Email: 451006 Autolearn: 0 AvgScore: 1.30 AvgScanTime: 1.81 sec Spam: 72434 Autolearn: 0 AvgScore: 13.11 AvgScanTime: 2.47 sec Ham: 378572 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.68 sec Time Spent Running SA: 226.62 hours Time Spent Processing Spam: 49.64 hours Time Spent Processing Ham: 176.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 66650 62.59 92.01 56.96 2 DCC_CHECK 56228 41.71 77.63 34.84 3 DKIM_SIGNED 53600 57.33 74.00 54.14 4 XM_DK_Pass 52488 56.47 72.46 53.41 5 DKIM_VALID 49375 53.77 68.17 51.02 6 XMListUnsubscribeExists 46619 44.17 64.36 40.31 7 DKIM_VALID_AU 43028 44.33 59.40 41.45 8 XM_H_QuotedFrom 39063 31.69 53.93 27.43 9 BAYES_50 29963 50.72 41.37 52.51 10 HTML_FONT_LOW_CONTRAST 29833 25.53 41.19 22.53 11 XM_DK_Undo_02 28035 12.18 38.70 7.10 12 MIME_HTML_ONLY 25120 18.12 34.68 14.95 13 LOC_TINY_FONT_1 24973 21.44 34.48 18.94 14 BAYES_99 24706 10.14 34.11 5.55 15 BAYES_999 20756 8.54 28.66 4.69 16 TR_DCC_Bayes_99 20170 7.40 27.85 3.49 17 FVGT_m_MULTI_ODD 19200 16.06 26.51 14.06 18 XMSubLong 17455 16.98 24.10 15.61 19 BOTNET_IPINHOSTNAME 16594 7.77 22.91 4.87 20 XM_Body_Dirty_Words 16245 11.89 22.43 9.87 21 DCC_CHECK_NEGATIVE 15112 57.41 20.86 64.41 22 BOTNET 14585 4.67 20.14 1.71 23 RELAYCOUNTRY_META 13840 5.76 19.11 3.21 24 T_TM2_M_HEADER_IN_MSG 12736 15.46 17.58 15.06 25 FSL_BULK_SIG 12168 6.72 16.80 4.79 26 XM_UncommonTLD01 12097 4.99 16.70 2.75 27 T_KAM_HTML_FONT_INVALID 11941 11.46 16.49 10.50 28 HTML_IMAGE_RATIO_02 10986 9.69 15.17 8.64 29 DKIM_VALID_EF 10728 18.99 14.81 19.80 30 MultiRelay 10527 9.95 14.53 9.08 31 UNTRUSTED_Relay 10054 3.04 13.88 0.96 32 XM_Multi_Part_URI 9385 10.63 12.96 10.19 33 XMSexyCombo_05 8856 5.22 12.23 3.88 34 LOTS_OF_MONEY 8381 6.26 11.57 5.24 35 XM_Evil_Numbers_Gen 7661 7.57 10.58 6.99 36 XMSubMetaSx_00 7193 4.18 9.93 3.08 37 HTML_IMAGE_RATIO_04 6468 5.95 8.93 5.38 38 HTML_MIME_NO_HTML_TAG 6085 1.95 8.40 0.72 39 XM_H_Long_From01 6073 5.20 8.38 4.59 40 XM_UB50 6050 1.71 8.35 0.44 41 MISSING_HEADERS 6020 1.46 8.31 0.15 42 T_REMOTE_IMAGE 5851 3.10 8.08 2.15 43 FROM_EXCESS_BASE64 5704 4.69 7.87 4.08 44 T_XMDrugObfuBody_14 5516 5.39 7.62 4.96 45 TooManyTo_001 5396 4.82 7.45 4.32 46 XM_B_Phish_Phrases 5351 5.56 7.39 5.21 47 BAYES_60 5070 4.17 7.00 3.63 48 MPART_ALT_DIFF 4887 3.13 6.75 2.44 49 XMStrtUSub 4757 4.50 6.57 4.11 50 BAYES_80 4693 2.88 6.48 2.19 51 XMNumbers 4447 2.82 6.14 2.19 52 DKIM_INVALID 4225 3.56 5.83 3.13 53 HTML_SHORT_LINK_IMG_1 4205 0.95 5.81 0.02 54 HTML_SHORT_CENTER 4124 0.97 5.69 0.07 55 MIME_HEADER_CTYPE_ONLY 4106 0.98 5.67 0.09 56 BODY_URI_ONLY 4090 0.93 5.65 0.03 57 HTML_IMAGE_ONLY_04 4063 0.92 5.61 0.03 58 FROM_SUSPICIOUS_NTLD 4037 1.03 5.57 0.16 59 SHORTENER_SHORT_IMG 4012 0.89 5.54 0.00 60 XM_SPF_SoftFail 3837 1.50 5.30 0.77 61 XM_DIRTYINTL 3580 2.00 4.94 1.43 62 HTML_IMAGE_RATIO_06 3520 2.50 4.86 2.05 63 MultiRelay_CC 3455 0.84 4.77 0.09 64 MultiRelay_Combo 3455 0.84 4.77 0.09 65 LotsOfNums_01 3211 5.18 4.43 5.32 66 REPLYTO_WITHOUT_TO_CC 3083 0.70 4.26 0.02 67 MIME_HTML_ONLY_MULTI 2939 1.53 4.06 1.04 68 HTML_IMAGE_RATIO_08 2934 2.08 4.05 1.70 69 TR_LOTS_OF_MONEY1 2900 0.65 4.00 0.01 70 XM_H_Long_From02 2881 1.15 3.98 0.61 71 XM_OfRef6 2814 1.59 3.88 1.15 72 XMSexyCombo_01 2809 0.95 3.88 0.39 73 MIME_HTML_MOSTLY 2728 2.77 3.77 2.58 74 BAYES_95 2707 1.73 3.74 1.34 75 RELAYCOUNTRY_CA 2549 1.63 3.52 1.27 76 XM_CamelCaseFrm001 2529 1.61 3.49 1.25 77 RCVD_IN_RP_SAFE 2501 9.52 3.45 10.68 78 URI_HEX 2501 1.79 3.45 1.47 79 NORDNS_LOW_CONTRAST 2475 0.55 3.42 0.01 80 T_TooManySym_01 2432 4.64 3.36 4.88 81 TM2_M_URI_OPT_OUT 2363 30.29 3.26 35.46 82 XMBody_17 2335 1.22 3.22 0.83 83 RCVD_IN_RP_RNBL 2280 0.54 3.15 0.04 84 T_XMDrugObfuBody_08 2279 1.15 3.15 0.77 85 RCVD_IN_RP_CERTIFIED 2107 8.16 2.91 9.17 86 BODY_ENHANCEMENT 2001 0.50 2.76 0.06 87 FILL_THIS_FORM 1968 0.85 2.72 0.50 88 DKIM_ADSP_CUSTOM_MED 1938 0.98 2.68 0.66 89 NML_ADSP_CUSTOM_MED 1911 0.79 2.64 0.44 90 NO_DNS_FOR_FROM 1905 1.26 2.63 1.00 91 BOTNET_NORDNS 1904 0.43 2.63 0.01 92 XMBdyGiftCard01 1899 1.49 2.62 1.27 93 SUBJ_ALL_CAPS 1897 1.28 2.62 1.03 94 FORGED_GMAIL_RCVD 1871 0.71 2.58 0.35 95 SpammyFromTLD_02 1853 0.52 2.56 0.13 96 RELAYCOUNTRY_CN 1803 0.42 2.49 0.02 97 RCVD_IN_MSPIKE_H2 1772 2.97 2.45 3.07 98 SpammyFromTLD_01 1753 0.57 2.42 0.22 99 UNPARSEABLE_RELAY 1734 2.92 2.39 3.02 100 XM_URI_RBL 1683 0.74 2.32 0.43 101 XM_UB60 1644 0.39 2.27 0.04 102 TR_LOTS_OF_MONEY3 1613 0.42 2.23 0.07 103 XM_S_JOY_D 1605 0.49 2.22 0.16 104 BAYES_40 1594 2.79 2.20 2.90 105 TR_Mismatch_TLD_02 1589 0.39 2.19 0.04 106 XMSubMetaI_00 1560 0.96 2.15 0.73 107 RELAYCOUNTRY_GB 1549 0.65 2.14 0.36 108 HELO_NODOT 1534 0.63 2.12 0.35 109 XMGppyBdWords 1503 0.54 2.07 0.24 110 XM_SendGrid 1494 3.44 2.06 3.71 111 XMDiploma_00 1482 1.04 2.05 0.85 112 RELAYCOUNTRY_NG_I 1445 0.32 1.99 0.01 113 MIME_QP_LONG_LINE 1442 2.75 1.99 2.89 114 BAYES_20 1420 15.67 1.96 18.29 115 TVD_SPACE_RATIO_MINFP 1400 0.33 1.93 0.02 116 XMSexyCombo_04 1343 0.44 1.85 0.17 117 XMSubMetaSxObfu_03 1343 0.67 1.85 0.44 118 DIET_1 1323 0.64 1.83 0.41 119 XM_OfRef7 1266 0.45 1.75 0.20 120 T_Symld_Words_02 1195 0.48 1.65 0.25 121 XMGenDplmaNmb 1171 0.56 1.62 0.35 122 URIBL_BLACK 1167 0.30 1.61 0.05 123 BAYES_00 1165 10.11 1.61 11.73 124 LONG_JUNK_URI 1150 0.31 1.59 0.06 125 XMSubMetaSSx_00 1122 0.50 1.55 0.30 126 XM_salutation2 1092 0.57 1.51 0.39 127 MONEY_FORM 1091 0.24 1.51 0.00 128 MONEY_FRAUD_8 1089 0.24 1.50 0.00 129 RELAYCOUNTRY_AT 1084 0.47 1.50 0.28 130 YOU_INHERIT 1042 0.23 1.44 0.00 131 XM_H_PHPOS 1039 0.76 1.43 0.63 132 HTML_OFF_PAGE 1038 0.23 1.43 0.00 133 URG_BIZ 1033 0.24 1.43 0.02 134 MONEY_ATM_CARD 1011 0.23 1.40 0.00 135 ADVANCE_FEE_5_NEW_FRM_MNY 1008 0.22 1.39 0.00 136 XMPhish30 992 0.47 1.37 0.30 137 ALL_TRUSTED 966 36.26 1.33 42.94 138 FILL_THIS_FORM_LONG 946 0.60 1.31 0.46 139 BAYES_05 943 1.53 1.30 1.58 140 FILL_THIS_FORM_LOAN 941 0.59 1.30 0.46 141 RELAYCOUNTRY_FR 930 0.32 1.28 0.13 142 XMPhish11 919 0.78 1.27 0.69 143 T_XMHurry_00 917 0.80 1.27 0.71 144 TR_XM_RelayPhish 912 0.53 1.26 0.39 145 RELAYCOUNTRY_IN 908 0.23 1.25 0.03 146 RCVD_IN_BL_SPAMCOP_NET 908 0.30 1.25 0.12 147 MAILING_LIST_MULTI 902 1.20 1.25 1.19 148 TM2_M_VERY_LONG_WORD 901 0.76 1.24 0.67 149 T_MONEY_PERCENT 881 0.51 1.22 0.38 150 TR_LOTS_OF_MONEY2 881 0.51 1.22 0.38 151 XM_B_REG_HTML 862 0.71 1.19 0.62 152 TR_XM_DK_Bayes 851 9.14 1.17 10.67 153 XMStockSpam_06 810 0.74 1.12 0.67 154 XMPhish14 809 0.54 1.12 0.43 155 RCVD_IN_IADB_LISTED 793 2.38 1.09 2.62 156 SUBJ_DOLLARS 783 0.43 1.08 0.30 157 XM_ProductURIs 778 0.83 1.07 0.78 158 XM_JunkDunk 766 0.17 1.06 0.00 159 XMHTMLBadTable_001 761 0.72 1.05 0.65 160 URIBL_DBL_SPAM 757 0.19 1.05 0.02 161 XMBody_78 739 0.49 1.02 0.39 162 TR_XM_DK_Bayes1 732 8.77 1.01 10.25 163 RCVD_IN_PSBL 729 0.16 1.01 0.00 164 RCVD_IN_IADB_SPF 711 2.11 0.98 2.33 165 HK_RANDOM_FROM 709 0.26 0.98 0.12 166 XM_H_PHPMailer 708 0.59 0.98 0.52 167 T_TooManySym_02 701 1.37 0.97 1.45 168 RCVD_IN_IADB_SENDERID 692 1.92 0.96 2.11 169 TR_XM_DK_Bayes2 687 7.82 0.95 9.13 170 DATE_IN_PAST_06_12 681 0.18 0.94 0.03 171 RCVD_IN_IADB_DK 681 1.89 0.94 2.08 172 RDNS_DYNAMIC 680 0.51 0.94 0.42 173 XMSubNoVowel 679 0.28 0.94 0.15 174 XM_UB99 667 0.16 0.92 0.01 175 XM_RXBody 659 0.52 0.91 0.45 176 T_XMDrugObfuBody_00 659 0.59 0.91 0.53 177 PP_MIME_FAKE_ASCII_TEXT 654 0.23 0.90 0.10 178 T_FILL_THIS_FORM_SHORT 654 0.44 0.90 0.35 179 TR_Symld_Words 639 0.87 0.88 0.86 180 LOW_PRICE 615 0.36 0.85 0.26 181 XM_Lotto 598 0.16 0.83 0.03 182 RELAYCOUNTRY_RU 598 0.15 0.83 0.02 183 XM_B_COPY_HTML 590 0.46 0.81 0.40 184 TR_Caps_n_Bayes_99 581 0.17 0.80 0.05 185 URI_TRY_3LD 580 0.94 0.80 0.96 186 SUBJECT_NEEDS_ENCODING 565 0.13 0.78 0.01 187 SUBJ_ILLEGAL_CHARS 564 0.13 0.78 0.01 188 HTML_FONT_FACE_BAD 548 0.50 0.76 0.46 189 MONEY_FRAUD_5 544 0.12 0.75 0.00 190 THIS_AD 538 0.72 0.74 0.72 191 DATE_IN_PAST_03_06 533 0.15 0.74 0.04 192 TR_Sbj_FN_Bdy 525 0.23 0.72 0.13 193 RELAYCOUNTRY_NL 508 0.23 0.70 0.14 194 LONG_JUNK_URI2 508 0.13 0.70 0.02 195 T_HTML_TAG_BALANCE_CENTER 506 0.20 0.70 0.11 196 XM_H_PHPOS_M 498 0.40 0.69 0.35 197 XM_UB80 491 0.12 0.68 0.01 198 ADVANCE_FEE_3_NEW_MONEY 491 0.11 0.68 0.00 199 URI_NOVOWEL 489 0.35 0.68 0.29 200 XM_UB999 486 0.12 0.67 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 243826 57.41 20.86 64.41 2 HTML_MESSAGE 215634 62.59 92.01 56.96 3 DKIM_SIGNED 204972 57.33 74.00 54.14 4 XM_DK_Pass 202210 56.47 72.46 53.41 5 BAYES_50 198792 50.72 41.37 52.51 6 DKIM_VALID 193129 53.77 68.17 51.02 7 ALL_TRUSTED 162574 36.26 1.33 42.94 8 DKIM_VALID_AU 156916 44.33 59.40 41.45 9 XMListUnsubscribeExists 152592 44.17 64.36 40.31 10 TM2_M_URI_OPT_OUT 134243 30.29 3.26 35.46 11 ANY_BOUNCE_MESSAGE 133690 29.68 0.26 35.31 12 BOUNCE_MESSAGE 133689 29.68 0.26 35.31 13 DCC_CHECK 131895 41.71 77.63 34.84 14 XM_H_QuotedFrom 103860 31.69 53.93 27.43 15 HTML_FONT_LOW_CONTRAST 85302 25.53 41.19 22.53 16 DKIM_VALID_EF 74939 18.99 14.81 19.80 17 LOC_TINY_FONT_1 71711 21.44 34.48 18.94 18 BAYES_20 69232 15.67 1.96 18.29 19 XMSubLong 59110 16.98 24.10 15.61 20 T_TM2_M_HEADER_IN_MSG 57005 15.46 17.58 15.06 21 MIME_HTML_ONLY 56593 18.12 34.68 14.95 22 FVGT_m_MULTI_ODD 53212 16.06 26.51 14.06 23 BAYES_00 44413 10.11 1.61 11.73 24 RCVD_IN_RP_SAFE 40445 9.52 3.45 10.68 25 TR_XM_DK_Bayes 40385 9.14 1.17 10.67 26 T_KAM_HTML_FONT_INVALID 39754 11.46 16.49 10.50 27 TR_XM_DK_Bayes1 38810 8.77 1.01 10.25 28 XM_Multi_Part_URI 38573 10.63 12.96 10.19 29 XM_DKIMWhitelistDomains 38034 8.44 0.02 10.05 30 XM_Body_Dirty_Words 37369 11.89 22.43 9.87 31 RCVD_IN_RP_CERTIFIED 34712 8.16 2.91 9.17 32 TR_XM_DK_Bayes2 34561 7.82 0.95 9.13 33 MultiRelay 34358 9.95 14.53 9.08 34 HTML_IMAGE_RATIO_02 32701 9.69 15.17 8.64 35 XM_DK_Undo_02 26884 12.18 38.70 7.10 36 XM_Evil_Numbers_Gen 26481 7.57 10.58 6.99 37 BAYES_99 21015 10.14 34.11 5.55 38 HTML_IMAGE_RATIO_04 20355 5.95 8.93 5.38 39 LotsOfNums_01 20143 5.18 4.43 5.32 40 LOTS_OF_MONEY 19832 6.26 11.57 5.24 41 XM_B_Phish_Phrases 19733 5.56 7.39 5.21 42 T_XMDrugObfuBody_14 18795 5.39 7.62 4.96 43 T_TooManySym_01 18485 4.64 3.36 4.88 44 BOTNET_IPINHOSTNAME 18429 7.77 22.91 4.87 45 FSL_BULK_SIG 18139 6.72 16.80 4.79 46 BAYES_999 17744 8.54 28.66 4.69 47 XM_H_Long_From01 17380 5.20 8.38 4.59 48 TooManyTo_001 16357 4.82 7.45 4.32 49 XMStrtUSub 15548 4.50 6.57 4.11 50 FROM_EXCESS_BASE64 15432 4.69 7.87 4.08 51 XMSexyCombo_05 14706 5.22 12.23 3.88 52 XM_SendGrid 14040 3.44 2.06 3.71 53 BAYES_60 13732 4.17 7.00 3.63 54 TR_DCC_Bayes_99 13194 7.40 27.85 3.49 55 RELAYCOUNTRY_META 12150 5.76 19.11 3.21 56 DKIM_INVALID 11843 3.56 5.83 3.13 57 TO_MALFORMED 11740 2.61 0.06 3.10 58 XMSubMetaSx_00 11649 4.18 9.93 3.08 59 RCVD_IN_MSPIKE_H2 11609 2.97 2.45 3.07 60 UNPARSEABLE_RELAY 11418 2.92 2.39 3.02 61 BAYES_40 10976 2.79 2.20 2.90 62 MIME_QP_LONG_LINE 10954 2.75 1.99 2.89 63 XM_UncommonTLD01 10401 4.99 16.70 2.75 64 RCVD_IN_IADB_LISTED 9937 2.38 1.09 2.62 65 MIME_HTML_MOSTLY 9771 2.77 3.77 2.58 66 TVD_RCVD_IP 9748 2.21 0.31 2.57 67 MPART_ALT_DIFF 9232 3.13 6.75 2.44 68 RCVD_IN_IADB_SPF 8810 2.11 0.98 2.33 69 IN_ZIMBRA_NJ_WHITELIST 8693 1.93 0.02 2.30 70 BAYES_80 8297 2.88 6.48 2.19 71 XMNumbers 8278 2.82 6.14 2.19 72 T_REMOTE_IMAGE 8121 3.10 8.08 2.15 73 RCVD_IN_IADB_SENDERID 7985 1.92 0.96 2.11 74 RCVD_IN_IADB_DK 7859 1.89 0.94 2.08 75 HTML_IMAGE_RATIO_06 7762 2.50 4.86 2.05 76 INVALID_MSGID 7092 1.62 0.29 1.87 77 BOTNET 6457 4.67 20.14 1.71 78 HTML_IMAGE_RATIO_08 6438 2.08 4.05 1.70 79 BAYES_05 5978 1.53 1.30 1.58 80 RCVD_IN_IADB_VOUCHED 5887 1.40 0.60 1.56 81 RCVD_IN_MSPIKE_WL 5759 1.32 0.27 1.52 82 RCVD_IN_MSPIKE_H3 5739 1.32 0.27 1.52 83 URI_HEX 5572 1.79 3.45 1.47 84 T_TooManySym_02 5492 1.37 0.97 1.45 85 XM_DIRTYINTL 5421 2.00 4.94 1.43 86 BAYES_95 5091 1.73 3.74 1.34 87 TR_MetaPhish_Combo_01 4884 1.18 0.59 1.29 88 XMBdyGiftCard01 4809 1.49 2.62 1.27 89 RELAYCOUNTRY_CA 4801 1.63 3.52 1.27 90 IN_HORDE_ADDRESS_BOOK 4788 1.07 0.05 1.26 91 XM_CamelCaseFrm001 4721 1.61 3.49 1.25 92 MAILING_LIST_MULTI 4504 1.20 1.25 1.19 93 XM_OfRef6 4368 1.59 3.88 1.15 94 USER_IN_DEF_DKIM_WL 4123 0.91 0.00 1.09 95 MIME_HTML_ONLY_MULTI 3944 1.53 4.06 1.04 96 XM_PDF 3929 0.92 0.28 1.04 97 SUBJ_ALL_CAPS 3881 1.28 2.62 1.03 98 NO_DNS_FOR_FROM 3767 1.26 2.63 1.00 99 RCVD_IN_IADB_OPTIN 3676 0.90 0.53 0.97 100 UNTRUSTED_Relay 3650 3.04 13.88 0.96 101 URI_TRY_3LD 3645 0.94 0.80 0.96 102 XM_DK_Undo_01 3491 0.88 0.67 0.92 103 TR_Symld_Words 3271 0.87 0.88 0.86 104 XMDiploma_00 3210 1.04 2.05 0.85 105 XMBody_17 3160 1.22 3.22 0.83 106 TooManyTo_002 3117 0.78 0.55 0.82 107 XM_ProductURIs 2944 0.83 1.07 0.78 108 XM_GoogleGroups 2930 0.72 0.45 0.77 109 T_XMDrugObfuBody_08 2926 1.15 3.15 0.77 110 XM_SPF_SoftFail 2915 1.50 5.30 0.77 111 XMSubMetaI_00 2777 0.96 2.15 0.73 112 THIS_AD 2717 0.72 0.74 0.72 113 HTML_MIME_NO_HTML_TAG 2711 1.95 8.40 0.72 114 T_XMHurry_00 2697 0.80 1.27 0.71 115 XMPhish11 2621 0.78 1.27 0.69 116 XMStockSpam_06 2539 0.74 1.12 0.67 117 TM2_M_VERY_LONG_WORD 2536 0.76 1.24 0.67 118 DKIM_ADSP_CUSTOM_MED 2502 0.98 2.68 0.66 119 XMHTMLBadTable_001 2475 0.72 1.05 0.65 120 XM_H_PHPOS 2403 0.76 1.43 0.63 121 XMSubMetaSxObfu_02 2358 0.56 0.22 0.62 122 XM_B_REG_HTML 2358 0.71 1.19 0.62 123 TooManyTo_003 2326 0.59 0.47 0.61 124 XM_H_Long_From02 2307 1.15 3.98 0.61 125 XMBody_95 2260 0.52 0.12 0.60 126 T_TooManySym_03 2196 0.51 0.14 0.58 127 USER_IN_WHITELIST 2075 0.46 0.00 0.55 128 T_XMDrugObfuBody_00 2002 0.59 0.91 0.53 129 XM_H_PHPMailer 1955 0.59 0.98 0.52 130 TooManyTo_004 1925 0.49 0.36 0.51 131 FILL_THIS_FORM 1886 0.85 2.72 0.50 132 FILL_THIS_FORM_LOAN 1741 0.59 1.30 0.46 133 FILL_THIS_FORM_LONG 1739 0.60 1.31 0.46 134 HTML_FONT_FACE_BAD 1729 0.50 0.76 0.46 135 XM_RXBody 1701 0.52 0.91 0.45 136 TooManyTo_005 1687 0.43 0.32 0.45 137 XM_UB50 1683 1.71 8.35 0.44 138 NML_ADSP_CUSTOM_MED 1671 0.79 2.64 0.44 139 XMSubMetaSxObfu_03 1658 0.67 1.85 0.44 140 XM_URI_RBL 1646 0.74 2.32 0.43 141 XMPhish14 1626 0.54 1.12 0.43 142 RDNS_DYNAMIC 1604 0.51 0.94 0.42 143 DIET_1 1545 0.64 1.83 0.41 144 XM_B_COPY_HTML 1501 0.46 0.81 0.40 145 XMBody_78 1491 0.49 1.02 0.39 146 TR_XM_RelayPhish 1485 0.53 1.26 0.39 147 XMSexyCombo_01 1482 0.95 3.88 0.39 148 XM_salutation2 1479 0.57 1.51 0.39 149 XMBrknScrpt_02 1479 0.40 0.48 0.39 150 T_MONEY_PERCENT 1422 0.51 1.22 0.38 151 TR_LOTS_OF_MONEY2 1422 0.51 1.22 0.38 152 PLING_QUERY 1369 0.39 0.51 0.36 153 RELAYCOUNTRY_GB 1362 0.65 2.14 0.36 154 XMGenDplmaNmb 1337 0.56 1.62 0.35 155 FORGED_GMAIL_RCVD 1336 0.71 2.58 0.35 156 XM_H_PHPOS_M 1326 0.40 0.69 0.35 157 T_FILL_THIS_FORM_SHORT 1323 0.44 0.90 0.35 158 HELO_NODOT 1318 0.63 2.12 0.35 159 TM2_M_A_HREF_HREF 1318 0.33 0.22 0.35 160 DKIM_ADSP_NXDOMAIN 1311 0.40 0.65 0.35 161 XMNoVowels 1307 0.38 0.58 0.35 162 XM_Body_Obfu01 1189 0.28 0.12 0.31 163 SUBJ_DOLLARS 1147 0.43 1.08 0.30 164 XMPhish30 1146 0.47 1.37 0.30 165 XMSubMetaSSx_00 1146 0.50 1.55 0.30 166 T_TooManySym_04 1121 0.25 0.02 0.30 167 URI_NOVOWEL 1099 0.35 0.68 0.29 168 HTTPS_HTTP_MISMATCH 1096 0.31 0.40 0.29 169 HTML_TAG_BALANCE_BODY 1088 0.30 0.36 0.29 170 XMHTML_After_End 1066 0.33 0.61 0.28 171 RELAYCOUNTRY_AT 1049 0.47 1.50 0.28 172 REMOVE_BEFORE_LINK 1041 0.32 0.56 0.27 173 XMCapTrack 1016 0.26 0.20 0.27 174 RELAYCOUNTRY_AU 1001 0.28 0.36 0.26 175 LOW_PRICE 987 0.36 0.85 0.26 176 BASE64_LENGTH_79_INF 987 0.26 0.26 0.26 177 XM_Walgreens_Forge 965 0.25 0.22 0.25 178 XMLngstWrd_00 964 0.25 0.25 0.25 179 XMSolicitRefs_0 952 0.25 0.27 0.25 180 T_Symld_Words_02 951 0.48 1.65 0.25 181 XMMoneyMeta_00 923 0.29 0.51 0.24 182 NUMERIC_HTTP_ADDR 915 0.30 0.59 0.24 183 XMGppyBdWords 914 0.54 2.07 0.24 184 FSL_THIS_IS_ADV 885 0.22 0.15 0.23 185 XM_Akamai 872 0.20 0.01 0.23 186 XMLngstWrd_01 859 0.23 0.23 0.23 187 SpammyFromTLD_01 838 0.57 2.42 0.22 188 XM_ShortIntro_01 817 0.25 0.44 0.22 189 XMDateMe_00 810 0.21 0.19 0.21 190 XMRcvdHeader_15 787 0.17 0.00 0.21 191 XMSubMetaD_03 775 0.25 0.48 0.20 192 XM_Combo_Sbj 771 0.24 0.43 0.20 193 XM_H_SpoofStaff4 761 0.18 0.07 0.20 194 XM_OfRef7 761 0.45 1.75 0.20 195 MPART_ALT_DIFF_COUNT 740 0.25 0.52 0.20 196 XMSUPPORT 693 0.15 0.00 0.18 197 XM_D_tchamptons_WL 674 0.15 0.00 0.18 198 XMSlimDrugH 641 0.25 0.64 0.17 199 XMSexyCombo_04 632 0.44 1.85 0.17 200 FROM_SUSPICIOUS_NTLD 623 1.03 5.57 0.16 ----------------------------------------------------------------------