Email: 621387 Autolearn: 0 AvgScore: 1.27 AvgScanTime: 2.06 sec Spam: 115058 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 2.73 sec Ham: 506329 Autolearn: 0 AvgScore: -1.25 AvgScanTime: 1.90 sec Time Spent Running SA: 354.98 hours Time Spent Processing Spam: 87.21 hours Time Spent Processing Ham: 267.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108487 90.51 94.29 89.65 2 DCC_CHECK 87361 48.29 75.93 42.01 3 DKIM_SIGNED 86801 76.37 75.44 76.58 4 XM_DK_Pass 83495 74.65 72.57 75.13 5 XM_B_Unicode 80853 69.82 70.27 69.72 6 DKIM_VALID 78691 71.02 68.39 71.62 7 XMListUnsubscribeExists 73618 54.68 63.98 52.56 8 DKIM_VALID_AU 58093 53.29 50.49 53.93 9 BAYES_50 55984 51.80 48.66 52.51 10 XM_B_Unicode3 48119 40.47 41.82 40.16 11 MIME_HTML_ONLY 45910 24.44 39.90 20.93 12 XM_DK_Undo_02 38470 11.15 33.44 6.09 13 HTML_FONT_LOW_CONTRAST 37202 28.97 32.33 28.21 14 LOC_TINY_FONT_1 36843 25.10 32.02 23.53 15 RELAYCOUNTRY_META 29173 9.65 25.36 6.08 16 XMSubLong 29134 22.00 25.32 21.24 17 DKIM_VALID_EF 28444 26.96 24.72 27.47 18 FVGT_m_MULTI_ODD 27733 22.02 24.10 21.54 19 BAYES_99 27325 6.96 23.75 3.15 20 DCC_CHECK_NEGATIVE 25601 49.63 22.25 55.85 21 T_KAM_HTML_FONT_INVALID 24690 19.14 21.46 18.61 22 XM_Body_Dirty_Words 24535 14.45 21.32 12.88 23 T_TM2_M_HEADER_IN_MSG 24425 28.84 21.23 30.57 24 XM_UncommonTLD01 22740 6.84 19.76 3.90 25 BOTNET 22500 5.16 19.56 1.89 26 MultiRelay 21896 19.03 19.03 19.03 27 BAYES_999 21452 5.53 18.64 2.54 28 XM_Multi_Part_URI 20497 12.73 17.81 11.58 29 BOTNET_IPINHOSTNAME 20285 6.84 17.63 4.39 30 TR_DCC_Bayes_99 19985 4.37 17.37 1.42 31 UNTRUSTED_Relay 18909 4.25 16.43 1.49 32 FSL_BULK_SIG 18192 8.37 15.81 6.67 33 XMSexyCombo_05 15362 5.54 13.35 3.77 34 XM_B_Unsub 15359 11.45 13.35 11.02 35 LOTS_OF_MONEY 15006 9.77 13.04 9.02 36 HTML_IMAGE_RATIO_02 14421 8.45 12.53 7.52 37 XM_Evil_Numbers_Gen 13787 9.46 11.98 8.88 38 T_REMOTE_IMAGE 12713 5.31 11.05 4.00 39 RCVD_IN_MSPIKE_H2 12374 12.26 10.75 12.60 40 XM_UB50 11802 2.60 10.26 0.87 41 XMSubMetaSx_00 10279 4.90 8.93 3.98 42 XMNumbers 10220 4.64 8.88 3.68 43 MIME_HEADER_CTYPE_ONLY 10150 1.81 8.82 0.22 44 LotsOfNums_01 9855 7.96 8.57 7.82 45 KHOP_HELO_FCRDNS 9466 3.25 8.23 2.12 46 MPART_ALT_DIFF 9345 5.82 8.12 5.29 47 XM_DIRTYINTL 9156 3.33 7.96 2.27 48 FROM_EXCESS_BASE64 9029 3.91 7.85 3.01 49 SpammyFromTLD_02 8760 1.65 7.61 0.30 50 BAYES_60 8702 5.29 7.56 4.77 51 HTML_MIME_NO_HTML_TAG 8609 3.09 7.48 2.09 52 BAYES_80 8465 3.31 7.36 2.39 53 DKIM_INVALID 8110 5.35 7.05 4.96 54 XM_H_Long_From01 7714 6.37 6.70 6.29 55 XM_B_Phish_Phrases 7479 6.25 6.50 6.20 56 TooManyTo_001 7440 8.34 6.47 8.77 57 RELAYCOUNTRY_FR 7009 1.39 6.09 0.32 58 MIME_HTML_MOSTLY 6881 3.42 5.98 2.84 59 RCVD_IN_BL_SPAMCOP_NET 6810 2.04 5.92 1.16 60 HTML_IMAGE_RATIO_04 6580 5.47 5.72 5.42 61 HTML_SHORT_LINK_IMG_1 6418 1.05 5.58 0.02 62 BODY_URI_ONLY 6250 1.06 5.43 0.07 63 HDRS_LCASE_IMGONLY 6101 0.99 5.30 0.01 64 XM_SendGrid 5929 6.00 5.15 6.20 65 XMStrtUSub 5872 4.74 5.10 4.65 66 RELAYCOUNTRY_CA 5819 2.53 5.06 1.95 67 HDRS_MISSP 5471 0.89 4.75 0.01 68 REPLYTO_WITHOUT_TO_CC 5461 0.94 4.75 0.07 69 TM2_M_URI_OPT_OUT 5453 2.65 4.74 2.18 70 HTML_TAG_BALANCE_CENTER 5273 0.91 4.58 0.07 71 SpammyFromTLD_01 5104 1.48 4.44 0.80 72 MIME_QP_LONG_LINE 5093 5.49 4.43 5.73 73 RCVD_IN_MSPIKE_WL 5042 8.66 4.38 9.63 74 RCVD_IN_MSPIKE_H3 5042 8.66 4.38 9.63 75 MISSING_HEADERS 4908 1.18 4.27 0.48 76 XM_CamelCaseFrm001 4853 2.65 4.22 2.29 77 TO_EQ_FM_DOM_HTML_IMG 4786 0.78 4.16 0.01 78 XM_SPF_Unknown 4729 1.32 4.11 0.69 79 RCVD_IN_MSPIKE_BL 4667 1.70 4.06 1.17 80 XM_SPF_SoftFail 4652 2.42 4.04 2.05 81 HTML_IMAGE_RATIO_06 4500 4.21 3.91 4.27 82 XM_URI_RBL 4368 0.98 3.80 0.34 83 MIME_HTML_ONLY_MULTI 4287 3.37 3.73 3.28 84 XM_B_Unsub2 4047 3.21 3.52 3.14 85 HTML_IMAGE_ONLY_08 4042 0.73 3.51 0.10 86 HTML_SHORT_LINK_IMG_2 3985 0.66 3.46 0.03 87 HTML_IMAGE_ONLY_16 3834 0.84 3.33 0.27 88 XM_OfRef6 3830 1.71 3.33 1.35 89 T_XMDrugObfuBody_08 3813 1.92 3.31 1.60 90 MultiRelay_CC 3796 0.76 3.30 0.19 91 MultiRelay_Combo 3796 0.76 3.30 0.19 92 BAYES_95 3759 1.75 3.27 1.40 93 URI_HEX 3712 1.64 3.23 1.28 94 BAYES_40 3678 5.91 3.20 6.53 95 RCVD_IN_RP_RNBL 3565 0.69 3.10 0.14 96 XM_B_SpammyTLD 3520 2.19 3.06 1.99 97 RELAYCOUNTRY_GB 3508 1.61 3.05 1.28 98 TR_XM_DK_SendGrid 3364 3.23 2.92 3.31 99 XMSexyCombo_01 3336 1.14 2.90 0.74 100 DKIM_ADSP_NXDOMAIN 3270 1.36 2.84 1.03 101 HTML_IMAGE_RATIO_08 3200 2.92 2.78 2.96 102 XMDiploma_00 3173 1.84 2.76 1.63 103 RCVD_IN_PSBL 3149 0.52 2.74 0.01 104 NO_DNS_FOR_FROM 3078 1.90 2.68 1.72 105 T_TooManySym_01 2851 4.46 2.48 4.91 106 HTML_IMAGE_ONLY_12 2842 0.60 2.47 0.17 107 FROM_SUSPICIOUS_NTLD 2839 0.48 2.47 0.03 108 FROM_SUSPICIOUS_NTLD_FP 2814 0.48 2.45 0.03 109 BAYES_20 2802 4.39 2.44 4.83 110 XM_UB60 2657 0.48 2.31 0.07 111 BOTNET_NORDNS 2613 0.46 2.27 0.05 112 TR_XM_INV_DKIM 2548 0.56 2.21 0.19 113 T_XMDrugObfuBody_14 2430 1.68 2.11 1.58 114 ALL_TRUSTED 2396 11.26 2.08 13.35 115 SUBJ_ALL_CAPS 2392 1.70 2.08 1.62 116 DIET_1 2377 0.79 2.07 0.50 117 RCVD_IN_MSPIKE_L3 2362 0.96 2.05 0.71 118 TM2_M_VERY_LONG_WORD 2348 1.32 2.04 1.15 119 XMSubMetaI_00 2338 0.88 2.03 0.62 120 URIBL_SBL_A 2336 0.69 2.03 0.38 121 RCVD_IN_IADB_LISTED 2262 4.59 1.97 5.18 122 XMStockSpam_06 2245 0.99 1.95 0.78 123 BAYES_00 2239 17.48 1.95 21.01 124 XMMoneyMeta_00 2214 0.91 1.92 0.68 125 XMBody_17 2197 1.22 1.91 1.06 126 TR_XM_RelayPhish 2183 1.00 1.90 0.79 127 TR_XM_PHPDW 2168 1.21 1.88 1.05 128 XMGenDplmaNmb 2158 1.25 1.88 1.11 129 XMSlimDrugH 2150 0.67 1.87 0.40 130 TR_Symld_Words 2123 1.56 1.85 1.50 131 TR_XM_PHPForged 2093 1.18 1.82 1.04 132 RELAYCOUNTRY_DE 2089 0.63 1.82 0.36 133 TR_XM_FormFill2 2088 1.18 1.81 1.03 134 RCVD_IN_RP_SAFE 2084 7.77 1.81 9.12 135 XM_H_PHPOS 2073 1.17 1.80 1.03 136 RCVD_IN_IADB_SPF 2062 4.01 1.79 4.51 137 RCVD_IN_IADB_SENDERID 2019 3.56 1.75 3.97 138 RCVD_IN_IADB_DK 2018 3.53 1.75 3.93 139 MAILING_LIST_MULTI 2010 2.49 1.75 2.66 140 PDS_OTHER_BAD_TLD 1959 0.61 1.70 0.36 141 HK_RANDOM_REPLYTO 1938 0.49 1.68 0.22 142 XMHTML_After_End 1899 1.06 1.65 0.93 143 URI_NOVOWEL 1866 0.59 1.62 0.36 144 T_XMDrugObfuBody_00 1859 0.76 1.62 0.56 145 TR_LOTS_OF_MONEY3 1844 0.73 1.60 0.53 146 RCVD_IN_RP_CERTIFIED 1834 7.01 1.59 8.23 147 SUBJECT_NEEDS_ENCODING 1821 0.33 1.58 0.04 148 XMSexyCombo_04 1815 0.37 1.58 0.10 149 SUBJ_ILLEGAL_CHARS 1783 0.32 1.55 0.04 150 DATE_IN_PAST_03_06 1772 0.36 1.54 0.09 151 MPART_ALT_DIFF_COUNT 1729 0.53 1.50 0.31 152 URI_TRY_3LD 1712 1.55 1.49 1.56 153 BAYES_05 1694 2.75 1.47 3.04 154 RCVD_IN_MSPIKE_L5 1694 0.43 1.47 0.19 155 TR_XM_DK_Bayes 1637 12.93 1.42 15.54 156 URI_NO_WWW_INFO_CGI 1630 0.32 1.42 0.07 157 BODY_SINGLE_WORD 1624 0.27 1.41 0.01 158 BODY_SINGLE_URI 1619 0.26 1.41 0.00 159 XMPhish11 1592 1.35 1.38 1.34 160 XMSlimDrugs 1545 0.28 1.34 0.03 161 XM_PDF 1533 3.95 1.33 4.54 162 XM_Combo_Sbj 1518 0.46 1.32 0.26 163 SHORT_IMG_SUSP_NTLD 1517 0.24 1.32 0.00 164 FSL_THIS_IS_ADV 1515 0.39 1.32 0.19 165 DKIM_ADSP_CUSTOM_MED 1487 0.97 1.29 0.90 166 SUBJ_DOLLARS 1487 0.45 1.29 0.26 167 TR_XM_DK_Bayes1 1460 12.33 1.27 14.84 168 XMSubMetaSxObfu_03 1455 0.65 1.26 0.51 169 RDNS_DYNAMIC 1454 0.52 1.26 0.35 170 HK_RANDOM_FROM 1449 0.35 1.26 0.15 171 XM_ProductURIs 1441 0.96 1.25 0.89 172 XM_H_PHPMailer 1440 0.60 1.25 0.45 173 T_XMHurry_00 1431 0.80 1.24 0.70 174 T_FILL_THIS_FORM_SHORT 1411 1.19 1.23 1.18 175 XM_BadFromFormat 1402 0.31 1.22 0.10 176 XMWghtMeta_00 1372 0.26 1.19 0.04 177 RELAYCOUNTRY_IN 1346 0.33 1.17 0.13 178 T_MONEY_PERCENT 1315 0.52 1.14 0.38 179 TR_LOTS_OF_MONEY2 1315 0.52 1.14 0.38 180 URIBL_DBL_ABUSE_REDIR 1298 0.33 1.13 0.14 181 XM_DK_Undo_01 1288 1.52 1.12 1.61 182 FORGED_GMAIL_RCVD 1270 0.59 1.10 0.47 183 TooManyTo_002 1270 1.90 1.10 2.09 184 NORDNS_LOW_CONTRAST 1260 0.21 1.10 0.00 185 TR_XM_DK_Bayes2 1251 10.89 1.09 13.11 186 HTML_FONT_FACE_BAD 1231 0.81 1.07 0.75 187 NML_ADSP_CUSTOM_MED 1220 0.70 1.06 0.62 188 XMPhish14 1203 0.51 1.05 0.38 189 XMGappySubj_01 1188 1.02 1.03 1.01 190 UNPARSEABLE_RELAY 1178 1.94 1.02 2.15 191 REMOVE_BEFORE_LINK 1138 0.57 0.99 0.47 192 HTML_FONT_SIZE_LARGE 1128 0.27 0.98 0.11 193 XM_H_PHPOS_M 1124 0.30 0.98 0.15 194 XM_H_Long_From02 1124 1.08 0.98 1.10 195 XMPhish30 1114 0.62 0.97 0.55 196 TM2_M_A_HREF_HREF 1099 0.63 0.96 0.55 197 XMBody_78 1094 0.51 0.95 0.41 198 TooManyTo_003 1064 1.29 0.92 1.38 199 TR_Mismatch_TLD_02 1058 0.23 0.92 0.07 200 PLING_QUERY 1055 0.62 0.92 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 453923 90.51 94.29 89.65 2 DKIM_SIGNED 387728 76.37 75.44 76.58 3 XM_DK_Pass 380382 74.65 72.57 75.13 4 DKIM_VALID 362617 71.02 68.39 71.62 5 XM_B_Unicode 352992 69.82 70.27 69.72 6 DCC_CHECK_NEGATIVE 282769 49.63 22.25 55.85 7 DKIM_VALID_AU 273053 53.29 50.49 53.93 8 XMListUnsubscribeExists 266137 54.68 63.98 52.56 9 BAYES_50 265866 51.80 48.66 52.51 10 DCC_CHECK 212722 48.29 75.93 42.01 11 XM_B_Unicode3 203347 40.47 41.82 40.16 12 T_TM2_M_HEADER_IN_MSG 154768 28.84 21.23 30.57 13 HTML_FONT_LOW_CONTRAST 142823 28.97 32.33 28.21 14 DKIM_VALID_EF 139091 26.96 24.72 27.47 15 LOC_TINY_FONT_1 119132 25.10 32.02 23.53 16 FVGT_m_MULTI_ODD 109072 22.02 24.10 21.54 17 XMSubLong 107546 22.00 25.32 21.24 18 BAYES_00 106376 17.48 1.95 21.01 19 MIME_HTML_ONLY 105980 24.44 39.90 20.93 20 MultiRelay 96373 19.03 19.03 19.03 21 T_KAM_HTML_FONT_INVALID 94215 19.14 21.46 18.61 22 TR_XM_DK_Bayes 78682 12.93 1.42 15.54 23 TR_XM_DK_Bayes1 75138 12.33 1.27 14.84 24 ALL_TRUSTED 67583 11.26 2.08 13.35 25 TR_XM_DK_Bayes2 66399 10.89 1.09 13.11 26 XM_Body_Dirty_Words 65234 14.45 21.32 12.88 27 RCVD_IN_MSPIKE_H2 63813 12.26 10.75 12.60 28 XM_Multi_Part_URI 58615 12.73 17.81 11.58 29 XM_B_Unsub 55780 11.45 13.35 11.02 30 RCVD_IN_MSPIKE_WL 48742 8.66 4.38 9.63 31 RCVD_IN_MSPIKE_H3 48740 8.66 4.38 9.63 32 RCVD_IN_RP_SAFE 46169 7.77 1.81 9.12 33 LOTS_OF_MONEY 45689 9.77 13.04 9.02 34 XM_Evil_Numbers_Gen 44972 9.46 11.98 8.88 35 TooManyTo_001 44408 8.34 6.47 8.77 36 RCVD_IN_RP_CERTIFIED 41695 7.01 1.59 8.23 37 LotsOfNums_01 39598 7.96 8.57 7.82 38 HTML_IMAGE_RATIO_02 38072 8.45 12.53 7.52 39 XM_DKIMWhitelistDomains 37198 5.99 0.01 7.35 40 FSL_BULK_SIG 33794 8.37 15.81 6.67 41 BAYES_40 33054 5.91 3.20 6.53 42 XM_H_Long_From01 31845 6.37 6.70 6.29 43 XM_B_Phish_Phrases 31380 6.25 6.50 6.20 44 XM_SendGrid 31378 6.00 5.15 6.20 45 XM_DK_Undo_02 30826 11.15 33.44 6.09 46 RELAYCOUNTRY_META 30789 9.65 25.36 6.08 47 MIME_QP_LONG_LINE 29019 5.49 4.43 5.73 48 HTML_IMAGE_RATIO_04 27430 5.47 5.72 5.42 49 MPART_ALT_DIFF 26799 5.82 8.12 5.29 50 RCVD_IN_IADB_LISTED 26245 4.59 1.97 5.18 51 DKIM_INVALID 25111 5.35 7.05 4.96 52 T_TooManySym_01 24876 4.46 2.48 4.91 53 BAYES_20 24448 4.39 2.44 4.83 54 BAYES_60 24160 5.29 7.56 4.77 55 XMStrtUSub 23561 4.74 5.10 4.65 56 XM_PDF 22994 3.95 1.33 4.54 57 RCVD_IN_IADB_SPF 22837 4.01 1.79 4.51 58 BOTNET_IPINHOSTNAME 22238 6.84 17.63 4.39 59 HTML_IMAGE_RATIO_06 21637 4.21 3.91 4.27 60 T_REMOTE_IMAGE 20275 5.31 11.05 4.00 61 XMSubMetaSx_00 20160 4.90 8.93 3.98 62 RCVD_IN_IADB_SENDERID 20087 3.56 1.75 3.97 63 RCVD_IN_IADB_DK 19919 3.53 1.75 3.93 64 XM_UncommonTLD01 19732 6.84 19.76 3.90 65 XMSexyCombo_05 19066 5.54 13.35 3.77 66 XMNumbers 18610 4.64 8.88 3.68 67 IN_ZIMBRA_NJ_WHITELIST 18014 2.90 0.01 3.56 68 TR_XM_DK_SendGrid 16735 3.23 2.92 3.31 69 RCVD_IN_IADB_VOUCHED 16629 2.79 0.62 3.28 70 MIME_HTML_ONLY_MULTI 16628 3.37 3.73 3.28 71 BAYES_99 15948 6.96 23.75 3.15 72 XM_B_Unsub2 15921 3.21 3.52 3.14 73 BAYES_05 15380 2.75 1.47 3.04 74 FROM_EXCESS_BASE64 15258 3.91 7.85 3.01 75 HTML_IMAGE_RATIO_08 14965 2.92 2.78 2.96 76 MIME_HTML_MOSTLY 14395 3.42 5.98 2.84 77 MAILING_LIST_MULTI 13467 2.49 1.75 2.66 78 BAYES_999 12883 5.53 18.64 2.54 79 BAYES_80 12101 3.31 7.36 2.39 80 T_TooManySym_02 11774 2.02 0.68 2.33 81 XM_CamelCaseFrm001 11614 2.65 4.22 2.29 82 XM_DIRTYINTL 11513 3.33 7.96 2.27 83 XM_H_Trusted_IP 11445 1.84 0.00 2.26 84 TM2_M_URI_OPT_OUT 11041 2.65 4.74 2.18 85 UNPARSEABLE_RELAY 10876 1.94 1.02 2.15 86 KHOP_HELO_FCRDNS 10725 3.25 8.23 2.12 87 HTML_MIME_NO_HTML_TAG 10599 3.09 7.48 2.09 88 TooManyTo_002 10566 1.90 1.10 2.09 89 XM_SPF_SoftFail 10393 2.42 4.04 2.05 90 RCVD_IN_IADB_OPTIN 10228 1.72 0.41 2.02 91 XM_B_SpammyTLD 10069 2.19 3.06 1.99 92 RELAYCOUNTRY_CA 9878 2.53 5.06 1.95 93 BOTNET 9592 5.16 19.56 1.89 94 TVD_RCVD_IP 9491 1.58 0.31 1.87 95 NO_DNS_FOR_FROM 8710 1.90 2.68 1.72 96 HELO_NODOT 8588 1.49 0.56 1.70 97 HELO_NO_DOMAIN 8543 1.48 0.56 1.69 98 XMDiploma_00 8238 1.84 2.76 1.63 99 ANY_BOUNCE_MESSAGE 8195 1.43 0.62 1.62 100 SUBJ_ALL_CAPS 8194 1.70 2.08 1.62 101 BOUNCE_MESSAGE 8192 1.43 0.60 1.62 102 XM_DK_Undo_01 8160 1.52 1.12 1.61 103 T_XMDrugObfuBody_08 8101 1.92 3.31 1.60 104 T_XMDrugObfuBody_14 7983 1.68 2.11 1.58 105 URI_TRY_3LD 7922 1.55 1.49 1.56 106 IN_HORDE_ADDRESS_BOOK 7728 1.25 0.03 1.53 107 XMCapTrack 7695 1.32 0.46 1.52 108 INVALID_MSGID 7682 1.28 0.22 1.52 109 TR_Symld_Words 7574 1.56 1.85 1.50 110 UNTRUSTED_Relay 7526 4.25 16.43 1.49 111 TR_DCC_Bayes_99 7190 4.37 17.37 1.42 112 BAYES_95 7091 1.75 3.27 1.40 113 TooManyTo_003 6965 1.29 0.92 1.38 114 XM_OfRef6 6816 1.71 3.33 1.35 115 XMPhish11 6780 1.35 1.38 1.34 116 TO_MALFORMED 6589 1.10 0.21 1.30 117 RELAYCOUNTRY_GB 6505 1.61 3.05 1.28 118 URI_HEX 6475 1.64 3.23 1.28 119 CK_HELO_DYNAMIC_SPLIT_IP 6252 1.03 0.11 1.23 120 HELO_DYNAMIC_IPADDR2 6243 1.02 0.06 1.23 121 XM_GoogleGroups 6173 1.07 0.43 1.22 122 T_FILL_THIS_FORM_SHORT 5998 1.19 1.23 1.18 123 RCVD_IN_MSPIKE_BL 5926 1.70 4.06 1.17 124 RCVD_IN_BL_SPAMCOP_NET 5864 2.04 5.92 1.16 125 TM2_M_VERY_LONG_WORD 5842 1.32 2.04 1.15 126 XMBdyGiftCard01 5715 1.03 0.60 1.13 127 XMGenDplmaNmb 5639 1.25 1.88 1.11 128 XM_H_Long_From02 5583 1.08 0.98 1.10 129 XMBody_17 5370 1.22 1.91 1.06 130 USER_IN_DEF_DKIM_WL 5365 0.86 0.00 1.06 131 TR_XM_PHPDW 5334 1.21 1.88 1.05 132 TR_XM_PHPForged 5242 1.18 1.82 1.04 133 TR_XM_FormFill2 5226 1.18 1.81 1.03 134 XM_H_PHPOS 5210 1.17 1.80 1.03 135 DKIM_ADSP_NXDOMAIN 5198 1.36 2.84 1.03 136 XMGappySubj_01 5133 1.02 1.03 1.01 137 TooManyTo_004 5051 0.96 0.79 1.00 138 XMSubNoVowel 5015 0.86 0.30 0.99 139 TR_MetaPhish_Combo_01 4698 0.87 0.64 0.93 140 XMHTML_After_End 4693 1.06 1.65 0.93 141 DKIM_ADSP_CUSTOM_MED 4549 0.97 1.29 0.90 142 XM_ProductURIs 4504 0.96 1.25 0.89 143 XM_UB50 4382 2.60 10.26 0.87 144 XMNoVowels 4318 0.80 0.57 0.85 145 XMBrknScrpt_02 4276 0.82 0.69 0.84 146 TooManyTo_005 4177 0.79 0.64 0.82 147 SpammyFromTLD_01 4069 1.48 4.44 0.80 148 TR_XM_RelayPhish 4007 1.00 1.90 0.79 149 XMStockSpam_06 3927 0.99 1.95 0.78 150 AC_FROM_MANY_DOTS 3887 0.63 0.02 0.77 151 HTML_FONT_FACE_BAD 3801 0.81 1.07 0.75 152 TO_NO_BRKTS_HTML_ONLY 3766 0.65 0.26 0.74 153 XMSexyCombo_01 3764 1.14 2.90 0.74 154 RCVD_IN_MSPIKE_L3 3584 0.96 2.05 0.71 155 T_XMHurry_00 3554 0.80 1.24 0.70 156 XM_SPF_Unknown 3481 1.32 4.11 0.69 157 XMMoneyMeta_00 3468 0.91 1.92 0.68 158 XMBody_95 3376 0.56 0.09 0.67 159 XMHTMLBadTable_001 3239 0.69 0.91 0.64 160 T_OBFU_PDF_ATTACH 3164 0.64 0.70 0.62 161 XMSubMetaI_00 3143 0.88 2.03 0.62 162 HTTPS_HTTP_MISMATCH 3136 0.64 0.73 0.62 163 NML_ADSP_CUSTOM_MED 3121 0.70 1.06 0.62 164 XM_B_REG_HTML 2917 0.54 0.40 0.58 165 RELAYCOUNTRY_AU 2911 0.58 0.59 0.57 166 T_TooManySym_03 2885 0.50 0.20 0.57 167 T_XMDrugObfuBody_00 2851 0.76 1.62 0.56 168 PLING_QUERY 2823 0.62 0.92 0.56 169 URIBL_CSS 2789 0.51 0.35 0.55 170 URIBL_CSS_A 2789 0.51 0.35 0.55 171 TM2_M_A_HREF_HREF 2788 0.63 0.96 0.55 172 T_Symld_Words_02 2788 0.60 0.81 0.55 173 FILL_THIS_FORM 2774 0.52 0.41 0.55 174 XMPhish30 2767 0.62 0.97 0.55 175 HTML_TAG_BALANCE_BODY 2753 0.58 0.74 0.54 176 XM_ShortIntro_01 2752 0.52 0.40 0.54 177 TR_LOTS_OF_MONEY3 2678 0.73 1.60 0.53 178 FROM_GOV_DKIM_AU 2635 0.46 0.19 0.52 179 XMSubMetaSxObfu_03 2582 0.65 1.26 0.51 180 RELAYCOUNTRY_NL 2531 0.49 0.45 0.50 181 DIET_1 2530 0.79 2.07 0.50 182 TM2_M_BODY_EMPTY 2473 0.41 0.05 0.49 183 USER_IN_WHITELIST 2457 0.40 0.00 0.49 184 MISSING_HEADERS 2451 1.18 4.27 0.48 185 FROM_GOV_SPOOF 2451 0.44 0.26 0.48 186 HTML_IMAGE_ONLY_20 2444 0.48 0.48 0.48 187 FORGED_GMAIL_RCVD 2383 0.59 1.10 0.47 188 REMOVE_BEFORE_LINK 2375 0.57 0.99 0.47 189 SHORT_HELO_AND_INLINE_IMAGE 2319 0.38 0.03 0.46 190 XM_H_PHPMailer 2300 0.60 1.25 0.45 191 XM_Body_Obfu01 2232 0.41 0.29 0.44 192 HTML_IMAGE_ONLY_28 2111 0.45 0.62 0.42 193 XMBSHREFv2 2080 0.41 0.41 0.41 194 XMBody_78 2059 0.51 0.95 0.41 195 RCVD_IN_SORBS_DUL 2047 0.35 0.13 0.40 196 XMSlimDrugH 2005 0.67 1.87 0.40 197 HTML_IMAGE_ONLY_32 1994 0.36 0.21 0.39 198 XMPhish14 1948 0.51 1.05 0.38 199 URIBL_SBL_A 1933 0.69 2.03 0.38 200 T_MONEY_PERCENT 1912 0.52 1.14 0.38 ----------------------------------------------------------------------