Email: 656119 Autolearn: 0 AvgScore: 2.73 AvgScanTime: 2.27 sec Spam: 158364 Autolearn: 0 AvgScore: 14.15 AvgScanTime: 2.71 sec Ham: 497755 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 2.13 sec Time Spent Running SA: 413.25 hours Time Spent Processing Spam: 119.01 hours Time Spent Processing Ham: 294.24 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146940 89.94 92.79 89.04 2 DCC_CHECK 119578 49.91 75.51 41.76 3 XM_B_Unicode 100063 68.57 63.19 70.28 4 DKIM_SIGNED 99531 74.21 62.85 77.82 5 XM_DK_Pass 96649 72.78 61.03 76.51 6 DKIM_VALID 90762 69.20 57.31 72.99 7 XMListUnsubscribeExists 79022 52.86 49.90 53.81 8 BAYES_50 74157 52.80 46.83 54.70 9 MIME_HTML_ONLY 73364 27.62 46.33 21.67 10 DKIM_VALID_AU 70922 53.04 44.78 55.66 11 XM_B_Unicode3 68369 41.55 43.17 41.04 12 HTML_FONT_LOW_CONTRAST 49232 29.34 31.09 28.79 13 RELAYCOUNTRY_META 43915 11.12 27.73 5.84 14 XM_DK_Undo_02 43762 11.64 27.63 6.55 15 LOC_TINY_FONT_1 43075 24.45 27.20 23.57 16 FSL_BULK_SIG 41903 11.29 26.46 6.46 17 XM_UncommonTLD01 39077 8.54 24.68 3.41 18 BOTNET 37875 7.35 23.92 2.08 19 XMSubLong 37053 22.04 23.40 21.61 20 UNTRUSTED_Relay 36758 6.92 23.21 1.74 21 DKIM_VALID_EF 36530 26.39 23.07 27.44 22 BAYES_99 36315 8.16 22.93 3.46 23 DCC_CHECK_NEGATIVE 35357 47.96 22.33 56.12 24 XM_Body_Dirty_Words 35319 15.42 22.30 13.23 25 FVGT_m_MULTI_ODD 29447 21.02 18.59 21.79 26 TR_DCC_Bayes_99 28714 5.54 18.13 1.54 27 HTML_IMAGE_RATIO_02 28619 10.70 18.07 8.36 28 XM_B_Unsub 27581 12.48 17.42 10.91 29 BAYES_999 27111 6.23 17.12 2.77 30 T_TM2_M_HEADER_IN_MSG 25650 26.15 16.20 29.32 31 T_KAM_HTML_FONT_INVALID 25591 17.97 16.16 18.55 32 BOTNET_IPINHOSTNAME 24949 7.18 15.75 4.45 33 MultiRelay 24714 17.87 15.61 18.60 34 XMSexyCombo_05 24329 7.00 15.36 4.33 35 HTML_MIME_NO_HTML_TAG 23902 5.66 15.09 2.65 36 T_REMOTE_IMAGE 20625 6.33 13.02 4.20 37 XM_Multi_Part_URI 20058 12.21 12.67 12.07 38 XM_UB50 19666 3.85 12.42 1.12 39 KHOP_HELO_FCRDNS 18424 4.10 11.63 1.70 40 HTML_SHORT_LINK_IMG_1 18417 2.84 11.63 0.04 41 SpammyFromTLD_02 17178 2.85 10.85 0.31 42 RCVD_IN_MSPIKE_BL 16681 3.77 10.53 1.61 43 XM_H_Long_From01 16679 7.30 10.53 6.28 44 LOTS_OF_MONEY 16322 9.30 10.31 8.97 45 HDRS_LCASE_IMGONLY 15462 2.37 9.76 0.02 46 HTML_IMAGE_ONLY_08 15338 2.42 9.69 0.11 47 XMNumbers 14510 4.96 9.16 3.63 48 XM_Evil_Numbers_Gen 13994 9.23 8.84 9.36 49 XM_B_Phish_Phrases 13718 6.87 8.66 6.30 50 XMSubMetaSx_00 13653 5.10 8.62 3.98 51 RCVD_IN_BL_SPAMCOP_NET 13570 2.96 8.57 1.17 52 XM_DIRTYINTL 13241 4.06 8.36 2.69 53 RCVD_IN_MSPIKE_H2 13169 11.38 8.32 12.35 54 RCVD_IN_RP_RNBL 13042 2.09 8.24 0.13 55 BAYES_60 13021 5.88 8.22 5.14 56 DKIM_ADSP_NXDOMAIN 12966 2.45 8.19 0.63 57 BAYES_80 12882 4.04 8.13 2.73 58 XM_BadFromFormat 12382 1.97 7.82 0.11 59 RDNS_DYNAMIC 12332 2.13 7.79 0.34 60 MPART_ALT_DIFF 11956 5.35 7.55 4.65 61 BODY_URI_ONLY 11842 1.87 7.48 0.09 62 FROM_SUSPICIOUS_NTLD 11683 1.81 7.38 0.04 63 FROM_SUSPICIOUS_NTLD_FP 11636 1.80 7.35 0.03 64 FROM_EXCESS_BASE64 11547 4.46 7.29 3.56 65 NO_DNS_FOR_FROM 10167 2.63 6.42 1.42 66 TR_Mismatch_TLD_02 9677 1.53 6.11 0.08 67 LotsOfNums_01 9655 7.59 6.10 8.07 68 TM2_M_URI_OPT_OUT 9520 3.00 6.01 2.05 69 RCVD_IN_PSBL 9226 1.42 5.83 0.01 70 HTML_TAG_BALANCE_CENTER 9042 1.43 5.71 0.07 71 PDS_OTHER_BAD_TLD 8809 1.68 5.56 0.45 72 DKIM_INVALID 8769 5.00 5.54 4.83 73 HTML_IMAGE_RATIO_04 8351 5.79 5.27 5.95 74 MIME_HEADER_CTYPE_ONLY 8335 1.35 5.26 0.10 75 RELAYCOUNTRY_FR 8288 1.51 5.23 0.33 76 TooManyTo_001 8103 7.44 5.12 8.19 77 BAYES_95 8052 2.41 5.08 1.56 78 RCVD_IN_MSPIKE_L3 7977 2.01 5.04 1.04 79 BOTNET_NORDNS 7929 1.26 5.01 0.06 80 XM_SPF_SoftFail 7796 2.45 4.92 1.67 81 XM_B_SpammyTLD 7368 2.56 4.65 1.89 82 XMPhish11 7236 2.03 4.57 1.22 83 XMHTML_After_End 6978 1.87 4.41 1.06 84 ALL_TRUSTED 6895 11.17 4.35 13.34 85 REPLYTO_WITHOUT_TO_CC 6601 1.05 4.17 0.05 86 RCVD_IN_MSPIKE_L5 6499 1.15 4.10 0.21 87 RCVD_IN_MSPIKE_H3 6493 8.59 4.10 10.02 88 RCVD_IN_MSPIKE_WL 6493 8.59 4.10 10.02 89 MIME_HTML_MOSTLY 6417 2.85 4.05 2.47 90 XM_SendGrid 6277 5.61 3.96 6.14 91 XM_H_PHPMailer 6086 1.32 3.84 0.52 92 XMStrtUSub 6024 4.36 3.80 4.54 93 SpammyFromTLD_01 5983 1.46 3.78 0.72 94 XMSexyCombo_01 5796 1.34 3.66 0.60 95 RELAYCOUNTRY_CA 5678 2.22 3.59 1.79 96 BAYES_40 5591 5.28 3.53 5.84 97 MIME_HTML_ONLY_MULTI 5443 2.91 3.44 2.74 98 TO_EQ_FM_DOM_HTML_IMG 5414 0.84 3.42 0.02 99 XMSubPhish11 5271 0.98 3.33 0.23 100 XM_UB60 5211 0.85 3.29 0.07 101 MIME_QP_LONG_LINE 5184 5.24 3.27 5.86 102 HTML_IMAGE_RATIO_06 5108 3.61 3.23 3.73 103 DATE_IN_PAST_03_06 5059 1.01 3.19 0.31 104 XMPhish04 4980 0.76 3.14 0.00 105 XM_CamelCaseFrm001 4787 2.41 3.02 2.21 106 T_XMDrugObfuBody_08 4530 1.74 2.86 1.39 107 LongTLD 4508 0.84 2.85 0.20 108 ADMITS_SPAM 4390 0.71 2.77 0.06 109 RELAYCOUNTRY_GB 4386 1.60 2.77 1.23 110 T_TooManySym_01 4333 4.28 2.74 4.77 111 MultiRelay_Combo 4275 0.78 2.70 0.18 112 MultiRelay_CC 4275 0.78 2.70 0.18 113 DATE_IN_PAST_06_12 4237 0.69 2.68 0.06 114 XM_URI_RBL 4202 0.86 2.65 0.29 115 XMDiploma_00 3794 1.99 2.40 1.86 116 XM_B_Unsub2 3792 2.83 2.39 2.97 117 RELAYCOUNTRY_RU 3701 0.58 2.34 0.02 118 RELAYCOUNTRY_DE 3641 1.02 2.30 0.61 119 XM_OfRef6 3494 1.60 2.21 1.41 120 BAYES_20 3462 3.90 2.19 4.45 121 XM_UB99 3378 0.52 2.13 0.01 122 HDRS_MISSP 3282 0.50 2.07 0.01 123 SHORT_IMG_SUSP_NTLD 3269 0.50 2.06 0.00 124 TR_XM_RelayPhish 3138 1.17 1.98 0.91 125 HTML_IMAGE_ONLY_12 3114 0.59 1.97 0.16 126 TR_XM_DK_SendGrid 3104 3.01 1.96 3.34 127 RCVD_IN_RP_SAFE 3087 8.00 1.95 9.93 128 XMSexyCombo_04 2981 0.54 1.88 0.12 129 RELAYCOUNTRY_IN 2950 0.57 1.86 0.15 130 FROM_MISSP_REPLYTO 2947 0.45 1.86 0.01 131 XM_UB80 2944 0.46 1.86 0.02 132 HTML_FONT_SIZE_LARGE 2823 0.52 1.78 0.12 133 XMGenDplmaNmb 2748 1.34 1.74 1.21 134 URI_NOVOWEL 2712 0.64 1.71 0.30 135 TR_Symld_Words 2697 1.58 1.70 1.54 136 HTML_IMAGE_RATIO_08 2685 2.59 1.70 2.88 137 BODY_SINGLE_WORD 2662 0.41 1.68 0.01 138 XM_UB999 2660 0.41 1.68 0.01 139 BODY_SINGLE_URI 2656 0.41 1.68 0.01 140 BAYES_00 2624 14.79 1.66 18.97 141 DKIM_ADSP_CUSTOM_MED 2586 1.08 1.63 0.90 142 UNICODE_OBFU_ASC 2580 0.40 1.63 0.01 143 SUBJ_ALL_CAPS 2564 1.69 1.62 1.72 144 NO_FM_NAME_IP_HOSTN 2536 0.39 1.60 0.01 145 RCVD_IN_RP_CERTIFIED 2502 7.28 1.58 9.10 146 URIBL_DBL_ABUSE_REDIR 2486 0.39 1.57 0.01 147 TM2_M_VERY_LONG_WORD 2440 1.36 1.54 1.30 148 XM_H_Long_From02 2428 1.33 1.53 1.26 149 URI_HEX 2418 1.51 1.53 1.51 150 URI_TRY_3LD 2408 1.40 1.52 1.36 151 FORGED_GMAIL_RCVD 2398 0.72 1.51 0.47 152 TR_XM_INV_DKIM 2397 0.47 1.51 0.14 153 T_XMDrugObfuBody_14 2367 1.58 1.49 1.61 154 RCVD_IN_IADB_LISTED 2365 4.40 1.49 5.32 155 TR_XM_PHPDW 2340 0.75 1.48 0.51 156 NML_ADSP_CUSTOM_MED 2322 0.82 1.47 0.61 157 TR_XM_PHPForged 2289 0.72 1.45 0.49 158 TR_XM_FormFill2 2271 0.71 1.43 0.48 159 TR_LOTS_OF_MONEY2 2271 0.78 1.43 0.58 160 T_MONEY_PERCENT 2271 0.78 1.43 0.58 161 XM_H_PHPOS 2258 0.71 1.43 0.48 162 DIET_1 2238 0.77 1.41 0.56 163 XMStockSpam_06 2211 1.05 1.40 0.94 164 RCVD_IN_IADB_SPF 2206 3.83 1.39 4.60 165 RCVD_IN_MSPIKE_L4 2205 0.61 1.39 0.36 166 HK_RANDOM_REPLYTO 2178 0.50 1.38 0.21 167 RCVD_IN_IADB_DK 2158 3.32 1.36 3.95 168 RCVD_IN_IADB_SENDERID 2144 3.37 1.35 4.01 169 XMSubMetaI_00 2126 0.86 1.34 0.71 170 NORDNS_LOW_CONTRAST 2071 0.32 1.31 0.00 171 T_XMDrugObfuBody_00 2070 0.96 1.31 0.85 172 MSGID_FROM_MTA_HEADER 2047 0.46 1.29 0.20 173 FSL_THIS_IS_ADV 2013 0.51 1.27 0.27 174 PLING_QUERY 1986 0.72 1.25 0.55 175 MAILING_LIST_MULTI 1955 1.97 1.23 2.20 176 XMPhish14 1900 0.60 1.20 0.41 177 TooManyTo_002 1872 2.01 1.18 2.27 178 RELAYCOUNTRY_SE 1859 0.30 1.17 0.02 179 FROM_MISSP_DYNIP 1853 0.28 1.17 0.00 180 HTML_EXTRA_CLOSE 1851 0.30 1.17 0.02 181 HK_RANDOM_FROM 1832 0.37 1.16 0.12 182 XMSlimDrugH 1825 0.59 1.15 0.41 183 XMSubMetaSSx_00 1822 0.59 1.15 0.42 184 BAYES_05 1810 2.44 1.14 2.86 185 XM_ProductURIs 1763 0.99 1.11 0.95 186 DATE_IN_PAST_12_24 1744 0.30 1.10 0.04 187 URIBL_DBL_SPAM 1683 0.28 1.06 0.03 188 FROM_NTLD_LINKBAIT 1662 0.25 1.05 0.00 189 RELAYCOUNTRY_NL 1653 0.37 1.04 0.16 190 TR_XM_DK_Bayes 1630 11.44 1.03 14.75 191 TR_MetaPhish_Combo_01 1606 1.05 1.01 1.06 192 XMBody_78 1584 0.66 1.00 0.56 193 XM_DK_Undo_01 1551 1.46 0.98 1.62 194 TooManyTo_003 1511 1.37 0.95 1.50 195 MPART_ALT_DIFF_COUNT 1467 0.48 0.93 0.34 196 TR_XM_DK_Bayes1 1448 10.94 0.91 14.13 197 T_XMHurry_00 1412 0.63 0.89 0.55 198 REMOVE_BEFORE_LINK 1409 0.57 0.89 0.47 199 XMBody_17 1408 0.87 0.89 0.86 200 T_TooManySym_02 1386 2.01 0.88 2.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 443206 89.94 92.79 89.04 2 DKIM_SIGNED 387349 74.21 62.85 77.82 3 XM_DK_Pass 380846 72.78 61.03 76.51 4 DKIM_VALID 363295 69.20 57.31 72.99 5 XM_B_Unicode 349822 68.57 63.19 70.28 6 DCC_CHECK_NEGATIVE 279324 47.96 22.33 56.12 7 DKIM_VALID_AU 277061 53.04 44.78 55.66 8 BAYES_50 272269 52.80 46.83 54.70 9 XMListUnsubscribeExists 267820 52.86 49.90 53.81 10 DCC_CHECK 207878 49.91 75.51 41.76 11 XM_B_Unicode3 204276 41.55 43.17 41.04 12 T_TM2_M_HEADER_IN_MSG 145931 26.15 16.20 29.32 13 HTML_FONT_LOW_CONTRAST 143299 29.34 31.09 28.79 14 DKIM_VALID_EF 136599 26.39 23.07 27.44 15 LOC_TINY_FONT_1 117323 24.45 27.20 23.57 16 FVGT_m_MULTI_ODD 108484 21.02 18.59 21.79 17 MIME_HTML_ONLY 107875 27.62 46.33 21.67 18 XMSubLong 107584 22.04 23.40 21.61 19 BAYES_00 94440 14.79 1.66 18.97 20 MultiRelay 92561 17.87 15.61 18.60 21 T_KAM_HTML_FONT_INVALID 92311 17.97 16.16 18.55 22 TR_XM_DK_Bayes 73406 11.44 1.03 14.75 23 TR_XM_DK_Bayes1 70310 10.94 0.91 14.13 24 ALL_TRUSTED 66402 11.17 4.35 13.34 25 XM_Body_Dirty_Words 65838 15.42 22.30 13.23 26 TR_XM_DK_Bayes2 62775 9.74 0.70 12.61 27 RCVD_IN_MSPIKE_H2 61489 11.38 8.32 12.35 28 XM_Multi_Part_URI 60075 12.21 12.67 12.07 29 XM_B_Unsub 54293 12.48 17.42 10.91 30 RCVD_IN_MSPIKE_H3 49853 8.59 4.10 10.02 31 RCVD_IN_MSPIKE_WL 49853 8.59 4.10 10.02 32 RCVD_IN_RP_SAFE 49427 8.00 1.95 9.93 33 XM_Evil_Numbers_Gen 46579 9.23 8.84 9.36 34 RCVD_IN_RP_CERTIFIED 45273 7.28 1.58 9.10 35 LOTS_OF_MONEY 44666 9.30 10.31 8.97 36 HTML_IMAGE_RATIO_02 41598 10.70 18.07 8.36 37 TooManyTo_001 40744 7.44 5.12 8.19 38 LotsOfNums_01 40147 7.59 6.10 8.07 39 XM_DKIMWhitelistDomains 37180 5.67 0.02 7.47 40 XM_DK_Undo_02 32608 11.64 27.63 6.55 41 FSL_BULK_SIG 32161 11.29 26.46 6.46 42 XM_B_Phish_Phrases 31365 6.87 8.66 6.30 43 XM_H_Long_From01 31244 7.30 10.53 6.28 44 XM_SendGrid 30545 5.61 3.96 6.14 45 HTML_IMAGE_RATIO_04 29628 5.79 5.27 5.95 46 MIME_QP_LONG_LINE 29176 5.24 3.27 5.86 47 RELAYCOUNTRY_META 29069 11.12 27.73 5.84 48 BAYES_40 29065 5.28 3.53 5.84 49 RCVD_IN_IADB_LISTED 26472 4.40 1.49 5.32 50 BAYES_60 25576 5.88 8.22 5.14 51 DKIM_INVALID 24054 5.00 5.54 4.83 52 T_TooManySym_01 23728 4.28 2.74 4.77 53 XM_PDF 23394 3.71 0.60 4.70 54 MPART_ALT_DIFF 23137 5.35 7.55 4.65 55 RCVD_IN_IADB_SPF 22918 3.83 1.39 4.60 56 XMStrtUSub 22575 4.36 3.80 4.54 57 BOTNET_IPINHOSTNAME 22164 7.18 15.75 4.45 58 BAYES_20 22127 3.90 2.19 4.45 59 XMSexyCombo_05 21577 7.00 15.36 4.33 60 T_REMOTE_IMAGE 20908 6.33 13.02 4.20 61 RCVD_IN_IADB_SENDERID 19953 3.37 1.35 4.01 62 XMSubMetaSx_00 19812 5.10 8.62 3.98 63 RCVD_IN_IADB_DK 19638 3.32 1.36 3.95 64 HTML_IMAGE_RATIO_06 18549 3.61 3.23 3.73 65 IN_ZIMBRA_NJ_WHITELIST 18391 2.81 0.03 3.69 66 XMNumbers 18050 4.96 9.16 3.63 67 FROM_EXCESS_BASE64 17734 4.46 7.29 3.56 68 BAYES_99 17199 8.16 22.93 3.46 69 RCVD_IN_IADB_VOUCHED 17045 2.70 0.43 3.42 70 XM_UncommonTLD01 16974 8.54 24.68 3.41 71 TR_XM_DK_SendGrid 16623 3.01 1.96 3.34 72 XM_B_Unsub2 14777 2.83 2.39 2.97 73 HTML_IMAGE_RATIO_08 14323 2.59 1.70 2.88 74 BAYES_05 14216 2.44 1.14 2.86 75 BAYES_999 13790 6.23 17.12 2.77 76 MIME_HTML_ONLY_MULTI 13619 2.91 3.44 2.74 77 BAYES_80 13597 4.04 8.13 2.73 78 XM_DIRTYINTL 13376 4.06 8.36 2.69 79 HTML_MIME_NO_HTML_TAG 13203 5.66 15.09 2.65 80 MIME_HTML_MOSTLY 12312 2.85 4.05 2.47 81 T_TooManySym_02 11829 2.01 0.88 2.38 82 ANY_BOUNCE_MESSAGE 11709 1.93 0.61 2.35 83 BOUNCE_MESSAGE 11706 1.93 0.60 2.35 84 TooManyTo_002 11287 2.01 1.18 2.27 85 XM_CamelCaseFrm001 10996 2.41 3.02 2.21 86 MAILING_LIST_MULTI 10970 1.97 1.23 2.20 87 UNPARSEABLE_RELAY 10842 1.81 0.66 2.18 88 RCVD_IN_IADB_OPTIN 10767 1.70 0.25 2.16 89 BOTNET 10377 7.35 23.92 2.08 90 TM2_M_URI_OPT_OUT 10194 3.00 6.01 2.05 91 XM_B_SpammyTLD 9426 2.56 4.65 1.89 92 XMDiploma_00 9255 1.99 2.40 1.86 93 RELAYCOUNTRY_CA 8909 2.22 3.59 1.79 94 UNTRUSTED_Relay 8648 6.92 23.21 1.74 95 SUBJ_ALL_CAPS 8547 1.69 1.62 1.72 96 XM_H_Trusted_IP 8539 1.30 0.00 1.72 97 KHOP_HELO_FCRDNS 8448 4.10 11.63 1.70 98 HELO_NODOT 8306 1.38 0.46 1.67 99 XM_SPF_SoftFail 8291 2.45 4.92 1.67 100 HELO_NO_DOMAIN 8264 1.37 0.46 1.66 101 XM_DK_Undo_01 8042 1.46 0.98 1.62 102 RCVD_IN_MSPIKE_BL 8032 3.77 10.53 1.61 103 T_XMDrugObfuBody_14 8017 1.58 1.49 1.61 104 IN_HORDE_ADDRESS_BOOK 7886 1.23 0.11 1.58 105 BAYES_95 7774 2.41 5.08 1.56 106 TVD_RCVD_IP 7700 1.32 0.59 1.55 107 TR_Symld_Words 7672 1.58 1.70 1.54 108 TR_DCC_Bayes_99 7647 5.54 18.13 1.54 109 INVALID_MSGID 7553 1.19 0.17 1.52 110 URI_HEX 7511 1.51 1.53 1.51 111 TooManyTo_003 7473 1.37 0.95 1.50 112 NO_DNS_FOR_FROM 7059 2.63 6.42 1.42 113 XM_OfRef6 7004 1.60 2.21 1.41 114 T_XMDrugObfuBody_08 6904 1.74 2.86 1.39 115 URI_TRY_3LD 6792 1.40 1.52 1.36 116 XMBdyGiftCard01 6642 1.21 0.80 1.33 117 TO_MALFORMED 6565 1.20 0.83 1.32 118 XMCapTrack 6518 1.07 0.31 1.31 119 TM2_M_VERY_LONG_WORD 6454 1.36 1.54 1.30 120 XM_H_Long_From02 6280 1.33 1.53 1.26 121 CK_HELO_DYNAMIC_SPLIT_IP 6138 0.99 0.23 1.23 122 HELO_DYNAMIC_IPADDR2 6136 0.97 0.15 1.23 123 RELAYCOUNTRY_GB 6105 1.60 2.77 1.23 124 XMPhish11 6054 2.03 4.57 1.22 125 XMGenDplmaNmb 6035 1.34 1.74 1.21 126 USER_IN_DEF_DKIM_WL 5877 0.90 0.00 1.18 127 XM_GoogleGroups 5856 0.97 0.32 1.18 128 RCVD_IN_BL_SPAMCOP_NET 5825 2.96 8.57 1.17 129 XMGappySubj_01 5721 0.94 0.26 1.15 130 T_FILL_THIS_FORM_SHORT 5634 1.05 0.81 1.13 131 XM_UB50 5585 3.85 12.42 1.12 132 TooManyTo_004 5431 1.02 0.78 1.09 133 XMHTML_After_End 5281 1.87 4.41 1.06 134 TR_MetaPhish_Combo_01 5273 1.05 1.01 1.06 135 RCVD_IN_MSPIKE_L3 5197 2.01 5.04 1.04 136 XM_ProductURIs 4722 0.99 1.11 0.95 137 XMStockSpam_06 4670 1.05 1.40 0.94 138 FROM_GOV_DKIM_AU 4550 0.74 0.18 0.91 139 TR_XM_RelayPhish 4543 1.17 1.98 0.91 140 DKIM_ADSP_CUSTOM_MED 4500 1.08 1.63 0.90 141 TooManyTo_005 4442 0.84 0.66 0.89 142 XMBody_17 4270 0.87 0.89 0.86 143 T_XMDrugObfuBody_00 4216 0.96 1.31 0.85 144 XMMoneyMeta_00 4105 0.79 0.67 0.82 145 HTML_FONT_FACE_BAD 4000 0.72 0.46 0.80 146 SpammyFromTLD_01 3586 1.46 3.78 0.72 147 XMBrknScrpt_02 3543 0.71 0.71 0.71 148 XMSubMetaI_00 3522 0.86 1.34 0.71 149 XMBody_95 3477 0.55 0.09 0.70 150 XMHTMLBadTable_001 3439 0.64 0.46 0.69 151 HTML_TAG_BALANCE_BODY 3389 0.65 0.55 0.68 152 T_Symld_Words_02 3342 0.70 0.79 0.67 153 XM_SPF_Unknown 3309 0.71 0.87 0.66 154 HTTPS_HTTP_MISMATCH 3249 0.63 0.54 0.65 155 DKIM_ADSP_NXDOMAIN 3135 2.45 8.19 0.63 156 TM2_M_A_HREF_HREF 3092 0.61 0.59 0.62 157 NML_ADSP_CUSTOM_MED 3036 0.82 1.47 0.61 158 RELAYCOUNTRY_DE 3023 1.02 2.30 0.61 159 XMSexyCombo_01 2978 1.34 3.66 0.60 160 T_OBFU_PDF_ATTACH 2941 0.49 0.17 0.59 161 FILL_THIS_FORM 2896 0.52 0.33 0.58 162 RELAYCOUNTRY_AU 2895 0.53 0.39 0.58 163 XMNoVowels 2890 0.60 0.67 0.58 164 TR_LOTS_OF_MONEY2 2873 0.78 1.43 0.58 165 T_MONEY_PERCENT 2873 0.78 1.43 0.58 166 DIET_1 2799 0.77 1.41 0.56 167 XM_B_REG_HTML 2783 0.49 0.27 0.56 168 XMBody_78 2777 0.66 1.00 0.56 169 PLING_QUERY 2751 0.72 1.25 0.55 170 T_XMHurry_00 2750 0.63 0.89 0.55 171 XM_Body_Obfu01 2653 0.46 0.24 0.53 172 LOW_PRICE 2650 0.57 0.71 0.53 173 XM_H_PHPMailer 2588 1.32 3.84 0.52 174 T_TooManySym_03 2567 0.47 0.34 0.52 175 TR_XM_PHPDW 2560 0.75 1.48 0.51 176 USER_IN_WHITELIST 2545 0.39 0.00 0.51 177 XMSubMetaSxObfu_03 2511 0.57 0.79 0.50 178 XM_ShortIntro_01 2509 0.52 0.55 0.50 179 XMSubNoVowel 2462 0.47 0.40 0.49 180 TR_XM_PHPForged 2425 0.72 1.45 0.49 181 TR_XM_FormFill2 2409 0.71 1.43 0.48 182 XM_H_PHPOS 2384 0.71 1.43 0.48 183 AC_DIV_BONANZA 2363 0.38 0.09 0.47 184 REMOVE_BEFORE_LINK 2348 0.57 0.89 0.47 185 XMPhish30 2328 0.56 0.84 0.47 186 FORGED_GMAIL_RCVD 2321 0.72 1.51 0.47 187 FILL_THIS_FORM_LONG 2314 0.42 0.27 0.46 188 T_FILL_THIS_FORM_LOAN 2282 0.41 0.25 0.46 189 PDS_OTHER_BAD_TLD 2230 1.68 5.56 0.45 190 SHORT_HELO_AND_INLINE_IMAGE 2207 0.34 0.02 0.44 191 FROM_GOV_SPOOF 2186 0.38 0.21 0.44 192 MISSING_HEADERS 2184 0.46 0.51 0.44 193 TM2_M_BODY_EMPTY 2094 0.34 0.10 0.42 194 XMSubMetaSxObfu_02 2089 0.41 0.39 0.42 195 RCVD_IN_SORBS_DUL 2085 0.37 0.21 0.42 196 HTML_IMAGE_ONLY_20 2073 0.46 0.59 0.42 197 XMSubMetaSSx_00 2072 0.59 1.15 0.42 198 XMPhish14 2059 0.60 1.20 0.41 199 XMSlimDrugH 2037 0.59 1.15 0.41 200 TR_LOTS_OF_MONEY3 2001 0.50 0.81 0.40 ----------------------------------------------------------------------