Email: 343209 Autolearn: 0 AvgScore: 2.09 AvgScanTime: 1.83 sec Spam: 89547 Autolearn: 0 AvgScore: 12.62 AvgScanTime: 2.71 sec Ham: 253662 Autolearn: 0 AvgScore: -1.63 AvgScanTime: 1.52 sec Time Spent Running SA: 174.51 hours Time Spent Processing Spam: 67.53 hours Time Spent Processing Ham: 106.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 83636 86.99 93.40 84.73 2 RELAYCOUNTRY_US 71495 80.62 79.84 80.90 3 DKIM_SIGNED 70457 79.02 78.68 79.14 4 XM_DK_Pass 68148 77.67 76.10 78.23 5 DCC_CHECK 67518 54.46 75.40 47.06 6 XM_B_Unicode 66465 72.42 74.22 71.78 7 DKIM_VALID 60637 73.25 67.72 75.20 8 XMListUnsubscribeExists 59592 58.63 66.55 55.83 9 DKIM_VALID_AU 44856 57.78 50.09 60.49 10 XM_B_Unicode3 41599 45.37 46.45 44.99 11 BAYES_50 41429 49.93 46.27 51.22 12 MIME_HTML_ONLY 33281 27.89 37.17 24.62 13 HTML_FONT_LOW_CONTRAST 32405 32.10 36.19 30.65 14 URIBL_RHS_DOB 30322 21.27 33.86 16.82 15 XM_DK_Undo_02 30087 14.78 33.60 8.14 16 LOC_TINY_FONT_1 28012 28.39 31.28 27.37 17 FVGT_m_MULTI_ODD 22709 22.41 25.36 21.37 18 DKIM_VALID_EF 22241 28.00 24.84 29.11 19 XMSubLong 22122 22.21 24.70 21.33 20 DCC_CHECK_NEGATIVE 20952 44.26 23.40 51.63 21 XM_Body_Dirty_Words 20484 16.62 22.88 14.42 22 BAYES_99 19742 8.92 22.05 4.29 23 T_KAM_HTML_FONT_INVALID 17436 17.85 19.47 17.28 24 T_TM2_M_HEADER_IN_MSG 17385 21.56 19.41 22.31 25 BOTNET 16796 6.77 18.76 2.54 26 XM_Multi_Part_URI 16487 15.27 18.41 14.16 27 RELAYCOUNTRY_META 15813 8.54 17.66 5.32 28 XM_UncommonTLD01 15292 7.24 17.08 3.77 29 BAYES_999 15123 7.07 16.89 3.60 30 TR_DCC_Bayes_99 14352 5.77 16.03 2.16 31 XM_B_Unsub 13593 11.61 15.18 10.36 32 FSL_BULK_SIG 13363 10.77 14.92 9.30 33 HTML_IMAGE_RATIO_02 12497 10.11 13.96 8.76 34 XMSexyCombo_05 11964 7.39 13.36 5.28 35 BOTNET_IPINHOSTNAME 11511 7.59 12.85 5.74 36 LOTS_OF_MONEY 11004 11.15 12.29 10.74 37 UNTRUSTED_Relay 10343 4.15 11.55 1.53 38 DKIM_INVALID 9820 5.77 10.97 3.93 39 XM_Evil_Numbers_Gen 8522 9.66 9.52 9.71 40 XM_H_Long_From01 7876 6.64 8.80 5.89 41 XMSubMetaSx_00 7787 5.52 8.70 4.40 42 RCVD_IN_MSPIKE_H2 7532 10.94 8.41 11.83 43 LotsOfNums_01 7450 7.57 8.32 7.30 44 TooManyTo_001 7411 6.43 8.28 5.78 45 MPART_ALT_DIFF 6900 5.25 7.71 4.39 46 BAYES_80 6875 3.85 7.68 2.50 47 BAYES_60 6766 5.93 7.56 5.36 48 NO_DNS_FOR_FROM 6560 3.56 7.33 2.24 49 XM_B_Phish_Phrases 6211 6.93 6.94 6.93 50 HTML_IMAGE_RATIO_04 6047 6.06 6.75 5.82 51 T_REMOTE_IMAGE 6017 4.38 6.72 3.56 52 KHOP_HELO_FCRDNS 5917 2.67 6.61 1.28 53 SpammyFromTLD_02 5655 1.79 6.32 0.20 54 XM_B_SpammyTLD 5586 3.64 6.24 2.73 55 XM_CamelCaseFrm001 5278 3.25 5.89 2.31 56 XM_UB50 5223 2.20 5.83 0.92 57 TR_Mismatch_TLD_02 5122 1.54 5.72 0.06 58 XM_SendGrid 4922 6.53 5.50 6.90 59 BODY_URI_ONLY 4918 1.46 5.49 0.04 60 XM_SPF_SoftFail 4794 2.33 5.35 1.26 61 XMNumbers 4730 4.72 5.28 4.52 62 RDNS_DYNAMIC 4599 1.69 5.14 0.48 63 RCVD_IN_BL_SPAMCOP_NET 4562 2.42 5.09 1.48 64 MIME_HTML_MOSTLY 4554 2.81 5.09 2.00 65 FROM_EXCESS_BASE64 4529 4.66 5.06 4.52 66 HTML_MIME_NO_HTML_TAG 4276 2.96 4.78 2.32 67 HTML_IMAGE_ONLY_08 4218 1.29 4.71 0.08 68 BAYES_95 4160 2.33 4.65 1.51 69 MIME_QP_LONG_LINE 4156 4.29 4.64 4.16 70 FROM_MISSP_REPLYTO 4083 1.20 4.56 0.01 71 RELAYCOUNTRY_CA 3961 2.85 4.42 2.30 72 PDS_OTHER_BAD_TLD 3693 1.69 4.12 0.84 73 URI_HEX 3603 1.85 4.02 1.09 74 RCVD_IN_RP_RNBL 3550 1.18 3.96 0.20 75 XMStrtUSub 3409 4.52 3.81 4.77 76 RCVD_IN_MSPIKE_BL 3309 1.66 3.70 0.94 77 TM2_M_URI_OPT_OUT 3261 3.04 3.64 2.82 78 TR_XM_PHPDW 3247 1.35 3.63 0.54 79 BAYES_40 3204 4.52 3.58 4.86 80 FROM_MISSP_DYNIP 3095 0.90 3.46 0.00 81 BOTNET_NORDNS 3010 0.90 3.36 0.04 82 ALL_TRUSTED 2932 11.99 3.27 15.06 83 FROM_SUSPICIOUS_NTLD 2871 0.86 3.21 0.04 84 FROM_SUSPICIOUS_NTLD_FP 2838 0.85 3.17 0.04 85 RCVD_IN_MSPIKE_H3 2829 8.46 3.16 10.34 86 RCVD_IN_MSPIKE_WL 2829 8.46 3.16 10.34 87 HTML_IMAGE_RATIO_06 2827 3.61 3.16 3.76 88 BAYES_00 2811 17.98 3.14 23.22 89 BAYES_20 2735 3.77 3.05 4.02 90 MIME_HTML_ONLY_MULTI 2684 2.97 3.00 2.96 91 T_TooManySym_01 2676 5.84 2.99 6.84 92 XM_BadFromFormat 2631 0.85 2.94 0.12 93 DIET_1 2587 1.18 2.89 0.57 94 XM_H_PHPMailer 2505 1.09 2.80 0.49 95 XM_DIRTYINTL 2501 1.13 2.79 0.54 96 XMSexyCombo_01 2393 1.23 2.67 0.73 97 RELAYCOUNTRY_FR 2380 0.99 2.66 0.40 98 TR_XM_INV_DKIM 2371 0.87 2.65 0.24 99 NORDNS_LOW_CONTRAST 2360 0.69 2.64 0.00 100 DATE_IN_PAST_03_06 2345 0.74 2.62 0.07 101 TR_XM_PHPForged 2330 1.06 2.60 0.51 102 TR_XM_FormFill2 2322 1.05 2.59 0.51 103 XM_H_PHPOS 2313 1.05 2.58 0.50 104 TR_XM_DK_Bayes 2285 14.87 2.55 19.22 105 HTML_IMAGE_RATIO_08 2277 2.68 2.54 2.72 106 TR_XM_DK_SendGrid 2215 3.73 2.47 4.18 107 XM_B_Unsub2 2213 1.49 2.47 1.14 108 RCVD_IN_RP_SAFE 2157 10.29 2.41 13.07 109 HTML_TAG_BALANCE_CENTER 2143 0.71 2.39 0.11 110 XMDiploma_00 2093 1.37 2.34 1.03 111 RCVD_IN_IADB_LISTED 2025 3.44 2.26 3.85 112 DATE_IN_PAST_06_12 1991 0.62 2.22 0.05 113 TM2_M_VERY_LONG_WORD 1982 1.63 2.21 1.42 114 XMHTML_After_End 1960 0.92 2.19 0.47 115 RCVD_IN_RP_CERTIFIED 1953 9.47 2.18 12.04 116 T_XMDrugObfuBody_08 1922 1.70 2.15 1.54 117 RCVD_IN_PSBL 1901 0.61 2.12 0.08 118 SpammyFromTLD_01 1868 0.81 2.09 0.36 119 RCVD_IN_IADB_SPF 1853 2.94 2.07 3.25 120 XMBdyGiftCard01 1852 1.81 2.07 1.72 121 RELAYCOUNTRY_GB 1852 1.15 2.07 0.82 122 RCVD_IN_IADB_SENDERID 1817 2.59 2.03 2.78 123 XMBody_17 1804 1.13 2.01 0.81 124 RCVD_IN_IADB_DK 1801 2.50 2.01 2.67 125 TR_Symld_Words 1773 1.77 1.98 1.70 126 XM_OfRef6 1756 1.56 1.96 1.42 127 URIBL_SBL_A 1744 0.64 1.95 0.18 128 T_XMDrugObfuBody_14 1738 1.82 1.94 1.77 129 TR_XM_DK_Bayes1 1729 14.17 1.93 18.49 130 HTML_SHORT_LINK_IMG_1 1703 0.51 1.90 0.02 131 XM_UB99 1690 0.50 1.89 0.01 132 XM_H_PHPOS_M 1653 0.66 1.85 0.24 133 BAYES_05 1638 2.62 1.83 2.90 134 TR_MetaPhish_Combo_01 1620 1.03 1.81 0.75 135 XM_URI_RBL 1583 0.72 1.77 0.34 136 TR_XM_DK_Bayes2 1534 13.35 1.71 17.46 137 HDRS_LCASE_IMGONLY 1522 0.45 1.70 0.01 138 XM_H_TOP 1471 0.43 1.64 0.00 139 URI_TRY_3LD 1435 2.02 1.60 2.17 140 XMCapTrack 1427 0.72 1.59 0.42 141 XMGenDplmaNmb 1400 0.84 1.56 0.58 142 RCVD_IN_MSPIKE_L3 1361 0.87 1.52 0.64 143 TR_Mismatch_TLD_01 1342 0.57 1.50 0.24 144 NO_FM_NAME_IP_HOSTN 1338 0.39 1.49 0.00 145 XMStockSpam_06 1276 1.04 1.42 0.91 146 DKIM_ADSP_CUSTOM_MED 1274 0.99 1.42 0.83 147 XM_UB999 1271 0.37 1.42 0.01 148 XMBrknScrpt_02 1267 0.98 1.41 0.83 149 SUBJ_ALL_CAPS 1258 1.43 1.40 1.44 150 XMSexyCombo_04 1258 0.50 1.40 0.18 151 TR_LOTS_OF_MONEY3 1240 0.71 1.38 0.47 152 BASE64_LENGTH_79_INF 1236 0.65 1.38 0.40 153 XMPhish14 1178 0.55 1.32 0.28 154 DKIM_ADSP_NXDOMAIN 1172 0.66 1.31 0.42 155 RCVD_IN_MSPIKE_L5 1159 0.37 1.29 0.05 156 TR_M_TOP_BAYES 1158 0.34 1.29 0.00 157 T_XMHurry_00 1151 0.86 1.29 0.71 158 TM2_M_A_HREF_HREF 1132 0.80 1.26 0.64 159 FORGED_GMAIL_RCVD 1116 0.62 1.25 0.40 160 XM_UB60 1099 0.37 1.23 0.06 161 LongTLD 1098 0.41 1.23 0.12 162 MAILING_LIST_MULTI 1089 1.83 1.22 2.04 163 T_XMDrugObfuBody_00 1063 0.94 1.19 0.86 164 XM_DK_Undo_01 1059 1.64 1.18 1.79 165 RELAYCOUNTRY_IN 1021 0.34 1.14 0.05 166 XMSlimDrugH 1015 0.66 1.13 0.49 167 NML_ADSP_CUSTOM_MED 1001 0.74 1.12 0.61 168 XM_SPF_Unknown 989 0.59 1.10 0.40 169 URIBL_ABUSE_SURBL 986 0.33 1.10 0.06 170 PDS_BTC_ID 947 0.28 1.06 0.01 171 XMSubNoVowel 936 1.14 1.05 1.17 172 REPLYTO_WITHOUT_TO_CC 922 0.65 1.03 0.51 173 XM_B_Crypto 921 0.29 1.03 0.03 174 XM_ProductURIs 914 0.86 1.02 0.81 175 XM_H_Long_From02 894 1.18 1.00 1.25 176 MISSING_HEADERS 892 0.77 1.00 0.69 177 T_FILL_THIS_FORM_SHORT 890 1.08 0.99 1.12 178 T_TooManySym_02 879 2.82 0.98 3.46 179 BITCOIN_EXTORT_01 876 0.26 0.98 0.00 180 MPART_ALT_DIFF_COUNT 876 0.53 0.98 0.37 181 XM_B_scareware 865 0.25 0.97 0.00 182 BITCOIN_SPAM_09 865 0.25 0.97 0.00 183 RELAYCOUNTRY_DE 841 0.45 0.94 0.28 184 XMSubMetaI_00 835 0.57 0.93 0.45 185 UNPARSEABLE_RELAY 834 3.14 0.93 3.91 186 TR_XM_MaxBayes 832 0.25 0.93 0.01 187 SUBJ_DOLLARS 830 0.50 0.93 0.35 188 XMBody_78 813 0.55 0.91 0.42 189 REMOVE_BEFORE_LINK 800 0.53 0.89 0.40 190 RCVD_IN_MSPIKE_L4 789 0.41 0.88 0.25 191 DATE_IN_PAST_12_24 770 0.26 0.86 0.05 192 XM_B_COPY_HTML 767 0.58 0.86 0.48 193 TR_XM_RelayPhish 759 0.32 0.85 0.13 194 URIBL_BLACK 748 0.23 0.84 0.02 195 URIBL_DBL_ABUSE_REDIR 734 0.45 0.82 0.32 196 XMPhish30 733 0.58 0.82 0.49 197 RELAYCOUNTRY_PL 730 0.23 0.82 0.02 198 DATE_IN_PAST_24_48 728 0.23 0.81 0.02 199 TooManyTo_002 722 1.07 0.81 1.16 200 XMHTMLBadTable_001 715 0.62 0.80 0.55 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 214921 86.99 93.40 84.73 2 RELAYCOUNTRY_US 205206 80.62 79.84 80.90 3 DKIM_SIGNED 200736 79.02 78.68 79.14 4 XM_DK_Pass 198432 77.67 76.10 78.23 5 DKIM_VALID 190757 73.25 67.72 75.20 6 XM_B_Unicode 182082 72.42 74.22 71.78 7 DKIM_VALID_AU 153436 57.78 50.09 60.49 8 XMListUnsubscribeExists 141627 58.63 66.55 55.83 9 DCC_CHECK_NEGATIVE 130956 44.26 23.40 51.63 10 BAYES_50 129926 49.93 46.27 51.22 11 DCC_CHECK 119382 54.46 75.40 47.06 12 XM_B_Unicode3 114122 45.37 46.45 44.99 13 HTML_FONT_LOW_CONTRAST 77753 32.10 36.19 30.65 14 DKIM_VALID_EF 73843 28.00 24.84 29.11 15 LOC_TINY_FONT_1 69436 28.39 31.28 27.37 16 MIME_HTML_ONLY 62440 27.89 37.17 24.62 17 BAYES_00 58910 17.98 3.14 23.22 18 T_TM2_M_HEADER_IN_MSG 56594 21.56 19.41 22.31 19 FVGT_m_MULTI_ODD 54214 22.41 25.36 21.37 20 XMSubLong 54107 22.21 24.70 21.33 21 TR_XM_DK_Bayes 48752 14.87 2.55 19.22 22 TR_XM_DK_Bayes1 46902 14.17 1.93 18.49 23 TR_XM_DK_Bayes2 44286 13.35 1.71 17.46 24 T_KAM_HTML_FONT_INVALID 43835 17.85 19.47 17.28 25 URIBL_RHS_DOB 42666 21.27 33.86 16.82 26 ALL_TRUSTED 38204 11.99 3.27 15.06 27 XM_Body_Dirty_Words 36571 16.62 22.88 14.42 28 XM_Multi_Part_URI 35916 15.27 18.41 14.16 29 RCVD_IN_RP_SAFE 33143 10.29 2.41 13.07 30 RCVD_IN_RP_CERTIFIED 30550 9.47 2.18 12.04 31 RCVD_IN_MSPIKE_H2 30016 10.94 8.41 11.83 32 XM_DKIMWhitelistDomains 28204 8.23 0.04 11.12 33 LOTS_OF_MONEY 27253 11.15 12.29 10.74 34 XM_B_Unsub 26267 11.61 15.18 10.36 35 RCVD_IN_MSPIKE_WL 26220 8.46 3.16 10.34 36 RCVD_IN_MSPIKE_H3 26220 8.46 3.16 10.34 37 XM_Evil_Numbers_Gen 24624 9.66 9.52 9.71 38 FSL_BULK_SIG 23592 10.77 14.92 9.30 39 HTML_IMAGE_RATIO_02 22217 10.11 13.96 8.76 40 XM_DK_Undo_02 20641 14.78 33.60 8.14 41 LotsOfNums_01 18522 7.57 8.32 7.30 42 XM_B_Phish_Phrases 17587 6.93 6.94 6.93 43 XM_SendGrid 17492 6.53 5.50 6.90 44 T_TooManySym_01 17361 5.84 2.99 6.84 45 XM_H_Long_From01 14930 6.64 8.80 5.89 46 HTML_IMAGE_RATIO_04 14760 6.06 6.75 5.82 47 TooManyTo_001 14671 6.43 8.28 5.78 48 BOTNET_IPINHOSTNAME 14552 7.59 12.85 5.74 49 BAYES_60 13592 5.93 7.56 5.36 50 RELAYCOUNTRY_META 13507 8.54 17.66 5.32 51 XMSexyCombo_05 13392 7.39 13.36 5.28 52 BAYES_40 12317 4.52 3.58 4.86 53 XMStrtUSub 12091 4.52 3.81 4.77 54 FROM_EXCESS_BASE64 11475 4.66 5.06 4.52 55 XMNumbers 11475 4.72 5.28 4.52 56 XMSubMetaSx_00 11157 5.52 8.70 4.40 57 MPART_ALT_DIFF 11125 5.25 7.71 4.39 58 BAYES_99 10882 8.92 22.05 4.29 59 TR_XM_DK_SendGrid 10599 3.73 2.47 4.18 60 MIME_QP_LONG_LINE 10556 4.29 4.64 4.16 61 BAYES_20 10190 3.77 3.05 4.02 62 DKIM_INVALID 9979 5.77 10.97 3.93 63 UNPARSEABLE_RELAY 9929 3.14 0.93 3.91 64 RCVD_IN_IADB_LISTED 9778 3.44 2.26 3.85 65 XM_UncommonTLD01 9560 7.24 17.08 3.77 66 HTML_IMAGE_RATIO_06 9549 3.61 3.16 3.76 67 BAYES_999 9131 7.07 16.89 3.60 68 T_REMOTE_IMAGE 9029 4.38 6.72 3.56 69 T_TooManySym_02 8783 2.82 0.98 3.46 70 IN_ZIMBRA_NJ_WHITELIST 8772 2.56 0.01 3.46 71 RCVD_IN_IADB_SPF 8242 2.94 2.07 3.25 72 TVD_RCVD_IP 7586 2.33 0.46 2.99 73 BOUNCE_MESSAGE 7567 2.29 0.33 2.98 74 ANY_BOUNCE_MESSAGE 7567 2.29 0.34 2.98 75 MIME_HTML_ONLY_MULTI 7520 2.97 3.00 2.96 76 BAYES_05 7364 2.62 1.83 2.90 77 XM_PDF 7350 2.23 0.34 2.90 78 INVALID_MSGID 7251 2.19 0.29 2.86 79 TM2_M_URI_OPT_OUT 7164 3.04 3.64 2.82 80 RCVD_IN_IADB_VOUCHED 7149 2.24 0.60 2.82 81 RCVD_IN_IADB_SENDERID 7058 2.59 2.03 2.78 82 TO_MALFORMED 6929 2.02 0.01 2.73 83 XM_B_SpammyTLD 6914 3.64 6.24 2.73 84 HTML_IMAGE_RATIO_08 6907 2.68 2.54 2.72 85 RCVD_IN_IADB_DK 6773 2.50 2.01 2.67 86 BOTNET 6431 6.77 18.76 2.54 87 BAYES_80 6335 3.85 7.68 2.50 88 CK_HELO_DYNAMIC_SPLIT_IP 6280 1.88 0.18 2.48 89 HELO_DYNAMIC_IPADDR2 6278 1.84 0.06 2.47 90 HTML_MIME_NO_HTML_TAG 5886 2.96 4.78 2.32 91 XM_CamelCaseFrm001 5867 3.25 5.89 2.31 92 RELAYCOUNTRY_CA 5823 2.85 4.42 2.30 93 NO_DNS_FOR_FROM 5673 3.56 7.33 2.24 94 URI_TRY_3LD 5505 2.02 1.60 2.17 95 TR_DCC_Bayes_99 5468 5.77 16.03 2.16 96 MAILING_LIST_MULTI 5185 1.83 1.22 2.04 97 MIME_HTML_MOSTLY 5074 2.81 5.09 2.00 98 RCVD_IN_IADB_OPTIN 4844 1.52 0.40 1.91 99 IN_HORDE_ADDRESS_BOOK 4804 1.41 0.03 1.89 100 XM_DK_Undo_01 4553 1.64 1.18 1.79 101 XM_H_Trusted_IP 4526 1.32 0.00 1.78 102 T_XMDrugObfuBody_14 4493 1.82 1.94 1.77 103 XMBdyGiftCard01 4371 1.81 2.07 1.72 104 USER_IN_DEF_DKIM_WL 4369 1.27 0.00 1.72 105 TR_Symld_Words 4311 1.77 1.98 1.70 106 T_XMDrugObfuBody_08 3899 1.70 2.15 1.54 107 UNTRUSTED_Relay 3889 4.15 11.55 1.53 108 BAYES_95 3840 2.33 4.65 1.51 109 RCVD_IN_BL_SPAMCOP_NET 3747 2.42 5.09 1.48 110 SUBJ_ALL_CAPS 3643 1.43 1.40 1.44 111 TM2_M_VERY_LONG_WORD 3607 1.63 2.21 1.42 112 XM_OfRef6 3598 1.56 1.96 1.42 113 XMGappySubj_01 3306 1.02 0.22 1.30 114 KHOP_HELO_FCRDNS 3248 2.67 6.61 1.28 115 XM_SPF_SoftFail 3199 2.33 5.35 1.26 116 XM_H_Long_From02 3162 1.18 1.00 1.25 117 XM_B_REG_HTML 3136 1.06 0.58 1.24 118 XM_GoogleGroups 3090 1.00 0.36 1.22 119 XMSubNoVowel 2976 1.14 1.05 1.17 120 TR_MSPIKEBAYES00 2964 0.86 0.00 1.17 121 TooManyTo_002 2940 1.07 0.81 1.16 122 XM_B_Unsub2 2904 1.49 2.47 1.14 123 T_FILL_THIS_FORM_SHORT 2830 1.08 0.99 1.12 124 URI_HEX 2757 1.85 4.02 1.09 125 XMBody_95 2680 0.80 0.08 1.06 126 XMDiploma_00 2611 1.37 2.34 1.03 127 USER_IN_WHITELIST 2492 0.73 0.00 0.98 128 RCVD_IN_MSPIKE_BL 2382 1.66 3.70 0.94 129 XM_UB50 2341 2.20 5.83 0.92 130 XMStockSpam_06 2303 1.04 1.42 0.91 131 T_XMDrugObfuBody_00 2170 0.94 1.19 0.86 132 PDS_OTHER_BAD_TLD 2123 1.69 4.12 0.84 133 DKIM_ADSP_CUSTOM_MED 2112 0.99 1.42 0.83 134 XMBrknScrpt_02 2100 0.98 1.41 0.83 135 RELAYCOUNTRY_GB 2079 1.15 2.07 0.82 136 XMBody_17 2067 1.13 2.01 0.81 137 XM_ProductURIs 2053 0.86 1.02 0.81 138 TooManyTo_003 2037 0.78 0.70 0.80 139 HTML_FONT_FACE_BAD 2013 0.78 0.73 0.79 140 TR_MetaPhish_Combo_01 1914 1.03 1.81 0.75 141 XMSexyCombo_01 1843 1.23 2.67 0.73 142 T_XMHurry_00 1808 0.86 1.29 0.71 143 XM_D_tchamptons_WL 1778 0.52 0.00 0.70 144 MISSING_HEADERS 1756 0.77 1.00 0.69 145 T_TooManySym_03 1756 0.55 0.15 0.69 146 FILL_THIS_FORM 1706 0.59 0.35 0.67 147 XMNoVowels 1664 0.66 0.67 0.66 148 TooManyTo_004 1652 0.65 0.64 0.65 149 HELO_NODOT 1650 0.61 0.48 0.65 150 HELO_NO_DOMAIN 1638 0.59 0.44 0.65 151 RCVD_IN_MSPIKE_L3 1632 0.87 1.52 0.64 152 TM2_M_A_HREF_HREF 1623 0.80 1.26 0.64 153 NML_ADSP_CUSTOM_MED 1537 0.74 1.12 0.61 154 XM_Body_Obfu01 1511 0.56 0.47 0.60 155 XM_RXBody 1504 0.57 0.50 0.59 156 XMGenDplmaNmb 1477 0.84 1.56 0.58 157 TooManyTo_005 1458 0.57 0.57 0.57 158 XMSubMetaSxObfu_02 1453 0.49 0.25 0.57 159 XMPhish08 1451 0.60 0.69 0.57 160 DIET_1 1447 1.18 2.89 0.57 161 HTML_TAG_BALANCE_BODY 1429 0.59 0.67 0.56 162 FILL_THIS_FORM_LONG 1417 0.49 0.30 0.56 163 T_FILL_THIS_FORM_LOAN 1403 0.43 0.07 0.55 164 XMHTMLBadTable_001 1399 0.62 0.80 0.55 165 PLING_QUERY 1375 0.54 0.55 0.54 166 TR_XM_PHPDW 1373 1.35 3.63 0.54 167 XM_DIRTYINTL 1370 1.13 2.79 0.54 168 XMBSHREFv2 1369 0.46 0.23 0.54 169 REPLYTO_WITHOUT_TO_CC 1305 0.65 1.03 0.51 170 TR_XM_PHPForged 1301 1.06 2.60 0.51 171 TR_XM_FormFill2 1298 1.05 2.59 0.51 172 XM_H_PHPOS 1279 1.05 2.58 0.50 173 XMSubMetaSxObfu_03 1262 0.57 0.77 0.50 174 XMSlimDrugH 1253 0.66 1.13 0.49 175 XMPhish30 1245 0.58 0.82 0.49 176 XM_H_PHPMailer 1233 1.09 2.80 0.49 177 XM_B_COPY_HTML 1228 0.58 0.86 0.48 178 HTML_IMAGE_ONLY_20 1216 0.42 0.26 0.48 179 RDNS_DYNAMIC 1210 1.69 5.14 0.48 180 HTML_OBFUSCATE_05_10 1209 0.38 0.11 0.48 181 HTTPS_HTTP_MISMATCH 1206 0.49 0.55 0.48 182 XMHTML_After_End 1189 0.92 2.19 0.47 183 TR_LOTS_OF_MONEY3 1182 0.71 1.38 0.47 184 FSL_THIS_IS_ADV 1163 0.42 0.31 0.46 185 XMSubMetaI_00 1133 0.57 0.93 0.45 186 XMRcvdHeader_15 1129 0.33 0.00 0.45 187 FSL_HELO_FAKE 1102 0.33 0.04 0.43 188 DKIM_ADSP_NXDOMAIN 1078 0.66 1.31 0.42 189 XMBody_78 1062 0.55 0.91 0.42 190 XMCapTrack 1053 0.72 1.59 0.42 191 T_TooManySym_04 1047 0.31 0.03 0.41 192 RELAYCOUNTRY_AU 1044 0.38 0.30 0.41 193 FORGED_GMAIL_RCVD 1027 0.62 1.25 0.40 194 XM_SPF_Unknown 1023 0.59 1.10 0.40 195 XM_Combo_Sbj 1020 0.48 0.69 0.40 196 RELAYCOUNTRY_FR 1018 0.99 2.66 0.40 197 REMOVE_BEFORE_LINK 1012 0.53 0.89 0.40 198 BASE64_LENGTH_79_INF 1008 0.65 1.38 0.40 199 MPART_ALT_DIFF_COUNT 937 0.53 0.98 0.37 200 TVD_SPACE_RATIO 926 0.37 0.39 0.37 ----------------------------------------------------------------------