Email: 695682 Autolearn: 0 AvgScore: 1.83 AvgScanTime: 2.41 sec Spam: 137765 Autolearn: 0 AvgScore: 12.83 AvgScanTime: 3.10 sec Ham: 557917 Autolearn: 0 AvgScore: -0.89 AvgScanTime: 2.24 sec Time Spent Running SA: 465.75 hours Time Spent Processing Spam: 118.60 hours Time Spent Processing Ham: 347.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130361 90.71 94.63 89.74 2 DCC_CHECK 112943 52.87 81.98 45.69 3 DKIM_SIGNED 103226 77.49 74.93 78.12 4 XM_DK_Pass 100167 76.15 72.71 77.00 5 XM_B_Unicode 96301 71.21 69.90 71.53 6 DKIM_VALID 94251 72.57 68.41 73.60 7 XMListUnsubscribeExists 87189 57.03 63.29 55.49 8 DKIM_VALID_AU 73148 55.53 53.10 56.13 9 XM_B_Unicode3 65256 43.33 47.37 42.34 10 BAYES_50 62351 53.67 45.26 55.75 11 MIME_HTML_ONLY 57808 24.50 41.96 20.19 12 XM_DK_Undo_02 49843 12.92 36.18 7.17 13 LOC_TINY_FONT_1 49457 27.87 35.90 25.89 14 HTML_FONT_LOW_CONTRAST 47789 30.28 34.69 29.19 15 XMSubLong 36426 22.73 26.44 21.82 16 BAYES_99 34148 7.58 24.79 3.34 17 RELAYCOUNTRY_META 32859 9.26 23.85 5.65 18 FVGT_m_MULTI_ODD 32182 22.60 23.36 22.41 19 XM_Body_Dirty_Words 31588 15.75 22.93 13.97 20 DKIM_VALID_EF 31447 25.87 22.83 26.62 21 BOTNET 30725 6.47 22.30 2.57 22 FSL_BULK_SIG 28211 9.41 20.48 6.68 23 TR_DCC_Bayes_99 27969 5.29 20.30 1.58 24 T_KAM_HTML_FONT_INVALID 26401 18.53 19.16 18.38 25 BAYES_999 25780 5.87 18.71 2.70 26 MultiRelay 25238 18.45 18.32 18.49 27 BOTNET_IPINHOSTNAME 25007 7.53 18.15 4.91 28 XM_B_Unsub 23744 12.61 17.24 11.47 29 XM_Multi_Part_URI 23194 13.19 16.84 12.30 30 XM_UncommonTLD01 22117 5.85 16.05 3.32 31 HTML_IMAGE_RATIO_02 22062 10.44 16.01 9.06 32 DCC_CHECK_NEGATIVE 21971 45.13 15.95 52.34 33 UNTRUSTED_Relay 21817 4.48 15.84 1.67 34 T_TM2_M_HEADER_IN_MSG 21421 25.95 15.55 28.52 35 LOTS_OF_MONEY 19872 10.47 14.42 9.49 36 XMSexyCombo_05 19651 6.05 14.26 4.02 37 XM_Evil_Numbers_Gen 18834 10.87 13.67 10.18 38 MPART_ALT_DIFF 15019 5.41 10.90 4.05 39 XM_H_Long_From01 14201 7.38 10.31 6.66 40 T_REMOTE_IMAGE 12706 4.86 9.22 3.79 41 XM_UB50 12195 2.55 8.85 1.00 42 T_XMDrugObfuBody_14 12096 8.31 8.78 8.19 43 TooManyTo_001 11727 8.11 8.51 8.01 44 RCVD_IN_BL_SPAMCOP_NET 11132 2.69 8.08 1.36 45 XM_DIRTYINTL 10505 3.91 7.63 3.00 46 XMSubMetaSx_00 10452 4.44 7.59 3.66 47 LotsOfNums_01 10302 8.30 7.48 8.50 48 HTML_MIME_NO_HTML_TAG 9788 3.02 7.10 2.02 49 HTML_IMAGE_RATIO_04 9678 8.16 7.03 8.44 50 BAYES_80 9520 3.25 6.91 2.34 51 XM_B_Phish_Phrases 9330 6.93 6.77 6.97 52 MIME_HTML_ONLY_MULTI 9144 3.19 6.64 2.34 53 DKIM_INVALID 8975 4.92 6.51 4.53 54 RCVD_IN_MSPIKE_H2 8547 7.64 6.20 7.99 55 BAYES_60 8465 4.84 6.14 4.52 56 XMNumbers 8454 3.72 6.14 3.13 57 KHOP_HELO_FCRDNS 8448 2.98 6.13 2.20 58 SpammyFromTLD_02 8436 1.42 6.12 0.26 59 XMStrtUSub 8030 4.64 5.83 4.35 60 URI_HEX 7877 2.67 5.72 1.92 61 MIME_QP_LONG_LINE 7381 6.17 5.36 6.37 62 HTML_SHORT_LINK_IMG_1 7202 1.05 5.23 0.02 63 HDRS_LCASE_IMGONLY 6793 1.01 4.93 0.04 64 HTML_IMAGE_RATIO_06 6785 3.92 4.93 3.68 65 TM2_M_URI_OPT_OUT 6682 2.64 4.85 2.10 66 XM_B_SpammyTLD 6549 2.72 4.75 2.22 67 MIME_HTML_MOSTLY 6485 3.01 4.71 2.59 68 FROM_SUSPICIOUS_NTLD 6401 0.95 4.65 0.04 69 FROM_SUSPICIOUS_NTLD_FP 6321 0.93 4.59 0.03 70 BAYES_95 6057 1.97 4.40 1.37 71 BAYES_40 6045 5.50 4.39 5.78 72 MIME_HEADER_CTYPE_ONLY 5531 0.91 4.01 0.14 73 RCVD_IN_PSBL 5482 0.82 3.98 0.04 74 TR_Mismatch_TLD_02 5467 0.83 3.97 0.06 75 FROM_EXCESS_BASE64 5123 3.45 3.72 3.38 76 T_TooManySym_01 5082 4.29 3.69 4.44 77 BAYES_20 5068 4.43 3.68 4.61 78 REPLYTO_WITHOUT_TO_CC 4892 0.73 3.55 0.03 79 XM_SendGrid 4853 6.03 3.52 6.64 80 MultiRelay_CC 4803 0.87 3.49 0.23 81 MultiRelay_Combo 4803 0.87 3.49 0.23 82 XM_SPF_SoftFail 4593 2.47 3.33 2.25 83 XM_BadFromFormat 4576 0.74 3.32 0.10 84 HTML_IMAGE_RATIO_08 4519 2.46 3.28 2.26 85 XM_URI_RBL 4456 0.87 3.23 0.28 86 RELAYCOUNTRY_CA 4388 1.98 3.19 1.68 87 T_HTML_TAG_BALANCE_CENTER 4306 0.71 3.13 0.12 88 HTML_IMAGE_ONLY_08 4245 0.70 3.08 0.11 89 RCVD_IN_RP_RNBL 4241 0.65 3.08 0.06 90 XMDiploma_00 4189 2.34 3.04 2.17 91 T_MONEY_PERCENT 4124 1.11 2.99 0.65 92 TR_LOTS_OF_MONEY2 4124 1.11 2.99 0.65 93 TO_EQ_FM_DOM_HTML_IMG 3998 0.58 2.90 0.01 94 HTML_IMAGE_ONLY_16 3989 0.80 2.90 0.28 95 SUBJ_ALL_CAPS 3977 1.80 2.89 1.53 96 XMStockSpam_06 3972 1.59 2.88 1.27 97 XM_CamelCaseFrm001 3969 2.53 2.88 2.45 98 TR_Symld_Words 3866 1.60 2.81 1.30 99 XM_B_Unsub2 3837 3.52 2.79 3.70 100 RELAYCOUNTRY_GB 3834 1.41 2.78 1.07 101 XM_DrugUnitList 3748 0.54 2.72 0.00 102 ALIBABA_IMG_NOT_RCVD_ALI 3746 0.54 2.72 0.00 103 RDNS_DYNAMIC 3730 0.79 2.71 0.32 104 XMSexyCombo_01 3674 1.03 2.67 0.62 105 RELAYCOUNTRY_FR 3652 0.81 2.65 0.36 106 RCVD_IN_MSPIKE_BL 3615 1.53 2.62 1.26 107 RELAYCOUNTRY_PL 3467 0.52 2.52 0.03 108 FROM_MISSP_REPLYTO 3459 0.50 2.51 0.00 109 HTML_IMAGE_ONLY_12 3393 0.63 2.46 0.17 110 NO_DNS_FOR_FROM 3339 1.49 2.42 1.25 111 BAYES_00 3215 15.78 2.33 19.10 112 T_XMDrugObfuBody_08 3203 1.80 2.32 1.67 113 DKIM_ADSP_NXDOMAIN 3198 1.13 2.32 0.83 114 SpammyFromTLD_01 3184 1.16 2.31 0.87 115 HOSTED_IMG_DIRECT_MX 3175 0.46 2.30 0.00 116 DATE_IN_PAST_03_06 3140 0.55 2.28 0.13 117 XM_ProductURIs 2992 1.37 2.17 1.17 118 RCVD_IN_IADB_LISTED 2907 4.48 2.11 5.07 119 XMSubMetaI_00 2859 1.09 2.08 0.84 120 T_TooManySym_02 2781 2.11 2.02 2.14 121 XMGenDplmaNmb 2777 1.65 2.02 1.56 122 T_XMHurry_00 2767 1.13 2.01 0.92 123 XMBdyGiftCard01 2745 1.62 1.99 1.53 124 RCVD_IN_IADB_SPF 2744 3.95 1.99 4.43 125 RCVD_IN_MSPIKE_L5 2720 0.62 1.97 0.29 126 XM_DK_Undo_01 2698 1.62 1.96 1.53 127 RCVD_IN_IADB_DK 2686 3.46 1.95 3.83 128 RCVD_IN_IADB_SENDERID 2672 3.48 1.94 3.86 129 URI_TRY_3LD 2594 1.66 1.88 1.60 130 BAYES_05 2569 2.72 1.86 2.93 131 XM_UB60 2513 0.41 1.82 0.06 132 TR_XM_PHPDW 2500 0.89 1.81 0.67 133 TR_XM_PHPForged 2477 0.88 1.80 0.65 134 TO_NO_BRKTS_FROM_MSSP 2470 0.37 1.79 0.02 135 XM_OfRef6 2448 1.49 1.78 1.42 136 BOTNET_NORDNS 2447 0.41 1.78 0.07 137 TM2_M_VERY_LONG_WORD 2440 1.51 1.77 1.45 138 RELAYCOUNTRY_DE 2438 0.69 1.77 0.42 139 TR_XM_FormFill2 2438 0.87 1.77 0.65 140 XM_H_PHPOS 2433 0.87 1.77 0.64 141 FROM_MISSP_DYNIP 2377 0.34 1.73 0.00 142 XMBody_17 2372 0.85 1.72 0.64 143 TR_XM_DK_SendGrid 2309 3.34 1.68 3.75 144 LongTLD 2290 0.46 1.66 0.17 145 RCVD_IN_RP_SAFE 2234 9.00 1.62 10.82 146 XMLngstWrd_00 2230 0.79 1.62 0.58 147 BODY_URI_ONLY 2222 0.36 1.61 0.05 148 T_FILL_THIS_FORM_SHORT 2215 0.91 1.61 0.74 149 XMLngstWrd_01 2208 0.73 1.60 0.52 150 TR_XM_INV_DKIM 2199 0.38 1.60 0.08 151 XM_RXBody 2150 0.85 1.56 0.68 152 XMLngstWrd_02 2077 0.55 1.51 0.31 153 DATE_IN_PAST_24_48 2034 0.30 1.48 0.01 154 FSL_THIS_IS_ADV 1968 0.38 1.43 0.12 155 XMSexyCombo_04 1963 0.45 1.42 0.21 156 ALL_TRUSTED 1960 10.88 1.42 13.21 157 TR_XM_RelayPhish 1913 1.17 1.39 1.12 158 UNPARSEABLE_RELAY 1902 2.04 1.38 2.21 159 XMSubMetaSSx_00 1868 0.42 1.36 0.19 160 RCVD_IN_MSPIKE_WL 1866 3.62 1.35 4.18 161 PLING_QUERY 1860 0.74 1.35 0.59 162 XMLngstWrd_03 1858 0.44 1.35 0.22 163 RELAYCOUNTRY_JP 1827 0.30 1.33 0.05 164 RELAYCOUNTRY_IE 1823 0.42 1.32 0.20 165 TR_XM_DK_Bayes 1809 12.54 1.31 15.31 166 RCVD_IN_RP_CERTIFIED 1797 8.11 1.30 9.80 167 XM_DKIMWhitelistDomains 1788 6.77 1.30 8.12 168 FILL_THIS_FORM 1785 0.68 1.30 0.53 169 HTML_TITLE_SUBJ_DIFF 1755 0.31 1.27 0.07 170 XMPhish11 1752 1.14 1.27 1.11 171 FILL_THIS_FORM_LONG 1714 0.60 1.24 0.44 172 XMMoneyMeta_00 1714 0.61 1.24 0.45 173 XMHTML_After_End 1688 1.31 1.23 1.34 174 XM_UB99 1678 0.25 1.22 0.01 175 XMBrknScrpt_02 1640 0.77 1.19 0.67 176 XMSubMetaSxObfu_03 1629 0.57 1.18 0.42 177 RCVD_IN_MSPIKE_H3 1623 3.23 1.18 3.74 178 XMBody_78 1611 0.68 1.17 0.55 179 TR_XM_DK_Bayes1 1608 11.98 1.17 14.65 180 TooManyTo_002 1542 1.74 1.12 1.90 181 XMLngstWrd_04 1540 0.35 1.12 0.16 182 XMSubject_48 1523 0.24 1.11 0.02 183 MAILING_LIST_MULTI 1501 2.34 1.09 2.65 184 RELAYCOUNTRY_AT 1498 0.38 1.09 0.20 185 HTML_TAG_BALANCE_HEAD 1468 0.30 1.07 0.11 186 XM_XX_Yahoo 1464 0.32 1.06 0.14 187 RELAYCOUNTRY_NL 1462 0.48 1.06 0.34 188 XMPhish30 1456 0.69 1.06 0.59 189 XM_UB80 1411 0.21 1.02 0.01 190 ADVANCE_FEE_5_NEW_FRM_MNY 1390 0.20 1.01 0.00 191 DATE_IN_PAST_06_12 1379 0.24 1.00 0.05 192 XM_H_PHPMailer 1373 0.60 1.00 0.51 193 T_Symld_Words_02 1361 0.72 0.99 0.65 194 MONEY_ATM_CARD 1333 0.19 0.97 0.00 195 MONEY_FORM_SHORT 1324 0.20 0.96 0.01 196 T_XMDrugObfuBody_00 1298 0.73 0.94 0.68 197 RELAYCOUNTRY_KR 1291 0.20 0.94 0.02 198 MONEY_FRAUD_5 1284 0.19 0.93 0.00 199 TooManyTo_003 1275 1.17 0.93 1.23 200 XMClaimOffer 1267 0.31 0.92 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 500701 90.71 94.63 89.74 2 DKIM_SIGNED 435871 77.49 74.93 78.12 3 XM_DK_Pass 429584 76.15 72.71 77.00 4 DKIM_VALID 410614 72.57 68.41 73.60 5 XM_B_Unicode 399100 71.21 69.90 71.53 6 DKIM_VALID_AU 313140 55.53 53.10 56.13 7 BAYES_50 311041 53.67 45.26 55.75 8 XMListUnsubscribeExists 309590 57.03 63.29 55.49 9 DCC_CHECK_NEGATIVE 292007 45.13 15.95 52.34 10 DCC_CHECK 254885 52.87 81.98 45.69 11 XM_B_Unicode3 236196 43.33 47.37 42.34 12 HTML_FONT_LOW_CONTRAST 162871 30.28 34.69 29.19 13 T_TM2_M_HEADER_IN_MSG 159101 25.95 15.55 28.52 14 DKIM_VALID_EF 148505 25.87 22.83 26.62 15 LOC_TINY_FONT_1 144460 27.87 35.90 25.89 16 FVGT_m_MULTI_ODD 125014 22.60 23.36 22.41 17 XMSubLong 121722 22.73 26.44 21.82 18 MIME_HTML_ONLY 112662 24.50 41.96 20.19 19 BAYES_00 106558 15.78 2.33 19.10 20 MultiRelay 103133 18.45 18.32 18.49 21 T_KAM_HTML_FONT_INVALID 102533 18.53 19.16 18.38 22 TR_XM_DK_Bayes 85403 12.54 1.31 15.31 23 TR_XM_DK_Bayes1 81712 11.98 1.17 14.65 24 XM_Body_Dirty_Words 77954 15.75 22.93 13.97 25 ALL_TRUSTED 73710 10.88 1.42 13.21 26 TR_XM_DK_Bayes2 71095 10.32 0.53 12.74 27 XM_Multi_Part_URI 68597 13.19 16.84 12.30 28 XM_B_Unsub 63994 12.61 17.24 11.47 29 RCVD_IN_RP_SAFE 60385 9.00 1.62 10.82 30 XM_Evil_Numbers_Gen 56784 10.87 13.67 10.18 31 RCVD_IN_RP_CERTIFIED 54652 8.11 1.30 9.80 32 LOTS_OF_MONEY 52943 10.47 14.42 9.49 33 HTML_IMAGE_RATIO_02 50566 10.44 16.01 9.06 34 LotsOfNums_01 47443 8.30 7.48 8.50 35 HTML_IMAGE_RATIO_04 47102 8.16 7.03 8.44 36 T_XMDrugObfuBody_14 45711 8.31 8.78 8.19 37 XM_DKIMWhitelistDomains 45275 6.77 1.30 8.12 38 TooManyTo_001 44662 8.11 8.51 8.01 39 RCVD_IN_MSPIKE_H2 44580 7.64 6.20 7.99 40 XM_DK_Undo_02 40027 12.92 36.18 7.17 41 XM_B_Phish_Phrases 38869 6.93 6.77 6.97 42 FSL_BULK_SIG 37242 9.41 20.48 6.68 43 XM_H_Long_From01 37172 7.38 10.31 6.66 44 XM_SendGrid 37063 6.03 3.52 6.64 45 MIME_QP_LONG_LINE 35553 6.17 5.36 6.37 46 BAYES_40 32226 5.50 4.39 5.78 47 RELAYCOUNTRY_META 31538 9.26 23.85 5.65 48 RCVD_IN_IADB_LISTED 28269 4.48 2.11 5.07 49 BOTNET_IPINHOSTNAME 27399 7.53 18.15 4.91 50 BAYES_20 25725 4.43 3.68 4.61 51 DKIM_INVALID 25257 4.92 6.51 4.53 52 BAYES_60 25217 4.84 6.14 4.52 53 T_TooManySym_01 24759 4.29 3.69 4.44 54 RCVD_IN_IADB_SPF 24706 3.95 1.99 4.43 55 XMStrtUSub 24278 4.64 5.83 4.35 56 RCVD_IN_MSPIKE_WL 23329 3.62 1.35 4.18 57 MPART_ALT_DIFF 22591 5.41 10.90 4.05 58 XMSexyCombo_05 22455 6.05 14.26 4.02 59 RCVD_IN_IADB_SENDERID 21556 3.48 1.94 3.86 60 RCVD_IN_IADB_DK 21377 3.46 1.95 3.83 61 T_REMOTE_IMAGE 21136 4.86 9.22 3.79 62 TR_XM_DK_SendGrid 20904 3.34 1.68 3.75 63 RCVD_IN_MSPIKE_H3 20859 3.23 1.18 3.74 64 XM_B_Unsub2 20621 3.52 2.79 3.70 65 HTML_IMAGE_RATIO_06 20509 3.92 4.93 3.68 66 XMSubMetaSx_00 20416 4.44 7.59 3.66 67 XM_PDF 20224 3.05 0.71 3.62 68 IN_ZIMBRA_NJ_WHITELIST 19922 2.87 0.02 3.57 69 FROM_EXCESS_BASE64 18847 3.45 3.72 3.38 70 BAYES_99 18618 7.58 24.79 3.34 71 XM_UncommonTLD01 18549 5.85 16.05 3.32 72 RCVD_IN_IADB_VOUCHED 17771 2.67 0.58 3.19 73 XMNumbers 17436 3.72 6.14 3.13 74 XM_DIRTYINTL 16723 3.91 7.63 3.00 75 BAYES_05 16355 2.72 1.86 2.93 76 BAYES_999 15057 5.87 18.71 2.70 77 MAILING_LIST_MULTI 14782 2.34 1.09 2.65 78 MIME_HTML_MOSTLY 14424 3.01 4.71 2.59 79 BOTNET 14318 6.47 22.30 2.57 80 XM_CamelCaseFrm001 13656 2.53 2.88 2.45 81 BAYES_80 13059 3.25 6.91 2.34 82 MIME_HTML_ONLY_MULTI 13053 3.19 6.64 2.34 83 HTML_IMAGE_RATIO_08 12613 2.46 3.28 2.26 84 XM_SPF_SoftFail 12580 2.47 3.33 2.25 85 XM_B_SpammyTLD 12388 2.72 4.75 2.22 86 UNPARSEABLE_RELAY 12310 2.04 1.38 2.21 87 KHOP_HELO_FCRDNS 12272 2.98 6.13 2.20 88 XMDiploma_00 12100 2.34 3.04 2.17 89 TVD_RCVD_IP 12000 1.81 0.42 2.15 90 T_TooManySym_02 11923 2.11 2.02 2.14 91 TM2_M_URI_OPT_OUT 11706 2.64 4.85 2.10 92 HTML_MIME_NO_HTML_TAG 11247 3.02 7.10 2.02 93 RCVD_IN_IADB_OPTIN 11031 1.67 0.42 1.98 94 URI_HEX 10693 2.67 5.72 1.92 95 TooManyTo_002 10578 1.74 1.12 1.90 96 ANY_BOUNCE_MESSAGE 10414 1.58 0.42 1.87 97 BOUNCE_MESSAGE 10413 1.58 0.42 1.87 98 RELAYCOUNTRY_CA 9384 1.98 3.19 1.68 99 UNTRUSTED_Relay 9324 4.48 15.84 1.67 100 T_XMDrugObfuBody_08 9308 1.80 2.32 1.67 101 URI_TRY_3LD 8923 1.66 1.88 1.60 102 TR_DCC_Bayes_99 8822 5.29 20.30 1.58 103 XMGenDplmaNmb 8694 1.65 2.02 1.56 104 XM_DK_Undo_01 8559 1.62 1.96 1.53 105 SUBJ_ALL_CAPS 8550 1.80 2.89 1.53 106 XMBdyGiftCard01 8538 1.62 1.99 1.53 107 IN_HORDE_ADDRESS_BOOK 8369 1.21 0.03 1.50 108 TM2_M_VERY_LONG_WORD 8099 1.51 1.77 1.45 109 INVALID_MSGID 7928 1.19 0.27 1.42 110 XM_OfRef6 7904 1.49 1.78 1.42 111 CK_HELO_DYNAMIC_SPLIT_IP 7823 1.18 0.28 1.40 112 HELO_DYNAMIC_IPADDR2 7818 1.14 0.07 1.40 113 BAYES_95 7627 1.97 4.40 1.37 114 RCVD_IN_BL_SPAMCOP_NET 7561 2.69 8.08 1.36 115 HELO_NODOT 7538 1.21 0.64 1.35 116 HELO_NO_DOMAIN 7537 1.21 0.64 1.35 117 XMHTML_After_End 7455 1.31 1.23 1.34 118 TR_Symld_Words 7263 1.60 2.81 1.30 119 XMStockSpam_06 7079 1.59 2.88 1.27 120 RCVD_IN_MSPIKE_BL 7046 1.53 2.62 1.26 121 NO_DNS_FOR_FROM 6998 1.49 2.42 1.25 122 TooManyTo_003 6862 1.17 0.93 1.23 123 XMCapTrack 6632 1.00 0.25 1.19 124 USER_IN_DEF_DKIM_WL 6621 0.95 0.01 1.19 125 TO_MALFORMED 6599 0.97 0.09 1.18 126 XM_ProductURIs 6530 1.37 2.17 1.17 127 XM_GoogleGroups 6358 1.01 0.51 1.14 128 TR_XM_RelayPhish 6253 1.17 1.39 1.12 129 XMPhish11 6168 1.14 1.27 1.11 130 XM_H_Long_From02 5999 1.04 0.89 1.08 131 RELAYCOUNTRY_GB 5947 1.41 2.78 1.07 132 XMGappySubj_01 5735 0.89 0.31 1.03 133 XM_UB50 5560 2.55 8.85 1.00 134 DKIM_ADSP_CUSTOM_MED 5295 0.94 0.91 0.95 135 FROM_GOV_DKIM_AU 5230 0.78 0.13 0.94 136 TR_MetaPhish_Combo_01 5124 0.86 0.62 0.92 137 T_XMHurry_00 5124 1.13 2.01 0.92 138 TooManyTo_004 4993 0.87 0.76 0.89 139 XM_SPF_Unknown 4965 0.81 0.50 0.89 140 SpammyFromTLD_01 4859 1.16 2.31 0.87 141 XMSubMetaI_00 4699 1.09 2.08 0.84 142 DKIM_ADSP_NXDOMAIN 4652 1.13 2.32 0.83 143 XMNoVowels 4413 0.74 0.53 0.79 144 HTML_FONT_FACE_BAD 4259 0.77 0.82 0.76 145 TooManyTo_005 4187 0.73 0.64 0.75 146 T_FILL_THIS_FORM_SHORT 4104 0.91 1.61 0.74 147 NML_ADSP_CUSTOM_MED 3921 0.69 0.66 0.70 148 T_XMDrugObfuBody_00 3814 0.73 0.94 0.68 149 XMBody_95 3804 0.58 0.16 0.68 150 XM_RXBody 3786 0.85 1.56 0.68 151 XMBrknScrpt_02 3724 0.77 1.19 0.67 152 TR_XM_PHPDW 3719 0.89 1.81 0.67 153 TR_XM_PHPForged 3639 0.88 1.80 0.65 154 T_Symld_Words_02 3623 0.72 0.99 0.65 155 TR_XM_FormFill2 3619 0.87 1.77 0.65 156 TR_LOTS_OF_MONEY2 3610 1.11 2.99 0.65 157 T_MONEY_PERCENT 3610 1.11 2.99 0.65 158 XM_H_PHPOS 3598 0.87 1.77 0.64 159 XMBody_17 3550 0.85 1.72 0.64 160 XMSexyCombo_01 3468 1.03 2.67 0.62 161 THIS_AD 3360 0.66 0.88 0.60 162 T_TooManySym_03 3343 0.52 0.19 0.60 163 XMPhish30 3317 0.69 1.06 0.59 164 PLING_QUERY 3292 0.74 1.35 0.59 165 XMLngstWrd_00 3247 0.79 1.62 0.58 166 HTTPS_HTTP_MISMATCH 3109 0.57 0.63 0.56 167 XM_B_REG_HTML 3105 0.48 0.19 0.56 168 XMBody_78 3092 0.68 1.17 0.55 169 TM2_M_A_HREF_HREF 3060 0.56 0.59 0.55 170 URI_NOVOWEL 3005 0.56 0.66 0.54 171 XM_shorewaves_Whitelist 2970 0.43 0.00 0.53 172 FILL_THIS_FORM 2965 0.68 1.30 0.53 173 XM_ShortIntro_01 2924 0.47 0.26 0.52 174 HTML_TAG_BALANCE_BODY 2921 0.55 0.68 0.52 175 XMLngstWrd_01 2903 0.73 1.60 0.52 176 FORGED_GMAIL_RCVD 2828 0.57 0.84 0.51 177 XM_H_PHPMailer 2826 0.60 1.00 0.51 178 T_OBFU_PDF_ATTACH 2770 0.44 0.22 0.50 179 RCVD_IN_MSPIKE_L3 2720 0.49 0.52 0.49 180 RCVD_IN_MSPIKE_L4 2709 0.42 0.13 0.49 181 XMSubNoVowel 2665 0.49 0.52 0.48 182 RELAYCOUNTRY_AU 2646 0.46 0.38 0.47 183 XMHTMLBadTable_001 2634 0.51 0.64 0.47 184 XM_B_COPY_HTML 2626 0.49 0.59 0.47 185 USER_IN_WHITELIST 2618 0.38 0.00 0.47 186 XMMoneyMeta_00 2530 0.61 1.24 0.45 187 XM_H_Trusted_IP 2493 0.36 0.00 0.45 188 FILL_THIS_FORM_LONG 2429 0.60 1.24 0.44 189 RELAYCOUNTRY_DE 2361 0.69 1.77 0.42 190 XMBSHREFv2 2352 0.47 0.64 0.42 191 AC_DIV_BONANZA 2351 0.36 0.09 0.42 192 XMSubMetaSxObfu_03 2318 0.57 1.18 0.42 193 MISSING_HEADERS 2288 0.45 0.63 0.41 194 T_FILL_THIS_FORM_LOAN 2280 0.34 0.05 0.41 195 REMOVE_BEFORE_LINK 2259 0.39 0.32 0.40 196 TM2_M_BODY_EMPTY 2249 0.34 0.09 0.40 197 TR_LOTS_OF_MONEY3 2235 0.49 0.86 0.40 198 XMLKML 2212 0.32 0.00 0.40 199 SHORT_HELO_AND_INLINE_IMAGE 2137 0.31 0.03 0.38 200 DIET_1 2093 0.46 0.80 0.38 ----------------------------------------------------------------------