Email: 400167 Autolearn: 0 AvgScore: 4.78 AvgScanTime: 2.53 sec Spam: 161363 Autolearn: 0 AvgScore: 14.14 AvgScanTime: 3.21 sec Ham: 238804 Autolearn: 0 AvgScore: -1.55 AvgScanTime: 2.08 sec Time Spent Running SA: 281.70 hours Time Spent Processing Spam: 143.95 hours Time Spent Processing Ham: 137.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 BAYES_50 95234 51.60 59.02 46.58 2 DCC_CHECK_NEGATIVE 86092 51.97 53.35 51.04 3 HTML_MESSAGE 85764 72.07 53.15 84.85 4 BOTNET 80173 21.47 49.68 2.40 5 DKIM_SIGNED 79586 67.59 49.32 79.93 6 XM_DK_Pass 77673 66.40 48.14 78.74 7 DCC_CHECK 73903 46.97 45.80 47.76 8 DKIM_VALID 73343 63.15 45.45 75.10 9 RCVD_IN_RP_RNBL 71418 17.87 44.26 0.04 10 XMListUnsubscribeExists 71026 51.35 44.02 56.30 11 RCVD_IN_PSBL 68128 17.03 42.22 0.00 12 BOUNCE_MESSAGE 67919 18.23 42.09 2.11 13 ANY_BOUNCE_MESSAGE 67919 18.23 42.09 2.11 14 T_TM2_M_HEADER_IN_MSG 64539 29.97 40.00 23.19 15 DKIM_VALID_AU 62489 52.06 38.73 61.07 16 LOTS_OF_MONEY 57820 20.16 35.83 9.57 17 XM_OfRef6 51808 13.95 32.11 1.67 18 XM_H_QuotedFrom 51530 36.26 31.93 39.18 19 FILL_THIS_FORM 50492 12.91 31.29 0.49 20 XM_DK_Undo_02 49859 25.77 30.90 22.30 21 XM_OfRef7 49484 12.57 30.67 0.34 22 MONEY_FORM 49281 12.32 30.54 0.01 23 DEAR_FRIEND 47332 11.85 29.33 0.04 24 BAYES_99 45196 23.66 28.01 20.73 25 FORM_FRAUD 42429 10.60 26.29 0.00 26 BAYES_999 38602 20.74 23.92 18.59 27 HTML_FONT_LOW_CONTRAST 37212 29.24 23.06 33.41 28 TR_DCC_Bayes_99 36193 15.63 22.43 11.04 29 LOC_TINY_FONT_1 34563 26.78 21.42 30.39 30 DATE_IN_PAST_12_24 32645 8.34 20.23 0.30 31 FVGT_m_MULTI_ODD 30032 20.32 18.61 21.47 32 MIME_HTML_ONLY 28898 21.20 17.91 23.43 33 XM_Multi_Part_URI 24941 15.92 15.46 16.24 34 XMSubLong 24688 21.77 15.30 26.15 35 DATE_IN_PAST_06_12 23190 5.84 14.37 0.08 36 XM_Body_Dirty_Words 20683 14.15 12.82 15.05 37 RELAYCOUNTRY_META 19308 7.43 11.97 4.37 38 HTML_IMAGE_RATIO_02 19294 11.22 11.96 10.72 39 DKIM_VALID_EF 17785 22.06 11.02 29.51 40 T_KAM_HTML_FONT_INVALID 16982 12.53 10.52 13.89 41 T_XMDrugObfuBody_01 13986 3.55 8.67 0.09 42 MultiRelay 13824 11.91 8.57 14.17 43 XM_Evil_Numbers_Gen 12563 9.57 7.79 10.77 44 BOTNET_IPINHOSTNAME 12167 7.28 7.54 7.11 45 UNTRUSTED_Relay 11849 3.77 7.34 1.35 46 FSL_BULK_SIG 11631 8.35 7.21 9.12 47 XMSexyCombo_05 10565 6.35 6.55 6.22 48 HTML_IMAGE_RATIO_04 8668 7.65 5.37 9.19 49 T_XMDrugObfuBody_14 8175 6.28 5.07 7.10 50 MPART_ALT_DIFF 8101 4.14 5.02 3.55 51 FROM_EXCESS_BASE64 8077 5.33 5.01 5.55 52 XM_H_Long_From01 7926 5.81 4.91 6.41 53 DATE_IN_PAST_03_06 7743 2.01 4.80 0.13 54 XMSubMetaSx_00 7728 5.13 4.79 5.37 55 TooManyTo_001 7182 5.44 4.45 6.10 56 XM_B_Phish_Phrases 7016 6.54 4.35 8.02 57 XM_UB50 6754 2.12 4.19 0.72 58 LotsOfNums_01 6588 6.43 4.08 8.02 59 DKIM_INVALID 6243 4.44 3.87 4.83 60 BAYES_80 6086 3.97 3.77 4.11 61 RCVD_IN_RP_SAFE 5710 11.33 3.54 16.59 62 MIME_HTML_MOSTLY 5664 3.22 3.51 3.03 63 BAYES_60 5591 5.03 3.46 6.09 64 XMStrtUSub 5510 4.46 3.41 5.16 65 HTML_IMAGE_RATIO_06 5509 3.35 3.41 3.31 66 DATE_IN_PAST_24_48 5346 1.35 3.31 0.02 67 XM_UncommonTLD01 5345 3.90 3.31 4.30 68 XM_URI_RBL 5031 1.75 3.12 0.82 69 XM_DIRTYINTL 4792 2.27 2.97 1.79 70 RCVD_IN_RP_CERTIFIED 4539 10.09 2.81 15.01 71 XMBdyGiftCard01 4501 2.15 2.79 1.72 72 RELAYCOUNTRY_CA 4277 1.97 2.65 1.51 73 BAYES_95 4022 2.93 2.49 3.23 74 XMPhish11 3953 1.73 2.45 1.24 75 FILL_THIS_FORM_LONG 3871 1.22 2.40 0.43 76 FILL_THIS_FORM_LOAN 3768 1.19 2.34 0.42 77 URI_HEX 3712 2.01 2.30 1.82 78 XMDiploma_00 3681 1.75 2.28 1.39 79 XM_SendGrid 3542 4.51 2.20 6.07 80 SUBJ_ALL_CAPS 3516 1.64 2.18 1.27 81 XMNumbers 3359 2.77 2.08 3.23 82 MIME_HTML_ONLY_MULTI 3310 1.85 2.05 1.71 83 TM2_M_URI_OPT_OUT 3067 1.83 1.90 1.78 84 XMLngstWrd_00 3002 1.06 1.86 0.52 85 XMLngstWrd_01 2951 1.02 1.83 0.47 86 XM_CamelCaseFrm001 2884 1.66 1.79 1.58 87 XMLngstWrd_02 2880 0.85 1.78 0.22 88 XMLngstWrd_03 2844 0.80 1.76 0.15 89 XM_SPF_SoftFail 2817 1.80 1.75 1.83 90 MONEY_FRAUD_8 2791 0.70 1.73 0.00 91 XMGenDplmaNmb 2774 1.08 1.72 0.65 92 BOTNET_NORDNS 2754 0.69 1.71 0.01 93 MILLION_HUNDRED 2721 0.68 1.69 0.00 94 HTML_MIME_NO_HTML_TAG 2686 1.82 1.66 1.92 95 HTML_IMAGE_RATIO_08 2671 1.91 1.66 2.09 96 DEAR_BENEFICIARY 2649 0.66 1.64 0.00 97 RELAYCOUNTRY_GR 2635 0.66 1.63 0.00 98 ADVANCE_FEE_5_NEW_FRM_MNY 2631 0.66 1.63 0.00 99 XMBody_17 2615 0.96 1.62 0.52 100 T_FILL_THIS_FORM_FRAUD_PHISH 2605 0.70 1.61 0.07 101 FROM_ADDR_WS 2605 0.65 1.61 0.00 102 TO_MALFORMED 2569 3.72 1.59 5.16 103 MIME_QP_LONG_LINE 2532 3.27 1.57 4.42 104 T_TooManySym_01 2489 5.29 1.54 7.82 105 RCVD_IN_MSPIKE_H2 2416 3.44 1.50 4.76 106 XMSexyCombo_01 2382 1.55 1.48 1.61 107 XM_H_Long_From02 2285 1.06 1.42 0.81 108 XMNoVowels 2158 0.80 1.34 0.44 109 XM_UB60 2062 0.56 1.28 0.08 110 XM_B_REG_HTML 2050 0.90 1.27 0.65 111 NO_DNS_FOR_FROM 2050 1.51 1.27 1.68 112 RCVD_IN_BL_SPAMCOP_NET 2035 0.59 1.26 0.14 113 T_REMOTE_IMAGE 2015 2.46 1.25 3.28 114 T_XMDrugObfuBody_08 2006 1.29 1.24 1.32 115 XMSubMetaI_00 2006 1.01 1.24 0.85 116 XM_salutation2 2001 0.88 1.24 0.64 117 T_XMHurry_00 1970 1.00 1.22 0.85 118 TM2_M_VERY_LONG_WORD 1965 1.03 1.22 0.91 119 MultiRelay_CC 1964 0.56 1.22 0.12 120 MultiRelay_Combo 1964 0.56 1.22 0.12 121 UNPARSEABLE_RELAY 1854 3.24 1.15 4.66 122 T_Symld_Words_02 1833 0.83 1.14 0.62 123 BAYES_40 1698 2.34 1.05 3.21 124 SpammyFromTLD_02 1694 0.56 1.05 0.22 125 RELAYCOUNTRY_DE 1668 0.70 1.03 0.48 126 XM_ProductURIs 1638 1.01 1.02 1.01 127 TR_Symld_Words 1622 1.22 1.01 1.37 128 XM_RXBody 1593 0.79 0.99 0.65 129 DKIM_ADSP_CUSTOM_MED 1544 0.96 0.96 0.96 130 XM_Hitman 1493 0.39 0.93 0.02 131 NML_ADSP_CUSTOM_MED 1488 0.74 0.92 0.62 132 XMStockSpam_06 1472 1.90 0.91 2.56 133 ALL_TRUSTED 1455 9.26 0.90 14.91 134 XMSexyCombo_04 1440 1.00 0.89 1.07 135 SUBJ_DOLLARS 1432 0.64 0.89 0.48 136 DKIM_ADSP_NXDOMAIN 1423 0.73 0.88 0.63 137 BAYES_20 1411 1.78 0.87 2.38 138 XM_H_PHPOS 1392 1.07 0.86 1.21 139 RELAYCOUNTRY_CN 1375 0.38 0.85 0.05 140 XMPhish30 1347 0.80 0.83 0.77 141 TR_Mismatch_TLD_02 1317 0.38 0.82 0.08 142 XM_UB99 1312 0.37 0.81 0.06 143 RCVD_IN_IADB_LISTED 1291 2.85 0.80 4.23 144 XMHTMLBadTable_001 1276 0.85 0.79 0.89 145 RDNS_DYNAMIC 1266 0.63 0.78 0.53 146 TR_XM_RelayPhish 1264 0.66 0.78 0.57 147 PLING_QUERY 1236 0.60 0.77 0.48 148 RELAYCOUNTRY_AT 1212 0.46 0.75 0.27 149 DIET_1 1209 0.61 0.75 0.51 150 URIBL_BLACK 1180 0.34 0.73 0.07 151 URI_TRY_3LD 1177 1.54 0.73 2.09 152 MAILING_LIST_MULTI 1166 1.47 0.72 1.97 153 THIS_AD 1138 0.59 0.71 0.52 154 RELAYCOUNTRY_FR 1127 0.37 0.70 0.15 155 TR_LOTS_OF_MONEY2 1126 0.63 0.70 0.59 156 T_MONEY_PERCENT 1126 0.63 0.70 0.59 157 XMSubGiftCard1 1126 0.31 0.70 0.04 158 RELAYCOUNTRY_GB 1123 0.61 0.70 0.56 159 XM_Walgreens_Forge 1122 0.45 0.70 0.28 160 LONG_JUNK_URI 1117 0.32 0.69 0.06 161 RCVD_IN_IADB_SPF 1101 2.50 0.68 3.72 162 SpammyFromTLD_01 1100 0.52 0.68 0.41 163 XMSubMetaSxObfu_03 1027 1.05 0.64 1.33 164 RCVD_IN_IADB_SENDERID 1003 2.24 0.62 3.34 165 RCVD_IN_IADB_DK 993 2.19 0.62 3.26 166 XMBody_78 990 0.50 0.61 0.42 167 TVD_SPACE_RATIO_MINFP 985 0.25 0.61 0.01 168 XM_UB999 967 0.27 0.60 0.04 169 XM_Doc_Oz_Body 967 0.30 0.60 0.10 170 T_XMDrugObfuBody_00 946 0.71 0.59 0.79 171 URIBL_DBL_SPAM 934 0.24 0.58 0.02 172 XMPhish14 921 0.67 0.57 0.74 173 MPART_ALT_DIFF_COUNT 903 0.35 0.56 0.21 174 HTML_TAG_BALANCE_BODY 901 0.57 0.56 0.57 175 TR_LOTS_OF_MONEY3 898 0.45 0.56 0.38 176 LongTLD 898 0.34 0.56 0.19 177 INVALID_MSGID 877 2.06 0.54 3.08 178 BAYES_00 868 7.18 0.54 11.67 179 FROM_SUSPICIOUS_NTLD 859 0.24 0.53 0.04 180 XMSlimDrugH 849 0.39 0.53 0.29 181 XMHTML_After_End 848 0.41 0.53 0.33 182 T_FILL_THIS_FORM_SHORT 838 0.54 0.52 0.56 183 URI_NOVOWEL 831 0.46 0.51 0.43 184 XM_B_COPY_HTML 824 0.63 0.51 0.71 185 XM_H_PHPMailer 819 0.63 0.51 0.72 186 FSL_THIS_IS_ADV 813 0.29 0.50 0.15 187 TO_NO_BRKTS_HTML_ONLY 812 0.25 0.50 0.07 188 SINGLETS_LOW_CONTRAST 798 0.21 0.49 0.02 189 BAYES_05 795 1.13 0.49 1.56 190 LOW_PRICE 793 0.34 0.49 0.23 191 PP_MIME_FAKE_ASCII_TEXT 780 0.29 0.48 0.15 192 TR_MetaPhish_Combo_01 772 1.63 0.48 2.41 193 RELAYCOUNTRY_ZA 769 0.20 0.48 0.01 194 XMMoneyMeta_00 753 0.32 0.47 0.23 195 XMBrknScrpt_02 745 0.76 0.46 0.96 196 FORGED_GMAIL_RCVD 743 0.46 0.46 0.46 197 FORGED_YAHOO_RCVD 732 0.20 0.45 0.02 198 XM_UB80 719 0.21 0.45 0.04 199 XM_DK_Undo_01 714 1.12 0.44 1.58 200 RCVD_IN_IADB_VOUCHED 705 1.71 0.44 2.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202617 72.07 53.15 84.85 2 DKIM_SIGNED 190884 67.59 49.32 79.93 3 XM_DK_Pass 188034 66.40 48.14 78.74 4 DKIM_VALID 179349 63.15 45.45 75.10 5 DKIM_VALID_AU 145831 52.06 38.73 61.07 6 XMListUnsubscribeExists 134449 51.35 44.02 56.30 7 DCC_CHECK_NEGATIVE 121878 51.97 53.35 51.04 8 DCC_CHECK 114058 46.97 45.80 47.76 9 BAYES_50 111238 51.60 59.02 46.58 10 XM_H_QuotedFrom 93565 36.26 31.93 39.18 11 HTML_FONT_LOW_CONTRAST 79778 29.24 23.06 33.41 12 LOC_TINY_FONT_1 72582 26.78 21.42 30.39 13 DKIM_VALID_EF 70476 22.06 11.02 29.51 14 XMSubLong 62439 21.77 15.30 26.15 15 MIME_HTML_ONLY 55944 21.20 17.91 23.43 16 T_TM2_M_HEADER_IN_MSG 55381 29.97 40.00 23.19 17 XM_DK_Undo_02 53257 25.77 30.90 22.30 18 FVGT_m_MULTI_ODD 51279 20.32 18.61 21.47 19 BAYES_99 49501 23.66 28.01 20.73 20 BAYES_999 44395 20.74 23.92 18.59 21 XM_DKIMWhitelistDomains 42959 10.74 0.01 17.99 22 RCVD_IN_RP_SAFE 39613 11.33 3.54 16.59 23 XM_Multi_Part_URI 38776 15.92 15.46 16.24 24 XM_Body_Dirty_Words 35934 14.15 12.82 15.05 25 RCVD_IN_RP_CERTIFIED 35841 10.09 2.81 15.01 26 ALL_TRUSTED 35595 9.26 0.90 14.91 27 MultiRelay 33839 11.91 8.57 14.17 28 T_KAM_HTML_FONT_INVALID 33174 12.53 10.52 13.89 29 BAYES_00 27874 7.18 0.54 11.67 30 TR_DCC_Bayes_99 26357 15.63 22.43 11.04 31 XM_Evil_Numbers_Gen 25723 9.57 7.79 10.77 32 HTML_IMAGE_RATIO_02 25607 11.22 11.96 10.72 33 TR_XM_DK_Bayes 24065 6.18 0.41 10.08 34 TR_XM_DK_Bayes1 23064 5.91 0.37 9.66 35 LOTS_OF_MONEY 22863 20.16 35.83 9.57 36 HTML_IMAGE_RATIO_04 21942 7.65 5.37 9.19 37 FSL_BULK_SIG 21781 8.35 7.21 9.12 38 TR_XM_DK_Bayes2 21382 5.48 0.33 8.95 39 LotsOfNums_01 19157 6.43 4.08 8.02 40 XM_B_Phish_Phrases 19146 6.54 4.35 8.02 41 T_TooManySym_01 18672 5.29 1.54 7.82 42 BOTNET_IPINHOSTNAME 16985 7.28 7.54 7.11 43 T_XMDrugObfuBody_14 16956 6.28 5.07 7.10 44 XM_H_Long_From01 15306 5.81 4.91 6.41 45 XMSexyCombo_05 14850 6.35 6.55 6.22 46 TooManyTo_001 14576 5.44 4.45 6.10 47 BAYES_60 14532 5.03 3.46 6.09 48 XM_SendGrid 14486 4.51 2.20 6.07 49 FROM_EXCESS_BASE64 13259 5.33 5.01 5.55 50 XMSubMetaSx_00 12816 5.13 4.79 5.37 51 XMStrtUSub 12325 4.46 3.41 5.16 52 TO_MALFORMED 12316 3.72 1.59 5.16 53 DKIM_INVALID 11535 4.44 3.87 4.83 54 TVD_RCVD_IP 11412 2.91 0.14 4.78 55 RCVD_IN_MSPIKE_H2 11360 3.44 1.50 4.76 56 UNPARSEABLE_RELAY 11119 3.24 1.15 4.66 57 MIME_QP_LONG_LINE 10566 3.27 1.57 4.42 58 RELAYCOUNTRY_META 10426 7.43 11.97 4.37 59 XM_UncommonTLD01 10276 3.90 3.31 4.30 60 RCVD_IN_IADB_LISTED 10100 2.85 0.80 4.23 61 BAYES_80 9803 3.97 3.77 4.11 62 IN_ZIMBRA_NJ_WHITELIST 9235 2.31 0.01 3.87 63 RCVD_IN_IADB_SPF 8892 2.50 0.68 3.72 64 MPART_ALT_DIFF 8467 4.14 5.02 3.55 65 RCVD_IN_IADB_SENDERID 7978 2.24 0.62 3.34 66 HTML_IMAGE_RATIO_06 7898 3.35 3.41 3.31 67 T_REMOTE_IMAGE 7826 2.46 1.25 3.28 68 RCVD_IN_IADB_DK 7788 2.19 0.62 3.26 69 XMNumbers 7706 2.77 2.08 3.23 70 BAYES_95 7703 2.93 2.49 3.23 71 BAYES_40 7671 2.34 1.05 3.21 72 INVALID_MSGID 7362 2.06 0.54 3.08 73 MIME_HTML_MOSTLY 7230 3.22 3.51 3.03 74 XMStockSpam_06 6124 1.90 0.91 2.56 75 RCVD_IN_IADB_VOUCHED 6123 1.71 0.44 2.56 76 RCVD_IN_MSPIKE_H3 5943 1.56 0.17 2.49 77 RCVD_IN_MSPIKE_WL 5943 1.56 0.17 2.49 78 TR_MetaPhish_Combo_01 5749 1.63 0.48 2.41 79 T_TooManySym_02 5744 1.57 0.33 2.41 80 BOTNET 5731 21.47 49.68 2.40 81 BAYES_20 5694 1.78 0.87 2.38 82 USER_IN_DEF_DKIM_WL 5348 1.42 0.20 2.24 83 XM_PDF 5339 1.40 0.16 2.24 84 BOUNCE_MESSAGE 5029 18.23 42.09 2.11 85 ANY_BOUNCE_MESSAGE 5029 18.23 42.09 2.11 86 HTML_IMAGE_RATIO_08 4991 1.91 1.66 2.09 87 URI_TRY_3LD 4990 1.54 0.73 2.09 88 IN_HORDE_ADDRESS_BOOK 4885 1.23 0.02 2.05 89 MAILING_LIST_MULTI 4704 1.47 0.72 1.97 90 HTML_MIME_NO_HTML_TAG 4595 1.82 1.66 1.92 91 XM_SPF_SoftFail 4371 1.80 1.75 1.83 92 URI_HEX 4338 2.01 2.30 1.82 93 XM_DIRTYINTL 4283 2.27 2.97 1.79 94 TM2_M_URI_OPT_OUT 4259 1.83 1.90 1.78 95 XMBdyGiftCard01 4119 2.15 2.79 1.72 96 MIME_HTML_ONLY_MULTI 4094 1.85 2.05 1.71 97 NO_DNS_FOR_FROM 4007 1.51 1.27 1.68 98 XM_OfRef6 3997 13.95 32.11 1.67 99 RCVD_IN_IADB_OPTIN 3901 1.12 0.36 1.63 100 XMSexyCombo_01 3835 1.55 1.48 1.61 101 XM_CamelCaseFrm001 3776 1.66 1.79 1.58 102 XM_DK_Undo_01 3770 1.12 0.44 1.58 103 BAYES_05 3720 1.13 0.49 1.56 104 RELAYCOUNTRY_CA 3602 1.97 2.65 1.51 105 XMDiploma_00 3312 1.75 2.28 1.39 106 TR_Symld_Words 3279 1.22 1.01 1.37 107 UNTRUSTED_Relay 3225 3.77 7.34 1.35 108 XMSubMetaSxObfu_03 3173 1.05 0.64 1.33 109 T_XMDrugObfuBody_08 3155 1.29 1.24 1.32 110 XM_GoogleGroups 3119 0.89 0.27 1.31 111 TooManyTo_002 3049 0.91 0.37 1.28 112 SUBJ_ALL_CAPS 3041 1.64 2.18 1.27 113 XMPhish11 2953 1.73 2.45 1.24 114 XM_H_PHPOS 2887 1.07 0.86 1.21 115 XMBody_95 2797 0.74 0.10 1.17 116 XMSubMetaSx_01 2581 0.79 0.36 1.08 117 XMSexyCombo_04 2546 1.00 0.89 1.07 118 XM_ProductURIs 2412 1.01 1.02 1.01 119 XMSexyCombo_02 2345 0.63 0.12 0.98 120 XMBrknScrpt_02 2302 0.76 0.46 0.96 121 DKIM_ADSP_CUSTOM_MED 2283 0.96 0.96 0.96 122 TM2_M_VERY_LONG_WORD 2176 1.03 1.22 0.91 123 TooManyTo_003 2133 0.66 0.32 0.89 124 XMHTMLBadTable_001 2121 0.85 0.79 0.89 125 USER_IN_WHITELIST 2082 0.52 0.00 0.87 126 XMSubMetaI_00 2036 1.01 1.24 0.85 127 T_XMHurry_00 2034 1.00 1.22 0.85 128 XM_URI_RBL 1966 1.75 3.12 0.82 129 XM_H_Long_From02 1946 1.06 1.42 0.81 130 XM_shorewaves_Whitelist 1938 0.48 0.00 0.81 131 T_XMDrugObfuBody_00 1895 0.71 0.59 0.79 132 XMPhish30 1836 0.80 0.83 0.77 133 T_TooManySym_03 1780 0.47 0.07 0.75 134 XMPhish14 1771 0.67 0.57 0.74 135 TooManyTo_004 1739 0.54 0.27 0.73 136 TM2_M_A_HREF_HREF 1737 0.55 0.29 0.73 137 XM_UB50 1720 2.12 4.19 0.72 138 XM_H_PHPMailer 1716 0.63 0.51 0.72 139 XM_B_COPY_HTML 1684 0.63 0.51 0.71 140 XMSubMetaSxObfu_02 1675 0.50 0.19 0.70 141 HTML_FONT_FACE_BAD 1664 0.58 0.40 0.70 142 XMBSHREFv2 1557 0.44 0.13 0.65 143 XM_RXBody 1551 0.79 0.99 0.65 144 XMGenDplmaNmb 1547 1.08 1.72 0.65 145 XM_B_REG_HTML 1547 0.90 1.27 0.65 146 TooManyTo_005 1544 0.48 0.24 0.65 147 XM_salutation2 1524 0.88 1.24 0.64 148 DKIM_ADSP_NXDOMAIN 1515 0.73 0.88 0.63 149 NML_ADSP_CUSTOM_MED 1491 0.74 0.92 0.62 150 T_Symld_Words_02 1485 0.83 1.14 0.62 151 T_MONEY_PERCENT 1409 0.63 0.70 0.59 152 TR_LOTS_OF_MONEY2 1409 0.63 0.70 0.59 153 TR_XM_RelayPhish 1366 0.66 0.78 0.57 154 HTML_TAG_BALANCE_BODY 1361 0.57 0.56 0.57 155 T_FILL_THIS_FORM_SHORT 1333 0.54 0.52 0.56 156 RELAYCOUNTRY_GB 1332 0.61 0.70 0.56 157 HELO_NODOT 1293 0.42 0.24 0.54 158 RDNS_DYNAMIC 1271 0.63 0.78 0.53 159 XMBody_17 1243 0.96 1.62 0.52 160 XMLngstWrd_00 1238 1.06 1.86 0.52 161 THIS_AD 1231 0.59 0.71 0.52 162 DIET_1 1213 0.61 0.75 0.51 163 FILL_THIS_FORM 1163 12.91 31.29 0.49 164 XM_H_PHPOS_M 1154 0.43 0.35 0.48 165 PLING_QUERY 1151 0.60 0.77 0.48 166 HELO_NO_DOMAIN 1151 0.38 0.23 0.48 167 SUBJ_DOLLARS 1149 0.64 0.89 0.48 168 RELAYCOUNTRY_DE 1148 0.70 1.03 0.48 169 XMLngstWrd_01 1121 1.02 1.83 0.47 170 FORGED_GMAIL_RCVD 1098 0.46 0.46 0.46 171 XMNoVowels 1044 0.80 1.34 0.44 172 XMCapTrack 1026 0.30 0.11 0.43 173 FILL_THIS_FORM_LONG 1024 1.22 2.40 0.43 174 URI_NOVOWEL 1023 0.46 0.51 0.43 175 XMBody_78 1014 0.50 0.61 0.42 176 FILL_THIS_FORM_LOAN 1000 1.19 2.34 0.42 177 T_TooManySym_04 981 0.25 0.01 0.41 178 BASE64_LENGTH_79_INF 980 0.27 0.05 0.41 179 SpammyFromTLD_01 977 0.52 0.68 0.41 180 HTTPS_HTTP_MISMATCH 919 0.31 0.21 0.38 181 TR_LOTS_OF_MONEY3 906 0.45 0.56 0.38 182 XM_Akamai 882 0.22 0.00 0.37 183 XM_D_tchamptons_WL 833 0.21 0.00 0.35 184 XMDateMe_00 824 0.25 0.10 0.35 185 HTML_IMAGE_ONLY_32 824 0.27 0.16 0.35 186 XM_OfRef7 803 12.57 30.67 0.34 187 XM_Combo_Sbj 798 0.33 0.32 0.33 188 XMHTML_After_End 796 0.41 0.53 0.33 189 NUMERIC_HTTP_ADDR 752 0.26 0.18 0.31 190 RELAYCOUNTRY_AU 750 0.28 0.22 0.31 191 DATE_IN_PAST_12_24 728 8.34 20.23 0.30 192 REMOVE_BEFORE_LINK 726 0.25 0.16 0.30 193 TVD_SPACE_RATIO 723 0.23 0.13 0.30 194 XM_ShortIntro_01 712 0.30 0.30 0.30 195 XMSlimDrugH 694 0.39 0.53 0.29 196 TM2_M_BODY_EMPTY 685 0.18 0.03 0.29 197 XM_Walgreens_Forge 679 0.45 0.70 0.28 198 RELAYCOUNTRY_AT 641 0.46 0.75 0.27 199 XMRcvdHeader_S01 601 0.15 0.00 0.25 200 MISSING_HEADERS 601 0.29 0.34 0.25 ----------------------------------------------------------------------