Email: 626634 Autolearn: 0 AvgScore: 1.06 AvgScanTime: 1.83 sec Spam: 112534 Autolearn: 0 AvgScore: 12.11 AvgScanTime: 3.15 sec Ham: 514100 Autolearn: 0 AvgScore: -1.36 AvgScanTime: 1.55 sec Time Spent Running SA: 319.27 hours Time Spent Processing Spam: 98.53 hours Time Spent Processing Ham: 220.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 105147 88.82 93.44 87.80 2 RELAYCOUNTRY_US 87268 77.76 77.55 77.80 3 DKIM_SIGNED 85782 71.34 76.23 70.27 4 DCC_CHECK 85335 44.22 75.83 37.30 5 XM_DK_Pass 83132 69.93 73.87 69.07 6 XM_B_Unicode 79868 70.38 70.97 70.25 7 XMListUnsubscribeExists 72533 49.84 64.45 46.64 8 DKIM_VALID 70867 64.64 62.97 65.00 9 DKIM_VALID_AU 52882 48.85 46.99 49.25 10 BAYES_50 51736 51.69 45.97 52.94 11 XM_B_Unicode3 48027 42.21 42.68 42.11 12 XM_DK_Undo_02 43536 13.08 38.69 7.47 13 MIME_HTML_ONLY 42501 23.63 37.77 20.53 14 LOC_TINY_FONT_1 36678 27.23 32.59 26.06 15 HTML_FONT_LOW_CONTRAST 32646 26.50 29.01 25.95 16 FVGT_m_MULTI_ODD 29800 21.15 26.48 19.99 17 DKIM_VALID_EF 28925 24.91 25.70 24.74 18 BAYES_99 28771 7.96 25.57 4.10 19 XMSubLong 27479 19.89 24.42 18.90 20 XM_Body_Dirty_Words 27283 15.43 24.24 13.50 21 BOTNET 26452 7.51 23.51 4.01 22 DCC_CHECK_NEGATIVE 25304 53.91 22.49 60.79 23 T_KAM_HTML_FONT_INVALID 24549 17.39 21.81 16.42 24 BAYES_999 22211 6.25 19.74 3.29 25 TR_DCC_Bayes_99 21998 5.23 19.55 2.09 26 XM_UncommonTLD01 21462 5.90 19.07 3.02 27 T_TM2_M_HEADER_IN_MSG 21420 27.47 19.03 29.32 28 RELAYCOUNTRY_META 21375 7.69 18.99 5.22 29 XM_Multi_Part_URI 18718 15.07 16.63 14.73 30 FSL_BULK_SIG 17908 8.04 15.91 6.32 31 LOTS_OF_MONEY 15835 9.20 14.07 8.14 32 BOTNET_IPINHOSTNAME 15786 5.80 14.03 4.00 33 DKIM_INVALID 14915 6.70 13.25 5.27 34 XM_B_Unsub 14397 11.26 12.79 10.92 35 UNTRUSTED_Relay 14187 3.64 12.61 1.68 36 HTML_IMAGE_RATIO_02 13222 8.25 11.75 7.49 37 XMSexyCombo_05 12236 5.48 10.87 4.30 38 SpammyFromTLD_02 11832 2.08 10.51 0.24 39 XM_Evil_Numbers_Gen 11715 8.88 10.41 8.54 40 NO_DNS_FOR_FROM 11703 4.36 10.40 3.04 41 XM_B_Phish_Phrases 11360 7.93 10.09 7.46 42 LotsOfNums_01 9852 7.33 8.75 7.02 43 XMSubMetaSx_00 9474 4.62 8.42 3.79 44 T_REMOTE_IMAGE 8553 4.38 7.60 3.67 45 REPLYTO_WITHOUT_TO_CC 8250 1.42 7.33 0.13 46 BAYES_60 8247 5.30 7.33 4.85 47 MIME_QP_LONG_LINE 8042 6.33 7.15 6.16 48 XMNumbers 7886 4.10 7.01 3.46 49 MPART_ALT_DIFF 7799 5.20 6.93 4.82 50 BAYES_80 7755 3.38 6.89 2.61 51 XM_UB50 7755 2.00 6.89 0.93 52 XM_H_Long_From01 7346 5.63 6.53 5.43 53 KHOP_HELO_FCRDNS 7130 2.76 6.34 1.97 54 HTML_IMAGE_RATIO_04 6754 6.15 6.00 6.18 55 TooManyTo_001 6644 7.94 5.90 8.38 56 HTML_SHORT_LINK_IMG_1 6401 1.03 5.69 0.02 57 HDRS_LCASE_IMGONLY 6226 1.01 5.53 0.02 58 MIME_HEADER_CTYPE_ONLY 6211 1.20 5.52 0.25 59 TM2_M_URI_OPT_OUT 6007 4.27 5.34 4.04 60 XM_SPF_SoftFail 5863 2.38 5.21 1.77 61 ALL_TRUSTED 5483 16.21 4.87 18.69 62 XM_B_SpammyTLD 5255 2.65 4.67 2.20 63 RCVD_IN_MSPIKE_H2 5234 8.77 4.65 9.67 64 MIME_HTML_MOSTLY 4999 2.64 4.44 2.24 65 RELAYCOUNTRY_CA 4909 2.03 4.36 1.52 66 TO_EQ_FM_DOM_HTML_IMG 4762 0.80 4.23 0.05 67 XM_CamelCaseFrm001 4685 2.41 4.16 2.03 68 RCVD_IN_MSPIKE_BL 4671 1.70 4.15 1.16 69 RCVD_IN_BL_SPAMCOP_NET 4492 1.37 3.99 0.80 70 T_XMDrugObfuBody_08 4439 1.98 3.94 1.56 71 XM_B_Unsub2 4434 3.24 3.94 3.08 72 RCVD_IN_MSPIKE_L3 4383 1.42 3.89 0.88 73 PDS_OTHER_BAD_TLD 4349 1.12 3.86 0.52 74 XM_SendGrid 4269 5.68 3.79 6.09 75 XM_DIRTYINTL 4240 1.15 3.77 0.58 76 BODY_URI_ONLY 4114 0.72 3.66 0.08 77 FROM_EXCESS_BASE64 4058 3.14 3.61 3.04 78 XM_URI_RBL 4001 0.77 3.56 0.16 79 BAYES_95 3959 1.98 3.52 1.65 80 HTML_IMAGE_ONLY_12 3951 0.83 3.51 0.25 81 XMSexyCombo_01 3945 1.28 3.51 0.80 82 XMHTML_After_End 3850 1.29 3.42 0.82 83 BAYES_40 3842 5.36 3.41 5.78 84 HTML_IMAGE_RATIO_06 3799 3.30 3.38 3.28 85 RCVD_IN_MSPIKE_WL 3683 8.09 3.27 9.15 86 RCVD_IN_MSPIKE_H3 3683 8.09 3.27 9.15 87 XMStrtUSub 3650 4.48 3.24 4.76 88 MIME_HTML_ONLY_MULTI 3632 3.07 3.23 3.04 89 TR_Mismatch_TLD_01 3622 0.75 3.22 0.20 90 TR_Mismatch_TLD_02 3478 0.61 3.09 0.07 91 RELAYCOUNTRY_FR 3451 0.79 3.07 0.29 92 URIBL_SBL_A 3434 0.67 3.05 0.15 93 XMBody_17 3431 1.07 3.05 0.64 94 SpammyFromTLD_01 3313 1.05 2.94 0.64 95 RCVD_IN_RP_RNBL 3284 0.68 2.92 0.19 96 RDNS_DYNAMIC 3273 0.75 2.91 0.27 97 BAYES_00 3258 17.27 2.90 20.42 98 SUBJ_DOLLARS 3234 0.75 2.87 0.28 99 FROM_SUSPICIOUS_NTLD 3201 0.53 2.84 0.03 100 FROM_SUSPICIOUS_NTLD_FP 3111 0.51 2.76 0.02 101 BAYES_20 3070 4.18 2.73 4.50 102 TR_XM_INV_DKIM 3053 0.59 2.71 0.13 103 XMNoVowels 3005 2.23 2.67 2.13 104 T_Symld_Words_02 3004 1.06 2.67 0.70 105 XMDiploma_00 2930 1.76 2.60 1.57 106 TR_XM_MaxBayes 2888 0.47 2.57 0.01 107 SUBJ_ALL_CAPS 2875 2.11 2.55 2.01 108 HTML_IMAGE_ONLY_08 2822 0.55 2.51 0.13 109 LOADSA_MONEY_COMBO 2753 0.46 2.45 0.03 110 XM_OfRef6 2653 1.46 2.36 1.26 111 BOTNET_NORDNS 2648 1.41 2.35 1.20 112 TR_XM_PHPDW 2616 0.83 2.32 0.51 113 TR_XM_PHPForged 2578 0.81 2.29 0.49 114 REMOVE_BEFORE_LINK 2555 0.67 2.27 0.32 115 TR_XM_FormFill2 2550 0.81 2.27 0.49 116 XM_H_PHPOS 2548 0.80 2.26 0.48 117 ANY_BOUNCE_MESSAGE 2544 2.86 2.26 2.99 118 BOUNCE_MESSAGE 2543 2.86 2.26 2.99 119 TR_XM_DK_Bayes 2428 11.52 2.16 13.57 120 XMMoneyMeta_00 2425 0.85 2.15 0.56 121 T_TooManySym_01 2409 4.19 2.14 4.64 122 RCVD_IN_RP_SAFE 2375 7.36 2.11 8.51 123 HTML_MIME_NO_HTML_TAG 2359 2.32 2.10 2.37 124 DATE_IN_PAST_06_12 2336 0.42 2.08 0.06 125 NO_FM_NAME_IP_HOSTN 2307 0.37 2.05 0.00 126 TM2_M_VERY_LONG_WORD 2228 1.38 1.98 1.25 127 FROM_ADDR_WS 2223 0.36 1.98 0.00 128 FROM_NO_USER 2188 0.35 1.94 0.00 129 HTML_IMAGE_RATIO_08 2114 2.08 1.88 2.13 130 XMGenDplmaNmb 2089 1.20 1.86 1.06 131 MISSING_HEADERS 2075 0.86 1.84 0.64 132 XMStockSpam_06 2057 1.25 1.83 1.12 133 T_XMHurry_00 2053 0.78 1.82 0.55 134 LongTLD 2047 0.47 1.82 0.18 135 T_XMDrugObfuBody_14 2040 1.60 1.81 1.55 136 DATE_IN_PAST_03_06 2037 0.41 1.81 0.10 137 RCVD_IN_IADB_LISTED 2006 3.80 1.78 4.25 138 BASE64_LENGTH_79_INF 1965 0.78 1.75 0.57 139 RCVD_IN_RP_CERTIFIED 1942 6.79 1.73 7.90 140 TR_Symld_Words 1928 1.70 1.71 1.70 141 URI_HEX 1908 1.31 1.70 1.23 142 URI_OPTOUT_3LD 1902 0.45 1.69 0.18 143 RCVD_IN_IADB_SPF 1867 3.31 1.66 3.67 144 RCVD_IN_IADB_DK 1836 2.86 1.63 3.13 145 RCVD_IN_IADB_SENDERID 1835 2.89 1.63 3.17 146 TR_XM_DK_Bayes1 1786 10.75 1.59 12.75 147 TR_XM_DK_SendGrid 1780 3.05 1.58 3.38 148 UNICODE_OBFU_ASC 1734 3.25 1.54 3.62 149 BAYES_05 1729 2.77 1.54 3.04 150 HK_RANDOM_REPLYTO 1712 0.44 1.52 0.21 151 TR_XM_RelayPhish 1707 0.41 1.52 0.17 152 RELAYCOUNTRY_IN 1687 0.39 1.50 0.15 153 DIET_1 1670 0.73 1.48 0.56 154 T_XMDrugObfuBody_00 1641 0.78 1.46 0.63 155 DKIM_ADSP_CUSTOM_MED 1635 1.16 1.45 1.10 156 RELAYCOUNTRY_GB 1633 1.12 1.45 1.05 157 XM_H_PHPMailer 1594 0.71 1.42 0.55 158 XM_DK_Undo_01 1593 1.73 1.42 1.80 159 XM_UB60 1560 0.30 1.39 0.07 160 TR_LOTS_OF_MONEY3 1501 0.53 1.33 0.36 161 MAILING_LIST_MULTI 1475 2.03 1.31 2.18 162 SUBJ_OBFU_PUNCT_FEW 1439 0.29 1.28 0.07 163 SHORT_URI_3 1437 0.39 1.28 0.20 164 NML_ADSP_CUSTOM_MED 1406 0.87 1.25 0.79 165 XM_UB99 1402 0.23 1.25 0.00 166 XM_ProductURIs 1401 0.98 1.24 0.92 167 THIS_AD 1388 0.36 1.23 0.17 168 FORGED_GMAIL_RCVD 1376 0.65 1.22 0.52 169 XM_H_PHPOS_M 1366 0.35 1.21 0.16 170 XMBrknScrpt_02 1342 0.75 1.19 0.65 171 XMSubMetaSSx_00 1335 0.43 1.19 0.27 172 TR_XM_DK_Bayes2 1333 9.50 1.18 11.32 173 URI_TRY_3LD 1319 1.15 1.17 1.14 174 SHORT_URI_4 1307 0.24 1.16 0.04 175 XMSubMetaI_00 1259 0.80 1.12 0.73 176 URI_WP_HACKED_2 1254 0.50 1.11 0.36 177 XMPhish14 1247 0.51 1.11 0.38 178 RCVD_IN_PSBL 1229 0.23 1.09 0.05 179 XMSexyCombo_04 1187 0.29 1.05 0.12 180 IMPOTENCE 1176 0.53 1.05 0.42 181 UNPARSEABLE_RELAY 1158 1.86 1.03 2.04 182 XMPhish30 1151 0.52 1.02 0.41 183 XMLngstWrd_00 1145 0.61 1.02 0.52 184 XM_UB80 1133 0.20 1.01 0.02 185 XMPhish08 1102 0.61 0.98 0.53 186 XMLngstWrd_01 1091 0.56 0.97 0.47 187 XM_H_MailChimp 1084 0.28 0.96 0.13 188 XM_H_Long_From02 1082 1.17 0.96 1.22 189 TR_XM_MaxSPIKE 1068 0.20 0.95 0.03 190 RELAYCOUNTRY_DE 1061 0.48 0.94 0.38 191 XMSlimDrugH 1054 0.44 0.94 0.33 192 DKIM_ADSP_NXDOMAIN 1053 0.35 0.94 0.23 193 XMBdyGiftCard01 1042 1.33 0.93 1.42 194 TVD_SPACE_RATIO 1014 0.52 0.90 0.43 195 XM_UB999 998 0.16 0.89 0.00 196 XM_B_COPY_HTML 994 0.70 0.88 0.66 197 XMSubMetaSxObfu_03 989 0.43 0.88 0.34 198 XM_PDF 952 4.07 0.85 4.78 199 XMHTMLBadTable_001 933 0.51 0.83 0.44 200 RELAYCOUNTRY_AT 925 0.39 0.82 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 451404 88.82 93.44 87.80 2 RELAYCOUNTRY_US 399987 77.76 77.55 77.80 3 DKIM_SIGNED 361239 71.34 76.23 70.27 4 XM_B_Unicode 361148 70.38 70.97 70.25 5 XM_DK_Pass 355099 69.93 73.87 69.07 6 DKIM_VALID 334168 64.64 62.97 65.00 7 DCC_CHECK_NEGATIVE 312544 53.91 22.49 60.79 8 BAYES_50 272146 51.69 45.97 52.94 9 DKIM_VALID_AU 253200 48.85 46.99 49.25 10 XMListUnsubscribeExists 239788 49.84 64.45 46.64 11 XM_B_Unicode3 216494 42.21 42.68 42.11 12 DCC_CHECK 191734 44.22 75.83 37.30 13 T_TM2_M_HEADER_IN_MSG 150741 27.47 19.03 29.32 14 LOC_TINY_FONT_1 133968 27.23 32.59 26.06 15 HTML_FONT_LOW_CONTRAST 133422 26.50 29.01 25.95 16 DKIM_VALID_EF 127184 24.91 25.70 24.74 17 MIME_HTML_ONLY 105565 23.63 37.77 20.53 18 BAYES_00 104985 17.27 2.90 20.42 19 FVGT_m_MULTI_ODD 102751 21.15 26.48 19.99 20 XMSubLong 97170 19.89 24.42 18.90 21 ALL_TRUSTED 96081 16.21 4.87 18.69 22 T_KAM_HTML_FONT_INVALID 84413 17.39 21.81 16.42 23 XM_Multi_Part_URI 75721 15.07 16.63 14.73 24 TR_XM_DK_Bayes 69752 11.52 2.16 13.57 25 XM_Body_Dirty_Words 69390 15.43 24.24 13.50 26 TR_XM_DK_Bayes1 65567 10.75 1.59 12.75 27 TR_XM_DK_Bayes2 58177 9.50 1.18 11.32 28 XM_B_Unsub 56133 11.26 12.79 10.92 29 RCVD_IN_MSPIKE_H2 49735 8.77 4.65 9.67 30 RCVD_IN_MSPIKE_H3 47034 8.09 3.27 9.15 31 RCVD_IN_MSPIKE_WL 47034 8.09 3.27 9.15 32 XM_Evil_Numbers_Gen 43900 8.88 10.41 8.54 33 RCVD_IN_RP_SAFE 43731 7.36 2.11 8.51 34 TooManyTo_001 43102 7.94 5.90 8.38 35 LOTS_OF_MONEY 41843 9.20 14.07 8.14 36 RCVD_IN_RP_CERTIFIED 40621 6.79 1.73 7.90 37 HTML_IMAGE_RATIO_02 38487 8.25 11.75 7.49 38 XM_DK_Undo_02 38418 13.08 38.69 7.47 39 XM_DKIMWhitelistDomains 38365 6.13 0.02 7.46 40 XM_B_Phish_Phrases 38359 7.93 10.09 7.46 41 LotsOfNums_01 36099 7.33 8.75 7.02 42 FSL_BULK_SIG 32469 8.04 15.91 6.32 43 HTML_IMAGE_RATIO_04 31783 6.15 6.00 6.18 44 MIME_QP_LONG_LINE 31653 6.33 7.15 6.16 45 XM_SendGrid 31334 5.68 3.79 6.09 46 BAYES_40 29740 5.36 3.41 5.78 47 XM_H_Long_From01 27938 5.63 6.53 5.43 48 DKIM_INVALID 27071 6.70 13.25 5.27 49 RELAYCOUNTRY_META 26836 7.69 18.99 5.22 50 BAYES_60 24944 5.30 7.33 4.85 51 MPART_ALT_DIFF 24782 5.20 6.93 4.82 52 XM_PDF 24564 4.07 0.85 4.78 53 XMStrtUSub 24448 4.48 3.24 4.76 54 T_TooManySym_01 23876 4.19 2.14 4.64 55 BAYES_20 23133 4.18 2.73 4.50 56 IN_ZIMBRA_NJ_WHITELIST 22470 3.59 0.02 4.37 57 XMSexyCombo_05 22121 5.48 10.87 4.30 58 RCVD_IN_IADB_LISTED 21834 3.80 1.78 4.25 59 BAYES_99 21079 7.96 25.57 4.10 60 TM2_M_URI_OPT_OUT 20751 4.27 5.34 4.04 61 BOTNET 20602 7.51 23.51 4.01 62 BOTNET_IPINHOSTNAME 20547 5.80 14.03 4.00 63 XMSubMetaSx_00 19495 4.62 8.42 3.79 64 RCVD_IN_IADB_SPF 18888 3.31 1.66 3.67 65 T_REMOTE_IMAGE 18874 4.38 7.60 3.67 66 UPPERCASE_75_100 18674 2.99 0.08 3.63 67 UNICODE_OBFU_ASC 18615 3.25 1.54 3.62 68 XM_H_Trusted_IP 18364 2.93 0.00 3.57 69 XMNumbers 17797 4.10 7.01 3.46 70 TR_XM_DK_SendGrid 17354 3.05 1.58 3.38 71 BAYES_999 16930 6.25 19.74 3.29 72 HTML_IMAGE_RATIO_06 16880 3.30 3.38 3.28 73 RCVD_IN_IADB_SENDERID 16273 2.89 1.63 3.17 74 RCVD_IN_IADB_DK 16109 2.86 1.63 3.13 75 XM_B_Unsub2 15857 3.24 3.94 3.08 76 BAYES_05 15626 2.77 1.54 3.04 77 FROM_EXCESS_BASE64 15625 3.14 3.61 3.04 78 MIME_HTML_ONLY_MULTI 15613 3.07 3.23 3.04 79 NO_DNS_FOR_FROM 15604 4.36 10.40 3.04 80 XM_UncommonTLD01 15533 5.90 19.07 3.02 81 ANY_BOUNCE_MESSAGE 15390 2.86 2.26 2.99 82 BOUNCE_MESSAGE 15385 2.86 2.26 2.99 83 RCVD_IN_IADB_VOUCHED 14752 2.44 0.49 2.87 84 BAYES_80 13411 3.38 6.89 2.61 85 T_TooManySym_02 12231 2.07 0.68 2.38 86 HTML_MIME_NO_HTML_TAG 12165 2.32 2.10 2.37 87 TooManyTo_002 11584 1.96 0.61 2.25 88 MIME_HTML_MOSTLY 11520 2.64 4.44 2.24 89 XM_B_SpammyTLD 11325 2.65 4.67 2.20 90 MAILING_LIST_MULTI 11220 2.03 1.31 2.18 91 XMNoVowels 10950 2.23 2.67 2.13 92 HTML_IMAGE_RATIO_08 10949 2.08 1.88 2.13 93 TR_DCC_Bayes_99 10758 5.23 19.55 2.09 94 UNPARSEABLE_RELAY 10502 1.86 1.03 2.04 95 XM_CamelCaseFrm001 10434 2.41 4.16 2.03 96 SUBJ_ALL_CAPS 10347 2.11 2.55 2.01 97 KHOP_HELO_FCRDNS 10138 2.76 6.34 1.97 98 RCVD_IN_IADB_OPTIN 9473 1.58 0.36 1.84 99 HELO_NODOT 9327 1.62 0.73 1.81 100 HELO_NO_DOMAIN 9325 1.62 0.73 1.81 101 XM_DK_Undo_01 9237 1.73 1.42 1.80 102 XM_SPF_SoftFail 9079 2.38 5.21 1.77 103 TR_Symld_Words 8745 1.70 1.71 1.70 104 UNTRUSTED_Relay 8621 3.64 12.61 1.68 105 BAYES_95 8459 1.98 3.52 1.65 106 TVD_RCVD_IP 8386 1.44 0.56 1.63 107 XMDiploma_00 8080 1.76 2.60 1.57 108 TooManyTo_003 8023 1.37 0.49 1.56 109 T_XMDrugObfuBody_08 7999 1.98 3.94 1.56 110 T_XMDrugObfuBody_14 7957 1.60 1.81 1.55 111 RELAYCOUNTRY_CA 7805 2.03 4.36 1.52 112 IN_HORDE_ADDRESS_BOOK 7759 1.24 0.03 1.51 113 INVALID_MSGID 7707 1.28 0.31 1.50 114 XMSubNoVowel 7590 1.31 0.56 1.48 115 XMBdyGiftCard01 7291 1.33 0.93 1.42 116 XMCapTrack 7167 1.23 0.48 1.39 117 TO_MALFORMED 7086 1.13 0.02 1.38 118 XM_OfRef6 6490 1.46 2.36 1.26 119 CK_HELO_DYNAMIC_SPLIT_IP 6448 1.07 0.22 1.25 120 HELO_DYNAMIC_IPADDR2 6444 1.04 0.06 1.25 121 TM2_M_VERY_LONG_WORD 6421 1.38 1.98 1.25 122 URI_HEX 6331 1.31 1.70 1.23 123 XM_H_Long_From02 6265 1.17 0.96 1.22 124 TooManyTo_004 6184 1.06 0.41 1.20 125 BOTNET_NORDNS 6182 1.41 2.35 1.20 126 XM_GoogleGroups 6048 1.03 0.38 1.18 127 HTML_FONT_FACE_BAD 6030 1.08 0.67 1.17 128 RCVD_IN_MSPIKE_BL 5968 1.70 4.15 1.16 129 USER_IN_DEF_DKIM_WL 5887 0.94 0.01 1.15 130 URI_TRY_3LD 5867 1.15 1.17 1.14 131 XMStockSpam_06 5752 1.25 1.83 1.12 132 DKIM_ADSP_CUSTOM_MED 5638 1.16 1.45 1.10 133 XMGenDplmaNmb 5456 1.20 1.86 1.06 134 RELAYCOUNTRY_GB 5385 1.12 1.45 1.05 135 TooManyTo_005 5279 0.91 0.36 1.03 136 XM_E_Blogspot 4944 0.81 0.11 0.96 137 XM_UB50 4783 2.00 6.89 0.93 138 XM_ProductURIs 4728 0.98 1.24 0.92 139 RCVD_IN_MSPIKE_L3 4504 1.42 3.89 0.88 140 XMGappySubj_01 4290 0.70 0.11 0.83 141 XMHTML_After_End 4222 1.29 3.42 0.82 142 XMBody_95 4165 0.69 0.11 0.81 143 RCVD_IN_BL_SPAMCOP_NET 4094 1.37 3.99 0.80 144 XMSexyCombo_01 4089 1.28 3.51 0.80 145 NML_ADSP_CUSTOM_MED 4075 0.87 1.25 0.79 146 FILL_THIS_FORM_SHORT 4055 0.78 0.77 0.79 147 TR_MetaPhish_Combo_01 3900 0.77 0.80 0.76 148 XMSubMetaI_00 3750 0.80 1.12 0.73 149 T_Symld_Words_02 3615 1.06 2.67 0.70 150 TR_MSPIKEBAYES00 3542 0.57 0.01 0.69 151 T_TooManySym_03 3538 0.61 0.24 0.69 152 T_MONEY_PERCENT 3401 0.69 0.80 0.66 153 TR_LOTS_OF_MONEY2 3401 0.69 0.80 0.66 154 XM_B_COPY_HTML 3380 0.70 0.88 0.66 155 FILL_THIS_FORM 3377 0.59 0.29 0.66 156 XMBrknScrpt_02 3357 0.75 1.19 0.65 157 MISSING_HEADERS 3307 0.86 1.84 0.64 158 HTML_IMAGE_ONLY_20 3300 0.60 0.40 0.64 159 XMBody_17 3276 1.07 3.05 0.64 160 SpammyFromTLD_01 3269 1.05 2.94 0.64 161 T_XMDrugObfuBody_00 3229 0.78 1.46 0.63 162 T_OBFU_PDF_ATTACH 3219 0.55 0.23 0.63 163 XM_SPF_Unknown 3213 0.65 0.77 0.62 164 XM_ShortIntro_01 3168 0.63 0.71 0.62 165 XM_DIRTYINTL 2967 1.15 3.77 0.58 166 BASE64_LENGTH_79_INF 2944 0.78 1.75 0.57 167 DIET_1 2899 0.73 1.48 0.56 168 HTTPS_HTTP_MISMATCH 2880 0.60 0.80 0.56 169 XMMoneyMeta_00 2877 0.85 2.15 0.56 170 XM_B_REG_HTML 2844 0.54 0.50 0.55 171 XM_H_PHPMailer 2844 0.71 1.42 0.55 172 T_XMHurry_00 2844 0.78 1.82 0.55 173 XMPhish08 2703 0.61 0.98 0.53 174 PDS_OTHER_BAD_TLD 2683 1.12 3.86 0.52 175 FORGED_GMAIL_RCVD 2681 0.65 1.22 0.52 176 XMLngstWrd_00 2680 0.61 1.02 0.52 177 FROM_GOV_SPOOF 2659 0.46 0.20 0.52 178 TR_XM_PHPDW 2609 0.83 2.32 0.51 179 TR_XM_PHPForged 2513 0.81 2.29 0.49 180 TR_XM_FormFill2 2498 0.81 2.27 0.49 181 SHORT_HELO_AND_INLINE_IMAGE 2486 0.40 0.03 0.48 182 XM_H_PHPOS 2473 0.80 2.26 0.48 183 TM2_M_BODY_EMPTY 2435 0.41 0.09 0.47 184 XMLngstWrd_01 2405 0.56 0.97 0.47 185 FILL_THIS_FORM_LONG 2374 0.42 0.22 0.46 186 XM_H_SpoofStaff4 2343 0.43 0.29 0.46 187 AC_DIV_BONANZA 2316 0.39 0.12 0.45 188 XMHTMLBadTable_001 2265 0.51 0.83 0.44 189 USER_IN_WHITELIST 2248 0.36 0.00 0.44 190 TVD_SPACE_RATIO 2236 0.52 0.90 0.43 191 HTML_IMAGE_ONLY_32 2212 0.42 0.37 0.43 192 HTML_IMAGE_ONLY_28 2197 0.44 0.50 0.43 193 XMBody_78 2183 0.48 0.75 0.42 194 IMPOTENCE 2166 0.53 1.05 0.42 195 RELAYCOUNTRY_AU 2154 0.44 0.55 0.42 196 XMPhish30 2105 0.52 1.02 0.41 197 RCVD_IN_SORBS_DUL 2056 0.38 0.29 0.40 198 T_FILL_THIS_FORM_LOAN 2031 0.34 0.10 0.40 199 XMLngstWrd_02 2002 0.38 0.35 0.39 200 XMSubMetaSxObfu_02 1981 0.40 0.45 0.39 ----------------------------------------------------------------------