Email: 672112 Autolearn: 0 AvgScore: 1.80 AvgScanTime: 2.28 sec Spam: 133093 Autolearn: 0 AvgScore: 12.98 AvgScanTime: 2.80 sec Ham: 539019 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 2.15 sec Time Spent Running SA: 426.06 hours Time Spent Processing Spam: 103.44 hours Time Spent Processing Ham: 322.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125826 89.90 94.54 88.75 2 DCC_CHECK 107436 52.34 80.72 45.33 3 DKIM_SIGNED 94851 75.25 71.27 76.23 4 XM_DK_Pass 92431 73.95 69.45 75.06 5 XM_B_Unicode 90312 71.17 67.86 71.98 6 DKIM_VALID 87360 70.73 65.64 71.99 7 XMListUnsubscribeExists 80156 55.90 60.23 54.83 8 DKIM_VALID_AU 68344 54.29 51.35 55.01 9 XM_B_Unicode3 61900 44.19 46.51 43.61 10 BAYES_50 59090 52.37 44.40 54.34 11 MIME_HTML_ONLY 54350 25.96 40.84 22.29 12 LOC_TINY_FONT_1 46024 27.04 34.58 25.17 13 XM_DK_Undo_02 45974 12.70 34.54 7.31 14 HTML_FONT_LOW_CONTRAST 43989 30.58 33.05 29.96 15 XMSubLong 33258 22.36 24.99 21.71 16 BAYES_99 32335 7.63 24.30 3.51 17 BOTNET 31327 7.75 23.54 3.85 18 FSL_BULK_SIG 30289 9.93 22.76 6.77 19 FVGT_m_MULTI_ODD 30136 20.77 22.64 20.31 20 XM_UncommonTLD01 29790 7.56 22.38 3.90 21 XM_Body_Dirty_Words 29161 16.03 21.91 14.58 22 DKIM_VALID_EF 28559 24.77 21.46 25.58 23 TR_DCC_Bayes_99 26145 5.19 19.64 1.62 24 BAYES_999 25145 6.09 18.89 2.93 25 RELAYCOUNTRY_META 24859 7.67 18.68 4.96 26 BOTNET_IPINHOSTNAME 24438 7.61 18.36 4.96 27 MultiRelay 24415 17.35 18.34 17.10 28 DCC_CHECK_NEGATIVE 23088 45.86 17.35 52.90 29 HTML_IMAGE_RATIO_02 22800 11.17 17.13 9.70 30 XM_Multi_Part_URI 21368 13.28 16.05 12.60 31 T_KAM_HTML_FONT_INVALID 21334 17.21 16.03 17.50 32 T_TM2_M_HEADER_IN_MSG 20998 25.63 15.78 28.06 33 XM_B_Unsub 20383 11.24 15.31 10.24 34 LOTS_OF_MONEY 19193 10.01 14.42 8.92 35 T_REMOTE_IMAGE 18247 5.81 13.71 3.86 36 XMSexyCombo_05 17751 6.12 13.34 4.34 37 XM_Evil_Numbers_Gen 16999 10.65 12.77 10.13 38 UNTRUSTED_Relay 14743 4.76 11.08 3.20 39 KHOP_HELO_FCRDNS 13961 3.38 10.49 1.62 40 MPART_ALT_DIFF 12474 5.95 9.37 5.11 41 XM_H_Long_From01 12218 7.40 9.18 6.97 42 XMSubMetaSx_00 12171 4.81 9.14 3.73 43 XMNumbers 11941 4.51 8.97 3.41 44 XM_B_Phish_Phrases 11560 7.53 8.69 7.25 45 T_XMDrugObfuBody_14 11389 8.44 8.56 8.41 46 HTML_MIME_NO_HTML_TAG 11350 3.37 8.53 2.10 47 TooManyTo_001 11199 7.49 8.41 7.26 48 SpammyFromTLD_02 10995 1.93 8.26 0.37 49 HTML_IMAGE_RATIO_04 10818 7.77 8.13 7.68 50 FROM_SUSPICIOUS_NTLD 10663 1.63 8.01 0.05 51 FROM_SUSPICIOUS_NTLD_FP 10611 1.62 7.97 0.05 52 HTML_SHORT_LINK_IMG_1 9954 1.50 7.48 0.03 53 LotsOfNums_01 9564 8.16 7.19 8.39 54 XM_DIRTYINTL 9269 3.87 6.96 3.10 55 RDNS_DYNAMIC 8999 1.59 6.76 0.32 56 RCVD_IN_MSPIKE_H2 8959 9.83 6.73 10.60 57 BAYES_80 8934 3.31 6.71 2.47 58 XM_UB50 8690 3.27 6.53 2.47 59 DKIM_ADSP_NXDOMAIN 8481 2.31 6.37 1.31 60 MIME_HEADER_CTYPE_ONLY 8451 1.32 6.35 0.08 61 TR_Mismatch_TLD_02 8089 1.27 6.08 0.08 62 XM_SPF_SoftFail 8072 2.46 6.06 1.57 63 BAYES_60 7673 5.07 5.77 4.90 64 HTML_IMAGE_ONLY_08 7630 1.21 5.73 0.10 65 MIME_HTML_MOSTLY 7563 3.30 5.68 2.71 66 DKIM_INVALID 7491 4.51 5.63 4.24 67 BAYES_40 7480 5.44 5.62 5.40 68 MIME_QP_LONG_LINE 6899 5.76 5.18 5.90 69 T_HTML_TAG_BALANCE_CENTER 6599 1.10 4.96 0.15 70 BODY_URI_ONLY 6563 1.03 4.93 0.07 71 HDRS_LCASE_IMGONLY 6250 0.96 4.70 0.04 72 MIME_HTML_ONLY_MULTI 6063 3.60 4.56 3.36 73 RCVD_IN_BL_SPAMCOP_NET 6009 1.90 4.51 1.26 74 RCVD_IN_MSPIKE_WL 5915 7.90 4.44 8.76 75 URI_HEX 5860 2.45 4.40 1.96 76 XMSexyCombo_01 5851 1.57 4.40 0.88 77 XM_SendGrid 5645 6.13 4.24 6.59 78 REPLYTO_WITHOUT_TO_CC 5612 0.86 4.22 0.03 79 XMStrtUSub 5405 4.26 4.06 4.31 80 RCVD_IN_MSPIKE_H3 5363 7.50 4.03 8.35 81 BOTNET_NORDNS 5255 1.89 3.95 1.39 82 TM2_M_URI_OPT_OUT 5239 2.79 3.94 2.51 83 RELAYCOUNTRY_GB 5211 1.40 3.92 0.78 84 TO_NO_BRKTS_DYNIP 5123 0.77 3.85 0.00 85 BAYES_95 5077 1.85 3.81 1.37 86 BAYES_20 5068 4.34 3.81 4.47 87 NO_DNS_FOR_FROM 4940 2.32 3.71 1.97 88 HTML_IMAGE_RATIO_06 4850 3.86 3.64 3.92 89 MISSING_HEADERS 4752 1.03 3.57 0.40 90 XM_URI_RBL 4723 0.97 3.55 0.34 91 RCVD_IN_PSBL 4539 0.72 3.41 0.05 92 MultiRelay_CC 4468 0.86 3.36 0.24 93 MultiRelay_Combo 4468 0.86 3.36 0.24 94 FROM_EXCESS_BASE64 4366 3.77 3.28 3.90 95 SUBJ_ALL_CAPS 4147 2.02 3.12 1.75 96 BAYES_00 4066 17.05 3.06 20.51 97 RELAYCOUNTRY_CA 4011 1.95 3.01 1.69 98 XMStockSpam_06 4006 1.66 3.01 1.33 99 XM_CamelCaseFrm001 3937 2.37 2.96 2.22 100 HDRS_MISSP 3864 0.57 2.90 0.00 101 XMDiploma_00 3830 2.01 2.88 1.80 102 XM_DrugUnitList 3787 0.57 2.85 0.00 103 ALIBABA_IMG_NOT_RCVD_ALI 3787 0.57 2.85 0.00 104 XMSexyCombo_04 3741 0.69 2.81 0.17 105 TR_XM_RelayPhish 3704 1.63 2.78 1.35 106 LongTLD 3671 0.67 2.76 0.15 107 XM_B_SpammyTLD 3655 2.59 2.75 2.55 108 DATE_IN_PAST_06_12 3610 0.58 2.71 0.05 109 T_MONEY_PERCENT 3544 0.95 2.66 0.52 110 TR_LOTS_OF_MONEY2 3544 0.95 2.66 0.52 111 XMHTML_After_End 3537 1.57 2.66 1.30 112 HTML_IMAGE_ONLY_28 3527 0.81 2.65 0.36 113 TO_EQ_FM_DOM_HTML_IMG 3501 0.52 2.63 0.00 114 XM_B_Unsub2 3458 2.25 2.60 2.16 115 XM_OfRef6 3426 1.71 2.57 1.50 116 HOSTED_IMG_DIRECT_MX 3343 0.50 2.51 0.00 117 T_XMDrugObfuBody_08 3235 1.97 2.43 1.86 118 XMBody_17 3217 1.12 2.42 0.80 119 HTML_IMAGE_ONLY_12 3188 0.60 2.40 0.16 120 TM2_M_VERY_LONG_WORD 3182 1.75 2.39 1.59 121 RCVD_IN_MSPIKE_BL 3126 1.73 2.35 1.58 122 DATE_IN_PAST_24_48 3111 0.48 2.34 0.02 123 BAYES_05 3030 2.67 2.28 2.76 124 XMSubNoVowel 3030 1.36 2.28 1.14 125 XMGenDplmaNmb 3006 1.40 2.26 1.19 126 RCVD_IN_RP_RNBL 2994 0.51 2.25 0.08 127 HTML_IMAGE_RATIO_08 2931 2.35 2.20 2.39 128 TR_XM_DK_SendGrid 2825 3.40 2.12 3.71 129 XMBrknScrpt_02 2664 1.18 2.00 0.97 130 T_TooManySym_01 2640 3.84 1.98 4.30 131 LOW_PRICE 2606 0.67 1.96 0.36 132 XMBdyGiftCard01 2589 1.80 1.95 1.77 133 RCVD_IN_IADB_LISTED 2558 4.40 1.92 5.01 134 XMSubMetaI_00 2452 1.21 1.84 1.06 135 HK_RANDOM_FROM 2435 0.45 1.83 0.11 136 TR_XM_PHPDW 2406 0.86 1.81 0.62 137 AC_FROM_MANY_DOTS 2382 1.13 1.79 0.96 138 RCVD_IN_IADB_SPF 2378 3.85 1.79 4.36 139 TR_XM_PHPForged 2367 0.85 1.78 0.62 140 RCVD_IN_MSPIKE_L5 2366 0.72 1.78 0.46 141 HTML_FONT_FACE_BAD 2356 1.68 1.77 1.66 142 TR_XM_FormFill2 2354 0.84 1.77 0.61 143 XM_H_PHPOS 2352 0.83 1.77 0.60 144 RCVD_IN_IADB_SENDERID 2326 3.44 1.75 3.85 145 RCVD_IN_IADB_DK 2321 3.38 1.74 3.78 146 T_XMHurry_00 2297 1.02 1.73 0.85 147 SHORT_IMG_SUSP_NTLD 2253 0.34 1.69 0.00 148 URI_TRY_3LD 2219 1.34 1.67 1.26 149 RCVD_IN_RP_SAFE 2201 9.75 1.65 11.75 150 TR_Symld_Words 2195 1.31 1.65 1.22 151 TR_XM_INV_DKIM 2188 0.42 1.64 0.12 152 XMPhish11 2119 1.18 1.59 1.07 153 T_Symld_Words_02 2115 0.67 1.59 0.45 154 SpammyFromTLD_01 2044 0.87 1.54 0.71 155 DKIM_ADSP_CUSTOM_MED 2030 1.12 1.53 1.01 156 RELAYCOUNTRY_IN 2015 0.40 1.51 0.13 157 RELAYCOUNTRY_FR 1988 0.59 1.49 0.36 158 FORGED_GMAIL_RCVD 1909 0.72 1.43 0.54 159 HOSTED_IMG_MULTI 1894 0.28 1.42 0.00 160 UNPARSEABLE_RELAY 1870 2.11 1.41 2.28 161 NML_ADSP_CUSTOM_MED 1862 0.91 1.40 0.79 162 TM2_M_A_HREF_HREF 1859 0.75 1.40 0.59 163 ALL_TRUSTED 1830 9.39 1.37 11.36 164 XM_DKIMWhitelistDomains 1778 6.74 1.34 8.07 165 TR_Mismatch_TLD_01 1758 0.48 1.32 0.27 166 HK_SCAM 1754 0.28 1.32 0.02 167 T_MANY_PILL_PRICE 1744 0.28 1.31 0.03 168 URG_BIZ 1729 0.31 1.30 0.07 169 HTML_IMAGE_ONLY_20 1723 0.63 1.29 0.46 170 T_XMDrugObfuBody_00 1721 0.99 1.29 0.92 171 RELAYCOUNTRY_DE 1721 0.52 1.29 0.33 172 THIS_AD 1691 0.71 1.27 0.57 173 RCVD_IN_RP_CERTIFIED 1635 8.62 1.23 10.44 174 NUMERIC_HTTP_ADDR 1629 0.50 1.22 0.32 175 TR_LOTS_OF_MONEY1 1597 0.25 1.20 0.02 176 RELAYCOUNTRY_AT 1541 0.42 1.16 0.24 177 FILL_THIS_FORM 1508 0.75 1.13 0.66 178 ADVANCE_FEE_3_NEW_MONEY 1504 0.22 1.13 0.00 179 XM_DK_Undo_01 1470 1.32 1.10 1.38 180 FILL_THIS_FORM_LONG 1433 0.58 1.08 0.46 181 RELAYCOUNTRY_NG_I 1415 0.21 1.06 0.00 182 EBAY_IMG_NOT_RCVD_EBAY 1407 0.21 1.06 0.01 183 LONG_HEX_URI 1399 0.35 1.05 0.18 184 XM_ProductURIs 1393 1.07 1.05 1.07 185 XMPhish30 1362 0.77 1.02 0.70 186 MAILING_LIST_MULTI 1335 1.68 1.00 1.85 187 DATE_IN_PAST_12_24 1330 0.22 1.00 0.03 188 XM_H_PHPMailer 1323 0.59 0.99 0.49 189 TR_XM_DK_Bayes 1305 11.81 0.98 14.49 190 SUBJ_DOLLARS 1294 0.78 0.97 0.74 191 XMSubMetaSxObfu_03 1290 0.57 0.97 0.47 192 XM_H_PHPOS_M 1269 0.34 0.95 0.18 193 DIET_1 1257 0.57 0.94 0.48 194 MONEY_FORM 1256 0.20 0.94 0.01 195 XM_BadFromFormat 1218 0.26 0.92 0.10 196 RELAYCOUNTRY_FI 1210 0.20 0.91 0.03 197 NORMAL_HTTP_TO_IP 1180 0.20 0.89 0.03 198 XMPhish14 1177 0.47 0.88 0.36 199 DATE_IN_PAST_03_06 1155 0.27 0.87 0.13 200 XM_H_Long_From02 1152 1.00 0.87 1.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 478375 89.90 94.54 88.75 2 DKIM_SIGNED 410900 75.25 71.27 76.23 3 XM_DK_Pass 404574 73.95 69.45 75.06 4 DKIM_VALID 388048 70.73 65.64 71.99 5 XM_B_Unicode 388002 71.17 67.86 71.98 6 DKIM_VALID_AU 296515 54.29 51.35 55.01 7 XMListUnsubscribeExists 295551 55.90 60.23 54.83 8 BAYES_50 292925 52.37 44.40 54.34 9 DCC_CHECK_NEGATIVE 285152 45.86 17.35 52.90 10 DCC_CHECK 244320 52.34 80.72 45.33 11 XM_B_Unicode3 235076 44.19 46.51 43.61 12 HTML_FONT_LOW_CONTRAST 161510 30.58 33.05 29.96 13 T_TM2_M_HEADER_IN_MSG 151264 25.63 15.78 28.06 14 DKIM_VALID_EF 137899 24.77 21.46 25.58 15 LOC_TINY_FONT_1 135687 27.04 34.58 25.17 16 MIME_HTML_ONLY 120149 25.96 40.84 22.29 17 XMSubLong 117033 22.36 24.99 21.71 18 BAYES_00 110533 17.05 3.06 20.51 19 FVGT_m_MULTI_ODD 109455 20.77 22.64 20.31 20 T_KAM_HTML_FONT_INVALID 94306 17.21 16.03 17.50 21 MultiRelay 92181 17.35 18.34 17.10 22 XM_Body_Dirty_Words 78580 16.03 21.91 14.58 23 TR_XM_DK_Bayes 78089 11.81 0.98 14.49 24 TR_XM_DK_Bayes1 74617 11.27 0.86 13.84 25 XM_Multi_Part_URI 67915 13.28 16.05 12.60 26 TR_XM_DK_Bayes2 65062 9.82 0.69 12.07 27 RCVD_IN_RP_SAFE 63313 9.75 1.65 11.75 28 ALL_TRUSTED 61248 9.39 1.37 11.36 29 RCVD_IN_MSPIKE_H2 57133 9.83 6.73 10.60 30 RCVD_IN_RP_CERTIFIED 56286 8.62 1.23 10.44 31 XM_B_Unsub 55188 11.24 15.31 10.24 32 XM_Evil_Numbers_Gen 54589 10.65 12.77 10.13 33 HTML_IMAGE_RATIO_02 52295 11.17 17.13 9.70 34 LOTS_OF_MONEY 48105 10.01 14.42 8.92 35 RCVD_IN_MSPIKE_WL 47192 7.90 4.44 8.76 36 T_XMDrugObfuBody_14 45319 8.44 8.56 8.41 37 LotsOfNums_01 45248 8.16 7.19 8.39 38 RCVD_IN_MSPIKE_H3 45032 7.50 4.03 8.35 39 XM_DKIMWhitelistDomains 43521 6.74 1.34 8.07 40 HTML_IMAGE_RATIO_04 41409 7.77 8.13 7.68 41 XM_DK_Undo_02 39395 12.70 34.54 7.31 42 TooManyTo_001 39113 7.49 8.41 7.26 43 XM_B_Phish_Phrases 39053 7.53 8.69 7.25 44 XM_H_Long_From01 37550 7.40 9.18 6.97 45 FSL_BULK_SIG 36473 9.93 22.76 6.77 46 XM_SendGrid 35536 6.13 4.24 6.59 47 MIME_QP_LONG_LINE 31812 5.76 5.18 5.90 48 BAYES_40 29097 5.44 5.62 5.40 49 MPART_ALT_DIFF 27549 5.95 9.37 5.11 50 RCVD_IN_IADB_LISTED 27024 4.40 1.92 5.01 51 RELAYCOUNTRY_META 26710 7.67 18.68 4.96 52 BOTNET_IPINHOSTNAME 26709 7.61 18.36 4.96 53 BAYES_60 26418 5.07 5.77 4.90 54 BAYES_20 24095 4.34 3.81 4.47 55 RCVD_IN_IADB_SPF 23510 3.85 1.79 4.36 56 XMSexyCombo_05 23387 6.12 13.34 4.34 57 XMStrtUSub 23247 4.26 4.06 4.31 58 T_TooManySym_01 23154 3.84 1.98 4.30 59 DKIM_INVALID 22852 4.51 5.63 4.24 60 IN_ZIMBRA_NJ_WHITELIST 22846 3.40 0.01 4.24 61 HTML_IMAGE_RATIO_06 21108 3.86 3.64 3.92 62 XM_PDF 21102 3.27 0.65 3.91 63 XM_UncommonTLD01 21040 7.56 22.38 3.90 64 FROM_EXCESS_BASE64 20999 3.77 3.28 3.90 65 T_REMOTE_IMAGE 20814 5.81 13.71 3.86 66 RCVD_IN_IADB_SENDERID 20769 3.44 1.75 3.85 67 BOTNET 20758 7.75 23.54 3.85 68 RCVD_IN_IADB_DK 20395 3.38 1.74 3.78 69 XMSubMetaSx_00 20127 4.81 9.14 3.73 70 TR_XM_DK_SendGrid 20003 3.40 2.12 3.71 71 BAYES_99 18946 7.63 24.30 3.51 72 XMNumbers 18392 4.51 8.97 3.41 73 MIME_HTML_ONLY_MULTI 18117 3.60 4.56 3.36 74 RCVD_IN_IADB_VOUCHED 17278 2.68 0.54 3.21 75 UNTRUSTED_Relay 17248 4.76 11.08 3.20 76 XM_DIRTYINTL 16715 3.87 6.96 3.10 77 BAYES_999 15808 6.09 18.89 2.93 78 XM_H_Trusted_IP 15123 2.25 0.00 2.81 79 BAYES_05 14901 2.67 2.28 2.76 80 MIME_HTML_MOSTLY 14586 3.30 5.68 2.71 81 XM_B_SpammyTLD 13729 2.59 2.75 2.55 82 TM2_M_URI_OPT_OUT 13506 2.79 3.94 2.51 83 XM_UB50 13313 3.27 6.53 2.47 84 BAYES_80 13290 3.31 6.71 2.47 85 HTML_IMAGE_RATIO_08 12857 2.35 2.20 2.39 86 UNPARSEABLE_RELAY 12300 2.11 1.41 2.28 87 XM_CamelCaseFrm001 11967 2.37 2.96 2.22 88 XM_B_Unsub2 11651 2.25 2.60 2.16 89 HTML_MIME_NO_HTML_TAG 11315 3.37 8.53 2.10 90 RCVD_IN_IADB_OPTIN 10681 1.66 0.35 1.98 91 NO_DNS_FOR_FROM 10630 2.32 3.71 1.97 92 URI_HEX 10585 2.45 4.40 1.96 93 TooManyTo_002 10300 1.64 0.56 1.91 94 TVD_SPACE_RATIO 10059 1.53 0.15 1.87 95 T_XMDrugObfuBody_08 10017 1.97 2.43 1.86 96 T_TooManySym_02 9968 1.62 0.70 1.85 97 MAILING_LIST_MULTI 9959 1.68 1.00 1.85 98 XMDiploma_00 9680 2.01 2.88 1.80 99 XMBdyGiftCard01 9527 1.80 1.95 1.77 100 SUBJ_ALL_CAPS 9458 2.02 3.12 1.75 101 TVD_RCVD_IP 9289 1.46 0.39 1.72 102 ANY_BOUNCE_MESSAGE 9243 1.46 0.43 1.71 103 BOUNCE_MESSAGE 9241 1.46 0.43 1.71 104 RELAYCOUNTRY_CA 9095 1.95 3.01 1.69 105 HTML_FONT_FACE_BAD 8925 1.68 1.77 1.66 106 KHOP_HELO_FCRDNS 8737 3.38 10.49 1.62 107 TR_DCC_Bayes_99 8714 5.19 19.64 1.62 108 TVD_SPACE_RATIO_MINFP 8624 1.30 0.06 1.60 109 TM2_M_VERY_LONG_WORD 8597 1.75 2.39 1.59 110 RCVD_IN_MSPIKE_BL 8534 1.73 2.35 1.58 111 XM_SPF_SoftFail 8468 2.46 6.06 1.57 112 IN_HORDE_ADDRESS_BOOK 8143 1.22 0.03 1.51 113 XM_OfRef6 8100 1.71 2.57 1.50 114 CK_HELO_DYNAMIC_SPLIT_IP 7853 1.23 0.32 1.46 115 HELO_DYNAMIC_IPADDR2 7851 1.20 0.16 1.46 116 INVALID_MSGID 7813 1.20 0.19 1.45 117 BOTNET_NORDNS 7470 1.89 3.95 1.39 118 XM_DK_Undo_01 7418 1.32 1.10 1.38 119 BAYES_95 7366 1.85 3.81 1.37 120 TR_XM_RelayPhish 7259 1.63 2.78 1.35 121 XMStockSpam_06 7146 1.66 3.01 1.33 122 DKIM_ADSP_NXDOMAIN 7056 2.31 6.37 1.31 123 XMHTML_After_End 7032 1.57 2.66 1.30 124 TooManyTo_003 6917 1.12 0.44 1.28 125 RCVD_IN_BL_SPAMCOP_NET 6784 1.90 4.51 1.26 126 XMGappySubj_01 6770 1.11 0.52 1.26 127 URI_TRY_3LD 6769 1.34 1.67 1.26 128 TO_MALFORMED 6690 1.07 0.40 1.24 129 TR_Symld_Words 6598 1.31 1.65 1.22 130 HELO_NODOT 6465 1.07 0.56 1.20 131 HELO_NO_DOMAIN 6464 1.07 0.54 1.20 132 XMGenDplmaNmb 6405 1.40 2.26 1.19 133 XMSubNoVowel 6124 1.36 2.28 1.14 134 XMPhish11 5789 1.18 1.59 1.07 135 XM_ProductURIs 5773 1.07 1.05 1.07 136 XMSubMetaI_00 5703 1.21 1.84 1.06 137 XM_H_Long_From02 5600 1.00 0.87 1.04 138 DKIM_ADSP_CUSTOM_MED 5468 1.12 1.53 1.01 139 XMCapTrack 5332 0.84 0.24 0.99 140 USER_IN_DEF_DKIM_WL 5316 0.79 0.01 0.99 141 XM_GoogleGroups 5274 0.86 0.36 0.98 142 XMBrknScrpt_02 5247 1.18 2.00 0.97 143 AC_FROM_MANY_DOTS 5201 1.13 1.79 0.96 144 TooManyTo_004 5052 0.82 0.36 0.94 145 T_XMDrugObfuBody_00 4966 0.99 1.29 0.92 146 XMSexyCombo_01 4723 1.57 4.40 0.88 147 T_XMHurry_00 4568 1.02 1.73 0.85 148 XMBody_17 4297 1.12 2.42 0.80 149 NML_ADSP_CUSTOM_MED 4267 0.91 1.40 0.79 150 RELAYCOUNTRY_GB 4219 1.40 3.92 0.78 151 FROM_GOV_DKIM_AU 4137 0.64 0.11 0.77 152 TR_MetaPhish_Combo_01 4078 0.70 0.48 0.76 153 SUBJ_DOLLARS 3982 0.78 0.97 0.74 154 TooManyTo_005 3929 0.65 0.31 0.73 155 SpammyFromTLD_01 3822 0.87 1.54 0.71 156 HTML_TAG_BALANCE_BODY 3819 0.67 0.53 0.71 157 XMPhish30 3782 0.77 1.02 0.70 158 XMBody_95 3744 0.60 0.20 0.69 159 FILL_THIS_FORM 3536 0.75 1.13 0.66 160 XMHTMLBadTable_001 3495 0.63 0.55 0.65 161 TR_XM_PHPDW 3360 0.86 1.81 0.62 162 T_FILL_THIS_FORM_SHORT 3353 0.64 0.72 0.62 163 TR_XM_PHPForged 3349 0.85 1.78 0.62 164 XMBody_78 3329 0.59 0.48 0.62 165 XM_SPF_Unknown 3304 0.65 0.82 0.61 166 PLING_QUERY 3289 0.59 0.51 0.61 167 TR_XM_FormFill2 3273 0.84 1.77 0.61 168 XM_H_PHPOS 3258 0.83 1.77 0.60 169 RCVD_IN_MSPIKE_L3 3201 0.55 0.39 0.59 170 TM2_M_A_HREF_HREF 3190 0.75 1.40 0.59 171 THIS_AD 3076 0.71 1.27 0.57 172 HTTPS_HTTP_MISMATCH 2991 0.54 0.46 0.55 173 XM_RXBody 2960 0.50 0.32 0.55 174 XMNoVowels 2940 0.54 0.53 0.55 175 FORGED_GMAIL_RCVD 2919 0.72 1.43 0.54 176 RCVD_IN_MSPIKE_L4 2859 0.46 0.18 0.53 177 REMOVE_BEFORE_LINK 2848 0.48 0.30 0.53 178 T_MONEY_PERCENT 2819 0.95 2.66 0.52 179 TR_LOTS_OF_MONEY2 2819 0.95 2.66 0.52 180 TR_LOTS_OF_MONEY3 2744 0.55 0.72 0.51 181 URI_NOVOWEL 2716 0.51 0.55 0.50 182 XM_H_PHPMailer 2617 0.59 0.99 0.49 183 DIET_1 2563 0.57 0.94 0.48 184 USER_IN_WHITELIST 2549 0.38 0.00 0.47 185 XMSubMetaSxObfu_03 2515 0.57 0.97 0.47 186 T_OBFU_PDF_ATTACH 2515 0.40 0.15 0.47 187 FILL_THIS_FORM_LONG 2498 0.58 1.08 0.46 188 FROM_GOV_SPOOF 2498 0.41 0.17 0.46 189 XMGappySubj_02 2492 0.43 0.32 0.46 190 HTML_IMAGE_ONLY_20 2483 0.63 1.29 0.46 191 RCVD_IN_MSPIKE_L5 2474 0.72 1.78 0.46 192 XM_ShortIntro_01 2448 0.39 0.12 0.45 193 T_Symld_Words_02 2403 0.67 1.59 0.45 194 T_FILL_THIS_FORM_LOAN 2367 0.37 0.09 0.44 195 XM_B_REG_HTML 2357 0.39 0.19 0.44 196 XM_Body_Obfu01 2261 0.48 0.71 0.42 197 XMMoneyMeta_00 2256 0.50 0.84 0.42 198 T_TooManySym_03 2192 0.35 0.11 0.41 199 RELAYCOUNTRY_AU 2168 0.40 0.42 0.40 200 XMLngstWrd_00 2148 0.40 0.43 0.40 ----------------------------------------------------------------------