Email: 796457 Autolearn: 0 AvgScore: 3.87 AvgScanTime: 4.78 sec Spam: 257976 Autolearn: 0 AvgScore: 14.47 AvgScanTime: 5.93 sec Ham: 538481 Autolearn: 0 AvgScore: -1.21 AvgScanTime: 4.23 sec Time Spent Running SA: 1058.15 hours Time Spent Processing Spam: 425.30 hours Time Spent Processing Ham: 632.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 251239 91.13 97.39 88.13 2 DKIM_SIGNED 184023 63.32 71.33 59.47 3 XM_DK_Pass 180169 62.17 69.84 58.49 4 DCC_CHECK 176684 41.57 68.49 28.67 5 DKIM_VALID 170019 58.23 65.90 54.55 6 XMListUnsubscribeExists 156556 45.69 60.69 38.51 7 DKIM_VALID_AU 130815 43.03 50.71 39.35 8 XM_H_QuotedFrom 116780 40.48 45.27 38.19 9 MIME_HTML_ONLY 112092 24.35 43.45 15.20 10 XM_DK_Undo_02 105589 21.06 40.93 11.54 11 BAYES_99 95503 19.33 37.02 10.86 12 BAYES_999 80389 16.50 31.16 9.48 13 HTML_FONT_LOW_CONTRAST 79040 26.26 30.64 24.16 14 LOC_TINY_FONT_1 78873 21.31 30.57 16.88 15 DCC_CHECK_NEGATIVE 77897 56.86 30.20 69.63 16 BAYES_50 75856 47.15 29.40 55.66 17 TR_DCC_Bayes_99 74241 12.79 28.78 5.12 18 XMSubLong 68475 20.79 26.54 18.04 19 BOTNET 66646 9.16 25.83 1.17 20 FVGT_m_MULTI_ODD 58537 20.09 22.69 18.84 21 FROM_EXCESS_BASE64 55621 8.93 21.56 2.87 22 T_REMOTE_IMAGE 50906 8.96 19.73 3.81 23 DKIM_VALID_EF 49536 21.30 19.20 22.31 24 HTML_MIME_NO_HTML_TAG 49047 7.70 19.01 2.28 25 MIME_HEADER_CTYPE_ONLY 48965 6.22 18.98 0.11 26 T_KAM_HTML_FONT_INVALID 47010 14.36 18.22 12.50 27 T_TM2_M_HEADER_IN_MSG 46233 24.66 17.92 27.89 28 SHORTENED_URL_SRC 46128 8.70 17.88 4.30 29 BODY_URI_ONLY 45525 5.75 17.65 0.05 30 MISSING_HEADERS 45349 6.13 17.58 0.64 31 HTML_SHORT_LINK_IMG_1 45306 8.53 17.56 4.20 32 XM_Body_Dirty_Words 44968 12.23 17.43 9.74 33 SHORTENER_SHORT_IMG 44715 8.44 17.33 4.17 34 URI_BUFFLY 44668 8.43 17.31 4.17 35 RELAYCOUNTRY_META 39851 8.34 15.45 4.94 36 XM_Multi_Part_URI 38771 10.99 15.03 9.06 37 BOTNET_NORDNS 36241 4.56 14.05 0.02 38 HTML_IMAGE_RATIO_02 35921 8.81 13.92 6.36 39 HTML_IMAGE_ONLY_08 32850 6.22 12.73 3.10 40 MultiRelay 32792 14.94 12.71 16.01 41 BAYES_80 30228 6.10 11.72 3.40 42 XM_Evil_Numbers_Gen 30150 9.13 11.69 7.90 43 FSL_BULK_SIG 30075 7.57 11.66 5.62 44 BOTNET_IPINHOSTNAME 29362 6.67 11.38 4.41 45 UNTRUSTED_Relay 28910 4.74 11.21 1.64 46 BAYES_60 28625 7.54 11.10 5.84 47 XMSexyCombo_05 28188 5.22 10.93 2.49 48 LOTS_OF_MONEY 27266 8.90 10.57 8.09 49 XMNumbers 25495 5.11 9.88 2.82 50 HTML_IMAGE_RATIO_04 22538 11.36 8.74 12.62 51 T_XMDrugObfuBody_14 22428 7.49 8.69 6.92 52 XM_B_Phish_Phrases 21587 5.54 8.37 4.18 53 XMSubMetaSx_00 20088 4.74 7.79 3.28 54 LotsOfNums_01 18699 7.49 7.25 7.61 55 XM_H_Long_From01 18359 5.36 7.12 4.51 56 BAYES_95 18315 3.94 7.10 2.43 57 TR_XM_DocInvoice 17473 4.57 6.77 3.51 58 XM_UncommonTLD01 17067 3.91 6.62 2.61 59 TooManyTo_001 16212 7.80 6.28 8.53 60 RCVD_IN_RP_RNBL 14675 1.86 5.69 0.03 61 MPART_ALT_DIFF 14123 3.57 5.47 2.65 62 DKIM_INVALID 14004 5.09 5.43 4.93 63 HTML_IMAGE_ONLY_04 12729 2.42 4.93 1.21 64 HTML_IMAGE_RATIO_06 12018 4.01 4.66 3.70 65 RCVD_IN_RP_SAFE 11048 6.05 4.28 6.90 66 XM_UB50 10280 2.05 3.98 1.12 67 SpammyFromTLD_02 9657 1.37 3.74 0.23 68 MIME_QP_LONG_LINE 9614 4.73 3.73 5.21 69 XM_SendGrid 9211 4.08 3.57 4.32 70 TM2_M_URI_OPT_OUT 9109 2.93 3.53 2.64 71 URI_HEX 8911 2.27 3.45 1.71 72 XM_DIRTYINTL 8653 2.08 3.35 1.47 73 MIME_HTML_MOSTLY 8561 2.75 3.32 2.48 74 T_TooManySym_01 8339 3.50 3.23 3.63 75 RCVD_IN_MSPIKE_H2 8333 3.88 3.23 4.19 76 RCVD_IN_RP_CERTIFIED 8063 5.08 3.13 6.02 77 XM_URI_RBL 7838 1.05 3.04 0.10 78 XM_CamelCaseFrm001 7533 1.82 2.92 1.30 79 XMStrtUSub 7512 6.43 2.91 8.11 80 XM_SPF_SoftFail 7331 2.15 2.84 1.82 81 MIME_HTML_ONLY_MULTI 7110 1.61 2.76 1.05 82 PLING_QUERY 7031 1.16 2.73 0.41 83 RELAYCOUNTRY_RO 6922 0.87 2.68 0.01 84 XM_UB60 6717 0.89 2.60 0.06 85 HTML_IMAGE_RATIO_08 6579 1.99 2.55 1.72 86 URIBL_BLACK 6348 0.82 2.46 0.03 87 XMSlimDrugH 6345 0.99 2.46 0.28 88 FILL_THIS_FORM 6298 1.14 2.44 0.51 89 MultiRelay_CC 6048 0.88 2.34 0.17 90 MultiRelay_Combo 6048 0.88 2.34 0.17 91 XM_OfRef6 6040 1.79 2.34 1.52 92 RELAYCOUNTRY_CA 5991 1.56 2.32 1.20 93 T_XMDrugObfuBody_08 5650 1.52 2.19 1.20 94 RELAYCOUNTRY_RU 5505 0.70 2.13 0.02 95 XMDiploma_00 5361 1.64 2.08 1.43 96 SUBJ_ALL_CAPS 5171 1.54 2.00 1.32 97 RCVD_IN_IADB_LISTED 4906 3.72 1.90 4.59 98 DIET_1 4566 0.74 1.77 0.24 99 RCVD_IN_IADB_SPF 4489 3.29 1.74 4.04 100 RCVD_IN_BL_SPAMCOP_NET 4438 0.77 1.72 0.31 101 RCVD_IN_IADB_SENDERID 4321 2.95 1.67 3.56 102 RCVD_IN_IADB_DK 4272 2.91 1.66 3.51 103 XMSubMetaSSx_00 4234 0.70 1.64 0.25 104 XMSubMetaI_00 4142 0.81 1.61 0.44 105 XM_UB80 4142 0.57 1.61 0.07 106 TM2_M_VERY_LONG_WORD 4106 1.02 1.59 0.74 107 XMBody_17 4023 0.75 1.56 0.36 108 XMBdyGiftCard01 3998 0.93 1.55 0.64 109 DKIM_ADSP_DISCARD 3979 0.51 1.54 0.01 110 STYLE_GIBBERISH 3930 0.51 1.52 0.02 111 XM_DK_Undo_01 3748 1.57 1.45 1.63 112 XMNoVowels 3747 1.55 1.45 1.59 113 T_XMHurry_00 3647 0.89 1.41 0.65 114 T_Symld_Words_02 3513 0.77 1.36 0.48 115 MAILING_LIST_MULTI 3482 2.08 1.35 2.44 116 XMGenDplmaNmb 3472 1.09 1.35 0.96 117 URI_TRY_3LD 3440 1.05 1.33 0.92 118 HTML_FONT_SIZE_LARGE 3398 0.70 1.32 0.41 119 XMSexyCombo_01 3323 0.71 1.29 0.43 120 ALL_TRUSTED 3274 15.50 1.27 22.32 121 BAYES_40 3234 3.02 1.25 3.87 122 XM_UB99 3207 0.46 1.24 0.08 123 XMStockSpam_06 3073 1.12 1.19 1.08 124 SpammyFromTLD_01 3049 0.79 1.18 0.60 125 RELAYCOUNTRY_FR 3048 0.54 1.18 0.23 126 UNPARSEABLE_RELAY 3035 2.71 1.18 3.44 127 XM_ProductURIs 2987 0.98 1.16 0.90 128 BAYES_00 2882 7.65 1.12 10.78 129 TR_XM_RelayPhish 2871 0.64 1.11 0.42 130 T_XMDrugObfuBody_00 2856 0.73 1.11 0.55 131 XMHTML_After_End 2818 0.61 1.09 0.37 132 XMWghtMeta_00 2745 0.35 1.06 0.01 133 XM_HighProb1 2733 0.35 1.06 0.01 134 URIBL_CSS_A 2709 0.35 1.05 0.02 135 URIBL_CSS 2709 0.35 1.05 0.02 136 MPART_ALT_DIFF_COUNT 2663 1.05 1.03 1.06 137 XM_H_Long_From02 2641 1.12 1.02 1.17 138 URIBL_DBL_SPAM 2635 0.35 1.02 0.03 139 XMPhish11 2602 1.04 1.01 1.05 140 XMBrknScrpt_02 2577 0.64 1.00 0.47 141 KHOP_DYNAMIC 2478 0.68 0.96 0.55 142 HTML_SHORT_CENTER 2443 0.46 0.95 0.23 143 NO_DNS_FOR_FROM 2418 0.66 0.94 0.53 144 XM_UB95 2386 0.36 0.92 0.09 145 TR_XM_DK_Bayes 2367 3.10 0.92 4.14 146 XMSubject_48 2367 0.31 0.92 0.02 147 T_MONEY_PERCENT 2334 0.50 0.90 0.31 148 TR_LOTS_OF_MONEY2 2334 0.50 0.90 0.31 149 SUBJ_DOLLARS 2268 0.41 0.88 0.18 150 XM_UB999 2245 0.31 0.87 0.04 151 HTML_FONT_FACE_BAD 2237 6.92 0.87 9.82 152 LOW_PRICE 2190 0.44 0.85 0.25 153 T_FILL_THIS_FORM_LONG 2187 0.56 0.85 0.43 154 DKIM_ADSP_CUSTOM_MED 2165 0.81 0.84 0.79 155 XMBody_78 2159 0.44 0.84 0.26 156 FVGT_m_MULTI_ODD_EMAIL 2145 0.31 0.83 0.06 157 T_FILL_THIS_FORM_SHORT 2124 0.80 0.82 0.79 158 XM_H_PHPOS 2096 1.01 0.81 1.10 159 ANY_BOUNCE_MESSAGE 2090 6.95 0.81 9.89 160 BOUNCE_MESSAGE 2090 6.95 0.81 9.89 161 RELAYCOUNTRY_AT 2088 0.36 0.81 0.15 162 TR_Symld_Words 2039 1.17 0.79 1.36 163 TR_XM_DK_Bayes1 2033 2.72 0.79 3.65 164 XM_JunkDunk 2033 0.26 0.79 0.00 165 XMPhish30 2014 0.41 0.78 0.23 166 RELAYCOUNTRY_CN 1999 0.29 0.77 0.05 167 XMClaimOffer 1982 0.30 0.77 0.08 168 BAYES_20 1965 3.00 0.76 4.07 169 TooManyTo_002 1961 2.16 0.76 2.83 170 HTML_IMAGE_ONLY_32 1948 0.60 0.76 0.52 171 XMSubMetaSx_01 1928 0.41 0.75 0.25 172 TR_XM_DK_Bayes2 1919 2.24 0.74 2.96 173 RCVD_IN_IADB_VOUCHED 1884 2.24 0.73 2.96 174 XM_Body_Obfu01 1871 0.38 0.73 0.21 175 HTTPS_HTTP_MISMATCH 1866 0.52 0.72 0.42 176 XMHTMLBadTable_001 1864 0.50 0.72 0.39 177 HTML_TAG_BALANCE_BODY 1862 0.49 0.72 0.38 178 T_URIBL_NEWDOMAIN_FMBLA 1855 0.24 0.72 0.02 179 RDNS_DYNAMIC 1850 0.50 0.72 0.40 180 NML_ADSP_CUSTOM_MED 1823 0.62 0.71 0.58 181 RELAYCOUNTRY_GB 1816 0.86 0.70 0.94 182 XMGppyBdWords 1801 0.35 0.70 0.18 183 REMOVE_BEFORE_LINK 1786 0.41 0.69 0.28 184 RCVD_IN_MSPIKE_WL 1776 1.43 0.69 1.78 185 FORGED_GMAIL_RCVD 1775 0.47 0.69 0.37 186 XM_B_REG_HTML 1771 0.50 0.69 0.40 187 XM_PDF 1760 3.15 0.68 4.34 188 RCVD_IN_MSPIKE_H3 1759 1.42 0.68 1.78 189 TooManyTo_003 1752 1.67 0.68 2.15 190 TR_LOTS_OF_MONEY3 1727 0.43 0.67 0.32 191 XMMoneyMeta_00 1725 0.48 0.67 0.39 192 TR_LOTS_OF_MONEY1 1700 0.22 0.66 0.02 193 RELAYCOUNTRY_IN 1645 0.27 0.64 0.09 194 XM_Nigeria_01 1588 0.22 0.62 0.03 195 T_TooManySym_02 1548 1.25 0.60 1.56 196 TR_Caps_n_Bayes_99 1548 0.31 0.60 0.18 197 BODY_ENHANCEMENT 1541 0.20 0.60 0.01 198 URI_NOVOWEL 1529 0.44 0.59 0.37 199 MILLION_USD 1525 0.20 0.59 0.02 200 XM_CreditScore_03 1520 0.20 0.59 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 474584 91.13 97.39 88.13 2 DCC_CHECK_NEGATIVE 374955 56.86 30.20 69.63 3 DKIM_SIGNED 320261 63.32 71.33 59.47 4 XM_DK_Pass 314971 62.17 69.84 58.49 5 BAYES_50 299708 47.15 29.40 55.66 6 DKIM_VALID 293737 58.23 65.90 54.55 7 DKIM_VALID_AU 211907 43.03 50.71 39.35 8 XMListUnsubscribeExists 207381 45.69 60.69 38.51 9 XM_H_QuotedFrom 205621 40.48 45.27 38.19 10 DCC_CHECK 154374 41.57 68.49 28.67 11 T_TM2_M_HEADER_IN_MSG 150176 24.66 17.92 27.89 12 HTML_FONT_LOW_CONTRAST 130077 26.26 30.64 24.16 13 ALL_TRUSTED 120200 15.50 1.27 22.32 14 DKIM_VALID_EF 120138 21.30 19.20 22.31 15 FVGT_m_MULTI_ODD 101446 20.09 22.69 18.84 16 XMSubLong 97140 20.79 26.54 18.04 17 LOC_TINY_FONT_1 90875 21.31 30.57 16.88 18 MultiRelay 86225 14.94 12.71 16.01 19 MIME_HTML_ONLY 81864 24.35 43.45 15.20 20 IN_ZIMBRA_NJ_WHITELIST 73097 9.18 0.02 13.57 21 HTML_IMAGE_RATIO_04 67972 11.36 8.74 12.62 22 T_KAM_HTML_FONT_INVALID 67324 14.36 18.22 12.50 23 XM_DK_Undo_02 62128 21.06 40.93 11.54 24 BAYES_99 58472 19.33 37.02 10.86 25 BAYES_00 58045 7.65 1.12 10.78 26 ANY_BOUNCE_MESSAGE 53276 6.95 0.81 9.89 27 BOUNCE_MESSAGE 53275 6.95 0.81 9.89 28 HTML_FONT_FACE_BAD 52862 6.92 0.87 9.82 29 XM_Body_Dirty_Words 52447 12.23 17.43 9.74 30 BAYES_999 51053 16.50 31.16 9.48 31 XM_Multi_Part_URI 48790 10.99 15.03 9.06 32 XM_DKIMWhitelistDomains 46429 5.84 0.04 8.62 33 TooManyTo_001 45912 7.80 6.28 8.53 34 XMStrtUSub 43663 6.43 2.91 8.11 35 LOTS_OF_MONEY 43585 8.90 10.57 8.09 36 XM_Evil_Numbers_Gen 42535 9.13 11.69 7.90 37 LotsOfNums_01 40977 7.49 7.25 7.61 38 T_XMDrugObfuBody_14 37266 7.49 8.69 6.92 39 RCVD_IN_RP_SAFE 37137 6.05 4.28 6.90 40 HTML_IMAGE_RATIO_02 34236 8.81 13.92 6.36 41 RCVD_IN_RP_CERTIFIED 32399 5.08 3.13 6.02 42 BAYES_60 31447 7.54 11.10 5.84 43 FSL_BULK_SIG 30243 7.57 11.66 5.62 44 MIME_QP_LONG_LINE 28034 4.73 3.73 5.21 45 TR_DCC_Bayes_99 27597 12.79 28.78 5.12 46 RELAYCOUNTRY_META 26612 8.34 15.45 4.94 47 DKIM_INVALID 26524 5.09 5.43 4.93 48 RCVD_IN_IADB_LISTED 24719 3.72 1.90 4.59 49 XM_H_Long_From01 24304 5.36 7.12 4.51 50 BOTNET_IPINHOSTNAME 23751 6.67 11.38 4.41 51 XM_PDF 23357 3.15 0.68 4.34 52 XM_SendGrid 23260 4.08 3.57 4.32 53 SHORTENED_URL_SRC 23173 8.70 17.88 4.30 54 HTML_SHORT_LINK_IMG_1 22605 8.53 17.56 4.20 55 RCVD_IN_MSPIKE_H2 22583 3.88 3.23 4.19 56 XM_B_Phish_Phrases 22510 5.54 8.37 4.18 57 SHORTENER_SHORT_IMG 22478 8.44 17.33 4.17 58 URI_BUFFLY 22478 8.43 17.31 4.17 59 TR_XM_DK_Bayes 22306 3.10 0.92 4.14 60 BAYES_20 21942 3.00 0.76 4.07 61 RCVD_IN_IADB_SPF 21736 3.29 1.74 4.04 62 BAYES_40 20857 3.02 1.25 3.87 63 T_REMOTE_IMAGE 20495 8.96 19.73 3.81 64 HTML_IMAGE_RATIO_06 19910 4.01 4.66 3.70 65 TR_XM_DK_Bayes1 19669 2.72 0.79 3.65 66 T_TooManySym_01 19560 3.50 3.23 3.63 67 RCVD_IN_IADB_SENDERID 19148 2.95 1.67 3.56 68 TR_XM_DocInvoice 18921 4.57 6.77 3.51 69 RCVD_IN_IADB_DK 18908 2.91 1.66 3.51 70 UNPARSEABLE_RELAY 18546 2.71 1.18 3.44 71 BAYES_80 18322 6.10 11.72 3.40 72 XMSubMetaSx_00 17688 4.74 7.79 3.28 73 TVD_RCVD_IP 17360 2.24 0.19 3.22 74 HTML_IMAGE_ONLY_08 16716 6.22 12.73 3.10 75 XMSubNoVowel 16387 2.14 0.26 3.04 76 BAYES_05 16219 2.19 0.49 3.01 77 TR_XM_DK_Bayes2 15952 2.24 0.74 2.96 78 RCVD_IN_IADB_VOUCHED 15928 2.24 0.73 2.96 79 FROM_EXCESS_BASE64 15480 8.93 21.56 2.87 80 TooManyTo_002 15254 2.16 0.76 2.83 81 XMNumbers 15173 5.11 9.88 2.82 82 MPART_ALT_DIFF 14289 3.57 5.47 2.65 83 TM2_M_URI_OPT_OUT 14221 2.93 3.53 2.64 84 XM_UncommonTLD01 14066 3.91 6.62 2.61 85 XMSexyCombo_05 13400 5.22 10.93 2.49 86 MIME_HTML_MOSTLY 13348 2.75 3.32 2.48 87 MAILING_LIST_MULTI 13116 2.08 1.35 2.44 88 BAYES_95 13100 3.94 7.10 2.43 89 HTML_MIME_NO_HTML_TAG 12287 7.70 19.01 2.28 90 TooManyTo_003 11570 1.67 0.68 2.15 91 RCVD_IN_IADB_OPTIN 10100 1.41 0.45 1.88 92 HELO_NODOT 9926 1.32 0.22 1.84 93 XM_SPF_SoftFail 9777 2.15 2.84 1.82 94 RCVD_IN_MSPIKE_WL 9577 1.43 0.69 1.78 95 RCVD_IN_MSPIKE_H3 9576 1.42 0.68 1.78 96 HTML_IMAGE_RATIO_08 9268 1.99 2.55 1.72 97 URI_HEX 9202 2.27 3.45 1.71 98 UNTRUSTED_Relay 8805 4.74 11.21 1.64 99 XM_DK_Undo_01 8763 1.57 1.45 1.63 100 XMNoVowels 8563 1.55 1.45 1.59 101 T_TooManySym_02 8400 1.25 0.60 1.56 102 IN_HORDE_ADDRESS_BOOK 8248 1.05 0.04 1.53 103 XM_OfRef6 8207 1.79 2.34 1.52 104 XM_DIRTYINTL 7942 2.08 3.35 1.47 105 XMDiploma_00 7712 1.64 2.08 1.43 106 TR_Symld_Words 7302 1.17 0.79 1.36 107 INVALID_MSGID 7228 0.97 0.19 1.34 108 SUBJ_ALL_CAPS 7128 1.54 2.00 1.32 109 XM_CamelCaseFrm001 6986 1.82 2.92 1.30 110 XMCapTrack 6826 0.99 0.42 1.27 111 USER_IN_DEF_DKIM_WL 6718 0.88 0.12 1.25 112 HTML_IMAGE_ONLY_04 6525 2.42 4.93 1.21 113 RELAYCOUNTRY_CA 6470 1.56 2.32 1.20 114 T_XMDrugObfuBody_08 6439 1.52 2.19 1.20 115 TO_MALFORMED 6438 0.81 0.01 1.20 116 XM_H_Long_From02 6286 1.12 1.02 1.17 117 BOTNET 6279 9.16 25.83 1.17 118 XM_UB50 6012 2.05 3.98 1.12 119 XM_H_PHPOS 5936 1.01 0.81 1.10 120 XMLngstWrd_00 5840 0.86 0.40 1.08 121 XMStockSpam_06 5832 1.12 1.19 1.08 122 XM_GoogleGroups 5762 0.84 0.37 1.07 123 MPART_ALT_DIFF_COUNT 5687 1.05 1.03 1.06 124 MIME_HTML_ONLY_MULTI 5676 1.61 2.76 1.05 125 XMPhish11 5674 1.04 1.01 1.05 126 XMSubLongNoVowel 5646 0.74 0.08 1.05 127 XMSubGarbage 5344 0.68 0.04 0.99 128 XMGenDplmaNmb 5185 1.09 1.35 0.96 129 TooManyTo_004 5116 0.78 0.44 0.95 130 XMLngstWrd_01 5105 0.76 0.36 0.95 131 RELAYCOUNTRY_GB 5035 0.86 0.70 0.94 132 URI_TRY_3LD 4954 1.05 1.33 0.92 133 XM_E_Blogspot 4865 0.64 0.09 0.90 134 XM_ProductURIs 4845 0.98 1.16 0.90 135 T_FILL_THIS_FORM_SHORT 4253 0.80 0.82 0.79 136 DKIM_ADSP_CUSTOM_MED 4249 0.81 0.84 0.79 137 TooManyTo_005 4248 0.66 0.38 0.79 138 TM2_M_VERY_LONG_WORD 3992 1.02 1.59 0.74 139 USER_IN_WHITELIST 3930 0.49 0.00 0.73 140 T_XMHurry_00 3477 0.89 1.41 0.65 141 MISSING_HEADERS 3452 6.13 17.58 0.64 142 XMBdyGiftCard01 3431 0.93 1.55 0.64 143 RELAYCOUNTRY_DE 3418 0.58 0.47 0.63 144 SpammyFromTLD_01 3238 0.79 1.18 0.60 145 T_TooManySym_03 3231 0.45 0.14 0.60 146 NML_ADSP_CUSTOM_MED 3110 0.62 0.71 0.58 147 XM_H_PHPMailer 3031 0.57 0.57 0.56 148 TR_MetaPhish_Combo_01 2991 0.53 0.48 0.56 149 T_XMDrugObfuBody_00 2956 0.73 1.11 0.55 150 KHOP_DYNAMIC 2945 0.68 0.96 0.55 151 XMLngstWrd_02 2919 0.47 0.33 0.54 152 NO_DNS_FOR_FROM 2854 0.66 0.94 0.53 153 HTML_IMAGE_ONLY_32 2812 0.60 0.76 0.52 154 FILL_THIS_FORM 2764 1.14 2.44 0.51 155 RELAYCOUNTRY_PH 2708 0.34 0.01 0.50 156 TM2_M_A_HREF_HREF 2670 0.49 0.47 0.50 157 T_OBFU_PDF_ATTACH 2645 0.39 0.17 0.49 158 XMSubMetaSxObfu_02 2620 0.39 0.18 0.49 159 XMBody_29 2602 0.43 0.32 0.48 160 SHORT_HELO_AND_INLINE_IMAGE 2593 0.35 0.06 0.48 161 T_Symld_Words_02 2590 0.77 1.36 0.48 162 XMBrknScrpt_02 2541 0.64 1.00 0.47 163 AC_DIV_BONANZA 2482 0.35 0.13 0.46 164 XMDateMe_00 2473 0.42 0.35 0.46 165 XMGappySubj_01 2451 0.44 0.39 0.46 166 XM_ShortIntro_01 2352 0.38 0.27 0.44 167 XMSubMetaI_00 2348 0.81 1.61 0.44 168 T_FILL_THIS_FORM_LONG 2310 0.56 0.85 0.43 169 XMSexyCombo_01 2299 0.71 1.29 0.43 170 TR_XM_RelayPhish 2263 0.64 1.11 0.42 171 HTTPS_HTTP_MISMATCH 2253 0.52 0.72 0.42 172 RCVD_IN_SORBS_DUL 2243 0.33 0.15 0.42 173 PLING_QUERY 2232 1.16 2.73 0.41 174 XMBody_95 2217 0.32 0.13 0.41 175 HTML_FONT_SIZE_LARGE 2200 0.70 1.32 0.41 176 XM_B_REG_HTML 2179 0.50 0.69 0.40 177 XMRcvdHeader_15 2142 0.27 0.00 0.40 178 RDNS_DYNAMIC 2138 0.50 0.72 0.40 179 XM_H_Trusted_IP 2105 0.26 0.00 0.39 180 XMSolicitRefs_0 2100 0.39 0.38 0.39 181 XMMoneyMeta_00 2097 0.48 0.67 0.39 182 XMHTMLBadTable_001 2094 0.50 0.72 0.39 183 FILL_THIS_FORM_LOAN 2065 0.40 0.44 0.38 184 HTML_TAG_BALANCE_BODY 2058 0.49 0.72 0.38 185 XMHTML_After_End 2011 0.61 1.09 0.37 186 FORGED_GMAIL_RCVD 1985 0.47 0.69 0.37 187 RELAYCOUNTRY_AU 1974 0.40 0.48 0.37 188 URI_NOVOWEL 1969 0.44 0.59 0.37 189 XM_B_COPY_HTML 1967 0.41 0.50 0.37 190 DKIM_ADSP_NXDOMAIN 1933 0.41 0.52 0.36 191 XMBody_17 1933 0.75 1.56 0.36 192 XMLKML 1933 0.24 0.00 0.36 193 TM2_M_BODY_EMPTY 1878 0.31 0.24 0.35 194 XM_H_SpoofStaff4 1868 0.25 0.04 0.35 195 XMLngstWrd_03 1867 0.32 0.25 0.35 196 TR_LOTS_OF_MONEY3 1726 0.43 0.67 0.32 197 XMSUPPORT 1714 0.22 0.00 0.32 198 HTML_IMAGE_ONLY_28 1704 0.33 0.37 0.32 199 RCVD_IN_BL_SPAMCOP_NET 1661 0.77 1.72 0.31 200 TR_LOTS_OF_MONEY2 1659 0.50 0.90 0.31 ----------------------------------------------------------------------