Email: 575469 Autolearn: 0 AvgScore: 2.28 AvgScanTime: 2.03 sec Spam: 131242 Autolearn: 0 AvgScore: 15.83 AvgScanTime: 2.46 sec Ham: 444227 Autolearn: 0 AvgScore: -1.73 AvgScanTime: 1.90 sec Time Spent Running SA: 323.90 hours Time Spent Processing Spam: 89.50 hours Time Spent Processing Ham: 234.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 121902 89.61 92.88 88.64 2 DCC_CHECK 103924 50.02 79.19 41.40 3 XM_B_Unicode 84297 68.31 64.23 69.52 4 DKIM_SIGNED 72249 70.95 55.05 75.65 5 XM_DK_Pass 69327 69.55 52.82 74.49 6 BAYES_50 67381 51.97 51.34 52.15 7 MIME_HTML_ONLY 66978 29.50 51.03 23.14 8 DKIM_VALID 65023 66.02 49.54 70.88 9 XMListUnsubscribeExists 57872 49.06 44.10 50.53 10 DKIM_VALID_AU 48908 50.99 37.27 55.04 11 XM_B_Unicode3 46303 40.87 35.28 42.52 12 RELAYCOUNTRY_META 45087 12.19 34.35 5.64 13 BOTNET 42443 9.19 32.34 2.35 14 FSL_BULK_SIG 41099 12.82 31.32 7.35 15 HTML_FONT_LOW_CONTRAST 40781 28.89 31.07 28.24 16 LOC_TINY_FONT_1 39351 25.50 29.98 24.17 17 XM_UncommonTLD01 39126 10.39 29.81 4.65 18 UNTRUSTED_Relay 38756 8.09 29.53 1.76 19 XM_DK_Undo_02 31069 11.22 23.67 7.54 20 T_REMOTE_IMAGE 29926 9.18 22.80 5.15 21 HTML_MIME_NO_HTML_TAG 28160 6.86 21.46 2.54 22 DKIM_ADSP_NXDOMAIN 28028 6.25 21.36 1.78 23 XMSubLong 27697 21.23 21.10 21.27 24 BOTNET_IPINHOSTNAME 25957 8.30 19.78 4.91 25 XM_Body_Dirty_Words 25280 15.11 19.26 13.89 26 DCC_CHECK_NEGATIVE 25253 48.20 19.24 56.75 27 DKIM_VALID_EF 24489 25.56 18.66 27.60 28 FROM_SUSPICIOUS_NTLD 24070 4.26 18.34 0.10 29 FROM_SUSPICIOUS_NTLD_FP 23974 4.24 18.27 0.09 30 KHOP_HELO_FCRDNS 23644 5.91 18.02 2.34 31 T_TM2_M_HEADER_IN_MSG 23529 26.49 17.93 29.02 32 XM_UB50 23431 4.73 17.85 0.86 33 SpammyFromTLD_02 23031 4.29 17.55 0.37 34 FVGT_m_MULTI_ODD 22922 19.71 17.47 20.37 35 MultiRelay 22897 18.41 17.45 18.69 36 BAYES_99 22719 7.12 17.31 4.11 37 XM_B_Unsub 21682 12.10 16.52 10.80 38 HTML_SHORT_LINK_IMG_1 21126 3.71 16.10 0.05 39 XMSexyCombo_05 19777 6.99 15.07 4.60 40 T_KAM_HTML_FONT_INVALID 19376 16.35 14.76 16.81 41 T_HTML_TAG_BALANCE_CENTER 18872 3.47 14.38 0.24 42 TR_DCC_Bayes_99 17527 4.53 13.35 1.92 43 HTML_IMAGE_ONLY_08 17484 3.14 13.32 0.13 44 BAYES_999 16955 5.59 12.92 3.42 45 XM_BadFromFormat 16925 3.07 12.90 0.17 46 SHORT_IMG_SUSP_NTLD 16311 2.83 12.43 0.00 47 RCVD_IN_RP_RNBL 16298 2.89 12.42 0.07 48 RCVD_IN_BL_SPAMCOP_NET 15686 3.69 11.95 1.25 49 HTML_IMAGE_RATIO_02 15553 9.39 11.85 8.67 50 MIME_HEADER_CTYPE_ONLY 15305 2.72 11.66 0.08 51 XM_Multi_Part_URI 15194 11.89 11.58 11.98 52 LOTS_OF_MONEY 14745 9.61 11.23 9.13 53 XMSubMetaSx_00 14020 5.50 10.68 3.97 54 RDNS_DYNAMIC 13211 2.56 10.07 0.34 55 RCVD_IN_MSPIKE_BL 13052 2.93 9.94 0.86 56 XM_SPF_SoftFail 12802 3.62 9.75 1.81 57 NO_DNS_FOR_FROM 12618 4.11 9.61 2.48 58 XM_DIRTYINTL 12087 4.32 9.21 2.88 59 XMNumbers 11402 4.93 8.69 3.83 60 XM_Evil_Numbers_Gen 11320 9.58 8.63 9.86 61 NORDNS_LOW_CONTRAST 10768 1.88 8.20 0.01 62 RCVD_IN_MSPIKE_L5 10712 2.07 8.16 0.27 63 HDRS_MISSP 10477 1.84 7.98 0.02 64 RCVD_IN_MSPIKE_H2 10030 10.85 7.64 11.79 65 HTML_TAG_BALANCE_BODY 9974 2.21 7.60 0.62 66 T_XMDrugObfuBody_14 9876 7.85 7.53 7.94 67 HDRS_LCASE_IMGONLY 9842 1.74 7.50 0.04 68 BODY_URI_ONLY 9680 1.72 7.38 0.05 69 BAYES_60 9610 5.32 7.32 4.73 70 XM_H_Long_From01 9518 6.80 7.25 6.66 71 BOTNET_NORDNS 9480 1.70 7.22 0.07 72 MPART_ALT_DIFF 9478 5.40 7.22 4.87 73 BAYES_80 9049 3.40 6.89 2.37 74 FROM_MISSP_REPLYTO 8151 1.42 6.21 0.00 75 LongTLD 8134 1.60 6.20 0.24 76 RELAYCOUNTRY_FR 8117 1.82 6.18 0.53 77 TO_MALFORMED 8063 2.55 6.14 1.49 78 HTML_FONT_SIZE_LARGE 7421 1.38 5.65 0.11 79 TooManyTo_001 7396 7.46 5.64 7.99 80 RELAYCOUNTRY_IN 7264 1.32 5.53 0.08 81 DKIM_INVALID 7226 4.93 5.51 4.76 82 XMSexyCombo_01 7145 1.80 5.44 0.72 83 URI_NOVOWEL 7060 1.54 5.38 0.40 84 LotsOfNums_01 6902 7.11 5.26 7.65 85 RCVD_IN_PSBL 6872 1.24 5.24 0.07 86 XM_B_SpammyTLD 6855 2.84 5.22 2.13 87 XM_B_Phish_Phrases 6508 5.72 4.96 5.94 88 MIME_HTML_MOSTLY 6218 3.06 4.74 2.56 89 XM_CamelCaseFrm001 6150 2.89 4.69 2.37 90 MISSING_HEADERS 6148 1.40 4.68 0.44 91 BAYES_40 6061 5.41 4.62 5.65 92 XMStrtUSub 5880 5.02 4.48 5.18 93 FROM_MISSP_DYNIP 5571 0.97 4.24 0.00 94 XMSexyCombo_04 5342 1.04 4.07 0.14 95 XM_SendGrid 5329 5.79 4.06 6.29 96 SpammyFromTLD_01 5147 1.45 3.92 0.73 97 REPLYTO_WITHOUT_TO_CC 4860 0.87 3.70 0.04 98 BAYES_95 4752 1.96 3.62 1.47 99 FROM_EXCESS_BASE64 4731 4.04 3.60 4.17 100 HK_RANDOM_FROM 4678 0.91 3.56 0.13 101 HTML_IMAGE_RATIO_06 4574 4.08 3.49 4.26 102 BAYES_20 4540 4.42 3.46 4.71 103 HTML_IMAGE_RATIO_04 4374 5.63 3.33 6.31 104 RELAYCOUNTRY_CA 4312 2.06 3.29 1.69 105 BAYES_00 4125 17.47 3.14 21.71 106 MIME_HTML_ONLY_MULTI 4116 3.11 3.14 3.10 107 HTML_IMAGE_ONLY_12 4086 0.88 3.11 0.22 108 MIME_QP_LONG_LINE 3795 4.99 2.89 5.60 109 XM_SPF_Unknown 3790 1.20 2.89 0.71 110 MultiRelay_Combo 3771 0.81 2.87 0.20 111 MultiRelay_CC 3771 0.81 2.87 0.20 112 TM2_M_URI_OPT_OUT 3638 2.18 2.77 2.00 113 RELAYCOUNTRY_GB 3579 1.48 2.73 1.11 114 NO_FM_NAME_IP_HOSTN 3503 0.61 2.67 0.00 115 RELAYCOUNTRY_CN 3366 0.63 2.56 0.06 116 TO_EQ_FM_DOM_HTML_IMG 3255 0.57 2.48 0.01 117 XM_URI_RBL 3229 0.81 2.46 0.32 118 RCVD_IN_MSPIKE_WL 3168 8.35 2.41 10.11 119 RCVD_IN_MSPIKE_H3 3161 8.32 2.41 10.07 120 DIET_1 3136 1.56 2.39 1.31 121 XM_OfRef6 3079 1.49 2.35 1.24 122 RCVD_IN_RP_SAFE 2970 8.66 2.26 10.55 123 HTML_IMAGE_RATIO_08 2955 2.52 2.25 2.60 124 T_TooManySym_01 2930 4.03 2.23 4.56 125 XMDiploma_00 2824 1.58 2.15 1.41 126 XM_UB60 2805 0.55 2.14 0.08 127 SHORTENER_SHORT_IMG 2793 0.49 2.13 0.00 128 T_XMDrugObfuBody_08 2670 1.58 2.03 1.44 129 TO_NO_BRKTS_HTML_ONLY 2626 0.62 2.00 0.21 130 DKIM_ADSP_CUSTOM_MED 2625 1.36 2.00 1.17 131 XMMoneyMeta_00 2624 0.83 2.00 0.49 132 BAYES_05 2620 2.64 2.00 2.83 133 DATE_IN_PAST_03_06 2576 0.60 1.96 0.19 134 FVGT_m_MULTI_ODD_EMAIL 2502 0.46 1.91 0.03 135 SUBJECT_NEEDS_ENCODING 2480 0.43 1.89 0.00 136 TR_XM_DK_SendGrid 2443 3.15 1.86 3.53 137 NML_ADSP_CUSTOM_MED 2442 1.10 1.86 0.88 138 XM_B_Unsub2 2418 2.16 1.84 2.26 139 URI_HEX 2386 1.65 1.82 1.60 140 CHARSET_FARAWAY_HEADER 2376 0.44 1.81 0.04 141 XMSexyCombo_03 2374 0.41 1.81 0.00 142 SUBJ_ILLEGAL_CHARS 2365 0.41 1.80 0.00 143 FORGED_GMAIL_RCVD 2281 0.84 1.74 0.58 144 XMBdyGiftCard01 2244 1.41 1.71 1.32 145 XMSubMetaSxObfu_03 2237 1.29 1.70 1.17 146 RCVD_IN_RP_CERTIFIED 2225 7.67 1.70 9.43 147 TR_Mismatch_TLD_02 2208 0.43 1.68 0.06 148 MIME_CHARSET_FARAWAY 2191 0.45 1.67 0.09 149 XMGenDplmaNmb 2169 1.22 1.65 1.09 150 RELAYCOUNTRY_DE 2160 0.63 1.65 0.32 151 XMHTML_After_End 2155 1.30 1.64 1.19 152 TR_Mismatch_TLD_01 2135 0.59 1.63 0.28 153 DATE_IN_PAST_06_12 2109 0.40 1.61 0.05 154 HTML_SHORT_LINK_IMG_2 2104 0.39 1.60 0.03 155 UNPARSEABLE_RELAY 2090 2.25 1.59 2.44 156 MISSING_MIMEOLE 2071 0.43 1.58 0.09 157 SUBJ_ALL_CAPS 2054 1.61 1.57 1.62 158 TR_XM_DK_Bayes 2050 12.56 1.56 15.81 159 T_XMDrugObfuBody_00 2044 1.00 1.56 0.83 160 XMSubMetaI_00 2026 0.85 1.54 0.65 161 TM2_M_VERY_LONG_WORD 2009 1.40 1.53 1.36 162 TR_XM_PHPDW 1968 0.78 1.50 0.56 163 TR_Symld_Words 1925 1.55 1.47 1.58 164 XMSlimDrugH 1912 0.58 1.46 0.33 165 TR_XM_PHPForged 1904 0.75 1.45 0.54 166 TR_XM_FormFill2 1892 0.74 1.44 0.54 167 XM_H_PHPOS 1878 0.74 1.43 0.53 168 URI_NO_WWW_INFO_CGI 1876 0.44 1.43 0.14 169 RELAYCOUNTRY_SG 1872 0.40 1.43 0.09 170 TR_XM_DK_Bayes1 1812 11.98 1.38 15.11 171 XM_UB99 1808 0.32 1.38 0.01 172 XM_UB80 1803 0.34 1.37 0.04 173 T_FILL_THIS_FORM_SHORT 1798 1.21 1.37 1.16 174 XMStockSpam_06 1767 1.39 1.35 1.40 175 XMSubGiftCard1 1753 0.38 1.34 0.10 176 RCVD_IN_MSPIKE_L3 1743 0.50 1.33 0.26 177 ALL_TRUSTED 1710 10.87 1.30 13.70 178 XMPhish11 1700 1.15 1.30 1.10 179 FROM_NTLD_LINKBAIT 1697 0.29 1.29 0.00 180 FILL_THIS_FORM 1681 0.63 1.28 0.44 181 TVD_SPACE_RATIO_MINFP 1662 0.30 1.27 0.01 182 FROM_LOCAL_NOVOWEL 1662 0.30 1.27 0.02 183 XM_OneSimpleTrick 1655 0.29 1.26 0.00 184 XMBody_17 1647 0.89 1.25 0.78 185 DOS_RCVD_IP_TWICE_B 1641 0.35 1.25 0.08 186 TR_XM_INV_DKIM 1627 0.43 1.24 0.19 187 TVD_SPACE_RATIO 1626 0.53 1.24 0.33 188 XMSubGiftCard2 1593 0.29 1.21 0.01 189 TR_XM_RelayPhish 1583 0.97 1.21 0.90 190 RCVD_IN_IADB_LISTED 1557 3.89 1.19 4.69 191 XMSubMetaSx_01 1542 0.33 1.17 0.08 192 MAILING_LIST_MULTI 1521 1.79 1.16 1.98 193 HTML_IMAGE_ONLY_16 1513 0.43 1.15 0.22 194 INVALID_MSGID 1495 1.55 1.14 1.68 195 FILL_THIS_FORM_LONG 1465 0.48 1.12 0.29 196 RCVD_IN_IADB_SPF 1409 3.36 1.07 4.04 197 DATE_IN_PAST_12_24 1408 0.29 1.07 0.06 198 XMWghtMeta_00 1390 0.27 1.06 0.03 199 CHARSET_FARAWAY 1380 0.24 1.05 0.00 200 RCVD_IN_IADB_SENDERID 1378 2.97 1.05 3.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 393770 89.61 92.88 88.64 2 DKIM_SIGNED 336048 70.95 55.05 75.65 3 XM_DK_Pass 330889 69.55 52.82 74.49 4 DKIM_VALID 314881 66.02 49.54 70.88 5 XM_B_Unicode 308812 68.31 64.23 69.52 6 DCC_CHECK_NEGATIVE 252097 48.20 19.24 56.75 7 DKIM_VALID_AU 244510 50.99 37.27 55.04 8 BAYES_50 231677 51.97 51.34 52.15 9 XMListUnsubscribeExists 224456 49.06 44.10 50.53 10 XM_B_Unicode3 188903 40.87 35.28 42.52 11 DCC_CHECK 183913 50.02 79.19 41.40 12 T_TM2_M_HEADER_IN_MSG 128926 26.49 17.93 29.02 13 HTML_FONT_LOW_CONTRAST 125451 28.89 31.07 28.24 14 DKIM_VALID_EF 122590 25.56 18.66 27.60 15 LOC_TINY_FONT_1 107390 25.50 29.98 24.17 16 MIME_HTML_ONLY 102790 29.50 51.03 23.14 17 BAYES_00 96430 17.47 3.14 21.71 18 XMSubLong 94470 21.23 21.10 21.27 19 FVGT_m_MULTI_ODD 90481 19.71 17.47 20.37 20 MultiRelay 83020 18.41 17.45 18.69 21 T_KAM_HTML_FONT_INVALID 74686 16.35 14.76 16.81 22 TR_XM_DK_Bayes 70233 12.56 1.56 15.81 23 TR_XM_DK_Bayes1 67104 11.98 1.38 15.11 24 XM_Body_Dirty_Words 61684 15.11 19.26 13.89 25 TR_XM_DK_Bayes2 60862 10.76 0.81 13.70 26 ALL_TRUSTED 60839 10.87 1.30 13.70 27 XM_Multi_Part_URI 53204 11.89 11.58 11.98 28 RCVD_IN_MSPIKE_H2 52391 10.85 7.64 11.79 29 XM_B_Unsub 47965 12.10 16.52 10.80 30 RCVD_IN_RP_SAFE 46853 8.66 2.26 10.55 31 RCVD_IN_MSPIKE_WL 44911 8.35 2.41 10.11 32 RCVD_IN_MSPIKE_H3 44712 8.32 2.41 10.07 33 XM_Evil_Numbers_Gen 43810 9.58 8.63 9.86 34 RCVD_IN_RP_CERTIFIED 41901 7.67 1.70 9.43 35 LOTS_OF_MONEY 40566 9.61 11.23 9.13 36 HTML_IMAGE_RATIO_02 38506 9.39 11.85 8.67 37 XM_DKIMWhitelistDomains 35675 6.20 0.02 8.03 38 TooManyTo_001 35506 7.46 5.64 7.99 39 T_XMDrugObfuBody_14 35289 7.85 7.53 7.94 40 LotsOfNums_01 33997 7.11 5.26 7.65 41 XM_DK_Undo_02 33485 11.22 23.67 7.54 42 FSL_BULK_SIG 32653 12.82 31.32 7.35 43 XM_H_Long_From01 29593 6.80 7.25 6.66 44 HTML_IMAGE_RATIO_04 28014 5.63 3.33 6.31 45 XM_SendGrid 27962 5.79 4.06 6.29 46 XM_B_Phish_Phrases 26387 5.72 4.96 5.94 47 BAYES_40 25093 5.41 4.62 5.65 48 RELAYCOUNTRY_META 25056 12.19 34.35 5.64 49 MIME_QP_LONG_LINE 24896 4.99 2.89 5.60 50 XMStrtUSub 23016 5.02 4.48 5.18 51 T_REMOTE_IMAGE 22884 9.18 22.80 5.15 52 XM_PDF 22151 3.98 0.59 4.99 53 BOTNET_IPINHOSTNAME 21804 8.30 19.78 4.91 54 MPART_ALT_DIFF 21620 5.40 7.22 4.87 55 DKIM_INVALID 21167 4.93 5.51 4.76 56 BAYES_60 20996 5.32 7.32 4.73 57 BAYES_20 20922 4.42 3.46 4.71 58 RCVD_IN_IADB_LISTED 20823 3.89 1.19 4.69 59 XM_UncommonTLD01 20657 10.39 29.81 4.65 60 XMSexyCombo_05 20444 6.99 15.07 4.60 61 T_TooManySym_01 20265 4.03 2.23 4.56 62 HTML_IMAGE_RATIO_06 18913 4.08 3.49 4.26 63 FROM_EXCESS_BASE64 18518 4.04 3.60 4.17 64 BAYES_99 18260 7.12 17.31 4.11 65 RCVD_IN_IADB_SPF 17948 3.36 1.07 4.04 66 XMSubMetaSx_00 17655 5.50 10.68 3.97 67 XMNumbers 16993 4.93 8.69 3.83 68 IN_ZIMBRA_NJ_WHITELIST 16693 2.90 0.02 3.76 69 RCVD_IN_IADB_SENDERID 15734 2.97 1.05 3.54 70 TR_XM_DK_SendGrid 15660 3.15 1.86 3.53 71 RCVD_IN_IADB_DK 15491 2.93 1.04 3.49 72 BAYES_999 15198 5.59 12.92 3.42 73 XM_H_Trusted_IP 13807 2.40 0.00 3.11 74 MIME_HTML_ONLY_MULTI 13771 3.11 3.14 3.10 75 RCVD_IN_IADB_VOUCHED 13199 2.37 0.33 2.97 76 XM_DIRTYINTL 12775 4.32 9.21 2.88 77 BAYES_05 12553 2.64 2.00 2.83 78 HTML_IMAGE_RATIO_08 11548 2.52 2.25 2.60 79 MIME_HTML_MOSTLY 11364 3.06 4.74 2.56 80 HTML_MIME_NO_HTML_TAG 11295 6.86 21.46 2.54 81 NO_DNS_FOR_FROM 11026 4.11 9.61 2.48 82 UNPARSEABLE_RELAY 10850 2.25 1.59 2.44 83 BAYES_80 10523 3.40 6.89 2.37 84 XM_CamelCaseFrm001 10506 2.89 4.69 2.37 85 BOTNET 10453 9.19 32.34 2.35 86 KHOP_HELO_FCRDNS 10388 5.91 18.02 2.34 87 XM_B_Unsub2 10028 2.16 1.84 2.26 88 T_TooManySym_02 10002 1.90 0.70 2.25 89 TooManyTo_002 9511 1.88 1.02 2.14 90 XM_B_SpammyTLD 9472 2.84 5.22 2.13 91 TVD_RCVD_IP 9464 1.79 0.64 2.13 92 TM2_M_URI_OPT_OUT 8883 2.18 2.77 2.00 93 MAILING_LIST_MULTI 8791 1.79 1.16 1.98 94 TR_DCC_Bayes_99 8541 4.53 13.35 1.92 95 RCVD_IN_IADB_OPTIN 8501 1.54 0.28 1.91 96 XM_SPF_SoftFail 8019 3.62 9.75 1.81 97 DKIM_ADSP_NXDOMAIN 7911 6.25 21.36 1.78 98 UNTRUSTED_Relay 7809 8.09 29.53 1.76 99 RELAYCOUNTRY_CA 7516 2.06 3.29 1.69 100 INVALID_MSGID 7448 1.55 1.14 1.68 101 ANY_BOUNCE_MESSAGE 7298 1.38 0.51 1.64 102 BOUNCE_MESSAGE 7295 1.38 0.51 1.64 103 SUBJ_ALL_CAPS 7184 1.61 1.57 1.62 104 IN_HORDE_ADDRESS_BOOK 7157 1.25 0.03 1.61 105 URI_HEX 7105 1.65 1.82 1.60 106 CK_HELO_DYNAMIC_SPLIT_IP 7084 1.37 0.62 1.59 107 HELO_DYNAMIC_IPADDR2 7082 1.29 0.27 1.59 108 TR_Symld_Words 7020 1.55 1.47 1.58 109 XM_DK_Undo_01 6911 1.37 0.74 1.56 110 XMSubNoVowel 6848 1.35 0.71 1.54 111 TO_MALFORMED 6602 2.55 6.14 1.49 112 BAYES_95 6538 1.96 3.62 1.47 113 TooManyTo_003 6431 1.30 0.79 1.45 114 T_XMDrugObfuBody_08 6417 1.58 2.03 1.44 115 HELO_NODOT 6369 1.28 0.76 1.43 116 HELO_NO_DOMAIN 6343 1.27 0.75 1.43 117 AC_FROM_MANY_DOTS 6285 1.10 0.04 1.41 118 XMDiploma_00 6254 1.58 2.15 1.41 119 XMStockSpam_06 6226 1.39 1.35 1.40 120 TM2_M_VERY_LONG_WORD 6024 1.40 1.53 1.36 121 XMBdyGiftCard01 5863 1.41 1.71 1.32 122 DIET_1 5838 1.56 2.39 1.31 123 RCVD_IN_BL_SPAMCOP_NET 5545 3.69 11.95 1.25 124 XM_OfRef6 5520 1.49 2.35 1.24 125 XMGappySubj_01 5514 1.03 0.34 1.24 126 XMHTML_After_End 5301 1.30 1.64 1.19 127 DKIM_ADSP_CUSTOM_MED 5198 1.36 2.00 1.17 128 XMSubMetaSxObfu_03 5189 1.29 1.70 1.17 129 T_FILL_THIS_FORM_SHORT 5172 1.21 1.37 1.16 130 URI_TRY_3LD 5061 1.08 0.86 1.14 131 XMCapTrack 5042 0.93 0.24 1.14 132 XM_H_Long_From02 5016 1.09 0.94 1.13 133 RELAYCOUNTRY_GB 4947 1.48 2.73 1.11 134 HTML_FONT_FACE_BAD 4943 1.00 0.63 1.11 135 XMPhish11 4903 1.15 1.30 1.10 136 XMGenDplmaNmb 4839 1.22 1.65 1.09 137 TooManyTo_004 4792 0.98 0.63 1.08 138 USER_IN_DEF_DKIM_WL 4772 0.83 0.01 1.07 139 XM_GoogleGroups 4727 0.89 0.28 1.06 140 TR_MetaPhish_Combo_01 4566 0.91 0.50 1.03 141 TR_XM_RelayPhish 4009 0.97 1.21 0.90 142 XMBody_95 3991 0.72 0.11 0.90 143 TooManyTo_005 3924 0.80 0.53 0.88 144 NML_ADSP_CUSTOM_MED 3910 1.10 1.86 0.88 145 RCVD_IN_MSPIKE_BL 3830 2.93 9.94 0.86 146 XM_UB50 3800 4.73 17.85 0.86 147 T_XMDrugObfuBody_00 3702 1.00 1.56 0.83 148 T_OBFU_PDF_ATTACH 3656 0.68 0.19 0.82 149 XMSolicitRefs_0 3619 0.77 0.64 0.81 150 FROM_GOV_DKIM_AU 3557 0.66 0.18 0.80 151 XM_ProductURIs 3471 0.82 0.93 0.78 152 XMBody_17 3449 0.89 1.25 0.78 153 HTML_IMAGE_ONLY_20 3324 0.63 0.23 0.75 154 SpammyFromTLD_01 3225 1.45 3.92 0.73 155 XMSexyCombo_01 3210 1.80 5.44 0.72 156 XM_SPF_Unknown 3142 1.20 2.89 0.71 157 PLING_QUERY 2979 0.61 0.41 0.67 158 XMHTMLBadTable_001 2902 0.70 0.86 0.65 159 XMSubMetaI_00 2868 0.85 1.54 0.65 160 XMPhish30 2757 0.66 0.81 0.62 161 HTML_TAG_BALANCE_BODY 2739 2.21 7.60 0.62 162 XM_B_REG_HTML 2692 0.53 0.27 0.61 163 XM_ShortIntro_01 2680 0.58 0.49 0.60 164 XMBrknScrpt_02 2676 0.57 0.48 0.60 165 FORGED_GMAIL_RCVD 2574 0.84 1.74 0.58 166 TR_XM_PHPDW 2494 0.78 1.50 0.56 167 XMBody_78 2484 0.55 0.52 0.56 168 XMPhish14 2408 0.53 0.51 0.54 169 TR_XM_PHPForged 2393 0.75 1.45 0.54 170 TR_XM_FormFill2 2385 0.74 1.44 0.54 171 XMNoVowels 2378 0.50 0.37 0.54 172 USER_IN_WHITELIST 2373 0.41 0.00 0.53 173 RELAYCOUNTRY_FR 2359 1.82 6.18 0.53 174 XM_H_PHPOS 2357 0.74 1.43 0.53 175 T_Symld_Words_02 2300 0.63 1.02 0.52 176 XMMoneyMeta_00 2178 0.83 2.00 0.49 177 XM_B_COPY_HTML 2172 0.51 0.58 0.49 178 T_XMHurry_00 2134 0.57 0.88 0.48 179 XMRcvdHeader_15 2093 0.36 0.00 0.47 180 SUBJ_DOLLARS 2063 0.47 0.50 0.46 181 TM2_M_A_HREF_HREF 2060 0.50 0.63 0.46 182 REMOVE_BEFORE_LINK 2043 0.46 0.44 0.46 183 RELAYCOUNTRY_AU 2032 0.43 0.33 0.46 184 XMBSHREFv2 1997 0.41 0.27 0.45 185 XM_H_PHPMailer 1973 0.56 0.96 0.44 186 HTML_IMAGE_ONLY_32 1968 0.39 0.22 0.44 187 T_TooManySym_03 1958 0.38 0.17 0.44 188 XM_Body_Obfu01 1949 0.39 0.22 0.44 189 FILL_THIS_FORM 1937 0.63 1.28 0.44 190 MISSING_HEADERS 1937 1.40 4.68 0.44 191 TM2_M_BODY_EMPTY 1933 0.37 0.15 0.44 192 T_MANY_PILL_PRICE 1914 0.33 0.00 0.43 193 HTTPS_HTTP_MISMATCH 1876 0.41 0.38 0.42 194 MPART_ALT_DIFF_COUNT 1801 0.46 0.65 0.41 195 URI_NOVOWEL 1787 1.54 5.38 0.40 196 FROM_GOV_SPOOF 1783 0.42 0.47 0.40 197 AC_DIV_BONANZA 1730 0.31 0.06 0.39 198 XM_USANA_RCVD 1709 0.30 0.00 0.38 199 XMSubMetaSxObfu_02 1708 0.35 0.25 0.38 200 XMDateMe_00 1664 0.37 0.34 0.37 ----------------------------------------------------------------------