Email: 688486 Autolearn: 0 AvgScore: 1.94 AvgScanTime: 2.27 sec Spam: 131580 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 3.03 sec Ham: 556906 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 2.09 sec Time Spent Running SA: 434.48 hours Time Spent Processing Spam: 110.65 hours Time Spent Processing Ham: 323.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125942 89.93 95.72 88.56 2 DCC_CHECK 107703 53.57 81.85 46.89 3 DKIM_SIGNED 99129 76.96 75.34 77.35 4 XM_DK_Pass 95542 75.46 72.61 76.13 5 DKIM_VALID 91975 72.96 69.90 73.68 6 XM_B_Unicode 87495 70.08 66.50 70.93 7 XMListUnsubscribeExists 86726 57.67 65.91 55.73 8 DKIM_VALID_AU 71201 55.29 54.11 55.57 9 BAYES_50 63013 54.46 47.89 56.02 10 XM_B_Unicode3 58821 41.94 44.70 41.28 11 MIME_HTML_ONLY 48819 23.96 37.10 20.85 12 HTML_FONT_LOW_CONTRAST 46750 30.04 35.53 28.75 13 LOC_TINY_FONT_1 44319 26.95 33.68 25.36 14 XM_DK_Undo_02 43542 11.29 33.09 6.14 15 XMSubLong 34753 22.76 26.41 21.90 16 FVGT_m_MULTI_ODD 33457 24.45 25.43 24.22 17 DKIM_VALID_EF 33117 26.61 25.17 26.96 18 BOTNET 29673 6.07 22.55 2.17 19 BAYES_99 29534 6.47 22.45 2.69 20 XM_Body_Dirty_Words 28782 15.96 21.87 14.56 21 RELAYCOUNTRY_META 27824 8.66 21.15 5.71 22 MultiRelay 27251 18.42 20.71 17.88 23 FSL_BULK_SIG 26762 10.35 20.34 7.99 24 T_KAM_HTML_FONT_INVALID 24286 18.66 18.46 18.71 25 TR_DCC_Bayes_99 23421 4.42 17.80 1.26 26 XM_Multi_Part_URI 23391 12.63 17.78 11.41 27 T_TM2_M_HEADER_IN_MSG 23219 26.90 17.65 29.08 28 BAYES_999 22853 4.97 17.37 2.04 29 DCC_CHECK_NEGATIVE 21635 44.49 16.44 51.11 30 BOTNET_IPINHOSTNAME 20971 6.62 15.94 4.42 31 XM_UncommonTLD01 19666 5.73 14.95 3.55 32 LOTS_OF_MONEY 16518 9.82 12.55 9.17 33 HTML_IMAGE_RATIO_02 15972 10.13 12.14 9.65 34 XM_B_Unsub 15738 9.73 11.96 9.20 35 XM_Evil_Numbers_Gen 15523 10.14 11.80 9.75 36 UNTRUSTED_Relay 15050 3.82 11.44 2.02 37 XMSexyCombo_05 14837 5.75 11.28 4.45 38 SpammyFromTLD_02 13994 2.51 10.64 0.58 39 TooManyTo_001 13840 8.69 10.52 8.26 40 HTML_SHORT_LINK_IMG_1 13190 1.95 10.02 0.04 41 HTML_MIME_NO_HTML_TAG 13145 4.02 9.99 2.61 42 T_XMDrugObfuBody_14 12095 8.38 9.19 8.19 43 XMSubMetaSx_00 11647 4.72 8.85 3.74 44 XM_B_SpammyTLD 11331 3.60 8.61 2.41 45 XM_B_Phish_Phrases 11193 6.75 8.51 6.33 46 LotsOfNums_01 10946 8.26 8.32 8.24 47 MPART_ALT_DIFF 10680 4.74 8.12 3.95 48 T_REMOTE_IMAGE 10639 4.64 8.09 3.82 49 BODY_URI_ONLY 10017 1.52 7.61 0.08 50 HTML_IMAGE_ONLY_08 9942 1.53 7.56 0.11 51 XMNumbers 9278 4.57 7.05 3.99 52 T_HTML_TAG_BALANCE_CENTER 9261 1.47 7.04 0.15 53 XM_DIRTYINTL 8430 3.62 6.41 2.97 54 BAYES_80 8414 3.10 6.39 2.32 55 XM_UB50 8190 2.07 6.22 1.09 56 BAYES_60 8137 5.03 6.18 4.76 57 HTML_IMAGE_RATIO_04 7934 6.09 6.03 6.10 58 XM_SPF_SoftFail 7838 3.84 5.96 3.34 59 XM_H_Long_From01 7764 6.87 5.90 7.11 60 XM_BadFromFormat 7694 1.20 5.85 0.11 61 FROM_SUSPICIOUS_NTLD 7448 1.15 5.66 0.08 62 BOTNET_NORDNS 7361 1.10 5.59 0.04 63 FROM_SUSPICIOUS_NTLD_FP 7360 1.13 5.59 0.08 64 MIME_QP_LONG_LINE 7318 5.95 5.56 6.04 65 HDRS_LCASE_IMGONLY 7234 1.08 5.50 0.04 66 DKIM_INVALID 7154 4.01 5.44 3.67 67 BAYES_40 6869 5.70 5.22 5.81 68 MIME_HTML_MOSTLY 6758 3.18 5.14 2.72 69 XM_SendGrid 6077 5.89 4.62 6.19 70 XM_H_TOP 5959 0.87 4.53 0.01 71 XMStrtUSub 5958 3.91 4.53 3.76 72 RCVD_IN_MSPIKE_H2 5737 5.90 4.36 6.27 73 FROM_MISSP_REPLYTO 5675 0.83 4.31 0.00 74 KHOP_HELO_FCRDNS 5636 2.48 4.28 2.05 75 MIME_HTML_ONLY_MULTI 5355 2.48 4.07 2.11 76 HTML_IMAGE_RATIO_06 5322 3.77 4.04 3.70 77 RELAYCOUNTRY_GB 5222 1.68 3.97 1.14 78 BAYES_20 4985 4.27 3.79 4.38 79 TM2_M_URI_OPT_OUT 4942 2.15 3.76 1.77 80 RELAYCOUNTRY_CA 4856 2.02 3.69 1.63 81 XM_URI_RBL 4850 0.95 3.69 0.31 82 NO_DNS_FOR_FROM 4817 1.47 3.66 0.96 83 FROM_EXCESS_BASE64 4790 3.28 3.64 3.19 84 URI_HEX 4770 2.26 3.63 1.94 85 XMDiploma_00 4708 1.92 3.58 1.53 86 RCVD_IN_BL_SPAMCOP_NET 4705 1.80 3.58 1.38 87 T_TooManySym_01 4541 3.92 3.45 4.03 88 BAYES_95 4417 1.77 3.36 1.39 89 DATE_IN_PAST_03_06 4058 0.77 3.08 0.22 90 REPLYTO_WITHOUT_TO_CC 4008 0.61 3.05 0.03 91 MIME_HEADER_CTYPE_ONLY 3971 0.67 3.02 0.11 92 US_DOLLARS_3 3807 1.55 2.89 1.24 93 ALL_TRUSTED 3792 12.73 2.88 15.05 94 TM2_M_VERY_LONG_WORD 3722 1.72 2.83 1.45 95 TR_XM_DK_SendGrid 3704 3.40 2.82 3.54 96 RELAYCOUNTRY_FR 3698 0.96 2.81 0.52 97 XMSexyCombo_01 3696 0.94 2.81 0.50 98 XM_CamelCaseFrm001 3678 2.30 2.80 2.19 99 BAYES_00 3668 16.24 2.79 19.42 100 HTML_IMAGE_ONLY_12 3647 0.65 2.77 0.15 101 RCVD_IN_MSPIKE_BL 3362 0.57 2.56 0.10 102 XMGenDplmaNmb 3330 1.26 2.53 0.96 103 DKIM_ADSP_NXDOMAIN 3301 0.91 2.51 0.53 104 HTML_IMAGE_RATIO_08 3287 2.39 2.50 2.36 105 TO_EQ_FM_DOM_HTML_IMG 3244 0.48 2.47 0.01 106 TR_XM_RelayPhish 3213 1.26 2.44 0.98 107 RCVD_IN_RP_RNBL 3200 0.56 2.43 0.12 108 RCVD_IN_MSPIKE_L5 3181 0.52 2.42 0.07 109 SUBJ_ALL_CAPS 3180 2.45 2.42 2.45 110 XM_B_Unsub2 3175 1.71 2.41 1.55 111 XMMoneyMeta_00 3107 0.83 2.36 0.46 112 SpammyFromTLD_01 3042 1.29 2.31 1.05 113 TR_M_TOP_BAYES 3004 0.44 2.28 0.00 114 T_XMDrugObfuBody_08 2988 1.65 2.27 1.50 115 XM_OfRef6 2840 1.64 2.16 1.52 116 MultiRelay_CC 2816 0.60 2.14 0.23 117 RCVD_IN_IADB_LISTED 2816 4.70 2.14 5.30 118 MultiRelay_Combo 2816 0.60 2.14 0.23 119 TR_XM_PHPDW 2786 0.86 2.12 0.56 120 TR_XM_PHPForged 2766 0.84 2.10 0.54 121 TR_XM_FormFill2 2757 0.84 2.10 0.54 122 XM_H_PHPOS 2738 0.83 2.08 0.53 123 RCVD_IN_IADB_SPF 2684 4.13 2.04 4.62 124 XMStockSpam_06 2671 1.53 2.03 1.41 125 RCVD_IN_IADB_SENDERID 2635 3.70 2.00 4.10 126 RCVD_IN_IADB_DK 2626 3.64 2.00 4.02 127 XMBody_17 2616 0.98 1.99 0.75 128 TR_Mismatch_TLD_02 2601 0.45 1.98 0.09 129 T_Symld_Words_02 2420 1.16 1.84 1.00 130 HTML_EXTRA_CLOSE 2409 0.36 1.83 0.01 131 T_XMDrugObfuBody_00 2363 1.07 1.80 0.90 132 BAYES_05 2187 2.69 1.66 2.93 133 XM_DK_Undo_01 2152 1.50 1.64 1.47 134 XMSubMetaI_00 2110 0.93 1.60 0.77 135 DKIM_ADSP_CUSTOM_MED 2059 1.61 1.56 1.62 136 TR_XM_DK_Bayes 2048 13.23 1.56 15.99 137 FSL_THIS_IS_ADV 2047 0.38 1.56 0.11 138 HTML_FONT_SIZE_HUGE 2021 0.35 1.54 0.07 139 RDNS_DYNAMIC 2015 0.56 1.53 0.34 140 RELAYCOUNTRY_DE 1987 0.71 1.51 0.52 141 TR_XM_DK_Bayes1 1983 12.84 1.51 15.51 142 UNPARSEABLE_RELAY 1948 2.03 1.48 2.15 143 XMPhish11 1906 1.20 1.45 1.14 144 TR_Symld_Words 1903 1.43 1.45 1.43 145 TR_XM_INV_DKIM 1899 0.36 1.44 0.11 146 URIBL_DBL_ABUSE_REDIR 1898 1.03 1.44 0.93 147 RCVD_IN_RP_SAFE 1866 8.40 1.42 10.04 148 LOCALPART_IN_SUBJECT 1812 0.28 1.38 0.02 149 NML_ADSP_CUSTOM_MED 1807 1.35 1.37 1.34 150 MAILING_LIST_MULTI 1787 2.21 1.36 2.42 151 T_XMHurry_00 1782 1.04 1.35 0.96 152 XMBrknScrpt_02 1765 0.74 1.34 0.59 153 RCVD_IN_MSPIKE_WL 1715 4.18 1.30 4.85 154 XM_Combo_Sbj 1714 0.44 1.30 0.24 155 HTML_FONT_FACE_BAD 1714 0.90 1.30 0.81 156 FORGED_GMAIL_RCVD 1621 0.80 1.23 0.70 157 URI_TRY_3LD 1614 1.58 1.23 1.67 158 T_FILL_THIS_FORM_SHORT 1592 0.90 1.21 0.83 159 XMHTML_After_End 1581 1.12 1.20 1.10 160 XM_UB60 1572 0.30 1.19 0.08 161 XMBdyGiftCard01 1570 1.53 1.19 1.61 162 XMSexyCombo_04 1557 0.30 1.18 0.09 163 XM_H_PHPMailer 1524 0.67 1.16 0.55 164 XM_ProductURIs 1511 0.96 1.15 0.92 165 TO_NAME_SUBJ_NO_RDNS 1506 0.22 1.14 0.00 166 XMSubMetaSxObfu_03 1501 0.66 1.14 0.55 167 SUBJ_DOLLARS 1492 0.53 1.13 0.39 168 HELO_NODOT 1487 1.37 1.13 1.42 169 HELO_NO_DOMAIN 1483 1.36 1.13 1.42 170 TR_XM_DK_Bayes2 1478 11.26 1.12 13.66 171 XMPhish30 1477 0.66 1.12 0.55 172 T_MONEY_PERCENT 1457 0.71 1.11 0.61 173 TR_LOTS_OF_MONEY2 1457 0.71 1.11 0.61 174 RELAYCOUNTRY_AT 1451 0.34 1.10 0.16 175 DIET_1 1440 0.57 1.09 0.45 176 HTML_TAG_BALANCE_BODY 1432 0.83 1.09 0.76 177 TM2_M_A_HREF_HREF 1398 0.57 1.06 0.45 178 LONG_HEX_URI 1274 0.33 0.97 0.17 179 RELAYCOUNTRY_IN 1271 0.28 0.97 0.12 180 HK_RANDOM_REPLYTO 1269 0.40 0.96 0.27 181 RCVD_IN_PSBL 1265 0.23 0.96 0.05 182 THIS_AD 1265 0.44 0.96 0.31 183 XM_H_PHPOS_M 1246 0.32 0.95 0.17 184 XMPhish14 1232 0.42 0.94 0.30 185 XM_UB99 1223 0.18 0.93 0.00 186 RCVD_IN_MSPIKE_H3 1220 3.17 0.93 3.70 187 XMSubMetaSSx_00 1207 0.31 0.92 0.16 188 TR_LOTS_OF_MONEY3 1181 0.57 0.90 0.50 189 XM_H_Long_From02 1167 1.30 0.89 1.40 190 FSL_HELO_NON_FQDN_1 1135 0.17 0.86 0.00 191 RCVD_IN_RP_CERTIFIED 1122 7.45 0.85 9.01 192 T_TooManySym_02 1120 1.72 0.85 1.93 193 XM_Body_Obfu01 1107 0.45 0.84 0.36 194 XMSlimDrugH 1087 0.40 0.83 0.31 195 RELAYCOUNTRY_VN 1075 0.16 0.82 0.01 196 XMHTMLBadTable_001 1042 0.66 0.79 0.63 197 XM_UB80 1039 0.16 0.79 0.01 198 TR_MetaPhish_Combo_01 1031 0.91 0.78 0.94 199 HTTPS_HTTP_MISMATCH 981 0.61 0.75 0.58 200 XM_PDF 959 3.83 0.73 4.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 493200 89.93 95.72 88.56 2 DKIM_SIGNED 430757 76.96 75.34 77.35 3 XM_DK_Pass 423998 75.46 72.61 76.13 4 DKIM_VALID 410318 72.96 69.90 73.68 5 XM_B_Unicode 394998 70.08 66.50 70.93 6 BAYES_50 311965 54.46 47.89 56.02 7 XMListUnsubscribeExists 310352 57.67 65.91 55.73 8 DKIM_VALID_AU 309497 55.29 54.11 55.57 9 DCC_CHECK_NEGATIVE 284653 44.49 16.44 51.11 10 DCC_CHECK 261142 53.57 81.85 46.89 11 XM_B_Unicode3 229904 41.94 44.70 41.28 12 T_TM2_M_HEADER_IN_MSG 161956 26.90 17.65 29.08 13 HTML_FONT_LOW_CONTRAST 160085 30.04 35.53 28.75 14 DKIM_VALID_EF 150122 26.61 25.17 26.96 15 LOC_TINY_FONT_1 141252 26.95 33.68 25.36 16 FVGT_m_MULTI_ODD 134861 24.45 25.43 24.22 17 XMSubLong 121972 22.76 26.41 21.90 18 MIME_HTML_ONLY 116123 23.96 37.10 20.85 19 BAYES_00 108134 16.24 2.79 19.42 20 T_KAM_HTML_FONT_INVALID 104183 18.66 18.46 18.71 21 MultiRelay 99578 18.42 20.71 17.88 22 TR_XM_DK_Bayes 89040 13.23 1.56 15.99 23 TR_XM_DK_Bayes1 86386 12.84 1.51 15.51 24 ALL_TRUSTED 83835 12.73 2.88 15.05 25 XM_Body_Dirty_Words 81099 15.96 21.87 14.56 26 TR_XM_DK_Bayes2 76077 11.26 1.12 13.66 27 XM_Multi_Part_URI 63550 12.63 17.78 11.41 28 RCVD_IN_RP_SAFE 55940 8.40 1.42 10.04 29 XM_Evil_Numbers_Gen 54297 10.14 11.80 9.75 30 HTML_IMAGE_RATIO_02 53755 10.13 12.14 9.65 31 XM_B_Unsub 51219 9.73 11.96 9.20 32 LOTS_OF_MONEY 51063 9.82 12.55 9.17 33 RCVD_IN_RP_CERTIFIED 50194 7.45 0.85 9.01 34 TooManyTo_001 45980 8.69 10.52 8.26 35 LotsOfNums_01 45904 8.26 8.32 8.24 36 T_XMDrugObfuBody_14 45594 8.38 9.19 8.19 37 FSL_BULK_SIG 44510 10.35 20.34 7.99 38 XM_DKIMWhitelistDomains 41761 6.08 0.07 7.50 39 XM_H_Long_From01 39569 6.87 5.90 7.11 40 XM_B_Phish_Phrases 35278 6.75 8.51 6.33 41 RCVD_IN_MSPIKE_H2 34902 5.90 4.36 6.27 42 XM_SendGrid 34479 5.89 4.62 6.19 43 XM_DK_Undo_02 34196 11.29 33.09 6.14 44 HTML_IMAGE_RATIO_04 33989 6.09 6.03 6.10 45 MIME_QP_LONG_LINE 33654 5.95 5.56 6.04 46 BAYES_40 32350 5.70 5.22 5.81 47 RELAYCOUNTRY_META 31822 8.66 21.15 5.71 48 RCVD_IN_IADB_LISTED 29513 4.70 2.14 5.30 49 RCVD_IN_MSPIKE_WL 27037 4.18 1.30 4.85 50 BAYES_60 26524 5.03 6.18 4.76 51 RCVD_IN_IADB_SPF 25743 4.13 2.04 4.62 52 XM_PDF 25443 3.83 0.73 4.57 53 XMSexyCombo_05 24769 5.75 11.28 4.45 54 BOTNET_IPINHOSTNAME 24619 6.62 15.94 4.42 55 BAYES_20 24399 4.27 3.79 4.38 56 RCVD_IN_IADB_SENDERID 22859 3.70 2.00 4.10 57 T_TooManySym_01 22468 3.92 3.45 4.03 58 RCVD_IN_IADB_DK 22401 3.64 2.00 4.02 59 XMNumbers 22208 4.57 7.05 3.99 60 MPART_ALT_DIFF 21979 4.74 8.12 3.95 61 T_REMOTE_IMAGE 21273 4.64 8.09 3.82 62 XMStrtUSub 20936 3.91 4.53 3.76 63 XMSubMetaSx_00 20844 4.72 8.85 3.74 64 RCVD_IN_MSPIKE_H3 20617 3.17 0.93 3.70 65 HTML_IMAGE_RATIO_06 20606 3.77 4.04 3.70 66 DKIM_INVALID 20439 4.01 5.44 3.67 67 XM_UncommonTLD01 19781 5.73 14.95 3.55 68 TR_XM_DK_SendGrid 19709 3.40 2.82 3.54 69 IN_ZIMBRA_NJ_WHITELIST 19235 2.80 0.02 3.45 70 XM_SPF_SoftFail 18583 3.84 5.96 3.34 71 RCVD_IN_IADB_VOUCHED 18573 2.82 0.64 3.34 72 FROM_EXCESS_BASE64 17764 3.28 3.64 3.19 73 XM_DIRTYINTL 16525 3.62 6.41 2.97 74 BAYES_05 16305 2.69 1.66 2.93 75 MIME_HTML_MOSTLY 15168 3.18 5.14 2.72 76 BAYES_99 14980 6.47 22.45 2.69 77 HTML_MIME_NO_HTML_TAG 14539 4.02 9.99 2.61 78 SUBJ_ALL_CAPS 13659 2.45 2.42 2.45 79 MAILING_LIST_MULTI 13457 2.21 1.36 2.42 80 XM_B_SpammyTLD 13448 3.60 8.61 2.41 81 HTML_IMAGE_RATIO_08 13170 2.39 2.50 2.36 82 BAYES_80 12901 3.10 6.39 2.32 83 XM_CamelCaseFrm001 12169 2.30 2.80 2.19 84 BOTNET 12093 6.07 22.55 2.17 85 UNPARSEABLE_RELAY 12001 2.03 1.48 2.15 86 MIME_HTML_ONLY_MULTI 11745 2.48 4.07 2.11 87 RCVD_IN_IADB_OPTIN 11586 1.78 0.51 2.08 88 TooManyTo_002 11517 1.80 0.66 2.07 89 KHOP_HELO_FCRDNS 11414 2.48 4.28 2.05 90 BAYES_999 11347 4.97 17.37 2.04 91 UNTRUSTED_Relay 11227 3.82 11.44 2.02 92 TVD_RCVD_IP 11183 1.72 0.48 2.01 93 URI_HEX 10811 2.26 3.63 1.94 94 T_TooManySym_02 10745 1.72 0.85 1.93 95 TM2_M_URI_OPT_OUT 9877 2.15 3.76 1.77 96 URI_TRY_3LD 9293 1.58 1.23 1.67 97 RELAYCOUNTRY_CA 9055 2.02 3.69 1.63 98 DKIM_ADSP_CUSTOM_MED 9009 1.61 1.56 1.62 99 XMBdyGiftCard01 8979 1.53 1.19 1.61 100 XM_B_Unsub2 8627 1.71 2.41 1.55 101 XMDiploma_00 8495 1.92 3.58 1.53 102 XM_OfRef6 8458 1.64 2.16 1.52 103 T_XMDrugObfuBody_08 8345 1.65 2.27 1.50 104 XM_DK_Undo_01 8204 1.50 1.64 1.47 105 TM2_M_VERY_LONG_WORD 8090 1.72 2.83 1.45 106 IN_HORDE_ADDRESS_BOOK 8082 1.18 0.02 1.45 107 ANY_BOUNCE_MESSAGE 8078 1.29 0.59 1.45 108 BOUNCE_MESSAGE 8076 1.29 0.59 1.45 109 TR_Symld_Words 7973 1.43 1.45 1.43 110 HELO_NODOT 7914 1.37 1.13 1.42 111 HELO_NO_DOMAIN 7913 1.36 1.13 1.42 112 XMStockSpam_06 7856 1.53 2.03 1.41 113 XM_H_Long_From02 7816 1.30 0.89 1.40 114 TooManyTo_003 7771 1.22 0.48 1.40 115 BAYES_95 7752 1.77 3.36 1.39 116 CK_HELO_DYNAMIC_SPLIT_IP 7750 1.21 0.46 1.39 117 HELO_DYNAMIC_IPADDR2 7710 1.14 0.10 1.38 118 RCVD_IN_BL_SPAMCOP_NET 7691 1.80 3.58 1.38 119 INVALID_MSGID 7689 1.16 0.21 1.38 120 NML_ADSP_CUSTOM_MED 7458 1.35 1.37 1.34 121 USER_IN_DEF_DKIM_WL 7337 1.07 0.03 1.32 122 XMGappySubj_01 7190 1.15 0.54 1.29 123 TR_DCC_Bayes_99 7000 4.42 17.80 1.26 124 US_DOLLARS_3 6894 1.55 2.89 1.24 125 XMCapTrack 6889 1.06 0.30 1.24 126 TO_MALFORMED 6821 0.99 0.02 1.22 127 RELAYCOUNTRY_GB 6349 1.68 3.97 1.14 128 XMPhish11 6337 1.20 1.45 1.14 129 XM_GoogleGroups 6209 1.00 0.51 1.11 130 XMHTML_After_End 6148 1.12 1.20 1.10 131 XM_UB50 6064 2.07 6.22 1.09 132 SpammyFromTLD_01 5828 1.29 2.31 1.05 133 TooManyTo_004 5741 0.91 0.39 1.03 134 T_Symld_Words_02 5577 1.16 1.84 1.00 135 URIBL_CSS_A 5466 0.92 0.65 0.98 136 URIBL_CSS 5466 0.92 0.65 0.98 137 TR_XM_RelayPhish 5438 1.26 2.44 0.98 138 T_XMHurry_00 5364 1.04 1.35 0.96 139 XMGenDplmaNmb 5347 1.26 2.53 0.96 140 NO_DNS_FOR_FROM 5336 1.47 3.66 0.96 141 TR_MetaPhish_Combo_01 5248 0.91 0.78 0.94 142 URIBL_DBL_ABUSE_REDIR 5177 1.03 1.44 0.93 143 XM_ProductURIs 5101 0.96 1.15 0.92 144 T_XMDrugObfuBody_00 4990 1.07 1.80 0.90 145 TooManyTo_005 4657 0.74 0.35 0.84 146 T_FILL_THIS_FORM_SHORT 4610 0.90 1.21 0.83 147 HTML_FONT_FACE_BAD 4505 0.90 1.30 0.81 148 XMNoVowels 4428 0.74 0.51 0.80 149 XMSubNoVowel 4377 0.75 0.58 0.79 150 RCVD_IN_MSPIKE_H5 4317 0.65 0.11 0.78 151 XMSubMetaI_00 4316 0.93 1.60 0.77 152 HTML_TAG_BALANCE_BODY 4255 0.83 1.09 0.76 153 XMBody_17 4157 0.98 1.99 0.75 154 FORGED_GMAIL_RCVD 3915 0.80 1.23 0.70 155 PLING_QUERY 3787 0.67 0.63 0.68 156 XM_B_REG_HTML 3743 0.58 0.20 0.67 157 XM_SPF_Unknown 3730 0.64 0.51 0.67 158 XMSubEmpty 3675 0.58 0.24 0.66 159 XMHTMLBadTable_001 3494 0.66 0.79 0.63 160 XM_ShortIntro_01 3431 0.56 0.35 0.62 161 T_MONEY_PERCENT 3424 0.71 1.11 0.61 162 TR_LOTS_OF_MONEY2 3424 0.71 1.11 0.61 163 FILL_THIS_FORM 3332 0.56 0.40 0.60 164 T_OBFU_PDF_ATTACH 3329 0.52 0.21 0.60 165 XMBrknScrpt_02 3311 0.74 1.34 0.59 166 XMBody_95 3306 0.50 0.10 0.59 167 SpammyFromTLD_02 3257 2.51 10.64 0.58 168 HTTPS_HTTP_MISMATCH 3246 0.61 0.75 0.58 169 TR_XM_PHPDW 3133 0.86 2.12 0.56 170 XM_H_PHPMailer 3088 0.67 1.16 0.55 171 XMSubMetaSxObfu_03 3073 0.66 1.14 0.55 172 XMPhish30 3039 0.66 1.12 0.55 173 T_TooManySym_03 3027 0.50 0.33 0.54 174 TR_XM_PHPForged 3007 0.84 2.10 0.54 175 TR_XM_FormFill2 3006 0.84 2.10 0.54 176 DKIM_ADSP_NXDOMAIN 2974 0.91 2.51 0.53 177 XM_H_PHPOS 2971 0.83 2.08 0.53 178 FROM_GOV_DKIM_AU 2957 0.45 0.13 0.53 179 FILL_THIS_FORM_LONG 2942 0.50 0.36 0.53 180 RELAYCOUNTRY_DE 2905 0.71 1.51 0.52 181 RELAYCOUNTRY_FR 2896 0.96 2.81 0.52 182 T_FILL_THIS_FORM_LOAN 2813 0.43 0.09 0.51 183 XMSexyCombo_01 2794 0.94 2.81 0.50 184 TR_LOTS_OF_MONEY3 2774 0.57 0.90 0.50 185 XMGappySubj_02 2733 0.44 0.24 0.49 186 NUMERIC_HTTP_ADDR 2691 0.47 0.42 0.48 187 URI_NOVOWEL 2688 0.51 0.63 0.48 188 RELAYCOUNTRY_AU 2687 0.50 0.56 0.48 189 XMMoneyMeta_00 2574 0.83 2.36 0.46 190 REMOVE_BEFORE_LINK 2531 0.49 0.63 0.45 191 TM2_M_A_HREF_HREF 2507 0.57 1.06 0.45 192 DIET_1 2498 0.57 1.09 0.45 193 USER_IN_WHITELIST 2495 0.36 0.00 0.45 194 XMOemUri 2457 0.39 0.18 0.44 195 AC_DIV_BONANZA 2440 0.38 0.15 0.44 196 FROM_GOV_SPOOF 2390 0.40 0.29 0.43 197 MISSING_HEADERS 2332 0.46 0.61 0.42 198 TM2_M_BODY_EMPTY 2277 0.35 0.10 0.41 199 TVD_SPACE_RATIO 2171 0.35 0.19 0.39 200 XMBody_78 2160 0.45 0.72 0.39 ----------------------------------------------------------------------