Email: 719401 Autolearn: 0 AvgScore: 2.89 AvgScanTime: 3.91 sec Spam: 198599 Autolearn: 0 AvgScore: 11.65 AvgScanTime: 4.65 sec Ham: 520802 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 3.62 sec Time Spent Running SA: 780.73 hours Time Spent Processing Spam: 256.63 hours Time Spent Processing Ham: 524.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145765 79.22 73.40 81.44 2 DKIM_SIGNED 124280 66.91 62.58 68.56 3 DCC_CHECK 121368 43.68 61.11 37.03 4 BAYES_50 120334 60.31 60.59 60.20 5 XM_DK_Pass 119763 65.41 60.30 67.36 6 DKIM_VALID 112510 61.32 56.65 63.10 7 XMListUnsubscribeExists 106725 48.22 53.74 46.12 8 DKIM_VALID_AU 90975 45.44 45.81 45.30 9 XM_H_QuotedFrom 84386 38.19 42.49 36.54 10 DCC_CHECK_NEGATIVE 74575 54.53 37.55 61.00 11 BOTNET 72790 11.57 36.65 2.01 12 XM_Evil_Numbers_Gen 72222 15.75 36.37 7.89 13 LOTS_OF_MONEY 65517 14.07 32.99 6.86 14 LOC_TINY_FONT_1 57933 22.44 29.17 19.87 15 HTML_FONT_LOW_CONTRAST 57218 26.60 28.81 25.75 16 MIME_HTML_ONLY 53790 21.00 27.08 18.68 17 RCVD_IN_RP_RNBL 53424 7.55 26.90 0.17 18 XM_DK_Undo_02 50499 11.70 25.43 6.46 19 TR_LOTS_OF_MONEY3 48173 7.10 24.26 0.56 20 BOUNCE_MESSAGE 47234 11.95 23.78 7.44 21 ANY_BOUNCE_MESSAGE 47234 11.95 23.78 7.44 22 XMSubLong 43956 20.93 22.13 20.47 23 FVGT_m_MULTI_ODD 42139 20.23 21.22 19.85 24 BAYES_99 40470 9.18 20.38 4.91 25 BAYES_999 33294 7.54 16.76 4.02 26 XM_Body_Dirty_Words 32782 12.47 16.51 10.93 27 TR_DCC_Bayes_99 32781 6.48 16.51 2.65 28 T_TM2_M_HEADER_IN_MSG 31041 25.55 15.63 29.34 29 XM_Multi_Part_URI 30199 12.16 15.21 11.00 30 DKIM_VALID_EF 28447 21.88 14.32 24.76 31 T_KAM_HTML_FONT_INVALID 27155 14.86 13.67 15.31 32 RELAYCOUNTRY_META 26436 7.37 13.31 5.10 33 MultiRelay 25678 15.98 12.93 17.15 34 HTML_IMAGE_RATIO_02 23386 8.04 11.78 6.62 35 BOTNET_IPINHOSTNAME 22727 6.74 11.44 4.95 36 FSL_BULK_SIG 20436 7.30 10.29 6.15 37 DATE_IN_PAST_03_06 18600 2.63 9.37 0.06 38 XMSexyCombo_05 17098 4.73 8.61 3.24 39 UNTRUSTED_Relay 16845 3.34 8.48 1.38 40 FROM_EXCESS_BASE64 16239 4.69 8.18 3.36 41 XM_UncommonTLD01 16219 4.37 8.17 2.93 42 HTML_IMAGE_RATIO_04 15036 5.99 7.57 5.39 43 T_XMDrugObfuBody_14 14601 7.00 7.35 6.87 44 XM_B_Phish_Phrases 13818 6.11 6.96 5.79 45 XMSubMetaSx_00 13573 4.20 6.83 3.20 46 TR_XM_DocInvoice 13209 4.63 6.65 3.86 47 XM_H_Long_From01 13127 6.04 6.61 5.83 48 MPART_ALT_DIFF 11964 3.74 6.02 2.87 49 DKIM_INVALID 11770 5.59 5.93 5.47 50 TooManyTo_001 11702 7.15 5.89 7.63 51 BAYES_80 11355 3.46 5.72 2.60 52 XM_UB50 10038 1.98 5.05 0.80 53 BAYES_60 9894 4.85 4.98 4.80 54 T_REMOTE_IMAGE 9705 3.98 4.89 3.64 55 HTML_MIME_NO_HTML_TAG 8759 2.94 4.41 2.37 56 XMNumbers 8723 4.28 4.39 4.24 57 SpammyFromTLD_02 8585 1.33 4.32 0.19 58 LotsOfNums_01 8226 6.83 4.14 7.86 59 MIME_HTML_MOSTLY 7220 2.69 3.64 2.33 60 TM2_M_URI_OPT_OUT 7008 2.31 3.53 1.84 61 XMStrtUSub 6999 3.93 3.52 4.09 62 XM_DIRTYINTL 6950 2.23 3.50 1.74 63 URI_HEX 6927 1.84 3.49 1.22 64 HTML_IMAGE_RATIO_06 6760 3.18 3.40 3.09 65 BAYES_95 6436 2.02 3.24 1.56 66 XM_SPF_SoftFail 6433 2.22 3.24 1.84 67 XM_SendGrid 6064 4.67 3.05 5.28 68 MIME_HTML_ONLY_MULTI 5908 1.88 2.97 1.46 69 MISSING_HEADERS 5828 1.16 2.93 0.48 70 T_TooManySym_01 5754 4.62 2.90 5.28 71 BODY_URI_ONLY 5634 0.85 2.84 0.09 72 HTML_SHORT_LINK_IMG_1 5505 0.79 2.77 0.03 73 MultiRelay_Combo 5287 0.88 2.66 0.19 74 MultiRelay_CC 5287 0.88 2.66 0.19 75 MIME_QP_LONG_LINE 5202 4.81 2.62 5.65 76 XM_OfRef6 5136 1.95 2.59 1.70 77 RELAYCOUNTRY_CA 5118 1.83 2.58 1.54 78 XM_CamelCaseFrm001 5085 1.88 2.56 1.62 79 SHORTENER_SHORT_IMG 4946 0.69 2.49 0.00 80 URI_BUFFLY 4943 0.69 2.49 0.00 81 MIME_HEADER_CTYPE_ONLY 4799 0.78 2.42 0.16 82 XMSexyCombo_01 4598 0.95 2.32 0.43 83 RCVD_IN_RP_SAFE 4573 6.35 2.30 7.89 84 HTML_IMAGE_RATIO_08 4550 2.35 2.29 2.38 85 XMDiploma_00 4477 1.72 2.25 1.51 86 HTML_IMAGE_ONLY_04 4445 0.66 2.24 0.06 87 T_XMDrugObfuBody_08 4432 1.57 2.23 1.31 88 SUBJ_ALL_CAPS 4350 1.66 2.19 1.45 89 RCVD_IN_MSPIKE_H2 4044 3.72 2.04 4.36 90 HTML_SHORT_CENTER 4018 0.56 2.02 0.00 91 XM_URI_RBL 3936 0.76 1.98 0.29 92 XMSubMetaI_00 3646 1.14 1.84 0.87 93 RCVD_IN_RP_CERTIFIED 3591 5.56 1.81 6.99 94 UNPARSEABLE_RELAY 3283 2.51 1.65 2.84 95 BAYES_40 3283 3.95 1.65 4.83 96 XMGenDplmaNmb 3117 1.02 1.57 0.81 97 XMStockSpam_06 2974 1.21 1.50 1.10 98 ALL_TRUSTED 2950 16.79 1.49 22.62 99 RCVD_IN_BL_SPAMCOP_NET 2942 0.62 1.48 0.30 100 TR_Mismatch_TLD_02 2898 0.44 1.46 0.06 101 BOTNET_NORDNS 2798 0.42 1.41 0.04 102 HTML_TAG_BALANCE_BODY 2798 0.70 1.41 0.43 103 BAYES_00 2752 11.49 1.39 15.35 104 XMPhish11 2682 1.23 1.35 1.18 105 RELAYCOUNTRY_FR 2679 0.51 1.35 0.18 106 T_XMHurry_00 2672 1.05 1.35 0.93 107 MAILING_LIST_MULTI 2632 1.94 1.33 2.18 108 DIET_1 2629 0.63 1.32 0.37 109 T_XMDrugObfuBody_00 2599 1.18 1.31 1.13 110 US_DOLLARS_3 2593 0.81 1.31 0.62 111 RELAYCOUNTRY_DE 2578 0.62 1.30 0.36 112 BAYES_20 2567 2.96 1.29 3.60 113 XMBdyGiftCard01 2525 0.91 1.27 0.77 114 T_TooManySym_02 2420 1.65 1.22 1.82 115 NORMAL_HTTP_TO_IP 2415 0.44 1.22 0.15 116 TM2_M_VERY_LONG_WORD 2400 0.99 1.21 0.91 117 TR_XM_RelayPhish 2342 0.82 1.18 0.68 118 T_MONEY_PERCENT 2333 0.50 1.17 0.24 119 TR_LOTS_OF_MONEY2 2333 0.50 1.17 0.24 120 SpammyFromTLD_01 2325 0.78 1.17 0.63 121 RELAYCOUNTRY_CN 2199 0.35 1.11 0.07 122 XMPhish30 2147 0.60 1.08 0.41 123 TR_XM_DK_Bayes 2140 8.78 1.08 11.72 124 XM_H_Long_From02 2129 1.03 1.07 1.01 125 XM_UB60 2113 0.35 1.06 0.07 126 XMHTML_After_End 2095 0.65 1.05 0.50 127 SUBJ_DOLLARS 2068 0.47 1.04 0.25 128 XMBody_17 2035 0.72 1.02 0.60 129 URIBL_BLACK 2003 0.34 1.01 0.08 130 TR_Symld_Words 1988 1.86 1.00 2.18 131 RCVD_IN_IADB_LISTED 1966 3.95 0.99 5.07 132 RELAYCOUNTRY_AT 1951 0.53 0.98 0.35 133 T_FILL_THIS_FORM_SHORT 1934 0.85 0.97 0.80 134 TR_XM_DK_Bayes1 1930 8.10 0.97 10.82 135 XMMoneyMeta_00 1851 0.63 0.93 0.51 136 RELAYCOUNTRY_GB 1847 0.96 0.93 0.97 137 URI_TRY_3LD 1830 1.11 0.92 1.18 138 URIBL_DBL_SPAM 1773 0.26 0.89 0.02 139 PLING_QUERY 1721 0.64 0.87 0.55 140 XM_Body_Obfu01 1707 0.40 0.86 0.23 141 XMSubMetaSSx_00 1693 0.35 0.85 0.16 142 XM_ProductURIs 1693 0.75 0.85 0.70 143 RCVD_IN_IADB_SPF 1668 3.51 0.84 4.53 144 XMReplyNow 1657 0.35 0.83 0.16 145 XMSexyCombo_04 1651 0.31 0.83 0.12 146 XM_DK_Undo_01 1650 1.50 0.83 1.76 147 T_XMDrugObfuBody_01 1628 0.25 0.82 0.03 148 XMSlimDrugH 1602 0.40 0.81 0.25 149 XM_H_PHPOS 1572 1.27 0.79 1.46 150 RCVD_IN_IADB_DK 1561 3.11 0.79 3.99 151 MPART_ALT_DIFF_COUNT 1529 0.36 0.77 0.20 152 RELAYCOUNTRY_IN 1525 0.29 0.77 0.10 153 RCVD_IN_IADB_SENDERID 1517 3.12 0.76 4.02 154 TR_XM_DK_Bayes2 1512 6.88 0.76 9.21 155 BAYES_05 1498 1.76 0.75 2.15 156 FROM_SUSPICIOUS_NTLD 1490 0.24 0.75 0.05 157 XMHTMLBadTable_001 1465 0.58 0.74 0.53 158 REMOVE_BEFORE_LINK 1446 0.48 0.73 0.39 159 RCVD_IN_MSPIKE_WL 1440 1.39 0.73 1.64 160 URI_NOVOWEL 1405 0.49 0.71 0.41 161 XMPhish14 1396 0.46 0.70 0.36 162 RCVD_IN_MSPIKE_H3 1392 1.38 0.70 1.64 163 TooManyTo_002 1389 1.72 0.70 2.11 164 HTTPS_HTTP_MISMATCH 1387 0.56 0.70 0.51 165 LongTLD 1363 0.32 0.69 0.18 166 XM_UB99 1346 0.20 0.68 0.02 167 HTML_FONT_FACE_BAD 1337 0.55 0.67 0.51 168 LONG_HEX_URI 1312 0.30 0.66 0.16 169 XM_UB80 1302 0.23 0.66 0.07 170 T_Symld_Words_02 1289 0.60 0.65 0.58 171 XMGppyBdWords 1279 0.28 0.64 0.14 172 XM_RXBody 1263 0.70 0.64 0.72 173 RCVD_IN_IADB_VOUCHED 1253 2.49 0.63 3.20 174 DKIM_ADSP_CUSTOM_MED 1252 0.87 0.63 0.96 175 XM_PDF 1237 3.53 0.62 4.64 176 DKIM_ADSP_NXDOMAIN 1221 0.56 0.61 0.54 177 RELAYCOUNTRY_AU 1205 0.52 0.61 0.49 178 RELAYCOUNTRY_NL 1203 0.31 0.61 0.19 179 TooManyTo_003 1185 1.22 0.60 1.46 180 NUMERIC_HTTP_ADDR 1179 0.24 0.59 0.11 181 XM_B_REG_HTML 1176 0.55 0.59 0.54 182 LOADSA_MONEY_COMBO 1175 0.22 0.59 0.07 183 XMBody_78 1174 0.47 0.59 0.43 184 NML_ADSP_CUSTOM_MED 1173 0.62 0.59 0.64 185 HTML_IMAGE_ONLY_08 1171 0.25 0.59 0.12 186 XM_Combo_Sbj 1131 0.39 0.57 0.32 187 XM_HighProb1 1123 0.16 0.57 0.01 188 RDNS_DYNAMIC 1089 0.45 0.55 0.42 189 HTML_TEXT_INVISIBLE_STYLE 1083 0.18 0.55 0.04 190 FORGED_GMAIL_RCVD 1081 0.55 0.54 0.55 191 XM_H_PHPMailer 1076 0.58 0.54 0.59 192 T_HTML_TAG_BALANCE_CENTER 1071 0.24 0.54 0.12 193 XM_OfRef7 1044 0.28 0.53 0.19 194 XM_B_COPY_HTML 1009 0.46 0.51 0.45 195 REPLYTO_WITHOUT_TO_CC 999 0.17 0.50 0.05 196 LOW_PRICE 998 0.31 0.50 0.24 197 XMSubMetaSxObfu_03 998 0.45 0.50 0.43 198 TR_LOTS_OF_MONEY1 986 0.15 0.50 0.02 199 HTML_FONT_SIZE_LARGE 985 0.30 0.50 0.23 200 HTML_TITLE_SUBJ_DIFF 947 0.21 0.48 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 424139 79.22 73.40 81.44 2 DKIM_SIGNED 357074 66.91 62.58 68.56 3 XM_DK_Pass 350819 65.41 60.30 67.36 4 DKIM_VALID 328611 61.32 56.65 63.10 5 DCC_CHECK_NEGATIVE 317685 54.53 37.55 61.00 6 BAYES_50 313512 60.31 60.59 60.20 7 XMListUnsubscribeExists 240189 48.22 53.74 46.12 8 DKIM_VALID_AU 235945 45.44 45.81 45.30 9 DCC_CHECK 192875 43.68 61.11 37.03 10 XM_H_QuotedFrom 190322 38.19 42.49 36.54 11 T_TM2_M_HEADER_IN_MSG 152792 25.55 15.63 29.34 12 HTML_FONT_LOW_CONTRAST 134113 26.60 28.81 25.75 13 DKIM_VALID_EF 128974 21.88 14.32 24.76 14 ALL_TRUSTED 117813 16.79 1.49 22.62 15 XMSubLong 106593 20.93 22.13 20.47 16 LOC_TINY_FONT_1 103496 22.44 29.17 19.87 17 FVGT_m_MULTI_ODD 103385 20.23 21.22 19.85 18 MIME_HTML_ONLY 97274 21.00 27.08 18.68 19 MultiRelay 89295 15.98 12.93 17.15 20 BAYES_00 79930 11.49 1.39 15.35 21 T_KAM_HTML_FONT_INVALID 79755 14.86 13.67 15.31 22 TR_XM_DK_Bayes 61043 8.78 1.08 11.72 23 XM_DKIMWhitelistDomains 59027 8.22 0.05 11.33 24 XM_Multi_Part_URI 57305 12.16 15.21 11.00 25 XM_Body_Dirty_Words 56943 12.47 16.51 10.93 26 TR_XM_DK_Bayes1 56355 8.10 0.97 10.82 27 TR_XM_DK_Bayes2 47985 6.88 0.76 9.21 28 RCVD_IN_RP_SAFE 41078 6.35 2.30 7.89 29 XM_Evil_Numbers_Gen 41070 15.75 36.37 7.89 30 LotsOfNums_01 40943 6.83 4.14 7.86 31 TooManyTo_001 39757 7.15 5.89 7.63 32 ANY_BOUNCE_MESSAGE 38758 11.95 23.78 7.44 33 BOUNCE_MESSAGE 38752 11.95 23.78 7.44 34 RCVD_IN_RP_CERTIFIED 36426 5.56 1.81 6.99 35 T_XMDrugObfuBody_14 35775 7.00 7.35 6.87 36 LOTS_OF_MONEY 35724 14.07 32.99 6.86 37 HTML_IMAGE_RATIO_02 34455 8.04 11.78 6.62 38 XM_DK_Undo_02 33635 11.70 25.43 6.46 39 FSL_BULK_SIG 32050 7.30 10.29 6.15 40 XM_H_Long_From01 30360 6.04 6.61 5.83 41 XM_B_Phish_Phrases 30145 6.11 6.96 5.79 42 MIME_QP_LONG_LINE 29411 4.81 2.62 5.65 43 DKIM_INVALID 28463 5.59 5.93 5.47 44 HTML_IMAGE_RATIO_04 28046 5.99 7.57 5.39 45 XM_SendGrid 27516 4.67 3.05 5.28 46 T_TooManySym_01 27478 4.62 2.90 5.28 47 RELAYCOUNTRY_META 26556 7.37 13.31 5.10 48 RCVD_IN_IADB_LISTED 26418 3.95 0.99 5.07 49 BOTNET_IPINHOSTNAME 25773 6.74 11.44 4.95 50 BAYES_99 25573 9.18 20.38 4.91 51 BAYES_40 25160 3.95 1.65 4.83 52 BAYES_60 25014 4.85 4.98 4.80 53 XM_PDF 24153 3.53 0.62 4.64 54 RCVD_IN_IADB_SPF 23591 3.51 0.84 4.53 55 RCVD_IN_MSPIKE_H2 22731 3.72 2.04 4.36 56 XMNumbers 22063 4.28 4.39 4.24 57 XMStrtUSub 21278 3.93 3.52 4.09 58 RCVD_IN_IADB_SENDERID 20956 3.12 0.76 4.02 59 BAYES_999 20943 7.54 16.76 4.02 60 RCVD_IN_IADB_DK 20796 3.11 0.79 3.99 61 TR_XM_DocInvoice 20093 4.63 6.65 3.86 62 T_REMOTE_IMAGE 18944 3.98 4.89 3.64 63 BAYES_20 18763 2.96 1.29 3.60 64 IN_ZIMBRA_NJ_WHITELIST 18279 2.55 0.02 3.51 65 FROM_EXCESS_BASE64 17511 4.69 8.18 3.36 66 XMSexyCombo_05 16900 4.73 8.61 3.24 67 RCVD_IN_IADB_VOUCHED 16681 2.49 0.63 3.20 68 XMSubMetaSx_00 16665 4.20 6.83 3.20 69 HTML_IMAGE_RATIO_06 16081 3.18 3.40 3.09 70 XM_UncommonTLD01 15243 4.37 8.17 2.93 71 MPART_ALT_DIFF 14936 3.74 6.02 2.87 72 UNPARSEABLE_RELAY 14784 2.51 1.65 2.84 73 TR_DCC_Bayes_99 13817 6.48 16.51 2.65 74 BAYES_80 13533 3.46 5.72 2.60 75 TO_MALFORMED 13115 1.93 0.38 2.52 76 TVD_RCVD_IP 12576 1.81 0.22 2.41 77 HTML_IMAGE_RATIO_08 12388 2.35 2.29 2.38 78 HTML_MIME_NO_HTML_TAG 12367 2.94 4.41 2.37 79 MIME_HTML_MOSTLY 12126 2.69 3.64 2.33 80 TR_Symld_Words 11375 1.86 1.00 2.18 81 MAILING_LIST_MULTI 11348 1.94 1.33 2.18 82 BAYES_05 11180 1.76 0.75 2.15 83 TooManyTo_002 10986 1.72 0.70 2.11 84 RCVD_IN_IADB_OPTIN 10559 1.59 0.45 2.03 85 BOTNET 10470 11.57 36.65 2.01 86 HELO_NODOT 10046 1.49 0.34 1.93 87 TM2_M_URI_OPT_OUT 9575 2.31 3.53 1.84 88 XM_SPF_SoftFail 9566 2.22 3.24 1.84 89 T_TooManySym_02 9458 1.65 1.22 1.82 90 XM_DK_Undo_01 9153 1.50 0.83 1.76 91 XM_DIRTYINTL 9074 2.23 3.50 1.74 92 XM_OfRef6 8870 1.95 2.59 1.70 93 RCVD_IN_MSPIKE_WL 8543 1.39 0.73 1.64 94 RCVD_IN_MSPIKE_H3 8523 1.38 0.70 1.64 95 XM_CamelCaseFrm001 8440 1.88 2.56 1.62 96 BAYES_95 8125 2.02 3.24 1.56 97 RELAYCOUNTRY_CA 8025 1.83 2.58 1.54 98 XMDiploma_00 7863 1.72 2.25 1.51 99 IN_HORDE_ADDRESS_BOOK 7827 1.10 0.03 1.50 100 XMCapTrack 7802 1.15 0.23 1.50 101 TR_MetaPhish_Combo_01 7757 1.21 0.47 1.49 102 MIME_HTML_ONLY_MULTI 7615 1.88 2.97 1.46 103 XM_H_PHPOS 7594 1.27 0.79 1.46 104 TooManyTo_003 7590 1.22 0.60 1.46 105 SUBJ_ALL_CAPS 7577 1.66 2.19 1.45 106 UNTRUSTED_Relay 7185 3.34 8.48 1.38 107 INVALID_MSGID 7144 1.03 0.12 1.37 108 T_XMDrugObfuBody_08 6838 1.57 2.23 1.31 109 USER_IN_DEF_DKIM_WL 6835 0.96 0.02 1.31 110 URI_HEX 6344 1.84 3.49 1.22 111 XMPhish11 6156 1.23 1.35 1.18 112 URI_TRY_3LD 6133 1.11 0.92 1.18 113 XM_GoogleGroups 6122 0.95 0.37 1.18 114 T_XMDrugObfuBody_00 5874 1.18 1.31 1.13 115 XMStockSpam_06 5748 1.21 1.50 1.10 116 TooManyTo_004 5746 0.92 0.46 1.10 117 XM_H_Long_From02 5249 1.03 1.07 1.01 118 RELAYCOUNTRY_GB 5032 0.96 0.93 0.97 119 DKIM_ADSP_CUSTOM_MED 5003 0.87 0.63 0.96 120 T_XMHurry_00 4869 1.05 1.35 0.93 121 TooManyTo_005 4762 0.77 0.40 0.91 122 TM2_M_VERY_LONG_WORD 4741 0.99 1.21 0.91 123 XMSubMetaI_00 4536 1.14 1.84 0.87 124 URI_WP_HACKED_2 4405 0.72 0.40 0.85 125 XMSubEmpty 4217 0.67 0.29 0.81 126 XMGenDplmaNmb 4201 1.02 1.57 0.81 127 T_FILL_THIS_FORM_SHORT 4192 0.85 0.97 0.80 128 XM_UB50 4189 1.98 5.05 0.80 129 XMBdyGiftCard01 4015 0.91 1.27 0.77 130 TO_NO_BRKTS_HTML_ONLY 3887 0.58 0.14 0.75 131 XM_RXBody 3749 0.70 0.64 0.72 132 XM_ProductURIs 3671 0.75 0.85 0.70 133 XMSolicitRefs_0 3581 0.60 0.37 0.69 134 TR_XM_RelayPhish 3560 0.82 1.18 0.68 135 XMGappySubj_01 3508 0.60 0.40 0.67 136 NML_ADSP_CUSTOM_MED 3312 0.62 0.59 0.64 137 SpammyFromTLD_01 3287 0.78 1.17 0.63 138 US_DOLLARS_3 3254 0.81 1.31 0.62 139 MISSING_SUBJECT 3221 0.51 0.22 0.62 140 XMNoSubject 3221 0.51 0.22 0.62 141 XMBody_17 3126 0.72 1.02 0.60 142 T_OBFU_PDF_ATTACH 3113 0.47 0.13 0.60 143 XM_H_PHPMailer 3075 0.58 0.54 0.59 144 T_Symld_Words_02 3029 0.60 0.65 0.58 145 T_TooManySym_03 2927 0.44 0.12 0.56 146 XMNoVowels 2924 0.51 0.36 0.56 147 TR_LOTS_OF_MONEY3 2916 7.10 24.26 0.56 148 FORGED_GMAIL_RCVD 2887 0.55 0.54 0.55 149 PLING_QUERY 2857 0.64 0.87 0.55 150 XM_ShortIntro_01 2846 0.52 0.45 0.55 151 XM_B_REG_HTML 2814 0.55 0.59 0.54 152 DKIM_ADSP_NXDOMAIN 2809 0.56 0.61 0.54 153 USER_IN_WHITELIST 2764 0.38 0.00 0.53 154 XMHTMLBadTable_001 2735 0.58 0.74 0.53 155 XMLngstWrd_00 2734 0.47 0.32 0.52 156 XMMoneyMeta_00 2671 0.63 0.93 0.51 157 HTTPS_HTTP_MISMATCH 2639 0.56 0.70 0.51 158 HTML_FONT_FACE_BAD 2632 0.55 0.67 0.51 159 XMHTML_After_End 2593 0.65 1.05 0.50 160 RELAYCOUNTRY_AU 2569 0.52 0.61 0.49 161 FROM_GOV_SPOOF 2529 0.40 0.19 0.49 162 MISSING_HEADERS 2512 1.16 2.93 0.48 163 XMBrknScrpt_02 2455 0.47 0.47 0.47 164 SHORT_HELO_AND_INLINE_IMAGE 2453 0.36 0.06 0.47 165 XMLngstWrd_01 2446 0.42 0.28 0.47 166 FILL_THIS_FORM 2435 0.42 0.30 0.47 167 TM2_M_BODY_EMPTY 2380 0.36 0.09 0.46 168 XMBody_95 2360 0.35 0.10 0.45 169 T_FROM_GOV_DKIM_AU 2319 0.35 0.09 0.45 170 XM_B_COPY_HTML 2319 0.46 0.51 0.45 171 HTML_TAG_BALANCE_BODY 2265 0.70 1.41 0.43 172 XMDateMe_00 2253 0.37 0.22 0.43 173 XMSubMetaSxObfu_03 2242 0.45 0.50 0.43 174 HTML_IMAGE_ONLY_32 2241 0.36 0.18 0.43 175 XMSexyCombo_01 2239 0.95 2.32 0.43 176 XMBody_78 2217 0.47 0.59 0.43 177 RDNS_DYNAMIC 2178 0.45 0.55 0.42 178 XMPhish30 2138 0.60 1.08 0.41 179 URI_NOVOWEL 2135 0.49 0.71 0.41 180 REMOVE_BEFORE_LINK 2030 0.48 0.73 0.39 181 RCVD_IN_SORBS_DUL 2016 0.34 0.22 0.39 182 T_FILL_THIS_FORM_LONG 2009 0.33 0.17 0.39 183 XMSubMetaSxObfu_02 1964 0.36 0.31 0.38 184 HK_RANDOM_FROM 1929 0.36 0.33 0.37 185 DIET_1 1901 0.63 1.32 0.37 186 XMPhish14 1898 0.46 0.70 0.36 187 XMGappySubj_02 1894 0.30 0.13 0.36 188 RELAYCOUNTRY_DE 1891 0.62 1.30 0.36 189 XM_S_JOY_D 1889 0.38 0.44 0.36 190 HTML_IMAGE_ONLY_28 1877 0.38 0.43 0.36 191 RELAYCOUNTRY_AT 1836 0.53 0.98 0.35 192 T_FILL_THIS_FORM_LOAN 1761 0.27 0.09 0.34 193 UPPERCASE_50_75 1715 0.26 0.09 0.33 194 TVD_SPACE_RATIO 1671 0.28 0.19 0.32 195 XM_Combo_Sbj 1662 0.39 0.57 0.32 196 HTML_IMAGE_ONLY_24 1639 0.29 0.22 0.31 197 AC_DIV_BONANZA 1636 0.25 0.10 0.31 198 HTML_IMAGE_ONLY_20 1628 0.30 0.26 0.31 199 XM_H_PHPOS_M 1602 0.31 0.33 0.31 200 RCVD_IN_BL_SPAMCOP_NET 1554 0.62 1.48 0.30 ----------------------------------------------------------------------