Email: 368660 Autolearn: 0 AvgScore: 1.56 AvgScanTime: 4.85 sec Spam: 83956 Autolearn: 0 AvgScore: 12.49 AvgScanTime: 5.77 sec Ham: 284704 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 4.58 sec Time Spent Running SA: 496.82 hours Time Spent Processing Spam: 134.53 hours Time Spent Processing Ham: 362.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77758 86.43 92.62 84.61 2 DCC_CHECK 68296 54.37 81.35 46.41 3 DKIM_SIGNED 67325 79.00 80.19 78.65 4 XM_DK_Pass 65576 77.64 78.11 77.50 5 DKIM_VALID 59748 71.96 71.17 72.19 6 XMListUnsubscribeExists 59240 58.28 70.56 54.65 7 DKIM_VALID_AU 49957 54.86 59.50 53.49 8 XM_H_QuotedFrom 46621 42.62 55.53 38.81 9 BAYES_50 41770 53.26 49.75 54.30 10 LOC_TINY_FONT_1 31285 28.55 37.26 25.98 11 HTML_FONT_LOW_CONTRAST 29557 32.00 35.21 31.05 12 XM_DK_Undo_02 29163 14.23 34.74 8.18 13 MIME_HTML_ONLY 27603 24.99 32.88 22.66 14 BAYES_99 22077 10.92 26.30 6.38 15 FVGT_m_MULTI_ODD 21384 22.65 25.47 21.81 16 XMSubLong 21048 21.69 25.07 20.70 17 RELAYCOUNTRY_META 21041 9.03 25.06 4.30 18 HTML_IMAGE_RATIO_02 18070 12.63 21.52 10.00 19 BAYES_999 17961 9.06 21.39 5.42 20 TR_DCC_Bayes_99 17805 7.61 21.21 3.60 21 DKIM_VALID_EF 16918 27.59 20.15 29.78 22 XM_Body_Dirty_Words 16538 13.80 19.70 12.05 23 UNTRUSTED_Relay 15401 5.08 18.34 1.16 24 MultiRelay 15134 16.87 18.03 16.54 25 BOTNET 14899 6.01 17.75 2.55 26 DCC_CHECK_NEGATIVE 14624 44.64 17.42 52.67 27 T_KAM_HTML_FONT_INVALID 13813 16.25 16.45 16.20 28 BOTNET_IPINHOSTNAME 13698 9.51 16.32 7.50 29 T_TM2_M_HEADER_IN_MSG 13467 22.80 16.04 24.79 30 XM_Evil_Numbers_Gen 13322 10.72 15.87 9.20 31 XM_Multi_Part_URI 13071 14.04 15.57 13.59 32 FSL_BULK_SIG 12672 10.51 15.09 9.16 33 STYLE_GIBBERISH 11937 14.10 14.22 14.06 34 HTML_IMAGE_RATIO_04 10819 8.32 12.89 6.97 35 XM_UncommonTLD01 10406 6.08 12.39 4.22 36 LOTS_OF_MONEY 10277 10.99 12.24 10.63 37 XMSexyCombo_05 9890 5.97 11.78 4.26 38 MPART_ALT_DIFF 8598 5.49 10.24 4.09 39 XM_UB50 8507 2.85 10.13 0.70 40 FROM_EXCESS_BASE64 7768 5.07 9.25 3.84 41 DKIM_INVALID 7577 7.05 9.02 6.46 42 T_XMDrugObfuBody_14 7249 7.22 8.63 6.80 43 TooManyTo_001 6930 6.63 8.25 6.15 44 SpammyFromTLD_02 6896 1.99 8.21 0.16 45 XMSubMetaSx_00 6840 5.23 8.15 4.37 46 XM_H_Long_From01 6631 6.26 7.90 5.78 47 XM_B_Phish_Phrases 5576 6.20 6.64 6.06 48 MultiRelay_CC 5106 1.47 6.08 0.11 49 MultiRelay_Combo 5106 1.47 6.08 0.11 50 XMNumbers 5065 4.44 6.03 3.98 51 BAYES_60 4815 5.00 5.74 4.78 52 BAYES_80 4778 3.44 5.69 2.77 53 XM_DIRTYINTL 4160 2.71 4.95 2.04 54 T_REMOTE_IMAGE 3858 4.83 4.60 4.90 55 MIME_HTML_MOSTLY 3818 3.23 4.55 2.84 56 LotsOfNums_01 3783 7.39 4.51 8.23 57 MIME_HTML_ONLY_MULTI 3595 2.50 4.28 1.98 58 RELAYCOUNTRY_CA 3493 2.33 4.16 1.78 59 RCVD_IN_RP_RNBL 3478 0.99 4.14 0.06 60 TR_Mismatch_TLD_02 3407 0.99 4.06 0.08 61 HTML_MIME_NO_HTML_TAG 3340 2.38 3.98 1.91 62 XMStrtUSub 3271 5.38 3.90 5.82 63 URI_HEX 3248 2.58 3.87 2.20 64 HTML_IMAGE_RATIO_06 3112 3.71 3.71 3.72 65 XMBdyGiftCard01 3106 1.77 3.70 1.21 66 BAYES_95 3065 2.16 3.65 1.72 67 XM_CamelCaseFrm001 2833 2.13 3.37 1.76 68 UNPARSEABLE_RELAY 2827 4.54 3.37 4.88 69 TM2_M_URI_OPT_OUT 2826 2.03 3.37 1.64 70 RELAYCOUNTRY_IN 2723 0.77 3.24 0.05 71 T_TooManySym_01 2697 6.43 3.21 7.38 72 RCVD_IN_RP_SAFE 2620 8.29 3.12 9.81 73 URIBL_DBL_SPAM 2615 0.80 3.11 0.12 74 BOTNET_NORDNS 2567 0.71 3.06 0.01 75 RCVD_IN_MSPIKE_H2 2563 4.53 3.05 4.97 76 XM_SendGrid 2561 5.60 3.05 6.36 77 XM_SPF_SoftFail 2460 2.00 2.93 1.72 78 BAYES_40 2405 4.11 2.86 4.48 79 BAYES_00 2378 16.09 2.83 20.00 80 RELAYCOUNTRY_FR 2351 0.82 2.80 0.24 81 RELAYCOUNTRY_CN 2299 0.64 2.74 0.02 82 T_MONEY_PERCENT 2244 0.90 2.67 0.37 83 TR_LOTS_OF_MONEY2 2244 0.90 2.67 0.37 84 XMSexyCombo_01 2204 1.07 2.63 0.61 85 SpammyFromTLD_01 2190 0.88 2.61 0.37 86 RCVD_IN_BL_SPAMCOP_NET 2173 0.88 2.59 0.38 87 HTML_IMAGE_RATIO_08 2095 2.34 2.50 2.30 88 XM_OfRef6 2045 1.47 2.44 1.19 89 XM_UB99 1935 0.53 2.30 0.01 90 SUBJ_ALL_CAPS 1930 1.93 2.30 1.82 91 DIET_1 1913 0.81 2.28 0.38 92 RCVD_IN_RP_CERTIFIED 1855 7.09 2.21 8.53 93 TR_XM_DK_Bayes 1813 13.49 2.16 16.83 94 XM_ShortIntro_01 1805 0.72 2.15 0.29 95 DATE_IN_PAST_06_12 1802 0.52 2.15 0.03 96 MISSING_HEADERS 1754 0.68 2.09 0.26 97 XM_UB60 1750 0.51 2.08 0.05 98 BAYES_20 1738 3.08 2.07 3.37 99 REPLYTO_WITHOUT_TO_CC 1693 0.49 2.02 0.04 100 RELAYCOUNTRY_AT 1693 0.62 2.02 0.21 101 TR_XM_DK_Bayes1 1672 12.70 1.99 15.86 102 XMSubMetaI_00 1626 0.85 1.94 0.53 103 MIME_QP_LONG_LINE 1586 4.37 1.89 5.11 104 NO_DNS_FOR_FROM 1580 1.31 1.88 1.14 105 SUBJ_DOLLARS 1567 0.75 1.87 0.42 106 XM_H_Long_From02 1564 1.18 1.86 0.98 107 BODY_URI_ONLY 1552 0.46 1.85 0.05 108 RELAYCOUNTRY_JP 1519 0.43 1.81 0.02 109 TR_LOTS_OF_MONEY1 1497 0.42 1.78 0.01 110 RELAYCOUNTRY_SK 1470 0.40 1.75 0.00 111 MAILING_LIST_MULTI 1445 1.97 1.72 2.04 112 XMPhish30 1441 0.70 1.72 0.41 113 MPART_ALT_DIFF_COUNT 1437 0.61 1.71 0.28 114 T_HTML_TAG_BALANCE_CENTER 1434 0.43 1.71 0.06 115 URIBL_BLACK 1417 0.46 1.69 0.09 116 T_XMHurry_00 1407 1.02 1.68 0.82 117 TR_XM_DK_Bayes2 1397 10.22 1.66 12.74 118 XM_URI_RBL 1374 0.71 1.64 0.44 119 HTML_SHORT_LINK_IMG_1 1362 0.39 1.62 0.03 120 XMDiploma_00 1353 1.28 1.61 1.19 121 T_XMDrugObfuBody_08 1351 1.32 1.61 1.23 122 DATE_IN_PAST_03_06 1347 0.43 1.60 0.08 123 ALL_TRUSTED 1346 12.44 1.60 15.63 124 RELAYCOUNTRY_NG_I 1318 0.36 1.57 0.00 125 DKIM_ADSP_NXDOMAIN 1312 0.90 1.56 0.70 126 XM_ProductURIs 1293 1.24 1.54 1.15 127 XMStockSpam_06 1263 0.89 1.50 0.71 128 ADVANCE_FEE_3_NEW_MONEY 1230 0.34 1.47 0.00 129 TM2_M_VERY_LONG_WORD 1225 1.07 1.46 0.96 130 SHORTENER_SHORT_IMG 1186 0.32 1.41 0.00 131 URI_BUFFLY 1180 0.32 1.41 0.00 132 XM_OfRef7 1171 0.42 1.39 0.13 133 RELAYCOUNTRY_PT 1131 0.31 1.35 0.00 134 XM_BadFromFormat 1123 0.46 1.34 0.20 135 XM_B_REG_HTML 1120 0.90 1.33 0.77 136 BOUNCE_MESSAGE 1104 2.38 1.31 2.70 137 ANY_BOUNCE_MESSAGE 1104 2.38 1.31 2.70 138 TR_Symld_Words 1086 2.24 1.29 2.52 139 FILL_THIS_FORM 1063 0.77 1.27 0.63 140 XMSexyCombo_04 1031 0.41 1.23 0.17 141 XMPhish11 1017 1.03 1.21 0.98 142 HTML_FONT_SIZE_HUGE 1012 0.40 1.21 0.16 143 XMBody_17 1005 0.97 1.20 0.91 144 HTML_FONT_FACE_BAD 999 0.63 1.19 0.47 145 TR_XM_RelayPhish 999 0.62 1.19 0.46 146 XMSolicitRefs_0 971 0.62 1.16 0.47 147 FROM_SUSPICIOUS_NTLD 952 0.31 1.13 0.06 148 RDNS_DYNAMIC 949 0.67 1.13 0.53 149 XM_UB95 947 0.27 1.13 0.02 150 XM_UB80 938 0.27 1.12 0.02 151 XM_B_COPY_HTML 933 0.64 1.11 0.50 152 BAYES_05 930 1.95 1.11 2.19 153 XMSlimDrugH 929 0.48 1.11 0.30 154 RELAYCOUNTRY_DE 928 0.56 1.11 0.40 155 XM_UB999 919 0.25 1.09 0.00 156 HTML_IMAGE_ONLY_08 907 0.31 1.08 0.09 157 XM_RXBody 893 0.44 1.06 0.25 158 XM_Body_Obfu01 892 0.34 1.06 0.13 159 XM_B_Illumintati 887 0.26 1.06 0.03 160 BODY_ENHANCEMENT 873 0.25 1.04 0.02 161 XM_H_PHPOS 865 0.98 1.03 0.97 162 RCVD_IN_IADB_LISTED 862 4.30 1.03 5.26 163 MONEY_FRAUD_8 859 0.24 1.02 0.00 164 T_XMDrugObfuBody_00 842 0.91 1.00 0.88 165 URI_NOVOWEL 837 0.61 1.00 0.49 166 LongTLD 830 0.32 0.99 0.12 167 XMGenDplmaNmb 829 0.73 0.99 0.66 168 LOADSA_MONEY_COMBO 822 0.31 0.98 0.12 169 XM_S_JOY_D 817 0.49 0.97 0.35 170 XMLongAddy 816 0.25 0.97 0.04 171 BASE64_LENGTH_79_INF 814 0.29 0.97 0.10 172 XMSubMetaSSx_00 807 0.45 0.96 0.30 173 INVALID_DATE 803 0.28 0.96 0.08 174 XM_H_Long_From03 801 0.26 0.95 0.06 175 T_FILL_THIS_FORM_SHORT 797 0.68 0.95 0.60 176 XM_H_PHPMailer 777 0.77 0.93 0.73 177 TVD_PH_BODY_ACCOUNTS_PRE 774 0.31 0.92 0.13 178 XMNoVowels 770 0.51 0.92 0.40 179 URI_TRY_3LD 769 1.54 0.92 1.72 180 RELAYCOUNTRY_GB 748 0.58 0.89 0.49 181 HTML_IMAGE_ONLY_24 728 0.39 0.87 0.25 182 RCVD_IN_IADB_SPF 722 3.72 0.86 4.56 183 XM_DK_Undo_01 722 1.46 0.86 1.64 184 XMHTMLBadTable_001 711 0.67 0.85 0.62 185 XMWghtMeta_00 707 0.21 0.84 0.02 186 HTML_TEXT_INVISIBLE_STYLE 700 0.25 0.83 0.08 187 XMBody_78 689 0.71 0.82 0.68 188 DKIM_ADSP_CUSTOM_MED 688 0.70 0.82 0.67 189 DATE_IN_PAST_12_24 686 0.24 0.82 0.07 190 RCVD_IN_IADB_SENDERID 686 3.31 0.82 4.04 191 RCVD_IN_IADB_DK 676 3.18 0.81 3.89 192 HTML_TAG_BALANCE_BODY 672 0.45 0.80 0.34 193 XMSubGiftCard1 667 0.27 0.79 0.11 194 T_Symld_Words_02 659 0.71 0.78 0.69 195 NML_ADSP_CUSTOM_MED 648 0.50 0.77 0.43 196 XMHTML_After_End 642 0.48 0.76 0.40 197 XM_OfRef8 634 0.18 0.76 0.01 198 PLING_QUERY 620 0.57 0.74 0.52 199 RELAYCOUNTRY_AU 614 0.50 0.73 0.43 200 TooManyTo_002 611 1.14 0.73 1.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 240877 86.43 92.62 84.61 2 DKIM_SIGNED 223925 79.00 80.19 78.65 3 XM_DK_Pass 220641 77.64 78.11 77.50 4 DKIM_VALID 205523 71.96 71.17 72.19 5 XMListUnsubscribeExists 155601 58.28 70.56 54.65 6 BAYES_50 154587 53.26 49.75 54.30 7 DKIM_VALID_AU 152300 54.86 59.50 53.49 8 DCC_CHECK_NEGATIVE 149953 44.64 17.42 52.67 9 DCC_CHECK 132145 54.37 81.35 46.41 10 XM_H_QuotedFrom 110492 42.62 55.53 38.81 11 HTML_FONT_LOW_CONTRAST 88412 32.00 35.21 31.05 12 DKIM_VALID_EF 84788 27.59 20.15 29.78 13 LOC_TINY_FONT_1 73954 28.55 37.26 25.98 14 T_TM2_M_HEADER_IN_MSG 70588 22.80 16.04 24.79 15 MIME_HTML_ONLY 64516 24.99 32.88 22.66 16 FVGT_m_MULTI_ODD 62104 22.65 25.47 21.81 17 XMSubLong 58930 21.69 25.07 20.70 18 BAYES_00 56942 16.09 2.83 20.00 19 TR_XM_DK_Bayes 47914 13.49 2.16 16.83 20 MultiRelay 47076 16.87 18.03 16.54 21 T_KAM_HTML_FONT_INVALID 46109 16.25 16.45 16.20 22 TR_XM_DK_Bayes1 45166 12.70 1.99 15.86 23 ALL_TRUSTED 44504 12.44 1.60 15.63 24 XM_DKIMWhitelistDomains 42397 11.50 0.01 14.89 25 STYLE_GIBBERISH 40041 14.10 14.22 14.06 26 XM_Multi_Part_URI 38691 14.04 15.57 13.59 27 TR_XM_DK_Bayes2 36284 10.22 1.66 12.74 28 XM_Body_Dirty_Words 34320 13.80 19.70 12.05 29 LOTS_OF_MONEY 30250 10.99 12.24 10.63 30 HTML_IMAGE_RATIO_02 28479 12.63 21.52 10.00 31 RCVD_IN_RP_SAFE 27937 8.29 3.12 9.81 32 XM_Evil_Numbers_Gen 26203 10.72 15.87 9.20 33 FSL_BULK_SIG 26074 10.51 15.09 9.16 34 RCVD_IN_RP_CERTIFIED 24296 7.09 2.21 8.53 35 LotsOfNums_01 23445 7.39 4.51 8.23 36 XM_DK_Undo_02 23303 14.23 34.74 8.18 37 BOTNET_IPINHOSTNAME 21358 9.51 16.32 7.50 38 T_TooManySym_01 21012 6.43 3.21 7.38 39 HTML_IMAGE_RATIO_04 19848 8.32 12.89 6.97 40 T_XMDrugObfuBody_14 19364 7.22 8.63 6.80 41 DKIM_INVALID 18402 7.05 9.02 6.46 42 BAYES_99 18167 10.92 26.30 6.38 43 XM_SendGrid 18093 5.60 3.05 6.36 44 TooManyTo_001 17505 6.63 8.25 6.15 45 XM_B_Phish_Phrases 17267 6.20 6.64 6.06 46 XMStrtUSub 16572 5.38 3.90 5.82 47 XM_H_Long_From01 16465 6.26 7.90 5.78 48 BAYES_999 15438 9.06 21.39 5.42 49 RCVD_IN_IADB_LISTED 14981 4.30 1.03 5.26 50 MIME_QP_LONG_LINE 14537 4.37 1.89 5.11 51 RCVD_IN_MSPIKE_H2 14155 4.53 3.05 4.97 52 T_REMOTE_IMAGE 13938 4.83 4.60 4.90 53 UNPARSEABLE_RELAY 13898 4.54 3.37 4.88 54 TVD_RCVD_IP 13649 3.84 0.61 4.79 55 BAYES_60 13621 5.00 5.74 4.78 56 TO_MALFORMED 13410 3.65 0.08 4.71 57 RCVD_IN_IADB_SPF 12980 3.72 0.86 4.56 58 BAYES_40 12746 4.11 2.86 4.48 59 XMSubMetaSx_00 12446 5.23 8.15 4.37 60 RELAYCOUNTRY_META 12233 9.03 25.06 4.30 61 XMSexyCombo_05 12133 5.97 11.78 4.26 62 XM_UncommonTLD01 12005 6.08 12.39 4.22 63 MPART_ALT_DIFF 11648 5.49 10.24 4.09 64 RCVD_IN_IADB_SENDERID 11501 3.31 0.82 4.04 65 XMNumbers 11317 4.44 6.03 3.98 66 RCVD_IN_IADB_DK 11061 3.18 0.81 3.89 67 FROM_EXCESS_BASE64 10925 5.07 9.25 3.84 68 HTML_IMAGE_RATIO_06 10579 3.71 3.71 3.72 69 RCVD_IN_IADB_VOUCHED 10343 2.96 0.68 3.63 70 TR_DCC_Bayes_99 10249 7.61 21.21 3.60 71 BAYES_20 9600 3.08 2.07 3.37 72 MIME_HTML_MOSTLY 8099 3.23 4.55 2.84 73 IN_ZIMBRA_NJ_WHITELIST 7968 2.16 0.01 2.80 74 BAYES_80 7894 3.44 5.69 2.77 75 ANY_BOUNCE_MESSAGE 7679 2.38 1.31 2.70 76 BOUNCE_MESSAGE 7676 2.38 1.31 2.70 77 XM_PDF 7354 2.11 0.49 2.58 78 INVALID_MSGID 7252 2.00 0.14 2.55 79 BOTNET 7248 6.01 17.75 2.55 80 TR_Symld_Words 7165 2.24 1.29 2.52 81 RCVD_IN_IADB_OPTIN 6741 1.95 0.55 2.37 82 HTML_IMAGE_RATIO_08 6548 2.34 2.50 2.30 83 URI_HEX 6273 2.58 3.87 2.20 84 T_TooManySym_02 6258 1.85 0.65 2.20 85 BAYES_05 6243 1.95 1.11 2.19 86 RCVD_IN_MSPIKE_WL 6120 1.81 0.64 2.15 87 RCVD_IN_MSPIKE_H3 6086 1.80 0.64 2.14 88 XM_DIRTYINTL 5814 2.71 4.95 2.04 89 MAILING_LIST_MULTI 5806 1.97 1.72 2.04 90 MIME_HTML_ONLY_MULTI 5628 2.50 4.28 1.98 91 TR_MetaPhish_Combo_01 5589 1.67 0.70 1.96 92 HTML_MIME_NO_HTML_TAG 5429 2.38 3.98 1.91 93 SUBJ_ALL_CAPS 5188 1.93 2.30 1.82 94 RELAYCOUNTRY_CA 5081 2.33 4.16 1.78 95 XM_CamelCaseFrm001 5012 2.13 3.37 1.76 96 XM_SPF_SoftFail 4909 2.00 2.93 1.72 97 BAYES_95 4903 2.16 3.65 1.72 98 URI_TRY_3LD 4898 1.54 0.92 1.72 99 XM_DK_Undo_01 4668 1.46 0.86 1.64 100 TM2_M_URI_OPT_OUT 4660 2.03 3.37 1.64 101 IN_HORDE_ADDRESS_BOOK 4585 1.25 0.03 1.61 102 USER_IN_DEF_DKIM_WL 4540 1.25 0.09 1.59 103 TooManyTo_002 3603 1.14 0.73 1.27 104 T_XMDrugObfuBody_08 3501 1.32 1.61 1.23 105 XMBdyGiftCard01 3433 1.77 3.70 1.21 106 XMDiploma_00 3376 1.28 1.61 1.19 107 XM_OfRef6 3374 1.47 2.44 1.19 108 XM_GoogleGroups 3369 1.02 0.45 1.18 109 UNTRUSTED_Relay 3311 5.08 18.34 1.16 110 XM_ProductURIs 3268 1.24 1.54 1.15 111 NO_DNS_FOR_FROM 3243 1.31 1.88 1.14 112 TM2_M_A_HREF_HREF 2907 0.94 0.68 1.02 113 XM_H_Long_From02 2792 1.18 1.86 0.98 114 XMPhish11 2785 1.03 1.21 0.98 115 XM_H_PHPOS 2757 0.98 1.03 0.97 116 TM2_M_VERY_LONG_WORD 2726 1.07 1.46 0.96 117 XMBody_17 2589 0.97 1.20 0.91 118 T_XMDrugObfuBody_00 2499 0.91 1.00 0.88 119 TooManyTo_003 2444 0.81 0.65 0.86 120 XMBody_95 2382 0.67 0.12 0.84 121 T_XMHurry_00 2340 1.02 1.68 0.82 122 T_TooManySym_03 2259 0.63 0.07 0.79 123 USER_IN_WHITELIST 2239 0.61 0.00 0.79 124 HELO_NODOT 2196 0.67 0.30 0.77 125 XM_B_REG_HTML 2181 0.90 1.33 0.77 126 XM_H_PHPMailer 2071 0.77 0.93 0.73 127 XMStockSpam_06 2022 0.89 1.50 0.71 128 DKIM_ADSP_NXDOMAIN 2006 0.90 1.56 0.70 129 XM_UB50 1982 2.85 10.13 0.70 130 T_Symld_Words_02 1975 0.71 0.78 0.69 131 XMSubMetaSxObfu_02 1942 0.58 0.25 0.68 132 XMBody_78 1932 0.71 0.82 0.68 133 DKIM_ADSP_CUSTOM_MED 1905 0.70 0.82 0.67 134 XMGenDplmaNmb 1880 0.73 0.99 0.66 135 TooManyTo_004 1841 0.61 0.48 0.65 136 FILL_THIS_FORM 1788 0.77 1.27 0.63 137 XMHTMLBadTable_001 1776 0.67 0.85 0.62 138 XM_shorewaves_Whitelist 1770 0.48 0.00 0.62 139 XMSexyCombo_01 1741 1.07 2.63 0.61 140 T_FILL_THIS_FORM_SHORT 1715 0.68 0.95 0.60 141 HTML_FONT_SIZE_LARGE 1710 0.50 0.17 0.60 142 TooManyTo_005 1630 0.54 0.41 0.57 143 RDNS_DYNAMIC 1521 0.67 1.13 0.53 144 XMSubMetaI_00 1517 0.85 1.94 0.53 145 XM_D_tchamptons_WL 1503 0.41 0.00 0.53 146 PLING_QUERY 1487 0.57 0.74 0.52 147 XMBrknScrpt_02 1443 0.48 0.38 0.51 148 T_FILL_THIS_FORM_LONG 1429 0.47 0.36 0.50 149 XM_B_COPY_HTML 1421 0.64 1.11 0.50 150 URI_NOVOWEL 1407 0.61 1.00 0.49 151 RELAYCOUNTRY_GB 1406 0.58 0.89 0.49 152 TRACKER_ID 1399 0.44 0.25 0.49 153 XM_H_PHPOS_M 1356 0.50 0.56 0.48 154 HTML_FONT_FACE_BAD 1333 0.63 1.19 0.47 155 XMSolicitRefs_0 1331 0.62 1.16 0.47 156 TR_XM_RelayPhish 1297 0.62 1.19 0.46 157 REMOVE_BEFORE_LINK 1287 0.50 0.67 0.45 158 T_OBFU_PDF_ATTACH 1254 0.39 0.21 0.44 159 XM_URI_RBL 1248 0.71 1.64 0.44 160 RELAYCOUNTRY_AU 1213 0.50 0.73 0.43 161 NML_ADSP_CUSTOM_MED 1212 0.50 0.77 0.43 162 SUBJ_DOLLARS 1205 0.75 1.87 0.42 163 XMCapTrack 1198 0.37 0.20 0.42 164 XMSubMetaSxObfu_03 1196 0.48 0.70 0.42 165 T_TooManySym_04 1159 0.32 0.01 0.41 166 XMPhish30 1154 0.70 1.72 0.41 167 RELAYCOUNTRY_DE 1149 0.56 1.11 0.40 168 XMHTML_After_End 1136 0.48 0.76 0.40 169 FORGED_GMAIL_RCVD 1133 0.47 0.71 0.40 170 HTTPS_HTTP_MISMATCH 1131 0.47 0.72 0.40 171 XMNoVowels 1127 0.51 0.92 0.40 172 DIET_1 1089 0.81 2.28 0.38 173 RCVD_IN_BL_SPAMCOP_NET 1072 0.88 2.59 0.38 174 SpammyFromTLD_01 1063 0.88 2.61 0.37 175 T_MONEY_PERCENT 1059 0.90 2.67 0.37 176 TR_LOTS_OF_MONEY2 1059 0.90 2.67 0.37 177 XM_S_JOY_D 988 0.49 0.97 0.35 178 HTML_TAG_BALANCE_BODY 982 0.45 0.80 0.34 179 XM_Akamai 932 0.26 0.03 0.33 180 FROM_EGROUPS 878 0.24 0.00 0.31 181 HTML_IMAGE_ONLY_20 875 0.28 0.19 0.31 182 TM2_M_BODY_EMPTY 865 0.26 0.10 0.30 183 NUMERIC_HTTP_ADDR 857 0.32 0.36 0.30 184 XMSubMetaSSx_00 856 0.45 0.96 0.30 185 TVD_SPACE_RATIO 855 0.28 0.21 0.30 186 XMSlimDrugH 841 0.48 1.11 0.30 187 XM_ShortIntro_01 834 0.72 2.15 0.29 188 XMPhish14 824 0.35 0.54 0.29 189 XMRcvdHeader_15 822 0.22 0.00 0.29 190 MPART_ALT_DIFF_COUNT 797 0.61 1.71 0.28 191 XMLngstWrd_00 788 0.30 0.40 0.28 192 AC_DIV_BONANZA 786 0.25 0.16 0.28 193 TR_LOTS_OF_MONEY3 776 0.36 0.64 0.27 194 T_FILL_THIS_FORM_LOAN 770 0.33 0.54 0.27 195 XMDateMe_00 761 0.26 0.25 0.27 196 HTML_IMAGE_ONLY_32 751 0.29 0.39 0.26 197 MISSING_HEADERS 745 0.68 2.09 0.26 198 XMSubNoVowel 744 0.28 0.36 0.26 199 HTML_IMAGE_ONLY_28 715 0.35 0.70 0.25 200 XM_RXBody 712 0.44 1.06 0.25 ----------------------------------------------------------------------