Email: 341362 Autolearn: 0 AvgScore: 2.77 AvgScanTime: 2.13 sec Spam: 90738 Autolearn: 0 AvgScore: 12.30 AvgScanTime: 2.56 sec Ham: 250624 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 1.97 sec Time Spent Running SA: 201.63 hours Time Spent Processing Spam: 64.46 hours Time Spent Processing Ham: 137.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 85641 86.98 94.38 84.30 2 DKIM_SIGNED 77387 81.77 85.29 80.49 3 XM_DK_Pass 75259 80.18 82.94 79.18 4 DCC_CHECK 72707 58.15 80.13 50.19 5 XMListUnsubscribeExists 72481 62.83 79.88 56.66 6 DKIM_VALID 71793 76.92 79.12 76.12 7 XM_B_Unicode 69298 72.30 76.37 70.82 8 DKIM_VALID_AU 58403 61.27 64.36 60.15 9 XM_B_Unicode3 45729 46.92 50.40 45.66 10 XM_DK_Undo_02 45031 26.46 49.63 18.07 11 HTML_FONT_LOW_CONTRAST 40097 37.14 44.19 34.58 12 BAYES_99 38940 23.31 42.91 16.21 13 LOC_TINY_FONT_1 35078 32.52 38.66 30.30 14 BAYES_999 32839 20.38 36.19 14.65 15 TR_DCC_Bayes_99 31487 15.44 34.70 8.47 16 BAYES_50 30047 45.09 33.11 49.42 17 MIME_HTML_ONLY 25867 24.46 28.51 22.99 18 FVGT_m_MULTI_ODD 24662 22.77 27.18 21.18 19 DKIM_VALID_EF 21434 28.57 23.62 30.36 20 XM_Body_Dirty_Words 20287 17.21 22.36 15.35 21 XMSubLong 19391 23.67 21.37 24.50 22 RELAYCOUNTRY_META 18573 8.61 20.47 4.32 23 T_KAM_HTML_FONT_INVALID 17637 16.33 19.44 15.21 24 DCC_CHECK_NEGATIVE 16842 40.69 18.56 48.70 25 HTML_IMAGE_RATIO_02 16671 13.47 18.37 11.69 26 XM_Multi_Part_URI 15635 14.63 17.23 13.69 27 T_TM2_M_HEADER_IN_MSG 15598 21.96 17.19 23.69 28 MultiRelay 14982 16.63 16.51 16.67 29 BOTNET_IPINHOSTNAME 14946 8.97 16.47 6.25 30 BOTNET 12897 5.23 14.21 1.98 31 XM_Evil_Numbers_Gen 12430 11.27 13.70 10.39 32 UNTRUSTED_Relay 12077 4.53 13.31 1.35 33 XM_UncommonTLD01 11560 7.40 12.74 5.47 34 SpammyFromTLD_02 9909 3.03 10.92 0.18 35 XMSexyCombo_05 9838 7.10 10.84 5.74 36 HTML_IMAGE_RATIO_04 9648 8.98 10.63 8.38 37 TooManyTo_001 9572 7.36 10.55 6.21 38 XM_B_SpammyTLD 8492 5.92 9.36 4.67 39 FSL_BULK_SIG 8395 9.87 9.25 10.09 40 LOTS_OF_MONEY 8322 10.64 9.17 11.17 41 T_XMDrugObfuBody_14 7794 8.75 8.59 8.81 42 XMSubMetaSx_00 7568 5.41 8.34 4.34 43 XM_B_Phish_Phrases 7253 7.32 7.99 7.07 44 XM_H_Long_From01 7041 7.00 7.76 6.73 45 BAYES_80 6613 4.77 7.29 3.85 46 LotsOfNums_01 6548 7.49 7.22 7.60 47 BAYES_60 6125 6.29 6.75 6.13 48 MPART_ALT_DIFF 5904 4.72 6.51 4.08 49 XM_DIRTYINTL 5639 4.20 6.21 3.47 50 DKIM_INVALID 5594 4.85 6.17 4.37 51 XMStrtUSub 5290 5.23 5.83 5.01 52 XMBdyGiftCard01 5287 2.66 5.83 1.52 53 RCVD_IN_MSPIKE_H2 5240 7.01 5.77 7.46 54 XM_UB50 5223 2.09 5.76 0.77 55 MIME_HTML_MOSTLY 4884 4.11 5.38 3.66 56 RCVD_IN_RP_SAFE 4748 12.30 5.23 14.85 57 FROM_SUSPICIOUS_NTLD 4446 1.31 4.90 0.01 58 FROM_SUSPICIOUS_NTLD_FP 4427 1.31 4.88 0.01 59 RELAYCOUNTRY_CA 4401 2.41 4.85 1.53 60 FROM_EXCESS_BASE64 4174 4.28 4.60 4.17 61 XM_SendGrid 4168 6.64 4.59 7.38 62 BAYES_95 3913 2.94 4.31 2.45 63 RELAYCOUNTRY_FR 3654 1.21 4.03 0.19 64 MIME_QP_LONG_LINE 3545 3.88 3.91 3.87 65 XM_H_TOP 3468 1.02 3.82 0.00 66 RCVD_IN_RP_CERTIFIED 3463 10.87 3.82 13.42 67 MIME_HTML_ONLY_MULTI 3452 2.45 3.80 1.96 68 HTML_IMAGE_RATIO_06 3398 3.23 3.74 3.04 69 XM_CamelCaseFrm001 3269 2.29 3.60 1.81 70 URI_HEX 3268 2.22 3.60 1.72 71 RCVD_IN_RP_RNBL 3137 0.95 3.46 0.05 72 RCVD_IN_BL_SPAMCOP_NET 3122 1.32 3.44 0.55 73 MultiRelay_CC 3121 1.05 3.44 0.18 74 MultiRelay_Combo 3121 1.05 3.44 0.18 75 XM_SPF_SoftFail 2856 1.72 3.15 1.20 76 RCVD_IN_PSBL 2830 0.87 3.12 0.05 77 TM2_M_URI_OPT_OUT 2826 2.18 3.11 1.84 78 DATE_IN_PAST_12_24 2680 0.83 2.95 0.06 79 XMNumbers 2659 3.72 2.93 4.00 80 US_DOLLARS_3 2601 3.19 2.87 3.31 81 T_TooManySym_01 2580 7.29 2.84 8.89 82 HTML_IMAGE_RATIO_08 2554 2.22 2.81 2.01 83 XMSubMetaI_00 2521 1.48 2.78 1.01 84 XMSexyCombo_01 2439 1.58 2.69 1.18 85 HTML_MIME_NO_HTML_TAG 2398 1.64 2.64 1.28 86 T_REMOTE_IMAGE 2255 3.08 2.49 3.29 87 KHOP_HELO_FCRDNS 2247 1.68 2.48 1.39 88 NORDNS_LOW_CONTRAST 2243 0.66 2.47 0.00 89 XM_UB99 2204 0.67 2.43 0.03 90 DKIM_ADSP_NXDOMAIN 2203 1.14 2.43 0.68 91 TR_XM_DK_SendGrid 2110 3.29 2.33 3.64 92 BAYES_40 2069 3.55 2.28 4.01 93 SUBJ_ALL_CAPS 2040 2.09 2.25 2.03 94 NO_DNS_FOR_FROM 2002 1.49 2.21 1.24 95 TM2_M_VERY_LONG_WORD 1974 1.45 2.18 1.19 96 XM_URI_RBL 1926 0.79 2.12 0.30 97 T_XMDrugObfuBody_08 1815 1.43 2.00 1.23 98 T_XMDrugObfuBody_00 1791 1.22 1.97 0.95 99 TR_XM_RelayPhish 1774 1.07 1.96 0.75 100 RCVD_IN_IADB_LISTED 1727 3.46 1.90 4.02 101 TR_XM_PHPDW 1723 0.89 1.90 0.52 102 TR_XM_PHPForged 1719 0.88 1.89 0.51 103 XM_OfRef6 1712 2.01 1.89 2.05 104 TR_XM_FormFill2 1685 0.85 1.86 0.49 105 XM_H_PHPOS 1679 0.85 1.85 0.49 106 XM_UB999 1626 0.50 1.79 0.03 107 XMDiploma_00 1603 1.55 1.77 1.47 108 XM_B_REG_HTML 1578 1.02 1.74 0.76 109 T_XMHurry_00 1557 1.69 1.72 1.68 110 TR_Mismatch_TLD_02 1532 0.49 1.69 0.06 111 XMBody_17 1528 0.90 1.68 0.62 112 THIS_AD 1511 1.05 1.67 0.83 113 RCVD_IN_IADB_SPF 1500 2.97 1.65 3.45 114 URIBL_DBL_ABUSE_REDIR 1494 0.45 1.65 0.02 115 TR_Symld_Words 1476 1.76 1.63 1.81 116 BAYES_20 1460 2.67 1.61 3.05 117 RCVD_IN_IADB_SENDERID 1442 2.63 1.59 3.01 118 RCVD_IN_IADB_DK 1427 2.57 1.57 2.93 119 DATE_IN_PAST_06_12 1415 0.45 1.56 0.05 120 DATE_IN_PAST_03_06 1377 0.46 1.52 0.08 121 XMStockSpam_06 1372 1.66 1.51 1.72 122 XM_H_Long_From02 1332 1.18 1.47 1.08 123 DIET_1 1282 0.71 1.41 0.46 124 RELAYCOUNTRY_IN 1255 0.41 1.38 0.06 125 T_FILL_THIS_FORM_SHORT 1251 0.93 1.38 0.77 126 XM_ProductURIs 1246 1.13 1.37 1.04 127 XM_UB60 1244 0.42 1.37 0.07 128 ALL_TRUSTED 1224 11.56 1.35 15.26 129 XMSubMetaSSx_00 1189 0.57 1.31 0.30 130 XM_H_PHPMailer 1165 0.72 1.28 0.52 131 XM_UB80 1160 0.36 1.28 0.03 132 XM_RXBody 1154 0.69 1.27 0.49 133 SpammyFromTLD_01 1151 0.60 1.27 0.36 134 XMGenDplmaNmb 1134 0.85 1.25 0.71 135 RELAYCOUNTRY_AT 1122 0.45 1.24 0.17 136 RCVD_IN_MSPIKE_WL 1118 4.06 1.23 5.08 137 URIBL_BLACK 1114 0.37 1.23 0.06 138 UNPARSEABLE_RELAY 1109 3.39 1.22 4.17 139 RDNS_DYNAMIC 1083 0.71 1.19 0.53 140 XMSubMetaSxObfu_03 1031 0.59 1.14 0.39 141 BOTNET_NORDNS 1027 0.31 1.13 0.02 142 XMGppyBdWords 1005 0.39 1.11 0.13 143 RCVD_IN_MSPIKE_H3 993 3.98 1.09 5.03 144 URI_TRY_3LD 973 1.47 1.07 1.61 145 XMBrknScrpt_02 969 0.92 1.07 0.86 146 RELAYCOUNTRY_GB 969 0.65 1.07 0.50 147 TM2_M_A_HREF_HREF 962 1.16 1.06 1.20 148 TR_M_TOP_BAYES 942 0.28 1.04 0.00 149 XM_H_PHPOS_M 938 0.42 1.03 0.20 150 XMPhish30 938 0.71 1.03 0.60 151 SUBJ_DOLLARS 920 0.58 1.01 0.42 152 RELAYCOUNTRY_DE 907 0.47 1.00 0.28 153 XMSexyCombo_04 900 0.32 0.99 0.08 154 MISSING_HEADERS 863 0.50 0.95 0.33 155 XM_B_COPY_HTML 855 0.69 0.94 0.59 156 XM_DK_Undo_01 834 1.26 0.92 1.39 157 PLING_QUERY 830 1.02 0.91 1.06 158 LOW_PRICE 823 0.41 0.91 0.23 159 URIBL_DBL_SPAM 820 0.25 0.90 0.01 160 XMPhish11 814 1.15 0.90 1.24 161 T_Symld_Words_02 800 0.71 0.88 0.65 162 HTML_FONT_FACE_BAD 795 0.70 0.88 0.64 163 XMHTMLBadTable_001 787 0.56 0.87 0.45 164 XMMoneyMeta_00 783 0.35 0.86 0.16 165 MAILING_LIST_MULTI 783 1.48 0.86 1.70 166 TooManyTo_002 776 1.11 0.86 1.20 167 XMPhish14 767 0.50 0.85 0.37 168 XMSubMetaSxObfu_04 761 0.51 0.84 0.39 169 XMGetyour 758 0.26 0.84 0.05 170 TR_LOTS_OF_MONEY3 752 0.58 0.83 0.49 171 REPLYTO_WITHOUT_TO_CC 745 0.24 0.82 0.04 172 XMBody_78 741 0.62 0.82 0.55 173 HTML_TAG_BALANCE_BODY 740 0.76 0.82 0.74 174 XMBSHREFv2 737 0.55 0.81 0.46 175 TVD_RCVD_IP 732 3.07 0.81 3.89 176 BAYES_00 727 9.47 0.80 12.61 177 XM_UB95 712 0.22 0.78 0.01 178 TR_MetaPhish_Combo_01 709 2.42 0.78 3.02 179 URIBL_SBL_A 695 0.27 0.77 0.10 180 DKIM_ADSP_CUSTOM_MED 695 0.87 0.77 0.91 181 TR_LOTS_OF_MONEY2 683 0.70 0.75 0.68 182 T_MONEY_PERCENT 683 0.70 0.75 0.68 183 XMHTML_After_End 681 0.45 0.75 0.35 184 BODY_ENHANCEMENT 666 0.21 0.73 0.02 185 XMSubMetaSx_01 661 0.29 0.73 0.13 186 FSL_THIS_IS_ADV 660 0.45 0.73 0.35 187 XMSlimDrugH 657 0.51 0.72 0.43 188 RCVD_IN_MSPIKE_BL 651 0.20 0.72 0.01 189 XM_BadFromFormat 649 0.30 0.72 0.16 190 RCVD_IN_IADB_VOUCHED 647 2.21 0.71 2.75 191 T_TooManySym_02 645 2.74 0.71 3.47 192 TR_Caps_n_Bayes_99 639 0.39 0.70 0.28 193 TooManyTo_003 636 0.82 0.70 0.86 194 RCVD_IN_MSPIKE_L5 634 0.19 0.70 0.01 195 FROM_MISSP_REPLYTO 629 0.19 0.69 0.01 196 XM_ShortIntro_01 626 0.43 0.69 0.34 197 XMSubNoVowel 623 0.36 0.69 0.24 198 FILL_THIS_FORM 618 0.92 0.68 1.00 199 BAYES_05 617 1.56 0.68 1.88 200 URI_NOVOWEL 617 0.44 0.68 0.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 211272 86.98 94.38 84.30 2 DKIM_SIGNED 201732 81.77 85.29 80.49 3 XM_DK_Pass 198454 80.18 82.94 79.18 4 DKIM_VALID 190769 76.92 79.12 76.12 5 XM_B_Unicode 177494 72.30 76.37 70.82 6 DKIM_VALID_AU 150744 61.27 64.36 60.15 7 XMListUnsubscribeExists 142010 62.83 79.88 56.66 8 DCC_CHECK 125784 58.15 80.13 50.19 9 BAYES_50 123859 45.09 33.11 49.42 10 DCC_CHECK_NEGATIVE 122065 40.69 18.56 48.70 11 XM_B_Unicode3 114436 46.92 50.40 45.66 12 HTML_FONT_LOW_CONTRAST 86674 37.14 44.19 34.58 13 DKIM_VALID_EF 76097 28.57 23.62 30.36 14 LOC_TINY_FONT_1 75934 32.52 38.66 30.30 15 XMSubLong 61394 23.67 21.37 24.50 16 T_TM2_M_HEADER_IN_MSG 59382 21.96 17.19 23.69 17 MIME_HTML_ONLY 57627 24.46 28.51 22.99 18 FVGT_m_MULTI_ODD 53079 22.77 27.18 21.18 19 XM_DK_Undo_02 45278 26.46 49.63 18.07 20 MultiRelay 41784 16.63 16.51 16.67 21 BAYES_99 40616 23.31 42.91 16.21 22 XM_Body_Dirty_Words 38464 17.21 22.36 15.35 23 ALL_TRUSTED 38244 11.56 1.35 15.26 24 T_KAM_HTML_FONT_INVALID 38114 16.33 19.44 15.21 25 RCVD_IN_RP_SAFE 37230 12.30 5.23 14.85 26 BAYES_999 36715 20.38 36.19 14.65 27 XM_Multi_Part_URI 34311 14.63 17.23 13.69 28 RCVD_IN_RP_CERTIFIED 33633 10.87 3.82 13.42 29 XM_DKIMWhitelistDomains 31871 9.39 0.19 12.72 30 BAYES_00 31608 9.47 0.80 12.61 31 HTML_IMAGE_RATIO_02 29305 13.47 18.37 11.69 32 TR_XM_DK_Bayes 28257 8.39 0.41 11.27 33 LOTS_OF_MONEY 28003 10.64 9.17 11.17 34 TR_XM_DK_Bayes1 27140 8.04 0.34 10.83 35 XM_Evil_Numbers_Gen 26046 11.27 13.70 10.39 36 FSL_BULK_SIG 25281 9.87 9.25 10.09 37 TR_XM_DK_Bayes2 23827 7.05 0.27 9.51 38 T_TooManySym_01 22289 7.29 2.84 8.89 39 T_XMDrugObfuBody_14 22087 8.75 8.59 8.81 40 TR_DCC_Bayes_99 21221 15.44 34.70 8.47 41 HTML_IMAGE_RATIO_04 20999 8.98 10.63 8.38 42 LotsOfNums_01 19035 7.49 7.22 7.60 43 RCVD_IN_MSPIKE_H2 18688 7.01 5.77 7.46 44 XM_SendGrid 18504 6.64 4.59 7.38 45 XM_B_Phish_Phrases 17726 7.32 7.99 7.07 46 TO_MALFORMED 17146 5.03 0.04 6.84 47 XM_H_Long_From01 16859 7.00 7.76 6.73 48 BOTNET_IPINHOSTNAME 15670 8.97 16.47 6.25 49 TooManyTo_001 15567 7.36 10.55 6.21 50 BAYES_60 15351 6.29 6.75 6.13 51 XMSexyCombo_05 14395 7.10 10.84 5.74 52 XM_UncommonTLD01 13706 7.40 12.74 5.47 53 RCVD_IN_MSPIKE_WL 12739 4.06 1.23 5.08 54 RCVD_IN_MSPIKE_H3 12605 3.98 1.09 5.03 55 XMStrtUSub 12553 5.23 5.83 5.01 56 XM_B_SpammyTLD 11709 5.92 9.36 4.67 57 DKIM_INVALID 10963 4.85 6.17 4.37 58 XMSubMetaSx_00 10883 5.41 8.34 4.34 59 RELAYCOUNTRY_META 10822 8.61 20.47 4.32 60 INVALID_MSGID 10494 3.09 0.06 4.19 61 UNPARSEABLE_RELAY 10453 3.39 1.22 4.17 62 FROM_EXCESS_BASE64 10452 4.28 4.60 4.17 63 MPART_ALT_DIFF 10221 4.72 6.51 4.08 64 RCVD_IN_IADB_LISTED 10075 3.46 1.90 4.02 65 BAYES_40 10046 3.55 2.28 4.01 66 XMNumbers 10035 3.72 2.93 4.00 67 TVD_RCVD_IP 9747 3.07 0.81 3.89 68 MIME_QP_LONG_LINE 9693 3.88 3.91 3.87 69 BAYES_80 9659 4.77 7.29 3.85 70 MIME_HTML_MOSTLY 9161 4.11 5.38 3.66 71 TR_XM_DK_SendGrid 9126 3.29 2.33 3.64 72 IN_ZIMBRA_NJ_WHITELIST 9018 2.65 0.01 3.60 73 XM_DIRTYINTL 8692 4.20 6.21 3.47 74 T_TooManySym_02 8692 2.74 0.71 3.47 75 RCVD_IN_IADB_SPF 8652 2.97 1.65 3.45 76 CK_HELO_DYNAMIC_SPLIT_IP 8363 2.58 0.50 3.34 77 HELO_DYNAMIC_IPADDR2 8360 2.52 0.27 3.34 78 US_DOLLARS_3 8286 3.19 2.87 3.31 79 T_REMOTE_IMAGE 8250 3.08 2.49 3.29 80 BAYES_20 7642 2.67 1.61 3.05 81 HTML_IMAGE_RATIO_06 7616 3.23 3.74 3.04 82 TR_MetaPhish_Combo_01 7564 2.42 0.78 3.02 83 RCVD_IN_IADB_SENDERID 7543 2.63 1.59 3.01 84 RCVD_IN_IADB_DK 7340 2.57 1.57 2.93 85 RCVD_IN_IADB_VOUCHED 6891 2.21 0.71 2.75 86 BAYES_95 6139 2.94 4.31 2.45 87 USER_IN_DEF_DKIM_WL 6115 1.80 0.02 2.44 88 XM_OfRef6 5133 2.01 1.89 2.05 89 SUBJ_ALL_CAPS 5086 2.09 2.25 2.03 90 HTML_IMAGE_RATIO_08 5032 2.22 2.81 2.01 91 BOTNET 4959 5.23 14.21 1.98 92 MIME_HTML_ONLY_MULTI 4922 2.45 3.80 1.96 93 BAYES_05 4707 1.56 0.68 1.88 94 TM2_M_URI_OPT_OUT 4605 2.18 3.11 1.84 95 TR_Symld_Words 4547 1.76 1.63 1.81 96 XM_CamelCaseFrm001 4544 2.29 3.60 1.81 97 RCVD_IN_IADB_OPTIN 4452 1.41 0.41 1.78 98 IN_HORDE_ADDRESS_BOOK 4438 1.31 0.03 1.77 99 URI_HEX 4320 2.22 3.60 1.72 100 XMStockSpam_06 4304 1.66 1.51 1.72 101 MAILING_LIST_MULTI 4265 1.48 0.86 1.70 102 T_XMHurry_00 4209 1.69 1.72 1.68 103 URI_TRY_3LD 4046 1.47 1.07 1.61 104 RELAYCOUNTRY_CA 3835 2.41 4.85 1.53 105 XMBdyGiftCard01 3809 2.66 5.83 1.52 106 XM_PDF 3700 1.17 0.34 1.48 107 XMDiploma_00 3690 1.55 1.77 1.47 108 KHOP_HELO_FCRDNS 3474 1.68 2.48 1.39 109 XM_DK_Undo_01 3473 1.26 0.92 1.39 110 XMGappySubj_01 3465 1.08 0.25 1.38 111 UNTRUSTED_Relay 3384 4.53 13.31 1.35 112 ANY_BOUNCE_MESSAGE 3240 0.98 0.13 1.29 113 BOUNCE_MESSAGE 3237 0.98 0.13 1.29 114 HTML_MIME_NO_HTML_TAG 3196 1.64 2.64 1.28 115 XMPhish11 3101 1.15 0.90 1.24 116 NO_DNS_FOR_FROM 3098 1.49 2.21 1.24 117 T_XMDrugObfuBody_08 3079 1.43 2.00 1.23 118 TooManyTo_002 3015 1.11 0.86 1.20 119 TM2_M_A_HREF_HREF 3014 1.16 1.06 1.20 120 XM_SPF_SoftFail 2999 1.72 3.15 1.20 121 TM2_M_VERY_LONG_WORD 2990 1.45 2.18 1.19 122 XMSexyCombo_01 2963 1.58 2.69 1.18 123 XM_GoogleGroups 2939 0.96 0.39 1.17 124 XM_H_Long_From02 2710 1.18 1.47 1.08 125 PLING_QUERY 2657 1.02 0.91 1.06 126 XM_ProductURIs 2600 1.13 1.37 1.04 127 XMSubMetaI_00 2522 1.48 2.78 1.01 128 FILL_THIS_FORM 2510 0.92 0.68 1.00 129 XMBody_29 2448 0.88 0.61 0.98 130 T_XMDrugObfuBody_00 2382 1.22 1.97 0.95 131 FILL_THIS_FORM_LONG 2342 0.85 0.62 0.93 132 FILL_THIS_FORM_LOAN 2321 0.74 0.21 0.93 133 DKIM_ADSP_CUSTOM_MED 2274 0.87 0.77 0.91 134 XMBrknScrpt_02 2161 0.92 1.07 0.86 135 TooManyTo_003 2157 0.82 0.70 0.86 136 XMBody_95 2146 0.66 0.12 0.86 137 THIS_AD 2079 1.05 1.67 0.83 138 USER_IN_WHITELIST 2044 0.60 0.00 0.82 139 T_TooManySym_03 1952 0.59 0.08 0.78 140 T_FILL_THIS_FORM_SHORT 1932 0.93 1.38 0.77 141 XM_D_tchamptons_WL 1932 0.57 0.00 0.77 142 XM_UB50 1919 2.09 5.76 0.77 143 XM_B_REG_HTML 1893 1.02 1.74 0.76 144 TR_XM_RelayPhish 1880 1.07 1.96 0.75 145 HTML_TAG_BALANCE_BODY 1845 0.76 0.82 0.74 146 TooManyTo_004 1844 0.70 0.60 0.74 147 XMSubMetaSxObfu_02 1797 0.70 0.65 0.72 148 XMGenDplmaNmb 1768 0.85 1.25 0.71 149 T_MONEY_PERCENT 1705 0.70 0.75 0.68 150 TR_LOTS_OF_MONEY2 1705 0.70 0.75 0.68 151 DKIM_ADSP_NXDOMAIN 1694 1.14 2.43 0.68 152 XMSubject_48 1659 0.51 0.07 0.66 153 T_Symld_Words_02 1630 0.71 0.88 0.65 154 TooManyTo_005 1618 0.61 0.50 0.65 155 HTML_FONT_FACE_BAD 1610 0.70 0.88 0.64 156 NML_ADSP_CUSTOM_MED 1561 0.63 0.66 0.62 157 XMBody_17 1547 0.90 1.68 0.62 158 XMPhish30 1499 0.71 1.03 0.60 159 XM_B_COPY_HTML 1491 0.69 0.94 0.59 160 HELO_NODOT 1402 0.55 0.54 0.56 161 RCVD_IN_BL_SPAMCOP_NET 1371 1.32 3.44 0.55 162 XMBody_78 1371 0.62 0.82 0.55 163 HTTPS_HTTP_MISMATCH 1369 0.47 0.27 0.55 164 RDNS_DYNAMIC 1325 0.71 1.19 0.53 165 HELO_NO_DOMAIN 1308 0.53 0.54 0.52 166 XMLngstWrd_00 1305 0.55 0.62 0.52 167 XM_H_PHPMailer 1302 0.72 1.28 0.52 168 TR_XM_PHPDW 1299 0.89 1.90 0.52 169 TR_XM_PHPForged 1283 0.88 1.89 0.51 170 RELAYCOUNTRY_GB 1244 0.65 1.07 0.50 171 XMLngstWrd_01 1243 0.53 0.61 0.50 172 ACT_NOW_CAPS 1236 0.42 0.23 0.49 173 TR_LOTS_OF_MONEY3 1229 0.58 0.83 0.49 174 TR_XM_FormFill2 1228 0.85 1.86 0.49 175 XM_H_PHPOS 1223 0.85 1.85 0.49 176 XM_RXBody 1218 0.69 1.27 0.49 177 DIET_1 1157 0.71 1.41 0.46 178 XMBSHREFv2 1151 0.55 0.81 0.46 179 XMHTMLBadTable_001 1135 0.56 0.87 0.45 180 XMNoVowels 1099 0.41 0.35 0.44 181 FORGED_GMAIL_RCVD 1081 0.47 0.56 0.43 182 XMSlimDrugH 1076 0.51 0.72 0.43 183 SUBJ_DOLLARS 1054 0.58 1.01 0.42 184 NUMERIC_HTTP_ADDR 1036 0.41 0.42 0.41 185 XM_Body_Obfu01 991 0.38 0.34 0.40 186 XM_Akamai 987 0.30 0.02 0.39 187 XMSubMetaSxObfu_04 984 0.51 0.84 0.39 188 XMSubMetaSxObfu_03 976 0.59 1.14 0.39 189 RELAYCOUNTRY_AU 973 0.36 0.27 0.39 190 XMCapTrack 967 0.33 0.16 0.39 191 XMPhish14 925 0.50 0.85 0.37 192 SpammyFromTLD_01 905 0.60 1.27 0.36 193 T_TooManySym_04 901 0.27 0.02 0.36 194 URI_NOVOWEL 888 0.44 0.68 0.35 195 FSL_THIS_IS_ADV 887 0.45 0.73 0.35 196 XMHTML_After_End 867 0.45 0.75 0.35 197 MPART_ALT_DIFF_COUNT 856 0.43 0.68 0.34 198 XM_ShortIntro_01 844 0.43 0.69 0.34 199 MISSING_HEADERS 829 0.50 0.95 0.33 200 XMOemUri 799 0.29 0.21 0.32 ----------------------------------------------------------------------