Email: 523764 Autolearn: 0 AvgScore: 1.70 AvgScanTime: 2.19 sec Spam: 113569 Autolearn: 0 AvgScore: 13.18 AvgScanTime: 2.60 sec Ham: 410195 Autolearn: 0 AvgScore: -1.48 AvgScanTime: 2.08 sec Time Spent Running SA: 319.02 hours Time Spent Processing Spam: 81.95 hours Time Spent Processing Ham: 237.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109034 90.47 96.01 88.93 2 DCC_CHECK 92602 56.54 81.54 49.62 3 XM_B_Unicode 76959 71.68 67.76 72.76 4 DKIM_SIGNED 74900 76.51 65.95 79.44 5 XM_DK_Pass 72462 75.25 63.80 78.42 6 DKIM_VALID 68058 71.87 59.93 75.17 7 XMListUnsubscribeExists 64326 58.35 56.64 58.82 8 DKIM_VALID_AU 52750 57.12 46.45 60.07 9 BAYES_50 51615 51.95 45.45 53.75 10 MIME_HTML_ONLY 51207 27.53 45.09 22.67 11 XM_B_Unicode3 50784 46.56 44.72 47.07 12 XM_DK_Undo_02 36435 12.54 32.08 7.14 13 HTML_FONT_LOW_CONTRAST 35048 31.69 30.86 31.92 14 LOC_TINY_FONT_1 32749 28.21 28.84 28.04 15 FSL_BULK_SIG 32062 11.68 28.23 7.09 16 XM_UncommonTLD01 26733 8.34 23.54 4.14 17 FVGT_m_MULTI_ODD 26636 23.40 23.45 23.38 18 BAYES_99 25817 8.06 22.73 4.00 19 RELAYCOUNTRY_META 24898 8.77 21.92 5.13 20 XMSubLong 24163 20.45 21.28 20.22 21 HTML_MIME_NO_HTML_TAG 21914 5.93 19.30 2.23 22 XM_Body_Dirty_Words 21311 15.18 18.76 14.18 23 TR_DCC_Bayes_99 20945 5.45 18.44 1.85 24 DKIM_VALID_EF 20794 24.63 18.31 26.38 25 BAYES_999 20442 6.45 18.00 3.26 26 BOTNET_IPINHOSTNAME 19643 7.91 17.30 5.31 27 BOTNET 19507 5.46 17.18 2.21 28 T_REMOTE_IMAGE 19056 6.53 16.78 3.70 29 T_KAM_HTML_FONT_INVALID 18914 19.11 16.65 19.79 30 DCC_CHECK_NEGATIVE 18770 41.69 16.53 48.66 31 XM_B_Unsub 18767 11.35 16.52 9.92 32 HTML_IMAGE_RATIO_02 18220 11.91 16.04 10.77 33 MultiRelay 16979 16.31 14.95 16.69 34 HTML_SHORT_LINK_IMG_1 16798 3.25 14.79 0.05 35 XM_Multi_Part_URI 16322 13.83 14.37 13.69 36 UNTRUSTED_Relay 16133 4.40 14.21 1.69 37 T_TM2_M_HEADER_IN_MSG 15081 22.33 13.28 24.83 38 HTML_IMAGE_ONLY_08 15020 3.02 13.23 0.20 39 T_HTML_TAG_BALANCE_CENTER 15003 3.07 13.21 0.26 40 SpammyFromTLD_02 14809 2.98 13.04 0.19 41 KHOP_HELO_FCRDNS 14523 4.09 12.79 1.68 42 BODY_URI_ONLY 14500 2.86 12.77 0.11 43 XM_Evil_Numbers_Gen 13126 11.84 11.56 11.92 44 XM_H_Long_From01 12685 7.64 11.17 6.66 45 XMSexyCombo_05 12132 5.90 10.68 4.57 46 LOTS_OF_MONEY 12024 8.95 10.59 8.50 47 RCVD_IN_MSPIKE_H2 11940 14.57 10.51 15.70 48 RDNS_DYNAMIC 11793 2.55 10.38 0.38 49 XM_BadFromFormat 11749 2.33 10.35 0.11 50 FROM_SUSPICIOUS_NTLD 11160 2.23 9.83 0.13 51 FROM_SUSPICIOUS_NTLD_FP 11132 2.22 9.80 0.12 52 DKIM_ADSP_NXDOMAIN 11118 3.13 9.79 1.29 53 MPART_ALT_DIFF 10393 5.63 9.15 4.66 54 T_XMDrugObfuBody_14 10048 8.40 8.85 8.28 55 XM_SPF_SoftFail 9639 3.12 8.49 1.63 56 XM_UB50 9152 2.41 8.06 0.84 57 BAYES_60 8688 5.90 7.65 5.41 58 BAYES_80 8538 3.84 7.52 2.82 59 SHORT_IMG_SUSP_NTLD 8481 1.62 7.47 0.00 60 HDRS_LCASE_IMGONLY 8088 1.58 7.12 0.04 61 MIME_HTML_MOSTLY 7788 3.61 6.86 2.71 62 XMSubMetaSx_00 7521 3.77 6.62 2.98 63 XM_B_Phish_Phrases 7499 7.87 6.60 8.22 64 TR_Mismatch_TLD_02 7412 1.46 6.53 0.05 65 DKIM_INVALID 6842 4.65 6.02 4.26 66 XM_DIRTYINTL 6800 3.64 5.99 2.99 67 LotsOfNums_01 6760 7.97 5.95 8.53 68 TO_MALFORMED 6400 2.49 5.64 1.61 69 XMNumbers 6362 4.06 5.60 3.63 70 TooManyTo_001 6212 6.95 5.47 7.36 71 HTML_IMAGE_RATIO_04 6121 7.19 5.39 7.68 72 TM2_M_URI_OPT_OUT 5758 2.97 5.07 2.39 73 FROM_EXCESS_BASE64 5746 4.62 5.06 4.50 74 TO_NO_BRKTS_DYNIP 5433 1.04 4.78 0.00 75 RCVD_IN_MSPIKE_WL 5318 9.59 4.68 10.95 76 BAYES_40 5317 5.23 4.68 5.38 77 HTML_IMAGE_RATIO_08 5184 2.90 4.56 2.44 78 MIME_HTML_ONLY_MULTI 4873 3.22 4.29 2.93 79 XM_SendGrid 4868 6.61 4.29 7.26 80 XMBdyGiftCard01 4788 2.36 4.22 1.84 81 RCVD_IN_MSPIKE_H3 4762 9.38 4.19 10.82 82 XM_B_SpammyTLD 4502 2.64 3.96 2.27 83 FROM_MISSP_REPLYTO 4481 0.86 3.95 0.01 84 MIME_HEADER_CTYPE_ONLY 4436 0.92 3.91 0.09 85 XMStrtUSub 4387 4.05 3.86 4.10 86 RCVD_IN_BL_SPAMCOP_NET 4319 1.61 3.80 1.01 87 HTML_IMAGE_RATIO_06 4275 3.89 3.76 3.93 88 RELAYCOUNTRY_CA 4238 2.28 3.73 1.88 89 MIME_QP_LONG_LINE 4201 5.22 3.70 5.64 90 XM_CamelCaseFrm001 4115 2.72 3.62 2.47 91 BAYES_20 4070 4.33 3.58 4.54 92 XMSubMetaI_00 4046 2.27 3.56 1.91 93 BAYES_95 3885 2.03 3.42 1.64 94 RELAYCOUNTRY_FR 3548 1.01 3.12 0.43 95 XM_URI_RBL 3498 0.93 3.08 0.34 96 RELAYCOUNTRY_DE 3430 0.86 3.02 0.26 97 T_TooManySym_01 3343 4.54 2.94 4.98 98 XMHTML_After_End 3312 1.48 2.92 1.08 99 RELAYCOUNTRY_GB 3275 1.21 2.88 0.75 100 FROM_MISSP_DYNIP 3229 0.62 2.84 0.00 101 REPLYTO_WITHOUT_TO_CC 3189 0.64 2.81 0.04 102 RCVD_IN_RP_RNBL 3156 0.65 2.78 0.06 103 MultiRelay_Combo 3040 0.74 2.68 0.20 104 MultiRelay_CC 3040 0.74 2.68 0.20 105 ALL_TRUSTED 3013 10.71 2.65 12.94 106 HDRS_MISSP 2955 0.58 2.60 0.01 107 NO_DNS_FOR_FROM 2949 2.15 2.60 2.03 108 XMSubGiftCard1 2859 0.63 2.52 0.11 109 PLING_QUERY 2857 1.66 2.52 1.42 110 HK_RANDOM_FROM 2830 0.63 2.49 0.11 111 XMSubGiftCard2 2814 0.58 2.48 0.06 112 XMPhish11 2808 1.37 2.47 1.07 113 BAYES_00 2704 15.57 2.38 19.22 114 XMSexyCombo_01 2697 0.96 2.37 0.57 115 DIET_1 2658 1.16 2.34 0.83 116 XM_H_PHPMailer 2626 0.84 2.31 0.44 117 BAYES_05 2535 2.73 2.23 2.87 118 SpammyFromTLD_01 2509 1.00 2.21 0.66 119 XM_OfRef6 2438 1.50 2.15 1.32 120 URI_HEX 2415 1.43 2.13 1.24 121 XMDiploma_00 2372 1.48 2.09 1.31 122 TO_EQ_FM_DOM_HTML_IMG 2354 0.45 2.07 0.00 123 MISSING_HEADERS 2351 0.71 2.07 0.34 124 XMStockSpam_06 2289 1.97 2.02 1.96 125 RCVD_IN_MSPIKE_BL 2274 0.98 2.00 0.70 126 T_XMDrugObfuBody_08 2265 1.75 1.99 1.68 127 TR_XM_DK_SendGrid 2232 3.51 1.97 3.94 128 HTML_IMAGE_ONLY_12 2207 0.56 1.94 0.17 129 TR_LOTS_OF_MONEY3 2204 1.12 1.94 0.89 130 RCVD_IN_IADB_LISTED 2111 3.93 1.86 4.50 131 URI_TRY_3LD 2109 2.04 1.86 2.09 132 TR_XM_INV_DKIM 2102 0.50 1.85 0.12 133 XM_B_Unsub2 1995 1.75 1.76 1.75 134 SUBJECT_NEEDS_ENCODING 1958 0.38 1.72 0.00 135 SUBJ_ILLEGAL_CHARS 1948 0.37 1.72 0.00 136 RCVD_IN_IADB_SPF 1911 3.45 1.68 3.94 137 TM2_M_VERY_LONG_WORD 1882 1.74 1.66 1.76 138 RCVD_IN_IADB_DK 1881 3.06 1.66 3.45 139 T_XMHurry_00 1876 1.33 1.65 1.24 140 RCVD_IN_IADB_SENDERID 1864 3.11 1.64 3.51 141 RCVD_IN_RP_SAFE 1838 10.52 1.62 12.99 142 UNPARSEABLE_RELAY 1825 2.54 1.61 2.80 143 NORDNS_LOW_CONTRAST 1804 0.35 1.59 0.00 144 BOTNET_NORDNS 1786 0.37 1.57 0.04 145 XM_UB60 1772 0.39 1.56 0.07 146 XMPhish04 1737 0.33 1.53 0.00 147 TR_XM_PHPDW 1688 0.80 1.49 0.61 148 TR_LOTS_OF_MONEY2 1688 0.80 1.49 0.61 149 T_MONEY_PERCENT 1688 0.80 1.49 0.61 150 XM_SPF_Unknown 1670 0.79 1.47 0.60 151 RCVD_IN_SORBS_DUL 1653 0.49 1.46 0.22 152 TR_XM_FormFill2 1613 0.77 1.42 0.58 153 TR_XM_PHPForged 1612 0.77 1.42 0.59 154 XM_H_PHPOS 1606 0.76 1.41 0.58 155 XMBody_17 1580 0.99 1.39 0.88 156 SUBJ_ALL_CAPS 1530 1.89 1.35 2.04 157 RELAYCOUNTRY_GR 1526 0.29 1.34 0.00 158 XMGenDplmaNmb 1506 0.84 1.33 0.71 159 DATE_IN_PAST_03_06 1495 0.38 1.32 0.12 160 LongTLD 1494 0.46 1.32 0.22 161 XM_DK_Undo_01 1445 1.84 1.27 2.00 162 RCVD_IN_MSPIKE_L5 1444 0.51 1.27 0.30 163 DKIM_ADSP_CUSTOM_MED 1429 1.04 1.26 0.98 164 TR_XM_RelayPhish 1412 1.64 1.24 1.75 165 RCVD_IN_RP_CERTIFIED 1393 9.32 1.23 11.56 166 NML_ADSP_CUSTOM_MED 1365 0.88 1.20 0.79 167 RELAYCOUNTRY_AT 1336 0.49 1.18 0.30 168 FORGED_GMAIL_RCVD 1323 0.66 1.16 0.52 169 MONEY_FRAUD_8 1297 0.25 1.14 0.00 170 TR_XM_DK_Bayes 1296 12.28 1.14 15.36 171 XMBrknScrpt_02 1275 1.04 1.12 1.02 172 XM_H_Undi_Recip 1267 0.35 1.12 0.14 173 DATE_IN_PAST_06_12 1252 0.29 1.10 0.07 174 URIBL_DBL_ABUSE_REDIR 1249 0.25 1.10 0.01 175 TR_XM_Undi_Recip5 1192 0.23 1.05 0.01 176 TR_XM_DK_Bayes1 1146 11.74 1.01 14.71 177 XMSubMetaSxObfu_03 1117 0.61 0.98 0.50 178 FILL_THIS_FORM 1104 0.63 0.97 0.53 179 TR_Symld_Words 1102 1.26 0.97 1.34 180 RELAYCOUNTRY_NL 1095 0.31 0.96 0.13 181 XM_Palau_URI 1087 0.21 0.96 0.00 182 XM_H_Long_From02 1074 1.00 0.95 1.02 183 FROM_LOCAL_NOVOWEL 1074 0.22 0.95 0.02 184 FILL_THIS_FORM_LONG 1069 0.53 0.94 0.42 185 TO_NO_BRKTS_HTML_ONLY 1065 0.31 0.94 0.14 186 TVD_RCVD_IP 1051 2.03 0.93 2.33 187 XM_ProductURIs 1050 1.40 0.92 1.53 188 HK_RANDOM_REPLYTO 1048 0.37 0.92 0.22 189 XMSlimDrugH 1028 0.42 0.91 0.29 190 MAILING_LIST_MULTI 1027 1.44 0.90 1.59 191 FVGT_m_MULTI_ODD_EMAIL 998 0.21 0.88 0.03 192 XMPhish30 984 0.74 0.87 0.71 193 FROM_ILLEGAL_CHARS 983 0.19 0.87 0.00 194 FROM_NTLD_LINKBAIT 982 0.19 0.86 0.00 195 XM_OfRef7 971 0.25 0.85 0.09 196 THIS_AD 951 0.69 0.84 0.65 197 XMSexyCombo_04 942 0.26 0.83 0.10 198 XM_B_COPY_HTML 936 0.71 0.82 0.68 199 XMSubMetaSSx_00 931 0.27 0.82 0.12 200 XMPhish14 923 0.52 0.81 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 364793 90.47 96.01 88.93 2 DKIM_SIGNED 325841 76.51 65.95 79.44 3 XM_DK_Pass 321656 75.25 63.80 78.42 4 DKIM_VALID 308350 71.87 59.93 75.17 5 XM_B_Unicode 298462 71.68 67.76 72.76 6 DKIM_VALID_AU 246408 57.12 46.45 60.07 7 XMListUnsubscribeExists 241269 58.35 56.64 58.82 8 BAYES_50 220492 51.95 45.45 53.75 9 DCC_CHECK 203523 56.54 81.54 49.62 10 DCC_CHECK_NEGATIVE 199593 41.69 16.53 48.66 11 XM_B_Unicode3 193074 46.56 44.72 47.07 12 HTML_FONT_LOW_CONTRAST 130935 31.69 30.86 31.92 13 LOC_TINY_FONT_1 115016 28.21 28.84 28.04 14 DKIM_VALID_EF 108214 24.63 18.31 26.38 15 T_TM2_M_HEADER_IN_MSG 101859 22.33 13.28 24.83 16 FVGT_m_MULTI_ODD 95914 23.40 23.45 23.38 17 MIME_HTML_ONLY 92991 27.53 45.09 22.67 18 XMSubLong 82961 20.45 21.28 20.22 19 T_KAM_HTML_FONT_INVALID 81198 19.11 16.65 19.79 20 BAYES_00 78859 15.57 2.38 19.22 21 MultiRelay 68447 16.31 14.95 16.69 22 RCVD_IN_MSPIKE_H2 64393 14.57 10.51 15.70 23 TR_XM_DK_Bayes 63016 12.28 1.14 15.36 24 TR_XM_DK_Bayes1 60348 11.74 1.01 14.71 25 XM_Body_Dirty_Words 58173 15.18 18.76 14.18 26 XM_Multi_Part_URI 56138 13.83 14.37 13.69 27 TR_XM_DK_Bayes2 55341 10.71 0.68 13.49 28 RCVD_IN_RP_SAFE 53280 10.52 1.62 12.99 29 ALL_TRUSTED 53092 10.71 2.65 12.94 30 XM_Evil_Numbers_Gen 48886 11.84 11.56 11.92 31 RCVD_IN_RP_CERTIFIED 47424 9.32 1.23 11.56 32 RCVD_IN_MSPIKE_WL 44932 9.59 4.68 10.95 33 RCVD_IN_MSPIKE_H3 44388 9.38 4.19 10.82 34 HTML_IMAGE_RATIO_02 44181 11.91 16.04 10.77 35 XM_DKIMWhitelistDomains 41711 7.97 0.03 10.17 36 XM_B_Unsub 40697 11.35 16.52 9.92 37 LotsOfNums_01 35001 7.97 5.95 8.53 38 LOTS_OF_MONEY 34856 8.95 10.59 8.50 39 T_XMDrugObfuBody_14 33971 8.40 8.85 8.28 40 XM_B_Phish_Phrases 33707 7.87 6.60 8.22 41 HTML_IMAGE_RATIO_04 31523 7.19 5.39 7.68 42 TooManyTo_001 30197 6.95 5.47 7.36 43 XM_SendGrid 29770 6.61 4.29 7.26 44 XM_DK_Undo_02 29271 12.54 32.08 7.14 45 FSL_BULK_SIG 29090 11.68 28.23 7.09 46 XM_H_Long_From01 27326 7.64 11.17 6.66 47 MIME_QP_LONG_LINE 23132 5.22 3.70 5.64 48 BAYES_60 22199 5.90 7.65 5.41 49 BAYES_40 22086 5.23 4.68 5.38 50 BOTNET_IPINHOSTNAME 21766 7.91 17.30 5.31 51 RELAYCOUNTRY_META 21057 8.77 21.92 5.13 52 T_TooManySym_01 20434 4.54 2.94 4.98 53 MPART_ALT_DIFF 19103 5.63 9.15 4.66 54 XMSexyCombo_05 18744 5.90 10.68 4.57 55 BAYES_20 18617 4.33 3.58 4.54 56 FROM_EXCESS_BASE64 18476 4.62 5.06 4.50 57 RCVD_IN_IADB_LISTED 18447 3.93 1.86 4.50 58 DKIM_INVALID 17491 4.65 6.02 4.26 59 XM_UncommonTLD01 16966 8.34 23.54 4.14 60 XMStrtUSub 16833 4.05 3.86 4.10 61 BAYES_99 16403 8.06 22.73 4.00 62 RCVD_IN_IADB_SPF 16176 3.45 1.68 3.94 63 TR_XM_DK_SendGrid 16170 3.51 1.97 3.94 64 HTML_IMAGE_RATIO_06 16119 3.89 3.76 3.93 65 XM_PDF 15438 3.04 0.43 3.76 66 T_REMOTE_IMAGE 15166 6.53 16.78 3.70 67 XMNumbers 14910 4.06 5.60 3.63 68 RCVD_IN_IADB_SENDERID 14407 3.11 1.64 3.51 69 RCVD_IN_IADB_DK 14171 3.06 1.66 3.45 70 IN_ZIMBRA_NJ_WHITELIST 13382 2.56 0.01 3.26 71 BAYES_999 13355 6.45 18.00 3.26 72 XM_DIRTYINTL 12259 3.64 5.99 2.99 73 XMSubMetaSx_00 12208 3.77 6.62 2.98 74 MIME_HTML_ONLY_MULTI 12002 3.22 4.29 2.93 75 BAYES_05 11766 2.73 2.23 2.87 76 BAYES_80 11554 3.84 7.52 2.82 77 UNPARSEABLE_RELAY 11491 2.54 1.61 2.80 78 RCVD_IN_IADB_VOUCHED 11154 2.25 0.55 2.72 79 MIME_HTML_MOSTLY 11098 3.61 6.86 2.71 80 XM_CamelCaseFrm001 10129 2.72 3.62 2.47 81 HTML_IMAGE_RATIO_08 10007 2.90 4.56 2.44 82 TM2_M_URI_OPT_OUT 9784 2.97 5.07 2.39 83 TVD_RCVD_IP 9559 2.03 0.93 2.33 84 XM_B_SpammyTLD 9303 2.64 3.96 2.27 85 HTML_MIME_NO_HTML_TAG 9142 5.93 19.30 2.23 86 BOTNET 9081 5.46 17.18 2.21 87 ANY_BOUNCE_MESSAGE 8953 1.80 0.43 2.18 88 BOUNCE_MESSAGE 8953 1.80 0.43 2.18 89 URI_TRY_3LD 8555 2.04 1.86 2.09 90 SUBJ_ALL_CAPS 8359 1.89 1.35 2.04 91 NO_DNS_FOR_FROM 8335 2.15 2.60 2.03 92 T_TooManySym_02 8328 1.76 0.79 2.03 93 XM_DK_Undo_01 8203 1.84 1.27 2.00 94 XMStockSpam_06 8028 1.97 2.02 1.96 95 XM_H_Trusted_IP 8008 1.53 0.00 1.95 96 XMSubMetaI_00 7853 2.27 3.56 1.91 97 TooManyTo_002 7801 1.65 0.75 1.90 98 RELAYCOUNTRY_CA 7707 2.28 3.73 1.88 99 INVALID_MSGID 7633 1.53 0.32 1.86 100 TR_DCC_Bayes_99 7599 5.45 18.44 1.85 101 XMBdyGiftCard01 7561 2.36 4.22 1.84 102 USER_IN_DEF_DKIM_WL 7535 1.44 0.00 1.84 103 CK_HELO_DYNAMIC_SPLIT_IP 7457 1.55 0.59 1.82 104 HELO_DYNAMIC_IPADDR2 7452 1.47 0.24 1.82 105 TM2_M_VERY_LONG_WORD 7209 1.74 1.66 1.76 106 TR_XM_RelayPhish 7167 1.64 1.24 1.75 107 XM_B_Unsub2 7161 1.75 1.76 1.75 108 RCVD_IN_IADB_OPTIN 6988 1.42 0.41 1.70 109 UNTRUSTED_Relay 6914 4.40 14.21 1.69 110 T_XMDrugObfuBody_08 6908 1.75 1.99 1.68 111 KHOP_HELO_FCRDNS 6884 4.09 12.79 1.68 112 BAYES_95 6743 2.03 3.42 1.64 113 XM_SPF_SoftFail 6702 3.12 8.49 1.63 114 TO_MALFORMED 6624 2.49 5.64 1.61 115 MAILING_LIST_MULTI 6506 1.44 0.90 1.59 116 XM_ProductURIs 6285 1.40 0.92 1.53 117 IN_HORDE_ADDRESS_BOOK 6183 1.18 0.02 1.51 118 XMGappySubj_01 5971 1.18 0.17 1.46 119 PLING_QUERY 5812 1.66 2.52 1.42 120 TooManyTo_003 5579 1.20 0.61 1.36 121 TR_Symld_Words 5492 1.26 0.97 1.34 122 XM_OfRef6 5408 1.50 2.15 1.32 123 XMDiploma_00 5357 1.48 2.09 1.31 124 DKIM_ADSP_NXDOMAIN 5288 3.13 9.79 1.29 125 T_FILL_THIS_FORM_SHORT 5124 1.07 0.44 1.25 126 T_XMHurry_00 5079 1.33 1.65 1.24 127 URI_HEX 5068 1.43 2.13 1.24 128 XMHTML_After_End 4428 1.48 2.92 1.08 129 XMPhish11 4391 1.37 2.47 1.07 130 XMSubNoVowel 4308 0.89 0.33 1.05 131 TooManyTo_004 4235 0.92 0.49 1.03 132 XMBrknScrpt_02 4177 1.04 1.12 1.02 133 XM_H_Long_From02 4173 1.00 0.95 1.02 134 RCVD_IN_BL_SPAMCOP_NET 4124 1.61 3.80 1.01 135 XMBody_95 4055 0.80 0.11 0.99 136 HTML_FONT_FACE_BAD 4017 0.89 0.57 0.98 137 DKIM_ADSP_CUSTOM_MED 4003 1.04 1.26 0.98 138 HELO_NODOT 3902 0.83 0.41 0.95 139 HELO_NO_DOMAIN 3901 0.83 0.41 0.95 140 XM_GoogleGroups 3790 0.79 0.33 0.92 141 AC_FROM_MANY_DOTS 3763 0.72 0.02 0.92 142 TR_MetaPhish_Combo_01 3729 0.84 0.59 0.91 143 TR_LOTS_OF_MONEY3 3662 1.12 1.94 0.89 144 XMBody_17 3611 0.99 1.39 0.88 145 TooManyTo_005 3520 0.76 0.39 0.86 146 XM_UB50 3454 2.41 8.06 0.84 147 DIET_1 3423 1.16 2.34 0.83 148 NML_ADSP_CUSTOM_MED 3245 0.88 1.20 0.79 149 XM_RXBody 3175 0.73 0.55 0.77 150 XMCapTrack 3119 0.67 0.36 0.76 151 RELAYCOUNTRY_GB 3064 1.21 2.88 0.75 152 XMPhish30 2902 0.74 0.87 0.71 153 XMGenDplmaNmb 2900 0.84 1.33 0.71 154 RCVD_IN_MSPIKE_BL 2860 0.98 2.00 0.70 155 XMGappySubj_02 2797 0.55 0.06 0.68 156 XM_B_COPY_HTML 2785 0.71 0.82 0.68 157 SpammyFromTLD_01 2705 1.00 2.21 0.66 158 XM_B_REG_HTML 2704 0.58 0.28 0.66 159 THIS_AD 2647 0.69 0.84 0.65 160 HTML_TAG_BALANCE_BODY 2626 0.60 0.47 0.64 161 XMBody_78 2599 0.64 0.64 0.63 162 XMHTMLBadTable_001 2527 0.58 0.44 0.62 163 T_MONEY_PERCENT 2502 0.80 1.49 0.61 164 TR_LOTS_OF_MONEY2 2502 0.80 1.49 0.61 165 TR_XM_PHPDW 2494 0.80 1.49 0.61 166 T_Symld_Words_02 2480 0.64 0.75 0.60 167 XM_SPF_Unknown 2469 0.79 1.47 0.60 168 T_XMDrugObfuBody_00 2456 0.61 0.63 0.60 169 TR_XM_PHPForged 2412 0.77 1.42 0.59 170 TR_XM_FormFill2 2396 0.77 1.42 0.58 171 XM_H_PHPOS 2380 0.76 1.41 0.58 172 XMSexyCombo_01 2346 0.96 2.37 0.57 173 USER_IN_WHITELIST 2340 0.45 0.00 0.57 174 T_OBFU_PDF_ATTACH 2198 0.45 0.15 0.54 175 XMSolicitRefs_0 2193 0.51 0.41 0.53 176 FILL_THIS_FORM 2179 0.63 0.97 0.53 177 XM_ShortIntro_01 2140 0.55 0.67 0.52 178 FORGED_GMAIL_RCVD 2123 0.66 1.16 0.52 179 XMSubMetaSxObfu_03 2055 0.61 0.98 0.50 180 HTML_IMAGE_ONLY_20 2003 0.43 0.22 0.49 181 XMSubMetaSxObfu_02 1962 0.43 0.26 0.48 182 FSL_THIS_IS_ADV 1906 0.52 0.72 0.46 183 LOW_PRICE 1840 0.52 0.77 0.45 184 T_TooManySym_03 1828 0.40 0.21 0.45 185 XMPhish14 1824 0.52 0.81 0.44 186 XM_H_PHPMailer 1799 0.84 2.31 0.44 187 XMRcvdHeader_15 1776 0.34 0.00 0.43 188 URI_NOVOWEL 1768 0.40 0.29 0.43 189 RELAYCOUNTRY_FR 1754 1.01 3.12 0.43 190 XMOemUri 1754 0.44 0.50 0.43 191 HTTPS_HTTP_MISMATCH 1744 0.42 0.42 0.43 192 FILL_THIS_FORM_LONG 1727 0.53 0.94 0.42 193 FILL_THIS_FORM_LOAN 1682 0.49 0.76 0.41 194 XMBSHREFv2 1672 0.38 0.30 0.41 195 TM2_M_BODY_EMPTY 1643 0.34 0.10 0.40 196 XMNoVowels 1613 0.36 0.24 0.39 197 XM_Body_Obfu01 1593 0.40 0.43 0.39 198 HTML_IMAGE_ONLY_32 1561 0.35 0.22 0.38 199 MPART_ALT_DIFF_COUNT 1559 0.42 0.56 0.38 200 RDNS_DYNAMIC 1550 2.55 10.38 0.38 ----------------------------------------------------------------------