Email: 628659 Autolearn: 0 AvgScore: 1.40 AvgScanTime: 2.00 sec Spam: 112277 Autolearn: 0 AvgScore: 12.97 AvgScanTime: 2.57 sec Ham: 516382 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.88 sec Time Spent Running SA: 349.26 hours Time Spent Processing Spam: 80.27 hours Time Spent Processing Ham: 268.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 104830 90.40 93.37 89.76 2 DCC_CHECK 87077 48.13 77.56 41.73 3 DKIM_SIGNED 84054 77.40 74.86 77.95 4 XM_DK_Pass 81411 75.83 72.51 76.55 5 XM_B_Unicode 78984 71.06 70.35 71.21 6 DKIM_VALID 76519 72.09 68.15 72.95 7 XMListUnsubscribeExists 71008 55.71 63.24 54.07 8 DKIM_VALID_AU 56582 54.29 50.40 55.14 9 BAYES_50 51271 51.42 45.66 52.67 10 XM_B_Unicode3 48496 42.10 43.19 41.87 11 MIME_HTML_ONLY 45049 24.29 40.12 20.84 12 XM_DK_Undo_02 38983 11.61 34.72 6.58 13 LOC_TINY_FONT_1 34491 25.90 30.72 24.86 14 HTML_FONT_LOW_CONTRAST 34425 28.21 30.66 27.68 15 DKIM_VALID_EF 29174 27.37 25.98 27.67 16 BAYES_99 28607 7.48 25.48 3.57 17 XMSubLong 28336 21.88 25.24 21.15 18 FVGT_m_MULTI_ODD 27981 22.93 24.92 22.50 19 RELAYCOUNTRY_META 25793 8.53 22.97 5.39 20 T_KAM_HTML_FONT_INVALID 23487 19.18 20.92 18.80 21 BOTNET 23228 5.42 20.69 2.09 22 DCC_CHECK_NEGATIVE 23220 49.83 20.68 56.16 23 XM_Body_Dirty_Words 22973 14.90 20.46 13.69 24 MultiRelay 22499 18.76 20.04 18.48 25 BAYES_999 21618 5.85 19.25 2.94 26 XM_UncommonTLD01 21005 6.56 18.71 3.92 27 T_TM2_M_HEADER_IN_MSG 20885 27.80 18.60 29.80 28 TR_DCC_Bayes_99 20869 4.74 18.59 1.73 29 BOTNET_IPINHOSTNAME 20834 6.77 18.56 4.21 30 FSL_BULK_SIG 19104 8.46 17.02 6.60 31 XM_B_Unsub 19080 11.84 16.99 10.72 32 XM_Multi_Part_URI 19026 12.40 16.95 11.41 33 LOTS_OF_MONEY 17772 10.37 15.83 9.18 34 UNTRUSTED_Relay 16228 3.83 14.45 1.52 35 HTML_IMAGE_RATIO_02 13663 8.58 12.17 7.79 36 XMSexyCombo_05 13219 5.42 11.77 4.04 37 XM_Evil_Numbers_Gen 12324 9.52 10.98 9.21 38 SpammyFromTLD_02 12086 2.18 10.76 0.32 39 HTML_SHORT_LINK_IMG_1 11376 1.84 10.13 0.03 40 RCVD_IN_MSPIKE_H2 10666 12.07 9.50 12.63 41 T_REMOTE_IMAGE 10489 5.22 9.34 4.33 42 HTML_MIME_NO_HTML_TAG 10095 3.44 8.99 2.23 43 XM_UB50 9781 2.25 8.71 0.84 44 XMNumbers 9640 4.29 8.59 3.36 45 LotsOfNums_01 9627 8.23 8.57 8.16 46 MPART_ALT_DIFF 8967 5.13 7.99 4.51 47 KHOP_HELO_FCRDNS 8773 2.82 7.81 1.73 48 BAYES_80 8753 3.37 7.80 2.40 49 XMSubMetaSx_00 8495 4.57 7.57 3.92 50 XM_B_Phish_Phrases 8340 6.87 7.43 6.75 51 FROM_SUSPICIOUS_NTLD 8237 1.33 7.34 0.03 52 FROM_SUSPICIOUS_NTLD_FP 8215 1.33 7.32 0.03 53 XM_DIRTYINTL 8159 3.25 7.27 2.38 54 HDRS_LCASE_IMGONLY 8112 1.31 7.22 0.03 55 BAYES_60 7772 5.08 6.92 4.68 56 RCVD_IN_BL_SPAMCOP_NET 7730 2.27 6.88 1.27 57 DKIM_INVALID 7535 5.31 6.71 5.00 58 FROM_EXCESS_BASE64 7397 4.02 6.59 3.46 59 TooManyTo_001 7051 7.82 6.28 8.15 60 MIME_HEADER_CTYPE_ONLY 6644 1.23 5.92 0.21 61 DKIM_ADSP_NXDOMAIN 6584 2.06 5.86 1.24 62 XM_H_Long_From01 6532 5.93 5.82 5.95 63 HTML_IMAGE_ONLY_08 6217 1.09 5.54 0.12 64 XM_SPF_SoftFail 6117 2.42 5.45 1.76 65 BODY_URI_ONLY 6106 1.07 5.44 0.12 66 HTML_IMAGE_RATIO_04 6034 7.31 5.37 7.73 67 RELAYCOUNTRY_CA 5779 2.31 5.15 1.69 68 SHORT_IMG_SUSP_NTLD 5687 0.90 5.07 0.00 69 BAYES_95 5438 2.09 4.84 1.49 70 MIME_HTML_MOSTLY 5386 2.77 4.80 2.33 71 HTML_TAG_BALANCE_CENTER 5289 0.93 4.71 0.11 72 XM_SendGrid 5164 6.07 4.60 6.38 73 MIME_QP_LONG_LINE 5012 5.55 4.46 5.79 74 HDRS_MISSP 4798 0.77 4.27 0.01 75 MIME_HTML_ONLY_MULTI 4759 3.18 4.24 2.95 76 XM_CamelCaseFrm001 4703 2.46 4.19 2.09 77 RCVD_IN_MSPIKE_H3 4686 8.84 4.17 9.86 78 RCVD_IN_MSPIKE_WL 4686 8.84 4.17 9.86 79 REPLYTO_WITHOUT_TO_CC 4485 0.75 3.99 0.05 80 RCVD_IN_RP_RNBL 4381 0.79 3.90 0.12 81 TM2_M_URI_OPT_OUT 4376 2.59 3.90 2.31 82 XM_URI_RBL 4290 0.91 3.82 0.28 83 RDNS_DYNAMIC 4200 0.94 3.74 0.33 84 XMStrtUSub 4063 4.71 3.62 4.95 85 RCVD_IN_MSPIKE_BL 3965 1.71 3.53 1.31 86 TO_EQ_FM_DOM_HTML_IMG 3963 0.64 3.53 0.02 87 T_XMDrugObfuBody_08 3879 1.91 3.45 1.57 88 HTML_IMAGE_RATIO_06 3843 3.40 3.42 3.40 89 RELAYCOUNTRY_DE 3739 0.92 3.33 0.40 90 XM_OfRef6 3681 1.86 3.28 1.55 91 XM_B_SpammyTLD 3670 2.09 3.27 1.84 92 MultiRelay_Combo 3541 0.72 3.15 0.20 93 MultiRelay_CC 3541 0.72 3.15 0.20 94 RELAYCOUNTRY_FR 3516 0.77 3.13 0.26 95 T_TooManySym_01 3380 4.44 3.01 4.75 96 BAYES_40 3372 5.42 3.00 5.95 97 DIET_1 3353 0.93 2.99 0.49 98 BODY_SINGLE_WORD 3299 0.53 2.94 0.01 99 BODY_SINGLE_URI 3295 0.53 2.93 0.01 100 XM_B_Unsub2 3279 3.24 2.92 3.31 101 HTML_IMAGE_RATIO_08 3256 2.84 2.90 2.82 102 HTML_IMAGE_ONLY_04 3238 0.57 2.88 0.06 103 FROM_NTLD_LINKBAIT 3223 0.51 2.87 0.00 104 HTML_SHORT_CENTER 3199 0.51 2.85 0.00 105 PDS_OTHER_BAD_TLD 3196 0.85 2.85 0.42 106 TO_MALFORMED 3182 1.56 2.83 1.28 107 RELAYCOUNTRY_GB 3096 1.51 2.76 1.24 108 XMDiploma_00 3006 1.81 2.68 1.62 109 URI_HEX 2930 1.59 2.61 1.37 110 URIBL_SBL_A 2878 0.73 2.56 0.33 111 SpammyFromTLD_01 2780 1.03 2.48 0.72 112 BAYES_00 2670 17.93 2.38 21.32 113 TR_XM_RelayPhish 2634 1.16 2.35 0.90 114 BAYES_20 2614 4.31 2.33 4.74 115 XMSexyCombo_01 2566 0.82 2.29 0.50 116 RCVD_IN_PSBL 2555 0.41 2.28 0.00 117 TR_XM_DK_SendGrid 2548 3.32 2.27 3.55 118 TR_XM_PHPDW 2518 0.81 2.24 0.50 119 RCVD_IN_MSPIKE_L3 2439 1.06 2.17 0.82 120 TR_XM_PHPForged 2428 0.78 2.16 0.48 121 RCVD_IN_IADB_LISTED 2426 4.72 2.16 5.28 122 TR_XM_FormFill2 2424 0.78 2.16 0.47 123 XM_H_PHPOS 2407 0.77 2.14 0.47 124 HTML_IMAGE_ONLY_12 2392 0.51 2.13 0.16 125 TR_XM_INV_DKIM 2385 0.50 2.12 0.15 126 NO_DNS_FOR_FROM 2366 2.00 2.11 1.97 127 SUBJ_ALL_CAPS 2349 1.54 2.09 1.41 128 XMBody_17 2339 1.06 2.08 0.84 129 T_XMDrugObfuBody_14 2198 1.65 1.96 1.58 130 BOTNET_NORDNS 2197 0.59 1.96 0.29 131 RCVD_IN_IADB_SPF 2191 4.12 1.95 4.59 132 ALL_TRUSTED 2170 10.60 1.93 12.48 133 RCVD_IN_IADB_SENDERID 2140 3.60 1.91 3.96 134 RCVD_IN_IADB_DK 2139 3.57 1.91 3.93 135 XMGenDplmaNmb 2122 1.26 1.89 1.13 136 HK_RANDOM_FROM 2113 0.45 1.88 0.14 137 MAILING_LIST_MULTI 2086 2.26 1.86 2.35 138 TM2_M_VERY_LONG_WORD 2075 1.39 1.85 1.29 139 TR_LOTS_OF_MONEY2 2052 0.69 1.83 0.44 140 T_MONEY_PERCENT 2052 0.69 1.83 0.44 141 XMSubMetaI_00 2040 0.76 1.82 0.53 142 XM_BadFromFormat 2037 0.42 1.81 0.11 143 HK_RANDOM_REPLYTO 1948 0.52 1.73 0.25 144 RCVD_IN_RP_SAFE 1940 7.89 1.73 9.23 145 XM_UB99 1934 0.31 1.72 0.00 146 TR_XM_DK_Bayes 1914 13.44 1.70 15.99 147 XMSlimDrugH 1910 0.53 1.70 0.28 148 TR_LOTS_OF_MONEY3 1836 0.71 1.64 0.51 149 FVGT_m_MULTI_ODD_EMAIL 1781 0.31 1.59 0.03 150 T_XMHurry_00 1763 0.81 1.57 0.65 151 TR_XM_DK_Bayes1 1758 12.81 1.57 15.25 152 T_FILL_THIS_FORM_SHORT 1756 1.05 1.56 0.94 153 TR_Symld_Words 1756 1.44 1.56 1.41 154 RCVD_IN_RP_CERTIFIED 1754 7.14 1.56 8.35 155 XMStockSpam_06 1748 0.86 1.56 0.71 156 TR_Mismatch_TLD_02 1745 0.34 1.55 0.07 157 DATE_IN_PAST_03_06 1732 0.36 1.54 0.10 158 XMPhish11 1707 1.24 1.52 1.18 159 XM_UB60 1647 0.31 1.47 0.06 160 XM_UB999 1635 0.26 1.46 0.00 161 XMHTML_After_End 1583 0.90 1.41 0.79 162 XM_ProductURIs 1582 1.31 1.41 1.29 163 XM_H_PHPMailer 1534 0.63 1.37 0.47 164 BAYES_05 1533 2.65 1.37 2.93 165 LongTLD 1495 0.37 1.33 0.16 166 T_TooManySym_02 1459 2.07 1.30 2.24 167 URI_TRY_3LD 1390 1.73 1.24 1.84 168 TR_XM_DK_Bayes2 1358 11.30 1.21 13.50 169 T_XMDrugObfuBody_00 1351 0.81 1.20 0.73 170 XMMoneyMeta_00 1335 0.62 1.19 0.50 171 XM_H_PHPOS_M 1330 0.31 1.18 0.12 172 DATE_IN_PAST_06_12 1306 0.26 1.16 0.06 173 XMPhish30 1278 0.63 1.14 0.52 174 RELAYCOUNTRY_VN 1270 0.21 1.13 0.01 175 DKIM_ADSP_CUSTOM_MED 1267 0.97 1.13 0.94 176 XM_DK_Undo_01 1266 1.56 1.13 1.65 177 XMSlimDrugs 1251 0.22 1.11 0.03 178 HTML_FONT_SIZE_LARGE 1238 0.28 1.10 0.11 179 REMOVE_BEFORE_LINK 1230 0.62 1.10 0.52 180 FSL_THIS_IS_ADV 1220 0.36 1.09 0.20 181 RELAYCOUNTRY_IN 1211 0.28 1.08 0.11 182 RCVD_IN_MSPIKE_L5 1210 0.39 1.08 0.24 183 T_Symld_Words_02 1208 0.74 1.08 0.66 184 PLING_QUERY 1200 0.58 1.07 0.48 185 NO_FM_NAME_IP_HOSTN 1168 0.19 1.04 0.00 186 XM_H_Long_From02 1162 1.38 1.03 1.45 187 XMSubMetaSSx_00 1128 0.42 1.00 0.30 188 TM2_M_A_HREF_HREF 1122 0.55 1.00 0.46 189 DEAR_FRIEND 1121 0.24 1.00 0.07 190 FORGED_GMAIL_RCVD 1117 0.56 0.99 0.46 191 TooManyTo_002 1115 1.98 0.99 2.19 192 XMBrknScrpt_02 1114 0.79 0.99 0.75 193 XM_OfRef7 1113 0.36 0.99 0.23 194 XMBody_78 1112 0.48 0.99 0.37 195 NML_ADSP_CUSTOM_MED 1098 0.73 0.98 0.68 196 HTML_FONT_FACE_BAD 1094 1.15 0.97 1.19 197 XM_Nigeria_01 1090 0.21 0.97 0.04 198 MPART_ALT_DIFF_COUNT 1082 0.45 0.96 0.34 199 XMSexyCombo_04 1080 0.23 0.96 0.08 200 TVD_SPACE_RATIO 1079 0.45 0.96 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 463479 90.40 93.37 89.76 2 DKIM_SIGNED 402524 77.40 74.86 77.95 3 XM_DK_Pass 395303 75.83 72.51 76.55 4 DKIM_VALID 376690 72.09 68.15 72.95 5 XM_B_Unicode 367722 71.06 70.35 71.21 6 DCC_CHECK_NEGATIVE 290021 49.83 20.68 56.16 7 DKIM_VALID_AU 284712 54.29 50.40 55.14 8 XMListUnsubscribeExists 279201 55.71 63.24 54.07 9 BAYES_50 271970 51.42 45.66 52.67 10 XM_B_Unicode3 216190 42.10 43.19 41.87 11 DCC_CHECK 215475 48.13 77.56 41.73 12 T_TM2_M_HEADER_IN_MSG 153905 27.80 18.60 29.80 13 HTML_FONT_LOW_CONTRAST 142916 28.21 30.66 27.68 14 DKIM_VALID_EF 142899 27.37 25.98 27.67 15 LOC_TINY_FONT_1 128361 25.90 30.72 24.86 16 FVGT_m_MULTI_ODD 116197 22.93 24.92 22.50 17 BAYES_00 110078 17.93 2.38 21.32 18 XMSubLong 109215 21.88 25.24 21.15 19 MIME_HTML_ONLY 107621 24.29 40.12 20.84 20 T_KAM_HTML_FONT_INVALID 97090 19.18 20.92 18.80 21 MultiRelay 95412 18.76 20.04 18.48 22 TR_XM_DK_Bayes 82564 13.44 1.70 15.99 23 TR_XM_DK_Bayes1 78772 12.81 1.57 15.25 24 XM_Body_Dirty_Words 70692 14.90 20.46 13.69 25 TR_XM_DK_Bayes2 69695 11.30 1.21 13.50 26 RCVD_IN_MSPIKE_H2 65222 12.07 9.50 12.63 27 ALL_TRUSTED 64470 10.60 1.93 12.48 28 XM_Multi_Part_URI 58907 12.40 16.95 11.41 29 XM_B_Unsub 55351 11.84 16.99 10.72 30 RCVD_IN_MSPIKE_WL 50894 8.84 4.17 9.86 31 RCVD_IN_MSPIKE_H3 50893 8.84 4.17 9.86 32 RCVD_IN_RP_SAFE 47659 7.89 1.73 9.23 33 XM_Evil_Numbers_Gen 47542 9.52 10.98 9.21 34 LOTS_OF_MONEY 47392 10.37 15.83 9.18 35 RCVD_IN_RP_CERTIFIED 43115 7.14 1.56 8.35 36 LotsOfNums_01 42140 8.23 8.57 8.16 37 TooManyTo_001 42105 7.82 6.28 8.15 38 HTML_IMAGE_RATIO_02 40247 8.58 12.17 7.79 39 HTML_IMAGE_RATIO_04 39902 7.31 5.37 7.73 40 XM_DKIMWhitelistDomains 38021 6.05 0.02 7.36 41 XM_B_Phish_Phrases 34879 6.87 7.43 6.75 42 FSL_BULK_SIG 34090 8.46 17.02 6.60 43 XM_DK_Undo_02 33994 11.61 34.72 6.58 44 XM_SendGrid 32969 6.07 4.60 6.38 45 XM_H_Long_From01 30737 5.93 5.82 5.95 46 BAYES_40 30704 5.42 3.00 5.95 47 MIME_QP_LONG_LINE 29888 5.55 4.46 5.79 48 RELAYCOUNTRY_META 27858 8.53 22.97 5.39 49 RCVD_IN_IADB_LISTED 27278 4.72 2.16 5.28 50 DKIM_INVALID 25834 5.31 6.71 5.00 51 XMStrtUSub 25563 4.71 3.62 4.95 52 T_TooManySym_01 24540 4.44 3.01 4.75 53 BAYES_20 24474 4.31 2.33 4.74 54 BAYES_60 24143 5.08 6.92 4.68 55 XM_PDF 24015 3.96 0.76 4.65 56 RCVD_IN_IADB_SPF 23693 4.12 1.95 4.59 57 MPART_ALT_DIFF 23306 5.13 7.99 4.51 58 IN_ZIMBRA_NJ_WHITELIST 22584 3.59 0.01 4.37 59 T_REMOTE_IMAGE 22344 5.22 9.34 4.33 60 BOTNET_IPINHOSTNAME 21722 6.77 18.56 4.21 61 XMSexyCombo_05 20857 5.42 11.77 4.04 62 RCVD_IN_IADB_SENDERID 20467 3.60 1.91 3.96 63 RCVD_IN_IADB_DK 20285 3.57 1.91 3.93 64 XMSubMetaSx_00 20260 4.57 7.57 3.92 65 XM_UncommonTLD01 20249 6.56 18.71 3.92 66 BAYES_99 18431 7.48 25.48 3.57 67 TR_XM_DK_SendGrid 18312 3.32 2.27 3.55 68 FROM_EXCESS_BASE64 17858 4.02 6.59 3.46 69 RCVD_IN_IADB_VOUCHED 17756 2.96 0.78 3.44 70 HTML_IMAGE_RATIO_06 17560 3.40 3.42 3.40 71 XMNumbers 17360 4.29 8.59 3.36 72 XM_B_Unsub2 17072 3.24 2.92 3.31 73 MIME_HTML_ONLY_MULTI 15225 3.18 4.24 2.95 74 BAYES_999 15185 5.85 19.25 2.94 75 BAYES_05 15128 2.65 1.37 2.93 76 HTML_IMAGE_RATIO_08 14572 2.84 2.90 2.82 77 BAYES_80 12416 3.37 7.80 2.40 78 XM_H_Trusted_IP 12314 1.96 0.00 2.38 79 XM_DIRTYINTL 12270 3.25 7.27 2.38 80 MAILING_LIST_MULTI 12133 2.26 1.86 2.35 81 MIME_HTML_MOSTLY 12029 2.77 4.80 2.33 82 TM2_M_URI_OPT_OUT 11908 2.59 3.90 2.31 83 T_TooManySym_02 11554 2.07 1.30 2.24 84 HTML_MIME_NO_HTML_TAG 11507 3.44 8.99 2.23 85 TooManyTo_002 11324 1.98 0.99 2.19 86 RCVD_IN_IADB_OPTIN 11207 1.88 0.52 2.17 87 BOTNET 10814 5.42 20.69 2.09 88 XM_CamelCaseFrm001 10793 2.46 4.19 2.09 89 NO_DNS_FOR_FROM 10186 2.00 2.11 1.97 90 UNPARSEABLE_RELAY 9996 1.74 0.84 1.94 91 URI_TRY_3LD 9499 1.73 1.24 1.84 92 XM_B_SpammyTLD 9489 2.09 3.27 1.84 93 XM_SPF_SoftFail 9107 2.42 5.45 1.76 94 KHOP_HELO_FCRDNS 8944 2.82 7.81 1.73 95 TR_DCC_Bayes_99 8938 4.74 18.59 1.73 96 RELAYCOUNTRY_CA 8746 2.31 5.15 1.69 97 TVD_RCVD_IP 8715 1.47 0.46 1.69 98 HELO_NODOT 8561 1.47 0.58 1.66 99 XM_DK_Undo_01 8520 1.56 1.13 1.65 100 HELO_NO_DOMAIN 8519 1.46 0.58 1.65 101 XMDiploma_00 8382 1.81 2.68 1.62 102 T_XMDrugObfuBody_14 8167 1.65 1.96 1.58 103 ANY_BOUNCE_MESSAGE 8112 1.39 0.55 1.57 104 BOUNCE_MESSAGE 8110 1.39 0.54 1.57 105 T_XMDrugObfuBody_08 8102 1.91 3.45 1.57 106 XM_OfRef6 8025 1.86 3.28 1.55 107 UNTRUSTED_Relay 7833 3.83 14.45 1.52 108 TooManyTo_003 7722 1.37 0.82 1.50 109 INVALID_MSGID 7711 1.27 0.26 1.49 110 BAYES_95 7705 2.09 4.84 1.49 111 IN_HORDE_ADDRESS_BOOK 7597 1.21 0.02 1.47 112 XM_H_Long_From02 7513 1.38 1.03 1.45 113 SUBJ_ALL_CAPS 7304 1.54 2.09 1.41 114 TR_Symld_Words 7286 1.44 1.56 1.41 115 URI_HEX 7097 1.59 2.61 1.37 116 XMCapTrack 6961 1.17 0.37 1.35 117 RCVD_IN_MSPIKE_BL 6764 1.71 3.53 1.31 118 TM2_M_VERY_LONG_WORD 6680 1.39 1.85 1.29 119 XM_ProductURIs 6650 1.31 1.41 1.29 120 TO_MALFORMED 6618 1.56 2.83 1.28 121 RCVD_IN_BL_SPAMCOP_NET 6571 2.27 6.88 1.27 122 XMGappySubj_01 6394 1.07 0.28 1.24 123 DKIM_ADSP_NXDOMAIN 6391 2.06 5.86 1.24 124 RELAYCOUNTRY_GB 6386 1.51 2.76 1.24 125 CK_HELO_DYNAMIC_SPLIT_IP 6300 1.01 0.06 1.22 126 HELO_DYNAMIC_IPADDR2 6297 1.01 0.03 1.22 127 HTML_FONT_FACE_BAD 6154 1.15 0.97 1.19 128 XMBdyGiftCard01 6124 1.07 0.56 1.19 129 XMPhish11 6068 1.24 1.52 1.18 130 XM_GoogleGroups 5929 1.03 0.46 1.15 131 XMGenDplmaNmb 5822 1.26 1.89 1.13 132 TooManyTo_004 5637 1.02 0.69 1.09 133 USER_IN_DEF_DKIM_WL 5630 0.90 0.02 1.09 134 XMSubNoVowel 5583 0.99 0.59 1.08 135 AC_FROM_MANY_DOTS 4930 0.79 0.01 0.95 136 T_FILL_THIS_FORM_SHORT 4859 1.05 1.56 0.94 137 DKIM_ADSP_CUSTOM_MED 4837 0.97 1.13 0.94 138 TR_XM_RelayPhish 4639 1.16 2.35 0.90 139 TooManyTo_005 4554 0.83 0.60 0.88 140 XM_UB50 4353 2.25 8.71 0.84 141 FILL_THIS_FORM 4331 0.79 0.56 0.84 142 XMBody_17 4324 1.06 2.08 0.84 143 TR_MetaPhish_Combo_01 4222 0.79 0.68 0.82 144 RCVD_IN_MSPIKE_L3 4217 1.06 2.17 0.82 145 XMHTML_After_End 4085 0.90 1.41 0.79 146 XMBrknScrpt_02 3872 0.79 0.99 0.75 147 T_XMDrugObfuBody_00 3760 0.81 1.20 0.73 148 SpammyFromTLD_01 3724 1.03 2.48 0.72 149 XMStockSpam_06 3658 0.86 1.56 0.71 150 XMBody_95 3578 0.60 0.17 0.69 151 NML_ADSP_CUSTOM_MED 3518 0.73 0.98 0.68 152 XMNoVowels 3473 0.66 0.59 0.67 153 T_Symld_Words_02 3415 0.74 1.08 0.66 154 T_XMHurry_00 3349 0.81 1.57 0.65 155 XM_SPF_Unknown 3286 0.66 0.78 0.64 156 XMPhish14 3169 0.65 0.82 0.61 157 T_OBFU_PDF_ATTACH 3056 0.52 0.20 0.59 158 URIBL_CSS_A 3047 0.58 0.53 0.59 159 URIBL_CSS 3047 0.58 0.53 0.59 160 HTML_IMAGE_ONLY_20 3000 0.53 0.27 0.58 161 HTTPS_HTTP_MISMATCH 2977 0.60 0.68 0.58 162 XMHTMLBadTable_001 2970 0.58 0.57 0.58 163 FROM_GOV_DKIM_AU 2814 0.48 0.20 0.54 164 XMSubMetaI_00 2726 0.76 1.82 0.53 165 REMOVE_BEFORE_LINK 2698 0.62 1.10 0.52 166 XMPhish30 2675 0.63 1.14 0.52 167 USER_IN_WHITELIST 2667 0.42 0.00 0.52 168 TR_LOTS_OF_MONEY3 2656 0.71 1.64 0.51 169 XM_ShortIntro_01 2650 0.52 0.54 0.51 170 XMSexyCombo_01 2607 0.82 2.29 0.50 171 XM_B_REG_HTML 2599 0.55 0.78 0.50 172 T_TooManySym_03 2582 0.44 0.16 0.50 173 AC_DIV_BONANZA 2570 0.43 0.12 0.50 174 XMMoneyMeta_00 2565 0.62 1.19 0.50 175 TR_XM_PHPDW 2559 0.81 2.24 0.50 176 RELAYCOUNTRY_AU 2554 0.49 0.46 0.49 177 DIET_1 2519 0.93 2.99 0.49 178 TR_XM_PHPForged 2465 0.78 2.16 0.48 179 PLING_QUERY 2455 0.58 1.07 0.48 180 TR_XM_FormFill2 2450 0.78 2.16 0.47 181 FILL_THIS_FORM_LONG 2437 0.47 0.48 0.47 182 XM_H_PHPOS 2431 0.77 2.14 0.47 183 XM_H_PHPMailer 2426 0.63 1.37 0.47 184 HTML_TAG_BALANCE_BODY 2411 0.51 0.69 0.47 185 FORGED_GMAIL_RCVD 2393 0.56 0.99 0.46 186 TM2_M_A_HREF_HREF 2367 0.55 1.00 0.46 187 FROM_GOV_SPOOF 2345 0.41 0.22 0.45 188 SHORT_HELO_AND_INLINE_IMAGE 2341 0.38 0.04 0.45 189 TM2_M_BODY_EMPTY 2338 0.38 0.07 0.45 190 XMSubMetaSxObfu_03 2311 0.54 0.95 0.45 191 HTML_IMAGE_ONLY_28 2289 0.48 0.65 0.44 192 TR_LOTS_OF_MONEY2 2264 0.69 1.83 0.44 193 T_MONEY_PERCENT 2264 0.69 1.83 0.44 194 MISSING_HEADERS 2229 0.47 0.65 0.43 195 XM_Body_Obfu01 2229 0.49 0.76 0.43 196 XMGappySubj_02 2211 0.36 0.06 0.43 197 PDS_OTHER_BAD_TLD 2161 0.85 2.85 0.42 198 T_FILL_THIS_FORM_LOAN 2154 0.38 0.21 0.42 199 XM_B_COPY_HTML 2096 0.46 0.73 0.41 200 RELAYCOUNTRY_DE 2056 0.92 3.33 0.40 ----------------------------------------------------------------------