Email: 620530 Autolearn: 0 AvgScore: 2.64 AvgScanTime: 2.04 sec Spam: 168789 Autolearn: 0 AvgScore: 12.44 AvgScanTime: 2.31 sec Ham: 451741 Autolearn: 0 AvgScore: -1.02 AvgScanTime: 1.94 sec Time Spent Running SA: 352.08 hours Time Spent Processing Spam: 108.40 hours Time Spent Processing Ham: 243.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162085 89.97 96.03 87.71 2 DKIM_SIGNED 139396 77.44 82.59 75.51 3 XM_DK_Pass 135652 75.89 80.37 74.21 4 DCC_CHECK 135564 49.66 80.32 38.21 5 DKIM_VALID 129017 72.14 76.44 70.53 6 XMListUnsubscribeExists 126841 57.66 75.15 51.13 7 DKIM_VALID_AU 104992 53.24 62.20 49.89 8 XM_DK_Undo_02 84918 25.16 50.31 15.77 9 XM_H_QuotedFrom 83279 40.36 49.34 37.01 10 BAYES_99 74894 22.47 44.37 14.28 11 HTML_FONT_LOW_CONTRAST 65678 31.24 38.91 28.37 12 BAYES_999 63453 19.46 37.59 12.68 13 TR_DCC_Bayes_99 60769 14.71 36.00 6.76 14 LOC_TINY_FONT_1 56804 25.27 33.65 22.14 15 MIME_HTML_ONLY 55715 24.03 33.01 20.68 16 BAYES_50 55246 47.25 32.73 52.67 17 FVGT_m_MULTI_ODD 47814 22.87 28.33 20.84 18 XMSubLong 45631 23.23 27.03 21.80 19 DKIM_VALID_EF 40058 26.48 23.73 27.51 20 T_KAM_HTML_FONT_INVALID 33488 18.11 19.84 17.47 21 XM_Body_Dirty_Words 33303 14.24 19.73 12.19 22 RELAYCOUNTRY_META 31721 9.05 18.79 5.41 23 T_TM2_M_HEADER_IN_MSG 31130 27.16 18.44 30.42 24 DCC_CHECK_NEGATIVE 30224 48.39 17.91 59.78 25 HTML_IMAGE_RATIO_02 29880 10.78 17.70 8.20 26 BOTNET 26937 5.72 15.96 1.89 27 XM_Multi_Part_URI 24749 13.20 14.66 12.65 28 MultiRelay 23138 17.14 13.71 18.42 29 BOTNET_IPINHOSTNAME 21847 7.05 12.94 4.85 30 XM_Evil_Numbers_Gen 20909 10.02 12.39 9.13 31 FSL_BULK_SIG 20344 8.04 12.05 6.53 32 LOTS_OF_MONEY 19587 10.33 11.60 9.85 33 UNTRUSTED_Relay 19479 4.26 11.54 1.54 34 XMSexyCombo_05 18354 5.75 10.87 3.83 35 TooManyTo_001 17508 8.91 10.37 8.36 36 XM_UncommonTLD01 16205 5.00 9.60 3.28 37 XMSubMetaSx_00 14587 5.13 8.64 3.82 38 HTML_IMAGE_RATIO_04 13320 6.43 7.89 5.89 39 T_XMDrugObfuBody_14 13001 8.02 7.70 8.14 40 XM_B_Phish_Phrases 12874 6.48 7.63 6.05 41 BAYES_80 12795 5.05 7.58 4.10 42 MPART_ALT_DIFF 12402 4.37 7.35 3.25 43 LotsOfNums_01 11544 8.24 6.84 8.77 44 XM_H_Long_From01 11535 6.69 6.83 6.63 45 BAYES_60 10792 6.31 6.39 6.28 46 XM_UB50 10765 2.42 6.38 0.94 47 FROM_EXCESS_BASE64 10430 4.56 6.18 3.95 48 DKIM_INVALID 10379 5.30 6.15 4.98 49 SpammyFromTLD_02 9566 1.80 5.67 0.36 50 HTML_IMAGE_RATIO_06 9159 4.11 5.43 3.62 51 XMNumbers 7780 3.21 4.61 2.68 52 XM_DIRTYINTL 7596 2.58 4.50 1.86 53 BAYES_95 7541 3.33 4.47 2.91 54 HTML_IMAGE_RATIO_08 7334 2.82 4.35 2.26 55 T_REMOTE_IMAGE 7250 4.24 4.30 4.22 56 NUMERIC_HTTP_ADDR 7186 1.47 4.26 0.44 57 RELAYCOUNTRY_CA 7022 2.23 4.16 1.51 58 MIME_HTML_MOSTLY 6648 2.67 3.94 2.20 59 XMStrtUSub 6641 4.02 3.93 4.05 60 RCVD_IN_RP_SAFE 6536 8.61 3.87 10.38 61 FROM_SUSPICIOUS_NTLD 6534 1.08 3.87 0.04 62 NORMAL_HTTP_TO_IP 6459 1.08 3.83 0.05 63 MIME_HTML_ONLY_MULTI 6411 2.28 3.80 1.71 64 MIME_QP_LONG_LINE 6328 5.66 3.75 6.38 65 XM_SPF_SoftFail 6131 2.60 3.63 2.21 66 DKIM_ADSP_NXDOMAIN 6046 1.51 3.58 0.73 67 TM2_M_URI_OPT_OUT 5952 2.40 3.53 1.98 68 XM_CamelCaseFrm001 5911 2.25 3.50 1.79 69 RELAYCOUNTRY_DE 5644 1.33 3.34 0.58 70 XM_SendGrid 5601 5.13 3.32 5.81 71 XM_URI_RBL 5370 1.25 3.18 0.53 72 URI_HEX 5333 2.32 3.16 2.00 73 HTML_MIME_NO_HTML_TAG 5096 2.89 3.02 2.84 74 XM_H_TOP 4984 0.81 2.95 0.01 75 RCVD_IN_RP_CERTIFIED 4899 7.53 2.90 9.26 76 RCVD_IN_RP_RNBL 4831 0.80 2.86 0.04 77 MIME_HEADER_CTYPE_ONLY 4668 0.84 2.77 0.12 78 RCVD_IN_MSPIKE_H2 4615 4.08 2.73 4.58 79 HTML_IMAGE_ONLY_12 4559 0.90 2.70 0.23 80 XM_OfRef6 4554 1.85 2.70 1.54 81 HDRS_LCASE_IMGONLY 4400 0.73 2.61 0.03 82 DATE_IN_PAST_06_12 4277 0.72 2.53 0.05 83 XMDiploma_00 4233 1.96 2.51 1.76 84 XM_H_Long_From02 4185 1.41 2.48 1.01 85 XMBdyGiftCard01 4076 1.39 2.41 1.01 86 T_TooManySym_01 3932 4.53 2.33 5.36 87 MultiRelay_CC 3911 0.75 2.32 0.17 88 MultiRelay_Combo 3911 0.75 2.32 0.17 89 RCVD_IN_BL_SPAMCOP_NET 3822 0.95 2.26 0.46 90 HTML_FONT_SIZE_LARGE 3802 0.75 2.25 0.18 91 MPART_ALT_DIFF_COUNT 3729 0.78 2.21 0.25 92 T_XMDrugObfuBody_08 3496 1.73 2.07 1.60 93 RCVD_IN_IADB_LISTED 3379 5.04 2.00 6.18 94 BAD_ENC_HEADER 3287 0.55 1.95 0.03 95 SUBJ_ALL_CAPS 3284 1.85 1.95 1.81 96 T_HTML_TAG_BALANCE_CENTER 3267 0.59 1.94 0.09 97 NO_DNS_FOR_FROM 3145 1.34 1.86 1.15 98 XMSexyCombo_01 3037 0.89 1.80 0.55 99 BOTNET_NORDNS 3007 0.49 1.78 0.01 100 XMSubMetaI_00 2968 0.89 1.76 0.56 101 XMBrknScrpt_02 2962 0.95 1.75 0.65 102 RELAYCOUNTRY_GB 2934 1.22 1.74 1.03 103 DATE_IN_PAST_03_06 2920 0.52 1.73 0.07 104 MAILING_LIST_MULTI 2915 2.19 1.73 2.36 105 XMGenDplmaNmb 2902 1.22 1.72 1.03 106 XM_UB99 2845 0.48 1.69 0.02 107 TM2_M_VERY_LONG_WORD 2824 1.14 1.67 0.94 108 ALL_TRUSTED 2823 12.05 1.67 15.93 109 BODY_URI_ONLY 2811 0.52 1.67 0.10 110 DIET_1 2788 0.74 1.65 0.39 111 RCVD_IN_IADB_SPF 2768 4.36 1.64 5.37 112 SpammyFromTLD_01 2650 1.00 1.57 0.78 113 XM_UB60 2646 0.50 1.57 0.11 114 TR_XM_RelayPhish 2605 0.85 1.54 0.60 115 XMPhish11 2543 1.29 1.51 1.21 116 UNPARSEABLE_RELAY 2521 2.37 1.49 2.70 117 RCVD_IN_IADB_SENDERID 2486 3.83 1.47 4.72 118 HTML_SHORT_LINK_IMG_3 2468 0.44 1.46 0.06 119 RCVD_IN_IADB_DK 2459 3.75 1.46 4.61 120 XMStockSpam_06 2447 1.39 1.45 1.37 121 BAYES_40 2437 3.14 1.44 3.77 122 RELAYCOUNTRY_FR 2437 0.57 1.44 0.24 123 HTML_IMAGE_ONLY_28 2384 0.67 1.41 0.39 124 HTML_SHORT_LINK_IMG_1 2363 0.40 1.40 0.03 125 XM_UB999 2320 0.39 1.37 0.02 126 XMSubMetaSxObfu_03 2270 0.61 1.34 0.33 127 T_FILL_THIS_FORM_SHORT 2244 1.04 1.33 0.93 128 RCVD_IN_PSBL 2213 0.36 1.31 0.00 129 TR_LOTS_OF_MONEY3 2206 0.87 1.31 0.70 130 URI_TRY_3LD 2188 1.29 1.30 1.28 131 T_XMDrugObfuBody_00 2187 0.93 1.30 0.79 132 HTML_IMAGE_ONLY_16 2141 0.53 1.27 0.25 133 RCVD_IN_IADB_VOUCHED 2138 3.20 1.27 3.92 134 XMBody_17 2092 0.72 1.24 0.53 135 T_XMHurry_00 2081 0.85 1.23 0.70 136 HELO_NODOT 2061 1.54 1.22 1.66 137 HTML_IMAGE_ONLY_24 2058 0.57 1.22 0.33 138 XMMoneyMeta_00 2038 0.73 1.21 0.55 139 XM_DK_Undo_01 1995 1.63 1.18 1.80 140 TR_Caps_n_Bayes_99 1993 0.44 1.18 0.17 141 XMLongAddy 1993 0.35 1.18 0.03 142 XM_ProductURIs 1983 0.86 1.17 0.74 143 XM_salutation2 1980 0.84 1.17 0.72 144 XMPhish30 1959 0.64 1.16 0.44 145 BAYES_20 1956 2.27 1.16 2.69 146 HTML_SHORT_LINK_IMG_2 1952 0.36 1.16 0.06 147 TVD_IP_HEX 1921 0.31 1.14 0.00 148 TVD_IP_SING_HEX 1920 0.31 1.14 0.00 149 URI_HEX_IP 1920 0.31 1.14 0.00 150 XMHTML_After_End 1909 0.63 1.13 0.45 151 XMBody_78 1901 0.60 1.13 0.41 152 TR_LOTS_OF_MONEY2 1859 0.56 1.10 0.36 153 T_MONEY_PERCENT 1859 0.56 1.10 0.36 154 XMSubNoVowel 1826 0.65 1.08 0.49 155 RDNS_DYNAMIC 1826 0.61 1.08 0.44 156 XMHTMLBadTable_001 1820 0.60 1.08 0.42 157 PLING_QUERY 1802 0.65 1.07 0.49 158 FVGT_m_MULTI_ODD_EMAIL 1800 0.31 1.07 0.02 159 TR_Symld_Words 1780 1.62 1.05 1.83 160 T_Symld_Words_02 1779 0.69 1.05 0.55 161 RELAYCOUNTRY_CN 1771 0.35 1.05 0.09 162 URIBL_BLACK 1744 0.32 1.03 0.05 163 TR_M_TOP_BAYES 1738 0.28 1.03 0.00 164 BASE64_LENGTH_79_INF 1709 0.52 1.01 0.34 165 TR_Mismatch_TLD_02 1687 0.36 1.00 0.12 166 RELAYCOUNTRY_AT 1686 0.40 1.00 0.18 167 FSL_THIS_IS_ADV 1655 0.32 0.98 0.07 168 HELO_NO_DOMAIN 1649 1.45 0.98 1.62 169 XM_UB80 1596 0.29 0.95 0.05 170 NORDNS_LOW_CONTRAST 1595 0.26 0.94 0.01 171 XM_Combo_Sbj 1591 0.47 0.94 0.30 172 XMPhish14 1580 0.50 0.94 0.33 173 XM_HighProb1 1574 0.30 0.93 0.06 174 URIBL_RHS_DOB 1522 0.27 0.90 0.03 175 CHARSET_FARAWAY_HEADER 1521 0.28 0.90 0.05 176 TR_MetaPhish_Combo_01 1503 1.35 0.89 1.52 177 BAYES_00 1503 8.37 0.89 11.16 178 RELAYCOUNTRY_IN 1503 0.33 0.89 0.12 179 FILL_THIS_FORM 1498 0.52 0.89 0.39 180 XM_B_REG_HTML 1485 0.56 0.88 0.44 181 HTML_FONT_SIZE_HUGE 1481 0.33 0.88 0.12 182 XMSlimDrugH 1466 0.50 0.87 0.36 183 HTML_IMAGE_ONLY_20 1455 0.43 0.86 0.27 184 XM_H_PHPOS 1450 0.99 0.86 1.04 185 BODY_ENHANCEMENT 1450 0.25 0.86 0.02 186 XMSubMetaSSx_00 1444 0.38 0.86 0.20 187 HK_RANDOM_FROM 1427 0.33 0.85 0.14 188 HTML_FONT_FACE_BAD 1425 0.64 0.84 0.56 189 RCVD_IN_IADB_OPTIN 1419 2.07 0.84 2.53 190 XMSubMetaSxObfu_02 1417 0.57 0.84 0.47 191 TooManyTo_002 1407 1.95 0.83 2.37 192 HTML_TAG_BALANCE_BODY 1402 0.69 0.83 0.64 193 XM_Body_Obfu01 1367 0.41 0.81 0.26 194 FILL_THIS_FORM_LONG 1364 0.44 0.81 0.30 195 XMSubEmpty 1363 0.54 0.81 0.45 196 URI_NOVOWEL 1344 0.58 0.80 0.50 197 SUBJ_ILLEGAL_CHARS 1315 0.21 0.78 0.00 198 TO_NO_BRKTS_PCNT 1309 0.21 0.78 0.00 199 LONG_JUNK_URI 1302 0.26 0.77 0.06 200 BAYES_05 1251 1.47 0.74 1.75 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 396217 89.97 96.03 87.71 2 DKIM_SIGNED 341130 77.44 82.59 75.51 3 XM_DK_Pass 335243 75.89 80.37 74.21 4 DKIM_VALID 318619 72.14 76.44 70.53 5 DCC_CHECK_NEGATIVE 270055 48.39 17.91 59.78 6 BAYES_50 237937 47.25 32.73 52.67 7 XMListUnsubscribeExists 230981 57.66 75.15 51.13 8 DKIM_VALID_AU 225360 53.24 62.20 49.89 9 DCC_CHECK 172613 49.66 80.32 38.21 10 XM_H_QuotedFrom 167190 40.36 49.34 37.01 11 T_TM2_M_HEADER_IN_MSG 137399 27.16 18.44 30.42 12 HTML_FONT_LOW_CONTRAST 128155 31.24 38.91 28.37 13 DKIM_VALID_EF 124260 26.48 23.73 27.51 14 LOC_TINY_FONT_1 100007 25.27 33.65 22.14 15 XMSubLong 98495 23.23 27.03 21.80 16 FVGT_m_MULTI_ODD 94126 22.87 28.33 20.84 17 MIME_HTML_ONLY 93416 24.03 33.01 20.68 18 MultiRelay 83195 17.14 13.71 18.42 19 T_KAM_HTML_FONT_INVALID 78899 18.11 19.84 17.47 20 ALL_TRUSTED 71969 12.05 1.67 15.93 21 XM_DK_Undo_02 71237 25.16 50.31 15.77 22 BAYES_99 64514 22.47 44.37 14.28 23 XM_DKIMWhitelistDomains 60218 9.71 0.02 13.33 24 BAYES_999 57289 19.46 37.59 12.68 25 XM_Multi_Part_URI 57131 13.20 14.66 12.65 26 XM_Body_Dirty_Words 55050 14.24 19.73 12.19 27 BAYES_00 50411 8.37 0.89 11.16 28 RCVD_IN_RP_SAFE 46911 8.61 3.87 10.38 29 LOTS_OF_MONEY 44492 10.33 11.60 9.85 30 RCVD_IN_RP_CERTIFIED 41815 7.53 2.90 9.26 31 XM_Evil_Numbers_Gen 41266 10.02 12.39 9.13 32 LotsOfNums_01 39617 8.24 6.84 8.77 33 TR_XM_DK_Bayes 38474 6.33 0.48 8.52 34 TooManyTo_001 37757 8.91 10.37 8.36 35 HTML_IMAGE_RATIO_02 37025 10.78 17.70 8.20 36 T_XMDrugObfuBody_14 36768 8.02 7.70 8.14 37 TR_XM_DK_Bayes1 36487 6.00 0.44 8.08 38 TR_XM_DK_Bayes2 31420 5.16 0.35 6.96 39 TR_DCC_Bayes_99 30530 14.71 36.00 6.76 40 XM_H_Long_From01 29962 6.69 6.83 6.63 41 FSL_BULK_SIG 29518 8.04 12.05 6.53 42 MIME_QP_LONG_LINE 28825 5.66 3.75 6.38 43 BAYES_60 28347 6.31 6.39 6.28 44 RCVD_IN_IADB_LISTED 27915 5.04 2.00 6.18 45 XM_B_Phish_Phrases 27311 6.48 7.63 6.05 46 HTML_IMAGE_RATIO_04 26588 6.43 7.89 5.89 47 XM_SendGrid 26242 5.13 3.32 5.81 48 RELAYCOUNTRY_META 24459 9.05 18.79 5.41 49 RCVD_IN_IADB_SPF 24264 4.36 1.64 5.37 50 T_TooManySym_01 24198 4.53 2.33 5.36 51 XM_PDF 22660 3.84 0.70 5.02 52 DKIM_INVALID 22511 5.30 6.15 4.98 53 BOTNET_IPINHOSTNAME 21914 7.05 12.94 4.85 54 RCVD_IN_IADB_SENDERID 21301 3.83 1.47 4.72 55 RCVD_IN_IADB_DK 20836 3.75 1.46 4.61 56 RCVD_IN_MSPIKE_H2 20701 4.08 2.73 4.58 57 T_REMOTE_IMAGE 19085 4.24 4.30 4.22 58 IN_ZIMBRA_NJ_WHITELIST 18752 3.03 0.02 4.15 59 BAYES_80 18513 5.05 7.58 4.10 60 XMStrtUSub 18297 4.02 3.93 4.05 61 FROM_EXCESS_BASE64 17855 4.56 6.18 3.95 62 RCVD_IN_IADB_VOUCHED 17700 3.20 1.27 3.92 63 XMSexyCombo_05 17307 5.75 10.87 3.83 64 XMSubMetaSx_00 17252 5.13 8.64 3.82 65 BAYES_40 17018 3.14 1.44 3.77 66 HTML_IMAGE_RATIO_06 16333 4.11 5.43 3.62 67 XM_UncommonTLD01 14807 5.00 9.60 3.28 68 MPART_ALT_DIFF 14694 4.37 7.35 3.25 69 BAYES_95 13125 3.33 4.47 2.91 70 HTML_MIME_NO_HTML_TAG 12809 2.89 3.02 2.84 71 TO_MALFORMED 12197 1.97 0.02 2.70 72 UNPARSEABLE_RELAY 12182 2.37 1.49 2.70 73 BAYES_20 12161 2.27 1.16 2.69 74 XMNumbers 12125 3.21 4.61 2.68 75 TVD_RCVD_IP 11946 2.00 0.27 2.64 76 RCVD_IN_IADB_OPTIN 11439 2.07 0.84 2.53 77 TooManyTo_002 10703 1.95 0.83 2.37 78 MAILING_LIST_MULTI 10661 2.19 1.73 2.36 79 HTML_IMAGE_RATIO_08 10189 2.82 4.35 2.26 80 XM_SPF_SoftFail 10002 2.60 3.63 2.21 81 MIME_HTML_MOSTLY 9930 2.67 3.94 2.20 82 RCVD_IN_MSPIKE_WL 9640 1.69 0.49 2.13 83 RCVD_IN_MSPIKE_H3 9637 1.69 0.49 2.13 84 URI_HEX 9050 2.32 3.16 2.00 85 TM2_M_URI_OPT_OUT 8962 2.40 3.53 1.98 86 ANY_BOUNCE_MESSAGE 8823 1.57 0.53 1.95 87 BOUNCE_MESSAGE 8775 1.56 0.53 1.94 88 BOTNET 8548 5.72 15.96 1.89 89 XM_DIRTYINTL 8393 2.58 4.50 1.86 90 TR_Symld_Words 8269 1.62 1.05 1.83 91 SUBJ_ALL_CAPS 8171 1.85 1.95 1.81 92 XM_DK_Undo_01 8137 1.63 1.18 1.80 93 XM_CamelCaseFrm001 8072 2.25 3.50 1.79 94 XMDiploma_00 7936 1.96 2.51 1.76 95 IN_HORDE_ADDRESS_BOOK 7916 1.29 0.04 1.75 96 T_TooManySym_02 7910 1.43 0.58 1.75 97 BAYES_05 7884 1.47 0.74 1.75 98 MIME_HTML_ONLY_MULTI 7747 2.28 3.80 1.71 99 HELO_NODOT 7502 1.54 1.22 1.66 100 INVALID_MSGID 7483 1.35 0.53 1.66 101 HELO_NO_DOMAIN 7335 1.45 0.98 1.62 102 T_XMDrugObfuBody_08 7235 1.73 2.07 1.60 103 TooManyTo_003 7127 1.34 0.71 1.58 104 XM_OfRef6 6949 1.85 2.70 1.54 105 UNTRUSTED_Relay 6940 4.26 11.54 1.54 106 TR_MetaPhish_Combo_01 6851 1.35 0.89 1.52 107 RELAYCOUNTRY_CA 6816 2.23 4.16 1.51 108 XMStockSpam_06 6204 1.39 1.45 1.37 109 XMCapTrack 6101 1.04 0.22 1.35 110 URI_TRY_3LD 5799 1.29 1.30 1.28 111 XM_GoogleGroups 5498 1.00 0.42 1.22 112 XMPhish11 5474 1.29 1.51 1.21 113 USER_IN_DEF_DKIM_WL 5367 0.87 0.00 1.19 114 TooManyTo_004 5226 1.01 0.63 1.16 115 NO_DNS_FOR_FROM 5194 1.34 1.86 1.15 116 DKIM_ADSP_CUSTOM_MED 4981 0.97 0.60 1.10 117 XM_H_PHPOS 4702 0.99 0.86 1.04 118 RELAYCOUNTRY_GB 4652 1.22 1.74 1.03 119 XMGenDplmaNmb 4645 1.22 1.72 1.03 120 XMBdyGiftCard01 4552 1.39 2.41 1.01 121 XM_H_Long_From02 4543 1.41 2.48 1.01 122 TM2_M_VERY_LONG_WORD 4250 1.14 1.67 0.94 123 XM_UB50 4247 2.42 6.38 0.94 124 T_FILL_THIS_FORM_SHORT 4195 1.04 1.33 0.93 125 TooManyTo_005 4174 0.81 0.49 0.92 126 XMGappySubj_01 3875 0.76 0.49 0.86 127 XM_H_Undi_Recip 3726 0.72 0.46 0.82 128 T_XMDrugObfuBody_00 3563 0.93 1.30 0.79 129 SpammyFromTLD_01 3528 1.00 1.57 0.78 130 NML_ADSP_CUSTOM_MED 3477 0.71 0.56 0.77 131 XM_ProductURIs 3340 0.86 1.17 0.74 132 DKIM_ADSP_NXDOMAIN 3311 1.51 3.58 0.73 133 TM2_M_A_HREF_HREF 3282 0.67 0.53 0.73 134 XM_salutation2 3262 0.84 1.17 0.72 135 XM_ShortIntro_01 3191 0.62 0.40 0.71 136 TR_LOTS_OF_MONEY3 3172 0.87 1.31 0.70 137 T_XMHurry_00 3164 0.85 1.23 0.70 138 T_OBFU_PDF_ATTACH 3088 0.53 0.13 0.68 139 XMBody_95 2985 0.50 0.08 0.66 140 XMBrknScrpt_02 2949 0.95 1.75 0.65 141 XMNoVowels 2914 0.60 0.48 0.65 142 HTML_TAG_BALANCE_BODY 2901 0.69 0.83 0.64 143 HTTPS_HTTP_MISMATCH 2888 0.66 0.70 0.64 144 USER_IN_WHITELIST 2861 0.46 0.00 0.63 145 RELAYCOUNTRY_AU 2738 0.63 0.70 0.61 146 TR_XM_RelayPhish 2695 0.85 1.54 0.60 147 XMLngstWrd_00 2660 0.52 0.33 0.59 148 RELAYCOUNTRY_DE 2603 1.33 3.34 0.58 149 XM_H_PHPMailer 2546 0.59 0.64 0.56 150 HTML_FONT_FACE_BAD 2540 0.64 0.84 0.56 151 XMSubMetaI_00 2525 0.89 1.76 0.56 152 T_Symld_Words_02 2506 0.69 1.05 0.55 153 XMMoneyMeta_00 2501 0.73 1.21 0.55 154 XMLngstWrd_01 2478 0.48 0.31 0.55 155 XMSexyCombo_01 2478 0.89 1.80 0.55 156 FORGED_GMAIL_RCVD 2463 0.53 0.48 0.55 157 XM_URI_RBL 2410 1.25 3.18 0.53 158 XMBody_17 2394 0.72 1.24 0.53 159 XM_B_COPY_HTML 2347 0.53 0.57 0.52 160 T_TooManySym_03 2331 0.41 0.11 0.52 161 XMGappySubj_02 2311 0.44 0.23 0.51 162 FROM_GOV_SPOOF 2253 0.40 0.15 0.50 163 URI_NOVOWEL 2248 0.58 0.80 0.50 164 PLING_QUERY 2226 0.65 1.07 0.49 165 XMSubNoVowel 2191 0.65 1.08 0.49 166 SHORT_HELO_AND_INLINE_IMAGE 2184 0.39 0.13 0.48 167 XMSubMetaSxObfu_02 2104 0.57 0.84 0.47 168 MISSING_HEADERS 2099 0.43 0.33 0.46 169 RCVD_IN_BL_SPAMCOP_NET 2063 0.95 2.26 0.46 170 XMHTML_After_End 2022 0.63 1.13 0.45 171 XMSubEmpty 2018 0.54 0.81 0.45 172 XM_B_REG_HTML 2007 0.56 0.88 0.44 173 XMPhish30 2001 0.64 1.16 0.44 174 RDNS_DYNAMIC 1972 0.61 1.08 0.44 175 NUMERIC_HTTP_ADDR 1966 1.47 4.26 0.44 176 FROM_GOV_DKIM_AU 1921 0.35 0.14 0.43 177 XMHTMLBadTable_001 1895 0.60 1.08 0.42 178 XM_shorewaves_Whitelist 1837 0.30 0.00 0.41 179 REMOVE_BEFORE_LINK 1836 0.49 0.72 0.41 180 XMBody_78 1834 0.60 1.13 0.41 181 HTML_IMAGE_ONLY_32 1817 0.38 0.30 0.40 182 SUBJ_DOLLARS 1803 0.47 0.66 0.40 183 DIET_1 1782 0.74 1.65 0.39 184 FILL_THIS_FORM 1751 0.52 0.89 0.39 185 HTML_IMAGE_ONLY_28 1751 0.67 1.41 0.39 186 TM2_M_BODY_EMPTY 1708 0.31 0.12 0.38 187 XMDateMe_00 1660 0.39 0.44 0.37 188 RCVD_IN_SORBS_DUL 1655 0.36 0.35 0.37 189 SpammyFromTLD_02 1620 1.80 5.67 0.36 190 TR_LOTS_OF_MONEY2 1618 0.56 1.10 0.36 191 T_MONEY_PERCENT 1618 0.56 1.10 0.36 192 XMSlimDrugH 1616 0.50 0.87 0.36 193 XM_B_TRADE_HTML 1603 0.39 0.50 0.35 194 AC_DIV_BONANZA 1599 0.28 0.07 0.35 195 BASE64_LENGTH_79_INF 1515 0.52 1.01 0.34 196 XMPhish14 1513 0.50 0.94 0.33 197 HTML_IMAGE_ONLY_24 1502 0.57 1.22 0.33 198 XMSubMetaSxObfu_03 1500 0.61 1.34 0.33 199 XM_H_Trusted_IP 1494 0.24 0.00 0.33 200 XMBSHREFv2 1426 0.32 0.34 0.32 ----------------------------------------------------------------------