Email: 400605 Autolearn: 0 AvgScore: 2.15 AvgScanTime: 1.12 sec Spam: 87707 Autolearn: 0 AvgScore: 14.52 AvgScanTime: 1.00 sec Ham: 312898 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 1.16 sec Time Spent Running SA: 125.12 hours Time Spent Processing Spam: 24.39 hours Time Spent Processing Ham: 100.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 84615 98.65 96.47 99.26 2 HTML_MESSAGE 81635 88.18 93.08 86.81 3 XM_B_SpammyWords 65621 57.08 74.82 52.11 4 DKIM_SIGNED 57860 78.50 65.97 82.02 5 XM_DK_Pass 56016 77.22 63.87 80.96 6 DKIM_VALID 54843 75.73 62.53 79.42 7 RELAYCOUNTRY_US 52394 77.17 59.74 82.06 8 XMListUnsubscribeExists 48644 58.99 55.46 59.98 9 XM_B_Unicode 48196 69.47 54.95 73.53 10 XM_B_SpammyWords2 47272 31.46 53.90 25.17 11 XM_DK_Undo_02 42608 22.20 48.58 14.81 12 DKIM_VALID_AU 42293 60.34 48.22 63.74 13 BAYES_99 40850 18.68 46.58 10.86 14 RCVD_IN_MSPIKE_H2 40158 31.87 45.79 27.96 15 RELAYCOUNTRY_META 36594 13.28 41.72 5.30 16 MIME_HTML_ONLY 35950 27.20 40.99 23.34 17 BAYES_999 30863 14.80 35.19 9.09 18 RCVD_IN_BL_SPAMCOP_NET 28267 8.62 32.23 2.00 19 BOTNET 27281 8.72 31.10 2.44 20 RCVD_IN_PSBL 25785 6.54 29.40 0.13 21 HTML_IMAGE_RATIO_08 24558 8.31 28.00 2.79 22 LOC_TINY_FONT_1 24424 29.95 27.85 30.54 23 DKIM_VALID_EF 24307 28.86 27.71 29.18 24 XM_B_Unicode3 23241 40.13 26.50 43.96 25 RCVD_IN_RP_RNBL 23150 5.84 26.39 0.07 26 HTML_MIME_NO_HTML_TAG 22888 7.34 26.10 2.08 27 FROM_EXCESS_BASE64 22715 8.70 25.90 3.87 28 UNTRUSTED_Relay 21708 7.29 24.75 2.39 29 BAYES_50 21137 44.91 24.10 50.75 30 HTML_FONT_LOW_CONTRAST 20074 31.29 22.89 33.64 31 T_KAM_HTML_FONT_INVALID 19275 19.38 21.98 18.66 32 XM_UncommonTLD01 18537 7.37 21.14 3.51 33 XMSubLong 16259 21.11 18.54 21.83 34 FVGT_m_MULTI_ODD 16175 22.79 18.44 24.00 35 LOTS_OF_MONEY 15535 11.16 17.71 9.32 36 T_TM2_M_HEADER_IN_MSG 14276 20.96 16.28 22.27 37 XM_Multi_Part_URI 13126 14.71 14.97 14.63 38 XM_Body_Dirty_Words 11607 14.41 13.23 14.74 39 MPART_ALT_DIFF 11036 6.22 12.58 4.43 40 BOTNET_IPINHOSTNAME 10964 8.16 12.50 6.94 41 RCVD_IN_MSPIKE_BL 10081 3.57 11.49 1.35 42 MIME_HTML_MOSTLY 9679 4.43 11.04 2.58 43 BAYES_80 8865 6.26 10.11 5.18 44 SpammyFromTLD_01 8361 2.50 9.53 0.52 45 XM_B_SpammyWords3 8090 7.52 9.22 7.05 46 URI_PHP_REDIR 7919 1.98 9.03 0.01 47 XMSexyCombo_05 7517 6.22 8.57 5.56 48 RCVD_IN_MSPIKE_WL 7349 25.77 8.38 30.64 49 XM_UB99 7294 1.83 8.32 0.01 50 BAYES_60 7207 7.95 8.22 7.87 51 XMSubMetaSx_00 6833 5.19 7.79 4.46 52 BAYES_95 6728 4.19 7.67 3.22 53 XMBrknScrpt_02 6490 3.30 7.40 2.15 54 RELAYCOUNTRY_GB 6237 2.09 7.11 0.69 55 XM_B_Unsub 6176 10.71 7.04 11.74 56 RELAYCOUNTRY_CA 6163 3.32 7.03 2.28 57 RCVD_IN_MSPIKE_L3 6004 2.25 6.85 0.96 58 HK_RANDOM_FROM 5914 1.55 6.74 0.10 59 TR_LOTS_OF_MONEY3 5574 2.84 6.36 1.86 60 HTML_IMAGE_RATIO_02 5439 8.29 6.20 8.88 61 XM_UB50 5195 2.07 5.92 0.98 62 RELAYCOUNTRY_FR 5158 1.52 5.88 0.29 63 XM_Evil_Numbers_Gen 5146 9.56 5.87 10.59 64 XM_UB999 5127 1.28 5.85 0.00 65 XM_B_Phish_Phrases 5074 6.87 5.79 7.17 66 BOTNET_NORDNS 5036 1.27 5.74 0.02 67 XM_DIRTYINTL 4618 1.57 5.27 0.53 68 XMBody_17 4411 2.14 5.03 1.33 69 URIBL_SBL_A 4240 1.26 4.83 0.26 70 T_TooManySym_01 4197 5.23 4.79 5.36 71 LotsOfNums_01 4129 8.07 4.71 9.02 72 XM_SPF_SoftFail 3908 1.92 4.46 1.21 73 KHOP_HELO_FCRDNS 3851 1.63 4.39 0.85 74 SpammyFromTLD_02 3798 1.10 4.33 0.20 75 RCVD_IN_MSPIKE_L5 3679 1.15 4.19 0.30 76 RCVD_IN_MSPIKE_H3 3672 14.20 4.19 17.01 77 TR_XM_MaxBayes 3634 0.94 4.14 0.05 78 XMOffer 3604 0.91 4.11 0.02 79 XM_H_Long_From01 3530 5.30 4.02 5.65 80 TR_XM_MaxSPIKE 3503 1.04 3.99 0.21 81 RCVD_IN_MSPIKE_H4 3477 9.94 3.96 11.62 82 XM_UB60 3413 1.03 3.89 0.22 83 XM_B_SpammyTLD 3381 2.50 3.85 2.12 84 TooManyTo_001 3343 5.87 3.81 6.45 85 SUBJ_ALL_CAPS 3314 1.97 3.78 1.46 86 HTML_IMAGE_RATIO_04 3145 5.94 3.59 6.60 87 UNPARSEABLE_RELAY 3078 8.07 3.51 9.35 88 DKIM_INVALID 3017 2.78 3.44 2.59 89 XM_UB80 2951 0.78 3.36 0.05 90 T_PDS_OTHER_BAD_TLD 2853 1.26 3.25 0.70 91 XM_OfRef6 2787 1.83 3.18 1.45 92 TR_XM_PhishingBody 2700 2.68 3.08 2.57 93 XMSexyCombo_01 2625 1.32 2.99 0.85 94 FROM_LOCAL_NOVOWEL 2495 0.64 2.84 0.03 95 FROM_SUSPICIOUS_NTLD 2462 0.68 2.81 0.08 96 FROM_SUSPICIOUS_NTLD_FP 2329 0.63 2.66 0.07 97 T_REMOTE_IMAGE 2275 2.96 2.59 3.06 98 XM_SendGrid 2173 7.11 2.48 8.40 99 URI_NO_WWW_BIZ_CGI 2140 0.54 2.44 0.01 100 XM_UB95 2132 0.55 2.43 0.03 101 XM_CamelCaseFrm001 2116 2.03 2.41 1.93 102 RELAYCOUNTRY_DE 2100 0.82 2.39 0.38 103 RELAYCOUNTRY_IN 2051 0.57 2.34 0.07 104 T_XMDrugObfuBody_08 2038 1.98 2.32 1.88 105 RDNS_DYNAMIC 2038 1.07 2.32 0.72 106 XMStrtUSub 2016 4.12 2.30 4.63 107 TR_XM_PHPDW 2009 0.84 2.29 0.43 108 TR_XM_PHPForged 1994 0.81 2.27 0.40 109 XMNumbers 1990 3.74 2.27 4.15 110 TR_XM_FormFill2 1983 0.81 2.26 0.40 111 XM_H_PHPOS 1976 0.80 2.25 0.40 112 RELAYCOUNTRY_NL 1914 0.69 2.18 0.27 113 LongTLD 1894 0.58 2.16 0.14 114 URI_TRY_3LD 1840 1.86 2.10 1.79 115 FVGT_m_MULTI_ODD_EMAIL 1801 0.49 2.05 0.05 116 TR_XM_UnparsRelay 1798 1.22 2.05 0.99 117 TR_Caps_n_Bayes_99 1790 0.63 2.04 0.24 118 XM_B_COVIDMETA 1782 1.51 2.03 1.36 119 RELAYCOUNTRY_JP 1769 0.47 2.02 0.04 120 RELAYCOUNTRY_KR 1764 0.45 2.01 0.01 121 T_XMHurry_00 1758 1.53 2.00 1.39 122 XM_B_Phish66 1634 1.32 1.86 1.16 123 XMSexyCombo_04 1551 0.57 1.77 0.23 124 RELAYCOUNTRY_IE 1551 0.49 1.77 0.13 125 URI_HEX 1551 1.87 1.77 1.90 126 XMDiploma_00 1534 1.62 1.75 1.58 127 T_FILL_THIS_FORM_SHORT 1532 1.07 1.75 0.87 128 TR_XM_SB_Phish 1502 1.61 1.71 1.59 129 DIET_1 1467 0.86 1.67 0.64 130 XMSubPhish11 1454 1.60 1.66 1.58 131 PDS_RDNS_DYNAMIC_FP 1443 0.43 1.65 0.09 132 HTML_IMAGE_RATIO_06 1433 2.98 1.63 3.35 133 TM2_M_VERY_LONG_WORD 1411 1.56 1.61 1.54 134 XM_URI_RBL 1399 0.51 1.60 0.21 135 XM_OfRef7 1355 0.41 1.54 0.09 136 DKIM_ADSP_NXDOMAIN 1355 1.23 1.54 1.14 137 RELAYCOUNTRY_AU 1350 0.52 1.54 0.23 138 TM2_M_URI_OPT_OUT 1336 3.31 1.52 3.81 139 MIME_CHARSET_FARAWAY 1333 0.42 1.52 0.12 140 MIME_QP_LONG_LINE 1313 3.63 1.50 4.23 141 TR_XM_COVIDMETA4 1312 0.58 1.50 0.33 142 NUMERIC_HTTP_ADDR 1296 0.73 1.48 0.52 143 CHARSET_FARAWAY_HEADER 1290 0.38 1.47 0.08 144 T_FONT_INVIS_MSGID 1277 0.98 1.46 0.84 145 TR_XM_INV_DKIM 1261 0.50 1.44 0.24 146 XMSubNoVowel 1259 0.84 1.44 0.67 147 MIMEOLE_DIRECT_TO_MX 1218 0.31 1.39 0.00 148 XM_B_SpammyWords4 1188 0.97 1.35 0.86 149 DATE_IN_FUTURE_06_12 1157 0.29 1.32 0.00 150 XM_SPF_Unknown 1138 0.58 1.30 0.38 151 T_XMDrugObfuBody_00 1131 0.87 1.29 0.75 152 NORMAL_HTTP_TO_IP 1129 0.31 1.29 0.04 153 XMBdyGiftCard01 1122 1.50 1.28 1.56 154 FILL_THIS_FORM 1104 0.41 1.26 0.17 155 ALL_TRUSTED 1103 10.62 1.26 13.24 156 TR_Mismatch_TLD_02 1102 0.33 1.26 0.07 157 TR_XM_RelayPhish 1100 0.38 1.25 0.14 158 MONEY_FRAUD_5 1097 0.28 1.25 0.00 159 TR_XM_FormFill 1093 0.34 1.25 0.09 160 T_FILL_THIS_FORM_LONG 1090 0.37 1.24 0.12 161 URI_NOVOWEL 1082 1.80 1.23 1.96 162 DKIM_ADSP_CUSTOM_MED 1068 1.03 1.22 0.98 163 T_XMDrugObfuBody_14 1064 1.47 1.21 1.55 164 TR_XM_DK_SendGrid 1058 4.27 1.21 5.13 165 BAYES_40 1058 3.32 1.21 3.91 166 RELAYCOUNTRY_AE 1040 0.26 1.19 0.00 167 MIME_HTML_ONLY_MULTI 1036 2.19 1.18 2.47 168 DOS_OE_TO_MX 1036 0.26 1.18 0.00 169 NML_ADSP_CUSTOM_MED 1024 0.78 1.17 0.67 170 XMHTML_After_End 1023 0.72 1.17 0.60 171 XM_B_Unsub2 986 1.77 1.12 1.96 172 T_DEAR_BENEFICIARY 976 0.25 1.11 0.00 173 SPOOFED_URL 970 0.72 1.11 0.61 174 FORM_FRAUD_5 970 0.24 1.11 0.00 175 XM_OfRef8 959 0.25 1.09 0.01 176 XMSubMetaSxObfu_01 945 0.25 1.08 0.02 177 FORGED_GMAIL_RCVD 939 0.67 1.07 0.55 178 INVESTMENT_ADVICE 928 0.31 1.06 0.10 179 URIBL_DBL_SPAM 920 0.25 1.05 0.02 180 DATE_IN_PAST_03_06 917 0.32 1.05 0.12 181 XMStockSpam_06 901 1.59 1.03 1.75 182 ADVANCE_FEE_3_NEW_FRM_MNY 895 0.22 1.02 0.00 183 HK_RANDOM_REPLYTO 874 0.42 1.00 0.26 184 TR_Mismatch_TLD_01 873 0.43 1.00 0.28 185 XMSubMetaD_00 868 0.27 0.99 0.06 186 BAYES_20 866 2.94 0.99 3.49 187 XMSubMetaSSx_00 864 0.35 0.99 0.18 188 XMGppyBdWords 856 0.36 0.98 0.19 189 HTML_IMAGE_ONLY_32 838 0.45 0.96 0.31 190 BILLION_DOLLARS 827 0.25 0.94 0.06 191 NO_DNS_FOR_FROM 800 0.76 0.91 0.72 192 XM_TLDProd2 799 0.32 0.91 0.16 193 SPOOFED_URL_HOST 795 0.58 0.91 0.49 194 SUBJ_BUY 779 0.23 0.89 0.05 195 XMGenDplmaNmb 767 0.74 0.87 0.71 196 RELAYCOUNTRY_SC 765 0.19 0.87 0.00 197 RCVD_IN_RP_SAFE 764 8.80 0.87 11.02 198 T_Symld_Words_02 755 0.81 0.86 0.79 199 XMSlimDrugH 755 0.66 0.86 0.60 200 CK_HELO_DYNAMIC_SPLIT_IP 753 2.00 0.86 2.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 310576 98.65 96.47 99.26 2 HTML_MESSAGE 271616 88.18 93.08 86.81 3 RELAYCOUNTRY_US 256759 77.17 59.74 82.06 4 DKIM_SIGNED 256634 78.50 65.97 82.02 5 XM_DK_Pass 253331 77.22 63.87 80.96 6 DKIM_VALID 248516 75.73 62.53 79.42 7 XM_B_Unicode 230085 69.47 54.95 73.53 8 DKIM_VALID_AU 199430 60.34 48.22 63.74 9 XMListUnsubscribeExists 187671 58.99 55.46 59.98 10 XM_B_SpammyWords 163058 57.08 74.82 52.11 11 BAYES_50 158794 44.91 24.10 50.75 12 XM_B_Unicode3 137541 40.13 26.50 43.96 13 HTML_FONT_LOW_CONTRAST 105262 31.29 22.89 33.64 14 RCVD_IN_MSPIKE_WL 95868 25.77 8.38 30.64 15 LOC_TINY_FONT_1 95566 29.95 27.85 30.54 16 DKIM_VALID_EF 91313 28.86 27.71 29.18 17 RCVD_IN_MSPIKE_H2 87497 31.87 45.79 27.96 18 XM_B_SpammyWords2 78744 31.46 53.90 25.17 19 FVGT_m_MULTI_ODD 75106 22.79 18.44 24.00 20 MIME_HTML_ONLY 73019 27.20 40.99 23.34 21 T_TM2_M_HEADER_IN_MSG 69678 20.96 16.28 22.27 22 XMSubLong 68296 21.11 18.54 21.83 23 T_KAM_HTML_FONT_INVALID 58379 19.38 21.98 18.66 24 RCVD_IN_MSPIKE_H3 53224 14.20 4.19 17.01 25 XM_DK_Undo_02 46338 22.20 48.58 14.81 26 XM_Body_Dirty_Words 46128 14.41 13.23 14.74 27 XM_Multi_Part_URI 45785 14.71 14.97 14.63 28 ALL_TRUSTED 41425 10.62 1.26 13.24 29 BAYES_00 39649 10.00 0.46 12.67 30 XM_B_Unsub 36724 10.71 7.04 11.74 31 RCVD_IN_MSPIKE_H4 36352 9.94 3.96 11.62 32 RCVD_IN_RP_SAFE 34493 8.80 0.87 11.02 33 BAYES_99 33974 18.68 46.58 10.86 34 XM_Evil_Numbers_Gen 33138 9.56 5.87 10.59 35 RCVD_IN_RP_CERTIFIED 32949 8.38 0.69 10.53 36 XM_DKIMWhitelistDomains 32106 8.01 0.00 10.26 37 TR_XM_DK_Bayes 29587 7.43 0.21 9.46 38 UNPARSEABLE_RELAY 29261 8.07 3.51 9.35 39 LOTS_OF_MONEY 29175 11.16 17.71 9.32 40 TR_XM_DK_Bayes1 28996 7.28 0.19 9.27 41 BAYES_999 28438 14.80 35.19 9.09 42 LotsOfNums_01 28215 8.07 4.71 9.02 43 HTML_IMAGE_RATIO_02 27791 8.29 6.20 8.88 44 TR_XM_DK_Bayes2 26436 6.63 0.13 8.45 45 XM_SendGrid 26290 7.11 2.48 8.40 46 BAYES_60 24622 7.95 8.22 7.87 47 XM_B_Phish_Phrases 22442 6.87 5.79 7.17 48 XM_B_SpammyWords3 22046 7.52 9.22 7.05 49 BOTNET_IPINHOSTNAME 21708 8.16 12.50 6.94 50 HTML_IMAGE_RATIO_04 20659 5.94 3.59 6.60 51 TooManyTo_001 20187 5.87 3.81 6.45 52 XM_H_Long_From01 17689 5.30 4.02 5.65 53 XMSexyCombo_05 17398 6.22 8.57 5.56 54 T_TooManySym_01 16770 5.23 4.79 5.36 55 RELAYCOUNTRY_META 16598 13.28 41.72 5.30 56 BAYES_80 16199 6.26 10.11 5.18 57 TR_XM_DK_SendGrid 16043 4.27 1.21 5.13 58 IN_ZIMBRA_NJ_WHITELIST 15448 3.87 0.06 4.94 59 XMStrtUSub 14479 4.12 2.30 4.63 60 XMSubMetaSx_00 13965 5.19 7.79 4.46 61 MPART_ALT_DIFF 13875 6.22 12.58 4.43 62 MIME_QP_LONG_LINE 13239 3.63 1.50 4.23 63 XMNumbers 12974 3.74 2.27 4.15 64 RCVD_IN_IADB_LISTED 12912 3.38 0.70 4.13 65 BAYES_40 12246 3.32 1.21 3.91 66 FROM_EXCESS_BASE64 12124 8.70 25.90 3.87 67 TM2_M_URI_OPT_OUT 11929 3.31 1.52 3.81 68 ANY_BOUNCE_MESSAGE 11867 3.02 0.25 3.79 69 BOUNCE_MESSAGE 11866 3.02 0.25 3.79 70 RCVD_IN_IADB_SPF 11257 2.94 0.57 3.60 71 XM_UncommonTLD01 10974 7.37 21.14 3.51 72 BAYES_20 10925 2.94 0.99 3.49 73 HTML_IMAGE_RATIO_06 10486 2.98 1.63 3.35 74 RCVD_IN_IADB_SENDERID 10083 2.64 0.54 3.22 75 BAYES_95 10071 4.19 7.67 3.22 76 RCVD_IN_IADB_DK 9856 2.58 0.54 3.15 77 T_REMOTE_IMAGE 9568 2.96 2.59 3.06 78 T_TooManySym_02 9452 2.46 0.44 3.02 79 HTML_IMAGE_RATIO_08 8742 8.31 28.00 2.79 80 DKIM_INVALID 8118 2.78 3.44 2.59 81 MIME_HTML_MOSTLY 8077 4.43 11.04 2.58 82 XM_PDF 8052 2.10 0.40 2.57 83 TR_XM_PhishingBody 8026 2.68 3.08 2.57 84 TVD_RCVD_IP 8002 2.11 0.49 2.56 85 RCVD_IN_IADB_VOUCHED 7846 2.02 0.28 2.51 86 MIME_HTML_ONLY_MULTI 7733 2.19 1.18 2.47 87 BOTNET 7642 8.72 31.10 2.44 88 UNTRUSTED_Relay 7491 7.29 24.75 2.39 89 CK_HELO_DYNAMIC_SPLIT_IP 7254 2.00 0.86 2.32 90 HELO_MISC_IP 7252 1.96 0.70 2.32 91 INVALID_MSGID 7249 1.89 0.38 2.32 92 RELAYCOUNTRY_CA 7133 3.32 7.03 2.28 93 XMBrknScrpt_02 6716 3.30 7.40 2.15 94 XM_B_SpammyTLD 6628 2.50 3.85 2.12 95 HTML_MIME_NO_HTML_TAG 6508 7.34 26.10 2.08 96 BAYES_05 6408 1.74 0.66 2.05 97 RCVD_IN_MSPIKE_H5 6292 1.62 0.23 2.01 98 TO_MALFORMED 6271 1.57 0.01 2.00 99 RCVD_IN_BL_SPAMCOP_NET 6268 8.62 32.23 2.00 100 URI_NOVOWEL 6133 1.80 1.23 1.96 101 XM_B_Unsub2 6120 1.77 1.12 1.96 102 XM_CamelCaseFrm001 6034 2.03 2.41 1.93 103 USER_IN_DEF_DKIM_WL 5985 1.49 0.00 1.91 104 URI_HEX 5930 1.87 1.77 1.90 105 T_XMDrugObfuBody_08 5889 1.98 2.32 1.88 106 TR_LOTS_OF_MONEY3 5817 2.84 6.36 1.86 107 URI_TRY_3LD 5603 1.86 2.10 1.79 108 MAILING_LIST_MULTI 5522 1.52 0.63 1.76 109 TR_Symld_Words 5490 1.56 0.85 1.75 110 XMStockSpam_06 5486 1.59 1.03 1.75 111 IN_HORDE_ADDRESS_BOOK 5148 1.32 0.14 1.65 112 RCVD_IN_IADB_OPTIN 5123 1.33 0.24 1.64 113 TR_XM_SB_Phish 4963 1.61 1.71 1.59 114 XMDiploma_00 4948 1.62 1.75 1.58 115 XMSubPhish11 4942 1.60 1.66 1.58 116 XM_DK_Undo_01 4920 1.36 0.61 1.57 117 XMBdyGiftCard01 4887 1.50 1.28 1.56 118 T_XMDrugObfuBody_14 4837 1.47 1.21 1.55 119 TM2_M_VERY_LONG_WORD 4834 1.56 1.61 1.54 120 XMGappySubj_01 4766 1.21 0.11 1.52 121 SUBJ_ALL_CAPS 4565 1.97 3.78 1.46 122 XM_OfRef6 4539 1.83 3.18 1.45 123 T_XMHurry_00 4362 1.53 2.00 1.39 124 XM_B_COVIDMETA 4252 1.51 2.03 1.36 125 RCVD_IN_MSPIKE_BL 4225 3.57 11.49 1.35 126 XMBody_17 4147 2.14 5.03 1.33 127 T_TooManySym_03 4137 1.05 0.10 1.32 128 XM_ProductURIs 3866 1.06 0.43 1.24 129 XM_SPF_SoftFail 3791 1.92 4.46 1.21 130 XM_B_Phish66 3642 1.32 1.86 1.16 131 DKIM_ADSP_NXDOMAIN 3567 1.23 1.54 1.14 132 XMBody_95 3424 0.87 0.09 1.09 133 XM_H_Long_From02 3410 0.99 0.61 1.09 134 XM_RXBody 3312 0.91 0.39 1.06 135 TooManyTo_002 3203 0.90 0.45 1.02 136 XM_GoogleGroups 3201 0.85 0.24 1.02 137 TR_XM_UnparsRelay 3094 1.22 2.05 0.99 138 XM_UB50 3080 2.07 5.92 0.98 139 DKIM_ADSP_CUSTOM_MED 3052 1.03 1.22 0.98 140 TR_MSPIKEBAYES00 3047 0.76 0.00 0.97 141 HTML_FONT_FACE_BAD 3021 0.85 0.45 0.97 142 RCVD_IN_MSPIKE_L3 3012 2.25 6.85 0.96 143 T_FILL_THIS_FORM_SHORT 2737 1.07 1.75 0.87 144 XM_B_SpammyWords4 2703 0.97 1.35 0.86 145 KHOP_HELO_FCRDNS 2675 1.63 4.39 0.85 146 XMSexyCombo_01 2665 1.32 2.99 0.85 147 T_FONT_INVIS_MSGID 2629 0.98 1.46 0.84 148 HTML_TAG_BALANCE_BODY 2545 0.75 0.52 0.81 149 XMHTMLBadTable_001 2517 0.72 0.44 0.80 150 T_Symld_Words_02 2480 0.81 0.86 0.79 151 PLING_QUERY 2468 0.67 0.26 0.79 152 T_TooManySym_04 2453 0.62 0.04 0.78 153 TR_MetaPhish_Combo_01 2389 0.72 0.58 0.76 154 T_XMDrugObfuBody_00 2341 0.87 1.29 0.75 155 TooManyTo_003 2295 0.64 0.31 0.73 156 XM_S_SubURI 2261 0.58 0.09 0.72 157 NO_DNS_FOR_FROM 2247 0.76 0.91 0.72 158 RDNS_DYNAMIC 2247 1.07 2.32 0.72 159 XMGenDplmaNmb 2210 0.74 0.87 0.71 160 T_PDS_OTHER_BAD_TLD 2198 1.26 3.25 0.70 161 XM_B_REG_HTML 2154 0.55 0.04 0.69 162 RELAYCOUNTRY_GB 2144 2.09 7.11 0.69 163 NML_ADSP_CUSTOM_MED 2107 0.78 1.17 0.67 164 XMSubNoVowel 2094 0.84 1.44 0.67 165 USER_IN_WHITELIST 2059 0.51 0.00 0.66 166 USER_IN_WELCOMELIST 2059 0.51 0.00 0.66 167 DIET_1 1995 0.86 1.67 0.64 168 TR_BOTNET_NEGATE 1951 0.59 0.48 0.62 169 SPOOFED_URL 1913 0.72 1.11 0.61 170 T_TooManySym_05 1905 0.48 0.01 0.61 171 XMSlimDrugH 1887 0.66 0.86 0.60 172 XMHTML_After_End 1881 0.72 1.17 0.60 173 XM_H_Trusted_IP 1868 0.47 0.00 0.60 174 XMSolicitRefs_0 1839 0.50 0.18 0.59 175 XMLngstWrd_00 1833 0.49 0.17 0.59 176 HTTPS_HTTP_MISMATCH 1830 0.60 0.65 0.58 177 XMBody_78 1770 0.59 0.69 0.57 178 TooManyTo_004 1743 0.49 0.26 0.56 179 FORGED_GMAIL_RCVD 1736 0.67 1.07 0.55 180 XMLngstWrd_01 1703 0.46 0.14 0.54 181 XMPhish08 1672 0.54 0.54 0.53 182 XM_DIRTYINTL 1656 1.57 5.27 0.53 183 HELO_NODOT 1656 0.54 0.60 0.53 184 HELO_NO_DOMAIN 1655 0.54 0.59 0.53 185 XMPhish30 1651 0.52 0.51 0.53 186 SpammyFromTLD_01 1642 2.50 9.53 0.52 187 NUMERIC_HTTP_ADDR 1638 0.73 1.48 0.52 188 MPART_ALT_DIFF_COUNT 1635 0.58 0.80 0.52 189 XMSubMetaI_00 1622 0.55 0.66 0.52 190 XMSubMetaSxObfu_02 1621 0.50 0.41 0.52 191 XM_B_COPY_HTML 1610 0.49 0.41 0.51 192 TM2_M_A_HREF_HREF 1592 0.50 0.45 0.51 193 XM_ShortIntro_01 1588 0.49 0.41 0.51 194 SPOOFED_URL_HOST 1544 0.58 0.91 0.49 195 XM_H_PHPMailer 1533 0.56 0.80 0.49 196 TooManyTo_005 1494 0.42 0.22 0.48 197 XMLngstWrd_02 1428 0.38 0.12 0.46 198 HTML_IMAGE_ONLY_20 1417 0.39 0.15 0.45 199 TR_XM_PHPDW 1348 0.84 2.29 0.43 200 BASE64_LENGTH_79_INF 1336 0.44 0.48 0.43 ----------------------------------------------------------------------