Email: 349905 Autolearn: 0 AvgScore: 3.03 AvgScanTime: 2.13 sec Spam: 98404 Autolearn: 0 AvgScore: 12.48 AvgScanTime: 2.55 sec Ham: 251501 Autolearn: 0 AvgScore: -0.67 AvgScanTime: 1.97 sec Time Spent Running SA: 207.49 hours Time Spent Processing Spam: 69.75 hours Time Spent Processing Ham: 137.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89893 87.81 91.35 86.43 2 DKIM_SIGNED 76896 80.07 78.14 80.83 3 DCC_CHECK 74731 58.23 75.94 51.30 4 XMListUnsubscribeExists 73868 62.69 75.07 57.85 5 XM_DK_Pass 71240 77.58 72.40 79.61 6 DKIM_VALID 69139 75.40 70.26 77.41 7 DKIM_VALID_AU 56471 60.98 57.39 62.39 8 XM_DK_Undo_02 46179 26.61 46.93 18.66 9 BAYES_99 40833 23.73 41.50 16.77 10 HTML_FONT_LOW_CONTRAST 36027 34.80 36.61 34.09 11 BAYES_999 34808 20.85 35.37 15.17 12 TR_DCC_Bayes_99 32839 15.76 33.37 8.87 13 BAYES_50 32725 44.26 33.26 48.57 14 LOC_TINY_FONT_1 32416 30.91 32.94 30.11 15 MIME_HTML_ONLY 30614 24.71 31.11 22.21 16 FVGT_m_MULTI_ODD 27244 23.17 27.69 21.41 17 BOTNET 22711 8.29 23.08 2.50 18 DCC_CHECK_NEGATIVE 22424 40.61 22.79 47.58 19 RELAYCOUNTRY_META 21513 9.35 21.86 4.45 20 XMSubLong 21452 21.90 21.80 21.94 21 BOTNET_IPINHOSTNAME 20753 10.88 21.09 6.88 22 XM_Body_Dirty_Words 20180 16.84 20.51 15.40 23 T_KAM_HTML_FONT_INVALID 17426 15.34 17.71 14.41 24 HTML_IMAGE_RATIO_02 16984 13.47 17.26 11.98 25 DKIM_VALID_EF 16274 25.24 16.54 28.65 26 UNTRUSTED_Relay 15933 5.73 16.19 1.63 27 T_TM2_M_HEADER_IN_MSG 15103 19.70 15.35 21.40 28 XM_Multi_Part_URI 13785 14.20 14.01 14.28 29 MultiRelay 13557 15.79 13.78 16.58 30 XM_Evil_Numbers_Gen 12501 12.09 12.70 11.84 31 LOTS_OF_MONEY 12355 10.08 12.56 9.11 32 FSL_BULK_SIG 10779 10.09 10.95 9.76 33 XMSexyCombo_05 10340 6.85 10.51 5.42 34 XM_UncommonTLD01 9692 6.17 9.85 4.73 35 HTML_IMAGE_RATIO_04 8328 8.45 8.46 8.44 36 DKIM_INVALID 7757 4.67 7.88 3.42 37 XMSubMetaSx_00 7291 5.36 7.41 4.55 38 BAYES_80 7256 5.11 7.37 4.23 39 DKIM_ADSP_NXDOMAIN 7227 2.72 7.34 0.91 40 RELAYCOUNTRY_FR 6991 2.31 7.10 0.43 41 T_XMDrugObfuBody_14 6902 7.15 7.01 7.21 42 HTML_MIME_NO_HTML_TAG 6823 3.21 6.93 1.76 43 LotsOfNums_01 6774 7.76 6.88 8.11 44 XM_B_Phish_Phrases 6714 8.31 6.82 8.89 45 XM_H_Long_From01 6692 6.36 6.80 6.19 46 SpammyFromTLD_02 6432 1.97 6.54 0.18 47 TooManyTo_001 6355 6.11 6.46 5.97 48 MPART_ALT_DIFF 6192 4.92 6.29 4.39 49 RCVD_IN_RP_SAFE 5914 13.48 6.01 16.40 50 FROM_EXCESS_BASE64 5681 5.33 5.77 5.15 51 XM_UB50 5560 2.21 5.65 0.86 52 XM_B_SpammyTLD 5424 4.71 5.51 4.40 53 BAYES_60 5295 6.17 5.38 6.47 54 XM_DIRTYINTL 4823 3.52 4.90 2.98 55 RCVD_IN_RP_CERTIFIED 4739 12.05 4.82 14.88 56 PDS_TO_EQ_FROM_NAME 4674 1.48 4.75 0.20 57 HTML_IMAGE_RATIO_06 4587 3.66 4.66 3.27 58 BOTNET_NORDNS 4487 1.29 4.56 0.02 59 SUBJ_ALL_CAPS 4430 2.55 4.50 1.79 60 XMStrtUSub 4402 5.41 4.47 5.78 61 MIME_HTML_MOSTLY 4365 4.06 4.44 3.92 62 XM_SendGrid 4357 6.98 4.43 7.98 63 ALL_TRUSTED 4299 11.58 4.37 14.40 64 BAYES_95 4128 3.23 4.19 2.86 65 RCVD_IN_RP_RNBL 4074 1.19 4.14 0.04 66 XM_CamelCaseFrm001 4072 2.38 4.14 1.70 67 URIBL_DBL_ABUSE_REDIR 3900 1.16 3.96 0.06 68 RELAYCOUNTRY_CA 3781 2.11 3.84 1.43 69 NO_DNS_FOR_FROM 3624 1.99 3.68 1.32 70 URI_HEX 3402 2.33 3.46 1.89 71 MIME_QP_LONG_LINE 3383 3.97 3.44 4.18 72 BAYES_40 3183 3.44 3.23 3.51 73 XMBdyGiftCard01 3095 2.29 3.15 1.95 74 XMDiploma_00 3070 2.23 3.12 1.89 75 XM_SPF_SoftFail 2992 1.59 3.04 1.03 76 MIME_HTML_ONLY_MULTI 2968 2.19 3.02 1.87 77 XM_UB99 2827 0.84 2.87 0.04 78 HTML_IMAGE_RATIO_08 2827 2.56 2.87 2.43 79 RCVD_IN_MSPIKE_H2 2744 4.31 2.79 4.90 80 TM2_M_URI_OPT_OUT 2729 2.35 2.77 2.19 81 XMNumbers 2678 3.31 2.72 3.53 82 XMSubMetaI_00 2645 1.79 2.69 1.44 83 MultiRelay_CC 2605 0.88 2.65 0.18 84 MultiRelay_Combo 2605 0.88 2.65 0.18 85 T_TooManySym_01 2550 6.68 2.59 8.29 86 NORDNS_LOW_CONTRAST 2479 0.73 2.52 0.02 87 XM_URI_RBL 2381 1.14 2.42 0.63 88 RCVD_IN_BL_SPAMCOP_NET 2377 0.87 2.42 0.27 89 MONEY_FROM_MISSP 2368 0.68 2.41 0.00 90 ADVANCE_FEE_3_NEW_MONEY 2353 0.67 2.39 0.00 91 DATE_IN_PAST_96_XX 2339 0.67 2.38 0.00 92 XM_UB999 2315 0.69 2.35 0.03 93 TR_XM_PHPDW 2294 1.06 2.33 0.56 94 TR_XM_PHPForged 2254 1.03 2.29 0.54 95 XM_ProductURIs 2252 1.40 2.29 1.05 96 TR_XM_FormFill2 2229 1.02 2.27 0.53 97 XMSexyCombo_01 2217 1.04 2.25 0.57 98 T_XMDrugObfuBody_08 2209 1.40 2.24 1.07 99 XM_H_PHPOS 2208 1.01 2.24 0.53 100 BAYES_20 2153 2.64 2.19 2.81 101 RELAYCOUNTRY_IN 2048 0.63 2.08 0.06 102 TR_XM_DK_SendGrid 2039 3.80 2.07 4.48 103 SpammyFromTLD_01 2034 0.79 2.07 0.29 104 T_REMOTE_IMAGE 2023 2.78 2.06 3.07 105 XM_B_REG_HTML 1973 0.84 2.00 0.39 106 XMBody_17 1866 1.20 1.90 0.93 107 RCVD_IN_IADB_LISTED 1847 3.57 1.88 4.24 108 T_XMHurry_00 1745 1.01 1.77 0.71 109 RCVD_IN_PSBL 1673 0.55 1.70 0.10 110 RDNS_DYNAMIC 1671 0.83 1.70 0.49 111 BAYES_00 1657 9.50 1.68 12.56 112 XMGenDplmaNmb 1635 1.30 1.66 1.15 113 RCVD_IN_IADB_SPF 1613 3.11 1.64 3.68 114 XM_H_Long_From02 1534 1.14 1.56 0.97 115 RCVD_IN_IADB_SENDERID 1533 2.78 1.56 3.26 116 RCVD_IN_IADB_DK 1524 2.71 1.55 3.17 117 TM2_M_VERY_LONG_WORD 1487 1.60 1.51 1.63 118 TVD_SPACE_RATIO_MINFP 1473 0.42 1.50 0.00 119 XM_H_PHPMailer 1437 0.81 1.46 0.55 120 FROM_SUSPICIOUS_NTLD 1417 0.43 1.44 0.04 121 UNPARSEABLE_RELAY 1398 3.41 1.42 4.19 122 BODY_ENHANCEMENT 1396 0.45 1.42 0.07 123 T_Symld_Words_02 1340 0.76 1.36 0.52 124 XMMoneyMeta_00 1309 0.59 1.33 0.29 125 HTML_IMAGE_ONLY_32 1302 0.59 1.32 0.31 126 XMGetyour 1298 0.39 1.32 0.03 127 TR_LOTS_OF_MONEY2 1274 0.78 1.29 0.58 128 T_MONEY_PERCENT 1274 0.78 1.29 0.58 129 XM_UB80 1224 0.37 1.24 0.03 130 MAILING_LIST_MULTI 1224 1.69 1.24 1.87 131 RELAYCOUNTRY_AT 1218 0.54 1.24 0.27 132 FILL_THIS_FORM 1206 1.27 1.23 1.28 133 XMPhish30 1204 0.82 1.22 0.66 134 TR_XM_RelayPhish 1203 1.23 1.22 1.24 135 XM_H_PHPOS_M 1181 0.51 1.20 0.23 136 DATE_IN_PAST_03_06 1174 0.39 1.19 0.08 137 XM_RXBody 1171 0.62 1.19 0.40 138 XM_OfRef6 1142 1.35 1.16 1.42 139 XMHTMLBadTable_001 1142 0.78 1.16 0.63 140 XM_UB60 1141 0.38 1.16 0.08 141 DKIM_ADSP_CUSTOM_MED 1133 0.92 1.15 0.83 142 BASE64_LENGTH_79_INF 1120 0.48 1.14 0.23 143 TR_Mismatch_TLD_02 1117 0.36 1.14 0.05 144 XMSubMetaSSx_00 1110 0.44 1.13 0.17 145 HTML_SHORT_LINK_IMG_1 1109 0.34 1.13 0.03 146 TVD_SPACE_RATIO 1107 0.47 1.12 0.21 147 URI_TRY_3LD 1098 1.11 1.12 1.10 148 XMStockSpam_06 1082 1.55 1.10 1.72 149 HTML_IMAGE_ONLY_04 1059 0.33 1.08 0.04 150 DIET_1 1047 0.59 1.06 0.40 151 XMSubNoVowel 1040 0.46 1.06 0.22 152 FVGT_m_IMAGE_ONLY_SPAM 1023 0.29 1.04 0.00 153 FILL_THIS_FORM_LONG 1017 0.78 1.03 0.68 154 URIBL_BLACK 1014 0.34 1.03 0.06 155 NML_ADSP_CUSTOM_MED 1001 0.69 1.02 0.57 156 XMPhish11 1000 0.90 1.02 0.85 157 URI_PHP_REDIR 982 0.28 1.00 0.00 158 XMSexyCombo_04 972 0.40 0.99 0.16 159 BODY_SINGLE_WORD 972 0.29 0.99 0.02 160 BODY_SINGLE_URI 970 0.28 0.99 0.00 161 FORGED_GMAIL_RCVD 961 0.55 0.98 0.39 162 XMBrknScrpt_02 960 0.92 0.98 0.89 163 TO_NO_BRKTS_DYNIP 960 0.28 0.98 0.01 164 TR_LOTS_OF_MONEY3 944 0.56 0.96 0.40 165 XM_B_COPY_HTML 944 0.70 0.96 0.60 166 SHORT_URI_3 939 0.39 0.95 0.17 167 DYN_RDNS_AND_INLINE_IMAGE 935 0.27 0.95 0.00 168 THIS_AD 930 0.97 0.95 0.97 169 REPLYTO_WITHOUT_TO_CC 925 0.30 0.94 0.05 170 XM_DK_Undo_01 924 1.40 0.94 1.58 171 BAYES_05 914 1.54 0.93 1.78 172 XMGppyBdWords 912 0.41 0.93 0.20 173 XM_XX_Yahoo 911 0.39 0.93 0.18 174 RELAYCOUNTRY_RU 904 0.27 0.92 0.02 175 FROM_DOMAIN_NOVOWEL 895 0.29 0.91 0.05 176 T_XMDrugObfuBody_00 891 0.66 0.91 0.56 177 XM_HighProb1 877 0.26 0.89 0.01 178 URI_NOVOWEL 863 0.52 0.88 0.38 179 XM_E_Blogspot 853 0.32 0.87 0.11 180 XMSlimDrugH 832 0.40 0.85 0.23 181 LONG_JUNK_URI 827 0.31 0.84 0.10 182 RELAYCOUNTRY_NG 819 0.23 0.83 0.00 183 MIXED_ES 818 0.25 0.83 0.02 184 TR_XM_SEO3 808 0.36 0.82 0.18 185 XM_H_Undi_Recip 804 0.36 0.82 0.18 186 DATE_IN_PAST_06_12 793 0.27 0.81 0.06 187 XM_UB95 761 0.23 0.77 0.02 188 MISSING_HEADERS 756 0.43 0.77 0.30 189 RCVD_IN_IADB_VOUCHED 754 2.15 0.77 2.69 190 TVD_PH_BODY_ACCOUNTS_PRE 749 0.35 0.76 0.19 191 URIBL_DBL_SPAM 746 0.22 0.76 0.01 192 LONG_JUNK_URI2 743 0.24 0.76 0.04 193 TR_Symld_Words 731 1.12 0.74 1.26 194 RELAYCOUNTRY_CN 723 0.25 0.73 0.06 195 XMSubMetaSxObfu_03 722 0.59 0.73 0.54 196 MONEY_FROM_41 722 0.21 0.73 0.00 197 MONEY_FRAUD_5 718 0.21 0.73 0.00 198 RELAYCOUNTRY_DE 717 0.39 0.73 0.26 199 SUBJ_ILLEGAL_CHARS 714 0.21 0.73 0.01 200 SUBJECT_NEEDS_ENCODING 712 0.21 0.72 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 217374 87.81 91.35 86.43 2 DKIM_SIGNED 203282 80.07 78.14 80.83 3 XM_DK_Pass 200223 77.58 72.40 79.61 4 DKIM_VALID 194688 75.40 70.26 77.41 5 DKIM_VALID_AU 156915 60.98 57.39 62.39 6 XMListUnsubscribeExists 145484 62.69 75.07 57.85 7 DCC_CHECK 129009 58.23 75.94 51.30 8 BAYES_50 122155 44.26 33.26 48.57 9 DCC_CHECK_NEGATIVE 119676 40.61 22.79 47.58 10 HTML_FONT_LOW_CONTRAST 85731 34.80 36.61 34.09 11 LOC_TINY_FONT_1 75727 30.91 32.94 30.11 12 DKIM_VALID_EF 72057 25.24 16.54 28.65 13 MIME_HTML_ONLY 55855 24.71 31.11 22.21 14 XMSubLong 55183 21.90 21.80 21.94 15 FVGT_m_MULTI_ODD 53841 23.17 27.69 21.41 16 T_TM2_M_HEADER_IN_MSG 53826 19.70 15.35 21.40 17 XM_DK_Undo_02 46933 26.61 46.93 18.66 18 BAYES_99 42189 23.73 41.50 16.77 19 MultiRelay 41690 15.79 13.78 16.58 20 RCVD_IN_RP_SAFE 41242 13.48 6.01 16.40 21 XM_Body_Dirty_Words 38733 16.84 20.51 15.40 22 BAYES_999 38142 20.85 35.37 15.17 23 RCVD_IN_RP_CERTIFIED 37414 12.05 4.82 14.88 24 T_KAM_HTML_FONT_INVALID 36248 15.34 17.71 14.41 25 ALL_TRUSTED 36224 11.58 4.37 14.40 26 XM_Multi_Part_URI 35902 14.20 14.01 14.28 27 XM_DKIMWhitelistDomains 31920 9.13 0.03 12.69 28 BAYES_00 31592 9.50 1.68 12.56 29 HTML_IMAGE_RATIO_02 30137 13.47 17.26 11.98 30 XM_Evil_Numbers_Gen 29788 12.09 12.70 11.84 31 TR_XM_DK_Bayes 28548 8.28 0.43 11.35 32 TR_XM_DK_Bayes1 27841 8.07 0.39 11.07 33 TR_XM_DK_Bayes2 25357 7.35 0.35 10.08 34 FSL_BULK_SIG 24541 10.09 10.95 9.76 35 LOTS_OF_MONEY 22905 10.08 12.56 9.11 36 XM_B_Phish_Phrases 22359 8.31 6.82 8.89 37 TR_DCC_Bayes_99 22315 15.76 33.37 8.87 38 HTML_IMAGE_RATIO_04 21222 8.45 8.46 8.44 39 T_TooManySym_01 20839 6.68 2.59 8.29 40 LotsOfNums_01 20396 7.76 6.88 8.11 41 XM_SendGrid 20063 6.98 4.43 7.98 42 T_XMDrugObfuBody_14 18126 7.15 7.01 7.21 43 BOTNET_IPINHOSTNAME 17300 10.88 21.09 6.88 44 TO_MALFORMED 16908 4.85 0.06 6.72 45 BAYES_60 16283 6.17 5.38 6.47 46 XM_H_Long_From01 15569 6.36 6.80 6.19 47 TooManyTo_001 15013 6.11 6.46 5.97 48 XMStrtUSub 14526 5.41 4.47 5.78 49 XMSexyCombo_05 13629 6.85 10.51 5.42 50 FROM_EXCESS_BASE64 12959 5.33 5.77 5.15 51 RCVD_IN_MSPIKE_H2 12333 4.31 2.79 4.90 52 XM_UncommonTLD01 11908 6.17 9.85 4.73 53 XMSubMetaSx_00 11451 5.36 7.41 4.55 54 TR_XM_DK_SendGrid 11256 3.80 2.07 4.48 55 RELAYCOUNTRY_META 11196 9.35 21.86 4.45 56 XM_B_SpammyTLD 11074 4.71 5.51 4.40 57 MPART_ALT_DIFF 11029 4.92 6.29 4.39 58 RCVD_IN_IADB_LISTED 10658 3.57 1.88 4.24 59 BAYES_80 10633 5.11 7.37 4.23 60 UNPARSEABLE_RELAY 10535 3.41 1.42 4.19 61 MIME_QP_LONG_LINE 10510 3.97 3.44 4.18 62 MIME_HTML_MOSTLY 9853 4.06 4.44 3.92 63 RCVD_IN_IADB_SPF 9265 3.11 1.64 3.68 64 IN_ZIMBRA_NJ_WHITELIST 9203 2.63 0.02 3.66 65 TVD_RCVD_IP 9100 2.69 0.33 3.62 66 XMNumbers 8889 3.31 2.72 3.53 67 BAYES_40 8839 3.44 3.23 3.51 68 DKIM_INVALID 8594 4.67 7.88 3.42 69 HTML_IMAGE_RATIO_06 8218 3.66 4.66 3.27 70 RCVD_IN_IADB_SENDERID 8196 2.78 1.56 3.26 71 T_TooManySym_02 7984 2.44 0.55 3.17 72 RCVD_IN_IADB_DK 7963 2.71 1.55 3.17 73 T_REMOTE_IMAGE 7720 2.78 2.06 3.07 74 XM_DIRTYINTL 7490 3.52 4.90 2.98 75 INVALID_MSGID 7345 2.15 0.17 2.92 76 BAYES_95 7182 3.23 4.19 2.86 77 BAYES_20 7070 2.64 2.19 2.81 78 RCVD_IN_IADB_VOUCHED 6776 2.15 0.77 2.69 79 XM_PDF 6740 2.01 0.30 2.68 80 RCVD_IN_MSPIKE_WL 6478 1.92 0.25 2.58 81 RCVD_IN_MSPIKE_H3 6477 1.92 0.25 2.58 82 BOTNET 6289 8.29 23.08 2.50 83 HTML_IMAGE_RATIO_08 6123 2.56 2.87 2.43 84 TR_MetaPhish_Combo_01 5912 1.82 0.45 2.35 85 TM2_M_URI_OPT_OUT 5503 2.35 2.77 2.19 86 USER_IN_DEF_DKIM_WL 5351 1.54 0.02 2.13 87 XMBdyGiftCard01 4916 2.29 3.15 1.95 88 XMDiploma_00 4749 2.23 3.12 1.89 89 URI_HEX 4741 2.33 3.46 1.89 90 IN_HORDE_ADDRESS_BOOK 4734 1.37 0.06 1.88 91 MIME_HTML_ONLY_MULTI 4705 2.19 3.02 1.87 92 MAILING_LIST_MULTI 4702 1.69 1.24 1.87 93 SUBJ_ALL_CAPS 4498 2.55 4.50 1.79 94 BAYES_05 4479 1.54 0.93 1.78 95 HTML_MIME_NO_HTML_TAG 4421 3.21 6.93 1.76 96 RCVD_IN_IADB_OPTIN 4400 1.38 0.43 1.75 97 XMStockSpam_06 4336 1.55 1.10 1.72 98 XM_CamelCaseFrm001 4267 2.38 4.14 1.70 99 UNTRUSTED_Relay 4110 5.73 16.19 1.63 100 TM2_M_VERY_LONG_WORD 4096 1.60 1.51 1.63 101 XM_DK_Undo_01 3978 1.40 0.94 1.58 102 XMSubMetaI_00 3621 1.79 2.69 1.44 103 RELAYCOUNTRY_CA 3602 2.11 3.84 1.43 104 XM_OfRef6 3579 1.35 1.16 1.42 105 ANY_BOUNCE_MESSAGE 3420 1.07 0.34 1.36 106 BOUNCE_MESSAGE 3419 1.07 0.34 1.36 107 NO_DNS_FOR_FROM 3330 1.99 3.68 1.32 108 FILL_THIS_FORM 3231 1.27 1.23 1.28 109 TR_Symld_Words 3173 1.12 0.74 1.26 110 XM_GoogleGroups 3148 1.03 0.47 1.25 111 TR_XM_RelayPhish 3107 1.23 1.22 1.24 112 TooManyTo_002 2922 0.99 0.54 1.16 113 XMGenDplmaNmb 2904 1.30 1.66 1.15 114 URI_TRY_3LD 2773 1.11 1.12 1.10 115 T_XMDrugObfuBody_08 2679 1.40 2.24 1.07 116 XM_ProductURIs 2639 1.40 2.29 1.05 117 XM_SPF_SoftFail 2588 1.59 3.04 1.03 118 XMBody_95 2526 0.74 0.08 1.00 119 THIS_AD 2451 0.97 0.95 0.97 120 XM_H_Long_From02 2438 1.14 1.56 0.97 121 XMBody_17 2330 1.20 1.90 0.93 122 HTML_FONT_SIZE_LARGE 2327 0.71 0.16 0.93 123 DKIM_ADSP_NXDOMAIN 2282 2.72 7.34 0.91 124 XMBrknScrpt_02 2250 0.92 0.98 0.89 125 XM_UB50 2158 2.21 5.65 0.86 126 USER_IN_WHITELIST 2154 0.62 0.00 0.86 127 XMPhish11 2149 0.90 1.02 0.85 128 DKIM_ADSP_CUSTOM_MED 2088 0.92 1.15 0.83 129 TooManyTo_003 1983 0.69 0.44 0.79 130 T_FILL_THIS_FORM_SHORT 1898 0.67 0.46 0.75 131 T_XMHurry_00 1784 1.01 1.77 0.71 132 HTML_FONT_FACE_BAD 1781 0.69 0.63 0.71 133 TM2_M_A_HREF_HREF 1780 0.71 0.72 0.71 134 XMSubMetaSxObfu_02 1765 0.60 0.34 0.70 135 FILL_THIS_FORM_LONG 1710 0.78 1.03 0.68 136 NUMERIC_HTTP_ADDR 1680 0.63 0.55 0.67 137 XMPhish30 1671 0.82 1.22 0.66 138 T_TooManySym_03 1655 0.52 0.17 0.66 139 TooManyTo_004 1652 0.57 0.36 0.66 140 XMLngstWrd_00 1651 0.58 0.38 0.66 141 FILL_THIS_FORM_LOAN 1619 0.52 0.21 0.64 142 XM_URI_RBL 1597 1.14 2.42 0.63 143 XMHTMLBadTable_001 1584 0.78 1.16 0.63 144 HTML_TAG_BALANCE_BODY 1549 0.62 0.63 0.62 145 XMLngstWrd_01 1519 0.53 0.33 0.60 146 XM_B_COPY_HTML 1505 0.70 0.96 0.60 147 TR_LOTS_OF_MONEY2 1457 0.78 1.29 0.58 148 T_MONEY_PERCENT 1457 0.78 1.29 0.58 149 TooManyTo_005 1434 0.49 0.29 0.57 150 XMSexyCombo_01 1425 1.04 2.25 0.57 151 NML_ADSP_CUSTOM_MED 1425 0.69 1.02 0.57 152 T_XMDrugObfuBody_00 1415 0.66 0.91 0.56 153 TR_XM_PHPDW 1398 1.06 2.33 0.56 154 XM_H_PHPMailer 1385 0.81 1.46 0.55 155 TR_XM_PHPForged 1360 1.03 2.29 0.54 156 XMSubMetaSxObfu_03 1359 0.59 0.73 0.54 157 RELAYCOUNTRY_GB 1356 0.58 0.69 0.54 158 TR_XM_FormFill2 1340 1.02 2.27 0.53 159 XM_H_PHPOS 1336 1.01 2.24 0.53 160 T_Symld_Words_02 1314 0.76 1.36 0.52 161 XM_B_Crypto 1286 0.38 0.04 0.51 162 RDNS_DYNAMIC 1241 0.83 1.70 0.49 163 T_OBFU_PDF_ATTACH 1160 0.37 0.15 0.46 164 SUBJ_DOLLARS 1145 0.50 0.63 0.46 165 XMNoVowels 1111 0.38 0.23 0.44 166 RELAYCOUNTRY_FR 1088 2.31 7.10 0.43 167 RELAYCOUNTRY_AU 1083 0.44 0.47 0.43 168 XMRcvdHeader_15 1078 0.31 0.00 0.43 169 XM_Body_Obfu01 1067 0.40 0.34 0.42 170 PLING_QUERY 1056 0.42 0.41 0.42 171 XMGappySubj_01 1052 0.36 0.21 0.42 172 XM_RXBody 1014 0.62 1.19 0.40 173 XMLngstWrd_02 1010 0.37 0.31 0.40 174 DIET_1 1000 0.59 1.06 0.40 175 HELO_NODOT 1000 0.45 0.59 0.40 176 TR_LOTS_OF_MONEY3 999 0.56 0.96 0.40 177 XM_B_REG_HTML 977 0.84 2.00 0.39 178 FORGED_GMAIL_RCVD 971 0.55 0.98 0.39 179 URI_NOVOWEL 945 0.52 0.88 0.38 180 XMBody_78 941 0.46 0.68 0.37 181 XM_Walgreens_Forge 938 0.33 0.21 0.37 182 MPART_ALT_DIFF_COUNT 924 0.44 0.64 0.37 183 T_TooManySym_04 915 0.27 0.04 0.36 184 HELO_NO_DOMAIN 907 0.42 0.59 0.36 185 XMClaimOffer 897 0.41 0.56 0.36 186 XMCapTrack 879 0.30 0.17 0.35 187 XMHTML_After_End 863 0.39 0.53 0.34 188 LOW_PRICE 860 0.43 0.64 0.34 189 XM_Akamai 849 0.24 0.00 0.34 190 FROM_EGROUPS 848 0.25 0.01 0.34 191 XMBSHREFv2 825 0.28 0.17 0.33 192 REMOVE_BEFORE_LINK 818 0.35 0.42 0.33 193 XMLngstWrd_03 797 0.30 0.27 0.32 194 FSL_THIS_IS_ADV 797 0.34 0.39 0.32 195 HTTPS_HTTP_MISMATCH 776 0.27 0.17 0.31 196 HTML_IMAGE_ONLY_32 775 0.59 1.32 0.31 197 XM_D_tchamptons_WL 758 0.22 0.00 0.30 198 MISSING_HEADERS 752 0.43 0.77 0.30 199 XMMoneyMeta_00 740 0.59 1.33 0.29 200 SpammyFromTLD_01 719 0.79 2.07 0.29 ----------------------------------------------------------------------