Email: 649629 Autolearn: 0 AvgScore: 1.87 AvgScanTime: 3.63 sec Spam: 138568 Autolearn: 0 AvgScore: 12.02 AvgScanTime: 4.08 sec Ham: 511061 Autolearn: 0 AvgScore: -0.88 AvgScanTime: 3.51 sec Time Spent Running SA: 655.57 hours Time Spent Processing Spam: 157.20 hours Time Spent Processing Ham: 498.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132187 89.94 95.40 88.46 2 DKIM_SIGNED 107573 75.33 77.63 74.70 3 DCC_CHECK 106745 48.93 77.03 41.30 4 XM_DK_Pass 104091 73.82 75.12 73.47 5 DKIM_VALID 97096 69.37 70.07 69.18 6 XMListUnsubscribeExists 93876 55.03 67.75 51.58 7 DKIM_VALID_AU 74335 50.46 53.65 49.60 8 XM_H_QuotedFrom 66717 41.35 48.15 39.50 9 BAYES_50 63947 54.47 46.15 56.73 10 MIME_HTML_ONLY 49643 23.72 35.83 20.43 11 HTML_FONT_LOW_CONTRAST 48641 29.23 35.10 27.63 12 XM_DK_Undo_02 47264 13.04 34.11 7.33 13 LOC_TINY_FONT_1 46902 25.31 33.85 23.00 14 XMSubLong 38668 22.48 27.91 21.01 15 FVGT_m_MULTI_ODD 38113 22.85 27.50 21.59 16 BAYES_99 37083 10.29 26.76 5.82 17 RELAYCOUNTRY_META 31679 9.33 22.86 5.66 18 BAYES_999 30115 8.47 21.73 4.88 19 TR_DCC_Bayes_99 29919 7.21 21.59 3.31 20 DCC_CHECK_NEGATIVE 29643 49.06 21.39 56.56 21 DKIM_VALID_EF 26286 24.92 18.97 26.54 22 T_TM2_M_HEADER_IN_MSG 26269 27.84 18.96 30.25 23 XM_Body_Dirty_Words 26077 13.26 18.82 11.75 24 T_KAM_HTML_FONT_INVALID 25149 17.38 18.15 17.17 25 BOTNET_IPINHOSTNAME 24824 7.63 17.91 4.84 26 UNTRUSTED_Relay 21689 4.50 15.65 1.48 27 BOTNET 21449 4.59 15.48 1.63 28 XM_Multi_Part_URI 20772 13.02 14.99 12.48 29 MultiRelay 20327 17.39 14.67 18.13 30 LOTS_OF_MONEY 19752 10.21 14.25 9.11 31 HTML_IMAGE_RATIO_02 19458 9.27 14.04 7.98 32 FSL_BULK_SIG 18188 7.33 13.13 5.76 33 XM_Evil_Numbers_Gen 17738 9.25 12.80 8.29 34 XM_UncommonTLD01 15999 4.95 11.55 3.16 35 FROM_EXCESS_BASE64 15787 5.97 11.39 4.49 36 T_XMDrugObfuBody_14 13323 8.34 9.61 8.00 37 XMSexyCombo_05 12759 4.86 9.21 3.68 38 T_REMOTE_IMAGE 12438 5.05 8.98 3.99 39 HTML_MIME_NO_HTML_TAG 12087 3.73 8.72 2.38 40 BAYES_60 11706 5.78 8.45 5.06 41 XMSubMetaSx_00 11625 4.92 8.39 3.98 42 MPART_ALT_DIFF 11278 4.09 8.14 3.00 43 XM_H_Long_From01 11256 6.71 8.12 6.32 44 XMNumbers 10648 4.48 7.68 3.62 45 BAYES_80 10554 3.95 7.62 2.95 46 XM_UB50 10511 2.37 7.59 0.96 47 DKIM_INVALID 10477 5.96 7.56 5.52 48 TooManyTo_001 10277 8.65 7.42 8.98 49 HTML_SHORT_LINK_IMG_1 10147 1.86 7.32 0.37 50 HTML_IMAGE_RATIO_04 9705 5.73 7.00 5.39 51 MIME_HEADER_CTYPE_ONLY 9214 1.79 6.65 0.47 52 XM_B_Phish_Phrases 9091 5.70 6.56 5.47 53 RELAYCOUNTRY_FR 8592 1.69 6.20 0.47 54 MISSING_HEADERS 8220 1.92 5.93 0.84 55 BODY_URI_ONLY 8164 1.49 5.89 0.30 56 LotsOfNums_01 8031 7.92 5.80 8.50 57 RCVD_IN_RP_RNBL 7226 1.16 5.21 0.06 58 XM_DIRTYINTL 6790 2.45 4.90 1.78 59 MIME_HTML_MOSTLY 6742 3.00 4.87 2.50 60 HTML_IMAGE_ONLY_04 6538 1.20 4.72 0.24 61 HTML_SHORT_CENTER 6442 1.15 4.65 0.20 62 XM_SPF_SoftFail 6415 2.74 4.63 2.22 63 XMStrtUSub 6300 4.14 4.55 4.03 64 MIME_HTML_ONLY_MULTI 6181 2.16 4.46 1.53 65 HTML_IMAGE_RATIO_06 5552 3.61 4.01 3.50 66 RELAYCOUNTRY_CA 5190 2.12 3.75 1.68 67 XM_salutation2 5161 1.42 3.72 0.79 68 TM2_M_URI_OPT_OUT 4991 2.46 3.60 2.15 69 XM_UB60 4935 0.82 3.56 0.08 70 SpammyFromTLD_02 4843 0.95 3.50 0.26 71 URI_HEX 4680 1.99 3.38 1.62 72 BAYES_95 4514 2.11 3.26 1.80 73 RCVD_IN_MSPIKE_H2 4352 4.11 3.14 4.38 74 XM_CamelCaseFrm001 4304 2.20 3.11 1.95 75 MultiRelay_CC 4225 0.78 3.05 0.17 76 MultiRelay_Combo 4225 0.78 3.05 0.17 77 HTML_IMAGE_RATIO_08 4202 2.25 3.03 2.04 78 SHORTENER_SHORT_IMG 4181 0.74 3.02 0.13 79 T_XMDrugObfuBody_08 4050 1.91 2.92 1.63 80 MIME_QP_LONG_LINE 4005 5.34 2.89 6.00 81 RCVD_IN_BL_SPAMCOP_NET 4000 0.90 2.89 0.36 82 XM_SendGrid 3952 5.13 2.85 5.75 83 XM_URI_RBL 3928 0.89 2.83 0.36 84 SpammyFromTLD_01 3609 1.27 2.60 0.91 85 BAYES_40 3548 4.62 2.56 5.18 86 XMSexyCombo_01 3521 0.92 2.54 0.47 87 T_TooManySym_01 3488 4.13 2.52 4.57 88 XM_OfRef6 3483 1.75 2.51 1.55 89 BOTNET_NORDNS 3420 0.54 2.47 0.02 90 URIBL_DBL_SPAM 3241 0.55 2.34 0.07 91 BAYES_20 3221 3.44 2.32 3.74 92 XMDiploma_00 3155 1.83 2.28 1.71 93 UNPARSEABLE_RELAY 3137 2.55 2.26 2.62 94 XMSubMetaI_00 3131 0.88 2.26 0.51 95 RELAYCOUNTRY_CN 3115 0.52 2.25 0.06 96 RCVD_IN_RP_SAFE 3007 7.16 2.17 8.52 97 T_XMHurry_00 2927 1.14 2.11 0.88 98 XMBdyGiftCard01 2921 1.15 2.11 0.89 99 HTML_IMAGE_ONLY_08 2801 0.64 2.02 0.26 100 RELAYCOUNTRY_GB 2790 1.35 2.01 1.18 101 ALL_TRUSTED 2708 13.18 1.95 16.23 102 XMMoneyMeta_00 2502 0.90 1.81 0.65 103 XMSlimDrugH 2420 0.70 1.75 0.42 104 DIET_1 2409 0.65 1.74 0.36 105 XMBody_17 2407 0.95 1.74 0.73 106 XMStockSpam_06 2404 0.91 1.73 0.69 107 T_XMDrugObfuBody_00 2371 1.04 1.71 0.86 108 MAILING_LIST_MULTI 2360 2.69 1.70 2.95 109 TM2_M_VERY_LONG_WORD 2354 1.11 1.70 0.95 110 RCVD_IN_IADB_LISTED 2239 4.77 1.62 5.63 111 XM_PDF 2203 3.99 1.59 4.64 112 XM_UB80 2192 0.36 1.58 0.03 113 XMGenDplmaNmb 2186 1.26 1.58 1.18 114 BAYES_00 2157 13.27 1.56 16.45 115 TR_XM_RelayPhish 2141 0.74 1.55 0.53 116 TR_MetaPhish_Combo_01 2050 1.60 1.48 1.63 117 TR_Symld_Words 2039 1.59 1.47 1.63 118 URI_TRY_3LD 2029 1.38 1.46 1.36 119 TR_LOTS_OF_MONEY3 2014 0.80 1.45 0.63 120 MPART_ALT_DIFF_COUNT 1998 0.48 1.44 0.22 121 SUBJ_ALL_CAPS 1987 1.58 1.43 1.62 122 URIBL_BLACK 1928 0.33 1.39 0.04 123 RCVD_IN_RP_CERTIFIED 1921 6.17 1.39 7.46 124 DKIM_ADSP_CUSTOM_MED 1888 1.02 1.36 0.93 125 RCVD_IN_IADB_SPF 1880 4.18 1.36 4.94 126 TVD_SPACE_RATIO_MINFP 1875 0.29 1.35 0.01 127 XMPhish11 1874 1.14 1.35 1.08 128 NML_ADSP_CUSTOM_MED 1835 0.79 1.32 0.64 129 BAYES_05 1833 2.06 1.32 2.26 130 RCVD_IN_IADB_SENDERID 1819 3.69 1.31 4.33 131 T_Symld_Words_02 1811 1.10 1.31 1.05 132 XMSubGiftCard1 1809 0.33 1.31 0.07 133 RCVD_IN_IADB_DK 1796 3.67 1.30 4.31 134 XM_H_PHPOS 1791 1.65 1.29 1.74 135 XMPhish30 1788 0.61 1.29 0.43 136 RELAYCOUNTRY_AT 1757 0.43 1.27 0.20 137 TR_LOTS_OF_MONEY2 1733 0.56 1.25 0.37 138 T_MONEY_PERCENT 1733 0.56 1.25 0.37 139 XMPhish14 1727 0.69 1.25 0.54 140 FORGED_GMAIL_RCVD 1703 0.66 1.23 0.51 141 XM_ProductURIs 1702 0.69 1.23 0.54 142 XM_H_Long_From02 1654 1.11 1.19 1.09 143 NO_DNS_FOR_FROM 1648 0.45 1.19 0.25 144 XMHTML_After_End 1637 0.73 1.18 0.61 145 SUBJ_DOLLARS 1605 0.61 1.16 0.46 146 TR_XM_DK_Bayes 1602 10.37 1.16 12.86 147 XM_DK_Undo_01 1578 1.66 1.14 1.80 148 FROM_SUSPICIOUS_NTLD 1555 0.31 1.12 0.08 149 XMBody_78 1554 0.63 1.12 0.50 150 DATE_IN_PAST_24_48 1529 0.27 1.10 0.05 151 BODY_ENHANCEMENT 1507 0.24 1.09 0.02 152 TR_Mismatch_TLD_02 1477 0.28 1.07 0.06 153 XM_BadFromFormat 1463 0.31 1.06 0.11 154 T_OBFU_PDF_ATTACH 1456 0.68 1.05 0.58 155 XMSexyCombo_04 1437 0.30 1.04 0.10 156 TR_XM_DK_Bayes1 1428 9.77 1.03 12.14 157 HTML_TAG_BALANCE_BODY 1424 0.63 1.03 0.52 158 HTML_FONT_FACE_BAD 1415 0.66 1.02 0.57 159 XMLongAddy 1404 0.26 1.01 0.06 160 HTTPS_HTTP_MISMATCH 1400 0.74 1.01 0.66 161 XM_UB99 1379 0.22 1.00 0.02 162 DKIM_ADSP_NXDOMAIN 1348 0.55 0.97 0.44 163 T_FILL_THIS_FORM_SHORT 1325 0.86 0.96 0.84 164 URI_NOVOWEL 1322 0.69 0.95 0.62 165 HTML_FONT_SIZE_LARGE 1322 0.36 0.95 0.20 166 RELAYCOUNTRY_DE 1303 0.49 0.94 0.37 167 RDNS_DYNAMIC 1300 0.56 0.94 0.46 168 XM_ShortIntro_01 1298 0.52 0.94 0.41 169 TooManyTo_002 1278 1.86 0.92 2.12 170 RCVD_IN_IADB_VOUCHED 1270 2.98 0.92 3.54 171 DATE_IN_PAST_12_24 1252 0.24 0.90 0.07 172 GMD_PDF_EMPTY_BODY 1249 0.38 0.90 0.24 173 HTML_IMAGE_ONLY_12 1237 0.36 0.89 0.22 174 NORMAL_HTTP_TO_IP 1231 0.25 0.89 0.08 175 LONG_HEX_URI 1190 0.30 0.86 0.15 176 XM_B_COPY_HTML 1189 0.52 0.86 0.43 177 XMSubMetaSxObfu_03 1182 0.50 0.85 0.41 178 XMSubGiftCard2 1178 0.19 0.85 0.01 179 XM_B_REG_HTML 1169 0.57 0.84 0.50 180 LONG_JUNK_URI 1148 0.23 0.83 0.07 181 TR_XM_DK_Bayes2 1139 8.16 0.82 10.15 182 FILL_THIS_FORM 1133 0.48 0.82 0.39 183 DEAR_FRIEND 1121 0.24 0.81 0.08 184 FROM_STARTS_WITH_NUMS 1120 0.27 0.81 0.12 185 T_TooManySym_02 1093 1.46 0.79 1.64 186 TooManyTo_003 1089 1.30 0.79 1.44 187 HK_RANDOM_FROM 1086 0.36 0.78 0.24 188 LongTLD 1079 0.29 0.78 0.16 189 THIS_AD 1073 0.38 0.77 0.27 190 XM_XX_Yahoo 1047 0.20 0.76 0.05 191 XM_RXBody 1045 0.30 0.75 0.18 192 FVGT_m_MULTI_ODD_EMAIL 1038 0.18 0.75 0.03 193 DATE_IN_PAST_03_06 1030 0.23 0.74 0.10 194 PLING_QUERY 1019 0.56 0.74 0.51 195 XMSpoofStaff2 1000 0.19 0.72 0.05 196 XM_H_SpoofStaff4 991 0.29 0.72 0.17 197 HTML_IMAGE_ONLY_28 989 0.45 0.71 0.38 198 TVD_PH_BODY_ACCOUNTS_PRE 985 0.23 0.71 0.09 199 XMBrknScrpt_02 979 0.58 0.71 0.54 200 XM_UB999 970 0.16 0.70 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 452081 89.94 95.40 88.46 2 DKIM_SIGNED 381776 75.33 77.63 74.70 3 XM_DK_Pass 375464 73.82 75.12 73.47 4 DKIM_VALID 353563 69.37 70.07 69.18 5 BAYES_50 289917 54.47 46.15 56.73 6 DCC_CHECK_NEGATIVE 289066 49.06 21.39 56.56 7 XMListUnsubscribeExists 263624 55.03 67.75 51.58 8 DKIM_VALID_AU 253481 50.46 53.65 49.60 9 DCC_CHECK 211089 48.93 77.03 41.30 10 XM_H_QuotedFrom 201893 41.35 48.15 39.50 11 T_TM2_M_HEADER_IN_MSG 154576 27.84 18.96 30.25 12 HTML_FONT_LOW_CONTRAST 141224 29.23 35.10 27.63 13 DKIM_VALID_EF 135624 24.92 18.97 26.54 14 LOC_TINY_FONT_1 117535 25.31 33.85 23.00 15 FVGT_m_MULTI_ODD 110333 22.85 27.50 21.59 16 XMSubLong 107374 22.48 27.91 21.01 17 MIME_HTML_ONLY 104417 23.72 35.83 20.43 18 MultiRelay 92634 17.39 14.67 18.13 19 T_KAM_HTML_FONT_INVALID 87771 17.38 18.15 17.17 20 BAYES_00 84067 13.27 1.56 16.45 21 ALL_TRUSTED 82920 13.18 1.95 16.23 22 TR_XM_DK_Bayes 65733 10.37 1.16 12.86 23 XM_Multi_Part_URI 63803 13.02 14.99 12.48 24 TR_XM_DK_Bayes1 62048 9.77 1.03 12.14 25 XM_Body_Dirty_Words 60074 13.26 18.82 11.75 26 XM_DKIMWhitelistDomains 58892 9.07 0.02 11.52 27 TR_XM_DK_Bayes2 51851 8.16 0.82 10.15 28 LOTS_OF_MONEY 46546 10.21 14.25 9.11 29 TooManyTo_001 45917 8.65 7.42 8.98 30 RCVD_IN_RP_SAFE 43526 7.16 2.17 8.52 31 LotsOfNums_01 43431 7.92 5.80 8.50 32 XM_Evil_Numbers_Gen 42347 9.25 12.80 8.29 33 T_XMDrugObfuBody_14 40862 8.34 9.61 8.00 34 HTML_IMAGE_RATIO_02 40777 9.27 14.04 7.98 35 RCVD_IN_RP_CERTIFIED 38145 6.17 1.39 7.46 36 XM_DK_Undo_02 37480 13.04 34.11 7.33 37 XM_H_Long_From01 32308 6.71 8.12 6.32 38 MIME_QP_LONG_LINE 30665 5.34 2.89 6.00 39 BAYES_99 29760 10.29 26.76 5.82 40 FSL_BULK_SIG 29412 7.33 13.13 5.76 41 XM_SendGrid 29372 5.13 2.85 5.75 42 RELAYCOUNTRY_META 28935 9.33 22.86 5.66 43 RCVD_IN_IADB_LISTED 28764 4.77 1.62 5.63 44 DKIM_INVALID 28213 5.96 7.56 5.52 45 XM_B_Phish_Phrases 27957 5.70 6.56 5.47 46 HTML_IMAGE_RATIO_04 27537 5.73 7.00 5.39 47 BAYES_40 26461 4.62 2.56 5.18 48 BAYES_60 25873 5.78 8.45 5.06 49 RCVD_IN_IADB_SPF 25268 4.18 1.36 4.94 50 BAYES_999 24929 8.47 21.73 4.88 51 BOTNET_IPINHOSTNAME 24717 7.63 17.91 4.84 52 XM_PDF 23721 3.99 1.59 4.64 53 T_TooManySym_01 23357 4.13 2.52 4.57 54 FROM_EXCESS_BASE64 22971 5.97 11.39 4.49 55 RCVD_IN_MSPIKE_H2 22367 4.11 3.14 4.38 56 RCVD_IN_IADB_SENDERID 22137 3.69 1.31 4.33 57 RCVD_IN_IADB_DK 22021 3.67 1.30 4.31 58 XMStrtUSub 20592 4.14 4.55 4.03 59 T_REMOTE_IMAGE 20366 5.05 8.98 3.99 60 XMSubMetaSx_00 20320 4.92 8.39 3.98 61 BAYES_20 19115 3.44 2.32 3.74 62 IN_ZIMBRA_NJ_WHITELIST 18968 2.93 0.03 3.71 63 XMSexyCombo_05 18794 4.86 9.21 3.68 64 XMNumbers 18475 4.48 7.68 3.62 65 RCVD_IN_IADB_VOUCHED 18088 2.98 0.92 3.54 66 HTML_IMAGE_RATIO_06 17907 3.61 4.01 3.50 67 TR_DCC_Bayes_99 16928 7.21 21.59 3.31 68 XM_UncommonTLD01 16134 4.95 11.55 3.16 69 MPART_ALT_DIFF 15311 4.09 8.14 3.00 70 BAYES_80 15098 3.95 7.62 2.95 71 MAILING_LIST_MULTI 15090 2.69 1.70 2.95 72 UNPARSEABLE_RELAY 13401 2.55 2.26 2.62 73 ANY_BOUNCE_MESSAGE 13337 2.20 0.68 2.61 74 BOUNCE_MESSAGE 13336 2.20 0.67 2.61 75 MIME_HTML_MOSTLY 12770 3.00 4.87 2.50 76 HTML_MIME_NO_HTML_TAG 12165 3.73 8.72 2.38 77 BAYES_05 11561 2.06 1.32 2.26 78 RCVD_IN_IADB_OPTIN 11426 1.90 0.67 2.24 79 TVD_RCVD_IP 11404 1.81 0.25 2.23 80 XM_SPF_SoftFail 11365 2.74 4.63 2.22 81 TO_MALFORMED 11208 1.74 0.06 2.19 82 TM2_M_URI_OPT_OUT 10992 2.46 3.60 2.15 83 TooManyTo_002 10830 1.86 0.92 2.12 84 HTML_IMAGE_RATIO_08 10443 2.25 3.03 2.04 85 XM_CamelCaseFrm001 9974 2.20 3.11 1.95 86 RCVD_IN_MSPIKE_WL 9714 1.57 0.35 1.90 87 RCVD_IN_MSPIKE_H3 9672 1.56 0.35 1.89 88 HELO_NODOT 9431 1.54 0.40 1.85 89 BAYES_95 9209 2.11 3.26 1.80 90 XM_DK_Undo_01 9195 1.66 1.14 1.80 91 XM_DIRTYINTL 9095 2.45 4.90 1.78 92 XM_H_PHPOS 8900 1.65 1.29 1.74 93 XMDiploma_00 8716 1.83 2.28 1.71 94 RELAYCOUNTRY_CA 8594 2.12 3.75 1.68 95 T_TooManySym_02 8402 1.46 0.79 1.64 96 TR_MetaPhish_Combo_01 8347 1.60 1.48 1.63 97 BOTNET 8344 4.59 15.48 1.63 98 T_XMDrugObfuBody_08 8331 1.91 2.92 1.63 99 TR_Symld_Words 8310 1.59 1.47 1.63 100 SUBJ_ALL_CAPS 8302 1.58 1.43 1.62 101 URI_HEX 8280 1.99 3.38 1.62 102 IN_HORDE_ADDRESS_BOOK 8105 1.26 0.07 1.59 103 XM_OfRef6 7902 1.75 2.51 1.55 104 MIME_HTML_ONLY_MULTI 7822 2.16 4.46 1.53 105 UNTRUSTED_Relay 7541 4.50 15.65 1.48 106 TooManyTo_003 7349 1.30 0.79 1.44 107 INVALID_MSGID 7194 1.13 0.12 1.41 108 XMCapTrack 7019 1.14 0.30 1.37 109 URI_TRY_3LD 6946 1.38 1.46 1.36 110 XMGenDplmaNmb 6023 1.26 1.58 1.18 111 RELAYCOUNTRY_GB 6009 1.35 2.01 1.18 112 XM_GoogleGroups 5869 0.99 0.42 1.15 113 XM_H_Long_From02 5582 1.11 1.19 1.09 114 XMBody_95 5554 0.89 0.16 1.09 115 XMPhish11 5525 1.14 1.35 1.08 116 TooManyTo_004 5491 0.99 0.67 1.07 117 T_Symld_Words_02 5361 1.10 1.31 1.05 118 USER_IN_DEF_DKIM_WL 5356 0.83 0.01 1.05 119 XM_UB50 4897 2.37 7.59 0.96 120 TM2_M_VERY_LONG_WORD 4849 1.11 1.70 0.95 121 DKIM_ADSP_CUSTOM_MED 4750 1.02 1.36 0.93 122 SpammyFromTLD_01 4640 1.27 2.60 0.91 123 TooManyTo_005 4595 0.83 0.60 0.90 124 XMBdyGiftCard01 4548 1.15 2.11 0.89 125 T_XMHurry_00 4503 1.14 2.11 0.88 126 T_XMDrugObfuBody_00 4388 1.04 1.71 0.86 127 T_FILL_THIS_FORM_SHORT 4285 0.86 0.96 0.84 128 MISSING_HEADERS 4277 1.92 5.93 0.84 129 XM_salutation2 4036 1.42 3.72 0.79 130 XMBody_17 3741 0.95 1.74 0.73 131 TO_NO_BRKTS_HTML_ONLY 3643 0.60 0.18 0.71 132 XMStockSpam_06 3509 0.91 1.73 0.69 133 XM_H_PHPMailer 3410 0.65 0.60 0.67 134 HTTPS_HTTP_MISMATCH 3388 0.74 1.01 0.66 135 XMMoneyMeta_00 3343 0.90 1.81 0.65 136 NML_ADSP_CUSTOM_MED 3282 0.79 1.32 0.64 137 TR_LOTS_OF_MONEY3 3212 0.80 1.45 0.63 138 URI_NOVOWEL 3188 0.69 0.95 0.62 139 XMLngstWrd_00 3126 0.54 0.26 0.61 140 XMHTML_After_End 3122 0.73 1.18 0.61 141 T_OBFU_PDF_ATTACH 2960 0.68 1.05 0.58 142 XMLngstWrd_01 2929 0.50 0.24 0.57 143 HTML_FONT_FACE_BAD 2897 0.66 1.02 0.57 144 XMHTMLBadTable_001 2838 0.58 0.69 0.56 145 XMNoVowels 2833 0.58 0.68 0.55 146 XMBrknScrpt_02 2780 0.58 0.71 0.54 147 FROM_GOV_SPOOF 2778 0.47 0.21 0.54 148 XM_ProductURIs 2753 0.69 1.23 0.54 149 XMPhish14 2743 0.69 1.25 0.54 150 RELAYCOUNTRY_AU 2694 0.53 0.54 0.53 151 TR_XM_RelayPhish 2688 0.74 1.55 0.53 152 HTML_TAG_BALANCE_BODY 2680 0.63 1.03 0.52 153 T_TooManySym_03 2641 0.43 0.12 0.52 154 USER_IN_WHITELIST 2638 0.41 0.00 0.52 155 XMSubMetaI_00 2598 0.88 2.26 0.51 156 PLING_QUERY 2592 0.56 0.74 0.51 157 FORGED_GMAIL_RCVD 2585 0.66 1.23 0.51 158 XMBody_78 2547 0.63 1.12 0.50 159 XM_B_REG_HTML 2530 0.57 0.84 0.50 160 XMSexyCombo_01 2427 0.92 2.54 0.47 161 SHORT_HELO_AND_INLINE_IMAGE 2417 0.38 0.03 0.47 162 XMGappySubj_01 2409 0.43 0.27 0.47 163 MIME_HEADER_CTYPE_ONLY 2389 1.79 6.65 0.47 164 RELAYCOUNTRY_FR 2382 1.69 6.20 0.47 165 SUBJ_DOLLARS 2358 0.61 1.16 0.46 166 RDNS_DYNAMIC 2344 0.56 0.94 0.46 167 REMOVE_BEFORE_LINK 2308 0.45 0.45 0.45 168 DKIM_ADSP_NXDOMAIN 2249 0.55 0.97 0.44 169 XM_B_COPY_HTML 2219 0.52 0.86 0.43 170 XMPhish30 2197 0.61 1.29 0.43 171 XMSolicitRefs_0 2181 0.44 0.47 0.43 172 XMSlimDrugH 2128 0.70 1.75 0.42 173 XM_ShortIntro_01 2112 0.52 0.94 0.41 174 XM_Body_Obfu01 2111 0.44 0.55 0.41 175 XMSubMetaSxObfu_03 2093 0.50 0.85 0.41 176 RCVD_IN_SORBS_DUL 2087 0.38 0.29 0.41 177 HTML_IMAGE_ONLY_32 1984 0.38 0.33 0.39 178 FILL_THIS_FORM 1980 0.48 0.82 0.39 179 XMSubMetaSxObfu_02 1957 0.40 0.45 0.38 180 HTML_IMAGE_ONLY_28 1949 0.45 0.71 0.38 181 HTML_SHORT_LINK_IMG_1 1904 1.86 7.32 0.37 182 XMDateMe_00 1893 0.38 0.44 0.37 183 T_MONEY_PERCENT 1885 0.56 1.25 0.37 184 TR_LOTS_OF_MONEY2 1885 0.56 1.25 0.37 185 RELAYCOUNTRY_DE 1880 0.49 0.94 0.37 186 TM2_M_BODY_EMPTY 1879 0.36 0.34 0.37 187 XM_URI_RBL 1853 0.89 2.83 0.36 188 DIET_1 1846 0.65 1.74 0.36 189 XMOemUri 1827 0.33 0.24 0.36 190 RCVD_IN_BL_SPAMCOP_NET 1817 0.90 2.89 0.36 191 XM_H_PHPOS_M 1809 0.36 0.40 0.35 192 TM2_M_A_HREF_HREF 1789 0.40 0.57 0.35 193 FROM_GOV_DKIM_AU 1761 0.34 0.32 0.34 194 AC_DIV_BONANZA 1759 0.30 0.12 0.34 195 XM_OfRef7 1720 0.37 0.50 0.34 196 XM_D_tchamptons_WL 1611 0.25 0.00 0.32 197 LOW_PRICE 1557 0.38 0.66 0.30 198 XMLKML 1521 0.23 0.00 0.30 199 TVD_SPACE_RATIO 1521 0.27 0.19 0.30 200 HTML_IMAGE_ONLY_24 1519 0.34 0.50 0.30 ----------------------------------------------------------------------