Email: 395927 Autolearn: 0 AvgScore: 1.29 AvgScanTime: 1.88 sec Spam: 87318 Autolearn: 0 AvgScore: 12.00 AvgScanTime: 2.90 sec Ham: 308609 Autolearn: 0 AvgScore: -1.74 AvgScanTime: 1.59 sec Time Spent Running SA: 206.50 hours Time Spent Processing Spam: 70.34 hours Time Spent Processing Ham: 136.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 82854 89.62 94.89 88.13 2 DCC_CHECK 72035 57.34 82.50 50.23 3 XM_B_Unicode 66275 74.58 75.90 74.20 4 DKIM_SIGNED 63384 72.51 72.59 72.48 5 XM_DK_Pass 62451 71.64 71.52 71.68 6 RELAYCOUNTRY_US 61019 76.25 69.88 78.05 7 DKIM_VALID 60500 69.34 69.29 69.35 8 XMListUnsubscribeExists 55310 53.98 63.34 51.33 9 DKIM_VALID_AU 45937 54.96 52.61 55.63 10 BAYES_50 42656 51.47 48.85 52.21 11 XM_DK_Undo_02 35175 15.08 40.28 7.95 12 MIME_HTML_ONLY 31913 25.40 36.55 22.25 13 XM_B_Unicode3 31530 41.08 36.11 42.48 14 T_KAM_HTML_FONT_INVALID 26672 23.41 30.55 21.39 15 LOC_TINY_FONT_1 26033 27.91 29.81 27.38 16 DKIM_VALID_EF 25475 26.39 29.17 25.60 17 BAYES_99 23104 8.83 26.46 3.84 18 HTML_FONT_LOW_CONTRAST 21630 27.50 24.77 28.28 19 FSL_BULK_SIG 21006 16.57 24.06 14.45 20 FVGT_m_MULTI_ODD 20483 21.33 23.46 20.73 21 RELAYCOUNTRY_META 18985 8.61 21.74 4.90 22 BOTNET 18503 9.74 21.19 6.50 23 TR_DCC_Bayes_99 18477 6.29 21.16 2.08 24 BAYES_999 18401 6.97 21.07 2.98 25 XM_UncommonTLD01 17908 7.35 20.51 3.63 26 XMSubLong 17821 18.79 20.41 18.33 27 XM_B_Unsub 16599 16.98 19.01 16.40 28 XM_Body_Dirty_Words 15885 14.26 18.19 13.15 29 XM_Multi_Part_URI 14926 14.64 17.09 13.95 30 DCC_CHECK_NEGATIVE 14445 41.51 16.54 48.58 31 T_TM2_M_HEADER_IN_MSG 13639 19.59 15.62 20.71 32 UNTRUSTED_Relay 13068 4.53 14.97 1.58 33 HTML_IMAGE_RATIO_02 12051 9.71 13.80 8.56 34 TooManyTo_001 11819 12.03 13.54 11.61 35 BOTNET_IPINHOSTNAME 11245 7.36 12.88 5.80 36 LOTS_OF_MONEY 10898 8.87 12.48 7.84 37 XM_B_Phish_Phrases 9419 8.49 10.79 7.84 38 XMSexyCombo_05 8971 6.05 10.27 4.86 39 XM_UB50 8971 3.04 10.27 0.99 40 ALL_TRUSTED 8934 16.51 10.23 18.29 41 LotsOfNums_01 8487 8.68 9.72 8.38 42 TooManyTo_002 8136 6.05 9.32 5.12 43 TooManyTo_003 7949 4.79 9.10 3.57 44 TooManyTo_004 7626 3.67 8.73 2.24 45 RCVD_IN_MSPIKE_H2 7575 12.68 8.68 13.81 46 XM_CamelCaseFrm001 7557 3.55 8.65 2.11 47 NO_DNS_FOR_FROM 6824 3.55 7.82 2.34 48 XM_Evil_Numbers_Gen 6654 9.61 7.62 10.17 49 SUSPICIOUS_RECIPS 6502 2.05 7.45 0.53 50 RCVD_IN_MSPIKE_BL 6217 2.97 7.12 1.79 51 TooManyTo_005 6020 2.63 6.89 1.42 52 XM_H_Long_From01 6012 5.77 6.89 5.46 53 RCVD_IN_MSPIKE_L3 5987 2.85 6.86 1.71 54 RELAYCOUNTRY_CA 5561 2.88 6.37 1.89 55 T_REMOTE_IMAGE 5332 4.03 6.11 3.44 56 UNPARSEABLE_RELAY 5047 9.30 5.78 10.29 57 MPART_ALT_DIFF 4937 5.45 5.65 5.39 58 BAYES_80 4906 3.36 5.62 2.73 59 SpammyFromTLD_02 4860 1.34 5.57 0.14 60 XM_B_COVIDMETA 4817 2.83 5.52 2.07 61 XM_SPF_SoftFail 4793 1.97 5.49 0.97 62 XMSubMetaSx_00 4758 4.35 5.45 4.04 63 PDS_OTHER_BAD_TLD 4655 1.87 5.33 0.89 64 URIBL_SBL_A 4503 1.24 5.16 0.13 65 BAYES_40 4491 6.17 5.14 6.46 66 HTML_IMAGE_RATIO_04 4459 7.07 5.11 7.62 67 URI_WP_HACKED_2 4405 2.55 5.04 1.84 68 KHOP_HELO_FCRDNS 4271 1.90 4.89 1.06 69 BAYES_60 4247 5.02 4.86 5.06 70 XMNumbers 4195 3.57 4.80 3.23 71 FROM_SUSPICIOUS_NTLD 4085 1.09 4.68 0.08 72 FROM_SUSPICIOUS_NTLD_FP 4036 1.08 4.62 0.07 73 RELAYCOUNTRY_FR 3967 1.16 4.54 0.21 74 XM_SendGrid 3865 6.50 4.43 7.08 75 TR_XM_MaxBayes 3804 0.98 4.36 0.03 76 LongTLD 3792 1.09 4.34 0.17 77 XM_B_SpammyTLD 3705 3.12 4.24 2.80 78 MIME_HTML_MOSTLY 3621 3.06 4.15 2.75 79 MIME_QP_LONG_LINE 3361 4.32 3.85 4.45 80 XMStrtUSub 3299 4.37 3.78 4.54 81 SHORT_SHORTNER 3298 0.86 3.78 0.04 82 SHORT_URI_2 3281 0.88 3.76 0.07 83 T_XMDrugObfuBody_08 3256 2.45 3.73 2.08 84 REPLYTO_WITHOUT_TO_CC 3219 0.88 3.69 0.08 85 RCVD_IN_BL_SPAMCOP_NET 3105 1.83 3.56 1.34 86 HTML_SHORT_LINK_IMG_1 3058 0.78 3.50 0.01 87 HTML_IMAGE_RATIO_06 3047 3.75 3.49 3.82 88 HTML_IMAGE_ONLY_04 3032 0.82 3.47 0.07 89 HDRS_LCASE_IMGONLY 2997 0.78 3.43 0.03 90 MIME_HEADER_CTYPE_ONLY 2986 0.94 3.42 0.24 91 HTML_SHORT_CENTER 2949 0.75 3.38 0.01 92 DKIM_INVALID 2884 3.17 3.30 3.13 93 SORTED_RECIPS 2766 0.71 3.17 0.02 94 RDNS_DYNAMIC 2723 1.02 3.12 0.43 95 RCVD_IN_MSPIKE_WL 2683 7.47 3.07 8.71 96 RCVD_IN_MSPIKE_H3 2683 7.47 3.07 8.71 97 TR_LOTS_OF_MONEY3 2634 0.98 3.02 0.40 98 XM_OfRef6 2579 1.74 2.95 1.40 99 BAYES_95 2542 1.97 2.91 1.71 100 DATE_IN_PAST_06_12 2525 0.82 2.89 0.24 101 BAYES_20 2498 3.82 2.86 4.10 102 XM_DIRTYINTL 2319 0.98 2.66 0.51 103 TR_XM_PhishingBody 2310 1.75 2.65 1.50 104 HEXHASH_WORD 2225 0.56 2.55 0.00 105 SpammyFromTLD_01 2224 0.90 2.55 0.43 106 MIME_HTML_ONLY_MULTI 2171 3.15 2.49 3.34 107 DATE_IN_PAST_03_06 2167 0.60 2.48 0.07 108 TM2_M_URI_OPT_OUT 2100 3.20 2.41 3.43 109 TR_XM_PHPDW 2089 0.89 2.39 0.46 110 FROM_EXCESS_BASE64 2074 3.46 2.38 3.77 111 TR_XM_PHPForged 2038 0.86 2.33 0.45 112 XMBody_17 2027 0.98 2.32 0.60 113 TR_XM_FormFill2 2019 0.86 2.31 0.44 114 XM_H_PHPOS 2016 0.85 2.31 0.44 115 TO_EQ_FM_DOM_HTML_IMG 1937 0.49 2.22 0.00 116 TR_XM_DK_SendGrid 1845 3.69 2.11 4.13 117 XM_URI_RBL 1821 0.59 2.09 0.17 118 HTML_IMAGE_RATIO_08 1821 2.12 2.09 2.13 119 T_TooManySym_01 1808 4.30 2.07 4.93 120 BAYES_00 1792 17.07 2.05 21.32 121 XM_B_Unsub2 1771 1.76 2.03 1.69 122 SUBJ_DOLLARS 1769 0.72 2.03 0.35 123 TR_XM_RelayPhish 1751 0.59 2.01 0.19 124 SUBJ_ALL_CAPS 1751 1.40 2.01 1.23 125 RCVD_IN_RP_RNBL 1735 0.50 1.99 0.08 126 T_Symld_Words_02 1715 0.74 1.96 0.40 127 NO_FM_NAME_IP_HOSTN 1705 0.43 1.95 0.00 128 T_XMHurry_00 1680 0.81 1.92 0.50 129 FROM_ADDR_WS 1609 0.41 1.84 0.00 130 TM2_M_VERY_LONG_WORD 1603 1.66 1.84 1.61 131 RELAYCOUNTRY_DE 1601 0.72 1.83 0.40 132 FROM_NO_USER 1558 0.40 1.78 0.01 133 XMDiploma_00 1522 1.30 1.74 1.18 134 RCVD_IN_RP_SAFE 1521 8.89 1.74 10.92 135 T_FILL_THIS_FORM_SHORT 1495 1.34 1.71 1.23 136 LOADSA_MONEY_COMBO 1454 0.41 1.67 0.06 137 XM_DK_Undo_01 1404 1.57 1.61 1.56 138 TR_XM_MaxSPIKE 1393 0.40 1.60 0.06 139 XMSexyCombo_01 1385 0.74 1.59 0.50 140 TR_XM_DK_Bayes 1378 11.77 1.58 14.65 141 DATE_IN_PAST_12_24 1371 0.38 1.57 0.05 142 TR_XM_DK_Bayes1 1332 11.48 1.53 14.30 143 BODY_URI_ONLY 1328 0.36 1.52 0.03 144 URI_HEX 1291 1.25 1.48 1.18 145 RCVD_IN_IADB_LISTED 1273 2.75 1.46 3.12 146 XMHTML_After_End 1268 0.72 1.45 0.51 147 BOTNET_NORDNS 1202 3.07 1.38 3.56 148 RELAYCOUNTRY_NL 1175 0.41 1.35 0.14 149 RCVD_IN_IADB_SPF 1168 2.43 1.34 2.74 150 XMStockSpam_06 1156 1.45 1.32 1.49 151 HK_RANDOM_REPLYTO 1152 0.50 1.32 0.27 152 RCVD_IN_IADB_DK 1152 2.17 1.32 2.41 153 RCVD_IN_IADB_SENDERID 1148 2.21 1.31 2.46 154 URI_TRY_3LD 1119 1.48 1.28 1.53 155 TR_Mismatch_TLD_02 1098 0.33 1.26 0.06 156 BAYES_05 1079 2.28 1.24 2.57 157 XM_H_PHPMailer 1079 0.65 1.24 0.48 158 T_MONEY_PERCENT 1069 0.53 1.22 0.34 159 TR_LOTS_OF_MONEY2 1069 0.53 1.22 0.34 160 T_XMDrugObfuBody_14 1015 1.24 1.16 1.26 161 TR_XM_DK_Bayes2 974 10.63 1.12 13.32 162 RCVD_IN_RP_CERTIFIED 958 8.11 1.10 10.09 163 XMGenDplmaNmb 938 0.81 1.07 0.74 164 XMPhish30 938 0.51 1.07 0.35 165 TR_Mismatch_TLD_01 932 0.36 1.07 0.16 166 FROM_MISSP_REPLYTO 913 0.23 1.05 0.00 167 HTML_MIME_NO_HTML_TAG 912 1.44 1.04 1.56 168 URIBL_ABUSE_SURBL 899 0.29 1.03 0.08 169 XM_H_PHPOS_M 898 0.40 1.03 0.22 170 DEAR_FRIEND 871 0.26 1.00 0.05 171 DKIM_ADSP_CUSTOM_MED 862 1.10 0.99 1.13 172 XM_ProductURIs 860 1.26 0.98 1.34 173 URIBL_BLACK 860 0.23 0.98 0.01 174 TVD_RCVD_IP 857 2.34 0.98 2.72 175 HTML_TITLE_SUBJ_DIFF 836 0.27 0.96 0.07 176 FROM_MISSP_DYNIP 834 0.21 0.96 0.00 177 MAILING_LIST_MULTI 830 1.72 0.95 1.94 178 XMHTMLBadTable_001 826 0.70 0.95 0.62 179 RELAYCOUNTRY_BG 824 0.22 0.94 0.02 180 XM_Combo_Sbj 816 0.51 0.93 0.39 181 XM_UB60 795 0.25 0.91 0.07 182 TR_XM_INV_DKIM 792 0.27 0.91 0.09 183 InconsistentFrom_001 782 0.21 0.90 0.01 184 RCVD_IN_PSBL 773 0.26 0.89 0.09 185 XMPhish08 765 0.80 0.88 0.78 186 RELAYCOUNTRY_GB 761 0.80 0.87 0.78 187 XMSubMetaI_00 749 0.47 0.86 0.35 188 XM_UB99 746 0.19 0.85 0.01 189 FORGED_GMAIL_RCVD 746 0.57 0.85 0.49 190 RELAYCOUNTRY_AT 740 0.35 0.85 0.21 191 MPART_ALT_DIFF_COUNT 738 0.45 0.85 0.34 192 XMBrknScrpt_02 734 0.76 0.84 0.74 193 NML_ADSP_CUSTOM_MED 720 0.83 0.82 0.84 194 XMReplyNow 709 0.23 0.81 0.07 195 URI_NOVOWEL 708 0.59 0.81 0.52 196 XMSubNoVowel 695 1.61 0.80 1.84 197 TR_MetaPhish_Combo_01 695 0.85 0.80 0.87 198 HK_SCAM 684 0.28 0.78 0.13 199 XMBdyGiftCard01 683 1.50 0.78 1.70 200 NORDNS_LOW_CONTRAST 674 0.19 0.77 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 271963 89.62 94.89 88.13 2 RELAYCOUNTRY_US 240882 76.25 69.88 78.05 3 XM_B_Unicode 229000 74.58 75.90 74.20 4 DKIM_SIGNED 223687 72.51 72.59 72.48 5 XM_DK_Pass 221203 71.64 71.52 71.68 6 DKIM_VALID 214027 69.34 69.29 69.35 7 DKIM_VALID_AU 171672 54.96 52.61 55.63 8 BAYES_50 161137 51.47 48.85 52.21 9 XMListUnsubscribeExists 158399 53.98 63.34 51.33 10 DCC_CHECK 155007 57.34 82.50 50.23 11 DCC_CHECK_NEGATIVE 149918 41.51 16.54 48.58 12 XM_B_Unicode3 131103 41.08 36.11 42.48 13 HTML_FONT_LOW_CONTRAST 87268 27.50 24.77 28.28 14 LOC_TINY_FONT_1 84483 27.91 29.81 27.38 15 DKIM_VALID_EF 78996 26.39 29.17 25.60 16 MIME_HTML_ONLY 68669 25.40 36.55 22.25 17 T_KAM_HTML_FONT_INVALID 66016 23.41 30.55 21.39 18 BAYES_00 65783 17.07 2.05 21.32 19 FVGT_m_MULTI_ODD 63964 21.33 23.46 20.73 20 T_TM2_M_HEADER_IN_MSG 63924 19.59 15.62 20.71 21 XMSubLong 56581 18.79 20.41 18.33 22 ALL_TRUSTED 56446 16.51 10.23 18.29 23 XM_B_Unsub 50619 16.98 19.01 16.40 24 TR_XM_DK_Bayes 45220 11.77 1.58 14.65 25 FSL_BULK_SIG 44596 16.57 24.06 14.45 26 TR_XM_DK_Bayes1 44134 11.48 1.53 14.30 27 XM_Multi_Part_URI 43056 14.64 17.09 13.95 28 RCVD_IN_MSPIKE_H2 42617 12.68 8.68 13.81 29 TR_XM_DK_Bayes2 41111 10.63 1.12 13.32 30 XM_Body_Dirty_Words 40590 14.26 18.19 13.15 31 TooManyTo_001 35824 12.03 13.54 11.61 32 RCVD_IN_RP_SAFE 33692 8.89 1.74 10.92 33 UNPARSEABLE_RELAY 31755 9.30 5.78 10.29 34 XM_Evil_Numbers_Gen 31395 9.61 7.62 10.17 35 RCVD_IN_RP_CERTIFIED 31136 8.11 1.10 10.09 36 XM_DKIMWhitelistDomains 29832 7.54 0.04 9.67 37 RCVD_IN_MSPIKE_H3 26893 7.47 3.07 8.71 38 RCVD_IN_MSPIKE_WL 26893 7.47 3.07 8.71 39 HTML_IMAGE_RATIO_02 26404 9.71 13.80 8.56 40 LotsOfNums_01 25875 8.68 9.72 8.38 41 XM_DK_Undo_02 24523 15.08 40.28 7.95 42 LOTS_OF_MONEY 24206 8.87 12.48 7.84 43 XM_B_Phish_Phrases 24202 8.49 10.79 7.84 44 HTML_IMAGE_RATIO_04 23517 7.07 5.11 7.62 45 XM_SendGrid 21855 6.50 4.43 7.08 46 BOTNET 20053 9.74 21.19 6.50 47 BAYES_40 19951 6.17 5.14 6.46 48 BOTNET_IPINHOSTNAME 17914 7.36 12.88 5.80 49 IN_ZIMBRA_NJ_WHITELIST 16904 4.27 0.02 5.48 50 XM_H_Long_From01 16841 5.77 6.89 5.46 51 MPART_ALT_DIFF 16635 5.45 5.65 5.39 52 XM_H_Trusted_IP 16218 4.10 0.00 5.26 53 TooManyTo_002 15816 6.05 9.32 5.12 54 BAYES_60 15624 5.02 4.86 5.06 55 T_TooManySym_01 15206 4.30 2.07 4.93 56 RELAYCOUNTRY_META 15114 8.61 21.74 4.90 57 XMSexyCombo_05 14989 6.05 10.27 4.86 58 XMStrtUSub 14007 4.37 3.78 4.54 59 MIME_QP_LONG_LINE 13734 4.32 3.85 4.45 60 TR_XM_DK_SendGrid 12755 3.69 2.11 4.13 61 BAYES_20 12638 3.82 2.86 4.10 62 XMSubMetaSx_00 12473 4.35 5.45 4.04 63 BAYES_99 11853 8.83 26.46 3.84 64 HTML_IMAGE_RATIO_06 11800 3.75 3.49 3.82 65 FROM_EXCESS_BASE64 11644 3.46 2.38 3.77 66 XM_UncommonTLD01 11210 7.35 20.51 3.63 67 TooManyTo_003 11020 4.79 9.10 3.57 68 BOTNET_NORDNS 10972 3.07 1.38 3.56 69 T_REMOTE_IMAGE 10631 4.03 6.11 3.44 70 TM2_M_URI_OPT_OUT 10582 3.20 2.41 3.43 71 MIME_HTML_ONLY_MULTI 10304 3.15 2.49 3.34 72 XMNumbers 9956 3.57 4.80 3.23 73 DKIM_INVALID 9660 3.17 3.30 3.13 74 RCVD_IN_IADB_LISTED 9631 2.75 1.46 3.12 75 BAYES_999 9211 6.97 21.07 2.98 76 XM_B_SpammyTLD 8646 3.12 4.24 2.80 77 MIME_HTML_MOSTLY 8479 3.06 4.15 2.75 78 RCVD_IN_IADB_SPF 8464 2.43 1.34 2.74 79 BAYES_80 8411 3.36 5.62 2.73 80 TVD_RCVD_IP 8391 2.34 0.98 2.72 81 T_TooManySym_02 8144 2.20 0.63 2.64 82 BAYES_05 7942 2.28 1.24 2.57 83 RCVD_IN_IADB_SENDERID 7596 2.21 1.31 2.46 84 CK_HELO_DYNAMIC_SPLIT_IP 7544 2.07 0.76 2.44 85 HELO_DYNAMIC_IPADDR2 7541 2.04 0.61 2.44 86 RCVD_IN_IADB_DK 7423 2.17 1.32 2.41 87 INVALID_MSGID 7316 1.89 0.18 2.37 88 NO_DNS_FOR_FROM 7218 3.55 7.82 2.34 89 TO_MALFORMED 7101 1.81 0.06 2.30 90 ANY_BOUNCE_MESSAGE 6955 1.82 0.27 2.25 91 BOUNCE_MESSAGE 6950 1.82 0.27 2.25 92 TooManyTo_004 6924 3.67 8.73 2.24 93 HTML_IMAGE_RATIO_08 6562 2.12 2.09 2.13 94 XM_CamelCaseFrm001 6510 3.55 8.65 2.11 95 T_XMDrugObfuBody_08 6432 2.45 3.73 2.08 96 TR_DCC_Bayes_99 6418 6.29 21.16 2.08 97 XM_B_COVIDMETA 6380 2.83 5.52 2.07 98 XM_PDF 6160 1.61 0.26 2.00 99 MAILING_LIST_MULTI 5979 1.72 0.95 1.94 100 RELAYCOUNTRY_CA 5842 2.88 6.37 1.89 101 RCVD_IN_IADB_VOUCHED 5833 1.56 0.38 1.89 102 URI_WP_HACKED_2 5691 2.55 5.04 1.84 103 XMSubNoVowel 5679 1.61 0.80 1.84 104 RCVD_IN_MSPIKE_BL 5529 2.97 7.12 1.79 105 RCVD_IN_MSPIKE_L3 5285 2.85 6.86 1.71 106 BAYES_95 5269 1.97 2.91 1.71 107 XMBdyGiftCard01 5260 1.50 0.78 1.70 108 XM_B_Unsub2 5206 1.76 2.03 1.69 109 IN_HORDE_ADDRESS_BOOK 5137 1.30 0.03 1.66 110 TM2_M_VERY_LONG_WORD 4974 1.66 1.84 1.61 111 UNTRUSTED_Relay 4875 4.53 14.97 1.58 112 XM_DK_Undo_01 4819 1.57 1.61 1.56 113 HTML_MIME_NO_HTML_TAG 4805 1.44 1.04 1.56 114 HTML_FONT_FACE_BAD 4739 1.29 0.40 1.54 115 USER_IN_DEF_DKIM_WL 4739 1.20 0.00 1.54 116 URI_TRY_3LD 4724 1.48 1.28 1.53 117 TR_XM_PhishingBody 4617 1.75 2.65 1.50 118 XMStockSpam_06 4601 1.45 1.32 1.49 119 TooManyTo_005 4376 2.63 6.89 1.42 120 XM_OfRef6 4327 1.74 2.95 1.40 121 XM_GoogleGroups 4249 1.16 0.37 1.38 122 RCVD_IN_BL_SPAMCOP_NET 4144 1.83 3.56 1.34 123 XM_ProductURIs 4133 1.26 0.98 1.34 124 T_XMDrugObfuBody_14 3877 1.24 1.16 1.26 125 T_FILL_THIS_FORM_SHORT 3801 1.34 1.71 1.23 126 SUBJ_ALL_CAPS 3792 1.40 2.01 1.23 127 XM_RXBody 3775 1.04 0.39 1.22 128 URI_HEX 3654 1.25 1.48 1.18 129 XMDiploma_00 3628 1.30 1.74 1.18 130 RCVD_IN_IADB_OPTIN 3582 0.96 0.27 1.16 131 DKIM_ADSP_CUSTOM_MED 3477 1.10 0.99 1.13 132 KHOP_HELO_FCRDNS 3262 1.90 4.89 1.06 133 XM_H_Long_From02 3247 0.99 0.75 1.05 134 TR_Symld_Words 3199 0.97 0.72 1.04 135 XMGappySubj_01 3088 0.85 0.31 1.00 136 XM_UB50 3069 3.04 10.27 0.99 137 XM_SPF_SoftFail 3000 1.97 5.49 0.97 138 PDS_OTHER_BAD_TLD 2738 1.87 5.33 0.89 139 TR_MetaPhish_Combo_01 2690 0.85 0.80 0.87 140 NML_ADSP_CUSTOM_MED 2583 0.83 0.82 0.84 141 HTML_IMAGE_ONLY_20 2513 0.71 0.35 0.81 142 XMPhish08 2420 0.80 0.88 0.78 143 RELAYCOUNTRY_GB 2401 0.80 0.87 0.78 144 XMGenDplmaNmb 2275 0.81 1.07 0.74 145 T_TooManySym_03 2270 0.63 0.28 0.74 146 XMBrknScrpt_02 2269 0.76 0.84 0.74 147 HELO_NODOT 2104 0.64 0.51 0.68 148 HELO_NO_DOMAIN 2103 0.64 0.51 0.68 149 TR_MSPIKEBAYES00 2083 0.53 0.00 0.67 150 XMHTMLBadTable_001 1926 0.70 0.95 0.62 151 USER_IN_WHITELIST 1857 0.47 0.00 0.60 152 XMBody_17 1857 0.98 2.32 0.60 153 FILL_THIS_FORM 1812 0.52 0.26 0.59 154 XM_B_REG_HTML 1808 0.50 0.21 0.59 155 SUSPICIOUS_RECIPS 1632 2.05 7.45 0.53 156 HTML_TAG_BALANCE_BODY 1628 0.56 0.68 0.53 157 URI_NOVOWEL 1619 0.59 0.81 0.52 158 XMBody_95 1593 0.41 0.03 0.52 159 XMHTML_After_End 1569 0.72 1.45 0.51 160 XM_DIRTYINTL 1566 0.98 2.66 0.51 161 HTTPS_HTTP_MISMATCH 1565 0.51 0.54 0.51 162 XMCapTrack 1539 0.46 0.33 0.50 163 T_XMHurry_00 1539 0.81 1.92 0.50 164 T_XMDrugObfuBody_00 1532 0.52 0.63 0.50 165 XMSexyCombo_01 1529 0.74 1.59 0.50 166 FORGED_GMAIL_RCVD 1510 0.57 0.85 0.49 167 XM_H_PHPMailer 1495 0.65 1.24 0.48 168 XMNoVowels 1486 0.47 0.43 0.48 169 TR_XM_PHPDW 1429 0.89 2.39 0.46 170 PLING_QUERY 1402 0.45 0.43 0.45 171 TR_XM_PHPForged 1377 0.86 2.33 0.45 172 XMSubMetaSxObfu_02 1377 0.45 0.44 0.45 173 TR_XM_FormFill2 1371 0.86 2.31 0.44 174 XM_H_PHPOS 1353 0.85 2.31 0.44 175 SpammyFromTLD_01 1341 0.90 2.55 0.43 176 RDNS_DYNAMIC 1328 1.02 3.12 0.43 177 TR_LOTS_OF_MONEY3 1247 0.98 3.02 0.40 178 RELAYCOUNTRY_DE 1246 0.72 1.83 0.40 179 T_Symld_Words_02 1225 0.74 1.96 0.40 180 XM_Body_Obfu01 1225 0.35 0.17 0.40 181 XM_Combo_Sbj 1215 0.51 0.93 0.39 182 XMBody_78 1170 0.42 0.55 0.38 183 XM_H_Undi_Recip 1164 0.45 0.71 0.38 184 XMSubMetaI_00 1094 0.47 0.86 0.35 185 XMPhish30 1088 0.51 1.07 0.35 186 SUBJ_DOLLARS 1085 0.72 2.03 0.35 187 XMSubMetaSxObfu_03 1082 0.42 0.66 0.35 188 XMPhish14 1057 0.39 0.55 0.34 189 MPART_ALT_DIFF_COUNT 1053 0.45 0.85 0.34 190 BODY_ENHANCEMENT 1048 0.28 0.05 0.34 191 TR_LOTS_OF_MONEY2 1046 0.53 1.22 0.34 192 T_MONEY_PERCENT 1046 0.53 1.22 0.34 193 MISSING_HEADERS 1036 0.36 0.43 0.34 194 XM_ShortIntro_01 1033 0.32 0.28 0.33 195 XMBSHREFv2 1016 0.35 0.44 0.33 196 XMAntiAgingB 1015 0.28 0.11 0.33 197 TR_Sbj_FN_Bdy 1007 0.41 0.71 0.33 198 TVD_SPACE_RATIO 993 0.28 0.12 0.32 199 XM_Akamai 989 0.25 0.01 0.32 200 XM_E_Blogspot 985 0.27 0.09 0.32 ----------------------------------------------------------------------