Email: 673203 Autolearn: 0 AvgScore: 2.09 AvgScanTime: 2.07 sec Spam: 149619 Autolearn: 0 AvgScore: 12.32 AvgScanTime: 3.56 sec Ham: 523584 Autolearn: 0 AvgScore: -0.83 AvgScanTime: 1.65 sec Time Spent Running SA: 387.36 hours Time Spent Processing Spam: 148.01 hours Time Spent Processing Ham: 239.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141201 86.62 94.37 84.40 2 RELAYCOUNTRY_US 120050 78.90 80.24 78.51 3 DCC_CHECK 118882 48.24 79.46 39.32 4 DKIM_SIGNED 115485 74.22 77.19 73.37 5 XM_DK_Pass 111393 72.67 74.45 72.17 6 XM_B_Unicode 110439 69.31 73.81 68.02 7 DKIM_VALID 96430 67.48 64.45 68.34 8 XMListUnsubscribeExists 94974 53.53 63.48 50.69 9 BAYES_50 72256 49.77 48.29 50.20 10 DKIM_VALID_AU 71246 50.46 47.62 51.28 11 XM_B_Unicode3 67611 41.35 45.19 40.26 12 MIME_HTML_ONLY 54919 23.68 36.71 19.96 13 XM_DK_Undo_02 50988 12.86 34.08 6.79 14 LOC_TINY_FONT_1 50510 25.35 33.76 22.95 15 HTML_FONT_LOW_CONTRAST 48277 27.55 32.27 26.20 16 FVGT_m_MULTI_ODD 38951 21.27 26.03 19.91 17 DKIM_VALID_EF 38432 25.52 25.69 25.47 18 XMSubLong 37237 20.55 24.89 19.31 19 BOTNET 34279 7.15 22.91 2.65 20 T_KAM_HTML_FONT_INVALID 33299 18.53 22.26 17.46 21 XM_Body_Dirty_Words 31862 14.46 21.30 12.51 22 FSL_BULK_SIG 31201 9.67 20.85 6.48 23 BAYES_99 30591 7.04 20.45 3.21 24 RELAYCOUNTRY_META 30110 8.88 20.12 5.67 25 T_TM2_M_HEADER_IN_MSG 28235 26.11 18.87 28.18 26 DCC_CHECK_NEGATIVE 27803 49.75 18.58 58.65 27 XM_B_Unsub 24839 11.25 16.60 9.72 28 BAYES_999 23755 5.55 15.88 2.60 29 XM_UncommonTLD01 23037 5.80 15.40 3.06 30 XM_Multi_Part_URI 22710 13.60 15.18 13.14 31 TR_DCC_Bayes_99 22575 4.78 15.09 1.83 32 LOTS_OF_MONEY 21413 9.90 14.31 8.63 33 DKIM_INVALID 19055 6.74 12.74 5.03 34 XMSexyCombo_05 18716 5.97 12.51 4.11 35 BOTNET_IPINHOSTNAME 18516 5.88 12.38 4.02 36 UNTRUSTED_Relay 17808 3.93 11.90 1.65 37 HTML_IMAGE_RATIO_02 17486 8.73 11.69 7.89 38 XM_Evil_Numbers_Gen 15839 8.92 10.59 8.45 39 XMSubMetaSx_00 15670 6.21 10.47 5.00 40 NO_DNS_FOR_FROM 15539 4.41 10.39 2.70 41 T_REMOTE_IMAGE 14114 5.14 9.43 3.91 42 RCVD_IN_MSPIKE_H2 13892 10.91 9.28 11.37 43 BAYES_80 12375 3.37 8.27 1.96 44 LotsOfNums_01 12179 7.87 8.14 7.80 45 MPART_ALT_DIFF 11892 4.90 7.95 4.03 46 XM_B_Phish_Phrases 11514 6.94 7.70 6.72 47 BAYES_60 11207 5.24 7.49 4.59 48 XM_H_Long_From01 10812 6.12 7.23 5.80 49 XM_UB50 10659 2.32 7.12 0.94 50 HTML_IMAGE_RATIO_04 9374 6.38 6.27 6.42 51 HTML_MIME_NO_HTML_TAG 9155 3.01 6.12 2.13 52 XMNumbers 9118 4.04 6.09 3.45 53 HTML_IMAGE_ONLY_08 8829 1.40 5.90 0.11 54 TooManyTo_001 8738 7.35 5.84 7.78 55 SpammyFromTLD_02 8730 1.54 5.83 0.31 56 KHOP_HELO_FCRDNS 8455 2.77 5.65 1.95 57 BODY_URI_ONLY 8238 1.29 5.51 0.08 58 XM_SPF_SoftFail 8066 2.57 5.39 1.76 59 MIME_HTML_MOSTLY 8024 2.74 5.36 1.99 60 HTML_SHORT_LINK_IMG_1 7754 1.17 5.18 0.03 61 MIME_QP_LONG_LINE 7742 5.44 5.17 5.51 62 HDRS_LCASE_IMGONLY 7647 1.16 5.11 0.03 63 XM_B_SpammyTLD 7587 2.65 5.07 1.96 64 XM_SendGrid 7267 5.55 4.86 5.75 65 RDNS_DYNAMIC 6963 1.30 4.65 0.34 66 RCVD_IN_BL_SPAMCOP_NET 6623 1.84 4.43 1.10 67 HTML_IMAGE_RATIO_06 6445 3.60 4.31 3.40 68 RCVD_IN_MSPIKE_BL 6337 1.82 4.24 1.14 69 XM_CamelCaseFrm001 6157 2.61 4.12 2.19 70 BOTNET_NORDNS 6072 0.95 4.06 0.06 71 BAYES_40 5993 5.08 4.01 5.38 72 MIME_HTML_ONLY_MULTI 5938 3.02 3.97 2.74 73 RELAYCOUNTRY_FR 5864 1.19 3.92 0.41 74 RELAYCOUNTRY_CA 5765 2.13 3.85 1.63 75 TR_Mismatch_TLD_02 5730 0.92 3.83 0.09 76 RCVD_IN_MSPIKE_H3 5717 8.33 3.82 9.62 77 RCVD_IN_MSPIKE_WL 5717 8.33 3.82 9.62 78 BAYES_95 5705 1.84 3.81 1.28 79 HTML_TAG_BALANCE_CENTER 5685 0.92 3.80 0.10 80 XM_DIRTYINTL 5620 1.22 3.76 0.50 81 XMStrtUSub 5551 4.36 3.71 4.54 82 TM2_M_URI_OPT_OUT 5529 6.50 3.70 7.30 83 SUBJ_ALL_CAPS 5502 2.18 3.68 1.75 84 XM_BadFromFormat 5442 0.89 3.64 0.11 85 REPLYTO_WITHOUT_TO_CC 4968 0.77 3.32 0.05 86 FROM_EXCESS_BASE64 4855 3.07 3.24 3.02 87 RELAYCOUNTRY_GB 4655 1.75 3.11 1.36 88 BAYES_20 4478 4.13 2.99 4.46 89 PDS_OTHER_BAD_TLD 4417 1.01 2.95 0.46 90 HTML_IMAGE_RATIO_08 4345 2.44 2.90 2.30 91 XM_URI_RBL 4262 0.81 2.85 0.23 92 RCVD_IN_RP_RNBL 4131 0.72 2.76 0.14 93 XMSexyCombo_01 4030 1.41 2.69 1.04 94 BAYES_00 3980 20.22 2.66 25.24 95 T_TooManySym_01 3911 4.38 2.61 4.88 96 RCVD_IN_PSBL 3844 0.57 2.57 0.00 97 XM_B_Unsub2 3669 2.21 2.45 2.14 98 T_XMDrugObfuBody_08 3659 1.80 2.45 1.61 99 DATE_IN_PAST_03_06 3616 0.63 2.42 0.12 100 XMDiploma_00 3592 1.74 2.40 1.55 101 URI_HEX 3552 1.55 2.37 1.32 102 XM_OfRef6 3532 1.58 2.36 1.36 103 FROM_MISSP_REPLYTO 3413 0.51 2.28 0.01 104 TR_XM_PHPDW 3389 1.10 2.27 0.77 105 RCVD_IN_MSPIKE_L3 3335 0.97 2.23 0.61 106 TR_XM_PHPForged 3334 1.08 2.23 0.75 107 TR_XM_FormFill2 3306 1.07 2.21 0.75 108 XM_H_PHPOS 3299 1.06 2.20 0.74 109 RCVD_IN_RP_SAFE 3291 7.63 2.20 9.18 110 NORDNS_LOW_CONTRAST 3267 0.49 2.18 0.00 111 FROM_MISSP_DYNIP 3212 0.48 2.15 0.00 112 TR_XM_DK_Bayes 3211 12.94 2.15 16.03 113 T_XMDrugObfuBody_14 3209 1.68 2.14 1.55 114 TR_LOTS_OF_MONEY2 3158 0.81 2.11 0.43 115 T_MONEY_PERCENT 3158 0.81 2.11 0.43 116 XMHTML_After_End 3071 1.06 2.05 0.78 117 FROM_SUSPICIOUS_NTLD 3070 0.47 2.05 0.02 118 FROM_SUSPICIOUS_NTLD_FP 3049 0.47 2.04 0.02 119 HTML_IMAGE_ONLY_12 3049 0.58 2.04 0.16 120 RCVD_IN_RP_CERTIFIED 3035 6.97 2.03 8.39 121 TR_XM_INV_DKIM 2995 0.56 2.00 0.14 122 MIME_HEADER_CTYPE_ONLY 2965 0.62 1.98 0.23 123 SpammyFromTLD_01 2957 0.98 1.98 0.70 124 RCVD_IN_IADB_LISTED 2919 4.40 1.95 5.10 125 TR_Sbj_FN_Bdy 2910 0.55 1.94 0.15 126 ALL_TRUSTED 2844 14.25 1.90 17.78 127 TM2_M_VERY_LONG_WORD 2841 1.33 1.90 1.17 128 TR_XM_DK_SendGrid 2813 2.86 1.88 3.15 129 TO_EQ_FM_DOM_HTML_IMG 2800 0.42 1.87 0.01 130 RCVD_IN_MSPIKE_L5 2762 0.58 1.85 0.22 131 XMStockSpam_06 2696 1.33 1.80 1.19 132 RCVD_IN_IADB_SPF 2696 3.84 1.80 4.43 133 LongTLD 2650 0.51 1.77 0.15 134 RCVD_IN_IADB_DK 2635 3.35 1.76 3.80 135 RCVD_IN_IADB_SENDERID 2635 3.40 1.76 3.86 136 XMGenDplmaNmb 2628 1.13 1.76 0.95 137 XMBody_17 2609 0.90 1.74 0.66 138 BAYES_05 2598 3.14 1.74 3.55 139 TR_Symld_Words 2554 1.39 1.71 1.30 140 DIET_1 2537 0.66 1.70 0.37 141 DKIM_ADSP_CUSTOM_MED 2532 1.15 1.69 1.00 142 MAILING_LIST_MULTI 2413 2.22 1.61 2.40 143 FORGED_GMAIL_RCVD 2343 0.71 1.57 0.46 144 DATE_IN_PAST_06_12 2298 0.37 1.54 0.04 145 REMOVE_BEFORE_LINK 2241 0.66 1.50 0.43 146 T_XMHurry_00 2207 0.78 1.48 0.59 147 NML_ADSP_CUSTOM_MED 2201 0.91 1.47 0.74 148 MISSING_HEADERS 2181 0.67 1.46 0.45 149 XMSubMetaI_00 2174 0.93 1.45 0.78 150 XM_H_PHPOS_M 2102 0.65 1.40 0.44 151 XM_UB60 2063 0.36 1.38 0.07 152 XMBdyGiftCard01 2063 1.05 1.38 0.95 153 XMMoneyMeta_00 2051 0.64 1.37 0.43 154 TR_XM_DK_Bayes1 2009 12.05 1.34 15.11 155 XM_H_Long_From02 1950 1.30 1.30 1.30 156 URI_TRY_3LD 1950 1.29 1.30 1.28 157 XMSlimDrugH 1939 0.60 1.30 0.40 158 URIBL_CSS 1931 0.31 1.29 0.03 159 URIBL_CSS_A 1931 0.31 1.29 0.03 160 RELAYCOUNTRY_DE 1921 0.57 1.28 0.36 161 XM_H_PHPMailer 1913 0.69 1.28 0.52 162 TR_LOTS_OF_MONEY1 1867 0.30 1.25 0.02 163 XMSubMetaSx_01 1855 0.34 1.24 0.08 164 TR_LOTS_OF_MONEY3 1820 0.52 1.22 0.32 165 T_FILL_THIS_FORM_SHORT 1816 0.99 1.21 0.92 166 XM_DK_Undo_01 1815 1.41 1.21 1.47 167 T_XMDrugObfuBody_00 1814 0.78 1.21 0.66 168 DKIM_ADSP_NXDOMAIN 1808 0.50 1.21 0.29 169 HTML_TAG_BALANCE_BODY 1759 0.72 1.18 0.59 170 MONEY_FRAUD_8 1757 0.26 1.17 0.00 171 URIBL_SBL_A 1710 0.43 1.14 0.22 172 XM_ProductURIs 1704 0.73 1.14 0.62 173 XMBody_78 1695 0.57 1.13 0.41 174 RELAYCOUNTRY_IN 1668 0.35 1.11 0.13 175 TR_XM_DK_Bayes2 1661 10.64 1.11 13.36 176 URIBL_DBL_ABUSE_REDIR 1651 0.62 1.10 0.48 177 XMPhish08 1636 0.60 1.09 0.46 178 ADVANCE_FEE_4_NEW_MONEY 1586 0.24 1.06 0.00 179 HK_RANDOM_REPLYTO 1499 0.38 1.00 0.20 180 T_Symld_Words_02 1470 0.66 0.98 0.57 181 HELO_DYNAMIC_IPADDR 1441 0.22 0.96 0.01 182 TR_Mismatch_TLD_01 1431 0.40 0.96 0.24 183 HTML_FONT_SIZE_HUGE 1430 0.28 0.96 0.08 184 SUBJECT_NEEDS_ENCODING 1420 0.21 0.95 0.00 185 SUBJ_ILLEGAL_CHARS 1416 0.21 0.95 0.00 186 XMSubMetaSxObfu_03 1412 0.57 0.94 0.46 187 URI_NOVOWEL 1391 0.50 0.93 0.38 188 THIS_AD 1383 0.34 0.92 0.17 189 XMSexyCombo_04 1345 0.64 0.90 0.57 190 XMPhish14 1326 0.42 0.89 0.28 191 XM_UB99 1321 0.20 0.88 0.01 192 TR_MetaPhish_Combo_01 1277 0.87 0.85 0.87 193 SUBJ_DOLLARS 1259 0.50 0.84 0.40 194 XMPhish30 1255 0.63 0.84 0.56 195 XM_PDF 1252 3.62 0.84 4.41 196 XM_H_MailChimp 1234 0.31 0.82 0.17 197 TR_XM_RelayPhish 1222 0.35 0.82 0.21 198 XM_B_COPY_HTML 1188 0.49 0.79 0.41 199 HTML_FONT_FACE_BAD 1188 0.86 0.79 0.88 200 FSL_THIS_IS_ADV 1185 0.33 0.79 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 441894 86.62 94.37 84.40 2 RELAYCOUNTRY_US 411080 78.90 80.24 78.51 3 DKIM_SIGNED 384146 74.22 77.19 73.37 4 XM_DK_Pass 377848 72.67 74.45 72.17 5 DKIM_VALID 357822 67.48 64.45 68.34 6 XM_B_Unicode 356134 69.31 73.81 68.02 7 DCC_CHECK_NEGATIVE 307087 49.75 18.58 58.65 8 DKIM_VALID_AU 268480 50.46 47.62 51.28 9 XMListUnsubscribeExists 265380 53.53 63.48 50.69 10 BAYES_50 262818 49.77 48.29 50.20 11 XM_B_Unicode3 210783 41.35 45.19 40.26 12 DCC_CHECK 205860 48.24 79.46 39.32 13 T_TM2_M_HEADER_IN_MSG 147553 26.11 18.87 28.18 14 HTML_FONT_LOW_CONTRAST 137177 27.55 32.27 26.20 15 DKIM_VALID_EF 133361 25.52 25.69 25.47 16 BAYES_00 132128 20.22 2.66 25.24 17 LOC_TINY_FONT_1 120158 25.35 33.76 22.95 18 MIME_HTML_ONLY 104525 23.68 36.71 19.96 19 FVGT_m_MULTI_ODD 104230 21.27 26.03 19.91 20 XMSubLong 101091 20.55 24.89 19.31 21 ALL_TRUSTED 93076 14.25 1.90 17.78 22 T_KAM_HTML_FONT_INVALID 91416 18.53 22.26 17.46 23 TR_XM_DK_Bayes 83934 12.94 2.15 16.03 24 TR_XM_DK_Bayes1 79132 12.05 1.34 15.11 25 TR_XM_DK_Bayes2 69969 10.64 1.11 13.36 26 XM_Multi_Part_URI 68824 13.60 15.18 13.14 27 XM_Body_Dirty_Words 65475 14.46 21.30 12.51 28 RCVD_IN_MSPIKE_H2 59548 10.91 9.28 11.37 29 XM_B_Unsub 50870 11.25 16.60 9.72 30 RCVD_IN_MSPIKE_H3 50350 8.33 3.82 9.62 31 RCVD_IN_MSPIKE_WL 50350 8.33 3.82 9.62 32 RCVD_IN_RP_SAFE 48053 7.63 2.20 9.18 33 LOTS_OF_MONEY 45202 9.90 14.31 8.63 34 XM_Evil_Numbers_Gen 44242 8.92 10.59 8.45 35 RCVD_IN_RP_CERTIFIED 43915 6.97 2.03 8.39 36 HTML_IMAGE_RATIO_02 41292 8.73 11.69 7.89 37 LotsOfNums_01 40829 7.87 8.14 7.80 38 TooManyTo_001 40730 7.35 5.84 7.78 39 XM_DKIMWhitelistDomains 38463 5.72 0.02 7.35 40 ANY_BOUNCE_MESSAGE 38413 5.80 0.41 7.34 41 BOUNCE_MESSAGE 38413 5.80 0.41 7.34 42 TM2_M_URI_OPT_OUT 38209 6.50 3.70 7.30 43 XM_DK_Undo_02 35566 12.86 34.08 6.79 44 XM_B_Phish_Phrases 35199 6.94 7.70 6.72 45 FSL_BULK_SIG 33923 9.67 20.85 6.48 46 HTML_IMAGE_RATIO_04 33608 6.38 6.27 6.42 47 XM_H_Long_From01 30385 6.12 7.23 5.80 48 XM_SendGrid 30083 5.55 4.86 5.75 49 RELAYCOUNTRY_META 29674 8.88 20.12 5.67 50 MIME_QP_LONG_LINE 28871 5.44 5.17 5.51 51 BAYES_40 28188 5.08 4.01 5.38 52 RCVD_IN_IADB_LISTED 26718 4.40 1.95 5.10 53 DKIM_INVALID 26324 6.74 12.74 5.03 54 XMSubMetaSx_00 26154 6.21 10.47 5.00 55 T_TooManySym_01 25562 4.38 2.61 4.88 56 BAYES_60 24051 5.24 7.49 4.59 57 XMStrtUSub 23786 4.36 3.71 4.54 58 BAYES_20 23353 4.13 2.99 4.46 59 RCVD_IN_IADB_SPF 23174 3.84 1.80 4.43 60 XM_PDF 23113 3.62 0.84 4.41 61 XMSexyCombo_05 21496 5.97 12.51 4.11 62 MPART_ALT_DIFF 21116 4.90 7.95 4.03 63 BOTNET_IPINHOSTNAME 21069 5.88 12.38 4.02 64 T_REMOTE_IMAGE 20481 5.14 9.43 3.91 65 RCVD_IN_IADB_SENDERID 20232 3.40 1.76 3.86 66 RCVD_IN_IADB_DK 19914 3.35 1.76 3.80 67 IN_ZIMBRA_NJ_WHITELIST 19624 2.92 0.01 3.75 68 BAYES_05 18574 3.14 1.74 3.55 69 XMNumbers 18088 4.04 6.09 3.45 70 HTML_IMAGE_RATIO_06 17816 3.60 4.31 3.40 71 RCVD_IN_IADB_VOUCHED 17081 2.66 0.53 3.26 72 BAYES_99 16828 7.04 20.45 3.21 73 TR_XM_DK_SendGrid 16474 2.86 1.88 3.15 74 XM_UncommonTLD01 16027 5.80 15.40 3.06 75 FROM_EXCESS_BASE64 15835 3.07 3.24 3.02 76 MIME_HTML_ONLY_MULTI 14364 3.02 3.97 2.74 77 NO_DNS_FOR_FROM 14156 4.41 10.39 2.70 78 BOTNET 13888 7.15 22.91 2.65 79 BAYES_999 13601 5.55 15.88 2.60 80 MAILING_LIST_MULTI 12555 2.22 1.61 2.40 81 HTML_IMAGE_RATIO_08 12048 2.44 2.90 2.30 82 T_TooManySym_02 11762 1.92 0.79 2.25 83 XM_CamelCaseFrm001 11443 2.61 4.12 2.19 84 XM_B_Unsub2 11223 2.21 2.45 2.14 85 HTML_MIME_NO_HTML_TAG 11133 3.01 6.12 2.13 86 RCVD_IN_IADB_OPTIN 11118 1.73 0.37 2.12 87 UNPARSEABLE_RELAY 10610 1.73 0.71 2.03 88 MIME_HTML_MOSTLY 10423 2.74 5.36 1.99 89 BAYES_80 10281 3.37 8.27 1.96 90 XM_B_SpammyTLD 10248 2.65 5.07 1.96 91 KHOP_HELO_FCRDNS 10203 2.77 5.65 1.95 92 TooManyTo_002 9750 1.62 0.78 1.86 93 TR_DCC_Bayes_99 9598 4.78 15.09 1.83 94 XM_H_Trusted_IP 9246 1.37 0.00 1.77 95 XM_SPF_SoftFail 9213 2.57 5.39 1.76 96 SUBJ_ALL_CAPS 9169 2.18 3.68 1.75 97 TVD_RCVD_IP 8772 1.39 0.40 1.68 98 UNTRUSTED_Relay 8649 3.93 11.90 1.65 99 RELAYCOUNTRY_CA 8546 2.13 3.85 1.63 100 T_XMDrugObfuBody_08 8443 1.80 2.45 1.61 101 HELO_NODOT 8178 1.37 0.70 1.56 102 HELO_NO_DOMAIN 8166 1.36 0.68 1.56 103 XMDiploma_00 8107 1.74 2.40 1.55 104 T_XMDrugObfuBody_14 8096 1.68 2.14 1.55 105 IN_HORDE_ADDRESS_BOOK 7823 1.17 0.03 1.49 106 XM_DK_Undo_01 7686 1.41 1.21 1.47 107 INVALID_MSGID 7454 1.15 0.20 1.42 108 RELAYCOUNTRY_GB 7128 1.75 3.11 1.36 109 XM_OfRef6 7124 1.58 2.36 1.36 110 TO_MALFORMED 6980 1.06 0.09 1.33 111 URI_HEX 6887 1.55 2.37 1.32 112 XM_H_Long_From02 6821 1.30 1.30 1.30 113 TR_Symld_Words 6796 1.39 1.71 1.30 114 URI_TRY_3LD 6702 1.29 1.30 1.28 115 BAYES_95 6679 1.84 3.81 1.28 116 TooManyTo_003 6442 1.09 0.60 1.23 117 XMCapTrack 6285 1.01 0.36 1.20 118 XMStockSpam_06 6240 1.33 1.80 1.19 119 USER_IN_DEF_DKIM_WL 6232 0.94 0.05 1.19 120 CK_HELO_DYNAMIC_SPLIT_IP 6153 0.95 0.15 1.18 121 HELO_DYNAMIC_IPADDR2 6151 0.92 0.03 1.17 122 TM2_M_VERY_LONG_WORD 6102 1.33 1.90 1.17 123 XM_GoogleGroups 5997 0.98 0.42 1.15 124 RCVD_IN_MSPIKE_BL 5944 1.82 4.24 1.14 125 RCVD_IN_BL_SPAMCOP_NET 5780 1.84 4.43 1.10 126 TR_MSPIKEBAYES00 5525 0.82 0.01 1.06 127 XMSexyCombo_01 5440 1.41 2.69 1.04 128 XMGappySubj_01 5349 0.85 0.24 1.02 129 DKIM_ADSP_CUSTOM_MED 5242 1.15 1.69 1.00 130 XMNoVowels 5211 0.94 0.75 1.00 131 XMSubNoVowel 5183 0.83 0.26 0.99 132 XMGenDplmaNmb 5000 1.13 1.76 0.95 133 XMBdyGiftCard01 4975 1.05 1.38 0.95 134 XM_UB50 4936 2.32 7.12 0.94 135 T_FILL_THIS_FORM_SHORT 4830 0.99 1.21 0.92 136 TooManyTo_004 4591 0.79 0.51 0.88 137 HTML_FONT_FACE_BAD 4586 0.86 0.79 0.88 138 TR_MetaPhish_Combo_01 4567 0.87 0.85 0.87 139 XMHTML_After_End 4088 1.06 2.05 0.78 140 XMSubMetaI_00 4077 0.93 1.45 0.78 141 TR_XM_PHPDW 4012 1.10 2.27 0.77 142 TR_XM_PHPForged 3938 1.08 2.23 0.75 143 TR_XM_FormFill2 3927 1.07 2.21 0.75 144 NML_ADSP_CUSTOM_MED 3900 0.91 1.47 0.74 145 TooManyTo_005 3882 0.67 0.42 0.74 146 XM_H_PHPOS 3869 1.06 2.20 0.74 147 SpammyFromTLD_01 3659 0.98 1.98 0.70 148 T_XMDrugObfuBody_00 3439 0.78 1.21 0.66 149 XMBody_17 3435 0.90 1.74 0.66 150 XMBody_95 3280 0.53 0.17 0.63 151 XM_ProductURIs 3221 0.73 1.14 0.62 152 RCVD_IN_MSPIKE_L3 3219 0.97 2.23 0.61 153 HTML_TAG_BALANCE_BODY 3081 0.72 1.18 0.59 154 T_XMHurry_00 3068 0.78 1.48 0.59 155 HTML_IMAGE_ONLY_20 3052 0.60 0.67 0.58 156 FILL_THIS_FORM 3023 0.59 0.62 0.58 157 XM_SPF_Unknown 3012 0.62 0.79 0.58 158 XMSexyCombo_04 2997 0.64 0.90 0.57 159 T_Symld_Words_02 2993 0.66 0.98 0.57 160 T_OBFU_PDF_ATTACH 2960 0.48 0.20 0.57 161 XMPhish30 2954 0.63 0.84 0.56 162 T_TooManySym_03 2920 0.48 0.20 0.56 163 XM_B_REG_HTML 2883 0.52 0.43 0.55 164 RELAYCOUNTRY_AU 2839 0.51 0.41 0.54 165 FROM_GOV_DKIM_AU 2773 0.48 0.32 0.53 166 XM_H_PHPMailer 2706 0.69 1.28 0.52 167 SHORT_SHORTNER 2704 0.49 0.39 0.52 168 USER_IN_WHITELIST 2681 0.40 0.00 0.51 169 HTTPS_HTTP_MISMATCH 2678 0.56 0.72 0.51 170 XMHTMLBadTable_001 2666 0.53 0.59 0.51 171 TM2_M_A_HREF_HREF 2647 0.56 0.73 0.51 172 XMBrknScrpt_02 2640 0.55 0.69 0.50 173 XM_DIRTYINTL 2624 1.22 3.76 0.50 174 AC_DIV_BONANZA 2571 0.41 0.12 0.49 175 URIBL_DBL_ABUSE_REDIR 2520 0.62 1.10 0.48 176 XM_ShortIntro_01 2472 0.44 0.31 0.47 177 FILL_THIS_FORM_LONG 2458 0.49 0.55 0.47 178 PLING_QUERY 2454 0.51 0.65 0.47 179 FROM_GOV_SPOOF 2442 0.40 0.19 0.47 180 FORGED_GMAIL_RCVD 2429 0.71 1.57 0.46 181 XMSubMetaSxObfu_03 2426 0.57 0.94 0.46 182 XMPhish08 2386 0.60 1.09 0.46 183 PDS_OTHER_BAD_TLD 2385 1.01 2.95 0.46 184 MISSING_HEADERS 2344 0.67 1.46 0.45 185 T_FILL_THIS_FORM_LOAN 2342 0.42 0.34 0.45 186 XM_H_PHPOS_M 2293 0.65 1.40 0.44 187 TR_LOTS_OF_MONEY2 2267 0.81 2.11 0.43 188 T_MONEY_PERCENT 2267 0.81 2.11 0.43 189 XMMoneyMeta_00 2260 0.64 1.37 0.43 190 TM2_M_BODY_EMPTY 2234 0.35 0.09 0.43 191 REMOVE_BEFORE_LINK 2232 0.66 1.50 0.43 192 SHORT_HELO_AND_INLINE_IMAGE 2157 0.33 0.05 0.41 193 RELAYCOUNTRY_FR 2141 1.19 3.92 0.41 194 XMBody_78 2131 0.57 1.13 0.41 195 XM_B_COPY_HTML 2128 0.49 0.79 0.41 196 HTML_IMAGE_ONLY_28 2128 0.45 0.61 0.41 197 SUBJ_DOLLARS 2080 0.50 0.84 0.40 198 XMSlimDrugH 2069 0.60 1.30 0.40 199 URI_NOVOWEL 1971 0.50 0.93 0.38 200 HTML_IMAGE_ONLY_32 1945 0.35 0.25 0.37 ----------------------------------------------------------------------