtUSub 5112 4.35 3.94 4.45 76 RCVD_IN_MSPIKE_WL 4776 8.91 3.68 10.30 77 RCVD_IN_MSPIKE_H3 4776 8.91 3.68 10.30 78 FROM_EXCESS_BASE64 4767 3.65 3.68 3.64 79 FROM_SUSPICIOUS_NTLD 4671 0.79 3.60 0.04 80 FROM_SUSPICIOUS_NTLD_FP 4640 0.78 3.58 0.04 81 HTML_IMAGE_RATIO_06 4640 3.58 3.58 3.58 82 RELAYCOUNTRY_FR 4594 1.00 3.54 0.32 83 RCVD_IN_MSPIKE_BL 4216 1.27 3.25 0.75 84 XM_B_Unsub2 4144 2.55 3.20 2.37 85 T_TooManySym_01 4119 4.50 3.18 4.85 86 XM_URI_RBL 4029 0.83 3.11 0.23 87 BAYES_20 4018 4.68 3.10 5.10 88 HTML_IMAGE_RATIO_08 4012 2.67 3.09 2.56 89 T_XMDrugObfuBody_08 4011 1.91 3.09 1.59 90 XM_DIRTYINTL 4004 1.10 3.09 0.57 91 XMSexyCombo_01 3813 0.99 2.94 0.47 92 RDNS_DYNAMIC 3544 0.83 2.73 0.33 93 BAYES_00 3541 18.24 2.73 22.36 94 RCVD_IN_RP_RNBL 3505 0.64 2.70 0.09 95 XMDiploma_00 3485 1.89 2.69 1.67 96 URI_HEX 3322 1.52 2.56 1.24 97 TR_XM_PHPDW 3264 1.43 2.52 1.14 98 TR_Mismatch_TLD_02 3233 0.58 2.49 0.07 99 TR_XM_PHPForged 3223 1.40 2.49 1.12 100 DIET_1 3220 0.79 2.48 0.35 101 TR_XM_FormFill2 3209 1.40 2.48 1.12 102 XM_H_PHPOS 3199 1.39 2.47 1.11 103 RCVD_IN_IADB_LISTED 3123 4.80 2.41 5.43 104 XM_OfRef6 3121 1.62 2.41 1.41 105 XMSlimDrugH 3070 0.75 2.37 0.32 106 RCVD_IN_RP_SAFE 3043 7.81 2.35 9.26 107 TR_XM_DK_SendGrid 2998 3.08 2.31 3.28 108 RCVD_IN_IADB_SPF 2954 4.20 2.28 4.71 109 RCVD_IN_IADB_SENDERID 2893 3.71 2.23 4.11 110 RCVD_IN_IADB_DK 2893 3.66 2.23 4.04 111 RCVD_IN_RP_CERTIFIED 2834 7.20 2.19 8.53 112 BOTNET_NORDNS 2821 0.51 2.18 0.07 113 SpammyFromTLD_01 2803 0.99 2.16 0.67 114 DATE_IN_PAST_12_24 2753 0.48 2.12 0.04 115 RELAYCOUNTRY_GB 2685 1.51 2.07 1.36 116 XMStockSpam_06 2683 1.19 2.07 0.95 117 XMGenDplmaNmb 2679 1.31 2.07 1.12 118 TR_XM_DK_Bayes 2668 13.83 2.06 16.96 119 XMBody_17 2650 0.98 2.04 0.70 120 RCVD_IN_MSPIKE_L3 2649 0.75 2.04 0.40 121 T_XMDrugObfuBody_14 2634 1.63 2.03 1.52 122 TR_XM_INV_DKIM 2556 0.48 1.97 0.09 123 TM2_M_VERY_LONG_WORD 2538 1.42 1.96 1.27 124 SUBJ_ALL_CAPS 2528 1.48 1.95 1.36 125 XM_UB60 2370 0.44 1.83 0.07 126 XM_DK_Undo_01 2369 1.62 1.83 1.56 127 XM_H_TOP 2346 0.38 1.81 0.00 128 T_XMHurry_00 2338 0.97 1.80 0.75 129 SUBJECT_NEEDS_ENCODING 2332 0.38 1.80 0.01 130 SUBJ_ILLEGAL_CHARS 2331 0.38 1.80 0.01 131 XM_UB80 2326 0.39 1.79 0.02 132 XMSexyCombo_04 2319 0.47 1.79 0.12 133 FROM_MISSP_REPLYTO 2252 0.37 1.74 0.01 134 XMHTML_After_End 2239 1.03 1.73 0.84 135 BAYES_05 2165 2.99 1.67 3.35 136 RELAYCOUNTRY_DE 2118 0.77 1.63 0.54 137 ALL_TRUSTED 2110 12.71 1.63 15.65 138 MAILING_LIST_MULTI 2103 2.42 1.62 2.63 139 LongTLD 2088 0.49 1.61 0.19 140 XMWghtMeta_00 2021 0.36 1.56 0.04 141 XMSubMetaI_00 2010 1.22 1.55 1.13 142 TR_XM_DK_Bayes1 1992 13.15 1.54 16.23 143 DATE_IN_PAST_03_06 1951 0.40 1.50 0.10 144 REMOVE_BEFORE_LINK 1930 0.59 1.49 0.35 145 DKIM_ADSP_NXDOMAIN 1917 0.61 1.48 0.38 146 TR_Symld_Words 1896 1.44 1.46 1.44 147 XMMoneyMeta_00 1863 0.78 1.44 0.61 148 T_XMDrugObfuBody_00 1763 1.05 1.36 0.97 149 XMPhish08 1744 0.64 1.35 0.45 150 URI_TRY_3LD 1721 1.26 1.33 1.24 151 RELAYCOUNTRY_BG 1697 0.28 1.31 0.00 152 XM_H_PHPMailer 1666 0.69 1.29 0.53 153 XMPhish14 1664 0.57 1.28 0.38 154 XMSubMetaSxObfu_03 1660 0.67 1.28 0.50 155 RCVD_IN_PSBL 1645 0.28 1.27 0.02 156 REPLYTO_WITHOUT_TO_CC 1642 0.31 1.27 0.06 157 SUBJ_DOLLARS 1640 0.53 1.26 0.34 158 T_Symld_Words_02 1640 0.89 1.26 0.79 159 TR_XM_DK_Bayes2 1607 11.45 1.24 14.16 160 XMBdyGiftCard01 1603 1.11 1.24 1.08 161 UNPARSEABLE_RELAY 1603 1.98 1.24 2.18 162 XM_H_PHPOS_M 1484 0.38 1.14 0.18 163 URIBL_SBL_A 1474 0.46 1.14 0.28 164 FROM_MISSP_DYNIP 1443 0.23 1.11 0.00 165 T_TooManySym_02 1426 2.14 1.10 2.42 166 RELAYCOUNTRY_IT 1419 0.27 1.09 0.05 167 DKIM_ADSP_CUSTOM_MED 1393 1.13 1.07 1.14 168 XM_ProductURIs 1383 0.78 1.07 0.70 169 XMSubMetaSSx_00 1382 0.34 1.07 0.14 170 MIME_HEADER_CTYPE_ONLY 1366 0.39 1.05 0.22 171 INVALID_MSGID 1360 1.44 1.05 1.54 172 TR_XM_RelayPhish 1343 0.35 1.04 0.17 173 XMBody_78 1339 0.43 1.03 0.27 174 NO_FM_NAME_IP_HOSTN 1337 0.22 1.03 0.00 175 XMBrknScrpt_02 1311 0.65 1.01 0.55 176 HTTPS_HTTP_MISMATCH 1302 0.76 1.00 0.69 177 TR_Mismatch_TLD_01 1249 0.46 0.96 0.33 178 XMHTMLBadTable_001 1231 0.68 0.95 0.61 179 RCVD_IN_MSPIKE_L5 1226 0.25 0.95 0.06 180 LOW_PRICE 1226 0.28 0.95 0.11 181 T_FILL_THIS_FORM_SHORT 1209 1.11 0.93 1.15 182 FORGED_GMAIL_RCVD 1208 0.67 0.93 0.60 183 TR_LOTS_OF_MONEY3 1189 0.44 0.92 0.32 184 XM_H_Long_From02 1172 1.05 0.90 1.09 185 RELAYCOUNTRY_IN 1169 0.29 0.90 0.13 186 THIS_AD 1156 0.51 0.89 0.41 187 NML_ADSP_CUSTOM_MED 1142 0.83 0.88 0.82 188 MPART_ALT_DIFF_COUNT 1130 0.39 0.87 0.26 189 XMPhish30 1124 0.52 0.87 0.43 190 XM_UB99 1114 0.19 0.86 0.01 191 PLING_QUERY 1112 0.55 0.86 0.46 192 HK_RANDOM_REPLYTO 1110 0.38 0.86 0.25 193 TO_EQ_FM_DOM_HTML_IMG 1108 0.23 0.85 0.06 194 TR_MetaPhish_Combo_01 1106 1.08 0.85 1.15 195 TR_LOTS_OF_MONEY2 1100 0.43 0.85 0.31 196 T_MONEY_PERCENT 1100 0.43 0.85 0.31 197 XM_H_MailChimp 1096 0.27 0.85 0.11 198 HTML_COMMENT_SAVED_URL 1087 0.22 0.84 0.05 199 XM_B_COPY_HTML 1080 0.52 0.83 0.44 200 URIBL_BLACK 1072 0.19 0.83 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 430574 89.75 95.55 88.21 2 RELAYCOUNTRY_US 391851 79.98 78.87 80.28 3 DKIM_SIGNED 367013 76.15 79.79 75.19 4 XM_DK_Pass 360924 74.44 76.34 73.94 5 DKIM_VALID 346360 70.45 68.56 70.96 6 XM_B_Unicode 335537 70.02 74.85 68.74 7 DCC_CHECK_NEGATIVE 281668 49.76 19.84 57.70 8 DKIM_VALID_AU 258489 52.54 50.96 52.95 9 BAYES_50 253484 50.90 47.02 51.93 10 XMListUnsubscribeExists 250195 54.44 66.45 51.26 11 DCC_CHECK 195522 48.11 78.43 40.06 12 XM_B_Unicode3 193298 40.49 43.82 39.60 13 T_TM2_M_HEADER_IN_MSG 147425 27.95 19.49 30.20 14 HTML_FONT_LOW_CONTRAST 131780 28.59 34.61 27.00 15 DKIM_VALID_EF 130153 26.36 25.20 26.66 16 LOC_TINY_FONT_1 109948 25.35 36.01 22.52 17 BAYES_00 109169 18.24 2.73 22.36 18 XMSubLong 104062 22.85 28.64 21.32 19 FVGT_m_MULTI_ODD 102650 22.04 25.85 21.03 20 MIME_HTML_ONLY 99389 23.82 36.84 20.36 21 T_KAM_HTML_FONT_INVALID 86997 18.66 21.81 17.82 22 TR_XM_DK_Bayes 82763 13.83 2.06 16.96 23 TR_XM_DK_Bayes1 79220 13.15 1.54 16.23 24 ALL_TRUSTED 76414 12.71 1.63 15.65 25 TR_XM_DK_Bayes2 69142 11.45 1.24 14.16 26 RCVD_IN_MSPIKE_H2 66419 13.12 11.29 13.61 27 XM_Body_Dirty_Words 64998 14.85 20.62 13.32 28 XM_Multi_Part_URI 54382 12.58 17.98 11.14 29 RCVD_IN_MSPIKE_WL 50265 8.91 3.68 10.30 30 RCVD_IN_MSPIKE_H3 50265 8.91 3.68 10.30 31 XM_B_Unsub 50245 11.35 15.33 10.29 32 RCVD_IN_RP_SAFE 45206 7.81 2.35 9.26 33 XM_Evil_Numbers_Gen 44557 9.64 11.55 9.13 34 TooManyTo_001 42042 8.36 7.42 8.61 35 RCVD_IN_RP_CERTIFIED 41637 7.20 2.19 8.53 36 LotsOfNums_01 39699 8.34 9.10 8.13 37 LOTS_OF_MONEY 39240 8.97 12.46 8.04 38 HTML_IMAGE_RATIO_02 35590 8.42 12.69 7.29 39 XM_DKIMWhitelistDomains 35484 5.75 0.02 7.27 40 XM_B_Phish_Phrases 33438 7.15 8.29 6.85 41 FSL_BULK_SIG 31688 8.44 15.79 6.49 42 XM_DK_Undo_02 31117 11.77 32.10 6.37 43 XM_H_Long_From01 30877 6.45 6.93 6.33 44 RELAYCOUNTRY_META 30524 9.51 21.77 6.25 45 BAYES_40 30329 5.84 4.44 6.21 46 XM_SendGrid 29023 5.77 5.09 5.95 47 MIME_QP_LONG_LINE 28211 5.81 5.94 5.78 48 RCVD_IN_IADB_LISTED 26526 4.80 2.41 5.43 49 BAYES_20 24878 4.68 3.10 5.10 50 XM_PDF 24028 4.05 0.76 4.92 51 T_TooManySym_01 23660 4.50 3.18 4.85 52 RCVD_IN_IADB_SPF 23001 4.20 2.28 4.71 53 HTML_IMAGE_RATIO_04 22761 5.06 6.58 4.66 54 XMStrtUSub 21738 4.35 3.94 4.45 55 BAYES_60 21720 5.03 7.19 4.45 56 BOTNET_IPINHOSTNAME 20957 6.28 13.74 4.29 57 DKIM_INVALID 20653 5.70 11.23 4.23 58 RCVD_IN_IADB_SENDERID 20047 3.71 2.23 4.11 59 MPART_ALT_DIFF 19824 5.03 8.69 4.06 60 RCVD_IN_IADB_DK 19741 3.66 2.23 4.04 61 XMSexyCombo_05 19549 6.04 13.72 4.00 62 XMSubMetaSx_00 18753 5.22 10.42 3.84 63 IN_ZIMBRA_NJ_WHITELIST 18365 2.98 0.01 3.76 64 XMNumbers 18088 4.65 8.20 3.71 65 FROM_EXCESS_BASE64 17777 3.65 3.68 3.64 66 T_REMOTE_IMAGE 17657 4.56 8.09 3.62 67 HTML_IMAGE_RATIO_06 17473 3.58 3.58 3.58 68 RCVD_IN_IADB_VOUCHED 17191 2.90 0.57 3.52 69 BAYES_05 16335 2.99 1.67 3.35 70 TR_XM_DK_SendGrid 16009 3.08 2.31 3.28 71 BAYES_99 15964 7.04 21.22 3.27 72 XM_UncommonTLD01 15175 5.14 12.79 3.11 73 BAYES_999 13265 5.57 16.29 2.72 74 MAILING_LIST_MULTI 12853 2.42 1.62 2.63 75 BOUNCE_MESSAGE 12686 2.16 0.50 2.60 76 ANY_BOUNCE_MESSAGE 12686 2.16 0.50 2.60 77 XM_B_SpammyTLD 12679 3.10 4.99 2.60 78 HTML_IMAGE_RATIO_08 12479 2.67 3.09 2.56 79 MIME_HTML_ONLY_MULTI 12284 2.82 3.98 2.52 80 TM2_M_URI_OPT_OUT 11912 2.77 3.99 2.44 81 T_TooManySym_02 11810 2.14 1.10 2.42 82 MIME_HTML_MOSTLY 11786 3.08 5.59 2.41 83 XM_B_Unsub2 11584 2.55 3.20 2.37 84 XM_CamelCaseFrm001 11354 2.82 4.67 2.33 85 HTML_MIME_NO_HTML_TAG 11285 3.13 6.22 2.31 86 RCVD_IN_IADB_OPTIN 11233 1.91 0.42 2.30 87 TooManyTo_002 11144 1.95 0.68 2.28 88 BOTNET 11107 5.68 18.52 2.28 89 UNPARSEABLE_RELAY 10651 1.98 1.24 2.18 90 BAYES_80 10026 3.39 8.40 2.05 91 TR_DCC_Bayes_99 9754 4.83 15.49 2.00 92 RELAYCOUNTRY_CA 9223 2.40 4.32 1.89 93 UNTRUSTED_Relay 9058 4.41 14.02 1.86 94 XM_SPF_SoftFail 8844 2.39 4.56 1.81 95 HELO_NODOT 8827 1.56 0.64 1.81 96 HELO_NO_DOMAIN 8819 1.56 0.61 1.81 97 KHOP_HELO_FCRDNS 8769 2.52 5.25 1.80 98 XMDiploma_00 8175 1.89 2.69 1.67 99 T_XMDrugObfuBody_08 7763 1.91 3.09 1.59 100 IN_HORDE_ADDRESS_BOOK 7673 1.25 0.05 1.57 101 XM_DK_Undo_01 7633 1.62 1.83 1.56 102 TVD_RCVD_IP 7570 1.33 0.51 1.55 103 INVALID_MSGID 7512 1.44 1.05 1.54 104 TooManyTo_003 7446 1.31 0.51 1.53 105 T_XMDrugObfuBody_14 7409 1.63 2.03 1.52 106 NO_DNS_FOR_FROM 7401 2.71 7.19 1.52 107 XMCapTrack 7031 1.24 0.47 1.44 108 TR_Symld_Words 7014 1.44 1.46 1.44 109 TO_MALFORMED 6938 1.12 0.00 1.42 110 XM_OfRef6 6867 1.62 2.41 1.41 111 XM_H_Trusted_IP 6727 1.09 0.00 1.38 112 TR_MSPIKEBAYES00 6700 1.09 0.01 1.37 113 RELAYCOUNTRY_GB 6649 1.51 2.07 1.36 114 SUBJ_ALL_CAPS 6644 1.48 1.95 1.36 115 TM2_M_VERY_LONG_WORD 6208 1.42 1.96 1.27 116 CK_HELO_DYNAMIC_SPLIT_IP 6107 1.02 0.15 1.25 117 HELO_DYNAMIC_IPADDR2 6107 1.00 0.03 1.25 118 URI_HEX 6056 1.52 2.56 1.24 119 URI_TRY_3LD 6045 1.26 1.33 1.24 120 XMGappySubj_01 5912 0.99 0.16 1.21 121 XM_GoogleGroups 5851 1.04 0.42 1.20 122 BAYES_95 5831 1.80 4.06 1.19 123 USER_IN_DEF_DKIM_WL 5822 0.95 0.05 1.19 124 T_FILL_THIS_FORM_SHORT 5632 1.11 0.93 1.15 125 TR_MetaPhish_Combo_01 5593 1.08 0.85 1.15 126 DKIM_ADSP_CUSTOM_MED 5562 1.13 1.07 1.14 127 TR_XM_PHPDW 5543 1.43 2.52 1.14 128 XMSubMetaI_00 5516 1.22 1.55 1.13 129 PDS_OTHER_BAD_TLD 5508 1.80 4.33 1.13 130 TR_XM_PHPForged 5455 1.40 2.49 1.12 131 TooManyTo_004 5451 0.97 0.43 1.12 132 TR_XM_FormFill2 5446 1.40 2.48 1.12 133 XMGenDplmaNmb 5444 1.31 2.07 1.12 134 XM_H_PHPOS 5418 1.39 2.47 1.11 135 XM_H_Long_From02 5317 1.05 0.90 1.09 136 XMBdyGiftCard01 5257 1.11 1.24 1.08 137 RCVD_IN_BL_SPAMCOP_NET 4867 1.64 4.04 1.00 138 T_XMDrugObfuBody_00 4745 1.05 1.36 0.97 139 XM_UB50 4649 2.29 7.30 0.95 140 XMStockSpam_06 4638 1.19 2.07 0.95 141 TooManyTo_005 4557 0.81 0.35 0.93 142 XMNoVowels 4347 0.87 0.78 0.89 143 XMHTML_After_End 4116 1.03 1.73 0.84 144 NML_ADSP_CUSTOM_MED 3980 0.83 0.88 0.82 145 T_Symld_Words_02 3872 0.89 1.26 0.79 146 TO_NO_BRKTS_HTML_ONLY 3835 0.67 0.24 0.79 147 XMSubNoVowel 3767 0.70 0.41 0.77 148 T_XMHurry_00 3654 0.97 1.80 0.75 149 RCVD_IN_MSPIKE_BL 3641 1.27 3.25 0.75 150 HTML_FONT_FACE_BAD 3572 0.72 0.67 0.73 151 XM_ProductURIs 3422 0.78 1.07 0.70 152 XMBody_95 3419 0.58 0.11 0.70 153 T_OBFU_PDF_ATTACH 3411 0.59 0.17 0.70 154 XMBody_17 3393 0.98 2.04 0.70 155 HTTPS_HTTP_MISMATCH 3377 0.76 1.00 0.69 156 SpammyFromTLD_01 3294 0.99 2.16 0.67 157 XMHTMLBadTable_001 2963 0.68 0.95 0.61 158 XMMoneyMeta_00 2954 0.78 1.44 0.61 159 XM_SPF_Unknown 2947 0.64 0.76 0.60 160 FORGED_GMAIL_RCVD 2946 0.67 0.93 0.60 161 T_TooManySym_03 2877 0.55 0.38 0.59 162 FILL_THIS_FORM 2806 0.51 0.28 0.57 163 XM_DIRTYINTL 2805 1.10 3.09 0.57 164 XM_ShortIntro_01 2771 0.55 0.49 0.57 165 MISSING_HEADERS 2760 0.55 0.50 0.57 166 FROM_GOV_SPOOF 2709 0.49 0.24 0.55 167 XMBrknScrpt_02 2681 0.65 1.01 0.55 168 TM2_M_BODY_EMPTY 2677 0.46 0.11 0.55 169 RELAYCOUNTRY_DE 2657 0.77 1.63 0.54 170 XM_B_REG_HTML 2606 0.54 0.56 0.53 171 XM_H_PHPMailer 2567 0.69 1.29 0.53 172 RELAYCOUNTRY_AU 2528 0.52 0.51 0.52 173 FROM_GOV_DKIM_AU 2492 0.44 0.16 0.51 174 XMSubMetaSxObfu_03 2455 0.67 1.28 0.50 175 HTML_TAG_BALANCE_BODY 2446 0.56 0.77 0.50 176 USER_IN_WHITELIST 2391 0.39 0.00 0.49 177 SHORT_HELO_AND_INLINE_IMAGE 2320 0.39 0.05 0.48 178 XMSexyCombo_01 2302 0.99 2.94 0.47 179 PLING_QUERY 2268 0.55 0.86 0.46 180 FILL_THIS_FORM_LONG 2256 0.40 0.15 0.46 181 XMGappySubj_02 2231 0.38 0.07 0.46 182 XMPhish08 2191 0.64 1.35 0.45 183 AC_DIV_BONANZA 2170 0.37 0.11 0.44 184 XM_B_COPY_HTML 2154 0.52 0.83 0.44 185 HTML_IMAGE_ONLY_28 2101 0.47 0.62 0.43 186 XMPhish30 2086 0.52 0.87 0.43 187 HTML_IMAGE_ONLY_20 2083 0.40 0.32 0.43 188 T_FILL_THIS_FORM_LOAN 2036 0.35 0.10 0.42 189 HTML_IMAGE_ONLY_32 2031 0.38 0.25 0.42 190 XMLngstWrd_00 2018 0.39 0.32 0.41 191 THIS_AD 2017 0.51 0.89 0.41 192 RCVD_IN_SORBS_DUL 2005 0.36 0.18 0.41 193 RCVD_IN_MSPIKE_L3 1973 0.75 2.04 0.40 194 XM_Body_Obfu01 1932 0.39 0.37 0.40 195 XM_Combo_Sbj 1916 0.41 0.48 0.39 196 DKIM_ADSP_NXDOMAIN 1879 0.61 1.48 0.38 197 XMDateMe_00 1873 0.40 0.47 0.38 198 BASE64_LENGTH_79_INF 1863 0.37 0.33 0.38 199 XMPhish14 1851 0.57 1.28 0.38 200 XMLngstWrd_01 1819 0.36 0.30 0.37 ----------------------------------------------------------------------