Email: 693651 Autolearn: 0 AvgScore: 1.42 AvgScanTime: 1.93 sec Spam: 125422 Autolearn: 0 AvgScore: 12.31 AvgScanTime: 2.51 sec Ham: 568229 Autolearn: 0 AvgScore: -0.98 AvgScanTime: 1.80 sec Time Spent Running SA: 372.19 hours Time Spent Processing Spam: 87.54 hours Time Spent Processing Ham: 284.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 119089 87.37 94.95 85.70 2 DCC_CHECK 96048 47.07 76.58 40.56 3 DKIM_SIGNED 93928 69.21 74.89 67.95 4 XM_B_Unicode 92850 66.03 74.03 64.27 5 XM_DK_Pass 91115 67.80 72.65 66.73 6 DKIM_VALID 85573 64.29 68.23 63.42 7 XMListUnsubscribeExists 78255 49.41 62.39 46.55 8 DKIM_VALID_AU 64602 47.79 51.51 46.97 9 BAYES_50 58133 49.10 46.35 49.71 10 XM_B_Unicode3 57717 39.09 46.02 37.56 11 MIME_HTML_ONLY 45066 22.32 35.93 19.31 12 XM_DK_Undo_02 43945 10.81 35.04 5.46 13 HTML_FONT_LOW_CONTRAST 43198 26.46 34.44 24.70 14 LOC_TINY_FONT_1 39234 23.04 31.28 21.23 15 FVGT_m_MULTI_ODD 34921 22.28 27.84 21.05 16 BAYES_99 32527 6.98 25.93 2.79 17 DKIM_VALID_EF 31489 23.79 25.11 23.50 18 XM_Body_Dirty_Words 30687 14.19 24.47 11.93 19 XMSubLong 29191 19.71 23.27 18.92 20 DCC_CHECK_NEGATIVE 27134 51.10 21.63 57.60 21 T_TM2_M_HEADER_IN_MSG 25514 26.44 20.34 27.78 22 TR_DCC_Bayes_99 25179 4.71 20.08 1.32 23 BAYES_999 24979 5.42 19.92 2.22 24 T_KAM_HTML_FONT_INVALID 24051 16.63 19.18 16.06 25 RELAYCOUNTRY_META 23964 7.95 19.11 5.48 26 MultiRelay 22627 17.90 18.04 17.87 27 BOTNET_IPINHOSTNAME 22162 6.39 17.67 3.90 28 XM_Multi_Part_URI 22081 13.02 17.61 12.01 29 BOTNET 21674 4.51 17.28 1.69 30 FSL_BULK_SIG 20771 11.58 16.56 10.49 31 XMSexyCombo_05 19690 6.13 15.70 4.02 32 XM_B_Unsub 18096 10.22 14.43 9.29 33 HTML_IMAGE_RATIO_02 17816 8.14 14.20 6.80 34 XM_UncommonTLD01 17657 4.89 14.08 2.86 35 XM_Evil_Numbers_Gen 15173 8.96 12.10 8.27 36 UNTRUSTED_Relay 15073 3.40 12.02 1.49 37 LOTS_OF_MONEY 13776 8.39 10.98 7.82 38 XM_B_Phish_Phrases 13313 7.05 10.61 6.26 39 XMSubMetaSx_00 12493 5.11 9.96 4.04 40 RCVD_IN_MSPIKE_H2 11470 11.10 9.15 11.53 41 ALL_TRUSTED 11067 19.71 8.82 22.11 42 LotsOfNums_01 10771 7.72 8.59 7.53 43 MPART_ALT_DIFF 10726 5.23 8.55 4.49 44 BAYES_80 10167 3.56 8.11 2.56 45 XM_H_Long_From01 9775 6.01 7.79 5.62 46 XM_DIRTYINTL 9035 3.49 7.20 2.67 47 TM2_M_URI_OPT_OUT 8787 6.69 7.01 6.62 48 XM_UB50 8460 1.88 6.75 0.80 49 DKIM_INVALID 8355 4.92 6.66 4.53 50 FROM_EXCESS_BASE64 8326 3.44 6.64 2.73 51 XMHTML_After_End 8266 1.89 6.59 0.85 52 BAYES_60 8116 5.78 6.47 5.63 53 XMNumbers 8021 5.70 6.40 5.55 54 XM_URI_RBL 7736 1.35 6.17 0.28 55 MIME_HTML_MOSTLY 7403 3.13 5.90 2.52 56 TooManyTo_001 6826 7.04 5.44 7.39 57 SpammyFromTLD_02 6791 1.23 5.41 0.31 58 XM_B_SpammyTLD 6774 2.32 5.40 1.64 59 TR_XM_PHPDW 6691 2.59 5.33 1.98 60 HTML_IMAGE_RATIO_04 6296 5.38 5.02 5.46 61 KHOP_HELO_FCRDNS 6255 2.41 4.99 1.84 62 MIME_QP_LONG_LINE 6252 5.42 4.98 5.51 63 HTML_MIME_NO_HTML_TAG 6251 2.57 4.98 2.04 64 RCVD_IN_MSPIKE_WL 6218 8.20 4.96 8.92 65 RCVD_IN_MSPIKE_H3 6218 8.20 4.96 8.92 66 XM_SendGrid 5959 5.74 4.75 5.95 67 RCVD_IN_BL_SPAMCOP_NET 5740 1.68 4.58 1.05 68 RELAYCOUNTRY_CA 5687 2.17 4.53 1.65 69 XM_H_PHPMailer 5634 2.01 4.49 1.46 70 XMPhish11 5405 1.75 4.31 1.19 71 URIBL_DBL_ABUSE_REDIR 5375 2.20 4.29 1.74 72 SpammyFromTLD_01 5085 1.35 4.05 0.75 73 HTML_IMAGE_RATIO_06 4999 3.81 3.99 3.77 74 BAYES_95 4971 1.86 3.96 1.40 75 XM_SPF_SoftFail 4793 2.04 3.82 1.65 76 XM_B_Unsub2 4772 2.08 3.80 1.70 77 MIME_HTML_ONLY_MULTI 4747 2.98 3.78 2.80 78 TONOM_EQ_TOLOC_SHRT_SHRTNER 4402 3.07 3.51 2.97 79 XM_CamelCaseFrm001 4398 2.28 3.51 2.01 80 XM_OfRef6 4312 1.60 3.44 1.19 81 XMStrtUSub 4097 3.85 3.27 3.97 82 T_REMOTE_IMAGE 4037 3.54 3.22 3.60 83 BAYES_40 3926 5.61 3.13 6.16 84 T_XMDrugObfuBody_08 3881 1.78 3.09 1.49 85 XMEqualsVooDoo_00 3873 0.57 3.09 0.02 86 XMEqualsVooDoo_01 3844 0.56 3.06 0.00 87 XMEqualsVooDoo_02 3842 0.55 3.06 0.00 88 XMPhish04 3817 0.55 3.04 0.00 89 HTML_IMAGE_RATIO_08 3528 2.75 2.81 2.74 90 PDS_OTHER_BAD_TLD 3474 0.82 2.77 0.39 91 RELAYCOUNTRY_FR 3419 0.79 2.73 0.37 92 FROM_SUSPICIOUS_NTLD 3411 0.53 2.72 0.04 93 RCVD_IN_RP_RNBL 3392 0.58 2.70 0.11 94 FROM_SUSPICIOUS_NTLD_FP 3365 0.52 2.68 0.04 95 RDNS_DYNAMIC 3263 0.73 2.60 0.32 96 XMSexyCombo_01 3251 1.03 2.59 0.68 97 URI_HEX 3208 1.36 2.56 1.10 98 NO_DNS_FOR_FROM 3204 1.31 2.55 1.04 99 BOTNET_NORDNS 3138 0.50 2.50 0.06 100 TR_XM_DK_SendGrid 3097 3.07 2.47 3.20 101 T_TooManySym_01 3092 4.03 2.47 4.38 102 NORDNS_LOW_CONTRAST 3011 0.44 2.40 0.01 103 TR_XM_PHPForged 2908 2.03 2.32 1.96 104 T_XMDrugObfuBody_14 2897 1.64 2.31 1.49 105 TR_XM_RelayPhish 2891 1.28 2.31 1.05 106 TR_XM_FormFill2 2887 2.03 2.30 1.97 107 BAYES_20 2885 4.26 2.30 4.69 108 XM_H_PHPOS 2881 2.02 2.30 1.96 109 RCVD_IN_MSPIKE_BL 2800 1.28 2.23 1.07 110 BAYES_00 2787 19.49 2.22 23.31 111 XMStockSpam_06 2647 1.38 2.11 1.22 112 MultiRelay_CC 2628 0.51 2.10 0.16 113 MultiRelay_Combo 2628 0.51 2.10 0.16 114 RCVD_IN_RP_SAFE 2620 7.10 2.09 8.21 115 XMDiploma_00 2595 1.59 2.07 1.48 116 DKIM_ADSP_NXDOMAIN 2553 0.63 2.04 0.32 117 XMBody_17 2506 0.87 2.00 0.62 118 TR_Mismatch_TLD_02 2407 0.38 1.92 0.04 119 DIET_1 2401 0.73 1.91 0.47 120 RCVD_IN_IADB_LISTED 2380 4.50 1.90 5.07 121 T_XMHurry_00 2373 0.90 1.89 0.68 122 RCVD_IN_RP_CERTIFIED 2367 6.38 1.89 7.37 123 URI_TRY_3LD 2335 1.16 1.86 1.01 124 XM_DK_Undo_01 2300 1.68 1.83 1.65 125 HTML_SHORT_LINK_IMG_1 2281 0.34 1.82 0.01 126 RCVD_IN_IADB_SPF 2268 3.93 1.81 4.39 127 TM2_M_VERY_LONG_WORD 2230 1.43 1.78 1.36 128 RCVD_IN_IADB_SENDERID 2206 3.46 1.76 3.83 129 RCVD_IN_IADB_DK 2205 3.43 1.76 3.80 130 RCVD_IN_PSBL 2186 0.32 1.74 0.01 131 RELAYCOUNTRY_GB 2181 1.45 1.74 1.38 132 TR_XM_INV_DKIM 2056 0.37 1.64 0.09 133 RELAYCOUNTRY_DE 2051 0.55 1.64 0.31 134 XMSubMetaI_00 2024 0.76 1.61 0.57 135 URIBL_SBL_A 2002 0.46 1.60 0.21 136 T_FILL_THIS_FORM_SHORT 2001 1.09 1.60 0.98 137 MAILING_LIST_MULTI 1977 1.98 1.58 2.07 138 FSL_THIS_IS_ADV 1973 0.40 1.57 0.14 139 XM_UB99 1973 0.29 1.57 0.01 140 LongTLD 1956 0.45 1.56 0.20 141 XMBdyGiftCard01 1923 0.96 1.53 0.83 142 TR_XM_DK_Bayes 1921 11.48 1.53 13.68 143 DATE_IN_PAST_03_06 1888 0.35 1.51 0.10 144 TR_LOTS_OF_MONEY2 1802 0.47 1.44 0.25 145 T_MONEY_PERCENT 1802 0.47 1.44 0.25 146 RCVD_IN_MSPIKE_L3 1725 0.69 1.38 0.54 147 MIME_HEADER_CTYPE_ONLY 1720 0.40 1.37 0.19 148 TR_XM_DK_Bayes1 1708 10.94 1.36 13.05 149 XMGenDplmaNmb 1697 1.05 1.35 0.98 150 XM_BadFromFormat 1696 0.34 1.35 0.11 151 SUBJ_ALL_CAPS 1684 1.35 1.34 1.36 152 HDRS_LCASE_IMGONLY 1614 0.26 1.29 0.04 153 BAYES_05 1610 3.06 1.28 3.46 154 RELAYCOUNTRY_IN 1606 0.31 1.28 0.10 155 XM_H_PHPOS_M 1597 1.15 1.27 1.12 156 XM_H_Long_From02 1581 1.02 1.26 0.97 157 T_XMDrugObfuBody_00 1557 1.06 1.24 1.02 158 REMOVE_BEFORE_LINK 1547 0.67 1.23 0.55 159 XMBody_78 1525 0.49 1.22 0.34 160 DATE_IN_PAST_06_12 1450 0.25 1.16 0.05 161 XM_UB999 1444 0.21 1.15 0.01 162 XMSlimDrugH 1401 0.66 1.12 0.56 163 TR_Symld_Words 1389 1.30 1.11 1.34 164 XM_Combo_Sbj 1383 0.41 1.10 0.25 165 XM_OfRef7 1382 0.28 1.10 0.10 166 DKIM_ADSP_CUSTOM_MED 1379 1.02 1.10 1.01 167 URIBL_DBL_SPAM 1361 0.21 1.09 0.02 168 REPLYTO_WITHOUT_TO_CC 1358 0.23 1.08 0.04 169 HTML_IMAGE_ONLY_12 1343 0.33 1.07 0.17 170 HTML_TAG_BALANCE_CENTER 1323 0.25 1.05 0.07 171 XM_UB60 1307 0.25 1.04 0.07 172 RELAYCOUNTRY_IE 1302 0.36 1.04 0.20 173 BODY_URI_ONLY 1297 0.28 1.03 0.11 174 XMSexyCombo_04 1287 0.33 1.03 0.18 175 XM_ProductURIs 1281 0.80 1.02 0.75 176 TR_XM_DK_Bayes2 1246 9.58 0.99 11.47 177 TR_Mismatch_TLD_01 1243 0.38 0.99 0.24 178 HK_RANDOM_REPLYTO 1241 0.42 0.99 0.29 179 TR_LOTS_OF_MONEY3 1215 0.38 0.97 0.24 180 XMGappySubj_01 1215 0.96 0.97 0.96 181 XMMoneyMeta_00 1191 0.64 0.95 0.58 182 FORGED_GMAIL_RCVD 1189 0.61 0.95 0.54 183 TR_MetaPhish_Combo_01 1155 0.89 0.92 0.88 184 XM_Body_Obfu01 1150 0.49 0.92 0.39 185 XMPhish14 1138 0.51 0.91 0.42 186 NUMERIC_HTTP_ADDR 1123 0.40 0.90 0.29 187 XM_HighProb1 1110 0.16 0.89 0.00 188 XM_UB80 1106 0.19 0.88 0.03 189 THIS_AD 1100 0.36 0.88 0.24 190 XMPhish30 1073 0.59 0.86 0.53 191 NML_ADSP_CUSTOM_MED 1072 0.77 0.85 0.75 192 MPART_ALT_DIFF_COUNT 1062 0.36 0.85 0.26 193 UNPARSEABLE_RELAY 1041 1.59 0.83 1.76 194 XMHTMLBadTable_001 1039 0.62 0.83 0.57 195 T_TooManySym_02 1031 2.12 0.82 2.40 196 URI_NO_WWW_INFO_CGI 1029 0.16 0.82 0.02 197 PLING_QUERY 1003 0.45 0.80 0.37 198 PDS_TINYSUBJ_URISHRT 999 0.48 0.80 0.41 199 XM_PDF 995 3.57 0.79 4.18 200 HELO_NODOT 988 1.39 0.79 1.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 486968 87.37 94.95 85.70 2 DKIM_SIGNED 386132 69.21 74.89 67.95 3 XM_DK_Pass 379201 67.80 72.65 66.73 4 XM_B_Unicode 365188 66.03 74.03 64.27 5 DKIM_VALID 360386 64.29 68.23 63.42 6 DCC_CHECK_NEGATIVE 327311 51.10 21.63 57.60 7 BAYES_50 282467 49.10 46.35 49.71 8 DKIM_VALID_AU 266876 47.79 51.51 46.97 9 XMListUnsubscribeExists 264486 49.41 62.39 46.55 10 DCC_CHECK 230471 47.07 76.58 40.56 11 XM_B_Unicode3 213407 39.09 46.02 37.56 12 T_TM2_M_HEADER_IN_MSG 157862 26.44 20.34 27.78 13 HTML_FONT_LOW_CONTRAST 140343 26.46 34.44 24.70 14 DKIM_VALID_EF 133537 23.79 25.11 23.50 15 BAYES_00 132427 19.49 2.22 23.31 16 ALL_TRUSTED 125624 19.71 8.82 22.11 17 LOC_TINY_FONT_1 120612 23.04 31.28 21.23 18 FVGT_m_MULTI_ODD 119635 22.28 27.84 21.05 19 MIME_HTML_ONLY 109731 22.32 35.93 19.31 20 XMSubLong 107537 19.71 23.27 18.92 21 MultiRelay 101543 17.90 18.04 17.87 22 T_KAM_HTML_FONT_INVALID 91276 16.63 19.18 16.06 23 TR_XM_DK_Bayes 77735 11.48 1.53 13.68 24 TR_XM_DK_Bayes1 74153 10.94 1.36 13.05 25 XM_Multi_Part_URI 68262 13.02 17.61 12.01 26 XM_Body_Dirty_Words 67764 14.19 24.47 11.93 27 RCVD_IN_MSPIKE_H2 65514 11.10 9.15 11.53 28 TR_XM_DK_Bayes2 65201 9.58 0.99 11.47 29 FSL_BULK_SIG 59588 11.58 16.56 10.49 30 XM_B_Unsub 52777 10.22 14.43 9.29 31 RCVD_IN_MSPIKE_WL 50666 8.20 4.96 8.92 32 RCVD_IN_MSPIKE_H3 50659 8.20 4.96 8.92 33 XM_Evil_Numbers_Gen 46979 8.96 12.10 8.27 34 RCVD_IN_RP_SAFE 46634 7.10 2.09 8.21 35 LOTS_OF_MONEY 44446 8.39 10.98 7.82 36 LotsOfNums_01 42763 7.72 8.59 7.53 37 TooManyTo_001 41977 7.04 5.44 7.39 38 RCVD_IN_RP_CERTIFIED 41888 6.38 1.89 7.37 39 ANY_BOUNCE_MESSAGE 40312 5.91 0.55 7.09 40 BOUNCE_MESSAGE 40298 5.91 0.55 7.09 41 HTML_IMAGE_RATIO_02 38640 8.14 14.20 6.80 42 TM2_M_URI_OPT_OUT 37628 6.69 7.01 6.62 43 XM_DKIMWhitelistDomains 36335 5.24 0.01 6.39 44 XM_B_Phish_Phrases 35561 7.05 10.61 6.26 45 BAYES_40 34987 5.61 3.13 6.16 46 XM_SendGrid 33831 5.74 4.75 5.95 47 BAYES_60 32004 5.78 6.47 5.63 48 XM_H_Long_From01 31911 6.01 7.79 5.62 49 XMNumbers 31546 5.70 6.40 5.55 50 MIME_QP_LONG_LINE 31312 5.42 4.98 5.51 51 RELAYCOUNTRY_META 31152 7.95 19.11 5.48 52 XM_DK_Undo_02 31041 10.81 35.04 5.46 53 HTML_IMAGE_RATIO_04 31008 5.38 5.02 5.46 54 RCVD_IN_IADB_LISTED 28832 4.50 1.90 5.07 55 BAYES_20 26677 4.26 2.30 4.69 56 DKIM_INVALID 25746 4.92 6.66 4.53 57 MPART_ALT_DIFF 25524 5.23 8.55 4.49 58 RCVD_IN_IADB_SPF 24973 3.93 1.81 4.39 59 T_TooManySym_01 24892 4.03 2.47 4.38 60 XM_PDF 23750 3.57 0.79 4.18 61 XMSubMetaSx_00 22933 5.11 9.96 4.04 62 XMSexyCombo_05 22855 6.13 15.70 4.02 63 XMStrtUSub 22578 3.85 3.27 3.97 64 BOTNET_IPINHOSTNAME 22170 6.39 17.67 3.90 65 RCVD_IN_IADB_SENDERID 21770 3.46 1.76 3.83 66 RCVD_IN_IADB_DK 21580 3.43 1.76 3.80 67 HTML_IMAGE_RATIO_06 21428 3.81 3.99 3.77 68 T_REMOTE_IMAGE 20484 3.54 3.22 3.60 69 BAYES_05 19643 3.06 1.28 3.46 70 IN_ZIMBRA_NJ_WHITELIST 18755 2.71 0.02 3.30 71 RCVD_IN_IADB_VOUCHED 18625 2.76 0.42 3.28 72 TR_XM_DK_SendGrid 18183 3.07 2.47 3.20 73 TONOM_EQ_TOLOC_SHRT_SHRTNER 16882 3.07 3.51 2.97 74 XM_UncommonTLD01 16234 4.89 14.08 2.86 75 MIME_HTML_ONLY_MULTI 15935 2.98 3.78 2.80 76 BAYES_99 15874 6.98 25.93 2.79 77 HTML_IMAGE_RATIO_08 15545 2.75 2.81 2.74 78 FROM_EXCESS_BASE64 15537 3.44 6.64 2.73 79 XM_H_Trusted_IP 15498 2.23 0.00 2.73 80 XM_DIRTYINTL 15179 3.49 7.20 2.67 81 BAYES_80 14528 3.56 8.11 2.56 82 MIME_HTML_MOSTLY 14318 3.13 5.90 2.52 83 T_TooManySym_02 13647 2.12 0.82 2.40 84 BAYES_999 12601 5.42 19.92 2.22 85 RCVD_IN_IADB_OPTIN 11955 1.78 0.32 2.10 86 MAILING_LIST_MULTI 11751 1.98 1.58 2.07 87 HTML_MIME_NO_HTML_TAG 11581 2.57 4.98 2.04 88 XM_CamelCaseFrm001 11397 2.28 3.51 2.01 89 TR_XM_PHPDW 11267 2.59 5.33 1.98 90 TR_XM_FormFill2 11168 2.03 2.30 1.97 91 TR_XM_PHPForged 11160 2.03 2.32 1.96 92 XM_H_PHPOS 11129 2.02 2.30 1.96 93 KHOP_HELO_FCRDNS 10477 2.41 4.99 1.84 94 TooManyTo_002 10442 1.62 0.62 1.84 95 UNPARSEABLE_RELAY 10005 1.59 0.83 1.76 96 URIBL_DBL_ABUSE_REDIR 9877 2.20 4.29 1.74 97 XM_B_Unsub2 9659 2.08 3.80 1.70 98 BOTNET 9629 4.51 17.28 1.69 99 RELAYCOUNTRY_CA 9369 2.17 4.53 1.65 100 XM_DK_Undo_01 9365 1.68 1.83 1.65 101 XM_SPF_SoftFail 9355 2.04 3.82 1.65 102 XM_B_SpammyTLD 9322 2.32 5.40 1.64 103 HELO_NODOT 8673 1.39 0.79 1.53 104 HELO_NO_DOMAIN 8629 1.38 0.78 1.52 105 T_XMDrugObfuBody_08 8493 1.78 3.09 1.49 106 UNTRUSTED_Relay 8480 3.40 12.02 1.49 107 T_XMDrugObfuBody_14 8478 1.64 2.31 1.49 108 XMDiploma_00 8417 1.59 2.07 1.48 109 XM_H_PHPMailer 8276 2.01 4.49 1.46 110 TVD_RCVD_IP 8031 1.25 0.49 1.41 111 IN_HORDE_ADDRESS_BOOK 8022 1.16 0.04 1.41 112 INVALID_MSGID 7987 1.22 0.35 1.41 113 BAYES_95 7939 1.86 3.96 1.40 114 RELAYCOUNTRY_GB 7858 1.45 1.74 1.38 115 XMSubNoVowel 7806 1.18 0.33 1.37 116 XMCapTrack 7735 1.21 0.55 1.36 117 TM2_M_VERY_LONG_WORD 7708 1.43 1.78 1.36 118 SUBJ_ALL_CAPS 7701 1.35 1.34 1.36 119 TR_Symld_Words 7614 1.30 1.11 1.34 120 TR_DCC_Bayes_99 7496 4.71 20.08 1.32 121 TooManyTo_003 6964 1.09 0.50 1.23 122 XMStockSpam_06 6904 1.38 2.11 1.22 123 TO_MALFORMED 6858 0.99 0.01 1.21 124 XM_OfRef6 6778 1.60 3.44 1.19 125 XMPhish11 6744 1.75 4.31 1.19 126 XM_H_PHPOS_M 6383 1.15 1.27 1.12 127 URI_HEX 6244 1.36 2.56 1.10 128 HELO_DYNAMIC_IPADDR2 6208 0.90 0.04 1.09 129 CK_HELO_DYNAMIC_SPLIT_IP 6208 0.91 0.11 1.09 130 RCVD_IN_MSPIKE_BL 6090 1.28 2.23 1.07 131 XM_GoogleGroups 6051 0.95 0.41 1.06 132 TR_XM_RelayPhish 5966 1.28 2.31 1.05 133 RCVD_IN_BL_SPAMCOP_NET 5948 1.68 4.58 1.05 134 NO_DNS_FOR_FROM 5914 1.31 2.55 1.04 135 T_XMDrugObfuBody_00 5811 1.06 1.24 1.02 136 URI_TRY_3LD 5742 1.16 1.86 1.01 137 DKIM_ADSP_CUSTOM_MED 5728 1.02 1.10 1.01 138 T_FILL_THIS_FORM_SHORT 5593 1.09 1.60 0.98 139 XMGenDplmaNmb 5561 1.05 1.35 0.98 140 XM_H_Long_From02 5519 1.02 1.26 0.97 141 XMGappySubj_01 5474 0.96 0.97 0.96 142 USER_IN_DEF_DKIM_WL 5427 0.78 0.00 0.96 143 TooManyTo_004 5097 0.81 0.40 0.90 144 TR_MetaPhish_Combo_01 5011 0.89 0.92 0.88 145 HTML_FONT_FACE_BAD 4880 0.82 0.67 0.86 146 XMHTML_After_End 4814 1.89 6.59 0.85 147 XMBdyGiftCard01 4706 0.96 1.53 0.83 148 XM_UB50 4567 1.88 6.75 0.80 149 TooManyTo_005 4305 0.68 0.33 0.76 150 SpammyFromTLD_01 4280 1.35 4.05 0.75 151 NML_ADSP_CUSTOM_MED 4269 0.77 0.85 0.75 152 XM_ProductURIs 4262 0.80 1.02 0.75 153 XMSexyCombo_01 3890 1.03 2.59 0.68 154 T_XMHurry_00 3855 0.90 1.89 0.68 155 XMBody_95 3727 0.55 0.10 0.66 156 TO_NO_BRKTS_HTML_ONLY 3651 0.59 0.37 0.64 157 HTTPS_HTTP_MISMATCH 3541 0.63 0.68 0.62 158 XMBody_17 3524 0.87 2.00 0.62 159 T_Symld_Words_02 3462 0.64 0.77 0.61 160 XMBrknScrpt_02 3412 0.59 0.57 0.60 161 XM_SPF_Unknown 3332 0.61 0.71 0.59 162 HTML_IMAGE_ONLY_20 3329 0.53 0.29 0.59 163 FILL_THIS_FORM 3296 0.53 0.32 0.58 164 XMMoneyMeta_00 3271 0.64 0.95 0.58 165 XMSubMetaI_00 3248 0.76 1.61 0.57 166 XMHTMLBadTable_001 3228 0.62 0.83 0.57 167 XMSlimDrugH 3174 0.66 1.12 0.56 168 XMNoVowels 3112 0.59 0.77 0.55 169 REMOVE_BEFORE_LINK 3109 0.67 1.23 0.55 170 RCVD_IN_MSPIKE_L3 3088 0.69 1.38 0.54 171 FORGED_GMAIL_RCVD 3066 0.61 0.95 0.54 172 XMPhish30 2992 0.59 0.86 0.53 173 T_OBFU_PDF_ATTACH 2973 0.46 0.19 0.52 174 XM_ShortIntro_01 2859 0.47 0.32 0.50 175 RELAYCOUNTRY_AU 2771 0.49 0.50 0.49 176 HTML_TAG_BALANCE_BODY 2745 0.49 0.53 0.48 177 FROM_GOV_SPOOF 2738 0.43 0.19 0.48 178 XM_B_REG_HTML 2686 0.43 0.22 0.47 179 HTML_IMAGE_ONLY_28 2685 0.50 0.64 0.47 180 DIET_1 2660 0.73 1.91 0.47 181 XMSubMetaSxObfu_03 2584 0.51 0.76 0.45 182 MISSING_HEADERS 2577 0.47 0.55 0.45 183 FROM_GOV_DKIM_AU 2569 0.42 0.25 0.45 184 USER_IN_WHITELIST 2534 0.37 0.00 0.45 185 TM2_M_A_HREF_HREF 2459 0.45 0.51 0.43 186 XMPhish14 2411 0.51 0.91 0.42 187 SHORT_HELO_AND_INLINE_IMAGE 2360 0.35 0.07 0.42 188 PDS_TINYSUBJ_URISHRT 2354 0.48 0.80 0.41 189 FILL_THIS_FORM_LONG 2347 0.39 0.27 0.41 190 T_TooManySym_03 2308 0.37 0.21 0.41 191 PDS_OTHER_BAD_TLD 2230 0.82 2.77 0.39 192 XM_Body_Obfu01 2217 0.49 0.92 0.39 193 XMLngstWrd_00 2172 0.40 0.46 0.38 194 XMDateMe_00 2150 0.39 0.44 0.38 195 TM2_M_BODY_EMPTY 2121 0.32 0.07 0.37 196 T_FILL_THIS_FORM_LOAN 2111 0.32 0.06 0.37 197 HTML_IMAGE_ONLY_32 2100 0.34 0.20 0.37 198 RELAYCOUNTRY_FR 2085 0.79 2.73 0.37 199 PLING_QUERY 2084 0.45 0.80 0.37 200 XMSolicitRefs_0 2025 0.37 0.45 0.36 ----------------------------------------------------------------------