Email: 664616 Autolearn: 0 AvgScore: 1.21 AvgScanTime: 2.00 sec Spam: 116570 Autolearn: 0 AvgScore: 12.00 AvgScanTime: 3.79 sec Ham: 548046 Autolearn: 0 AvgScore: -1.09 AvgScanTime: 1.62 sec Time Spent Running SA: 368.89 hours Time Spent Processing Spam: 122.86 hours Time Spent Processing Ham: 246.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108059 89.67 92.70 89.02 2 DKIM_SIGNED 96554 77.61 82.83 76.50 3 RELAYCOUNTRY_US 94511 83.09 81.08 83.52 4 XM_DK_Pass 93356 76.20 80.09 75.37 5 DCC_CHECK 91218 47.39 78.25 40.83 6 XM_B_Unicode 90380 72.97 77.53 72.00 7 XMListUnsubscribeExists 80825 55.15 69.34 52.13 8 DKIM_VALID 78598 70.50 67.43 71.15 9 DKIM_VALID_AU 57677 51.64 49.48 52.10 10 XM_B_Unicode3 57045 43.10 48.94 41.86 11 XM_DK_Undo_02 51652 14.29 44.31 7.90 12 BAYES_50 47524 48.78 40.77 50.49 13 LOC_TINY_FONT_1 41242 25.97 35.38 23.97 14 MIME_HTML_ONLY 39469 23.70 33.86 21.54 15 HTML_FONT_LOW_CONTRAST 35218 26.35 30.21 25.52 16 BAYES_99 33101 8.50 28.40 4.27 17 FVGT_m_MULTI_ODD 31581 22.16 27.09 21.11 18 DKIM_VALID_EF 28754 25.23 24.67 25.34 19 BOTNET 27663 6.59 23.73 2.94 20 XMSubLong 27246 20.80 23.37 20.25 21 T_KAM_HTML_FONT_INVALID 26934 18.66 23.11 17.71 22 TR_DCC_Bayes_99 26391 5.74 22.64 2.14 23 BAYES_999 25010 6.56 21.45 3.39 24 XM_Body_Dirty_Words 24151 13.34 20.72 11.77 25 DCC_CHECK_NEGATIVE 22938 50.48 19.68 57.03 26 T_TM2_M_HEADER_IN_MSG 21853 25.66 18.75 27.13 27 RELAYCOUNTRY_META 21787 7.59 18.69 5.23 28 XM_Multi_Part_URI 20798 12.86 17.84 11.81 29 DKIM_INVALID 17956 7.12 15.40 5.35 30 XM_UncommonTLD01 17615 5.14 15.11 3.02 31 BOTNET_IPINHOSTNAME 17476 6.28 14.99 4.42 32 FSL_BULK_SIG 16402 8.52 14.07 7.34 33 LOTS_OF_MONEY 16144 9.19 13.85 8.20 34 XM_B_Phish_Phrases 15371 10.33 13.19 9.72 35 XM_B_Unsub 14942 11.11 12.82 10.75 36 XMSexyCombo_05 14877 5.13 12.76 3.50 37 XM_Evil_Numbers_Gen 14314 10.30 12.28 9.88 38 HTML_IMAGE_RATIO_02 14097 7.89 12.09 6.99 39 NO_DNS_FOR_FROM 13617 4.43 11.68 2.89 40 UNTRUSTED_Relay 13346 3.28 11.45 1.54 41 LotsOfNums_01 11811 9.30 10.13 9.12 42 XMSubMetaSx_00 9081 3.97 7.79 3.15 43 BAYES_80 8817 3.78 7.56 2.98 44 HTML_IMAGE_RATIO_04 8772 6.46 7.53 6.24 45 RCVD_IN_MSPIKE_H2 8660 10.72 7.43 11.42 46 MPART_ALT_DIFF 8214 6.21 7.05 6.04 47 XM_H_Long_From01 7933 6.43 6.81 6.35 48 RCVD_IN_BL_SPAMCOP_NET 7631 1.92 6.55 0.94 49 BAYES_60 7412 5.46 6.36 5.27 50 TooManyTo_001 7398 8.10 6.35 8.47 51 MIME_QP_LONG_LINE 6984 6.63 5.99 6.77 52 XM_UB50 6971 1.75 5.98 0.85 53 FROM_EXCESS_BASE64 6461 3.44 5.54 2.99 54 XMStrtUSub 6318 4.34 5.42 4.11 55 RCVD_IN_RP_RNBL 5835 0.94 5.01 0.07 56 RCVD_IN_MSPIKE_BL 5704 2.06 4.89 1.46 57 RELAYCOUNTRY_CA 5702 2.05 4.89 1.45 58 XM_SendGrid 5684 6.20 4.88 6.48 59 XM_CamelCaseFrm001 5622 2.59 4.82 2.11 60 MIME_HTML_MOSTLY 5485 2.83 4.71 2.43 61 TR_Mismatch_TLD_02 5293 0.86 4.54 0.07 62 XM_SPF_SoftFail 5293 2.07 4.54 1.54 63 RCVD_IN_MSPIKE_L3 5215 1.68 4.47 1.09 64 BAYES_95 5194 2.25 4.46 1.78 65 RCVD_IN_MSPIKE_WL 5050 8.52 4.33 9.41 66 RCVD_IN_MSPIKE_H3 5050 8.52 4.33 9.41 67 XM_B_SpammyTLD 5032 2.48 4.32 2.09 68 PDS_OTHER_BAD_TLD 4954 1.37 4.25 0.76 69 SpammyFromTLD_02 4845 1.07 4.16 0.41 70 SpammyFromTLD_01 4770 1.34 4.09 0.76 71 KHOP_HELO_FCRDNS 4738 2.32 4.06 1.95 72 T_REMOTE_IMAGE 4665 4.09 4.00 4.11 73 FROM_SUSPICIOUS_NTLD 4563 0.74 3.91 0.07 74 BAYES_40 4542 5.60 3.90 5.96 75 XMNumbers 4534 3.53 3.89 3.46 76 HTML_MIME_NO_HTML_TAG 4360 2.69 3.74 2.47 77 TM2_M_URI_OPT_OUT 4270 3.11 3.66 2.99 78 MIME_HTML_ONLY_MULTI 4054 3.85 3.48 3.93 79 T_XMDrugObfuBody_08 4024 2.04 3.45 1.74 80 XM_OfRef6 3945 1.60 3.38 1.22 81 XM_DIRTYINTL 3841 1.00 3.30 0.51 82 BAYES_20 3777 4.52 3.24 4.79 83 XMNoVowels 3762 2.44 3.23 2.27 84 FROM_SUSPICIOUS_NTLD_FP 3698 0.61 3.17 0.06 85 HTML_IMAGE_RATIO_06 3613 3.30 3.10 3.34 86 BAYES_00 3492 17.87 3.00 21.04 87 XM_URI_RBL 3483 0.69 2.99 0.20 88 TR_LOTS_OF_MONEY2 3413 0.75 2.93 0.29 89 T_MONEY_PERCENT 3413 0.75 2.93 0.29 90 TR_XM_INV_DKIM 3310 0.58 2.84 0.10 91 LongTLD 3303 0.64 2.83 0.17 92 TM2_M_VERY_LONG_WORD 3218 1.47 2.76 1.19 93 XM_B_Unsub2 3185 1.79 2.73 1.59 94 URI_HEX 3113 1.55 2.67 1.31 95 RELAYCOUNTRY_FR 3103 0.72 2.66 0.31 96 T_XMDrugObfuBody_00 2988 1.09 2.56 0.78 97 URIBL_SBL_A 2977 0.60 2.55 0.18 98 RCVD_IN_PSBL 2802 0.45 2.40 0.04 99 TR_XM_DK_Bayes 2706 12.31 2.32 14.44 100 XMHTML_After_End 2705 0.93 2.32 0.64 101 XMDiploma_00 2663 1.92 2.28 1.84 102 XMPhish30 2645 1.24 2.27 1.02 103 MILLION_HUNDRED 2631 0.44 2.26 0.06 104 HTML_IMAGE_RATIO_08 2623 2.20 2.25 2.18 105 BOTNET_NORDNS 2612 0.42 2.24 0.03 106 RCVD_IN_RP_SAFE 2579 8.39 2.21 9.70 107 T_TooManySym_01 2554 3.88 2.19 4.24 108 TR_XM_PHPDW 2479 0.68 2.13 0.37 109 TR_XM_PHPForged 2451 0.67 2.10 0.36 110 TR_XM_FormFill2 2433 0.66 2.09 0.36 111 XM_H_PHPOS 2430 0.66 2.08 0.35 112 XMSexyCombo_01 2388 0.67 2.05 0.37 113 XM_BadFromFormat 2371 0.46 2.03 0.12 114 RCVD_IN_IADB_LISTED 2359 5.14 2.02 5.81 115 BAYES_05 2327 3.02 2.00 3.24 116 RDNS_DYNAMIC 2298 0.57 1.97 0.27 117 XMBody_17 2249 0.80 1.93 0.56 118 SUBJ_ALL_CAPS 2233 2.03 1.92 2.06 119 XMStockSpam_06 2208 1.27 1.89 1.14 120 T_XMDrugObfuBody_14 2174 2.31 1.86 2.40 121 RCVD_IN_IADB_SPF 2169 4.47 1.86 5.03 122 RCVD_IN_RP_CERTIFIED 2160 7.60 1.85 8.82 123 XMPhish08 2159 0.98 1.85 0.79 124 TR_XM_MaxBayes 2121 0.33 1.82 0.01 125 RCVD_IN_IADB_DK 2107 3.89 1.81 4.33 126 RCVD_IN_IADB_SENDERID 2107 3.97 1.81 4.42 127 ALL_TRUSTED 2084 10.99 1.79 12.94 128 BODY_URI_ONLY 2081 0.35 1.79 0.04 129 XMGenDplmaNmb 1967 1.17 1.69 1.06 130 HTML_TAG_BALANCE_CENTER 1954 0.36 1.68 0.08 131 TR_XM_DK_SendGrid 1940 3.10 1.66 3.40 132 TR_MetaPhish_Combo_01 1939 1.18 1.66 1.08 133 TR_XM_DK_Bayes1 1929 11.44 1.65 13.53 134 URI_TRY_3LD 1881 1.27 1.61 1.20 135 MONEY_FRAUD_5 1867 0.28 1.60 0.00 136 UNPARSEABLE_RELAY 1855 1.96 1.59 2.04 137 T_FILL_THIS_FORM_SHORT 1851 1.17 1.59 1.09 138 ADVANCE_FEE_4_NEW_MONEY 1826 0.28 1.57 0.00 139 TR_XM_DK_Bayes2 1825 10.06 1.57 11.86 140 FROM_MISSP_REPLYTO 1763 0.28 1.51 0.02 141 DKIM_ADSP_NXDOMAIN 1702 0.46 1.46 0.25 142 XMBdyGiftCard01 1667 1.10 1.43 1.03 143 MAILING_LIST_MULTI 1631 2.12 1.40 2.27 144 TR_XM_MaxSPIKE 1631 0.29 1.40 0.06 145 FSL_THIS_IS_ADV 1598 0.32 1.37 0.09 146 RELAYCOUNTRY_GB 1591 1.11 1.36 1.06 147 TR_XM_RelayPhish 1586 0.45 1.36 0.25 148 XM_ProductURIs 1574 0.78 1.35 0.65 149 XM_DK_Undo_01 1560 1.64 1.34 1.70 150 XMGppyBdWords 1554 0.52 1.33 0.35 151 XM_UB60 1535 0.28 1.32 0.05 152 XM_H_PHPMailer 1514 0.62 1.30 0.48 153 DKIM_ADSP_CUSTOM_MED 1500 1.32 1.29 1.33 154 DATE_IN_PAST_03_06 1499 0.36 1.29 0.16 155 XMBrknScrpt_02 1464 0.73 1.26 0.62 156 HTML_FONT_SIZE_LARGE 1464 0.32 1.26 0.12 157 RELAYCOUNTRY_IN 1436 0.33 1.23 0.14 158 TR_Symld_Words 1433 1.26 1.23 1.26 159 DIET_1 1429 0.50 1.23 0.34 160 HTML_SHORT_LINK_IMG_1 1408 0.23 1.21 0.02 161 REMOVE_BEFORE_LINK 1390 0.53 1.19 0.39 162 T_XMHurry_00 1373 0.56 1.18 0.43 163 HDRS_MISSP 1342 0.22 1.15 0.02 164 XM_H_PHPOS_M 1329 0.30 1.14 0.12 165 TR_Mismatch_TLD_01 1320 0.40 1.13 0.24 166 MPART_ALT_DIFF_COUNT 1303 0.58 1.12 0.47 167 XMSubMetaI_00 1296 0.70 1.11 0.61 168 FORGED_GMAIL_RCVD 1295 0.69 1.11 0.60 169 XM_H_MailChimp 1291 0.37 1.11 0.21 170 XMSexyCombo_04 1282 0.28 1.10 0.11 171 XMSubMetaSxObfu_03 1277 0.50 1.10 0.38 172 NO_FM_NAME_IP_HOSTN 1246 0.19 1.07 0.00 173 XMSlimDrugH 1172 0.41 1.01 0.28 174 HTML_IMAGE_ONLY_28 1149 0.50 0.99 0.39 175 NML_ADSP_CUSTOM_MED 1112 1.00 0.95 1.01 176 XM_H_Long_From02 1109 1.21 0.95 1.27 177 RELAYCOUNTRY_AT 1100 0.32 0.94 0.19 178 TO_NO_BRKTS_FROM_MSSP 1074 0.17 0.92 0.01 179 FROM_ADDR_WS 1074 0.16 0.92 0.00 180 PLING_QUERY 1065 0.70 0.91 0.65 181 TR_LOTS_OF_MONEY3 1063 0.45 0.91 0.36 182 FROM_MISSP_EH_MATCH 1061 0.17 0.91 0.01 183 TM2_M_A_HREF_HREF 1059 0.53 0.91 0.45 184 XMBody_78 1002 0.48 0.86 0.40 185 FILL_THIS_FORM 1001 0.55 0.86 0.48 186 FROM_NO_USER 1000 0.15 0.86 0.00 187 HTML_TAG_BALANCE_BODY 980 0.45 0.84 0.37 188 XM_UB99 980 0.15 0.84 0.01 189 HTML_IMAGE_ONLY_04 959 0.20 0.82 0.06 190 RELAYCOUNTRY_DE 933 0.42 0.80 0.34 191 T_Symld_Words_02 930 0.53 0.80 0.47 192 URIBL_BLACK 929 0.15 0.80 0.02 193 THIS_AD 927 0.26 0.80 0.15 194 DATE_IN_PAST_06_12 919 0.32 0.79 0.23 195 XMMoneyMeta_00 911 0.54 0.78 0.48 196 XM_XX_Yahoo 905 0.22 0.78 0.10 197 T_FILL_THIS_FORM_FRAUD_PHISH 897 0.16 0.77 0.03 198 XM_OfRef7 893 0.24 0.77 0.13 199 IMG_ONLY_FM_DOM_INFO 893 0.14 0.77 0.01 200 MONEY_FORM_SHORT 883 0.14 0.76 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 487889 89.67 92.70 89.02 2 RELAYCOUNTRY_US 457750 83.09 81.08 83.52 3 DKIM_SIGNED 419278 77.61 82.83 76.50 4 XM_DK_Pass 413053 76.20 80.09 75.37 5 XM_B_Unicode 394566 72.97 77.53 72.00 6 DKIM_VALID 389946 70.50 67.43 71.15 7 DCC_CHECK_NEGATIVE 312541 50.48 19.68 57.03 8 XMListUnsubscribeExists 285684 55.15 69.34 52.13 9 DKIM_VALID_AU 285553 51.64 49.48 52.10 10 BAYES_50 276689 48.78 40.77 50.49 11 XM_B_Unicode3 229409 43.10 48.94 41.86 12 DCC_CHECK 223770 47.39 78.25 40.83 13 T_TM2_M_HEADER_IN_MSG 148695 25.66 18.75 27.13 14 HTML_FONT_LOW_CONTRAST 139888 26.35 30.21 25.52 15 DKIM_VALID_EF 138901 25.23 24.67 25.34 16 LOC_TINY_FONT_1 131378 25.97 35.38 23.97 17 MIME_HTML_ONLY 118047 23.70 33.86 21.54 18 FVGT_m_MULTI_ODD 115708 22.16 27.09 21.11 19 BAYES_00 115300 17.87 3.00 21.04 20 XMSubLong 110994 20.80 23.37 20.25 21 T_KAM_HTML_FONT_INVALID 97079 18.66 23.11 17.71 22 TR_XM_DK_Bayes 79128 12.31 2.32 14.44 23 TR_XM_DK_Bayes1 74128 11.44 1.65 13.53 24 ALL_TRUSTED 70934 10.99 1.79 12.94 25 TR_XM_DK_Bayes2 65016 10.06 1.57 11.86 26 XM_Multi_Part_URI 64697 12.86 17.84 11.81 27 XM_Body_Dirty_Words 64512 13.34 20.72 11.77 28 RCVD_IN_MSPIKE_H2 62609 10.72 7.43 11.42 29 XM_B_Unsub 58924 11.11 12.82 10.75 30 XM_Evil_Numbers_Gen 54172 10.30 12.28 9.88 31 XM_B_Phish_Phrases 53279 10.33 13.19 9.72 32 RCVD_IN_RP_SAFE 53155 8.39 2.21 9.70 33 RCVD_IN_MSPIKE_H3 51546 8.52 4.33 9.41 34 RCVD_IN_MSPIKE_WL 51546 8.52 4.33 9.41 35 LotsOfNums_01 49992 9.30 10.13 9.12 36 RCVD_IN_RP_CERTIFIED 48348 7.60 1.85 8.82 37 TooManyTo_001 46429 8.10 6.35 8.47 38 LOTS_OF_MONEY 44942 9.19 13.85 8.20 39 XM_DK_Undo_02 43307 14.29 44.31 7.90 40 FSL_BULK_SIG 40231 8.52 14.07 7.34 41 HTML_IMAGE_RATIO_02 38312 7.89 12.09 6.99 42 MIME_QP_LONG_LINE 37098 6.63 5.99 6.77 43 XM_DKIMWhitelistDomains 37045 5.58 0.02 6.76 44 XM_SendGrid 35535 6.20 4.88 6.48 45 XM_H_Long_From01 34780 6.43 6.81 6.35 46 HTML_IMAGE_RATIO_04 34180 6.46 7.53 6.24 47 MPART_ALT_DIFF 33079 6.21 7.05 6.04 48 BAYES_40 32644 5.60 3.90 5.96 49 RCVD_IN_IADB_LISTED 31817 5.14 2.02 5.81 50 DKIM_INVALID 29332 7.12 15.40 5.35 51 BAYES_60 28895 5.46 6.36 5.27 52 RELAYCOUNTRY_META 28648 7.59 18.69 5.23 53 RCVD_IN_IADB_SPF 27559 4.47 1.86 5.03 54 BAYES_20 26237 4.52 3.24 4.79 55 BOTNET_IPINHOSTNAME 24251 6.28 14.99 4.42 56 RCVD_IN_IADB_SENDERID 24247 3.97 1.81 4.42 57 RCVD_IN_IADB_DK 23721 3.89 1.81 4.33 58 BAYES_99 23380 8.50 28.40 4.27 59 XM_PDF 23342 3.62 0.63 4.26 60 T_TooManySym_01 23259 3.88 2.19 4.24 61 T_REMOTE_IMAGE 22525 4.09 4.00 4.11 62 XMStrtUSub 22507 4.34 5.42 4.11 63 MIME_HTML_ONLY_MULTI 21557 3.85 3.48 3.93 64 RCVD_IN_IADB_VOUCHED 20394 3.18 0.63 3.72 65 XMSexyCombo_05 19206 5.13 12.76 3.50 66 IN_ZIMBRA_NJ_WHITELIST 19054 2.87 0.01 3.48 67 XMNumbers 18954 3.53 3.89 3.46 68 TR_XM_DK_SendGrid 18660 3.10 1.66 3.40 69 BAYES_999 18578 6.56 21.45 3.39 70 XM_H_Trusted_IP 18396 2.77 0.00 3.36 71 HTML_IMAGE_RATIO_06 18331 3.30 3.10 3.34 72 BAYES_05 17736 3.02 2.00 3.24 73 XMSubMetaSx_00 17275 3.97 7.79 3.15 74 XM_UncommonTLD01 16540 5.14 15.11 3.02 75 TM2_M_URI_OPT_OUT 16406 3.11 3.66 2.99 76 FROM_EXCESS_BASE64 16380 3.44 5.54 2.99 77 BAYES_80 16327 3.78 7.56 2.98 78 BOTNET 16113 6.59 23.73 2.94 79 NO_DNS_FOR_FROM 15814 4.43 11.68 2.89 80 ANY_BOUNCE_MESSAGE 14131 2.22 0.53 2.58 81 BOUNCE_MESSAGE 14123 2.21 0.51 2.58 82 HTML_MIME_NO_HTML_TAG 13534 2.69 3.74 2.47 83 TooManyTo_002 13510 2.15 0.64 2.47 84 MIME_HTML_MOSTLY 13326 2.83 4.71 2.43 85 T_XMDrugObfuBody_14 13168 2.31 1.86 2.40 86 RCVD_IN_IADB_OPTIN 12989 2.04 0.47 2.37 87 XMNoVowels 12452 2.44 3.23 2.27 88 MAILING_LIST_MULTI 12444 2.12 1.40 2.27 89 HTML_IMAGE_RATIO_08 11972 2.20 2.25 2.18 90 TR_DCC_Bayes_99 11741 5.74 22.64 2.14 91 XM_CamelCaseFrm001 11568 2.59 4.82 2.11 92 T_TooManySym_02 11461 1.84 0.69 2.09 93 XM_B_SpammyTLD 11439 2.48 4.32 2.09 94 SUBJ_ALL_CAPS 11266 2.03 1.92 2.06 95 UNPARSEABLE_RELAY 11186 1.96 1.59 2.04 96 KHOP_HELO_FCRDNS 10679 2.32 4.06 1.95 97 XMDiploma_00 10067 1.92 2.28 1.84 98 BAYES_95 9762 2.25 4.46 1.78 99 T_XMDrugObfuBody_08 9523 2.04 3.45 1.74 100 TooManyTo_003 9478 1.52 0.51 1.73 101 XM_DK_Undo_01 9344 1.64 1.34 1.70 102 XM_B_Unsub2 8726 1.79 2.73 1.59 103 IN_HORDE_ADDRESS_BOOK 8689 1.32 0.07 1.59 104 INVALID_MSGID 8610 1.35 0.29 1.57 105 TVD_RCVD_IP 8552 1.38 0.51 1.56 106 UNTRUSTED_Relay 8463 3.28 11.45 1.54 107 XM_SPF_SoftFail 8454 2.07 4.54 1.54 108 HTML_FONT_FACE_BAD 8403 1.37 0.60 1.53 109 RCVD_IN_MSPIKE_BL 8002 2.06 4.89 1.46 110 RELAYCOUNTRY_CA 7949 2.05 4.89 1.45 111 HELO_NODOT 7904 1.28 0.54 1.44 112 HELO_NO_DOMAIN 7903 1.28 0.54 1.44 113 TooManyTo_004 7383 1.19 0.44 1.35 114 DKIM_ADSP_CUSTOM_MED 7304 1.32 1.29 1.33 115 URI_HEX 7164 1.55 2.67 1.31 116 XM_GoogleGroups 7159 1.17 0.55 1.31 117 TO_MALFORMED 7135 1.08 0.05 1.30 118 XMCapTrack 7079 1.15 0.48 1.29 119 XM_H_Long_From02 6940 1.21 0.95 1.27 120 TR_Symld_Words 6917 1.26 1.23 1.26 121 XM_OfRef6 6669 1.60 3.38 1.22 122 CK_HELO_DYNAMIC_SPLIT_IP 6623 1.07 0.40 1.21 123 HELO_DYNAMIC_IPADDR2 6618 1.03 0.21 1.21 124 URI_TRY_3LD 6585 1.27 1.61 1.20 125 TM2_M_VERY_LONG_WORD 6544 1.47 2.76 1.19 126 XMGappySubj_01 6422 1.05 0.46 1.17 127 XMStockSpam_06 6244 1.27 1.89 1.14 128 TooManyTo_005 6238 1.01 0.39 1.14 129 XMSubNoVowel 6021 0.95 0.27 1.10 130 RCVD_IN_MSPIKE_L3 5958 1.68 4.47 1.09 131 T_FILL_THIS_FORM_SHORT 5954 1.17 1.59 1.09 132 TR_MetaPhish_Combo_01 5900 1.18 1.66 1.08 133 XMGenDplmaNmb 5834 1.17 1.69 1.06 134 RELAYCOUNTRY_GB 5812 1.11 1.36 1.06 135 XMBdyGiftCard01 5643 1.10 1.43 1.03 136 XMPhish30 5568 1.24 2.27 1.02 137 NML_ADSP_CUSTOM_MED 5524 1.00 0.95 1.01 138 RCVD_IN_BL_SPAMCOP_NET 5155 1.92 6.55 0.94 139 TR_MSPIKEBAYES00 4796 0.72 0.01 0.88 140 HTTPS_HTTP_MISMATCH 4763 0.82 0.59 0.87 141 XM_UB50 4632 1.75 5.98 0.85 142 USER_IN_DEF_DKIM_WL 4613 0.70 0.01 0.84 143 XMPhish08 4342 0.98 1.85 0.79 144 T_XMDrugObfuBody_00 4260 1.09 2.56 0.78 145 SpammyFromTLD_01 4153 1.34 4.09 0.76 146 PDS_OTHER_BAD_TLD 4141 1.37 4.25 0.76 147 XMBody_95 3849 0.59 0.07 0.70 148 FROM_GOV_DKIM_AU 3696 0.61 0.32 0.67 149 XM_ProductURIs 3581 0.78 1.35 0.65 150 PLING_QUERY 3558 0.70 0.91 0.65 151 XMHTML_After_End 3495 0.93 2.32 0.64 152 XMBrknScrpt_02 3386 0.73 1.26 0.62 153 XMSubMetaI_00 3326 0.70 1.11 0.61 154 XM_SPF_Unknown 3310 0.60 0.57 0.60 155 MISSING_HEADERS 3286 0.58 0.50 0.60 156 FORGED_GMAIL_RCVD 3278 0.69 1.11 0.60 157 RELAYCOUNTRY_AU 3202 0.58 0.56 0.58 158 T_OBFU_PDF_ATTACH 3134 0.50 0.15 0.57 159 XMBody_17 3061 0.80 1.93 0.56 160 T_TooManySym_03 3027 0.49 0.22 0.55 161 XMHTMLBadTable_001 3024 0.59 0.76 0.55 162 XM_B_REG_HTML 2915 0.54 0.61 0.53 163 HTML_IMAGE_ONLY_20 2892 0.49 0.32 0.53 164 XM_RXBody 2871 0.50 0.40 0.52 165 XM_DIRTYINTL 2776 1.00 3.30 0.51 166 XMMoneyMeta_00 2656 0.54 0.78 0.48 167 XM_H_PHPMailer 2637 0.62 1.30 0.48 168 FILL_THIS_FORM 2636 0.55 0.86 0.48 169 SUBJ_DOLLARS 2629 0.46 0.38 0.48 170 MPART_ALT_DIFF_COUNT 2574 0.58 1.12 0.47 171 XM_ShortIntro_01 2573 0.45 0.34 0.47 172 T_Symld_Words_02 2571 0.53 0.80 0.47 173 TM2_M_A_HREF_HREF 2480 0.53 0.91 0.45 174 XMLngstWrd_00 2479 0.43 0.34 0.45 175 HTML_IMAGE_ONLY_32 2379 0.39 0.17 0.43 176 FROM_GOV_SPOOF 2372 0.40 0.22 0.43 177 T_XMHurry_00 2359 0.56 1.18 0.43 178 XMPhish14 2324 0.44 0.54 0.42 179 SpammyFromTLD_02 2265 1.07 4.16 0.41 180 XMLngstWrd_01 2250 0.39 0.31 0.41 181 XMBody_78 2209 0.48 0.86 0.40 182 RCVD_IN_SORBS_DUL 2177 0.34 0.08 0.40 183 HTML_IMAGE_ONLY_28 2164 0.50 0.99 0.39 184 REMOVE_BEFORE_LINK 2148 0.53 1.19 0.39 185 USER_IN_WHITELIST 2131 0.32 0.00 0.39 186 XMGappySubj_02 2092 0.32 0.03 0.38 187 SHORT_HELO_AND_INLINE_IMAGE 2065 0.32 0.03 0.38 188 XMSubMetaSxObfu_03 2059 0.50 1.10 0.38 189 MSGID_FROM_MTA_HEADER 2058 0.38 0.41 0.38 190 URI_NOVOWEL 2055 0.37 0.36 0.37 191 XMSexyCombo_01 2049 0.67 2.05 0.37 192 TR_XM_PHPDW 2046 0.68 2.13 0.37 193 HTML_TAG_BALANCE_BODY 2040 0.45 0.84 0.37 194 TM2_M_BODY_EMPTY 1986 0.31 0.07 0.36 195 XM_Body_Obfu01 1985 0.42 0.67 0.36 196 TR_XM_PHPForged 1984 0.67 2.10 0.36 197 RCVD_IN_MSPIKE_L4 1981 0.33 0.20 0.36 198 TR_LOTS_OF_MONEY3 1958 0.45 0.91 0.36 199 TR_XM_FormFill2 1957 0.66 2.09 0.36 200 XM_H_PHPOS 1925 0.66 2.08 0.35 ----------------------------------------------------------------------