Email: 355636 Autolearn: 0 AvgScore: 1.01 AvgScanTime: 1.93 sec Spam: 68925 Autolearn: 0 AvgScore: 12.03 AvgScanTime: 3.52 sec Ham: 286711 Autolearn: 0 AvgScore: -1.64 AvgScanTime: 1.55 sec Time Spent Running SA: 190.86 hours Time Spent Processing Spam: 67.44 hours Time Spent Processing Ham: 123.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 63236 88.24 91.75 87.39 2 DKIM_SIGNED 55837 80.54 81.01 80.42 3 DCC_CHECK 53902 55.42 78.20 49.95 4 XM_DK_Pass 53477 79.08 77.59 79.44 5 RELAYCOUNTRY_US 49265 80.84 71.48 83.09 6 XM_B_Unicode 48752 72.96 70.73 73.49 7 XMListUnsubscribeExists 46523 59.79 67.50 57.94 8 DKIM_VALID 45027 73.80 65.33 75.84 9 DKIM_VALID_AU 35018 58.96 50.81 60.92 10 BAYES_50 31985 51.45 46.41 52.67 11 XM_DK_Undo_02 29204 14.56 42.37 7.87 12 XM_B_Unicode3 28827 43.85 41.82 44.34 13 LOC_TINY_FONT_1 25007 30.94 36.28 29.65 14 HTML_FONT_LOW_CONTRAST 22537 33.25 32.70 33.39 15 MIME_HTML_ONLY 21400 24.35 31.05 22.74 16 RELAYCOUNTRY_META 19490 9.77 28.28 5.33 17 BAYES_99 18937 8.92 27.47 4.46 18 FVGT_m_MULTI_ODD 18592 22.35 26.97 21.24 19 DKIM_VALID_EF 16360 26.77 23.74 27.50 20 XMSubLong 16010 21.98 23.23 21.68 21 BOTNET 14963 6.35 21.71 2.66 22 TR_DCC_Bayes_99 14613 6.13 21.20 2.51 23 BAYES_999 14566 6.93 21.13 3.51 24 DCC_CHECK_NEGATIVE 13904 43.18 20.17 48.72 25 XM_Body_Dirty_Words 13662 14.62 19.82 13.36 26 T_KAM_HTML_FONT_INVALID 13650 18.11 19.80 17.70 27 UNTRUSTED_Relay 13145 5.11 19.07 1.75 28 XM_UncommonTLD01 12649 6.79 18.35 4.00 29 T_TM2_M_HEADER_IN_MSG 11981 22.19 17.38 23.34 30 HTML_IMAGE_RATIO_02 11647 10.35 16.90 8.77 31 DKIM_INVALID 10810 6.74 15.68 4.59 32 FSL_BULK_SIG 10610 9.71 15.39 8.34 33 BOTNET_IPINHOSTNAME 10370 7.75 15.05 6.00 34 XM_Multi_Part_URI 10336 13.31 15.00 12.91 35 XM_B_Unsub 8664 11.20 12.57 10.87 36 XMSexyCombo_05 8203 5.77 11.90 4.30 37 LOTS_OF_MONEY 8054 8.16 11.69 7.31 38 XM_UB50 8025 3.13 11.64 1.08 39 LotsOfNums_01 7357 8.22 10.67 7.63 40 NO_DNS_FOR_FROM 6952 3.89 10.09 2.40 41 XM_B_Phish_Phrases 6519 8.99 9.46 8.87 42 TooManyTo_001 6136 7.94 8.90 7.71 43 XM_H_Long_From01 6020 6.26 8.73 5.67 44 RCVD_IN_MSPIKE_BL 5948 2.67 8.63 1.24 45 XM_Evil_Numbers_Gen 5905 9.27 8.57 9.44 46 PDS_OTHER_BAD_TLD 5886 1.77 8.54 0.14 47 XM_B_SpammyTLD 5837 2.95 8.47 1.62 48 RCVD_IN_MSPIKE_L3 5818 2.58 8.44 1.17 49 RCVD_IN_MSPIKE_H2 5739 13.00 8.33 14.13 50 UNPARSEABLE_RELAY 5111 9.59 7.42 10.11 51 MPART_ALT_DIFF 5076 5.63 7.36 5.21 52 BAYES_60 4881 6.24 7.08 6.04 53 SpammyFromTLD_02 4789 1.56 6.95 0.27 54 RELAYCOUNTRY_CA 4752 2.93 6.89 1.98 55 BAYES_80 4563 4.32 6.62 3.77 56 XM_SPF_SoftFail 4305 2.12 6.25 1.12 57 FROM_SUSPICIOUS_NTLD 4147 1.19 6.02 0.04 58 XMSubMetaSx_00 4138 3.78 6.00 3.24 59 FROM_SUSPICIOUS_NTLD_FP 4125 1.19 5.98 0.03 60 MIME_HTML_MOSTLY 4119 3.57 5.98 2.99 61 HTML_IMAGE_RATIO_04 4036 7.15 5.86 7.47 62 KHOP_HELO_FCRDNS 3904 2.03 5.66 1.15 63 XM_SendGrid 3540 6.48 5.14 6.80 64 RCVD_IN_RP_SAFE 3479 10.60 5.05 11.94 65 RELAYCOUNTRY_DE 3149 1.28 4.57 0.49 66 RCVD_IN_BL_SPAMCOP_NET 3039 1.63 4.41 0.96 67 RCVD_IN_RP_CERTIFIED 3016 9.50 4.38 10.74 68 DATE_IN_PAST_03_06 3002 0.91 4.36 0.08 69 RELAYCOUNTRY_FR 2956 1.01 4.29 0.22 70 RCVD_IN_RP_RNBL 2797 0.84 4.06 0.06 71 XM_CamelCaseFrm001 2713 2.44 3.94 2.09 72 XMStrtUSub 2618 4.41 3.80 4.56 73 XM_DIRTYINTL 2556 1.14 3.71 0.52 74 T_XMHurry_00 2532 1.27 3.67 0.69 75 LongTLD 2484 0.83 3.60 0.17 76 RDNS_DYNAMIC 2460 1.06 3.57 0.46 77 T_REMOTE_IMAGE 2442 3.01 3.54 2.88 78 BAYES_95 2407 2.48 3.49 2.24 79 XMNumbers 2312 3.99 3.35 4.14 80 TM2_M_URI_OPT_OUT 2238 3.43 3.25 3.47 81 FROM_EXCESS_BASE64 2211 4.35 3.21 4.63 82 MIME_QP_LONG_LINE 2197 4.27 3.19 4.53 83 DIET_1 2136 1.42 3.10 1.01 84 BAYES_40 2052 4.46 2.98 4.81 85 TR_Mismatch_TLD_02 1952 0.67 2.83 0.15 86 SUBJ_ALL_CAPS 1942 1.54 2.82 1.24 87 T_TooManySym_01 1940 4.79 2.81 5.26 88 RCVD_IN_MSPIKE_WL 1897 8.75 2.75 10.19 89 RCVD_IN_MSPIKE_H3 1897 8.75 2.75 10.19 90 HTML_IMAGE_RATIO_08 1885 2.63 2.73 2.60 91 XMPhish30 1880 0.90 2.73 0.45 92 MIME_HTML_ONLY_MULTI 1877 2.82 2.72 2.84 93 RCVD_IN_PSBL 1855 0.59 2.69 0.09 94 XM_UB60 1837 0.57 2.67 0.07 95 XM_OfRef6 1816 1.57 2.63 1.31 96 BOTNET_NORDNS 1814 0.52 2.63 0.02 97 XM_H_TOP 1723 0.49 2.50 0.00 98 NORDNS_LOW_CONTRAST 1713 0.49 2.49 0.00 99 BAYES_20 1712 3.63 2.48 3.90 100 XM_URI_RBL 1710 0.63 2.48 0.18 101 XMBody_17 1704 1.33 2.47 1.06 102 HTML_IMAGE_RATIO_06 1701 3.87 2.47 4.21 103 FROM_MISSP_REPLYTO 1678 0.49 2.43 0.03 104 HTML_MIME_NO_HTML_TAG 1594 1.97 2.31 1.89 105 SpammyFromTLD_01 1589 0.86 2.31 0.51 106 FROM_MISSP_DYNIP 1587 0.45 2.30 0.00 107 HEXHASH_WORD 1577 0.45 2.29 0.00 108 DKIM_ADSP_CUSTOM_MED 1577 1.53 2.29 1.34 109 XMDiploma_00 1565 1.30 2.27 1.07 110 XM_B_Unsub2 1498 1.31 2.17 1.10 111 TR_XM_INV_DKIM 1488 0.50 2.16 0.10 112 TR_Mismatch_TLD_01 1466 0.72 2.13 0.38 113 FORGED_GMAIL_RCVD 1465 0.96 2.13 0.68 114 TR_XM_PHPDW 1463 0.69 2.12 0.34 115 ALL_TRUSTED 1446 10.90 2.10 13.02 116 TR_XM_PHPForged 1428 0.67 2.07 0.34 117 NML_ADSP_CUSTOM_MED 1423 1.13 2.06 0.91 118 TR_XM_FormFill2 1417 0.67 2.06 0.34 119 T_XMDrugObfuBody_08 1416 1.29 2.05 1.11 120 XM_H_PHPOS 1414 0.66 2.05 0.33 121 TM2_M_VERY_LONG_WORD 1410 1.50 2.05 1.37 122 URI_HEX 1379 1.36 2.00 1.21 123 BAYES_00 1371 16.03 1.99 19.41 124 XMSlimDrugH 1344 0.76 1.95 0.48 125 DKIM_ADSP_NXDOMAIN 1335 0.61 1.94 0.29 126 XMSubMetaI_00 1294 1.15 1.88 0.98 127 T_XMDrugObfuBody_14 1268 1.88 1.84 1.89 128 TR_XM_DK_SendGrid 1237 3.20 1.79 3.53 129 XM_H_Undi_Recip 1236 0.66 1.79 0.38 130 BODY_URI_ONLY 1215 0.37 1.76 0.04 131 XMStockSpam_06 1198 1.53 1.74 1.48 132 SCRIPT_GIBBERISH 1182 0.33 1.71 0.00 133 APP_DEVELOPMENT_NORDNS 1181 0.33 1.71 0.00 134 T_FILL_THIS_FORM_SHORT 1139 0.79 1.65 0.59 135 RELAYCOUNTRY_GB 1121 0.97 1.63 0.82 136 XMNoVowels 1113 1.46 1.61 1.42 137 TR_XM_MaxSPIKE 1109 0.34 1.61 0.04 138 XM_UB99 1095 0.31 1.59 0.01 139 URI_TRY_3LD 1094 1.48 1.59 1.45 140 RELAYCOUNTRY_UA 1091 0.31 1.58 0.01 141 XMSexyCombo_01 1078 0.66 1.56 0.44 142 XM_ProductURIs 1053 1.74 1.53 1.79 143 TR_XM_DK_Bayes 1047 12.35 1.52 14.96 144 TR_XM_Undi_Recip5 1044 0.37 1.51 0.10 145 LONG_IMG_URI 1039 0.33 1.51 0.04 146 DATE_IN_PAST_06_12 1031 0.49 1.50 0.25 147 XMSlimDrugs 1026 0.35 1.49 0.07 148 BAYES_05 1013 2.46 1.47 2.70 149 XM_H_PHPMailer 1008 0.67 1.46 0.48 150 AC_SPAMMY_URI_PATTERNS8 1003 0.28 1.46 0.00 151 XMGenDplmaNmb 1003 0.84 1.46 0.69 152 XMHTML_After_End 998 0.65 1.45 0.46 153 XMGppyBdWords 976 0.36 1.42 0.11 154 TR_XM_RelayPhish 975 0.42 1.41 0.18 155 XMBrknScrpt_02 930 0.72 1.35 0.57 156 RCVD_IN_IADB_LISTED 910 3.19 1.32 3.64 157 TR_Symld_Words 904 0.95 1.31 0.87 158 XM_H_PHPOS_M 884 0.38 1.28 0.16 159 RCVD_IN_IADB_SPF 873 2.77 1.27 3.13 160 RCVD_IN_IADB_DK 863 2.41 1.25 2.69 161 RCVD_IN_IADB_SENDERID 863 2.45 1.25 2.74 162 XMLngstWrd_00 854 0.56 1.24 0.40 163 HTML_TAG_BALANCE_CENTER 845 0.36 1.23 0.15 164 XMLngstWrd_01 835 0.52 1.21 0.36 165 XM_UB999 824 0.24 1.20 0.01 166 XM_DK_Undo_01 823 1.70 1.19 1.83 167 MAILING_LIST_MULTI 821 2.24 1.19 2.49 168 XM_B_REG_HTML 815 0.88 1.18 0.81 169 MONEY_FORM_SHORT 779 0.30 1.13 0.10 170 XMLngstWrd_02 769 0.41 1.12 0.25 171 XM_UB80 764 0.24 1.11 0.03 172 XMLngstWrd_03 750 0.36 1.09 0.19 173 URIBL_DBL_SPAM 726 0.23 1.05 0.03 174 XM_H_Long_From02 725 1.44 1.05 1.53 175 XMSubNoVowel 722 1.08 1.05 1.09 176 XMSubEmpty 718 0.39 1.04 0.23 177 TR_LOTS_OF_MONEY3 716 0.68 1.04 0.59 178 XMLngstWrd_04 714 0.33 1.04 0.15 179 THIS_AD 701 0.99 1.02 0.98 180 MPART_ALT_DIFF_COUNT 692 0.48 1.00 0.35 181 DATE_IN_PAST_12_24 689 0.26 1.00 0.08 182 XM_B_Crypto 682 0.24 0.99 0.06 183 PLING_QUERY 682 0.47 0.99 0.34 184 XMHTMLBadTable_001 677 0.61 0.98 0.52 185 T_XMDrugObfuBody_00 673 0.75 0.98 0.69 186 RELAYCOUNTRY_IN 669 0.22 0.97 0.04 187 URIBL_BLACK 669 0.20 0.97 0.01 188 MONERO_EXTORT_01 664 0.22 0.96 0.04 189 RELAYCOUNTRY_AT 655 0.32 0.95 0.17 190 TM2_M_A_HREF_HREF 654 0.49 0.95 0.38 191 TR_XM_DK_Bayes1 641 11.64 0.93 14.22 192 TR_XM_Crypto2 639 0.20 0.93 0.03 193 NO_FM_NAME_IP_HOSTN 630 0.18 0.91 0.00 194 XMPhish08 610 0.83 0.89 0.82 195 FILL_THIS_FORM 609 0.50 0.88 0.40 196 XMBody_78 599 0.48 0.87 0.39 197 HTML_IMAGE_ONLY_04 596 0.22 0.86 0.07 198 LOW_PRICE 592 0.80 0.86 0.79 199 RELAYCOUNTRY_RO 588 0.23 0.85 0.08 200 XM_B_COPY_HTML 588 0.56 0.85 0.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 250567 88.24 91.75 87.39 2 RELAYCOUNTRY_US 238220 80.84 71.48 83.09 3 DKIM_SIGNED 230587 80.54 81.01 80.42 4 XM_DK_Pass 227774 79.08 77.59 79.44 5 DKIM_VALID 217429 73.80 65.33 75.84 6 XM_B_Unicode 210718 72.96 70.73 73.49 7 DKIM_VALID_AU 174671 58.96 50.81 60.92 8 XMListUnsubscribeExists 166121 59.79 67.50 57.94 9 BAYES_50 150997 51.45 46.41 52.67 10 DCC_CHECK 143204 55.42 78.20 49.95 11 DCC_CHECK_NEGATIVE 139675 43.18 20.17 48.72 12 XM_B_Unicode3 127117 43.85 41.82 44.34 13 HTML_FONT_LOW_CONTRAST 95727 33.25 32.70 33.39 14 LOC_TINY_FONT_1 85012 30.94 36.28 29.65 15 DKIM_VALID_EF 78836 26.77 23.74 27.50 16 T_TM2_M_HEADER_IN_MSG 66931 22.19 17.38 23.34 17 MIME_HTML_ONLY 65190 24.35 31.05 22.74 18 XMSubLong 62173 21.98 23.23 21.68 19 FVGT_m_MULTI_ODD 60894 22.35 26.97 21.24 20 BAYES_00 55648 16.03 1.99 19.41 21 T_KAM_HTML_FONT_INVALID 50748 18.11 19.80 17.70 22 TR_XM_DK_Bayes 42887 12.35 1.52 14.96 23 TR_XM_DK_Bayes1 40765 11.64 0.93 14.22 24 RCVD_IN_MSPIKE_H2 40498 13.00 8.33 14.13 25 XM_Body_Dirty_Words 38316 14.62 19.82 13.36 26 TR_XM_DK_Bayes2 37926 10.83 0.84 13.23 27 ALL_TRUSTED 37324 10.90 2.10 13.02 28 XM_Multi_Part_URI 37002 13.31 15.00 12.91 29 RCVD_IN_RP_SAFE 34225 10.60 5.05 11.94 30 XM_DKIMWhitelistDomains 33956 9.55 0.03 11.84 31 XM_B_Unsub 31162 11.20 12.57 10.87 32 RCVD_IN_RP_CERTIFIED 30784 9.50 4.38 10.74 33 RCVD_IN_MSPIKE_WL 29227 8.75 2.75 10.19 34 RCVD_IN_MSPIKE_H3 29227 8.75 2.75 10.19 35 UNPARSEABLE_RELAY 28980 9.59 7.42 10.11 36 XM_Evil_Numbers_Gen 27065 9.27 8.57 9.44 37 XM_B_Phish_Phrases 25442 8.99 9.46 8.87 38 HTML_IMAGE_RATIO_02 25149 10.35 16.90 8.77 39 FSL_BULK_SIG 23909 9.71 15.39 8.34 40 XM_DK_Undo_02 22564 14.56 42.37 7.87 41 TooManyTo_001 22110 7.94 8.90 7.71 42 LotsOfNums_01 21883 8.22 10.67 7.63 43 HTML_IMAGE_RATIO_04 21408 7.15 5.86 7.47 44 LOTS_OF_MONEY 20969 8.16 11.69 7.31 45 XM_SendGrid 19502 6.48 5.14 6.80 46 BAYES_60 17322 6.24 7.08 6.04 47 BOTNET_IPINHOSTNAME 17206 7.75 15.05 6.00 48 XM_H_Long_From01 16251 6.26 8.73 5.67 49 RELAYCOUNTRY_META 15268 9.77 28.28 5.33 50 T_TooManySym_01 15083 4.79 2.81 5.26 51 MPART_ALT_DIFF 14935 5.63 7.36 5.21 52 BAYES_40 13799 4.46 2.98 4.81 53 FROM_EXCESS_BASE64 13266 4.35 3.21 4.63 54 DKIM_INVALID 13158 6.74 15.68 4.59 55 XMStrtUSub 13077 4.41 3.80 4.56 56 MIME_QP_LONG_LINE 12996 4.27 3.19 4.53 57 BAYES_99 12790 8.92 27.47 4.46 58 XMSexyCombo_05 12318 5.77 11.90 4.30 59 HTML_IMAGE_RATIO_06 12077 3.87 2.47 4.21 60 XMNumbers 11883 3.99 3.35 4.14 61 XM_UncommonTLD01 11481 6.79 18.35 4.00 62 BAYES_20 11188 3.63 2.48 3.90 63 BAYES_80 10811 4.32 6.62 3.77 64 RCVD_IN_IADB_LISTED 10449 3.19 1.32 3.64 65 TR_XM_DK_SendGrid 10134 3.20 1.79 3.53 66 BAYES_999 10063 6.93 21.13 3.51 67 TM2_M_URI_OPT_OUT 9950 3.43 3.25 3.47 68 XMSubMetaSx_00 9290 3.78 6.00 3.24 69 TVD_RCVD_IP 8988 2.66 0.68 3.13 70 RCVD_IN_IADB_SPF 8985 2.77 1.27 3.13 71 IN_ZIMBRA_NJ_WHITELIST 8645 2.43 0.01 3.02 72 MIME_HTML_MOSTLY 8578 3.57 5.98 2.99 73 T_REMOTE_IMAGE 8261 3.01 3.54 2.88 74 MIME_HTML_ONLY_MULTI 8136 2.82 2.72 2.84 75 INVALID_MSGID 8038 2.32 0.30 2.80 76 CK_HELO_DYNAMIC_SPLIT_IP 7955 2.29 0.28 2.77 77 HELO_DYNAMIC_IPADDR2 7951 2.25 0.07 2.77 78 T_TooManySym_02 7934 2.38 0.77 2.77 79 RCVD_IN_IADB_SENDERID 7849 2.45 1.25 2.74 80 BAYES_05 7738 2.46 1.47 2.70 81 RCVD_IN_IADB_DK 7710 2.41 1.25 2.69 82 BOTNET 7637 6.35 21.71 2.66 83 HTML_IMAGE_RATIO_08 7459 2.63 2.73 2.60 84 TR_DCC_Bayes_99 7191 6.13 21.20 2.51 85 MAILING_LIST_MULTI 7136 2.24 1.19 2.49 86 TO_MALFORMED 7059 2.12 0.72 2.46 87 XM_H_Trusted_IP 7038 1.98 0.00 2.45 88 NO_DNS_FOR_FROM 6876 3.89 10.09 2.40 89 XM_PDF 6732 2.01 0.60 2.35 90 ANY_BOUNCE_MESSAGE 6702 1.95 0.33 2.34 91 BOUNCE_MESSAGE 6700 1.95 0.33 2.34 92 RCVD_IN_IADB_VOUCHED 6661 1.93 0.28 2.32 93 BAYES_95 6410 2.48 3.49 2.24 94 XM_CamelCaseFrm001 5978 2.44 3.94 2.09 95 RELAYCOUNTRY_CA 5684 2.93 6.89 1.98 96 XMBdyGiftCard01 5582 1.73 0.81 1.95 97 HTML_MIME_NO_HTML_TAG 5427 1.97 2.31 1.89 98 T_XMDrugObfuBody_14 5407 1.88 1.84 1.89 99 TooManyTo_002 5320 1.63 0.72 1.86 100 XM_DK_Undo_01 5239 1.70 1.19 1.83 101 XM_ProductURIs 5123 1.74 1.53 1.79 102 IN_HORDE_ADDRESS_BOOK 5115 1.47 0.14 1.78 103 UNTRUSTED_Relay 5016 5.11 19.07 1.75 104 XM_GoogleGroups 4984 1.49 0.45 1.74 105 XM_B_SpammyTLD 4652 2.95 8.47 1.62 106 XM_H_Long_From02 4387 1.44 1.05 1.53 107 RCVD_IN_IADB_OPTIN 4276 1.26 0.32 1.49 108 XMStockSpam_06 4230 1.53 1.74 1.48 109 URI_TRY_3LD 4168 1.48 1.59 1.45 110 XMNoVowels 4063 1.46 1.61 1.42 111 USER_IN_DEF_DKIM_WL 4027 1.13 0.00 1.40 112 TooManyTo_003 3947 1.23 0.61 1.38 113 TM2_M_VERY_LONG_WORD 3930 1.50 2.05 1.37 114 DKIM_ADSP_CUSTOM_MED 3851 1.53 2.29 1.34 115 XM_OfRef6 3756 1.57 2.63 1.31 116 RCVD_IN_MSPIKE_BL 3561 2.67 8.63 1.24 117 SUBJ_ALL_CAPS 3546 1.54 2.82 1.24 118 HTML_FONT_FACE_BAD 3502 1.10 0.59 1.22 119 URI_HEX 3466 1.36 2.00 1.21 120 RCVD_IN_MSPIKE_L3 3359 2.58 8.44 1.17 121 XMGappySubj_01 3350 0.97 0.16 1.17 122 TooManyTo_004 3337 1.04 0.53 1.16 123 KHOP_HELO_FCRDNS 3303 2.03 5.66 1.15 124 XM_SPF_SoftFail 3225 2.12 6.25 1.12 125 T_XMDrugObfuBody_08 3184 1.29 2.05 1.11 126 XM_B_Unsub2 3146 1.31 2.17 1.10 127 XMSubNoVowel 3123 1.08 1.05 1.09 128 XM_UB50 3106 3.13 11.64 1.08 129 XMDiploma_00 3071 1.30 2.27 1.07 130 XMBody_17 3035 1.33 2.47 1.06 131 TooManyTo_005 2905 0.90 0.42 1.01 132 DIET_1 2897 1.42 3.10 1.01 133 TR_LOTS_OF_MONEY2 2855 0.97 0.84 1.00 134 T_MONEY_PERCENT 2855 0.97 0.84 1.00 135 XMSubMetaI_00 2805 1.15 1.88 0.98 136 THIS_AD 2804 0.99 1.02 0.98 137 RCVD_IN_BL_SPAMCOP_NET 2760 1.63 4.41 0.96 138 TR_MetaPhish_Combo_01 2674 0.88 0.69 0.93 139 NML_ADSP_CUSTOM_MED 2595 1.13 2.06 0.91 140 TR_MSPIKEBAYES00 2534 0.71 0.00 0.88 141 TR_Symld_Words 2485 0.95 1.31 0.87 142 XMPhish08 2350 0.83 0.89 0.82 143 RELAYCOUNTRY_GB 2341 0.97 1.63 0.82 144 XM_B_REG_HTML 2321 0.88 1.18 0.81 145 T_TooManySym_03 2319 0.71 0.31 0.81 146 LOW_PRICE 2253 0.80 0.86 0.79 147 USER_IN_WHITELIST 2172 0.61 0.00 0.76 148 HELO_NODOT 2102 0.71 0.59 0.73 149 HELO_NO_DOMAIN 2094 0.70 0.59 0.73 150 T_XMDrugObfuBody_00 1992 0.75 0.98 0.69 151 XMGenDplmaNmb 1979 0.84 1.46 0.69 152 T_XMHurry_00 1975 1.27 3.67 0.69 153 FORGED_GMAIL_RCVD 1938 0.96 2.13 0.68 154 HTML_IMAGE_ONLY_20 1933 0.61 0.35 0.67 155 HTTPS_HTTP_MISMATCH 1887 0.67 0.74 0.66 156 XMSolicitRefs_0 1779 0.58 0.40 0.62 157 XMCapTrack 1745 0.59 0.53 0.61 158 TR_LOTS_OF_MONEY3 1695 0.68 1.04 0.59 159 T_FILL_THIS_FORM_SHORT 1683 0.79 1.65 0.59 160 XMBrknScrpt_02 1620 0.72 1.35 0.57 161 XMHTMLBadTable_001 1499 0.61 0.98 0.52 162 XM_DIRTYINTL 1496 1.14 3.71 0.52 163 SpammyFromTLD_01 1456 0.86 2.31 0.51 164 NUMERIC_HTTP_ADDR 1432 0.44 0.20 0.50 165 XM_B_COPY_HTML 1421 0.56 0.85 0.50 166 RELAYCOUNTRY_DE 1395 1.28 4.57 0.49 167 XMSlimDrugH 1375 0.76 1.95 0.48 168 XM_H_PHPMailer 1364 0.67 1.46 0.48 169 XMPhish14 1355 0.53 0.78 0.47 170 RDNS_DYNAMIC 1323 1.06 3.57 0.46 171 XMHTML_After_End 1314 0.65 1.45 0.46 172 XMPhish30 1303 0.90 2.73 0.45 173 XMSexyCombo_01 1275 0.66 1.56 0.44 174 SUBJ_DOLLARS 1266 0.47 0.59 0.44 175 MISSING_HEADERS 1261 0.51 0.80 0.44 176 XM_Walgreens_Forge 1251 0.35 0.01 0.44 177 XMSubMetaSxObfu_02 1248 0.41 0.31 0.44 178 HTML_TAG_BALANCE_BODY 1225 0.48 0.71 0.43 179 XMSubMetaSxObfu_03 1213 0.45 0.56 0.42 180 T_OBFU_PDF_ATTACH 1197 0.35 0.06 0.42 181 FILL_THIS_FORM 1152 0.50 0.88 0.40 182 XMBSHREFv2 1152 0.40 0.37 0.40 183 XMLngstWrd_00 1149 0.56 1.24 0.40 184 XMBody_78 1120 0.48 0.87 0.39 185 XM_Lotto 1103 0.36 0.26 0.38 186 XM_H_Undi_Recip 1097 0.66 1.79 0.38 187 T_TooManySym_04 1087 0.34 0.16 0.38 188 TM2_M_A_HREF_HREF 1087 0.49 0.95 0.38 189 TR_Mismatch_TLD_01 1086 0.72 2.13 0.38 190 RELAYCOUNTRY_AU 1084 0.38 0.39 0.38 191 TVD_SPACE_RATIO 1063 0.34 0.20 0.37 192 XM_RXBody 1038 0.43 0.71 0.36 193 XM_Akamai 1032 0.30 0.04 0.36 194 XMBody_95 1027 0.31 0.09 0.36 195 XMLngstWrd_01 1026 0.52 1.21 0.36 196 XM_E_Blogspot 1024 0.34 0.26 0.36 197 MPART_ALT_DIFF_COUNT 1013 0.48 1.00 0.35 198 BASE64_LENGTH_79_INF 989 0.30 0.13 0.34 199 XMSolicitRefs_4 983 0.29 0.05 0.34 200 TR_XM_PHPDW 980 0.69 2.12 0.34 ----------------------------------------------------------------------