Email: 335449 Autolearn: 0 AvgScore: 1.16 AvgScanTime: 2.15 sec Spam: 63461 Autolearn: 0 AvgScore: 12.80 AvgScanTime: 2.88 sec Ham: 271988 Autolearn: 0 AvgScore: -1.56 AvgScanTime: 1.98 sec Time Spent Running SA: 200.37 hours Time Spent Processing Spam: 50.83 hours Time Spent Processing Ham: 149.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 57640 88.74 90.83 88.26 2 DCC_CHECK 48042 57.87 75.70 53.71 3 DKIM_SIGNED 48040 81.56 75.70 82.93 4 XM_DK_Pass 46175 80.14 72.76 81.86 5 XM_B_Unicode 46161 75.63 72.74 76.30 6 DKIM_VALID 43011 76.59 67.78 78.65 7 XMListUnsubscribeExists 40225 61.74 63.39 61.36 8 DKIM_VALID_AU 33911 63.68 53.44 66.07 9 XM_B_Unicode3 30292 48.71 47.73 48.93 10 BAYES_50 30268 52.10 47.70 53.13 11 HTML_FONT_LOW_CONTRAST 22235 35.83 35.04 36.01 12 XM_DK_Undo_02 22145 13.82 34.90 8.90 13 MIME_HTML_ONLY 21796 26.65 34.35 24.85 14 LOC_TINY_FONT_1 20789 32.08 32.76 31.92 15 FVGT_m_MULTI_ODD 16083 22.65 25.34 22.02 16 BAYES_99 15953 9.21 25.14 5.49 17 RELAYCOUNTRY_META 15112 8.60 23.81 5.05 18 DCC_CHECK_NEGATIVE 14488 40.86 22.83 45.06 19 DKIM_VALID_EF 14341 26.61 22.60 27.55 20 XMSubLong 14204 22.03 22.38 21.95 21 XM_Body_Dirty_Words 14161 18.56 22.31 17.69 22 MultiRelay 13485 17.00 21.25 16.01 23 BOTNET 13048 5.85 20.56 2.41 24 BAYES_999 12268 7.41 19.33 4.62 25 XM_Multi_Part_URI 12154 15.53 19.15 14.68 26 TR_DCC_Bayes_99 11749 6.08 18.51 3.18 27 XM_UncommonTLD01 11603 7.32 18.28 4.77 28 T_KAM_HTML_FONT_INVALID 11494 17.34 18.11 17.16 29 BOTNET_IPINHOSTNAME 11460 8.35 18.06 6.09 30 FSL_BULK_SIG 11225 10.72 17.69 9.09 31 HTML_IMAGE_RATIO_02 9975 12.44 15.72 11.67 32 T_TM2_M_HEADER_IN_MSG 9732 20.82 15.34 22.10 33 XM_B_Unsub 9363 11.70 14.75 10.99 34 UNTRUSTED_Relay 8295 3.75 13.07 1.58 35 LOTS_OF_MONEY 8168 10.22 12.87 9.61 36 XMSexyCombo_05 7377 7.46 11.62 6.49 37 XM_Evil_Numbers_Gen 6989 11.98 11.01 12.20 38 RCVD_IN_MSPIKE_H2 6643 12.40 10.47 12.85 39 XMNumbers 6333 5.69 9.98 4.69 40 SpammyFromTLD_02 6072 1.95 9.57 0.17 41 MPART_ALT_DIFF 5729 5.64 9.03 4.85 42 XMSubMetaSx_00 5673 5.78 8.94 5.05 43 XM_UB50 5082 2.15 8.01 0.79 44 XM_DIRTYINTL 5072 4.77 7.99 4.02 45 DKIM_INVALID 5029 4.97 7.92 4.28 46 TooManyTo_001 4842 6.57 7.63 6.32 47 MIME_HTML_MOSTLY 4708 4.51 7.42 3.83 48 XM_B_Phish_Phrases 4676 8.19 7.37 8.38 49 BAYES_80 4473 3.53 7.05 2.71 50 T_REMOTE_IMAGE 4433 3.70 6.99 2.93 51 HTML_IMAGE_RATIO_04 4399 7.84 6.93 8.06 52 FROM_EXCESS_BASE64 4350 5.68 6.85 5.41 53 RCVD_IN_BL_SPAMCOP_NET 4021 2.16 6.34 1.19 54 LotsOfNums_01 3981 7.15 6.27 7.36 55 XMStrtUSub 3949 6.76 6.22 6.88 56 BAYES_60 3948 5.35 6.22 5.15 57 XM_SendGrid 3800 6.73 5.99 6.91 58 XM_H_Long_From01 3762 6.34 5.93 6.44 59 REPLYTO_WITHOUT_TO_CC 3755 1.14 5.92 0.02 60 HTML_SHORT_LINK_IMG_1 3751 1.15 5.91 0.03 61 RCVD_IN_RP_RNBL 3674 1.19 5.79 0.12 62 KHOP_HELO_FCRDNS 3537 1.76 5.57 0.87 63 RELAYCOUNTRY_CA 3502 2.85 5.52 2.23 64 TM2_M_URI_OPT_OUT 3415 2.85 5.38 2.26 65 HDRS_LCASE_IMGONLY 3341 1.01 5.26 0.02 66 MIME_HEADER_CTYPE_ONLY 3227 1.11 5.09 0.18 67 TO_EQ_FM_DOM_HTML_IMG 3170 0.95 5.00 0.00 68 RCVD_IN_PSBL 3085 0.93 4.86 0.01 69 XM_CamelCaseFrm001 3031 3.08 4.78 2.68 70 ALL_TRUSTED 2925 10.41 4.61 11.76 71 HTML_IMAGE_ONLY_08 2827 0.92 4.45 0.10 72 RCVD_IN_MSPIKE_BL 2805 2.46 4.42 2.00 73 XM_SPF_SoftFail 2719 1.68 4.28 1.07 74 XM_H_PHPMailer 2636 1.20 4.15 0.52 75 BAYES_95 2519 2.10 3.97 1.66 76 XM_B_SpammyTLD 2419 2.49 3.81 2.18 77 TR_Symld_Words 2320 1.69 3.66 1.23 78 RELAYCOUNTRY_GB 2304 1.11 3.63 0.52 79 XMSexyCombo_01 2303 1.55 3.63 1.06 80 BOTNET_NORDNS 2243 0.68 3.53 0.01 81 T_MONEY_PERCENT 2221 1.10 3.50 0.54 82 TR_LOTS_OF_MONEY2 2221 1.10 3.50 0.54 83 HTML_IMAGE_RATIO_06 2203 4.04 3.47 4.17 84 RCVD_IN_MSPIKE_H3 2120 10.01 3.34 11.57 85 RCVD_IN_MSPIKE_WL 2120 10.01 3.34 11.57 86 MIME_HTML_ONLY_MULTI 2107 2.79 3.32 2.67 87 DIET_1 2058 1.11 3.24 0.61 88 MIME_QP_LONG_LINE 2057 3.86 3.24 4.01 89 TM2_M_VERY_LONG_WORD 2041 1.83 3.22 1.50 90 FROM_SUSPICIOUS_NTLD 2030 0.63 3.20 0.03 91 XMPhish11 2029 1.65 3.20 1.28 92 BAYES_40 2019 4.60 3.18 4.93 93 FROM_SUSPICIOUS_NTLD_FP 2012 0.62 3.17 0.03 94 PDS_OTHER_BAD_TLD 2009 1.16 3.17 0.70 95 XMHTML_After_End 1992 1.25 3.14 0.81 96 MultiRelay_CC 1946 0.71 3.07 0.16 97 MultiRelay_Combo 1946 0.71 3.07 0.16 98 TR_XM_DK_SendGrid 1941 3.87 3.06 4.06 99 RCVD_IN_MSPIKE_L3 1903 1.89 3.00 1.63 100 T_TooManySym_01 1897 6.79 2.99 7.68 101 XM_URI_RBL 1850 0.86 2.92 0.38 102 HTML_MIME_NO_HTML_TAG 1833 1.78 2.89 1.52 103 SpammyFromTLD_01 1758 0.81 2.77 0.35 104 TR_XM_PHPDW 1728 0.87 2.72 0.44 105 HTML_IMAGE_RATIO_08 1720 4.04 2.71 4.35 106 XMDiploma_00 1666 1.60 2.63 1.36 107 TR_XM_PHPForged 1656 0.83 2.61 0.41 108 TR_XM_FormFill2 1655 0.82 2.61 0.41 109 XM_H_PHPOS 1638 0.81 2.58 0.40 110 NO_DNS_FOR_FROM 1620 2.33 2.55 2.28 111 BAYES_20 1578 3.73 2.49 4.02 112 RELAYCOUNTRY_FR 1576 0.69 2.48 0.27 113 TR_Mismatch_TLD_02 1574 0.51 2.48 0.05 114 URI_HEX 1563 1.52 2.46 1.31 115 BAYES_00 1542 16.76 2.43 20.11 116 T_XMDrugObfuBody_08 1535 1.42 2.42 1.19 117 TR_XM_INV_DKIM 1520 0.61 2.40 0.19 118 XM_OfRef6 1461 1.95 2.30 1.87 119 XMBody_17 1387 1.26 2.19 1.05 120 XMSlimDrugH 1353 0.62 2.13 0.26 121 T_XMDrugObfuBody_14 1352 1.73 2.13 1.64 122 RCVD_IN_RP_SAFE 1340 12.65 2.11 15.11 123 URIBL_SBL_A 1309 0.59 2.06 0.25 124 TR_Mismatch_TLD_01 1245 0.64 1.96 0.33 125 XMBdyGiftCard01 1227 2.67 1.93 2.84 126 XM_B_Unsub2 1210 1.25 1.91 1.10 127 XMPhish04 1201 0.36 1.89 0.00 128 XMGenDplmaNmb 1200 1.08 1.89 0.90 129 XM_H_PHPOS_M 1197 0.50 1.89 0.17 130 XMStockSpam_06 1196 2.16 1.88 2.22 131 RELAYCOUNTRY_DE 1135 0.61 1.79 0.34 132 XMWghtMeta_00 1116 0.37 1.76 0.05 133 RCVD_IN_RP_CERTIFIED 1114 11.67 1.76 13.98 134 SUBJ_ALL_CAPS 1094 1.25 1.72 1.14 135 TR_XM_RelayPhish 1092 1.09 1.72 0.94 136 RELAYCOUNTRY_KR 1080 0.33 1.70 0.01 137 RDNS_DYNAMIC 1077 0.68 1.70 0.45 138 XMSexyCombo_04 1052 0.45 1.66 0.17 139 DKIM_ADSP_NXDOMAIN 1052 1.49 1.66 1.45 140 DEAR_SOMETHING 1039 0.40 1.64 0.11 141 XM_ProductURIs 1036 1.13 1.63 1.01 142 TR_XM_DK_Bayes 1033 14.53 1.63 17.54 143 XM_SPF_Unknown 1024 0.66 1.61 0.43 144 ADVANCE_FEE_4_NEW_MONEY 1015 0.30 1.60 0.00 145 XMSubMetaI_00 1003 1.17 1.58 1.07 146 LongTLD 1001 0.41 1.58 0.13 147 RCVD_IN_IADB_LISTED 960 2.89 1.51 3.22 148 DATE_IN_PAST_03_06 948 0.36 1.49 0.10 149 BAYES_05 941 2.25 1.48 2.43 150 TR_LOTS_OF_MONEY3 938 0.65 1.48 0.46 151 URI_TRY_3LD 931 1.39 1.47 1.37 152 HK_RANDOM_REPLYTO 931 0.43 1.47 0.19 153 DATE_IN_PAST_06_12 927 0.33 1.46 0.07 154 T_XMHurry_00 907 0.85 1.43 0.71 155 XM_UB60 891 0.31 1.40 0.05 156 TR_XM_DK_Bayes1 881 13.97 1.39 16.91 157 RCVD_IN_IADB_SPF 875 2.50 1.38 2.76 158 DKIM_ADSP_CUSTOM_MED 868 1.03 1.37 0.95 159 RCVD_IN_IADB_SENDERID 864 2.24 1.36 2.45 160 RCVD_IN_IADB_DK 861 2.19 1.36 2.38 161 XMSlimDrugs 860 0.27 1.36 0.02 162 HTML_TAG_BALANCE_CENTER 844 0.33 1.33 0.09 163 URIBL_BLACK 832 0.26 1.31 0.01 164 UNPARSEABLE_RELAY 820 3.17 1.29 3.61 165 PLING_QUERY 807 0.61 1.27 0.46 166 NML_ADSP_CUSTOM_MED 804 0.78 1.27 0.66 167 BODY_URI_ONLY 785 0.26 1.24 0.04 168 MAILING_LIST_MULTI 782 1.75 1.23 1.87 169 TR_XM_DK_Bayes2 781 13.30 1.23 16.12 170 FORGED_GMAIL_RCVD 774 0.69 1.22 0.56 171 XM_B_COPY_HTML 767 0.71 1.21 0.60 172 MPART_ALT_DIFF_COUNT 765 0.53 1.21 0.37 173 XMPhish30 738 0.71 1.16 0.60 174 RCVD_IN_MSPIKE_L5 719 0.38 1.13 0.20 175 HTML_IMAGE_ONLY_04 696 0.25 1.10 0.05 176 TooManyTo_002 685 1.17 1.08 1.20 177 URIBL_DBL_SPAM 682 0.24 1.07 0.05 178 URIBL_DBL_ABUSE_REDIR 671 0.20 1.06 0.00 179 XMGppyBdWords 670 0.34 1.06 0.18 180 T_TooManySym_02 667 3.01 1.05 3.47 181 TR_MetaPhish_Combo_01 665 0.80 1.05 0.74 182 XMNoVowels 659 0.59 1.04 0.48 183 THIS_AD 647 0.35 1.02 0.19 184 LOW_PRICE 642 0.30 1.01 0.14 185 XMBrknScrpt_02 641 1.60 1.01 1.74 186 T_FILL_THIS_FORM_SHORT 631 0.98 0.99 0.97 187 XM_UB99 627 0.19 0.99 0.01 188 LONG_HEX_URI 620 0.34 0.98 0.19 189 T_Symld_Words_02 619 0.65 0.98 0.57 190 RELAYCOUNTRY_AT 619 0.52 0.98 0.41 191 XM_DK_Undo_01 619 1.29 0.98 1.36 192 TooManyTo_003 598 0.86 0.94 0.84 193 T_XMDrugObfuBody_00 594 0.63 0.94 0.56 194 XMSubMetaSSx_00 591 0.56 0.93 0.47 195 HTML_FONT_FACE_BAD 588 0.96 0.93 0.97 196 HTML_IMAGE_ONLY_12 587 0.26 0.92 0.11 197 FROM_MISSP_REPLYTO 586 0.18 0.92 0.01 198 XM_H_Long_From02 583 1.16 0.92 1.22 199 HK_RANDOM_FROM 565 0.25 0.89 0.10 200 MISSING_HEADERS 555 0.40 0.87 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 240051 88.74 90.83 88.26 2 DKIM_SIGNED 225565 81.56 75.70 82.93 3 XM_DK_Pass 222641 80.14 72.76 81.86 4 DKIM_VALID 213924 76.59 67.78 78.65 5 XM_B_Unicode 207533 75.63 72.74 76.30 6 DKIM_VALID_AU 179690 63.68 53.44 66.07 7 XMListUnsubscribeExists 166892 61.74 63.39 61.36 8 DCC_CHECK 146093 57.87 75.70 53.71 9 BAYES_50 144506 52.10 47.70 53.13 10 XM_B_Unicode3 133092 48.71 47.73 48.93 11 DCC_CHECK_NEGATIVE 122561 40.86 22.83 45.06 12 HTML_FONT_LOW_CONTRAST 97948 35.83 35.04 36.01 13 LOC_TINY_FONT_1 86825 32.08 32.76 31.92 14 DKIM_VALID_EF 74935 26.61 22.60 27.55 15 MIME_HTML_ONLY 67599 26.65 34.35 24.85 16 T_TM2_M_HEADER_IN_MSG 60099 20.82 15.34 22.10 17 FVGT_m_MULTI_ODD 59887 22.65 25.34 22.02 18 XMSubLong 59711 22.03 22.38 21.95 19 BAYES_00 54688 16.76 2.43 20.11 20 XM_Body_Dirty_Words 48104 18.56 22.31 17.69 21 TR_XM_DK_Bayes 47708 14.53 1.63 17.54 22 T_KAM_HTML_FONT_INVALID 46666 17.34 18.11 17.16 23 TR_XM_DK_Bayes1 45982 13.97 1.39 16.91 24 TR_XM_DK_Bayes2 43841 13.30 1.23 16.12 25 MultiRelay 43557 17.00 21.25 16.01 26 RCVD_IN_RP_SAFE 41093 12.65 2.11 15.11 27 XM_Multi_Part_URI 39931 15.53 19.15 14.68 28 RCVD_IN_RP_CERTIFIED 38035 11.67 1.76 13.98 29 RCVD_IN_MSPIKE_H2 34955 12.40 10.47 12.85 30 XM_DKIMWhitelistDomains 33280 9.93 0.03 12.24 31 XM_Evil_Numbers_Gen 33190 11.98 11.01 12.20 32 ALL_TRUSTED 31980 10.41 4.61 11.76 33 HTML_IMAGE_RATIO_02 31739 12.44 15.72 11.67 34 RCVD_IN_MSPIKE_WL 31469 10.01 3.34 11.57 35 RCVD_IN_MSPIKE_H3 31467 10.01 3.34 11.57 36 XM_B_Unsub 29900 11.70 14.75 10.99 37 LOTS_OF_MONEY 26125 10.22 12.87 9.61 38 FSL_BULK_SIG 24733 10.72 17.69 9.09 39 XM_DK_Undo_02 24203 13.82 34.90 8.90 40 XM_B_Phish_Phrases 22795 8.19 7.37 8.38 41 HTML_IMAGE_RATIO_04 21915 7.84 6.93 8.06 42 T_TooManySym_01 20886 6.79 2.99 7.68 43 LotsOfNums_01 20007 7.15 6.27 7.36 44 XM_SendGrid 18789 6.73 5.99 6.91 45 XMStrtUSub 18712 6.76 6.22 6.88 46 XMSexyCombo_05 17651 7.46 11.62 6.49 47 XM_H_Long_From01 17507 6.34 5.93 6.44 48 TooManyTo_001 17200 6.57 7.63 6.32 49 BOTNET_IPINHOSTNAME 16564 8.35 18.06 6.09 50 BAYES_99 14934 9.21 25.14 5.49 51 FROM_EXCESS_BASE64 14701 5.68 6.85 5.41 52 BAYES_60 14007 5.35 6.22 5.15 53 RELAYCOUNTRY_META 13746 8.60 23.81 5.05 54 XMSubMetaSx_00 13729 5.78 8.94 5.05 55 BAYES_40 13416 4.60 3.18 4.93 56 MPART_ALT_DIFF 13205 5.64 9.03 4.85 57 XM_UncommonTLD01 12965 7.32 18.28 4.77 58 XMNumbers 12757 5.69 9.98 4.69 59 BAYES_999 12573 7.41 19.33 4.62 60 HTML_IMAGE_RATIO_08 11825 4.04 2.71 4.35 61 DKIM_INVALID 11641 4.97 7.92 4.28 62 HTML_IMAGE_RATIO_06 11345 4.04 3.47 4.17 63 TR_XM_DK_SendGrid 11045 3.87 3.06 4.06 64 BAYES_20 10932 3.73 2.49 4.02 65 XM_DIRTYINTL 10927 4.77 7.99 4.02 66 MIME_QP_LONG_LINE 10898 3.86 3.24 4.01 67 MIME_HTML_MOSTLY 10422 4.51 7.42 3.83 68 UNPARSEABLE_RELAY 9811 3.17 1.29 3.61 69 T_TooManySym_02 9425 3.01 1.05 3.47 70 RCVD_IN_IADB_LISTED 8747 2.89 1.51 3.22 71 TR_DCC_Bayes_99 8652 6.08 18.51 3.18 72 IN_ZIMBRA_NJ_WHITELIST 8585 2.56 0.01 3.16 73 T_REMOTE_IMAGE 7976 3.70 6.99 2.93 74 XMBdyGiftCard01 7728 2.67 1.93 2.84 75 RCVD_IN_IADB_SPF 7518 2.50 1.38 2.76 76 BAYES_80 7383 3.53 7.05 2.71 77 INVALID_MSGID 7327 2.25 0.34 2.69 78 XM_CamelCaseFrm001 7287 3.08 4.78 2.68 79 MIME_HTML_ONLY_MULTI 7263 2.79 3.32 2.67 80 TVD_RCVD_IP 7050 2.20 0.52 2.59 81 RCVD_IN_IADB_SENDERID 6654 2.24 1.36 2.45 82 BAYES_05 6608 2.25 1.48 2.43 83 TO_MALFORMED 6573 2.09 0.69 2.42 84 BOTNET 6567 5.85 20.56 2.41 85 RCVD_IN_IADB_DK 6480 2.19 1.36 2.38 86 CK_HELO_DYNAMIC_SPLIT_IP 6402 1.93 0.09 2.35 87 HELO_DYNAMIC_IPADDR2 6399 1.92 0.04 2.35 88 NO_DNS_FOR_FROM 6196 2.33 2.55 2.28 89 TM2_M_URI_OPT_OUT 6143 2.85 5.38 2.26 90 RELAYCOUNTRY_CA 6057 2.85 5.52 2.23 91 XMStockSpam_06 6037 2.16 1.88 2.22 92 XM_B_SpammyTLD 5939 2.49 3.81 2.18 93 XM_PDF 5555 1.71 0.31 2.04 94 USER_IN_DEF_DKIM_WL 5472 1.63 0.01 2.01 95 RCVD_IN_MSPIKE_BL 5441 2.46 4.42 2.00 96 RCVD_IN_IADB_VOUCHED 5357 1.67 0.39 1.97 97 MAILING_LIST_MULTI 5088 1.75 1.23 1.87 98 XM_OfRef6 5081 1.95 2.30 1.87 99 XM_H_Trusted_IP 5012 1.49 0.00 1.84 100 XMBrknScrpt_02 4731 1.60 1.01 1.74 101 IN_HORDE_ADDRESS_BOOK 4680 1.40 0.04 1.72 102 BAYES_95 4519 2.10 3.97 1.66 103 T_XMDrugObfuBody_14 4467 1.73 2.13 1.64 104 RCVD_IN_MSPIKE_L3 4422 1.89 3.00 1.63 105 UNTRUSTED_Relay 4298 3.75 13.07 1.58 106 HTML_MIME_NO_HTML_TAG 4147 1.78 2.89 1.52 107 TM2_M_VERY_LONG_WORD 4081 1.83 3.22 1.50 108 DKIM_ADSP_NXDOMAIN 3933 1.49 1.66 1.45 109 URI_TRY_3LD 3715 1.39 1.47 1.37 110 XM_DK_Undo_01 3693 1.29 0.98 1.36 111 XMDiploma_00 3692 1.60 2.63 1.36 112 URI_HEX 3552 1.52 2.46 1.31 113 XMPhish11 3494 1.65 3.20 1.28 114 RCVD_IN_IADB_OPTIN 3409 1.07 0.31 1.25 115 XM_GoogleGroups 3375 1.09 0.46 1.24 116 TR_Symld_Words 3358 1.69 3.66 1.23 117 XM_H_Long_From02 3313 1.16 0.92 1.22 118 TooManyTo_002 3256 1.17 1.08 1.20 119 XMGappySubj_01 3246 1.02 0.26 1.19 120 RCVD_IN_BL_SPAMCOP_NET 3238 2.16 6.34 1.19 121 T_XMDrugObfuBody_08 3230 1.42 2.42 1.19 122 SUBJ_ALL_CAPS 3094 1.25 1.72 1.14 123 XM_B_Unsub2 2996 1.25 1.91 1.10 124 ANY_BOUNCE_MESSAGE 2984 0.97 0.43 1.10 125 BOUNCE_MESSAGE 2981 0.97 0.43 1.10 126 XM_B_REG_HTML 2962 0.94 0.32 1.09 127 XMSubMetaI_00 2911 1.17 1.58 1.07 128 XM_SPF_SoftFail 2902 1.68 4.28 1.07 129 XMSubNoVowel 2895 0.97 0.56 1.06 130 XMSexyCombo_01 2885 1.55 3.63 1.06 131 XMBody_17 2848 1.26 2.19 1.05 132 FILL_THIS_FORM 2820 0.95 0.60 1.04 133 XM_ProductURIs 2748 1.13 1.63 1.01 134 XMBody_95 2695 0.83 0.15 0.99 135 AC_FROM_MANY_DOTS 2688 0.80 0.01 0.99 136 T_FILL_THIS_FORM_SHORT 2651 0.98 0.99 0.97 137 URIBL_CSS_A 2642 0.93 0.74 0.97 138 URIBL_CSS 2642 0.93 0.74 0.97 139 HTML_FONT_FACE_BAD 2635 0.96 0.93 0.97 140 DKIM_ADSP_CUSTOM_MED 2572 1.03 1.37 0.95 141 TR_XM_RelayPhish 2555 1.09 1.72 0.94 142 FILL_THIS_FORM_LONG 2503 0.85 0.53 0.92 143 XMGenDplmaNmb 2437 1.08 1.89 0.90 144 T_FILL_THIS_FORM_LOAN 2412 0.74 0.10 0.89 145 KHOP_HELO_FCRDNS 2378 1.76 5.57 0.87 146 TooManyTo_003 2289 0.86 0.94 0.84 147 HTML_TAG_BALANCE_BODY 2243 0.79 0.63 0.82 148 XMHTML_After_End 2212 1.25 3.14 0.81 149 XM_UB50 2144 2.15 8.01 0.79 150 SUBJ_DOLLARS 2067 0.74 0.68 0.76 151 TR_MetaPhish_Combo_01 2019 0.80 1.05 0.74 152 USER_IN_WHITELIST 2002 0.60 0.00 0.74 153 T_XMHurry_00 1939 0.85 1.43 0.71 154 TooManyTo_004 1904 0.72 0.82 0.70 155 PDS_OTHER_BAD_TLD 1894 1.16 3.17 0.70 156 XMSubMetaSxObfu_02 1814 0.70 0.84 0.67 157 NML_ADSP_CUSTOM_MED 1799 0.78 1.27 0.66 158 XMBSHREFv2 1741 0.62 0.52 0.64 159 T_TooManySym_03 1689 0.56 0.29 0.62 160 TooManyTo_005 1680 0.63 0.70 0.62 161 DIET_1 1665 1.11 3.24 0.61 162 XMPhish30 1644 0.71 1.16 0.60 163 XMHTMLBadTable_001 1641 0.65 0.87 0.60 164 XM_B_COPY_HTML 1623 0.71 1.21 0.60 165 T_Symld_Words_02 1561 0.65 0.98 0.57 166 ADMITS_SPAM 1555 0.50 0.20 0.57 167 FORGED_GMAIL_RCVD 1535 0.69 1.22 0.56 168 XMBody_78 1524 0.62 0.86 0.56 169 T_XMDrugObfuBody_00 1521 0.63 0.94 0.56 170 HELO_NODOT 1495 0.53 0.46 0.55 171 T_MONEY_PERCENT 1472 1.10 3.50 0.54 172 TR_LOTS_OF_MONEY2 1472 1.10 3.50 0.54 173 HELO_NO_DOMAIN 1449 0.52 0.45 0.53 174 RELAYCOUNTRY_GB 1425 1.11 3.63 0.52 175 XM_H_PHPMailer 1403 1.20 4.15 0.52 176 XM_Body_Obfu01 1375 0.45 0.21 0.51 177 TM2_M_A_HREF_HREF 1342 0.54 0.72 0.49 178 XMNoVowels 1314 0.59 1.04 0.48 179 XMSubMetaSSx_00 1291 0.56 0.93 0.47 180 XMRcvdHeader_15 1278 0.38 0.00 0.47 181 XMCapTrack 1277 0.43 0.29 0.47 182 XMLngstWrd_00 1269 0.45 0.39 0.47 183 TR_LOTS_OF_MONEY3 1256 0.65 1.48 0.46 184 PLING_QUERY 1247 0.61 1.27 0.46 185 HTML_IMAGE_ONLY_20 1215 0.45 0.48 0.45 186 RDNS_DYNAMIC 1214 0.68 1.70 0.45 187 TR_XM_PHPDW 1200 0.87 2.72 0.44 188 XM_SPF_Unknown 1180 0.66 1.61 0.43 189 XMLngstWrd_01 1152 0.41 0.38 0.42 190 TR_XM_PHPForged 1115 0.83 2.61 0.41 191 RELAYCOUNTRY_AT 1115 0.52 0.98 0.41 192 TR_XM_FormFill2 1109 0.82 2.61 0.41 193 XMSubMetaSxObfu_03 1108 0.44 0.60 0.41 194 FSL_HELO_FAKE 1100 0.34 0.07 0.40 195 XMPhish14 1097 0.49 0.84 0.40 196 XM_H_PHPOS 1090 0.81 2.58 0.40 197 XM_Walgreens_Forge 1057 0.34 0.13 0.39 198 T_TooManySym_04 1033 0.32 0.05 0.38 199 REMOVE_BEFORE_LINK 1033 0.42 0.61 0.38 200 XM_URI_RBL 1026 0.86 2.92 0.38 ----------------------------------------------------------------------