Email: 583758 Autolearn: 0 AvgScore: 2.73 AvgScanTime: 1.86 sec Spam: 149133 Autolearn: 0 AvgScore: 13.23 AvgScanTime: 2.24 sec Ham: 434625 Autolearn: 0 AvgScore: -0.87 AvgScanTime: 1.74 sec Time Spent Running SA: 302.40 hours Time Spent Processing Spam: 92.61 hours Time Spent Processing Ham: 209.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139402 88.88 93.47 87.30 2 DCC_CHECK 118443 47.44 79.42 36.47 3 DKIM_SIGNED 117286 74.51 78.65 73.09 4 XM_DK_Pass 114599 73.01 76.84 71.70 5 DKIM_VALID 108632 69.16 72.84 67.90 6 XMListUnsubscribeExists 108215 53.58 72.56 47.06 7 DKIM_VALID_AU 86692 51.96 58.13 49.85 8 XM_H_QuotedFrom 78598 42.79 52.70 39.38 9 XM_DK_Undo_02 68118 21.95 45.68 13.81 10 BAYES_99 59696 19.42 40.03 12.34 11 HTML_FONT_LOW_CONTRAST 57039 29.50 38.25 26.49 12 BAYES_50 52566 47.24 35.25 51.36 13 BAYES_999 50485 16.82 33.85 10.97 14 LOC_TINY_FONT_1 50190 24.34 33.65 21.15 15 TR_DCC_Bayes_99 46962 12.48 31.49 5.95 16 MIME_HTML_ONLY 45998 24.02 30.84 21.68 17 FVGT_m_MULTI_ODD 39312 21.06 26.36 19.24 18 XMSubLong 39059 22.61 26.19 21.38 19 DKIM_VALID_EF 33258 26.30 22.30 27.67 20 RELAYCOUNTRY_META 32402 9.38 21.73 5.14 21 T_KAM_HTML_FONT_INVALID 29089 16.83 19.51 15.91 22 DCC_CHECK_NEGATIVE 27700 50.51 18.57 61.47 23 BOTNET 27620 6.13 18.52 1.88 24 XM_Body_Dirty_Words 27496 13.03 18.44 11.18 25 T_TM2_M_HEADER_IN_MSG 26641 28.29 17.86 31.87 26 BOTNET_IPINHOSTNAME 24884 8.46 16.69 5.64 27 MultiRelay 22824 18.64 15.30 19.79 28 UNTRUSTED_Relay 21704 4.64 14.55 1.24 29 XM_Multi_Part_URI 21416 12.80 14.36 12.26 30 FSL_BULK_SIG 21357 8.75 14.32 6.84 31 HTML_IMAGE_RATIO_02 20095 8.41 13.47 6.67 32 LOTS_OF_MONEY 19811 9.38 13.28 8.04 33 XM_UncommonTLD01 18830 5.68 12.63 3.29 34 XM_Evil_Numbers_Gen 18774 10.16 12.59 9.33 35 XMSexyCombo_05 14998 5.26 10.06 3.62 36 T_XMDrugObfuBody_14 13072 8.15 8.77 7.94 37 TooManyTo_001 12945 9.17 8.68 9.34 38 XM_H_Long_From01 12706 6.71 8.52 6.10 39 BAYES_80 12286 4.73 8.24 3.53 40 XM_UB50 12148 2.61 8.15 0.71 41 HTML_IMAGE_RATIO_04 11736 7.78 7.87 7.76 42 XMSubMetaSx_00 11385 4.97 7.63 4.06 43 XM_B_Phish_Phrases 11139 5.64 7.47 5.01 44 XM_salutation2 10843 3.57 7.27 2.30 45 MPART_ALT_DIFF 10731 4.03 7.20 2.94 46 BAYES_60 10536 7.29 7.06 7.36 47 SpammyFromTLD_02 9622 1.83 6.45 0.25 48 LotsOfNums_01 8672 7.69 5.81 8.33 49 DKIM_INVALID 8654 5.35 5.80 5.19 50 HTML_IMAGE_RATIO_06 8068 4.09 5.41 3.63 51 FROM_EXCESS_BASE64 7458 4.19 5.00 3.91 52 XM_DIRTYINTL 7074 2.69 4.74 1.99 53 FROM_SUSPICIOUS_NTLD 7045 1.31 4.72 0.14 54 XMStrtUSub 6898 4.88 4.63 4.97 55 BAYES_95 6603 2.94 4.43 2.43 56 XM_OfRef6 6316 2.08 4.24 1.35 57 MIME_HTML_MOSTLY 6279 2.84 4.21 2.36 58 XM_SPF_SoftFail 6068 2.66 4.07 2.17 59 T_REMOTE_IMAGE 5726 4.05 3.84 4.12 60 TM2_M_URI_OPT_OUT 5624 2.29 3.77 1.78 61 RCVD_IN_RP_RNBL 5588 0.98 3.75 0.03 62 XMNumbers 5564 3.08 3.73 2.85 63 URI_HEX 5323 2.09 3.57 1.59 64 MultiRelay_Combo 5302 1.01 3.56 0.14 65 MultiRelay_CC 5302 1.01 3.56 0.14 66 RELAYCOUNTRY_CA 5291 1.93 3.55 1.37 67 BOTNET_NORDNS 5278 0.92 3.54 0.02 68 HTML_IMAGE_RATIO_08 5171 2.61 3.47 2.32 69 RELAYCOUNTRY_FR 5115 1.02 3.43 0.19 70 XM_SendGrid 5037 5.65 3.38 6.43 71 HTML_MIME_NO_HTML_TAG 4994 3.96 3.35 4.17 72 RCVD_IN_RP_SAFE 4893 8.08 3.28 9.73 73 MIME_HTML_ONLY_MULTI 4762 1.84 3.19 1.38 74 T_TooManySym_01 4696 4.67 3.15 5.19 75 XM_CamelCaseFrm001 4640 2.17 3.11 1.85 76 DKIM_ADSP_NXDOMAIN 4529 1.08 3.04 0.41 77 XMBdyGiftCard01 4408 1.23 2.96 0.64 78 XM_URI_RBL 4307 1.07 2.89 0.45 79 XMPhish11 4192 1.64 2.81 1.23 80 TR_Symld_Words 4109 1.90 2.76 1.60 81 MIME_QP_LONG_LINE 4089 4.91 2.74 5.65 82 RCVD_IN_RP_CERTIFIED 4052 7.27 2.72 8.83 83 RCVD_IN_BL_SPAMCOP_NET 3899 0.90 2.61 0.31 84 FILL_THIS_FORM 3731 0.94 2.50 0.41 85 RCVD_IN_MSPIKE_H2 3683 3.92 2.47 4.41 86 NUMERIC_HTTP_ADDR 3678 0.83 2.47 0.27 87 FILL_THIS_FORM_LONG 3646 0.87 2.44 0.32 88 XMDiploma_00 3481 1.73 2.33 1.53 89 RELAYCOUNTRY_GB 3427 1.36 2.30 1.04 90 T_XMDrugObfuBody_08 3261 1.69 2.19 1.52 91 XMBody_17 3221 1.00 2.16 0.60 92 FILL_THIS_FORM_LOAN 3136 0.77 2.10 0.31 93 NORMAL_HTTP_TO_IP 3075 0.56 2.06 0.05 94 XMSexyCombo_01 3034 1.18 2.03 0.89 95 RELAYCOUNTRY_DE 2983 0.78 2.00 0.36 96 XM_UB99 2965 0.52 1.99 0.01 97 XM_OfRef7 2952 0.61 1.98 0.14 98 MONEY_FRAUD_8 2907 0.50 1.95 0.00 99 RCVD_IN_PSBL 2903 0.52 1.95 0.03 100 NO_DNS_FOR_FROM 2868 1.42 1.92 1.25 101 MAILING_LIST_MULTI 2865 2.26 1.92 2.38 102 XM_UB60 2855 0.54 1.91 0.07 103 RELAYCOUNTRY_CN 2834 0.54 1.90 0.07 104 DIET_1 2820 0.74 1.89 0.34 105 HTML_IMAGE_ONLY_12 2794 0.69 1.87 0.29 106 XMSubMetaI_00 2653 1.09 1.78 0.85 107 TR_XM_RelayPhish 2628 0.85 1.76 0.54 108 BAYES_40 2595 3.54 1.74 4.16 109 SpammyFromTLD_01 2590 0.99 1.74 0.73 110 MILLION_HUNDRED 2577 0.44 1.73 0.00 111 XMGenDplmaNmb 2569 1.12 1.72 0.92 112 RCVD_IN_IADB_LISTED 2515 4.42 1.69 5.36 113 SUBJ_ALL_CAPS 2501 1.69 1.68 1.70 114 XMStockSpam_06 2493 1.49 1.67 1.43 115 XM_UB999 2454 0.43 1.65 0.01 116 XMBody_78 2424 2.10 1.63 2.27 117 T_FILL_THIS_FORM_SHORT 2417 1.08 1.62 0.90 118 HTML_FONT_SIZE_LARGE 2360 0.56 1.58 0.21 119 ALL_TRUSTED 2322 13.50 1.56 17.60 120 T_MONEY_PERCENT 2293 0.72 1.54 0.44 121 TR_LOTS_OF_MONEY2 2293 0.72 1.54 0.44 122 XM_H_TOP 2270 0.39 1.52 0.00 123 MONEY_FORM 2245 0.39 1.51 0.01 124 DEAR_BENEFICIARY 2233 0.38 1.50 0.00 125 XM_H_Long_From02 2220 1.33 1.49 1.28 126 FROM_ADDR_WS 2208 0.38 1.48 0.00 127 DKIM_ADSP_CUSTOM_MED 2203 1.24 1.48 1.16 128 XM_ProductURIs 2197 0.95 1.47 0.77 129 ADVANCE_FEE_5_NEW_FRM_MNY 2173 0.37 1.46 0.00 130 TM2_M_VERY_LONG_WORD 2147 1.01 1.44 0.87 131 BAYES_20 2133 2.70 1.43 3.13 132 T_FILL_THIS_FORM_FRAUD_PHISH 2103 0.42 1.41 0.09 133 NML_ADSP_CUSTOM_MED 2101 1.00 1.41 0.86 134 HTML_IMAGE_ONLY_32 2095 0.70 1.40 0.46 135 DATE_IN_PAST_03_06 2087 0.43 1.40 0.10 136 TO_MALFORMED 2081 2.54 1.40 2.93 137 RCVD_IN_IADB_SPF 2028 3.87 1.36 4.73 138 INVALID_MSGID 1996 1.62 1.34 1.72 139 FORGED_GMAIL_RCVD 1967 0.74 1.32 0.55 140 T_XMHurry_00 1963 0.81 1.32 0.64 141 TR_M_TOP_BAYES 1961 0.34 1.31 0.00 142 XMSubMetaSxObfu_03 1957 0.98 1.31 0.87 143 RELAYCOUNTRY_NG 1952 0.33 1.31 0.00 144 DATE_IN_PAST_06_12 1945 0.35 1.30 0.02 145 XMPhish30 1876 0.65 1.26 0.44 146 XMSlimDrugH 1866 0.61 1.25 0.39 147 RCVD_IN_IADB_SENDERID 1855 3.40 1.24 4.14 148 MONEY_FROM_41 1836 0.31 1.23 0.00 149 TR_MetaPhish_Combo_01 1828 1.56 1.23 1.68 150 RCVD_IN_IADB_DK 1821 3.37 1.22 4.11 151 XM_H_PHPOS 1808 1.11 1.21 1.08 152 BODY_URI_ONLY 1781 0.39 1.19 0.11 153 XMHTML_After_End 1780 0.59 1.19 0.38 154 URI_HEX_IP 1766 0.30 1.18 0.00 155 TVD_IP_SING_HEX 1766 0.30 1.18 0.00 156 TVD_IP_HEX 1766 0.30 1.18 0.00 157 UNPARSEABLE_RELAY 1738 2.93 1.17 3.54 158 XM_B_REG_HTML 1717 0.64 1.15 0.46 159 TR_Mismatch_TLD_02 1712 0.34 1.15 0.07 160 SUBJECT_NEEDS_ENCODING 1626 0.29 1.09 0.01 161 SUBJ_ILLEGAL_CHARS 1625 0.29 1.09 0.01 162 RELAYCOUNTRY_IN 1615 0.36 1.08 0.12 163 RELAYCOUNTRY_AT 1607 0.43 1.08 0.21 164 XM_UB80 1604 0.31 1.08 0.04 165 RCVD_IN_IADB_VOUCHED 1604 2.72 1.08 3.29 166 T_HTML_TAG_BALANCE_CENTER 1592 0.39 1.07 0.15 167 HTML_SHORT_LINK_IMG_1 1582 0.30 1.06 0.04 168 XMSexyCombo_04 1521 0.67 1.02 0.55 169 XM_HighProb1 1469 0.26 0.99 0.01 170 T_XMDrugObfuBody_00 1453 0.78 0.97 0.72 171 XMHTMLBadTable_001 1438 0.61 0.96 0.49 172 NORDNS_LOW_CONTRAST 1426 0.25 0.96 0.01 173 URI_TRY_3LD 1378 0.98 0.92 1.00 174 BODY_ENHANCEMENT 1375 0.27 0.92 0.04 175 MPART_ALT_DIFF_COUNT 1367 0.41 0.92 0.23 176 MONEY_FORM_SHORT 1363 0.25 0.91 0.02 177 MIME_HEADER_CTYPE_ONLY 1362 0.34 0.91 0.15 178 URI_NOVOWEL 1349 0.60 0.90 0.50 179 BAYES_05 1340 1.70 0.90 1.98 180 XMPhish14 1327 0.62 0.89 0.53 181 T_Symld_Words_02 1305 0.56 0.88 0.45 182 XM_H_PHPMailer 1298 0.91 0.87 0.92 183 XM_DK_Undo_01 1289 1.63 0.86 1.90 184 XM_GoogleGroups 1270 1.16 0.85 1.26 185 FSL_THIS_IS_ADV 1268 0.53 0.85 0.42 186 URIBL_BLACK 1253 0.25 0.84 0.05 187 TR_LOTS_OF_MONEY3 1244 0.38 0.83 0.22 188 URIBL_DBL_SPAM 1238 0.22 0.83 0.01 189 PLING_QUERY 1225 0.61 0.82 0.53 190 XM_PDF 1217 4.01 0.82 5.11 191 SHORT_URI_3 1217 0.28 0.82 0.10 192 HELO_NODOT 1205 1.67 0.81 1.96 193 HELO_NO_DOMAIN 1198 1.66 0.80 1.96 194 HTML_OFF_PAGE 1198 0.21 0.80 0.00 195 LongTLD 1190 0.30 0.80 0.13 196 XMSubMetaSx_01 1190 0.28 0.80 0.10 197 XMBrknScrpt_02 1163 0.73 0.78 0.71 198 FORM_FRAUD 1159 0.20 0.78 0.00 199 HK_SCAM 1157 0.21 0.78 0.02 200 RCVD_IN_IADB_OPTIN 1126 1.76 0.76 2.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 379430 88.88 93.47 87.30 2 DKIM_SIGNED 317667 74.51 78.65 73.09 3 XM_DK_Pass 311605 73.01 76.84 71.70 4 DKIM_VALID 295098 69.16 72.84 67.90 5 DCC_CHECK_NEGATIVE 267161 50.51 18.57 61.47 6 BAYES_50 223220 47.24 35.25 51.36 7 DKIM_VALID_AU 216642 51.96 58.13 49.85 8 XMListUnsubscribeExists 204546 53.58 72.56 47.06 9 XM_H_QuotedFrom 171173 42.79 52.70 39.38 10 DCC_CHECK 158519 47.44 79.42 36.47 11 T_TM2_M_HEADER_IN_MSG 138529 28.29 17.86 31.87 12 DKIM_VALID_EF 120261 26.30 22.30 27.67 13 HTML_FONT_LOW_CONTRAST 115150 29.50 38.25 26.49 14 MIME_HTML_ONLY 94207 24.02 30.84 21.68 15 XMSubLong 92919 22.61 26.19 21.38 16 LOC_TINY_FONT_1 91915 24.34 33.65 21.15 17 MultiRelay 86007 18.64 15.30 19.79 18 FVGT_m_MULTI_ODD 83602 21.06 26.36 19.24 19 ALL_TRUSTED 76505 13.50 1.56 17.60 20 T_KAM_HTML_FONT_INVALID 69136 16.83 19.51 15.91 21 XM_DK_Undo_02 60030 21.95 45.68 13.81 22 BAYES_00 58479 10.21 0.74 13.46 23 BAYES_99 53652 19.42 40.03 12.34 24 XM_Multi_Part_URI 53291 12.80 14.36 12.26 25 XM_DKIMWhitelistDomains 52776 9.07 0.10 12.14 26 XM_Body_Dirty_Words 48596 13.03 18.44 11.18 27 BAYES_999 47691 16.82 33.85 10.97 28 TR_XM_DK_Bayes 45798 7.96 0.44 10.54 29 TR_XM_DK_Bayes1 43319 7.51 0.35 9.97 30 RCVD_IN_RP_SAFE 42300 8.08 3.28 9.73 31 TooManyTo_001 40599 9.17 8.68 9.34 32 XM_Evil_Numbers_Gen 40544 10.16 12.59 9.33 33 RCVD_IN_RP_CERTIFIED 38380 7.27 2.72 8.83 34 TR_XM_DK_Bayes2 37612 6.51 0.26 8.65 35 LotsOfNums_01 36206 7.69 5.81 8.33 36 LOTS_OF_MONEY 34963 9.38 13.28 8.04 37 T_XMDrugObfuBody_14 34506 8.15 8.77 7.94 38 HTML_IMAGE_RATIO_04 33708 7.78 7.87 7.76 39 BAYES_60 32006 7.29 7.06 7.36 40 FSL_BULK_SIG 29719 8.75 14.32 6.84 41 HTML_IMAGE_RATIO_02 28973 8.41 13.47 6.67 42 XM_SendGrid 27949 5.65 3.38 6.43 43 XM_H_Long_From01 26491 6.71 8.52 6.10 44 TR_DCC_Bayes_99 25878 12.48 31.49 5.95 45 MIME_QP_LONG_LINE 24563 4.91 2.74 5.65 46 BOTNET_IPINHOSTNAME 24494 8.46 16.69 5.64 47 RCVD_IN_IADB_LISTED 23285 4.42 1.69 5.36 48 DKIM_INVALID 22569 5.35 5.80 5.19 49 T_TooManySym_01 22556 4.67 3.15 5.19 50 RELAYCOUNTRY_META 22350 9.38 21.73 5.14 51 XM_PDF 22203 4.01 0.82 5.11 52 XM_B_Phish_Phrases 21784 5.64 7.47 5.01 53 XMStrtUSub 21613 4.88 4.63 4.97 54 RCVD_IN_IADB_SPF 20575 3.87 1.36 4.73 55 RCVD_IN_MSPIKE_H2 19186 3.92 2.47 4.41 56 HTML_MIME_NO_HTML_TAG 18108 3.96 3.35 4.17 57 BAYES_40 18094 3.54 1.74 4.16 58 RCVD_IN_IADB_SENDERID 18005 3.40 1.24 4.14 59 IN_ZIMBRA_NJ_WHITELIST 17969 3.09 0.03 4.13 60 T_REMOTE_IMAGE 17904 4.05 3.84 4.12 61 RCVD_IN_IADB_DK 17872 3.37 1.22 4.11 62 XMSubMetaSx_00 17626 4.97 7.63 4.06 63 FROM_EXCESS_BASE64 16978 4.19 5.00 3.91 64 HTML_IMAGE_RATIO_06 15784 4.09 5.41 3.63 65 XMSexyCombo_05 15724 5.26 10.06 3.62 66 UNPARSEABLE_RELAY 15368 2.93 1.17 3.54 67 BAYES_80 15340 4.73 8.24 3.53 68 TVD_RCVD_IP 14816 2.68 0.55 3.41 69 XM_UncommonTLD01 14304 5.68 12.63 3.29 70 RCVD_IN_IADB_VOUCHED 14291 2.72 1.08 3.29 71 BAYES_20 13613 2.70 1.43 3.13 72 MPART_ALT_DIFF 12775 4.03 7.20 2.94 73 TO_MALFORMED 12747 2.54 1.40 2.93 74 XMNumbers 12405 3.08 3.73 2.85 75 TooManyTo_002 11298 2.12 0.70 2.60 76 RCVD_IN_MSPIKE_H3 11136 2.04 0.52 2.56 77 RCVD_IN_MSPIKE_WL 11136 2.04 0.52 2.56 78 BAYES_95 10579 2.94 4.43 2.43 79 MAILING_LIST_MULTI 10341 2.26 1.92 2.38 80 MIME_HTML_MOSTLY 10275 2.84 4.21 2.36 81 HTML_IMAGE_RATIO_08 10087 2.61 3.47 2.32 82 XM_salutation2 9975 3.57 7.27 2.30 83 XMBody_78 9855 2.10 1.63 2.27 84 XM_SPF_SoftFail 9453 2.66 4.07 2.17 85 RCVD_IN_IADB_OPTIN 9130 1.76 0.76 2.10 86 XM_DIRTYINTL 8648 2.69 4.74 1.99 87 BAYES_05 8601 1.70 0.90 1.98 88 HELO_NODOT 8521 1.67 0.81 1.96 89 HELO_NO_DOMAIN 8519 1.66 0.80 1.96 90 ANY_BOUNCE_MESSAGE 8510 1.58 0.49 1.96 91 BOUNCE_MESSAGE 8508 1.58 0.49 1.96 92 XM_DK_Undo_01 8237 1.63 0.86 1.90 93 BOTNET 8166 6.13 18.52 1.88 94 XM_CamelCaseFrm001 8042 2.17 3.11 1.85 95 T_TooManySym_02 8009 1.54 0.65 1.84 96 IN_HORDE_ADDRESS_BOOK 7999 1.38 0.04 1.84 97 TooManyTo_003 7753 1.47 0.56 1.78 98 TM2_M_URI_OPT_OUT 7715 2.29 3.77 1.78 99 INVALID_MSGID 7460 1.62 1.34 1.72 100 SUBJ_ALL_CAPS 7379 1.69 1.68 1.70 101 TR_MetaPhish_Combo_01 7296 1.56 1.23 1.68 102 XMCapTrack 6980 1.27 0.28 1.61 103 TR_Symld_Words 6968 1.90 2.76 1.60 104 URI_HEX 6901 2.09 3.57 1.59 105 XMDiploma_00 6640 1.73 2.33 1.53 106 T_XMDrugObfuBody_08 6624 1.69 2.19 1.52 107 USER_IN_DEF_DKIM_WL 6272 1.08 0.03 1.44 108 XMStockSpam_06 6206 1.49 1.67 1.43 109 MIME_HTML_ONLY_MULTI 5989 1.84 3.19 1.38 110 RELAYCOUNTRY_CA 5967 1.93 3.55 1.37 111 XM_OfRef6 5847 2.08 4.24 1.35 112 TooManyTo_004 5820 1.12 0.46 1.34 113 XM_H_Long_From02 5571 1.33 1.49 1.28 114 XM_GoogleGroups 5476 1.16 0.85 1.26 115 NO_DNS_FOR_FROM 5413 1.42 1.92 1.25 116 UNTRUSTED_Relay 5398 4.64 14.55 1.24 117 XMPhish11 5353 1.64 2.81 1.23 118 DKIM_ADSP_CUSTOM_MED 5032 1.24 1.48 1.16 119 TooManyTo_005 4823 0.92 0.36 1.11 120 XM_H_PHPOS 4681 1.11 1.21 1.08 121 RELAYCOUNTRY_GB 4532 1.36 2.30 1.04 122 URI_TRY_3LD 4363 0.98 0.92 1.00 123 XM_H_PHPMailer 3998 0.91 0.87 0.92 124 XMGenDplmaNmb 3997 1.12 1.72 0.92 125 T_FILL_THIS_FORM_SHORT 3902 1.08 1.62 0.90 126 XMSexyCombo_01 3881 1.18 2.03 0.89 127 XMSubMetaSxObfu_03 3786 0.98 1.31 0.87 128 TM2_M_VERY_LONG_WORD 3763 1.01 1.44 0.87 129 NML_ADSP_CUSTOM_MED 3736 1.00 1.41 0.86 130 XMSubMetaI_00 3699 1.09 1.78 0.85 131 HTTPS_HTTP_MISMATCH 3359 0.73 0.62 0.77 132 XM_ProductURIs 3344 0.95 1.47 0.77 133 XM_RXBody 3231 0.73 0.68 0.74 134 LOW_PRICE 3221 0.67 0.48 0.74 135 SpammyFromTLD_01 3193 0.99 1.74 0.73 136 T_XMDrugObfuBody_00 3110 0.78 0.97 0.72 137 XM_UB50 3100 2.61 8.15 0.71 138 XMNoVowels 3096 0.63 0.41 0.71 139 XMBrknScrpt_02 3078 0.73 0.78 0.71 140 T_OBFU_PDF_ATTACH 2980 0.56 0.18 0.69 141 XMMoneyMeta_00 2896 0.66 0.65 0.67 142 XMBdyGiftCard01 2795 1.23 2.96 0.64 143 XMBody_95 2777 0.51 0.12 0.64 144 T_XMHurry_00 2776 0.81 1.32 0.64 145 XM_ShortIntro_01 2736 0.57 0.39 0.63 146 T_TooManySym_03 2602 0.49 0.15 0.60 147 XMBody_17 2590 1.00 2.16 0.60 148 AC_DIV_BONANZA 2573 0.47 0.10 0.59 149 THIS_AD 2560 0.59 0.58 0.59 150 XMLngstWrd_00 2477 0.50 0.30 0.57 151 MISSING_HEADERS 2475 0.58 0.62 0.57 152 SHORT_HELO_AND_INLINE_IMAGE 2445 0.43 0.04 0.56 153 USER_IN_WHITELIST 2443 0.42 0.00 0.56 154 XMSubMetaSxObfu_02 2423 0.50 0.35 0.56 155 XMGappySubj_01 2420 0.52 0.41 0.56 156 BASE64_LENGTH_79_INF 2414 0.46 0.19 0.56 157 XMSexyCombo_04 2394 0.67 1.02 0.55 158 FORGED_GMAIL_RCVD 2378 0.74 1.32 0.55 159 HTML_TAG_BALANCE_BODY 2362 0.56 0.59 0.54 160 TR_XM_RelayPhish 2339 0.85 1.76 0.54 161 PLING_QUERY 2307 0.61 0.82 0.53 162 TM2_M_BODY_EMPTY 2302 0.44 0.18 0.53 163 XMPhish14 2291 0.62 0.89 0.53 164 XMLngstWrd_01 2287 0.47 0.29 0.53 165 RELAYCOUNTRY_AU 2282 0.53 0.53 0.53 166 URI_NOVOWEL 2165 0.60 0.90 0.50 167 XM_B_COPY_HTML 2132 0.51 0.58 0.49 168 XMHTMLBadTable_001 2113 0.61 0.96 0.49 169 RCVD_IN_SORBS_DUL 2094 0.44 0.31 0.48 170 XM_B_REG_HTML 2002 0.64 1.15 0.46 171 HTML_IMAGE_ONLY_32 1982 0.70 1.40 0.46 172 XMDateMe_00 1967 0.44 0.42 0.45 173 XM_URI_RBL 1957 1.07 2.89 0.45 174 T_Symld_Words_02 1950 0.56 0.88 0.45 175 HTML_FONT_FACE_BAD 1926 0.51 0.72 0.44 176 HTML_IMAGE_ONLY_28 1905 0.50 0.68 0.44 177 XMPhish30 1894 0.65 1.26 0.44 178 T_MONEY_PERCENT 1894 0.72 1.54 0.44 179 TR_LOTS_OF_MONEY2 1894 0.72 1.54 0.44 180 FROM_GOV_SPOOF 1832 0.34 0.11 0.42 181 FSL_THIS_IS_ADV 1807 0.53 0.85 0.42 182 HTML_IMAGE_ONLY_24 1797 0.37 0.23 0.41 183 DKIM_ADSP_NXDOMAIN 1766 1.08 3.04 0.41 184 FILL_THIS_FORM 1761 0.94 2.50 0.41 185 RDNS_DYNAMIC 1706 0.43 0.54 0.39 186 XMSolicitRefs_0 1705 0.45 0.60 0.39 187 XMSlimDrugH 1698 0.61 1.25 0.39 188 FROM_GOV_DKIM_AU 1685 0.32 0.13 0.39 189 TM2_M_A_HREF_HREF 1681 0.42 0.51 0.39 190 XMHTML_After_End 1653 0.59 1.19 0.38 191 RELAYCOUNTRY_NL 1640 0.40 0.45 0.38 192 HTML_IMAGE_ONLY_20 1637 0.40 0.46 0.38 193 XM_H_PHPOS_M 1611 0.40 0.50 0.37 194 RELAYCOUNTRY_DE 1573 0.78 2.00 0.36 195 XMLKML 1541 0.26 0.00 0.35 196 HTML_IMAGE_ONLY_16 1526 0.40 0.53 0.35 197 XMSubNoVowel 1525 0.35 0.34 0.35 198 DIET_1 1493 0.74 1.89 0.34 199 TVD_SPACE_RATIO 1473 0.29 0.15 0.34 200 REMOVE_BEFORE_LINK 1457 0.39 0.54 0.34 ----------------------------------------------------------------------