Email: 336911 Autolearn: 0 AvgScore: 3.00 AvgScanTime: 2.15 sec Spam: 95535 Autolearn: 0 AvgScore: 12.83 AvgScanTime: 2.49 sec Ham: 241376 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 2.01 sec Time Spent Running SA: 201.16 hours Time Spent Processing Spam: 66.06 hours Time Spent Processing Ham: 135.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88221 87.84 92.34 86.06 2 DKIM_SIGNED 76174 81.58 79.73 82.31 3 DCC_CHECK 74181 57.01 77.65 48.85 4 XMListUnsubscribeExists 72395 62.50 75.78 57.25 5 XM_DK_Pass 71866 79.35 75.22 80.98 6 DKIM_VALID 68128 75.90 71.31 77.71 7 DKIM_VALID_AU 56250 62.43 58.88 63.84 8 XM_DK_Undo_02 46356 27.49 48.52 19.17 9 BAYES_99 43384 25.42 45.41 17.51 10 BAYES_999 36474 22.24 38.18 15.93 11 TR_DCC_Bayes_99 34789 16.93 36.41 9.21 12 HTML_FONT_LOW_CONTRAST 33602 34.84 35.17 34.70 13 LOC_TINY_FONT_1 33251 30.92 34.81 29.39 14 BAYES_50 31326 44.17 32.79 48.67 15 MIME_HTML_ONLY 30237 26.29 31.65 24.17 16 RELAYCOUNTRY_META 25133 11.48 26.31 5.61 17 FVGT_m_MULTI_ODD 24968 22.60 26.13 21.20 18 BOTNET 21060 7.78 22.04 2.13 19 XMSubLong 20549 23.48 21.51 24.26 20 DCC_CHECK_NEGATIVE 19981 41.64 20.91 49.84 21 DKIM_VALID_EF 18779 28.13 19.66 31.49 22 UNTRUSTED_Relay 18776 7.40 19.65 2.54 23 XM_Body_Dirty_Words 18646 16.26 19.52 14.98 24 T_KAM_HTML_FONT_INVALID 18137 15.50 18.98 14.12 25 BOTNET_IPINHOSTNAME 16458 9.86 17.23 6.95 26 MultiRelay 15705 16.01 16.44 15.83 27 HTML_IMAGE_RATIO_02 15185 13.56 15.89 12.64 28 T_TM2_M_HEADER_IN_MSG 15082 21.37 15.79 23.58 29 XM_Multi_Part_URI 14268 14.08 14.93 13.74 30 XM_Evil_Numbers_Gen 13852 11.87 14.50 10.84 31 FSL_BULK_SIG 12275 9.73 12.85 8.50 32 HTML_IMAGE_RATIO_04 10242 8.28 10.72 7.31 33 XM_UB50 9573 3.96 10.02 1.57 34 LOTS_OF_MONEY 9437 9.12 9.88 8.82 35 TooManyTo_001 9178 7.26 9.61 6.34 36 XMSexyCombo_05 9140 6.60 9.57 5.43 37 XM_UncommonTLD01 9081 5.80 9.51 4.33 38 XM_B_Phish_Phrases 8324 7.69 8.71 7.29 39 DKIM_INVALID 8046 5.68 8.42 4.59 40 LotsOfNums_01 7925 7.98 8.30 7.86 41 XMStrtUSub 7829 6.44 8.19 5.74 42 XMSubMetaSx_00 6837 5.51 7.16 4.85 43 RELAYCOUNTRY_FR 6650 2.16 6.96 0.26 44 XM_H_Long_From01 6538 6.60 6.84 6.51 45 T_XMDrugObfuBody_14 6188 7.50 6.48 7.91 46 DKIM_ADSP_NXDOMAIN 5935 2.26 6.21 0.70 47 XM_B_SpammyTLD 5856 5.06 6.13 4.64 48 BAYES_80 5710 4.58 5.98 4.02 49 HTML_MIME_NO_HTML_TAG 5696 3.44 5.96 2.44 50 MPART_ALT_DIFF 5606 4.23 5.87 3.58 51 RCVD_IN_RP_SAFE 5374 13.13 5.63 16.11 52 FROM_EXCESS_BASE64 5177 5.70 5.42 5.81 53 SpammyFromTLD_02 5021 1.64 5.26 0.21 54 BAYES_60 4889 5.83 5.12 6.12 55 PDS_TO_EQ_FROM_NAME 4595 1.43 4.81 0.09 56 T_REMOTE_IMAGE 4537 3.37 4.75 2.83 57 XM_DIRTYINTL 4502 3.45 4.71 2.96 58 XM_UB99 4443 1.34 4.65 0.03 59 RCVD_IN_RP_CERTIFIED 4344 11.48 4.55 14.22 60 RELAYCOUNTRY_CA 4303 2.29 4.50 1.41 61 RCVD_IN_RP_RNBL 4247 1.29 4.45 0.04 62 MIME_QP_LONG_LINE 4026 3.80 4.21 3.64 63 BOTNET_NORDNS 3995 1.20 4.18 0.02 64 MultiRelay_Combo 3892 1.29 4.07 0.19 65 MultiRelay_CC 3892 1.29 4.07 0.19 66 XMBdyGiftCard01 3841 2.76 4.02 2.26 67 HTML_IMAGE_RATIO_08 3797 3.02 3.97 2.64 68 MIME_HTML_MOSTLY 3768 3.50 3.94 3.33 69 XM_SendGrid 3624 5.92 3.79 6.77 70 BAYES_95 3491 3.04 3.65 2.80 71 RCVD_IN_PSBL 3469 1.14 3.63 0.15 72 URIBL_DBL_ABUSE_REDIR 3433 1.06 3.59 0.06 73 XM_UB999 3379 1.02 3.54 0.03 74 XMNumbers 3148 3.40 3.30 3.44 75 URI_HEX 3129 2.34 3.28 1.98 76 TR_XM_RelayPhish 3122 1.46 3.27 0.74 77 XM_SPF_SoftFail 3098 1.69 3.24 1.07 78 RCVD_IN_BL_SPAMCOP_NET 3052 1.07 3.19 0.23 79 RELAYCOUNTRY_DE 3006 1.94 3.15 1.46 80 TR_XM_PHPDW 2982 1.47 3.12 0.82 81 TR_XM_PHPForged 2966 1.46 3.10 0.81 82 MIME_HTML_ONLY_MULTI 2944 2.16 3.08 1.80 83 RCVD_IN_MSPIKE_H2 2943 4.19 3.08 4.63 84 TR_XM_FormFill2 2925 1.44 3.06 0.79 85 HTML_IMAGE_ONLY_24 2922 1.06 3.06 0.27 86 XM_H_PHPOS 2910 1.43 3.05 0.79 87 XM_CamelCaseFrm001 2907 2.05 3.04 1.66 88 XM_OfRef6 2904 2.39 3.04 2.13 89 HTML_IMAGE_RATIO_06 2885 3.12 3.02 3.16 90 DATE_IN_PAST_06_12 2866 0.89 3.00 0.05 91 FROM_SUSPICIOUS_NTLD 2698 0.81 2.82 0.02 92 T_TooManySym_01 2681 7.23 2.81 8.99 93 KHOP_HELO_FCRDNS 2629 1.61 2.75 1.16 94 XMDiploma_00 2548 2.16 2.67 1.97 95 XM_URI_RBL 2417 1.12 2.53 0.56 96 DATE_IN_PAST_03_06 2413 0.79 2.53 0.11 97 TM2_M_URI_OPT_OUT 2320 1.87 2.43 1.64 98 T_XMHurry_00 2302 1.33 2.41 0.90 99 BAYES_40 2283 3.47 2.39 3.90 100 EBAY_IMG_NOT_RCVD_EBAY 2238 0.67 2.34 0.01 101 SUBJ_ALL_CAPS 2204 1.72 2.31 1.48 102 XM_ProductURIs 2180 2.09 2.28 2.01 103 RELAYCOUNTRY_PT 2142 0.80 2.24 0.22 104 ALL_TRUSTED 2074 10.43 2.17 13.70 105 SpammyFromTLD_01 2063 1.00 2.16 0.54 106 HOSTED_IMG_DIRECT_MX 2050 0.61 2.15 0.00 107 NO_DNS_FOR_FROM 2014 1.65 2.11 1.47 108 XM_H_TOP 1961 0.58 2.05 0.00 109 BAYES_20 1923 2.56 2.01 2.77 110 T_XMDrugObfuBody_08 1897 1.50 1.99 1.31 111 RCVD_IN_IADB_LISTED 1807 3.04 1.89 3.49 112 TR_M_TOP_BAYES 1764 0.52 1.85 0.00 113 FILL_THIS_FORM 1709 1.09 1.79 0.82 114 RCVD_IN_IADB_SPF 1704 2.70 1.78 3.06 115 XMSexyCombo_01 1692 0.95 1.77 0.62 116 RCVD_IN_IADB_SENDERID 1632 2.44 1.71 2.73 117 RCVD_IN_IADB_DK 1624 2.38 1.70 2.65 118 RCVD_IN_MSPIKE_H3 1620 2.35 1.70 2.61 119 RCVD_IN_MSPIKE_WL 1620 2.35 1.70 2.61 120 XM_B_REG_HTML 1610 0.98 1.69 0.70 121 FILL_THIS_FORM_LONG 1609 0.87 1.68 0.55 122 UNPARSEABLE_RELAY 1577 3.73 1.65 4.56 123 XMSubMetaSxObfu_03 1574 0.87 1.65 0.56 124 XMSubMetaSSx_00 1562 0.74 1.64 0.39 125 DIET_1 1538 0.85 1.61 0.55 126 TR_XM_DK_SendGrid 1483 3.07 1.55 3.68 127 RELAYCOUNTRY_IN 1451 0.47 1.52 0.05 128 XM_H_PHPMailer 1449 0.88 1.52 0.63 129 URI_TRY_3LD 1436 1.58 1.50 1.61 130 XMGenDplmaNmb 1402 1.25 1.47 1.16 131 XMBody_78 1348 1.11 1.41 0.99 132 XMBody_17 1330 0.77 1.39 0.52 133 XM_UB60 1328 0.44 1.39 0.07 134 MAILING_LIST_MULTI 1310 2.05 1.37 2.32 135 FILL_THIS_FORM_LOAN 1301 0.79 1.36 0.56 136 T_XMDrugObfuBody_00 1298 1.32 1.36 1.30 137 XMPhish11 1250 1.14 1.31 1.07 138 XM_H_Long_From02 1249 1.38 1.31 1.41 139 BAYES_05 1210 1.72 1.27 1.90 140 XM_H_PHPOS_M 1199 0.54 1.26 0.25 141 XMGppyBdWords 1195 0.48 1.25 0.18 142 XMSubMetaI_00 1185 1.03 1.24 0.95 143 FROM_DOMAIN_NOVOWEL 1170 0.37 1.22 0.03 144 TM2_M_VERY_LONG_WORD 1164 1.35 1.22 1.40 145 T_Symld_Words_02 1133 0.70 1.19 0.50 146 URIBL_BLACK 1117 0.39 1.17 0.08 147 XMMoneyMeta_00 1115 0.58 1.17 0.35 148 BAYES_00 1071 8.86 1.12 11.92 149 HTML_IMAGE_ONLY_32 1069 0.50 1.12 0.26 150 XMPhish30 1063 0.89 1.11 0.80 151 XMBrknScrpt_02 1057 0.84 1.11 0.73 152 XMHTMLBadTable_001 1048 0.76 1.10 0.63 153 DATE_IN_PAST_12_24 1017 0.37 1.06 0.09 154 RELAYCOUNTRY_GB 975 0.66 1.02 0.51 155 SHORT_URI_3 965 0.41 1.01 0.17 156 TR_Caps_n_Bayes_99 962 0.42 1.01 0.19 157 TR_Symld_Words 958 1.33 1.00 1.46 158 XM_HighProb1 944 0.29 0.99 0.02 159 TM2_M_BODY_EMPTY 933 0.58 0.98 0.42 160 RELAYCOUNTRY_AT 923 0.44 0.97 0.24 161 DKIM_ADSP_CUSTOM_MED 921 0.95 0.96 0.94 162 XMStockSpam_06 912 1.58 0.95 1.82 163 XMEmptyBody_01 904 0.46 0.95 0.26 164 XMHTML_After_End 887 0.56 0.93 0.41 165 RELAYCOUNTRY_IE 878 0.39 0.92 0.18 166 XM_OfRef7 875 0.38 0.92 0.17 167 XM_B_COPY_HTML 849 0.70 0.89 0.63 168 RDNS_DYNAMIC 843 0.62 0.88 0.52 169 TR_LOTS_OF_MONEY3 835 0.57 0.87 0.45 170 NML_ADSP_CUSTOM_MED 831 0.74 0.87 0.68 171 XMSexyCombo_04 822 0.30 0.86 0.07 172 LONG_JUNK_URI 814 0.32 0.85 0.11 173 XMSubMetaSxObfu_02 812 0.87 0.85 0.88 174 SUBJ_DOLLARS 789 0.66 0.83 0.60 175 XM_UB80 783 0.25 0.82 0.02 176 T_MONEY_PERCENT 780 0.39 0.82 0.22 177 TR_LOTS_OF_MONEY2 780 0.39 0.82 0.22 178 XMClaimOffer 774 0.36 0.81 0.18 179 URI_NOVOWEL 773 0.45 0.81 0.31 180 TR_Mismatch_TLD_02 772 0.27 0.81 0.06 181 XM_DK_Undo_01 771 1.48 0.81 1.75 182 NUMERIC_HTTP_ADDR 757 0.55 0.79 0.45 183 TM2_M_A_HREF_HREF 753 0.75 0.79 0.73 184 FORGED_GMAIL_RCVD 738 0.53 0.77 0.44 185 T_FILL_THIS_FORM_SHORT 737 0.65 0.77 0.61 186 RELAYCOUNTRY_CN 708 0.25 0.74 0.05 187 URI_PHP_REDIR 705 0.21 0.74 0.00 188 BASE64_LENGTH_79_INF 701 0.39 0.73 0.25 189 THIS_AD 681 0.29 0.71 0.13 190 MPART_ALT_DIFF_COUNT 678 0.41 0.71 0.29 191 LOW_PRICE 667 0.29 0.70 0.12 192 XM_RXBody 665 0.56 0.70 0.50 193 FROM_2_EMAILS_SHORT 659 0.20 0.69 0.01 194 URIBL_DBL_SPAM 652 0.22 0.68 0.04 195 BODY_ENHANCEMENT 652 0.22 0.68 0.04 196 RELAYCOUNTRY_NL 649 0.37 0.68 0.24 197 SUBJ_OBFU_PUNCT_FEW 638 0.23 0.67 0.05 198 HK_SCAM 621 0.19 0.65 0.01 199 URIBL_ABUSE_SURBL 616 0.22 0.64 0.05 200 TVD_APP_LOAN 614 0.19 0.64 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 207727 87.84 92.34 86.06 2 DKIM_SIGNED 198672 81.58 79.73 82.31 3 XM_DK_Pass 195478 79.35 75.22 80.98 4 DKIM_VALID 187584 75.90 71.31 77.71 5 DKIM_VALID_AU 154097 62.43 58.88 63.84 6 XMListUnsubscribeExists 138178 62.50 75.78 57.25 7 DCC_CHECK_NEGATIVE 120309 41.64 20.91 49.84 8 DCC_CHECK 117901 57.01 77.65 48.85 9 BAYES_50 117474 44.17 32.79 48.67 10 HTML_FONT_LOW_CONTRAST 83769 34.84 35.17 34.70 11 DKIM_VALID_EF 76001 28.13 19.66 31.49 12 LOC_TINY_FONT_1 70931 30.92 34.81 29.39 13 XMSubLong 58553 23.48 21.51 24.26 14 MIME_HTML_ONLY 58351 26.29 31.65 24.17 15 T_TM2_M_HEADER_IN_MSG 56924 21.37 15.79 23.58 16 FVGT_m_MULTI_ODD 51161 22.60 26.13 21.20 17 XM_DK_Undo_02 46276 27.49 48.52 19.17 18 BAYES_99 42255 25.42 45.41 17.51 19 RCVD_IN_RP_SAFE 38877 13.13 5.63 16.11 20 BAYES_999 38448 22.24 38.18 15.93 21 MultiRelay 38219 16.01 16.44 15.83 22 XM_Body_Dirty_Words 36151 16.26 19.52 14.98 23 RCVD_IN_RP_CERTIFIED 34320 11.48 4.55 14.22 24 T_KAM_HTML_FONT_INVALID 34093 15.50 18.98 14.12 25 XM_Multi_Part_URI 33158 14.08 14.93 13.74 26 ALL_TRUSTED 33059 10.43 2.17 13.70 27 XM_DKIMWhitelistDomains 32360 9.62 0.05 13.41 28 HTML_IMAGE_RATIO_02 30506 13.56 15.89 12.64 29 BAYES_00 28771 8.86 1.12 11.92 30 TR_XM_DK_Bayes 26383 7.95 0.43 10.93 31 XM_Evil_Numbers_Gen 26156 11.87 14.50 10.84 32 TR_XM_DK_Bayes1 25388 7.63 0.35 10.52 33 TR_XM_DK_Bayes2 23622 7.07 0.20 9.79 34 TR_DCC_Bayes_99 22236 16.93 36.41 9.21 35 T_TooManySym_01 21690 7.23 2.81 8.99 36 LOTS_OF_MONEY 21284 9.12 9.88 8.82 37 TO_MALFORMED 20801 6.19 0.07 8.62 38 FSL_BULK_SIG 20506 9.73 12.85 8.50 39 T_XMDrugObfuBody_14 19087 7.50 6.48 7.91 40 LotsOfNums_01 18977 7.98 8.30 7.86 41 HTML_IMAGE_RATIO_04 17648 8.28 10.72 7.31 42 XM_B_Phish_Phrases 17585 7.69 8.71 7.29 43 BOTNET_IPINHOSTNAME 16771 9.86 17.23 6.95 44 XM_SendGrid 16332 5.92 3.79 6.77 45 XM_H_Long_From01 15710 6.60 6.84 6.51 46 TooManyTo_001 15295 7.26 9.61 6.34 47 BAYES_60 14762 5.83 5.12 6.12 48 FROM_EXCESS_BASE64 14021 5.70 5.42 5.81 49 XMStrtUSub 13859 6.44 8.19 5.74 50 RELAYCOUNTRY_META 13546 11.48 26.31 5.61 51 XMSexyCombo_05 13112 6.60 9.57 5.43 52 XMSubMetaSx_00 11718 5.51 7.16 4.85 53 XM_B_SpammyTLD 11188 5.06 6.13 4.64 54 RCVD_IN_MSPIKE_H2 11186 4.19 3.08 4.63 55 DKIM_INVALID 11088 5.68 8.42 4.59 56 UNPARSEABLE_RELAY 11000 3.73 1.65 4.56 57 XM_UncommonTLD01 10457 5.80 9.51 4.33 58 TVD_RCVD_IP 10344 3.19 0.42 4.29 59 BAYES_80 9708 4.58 5.98 4.02 60 BAYES_40 9421 3.47 2.39 3.90 61 TR_XM_DK_SendGrid 8876 3.07 1.55 3.68 62 MIME_QP_LONG_LINE 8790 3.80 4.21 3.64 63 IN_ZIMBRA_NJ_WHITELIST 8761 2.60 0.01 3.63 64 MPART_ALT_DIFF 8638 4.23 5.87 3.58 65 RCVD_IN_IADB_LISTED 8425 3.04 1.89 3.49 66 XMNumbers 8315 3.40 3.30 3.44 67 MIME_HTML_MOSTLY 8031 3.50 3.94 3.33 68 HTML_IMAGE_RATIO_06 7622 3.12 3.02 3.16 69 INVALID_MSGID 7490 2.26 0.14 3.10 70 RCVD_IN_IADB_SPF 7376 2.70 1.78 3.06 71 T_TooManySym_02 7364 2.34 0.54 3.05 72 XM_DIRTYINTL 7137 3.45 4.71 2.96 73 T_REMOTE_IMAGE 6833 3.37 4.75 2.83 74 BAYES_95 6761 3.04 3.65 2.80 75 BAYES_20 6694 2.56 2.01 2.77 76 RCVD_IN_IADB_SENDERID 6601 2.44 1.71 2.73 77 RCVD_IN_IADB_DK 6398 2.38 1.70 2.65 78 HTML_IMAGE_RATIO_08 6378 3.02 3.97 2.64 79 RCVD_IN_MSPIKE_WL 6304 2.35 1.70 2.61 80 RCVD_IN_MSPIKE_H3 6303 2.35 1.70 2.61 81 UNTRUSTED_Relay 6141 7.40 19.65 2.54 82 HTML_MIME_NO_HTML_TAG 5898 3.44 5.96 2.44 83 TR_MetaPhish_Combo_01 5645 1.86 0.64 2.34 84 USER_IN_DEF_DKIM_WL 5613 1.67 0.02 2.33 85 MAILING_LIST_MULTI 5594 2.05 1.37 2.32 86 XMBdyGiftCard01 5462 2.76 4.02 2.26 87 BOTNET 5148 7.78 22.04 2.13 88 XM_OfRef6 5148 2.39 3.04 2.13 89 RCVD_IN_IADB_VOUCHED 5113 1.67 0.55 2.12 90 XM_ProductURIs 4857 2.09 2.28 2.01 91 URI_HEX 4770 2.34 3.28 1.98 92 XMDiploma_00 4745 2.16 2.67 1.97 93 IN_HORDE_ADDRESS_BOOK 4743 1.42 0.05 1.96 94 BAYES_05 4581 1.72 1.27 1.90 95 XMStockSpam_06 4402 1.58 0.95 1.82 96 XM_PDF 4360 1.41 0.39 1.81 97 MIME_HTML_ONLY_MULTI 4348 2.16 3.08 1.80 98 XM_DK_Undo_01 4216 1.48 0.81 1.75 99 XM_CamelCaseFrm001 4007 2.05 3.04 1.66 100 TM2_M_URI_OPT_OUT 3967 1.87 2.43 1.64 101 URI_TRY_3LD 3876 1.58 1.50 1.61 102 XM_UB50 3778 3.96 10.02 1.57 103 SUBJ_ALL_CAPS 3580 1.72 2.31 1.48 104 NO_DNS_FOR_FROM 3555 1.65 2.11 1.47 105 RELAYCOUNTRY_DE 3529 1.94 3.15 1.46 106 TR_Symld_Words 3515 1.33 1.00 1.46 107 TooManyTo_002 3457 1.17 0.50 1.43 108 ANY_BOUNCE_MESSAGE 3420 1.08 0.24 1.42 109 BOUNCE_MESSAGE 3419 1.08 0.24 1.42 110 XM_H_Long_From02 3414 1.38 1.31 1.41 111 RELAYCOUNTRY_CA 3412 2.29 4.50 1.41 112 TM2_M_VERY_LONG_WORD 3379 1.35 1.22 1.40 113 RCVD_IN_IADB_OPTIN 3278 1.07 0.35 1.36 114 XM_GoogleGroups 3171 1.07 0.44 1.31 115 T_XMDrugObfuBody_08 3170 1.50 1.99 1.31 116 T_XMDrugObfuBody_00 3140 1.32 1.36 1.30 117 XM_H_Trusted_IP 2924 0.87 0.00 1.21 118 KHOP_HELO_FCRDNS 2806 1.61 2.75 1.16 119 XMGenDplmaNmb 2803 1.25 1.47 1.16 120 TooManyTo_003 2589 0.89 0.41 1.07 121 XM_SPF_SoftFail 2585 1.69 3.24 1.07 122 XMPhish11 2579 1.14 1.31 1.07 123 XMBody_95 2516 0.77 0.10 1.04 124 XMBody_78 2381 1.11 1.41 0.99 125 XMSubMetaI_00 2286 1.03 1.24 0.95 126 DKIM_ADSP_CUSTOM_MED 2269 0.95 0.96 0.94 127 T_XMHurry_00 2183 1.33 2.41 0.90 128 TooManyTo_004 2150 0.74 0.35 0.89 129 XMSubMetaSxObfu_02 2118 0.87 0.85 0.88 130 XMGappySubj_01 2085 0.71 0.32 0.86 131 USER_IN_WHITELIST 2024 0.60 0.00 0.84 132 FILL_THIS_FORM 1978 1.09 1.79 0.82 133 TR_XM_PHPDW 1975 1.47 3.12 0.82 134 TR_XM_PHPForged 1948 1.46 3.10 0.81 135 XMPhish30 1927 0.89 1.11 0.80 136 TR_XM_FormFill2 1918 1.44 3.06 0.79 137 XM_H_PHPOS 1911 1.43 3.05 0.79 138 TooManyTo_005 1901 0.65 0.30 0.79 139 T_TooManySym_03 1825 0.57 0.11 0.76 140 TR_XM_RelayPhish 1789 1.46 3.27 0.74 141 TM2_M_A_HREF_HREF 1769 0.75 0.79 0.73 142 XMBrknScrpt_02 1765 0.84 1.11 0.73 143 XM_B_REG_HTML 1687 0.98 1.69 0.70 144 DKIM_ADSP_NXDOMAIN 1678 2.26 6.21 0.70 145 HTML_FONT_FACE_BAD 1678 0.67 0.60 0.70 146 NML_ADSP_CUSTOM_MED 1647 0.74 0.87 0.68 147 XMHTMLBadTable_001 1522 0.76 1.10 0.63 148 XM_H_PHPMailer 1521 0.88 1.52 0.63 149 XM_B_COPY_HTML 1519 0.70 0.89 0.63 150 XMLngstWrd_00 1517 0.52 0.25 0.63 151 XMSexyCombo_01 1494 0.95 1.77 0.62 152 T_FILL_THIS_FORM_SHORT 1466 0.65 0.77 0.61 153 HTML_TAG_BALANCE_BODY 1455 0.58 0.53 0.60 154 SUBJ_DOLLARS 1451 0.66 0.83 0.60 155 XMGappySubj_02 1440 0.45 0.09 0.60 156 HELO_NODOT 1428 0.51 0.30 0.59 157 XMBSHREFv2 1422 0.53 0.40 0.59 158 XMLngstWrd_01 1414 0.49 0.23 0.59 159 XMNoVowels 1379 0.46 0.19 0.57 160 XMSubMetaSxObfu_03 1356 0.87 1.65 0.56 161 XM_URI_RBL 1356 1.12 2.53 0.56 162 FILL_THIS_FORM_LOAN 1351 0.79 1.36 0.56 163 DIET_1 1337 0.85 1.61 0.55 164 HELO_NO_DOMAIN 1331 0.48 0.29 0.55 165 FILL_THIS_FORM_LONG 1327 0.87 1.68 0.55 166 PLING_QUERY 1326 0.56 0.59 0.55 167 SpammyFromTLD_01 1313 1.00 2.16 0.54 168 RDNS_DYNAMIC 1257 0.62 0.88 0.52 169 XMBody_17 1253 0.77 1.39 0.52 170 RELAYCOUNTRY_GB 1239 0.66 1.02 0.51 171 T_Symld_Words_02 1217 0.70 1.19 0.50 172 XM_RXBody 1209 0.56 0.70 0.50 173 XMCapTrack 1166 0.39 0.14 0.48 174 XMRcvdHeader_15 1111 0.33 0.00 0.46 175 NUMERIC_HTTP_ADDR 1087 0.55 0.79 0.45 176 TR_LOTS_OF_MONEY3 1085 0.57 0.87 0.45 177 FORGED_GMAIL_RCVD 1064 0.53 0.77 0.44 178 TM2_M_BODY_EMPTY 1010 0.58 0.98 0.42 179 XMSubject_48 997 0.32 0.10 0.41 180 XMHTML_After_End 995 0.56 0.93 0.41 181 T_TooManySym_04 982 0.30 0.03 0.41 182 MISSING_HEADERS 956 0.45 0.57 0.40 183 XMSubMetaSSx_00 940 0.74 1.64 0.39 184 XM_Walgreens_Forge 939 0.33 0.17 0.39 185 XM_Body_Obfu01 927 0.38 0.38 0.38 186 RELAYCOUNTRY_AU 922 0.36 0.30 0.38 187 XMSolicitRefs_0 895 0.41 0.50 0.37 188 XM_Akamai 881 0.26 0.01 0.36 189 HTTPS_HTTP_MISMATCH 854 0.32 0.25 0.35 190 XMDateMe_00 854 0.31 0.21 0.35 191 XMMoneyMeta_00 840 0.58 1.17 0.35 192 XMSlimDrugH 831 0.41 0.59 0.34 193 XM_ShortIntro_01 814 0.37 0.46 0.34 194 XMLngstWrd_02 768 0.29 0.21 0.32 195 URI_NOVOWEL 759 0.45 0.81 0.31 196 XMSUPPORT 744 0.22 0.00 0.31 197 XM_H_SpoofStaff4 724 0.23 0.04 0.30 198 MIME_CHARSET_FARAWAY 722 0.32 0.37 0.30 199 FROM_EGROUPS 705 0.21 0.00 0.29 200 MPART_ALT_DIFF_COUNT 689 0.41 0.71 0.29 ----------------------------------------------------------------------