Email: 639578 Autolearn: 0 AvgScore: 1.00 AvgScanTime: 1.95 sec Spam: 113002 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 3.31 sec Ham: 526576 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.66 sec Time Spent Running SA: 346.59 hours Time Spent Processing Spam: 104.05 hours Time Spent Processing Ham: 242.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 107046 89.64 94.73 88.55 2 DKIM_SIGNED 90332 77.70 79.94 77.22 3 DCC_CHECK 88815 48.57 78.60 42.12 4 RELAYCOUNTRY_US 87138 82.02 77.11 83.07 5 XM_DK_Pass 86837 75.96 76.85 75.77 6 XM_B_Unicode 86228 71.97 76.31 71.03 7 XMListUnsubscribeExists 76776 56.23 67.94 53.72 8 DKIM_VALID 74843 70.80 66.23 71.78 9 DKIM_VALID_AU 56105 53.13 49.65 53.88 10 BAYES_50 48990 49.82 43.35 51.21 11 XM_B_Unicode3 48218 41.70 42.67 41.49 12 XM_DK_Undo_02 46901 13.53 41.50 7.53 13 MIME_HTML_ONLY 44141 24.74 39.06 21.67 14 LOC_TINY_FONT_1 37953 25.80 33.59 24.13 15 HTML_FONT_LOW_CONTRAST 35407 28.72 31.33 28.16 16 DKIM_VALID_EF 32554 27.19 28.81 26.85 17 BAYES_99 31065 7.95 27.49 3.75 18 XMSubLong 30263 22.68 26.78 21.79 19 FVGT_m_MULTI_ODD 29049 22.87 25.71 22.26 20 T_KAM_HTML_FONT_INVALID 27000 19.46 23.89 18.50 21 BOTNET 26378 6.49 23.34 2.88 22 RELAYCOUNTRY_META 25033 8.51 22.15 5.58 23 TR_DCC_Bayes_99 24258 5.46 21.47 2.02 24 BAYES_999 23287 6.09 20.61 2.97 25 T_TM2_M_HEADER_IN_MSG 22843 27.90 20.21 29.55 26 DCC_CHECK_NEGATIVE 22181 49.38 19.63 55.76 27 XM_UncommonTLD01 21352 5.96 18.90 3.18 28 XM_Body_Dirty_Words 20064 14.31 17.76 13.57 29 XM_Multi_Part_URI 19278 13.06 17.06 12.21 30 BOTNET_IPINHOSTNAME 18921 6.41 16.74 4.19 31 XM_B_Unsub 18539 11.29 16.41 10.19 32 UNTRUSTED_Relay 17454 3.94 15.45 1.47 33 FSL_BULK_SIG 16837 8.42 14.90 7.02 34 LOTS_OF_MONEY 16521 10.66 14.62 9.81 35 HTML_IMAGE_RATIO_02 15547 9.26 13.76 8.29 36 DKIM_INVALID 15489 6.90 13.71 5.44 37 XMSexyCombo_05 11799 5.19 10.44 4.06 38 NO_DNS_FOR_FROM 11490 4.21 10.17 2.93 39 XM_Evil_Numbers_Gen 11482 9.21 10.16 9.01 40 XM_B_Phish_Phrases 9797 7.32 8.67 7.03 41 XM_UB50 9263 2.08 8.20 0.77 42 XMSubMetaSx_00 8930 4.31 7.90 3.54 43 XM_H_Long_From01 8785 6.19 7.77 5.85 44 LotsOfNums_01 8723 8.27 7.72 8.39 45 BAYES_80 8359 3.45 7.40 2.60 46 BAYES_60 7986 5.19 7.07 4.78 47 MPART_ALT_DIFF 7947 5.51 7.03 5.19 48 KHOP_HELO_FCRDNS 7819 2.62 6.92 1.70 49 TooManyTo_001 7135 7.82 6.31 8.14 50 HTML_IMAGE_RATIO_04 6820 5.58 6.04 5.48 51 RCVD_IN_MSPIKE_H2 6711 9.15 5.94 9.84 52 XMStrtUSub 6602 4.37 5.84 4.06 53 T_REMOTE_IMAGE 6518 3.99 5.77 3.61 54 PDS_OTHER_BAD_TLD 6403 1.39 5.67 0.47 55 HTML_MIME_NO_HTML_TAG 6401 2.88 5.66 2.28 56 XM_CamelCaseFrm001 6257 2.95 5.54 2.39 57 XM_SPF_SoftFail 6241 2.38 5.52 1.70 58 SpammyFromTLD_02 6222 1.29 5.51 0.39 59 RELAYCOUNTRY_CA 5981 2.41 5.29 1.79 60 RDNS_DYNAMIC 5843 1.17 5.17 0.31 61 TR_Mismatch_TLD_02 5735 0.95 5.08 0.07 62 MIME_HTML_MOSTLY 5439 2.96 4.81 2.57 63 XMNumbers 5225 3.69 4.62 3.49 64 MIME_QP_LONG_LINE 5166 5.74 4.57 5.99 65 XM_SendGrid 5146 6.32 4.55 6.70 66 RCVD_IN_RP_RNBL 4982 0.91 4.41 0.16 67 XM_B_SpammyTLD 4829 2.33 4.27 1.91 68 RCVD_IN_BL_SPAMCOP_NET 4819 1.69 4.26 1.14 69 FROM_SUSPICIOUS_NTLD 4759 0.79 4.21 0.06 70 TM2_M_URI_OPT_OUT 4691 2.94 4.15 2.68 71 HTML_IMAGE_RATIO_06 4689 4.07 4.15 4.05 72 FROM_SUSPICIOUS_NTLD_FP 4551 0.75 4.03 0.05 73 BAYES_95 4521 2.04 4.00 1.61 74 RCVD_IN_MSPIKE_BL 4378 1.65 3.87 1.17 75 DATE_IN_PAST_03_06 4194 0.75 3.71 0.12 76 BAYES_40 4064 5.54 3.60 5.96 77 RELAYCOUNTRY_FR 4051 0.90 3.58 0.32 78 URIBL_SBL_A 4051 0.88 3.58 0.30 79 XM_URI_RBL 3887 0.75 3.44 0.17 80 RCVD_IN_MSPIKE_H3 3802 8.80 3.36 9.97 81 RCVD_IN_MSPIKE_WL 3802 8.80 3.36 9.97 82 MIME_HTML_ONLY_MULTI 3550 3.24 3.14 3.26 83 T_XMDrugObfuBody_08 3529 1.93 3.12 1.68 84 FROM_EXCESS_BASE64 3448 3.20 3.05 3.23 85 BODY_URI_ONLY 3395 0.61 3.00 0.09 86 XM_DIRTYINTL 3357 1.03 2.97 0.61 87 RCVD_IN_MSPIKE_L3 3353 1.21 2.97 0.83 88 BOTNET_NORDNS 3350 0.58 2.96 0.07 89 URI_HEX 3339 1.75 2.95 1.49 90 FROM_MISSP_REPLYTO 3332 0.53 2.95 0.01 91 LongTLD 3332 0.68 2.95 0.20 92 BAYES_20 3237 4.53 2.86 4.88 93 XM_B_Unsub2 3165 2.16 2.80 2.02 94 HTML_IMAGE_RATIO_08 3158 2.62 2.79 2.59 95 T_TooManySym_01 3088 4.66 2.73 5.07 96 HTML_IMAGE_ONLY_08 2894 0.54 2.56 0.11 97 XMBody_17 2893 1.16 2.56 0.86 98 BAYES_00 2849 18.23 2.52 21.60 99 XM_OfRef6 2832 1.97 2.51 1.86 100 TR_XM_INV_DKIM 2651 0.51 2.35 0.12 101 TR_XM_MaxBayes 2623 0.42 2.32 0.01 102 XMDiploma_00 2612 2.06 2.31 2.01 103 FROM_MISSP_DYNIP 2578 0.40 2.28 0.00 104 SpammyFromTLD_01 2560 0.97 2.27 0.69 105 T_XMDrugObfuBody_14 2528 1.66 2.24 1.54 106 REPLYTO_WITHOUT_TO_CC 2416 0.42 2.14 0.05 107 XMSexyCombo_01 2314 0.88 2.05 0.63 108 TR_XM_DK_SendGrid 2291 3.27 2.03 3.53 109 TM2_M_VERY_LONG_WORD 2282 1.44 2.02 1.31 110 TR_Symld_Words 2268 1.57 2.01 1.47 111 TR_LOTS_OF_MONEY3 2262 0.85 2.00 0.60 112 XM_UB99 2254 0.36 1.99 0.00 113 HTML_SHORT_LINK_IMG_1 2247 0.37 1.99 0.02 114 DATE_IN_PAST_06_12 2242 0.42 1.98 0.08 115 TR_XM_PHPDW 2215 0.82 1.96 0.57 116 TR_XM_PHPForged 2210 0.80 1.96 0.55 117 TR_XM_DK_Bayes 2187 13.74 1.94 16.28 118 TR_XM_FormFill2 2181 0.79 1.93 0.55 119 XM_H_PHPOS 2180 0.79 1.93 0.54 120 HDRS_LCASE_IMGONLY 2115 0.35 1.87 0.02 121 XMHTML_After_End 2094 1.06 1.85 0.89 122 ALL_TRUSTED 2051 11.35 1.82 13.40 123 TR_Mismatch_TLD_01 1961 0.50 1.74 0.23 124 RCVD_IN_IADB_LISTED 1960 4.57 1.73 5.18 125 RCVD_IN_PSBL 1879 0.32 1.66 0.04 126 RELAYCOUNTRY_IN 1875 0.39 1.66 0.12 127 XMStockSpam_06 1860 0.97 1.65 0.83 128 XM_BadFromFormat 1837 0.40 1.63 0.14 129 RCVD_IN_RP_SAFE 1836 7.65 1.62 8.94 130 XM_UB999 1829 0.29 1.62 0.00 131 URIBL_ABUSE_SURBL 1827 0.35 1.62 0.08 132 SUBJ_ALL_CAPS 1811 1.94 1.60 2.01 133 XMGenDplmaNmb 1796 1.29 1.59 1.22 134 RCVD_IN_IADB_SPF 1789 3.99 1.58 4.51 135 MAILING_LIST_MULTI 1787 2.63 1.58 2.85 136 XM_UB60 1786 0.32 1.58 0.05 137 URI_TRY_3LD 1782 1.50 1.58 1.48 138 NORDNS_LOW_CONTRAST 1769 0.28 1.57 0.00 139 XM_DK_Undo_01 1760 1.79 1.56 1.84 140 URI_NOVOWEL 1759 0.56 1.56 0.34 141 RCVD_IN_IADB_DK 1728 3.48 1.53 3.90 142 RCVD_IN_IADB_SENDERID 1686 3.54 1.49 3.98 143 HTML_TAG_BALANCE_CENTER 1656 0.39 1.47 0.15 144 XMCapTrack 1643 1.28 1.45 1.25 145 BAYES_05 1643 3.12 1.45 3.48 146 REMOVE_BEFORE_LINK 1613 0.57 1.43 0.38 147 T_XMHurry_00 1613 0.82 1.43 0.69 148 TR_XM_DK_Bayes1 1574 12.81 1.39 15.26 149 RELAYCOUNTRY_DE 1568 0.54 1.39 0.36 150 URIBL_DBL_SPAM 1555 0.27 1.38 0.03 151 RELAYCOUNTRY_GB 1548 0.99 1.37 0.91 152 T_XMDrugObfuBody_00 1530 0.96 1.35 0.88 153 XM_H_PHPMailer 1492 0.63 1.32 0.48 154 XMNoVowels 1489 1.64 1.32 1.70 155 XMMoneyMeta_00 1486 0.72 1.32 0.59 156 XMSubMetaSxObfu_03 1473 0.61 1.30 0.47 157 HTML_IMAGE_ONLY_12 1435 0.37 1.27 0.17 158 DKIM_ADSP_CUSTOM_MED 1393 1.14 1.23 1.13 159 XMSubMetaI_00 1389 0.74 1.23 0.63 160 DIET_1 1383 0.61 1.22 0.48 161 UNPARSEABLE_RELAY 1371 1.94 1.21 2.09 162 XM_H_PHPOS_M 1358 0.34 1.20 0.16 163 MIME_HEADER_CTYPE_ONLY 1342 0.42 1.19 0.26 164 XM_H_Long_From02 1342 1.38 1.19 1.42 165 T_MONEY_PERCENT 1321 0.72 1.17 0.63 166 TR_LOTS_OF_MONEY2 1321 0.72 1.17 0.63 167 RCVD_IN_RP_CERTIFIED 1317 6.89 1.17 8.11 168 TR_XM_RelayPhish 1296 0.35 1.15 0.18 169 FILL_THIS_FORM_SHORT 1283 1.14 1.14 1.14 170 XMBrknScrpt_02 1280 0.67 1.13 0.57 171 TVD_RCVD_IP 1257 1.40 1.11 1.46 172 FORGED_GMAIL_RCVD 1233 0.65 1.09 0.56 173 MISSING_HEADERS 1229 0.64 1.09 0.54 174 NML_ADSP_CUSTOM_MED 1216 0.88 1.08 0.83 175 TR_XM_DK_Bayes2 1197 11.30 1.06 13.49 176 XM_UB80 1192 0.19 1.05 0.01 177 THIS_AD 1181 0.43 1.05 0.30 178 XM_ProductURIs 1161 0.59 1.03 0.50 179 XMPhish14 1127 0.47 1.00 0.36 180 FROM_MISSP_EH_MATCH 1101 0.18 0.97 0.01 181 XMPhish08 1093 0.60 0.97 0.52 182 TO_EQ_FM_DOM_HTML_IMG 1086 0.19 0.96 0.02 183 URIBL_CSS_A 1077 0.19 0.95 0.02 184 URIBL_CSS 1077 0.19 0.95 0.02 185 HTTPS_HTTP_MISMATCH 1051 0.79 0.93 0.76 186 TO_NO_BRKTS_FROM_MSSP 1048 0.17 0.93 0.01 187 T_Symld_Words_02 1010 0.62 0.89 0.56 188 T_TooManySym_02 973 2.26 0.86 2.56 189 XMBdyGiftCard01 965 1.08 0.85 1.13 190 XMSlimDrugH 959 0.47 0.85 0.39 191 XM_H_MailChimp 954 0.30 0.84 0.19 192 XMBody_78 954 0.45 0.84 0.37 193 URIBL_BLACK 952 0.17 0.84 0.03 194 DKIM_ADSP_NXDOMAIN 948 0.38 0.84 0.28 195 XMPhish30 938 0.62 0.83 0.58 196 MPART_ALT_DIFF_COUNT 933 0.49 0.83 0.41 197 DATE_IN_PAST_12_24 908 0.22 0.80 0.10 198 TR_MetaPhish_Combo_01 907 0.90 0.80 0.92 199 XMSexyCombo_04 901 0.20 0.80 0.08 200 XM_PDF 875 4.04 0.77 4.74 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 466297 89.64 94.73 88.55 2 RELAYCOUNTRY_US 437443 82.02 77.11 83.07 3 DKIM_SIGNED 406610 77.70 79.94 77.22 4 XM_DK_Pass 398989 75.96 76.85 75.77 5 DKIM_VALID 377951 70.80 66.23 71.78 6 XM_B_Unicode 374052 71.97 76.31 71.03 7 DCC_CHECK_NEGATIVE 293616 49.38 19.63 55.76 8 DKIM_VALID_AU 283721 53.13 49.65 53.88 9 XMListUnsubscribeExists 282881 56.23 67.94 53.72 10 BAYES_50 269660 49.82 43.35 51.21 11 DCC_CHECK 221810 48.57 78.60 42.12 12 XM_B_Unicode3 218456 41.70 42.67 41.49 13 T_TM2_M_HEADER_IN_MSG 155603 27.90 20.21 29.55 14 HTML_FONT_LOW_CONTRAST 148293 28.72 31.33 28.16 15 DKIM_VALID_EF 141377 27.19 28.81 26.85 16 LOC_TINY_FONT_1 127045 25.80 33.59 24.13 17 FVGT_m_MULTI_ODD 117218 22.87 25.71 22.26 18 XMSubLong 114764 22.68 26.78 21.79 19 MIME_HTML_ONLY 114085 24.74 39.06 21.67 20 BAYES_00 113759 18.23 2.52 21.60 21 T_KAM_HTML_FONT_INVALID 97438 19.46 23.89 18.50 22 TR_XM_DK_Bayes 85711 13.74 1.94 16.28 23 TR_XM_DK_Bayes1 80356 12.81 1.39 15.26 24 XM_Body_Dirty_Words 71437 14.31 17.76 13.57 25 TR_XM_DK_Bayes2 71058 11.30 1.06 13.49 26 ALL_TRUSTED 70549 11.35 1.82 13.40 27 XM_Multi_Part_URI 64275 13.06 17.06 12.21 28 XM_B_Unsub 53661 11.29 16.41 10.19 29 RCVD_IN_MSPIKE_WL 52494 8.80 3.36 9.97 30 RCVD_IN_MSPIKE_H3 52494 8.80 3.36 9.97 31 RCVD_IN_MSPIKE_H2 51798 9.15 5.94 9.84 32 LOTS_OF_MONEY 51642 10.66 14.62 9.81 33 XM_Evil_Numbers_Gen 47447 9.21 10.16 9.01 34 RCVD_IN_RP_SAFE 47086 7.65 1.62 8.94 35 LotsOfNums_01 44184 8.27 7.72 8.39 36 HTML_IMAGE_RATIO_02 43654 9.26 13.76 8.29 37 TooManyTo_001 42850 7.82 6.31 8.14 38 RCVD_IN_RP_CERTIFIED 42724 6.89 1.17 8.11 39 XM_DK_Undo_02 39660 13.53 41.50 7.53 40 XM_DKIMWhitelistDomains 37495 5.86 0.01 7.12 41 XM_B_Phish_Phrases 37023 7.32 8.67 7.03 42 FSL_BULK_SIG 36985 8.42 14.90 7.02 43 XM_SendGrid 35303 6.32 4.55 6.70 44 MIME_QP_LONG_LINE 31524 5.74 4.57 5.99 45 BAYES_40 31358 5.54 3.60 5.96 46 XM_H_Long_From01 30788 6.19 7.77 5.85 47 RELAYCOUNTRY_META 29367 8.51 22.15 5.58 48 HTML_IMAGE_RATIO_04 28872 5.58 6.04 5.48 49 DKIM_INVALID 28659 6.90 13.71 5.44 50 MPART_ALT_DIFF 27307 5.51 7.03 5.19 51 RCVD_IN_IADB_LISTED 27289 4.57 1.73 5.18 52 T_TooManySym_01 26690 4.66 2.73 5.07 53 BAYES_20 25711 4.53 2.86 4.88 54 BAYES_60 25195 5.19 7.07 4.78 55 XM_PDF 24943 4.04 0.77 4.74 56 RCVD_IN_IADB_SPF 23734 3.99 1.58 4.51 57 BOTNET_IPINHOSTNAME 22068 6.41 16.74 4.19 58 XMSexyCombo_05 21370 5.19 10.44 4.06 59 XMStrtUSub 21366 4.37 5.84 4.06 60 HTML_IMAGE_RATIO_06 21317 4.07 4.15 4.05 61 RCVD_IN_IADB_SENDERID 20969 3.54 1.49 3.98 62 RCVD_IN_IADB_DK 20546 3.48 1.53 3.90 63 BAYES_99 19764 7.95 27.49 3.75 64 IN_ZIMBRA_NJ_WHITELIST 19678 3.08 0.02 3.74 65 T_REMOTE_IMAGE 19031 3.99 5.77 3.61 66 XMSubMetaSx_00 18635 4.31 7.90 3.54 67 TR_XM_DK_SendGrid 18599 3.27 2.03 3.53 68 XMNumbers 18399 3.69 4.62 3.49 69 BAYES_05 18333 3.12 1.45 3.48 70 RCVD_IN_IADB_VOUCHED 17326 2.83 0.68 3.29 71 MIME_HTML_ONLY_MULTI 17168 3.24 3.14 3.26 72 FROM_EXCESS_BASE64 16990 3.20 3.05 3.23 73 XM_UncommonTLD01 16740 5.96 18.90 3.18 74 BAYES_999 15656 6.09 20.61 2.97 75 NO_DNS_FOR_FROM 15443 4.21 10.17 2.93 76 BOTNET 15153 6.49 23.34 2.88 77 MAILING_LIST_MULTI 15005 2.63 1.58 2.85 78 TM2_M_URI_OPT_OUT 14131 2.94 4.15 2.68 79 BAYES_80 13712 3.45 7.40 2.60 80 HTML_IMAGE_RATIO_08 13617 2.62 2.79 2.59 81 MIME_HTML_MOSTLY 13517 2.96 4.81 2.57 82 T_TooManySym_02 13472 2.26 0.86 2.56 83 XM_CamelCaseFrm001 12585 2.95 5.54 2.39 84 ANY_BOUNCE_MESSAGE 12374 2.06 0.69 2.35 85 BOUNCE_MESSAGE 12372 2.06 0.69 2.35 86 HTML_MIME_NO_HTML_TAG 11994 2.88 5.66 2.28 87 TooManyTo_002 11549 1.91 0.57 2.19 88 UNPARSEABLE_RELAY 11009 1.94 1.21 2.09 89 RCVD_IN_IADB_OPTIN 10974 1.80 0.48 2.08 90 XM_H_Trusted_IP 10801 1.69 0.00 2.05 91 TR_DCC_Bayes_99 10634 5.46 21.47 2.02 92 XM_B_Unsub2 10626 2.16 2.80 2.02 93 XMDiploma_00 10591 2.06 2.31 2.01 94 SUBJ_ALL_CAPS 10568 1.94 1.60 2.01 95 XM_B_SpammyTLD 10048 2.33 4.27 1.91 96 XM_OfRef6 9785 1.97 2.51 1.86 97 XM_DK_Undo_01 9673 1.79 1.56 1.84 98 RELAYCOUNTRY_CA 9422 2.41 5.29 1.79 99 XMNoVowels 8978 1.64 1.32 1.70 100 KHOP_HELO_FCRDNS 8966 2.62 6.92 1.70 101 XM_SPF_SoftFail 8953 2.38 5.52 1.70 102 T_XMDrugObfuBody_08 8831 1.93 3.12 1.68 103 HELO_NODOT 8677 1.46 0.59 1.65 104 HELO_NO_DOMAIN 8635 1.46 0.59 1.64 105 BAYES_95 8500 2.04 4.00 1.61 106 T_XMDrugObfuBody_14 8097 1.66 2.24 1.54 107 URI_HEX 7860 1.75 2.95 1.49 108 TooManyTo_003 7829 1.30 0.44 1.49 109 URI_TRY_3LD 7785 1.50 1.58 1.48 110 UNTRUSTED_Relay 7761 3.94 15.45 1.47 111 TR_Symld_Words 7743 1.57 2.01 1.47 112 TVD_RCVD_IP 7714 1.40 1.11 1.46 113 INVALID_MSGID 7611 1.26 0.39 1.45 114 IN_HORDE_ADDRESS_BOOK 7543 1.18 0.02 1.43 115 XM_H_Long_From02 7454 1.38 1.19 1.42 116 XMGappySubj_01 7165 1.16 0.23 1.36 117 TO_MALFORMED 7072 1.11 0.02 1.34 118 TM2_M_VERY_LONG_WORD 6919 1.44 2.02 1.31 119 XMSubNoVowel 6571 1.15 0.71 1.25 120 XMCapTrack 6558 1.28 1.45 1.25 121 CK_HELO_DYNAMIC_SPLIT_IP 6443 1.04 0.19 1.22 122 HELO_DYNAMIC_IPADDR2 6438 1.01 0.03 1.22 123 XMGenDplmaNmb 6431 1.29 1.59 1.22 124 XM_GoogleGroups 6425 1.11 0.62 1.22 125 RCVD_IN_MSPIKE_BL 6161 1.65 3.87 1.17 126 USER_IN_DEF_DKIM_WL 6025 0.94 0.01 1.14 127 FILL_THIS_FORM_SHORT 5992 1.14 1.14 1.14 128 RCVD_IN_BL_SPAMCOP_NET 5981 1.69 4.26 1.14 129 DKIM_ADSP_CUSTOM_MED 5929 1.14 1.23 1.13 130 XMBdyGiftCard01 5925 1.08 0.85 1.13 131 TR_MSPIKEBAYES00 5865 0.92 0.01 1.11 132 TooManyTo_004 5683 0.95 0.37 1.08 133 HTML_FONT_FACE_BAD 4966 0.90 0.71 0.94 134 TR_MetaPhish_Combo_01 4867 0.90 0.80 0.92 135 RELAYCOUNTRY_GB 4809 0.99 1.37 0.91 136 XMHTML_After_End 4712 1.06 1.85 0.89 137 T_XMDrugObfuBody_00 4617 0.96 1.35 0.88 138 TooManyTo_005 4559 0.77 0.33 0.87 139 XMBody_17 4518 1.16 2.56 0.86 140 RCVD_IN_MSPIKE_L3 4392 1.21 2.97 0.83 141 FILL_THIS_FORM 4387 0.73 0.23 0.83 142 NML_ADSP_CUSTOM_MED 4387 0.88 1.08 0.83 143 XMStockSpam_06 4373 0.97 1.65 0.83 144 XM_UB50 4053 2.08 8.20 0.77 145 HTTPS_HTTP_MISMATCH 3980 0.79 0.93 0.76 146 XMBody_95 3714 0.60 0.11 0.71 147 SpammyFromTLD_01 3648 0.97 2.27 0.69 148 T_XMHurry_00 3616 0.82 1.43 0.69 149 FILL_THIS_FORM_LONG 3483 0.58 0.18 0.66 150 XM_SPF_Unknown 3406 0.64 0.61 0.65 151 XMSubMetaI_00 3330 0.74 1.23 0.63 152 XMSexyCombo_01 3322 0.88 2.05 0.63 153 TR_LOTS_OF_MONEY2 3292 0.72 1.17 0.63 154 T_MONEY_PERCENT 3292 0.72 1.17 0.63 155 T_FILL_THIS_FORM_LOAN 3233 0.52 0.07 0.61 156 T_TooManySym_03 3222 0.57 0.37 0.61 157 XM_DIRTYINTL 3217 1.03 2.97 0.61 158 TR_LOTS_OF_MONEY3 3164 0.85 2.00 0.60 159 XMMoneyMeta_00 3123 0.72 1.32 0.59 160 T_OBFU_PDF_ATTACH 3059 0.51 0.18 0.58 161 XMPhish30 3028 0.62 0.83 0.58 162 XMBrknScrpt_02 3020 0.67 1.13 0.57 163 XMHTMLBadTable_001 3018 0.59 0.67 0.57 164 TR_XM_PHPDW 3008 0.82 1.96 0.57 165 FROM_GOV_DKIM_AU 2943 0.49 0.15 0.56 166 T_Symld_Words_02 2934 0.62 0.89 0.56 167 FORGED_GMAIL_RCVD 2925 0.65 1.09 0.56 168 TR_XM_PHPForged 2891 0.80 1.96 0.55 169 TR_XM_FormFill2 2873 0.79 1.93 0.55 170 XM_H_PHPOS 2861 0.79 1.93 0.54 171 MISSING_HEADERS 2850 0.64 1.09 0.54 172 USER_IN_WHITELIST 2836 0.44 0.00 0.54 173 TM2_M_A_HREF_HREF 2822 0.56 0.65 0.54 174 XMPhish08 2760 0.60 0.97 0.52 175 XMGappySubj_02 2742 0.44 0.08 0.52 176 HTML_TAG_BALANCE_BODY 2742 0.55 0.70 0.52 177 FROM_GOV_SPOOF 2724 0.49 0.34 0.52 178 SUBJ_DOLLARS 2722 0.51 0.49 0.52 179 XM_RXBody 2665 0.49 0.39 0.51 180 XM_ProductURIs 2619 0.59 1.03 0.50 181 PLING_QUERY 2579 0.50 0.57 0.49 182 XM_B_REG_HTML 2571 0.49 0.50 0.49 183 RELAYCOUNTRY_AU 2566 0.49 0.51 0.49 184 XM_H_PHPMailer 2549 0.63 1.32 0.48 185 RELAYCOUNTRY_NL 2515 0.47 0.42 0.48 186 DIET_1 2511 0.61 1.22 0.48 187 XM_ShortIntro_01 2510 0.45 0.33 0.48 188 AC_DIV_BONANZA 2507 0.43 0.20 0.48 189 PDS_OTHER_BAD_TLD 2462 1.39 5.67 0.47 190 XMSubMetaSxObfu_03 2452 0.61 1.30 0.47 191 XMRcvdHeader_15 2440 0.38 0.00 0.46 192 XMDateMe_00 2390 0.46 0.47 0.45 193 HTML_IMAGE_ONLY_20 2382 0.42 0.27 0.45 194 TM2_M_BODY_EMPTY 2315 0.40 0.20 0.44 195 XMLKML 2293 0.36 0.00 0.44 196 SHORT_HELO_AND_INLINE_IMAGE 2289 0.36 0.02 0.43 197 MPART_ALT_DIFF_COUNT 2175 0.49 0.83 0.41 198 RCVD_IN_SORBS_DUL 2103 0.38 0.30 0.40 199 HTML_IMAGE_ONLY_32 2076 0.37 0.25 0.39 200 XMSlimDrugH 2070 0.47 0.85 0.39 ----------------------------------------------------------------------