Email: 634518 Autolearn: 0 AvgScore: 2.80 AvgScanTime: 2.04 sec Spam: 157762 Autolearn: 0 AvgScore: 12.17 AvgScanTime: 2.55 sec Ham: 476756 Autolearn: 0 AvgScore: -0.30 AvgScanTime: 1.87 sec Time Spent Running SA: 358.90 hours Time Spent Processing Spam: 111.76 hours Time Spent Processing Ham: 247.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146462 88.06 92.84 86.47 2 DKIM_SIGNED 126409 75.75 80.13 74.30 3 XM_DK_Pass 120362 73.81 76.29 72.99 4 XMListUnsubscribeExists 119309 55.89 75.63 49.36 5 DCC_CHECK 118537 46.86 75.14 37.51 6 DKIM_VALID 114223 70.69 72.40 70.12 7 DKIM_VALID_AU 88688 52.76 56.22 51.62 8 XM_DK_Undo_02 72156 21.27 45.74 13.18 9 BAYES_99 63561 18.73 40.29 11.59 10 BAYES_50 58139 48.99 36.85 53.01 11 HTML_FONT_LOW_CONTRAST 57520 29.41 36.46 27.08 12 BAYES_999 53306 16.12 33.79 10.27 13 LOC_TINY_FONT_1 51982 23.52 32.95 20.40 14 TR_DCC_Bayes_99 50713 12.12 32.15 5.49 15 MIME_HTML_ONLY 48804 22.37 30.94 19.54 16 FVGT_m_MULTI_ODD 40851 21.77 25.89 20.40 17 XMSubLong 36927 21.80 23.41 21.27 18 DCC_CHECK_NEGATIVE 36666 51.17 23.24 60.42 19 DKIM_VALID_EF 35549 25.71 22.53 26.76 20 BOTNET_IPINHOSTNAME 30931 8.48 19.61 4.80 21 T_TM2_M_HEADER_IN_MSG 30786 28.80 19.51 31.88 22 T_KAM_HTML_FONT_INVALID 30482 17.42 19.32 16.79 23 XM_Body_Dirty_Words 30223 14.08 19.16 12.41 24 RELAYCOUNTRY_META 28736 8.47 18.21 5.25 25 BOTNET 28252 6.02 17.91 2.09 26 XM_Multi_Part_URI 25919 12.79 16.43 11.59 27 MultiRelay 25402 19.08 16.10 20.06 28 XM_UncommonTLD01 23689 6.41 15.02 3.56 29 HTML_IMAGE_RATIO_02 20946 9.09 13.28 7.71 30 XM_Evil_Numbers_Gen 20844 10.85 13.21 10.06 31 UNTRUSTED_Relay 18921 4.02 11.99 1.38 32 FSL_BULK_SIG 16092 7.54 10.20 6.65 33 LOTS_OF_MONEY 15578 7.77 9.87 7.07 34 XMSexyCombo_05 14894 4.97 9.44 3.49 35 LotsOfNums_01 14194 8.44 9.00 8.25 36 TooManyTo_001 14114 8.94 8.95 8.93 37 XM_B_SpammyTLD 13088 4.30 8.30 2.98 38 HTML_IMAGE_RATIO_04 12896 5.99 8.17 5.27 39 T_XMDrugObfuBody_14 12447 7.70 7.89 7.64 40 DKIM_INVALID 12186 5.07 7.72 4.19 41 SpammyFromTLD_02 12184 2.08 7.72 0.21 42 XM_H_Long_From01 11184 6.63 7.09 6.48 43 XM_B_Phish_Phrases 10718 6.14 6.79 5.92 44 BAYES_80 10497 4.58 6.65 3.89 45 XMNumbers 9977 4.14 6.32 3.42 46 TR_XM_PHPDW 9952 2.56 6.31 1.32 47 XMSubMetaSx_00 9916 4.36 6.29 3.72 48 TR_XM_PHPForged 9871 2.52 6.26 1.29 49 TR_XM_FormFill2 9847 2.51 6.24 1.28 50 XM_H_PHPOS 9815 2.51 6.22 1.28 51 MPART_ALT_DIFF 9506 3.90 6.03 3.20 52 MIME_QP_LONG_LINE 9403 6.02 5.96 6.04 53 BAYES_60 9250 6.10 5.86 6.17 54 XM_SPF_SoftFail 8345 2.77 5.29 1.93 55 XM_UB50 8318 1.90 5.27 0.78 56 FROM_EXCESS_BASE64 7885 4.74 5.00 4.65 57 HTML_MIME_NO_HTML_TAG 7759 3.08 4.92 2.47 58 RELAYCOUNTRY_FR 7185 1.35 4.55 0.29 59 FROM_SUSPICIOUS_NTLD 7136 1.23 4.52 0.14 60 SUBJ_ALL_CAPS 7104 2.56 4.50 1.91 61 XM_DIRTYINTL 6886 2.84 4.36 2.34 62 SpammyFromTLD_01 6513 1.79 4.13 1.01 63 XM_CamelCaseFrm001 6507 2.60 4.12 2.10 64 T_REMOTE_IMAGE 6308 4.07 4.00 4.09 65 RELAYCOUNTRY_CA 6096 2.05 3.86 1.45 66 HTML_IMAGE_RATIO_06 5940 3.20 3.77 3.02 67 MIME_HTML_MOSTLY 5807 2.63 3.68 2.29 68 XMStrtUSub 5702 5.32 3.61 5.88 69 ALL_TRUSTED 5647 13.28 3.58 16.49 70 XM_SendGrid 5621 5.81 3.56 6.56 71 TM2_M_URI_OPT_OUT 5533 2.15 3.51 1.70 72 BAYES_95 5475 2.79 3.47 2.57 73 DKIM_ADSP_NXDOMAIN 5383 1.23 3.41 0.50 74 URI_HEX 5137 2.04 3.26 1.63 75 MIME_HTML_ONLY_MULTI 4976 2.05 3.15 1.69 76 HTML_IMAGE_RATIO_08 4973 2.27 3.15 1.98 77 BOTNET_NORDNS 4924 0.79 3.12 0.02 78 XM_URI_RBL 4791 1.07 3.04 0.42 79 RCVD_IN_RP_SAFE 4671 8.38 2.96 10.17 80 XMDiploma_00 4653 2.27 2.95 2.05 81 BAYES_40 4499 4.04 2.85 4.44 82 RCVD_IN_IADB_LISTED 4476 4.98 2.84 5.69 83 XMSubMetaI_00 4260 1.16 2.70 0.65 84 NO_DNS_FOR_FROM 4131 1.44 2.62 1.06 85 T_TooManySym_01 4083 4.56 2.59 5.21 86 RCVD_IN_IADB_SPF 3976 4.38 2.52 5.00 87 RCVD_IN_MSPIKE_H2 3943 3.98 2.50 4.47 88 DATE_IN_PAST_24_48 3870 0.62 2.45 0.01 89 XM_H_TOP 3850 0.61 2.44 0.01 90 RCVD_IN_IADB_SENDERID 3837 3.90 2.43 4.39 91 XM_OfRef6 3829 1.94 2.43 1.79 92 RCVD_IN_IADB_DK 3795 3.81 2.41 4.27 93 RCVD_IN_BL_SPAMCOP_NET 3731 0.93 2.36 0.46 94 RCVD_IN_PSBL 3659 0.63 2.32 0.07 95 T_XMDrugObfuBody_08 3659 1.71 2.32 1.51 96 XM_UB99 3635 0.59 2.30 0.03 97 RCVD_IN_RP_CERTIFIED 3618 7.47 2.29 9.18 98 TR_M_TOP_BAYES 3529 0.56 2.24 0.00 99 NORDNS_LOW_CONTRAST 3466 0.55 2.20 0.01 100 PDS_TO_EQ_FROM_NAME 3362 0.61 2.13 0.11 101 XMGppyBdWords 3296 0.72 2.09 0.26 102 XMBdyGiftCard01 3260 1.20 2.07 0.92 103 XMSexyCombo_01 3136 0.92 1.99 0.57 104 BAYES_20 3031 3.02 1.92 3.39 105 XM_UB999 2996 0.49 1.90 0.02 106 MultiRelay_CC 2884 0.64 1.83 0.25 107 MultiRelay_Combo 2884 0.64 1.83 0.25 108 TR_XM_DK_SendGrid 2762 3.02 1.75 3.44 109 TO_NO_BRKTS_HTML_ONLY 2759 0.62 1.75 0.24 110 URIBL_DBL_ABUSE_REDIR 2730 0.44 1.73 0.02 111 RELAYCOUNTRY_DE 2723 0.70 1.73 0.37 112 RCVD_IN_RP_RNBL 2674 0.44 1.69 0.03 113 XMGenDplmaNmb 2646 1.36 1.68 1.26 114 XMBody_78 2605 0.72 1.65 0.41 115 HTML_IMAGE_ONLY_20 2559 0.66 1.62 0.35 116 URI_TRY_3LD 2491 1.25 1.58 1.14 117 MAILING_LIST_MULTI 2487 2.19 1.58 2.39 118 TM2_M_VERY_LONG_WORD 2385 1.21 1.51 1.11 119 XM_ProductURIs 2362 0.98 1.50 0.81 120 XM_H_Long_From02 2250 1.03 1.43 0.90 121 XMHTMLBadTable_001 2244 0.76 1.42 0.54 122 XMStockSpam_06 2227 1.05 1.41 0.93 123 DATE_IN_PAST_03_06 2165 0.41 1.37 0.09 124 T_XMHurry_00 2159 0.95 1.37 0.81 125 TR_LOTS_OF_MONEY2 2126 0.53 1.35 0.26 126 T_MONEY_PERCENT 2126 0.53 1.35 0.26 127 XMBody_17 2018 0.71 1.28 0.52 128 XMPhish11 1992 1.20 1.26 1.18 129 XMMoneyMeta_00 1970 0.75 1.25 0.58 130 T_XMDrugObfuBody_00 1959 0.81 1.24 0.66 131 XMBrknScrpt_02 1915 0.75 1.21 0.60 132 TR_XM_RelayPhish 1905 0.88 1.21 0.77 133 XMPhish30 1825 0.66 1.16 0.50 134 XMSlimDrugH 1774 0.50 1.12 0.29 135 BAYES_00 1760 9.71 1.12 12.55 136 XM_H_PHPMailer 1714 0.81 1.09 0.72 137 RELAYCOUNTRY_GB 1705 1.15 1.08 1.17 138 RELAYCOUNTRY_IN 1676 0.36 1.06 0.13 139 T_Symld_Words_02 1675 0.90 1.06 0.84 140 RCVD_IN_IADB_VOUCHED 1652 3.11 1.05 3.79 141 TR_Symld_Words 1648 1.45 1.04 1.58 142 DKIM_ADSP_CUSTOM_MED 1648 1.07 1.04 1.08 143 UNPARSEABLE_RELAY 1632 2.09 1.03 2.44 144 DIET_1 1614 0.52 1.02 0.36 145 XM_DK_Undo_01 1606 1.57 1.02 1.75 146 URIBL_BLACK 1564 0.29 0.99 0.05 147 XM_HighProb1 1548 0.28 0.98 0.05 148 XMHTML_After_End 1547 0.54 0.98 0.40 149 XMSubMetaSxObfu_03 1530 0.77 0.97 0.70 150 DATE_IN_PAST_06_12 1516 0.30 0.96 0.08 151 EBAY_IMG_NOT_RCVD_EBAY 1502 0.24 0.95 0.00 152 XM_H_PHPOS_M 1485 0.39 0.94 0.21 153 XM_B_REG_HTML 1452 0.48 0.92 0.33 154 FORGED_GMAIL_RCVD 1438 0.59 0.91 0.49 155 HOSTED_IMG_DIRECT_MX 1423 0.23 0.90 0.00 156 T_TooManySym_02 1422 1.46 0.90 1.65 157 MIME_HEADER_CTYPE_ONLY 1418 0.33 0.90 0.14 158 NML_ADSP_CUSTOM_MED 1417 0.82 0.90 0.80 159 XM_UB60 1379 0.28 0.87 0.08 160 BODY_URI_ONLY 1351 0.32 0.86 0.14 161 HTML_FONT_FACE_BAD 1314 0.60 0.83 0.53 162 HTML_SHORT_LINK_IMG_1 1298 0.22 0.82 0.03 163 XMSubMetaSSx_00 1239 0.34 0.79 0.19 164 BAYES_05 1238 1.79 0.78 2.13 165 URIBL_DBL_SPAM 1233 0.20 0.78 0.01 166 HDRS_LCASE_IMGONLY 1226 0.24 0.78 0.06 167 TooManyTo_002 1212 2.10 0.77 2.54 168 HTML_IMAGE_ONLY_04 1197 0.23 0.76 0.06 169 XMGetyour 1178 0.25 0.75 0.08 170 RDNS_DYNAMIC 1168 0.46 0.74 0.37 171 XM_B_COPY_HTML 1166 0.59 0.74 0.54 172 SUBJ_DOLLARS 1164 0.32 0.74 0.18 173 THIS_AD 1163 0.66 0.74 0.63 174 HTML_IMAGE_ONLY_32 1158 0.49 0.73 0.41 175 XM_UB80 1134 0.20 0.72 0.03 176 T_FILL_THIS_FORM_SHORT 1127 0.90 0.71 0.96 177 TR_MetaPhish_Combo_01 1124 1.61 0.71 1.91 178 URI_NOVOWEL 1124 0.48 0.71 0.40 179 RELAYCOUNTRY_AT 1123 0.27 0.71 0.13 180 SHORT_URI_3 1113 0.30 0.71 0.17 181 HTML_SHORT_CENTER 1103 0.18 0.70 0.00 182 XM_PDF 1100 4.34 0.70 5.54 183 BODY_EMPTY 1094 0.17 0.69 0.00 184 XMSexyCombo_04 1093 0.24 0.69 0.08 185 RELAYCOUNTRY_CN 1089 0.23 0.69 0.07 186 XM_RXBody 1078 0.28 0.68 0.15 187 HK_RANDOM_REPLYTO 1074 0.38 0.68 0.28 188 FILL_THIS_FORM 1056 0.68 0.67 0.69 189 URI_PHP_REDIR 1040 0.17 0.66 0.00 190 LONG_JUNK_URI 1027 0.24 0.65 0.11 191 TR_Mismatch_TLD_02 1011 0.22 0.64 0.08 192 TooManyTo_003 972 1.43 0.62 1.70 193 HELO_NODOT 972 1.64 0.62 1.97 194 HELO_NO_DOMAIN 963 1.63 0.61 1.97 195 XM_E_Blogspot 952 0.23 0.60 0.10 196 LongTLD 948 0.27 0.60 0.16 197 PLING_QUERY 930 0.58 0.59 0.57 198 RELAYCOUNTRY_AU 888 0.54 0.56 0.53 199 RCVD_IN_IADB_OPTIN 880 2.01 0.56 2.49 200 HTTPS_HTTP_MISMATCH 879 0.64 0.56 0.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 412270 88.06 92.84 86.47 2 DKIM_SIGNED 354247 75.75 80.13 74.30 3 XM_DK_Pass 347974 73.81 76.29 72.99 4 DKIM_VALID 334290 70.69 72.40 70.12 5 DCC_CHECK_NEGATIVE 288034 51.17 23.24 60.42 6 BAYES_50 252729 48.99 36.85 53.01 7 DKIM_VALID_AU 246104 52.76 56.22 51.62 8 XMListUnsubscribeExists 235344 55.89 75.63 49.36 9 DCC_CHECK 178812 46.86 75.14 37.51 10 T_TM2_M_HEADER_IN_MSG 151973 28.80 19.51 31.88 11 HTML_FONT_LOW_CONTRAST 129084 29.41 36.46 27.08 12 DKIM_VALID_EF 127577 25.71 22.53 26.76 13 XMSubLong 101421 21.80 23.41 21.27 14 FVGT_m_MULTI_ODD 97273 21.77 25.89 20.40 15 LOC_TINY_FONT_1 97251 23.52 32.95 20.40 16 MultiRelay 95651 19.08 16.10 20.06 17 MIME_HTML_ONLY 93160 22.37 30.94 19.54 18 T_KAM_HTML_FONT_INVALID 80062 17.42 19.32 16.79 19 ALL_TRUSTED 78611 13.28 3.58 16.49 20 XM_DK_Undo_02 62822 21.27 45.74 13.18 21 BAYES_00 59830 9.71 1.12 12.55 22 XM_Body_Dirty_Words 59145 14.08 19.16 12.41 23 BAYES_99 55266 18.73 40.29 11.59 24 XM_Multi_Part_URI 55251 12.79 16.43 11.59 25 BAYES_999 48978 16.12 33.79 10.27 26 RCVD_IN_RP_SAFE 48506 8.38 2.96 10.17 27 XM_Evil_Numbers_Gen 47982 10.85 13.21 10.06 28 TR_XM_DK_Bayes 46808 7.50 0.51 9.82 29 TR_XM_DK_Bayes1 44992 7.21 0.48 9.44 30 RCVD_IN_RP_CERTIFIED 43779 7.47 2.29 9.18 31 TooManyTo_001 42585 8.94 8.95 8.93 32 LotsOfNums_01 39332 8.44 9.00 8.25 33 TR_XM_DK_Bayes2 39104 6.25 0.35 8.20 34 XM_DKIMWhitelistDomains 37143 5.86 0.02 7.79 35 HTML_IMAGE_RATIO_02 36746 9.09 13.28 7.71 36 T_XMDrugObfuBody_14 36422 7.70 7.89 7.64 37 LOTS_OF_MONEY 33727 7.77 9.87 7.07 38 FSL_BULK_SIG 31724 7.54 10.20 6.65 39 XM_SendGrid 31274 5.81 3.56 6.56 40 XM_H_Long_From01 30909 6.63 7.09 6.48 41 BAYES_60 29433 6.10 5.86 6.17 42 MIME_QP_LONG_LINE 28778 6.02 5.96 6.04 43 XM_B_Phish_Phrases 28212 6.14 6.79 5.92 44 XMStrtUSub 28046 5.32 3.61 5.88 45 RCVD_IN_IADB_LISTED 27115 4.98 2.84 5.69 46 XM_PDF 26433 4.34 0.70 5.54 47 TR_DCC_Bayes_99 26188 12.12 32.15 5.49 48 HTML_IMAGE_RATIO_04 25120 5.99 8.17 5.27 49 RELAYCOUNTRY_META 25031 8.47 18.21 5.25 50 T_TooManySym_01 24845 4.56 2.59 5.21 51 RCVD_IN_IADB_SPF 23828 4.38 2.52 5.00 52 BOTNET_IPINHOSTNAME 22890 8.48 19.61 4.80 53 FROM_EXCESS_BASE64 22184 4.74 5.00 4.65 54 RCVD_IN_MSPIKE_H2 21323 3.98 2.50 4.47 55 BAYES_40 21156 4.04 2.85 4.44 56 RCVD_IN_IADB_SENDERID 20914 3.90 2.43 4.39 57 RCVD_IN_IADB_DK 20362 3.81 2.41 4.27 58 DKIM_INVALID 19957 5.07 7.72 4.19 59 T_REMOTE_IMAGE 19518 4.07 4.00 4.09 60 IN_ZIMBRA_NJ_WHITELIST 19294 3.05 0.02 4.05 61 BAYES_80 18542 4.58 6.65 3.89 62 RCVD_IN_IADB_VOUCHED 18061 3.11 1.05 3.79 63 XMSubMetaSx_00 17731 4.36 6.29 3.72 64 XM_UncommonTLD01 16969 6.41 15.02 3.56 65 TO_MALFORMED 16827 2.66 0.03 3.53 66 XMSexyCombo_05 16627 4.97 9.44 3.49 67 TR_XM_DK_SendGrid 16401 3.02 1.75 3.44 68 XMNumbers 16284 4.14 6.32 3.42 69 BAYES_20 16139 3.02 1.92 3.39 70 MPART_ALT_DIFF 15233 3.90 6.03 3.20 71 HTML_IMAGE_RATIO_06 14388 3.20 3.77 3.02 72 XM_B_SpammyTLD 14202 4.30 8.30 2.98 73 BAYES_95 12244 2.79 3.47 2.57 74 TooManyTo_002 12099 2.10 0.77 2.54 75 RCVD_IN_IADB_OPTIN 11865 2.01 0.56 2.49 76 HTML_MIME_NO_HTML_TAG 11773 3.08 4.92 2.47 77 UNPARSEABLE_RELAY 11622 2.09 1.03 2.44 78 MAILING_LIST_MULTI 11379 2.19 1.58 2.39 79 XM_DIRTYINTL 11140 2.84 4.36 2.34 80 MIME_HTML_MOSTLY 10896 2.63 3.68 2.29 81 RCVD_IN_MSPIKE_H3 10361 1.71 0.32 2.17 82 RCVD_IN_MSPIKE_WL 10361 1.71 0.32 2.17 83 TVD_RCVD_IP 10203 1.67 0.26 2.14 84 BAYES_05 10151 1.79 0.78 2.13 85 XM_CamelCaseFrm001 9997 2.60 4.12 2.10 86 BOTNET 9957 6.02 17.91 2.09 87 XMDiploma_00 9763 2.27 2.95 2.05 88 HTML_IMAGE_RATIO_08 9446 2.27 3.15 1.98 89 HELO_NODOT 9403 1.64 0.62 1.97 90 HELO_NO_DOMAIN 9400 1.63 0.61 1.97 91 ANY_BOUNCE_MESSAGE 9294 1.60 0.53 1.95 92 BOUNCE_MESSAGE 9290 1.59 0.53 1.95 93 XM_SPF_SoftFail 9224 2.77 5.29 1.93 94 SUBJ_ALL_CAPS 9116 2.56 4.50 1.91 95 TR_MetaPhish_Combo_01 9104 1.61 0.71 1.91 96 XM_OfRef6 8512 1.94 2.43 1.79 97 XM_DK_Undo_01 8360 1.57 1.02 1.75 98 TooManyTo_003 8118 1.43 0.62 1.70 99 TM2_M_URI_OPT_OUT 8083 2.15 3.51 1.70 100 MIME_HTML_ONLY_MULTI 8040 2.05 3.15 1.69 101 IN_HORDE_ADDRESS_BOOK 7908 1.26 0.04 1.66 102 T_TooManySym_02 7847 1.46 0.90 1.65 103 URI_HEX 7779 2.04 3.26 1.63 104 XMCapTrack 7565 1.27 0.31 1.59 105 TR_Symld_Words 7543 1.45 1.04 1.58 106 INVALID_MSGID 7380 1.21 0.20 1.55 107 T_XMDrugObfuBody_08 7188 1.71 2.32 1.51 108 RELAYCOUNTRY_CA 6917 2.05 3.86 1.45 109 UNTRUSTED_Relay 6562 4.02 11.99 1.38 110 TR_XM_PHPDW 6286 2.56 6.31 1.32 111 TooManyTo_004 6171 1.10 0.50 1.29 112 TR_XM_PHPForged 6131 2.52 6.26 1.29 113 TR_XM_FormFill2 6109 2.51 6.24 1.28 114 XM_H_PHPOS 6091 2.51 6.22 1.28 115 XMGenDplmaNmb 6001 1.36 1.68 1.26 116 XM_GoogleGroups 5762 1.02 0.44 1.21 117 XMPhish11 5647 1.20 1.26 1.18 118 USER_IN_DEF_DKIM_WL 5589 0.88 0.01 1.17 119 RELAYCOUNTRY_GB 5582 1.15 1.08 1.17 120 URI_TRY_3LD 5443 1.25 1.58 1.14 121 TM2_M_VERY_LONG_WORD 5306 1.21 1.51 1.11 122 DKIM_ADSP_CUSTOM_MED 5165 1.07 1.04 1.08 123 TooManyTo_005 5149 0.91 0.41 1.08 124 NO_DNS_FOR_FROM 5037 1.44 2.62 1.06 125 SpammyFromTLD_01 4819 1.79 4.13 1.01 126 T_FILL_THIS_FORM_SHORT 4573 0.90 0.71 0.96 127 T_OBFU_PDF_ATTACH 4439 0.74 0.17 0.93 128 XMStockSpam_06 4426 1.05 1.41 0.93 129 XMBdyGiftCard01 4380 1.20 2.07 0.92 130 XM_H_Long_From02 4302 1.03 1.43 0.90 131 T_Symld_Words_02 4004 0.90 1.06 0.84 132 T_XMHurry_00 3864 0.95 1.37 0.81 133 XM_ProductURIs 3844 0.98 1.50 0.81 134 NML_ADSP_CUSTOM_MED 3809 0.82 0.90 0.80 135 XM_UB50 3716 1.90 5.27 0.78 136 TR_XM_RelayPhish 3651 0.88 1.21 0.77 137 XM_ShortIntro_01 3513 0.64 0.35 0.74 138 XM_H_PHPMailer 3436 0.81 1.09 0.72 139 XMSubMetaSxObfu_03 3357 0.77 0.97 0.70 140 FILL_THIS_FORM 3269 0.68 0.67 0.69 141 HTTPS_HTTP_MISMATCH 3161 0.64 0.56 0.66 142 T_XMDrugObfuBody_00 3151 0.81 1.24 0.66 143 XMLngstWrd_00 3135 0.61 0.47 0.66 144 XMSubMetaI_00 3118 1.16 2.70 0.65 145 THIS_AD 3018 0.66 0.74 0.63 146 XMLngstWrd_01 2912 0.56 0.43 0.61 147 XMBrknScrpt_02 2869 0.75 1.21 0.60 148 USER_IN_WHITELIST 2816 0.44 0.00 0.59 149 XMMoneyMeta_00 2764 0.75 1.25 0.58 150 XMBody_95 2750 0.45 0.08 0.58 151 PLING_QUERY 2740 0.58 0.59 0.57 152 XMSexyCombo_01 2724 0.92 1.99 0.57 153 XMGappySubj_01 2705 0.52 0.38 0.57 154 MISSING_HEADERS 2672 0.55 0.50 0.56 155 XMNoVowels 2619 0.55 0.55 0.55 156 XM_B_COPY_HTML 2597 0.59 0.74 0.54 157 T_TooManySym_03 2576 0.47 0.25 0.54 158 XMHTMLBadTable_001 2566 0.76 1.42 0.54 159 RELAYCOUNTRY_AU 2547 0.54 0.56 0.53 160 FILL_THIS_FORM_LONG 2528 0.53 0.54 0.53 161 HTML_FONT_FACE_BAD 2508 0.60 0.83 0.53 162 SHORT_HELO_AND_INLINE_IMAGE 2490 0.40 0.05 0.52 163 XMBody_17 2480 0.71 1.28 0.52 164 FILL_THIS_FORM_LOAN 2450 0.47 0.36 0.51 165 DKIM_ADSP_NXDOMAIN 2399 1.23 3.41 0.50 166 XMPhish30 2360 0.66 1.16 0.50 167 FORGED_GMAIL_RCVD 2322 0.59 0.91 0.49 168 TM2_M_BODY_EMPTY 2264 0.43 0.29 0.47 169 XMSolicitRefs_0 2210 0.44 0.39 0.46 170 TM2_M_A_HREF_HREF 2199 0.48 0.55 0.46 171 RCVD_IN_BL_SPAMCOP_NET 2170 0.93 2.36 0.46 172 HTML_TAG_BALANCE_BODY 2158 0.47 0.54 0.45 173 XMDateMe_00 2145 0.43 0.38 0.45 174 HTML_IMAGE_ONLY_24 2116 0.43 0.39 0.44 175 HTML_IMAGE_ONLY_28 2080 0.44 0.45 0.44 176 FSL_THIS_IS_ADV 2069 0.42 0.38 0.43 177 XM_USANA_RCVD 2003 0.32 0.00 0.42 178 XM_Body_Obfu01 1999 0.40 0.33 0.42 179 XM_URI_RBL 1997 1.07 3.04 0.42 180 XMBody_78 1973 0.72 1.65 0.41 181 HTML_IMAGE_ONLY_32 1965 0.49 0.73 0.41 182 RCVD_IN_SORBS_DUL 1960 0.36 0.20 0.41 183 FROM_GOV_DKIM_AU 1904 0.32 0.08 0.40 184 XMHTML_After_End 1902 0.54 0.98 0.40 185 URI_NOVOWEL 1899 0.48 0.71 0.40 186 FROM_GOV_SPOOF 1866 0.32 0.11 0.39 187 RDNS_DYNAMIC 1776 0.46 0.74 0.37 188 RELAYCOUNTRY_DE 1745 0.70 1.73 0.37 189 XMRcvdHeader_15 1717 0.27 0.00 0.36 190 DIET_1 1708 0.52 1.02 0.36 191 XMSubPhish11 1685 0.29 0.12 0.35 192 AC_DIV_BONANZA 1682 0.29 0.11 0.35 193 XMSubNoVowel 1672 0.39 0.51 0.35 194 XMSubMetaSxObfu_02 1649 0.37 0.43 0.35 195 HTML_IMAGE_ONLY_20 1648 0.66 1.62 0.35 196 TVD_SPACE_RATIO 1617 0.34 0.35 0.34 197 HTML_IMAGE_ONLY_16 1594 0.35 0.39 0.33 198 XM_B_REG_HTML 1591 0.48 0.92 0.33 199 NUMERIC_HTTP_ADDR 1578 0.35 0.42 0.33 200 XM_B_TRADE_HTML 1562 0.33 0.35 0.33 ----------------------------------------------------------------------