Email: 324670 Autolearn: 0 AvgScore: 2.61 AvgScanTime: 2.34 sec Spam: 83654 Autolearn: 0 AvgScore: 12.13 AvgScanTime: 2.87 sec Ham: 241016 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 2.15 sec Time Spent Running SA: 210.90 hours Time Spent Processing Spam: 66.67 hours Time Spent Processing Ham: 144.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77818 86.19 93.02 83.82 2 DKIM_SIGNED 71409 81.89 85.36 80.68 3 XM_DK_Pass 69244 80.40 82.77 79.57 4 DKIM_VALID 67032 78.01 80.13 77.27 5 XM_B_Unicode 66976 73.12 80.06 70.71 6 DCC_CHECK 65407 58.01 78.19 51.01 7 XMListUnsubscribeExists 64886 61.55 77.56 55.99 8 DKIM_VALID_AU 54809 63.06 65.52 62.21 9 XM_DK_Undo_02 42597 26.79 50.92 18.41 10 BAYES_99 36779 23.27 43.97 16.09 11 HTML_FONT_LOW_CONTRAST 34457 35.71 41.19 33.81 12 LOC_TINY_FONT_1 31056 31.41 37.12 29.42 13 BAYES_999 30800 20.22 36.82 14.46 14 TR_DCC_Bayes_99 29247 15.12 34.96 8.23 15 BAYES_50 27256 45.76 32.58 50.33 16 MIME_HTML_ONLY 25228 25.49 30.16 23.87 17 FVGT_m_MULTI_ODD 23666 23.16 28.29 21.38 18 XM_Body_Dirty_Words 20246 17.08 24.20 14.61 19 XMSubLong 19527 24.33 23.34 24.67 20 DCC_CHECK_NEGATIVE 17040 40.74 20.37 47.81 21 DKIM_VALID_EF 16606 28.54 19.85 31.56 22 RELAYCOUNTRY_META 16452 8.54 19.67 4.67 23 HTML_IMAGE_RATIO_02 16061 13.00 19.20 10.85 24 T_KAM_HTML_FONT_INVALID 16012 15.91 19.14 14.79 25 T_TM2_M_HEADER_IN_MSG 15820 22.27 18.91 23.43 26 XM_Multi_Part_URI 15018 15.20 17.95 14.25 27 MultiRelay 14136 17.26 16.90 17.38 28 BOTNET 12914 5.79 15.44 2.45 29 BOTNET_IPINHOSTNAME 12376 8.66 14.79 6.52 30 XM_Evil_Numbers_Gen 11589 11.26 13.85 10.36 31 UNTRUSTED_Relay 10051 4.15 12.01 1.42 32 XMSexyCombo_05 10011 7.28 11.97 5.65 33 LOTS_OF_MONEY 9169 9.54 10.96 9.05 34 XMSubMetaSx_00 8452 5.74 10.10 4.22 35 HTML_IMAGE_RATIO_04 8429 7.70 10.08 6.87 36 FSL_BULK_SIG 8141 10.81 9.73 11.18 37 RCVD_IN_MSPIKE_H2 7154 10.17 8.55 10.73 38 MPART_ALT_DIFF 7139 5.53 8.53 4.48 39 TooManyTo_001 6740 7.31 8.06 7.06 40 XM_H_Long_From01 6727 7.05 8.04 6.71 41 LotsOfNums_01 6435 7.56 7.69 7.52 42 T_XMDrugObfuBody_14 6386 8.50 7.63 8.81 43 BAYES_80 6289 4.90 7.52 3.99 44 XM_B_Phish_Phrases 5876 8.09 7.02 8.46 45 XM_DIRTYINTL 5316 4.28 6.35 3.56 46 XM_UncommonTLD01 5155 5.82 6.16 5.70 47 BAYES_60 5141 6.22 6.15 6.25 48 MIME_HTML_MOSTLY 4837 4.02 5.78 3.41 49 XMStrtUSub 4753 5.82 5.68 5.87 50 FROM_EXCESS_BASE64 4700 4.25 5.62 3.78 51 XM_UB50 4668 2.06 5.58 0.84 52 XMBdyGiftCard01 4572 2.82 5.47 1.90 53 DKIM_INVALID 4377 3.88 5.23 3.41 54 HTML_IMAGE_RATIO_06 4375 4.14 5.23 3.77 55 RELAYCOUNTRY_CA 4292 2.37 5.13 1.41 56 BAYES_95 3812 3.13 4.56 2.64 57 XM_SendGrid 3726 6.79 4.45 7.59 58 MIME_HTML_ONLY_MULTI 3663 2.59 4.38 1.97 59 URI_HEX 3478 2.47 4.16 1.88 60 MIME_QP_LONG_LINE 3415 4.00 4.08 3.97 61 XM_B_SpammyTLD 3383 4.70 4.04 4.93 62 RCVD_IN_RP_SAFE 3363 11.97 4.02 14.73 63 XMNumbers 3292 3.32 3.94 3.11 64 HTML_IMAGE_RATIO_08 3245 2.73 3.88 2.32 65 RELAYCOUNTRY_FR 3133 1.14 3.75 0.23 66 RCVD_IN_BL_SPAMCOP_NET 3115 1.41 3.72 0.61 67 T_TooManySym_01 3095 6.72 3.70 7.77 68 XMSexyCombo_01 3063 1.40 3.66 0.62 69 SpammyFromTLD_02 3048 1.09 3.64 0.20 70 TM2_M_URI_OPT_OUT 2986 2.11 3.57 1.61 71 NO_DNS_FOR_FROM 2763 1.81 3.30 1.29 72 XM_SPF_SoftFail 2674 1.52 3.20 0.94 73 TR_XM_PHPDW 2643 1.24 3.16 0.58 74 XM_CamelCaseFrm001 2641 2.41 3.16 2.15 75 TR_XM_PHPForged 2603 1.21 3.11 0.55 76 SUBJ_ALL_CAPS 2585 1.94 3.09 1.54 77 TR_XM_FormFill2 2578 1.19 3.08 0.53 78 XM_H_PHPOS 2569 1.19 3.07 0.53 79 RCVD_IN_RP_RNBL 2447 0.78 2.93 0.04 80 RCVD_IN_RP_CERTIFIED 2396 10.65 2.86 13.35 81 XM_URI_RBL 2346 1.01 2.80 0.39 82 T_XMDrugObfuBody_08 2342 2.48 2.80 2.37 83 HTML_MIME_NO_HTML_TAG 2332 2.31 2.79 2.15 84 DKIM_ADSP_NXDOMAIN 2251 1.11 2.69 0.57 85 XMDiploma_00 2247 1.58 2.69 1.19 86 US_DOLLARS_3 2209 2.08 2.64 1.89 87 XMSubMetaI_00 2102 1.59 2.51 1.28 88 MultiRelay_CC 1967 0.72 2.35 0.15 89 MultiRelay_Combo 1967 0.72 2.35 0.15 90 TR_XM_DK_SendGrid 1954 3.77 2.34 4.27 91 KHOP_HELO_FCRDNS 1900 1.35 2.27 1.03 92 T_REMOTE_IMAGE 1895 2.80 2.27 2.99 93 ALL_TRUSTED 1814 11.90 2.17 15.28 94 BAYES_40 1792 3.19 2.14 3.55 95 RCVD_IN_IADB_LISTED 1690 3.16 2.02 3.56 96 TR_Symld_Words 1681 1.68 2.01 1.56 97 XM_UB99 1654 0.54 1.98 0.05 98 XMBody_17 1628 1.21 1.95 0.96 99 XM_OfRef6 1609 1.98 1.92 2.01 100 XMSubMetaSxObfu_03 1602 0.73 1.92 0.32 101 TM2_M_VERY_LONG_WORD 1582 1.52 1.89 1.39 102 XMSlimDrugH 1572 0.78 1.88 0.40 103 T_MONEY_PERCENT 1563 0.71 1.87 0.31 104 TR_LOTS_OF_MONEY2 1563 0.71 1.87 0.31 105 XM_H_PHPOS_M 1549 0.66 1.85 0.25 106 XM_H_PHPMailer 1537 0.95 1.84 0.65 107 RCVD_IN_IADB_SPF 1485 2.78 1.78 3.13 108 XMGenDplmaNmb 1484 0.97 1.77 0.69 109 XMStockSpam_06 1417 1.78 1.69 1.81 110 RCVD_IN_IADB_SENDERID 1407 2.48 1.68 2.76 111 RCVD_IN_IADB_DK 1395 2.44 1.67 2.71 112 XMPhish30 1350 0.85 1.61 0.58 113 SpammyFromTLD_01 1321 0.68 1.58 0.37 114 SUBJ_DOLLARS 1303 0.66 1.56 0.35 115 XM_H_Long_From02 1291 1.17 1.54 1.04 116 LOW_PRICE 1285 0.66 1.54 0.36 117 T_XMDrugObfuBody_00 1271 1.18 1.52 1.07 118 RCVD_IN_PSBL 1270 0.43 1.52 0.05 119 TR_Mismatch_TLD_02 1250 0.44 1.49 0.07 120 TR_XM_RelayPhish 1248 1.06 1.49 0.91 121 DIET_1 1226 0.70 1.47 0.44 122 BOTNET_NORDNS 1209 0.40 1.45 0.03 123 BAYES_20 1192 2.32 1.42 2.63 124 XM_B_REG_HTML 1178 0.94 1.41 0.78 125 XM_UB60 1146 0.40 1.37 0.06 126 XMPhish11 1134 1.27 1.36 1.24 127 FROM_SUSPICIOUS_NTLD 1129 0.36 1.35 0.02 128 RCVD_IN_MSPIKE_BL 1129 0.86 1.35 0.68 129 URI_TRY_3LD 1102 1.73 1.32 1.88 130 XMSexyCombo_04 1095 0.44 1.31 0.14 131 RELAYCOUNTRY_AT 1090 0.51 1.30 0.24 132 XMGppyBdWords 1089 0.41 1.30 0.10 133 FROM_SUSPICIOUS_NTLD_FP 1087 0.35 1.30 0.02 134 T_TooManySym_02 1086 2.32 1.30 2.67 135 XM_UB999 1079 0.36 1.29 0.04 136 URIBL_DBL_ABUSE_REDIR 1070 0.37 1.28 0.06 137 RCVD_IN_MSPIKE_L5 1044 0.83 1.25 0.68 138 UNPARSEABLE_RELAY 1040 3.55 1.24 4.35 139 MAILING_LIST_MULTI 1027 2.22 1.23 2.57 140 XM_ProductURIs 1005 1.23 1.20 1.25 141 XMHTML_After_End 1004 0.55 1.20 0.33 142 TR_Caps_n_Bayes_99 1004 0.52 1.20 0.28 143 HTML_TAG_BALANCE_BODY 991 0.75 1.18 0.59 144 T_XMHurry_00 988 0.72 1.18 0.56 145 URIBL_BLACK 982 0.38 1.17 0.10 146 TM2_M_A_HREF_HREF 932 0.66 1.11 0.50 147 XMBody_78 930 0.72 1.11 0.59 148 LongTLD 916 0.41 1.09 0.18 149 XMBrknScrpt_02 908 0.77 1.09 0.66 150 DATE_IN_PAST_03_06 862 0.36 1.03 0.12 151 TooManyTo_002 861 1.26 1.03 1.34 152 XM_UB80 854 0.28 1.02 0.02 153 RDNS_DYNAMIC 851 0.67 1.02 0.54 154 XMSubGiftCard1 849 0.33 1.01 0.09 155 XMSubMetaD_00 787 0.29 0.94 0.06 156 XMSubMetaSSx_00 785 0.46 0.94 0.30 157 RCVD_IN_IADB_VOUCHED 771 1.88 0.92 2.22 158 HK_RANDOM_REPLYTO 764 0.44 0.91 0.28 159 XMHTMLBadTable_001 763 0.78 0.91 0.73 160 DRUGS_ERECTILE 752 0.32 0.90 0.11 161 DKIM_ADSP_CUSTOM_MED 748 0.92 0.89 0.93 162 XM_B_COPY_HTML 743 0.65 0.89 0.57 163 RELAYCOUNTRY_GB 740 0.60 0.88 0.50 164 XM_DK_Undo_01 737 1.33 0.88 1.48 165 NUMERIC_HTTP_ADDR 734 0.63 0.88 0.55 166 RCVD_IN_MSPIKE_H3 726 3.24 0.87 4.07 167 RCVD_IN_MSPIKE_WL 726 3.24 0.87 4.07 168 HTML_COMMENT_SAVED_URL 721 0.28 0.86 0.07 169 TooManyTo_003 719 0.92 0.86 0.94 170 T_FILL_THIS_FORM_SHORT 716 1.17 0.86 1.28 171 BODY_ENHANCEMENT 713 0.23 0.85 0.01 172 HTML_FONT_FACE_BAD 691 0.77 0.83 0.75 173 THIS_AD 688 0.29 0.82 0.11 174 FROM_MISSP_REPLYTO 664 0.21 0.79 0.01 175 PLING_QUERY 659 0.63 0.79 0.58 176 PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 658 0.21 0.79 0.00 177 XM_UB95 656 0.22 0.78 0.02 178 DATE_IN_PAST_12_24 652 0.25 0.78 0.06 179 RELAYCOUNTRY_IN 652 0.25 0.78 0.06 180 TR_LOTS_OF_MONEY3 646 0.41 0.77 0.28 181 URIBL_DBL_SPAM 632 0.23 0.76 0.04 182 RELAYCOUNTRY_DE 629 0.46 0.75 0.35 183 NML_ADSP_CUSTOM_MED 613 0.66 0.73 0.64 184 LOADSA_MONEY_COMBO 601 0.21 0.72 0.03 185 XMMoneyMeta_00 598 0.29 0.71 0.14 186 URI_NOVOWEL 594 0.44 0.71 0.34 187 HDRS_LCASE 593 0.18 0.71 0.00 188 FORGED_GMAIL_RCVD 583 0.53 0.70 0.48 189 XMSubMetaSx_01 581 0.32 0.69 0.18 190 UPPERCASE_50_75 580 0.39 0.69 0.28 191 TVD_RCVD_IP 580 2.99 0.69 3.79 192 XMObfuSubjects 580 0.19 0.69 0.01 193 BODY_URI_ONLY 578 0.21 0.69 0.04 194 XMGappySubj_01 569 0.45 0.68 0.37 195 XM_HighProb1 569 0.18 0.68 0.01 196 BAYES_00 567 9.29 0.68 12.28 197 SUBJECT_NEEDS_ENCODING 566 0.19 0.68 0.02 198 SUBJ_ILLEGAL_CHARS 563 0.19 0.67 0.02 199 XM_RXBody 555 0.41 0.66 0.32 200 HELO_NODOT 553 0.63 0.66 0.62 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202017 86.19 93.02 83.82 2 DKIM_SIGNED 194457 81.89 85.36 80.68 3 XM_DK_Pass 191783 80.40 82.77 79.57 4 DKIM_VALID 186244 78.01 80.13 77.27 5 XM_B_Unicode 170418 73.12 80.06 70.71 6 DKIM_VALID_AU 149932 63.06 65.52 62.21 7 XMListUnsubscribeExists 134942 61.55 77.56 55.99 8 DCC_CHECK 122938 58.01 78.19 51.01 9 BAYES_50 121304 45.76 32.58 50.33 10 DCC_CHECK_NEGATIVE 115223 40.74 20.37 47.81 11 HTML_FONT_LOW_CONTRAST 81489 35.71 41.19 33.81 12 DKIM_VALID_EF 76061 28.54 19.85 31.56 13 LOC_TINY_FONT_1 70916 31.41 37.12 29.42 14 XMSubLong 59466 24.33 23.34 24.67 15 MIME_HTML_ONLY 57540 25.49 30.16 23.87 16 T_TM2_M_HEADER_IN_MSG 56478 22.27 18.91 23.43 17 FVGT_m_MULTI_ODD 51521 23.16 28.29 21.38 18 XM_DK_Undo_02 44369 26.79 50.92 18.41 19 MultiRelay 41895 17.26 16.90 17.38 20 BAYES_99 38781 23.27 43.97 16.09 21 ALL_TRUSTED 36835 11.90 2.17 15.28 22 T_KAM_HTML_FONT_INVALID 35640 15.91 19.14 14.79 23 RCVD_IN_RP_SAFE 35512 11.97 4.02 14.73 24 XM_Body_Dirty_Words 35218 17.08 24.20 14.61 25 BAYES_999 34861 20.22 36.82 14.46 26 XM_Multi_Part_URI 34344 15.20 17.95 14.25 27 XM_DKIMWhitelistDomains 33705 10.44 0.22 13.98 28 RCVD_IN_RP_CERTIFIED 32187 10.65 2.86 13.35 29 BAYES_00 29588 9.29 0.68 12.28 30 TR_XM_DK_Bayes 27237 8.49 0.38 11.30 31 FSL_BULK_SIG 26944 10.81 9.73 11.18 32 TR_XM_DK_Bayes1 26659 8.30 0.36 11.06 33 HTML_IMAGE_RATIO_02 26159 13.00 19.20 10.85 34 RCVD_IN_MSPIKE_H2 25852 10.17 8.55 10.73 35 XM_Evil_Numbers_Gen 24980 11.26 13.85 10.36 36 TR_XM_DK_Bayes2 24399 7.60 0.33 10.12 37 LOTS_OF_MONEY 21819 9.54 10.96 9.05 38 T_XMDrugObfuBody_14 21227 8.50 7.63 8.81 39 XM_B_Phish_Phrases 20387 8.09 7.02 8.46 40 TR_DCC_Bayes_99 19829 15.12 34.96 8.23 41 T_TooManySym_01 18719 6.72 3.70 7.77 42 XM_SendGrid 18304 6.79 4.45 7.59 43 LotsOfNums_01 18123 7.56 7.69 7.52 44 TO_MALFORMED 17298 5.34 0.05 7.18 45 TooManyTo_001 17006 7.31 8.06 7.06 46 HTML_IMAGE_RATIO_04 16557 7.70 10.08 6.87 47 XM_H_Long_From01 16175 7.05 8.04 6.71 48 BOTNET_IPINHOSTNAME 15726 8.66 14.79 6.52 49 BAYES_60 15055 6.22 6.15 6.25 50 XMStrtUSub 14147 5.82 5.68 5.87 51 XM_UncommonTLD01 13744 5.82 6.16 5.70 52 XMSexyCombo_05 13611 7.28 11.97 5.65 53 XM_B_SpammyTLD 11872 4.70 4.04 4.93 54 RELAYCOUNTRY_META 11267 8.54 19.67 4.67 55 MPART_ALT_DIFF 10800 5.53 8.53 4.48 56 INVALID_MSGID 10754 3.34 0.11 4.46 57 UNPARSEABLE_RELAY 10482 3.55 1.24 4.35 58 TR_XM_DK_SendGrid 10289 3.77 2.34 4.27 59 XMSubMetaSx_00 10180 5.74 10.10 4.22 60 RCVD_IN_MSPIKE_WL 9803 3.24 0.87 4.07 61 RCVD_IN_MSPIKE_H3 9803 3.24 0.87 4.07 62 BAYES_80 9611 4.90 7.52 3.99 63 MIME_QP_LONG_LINE 9566 4.00 4.08 3.97 64 TVD_RCVD_IP 9133 2.99 0.69 3.79 65 FROM_EXCESS_BASE64 9106 4.25 5.62 3.78 66 HTML_IMAGE_RATIO_06 9079 4.14 5.23 3.77 67 IN_ZIMBRA_NJ_WHITELIST 8744 2.69 0.00 3.63 68 XM_DIRTYINTL 8589 4.28 6.35 3.56 69 RCVD_IN_IADB_LISTED 8579 3.16 2.02 3.56 70 BAYES_40 8555 3.19 2.14 3.55 71 CK_HELO_DYNAMIC_SPLIT_IP 8409 2.71 0.47 3.49 72 HELO_DYNAMIC_IPADDR2 8408 2.67 0.31 3.49 73 MIME_HTML_MOSTLY 8222 4.02 5.78 3.41 74 DKIM_INVALID 8213 3.88 5.23 3.41 75 RCVD_IN_IADB_SPF 7549 2.78 1.78 3.13 76 XMNumbers 7503 3.32 3.94 3.11 77 T_REMOTE_IMAGE 7207 2.80 2.27 2.99 78 RCVD_IN_IADB_SENDERID 6648 2.48 1.68 2.76 79 RCVD_IN_IADB_DK 6531 2.44 1.67 2.71 80 T_TooManySym_02 6436 2.32 1.30 2.67 81 BAYES_95 6359 3.13 4.56 2.64 82 BAYES_20 6347 2.32 1.42 2.63 83 XM_PDF 6267 2.02 0.34 2.60 84 MAILING_LIST_MULTI 6185 2.22 1.23 2.57 85 BOTNET 5895 5.79 15.44 2.45 86 TR_MetaPhish_Combo_01 5776 1.92 0.53 2.40 87 T_XMDrugObfuBody_08 5701 2.48 2.80 2.37 88 HTML_IMAGE_RATIO_08 5603 2.73 3.88 2.32 89 RCVD_IN_IADB_VOUCHED 5346 1.88 0.92 2.22 90 XM_CamelCaseFrm001 5191 2.41 3.16 2.15 91 HTML_MIME_NO_HTML_TAG 5184 2.31 2.79 2.15 92 XM_OfRef6 4835 1.98 1.92 2.01 93 MIME_HTML_ONLY_MULTI 4741 2.59 4.38 1.97 94 USER_IN_DEF_DKIM_WL 4605 1.42 0.01 1.91 95 XMBdyGiftCard01 4572 2.82 5.47 1.90 96 US_DOLLARS_3 4551 2.08 2.64 1.89 97 URI_HEX 4528 2.47 4.16 1.88 98 URI_TRY_3LD 4523 1.73 1.32 1.88 99 IN_HORDE_ADDRESS_BOOK 4458 1.38 0.05 1.85 100 XMStockSpam_06 4367 1.78 1.69 1.81 101 BAYES_05 4138 1.44 0.65 1.72 102 TM2_M_URI_OPT_OUT 3876 2.11 3.57 1.61 103 TR_Symld_Words 3766 1.68 2.01 1.56 104 SUBJ_ALL_CAPS 3711 1.94 3.09 1.54 105 XM_DK_Undo_01 3573 1.33 0.88 1.48 106 UNTRUSTED_Relay 3419 4.15 12.01 1.42 107 RCVD_IN_IADB_OPTIN 3396 1.19 0.56 1.41 108 RELAYCOUNTRY_CA 3392 2.37 5.13 1.41 109 ANY_BOUNCE_MESSAGE 3380 1.10 0.23 1.40 110 BOUNCE_MESSAGE 3369 1.09 0.22 1.40 111 TM2_M_VERY_LONG_WORD 3360 1.52 1.89 1.39 112 TooManyTo_002 3235 1.26 1.03 1.34 113 NO_DNS_FOR_FROM 3110 1.81 3.30 1.29 114 T_FILL_THIS_FORM_SHORT 3084 1.17 0.86 1.28 115 XMSubMetaI_00 3075 1.59 2.51 1.28 116 XM_ProductURIs 3003 1.23 1.20 1.25 117 XMPhish11 2995 1.27 1.36 1.24 118 XM_GoogleGroups 2982 1.05 0.52 1.24 119 FILL_THIS_FORM 2895 1.03 0.55 1.20 120 XMDiploma_00 2873 1.58 2.69 1.19 121 FILL_THIS_FORM_LONG 2679 0.93 0.40 1.11 122 FILL_THIS_FORM_LOAN 2642 0.91 0.36 1.10 123 T_XMDrugObfuBody_00 2570 1.18 1.52 1.07 124 XM_H_Long_From02 2502 1.17 1.54 1.04 125 KHOP_HELO_FCRDNS 2488 1.35 2.27 1.03 126 XMBody_95 2453 0.77 0.07 1.02 127 XMBody_17 2302 1.21 1.95 0.96 128 XM_SPF_SoftFail 2258 1.52 3.20 0.94 129 TooManyTo_003 2256 0.92 0.86 0.94 130 DKIM_ADSP_CUSTOM_MED 2238 0.92 0.89 0.93 131 TR_XM_RelayPhish 2198 1.06 1.49 0.91 132 USER_IN_WHITELIST 2167 0.67 0.00 0.90 133 XMSubMetaSxObfu_02 2166 0.81 0.55 0.90 134 T_TooManySym_03 2081 0.70 0.21 0.86 135 XMNoVowels 2072 0.76 0.47 0.86 136 XM_UB50 2017 2.06 5.58 0.84 137 XM_B_REG_HTML 1881 0.94 1.41 0.78 138 XMBSHREFv2 1871 0.70 0.49 0.78 139 TooManyTo_004 1845 0.74 0.66 0.77 140 HTML_FONT_FACE_BAD 1812 0.77 0.83 0.75 141 XMHTMLBadTable_001 1764 0.78 0.91 0.73 142 XMGenDplmaNmb 1667 0.97 1.77 0.69 143 RELAYCOUNTRY_NL 1650 0.67 0.64 0.68 144 RCVD_IN_MSPIKE_BL 1647 0.86 1.35 0.68 145 RCVD_IN_MSPIKE_L5 1646 0.83 1.25 0.68 146 TooManyTo_005 1633 0.64 0.55 0.68 147 XMBrknScrpt_02 1590 0.77 1.09 0.66 148 XM_H_PHPMailer 1559 0.95 1.84 0.65 149 NML_ADSP_CUSTOM_MED 1546 0.66 0.73 0.64 150 XMSexyCombo_01 1493 1.40 3.66 0.62 151 HELO_NODOT 1489 0.63 0.66 0.62 152 RCVD_IN_BL_SPAMCOP_NET 1469 1.41 3.72 0.61 153 HTML_TAG_BALANCE_BODY 1433 0.75 1.18 0.59 154 XMBody_78 1410 0.72 1.11 0.59 155 PLING_QUERY 1402 0.63 0.79 0.58 156 XMPhish30 1398 0.85 1.61 0.58 157 HELO_NO_DOMAIN 1395 0.60 0.66 0.58 158 TR_XM_PHPDW 1386 1.24 3.16 0.58 159 XM_B_COPY_HTML 1369 0.65 0.89 0.57 160 DKIM_ADSP_NXDOMAIN 1366 1.11 2.69 0.57 161 T_XMHurry_00 1356 0.72 1.18 0.56 162 XMSolicitRefs_0 1341 0.49 0.28 0.56 163 TR_XM_PHPForged 1319 1.21 3.11 0.55 164 NUMERIC_HTTP_ADDR 1317 0.63 0.88 0.55 165 RDNS_DYNAMIC 1312 0.67 1.02 0.54 166 TR_XM_FormFill2 1288 1.19 3.08 0.53 167 XM_H_PHPOS 1286 1.19 3.07 0.53 168 XMLngstWrd_00 1251 0.52 0.52 0.52 169 T_Symld_Words_02 1224 0.51 0.51 0.51 170 RELAYCOUNTRY_GB 1206 0.60 0.88 0.50 171 TM2_M_A_HREF_HREF 1200 0.66 1.11 0.50 172 FORGED_GMAIL_RCVD 1146 0.53 0.70 0.48 173 XMLngstWrd_01 1133 0.47 0.48 0.47 174 T_TooManySym_04 1129 0.36 0.03 0.47 175 XMCapTrack 1124 0.40 0.22 0.47 176 HTTPS_HTTP_MISMATCH 1071 0.41 0.30 0.44 177 DIET_1 1050 0.70 1.47 0.44 178 XM_Akamai 972 0.30 0.01 0.40 179 XMLKML 962 0.30 0.00 0.40 180 XMSlimDrugH 961 0.78 1.88 0.40 181 XM_D_tchamptons_WL 946 0.29 0.00 0.39 182 XM_URI_RBL 944 1.01 2.80 0.39 183 XM_Body_Obfu01 929 0.41 0.50 0.39 184 MPART_ALT_DIFF_COUNT 891 0.42 0.58 0.37 185 SpammyFromTLD_01 888 0.68 1.58 0.37 186 XMGappySubj_01 885 0.45 0.68 0.37 187 FSL_THIS_IS_ADV 867 0.38 0.42 0.36 188 LOW_PRICE 856 0.66 1.54 0.36 189 RELAYCOUNTRY_DE 851 0.46 0.75 0.35 190 SUBJ_DOLLARS 850 0.66 1.56 0.35 191 MISSING_HEADERS 844 0.41 0.57 0.35 192 XMRcvdHeader_15 833 0.26 0.00 0.35 193 URI_NOVOWEL 828 0.44 0.71 0.34 194 XM_Walgreens_Forge 823 0.35 0.39 0.34 195 RELAYCOUNTRY_AU 815 0.34 0.35 0.34 196 XMHTML_After_End 784 0.55 1.20 0.33 197 XM_ShortIntro_01 783 0.36 0.47 0.32 198 XMLngstWrd_02 775 0.35 0.42 0.32 199 XM_RXBody 768 0.41 0.66 0.32 200 XMSubMetaSxObfu_03 768 0.73 1.92 0.32 ----------------------------------------------------------------------