Email: 701239 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 1.89 sec Spam: 119177 Autolearn: 0 AvgScore: 12.34 AvgScanTime: 3.45 sec Ham: 582062 Autolearn: 0 AvgScore: -2.29 AvgScanTime: 1.57 sec Time Spent Running SA: 368.79 hours Time Spent Processing Spam: 114.36 hours Time Spent Processing Ham: 254.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 113187 91.17 94.97 90.39 2 DKIM_SIGNED 97130 68.55 81.50 65.90 3 RELAYCOUNTRY_US 96201 79.59 80.72 79.36 4 XM_DK_Pass 94858 67.30 79.59 64.78 5 DCC_CHECK 93807 42.72 78.71 35.35 6 XM_B_Unicode 91000 74.09 76.36 73.63 7 DKIM_VALID 81305 62.18 68.22 60.94 8 XMListUnsubscribeExists 79366 48.48 66.60 44.77 9 DKIM_VALID_AU 62122 47.00 52.13 45.95 10 XM_B_Unicode3 58392 46.28 49.00 45.72 11 BAYES_50 53842 49.23 45.18 50.06 12 XM_DK_Undo_02 51762 13.05 43.43 6.83 13 LOC_TINY_FONT_1 44657 27.29 37.47 25.21 14 MIME_HTML_ONLY 43652 23.98 36.63 21.40 15 HTML_FONT_LOW_CONTRAST 39322 25.11 32.99 23.50 16 XMSubLong 33872 20.89 28.42 19.34 17 BAYES_99 33650 7.85 28.24 3.68 18 FVGT_m_MULTI_ODD 30077 20.23 25.24 19.20 19 DKIM_VALID_EF 29820 22.96 25.02 22.53 20 XM_Body_Dirty_Words 26889 13.48 22.56 11.62 21 TR_DCC_Bayes_99 26761 5.31 22.45 1.80 22 T_KAM_HTML_FONT_INVALID 26573 16.70 22.30 15.56 23 BAYES_999 26427 6.29 22.17 3.03 24 BOTNET 26075 5.57 21.88 2.24 25 DCC_CHECK_NEGATIVE 23270 55.53 19.53 62.91 26 T_TM2_M_HEADER_IN_MSG 22321 24.66 18.73 25.88 27 RELAYCOUNTRY_META 22100 7.19 18.54 4.87 28 XM_Multi_Part_URI 20310 14.55 17.04 14.04 29 FSL_BULK_SIG 19850 8.24 16.66 6.52 30 XM_UncommonTLD01 17900 4.88 15.02 2.81 31 BOTNET_IPINHOSTNAME 17665 5.52 14.82 3.62 32 XM_B_Unsub 17566 9.65 14.74 8.60 33 XM_Evil_Numbers_Gen 16579 9.95 13.91 9.14 34 LOTS_OF_MONEY 16567 8.38 13.90 7.25 35 DKIM_INVALID 15825 6.37 13.28 4.96 36 XMSexyCombo_05 15621 4.89 13.11 3.21 37 HTML_IMAGE_RATIO_02 14574 7.33 12.23 6.33 38 XM_B_Phish_Phrases 14539 8.33 12.20 7.54 39 UNTRUSTED_Relay 13293 3.12 11.15 1.47 40 NO_DNS_FOR_FROM 12608 4.20 10.58 2.89 41 LotsOfNums_01 10786 7.24 9.05 6.87 42 XMSubMetaSx_00 9856 4.06 8.27 3.20 43 RCVD_IN_MSPIKE_H2 9734 8.85 8.17 8.99 44 MPART_ALT_DIFF 9420 8.17 7.90 8.23 45 XM_H_Long_From01 8884 5.59 7.45 5.21 46 HTML_IMAGE_RATIO_04 8876 11.62 7.45 12.48 47 XM_UB50 8180 1.92 6.86 0.91 48 SpammyFromTLD_02 8079 1.40 6.78 0.30 49 BAYES_80 7934 3.10 6.66 2.37 50 TooManyTo_001 7800 7.72 6.54 7.96 51 BAYES_60 7654 5.04 6.42 4.75 52 XMNumbers 7034 3.64 5.90 3.17 53 RCVD_IN_BL_SPAMCOP_NET 6635 1.81 5.57 1.05 54 MIME_QP_LONG_LINE 6621 4.90 5.56 4.77 55 T_REMOTE_IMAGE 6521 3.88 5.47 3.55 56 XM_SPF_SoftFail 6319 2.22 5.30 1.59 57 T_XMDrugObfuBody_08 5916 2.10 4.96 1.51 58 KHOP_HELO_FCRDNS 5861 2.26 4.92 1.72 59 XM_CamelCaseFrm001 5761 2.45 4.83 1.97 60 RELAYCOUNTRY_CA 5658 1.97 4.75 1.40 61 RCVD_IN_MSPIKE_BL 5623 1.72 4.72 1.10 62 RCVD_IN_MSPIKE_WL 5612 7.67 4.71 8.28 63 RCVD_IN_MSPIKE_H3 5612 7.67 4.71 8.28 64 XM_SendGrid 5587 5.17 4.69 5.27 65 MIME_HTML_MOSTLY 5519 2.72 4.63 2.33 66 RCVD_IN_MSPIKE_L3 5086 1.41 4.27 0.82 67 HTML_IMAGE_RATIO_06 4939 4.47 4.14 4.54 68 XM_URI_RBL 4792 0.81 4.02 0.16 69 TM2_M_URI_OPT_OUT 4764 2.77 4.00 2.51 70 XMStrtUSub 4566 7.39 3.83 8.12 71 RCVD_IN_RP_RNBL 4435 0.73 3.72 0.11 72 MIME_HTML_ONLY_MULTI 4415 5.90 3.70 6.35 73 PDS_OTHER_BAD_TLD 4380 0.99 3.68 0.44 74 BAYES_95 4360 1.78 3.66 1.39 75 XM_B_SpammyTLD 4249 2.04 3.57 1.73 76 FROM_EXCESS_BASE64 4235 2.80 3.55 2.64 77 XMHTML_After_End 4195 1.23 3.52 0.76 78 BAYES_40 4149 5.34 3.48 5.72 79 BODY_URI_ONLY 4087 0.63 3.43 0.05 80 XMStockSpam_06 3946 1.29 3.31 0.87 81 RCVD_IN_RP_SAFE 3895 7.02 3.27 7.79 82 XM_B_Unsub2 3861 2.03 3.24 1.78 83 XM_DIRTYINTL 3765 0.94 3.16 0.49 84 FROM_SUSPICIOUS_NTLD 3661 0.54 3.07 0.02 85 FROM_SUSPICIOUS_NTLD_FP 3596 0.53 3.02 0.02 86 SUBJ_ALL_CAPS 3519 1.93 2.95 1.72 87 TR_Mismatch_TLD_02 3492 0.55 2.93 0.07 88 XMNoVowels 3489 1.89 2.93 1.68 89 REPLYTO_WITHOUT_TO_CC 3441 0.54 2.89 0.06 90 XM_OfRef6 3417 1.49 2.87 1.21 91 SpammyFromTLD_01 3393 1.04 2.85 0.67 92 RCVD_IN_RP_CERTIFIED 3342 6.49 2.80 7.25 93 XMDiploma_00 3325 1.93 2.79 1.75 94 HTML_SHORT_LINK_IMG_1 3279 0.48 2.75 0.02 95 TM2_M_VERY_LONG_WORD 3264 1.46 2.74 1.20 96 T_MONEY_PERCENT 3238 0.88 2.72 0.50 97 TR_LOTS_OF_MONEY2 3238 0.88 2.72 0.50 98 RELAYCOUNTRY_FR 3207 0.70 2.69 0.29 99 FROM_ADDR_WS 3205 0.46 2.69 0.00 100 XMSexyCombo_01 3076 0.95 2.58 0.62 101 HDRS_LCASE_IMGONLY 3063 0.45 2.57 0.01 102 MIME_HEADER_CTYPE_ONLY 3058 0.61 2.57 0.21 103 BAYES_20 3058 4.95 2.57 5.43 104 HTML_IMAGE_RATIO_08 3013 2.19 2.53 2.13 105 T_TooManySym_01 2973 3.62 2.49 3.85 106 LongTLD 2938 0.55 2.47 0.16 107 TR_XM_INV_DKIM 2913 0.52 2.44 0.13 108 XMBrknScrpt_02 2907 1.14 2.44 0.88 109 T_XMDrugObfuBody_14 2901 1.72 2.43 1.58 110 ALL_TRUSTED 2809 14.87 2.36 17.44 111 RDNS_DYNAMIC 2774 0.63 2.33 0.28 112 BAYES_00 2620 18.95 2.20 22.38 113 RCVD_IN_IADB_LISTED 2556 3.85 2.14 4.20 114 HTML_IMAGE_ONLY_08 2529 0.44 2.12 0.10 115 T_Symld_Words_02 2521 0.75 2.12 0.48 116 URI_HEX 2505 1.39 2.10 1.24 117 XMBody_17 2491 0.70 2.09 0.42 118 XMPhish30 2488 0.79 2.09 0.53 119 HTML_MIME_NO_HTML_TAG 2464 1.96 2.07 1.94 120 XM_RXBody 2438 0.54 2.05 0.23 121 RCVD_IN_IADB_SPF 2430 3.35 2.04 3.62 122 URIBL_SBL_A 2389 0.46 2.00 0.14 123 RCVD_IN_IADB_DK 2374 2.90 1.99 3.09 124 RCVD_IN_IADB_SENDERID 2373 2.96 1.99 3.16 125 XMSubMetaI_00 2305 0.78 1.93 0.54 126 TR_XM_PHPDW 2289 0.71 1.92 0.46 127 TR_XM_PHPForged 2251 0.68 1.89 0.44 128 TR_XM_FormFill2 2220 0.68 1.86 0.44 129 XMGenDplmaNmb 2217 1.18 1.86 1.03 130 XM_H_PHPOS 2212 0.67 1.86 0.43 131 TR_Symld_Words 2148 1.75 1.80 1.74 132 TR_XM_DK_Bayes 2142 10.81 1.80 12.65 133 DATE_IN_PAST_03_06 2103 0.36 1.76 0.08 134 TR_XM_DK_SendGrid 2086 2.80 1.75 3.01 135 URI_TRY_3LD 2051 1.11 1.72 0.98 136 NO_FM_NAME_IP_HOSTN 1994 0.28 1.67 0.00 137 XM_DKIMWhitelistDomains 1987 5.21 1.67 5.94 138 SUBJ_DOLLARS 1965 0.57 1.65 0.35 139 FROM_NO_USER 1930 0.28 1.62 0.00 140 T_XMDrugObfuBody_00 1917 0.79 1.61 0.63 141 UNICODE_OBFU_ASC 1915 3.63 1.61 4.04 142 TR_MetaPhish_Combo_01 1912 1.13 1.60 1.04 143 DATE_IN_PAST_06_12 1854 0.39 1.56 0.16 144 BOTNET_NORDNS 1850 0.28 1.55 0.02 145 RELAYCOUNTRY_GB 1849 1.07 1.55 0.97 146 DIET_1 1833 0.58 1.54 0.39 147 TR_XM_MaxBayes 1811 0.26 1.52 0.01 148 HTML_IMAGE_ONLY_12 1755 0.40 1.47 0.18 149 LOADSA_MONEY_COMBO 1696 0.27 1.42 0.04 150 BAYES_05 1610 3.61 1.35 4.07 151 RELAYCOUNTRY_DE 1597 0.64 1.34 0.50 152 MAILING_LIST_MULTI 1593 2.19 1.34 2.37 153 XM_DK_Undo_01 1561 1.48 1.31 1.51 154 TR_XM_RelayPhish 1542 0.34 1.29 0.15 155 TR_LOTS_OF_MONEY3 1531 0.48 1.28 0.32 156 ANY_BOUNCE_MESSAGE 1491 2.67 1.25 2.95 157 BOUNCE_MESSAGE 1489 2.66 1.25 2.95 158 T_XMHurry_00 1486 0.65 1.25 0.53 159 TO_EQ_FM_DOM_HTML_IMG 1485 0.23 1.25 0.02 160 RELAYCOUNTRY_RU 1482 0.25 1.24 0.04 161 FROM_MISSP_REPLYTO 1429 0.21 1.20 0.01 162 TR_XM_DK_Bayes1 1412 10.03 1.18 11.84 163 UNPARSEABLE_RELAY 1406 1.74 1.18 1.86 164 DKIM_ADSP_CUSTOM_MED 1397 1.01 1.17 0.97 165 XM_H_PHPMailer 1391 0.58 1.17 0.46 166 RELAYCOUNTRY_IN 1337 0.30 1.12 0.13 167 XM_UB60 1326 0.24 1.11 0.06 168 T_FILL_THIS_FORM_SHORT 1298 0.94 1.09 0.92 169 XMSexyCombo_04 1282 0.32 1.08 0.17 170 SHORT_URI 1278 0.20 1.07 0.02 171 TR_XM_MaxSPIKE 1276 0.21 1.07 0.03 172 REMOVE_BEFORE_LINK 1265 0.49 1.06 0.37 173 TO_MALFORMED 1257 1.19 1.05 1.21 174 XM_salutation 1256 0.18 1.05 0.00 175 XMBody_78 1249 0.50 1.05 0.39 176 RELAYCOUNTRY_BJ 1244 0.18 1.04 0.00 177 XM_H_Long_From02 1224 0.99 1.03 0.98 178 XM_H_PHPOS_M 1207 0.28 1.01 0.13 179 NML_ADSP_CUSTOM_MED 1198 0.75 1.01 0.70 180 FORGED_GMAIL_RCVD 1188 0.54 1.00 0.44 181 XM_B_COPY_HTML 1138 0.45 0.95 0.35 182 RCVD_IN_PSBL 1094 0.18 0.92 0.03 183 HK_RANDOM_REPLYTO 1093 0.30 0.92 0.18 184 XMPhish08 1090 0.48 0.91 0.40 185 HTTPS_HTTP_MISMATCH 1081 0.62 0.91 0.56 186 XM_ProductURIs 1072 0.63 0.90 0.57 187 MPART_ALT_DIFF_COUNT 1071 0.48 0.90 0.39 188 DKIM_ADSP_NXDOMAIN 1071 0.50 0.90 0.42 189 XMSubMetaSSx_00 1057 0.29 0.89 0.17 190 URI_OPTOUT_3LD 1054 0.37 0.88 0.27 191 T_TooManySym_02 1044 1.94 0.88 2.16 192 XM_H_MailChimp 1034 0.27 0.87 0.15 193 XMPhish14 1026 0.38 0.86 0.28 194 XM_PDF 1015 3.32 0.85 3.82 195 TR_XM_DK_Bayes2 1015 8.79 0.85 10.41 196 URIBL_DBL_SPAM 993 0.16 0.83 0.02 197 XMBdyGiftCard01 991 0.96 0.83 0.98 198 XMLngstWrd_00 989 0.83 0.83 0.83 199 FSL_THIS_IS_ADV 986 0.24 0.83 0.12 200 THIS_AD 979 0.28 0.82 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 526098 91.17 94.97 90.39 2 RELAYCOUNTRY_US 461945 79.59 80.72 79.36 3 XM_B_Unicode 428556 74.09 76.36 73.63 4 DKIM_SIGNED 383584 68.55 81.50 65.90 5 XM_DK_Pass 377055 67.30 79.59 64.78 6 DCC_CHECK_NEGATIVE 366151 55.53 19.53 62.91 7 DKIM_VALID 354722 62.18 68.22 60.94 8 BAYES_50 291401 49.23 45.18 50.06 9 DKIM_VALID_AU 267486 47.00 52.13 45.95 10 XM_B_Unicode3 266124 46.28 49.00 45.72 11 XMListUnsubscribeExists 260605 48.48 66.60 44.77 12 DCC_CHECK 205735 42.72 78.71 35.35 13 T_TM2_M_HEADER_IN_MSG 150637 24.66 18.73 25.88 14 LOC_TINY_FONT_1 146744 27.29 37.47 25.21 15 HTML_FONT_LOW_CONTRAST 136767 25.11 32.99 23.50 16 DKIM_VALID_EF 131151 22.96 25.02 22.53 17 BAYES_00 130253 18.95 2.20 22.38 18 MIME_HTML_ONLY 124538 23.98 36.63 21.40 19 XMSubLong 112593 20.89 28.42 19.34 20 FVGT_m_MULTI_ODD 111769 20.23 25.24 19.20 21 ALL_TRUSTED 101499 14.87 2.36 17.44 22 T_KAM_HTML_FONT_INVALID 90550 16.70 22.30 15.56 23 XM_Multi_Part_URI 81729 14.55 17.04 14.04 24 TR_XM_DK_Bayes 73643 10.81 1.80 12.65 25 HTML_IMAGE_RATIO_04 72628 11.62 7.45 12.48 26 TR_XM_DK_Bayes1 68889 10.03 1.18 11.84 27 XM_Body_Dirty_Words 67643 13.48 22.56 11.62 28 TR_XM_DK_Bayes2 60617 8.79 0.85 10.41 29 HTML_FONT_FACE_BAD 59953 8.67 0.70 10.30 30 XM_H_Trusted_IP 59596 8.50 0.00 10.24 31 XM_Evil_Numbers_Gen 53222 9.95 13.91 9.14 32 RCVD_IN_MSPIKE_H2 52344 8.85 8.17 8.99 33 XM_B_Unsub 50076 9.65 14.74 8.60 34 RCVD_IN_MSPIKE_WL 48196 7.67 4.71 8.28 35 RCVD_IN_MSPIKE_H3 48196 7.67 4.71 8.28 36 MPART_ALT_DIFF 47898 8.17 7.90 8.23 37 XMStrtUSub 47256 7.39 3.83 8.12 38 TooManyTo_001 46349 7.72 6.54 7.96 39 RCVD_IN_RP_SAFE 45338 7.02 3.27 7.79 40 XM_B_Phish_Phrases 43864 8.33 12.20 7.54 41 LOTS_OF_MONEY 42220 8.38 13.90 7.25 42 RCVD_IN_RP_CERTIFIED 42171 6.49 2.80 7.25 43 LotsOfNums_01 40009 7.24 9.05 6.87 44 XM_DK_Undo_02 39780 13.05 43.43 6.83 45 FSL_BULK_SIG 37934 8.24 16.66 6.52 46 MIME_HTML_ONLY_MULTI 36979 5.90 3.70 6.35 47 HTML_IMAGE_RATIO_02 36859 7.33 12.23 6.33 48 XM_DKIMWhitelistDomains 34579 5.21 1.67 5.94 49 BAYES_40 33266 5.34 3.48 5.72 50 BAYES_20 31632 4.95 2.57 5.43 51 XM_SendGrid 30652 5.17 4.69 5.27 52 XM_H_Long_From01 30315 5.59 7.45 5.21 53 DKIM_INVALID 28862 6.37 13.28 4.96 54 RELAYCOUNTRY_META 28327 7.19 18.54 4.87 55 MIME_QP_LONG_LINE 27740 4.90 5.56 4.77 56 BAYES_60 27668 5.04 6.42 4.75 57 HTML_IMAGE_RATIO_06 26438 4.47 4.14 4.54 58 RCVD_IN_IADB_LISTED 24440 3.85 2.14 4.20 59 BAYES_05 23718 3.61 1.35 4.07 60 UNICODE_OBFU_ASC 23520 3.63 1.61 4.04 61 UPPERCASE_75_100 22718 3.37 0.78 3.90 62 T_TooManySym_01 22407 3.62 2.49 3.85 63 XM_PDF 22251 3.32 0.85 3.82 64 BAYES_99 21427 7.85 28.24 3.68 65 RCVD_IN_IADB_SPF 21074 3.35 2.04 3.62 66 BOTNET_IPINHOSTNAME 21060 5.52 14.82 3.62 67 T_REMOTE_IMAGE 20674 3.88 5.47 3.55 68 XMSubNoVowel 20285 2.96 0.37 3.49 69 IN_ZIMBRA_NJ_WHITELIST 18931 2.70 0.01 3.25 70 XMSexyCombo_05 18678 4.89 13.11 3.21 71 XMSubMetaSx_00 18603 4.06 8.27 3.20 72 XMNumbers 18460 3.64 5.90 3.17 73 RCVD_IN_IADB_SENDERID 18370 2.96 1.99 3.16 74 RCVD_IN_IADB_DK 17996 2.90 1.99 3.09 75 BAYES_999 17655 6.29 22.17 3.03 76 TR_XM_DK_SendGrid 17535 2.80 1.75 3.01 77 ANY_BOUNCE_MESSAGE 17198 2.67 1.25 2.95 78 BOUNCE_MESSAGE 17191 2.66 1.25 2.95 79 NO_DNS_FOR_FROM 16838 4.20 10.58 2.89 80 XM_UncommonTLD01 16349 4.88 15.02 2.81 81 RCVD_IN_IADB_VOUCHED 15919 2.39 0.69 2.73 82 FROM_EXCESS_BASE64 15383 2.80 3.55 2.64 83 TM2_M_URI_OPT_OUT 14626 2.77 4.00 2.51 84 BAYES_80 13801 3.10 6.66 2.37 85 MAILING_LIST_MULTI 13799 2.19 1.34 2.37 86 MIME_HTML_MOSTLY 13538 2.72 4.63 2.33 87 BOTNET 13016 5.57 21.88 2.24 88 T_TooManySym_02 12548 1.94 0.88 2.16 89 HTML_IMAGE_RATIO_08 12371 2.19 2.53 2.13 90 XM_CamelCaseFrm001 11453 2.45 4.83 1.97 91 HTML_MIME_NO_HTML_TAG 11272 1.96 2.07 1.94 92 TooManyTo_002 11089 1.69 0.63 1.91 93 UNPARSEABLE_RELAY 10828 1.74 1.18 1.86 94 TR_DCC_Bayes_99 10449 5.31 22.45 1.80 95 XM_B_Unsub2 10374 2.03 3.24 1.78 96 RCVD_IN_IADB_OPTIN 10273 1.54 0.47 1.76 97 XMDiploma_00 10178 1.93 2.79 1.75 98 TR_Symld_Words 10144 1.75 1.80 1.74 99 XM_B_SpammyTLD 10056 2.04 3.57 1.73 100 KHOP_HELO_FCRDNS 10009 2.26 4.92 1.72 101 SUBJ_ALL_CAPS 9998 1.93 2.95 1.72 102 XMNoVowels 9790 1.89 2.93 1.68 103 XM_SPF_SoftFail 9250 2.22 5.30 1.59 104 T_XMDrugObfuBody_14 9179 1.72 2.43 1.58 105 T_XMDrugObfuBody_08 8817 2.10 4.96 1.51 106 XM_DK_Undo_01 8804 1.48 1.31 1.51 107 HELO_NODOT 8567 1.32 0.56 1.47 108 HELO_NO_DOMAIN 8566 1.32 0.56 1.47 109 UNTRUSTED_Relay 8555 3.12 11.15 1.47 110 TVD_RCVD_IP 8373 1.26 0.39 1.44 111 RELAYCOUNTRY_CA 8163 1.97 4.75 1.40 112 BAYES_95 8107 1.78 3.66 1.39 113 IN_HORDE_ADDRESS_BOOK 8035 1.15 0.02 1.38 114 INVALID_MSGID 7732 1.16 0.32 1.33 115 TooManyTo_003 7458 1.15 0.54 1.28 116 URI_HEX 7241 1.39 2.10 1.24 117 XMSubLongNoVowel 7156 1.04 0.09 1.23 118 XMSubGarbage 7098 1.02 0.03 1.22 119 TO_MALFORMED 7055 1.19 1.05 1.21 120 XM_OfRef6 7041 1.49 2.87 1.21 121 XMCapTrack 7017 1.10 0.59 1.21 122 TM2_M_VERY_LONG_WORD 6990 1.46 2.74 1.20 123 XM_GoogleGroups 6766 1.04 0.45 1.16 124 CK_HELO_DYNAMIC_SPLIT_IP 6569 0.98 0.27 1.13 125 HELO_DYNAMIC_IPADDR2 6560 0.95 0.08 1.13 126 RCVD_IN_MSPIKE_BL 6409 1.72 4.72 1.10 127 RCVD_IN_BL_SPAMCOP_NET 6090 1.81 5.57 1.05 128 TR_MetaPhish_Combo_01 6028 1.13 1.60 1.04 129 XMGenDplmaNmb 6023 1.18 1.86 1.03 130 XM_E_Blogspot 5901 0.86 0.13 1.01 131 TooManyTo_004 5751 0.90 0.45 0.99 132 XM_H_Long_From02 5730 0.99 1.03 0.98 133 URI_TRY_3LD 5725 1.11 1.72 0.98 134 XMBdyGiftCard01 5710 0.96 0.83 0.98 135 DKIM_ADSP_CUSTOM_MED 5658 1.01 1.17 0.97 136 RELAYCOUNTRY_GB 5635 1.07 1.55 0.97 137 USER_IN_DEF_DKIM_WL 5556 0.79 0.01 0.95 138 T_FILL_THIS_FORM_SHORT 5328 0.94 1.09 0.92 139 XM_UB50 5307 1.92 6.86 0.91 140 XMBrknScrpt_02 5101 1.14 2.44 0.88 141 XMStockSpam_06 5067 1.29 3.31 0.87 142 TooManyTo_005 4917 0.77 0.40 0.84 143 XMGappySubj_01 4850 0.72 0.18 0.83 144 XMLngstWrd_00 4819 0.83 0.83 0.83 145 RCVD_IN_MSPIKE_L3 4795 1.41 4.27 0.82 146 XMLngstWrd_01 4599 0.79 0.81 0.79 147 XMHTML_After_End 4452 1.23 3.52 0.76 148 TR_MSPIKEBAYES00 4258 0.61 0.01 0.73 149 XMLngstWrd_02 4130 0.64 0.28 0.71 150 NML_ADSP_CUSTOM_MED 4096 0.75 1.01 0.70 151 SpammyFromTLD_01 3920 1.04 2.85 0.67 152 XMLngstWrd_03 3654 0.56 0.21 0.63 153 T_XMDrugObfuBody_00 3645 0.79 1.61 0.63 154 XMSexyCombo_01 3611 0.95 2.58 0.62 155 XMBody_95 3475 0.51 0.07 0.60 156 XMLngstWrd_04 3424 0.51 0.14 0.59 157 XM_ProductURIs 3337 0.63 0.90 0.57 158 HTTPS_HTTP_MISMATCH 3273 0.62 0.91 0.56 159 XM_SPF_Unknown 3216 0.57 0.66 0.55 160 T_TooManySym_03 3212 0.50 0.24 0.55 161 T_OBFU_PDF_ATTACH 3186 0.50 0.24 0.55 162 XMSubMetaI_00 3168 0.78 1.93 0.54 163 PLING_QUERY 3143 0.56 0.64 0.54 164 T_XMHurry_00 3081 0.65 1.25 0.53 165 XMPhish30 3079 0.79 2.09 0.53 166 XM_B_REG_HTML 2967 0.52 0.60 0.51 167 T_MONEY_PERCENT 2932 0.88 2.72 0.50 168 TR_LOTS_OF_MONEY2 2932 0.88 2.72 0.50 169 RELAYCOUNTRY_DE 2903 0.64 1.34 0.50 170 PDS_BTC_ID 2842 0.42 0.11 0.49 171 XM_DIRTYINTL 2837 0.94 3.16 0.49 172 FROM_GOV_DKIM_AU 2780 0.43 0.21 0.48 173 T_Symld_Words_02 2767 0.75 2.12 0.48 174 MISSING_HEADERS 2756 0.46 0.41 0.47 175 FILL_THIS_FORM 2723 0.41 0.14 0.47 176 XM_ShortIntro_01 2685 0.52 0.82 0.46 177 XMMoneyMeta_00 2680 0.50 0.71 0.46 178 XMHTMLBadTable_001 2675 0.52 0.79 0.46 179 TR_XM_PHPDW 2666 0.71 1.92 0.46 180 XM_H_PHPMailer 2664 0.58 1.17 0.46 181 FORGED_GMAIL_RCVD 2581 0.54 1.00 0.44 182 PDS_OTHER_BAD_TLD 2563 0.99 3.68 0.44 183 TR_XM_FormFill2 2555 0.68 1.86 0.44 184 TR_XM_PHPForged 2551 0.68 1.89 0.44 185 AC_DIV_BONANZA 2540 0.38 0.13 0.44 186 FROM_GOV_SPOOF 2523 0.38 0.12 0.43 187 XM_H_PHPOS 2515 0.67 1.86 0.43 188 HTML_TAG_BALANCE_BODY 2514 0.46 0.59 0.43 189 RELAYCOUNTRY_AU 2463 0.43 0.49 0.42 190 SHORT_HELO_AND_INLINE_IMAGE 2458 0.35 0.02 0.42 191 DKIM_ADSP_NXDOMAIN 2441 0.50 0.90 0.42 192 XMBody_17 2440 0.70 2.09 0.42 193 USER_IN_WHITELIST 2431 0.35 0.00 0.42 194 HTML_IMAGE_ONLY_20 2336 0.39 0.34 0.40 195 TM2_M_BODY_EMPTY 2316 0.35 0.10 0.40 196 TM2_M_A_HREF_HREF 2312 0.47 0.80 0.40 197 XMPhish08 2307 0.48 0.91 0.40 198 MPART_ALT_DIFF_COUNT 2292 0.48 0.90 0.39 199 XMBody_78 2283 0.50 1.05 0.39 200 XMPhish11 2282 0.35 0.15 0.39 ----------------------------------------------------------------------