Email: 627505 Autolearn: 0 AvgScore: 1.84 AvgScanTime: 3.65 sec Spam: 131407 Autolearn: 0 AvgScore: 11.97 AvgScanTime: 4.25 sec Ham: 496098 Autolearn: 0 AvgScore: -0.84 AvgScanTime: 3.49 sec Time Spent Running SA: 636.03 hours Time Spent Processing Spam: 155.20 hours Time Spent Processing Ham: 480.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125296 89.34 95.35 87.75 2 DKIM_SIGNED 108629 76.85 82.67 75.30 3 DCC_CHECK 107958 49.06 82.16 40.29 4 XM_DK_Pass 104709 75.18 79.68 73.99 5 XMListUnsubscribeExists 97798 57.06 74.42 52.46 6 DKIM_VALID 97452 70.58 74.16 69.63 7 DKIM_VALID_AU 76546 51.16 58.25 49.28 8 XM_H_QuotedFrom 68987 41.62 52.50 38.74 9 BAYES_50 63729 55.67 48.50 57.56 10 HTML_FONT_LOW_CONTRAST 51583 30.02 39.25 27.58 11 LOC_TINY_FONT_1 46944 24.34 35.72 21.32 12 XM_DK_Undo_02 46143 12.84 35.11 6.95 13 MIME_HTML_ONLY 45236 22.88 34.42 19.83 14 FVGT_m_MULTI_ODD 37047 22.93 28.19 21.53 15 BAYES_99 36895 10.16 28.08 5.42 16 XMSubLong 36618 23.20 27.87 21.96 17 BAYES_999 30888 8.53 23.51 4.57 18 TR_DCC_Bayes_99 30418 7.10 23.15 2.85 19 XM_Body_Dirty_Words 26365 13.86 20.06 12.21 20 DKIM_VALID_EF 26314 25.30 20.02 26.70 21 T_KAM_HTML_FONT_INVALID 24674 17.51 18.78 17.17 22 BOTNET_IPINHOSTNAME 24336 7.81 18.52 4.97 23 RELAYCOUNTRY_META 24290 8.24 18.48 5.53 24 T_TM2_M_HEADER_IN_MSG 24097 27.03 18.34 29.33 25 XM_Multi_Part_URI 21583 13.41 16.42 12.61 26 DCC_CHECK_NEGATIVE 21392 48.81 16.28 57.43 27 MultiRelay 19837 17.39 15.10 18.00 28 XM_Evil_Numbers_Gen 19301 9.89 14.69 8.62 29 LOTS_OF_MONEY 19088 10.33 14.53 9.22 30 BOTNET 18861 4.26 14.35 1.59 31 HTML_IMAGE_RATIO_02 18687 10.36 14.22 9.34 32 FSL_BULK_SIG 15565 7.13 11.84 5.88 33 UNTRUSTED_Relay 15449 3.46 11.76 1.26 34 XMSexyCombo_05 15293 5.45 11.64 3.81 35 XM_UncommonTLD01 15260 5.00 11.61 3.25 36 XMSubMetaSx_00 12356 5.22 9.40 4.11 37 T_XMDrugObfuBody_14 11744 8.03 8.94 7.78 38 HTML_IMAGE_RATIO_04 11647 6.01 8.86 5.26 39 MPART_ALT_DIFF 11311 4.31 8.61 3.18 40 DKIM_INVALID 11177 6.27 8.51 5.67 41 TooManyTo_001 11104 8.38 8.45 8.36 42 FROM_EXCESS_BASE64 10335 4.60 7.86 3.73 43 XM_H_Long_From01 10269 6.80 7.81 6.53 44 XM_B_Phish_Phrases 9925 6.23 7.55 5.88 45 XM_UB50 8444 1.97 6.43 0.79 46 BAYES_80 8182 3.62 6.23 2.93 47 LotsOfNums_01 8100 8.31 6.16 8.88 48 BAYES_60 7850 5.38 5.97 5.23 49 RCVD_IN_RP_RNBL 7155 1.19 5.44 0.06 50 HTML_IMAGE_RATIO_06 6893 3.62 5.25 3.19 51 XM_DIRTYINTL 6524 2.64 4.96 2.03 52 MIME_HTML_ONLY_MULTI 6490 2.29 4.94 1.59 53 XMNumbers 6410 3.91 4.88 3.65 54 XM_SPF_SoftFail 5951 2.55 4.53 2.03 55 SpammyFromTLD_02 5479 1.15 4.17 0.35 56 T_REMOTE_IMAGE 5043 4.01 3.84 4.05 57 HTML_MIME_NO_HTML_TAG 4942 2.74 3.76 2.46 58 TM2_M_URI_OPT_OUT 4905 2.41 3.73 2.06 59 MIME_HTML_MOSTLY 4879 2.92 3.71 2.70 60 XM_salutation2 4673 1.43 3.56 0.87 61 RELAYCOUNTRY_CA 4672 2.11 3.56 1.72 62 HTML_IMAGE_RATIO_08 4663 2.54 3.55 2.27 63 XMStrtUSub 4648 4.39 3.54 4.62 64 XM_URI_RBL 4587 1.07 3.49 0.43 65 XM_CamelCaseFrm001 4350 2.38 3.31 2.13 66 URI_HEX 4306 2.22 3.28 1.94 67 BAYES_95 4214 2.02 3.21 1.71 68 T_XMDrugObfuBody_08 4025 1.91 3.06 1.60 69 XM_SendGrid 3903 5.11 2.97 5.68 70 MIME_QP_LONG_LINE 3726 5.40 2.84 6.08 71 RCVD_IN_MSPIKE_H2 3716 3.90 2.83 4.18 72 SUBJ_ALL_CAPS 3673 2.03 2.80 1.82 73 URIBL_DBL_SPAM 3637 0.61 2.77 0.04 74 MultiRelay_Combo 3593 0.71 2.73 0.17 75 MultiRelay_CC 3593 0.71 2.73 0.17 76 XM_OfRef6 3538 1.72 2.69 1.46 77 T_TooManySym_01 3447 4.48 2.62 4.97 78 BAYES_40 3440 4.44 2.62 4.92 79 T_XMDrugObfuBody_00 3353 1.17 2.55 0.80 80 XM_H_Long_From02 3349 1.52 2.55 1.24 81 FROM_SUSPICIOUS_NTLD 3341 0.66 2.54 0.16 82 BOTNET_NORDNS 3307 0.54 2.52 0.02 83 RCVD_IN_BL_SPAMCOP_NET 3191 0.84 2.43 0.42 84 XMSexyCombo_01 3119 0.99 2.37 0.62 85 RCVD_IN_RP_SAFE 3115 7.54 2.37 8.91 86 BAYES_20 2900 3.28 2.21 3.57 87 XMSubMetaI_00 2836 0.96 2.16 0.65 88 XMDiploma_00 2816 1.92 2.14 1.86 89 RELAYCOUNTRY_CN 2698 0.50 2.05 0.09 90 TR_LOTS_OF_MONEY2 2681 0.80 2.04 0.48 91 T_MONEY_PERCENT 2681 0.80 2.04 0.48 92 XMStockSpam_06 2600 1.08 1.98 0.84 93 DKIM_ADSP_NXDOMAIN 2556 0.77 1.95 0.47 94 RELAYCOUNTRY_FR 2522 0.64 1.92 0.30 95 SpammyFromTLD_01 2518 1.00 1.92 0.76 96 XM_UB60 2466 0.45 1.88 0.07 97 UNPARSEABLE_RELAY 2396 2.40 1.82 2.55 98 XM_ProductURIs 2386 1.38 1.82 1.26 99 MAILING_LIST_MULTI 2303 2.80 1.75 3.07 100 RCVD_IN_IADB_LISTED 2295 4.90 1.75 5.74 101 BAYES_00 2277 13.32 1.73 16.39 102 TR_XM_RelayPhish 2201 0.81 1.67 0.58 103 XMBody_17 2180 0.86 1.66 0.65 104 XMBdyGiftCard01 2172 1.14 1.65 1.01 105 RCVD_IN_RP_CERTIFIED 2143 6.48 1.63 7.77 106 XMBody_78 2117 0.74 1.61 0.51 107 TM2_M_VERY_LONG_WORD 2085 1.18 1.59 1.07 108 XMHTML_After_End 2059 0.74 1.57 0.52 109 RELAYCOUNTRY_IN 2050 0.43 1.56 0.13 110 ALL_TRUSTED 2009 13.20 1.53 16.29 111 XMBrknScrpt_02 1985 0.77 1.51 0.57 112 RELAYCOUNTRY_GB 1985 1.15 1.51 1.05 113 BAYES_05 1920 2.10 1.46 2.27 114 XMPhish30 1908 0.66 1.45 0.45 115 URIBL_BLACK 1904 0.36 1.45 0.07 116 RCVD_IN_IADB_SPF 1893 4.29 1.44 5.05 117 TVD_SPACE_RATIO_MINFP 1873 0.30 1.43 0.00 118 XMGenDplmaNmb 1872 1.18 1.42 1.12 119 XMHTMLBadTable_001 1821 0.79 1.39 0.63 120 RCVD_IN_IADB_SENDERID 1817 3.80 1.38 4.44 121 RCVD_IN_IADB_DK 1799 3.76 1.37 4.40 122 XM_DK_Undo_01 1796 1.81 1.37 1.93 123 RDNS_DYNAMIC 1787 0.66 1.36 0.48 124 LONG_HEX_URI 1786 0.41 1.36 0.16 125 URI_TRY_3LD 1778 1.39 1.35 1.40 126 XM_H_PHPOS 1666 1.12 1.27 1.08 127 DIET_1 1641 0.55 1.25 0.37 128 T_XMHurry_00 1635 0.85 1.24 0.74 129 BODY_URI_ONLY 1619 0.35 1.23 0.11 130 FSL_THIS_IS_ADV 1611 0.43 1.23 0.22 131 XMPhish11 1557 1.12 1.18 1.11 132 RELAYCOUNTRY_AT 1535 0.36 1.17 0.15 133 TR_Mismatch_TLD_02 1526 0.29 1.16 0.06 134 HTML_SHORT_LINK_IMG_1 1521 0.27 1.16 0.03 135 T_HTML_TAG_BALANCE_CENTER 1520 0.34 1.16 0.13 136 XMLongAddy 1504 0.30 1.14 0.07 137 TR_LOTS_OF_MONEY3 1488 0.69 1.13 0.57 138 ANY_BOUNCE_MESSAGE 1488 2.36 1.13 2.68 139 BOUNCE_MESSAGE 1487 2.36 1.13 2.68 140 TR_Caps_n_Bayes_99 1476 0.27 1.12 0.05 141 URIBL_ABUSE_SURBL 1431 0.28 1.09 0.06 142 HTML_FONT_FACE_BAD 1422 0.68 1.08 0.57 143 TR_XM_DK_Bayes 1418 10.33 1.08 12.79 144 TR_Symld_Words 1417 1.41 1.08 1.50 145 BODY_ENHANCEMENT 1402 0.25 1.07 0.03 146 MPART_ALT_DIFF_COUNT 1391 0.36 1.06 0.18 147 DKIM_ADSP_CUSTOM_MED 1385 0.98 1.05 0.96 148 NORMAL_HTTP_TO_IP 1385 0.27 1.05 0.06 149 RCVD_IN_IADB_VOUCHED 1383 3.07 1.05 3.61 150 T_Symld_Words_02 1380 0.73 1.05 0.65 151 XM_BadFromFormat 1379 0.33 1.05 0.14 152 HTML_IMAGE_ONLY_12 1379 0.39 1.05 0.21 153 DATE_IN_PAST_06_12 1360 0.25 1.03 0.04 154 URIBL_CSS_A 1315 0.24 1.00 0.04 155 URIBL_CSS 1315 0.24 1.00 0.04 156 TR_MetaPhish_Combo_01 1311 1.34 1.00 1.43 157 NO_DNS_FOR_FROM 1305 0.41 0.99 0.25 158 FILL_THIS_FORM 1288 0.56 0.98 0.45 159 NML_ADSP_CUSTOM_MED 1284 0.73 0.98 0.66 160 TR_XM_DK_Bayes1 1278 9.70 0.97 12.01 161 XM_H_TOP 1277 0.21 0.97 0.01 162 XMPhish14 1246 0.48 0.95 0.36 163 XMSexyCombo_04 1241 0.31 0.94 0.15 164 FILL_THIS_FORM_LONG 1236 0.50 0.94 0.38 165 LONG_JUNK_URI 1230 0.25 0.94 0.07 166 DATE_IN_PAST_03_06 1226 0.29 0.93 0.12 167 XM_Combo_Sbj 1222 0.40 0.93 0.26 168 TooManyTo_002 1218 2.05 0.93 2.35 169 T_TooManySym_02 1211 1.66 0.92 1.85 170 XM_B_REG_HTML 1204 0.59 0.92 0.51 171 XM_UB99 1195 0.20 0.91 0.01 172 HTML_TAG_BALANCE_BODY 1187 0.68 0.90 0.62 173 XM_HighProb1 1177 0.21 0.90 0.03 174 FORGED_GMAIL_RCVD 1170 0.58 0.89 0.49 175 XMMoneyMeta_00 1169 0.64 0.89 0.57 176 HTML_FONT_SIZE_LARGE 1166 0.32 0.89 0.17 177 XM_RXBody 1126 0.50 0.86 0.40 178 SUBJ_DOLLARS 1107 0.44 0.84 0.34 179 PLING_QUERY 1102 0.59 0.84 0.52 180 THIS_AD 1060 0.35 0.81 0.23 181 TooManyTo_003 1043 1.43 0.79 1.60 182 TR_XM_DK_Bayes2 1039 7.93 0.79 9.83 183 LongTLD 1025 0.29 0.78 0.17 184 XM_PDF 1021 3.90 0.78 4.73 185 XMSubMetaSxObfu_03 1020 0.52 0.78 0.46 186 T_FILL_THIS_FORM_SHORT 1019 0.92 0.78 0.96 187 XMClaimOffer 1004 0.28 0.76 0.16 188 XM_B_COPY_HTML 1001 0.51 0.76 0.45 189 RCVD_IN_IADB_OPTIN 976 1.94 0.74 2.26 190 FILL_THIS_FORM_LOAN 974 0.43 0.74 0.35 191 NORDNS_LOW_CONTRAST 941 0.16 0.72 0.01 192 XMSlimDrugH 939 0.44 0.71 0.36 193 XM_UB80 939 0.16 0.71 0.02 194 XMSubMetaSSx_00 934 0.35 0.71 0.25 195 RELAYCOUNTRY_AU 930 0.64 0.71 0.63 196 RELAYCOUNTRY_DE 930 0.44 0.71 0.36 197 TooManyTo_004 902 1.05 0.69 1.15 198 XMSubNoVowel 887 0.38 0.68 0.30 199 XM_UB999 875 0.14 0.67 0.00 200 XM_H_PHPMailer 865 0.72 0.66 0.74 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 435317 89.34 95.35 87.75 2 DKIM_SIGNED 373583 76.85 82.67 75.30 3 XM_DK_Pass 367045 75.18 79.68 73.99 4 DKIM_VALID 345431 70.58 74.16 69.63 5 BAYES_50 285574 55.67 48.50 57.56 6 DCC_CHECK_NEGATIVE 284922 48.81 16.28 57.43 7 XMListUnsubscribeExists 260269 57.06 74.42 52.46 8 DKIM_VALID_AU 244481 51.16 58.25 49.28 9 DCC_CHECK 199899 49.06 82.16 40.29 10 XM_H_QuotedFrom 192195 41.62 52.50 38.74 11 T_TM2_M_HEADER_IN_MSG 145495 27.03 18.34 29.33 12 HTML_FONT_LOW_CONTRAST 136800 30.02 39.25 27.58 13 DKIM_VALID_EF 132461 25.30 20.02 26.70 14 XMSubLong 108940 23.20 27.87 21.96 15 FVGT_m_MULTI_ODD 106821 22.93 28.19 21.53 16 LOC_TINY_FONT_1 105785 24.34 35.72 21.32 17 MIME_HTML_ONLY 98359 22.88 34.42 19.83 18 MultiRelay 89303 17.39 15.10 18.00 19 T_KAM_HTML_FONT_INVALID 85196 17.51 18.78 17.17 20 BAYES_00 81296 13.32 1.73 16.39 21 ALL_TRUSTED 80807 13.20 1.53 16.29 22 TR_XM_DK_Bayes 63427 10.33 1.08 12.79 23 XM_Multi_Part_URI 62563 13.41 16.42 12.61 24 XM_Body_Dirty_Words 60598 13.86 20.06 12.21 25 TR_XM_DK_Bayes1 59584 9.70 0.97 12.01 26 XM_DKIMWhitelistDomains 56775 9.12 0.33 11.44 27 TR_XM_DK_Bayes2 48745 7.93 0.79 9.83 28 HTML_IMAGE_RATIO_02 46321 10.36 14.22 9.34 29 LOTS_OF_MONEY 45752 10.33 14.53 9.22 30 RCVD_IN_RP_SAFE 44184 7.54 2.37 8.91 31 LotsOfNums_01 44057 8.31 6.16 8.88 32 XM_Evil_Numbers_Gen 42767 9.89 14.69 8.62 33 TooManyTo_001 41474 8.38 8.45 8.36 34 T_XMDrugObfuBody_14 38616 8.03 8.94 7.78 35 RCVD_IN_RP_CERTIFIED 38546 6.48 1.63 7.77 36 XM_DK_Undo_02 34457 12.84 35.11 6.95 37 XM_H_Long_From01 32389 6.80 7.81 6.53 38 MIME_QP_LONG_LINE 30172 5.40 2.84 6.08 39 XM_B_Phish_Phrases 29181 6.23 7.55 5.88 40 FSL_BULK_SIG 29156 7.13 11.84 5.88 41 RCVD_IN_IADB_LISTED 28458 4.90 1.75 5.74 42 XM_SendGrid 28160 5.11 2.97 5.68 43 DKIM_INVALID 28152 6.27 8.51 5.67 44 RELAYCOUNTRY_META 27414 8.24 18.48 5.53 45 BAYES_99 26889 10.16 28.08 5.42 46 HTML_IMAGE_RATIO_04 26087 6.01 8.86 5.26 47 BAYES_60 25931 5.38 5.97 5.23 48 RCVD_IN_IADB_SPF 25041 4.29 1.44 5.05 49 T_TooManySym_01 24668 4.48 2.62 4.97 50 BOTNET_IPINHOSTNAME 24651 7.81 18.52 4.97 51 BAYES_40 24427 4.44 2.62 4.92 52 XM_PDF 23444 3.90 0.78 4.73 53 XMStrtUSub 22902 4.39 3.54 4.62 54 BAYES_999 22647 8.53 23.51 4.57 55 RCVD_IN_IADB_SENDERID 22014 3.80 1.38 4.44 56 RCVD_IN_IADB_DK 21806 3.76 1.37 4.40 57 RCVD_IN_MSPIKE_H2 20755 3.90 2.83 4.18 58 XMSubMetaSx_00 20375 5.22 9.40 4.11 59 T_REMOTE_IMAGE 20097 4.01 3.84 4.05 60 XMSexyCombo_05 18894 5.45 11.64 3.81 61 FROM_EXCESS_BASE64 18521 4.60 7.86 3.73 62 IN_ZIMBRA_NJ_WHITELIST 18486 2.95 0.03 3.73 63 XMNumbers 18132 3.91 4.88 3.65 64 RCVD_IN_IADB_VOUCHED 17909 3.07 1.05 3.61 65 BAYES_20 17698 3.28 2.21 3.57 66 XM_UncommonTLD01 16125 5.00 11.61 3.25 67 HTML_IMAGE_RATIO_06 15837 3.62 5.25 3.19 68 MPART_ALT_DIFF 15761 4.31 8.61 3.18 69 MAILING_LIST_MULTI 15245 2.80 1.75 3.07 70 BAYES_80 14526 3.62 6.23 2.93 71 TR_DCC_Bayes_99 14141 7.10 23.15 2.85 72 MIME_HTML_MOSTLY 13418 2.92 3.71 2.70 73 ANY_BOUNCE_MESSAGE 13314 2.36 1.13 2.68 74 BOUNCE_MESSAGE 13301 2.36 1.13 2.68 75 UNPARSEABLE_RELAY 12652 2.40 1.82 2.55 76 HTML_MIME_NO_HTML_TAG 12222 2.74 3.76 2.46 77 TooManyTo_002 11663 2.05 0.93 2.35 78 HTML_IMAGE_RATIO_08 11277 2.54 3.55 2.27 79 BAYES_05 11270 2.10 1.46 2.27 80 TO_MALFORMED 11212 1.80 0.05 2.26 81 RCVD_IN_IADB_OPTIN 11211 1.94 0.74 2.26 82 XM_CamelCaseFrm001 10581 2.38 3.31 2.13 83 TVD_RCVD_IP 10361 1.74 0.43 2.09 84 TM2_M_URI_OPT_OUT 10195 2.41 3.73 2.06 85 XM_SPF_SoftFail 10074 2.55 4.53 2.03 86 XM_DIRTYINTL 10051 2.64 4.96 2.03 87 RCVD_IN_MSPIKE_WL 9912 1.69 0.51 2.00 88 RCVD_IN_MSPIKE_H3 9907 1.68 0.50 2.00 89 URI_HEX 9611 2.22 3.28 1.94 90 XM_DK_Undo_01 9564 1.81 1.37 1.93 91 XMDiploma_00 9235 1.92 2.14 1.86 92 T_TooManySym_02 9192 1.66 0.92 1.85 93 SUBJ_ALL_CAPS 9039 2.03 2.80 1.82 94 RELAYCOUNTRY_CA 8545 2.11 3.56 1.72 95 BAYES_95 8487 2.02 3.21 1.71 96 HELO_NODOT 8370 1.41 0.37 1.69 97 IN_HORDE_ADDRESS_BOOK 8138 1.31 0.04 1.64 98 T_XMDrugObfuBody_08 7945 1.91 3.06 1.60 99 TooManyTo_003 7944 1.43 0.79 1.60 100 BOTNET 7901 4.26 14.35 1.59 101 MIME_HTML_ONLY_MULTI 7868 2.29 4.94 1.59 102 TR_Symld_Words 7436 1.41 1.08 1.50 103 XM_OfRef6 7257 1.72 2.69 1.46 104 INVALID_MSGID 7111 1.18 0.21 1.43 105 TR_MetaPhish_Combo_01 7075 1.34 1.00 1.43 106 URI_TRY_3LD 6922 1.39 1.35 1.40 107 XMCapTrack 6680 1.12 0.27 1.35 108 XM_ProductURIs 6256 1.38 1.82 1.26 109 UNTRUSTED_Relay 6241 3.46 11.76 1.26 110 XM_H_Long_From02 6167 1.52 2.55 1.24 111 XM_GoogleGroups 6157 1.08 0.47 1.24 112 USER_IN_DEF_DKIM_WL 5984 0.97 0.10 1.21 113 TooManyTo_004 5692 1.05 0.69 1.15 114 XMGenDplmaNmb 5540 1.18 1.42 1.12 115 XMPhish11 5490 1.12 1.18 1.11 116 XM_H_PHPOS 5367 1.12 1.27 1.08 117 TM2_M_VERY_LONG_WORD 5307 1.18 1.59 1.07 118 RELAYCOUNTRY_GB 5223 1.15 1.51 1.05 119 XMBdyGiftCard01 4994 1.14 1.65 1.01 120 T_FILL_THIS_FORM_SHORT 4783 0.92 0.78 0.96 121 DKIM_ADSP_CUSTOM_MED 4744 0.98 1.05 0.96 122 TooManyTo_005 4528 0.85 0.60 0.91 123 XM_salutation2 4303 1.43 3.56 0.87 124 XMStockSpam_06 4171 1.08 1.98 0.84 125 XMGappySubj_01 4164 0.72 0.27 0.84 126 T_XMDrugObfuBody_00 3979 1.17 2.55 0.80 127 XM_UB50 3923 1.97 6.43 0.79 128 SpammyFromTLD_01 3774 1.00 1.92 0.76 129 T_XMHurry_00 3670 0.85 1.24 0.74 130 XM_H_PHPMailer 3653 0.72 0.66 0.74 131 XMNoVowels 3568 0.68 0.52 0.72 132 T_TooManySym_03 3375 0.57 0.14 0.68 133 NML_ADSP_CUSTOM_MED 3268 0.73 0.98 0.66 134 XMBody_17 3234 0.86 1.66 0.65 135 XMSubMetaI_00 3215 0.96 2.16 0.65 136 T_Symld_Words_02 3213 0.73 1.05 0.65 137 XMBody_95 3153 0.55 0.24 0.64 138 XMHTMLBadTable_001 3116 0.79 1.39 0.63 139 RELAYCOUNTRY_AU 3102 0.64 0.71 0.63 140 HTML_TAG_BALANCE_BODY 3076 0.68 0.90 0.62 141 XMSexyCombo_01 3070 0.99 2.37 0.62 142 TR_XM_RelayPhish 2877 0.81 1.67 0.58 143 XMBrknScrpt_02 2845 0.77 1.51 0.57 144 XMMoneyMeta_00 2840 0.64 0.89 0.57 145 TR_LOTS_OF_MONEY3 2837 0.69 1.13 0.57 146 HTML_FONT_FACE_BAD 2824 0.68 1.08 0.57 147 HTTPS_HTTP_MISMATCH 2814 0.56 0.51 0.57 148 FROM_GOV_SPOOF 2812 0.49 0.20 0.57 149 T_OBFU_PDF_ATTACH 2779 0.49 0.22 0.56 150 TM2_M_A_HREF_HREF 2765 0.54 0.48 0.56 151 USER_IN_WHITELIST 2735 0.44 0.00 0.55 152 XMLngstWrd_00 2660 0.49 0.30 0.54 153 URI_NOVOWEL 2641 0.56 0.65 0.53 154 PLING_QUERY 2583 0.59 0.84 0.52 155 XMHTML_After_End 2569 0.74 1.57 0.52 156 XM_B_REG_HTML 2529 0.59 0.92 0.51 157 XMBody_78 2529 0.74 1.61 0.51 158 AC_DIV_BONANZA 2483 0.43 0.17 0.50 159 FORGED_GMAIL_RCVD 2439 0.58 0.89 0.49 160 XMLngstWrd_01 2417 0.44 0.28 0.49 161 RDNS_DYNAMIC 2381 0.66 1.36 0.48 162 TR_LOTS_OF_MONEY2 2369 0.80 2.04 0.48 163 T_MONEY_PERCENT 2369 0.80 2.04 0.48 164 XMSubMetaSxObfu_02 2367 0.50 0.60 0.48 165 XMGappySubj_02 2342 0.39 0.08 0.47 166 DKIM_ADSP_NXDOMAIN 2307 0.77 1.95 0.47 167 REMOVE_BEFORE_LINK 2295 0.45 0.41 0.46 168 XMSubMetaSxObfu_03 2271 0.52 0.78 0.46 169 XMPhish30 2236 0.66 1.45 0.45 170 SHORT_HELO_AND_INLINE_IMAGE 2226 0.36 0.04 0.45 171 XM_B_COPY_HTML 2217 0.51 0.76 0.45 172 FILL_THIS_FORM 2213 0.56 0.98 0.45 173 XM_URI_RBL 2131 1.07 3.49 0.43 174 RCVD_IN_BL_SPAMCOP_NET 2097 0.84 2.43 0.42 175 XMDateMe_00 2083 0.39 0.29 0.42 176 XM_RXBody 2008 0.50 0.86 0.40 177 MISSING_HEADERS 1995 0.42 0.49 0.40 178 XM_Body_Obfu01 1966 0.39 0.39 0.40 179 FILL_THIS_FORM_LONG 1893 0.50 0.94 0.38 180 RCVD_IN_SORBS_DUL 1867 0.39 0.44 0.38 181 FROM_GOV_DKIM_AU 1854 0.32 0.14 0.37 182 XM_H_PHPOS_M 1854 0.38 0.42 0.37 183 XM_ShortIntro_01 1851 0.39 0.44 0.37 184 DIET_1 1816 0.55 1.25 0.37 185 HTML_IMAGE_ONLY_24 1807 0.38 0.46 0.36 186 RELAYCOUNTRY_DE 1805 0.44 0.71 0.36 187 XMSlimDrugH 1797 0.44 0.71 0.36 188 XMPhish14 1782 0.48 0.95 0.36 189 HTML_IMAGE_ONLY_28 1769 0.38 0.46 0.36 190 SpammyFromTLD_02 1741 1.15 4.17 0.35 191 HTML_IMAGE_ONLY_32 1727 0.35 0.36 0.35 192 XMSubGiftCard1 1719 0.31 0.18 0.35 193 FILL_THIS_FORM_LOAN 1713 0.43 0.74 0.35 194 TM2_M_BODY_EMPTY 1702 0.30 0.13 0.34 195 SUBJ_DOLLARS 1684 0.44 0.84 0.34 196 RELAYCOUNTRY_NL 1622 0.39 0.61 0.33 197 XMSolicitRefs_0 1591 0.31 0.26 0.32 198 T_HTML_ATTACH 1581 0.32 0.34 0.32 199 XMLKML 1534 0.24 0.00 0.31 200 XM_B_TRADE_HTML 1533 0.32 0.36 0.31 ----------------------------------------------------------------------