Email: 376327 Autolearn: 0 AvgScore: 2.61 AvgScanTime: 3.06 sec Spam: 106559 Autolearn: 0 AvgScore: 12.15 AvgScanTime: 3.48 sec Ham: 269768 Autolearn: 0 AvgScore: -1.16 AvgScanTime: 2.90 sec Time Spent Running SA: 319.93 hours Time Spent Processing Spam: 102.94 hours Time Spent Processing Ham: 216.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89384 85.31 83.88 85.87 2 DKIM_SIGNED 75368 77.66 70.73 80.40 3 XM_DK_Pass 73659 76.38 69.13 79.25 4 DCC_CHECK 72894 54.53 68.41 49.05 5 DKIM_VALID 69677 73.27 65.39 76.39 6 XMListUnsubscribeExists 68430 59.41 64.22 57.51 7 DKIM_VALID_AU 59437 57.35 55.78 57.96 8 BAYES_50 53694 51.42 50.39 51.82 9 XM_H_QuotedFrom 47507 40.49 44.58 38.88 10 STYLE_GIBBERISH 40056 35.40 37.59 34.53 11 LOC_TINY_FONT_1 35351 27.59 33.18 25.39 12 XM_DK_Undo_02 34646 16.13 32.51 9.65 13 HTML_FONT_LOW_CONTRAST 33646 32.34 31.57 32.65 14 MIME_HTML_ONLY 33254 25.85 31.21 23.74 15 DCC_CHECK_NEGATIVE 32607 44.43 30.60 49.89 16 BAYES_99 27962 13.05 26.24 7.84 17 BOTNET 27211 8.94 25.54 2.39 18 XM_Multi_Part_URI 27044 17.83 25.38 14.85 19 FVGT_m_MULTI_ODD 26410 23.07 24.78 22.39 20 XM_Evil_Numbers_Gen 26258 13.58 24.64 9.22 21 XMSubLong 23214 21.86 21.79 21.89 22 BAYES_999 23188 10.98 21.76 6.73 23 TR_DCC_Bayes_99 22830 9.36 21.42 4.59 24 RELAYCOUNTRY_META 21985 9.03 20.63 4.45 25 LOTS_OF_MONEY 21721 14.48 20.38 12.14 26 XM_Body_Dirty_Words 18011 14.47 16.90 13.51 27 HTML_IMAGE_RATIO_02 17935 12.46 16.83 10.74 28 DKIM_VALID_EF 17061 26.95 16.01 31.28 29 UNTRUSTED_Relay 16565 5.26 15.55 1.19 30 T_KAM_HTML_FONT_INVALID 16488 15.52 15.47 15.54 31 T_TM2_M_HEADER_IN_MSG 15472 19.95 14.52 22.09 32 RCVD_IN_RP_RNBL 14694 4.14 13.79 0.33 33 BOTNET_IPINHOSTNAME 14470 8.58 13.58 6.60 34 MultiRelay 13973 15.09 13.11 15.87 35 TR_LOTS_OF_MONEY3 13017 3.88 12.22 0.58 36 ANY_BOUNCE_MESSAGE 12909 6.30 12.11 4.00 37 BOUNCE_MESSAGE 12909 6.30 12.11 4.00 38 FROM_EXCESS_BASE64 10652 6.45 10.00 5.05 39 XMSexyCombo_05 9785 5.78 9.18 4.44 40 FSL_BULK_SIG 9291 8.18 8.72 7.97 41 HTML_IMAGE_RATIO_04 8387 6.44 7.87 5.88 42 T_XMDrugObfuBody_14 8380 7.25 7.86 7.00 43 BAYES_60 7952 6.19 7.46 5.69 44 XM_UB50 7950 2.55 7.46 0.61 45 MPART_ALT_DIFF 7800 4.76 7.32 3.75 46 TooManyTo_001 7410 5.86 6.95 5.43 47 XM_UncommonTLD01 7364 4.64 6.91 3.74 48 HTML_MIME_NO_HTML_TAG 7291 3.23 6.84 1.80 49 XMSubMetaSx_00 7183 5.00 6.74 4.31 50 XM_H_Long_From01 6930 6.16 6.50 6.02 51 LotsOfNums_01 6370 7.94 5.98 8.72 52 XMNumbers 6187 4.51 5.81 4.00 53 BAYES_80 6178 3.97 5.80 3.24 54 T_REMOTE_IMAGE 5769 4.21 5.41 3.73 55 DKIM_INVALID 5691 4.39 5.34 4.01 56 XM_B_Phish_Phrases 5223 6.47 4.90 7.09 57 RCVD_IN_RP_SAFE 4988 10.99 4.68 13.48 58 XMStrtUSub 4860 4.65 4.56 4.68 59 MIME_HTML_MOSTLY 4710 3.33 4.42 2.89 60 MISSING_HEADERS 4699 1.37 4.41 0.17 61 HTML_IMAGE_RATIO_06 4441 4.44 4.17 4.55 62 HTML_SHORT_LINK_IMG_1 4398 1.20 4.13 0.04 63 RELAYCOUNTRY_CN 4297 1.16 4.03 0.03 64 XM_DIRTYINTL 4256 2.63 3.99 2.10 65 MIME_HTML_ONLY_MULTI 4220 2.42 3.96 1.81 66 HTML_IMAGE_RATIO_08 4158 2.88 3.90 2.47 67 BODY_URI_ONLY 4026 1.09 3.78 0.03 68 RELAYCOUNTRY_DE 4010 1.27 3.76 0.29 69 URI_HEX 3810 2.21 3.58 1.67 70 MIME_HEADER_CTYPE_ONLY 3804 1.08 3.57 0.10 71 XM_CamelCaseFrm001 3639 2.31 3.42 1.87 72 XM_UB60 3625 1.01 3.40 0.07 73 RCVD_IN_RP_CERTIFIED 3610 9.38 3.39 11.74 74 SpammyFromTLD_02 3392 1.02 3.18 0.17 75 BOTNET_NORDNS 3368 0.90 3.16 0.01 76 UNPARSEABLE_RELAY 3364 3.97 3.16 4.29 77 HTML_IMAGE_ONLY_04 3279 0.90 3.08 0.03 78 XM_SPF_SoftFail 3250 1.76 3.05 1.25 79 XM_salutation2 3208 1.59 3.01 1.03 80 RELAYCOUNTRY_CA 3208 2.13 3.01 1.79 81 BAYES_95 3134 2.31 2.94 2.06 82 TM2_M_URI_OPT_OUT 3056 1.84 2.87 1.44 83 XMBdyGiftCard01 2998 1.79 2.81 1.39 84 SUBJ_ALL_CAPS 2958 2.29 2.78 2.10 85 XM_SendGrid 2918 5.66 2.74 6.82 86 HTML_SHORT_CENTER 2880 0.77 2.70 0.00 87 MultiRelay_Combo 2709 0.81 2.54 0.12 88 MultiRelay_CC 2709 0.81 2.54 0.12 89 T_TooManySym_01 2675 5.80 2.51 7.10 90 RCVD_IN_MSPIKE_H2 2667 3.89 2.50 4.44 91 RCVD_IN_BL_SPAMCOP_NET 2456 0.92 2.30 0.37 92 XM_H_Long_From02 2444 1.47 2.29 1.14 93 TVD_SPACE_RATIO_MINFP 2442 0.65 2.29 0.00 94 BAYES_40 2326 3.88 2.18 4.55 95 T_XMDrugObfuBody_12 2297 0.66 2.16 0.07 96 XM_RXBody 2119 1.51 1.99 1.32 97 MIME_QP_LONG_LINE 2114 3.94 1.98 4.71 98 URIBL_DBL_SPAM 2074 0.69 1.95 0.19 99 RELAYCOUNTRY_FR 2026 0.67 1.90 0.19 100 XM_OfRef6 2017 1.65 1.89 1.55 101 ALL_TRUSTED 2011 11.23 1.89 14.92 102 LONG_JUNK_URI 1989 0.59 1.87 0.09 103 BAYES_00 1963 14.73 1.84 19.83 104 BAYES_20 1930 2.60 1.81 2.92 105 XMSubMetaI_00 1907 0.93 1.79 0.59 106 FROM_SUSPICIOUS_NTLD 1880 0.54 1.76 0.06 107 T_XMDrugObfuBody_08 1872 1.42 1.76 1.28 108 RELAYCOUNTRY_AT 1865 0.73 1.75 0.33 109 LOW_PRICE 1855 0.67 1.74 0.25 110 XMSexyCombo_01 1835 1.15 1.72 0.93 111 URIBL_BLACK 1742 0.52 1.63 0.08 112 XMSubNoVowel 1733 0.62 1.63 0.22 113 XM_ProductURIs 1722 1.22 1.62 1.07 114 MAILING_LIST_MULTI 1648 1.60 1.55 1.62 115 T_XMDrugObfuBody_01 1642 0.46 1.54 0.03 116 XMPhish30 1620 0.85 1.52 0.58 117 XMDiploma_00 1593 1.56 1.49 1.58 118 XM_URI_RBL 1567 0.82 1.47 0.57 119 XM_XX_Yahoo 1541 0.45 1.45 0.06 120 TM2_M_VERY_LONG_WORD 1535 1.20 1.44 1.11 121 DIET_1 1523 0.72 1.43 0.44 122 RELAYCOUNTRY_IN 1520 0.46 1.43 0.07 123 XM_B_REG_HTML 1514 0.86 1.42 0.63 124 TR_XM_DK_Bayes 1473 12.70 1.38 17.17 125 SUBJ_DOLLARS 1452 0.75 1.36 0.51 126 BAYES_05 1420 1.85 1.33 2.05 127 T_XMHurry_00 1414 0.98 1.33 0.84 128 TR_XM_DK_Bayes1 1387 12.38 1.30 16.76 129 RDNS_DYNAMIC 1385 0.76 1.30 0.55 130 XM_UB80 1383 0.38 1.30 0.02 131 DKIM_ADSP_NXDOMAIN 1364 0.80 1.28 0.60 132 SpammyFromTLD_01 1333 0.61 1.25 0.36 133 XM_H_PHPOS 1309 1.02 1.23 0.94 134 MIME_CHARSET_FARAWAY 1302 0.39 1.22 0.06 135 BODY_ENHANCEMENT 1298 0.39 1.22 0.07 136 XMPhish11 1274 1.07 1.20 1.02 137 XM_BadFromFormat 1267 0.45 1.19 0.16 138 CHARSET_FARAWAY_HEADER 1262 0.35 1.18 0.03 139 TR_XM_DK_Bayes2 1218 9.85 1.14 13.29 140 HTML_IMAGE_ONLY_12 1209 0.42 1.13 0.14 141 XMGenDplmaNmb 1183 1.08 1.11 1.07 142 XMBody_78 1178 0.71 1.11 0.56 143 HTML_FONT_FACE_BAD 1145 0.72 1.07 0.58 144 PLING_QUERY 1141 0.72 1.07 0.58 145 URIBL_SBL_A 1129 0.69 1.06 0.55 146 DKIM_ADSP_CUSTOM_MED 1102 0.82 1.03 0.74 147 LONG_JUNK_URI3 1095 0.30 1.03 0.02 148 REPLYTO_WITHOUT_TO_CC 1089 0.31 1.02 0.03 149 T_HTML_TAG_BALANCE_CENTER 1087 0.43 1.02 0.19 150 LongTLD 1068 0.37 1.00 0.13 151 MIXED_ES 1068 0.30 1.00 0.02 152 NML_ADSP_CUSTOM_MED 1063 0.66 1.00 0.52 153 XM_UB99 1057 0.29 0.99 0.01 154 XMStockSpam_06 1036 1.03 0.97 1.06 155 T_MONEY_PERCENT 1033 0.48 0.97 0.29 156 TR_LOTS_OF_MONEY2 1033 0.48 0.97 0.29 157 XMBody_17 1029 0.71 0.97 0.61 158 XMSlimDrugH 1015 0.47 0.95 0.28 159 DATE_IN_PAST_03_06 1001 0.32 0.94 0.08 160 FORGED_GMAIL_RCVD 1001 0.57 0.94 0.43 161 TR_XM_RelayPhish 976 0.62 0.92 0.51 162 T_XMDrugObfuBody_00 957 0.66 0.90 0.57 163 XMHTMLBadTable_001 949 0.68 0.89 0.60 164 T_FILL_THIS_FORM_SHORT 947 0.65 0.89 0.55 165 RCVD_IN_IADB_LISTED 932 3.90 0.87 5.10 166 SHORT_URI_4 918 0.25 0.86 0.00 167 SHORTENER_SHORT_IMG 917 0.24 0.86 0.00 168 XMUrgent 880 0.34 0.83 0.14 169 TooManyTo_002 874 1.04 0.82 1.12 170 XM_B_COPY_HTML 849 0.73 0.80 0.70 171 MPART_ALT_DIFF_COUNT 841 0.35 0.79 0.18 172 TR_Mismatch_TLD_02 830 0.26 0.78 0.06 173 RELAYCOUNTRY_GB 828 0.58 0.78 0.50 174 T_Symld_Words_02 827 0.63 0.78 0.58 175 SHORT_URI_2 826 0.25 0.78 0.04 176 XMPhish14 814 0.69 0.76 0.66 177 TooManyTo_003 799 0.80 0.75 0.82 178 URI_NOVOWEL 779 0.51 0.73 0.42 179 SHORT_IMG_SUSP_NTLD 772 0.21 0.72 0.00 180 T_TooManySym_02 759 1.90 0.71 2.37 181 URIBL_ABUSE_SURBL 746 0.22 0.70 0.03 182 RCVD_IN_IADB_SPF 730 3.43 0.69 4.52 183 REMOVE_BEFORE_LINK 724 0.51 0.68 0.44 184 HK_RANDOM_FROM 719 0.34 0.67 0.21 185 THIS_AD 717 0.25 0.67 0.09 186 HTML_TAG_BALANCE_BODY 715 0.65 0.67 0.64 187 XMSexyCombo_04 708 0.37 0.66 0.26 188 TooManyTo_004 693 0.66 0.65 0.66 189 XM_DK_Undo_01 684 1.46 0.64 1.79 190 RCVD_IN_IADB_SENDERID 679 3.08 0.64 4.04 191 RCVD_IN_IADB_DK 679 3.01 0.64 3.94 192 RCVD_IN_MSPIKE_WL 665 1.75 0.62 2.19 193 XMHTML_After_End 664 0.45 0.62 0.39 194 TR_MetaPhish_Combo_01 663 1.49 0.62 1.83 195 TR_Caps_n_Bayes_99 663 0.22 0.62 0.06 196 XMSubMetaSSx_00 659 0.35 0.62 0.24 197 LONG_JUNK_URI2 657 0.18 0.62 0.01 198 XM_UB95 648 0.18 0.61 0.01 199 TooManyTo_005 644 0.58 0.60 0.56 200 XM_UB999 641 0.17 0.60 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 231648 85.31 83.88 85.87 2 DKIM_SIGNED 216894 77.66 70.73 80.40 3 XM_DK_Pass 213790 76.38 69.13 79.25 4 DKIM_VALID 206065 73.27 65.39 76.39 5 DKIM_VALID_AU 156370 57.35 55.78 57.96 6 XMListUnsubscribeExists 155142 59.41 64.22 57.51 7 BAYES_50 139795 51.42 50.39 51.82 8 DCC_CHECK_NEGATIVE 134581 44.43 30.60 49.89 9 DCC_CHECK 132309 54.53 68.41 49.05 10 XM_H_QuotedFrom 104875 40.49 44.58 38.88 11 STYLE_GIBBERISH 93163 35.40 37.59 34.53 12 HTML_FONT_LOW_CONTRAST 88073 32.34 31.57 32.65 13 DKIM_VALID_EF 84370 26.95 16.01 31.28 14 LOC_TINY_FONT_1 68484 27.59 33.18 25.39 15 MIME_HTML_ONLY 64035 25.85 31.21 23.74 16 FVGT_m_MULTI_ODD 60392 23.07 24.78 22.39 17 T_TM2_M_HEADER_IN_MSG 59595 19.95 14.52 22.09 18 XMSubLong 59042 21.86 21.79 21.89 19 BAYES_00 53484 14.73 1.84 19.83 20 TR_XM_DK_Bayes 46310 12.70 1.38 17.17 21 TR_XM_DK_Bayes1 45202 12.38 1.30 16.76 22 MultiRelay 42807 15.09 13.11 15.87 23 XM_DKIMWhitelistDomains 42283 11.26 0.08 15.67 24 T_KAM_HTML_FONT_INVALID 41913 15.52 15.47 15.54 25 ALL_TRUSTED 40256 11.23 1.89 14.92 26 XM_Multi_Part_URI 40065 17.83 25.38 14.85 27 XM_Body_Dirty_Words 36443 14.47 16.90 13.51 28 RCVD_IN_RP_SAFE 36372 10.99 4.68 13.48 29 TR_XM_DK_Bayes2 35840 9.85 1.14 13.29 30 LOTS_OF_MONEY 32755 14.48 20.38 12.14 31 RCVD_IN_RP_CERTIFIED 31682 9.38 3.39 11.74 32 HTML_IMAGE_RATIO_02 28971 12.46 16.83 10.74 33 XM_DK_Undo_02 26044 16.13 32.51 9.65 34 XM_Evil_Numbers_Gen 24866 13.58 24.64 9.22 35 LotsOfNums_01 23522 7.94 5.98 8.72 36 FSL_BULK_SIG 21490 8.18 8.72 7.97 37 BAYES_99 21139 13.05 26.24 7.84 38 T_TooManySym_01 19160 5.80 2.51 7.10 39 XM_B_Phish_Phrases 19137 6.47 4.90 7.09 40 T_XMDrugObfuBody_14 18889 7.25 7.86 7.00 41 XM_SendGrid 18399 5.66 2.74 6.82 42 BAYES_999 18148 10.98 21.76 6.73 43 BOTNET_IPINHOSTNAME 17806 8.58 13.58 6.60 44 XM_H_Long_From01 16252 6.16 6.50 6.02 45 HTML_IMAGE_RATIO_04 15866 6.44 7.87 5.88 46 BAYES_60 15343 6.19 7.46 5.69 47 TooManyTo_001 14640 5.86 6.95 5.43 48 RCVD_IN_IADB_LISTED 13762 3.90 0.87 5.10 49 FROM_EXCESS_BASE64 13624 6.45 10.00 5.05 50 MIME_QP_LONG_LINE 12705 3.94 1.98 4.71 51 XMStrtUSub 12634 4.65 4.56 4.68 52 TR_DCC_Bayes_99 12386 9.36 21.42 4.59 53 BAYES_40 12285 3.88 2.18 4.55 54 HTML_IMAGE_RATIO_06 12276 4.44 4.17 4.55 55 RCVD_IN_IADB_SPF 12186 3.43 0.69 4.52 56 RELAYCOUNTRY_META 12009 9.03 20.63 4.45 57 RCVD_IN_MSPIKE_H2 11982 3.89 2.50 4.44 58 XMSexyCombo_05 11980 5.78 9.18 4.44 59 XMSubMetaSx_00 11617 5.00 6.74 4.31 60 UNPARSEABLE_RELAY 11571 3.97 3.16 4.29 61 TO_MALFORMED 11154 2.98 0.07 4.13 62 RCVD_IN_IADB_SENDERID 10897 3.08 0.64 4.04 63 DKIM_INVALID 10829 4.39 5.34 4.01 64 BOUNCE_MESSAGE 10802 6.30 12.11 4.00 65 ANY_BOUNCE_MESSAGE 10802 6.30 12.11 4.00 66 XMNumbers 10795 4.51 5.81 4.00 67 RCVD_IN_IADB_DK 10641 3.01 0.64 3.94 68 TVD_RCVD_IP 10150 2.77 0.27 3.76 69 MPART_ALT_DIFF 10106 4.76 7.32 3.75 70 XM_UncommonTLD01 10084 4.64 6.91 3.74 71 T_REMOTE_IMAGE 10068 4.21 5.41 3.73 72 IN_ZIMBRA_NJ_WHITELIST 9344 2.49 0.01 3.46 73 BAYES_80 8746 3.97 5.80 3.24 74 RCVD_IN_IADB_VOUCHED 8582 2.44 0.57 3.18 75 BAYES_20 7872 2.60 1.81 2.92 76 MIME_HTML_MOSTLY 7803 3.33 4.42 2.89 77 INVALID_MSGID 6896 1.86 0.08 2.56 78 TR_Symld_Words 6790 1.97 0.59 2.52 79 HTML_IMAGE_RATIO_08 6671 2.88 3.90 2.47 80 BOTNET 6445 8.94 25.54 2.39 81 T_TooManySym_02 6403 1.90 0.71 2.37 82 RCVD_IN_MSPIKE_WL 5906 1.75 0.62 2.19 83 RCVD_IN_MSPIKE_H3 5895 1.72 0.55 2.19 84 XM_PDF 5768 1.59 0.20 2.14 85 SUBJ_ALL_CAPS 5666 2.29 2.78 2.10 86 XM_DIRTYINTL 5655 2.63 3.99 2.10 87 BAYES_95 5568 2.31 2.94 2.06 88 BAYES_05 5536 1.85 1.33 2.05 89 RCVD_IN_IADB_OPTIN 5351 1.54 0.41 1.98 90 USER_IN_DEF_DKIM_WL 5225 1.43 0.14 1.94 91 XM_CamelCaseFrm001 5040 2.31 3.42 1.87 92 IN_HORDE_ADDRESS_BOOK 5026 1.35 0.05 1.86 93 TR_MetaPhish_Combo_01 4934 1.49 0.62 1.83 94 MIME_HTML_ONLY_MULTI 4870 2.42 3.96 1.81 95 HTML_MIME_NO_HTML_TAG 4853 3.23 6.84 1.80 96 XM_DK_Undo_01 4824 1.46 0.64 1.79 97 RELAYCOUNTRY_CA 4823 2.13 3.01 1.79 98 URI_TRY_3LD 4670 1.40 0.58 1.73 99 URI_HEX 4505 2.21 3.58 1.67 100 MAILING_LIST_MULTI 4359 1.60 1.55 1.62 101 XMDiploma_00 4264 1.56 1.49 1.58 102 XM_OfRef6 4188 1.65 1.89 1.55 103 TM2_M_A_HREF_HREF 3997 1.22 0.56 1.48 104 TM2_M_URI_OPT_OUT 3886 1.84 2.87 1.44 105 XMBdyGiftCard01 3754 1.79 2.81 1.39 106 XM_RXBody 3569 1.51 1.99 1.32 107 T_XMDrugObfuBody_08 3461 1.42 1.76 1.28 108 XM_SPF_SoftFail 3375 1.76 3.05 1.25 109 UNTRUSTED_Relay 3221 5.26 15.55 1.19 110 XM_H_Long_From02 3076 1.47 2.29 1.14 111 TooManyTo_002 3031 1.04 0.82 1.12 112 XM_GoogleGroups 3025 0.94 0.47 1.12 113 TM2_M_VERY_LONG_WORD 2986 1.20 1.44 1.11 114 XMGenDplmaNmb 2894 1.08 1.11 1.07 115 XM_ProductURIs 2874 1.22 1.62 1.07 116 XMStockSpam_06 2851 1.03 0.97 1.06 117 T_TooManySym_03 2786 0.79 0.19 1.03 118 XM_salutation2 2769 1.59 3.01 1.03 119 XMPhish11 2763 1.07 1.20 1.02 120 XM_H_PHPOS 2539 1.02 1.23 0.94 121 XMBody_95 2530 0.70 0.10 0.94 122 XMSexyCombo_01 2502 1.15 1.72 0.93 123 USER_IN_WHITELIST 2317 0.62 0.00 0.86 124 T_XMHurry_00 2261 0.98 1.33 0.84 125 TooManyTo_003 2213 0.80 0.75 0.82 126 XM_H_PHPMailer 2063 0.71 0.58 0.76 127 DKIM_ADSP_CUSTOM_MED 2000 0.82 1.03 0.74 128 XMBrknScrpt_02 1933 0.62 0.36 0.72 129 XM_B_COPY_HTML 1895 0.73 0.80 0.70 130 FILL_THIS_FORM 1825 0.56 0.28 0.68 131 XMSubMetaSxObfu_02 1797 0.57 0.31 0.67 132 XMPhish14 1786 0.69 0.76 0.66 133 TooManyTo_004 1780 0.66 0.65 0.66 134 HTML_TAG_BALANCE_BODY 1717 0.65 0.67 0.64 135 XM_B_REG_HTML 1708 0.86 1.42 0.63 136 XM_D_tchamptons_WL 1691 0.45 0.00 0.63 137 T_FILL_THIS_FORM_LONG 1672 0.49 0.18 0.62 138 XM_UB50 1650 2.55 7.46 0.61 139 XMBody_17 1636 0.71 0.97 0.61 140 DKIM_ADSP_NXDOMAIN 1629 0.80 1.28 0.60 141 HELO_NODOT 1622 0.50 0.23 0.60 142 XMHTMLBadTable_001 1606 0.68 0.89 0.60 143 XMSubMetaI_00 1588 0.93 1.79 0.59 144 T_FILL_THIS_FORM_LOAN 1583 0.45 0.09 0.59 145 XMPhish30 1576 0.85 1.52 0.58 146 TR_LOTS_OF_MONEY3 1569 3.88 12.22 0.58 147 HTML_FONT_FACE_BAD 1566 0.72 1.07 0.58 148 PLING_QUERY 1558 0.72 1.07 0.58 149 T_Symld_Words_02 1557 0.63 0.78 0.58 150 T_XMDrugObfuBody_00 1540 0.66 0.90 0.57 151 XM_URI_RBL 1530 0.82 1.47 0.57 152 TooManyTo_005 1522 0.58 0.60 0.56 153 XMBody_78 1501 0.71 1.11 0.56 154 T_FILL_THIS_FORM_SHORT 1494 0.65 0.89 0.55 155 URIBL_SBL_A 1477 0.69 1.06 0.55 156 RDNS_DYNAMIC 1475 0.76 1.30 0.55 157 NML_ADSP_CUSTOM_MED 1413 0.66 1.00 0.52 158 SUBJ_DOLLARS 1383 0.75 1.36 0.51 159 TR_XM_RelayPhish 1368 0.62 0.92 0.51 160 RELAYCOUNTRY_GB 1359 0.58 0.78 0.50 161 T_TooManySym_04 1317 0.36 0.04 0.49 162 XM_H_PHPOS_M 1315 0.47 0.43 0.49 163 XM_Body_Obfu01 1315 0.39 0.14 0.49 164 XM_Walgreens_Forge 1307 0.35 0.01 0.48 165 XM_Ancestry_Forge 1245 0.38 0.17 0.46 166 FSL_THIS_IS_ADV 1197 0.44 0.44 0.44 167 DIET_1 1184 0.72 1.43 0.44 168 REMOVE_BEFORE_LINK 1178 0.51 0.68 0.44 169 NO_DNS_FOR_FROM 1172 0.47 0.57 0.43 170 FORGED_GMAIL_RCVD 1154 0.57 0.94 0.43 171 URI_NOVOWEL 1135 0.51 0.73 0.42 172 XM_S_JOY_D 1078 0.42 0.49 0.40 173 XMLngstWrd_00 1058 0.32 0.14 0.39 174 XMCapTrack 1050 0.33 0.17 0.39 175 XMHTML_After_End 1045 0.45 0.62 0.39 176 AC_DIV_BONANZA 1038 0.30 0.09 0.38 177 HTML_IMAGE_ONLY_32 1029 0.33 0.20 0.38 178 RELAYCOUNTRY_AU 1028 0.38 0.36 0.38 179 RCVD_IN_BL_SPAMCOP_NET 1004 0.92 2.30 0.37 180 SpammyFromTLD_01 969 0.61 1.25 0.36 181 XMNoVowels 960 0.38 0.44 0.36 182 XMLngstWrd_01 944 0.29 0.13 0.35 183 XMSubMetaSxObfu_03 941 0.40 0.54 0.35 184 XM_Akamai 909 0.24 0.01 0.34 185 RELAYCOUNTRY_AT 891 0.73 1.75 0.33 186 HTML_TEXT_INVISIBLE_STYLE 888 0.37 0.49 0.33 187 HTTPS_HTTP_MISMATCH 886 0.38 0.51 0.33 188 RCVD_IN_RP_RNBL 886 4.14 13.79 0.33 189 TR_MetaPhish_Combo_01b 881 0.25 0.07 0.33 190 XMManySubDom_06 844 0.26 0.14 0.31 191 XMOemUri 830 0.27 0.18 0.31 192 XMMoneyMeta_00 811 0.33 0.41 0.30 193 T_OBFU_PDF_ATTACH 800 0.22 0.03 0.30 194 XMManySubDom_07 794 0.23 0.06 0.29 195 RELAYCOUNTRY_DE 784 1.27 3.76 0.29 196 T_MONEY_PERCENT 783 0.48 0.97 0.29 197 TR_LOTS_OF_MONEY2 783 0.48 0.97 0.29 198 XM_B_TRADE_HTML 770 0.25 0.17 0.29 199 XMRcvdHeader_15 766 0.20 0.00 0.28 200 TVD_SPACE_RATIO 746 0.27 0.27 0.28 ----------------------------------------------------------------------