Email: 588016 Autolearn: 0 AvgScore: 3.10 AvgScanTime: 2.01 sec Spam: 152474 Autolearn: 0 AvgScore: 12.50 AvgScanTime: 2.42 sec Ham: 435542 Autolearn: 0 AvgScore: -0.19 AvgScanTime: 1.86 sec Time Spent Running SA: 327.98 hours Time Spent Processing Spam: 102.42 hours Time Spent Processing Ham: 225.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146123 90.07 95.83 88.05 2 DKIM_SIGNED 122901 78.04 80.60 77.14 3 DCC_CHECK 122022 51.39 80.03 41.36 4 XMListUnsubscribeExists 120383 59.15 78.95 52.22 5 XM_DK_Pass 112262 75.13 73.63 75.66 6 DKIM_VALID 106726 71.49 70.00 72.02 7 DKIM_VALID_AU 81252 52.07 53.29 51.64 8 XM_DK_Undo_02 68377 22.52 44.85 14.70 9 BAYES_99 62528 20.19 41.01 12.91 10 BAYES_50 56001 47.70 36.73 51.54 11 HTML_FONT_LOW_CONTRAST 53234 31.09 34.91 29.76 12 BAYES_999 52347 17.49 34.33 11.59 13 LOC_TINY_FONT_1 50790 25.73 33.31 23.08 14 TR_DCC_Bayes_99 50034 13.28 32.81 6.45 15 MIME_HTML_ONLY 49995 23.85 32.79 20.72 16 FVGT_m_MULTI_ODD 43553 23.07 28.56 21.14 17 XMSubLong 38933 23.19 25.53 22.37 18 BOTNET 31712 6.96 20.80 2.12 19 XM_Body_Dirty_Words 31700 15.41 20.79 13.53 20 T_KAM_HTML_FONT_INVALID 31430 17.20 20.61 16.00 21 T_TM2_M_HEADER_IN_MSG 30417 27.09 19.95 29.59 22 RELAYCOUNTRY_META 28007 8.62 18.37 5.21 23 DCC_CHECK_NEGATIVE 27581 46.64 18.09 56.63 24 BOTNET_IPINHOSTNAME 27317 8.34 17.92 4.99 25 DKIM_VALID_EF 27127 24.94 17.79 27.45 26 XM_Multi_Part_URI 26352 13.56 17.28 12.25 27 LOTS_OF_MONEY 25230 12.06 16.55 10.49 28 MultiRelay 23930 18.27 15.69 19.17 29 HTML_IMAGE_RATIO_02 20608 10.07 13.52 8.87 30 XM_Evil_Numbers_Gen 19783 9.58 12.97 8.39 31 XM_UncommonTLD01 19007 5.67 12.47 3.29 32 XMSexyCombo_05 16868 5.23 11.06 3.19 33 DKIM_INVALID 16175 6.55 10.61 5.13 34 UNTRUSTED_Relay 15149 3.74 9.94 1.57 35 FSL_BULK_SIG 14332 7.88 9.40 7.34 36 LotsOfNums_01 14023 8.78 9.20 8.63 37 HTML_IMAGE_RATIO_04 12661 6.48 8.30 5.85 38 MIME_QP_LONG_LINE 12278 6.44 8.05 5.88 39 XM_H_Long_From01 11297 6.61 7.41 6.33 40 T_XMDrugObfuBody_14 11089 8.25 7.27 8.59 41 XM_B_Phish_Phrases 10936 6.17 7.17 5.81 42 XM_B_SpammyTLD 10768 4.49 7.06 3.60 43 BAYES_80 10645 4.89 6.98 4.16 44 XMSubMetaSx_00 10166 4.44 6.67 3.66 45 MPART_ALT_DIFF 9594 4.09 6.29 3.32 46 BAYES_60 9478 6.26 6.22 6.28 47 FROM_EXCESS_BASE64 8899 4.38 5.84 3.87 48 TooManyTo_001 8869 7.33 5.82 7.86 49 SpammyFromTLD_02 8851 1.85 5.80 0.46 50 DKIM_ADSP_NXDOMAIN 8781 1.97 5.76 0.65 51 T_REMOTE_IMAGE 8657 5.11 5.68 4.91 52 HTML_IMAGE_RATIO_06 8045 4.01 5.28 3.56 53 XM_DIRTYINTL 7721 3.36 5.06 2.76 54 XM_SendGrid 7368 6.57 4.83 7.18 55 HTML_MIME_NO_HTML_TAG 6991 3.08 4.59 2.56 56 RCVD_IN_BL_SPAMCOP_NET 6766 1.62 4.44 0.63 57 XM_UB50 6648 1.83 4.36 0.94 58 NUMERIC_HTTP_ADDR 6610 1.38 4.34 0.35 59 RELAYCOUNTRY_DE 6288 1.38 4.12 0.42 60 MIME_HTML_MOSTLY 6230 2.89 4.09 2.47 61 NORMAL_HTTP_TO_IP 6063 1.08 3.98 0.07 62 BAYES_95 5962 3.10 3.91 2.82 63 URI_HEX 5683 2.39 3.73 1.92 64 RCVD_IN_PSBL 5680 1.01 3.73 0.06 65 RCVD_IN_RP_SAFE 5612 8.81 3.68 10.60 66 RELAYCOUNTRY_CA 5453 1.97 3.58 1.41 67 BOTNET_NORDNS 5236 0.95 3.43 0.09 68 MIME_HTML_ONLY_MULTI 5084 2.05 3.33 1.60 69 XMStrtUSub 5035 4.20 3.30 4.51 70 TM2_M_URI_OPT_OUT 5003 1.94 3.28 1.47 71 RCVD_IN_RP_CERTIFIED 4806 7.83 3.15 9.47 72 XM_URI_RBL 4734 1.10 3.10 0.40 73 XMBdyGiftCard01 4705 1.67 3.09 1.17 74 XM_SPF_SoftFail 4679 2.05 3.07 1.69 75 XMNumbers 4672 2.95 3.06 2.90 76 HTML_IMAGE_RATIO_08 4632 2.50 3.04 2.31 77 XMDiploma_00 4587 2.04 3.01 1.71 78 RELAYCOUNTRY_FR 4552 1.00 2.99 0.31 79 RCVD_IN_MSPIKE_H2 4536 4.19 2.97 4.62 80 RCVD_IN_IADB_LISTED 4516 5.31 2.96 6.13 81 XM_CamelCaseFrm001 4250 2.08 2.79 1.84 82 NO_DNS_FOR_FROM 4160 1.60 2.73 1.20 83 FROM_SUSPICIOUS_NTLD 4160 0.75 2.73 0.05 84 T_TooManySym_01 4091 5.25 2.68 6.15 85 T_Symld_Words_02 3972 1.13 2.61 0.61 86 RCVD_IN_IADB_SPF 3960 4.59 2.60 5.29 87 T_XMDrugObfuBody_08 3900 1.74 2.56 1.45 88 XMBody_78 3889 0.99 2.55 0.44 89 UNPARSEABLE_RELAY 3877 2.71 2.54 2.77 90 RCVD_IN_IADB_SENDERID 3780 4.04 2.48 4.59 91 RCVD_IN_IADB_DK 3753 3.96 2.46 4.48 92 TR_XM_PHPDW 3731 1.21 2.45 0.77 93 TR_XM_PHPForged 3685 1.18 2.42 0.75 94 TR_XM_FormFill2 3645 1.17 2.39 0.75 95 XM_H_PHPOS 3622 1.17 2.38 0.74 96 XMSexyCombo_01 3592 1.18 2.36 0.77 97 SUBJ_ALL_CAPS 3506 2.02 2.30 1.92 98 TR_Mismatch_TLD_01 3353 0.69 2.20 0.16 99 ALL_TRUSTED 3248 11.25 2.13 14.44 100 HTML_IMAGE_ONLY_28 3242 0.82 2.13 0.36 101 BODY_URI_ONLY 3161 0.63 2.07 0.12 102 URI_TRY_3LD 3161 1.40 2.07 1.16 103 XM_OfRef6 3034 1.98 1.99 1.98 104 TR_LOTS_OF_MONEY3 2994 0.94 1.96 0.59 105 BAYES_40 2947 3.44 1.93 3.97 106 XMSubMetaI_00 2934 1.40 1.92 1.22 107 XMBody_17 2915 0.99 1.91 0.67 108 XMGenDplmaNmb 2904 1.22 1.90 0.98 109 SpammyFromTLD_01 2876 1.01 1.89 0.70 110 MultiRelay_Combo 2846 0.65 1.87 0.23 111 MultiRelay_CC 2846 0.65 1.87 0.23 112 RCVD_IN_RP_RNBL 2780 0.50 1.82 0.03 113 XMSubGiftCard1 2741 0.51 1.80 0.06 114 T_XMDrugObfuBody_00 2535 1.11 1.66 0.91 115 HTML_SHORT_LINK_IMG_1 2508 0.44 1.64 0.02 116 FSL_THIS_IS_ADV 2468 0.63 1.62 0.29 117 XM_UB99 2424 0.43 1.59 0.03 118 T_MONEY_PERCENT 2359 0.63 1.55 0.31 119 TR_LOTS_OF_MONEY2 2359 0.63 1.55 0.31 120 TM2_M_VERY_LONG_WORD 2317 1.22 1.52 1.12 121 BAYES_20 2314 2.73 1.52 3.16 122 HTML_IMAGE_ONLY_08 2299 0.49 1.51 0.13 123 MAILING_LIST_MULTI 2298 2.09 1.51 2.29 124 T_HTML_TAG_BALANCE_CENTER 2278 0.46 1.49 0.10 125 SHORT_IMG_SUSP_NTLD 2262 0.38 1.48 0.00 126 THIS_AD 2240 0.78 1.47 0.53 127 FROM_NTLD_LINKBAIT 2176 0.37 1.43 0.00 128 TR_XM_DK_SendGrid 2172 2.86 1.42 3.37 129 HTML_FONT_SIZE_LARGE 2138 0.50 1.40 0.18 130 PDS_TO_EQ_FROM_NAME 2098 0.41 1.38 0.07 131 DATE_IN_PAST_03_06 2063 0.42 1.35 0.09 132 XM_UB999 2002 0.36 1.31 0.03 133 XM_H_Long_From02 1996 1.43 1.31 1.47 134 TR_XM_RelayPhish 1972 1.06 1.29 0.98 135 XMStockSpam_06 1963 1.12 1.29 1.07 136 XMHTML_After_End 1931 0.59 1.27 0.35 137 XMPhish11 1924 1.24 1.26 1.23 138 XM_UB60 1921 0.39 1.26 0.09 139 SUBJ_DOLLARS 1838 0.62 1.21 0.41 140 RCVD_IN_IADB_VOUCHED 1829 3.37 1.20 4.13 141 HTML_IMAGE_ONLY_20 1821 0.53 1.19 0.29 142 XMSexyCombo_04 1801 0.38 1.18 0.10 143 XM_B_REG_HTML 1784 0.57 1.17 0.36 144 XM_DK_Undo_01 1729 1.68 1.13 1.88 145 T_XMHurry_00 1719 1.19 1.13 1.21 146 MIME_HEADER_CTYPE_ONLY 1709 0.36 1.12 0.10 147 DIET_1 1704 0.52 1.12 0.31 148 XM_ProductURIs 1696 0.80 1.11 0.69 149 HTML_IMAGE_ONLY_24 1682 0.56 1.10 0.36 150 XMGetyour 1682 0.31 1.10 0.03 151 DATE_IN_PAST_06_12 1645 0.32 1.08 0.05 152 XM_GoogleGroups 1639 1.22 1.07 1.27 153 XMMoneyMeta_00 1638 0.60 1.07 0.44 154 XM_H_PHPMailer 1624 0.66 1.07 0.51 155 RDNS_DYNAMIC 1599 0.59 1.05 0.42 156 URIBL_DBL_ABUSE_REDIR 1599 0.29 1.05 0.02 157 TR_MetaPhish_Combo_01 1587 1.48 1.04 1.63 158 TM2_M_A_HREF_HREF 1561 0.98 1.02 0.96 159 DKIM_ADSP_CUSTOM_MED 1533 1.05 1.01 1.06 160 REPLYTO_WITHOUT_TO_CC 1530 0.33 1.00 0.09 161 XMPhish30 1495 0.69 0.98 0.59 162 URIBL_BLACK 1477 0.29 0.97 0.05 163 RELAYCOUNTRY_GB 1434 1.00 0.94 1.03 164 XM_HighProb1 1430 0.25 0.94 0.01 165 XM_UB80 1423 0.27 0.93 0.04 166 XM_DrugUnitList 1407 0.24 0.92 0.00 167 RELAYCOUNTRY_AT 1388 0.40 0.91 0.22 168 TR_Symld_Words 1354 1.51 0.89 1.73 169 FORGED_GMAIL_RCVD 1336 0.58 0.88 0.48 170 XMBrknScrpt_02 1324 0.68 0.87 0.61 171 RELAYCOUNTRY_IN 1319 0.32 0.87 0.12 172 HTML_FONT_FACE_BAD 1316 0.74 0.86 0.69 173 MISSING_HEADERS 1293 0.61 0.85 0.53 174 XMHTMLBadTable_001 1291 0.59 0.85 0.50 175 NML_ADSP_CUSTOM_MED 1280 0.81 0.84 0.79 176 XM_H_PHPOS_M 1259 0.35 0.83 0.18 177 XMSubMetaSxObfu_03 1237 0.80 0.81 0.79 178 BAYES_00 1221 9.79 0.80 12.93 179 URI_NOVOWEL 1215 0.52 0.80 0.43 180 HTML_TAG_BALANCE_BODY 1208 0.57 0.79 0.49 181 XM_NotFromAmazon 1197 0.21 0.79 0.01 182 FILL_THIS_FORM 1192 0.62 0.78 0.57 183 XMGppyBdWords 1181 0.29 0.77 0.13 184 BAYES_05 1170 1.70 0.77 2.03 185 BODY_ENHANCEMENT 1166 0.23 0.76 0.04 186 XM_OfRef7 1139 0.34 0.75 0.19 187 FROM_MISSP_REPLYTO 1134 0.20 0.74 0.01 188 TR_Caps_n_Bayes_99 1119 0.38 0.73 0.26 189 MPART_ALT_DIFF_COUNT 1106 0.41 0.73 0.30 190 SHORT_URI_3 1096 0.28 0.72 0.13 191 XM_B_COPY_HTML 1058 0.61 0.69 0.58 192 NORDNS_LOW_CONTRAST 1051 0.18 0.69 0.00 193 URI_PHP_REDIR 1047 0.18 0.69 0.00 194 XM_XX_Yahoo 1041 0.31 0.68 0.18 195 T_FILL_THIS_FORM_SHORT 1030 1.20 0.68 1.38 196 XMSubMetaSSx_00 1023 0.47 0.67 0.39 197 MONEY_FRAUD_5 990 0.17 0.65 0.00 198 RCVD_IN_IADB_OPTIN 962 2.16 0.63 2.69 199 XMClaimOffer 948 0.24 0.62 0.11 200 URIBL_CSS 937 0.52 0.61 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 383486 90.07 95.83 88.05 2 DKIM_SIGNED 335995 78.04 80.60 77.14 3 XM_DK_Pass 329517 75.13 73.63 75.66 4 DKIM_VALID 313663 71.49 70.00 72.02 5 DCC_CHECK_NEGATIVE 246659 46.64 18.09 56.63 6 XMListUnsubscribeExists 227426 59.15 78.95 52.22 7 DKIM_VALID_AU 224928 52.07 53.29 51.64 8 BAYES_50 224459 47.70 36.73 51.54 9 DCC_CHECK 180138 51.39 80.03 41.36 10 HTML_FONT_LOW_CONTRAST 129599 31.09 34.91 29.76 11 T_TM2_M_HEADER_IN_MSG 128863 27.09 19.95 29.59 12 DKIM_VALID_EF 119540 24.94 17.79 27.45 13 LOC_TINY_FONT_1 100534 25.73 33.31 23.08 14 XMSubLong 97433 23.19 25.53 22.37 15 FVGT_m_MULTI_ODD 92087 23.07 28.56 21.14 16 MIME_HTML_ONLY 90223 23.85 32.79 20.72 17 MultiRelay 83513 18.27 15.69 19.17 18 T_KAM_HTML_FONT_INVALID 69686 17.20 20.61 16.00 19 XM_DK_Undo_02 64017 22.52 44.85 14.70 20 ALL_TRUSTED 62883 11.25 2.13 14.44 21 XM_Body_Dirty_Words 58941 15.41 20.79 13.53 22 BAYES_00 56317 9.79 0.80 12.93 23 BAYES_99 56221 20.19 41.01 12.91 24 XM_Multi_Part_URI 53374 13.56 17.28 12.25 25 BAYES_999 50491 17.49 34.33 11.59 26 RCVD_IN_RP_SAFE 46169 8.81 3.68 10.60 27 TR_XM_DK_Bayes 45863 7.88 0.32 10.53 28 LOTS_OF_MONEY 45692 12.06 16.55 10.49 29 TR_XM_DK_Bayes1 43485 7.46 0.25 9.98 30 RCVD_IN_RP_CERTIFIED 41245 7.83 3.15 9.47 31 XM_DKIMWhitelistDomains 39742 6.76 0.02 9.12 32 HTML_IMAGE_RATIO_02 38621 10.07 13.52 8.87 33 LotsOfNums_01 37606 8.78 9.20 8.63 34 T_XMDrugObfuBody_14 37430 8.25 7.27 8.59 35 TR_XM_DK_Bayes2 36683 6.28 0.17 8.42 36 XM_Evil_Numbers_Gen 36554 9.58 12.97 8.39 37 TooManyTo_001 34251 7.33 5.82 7.86 38 FSL_BULK_SIG 31985 7.88 9.40 7.34 39 XM_SendGrid 31287 6.57 4.83 7.18 40 TR_DCC_Bayes_99 28071 13.28 32.81 6.45 41 XM_H_Long_From01 27574 6.61 7.41 6.33 42 BAYES_60 27360 6.26 6.22 6.28 43 T_TooManySym_01 26768 5.25 2.68 6.15 44 RCVD_IN_IADB_LISTED 26700 5.31 2.96 6.13 45 MIME_QP_LONG_LINE 25595 6.44 8.05 5.88 46 HTML_IMAGE_RATIO_04 25459 6.48 8.30 5.85 47 XM_B_Phish_Phrases 25322 6.17 7.17 5.81 48 RCVD_IN_IADB_SPF 23023 4.59 2.60 5.29 49 RELAYCOUNTRY_META 22705 8.62 18.37 5.21 50 DKIM_INVALID 22332 6.55 10.61 5.13 51 XM_PDF 21779 3.84 0.53 5.00 52 BOTNET_IPINHOSTNAME 21742 8.34 17.92 4.99 53 T_REMOTE_IMAGE 21402 5.11 5.68 4.91 54 RCVD_IN_MSPIKE_H2 20122 4.19 2.97 4.62 55 RCVD_IN_IADB_SENDERID 19986 4.04 2.48 4.59 56 XMStrtUSub 19655 4.20 3.30 4.51 57 RCVD_IN_IADB_DK 19507 3.96 2.46 4.48 58 BAYES_80 18098 4.89 6.98 4.16 59 RCVD_IN_IADB_VOUCHED 17990 3.37 1.20 4.13 60 IN_ZIMBRA_NJ_WHITELIST 17743 3.02 0.01 4.07 61 BAYES_40 17289 3.44 1.93 3.97 62 TO_MALFORMED 16958 2.90 0.06 3.89 63 FROM_EXCESS_BASE64 16867 4.38 5.84 3.87 64 XMSubMetaSx_00 15946 4.44 6.67 3.66 65 XM_B_SpammyTLD 15659 4.49 7.06 3.60 66 HTML_IMAGE_RATIO_06 15525 4.01 5.28 3.56 67 TR_XM_DK_SendGrid 14659 2.86 1.42 3.37 68 MPART_ALT_DIFF 14471 4.09 6.29 3.32 69 XM_UncommonTLD01 14349 5.67 12.47 3.29 70 XMSexyCombo_05 13875 5.23 11.06 3.19 71 BAYES_20 13753 2.73 1.52 3.16 72 XMNumbers 12648 2.95 3.06 2.90 73 BAYES_95 12291 3.10 3.91 2.82 74 UNPARSEABLE_RELAY 12050 2.71 2.54 2.77 75 XM_DIRTYINTL 12032 3.36 5.06 2.76 76 RCVD_IN_IADB_OPTIN 11732 2.16 0.63 2.69 77 HTML_MIME_NO_HTML_TAG 11135 3.08 4.59 2.56 78 MIME_HTML_MOSTLY 10776 2.89 4.09 2.47 79 TVD_RCVD_IP 10217 1.81 0.29 2.35 80 HTML_IMAGE_RATIO_08 10054 2.50 3.04 2.31 81 MAILING_LIST_MULTI 9993 2.09 1.51 2.29 82 RCVD_IN_MSPIKE_H3 9731 1.73 0.30 2.23 83 RCVD_IN_MSPIKE_WL 9731 1.73 0.30 2.23 84 BOTNET 9233 6.96 20.80 2.12 85 TooManyTo_002 8939 1.67 0.59 2.05 86 BAYES_05 8854 1.70 0.77 2.03 87 XM_OfRef6 8631 1.98 1.99 1.98 88 URI_HEX 8380 2.39 3.73 1.92 89 SUBJ_ALL_CAPS 8378 2.02 2.30 1.92 90 XM_DK_Undo_01 8179 1.68 1.13 1.88 91 T_TooManySym_02 8021 1.49 0.47 1.84 92 XM_CamelCaseFrm001 8009 2.08 2.79 1.84 93 IN_HORDE_ADDRESS_BOOK 7909 1.35 0.02 1.82 94 TR_Symld_Words 7525 1.51 0.89 1.73 95 INVALID_MSGID 7444 1.37 0.40 1.71 96 XMDiploma_00 7431 2.04 3.01 1.71 97 XM_SPF_SoftFail 7376 2.05 3.07 1.69 98 BOUNCE_MESSAGE 7246 1.34 0.41 1.66 99 ANY_BOUNCE_MESSAGE 7246 1.34 0.41 1.66 100 TR_MetaPhish_Combo_01 7111 1.48 1.04 1.63 101 MIME_HTML_ONLY_MULTI 6975 2.05 3.33 1.60 102 UNTRUSTED_Relay 6851 3.74 9.94 1.57 103 HELO_NODOT 6413 1.20 0.40 1.47 104 HELO_NO_DOMAIN 6412 1.19 0.40 1.47 105 TM2_M_URI_OPT_OUT 6409 1.94 3.28 1.47 106 XM_H_Long_From02 6402 1.43 1.31 1.47 107 T_XMDrugObfuBody_08 6326 1.74 2.56 1.45 108 RELAYCOUNTRY_CA 6154 1.97 3.58 1.41 109 TooManyTo_003 6072 1.15 0.46 1.39 110 T_FILL_THIS_FORM_SHORT 6013 1.20 0.68 1.38 111 XM_GoogleGroups 5536 1.22 1.07 1.27 112 USER_IN_DEF_DKIM_WL 5421 0.93 0.02 1.24 113 XMCapTrack 5394 0.98 0.25 1.24 114 XMPhish11 5366 1.24 1.26 1.23 115 XMSubMetaI_00 5295 1.40 1.92 1.22 116 T_XMHurry_00 5279 1.19 1.13 1.21 117 NO_DNS_FOR_FROM 5220 1.60 2.73 1.20 118 XMBdyGiftCard01 5101 1.67 3.09 1.17 119 URI_TRY_3LD 5071 1.40 2.07 1.16 120 TM2_M_VERY_LONG_WORD 4864 1.22 1.52 1.12 121 XMStockSpam_06 4651 1.12 1.29 1.07 122 DKIM_ADSP_CUSTOM_MED 4617 1.05 1.01 1.06 123 TooManyTo_004 4480 0.86 0.39 1.03 124 RELAYCOUNTRY_GB 4467 1.00 0.94 1.03 125 XMGenDplmaNmb 4283 1.22 1.90 0.98 126 TR_XM_RelayPhish 4280 1.06 1.29 0.98 127 TM2_M_A_HREF_HREF 4184 0.98 1.02 0.96 128 XM_UB50 4113 1.83 4.36 0.94 129 T_XMDrugObfuBody_00 3984 1.11 1.66 0.91 130 TooManyTo_005 3740 0.72 0.32 0.86 131 XMSolicitRefs_0 3566 0.70 0.36 0.82 132 NML_ADSP_CUSTOM_MED 3462 0.81 0.84 0.79 133 XMSubMetaSxObfu_03 3438 0.80 0.81 0.79 134 PLING_QUERY 3372 0.69 0.43 0.77 135 XMSexyCombo_01 3369 1.18 2.36 0.77 136 TR_XM_PHPDW 3363 1.21 2.45 0.77 137 TR_XM_PHPForged 3270 1.18 2.42 0.75 138 TR_XM_FormFill2 3246 1.17 2.39 0.75 139 XM_H_PHPOS 3234 1.17 2.38 0.74 140 SpammyFromTLD_01 3042 1.01 1.89 0.70 141 T_OBFU_PDF_ATTACH 3036 0.56 0.17 0.70 142 HTML_FONT_FACE_BAD 3013 0.74 0.86 0.69 143 XM_ProductURIs 2992 0.80 1.11 0.69 144 XMBody_17 2926 0.99 1.91 0.67 145 HTTPS_HTTP_MISMATCH 2853 0.64 0.58 0.66 146 XMGappySubj_01 2831 0.57 0.34 0.65 147 DKIM_ADSP_NXDOMAIN 2813 1.97 5.76 0.65 148 XMBody_95 2753 0.50 0.13 0.63 149 RCVD_IN_BL_SPAMCOP_NET 2753 1.62 4.44 0.63 150 USER_IN_WHITELIST 2734 0.46 0.00 0.63 151 FROM_GOV_SPOOF 2713 0.50 0.16 0.62 152 XMBrknScrpt_02 2651 0.68 0.87 0.61 153 T_Symld_Words_02 2648 1.13 2.61 0.61 154 TM2_M_BODY_EMPTY 2576 0.50 0.22 0.59 155 XMPhish30 2556 0.69 0.98 0.59 156 TR_LOTS_OF_MONEY3 2549 0.94 1.96 0.59 157 XM_B_COPY_HTML 2507 0.61 0.69 0.58 158 FILL_THIS_FORM 2477 0.62 0.78 0.57 159 XMLngstWrd_00 2454 0.51 0.36 0.56 160 RELAYCOUNTRY_AU 2433 0.56 0.56 0.56 161 XM_ShortIntro_01 2349 0.48 0.31 0.54 162 XMLngstWrd_01 2327 0.48 0.34 0.53 163 THIS_AD 2326 0.78 1.47 0.53 164 MISSING_HEADERS 2288 0.61 0.85 0.53 165 T_MANY_PILL_PRICE 2284 0.39 0.00 0.52 166 T_ANY_PILL_PRICE 2275 0.39 0.01 0.52 167 XM_H_PHPMailer 2238 0.66 1.07 0.51 168 T_TooManySym_03 2200 0.40 0.11 0.51 169 XMHTMLBadTable_001 2165 0.59 0.85 0.50 170 HTML_TAG_BALANCE_BODY 2143 0.57 0.79 0.49 171 URIBL_CSS 2137 0.52 0.61 0.49 172 URIBL_CSS_A 2137 0.52 0.61 0.49 173 AC_DIV_BONANZA 2089 0.38 0.11 0.48 174 FORGED_GMAIL_RCVD 2083 0.58 0.88 0.48 175 XMNoVowels 2050 0.43 0.33 0.47 176 SpammyFromTLD_02 2013 1.85 5.80 0.46 177 XM_D_tchamptons_WL 1943 0.33 0.00 0.45 178 XMBody_78 1926 0.99 2.55 0.44 179 XMMoneyMeta_00 1909 0.60 1.07 0.44 180 REMOVE_BEFORE_LINK 1880 0.44 0.46 0.43 181 URI_NOVOWEL 1854 0.52 0.80 0.43 182 RDNS_DYNAMIC 1850 0.59 1.05 0.42 183 HTML_IMAGE_ONLY_32 1830 0.44 0.51 0.42 184 RELAYCOUNTRY_DE 1814 1.38 4.12 0.42 185 SUBJ_DOLLARS 1802 0.62 1.21 0.41 186 FILL_THIS_FORM_LONG 1797 0.40 0.35 0.41 187 XMPhish14 1776 0.43 0.51 0.41 188 XM_Body_Obfu01 1770 0.38 0.31 0.41 189 XM_Combo_Sbj 1762 0.40 0.37 0.40 190 XM_URI_RBL 1761 1.10 3.10 0.40 191 SHORT_HELO_AND_INLINE_IMAGE 1759 0.31 0.03 0.40 192 FILL_THIS_FORM_LOAN 1726 0.42 0.47 0.40 193 XMSubMetaSSx_00 1713 0.47 0.67 0.39 194 XMSubMetaSxObfu_02 1591 0.38 0.42 0.37 195 HTML_IMAGE_ONLY_24 1583 0.56 1.10 0.36 196 XM_B_REG_HTML 1581 0.57 1.17 0.36 197 HTML_IMAGE_ONLY_28 1554 0.82 2.13 0.36 198 XMHTML_After_End 1539 0.59 1.27 0.35 199 NUMERIC_HTTP_ADDR 1509 1.38 4.34 0.35 200 XMSlimDrugH 1496 0.36 0.41 0.34 ----------------------------------------------------------------------