Email: 717762 Autolearn: 0 AvgScore: -0.24 AvgScanTime: 1.92 sec Spam: 107742 Autolearn: 0 AvgScore: 12.80 AvgScanTime: 2.67 sec Ham: 610020 Autolearn: 0 AvgScore: -2.54 AvgScanTime: 1.79 sec Time Spent Running SA: 383.63 hours Time Spent Processing Spam: 79.80 hours Time Spent Processing Ham: 303.84 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102011 87.27 94.68 85.96 2 DCC_CHECK 85250 43.59 79.12 37.32 3 DKIM_SIGNED 79700 65.79 73.97 64.34 4 XM_DK_Pass 77594 64.60 72.02 63.29 5 XM_B_Unicode 74098 68.83 68.77 68.84 6 DKIM_VALID 72115 61.24 66.93 60.24 7 XMListUnsubscribeExists 65519 46.93 60.81 44.48 8 BAYES_50 54313 47.23 50.41 46.67 9 DKIM_VALID_AU 52254 45.58 48.50 45.06 10 XM_B_Unicode3 44581 41.74 41.38 41.81 11 MIME_HTML_ONLY 43561 24.62 40.43 21.83 12 XM_DK_Undo_02 35452 9.39 32.90 5.24 13 HTML_FONT_LOW_CONTRAST 33233 25.00 30.84 23.96 14 LOC_TINY_FONT_1 31775 22.00 29.49 20.68 15 XMSubLong 28705 20.38 26.64 19.27 16 DKIM_VALID_EF 28586 23.01 26.53 22.39 17 XM_Body_Dirty_Words 26315 13.90 24.42 12.04 18 RELAYCOUNTRY_META 26245 7.86 24.36 4.94 19 FVGT_m_MULTI_ODD 25788 20.70 23.93 20.13 20 T_TM2_M_HEADER_IN_MSG 24598 25.13 22.83 25.54 21 BOTNET 23899 4.64 22.18 1.54 22 BAYES_99 23895 5.40 22.18 2.44 23 T_KAM_HTML_FONT_INVALID 22228 16.18 20.63 15.40 24 MultiRelay 21087 17.23 19.57 16.82 25 XM_UncommonTLD01 20711 5.24 19.22 2.77 26 DCC_CHECK_NEGATIVE 20463 54.61 18.99 60.90 27 BOTNET_IPINHOSTNAME 19845 5.72 18.42 3.48 28 XM_Multi_Part_URI 19668 12.89 18.25 11.94 29 FSL_BULK_SIG 18543 9.86 17.21 8.56 30 XM_B_Unsub 18038 10.51 16.74 9.42 31 TR_DCC_Bayes_99 17763 3.41 16.49 1.10 32 UNTRUSTED_Relay 17223 3.56 15.99 1.36 33 BAYES_999 17157 3.98 15.92 1.87 34 XMSexyCombo_05 16195 6.04 15.03 4.45 35 HTML_IMAGE_RATIO_02 14165 7.01 13.15 5.93 36 LOTS_OF_MONEY 13844 9.02 12.85 8.35 37 XM_Evil_Numbers_Gen 13137 9.69 12.19 9.25 38 XM_UB50 11462 2.18 10.64 0.68 39 KHOP_HELO_FCRDNS 10351 3.45 9.61 2.36 40 HTML_MIME_NO_HTML_TAG 10090 3.09 9.36 1.99 41 RCVD_IN_MSPIKE_H2 9955 10.49 9.24 10.72 42 T_REMOTE_IMAGE 9557 4.31 8.87 3.51 43 XMSubMetaSx_00 9537 4.85 8.85 4.15 44 MPART_ALT_DIFF 9404 7.79 8.73 7.63 45 XM_H_Long_From01 9245 5.65 8.58 5.13 46 SpammyFromTLD_02 9185 1.50 8.52 0.26 47 LotsOfNums_01 9112 7.20 8.46 6.97 48 XM_B_Phish_Phrases 8557 6.09 7.94 5.77 49 XM_DIRTYINTL 8331 3.53 7.73 2.79 50 BAYES_80 7760 2.73 7.20 1.94 51 HTML_SHORT_LINK_IMG_1 7695 1.09 7.14 0.02 52 DKIM_INVALID 7585 4.54 7.04 4.10 53 FROM_SUSPICIOUS_NTLD 7543 1.16 7.00 0.13 54 FROM_SUSPICIOUS_NTLD_FP 7498 1.15 6.96 0.12 55 HTML_IMAGE_RATIO_04 6927 12.77 6.43 13.89 56 MIME_HEADER_CTYPE_ONLY 6889 1.11 6.39 0.18 57 HDRS_LCASE_IMGONLY 6870 0.97 6.38 0.02 58 RCVD_IN_BL_SPAMCOP_NET 6475 2.03 6.01 1.33 59 BAYES_60 6427 4.78 5.97 4.57 60 DKIM_ADSP_NXDOMAIN 5972 1.20 5.54 0.43 61 XM_URI_RBL 5889 1.04 5.47 0.26 62 TooManyTo_001 5763 6.50 5.35 6.70 63 XMNumbers 5743 3.49 5.33 3.16 64 MIME_HTML_MOSTLY 5427 2.49 5.04 2.04 65 RELAYCOUNTRY_CA 5411 2.03 5.02 1.50 66 MIME_QP_LONG_LINE 5294 5.06 4.91 5.09 67 XM_SPF_SoftFail 5170 2.07 4.80 1.59 68 XM_SendGrid 5146 5.36 4.78 5.46 69 URI_NOVOWEL 4740 0.89 4.40 0.27 70 HDRS_MISSP 4326 0.61 4.02 0.00 71 TM2_M_URI_OPT_OUT 4325 5.77 4.01 6.08 72 RCVD_IN_MSPIKE_H3 4319 8.22 4.01 8.96 73 RCVD_IN_MSPIKE_WL 4319 8.22 4.01 8.96 74 RDNS_DYNAMIC 4311 0.80 4.00 0.24 75 DIET_1 4299 0.97 3.99 0.44 76 FROM_EXCESS_BASE64 4278 2.83 3.97 2.63 77 SHORT_IMG_SUSP_NTLD 4204 0.59 3.90 0.00 78 HTML_IMAGE_ONLY_08 4124 0.68 3.83 0.12 79 PDS_OTHER_BAD_TLD 4105 1.00 3.81 0.50 80 BAYES_95 3950 1.55 3.67 1.18 81 XMBdyGiftCard01 3925 1.27 3.64 0.85 82 MIME_HTML_ONLY_MULTI 3871 5.69 3.59 6.07 83 XM_B_Unsub2 3858 2.35 3.58 2.13 84 XMSexyCombo_01 3833 1.13 3.56 0.71 85 RELAYCOUNTRY_IN 3752 0.64 3.48 0.13 86 HTML_IMAGE_RATIO_06 3740 4.52 3.47 4.71 87 ALL_TRUSTED 3718 15.91 3.45 18.11 88 BAYES_40 3701 5.50 3.44 5.87 89 FSL_THIS_IS_ADV 3672 0.69 3.41 0.21 90 RELAYCOUNTRY_FR 3603 0.72 3.34 0.26 91 SpammyFromTLD_01 3565 1.06 3.31 0.67 92 XMHTML_After_End 3528 1.24 3.27 0.88 93 T_XMDrugObfuBody_08 3511 1.81 3.26 1.55 94 HTML_IMAGE_ONLY_12 3430 0.60 3.18 0.14 95 TR_Mismatch_TLD_02 3416 0.52 3.17 0.05 96 T_TooManySym_01 3413 4.00 3.17 4.15 97 RCVD_IN_RP_RNBL 3399 0.57 3.15 0.11 98 XMStrtUSub 3365 7.04 3.12 7.73 99 HTML_IMAGE_RATIO_08 3306 2.41 3.07 2.29 100 XM_B_SpammyTLD 3264 1.84 3.03 1.63 101 THIS_AD 3243 0.69 3.01 0.28 102 REPLYTO_WITHOUT_TO_CC 3227 0.48 3.00 0.04 103 RCVD_IN_MSPIKE_BL 3145 1.29 2.92 1.00 104 MultiRelay_CC 3078 0.58 2.86 0.18 105 MultiRelay_Combo 3078 0.58 2.86 0.18 106 URIBL_DBL_ABUSE_REDIR 3003 1.13 2.79 0.84 107 XM_CamelCaseFrm001 2956 2.03 2.74 1.90 108 BAYES_20 2935 5.21 2.72 5.64 109 NO_DNS_FOR_FROM 2902 1.31 2.69 1.07 110 TR_XM_RelayPhish 2875 1.22 2.67 0.96 111 BAYES_00 2820 23.30 2.62 26.96 112 LongTLD 2809 0.62 2.61 0.27 113 BOTNET_NORDNS 2784 0.43 2.58 0.05 114 ADMITS_SPAM 2719 0.42 2.52 0.05 115 RCVD_IN_RP_SAFE 2701 6.93 2.51 7.71 116 TO_EQ_FM_DOM_HTML_IMG 2641 0.38 2.45 0.01 117 URI_HEX 2583 1.59 2.40 1.45 118 RCVD_IN_RP_CERTIFIED 2536 6.44 2.35 7.16 119 XMDiploma_00 2512 1.57 2.33 1.43 120 RELAYCOUNTRY_DE 2443 0.56 2.27 0.26 121 XM_OfRef6 2442 1.36 2.27 1.20 122 TR_XM_PHPDW 2424 0.76 2.25 0.50 123 TR_XM_PHPForged 2391 0.75 2.22 0.49 124 TR_XM_FormFill2 2373 0.74 2.20 0.49 125 XM_H_PHPOS 2361 0.74 2.19 0.48 126 XMBody_17 2297 0.97 2.13 0.77 127 URI_TRY_3LD 2296 1.07 2.13 0.88 128 EXCUSE_4 2259 0.32 2.10 0.01 129 DATE_IN_PAST_03_06 2184 0.43 2.03 0.15 130 TR_XM_DK_SendGrid 2161 2.95 2.01 3.12 131 XMSlimDrugH 2083 0.58 1.93 0.34 132 RCVD_IN_MSPIKE_L3 2053 0.73 1.91 0.52 133 TR_XM_DK_Bayes 2048 12.13 1.90 13.94 134 FVGT_m_MULTI_ODD_EMAIL 2034 0.30 1.89 0.02 135 RELAYCOUNTRY_GB 2022 1.33 1.88 1.23 136 XMPhish11 2003 1.20 1.86 1.08 137 RCVD_IN_IADB_LISTED 1978 4.19 1.84 4.61 138 NO_FM_NAME_IP_HOSTN 1966 0.27 1.82 0.00 139 XMStockSpam_06 1946 1.46 1.81 1.40 140 TM2_M_VERY_LONG_WORD 1917 1.22 1.78 1.12 141 TR_Symld_Words 1865 1.43 1.73 1.38 142 RCVD_IN_IADB_SPF 1833 3.63 1.70 3.98 143 TR_XM_DK_Bayes1 1808 11.56 1.68 13.31 144 T_XMDrugObfuBody_14 1804 1.43 1.67 1.39 145 RCVD_IN_IADB_DK 1770 3.16 1.64 3.43 146 RCVD_IN_IADB_SENDERID 1767 3.19 1.64 3.47 147 XMSexyCombo_04 1763 0.47 1.64 0.27 148 XMSubMetaI_00 1729 0.85 1.60 0.71 149 TONOM_EQ_TOLOC_SHRT_SHRTNER 1717 1.39 1.59 1.36 150 XMGenDplmaNmb 1680 1.04 1.56 0.95 151 T_XMHurry_00 1677 0.79 1.56 0.66 152 BAYES_05 1668 4.05 1.55 4.49 153 XM_H_PHPMailer 1665 0.59 1.55 0.43 154 XMSubMetaSSx_00 1664 0.49 1.54 0.30 155 T_MONEY_PERCENT 1639 0.58 1.52 0.41 156 TR_LOTS_OF_MONEY2 1639 0.58 1.52 0.41 157 MAILING_LIST_MULTI 1632 1.80 1.51 1.85 158 TR_XM_INV_DKIM 1611 0.32 1.50 0.11 159 T_Symld_Words_02 1598 0.86 1.48 0.75 160 BODY_URI_ONLY 1589 0.29 1.47 0.09 161 FROM_DOMAIN_NOVOWEL 1579 0.25 1.47 0.03 162 DATE_IN_PAST_06_12 1564 0.29 1.45 0.08 163 XM_DK_Undo_01 1556 1.43 1.44 1.43 164 T_XMDrugObfuBody_00 1539 1.02 1.43 0.95 165 SUBJ_ALL_CAPS 1514 1.33 1.41 1.32 166 XM_H_PHPOS_M 1456 0.32 1.35 0.14 167 HTML_TITLE_SUBJ_DIFF 1456 0.24 1.35 0.04 168 XMWghtMeta_00 1426 0.25 1.32 0.06 169 RCVD_IN_PSBL 1408 0.22 1.31 0.03 170 DKIM_ADSP_CUSTOM_MED 1387 0.95 1.29 0.89 171 XMSubMetaSxObfu_03 1374 0.59 1.28 0.46 172 LONG_HEX_URI 1339 0.32 1.24 0.16 173 HK_RANDOM_REPLYTO 1336 0.34 1.24 0.18 174 T_TooManySym_02 1334 1.89 1.24 2.01 175 XM_UB99 1333 0.19 1.24 0.00 176 HTML_TAG_BALANCE_CENTER 1306 0.24 1.21 0.06 177 TR_Mismatch_TLD_01 1299 0.40 1.21 0.26 178 TR_LOTS_OF_MONEY3 1299 0.50 1.21 0.38 179 T_FILL_THIS_FORM_SHORT 1292 0.90 1.20 0.84 180 XM_UB60 1292 0.22 1.20 0.05 181 TR_XM_DK_Bayes2 1291 10.22 1.20 11.82 182 MPART_ALT_DIFF_COUNT 1284 0.35 1.19 0.20 183 HK_RANDOM_FROM 1245 0.29 1.16 0.14 184 XMSubMetaSx_01 1239 0.24 1.15 0.08 185 URIBL_SBL_A 1233 0.45 1.14 0.33 186 FORGED_GMAIL_RCVD 1229 0.59 1.14 0.49 187 TR_MetaPhish_Combo_01 1167 0.68 1.08 0.61 188 SUBJ_DOLLARS 1161 0.48 1.08 0.38 189 XMSexyCombo_02 1137 0.17 1.06 0.02 190 UNPARSEABLE_RELAY 1136 1.67 1.05 1.78 191 TVD_SPACE_RATIO_MINFP 1127 0.17 1.05 0.01 192 XM_PDF 1105 3.40 1.03 3.82 193 MSGID_FROM_MTA_HEADER 1100 0.38 1.02 0.27 194 XMBody_78 1095 0.40 1.02 0.29 195 TVD_SPACE_RATIO 1084 0.39 1.01 0.28 196 LOW_PRICE 1080 0.89 1.00 0.87 197 XMPhish14 1072 0.48 0.99 0.39 198 HELO_NODOT 1068 1.34 0.99 1.40 199 XMMoneyMeta_00 1068 0.55 0.99 0.47 200 HELO_NO_DOMAIN 1066 1.33 0.99 1.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 524372 87.27 94.68 85.96 2 XM_B_Unicode 419910 68.83 68.77 68.84 3 DKIM_SIGNED 392493 65.79 73.97 64.34 4 XM_DK_Pass 386087 64.60 72.02 63.29 5 DCC_CHECK_NEGATIVE 371488 54.61 18.99 60.90 6 DKIM_VALID 367463 61.24 66.93 60.24 7 BAYES_50 284713 47.23 50.41 46.67 8 DKIM_VALID_AU 274888 45.58 48.50 45.06 9 XMListUnsubscribeExists 271326 46.93 60.81 44.48 10 XM_B_Unicode3 255024 41.74 41.38 41.81 11 DCC_CHECK 227639 43.59 79.12 37.32 12 BAYES_00 164437 23.30 2.62 26.96 13 T_TM2_M_HEADER_IN_MSG 155778 25.13 22.83 25.54 14 HTML_FONT_LOW_CONTRAST 146179 25.00 30.84 23.96 15 DKIM_VALID_EF 136558 23.01 26.53 22.39 16 MIME_HTML_ONLY 133158 24.62 40.43 21.83 17 LOC_TINY_FONT_1 126139 22.00 29.49 20.68 18 FVGT_m_MULTI_ODD 122776 20.70 23.93 20.13 19 XMSubLong 117553 20.38 26.64 19.27 20 ALL_TRUSTED 110477 15.91 3.45 18.11 21 MultiRelay 102606 17.23 19.57 16.82 22 T_KAM_HTML_FONT_INVALID 93915 16.18 20.63 15.40 23 TR_XM_DK_Bayes 85016 12.13 1.90 13.94 24 HTML_IMAGE_RATIO_04 84719 12.77 6.43 13.89 25 TR_XM_DK_Bayes1 81173 11.56 1.68 13.31 26 XM_Body_Dirty_Words 73426 13.90 24.42 12.04 27 XM_Multi_Part_URI 72854 12.89 18.25 11.94 28 TR_XM_DK_Bayes2 72088 10.22 1.20 11.82 29 RCVD_IN_MSPIKE_H2 65368 10.49 9.24 10.72 30 XM_H_Trusted_IP 63830 8.89 0.00 10.46 31 HTML_FONT_FACE_BAD 63109 8.90 0.74 10.35 32 XM_B_Unsub 57434 10.51 16.74 9.42 33 XM_Evil_Numbers_Gen 56406 9.69 12.19 9.25 34 RCVD_IN_MSPIKE_WL 54653 8.22 4.01 8.96 35 RCVD_IN_MSPIKE_H3 54650 8.22 4.01 8.96 36 FSL_BULK_SIG 52203 9.86 17.21 8.56 37 LOTS_OF_MONEY 50926 9.02 12.85 8.35 38 XMStrtUSub 47138 7.04 3.12 7.73 39 ANY_BOUNCE_MESSAGE 47062 6.64 0.58 7.71 40 BOUNCE_MESSAGE 47058 6.64 0.58 7.71 41 RCVD_IN_RP_SAFE 47021 6.93 2.51 7.71 42 MPART_ALT_DIFF 46529 7.79 8.73 7.63 43 RCVD_IN_RP_CERTIFIED 43674 6.44 2.35 7.16 44 LotsOfNums_01 42533 7.20 8.46 6.97 45 TooManyTo_001 40865 6.50 5.35 6.70 46 TM2_M_URI_OPT_OUT 37087 5.77 4.01 6.08 47 MIME_HTML_ONLY_MULTI 36998 5.69 3.59 6.07 48 XM_DKIMWhitelistDomains 36946 5.15 0.01 6.06 49 HTML_IMAGE_RATIO_02 36164 7.01 13.15 5.93 50 BAYES_40 35811 5.50 3.44 5.87 51 XM_B_Phish_Phrases 35186 6.09 7.94 5.77 52 BAYES_20 34425 5.21 2.72 5.64 53 XM_SendGrid 33322 5.36 4.78 5.46 54 XM_DK_Undo_02 31946 9.39 32.90 5.24 55 XM_H_Long_From01 31303 5.65 8.58 5.13 56 MIME_QP_LONG_LINE 31056 5.06 4.91 5.09 57 RELAYCOUNTRY_META 30145 7.86 24.36 4.94 58 HTML_IMAGE_RATIO_06 28734 4.52 3.47 4.71 59 RCVD_IN_IADB_LISTED 28102 4.19 1.84 4.61 60 BAYES_60 27871 4.78 5.97 4.57 61 BAYES_05 27368 4.05 1.55 4.49 62 XMSexyCombo_05 27126 6.04 15.03 4.45 63 XMSubMetaSx_00 25309 4.85 8.85 4.15 64 T_TooManySym_01 25293 4.00 3.17 4.15 65 DKIM_INVALID 25030 4.54 7.04 4.10 66 XMSubNoVowel 24558 3.47 0.35 4.03 67 RCVD_IN_IADB_SPF 24249 3.63 1.70 3.98 68 XM_PDF 23294 3.40 1.03 3.82 69 T_REMOTE_IMAGE 21409 4.31 8.87 3.51 70 BOTNET_IPINHOSTNAME 21229 5.72 18.42 3.48 71 RCVD_IN_IADB_SENDERID 21146 3.19 1.64 3.47 72 RCVD_IN_IADB_DK 20908 3.16 1.64 3.43 73 XMNumbers 19287 3.49 5.33 3.16 74 TR_XM_DK_SendGrid 19025 2.95 2.01 3.12 75 IN_ZIMBRA_NJ_WHITELIST 18268 2.55 0.01 2.99 76 RCVD_IN_IADB_VOUCHED 18002 2.58 0.46 2.95 77 XM_DIRTYINTL 17033 3.53 7.73 2.79 78 XM_UncommonTLD01 16878 5.24 19.22 2.77 79 FROM_EXCESS_BASE64 16030 2.83 3.97 2.63 80 BAYES_99 14874 5.40 22.18 2.44 81 KHOP_HELO_FCRDNS 14376 3.45 9.61 2.36 82 HTML_IMAGE_RATIO_08 13989 2.41 3.07 2.29 83 XM_B_Unsub2 13013 2.35 3.58 2.13 84 MIME_HTML_MOSTLY 12470 2.49 5.04 2.04 85 T_TooManySym_02 12251 1.89 1.24 2.01 86 HTML_MIME_NO_HTML_TAG 12113 3.09 9.36 1.99 87 BAYES_80 11862 2.73 7.20 1.94 88 XM_CamelCaseFrm001 11604 2.03 2.74 1.90 89 BAYES_999 11415 3.98 15.92 1.87 90 MAILING_LIST_MULTI 11301 1.80 1.51 1.85 91 RCVD_IN_IADB_OPTIN 11215 1.62 0.36 1.84 92 UNPARSEABLE_RELAY 10857 1.67 1.05 1.78 93 TooManyTo_002 10571 1.58 0.68 1.73 94 XM_B_SpammyTLD 9955 1.84 3.03 1.63 95 XM_SPF_SoftFail 9678 2.07 4.80 1.59 96 T_XMDrugObfuBody_08 9454 1.81 3.26 1.55 97 BOTNET 9374 4.64 22.18 1.54 98 TVD_RCVD_IP 9280 1.39 0.64 1.52 99 RELAYCOUNTRY_CA 9160 2.03 5.02 1.50 100 URI_HEX 8821 1.59 2.40 1.45 101 XM_DK_Undo_01 8739 1.43 1.44 1.43 102 XMDiploma_00 8724 1.57 2.33 1.43 103 HELO_NODOT 8540 1.34 0.99 1.40 104 XMStockSpam_06 8524 1.46 1.81 1.40 105 HELO_NO_DOMAIN 8496 1.33 0.99 1.39 106 T_XMDrugObfuBody_14 8482 1.43 1.67 1.39 107 TR_Symld_Words 8412 1.43 1.73 1.38 108 UNTRUSTED_Relay 8298 3.56 15.99 1.36 109 TONOM_EQ_TOLOC_SHRT_SHRTNER 8286 1.39 1.59 1.36 110 INVALID_MSGID 8253 1.18 0.21 1.35 111 RCVD_IN_BL_SPAMCOP_NET 8085 2.03 6.01 1.33 112 SUBJ_ALL_CAPS 8065 1.33 1.41 1.32 113 IN_HORDE_ADDRESS_BOOK 7951 1.11 0.03 1.30 114 XMSubGarbage 7869 1.10 0.04 1.29 115 XMSubLongNoVowel 7775 1.10 0.10 1.27 116 RELAYCOUNTRY_GB 7515 1.33 1.88 1.23 117 XM_OfRef6 7311 1.36 2.27 1.20 118 BAYES_95 7195 1.55 3.67 1.18 119 XMLngstWrd_00 7120 1.05 0.41 1.17 120 TooManyTo_003 6920 1.04 0.50 1.13 121 TM2_M_VERY_LONG_WORD 6847 1.22 1.78 1.12 122 TO_MALFORMED 6837 0.97 0.09 1.12 123 XMCapTrack 6764 1.02 0.53 1.11 124 TR_DCC_Bayes_99 6692 3.41 16.49 1.10 125 XMPhish11 6589 1.20 1.86 1.08 126 NO_DNS_FOR_FROM 6528 1.31 2.69 1.07 127 XM_RXBody 6489 0.97 0.47 1.06 128 CK_HELO_DYNAMIC_SPLIT_IP 6247 0.88 0.06 1.02 129 HELO_DYNAMIC_IPADDR2 6243 0.87 0.03 1.02 130 RCVD_IN_MSPIKE_BL 6093 1.29 2.92 1.00 131 USER_IN_DEF_DKIM_WL 6067 0.85 0.02 0.99 132 XM_GoogleGroups 5961 0.90 0.48 0.98 133 TR_XM_RelayPhish 5871 1.22 2.67 0.96 134 XMLngstWrd_01 5825 0.87 0.38 0.95 135 T_XMDrugObfuBody_00 5808 1.02 1.43 0.95 136 XM_E_Blogspot 5792 0.82 0.09 0.95 137 XMGenDplmaNmb 5767 1.04 1.56 0.95 138 XM_H_Long_From02 5678 0.92 0.88 0.93 139 XMSolicitRefs_0 5599 0.83 0.33 0.92 140 DKIM_ADSP_CUSTOM_MED 5445 0.95 1.29 0.89 141 XMHTML_After_End 5373 1.24 3.27 0.88 142 URI_TRY_3LD 5354 1.07 2.13 0.88 143 LOW_PRICE 5315 0.89 1.00 0.87 144 XMBdyGiftCard01 5179 1.27 3.64 0.85 145 T_FILL_THIS_FORM_SHORT 5152 0.90 1.20 0.84 146 URIBL_DBL_ABUSE_REDIR 5096 1.13 2.79 0.84 147 TooManyTo_004 5077 0.77 0.39 0.83 148 XMGappySubj_01 4811 0.81 0.95 0.79 149 XMBody_17 4674 0.97 2.13 0.77 150 T_Symld_Words_02 4546 0.86 1.48 0.75 151 XMSubMetaI_00 4349 0.85 1.60 0.71 152 XMSexyCombo_01 4301 1.13 3.56 0.71 153 XMBrknScrpt_02 4288 0.74 0.93 0.70 154 TooManyTo_005 4258 0.64 0.34 0.70 155 XMLngstWrd_02 4203 0.63 0.28 0.69 156 XM_UB50 4155 2.18 10.64 0.68 157 SpammyFromTLD_01 4072 1.06 3.31 0.67 158 NML_ADSP_CUSTOM_MED 4045 0.71 0.97 0.66 159 T_XMHurry_00 4020 0.79 1.56 0.66 160 TR_MetaPhish_Combo_01 3741 0.68 1.08 0.61 161 XM_B_REG_HTML 3554 0.56 0.44 0.58 162 XMBody_95 3542 0.52 0.17 0.58 163 XM_ProductURIs 3449 0.62 0.95 0.57 164 XMNoVowels 3408 0.58 0.72 0.56 165 XM_SPF_Unknown 3314 0.58 0.82 0.54 166 HTML_IMAGE_ONLY_20 3297 0.53 0.45 0.54 167 RCVD_IN_MSPIKE_L3 3170 0.73 1.91 0.52 168 FILL_THIS_FORM 3117 0.49 0.39 0.51 169 REMOVE_BEFORE_LINK 3092 0.56 0.88 0.51 170 PDS_OTHER_BAD_TLD 3074 1.00 3.81 0.50 171 HTTPS_HTTP_MISMATCH 3071 0.56 0.87 0.50 172 TR_XM_PHPDW 3052 0.76 2.25 0.50 173 TR_XM_PHPForged 2986 0.75 2.22 0.49 174 FORGED_GMAIL_RCVD 2986 0.59 1.14 0.49 175 T_OBFU_PDF_ATTACH 2974 0.46 0.28 0.49 176 TR_XM_FormFill2 2960 0.74 2.20 0.49 177 XM_H_PHPOS 2938 0.74 2.19 0.48 178 XMMoneyMeta_00 2860 0.55 0.99 0.47 179 XMSubMetaSxObfu_03 2826 0.59 1.28 0.46 180 T_TooManySym_03 2796 0.50 0.71 0.46 181 FROM_GOV_DKIM_AU 2757 0.41 0.18 0.45 182 PLING_QUERY 2717 0.48 0.65 0.45 183 DIET_1 2698 0.97 3.99 0.44 184 DKIM_ADSP_NXDOMAIN 2648 1.20 5.54 0.43 185 XM_ShortIntro_01 2648 0.44 0.47 0.43 186 XMPhish30 2627 0.47 0.71 0.43 187 XM_H_PHPMailer 2602 0.59 1.55 0.43 188 AC_DIV_BONANZA 2586 0.38 0.13 0.42 189 TR_LOTS_OF_MONEY2 2523 0.58 1.52 0.41 190 T_MONEY_PERCENT 2523 0.58 1.52 0.41 191 TM2_M_A_HREF_HREF 2490 0.44 0.59 0.41 192 XM_B_COPY_HTML 2430 0.45 0.76 0.40 193 XM_Body_Obfu01 2384 0.37 0.28 0.39 194 HTML_TAG_BALANCE_BODY 2379 0.41 0.51 0.39 195 FROM_GOV_SPOOF 2366 0.36 0.23 0.39 196 XMPhish14 2361 0.48 0.99 0.39 197 USER_IN_WHITELIST 2357 0.33 0.00 0.39 198 XMHTMLBadTable_001 2327 0.39 0.44 0.38 199 MISSING_HEADERS 2325 0.42 0.62 0.38 200 RELAYCOUNTRY_AU 2323 0.41 0.57 0.38 ----------------------------------------------------------------------