Email: 608898 Autolearn: 0 AvgScore: 3.21 AvgScanTime: 2.02 sec Spam: 158744 Autolearn: 0 AvgScore: 12.58 AvgScanTime: 2.47 sec Ham: 450154 Autolearn: 0 AvgScore: -0.10 AvgScanTime: 1.86 sec Time Spent Running SA: 341.77 hours Time Spent Processing Spam: 108.81 hours Time Spent Processing Ham: 232.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150419 87.19 94.76 84.52 2 DCC_CHECK 129212 51.22 81.40 40.58 3 DKIM_SIGNED 125233 76.06 78.89 75.06 4 XM_DK_Pass 120955 74.24 76.20 73.55 5 DKIM_VALID 115228 70.73 72.59 70.08 6 XM_B_Unicode 113382 68.64 71.42 67.66 7 XMListUnsubscribeExists 110596 55.26 69.67 50.17 8 DKIM_VALID_AU 89362 52.00 56.29 50.48 9 XM_B_Unicode3 76147 41.95 47.97 39.83 10 XM_DK_Undo_02 69753 20.68 43.94 12.47 11 MIME_HTML_ONLY 60946 25.32 38.39 20.71 12 BAYES_99 60267 18.35 37.96 11.43 13 BAYES_50 57253 47.86 36.07 52.02 14 LOC_TINY_FONT_1 56497 25.96 35.59 22.57 15 HTML_FONT_LOW_CONTRAST 56250 29.94 35.43 28.01 16 BAYES_999 48978 15.31 30.85 9.83 17 TR_DCC_Bayes_99 47654 11.73 30.02 5.28 18 XMSubLong 46834 24.96 29.50 23.36 19 FVGT_m_MULTI_ODD 39278 21.26 24.74 20.04 20 XM_Body_Dirty_Words 36872 15.54 23.23 12.82 21 RELAYCOUNTRY_META 34042 9.39 21.44 5.14 22 DKIM_VALID_EF 33715 26.00 21.24 27.68 23 FSL_BULK_SIG 30011 10.81 18.91 7.95 24 T_KAM_HTML_FONT_INVALID 29900 17.51 18.84 17.04 25 T_TM2_M_HEADER_IN_MSG 28139 26.09 17.73 29.04 26 MultiRelay 28106 18.56 17.71 18.86 27 DCC_CHECK_NEGATIVE 27065 46.82 17.05 57.31 28 XM_Multi_Part_URI 26735 13.43 16.84 12.23 29 LOTS_OF_MONEY 26264 12.31 16.54 10.81 30 XM_Evil_Numbers_Gen 24299 10.37 15.31 8.63 31 XM_UncommonTLD01 23614 6.89 14.88 4.07 32 XMSexyCombo_05 22050 6.51 13.89 3.91 33 UNTRUSTED_Relay 21528 4.57 13.56 1.40 34 BOTNET 21043 4.75 13.26 1.74 35 BOTNET_IPINHOSTNAME 20544 6.62 12.94 4.39 36 HTML_IMAGE_RATIO_02 20383 9.40 12.84 8.19 37 SpammyFromTLD_02 20040 3.61 12.62 0.43 38 HTML_IMAGE_RATIO_04 17226 7.10 10.85 5.77 39 T_REMOTE_IMAGE 17123 5.93 10.79 4.22 40 XMSubMetaSx_00 16281 5.66 10.26 4.04 41 BODY_URI_ONLY 14477 2.45 9.12 0.10 42 T_XMDrugObfuBody_14 14400 8.06 9.07 7.71 43 HTML_SHORT_LINK_IMG_1 14132 2.36 8.90 0.06 44 XM_DIRTYINTL 13787 3.99 8.69 2.33 45 TooManyTo_001 13779 9.18 8.68 9.36 46 KHOP_HELO_FCRDNS 13062 3.60 8.23 1.96 47 LotsOfNums_01 12923 8.36 8.14 8.43 48 BAYES_80 12814 5.45 8.07 4.53 49 XM_B_Phish_Phrases 12504 6.23 7.88 5.65 50 BAYES_60 12278 6.88 7.73 6.58 51 MPART_ALT_DIFF 11861 4.30 7.47 3.18 52 NUMERIC_HTTP_ADDR 11462 2.23 7.22 0.48 53 NORMAL_HTTP_TO_IP 10714 1.79 6.75 0.04 54 HTML_IMAGE_ONLY_12 10467 1.87 6.59 0.21 55 URI_HEX_IP 10397 1.71 6.55 0.00 56 XM_UB50 10212 2.35 6.43 0.91 57 XMNumbers 10207 4.63 6.43 4.00 58 DKIM_INVALID 10005 5.32 6.30 4.98 59 XM_H_Long_From01 9596 6.40 6.04 6.53 60 REPLYTO_WITHOUT_TO_CC 9521 1.59 6.00 0.04 61 MIME_HEADER_CTYPE_ONLY 9393 1.64 5.92 0.14 62 XM_H_Long_From03 9377 1.58 5.91 0.06 63 XMLongAddy 9319 1.57 5.87 0.05 64 FROM_MISSP_REPLYTO 9279 1.53 5.85 0.00 65 MIME_QP_LONG_LINE 9177 5.70 5.78 5.67 66 T_TooManySym_01 8983 6.29 5.66 6.51 67 XM_B_SpammyTLD 8608 4.21 5.42 3.78 68 T_XMDrugObfuBody_08 7795 2.50 4.91 1.65 69 RELAYCOUNTRY_CA 7359 2.30 4.64 1.48 70 XM_SendGrid 7329 5.89 4.62 6.33 71 BAYES_95 7253 3.43 4.57 3.02 72 HTML_IMAGE_RATIO_06 6987 3.61 4.40 3.33 73 XMStockSpam_06 6965 1.81 4.39 0.90 74 XMSexyCombo_01 6866 1.70 4.33 0.77 75 RCVD_IN_MSPIKE_H2 6739 6.20 4.25 6.88 76 MIME_HTML_ONLY_MULTI 6555 2.34 4.13 1.71 77 MIME_HTML_MOSTLY 5908 2.58 3.72 2.18 78 RCVD_IN_BL_SPAMCOP_NET 5825 1.45 3.67 0.67 79 TM2_M_URI_OPT_OUT 5773 2.21 3.64 1.71 80 XM_RXBody 5737 1.24 3.61 0.40 81 URI_HEX 5414 2.28 3.41 1.88 82 HTML_IMAGE_RATIO_08 5310 2.47 3.35 2.16 83 FROM_SUSPICIOUS_NTLD 5202 0.87 3.28 0.02 84 FROM_EXCESS_BASE64 5163 3.03 3.25 2.96 85 RCVD_IN_RP_SAFE 5141 8.59 3.24 10.48 86 XM_SPF_SoftFail 5080 2.06 3.20 1.65 87 FROM_SUSPICIOUS_NTLD_FP 5045 0.84 3.18 0.01 88 XMStrtUSub 4810 3.66 3.03 3.88 89 T_Symld_Words_02 4808 1.23 3.03 0.60 90 XMBdyGiftCard01 4709 1.34 2.97 0.77 91 TR_XM_RelayPhish 4649 1.35 2.93 0.79 92 RELAYCOUNTRY_FR 4549 0.94 2.87 0.26 93 RCVD_IN_IADB_LISTED 4511 5.16 2.84 5.98 94 XM_DKIMWhitelistDomains 4304 6.33 2.71 7.61 95 XMDiploma_00 4239 1.96 2.67 1.71 96 NO_DNS_FOR_FROM 4224 1.39 2.66 0.95 97 SUBJ_DOLLARS 4216 0.98 2.66 0.39 98 RCVD_IN_IADB_SPF 4141 4.45 2.61 5.10 99 US_DOLLARS_3 4064 3.11 2.56 3.30 100 HTML_IMAGE_ONLY_08 4055 0.77 2.55 0.14 101 XM_CamelCaseFrm001 4043 2.15 2.55 2.02 102 XMSubMetaSxObfu_03 4003 1.03 2.52 0.50 103 RCVD_IN_RP_RNBL 3994 0.69 2.52 0.05 104 RCVD_IN_IADB_SENDERID 3988 3.92 2.51 4.41 105 RCVD_IN_IADB_DK 3987 3.81 2.51 4.26 106 XM_URI_RBL 3935 0.84 2.48 0.26 107 TR_XM_DK_SendGrid 3824 2.85 2.41 3.01 108 XMSexyCombo_04 3806 0.73 2.40 0.14 109 HTML_MIME_NO_HTML_TAG 3588 2.23 2.26 2.22 110 XMSubMetaI_00 3584 1.45 2.26 1.17 111 RCVD_IN_RP_CERTIFIED 3553 7.45 2.24 9.29 112 BAYES_40 3513 3.53 2.21 3.99 113 MultiRelay_CC 3487 0.74 2.20 0.23 114 MultiRelay_Combo 3487 0.74 2.20 0.23 115 XM_UB60 3476 0.63 2.19 0.08 116 XMGenDplmaNmb 3475 1.41 2.19 1.14 117 DKIM_ADSP_NXDOMAIN 3465 0.91 2.18 0.46 118 RELAYCOUNTRY_GB 3428 1.30 2.16 1.00 119 XM_BadFromFormat 3428 0.67 2.16 0.14 120 SUBJ_ALL_CAPS 3411 2.85 2.15 3.09 121 XM_OfRef6 3404 1.81 2.14 1.69 122 FVGT_m_MULTI_ODD_EMAIL 3384 0.58 2.13 0.03 123 XM_H_TOP 3376 0.56 2.13 0.00 124 LOADSA_MONEY_COMBO 3323 0.57 2.09 0.04 125 RELAYCOUNTRY_NL 3235 0.68 2.04 0.21 126 ALL_TRUSTED 3087 12.75 1.94 16.56 127 TR_XM_PHPDW 3027 0.88 1.91 0.51 128 TR_XM_PHPForged 3000 0.86 1.89 0.50 129 TR_XM_FormFill2 2983 0.85 1.88 0.49 130 XM_H_PHPOS 2971 0.85 1.87 0.49 131 TM2_M_VERY_LONG_WORD 2965 1.23 1.87 1.01 132 HDRS_LCASE_IMGONLY 2929 0.54 1.85 0.08 133 TR_Symld_Words 2925 2.11 1.84 2.20 134 XM_UB99 2922 0.49 1.84 0.01 135 XMSubMetaSx_01 2916 0.60 1.84 0.16 136 MONEY_FROM_MISSP 2778 0.46 1.75 0.00 137 RCVD_IN_MSPIKE_WL 2712 4.52 1.71 5.51 138 XMBody_17 2702 0.84 1.70 0.54 139 T_XMDrugObfuBody_00 2674 1.12 1.68 0.92 140 XMSexyCombo_02 2496 0.45 1.57 0.05 141 TR_LOTS_OF_MONEY2 2332 0.70 1.47 0.43 142 T_MONEY_PERCENT 2332 0.70 1.47 0.43 143 BAYES_20 2288 2.69 1.44 3.13 144 XM_H_Long_From02 2267 1.15 1.43 1.05 145 XMhairloss01 2223 0.40 1.40 0.04 146 MAILING_LIST_MULTI 2216 2.06 1.40 2.29 147 RELAYCOUNTRY_IN 2169 0.44 1.37 0.11 148 XM_UB999 2131 0.36 1.34 0.01 149 XM_DK_Undo_01 2102 1.57 1.32 1.65 150 DATE_IN_PAST_06_12 2095 0.38 1.32 0.04 151 RCVD_IN_MSPIKE_H3 2023 4.33 1.27 5.41 152 SpammyFromTLD_01 2022 0.85 1.27 0.70 153 XMPhish11 2014 1.17 1.27 1.14 154 BOTNET_NORDNS 1973 0.36 1.24 0.04 155 TR_LOTS_OF_MONEY3 1925 0.66 1.21 0.47 156 HTML_FONT_FACE_BAD 1921 0.64 1.21 0.45 157 TooManyTo_002 1893 2.65 1.19 3.17 158 XMMoneyMeta_00 1878 0.65 1.18 0.46 159 URI_TRY_3LD 1786 1.15 1.13 1.16 160 XM_UB80 1781 0.31 1.12 0.02 161 RCVD_IN_PSBL 1774 0.31 1.12 0.03 162 TM2_M_A_HREF_HREF 1774 1.11 1.12 1.11 163 XMSubMetaSSx_00 1771 0.49 1.12 0.26 164 DATE_IN_PAST_03_06 1719 0.35 1.08 0.09 165 DIET_1 1713 0.52 1.08 0.32 166 RCVD_IN_IADB_VOUCHED 1706 3.37 1.07 4.18 167 NORDNS_LOW_CONTRAST 1703 0.29 1.07 0.01 168 FROM_LOCAL_NOVOWEL 1703 0.30 1.07 0.02 169 XMHTML_After_End 1702 0.54 1.07 0.36 170 XM_H_PHPMailer 1697 0.63 1.07 0.48 171 RELAYCOUNTRY_RU 1691 0.30 1.07 0.02 172 XM_ProductURIs 1690 0.90 1.06 0.84 173 RELAYCOUNTRY_AT 1649 0.36 1.04 0.11 174 TooManyTo_003 1644 1.92 1.04 2.23 175 T_FILL_THIS_FORM_SHORT 1631 0.87 1.03 0.82 176 UNPARSEABLE_RELAY 1613 2.13 1.02 2.53 177 XMPhish30 1580 0.59 1.00 0.44 178 BAYES_00 1550 9.86 0.98 13.00 179 NO_MEDICAL 1548 0.26 0.98 0.01 180 T_TooManySym_02 1505 2.12 0.95 2.54 181 TR_Mismatch_TLD_02 1468 0.30 0.92 0.08 182 TooManyTo_004 1460 1.46 0.92 1.65 183 XMBody_78 1445 0.66 0.91 0.57 184 DATE_IN_PAST_12_24 1431 0.28 0.90 0.07 185 TVD_SPACE_RATIO 1429 0.52 0.90 0.39 186 XM_H_PHPOS_M 1419 0.36 0.89 0.17 187 XM_B_REG_HTML 1410 0.53 0.89 0.40 188 DKIM_ADSP_CUSTOM_MED 1374 1.05 0.87 1.12 189 RELAYCOUNTRY_DE 1370 0.47 0.86 0.34 190 T_XMHurry_00 1346 0.67 0.85 0.61 191 XMSlimDrugH 1340 0.47 0.84 0.34 192 XMBrknScrpt_02 1327 0.64 0.84 0.57 193 TR_M_TOP_BAYES 1299 0.21 0.82 0.00 194 THIS_AD 1296 0.60 0.82 0.53 195 SUBJ_OBFU_PUNCT_FEW 1283 0.26 0.81 0.07 196 TVD_SPACE_RATIO_MINFP 1272 0.21 0.80 0.01 197 PLING_QUERY 1260 0.69 0.79 0.65 198 URIBL_BLACK 1239 0.22 0.78 0.02 199 TR_Caps_n_Bayes_99 1237 0.37 0.78 0.23 200 RDNS_DYNAMIC 1236 0.50 0.78 0.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 380460 87.19 94.76 84.52 2 DKIM_SIGNED 337870 76.06 78.89 75.06 3 XM_DK_Pass 331105 74.24 76.20 73.55 4 DKIM_VALID 315467 70.73 72.59 70.08 5 XM_B_Unicode 304565 68.64 71.42 67.66 6 DCC_CHECK_NEGATIVE 258004 46.82 17.05 57.31 7 BAYES_50 234191 47.86 36.07 52.02 8 DKIM_VALID_AU 227238 52.00 56.29 50.48 9 XMListUnsubscribeExists 225860 55.26 69.67 50.17 10 DCC_CHECK 182654 51.22 81.40 40.58 11 XM_B_Unicode3 179293 41.95 47.97 39.83 12 T_TM2_M_HEADER_IN_MSG 130711 26.09 17.73 29.04 13 HTML_FONT_LOW_CONTRAST 126082 29.94 35.43 28.01 14 DKIM_VALID_EF 124615 26.00 21.24 27.68 15 XMSubLong 105146 24.96 29.50 23.36 16 LOC_TINY_FONT_1 101598 25.96 35.59 22.57 17 MIME_HTML_ONLY 93221 25.32 38.39 20.71 18 FVGT_m_MULTI_ODD 90195 21.26 24.74 20.04 19 MultiRelay 84907 18.56 17.71 18.86 20 T_KAM_HTML_FONT_INVALID 76725 17.51 18.84 17.04 21 ALL_TRUSTED 74535 12.75 1.94 16.56 22 BAYES_00 58505 9.86 0.98 13.00 23 XM_Body_Dirty_Words 57730 15.54 23.23 12.82 24 XM_DK_Undo_02 56149 20.68 43.94 12.47 25 XM_Multi_Part_URI 55038 13.43 16.84 12.23 26 BAYES_99 51449 18.35 37.96 11.43 27 LOTS_OF_MONEY 48684 12.31 16.54 10.81 28 RCVD_IN_RP_SAFE 47163 8.59 3.24 10.48 29 TR_XM_DK_Bayes 46928 7.84 0.52 10.42 30 TR_XM_DK_Bayes1 44393 7.41 0.46 9.86 31 BAYES_999 44254 15.31 30.85 9.83 32 TooManyTo_001 42136 9.18 8.68 9.36 33 RCVD_IN_RP_CERTIFIED 41840 7.45 2.24 9.29 34 XM_Evil_Numbers_Gen 38854 10.37 15.31 8.63 35 LotsOfNums_01 37961 8.36 8.14 8.43 36 HTML_IMAGE_RATIO_02 36878 9.40 12.84 8.19 37 TR_XM_DK_Bayes2 36360 6.06 0.34 8.08 38 FSL_BULK_SIG 35796 10.81 18.91 7.95 39 T_XMDrugObfuBody_14 34687 8.06 9.07 7.71 40 XM_DKIMWhitelistDomains 34268 6.33 2.71 7.61 41 RCVD_IN_MSPIKE_H2 30987 6.20 4.25 6.88 42 BAYES_60 29615 6.88 7.73 6.58 43 XM_H_Long_From01 29378 6.40 6.04 6.53 44 T_TooManySym_01 29311 6.29 5.66 6.51 45 XM_SendGrid 28509 5.89 4.62 6.33 46 RCVD_IN_IADB_LISTED 26928 5.16 2.84 5.98 47 HTML_IMAGE_RATIO_04 25980 7.10 10.85 5.77 48 MIME_QP_LONG_LINE 25508 5.70 5.78 5.67 49 XM_B_Phish_Phrases 25455 6.23 7.88 5.65 50 RCVD_IN_MSPIKE_WL 24814 4.52 1.71 5.51 51 RCVD_IN_MSPIKE_H3 24357 4.33 1.27 5.41 52 TR_DCC_Bayes_99 23789 11.73 30.02 5.28 53 RELAYCOUNTRY_META 23138 9.39 21.44 5.14 54 RCVD_IN_IADB_SPF 22949 4.45 2.61 5.10 55 DKIM_INVALID 22403 5.32 6.30 4.98 56 XM_PDF 20508 3.52 0.57 4.56 57 BAYES_80 20398 5.45 8.07 4.53 58 RCVD_IN_IADB_SENDERID 19860 3.92 2.51 4.41 59 BOTNET_IPINHOSTNAME 19781 6.62 12.94 4.39 60 RCVD_IN_IADB_DK 19184 3.81 2.51 4.26 61 T_REMOTE_IMAGE 18999 5.93 10.79 4.22 62 RCVD_IN_IADB_VOUCHED 18838 3.37 1.07 4.18 63 XM_UncommonTLD01 18309 6.89 14.88 4.07 64 XMSubMetaSx_00 18204 5.66 10.26 4.04 65 IN_ZIMBRA_NJ_WHITELIST 18006 2.96 0.02 4.00 66 XMNumbers 17990 4.63 6.43 4.00 67 BAYES_40 17966 3.53 2.21 3.99 68 XMSexyCombo_05 17593 6.51 13.89 3.91 69 XMStrtUSub 17468 3.66 3.03 3.88 70 TO_MALFORMED 17164 2.82 0.00 3.81 71 XM_B_SpammyTLD 17013 4.21 5.42 3.78 72 HTML_IMAGE_RATIO_06 15003 3.61 4.40 3.33 73 US_DOLLARS_3 14859 3.11 2.56 3.30 74 MPART_ALT_DIFF 14333 4.30 7.47 3.18 75 TooManyTo_002 14271 2.65 1.19 3.17 76 BAYES_20 14069 2.69 1.44 3.13 77 SUBJ_ALL_CAPS 13926 2.85 2.15 3.09 78 BAYES_95 13608 3.43 4.57 3.02 79 TR_XM_DK_SendGrid 13540 2.85 2.41 3.01 80 FROM_EXCESS_BASE64 13304 3.03 3.25 2.96 81 RCVD_IN_IADB_OPTIN 12173 2.15 0.59 2.70 82 T_TooManySym_02 11433 2.12 0.95 2.54 83 UNPARSEABLE_RELAY 11367 2.13 1.02 2.53 84 INVALID_MSGID 10828 1.80 0.09 2.41 85 XM_DIRTYINTL 10492 3.99 8.69 2.33 86 ANY_BOUNCE_MESSAGE 10399 1.79 0.32 2.31 87 BOUNCE_MESSAGE 10394 1.79 0.32 2.31 88 MAILING_LIST_MULTI 10310 2.06 1.40 2.29 89 TooManyTo_003 10040 1.92 1.04 2.23 90 HTML_MIME_NO_HTML_TAG 10011 2.23 2.26 2.22 91 TR_Symld_Words 9901 2.11 1.84 2.20 92 MIME_HTML_MOSTLY 9803 2.58 3.72 2.18 93 HTML_IMAGE_RATIO_08 9740 2.47 3.35 2.16 94 TVD_RCVD_IP 9650 1.74 0.61 2.14 95 XM_CamelCaseFrm001 9078 2.15 2.55 2.02 96 BAYES_05 9012 1.68 0.76 2.00 97 KHOP_HELO_FCRDNS 8834 3.60 8.23 1.96 98 URI_HEX 8457 2.28 3.41 1.88 99 TR_MetaPhish_Combo_01 8322 1.54 0.68 1.85 100 CK_HELO_DYNAMIC_SPLIT_IP 8275 1.44 0.31 1.84 101 HELO_DYNAMIC_IPADDR2 8271 1.39 0.14 1.84 102 BOTNET 7853 4.75 13.26 1.74 103 IN_HORDE_ADDRESS_BOOK 7753 1.28 0.03 1.72 104 MIME_HTML_ONLY_MULTI 7716 2.34 4.13 1.71 105 XMDiploma_00 7705 1.96 2.67 1.71 106 TM2_M_URI_OPT_OUT 7699 2.21 3.64 1.71 107 XM_OfRef6 7607 1.81 2.14 1.69 108 XM_SPF_SoftFail 7442 2.06 3.20 1.65 109 XM_DK_Undo_01 7437 1.57 1.32 1.65 110 TooManyTo_004 7426 1.46 0.92 1.65 111 T_XMDrugObfuBody_08 7420 2.50 4.91 1.65 112 HELO_NODOT 7142 1.32 0.56 1.59 113 HELO_NO_DOMAIN 7141 1.32 0.56 1.59 114 RELAYCOUNTRY_CA 6672 2.30 4.64 1.48 115 UNTRUSTED_Relay 6307 4.57 13.56 1.40 116 XMGappySubj_01 6119 1.10 0.35 1.36 117 XMCapTrack 5790 1.01 0.23 1.29 118 TooManyTo_005 5748 1.14 0.77 1.28 119 XMSubMetaI_00 5265 1.45 2.26 1.17 120 URI_TRY_3LD 5218 1.15 1.13 1.16 121 XMPhish11 5136 1.17 1.27 1.14 122 XMGenDplmaNmb 5134 1.41 2.19 1.14 123 XM_GoogleGroups 5043 0.94 0.41 1.12 124 USER_IN_DEF_DKIM_WL 5032 0.83 0.00 1.12 125 DKIM_ADSP_CUSTOM_MED 5026 1.05 0.87 1.12 126 TM2_M_A_HREF_HREF 4979 1.11 1.12 1.11 127 XM_H_Long_From02 4721 1.15 1.43 1.05 128 TM2_M_VERY_LONG_WORD 4552 1.23 1.87 1.01 129 RELAYCOUNTRY_GB 4492 1.30 2.16 1.00 130 NO_DNS_FOR_FROM 4256 1.39 2.66 0.95 131 T_XMDrugObfuBody_00 4161 1.12 1.68 0.92 132 XM_D_tchamptons_WL 4124 0.68 0.00 0.92 133 XM_UB50 4101 2.35 6.43 0.91 134 XMStockSpam_06 4068 1.81 4.39 0.90 135 NML_ADSP_CUSTOM_MED 3788 0.80 0.67 0.84 136 XM_ProductURIs 3782 0.90 1.06 0.84 137 T_FILL_THIS_FORM_SHORT 3681 0.87 1.03 0.82 138 TR_XM_RelayPhish 3542 1.35 2.93 0.79 139 XMSexyCombo_01 3478 1.70 4.33 0.77 140 XMBdyGiftCard01 3463 1.34 2.97 0.77 141 HTTPS_HTTP_MISMATCH 3194 0.70 0.67 0.71 142 SpammyFromTLD_01 3144 0.85 1.27 0.70 143 T_TooManySym_03 3079 0.65 0.54 0.68 144 RCVD_IN_BL_SPAMCOP_NET 3022 1.45 3.67 0.67 145 PLING_QUERY 2943 0.69 0.79 0.65 146 T_OBFU_PDF_ATTACH 2900 0.51 0.13 0.64 147 XM_ShortIntro_01 2824 0.54 0.29 0.63 148 USER_IN_WHITELIST 2805 0.46 0.00 0.62 149 T_XMHurry_00 2744 0.67 0.85 0.61 150 T_Symld_Words_02 2690 1.23 3.03 0.60 151 FILL_THIS_FORM 2625 0.60 0.63 0.58 152 XMBrknScrpt_02 2568 0.64 0.84 0.57 153 XMBody_78 2554 0.66 0.91 0.57 154 XMBody_95 2528 0.44 0.09 0.56 155 FROM_GOV_SPOOF 2499 0.49 0.29 0.56 156 RELAYCOUNTRY_AU 2470 0.52 0.43 0.55 157 XMNoVowels 2462 0.50 0.38 0.55 158 XMBody_17 2413 0.84 1.70 0.54 159 THIS_AD 2387 0.60 0.82 0.53 160 XMHTMLBadTable_001 2363 0.56 0.65 0.52 161 TR_XM_PHPDW 2304 0.88 1.91 0.51 162 HTML_TAG_BALANCE_BODY 2281 0.54 0.65 0.51 163 XMSubMetaSxObfu_03 2263 1.03 2.52 0.50 164 TR_XM_PHPForged 2246 0.86 1.89 0.50 165 TM2_M_BODY_EMPTY 2226 0.39 0.09 0.49 166 FILL_THIS_FORM_LONG 2216 0.50 0.53 0.49 167 TR_XM_FormFill2 2213 0.85 1.88 0.49 168 FILL_THIS_FORM_LOAN 2212 0.44 0.28 0.49 169 URI_NOVOWEL 2205 0.54 0.68 0.49 170 XM_H_PHPOS 2203 0.85 1.87 0.49 171 FORGED_GMAIL_RCVD 2195 0.55 0.74 0.49 172 XM_B_COPY_HTML 2170 0.54 0.69 0.48 173 XM_H_PHPMailer 2152 0.63 1.07 0.48 174 NUMERIC_HTTP_ADDR 2146 2.23 7.22 0.48 175 TR_LOTS_OF_MONEY3 2110 0.66 1.21 0.47 176 DKIM_ADSP_NXDOMAIN 2066 0.91 2.18 0.46 177 XMMoneyMeta_00 2060 0.65 1.18 0.46 178 HTML_FONT_FACE_BAD 2005 0.64 1.21 0.45 179 XMPhish30 1987 0.59 1.00 0.44 180 SpammyFromTLD_02 1953 3.61 12.62 0.43 181 TR_LOTS_OF_MONEY2 1927 0.70 1.47 0.43 182 SHORT_HELO_AND_INLINE_IMAGE 1927 0.32 0.03 0.43 183 T_MONEY_PERCENT 1927 0.70 1.47 0.43 184 FROM_GOV_DKIM_AU 1892 0.33 0.08 0.42 185 MISSING_HEADERS 1880 0.41 0.40 0.42 186 XMOemUri 1859 0.35 0.17 0.41 187 XMSubMetaSxObfu_02 1830 0.38 0.32 0.41 188 REMOVE_BEFORE_LINK 1823 0.43 0.50 0.40 189 XMLngstWrd_00 1818 0.43 0.50 0.40 190 XM_RXBody 1812 1.24 3.61 0.40 191 HTML_IMAGE_ONLY_32 1802 0.38 0.30 0.40 192 RDNS_DYNAMIC 1798 0.50 0.78 0.40 193 XM_B_REG_HTML 1797 0.53 0.89 0.40 194 SUBJ_DOLLARS 1760 0.98 2.66 0.39 195 TVD_SPACE_RATIO 1755 0.52 0.90 0.39 196 XMPhish14 1755 0.46 0.65 0.39 197 FSL_THIS_IS_ADV 1740 0.41 0.49 0.39 198 HTML_IMAGE_ONLY_28 1725 0.41 0.50 0.38 199 XMGappySubj_02 1715 0.30 0.09 0.38 200 XMLngstWrd_01 1697 0.41 0.49 0.38 ----------------------------------------------------------------------