Email: 680266 Autolearn: 0 AvgScore: 4.08 AvgScanTime: 4.54 sec Spam: 234205 Autolearn: 0 AvgScore: 12.44 AvgScanTime: 5.27 sec Ham: 446061 Autolearn: 0 AvgScore: -0.31 AvgScanTime: 4.16 sec Time Spent Running SA: 857.90 hours Time Spent Processing Spam: 343.07 hours Time Spent Processing Ham: 514.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 218993 89.51 93.50 87.41 2 DKIM_SIGNED 184867 75.14 78.93 73.15 3 XM_DK_Pass 180547 73.54 77.09 71.68 4 DCC_CHECK 175520 48.41 74.94 34.48 5 DKIM_VALID 169957 69.25 72.57 67.51 6 XMListUnsubscribeExists 157209 55.71 67.12 49.72 7 DKIM_VALID_AU 135173 50.35 57.72 46.49 8 XM_H_QuotedFrom 119840 40.49 51.17 34.88 9 XM_DK_Undo_02 106940 25.26 45.66 14.55 10 BAYES_99 95180 22.92 40.64 13.61 11 BAYES_50 88105 49.61 37.62 55.90 12 BAYES_999 80621 19.48 34.42 11.64 13 HTML_FONT_LOW_CONTRAST 80526 30.34 34.38 28.22 14 LOC_TINY_FONT_1 80224 25.80 34.25 21.35 15 TR_DCC_Bayes_99 75378 15.71 32.18 7.06 16 MIME_HTML_ONLY 69103 22.13 29.51 18.26 17 FVGT_m_MULTI_ODD 62035 23.96 26.49 22.63 18 DCC_CHECK_NEGATIVE 55606 49.70 23.74 63.33 19 XMSubLong 55375 21.95 23.64 21.06 20 DKIM_VALID_EF 51543 24.98 22.01 26.54 21 T_KAM_HTML_FONT_INVALID 46758 17.49 19.96 16.20 22 T_TM2_M_HEADER_IN_MSG 44236 26.30 18.89 30.19 23 BOTNET 42882 7.45 18.31 1.74 24 XM_Body_Dirty_Words 40936 12.98 17.48 10.62 25 XM_Multi_Part_URI 36659 12.41 15.65 10.71 26 HTML_IMAGE_RATIO_02 35552 10.17 15.18 7.54 27 MultiRelay 34657 16.85 14.80 17.93 28 BOTNET_IPINHOSTNAME 32308 8.37 13.79 5.52 29 FSL_BULK_SIG 31449 7.32 13.43 4.11 30 XM_Evil_Numbers_Gen 29292 9.63 12.51 8.11 31 RELAYCOUNTRY_META 29271 7.65 12.50 5.10 32 LOTS_OF_MONEY 25442 10.13 10.86 9.74 33 T_XMDrugObfuBody_14 21491 8.26 9.18 7.78 34 XMSexyCombo_05 20945 5.10 8.94 3.08 35 XM_UncommonTLD01 20225 4.20 8.64 1.88 36 XM_B_Phish_Phrases 19889 5.82 8.49 4.41 37 HTML_IMAGE_RATIO_04 19534 6.48 8.34 5.50 38 XM_H_Long_From01 18423 6.13 7.87 5.21 39 TR_XM_DocInvoice 18250 4.96 7.79 3.47 40 XMSubMetaSx_00 17097 5.65 7.30 4.78 41 BAYES_80 16266 5.51 6.95 4.75 42 TooManyTo_001 16164 7.37 6.90 7.61 43 MPART_ALT_DIFF 16114 4.29 6.88 2.93 44 UNTRUSTED_Relay 15837 3.17 6.76 1.28 45 RCVD_IN_RP_RNBL 15015 2.29 6.41 0.12 46 DKIM_INVALID 14910 5.89 6.37 5.63 47 BOUNCE_MESSAGE 14723 6.16 6.29 6.10 48 ANY_BOUNCE_MESSAGE 14723 6.16 6.29 6.10 49 BAYES_60 13949 7.08 5.96 7.68 50 FROM_EXCESS_BASE64 13794 4.45 5.89 3.70 51 LotsOfNums_01 13278 8.66 5.67 10.23 52 RCVD_IN_PSBL 12300 1.84 5.25 0.05 53 ALL_TRUSTED 12153 13.49 5.19 17.84 54 HTML_FONT_SIZE_HUGE 12128 2.06 5.18 0.43 55 RCVD_IN_RP_SAFE 11935 7.19 5.10 8.29 56 XMNumbers 11443 3.75 4.89 3.16 57 T_REMOTE_IMAGE 11139 4.64 4.76 4.58 58 XM_SendGrid 11063 4.75 4.72 4.76 59 HTML_IMAGE_RATIO_06 10812 3.90 4.62 3.52 60 MIME_HTML_MOSTLY 10618 3.03 4.53 2.24 61 TM2_M_URI_OPT_OUT 10092 2.81 4.31 2.03 62 BAYES_95 9992 3.63 4.27 3.30 63 HTML_MIME_NO_HTML_TAG 9710 3.04 4.15 2.46 64 RCVD_IN_RP_CERTIFIED 9686 6.62 4.14 7.92 65 XMStrtUSub 9519 3.73 4.06 3.55 66 HTML_IMAGE_RATIO_08 8906 2.64 3.80 2.03 67 MIME_HTML_ONLY_MULTI 8482 2.25 3.62 1.53 68 XM_DIRTYINTL 8172 2.31 3.49 1.68 69 XM_UB50 7869 1.68 3.36 0.80 70 HTML_SHORT_LINK_IMG_1 7523 1.13 3.21 0.04 71 SpammyFromTLD_02 7507 1.28 3.21 0.27 72 HTML_IMAGE_ONLY_04 7342 1.10 3.13 0.04 73 XM_SPF_SoftFail 7273 2.30 3.11 1.88 74 RCVD_IN_MSPIKE_H2 7234 4.39 3.09 5.08 75 SHORTENED_URL_SRC 7040 1.04 3.01 0.00 76 SHORTENER_SHORT_IMG 7015 1.03 3.00 0.00 77 URI_BUFFLY 7011 1.03 2.99 0.00 78 RELAYCOUNTRY_CA 6943 1.98 2.96 1.46 79 XM_CamelCaseFrm001 6808 2.06 2.91 1.62 80 INVALID_MSGID 6782 1.09 2.90 0.14 81 HTML_SHORT_CENTER 6629 0.98 2.83 0.00 82 TO_MALFORMED 6361 0.96 2.72 0.04 83 MIME_QP_LONG_LINE 6264 5.13 2.67 6.41 84 XM_OfRef6 6073 1.81 2.59 1.40 85 XM_URI_RBL 6048 0.99 2.58 0.15 86 BODY_URI_ONLY 6005 0.94 2.56 0.08 87 URI_HEX 5737 2.02 2.45 1.79 88 XMBdyGiftCard01 5696 1.30 2.43 0.71 89 T_TooManySym_01 5404 3.51 2.31 4.15 90 SUBJ_ALL_CAPS 5311 1.95 2.27 1.78 91 RCVD_IN_BL_SPAMCOP_NET 5266 1.01 2.25 0.36 92 T_XMDrugObfuBody_08 5243 1.73 2.24 1.46 93 MISSING_HEADERS 5205 1.10 2.22 0.51 94 MultiRelay_CC 4903 0.87 2.09 0.23 95 MultiRelay_Combo 4903 0.87 2.09 0.23 96 MIME_HEADER_CTYPE_ONLY 4820 0.80 2.06 0.14 97 XMDiploma_00 4800 1.92 2.05 1.86 98 URI_TRY_3LD 4708 1.69 2.01 1.51 99 XM_H_Long_From02 4510 1.34 1.93 1.04 100 XM_ProductURIs 4340 1.37 1.85 1.12 101 XMSexyCombo_01 4204 1.15 1.80 0.81 102 T_XMDrugObfuBody_00 4150 1.26 1.77 0.99 103 XMGppyBdWords 3914 0.67 1.67 0.15 104 NO_DNS_FOR_FROM 3903 1.31 1.67 1.13 105 BOTNET_NORDNS 3781 0.57 1.61 0.02 106 TM2_M_VERY_LONG_WORD 3694 1.11 1.58 0.87 107 T_XMHurry_00 3676 1.00 1.57 0.70 108 XMSubMetaI_00 3593 0.85 1.53 0.50 109 TR_XM_RelayPhish 3538 0.84 1.51 0.48 110 UNPARSEABLE_RELAY 3433 3.47 1.47 4.52 111 DIET_1 3394 0.73 1.45 0.36 112 XMSubMetaSxObfu_03 3336 0.80 1.42 0.47 113 T_Symld_Words_02 3317 0.88 1.42 0.60 114 BAYES_00 3258 5.21 1.39 7.22 115 XMGenDplmaNmb 3240 1.17 1.38 1.06 116 BAYES_40 3158 2.70 1.35 3.41 117 MAILING_LIST_MULTI 3117 2.06 1.33 2.44 118 URIBL_BLACK 3110 0.48 1.33 0.04 119 RCVD_IN_IADB_LISTED 3045 5.14 1.30 7.16 120 SpammyFromTLD_01 3004 0.94 1.28 0.77 121 XMBody_17 2981 0.72 1.27 0.43 122 XMStockSpam_06 2935 1.24 1.25 1.23 123 XMHTML_After_End 2839 0.67 1.21 0.38 124 XMPhish11 2823 1.24 1.21 1.26 125 XM_HighProb1 2813 0.44 1.20 0.04 126 XMPhish30 2758 0.59 1.18 0.28 127 SUBJ_DOLLARS 2747 0.56 1.17 0.24 128 BAYES_20 2688 2.04 1.15 2.50 129 TR_Caps_n_Bayes_99 2665 0.46 1.14 0.10 130 XM_DK_Undo_01 2656 1.71 1.13 2.01 131 XMBody_78 2609 0.64 1.11 0.39 132 TR_XM_DK_Bayes 2579 3.57 1.10 4.87 133 RCVD_IN_IADB_SPF 2578 4.52 1.10 6.32 134 TR_LOTS_OF_MONEY2 2517 0.81 1.07 0.68 135 T_MONEY_PERCENT 2517 0.81 1.07 0.68 136 XMPhish14 2506 0.71 1.07 0.52 137 RELAYCOUNTRY_GB 2472 1.06 1.06 1.06 138 TR_Symld_Words 2464 1.46 1.05 1.67 139 RCVD_IN_IADB_SENDERID 2452 4.00 1.05 5.55 140 URI_NOVOWEL 2445 0.65 1.04 0.44 141 XMHTMLBadTable_001 2409 0.64 1.03 0.44 142 RCVD_IN_IADB_DK 2400 3.96 1.02 5.50 143 RELAYCOUNTRY_CN 2368 0.38 1.01 0.05 144 XM_UB99 2351 0.38 1.00 0.05 145 HTML_FONT_FACE_BAD 2300 0.62 0.98 0.43 146 PLING_QUERY 2295 0.68 0.98 0.53 147 TR_XM_DK_Bayes1 2276 3.24 0.97 4.43 148 RELAYCOUNTRY_AT 2149 0.42 0.92 0.15 149 XMSlimDrugH 2118 0.61 0.90 0.45 150 XM_UB60 2110 0.36 0.90 0.08 151 TooManyTo_002 2099 1.80 0.90 2.28 152 TR_XM_DK_Bayes2 2075 2.64 0.89 3.55 153 XMSexyCombo_04 2061 0.65 0.88 0.53 154 XM_H_PHPOS 2028 1.05 0.87 1.15 155 RCVD_IN_IADB_VOUCHED 1936 3.25 0.83 4.52 156 HTTPS_HTTP_MISMATCH 1921 0.62 0.82 0.52 157 XM_PDF 1901 3.46 0.81 4.85 158 RELAYCOUNTRY_FR 1890 0.42 0.81 0.22 159 TooManyTo_003 1881 1.27 0.80 1.52 160 XM_RXBody 1875 0.51 0.80 0.35 161 T_TooManySym_02 1873 1.36 0.80 1.65 162 XMBrknScrpt_02 1835 0.60 0.78 0.51 163 FILL_THIS_FORM 1801 0.52 0.77 0.39 164 HTML_TAG_BALANCE_BODY 1777 0.62 0.76 0.55 165 DKIM_ADSP_NXDOMAIN 1776 0.51 0.76 0.38 166 XMMoneyMeta_00 1772 0.58 0.76 0.48 167 T_FILL_THIS_FORM_SHORT 1747 0.87 0.75 0.93 168 TM2_M_A_HREF_HREF 1744 0.66 0.74 0.61 169 REMOVE_BEFORE_LINK 1742 0.45 0.74 0.29 170 TR_MetaPhish_Combo_01 1725 0.67 0.74 0.64 171 XM_Combo_Sbj 1719 0.41 0.73 0.25 172 TR_LOTS_OF_MONEY3 1703 0.42 0.73 0.25 173 XM_B_COPY_HTML 1700 0.51 0.73 0.39 174 URIBL_DBL_SPAM 1671 0.26 0.71 0.03 175 XM_UB999 1661 0.27 0.71 0.04 176 DATE_IN_PAST_03_06 1656 0.31 0.71 0.10 177 HTML_FONT_SIZE_LARGE 1633 0.38 0.70 0.22 178 LOW_PRICE 1589 0.54 0.68 0.47 179 BODY_ENHANCEMENT 1552 0.24 0.66 0.01 180 T_FILL_THIS_FORM_LONG 1548 0.42 0.66 0.29 181 XM_B_REG_HTML 1540 0.53 0.66 0.47 182 MPART_ALT_DIFF_COUNT 1537 0.43 0.66 0.31 183 BAYES_05 1520 1.24 0.65 1.54 184 DKIM_ADSP_CUSTOM_MED 1495 0.94 0.64 1.09 185 TooManyTo_004 1492 0.98 0.64 1.16 186 RELAYCOUNTRY_DE 1468 0.57 0.63 0.54 187 XMCapTrack 1463 1.09 0.62 1.34 188 RELAYCOUNTRY_AU 1462 0.54 0.62 0.50 189 XMClaimOffer 1431 0.28 0.61 0.11 190 XMSubMetaD_03 1430 0.24 0.61 0.04 191 XM_UB80 1430 0.26 0.61 0.07 192 XM_H_PHPMailer 1387 0.61 0.59 0.62 193 XMSubMetaSSx_00 1364 0.37 0.58 0.26 194 RDNS_DYNAMIC 1361 0.49 0.58 0.45 195 XM_GoogleGroups 1360 1.14 0.58 1.44 196 TooManyTo_005 1359 0.84 0.58 0.98 197 FILL_THIS_FORM_LOAN 1359 0.37 0.58 0.26 198 XMNoVowels 1351 0.65 0.58 0.69 199 NML_ADSP_CUSTOM_MED 1347 0.68 0.58 0.74 200 RCVD_IN_IADB_OPTIN 1305 2.03 0.56 2.81 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 389917 89.51 93.50 87.41 2 DKIM_SIGNED 326278 75.14 78.93 73.15 3 XM_DK_Pass 319735 73.54 77.09 71.68 4 DKIM_VALID 301149 69.25 72.57 67.51 5 DCC_CHECK_NEGATIVE 282497 49.70 23.74 63.33 6 BAYES_50 249344 49.61 37.62 55.90 7 XMListUnsubscribeExists 221763 55.71 67.12 49.72 8 DKIM_VALID_AU 207353 50.35 57.72 46.49 9 XM_H_QuotedFrom 155595 40.49 51.17 34.88 10 DCC_CHECK 153783 48.41 74.94 34.48 11 T_TM2_M_HEADER_IN_MSG 134665 26.30 18.89 30.19 12 HTML_FONT_LOW_CONTRAST 125890 30.34 34.38 28.22 13 DKIM_VALID_EF 118405 24.98 22.01 26.54 14 FVGT_m_MULTI_ODD 100956 23.96 26.49 22.63 15 LOC_TINY_FONT_1 95256 25.80 34.25 21.35 16 XMSubLong 93955 21.95 23.64 21.06 17 MIME_HTML_ONLY 81440 22.13 29.51 18.26 18 MultiRelay 79963 16.85 14.80 17.93 19 ALL_TRUSTED 79590 13.49 5.19 17.84 20 T_KAM_HTML_FONT_INVALID 72242 17.49 19.96 16.20 21 XM_DKIMWhitelistDomains 69515 10.30 0.23 15.58 22 XM_DK_Undo_02 64906 25.26 45.66 14.55 23 BAYES_99 60721 22.92 40.64 13.61 24 BAYES_999 51925 19.48 34.42 11.64 25 XM_Multi_Part_URI 47758 12.41 15.65 10.71 26 XM_Body_Dirty_Words 47382 12.98 17.48 10.62 27 LotsOfNums_01 45615 8.66 5.67 10.23 28 LOTS_OF_MONEY 43450 10.13 10.86 9.74 29 RCVD_IN_RP_SAFE 36979 7.19 5.10 8.29 30 XM_Evil_Numbers_Gen 36185 9.63 12.51 8.11 31 RCVD_IN_RP_CERTIFIED 35333 6.62 4.14 7.92 32 T_XMDrugObfuBody_14 34724 8.26 9.18 7.78 33 BAYES_60 34238 7.08 5.96 7.68 34 TooManyTo_001 33948 7.37 6.90 7.61 35 HTML_IMAGE_RATIO_02 33621 10.17 15.18 7.54 36 BAYES_00 32210 5.21 1.39 7.22 37 RCVD_IN_IADB_LISTED 31948 5.14 1.30 7.16 38 TR_DCC_Bayes_99 31477 15.71 32.18 7.06 39 MIME_QP_LONG_LINE 28604 5.13 2.67 6.41 40 RCVD_IN_IADB_SPF 28177 4.52 1.10 6.32 41 ANY_BOUNCE_MESSAGE 27214 6.16 6.29 6.10 42 BOUNCE_MESSAGE 27213 6.16 6.29 6.10 43 DKIM_INVALID 25129 5.89 6.37 5.63 44 RCVD_IN_IADB_SENDERID 24741 4.00 1.05 5.55 45 BOTNET_IPINHOSTNAME 24616 8.37 13.79 5.52 46 HTML_IMAGE_RATIO_04 24552 6.48 8.34 5.50 47 RCVD_IN_IADB_DK 24531 3.96 1.02 5.50 48 XM_H_Long_From01 23250 6.13 7.87 5.21 49 RELAYCOUNTRY_META 22741 7.65 12.50 5.10 50 RCVD_IN_MSPIKE_H2 22658 4.39 3.09 5.08 51 TR_XM_DK_Bayes 21733 3.57 1.10 4.87 52 XM_PDF 21652 3.46 0.81 4.85 53 XMSubMetaSx_00 21305 5.65 7.30 4.78 54 XM_SendGrid 21249 4.75 4.72 4.76 55 BAYES_80 21187 5.51 6.95 4.75 56 T_REMOTE_IMAGE 20415 4.64 4.76 4.58 57 RCVD_IN_IADB_VOUCHED 20177 3.25 0.83 4.52 58 UNPARSEABLE_RELAY 20141 3.47 1.47 4.52 59 TR_XM_DK_Bayes1 19766 3.24 0.97 4.43 60 XM_B_Phish_Phrases 19688 5.82 8.49 4.41 61 T_TooManySym_01 18492 3.51 2.31 4.15 62 FSL_BULK_SIG 18316 7.32 13.43 4.11 63 IN_ZIMBRA_NJ_WHITELIST 17951 2.65 0.02 4.02 64 TVD_RCVD_IP 17487 2.65 0.22 3.92 65 FROM_EXCESS_BASE64 16483 4.45 5.89 3.70 66 TR_XM_DK_Bayes2 15852 2.64 0.89 3.55 67 XMStrtUSub 15833 3.73 4.06 3.55 68 HTML_IMAGE_RATIO_06 15698 3.90 4.62 3.52 69 TR_XM_DocInvoice 15490 4.96 7.79 3.47 70 BAYES_40 15204 2.70 1.35 3.41 71 BAYES_95 14727 3.63 4.27 3.30 72 XMNumbers 14079 3.75 4.89 3.16 73 XMSexyCombo_05 13756 5.10 8.94 3.08 74 MPART_ALT_DIFF 13091 4.29 6.88 2.93 75 RCVD_IN_IADB_OPTIN 12523 2.03 0.56 2.81 76 BAYES_20 11171 2.04 1.15 2.50 77 HTML_MIME_NO_HTML_TAG 10976 3.04 4.15 2.46 78 MAILING_LIST_MULTI 10901 2.06 1.33 2.44 79 TooManyTo_002 10152 1.80 0.90 2.28 80 MIME_HTML_MOSTLY 10013 3.03 4.53 2.24 81 RCVD_IN_MSPIKE_WL 9958 1.65 0.53 2.23 82 RCVD_IN_MSPIKE_H3 9952 1.64 0.52 2.23 83 HTML_IMAGE_RATIO_08 9066 2.64 3.80 2.03 84 TM2_M_URI_OPT_OUT 9041 2.81 4.31 2.03 85 XM_DK_Undo_01 8951 1.71 1.13 2.01 86 HELO_NODOT 8415 1.30 0.19 1.89 87 XM_SPF_SoftFail 8382 2.30 3.11 1.88 88 XM_UncommonTLD01 8379 4.20 8.64 1.88 89 XMDiploma_00 8283 1.92 2.05 1.86 90 IN_HORDE_ADDRESS_BOOK 8174 1.23 0.08 1.83 91 URI_HEX 7971 2.02 2.45 1.79 92 SUBJ_ALL_CAPS 7958 1.95 2.27 1.78 93 BOTNET 7768 7.45 18.31 1.74 94 XM_DIRTYINTL 7514 2.31 3.49 1.68 95 TR_Symld_Words 7457 1.46 1.05 1.67 96 T_TooManySym_02 7364 1.36 0.80 1.65 97 XM_CamelCaseFrm001 7209 2.06 2.91 1.62 98 BAYES_05 6884 1.24 0.65 1.54 99 MIME_HTML_ONLY_MULTI 6832 2.25 3.62 1.53 100 USER_IN_DEF_DKIM_WL 6778 1.03 0.09 1.52 101 TooManyTo_003 6774 1.27 0.80 1.52 102 URI_TRY_3LD 6756 1.69 2.01 1.51 103 T_XMDrugObfuBody_08 6517 1.73 2.24 1.46 104 RELAYCOUNTRY_CA 6508 1.98 2.96 1.46 105 XM_GoogleGroups 6403 1.14 0.58 1.44 106 XM_OfRef6 6234 1.81 2.59 1.40 107 XMCapTrack 5983 1.09 0.62 1.34 108 UNTRUSTED_Relay 5722 3.17 6.76 1.28 109 XMPhish11 5606 1.24 1.21 1.26 110 XMStockSpam_06 5496 1.24 1.25 1.23 111 TooManyTo_004 5160 0.98 0.64 1.16 112 XMLngstWrd_00 5148 0.84 0.25 1.15 113 XM_H_PHPOS 5145 1.05 0.87 1.15 114 NO_DNS_FOR_FROM 5022 1.31 1.67 1.13 115 XM_ProductURIs 4989 1.37 1.85 1.12 116 DKIM_ADSP_CUSTOM_MED 4878 0.94 0.64 1.09 117 RELAYCOUNTRY_GB 4727 1.06 1.06 1.06 118 XMGenDplmaNmb 4708 1.17 1.38 1.06 119 XM_H_Long_From02 4632 1.34 1.93 1.04 120 XMLngstWrd_01 4604 0.76 0.23 1.03 121 URI_WP_HACKED_2 4535 0.82 0.44 1.02 122 T_XMDrugObfuBody_00 4401 1.26 1.77 0.99 123 TooManyTo_005 4350 0.84 0.58 0.98 124 T_FILL_THIS_FORM_SHORT 4145 0.87 0.75 0.93 125 TM2_M_VERY_LONG_WORD 3876 1.11 1.58 0.87 126 XMSexyCombo_01 3608 1.15 1.80 0.81 127 XM_UB50 3577 1.68 3.36 0.80 128 SpammyFromTLD_01 3413 0.94 1.28 0.77 129 NML_ADSP_CUSTOM_MED 3309 0.68 0.58 0.74 130 XMBdyGiftCard01 3180 1.30 2.43 0.71 131 T_XMHurry_00 3104 1.00 1.57 0.70 132 XMNoVowels 3064 0.65 0.58 0.69 133 IMPOTENCE 3058 0.54 0.27 0.69 134 T_MONEY_PERCENT 3023 0.81 1.07 0.68 135 TR_LOTS_OF_MONEY2 3023 0.81 1.07 0.68 136 KHOP_DYNAMIC 2924 0.61 0.52 0.66 137 TR_MetaPhish_Combo_01 2843 0.67 0.74 0.64 138 USER_IN_WHITELIST 2787 0.41 0.00 0.62 139 XM_H_PHPMailer 2749 0.61 0.59 0.62 140 XMLngstWrd_02 2736 0.46 0.18 0.61 141 TM2_M_A_HREF_HREF 2719 0.66 0.74 0.61 142 T_Symld_Words_02 2677 0.88 1.42 0.60 143 FORGED_GMAIL_RCVD 2650 0.57 0.52 0.59 144 T_TooManySym_03 2588 0.41 0.09 0.58 145 XMSubMetaSxObfu_02 2581 0.53 0.43 0.58 146 XMBody_95 2558 0.40 0.08 0.57 147 T_OBFU_PDF_ATTACH 2554 0.44 0.19 0.57 148 HTML_TAG_BALANCE_BODY 2459 0.62 0.76 0.55 149 RELAYCOUNTRY_DE 2413 0.57 0.63 0.54 150 HTML_IMAGE_ONLY_32 2389 0.44 0.27 0.54 151 XMSexyCombo_04 2374 0.65 0.88 0.53 152 PLING_QUERY 2344 0.68 0.98 0.53 153 XMPhish14 2325 0.71 1.07 0.52 154 HTTPS_HTTP_MISMATCH 2315 0.62 0.82 0.52 155 MISSING_HEADERS 2261 1.10 2.22 0.51 156 XMBrknScrpt_02 2258 0.60 0.78 0.51 157 AC_DIV_BONANZA 2258 0.38 0.14 0.51 158 XM_ShortIntro_01 2243 0.45 0.34 0.50 159 RELAYCOUNTRY_AU 2220 0.54 0.62 0.50 160 XMSubMetaI_00 2209 0.85 1.53 0.50 161 TR_XM_RelayPhish 2154 0.84 1.51 0.48 162 XMMoneyMeta_00 2148 0.58 0.76 0.48 163 SHORT_HELO_AND_INLINE_IMAGE 2127 0.33 0.06 0.48 164 XM_USANA_RCVD 2102 0.31 0.00 0.47 165 XMSubMetaSxObfu_03 2076 0.80 1.42 0.47 166 LOW_PRICE 2076 0.54 0.68 0.47 167 XM_B_REG_HTML 2075 0.53 0.66 0.47 168 XMDateMe_00 2020 0.40 0.31 0.45 169 XMSlimDrugH 2018 0.61 0.90 0.45 170 RDNS_DYNAMIC 1986 0.49 0.58 0.45 171 URI_NOVOWEL 1964 0.65 1.04 0.44 172 XMHTMLBadTable_001 1958 0.64 1.03 0.44 173 TM2_M_BODY_EMPTY 1941 0.32 0.11 0.44 174 HTML_FONT_SIZE_HUGE 1912 2.06 5.18 0.43 175 XMBody_17 1905 0.72 1.27 0.43 176 HTML_FONT_FACE_BAD 1900 0.62 0.98 0.43 177 ONLINE_PHARMACY 1807 0.31 0.13 0.41 178 FILL_THIS_FORM 1759 0.52 0.77 0.39 179 XM_B_COPY_HTML 1749 0.51 0.73 0.39 180 XMBody_78 1742 0.64 1.11 0.39 181 XMGappySubj_01 1726 0.37 0.33 0.39 182 DKIM_ADSP_NXDOMAIN 1705 0.51 0.76 0.38 183 XMHTML_After_End 1685 0.67 1.21 0.38 184 XM_D_tchamptons_WL 1663 0.24 0.00 0.37 185 RCVD_IN_SORBS_DUL 1660 0.28 0.11 0.37 186 RCVD_IN_BL_SPAMCOP_NET 1626 1.01 2.25 0.36 187 XMLngstWrd_03 1606 0.28 0.14 0.36 188 DIET_1 1590 0.73 1.45 0.36 189 XM_RXBody 1581 0.51 0.80 0.35 190 HTML_IMAGE_ONLY_28 1579 0.39 0.46 0.35 191 XM_B_TRADE_HTML 1565 0.33 0.28 0.35 192 XMSolicitRefs_0 1471 0.33 0.32 0.33 193 HTML_IMAGE_ONLY_24 1468 0.33 0.32 0.33 194 XM_Body_Obfu01 1460 0.37 0.45 0.33 195 TVD_VISIT_PHARMA 1426 0.25 0.12 0.32 196 TO_NO_BRKTS_HTML_ONLY 1409 0.25 0.11 0.32 197 MPART_ALT_DIFF_COUNT 1399 0.43 0.66 0.31 198 XMSubNoVowel 1381 0.33 0.36 0.31 199 XM_H_PHPOS_M 1357 0.33 0.37 0.30 200 XM_S_JOY_D 1342 0.32 0.37 0.30 ----------------------------------------------------------------------