Email: 639956 Autolearn: 0 AvgScore: 3.41 AvgScanTime: 2.01 sec Spam: 204663 Autolearn: 0 AvgScore: 12.62 AvgScanTime: 2.32 sec Ham: 435293 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 1.86 sec Time Spent Running SA: 356.77 hours Time Spent Processing Spam: 131.77 hours Time Spent Processing Ham: 225.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152836 83.13 74.68 87.10 2 DKIM_SIGNED 133636 68.91 65.30 70.62 3 XM_DK_Pass 127676 67.10 62.38 69.31 4 DCC_CHECK 125746 43.30 61.44 34.76 5 DKIM_VALID 121088 63.57 59.16 65.65 6 XMListUnsubscribeExists 118265 49.11 57.79 45.03 7 DKIM_VALID_AU 100444 47.98 49.08 47.47 8 BAYES_50 89165 49.80 43.57 52.73 9 XM_DK_Undo_02 82693 22.99 40.40 14.80 10 XM_H_QuotedFrom 79693 39.41 38.94 39.63 11 DCC_CHECK_NEGATIVE 76443 54.89 37.35 63.14 12 BAYES_99 76340 21.14 37.30 13.54 13 BOTNET 72287 12.62 35.32 1.95 14 HTML_FONT_LOW_CONTRAST 69231 27.75 33.83 24.89 15 BAYES_999 66316 18.53 32.40 12.01 16 LOTS_OF_MONEY 63506 15.17 31.03 7.71 17 TR_DCC_Bayes_99 62590 14.42 30.58 6.82 18 LOC_TINY_FONT_1 58562 23.00 28.61 20.36 19 MIME_HTML_ONLY 52674 22.22 25.74 20.56 20 RCVD_IN_RP_RNBL 51889 8.16 25.35 0.07 21 RCVD_IN_PSBL 50758 7.95 24.80 0.02 22 BOUNCE_MESSAGE 49023 9.32 23.95 2.44 23 ANY_BOUNCE_MESSAGE 49023 9.32 23.95 2.44 24 FVGT_m_MULTI_ODD 43605 20.17 21.31 19.64 25 XMSubLong 39141 20.41 19.12 21.02 26 XM_Multi_Part_URI 36869 13.65 18.01 11.60 27 DKIM_VALID_EF 35324 24.02 17.26 27.19 28 XM_Body_Dirty_Words 33428 12.37 16.33 10.51 29 T_TM2_M_HEADER_IN_MSG 30116 26.21 14.71 31.61 30 T_KAM_HTML_FONT_INVALID 28481 14.83 13.92 15.26 31 RELAYCOUNTRY_META 26626 7.64 13.01 5.12 32 XM_Evil_Numbers_Gen 24736 9.68 12.09 8.55 33 MultiRelay 24127 16.49 11.79 18.70 34 HTML_IMAGE_RATIO_02 23403 8.51 11.43 7.14 35 BOTNET_IPINHOSTNAME 21025 6.58 10.27 4.85 36 XMSexyCombo_05 19273 5.08 9.42 3.04 37 FSL_BULK_SIG 18880 7.27 9.22 6.36 38 XM_UncommonTLD01 16103 4.86 7.87 3.44 39 UNTRUSTED_Relay 15295 3.26 7.47 1.28 40 TooManyTo_001 14927 8.27 7.29 8.72 41 XMSubMetaSx_00 14457 4.59 7.06 3.42 42 T_XMDrugObfuBody_14 13960 7.56 6.82 7.90 43 HTML_IMAGE_RATIO_04 13812 4.98 6.75 4.15 44 DATE_IN_PAST_03_06 13206 2.14 6.45 0.11 45 DKIM_INVALID 12548 5.34 6.13 4.97 46 LotsOfNums_01 12395 7.58 6.06 8.30 47 XM_B_Phish_Phrases 12263 5.79 5.99 5.70 48 MPART_ALT_DIFF 11983 3.79 5.85 2.82 49 HTML_IMAGE_RATIO_06 11241 3.93 5.49 3.20 50 XM_H_Long_From01 10432 5.71 5.10 6.00 51 BAYES_80 10219 4.14 4.99 3.73 52 FROM_EXCESS_BASE64 8801 3.65 4.30 3.34 53 BAYES_60 8522 5.92 4.16 6.75 54 RCVD_IN_RP_SAFE 7523 8.13 3.68 10.22 55 MIME_HTML_MOSTLY 7476 2.69 3.65 2.24 56 FROM_SUSPICIOUS_NTLD 7345 1.17 3.59 0.03 57 NORDNS_LOW_CONTRAST 6923 1.09 3.38 0.01 58 XM_DIRTYINTL 6610 2.24 3.23 1.77 59 XM_URI_RBL 6511 1.36 3.18 0.50 60 XM_SPF_SoftFail 6409 2.61 3.13 2.36 61 BAYES_95 6390 2.67 3.12 2.45 62 SpammyFromTLD_02 6367 1.18 3.11 0.27 63 XM_UB50 6335 1.51 3.10 0.77 64 HTML_IMAGE_RATIO_08 6182 2.32 3.02 2.00 65 MIME_HTML_ONLY_MULTI 5999 1.88 2.93 1.38 66 XMNumbers 5990 2.95 2.93 2.95 67 TM2_M_URI_OPT_OUT 5957 2.08 2.91 1.69 68 BAYES_40 5914 3.68 2.89 4.06 69 XMStrtUSub 5808 4.25 2.84 4.91 70 T_XMDrugObfuBody_08 5708 1.87 2.79 1.44 71 T_REMOTE_IMAGE 5596 3.56 2.73 3.96 72 XMSexyCombo_01 5484 1.12 2.68 0.38 73 URI_HEX 5478 1.84 2.68 1.45 74 XM_SendGrid 5446 4.74 2.66 5.71 75 RELAYCOUNTRY_CA 5415 1.84 2.65 1.46 76 XM_CamelCaseFrm001 5388 2.04 2.63 1.77 77 XMPhish14 5162 1.10 2.52 0.43 78 XMBdyGiftCard01 5120 1.30 2.50 0.74 79 XMStockSpam_06 4847 1.35 2.37 0.87 80 RCVD_IN_RP_CERTIFIED 4720 6.82 2.31 8.95 81 T_TooManySym_01 4617 4.25 2.26 5.18 82 RCVD_IN_MSPIKE_H2 4420 3.72 2.16 4.45 83 MultiRelay_CC 4332 0.80 2.12 0.19 84 MultiRelay_Combo 4332 0.80 2.12 0.19 85 DKIM_ADSP_NXDOMAIN 4292 1.09 2.10 0.62 86 MIME_QP_LONG_LINE 4271 4.63 2.09 5.83 87 BAYES_20 4075 2.72 1.99 3.06 88 SUBJ_ALL_CAPS 4032 1.95 1.97 1.94 89 TVD_PH_BODY_ACCOUNTS_PRE 3881 0.68 1.90 0.11 90 RELAYCOUNTRY_DE 3814 0.92 1.86 0.48 91 XM_OfRef6 3715 1.64 1.82 1.56 92 XM_RXBody 3715 0.84 1.82 0.39 93 HTML_MIME_NO_HTML_TAG 3691 3.94 1.80 4.95 94 TR_Mismatch_TLD_02 3632 0.62 1.77 0.07 95 NO_DNS_FOR_FROM 3583 1.31 1.75 1.10 96 XM_H_Long_From02 3564 1.15 1.74 0.86 97 XMDiploma_00 3556 1.66 1.74 1.63 98 NUMERIC_HTTP_ADDR 3355 0.74 1.64 0.31 99 T_XMDrugObfuBody_00 3338 1.00 1.63 0.70 100 RCVD_IN_BL_SPAMCOP_NET 3299 0.70 1.61 0.28 101 XMPhish11 3293 1.32 1.61 1.18 102 LongTLD 3273 0.60 1.60 0.14 103 XM_UB99 3202 0.51 1.56 0.01 104 XMSexyCombo_04 3121 0.55 1.52 0.09 105 XMSubMetaI_00 3085 1.00 1.51 0.76 106 XM_H_TOP 3043 0.48 1.49 0.00 107 SpammyFromTLD_01 3030 1.02 1.48 0.80 108 TR_M_TOP_BAYES 2992 0.47 1.46 0.00 109 NORMAL_HTTP_TO_IP 2951 0.51 1.44 0.07 110 HTML_IMAGE_ONLY_28 2919 0.74 1.43 0.41 111 TR_Symld_Words 2837 1.50 1.39 1.55 112 UNPARSEABLE_RELAY 2772 2.36 1.35 2.83 113 BOTNET_NORDNS 2769 0.45 1.35 0.02 114 XM_GoogleGroups 2664 1.26 1.30 1.24 115 TM2_M_VERY_LONG_WORD 2628 0.99 1.28 0.86 116 XM_UB60 2619 0.46 1.28 0.07 117 XM_ProductURIs 2592 0.84 1.27 0.64 118 XM_UB999 2516 0.40 1.23 0.01 119 TR_XM_RelayPhish 2469 0.80 1.21 0.61 120 MAILING_LIST_MULTI 2439 1.92 1.19 2.26 121 RELAYCOUNTRY_FR 2402 0.51 1.17 0.20 122 XM_salutation2 2399 0.87 1.17 0.72 123 XMBody_17 2360 0.82 1.15 0.67 124 RCVD_IN_IADB_LISTED 2320 3.83 1.13 5.10 125 XMGenDplmaNmb 2288 0.99 1.12 0.93 126 T_HTML_TAG_BALANCE_CENTER 2249 0.43 1.10 0.12 127 TR_Caps_n_Bayes_99 2190 0.60 1.07 0.38 128 XM_DKIMWhitelistDomains 2186 8.51 1.07 12.01 129 ALL_TRUSTED 2182 14.18 1.07 20.34 130 XMSubMetaSxObfu_03 2172 0.63 1.06 0.42 131 XMAntiAgingB 2164 0.36 1.06 0.04 132 XM_GoogleGroups2 2147 0.36 1.05 0.04 133 BAYES_05 2077 1.64 1.01 1.93 134 XM_H_PHPOS 2063 1.09 1.01 1.14 135 DATE_IN_PAST_06_12 2008 0.33 0.98 0.03 136 PLING_QUERY 1966 0.59 0.96 0.42 137 RCVD_IN_IADB_SPF 1946 3.38 0.95 4.52 138 XMPhish30 1938 0.55 0.95 0.36 139 RELAYCOUNTRY_CN 1903 0.33 0.93 0.05 140 T_MONEY_PERCENT 1881 0.57 0.92 0.41 141 TR_LOTS_OF_MONEY2 1881 0.57 0.92 0.41 142 RELAYCOUNTRY_AT 1880 0.43 0.92 0.21 143 DIET_1 1828 0.54 0.89 0.37 144 FILL_THIS_FORM 1816 0.55 0.89 0.39 145 TooManyTo_002 1801 2.00 0.88 2.53 146 T_XMHurry_00 1794 0.69 0.88 0.60 147 RCVD_IN_IADB_SENDERID 1774 3.00 0.87 4.00 148 XMHTML_After_End 1749 0.54 0.85 0.39 149 RCVD_IN_IADB_DK 1733 2.97 0.85 3.97 150 URI_TRY_3LD 1721 1.18 0.84 1.33 151 URI_NOVOWEL 1710 0.60 0.84 0.48 152 RELAYCOUNTRY_GB 1693 0.99 0.83 1.07 153 T_TooManySym_02 1666 1.49 0.81 1.80 154 FSL_THIS_IS_ADV 1656 0.29 0.81 0.05 155 XMManySubDom_06 1646 0.43 0.80 0.25 156 XMBody_78 1642 0.56 0.80 0.44 157 URIBL_BLACK 1629 0.29 0.80 0.05 158 FILL_THIS_FORM_LONG 1614 0.46 0.79 0.30 159 AMAZON_IMG_NOT_RCVD_AMZN 1600 0.28 0.78 0.04 160 HELO_NODOT 1597 1.40 0.78 1.69 161 HELO_NO_DOMAIN 1584 1.40 0.77 1.69 162 TooManyTo_003 1562 1.42 0.76 1.73 163 XMBrknScrpt_02 1510 0.66 0.74 0.62 164 XMGppyBdWords 1499 0.32 0.73 0.12 165 BAYES_00 1498 7.98 0.73 11.39 166 RELAYCOUNTRY_IN 1480 0.31 0.72 0.11 167 RCVD_IN_IADB_VOUCHED 1429 2.48 0.70 3.32 168 XM_B_REG_HTML 1423 0.55 0.70 0.48 169 HTML_FONT_FACE_BAD 1415 0.54 0.69 0.46 170 T_FILL_THIS_FORM_SHORT 1391 0.91 0.68 1.02 171 XMSubMetaSSx_00 1391 0.35 0.68 0.19 172 TR_MetaPhish_Combo_01 1379 1.24 0.67 1.51 173 XMHTMLBadTable_001 1374 0.49 0.67 0.41 174 XM_HighProb1 1368 0.22 0.67 0.01 175 XM_UB80 1367 0.23 0.67 0.03 176 FILL_THIS_FORM_LOAN 1362 0.41 0.67 0.29 177 TooManyTo_004 1338 1.08 0.65 1.28 178 HTML_FONT_SIZE_LARGE 1302 0.32 0.64 0.17 179 XM_DK_Undo_01 1296 1.45 0.63 1.84 180 SPOOF_COM2OTH 1290 0.23 0.63 0.04 181 TVD_SPACE_RATIO_MINFP 1286 0.21 0.63 0.01 182 SPOOF_COM2COM 1266 0.23 0.62 0.05 183 LONG_JUNK_URI 1265 0.24 0.62 0.07 184 HOSTED_IMG_DIRECT_MX 1226 0.19 0.60 0.00 185 TooManyTo_005 1209 0.91 0.59 1.06 186 XM_H_PHPMailer 1198 0.61 0.59 0.62 187 XM_PDF 1149 3.78 0.56 5.29 188 RELAYCOUNTRY_AU 1102 0.47 0.54 0.44 189 HTML_IMAGE_ONLY_20 1101 0.40 0.54 0.34 190 DKIM_ADSP_CUSTOM_MED 1068 0.95 0.52 1.16 191 XMDateMe_00 1067 0.45 0.52 0.41 192 GAPPY_SUBJECT 1058 0.35 0.52 0.27 193 RDNS_DYNAMIC 1051 0.48 0.51 0.47 194 XMSubGiftCard1 1037 0.20 0.51 0.06 195 XM_OfRef7 1030 0.33 0.50 0.25 196 XMClaimOffer 1010 0.21 0.49 0.08 197 XM_ShortIntro_01 1007 0.61 0.49 0.67 198 THIS_AD 1006 0.34 0.49 0.27 199 SUBJ_DOLLARS 1003 0.40 0.49 0.36 200 HK_SCAM 998 0.17 0.49 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 379137 83.13 74.68 87.10 2 DKIM_SIGNED 307383 68.91 65.30 70.62 3 XM_DK_Pass 301706 67.10 62.38 69.31 4 DKIM_VALID 285749 63.57 59.16 65.65 5 DCC_CHECK_NEGATIVE 274824 54.89 37.35 63.14 6 BAYES_50 229523 49.80 43.57 52.73 7 DKIM_VALID_AU 206637 47.98 49.08 47.47 8 XMListUnsubscribeExists 196032 49.11 57.79 45.03 9 XM_H_QuotedFrom 172497 39.41 38.94 39.63 10 DCC_CHECK 151327 43.30 61.44 34.76 11 T_TM2_M_HEADER_IN_MSG 137607 26.21 14.71 31.61 12 DKIM_VALID_EF 118367 24.02 17.26 27.19 13 HTML_FONT_LOW_CONTRAST 108335 27.75 33.83 24.89 14 XMSubLong 91479 20.41 19.12 21.02 15 MIME_HTML_ONLY 89493 22.22 25.74 20.56 16 LOC_TINY_FONT_1 88607 23.00 28.61 20.36 17 ALL_TRUSTED 88553 14.18 1.07 20.34 18 FVGT_m_MULTI_ODD 85491 20.17 21.31 19.64 19 MultiRelay 81397 16.49 11.79 18.70 20 T_KAM_HTML_FONT_INVALID 66415 14.83 13.92 15.26 21 XM_DK_Undo_02 64420 22.99 40.40 14.80 22 BAYES_99 58951 21.14 37.30 13.54 23 BAYES_999 52272 18.53 32.40 12.01 24 XM_DKIMWhitelistDomains 52257 8.51 1.07 12.01 25 XM_Multi_Part_URI 50490 13.65 18.01 11.60 26 BAYES_00 49578 7.98 0.73 11.39 27 XM_Body_Dirty_Words 45760 12.37 16.33 10.51 28 RCVD_IN_RP_SAFE 44478 8.13 3.68 10.22 29 RCVD_IN_RP_CERTIFIED 38943 6.82 2.31 8.95 30 TooManyTo_001 37975 8.27 7.29 8.72 31 XM_Evil_Numbers_Gen 37214 9.68 12.09 8.55 32 TR_XM_DK_Bayes 36562 5.84 0.39 8.40 33 LotsOfNums_01 36143 7.58 6.06 8.30 34 TR_XM_DK_Bayes1 34475 5.50 0.35 7.92 35 T_XMDrugObfuBody_14 34407 7.56 6.82 7.90 36 LOTS_OF_MONEY 33553 15.17 31.03 7.71 37 HTML_IMAGE_RATIO_02 31072 8.51 11.43 7.14 38 TR_DCC_Bayes_99 29690 14.42 30.58 6.82 39 BAYES_60 29385 5.92 4.16 6.75 40 TR_XM_DK_Bayes2 29079 4.63 0.27 6.68 41 FSL_BULK_SIG 27667 7.27 9.22 6.36 42 XM_H_Long_From01 26125 5.71 5.10 6.00 43 MIME_QP_LONG_LINE 25359 4.63 2.09 5.83 44 XM_SendGrid 24856 4.74 2.66 5.71 45 XM_B_Phish_Phrases 24798 5.79 5.99 5.70 46 XM_PDF 23030 3.78 0.56 5.29 47 T_TooManySym_01 22552 4.25 2.26 5.18 48 RELAYCOUNTRY_META 22278 7.64 13.01 5.12 49 RCVD_IN_IADB_LISTED 22210 3.83 1.13 5.10 50 DKIM_INVALID 21634 5.34 6.13 4.97 51 HTML_MIME_NO_HTML_TAG 21552 3.94 1.80 4.95 52 XMStrtUSub 21392 4.25 2.84 4.91 53 BOTNET_IPINHOSTNAME 21108 6.58 10.27 4.85 54 RCVD_IN_IADB_SPF 19696 3.38 0.95 4.52 55 RCVD_IN_MSPIKE_H2 19355 3.72 2.16 4.45 56 HTML_IMAGE_RATIO_04 18046 4.98 6.75 4.15 57 BAYES_40 17656 3.68 2.89 4.06 58 IN_ZIMBRA_NJ_WHITELIST 17655 2.76 0.01 4.06 59 RCVD_IN_IADB_SENDERID 17431 3.00 0.87 4.00 60 RCVD_IN_IADB_DK 17279 2.97 0.85 3.97 61 T_REMOTE_IMAGE 17218 3.56 2.73 3.96 62 BAYES_80 16250 4.14 4.99 3.73 63 XM_UncommonTLD01 14983 4.86 7.87 3.44 64 XMSubMetaSx_00 14892 4.59 7.06 3.42 65 FROM_EXCESS_BASE64 14535 3.65 4.30 3.34 66 RCVD_IN_IADB_VOUCHED 14438 2.48 0.70 3.32 67 HTML_IMAGE_RATIO_06 13913 3.93 5.49 3.20 68 BAYES_20 13314 2.72 1.99 3.06 69 XMSexyCombo_05 13214 5.08 9.42 3.04 70 XMNumbers 12857 2.95 2.93 2.95 71 UNPARSEABLE_RELAY 12327 2.36 1.35 2.83 72 MPART_ALT_DIFF 12279 3.79 5.85 2.82 73 TO_MALFORMED 12172 1.91 0.02 2.80 74 TVD_RCVD_IP 12000 1.92 0.15 2.76 75 TooManyTo_002 11028 2.00 0.88 2.53 76 BAYES_95 10682 2.67 3.12 2.45 77 ANY_BOUNCE_MESSAGE 10626 9.32 23.95 2.44 78 BOUNCE_MESSAGE 10623 9.32 23.95 2.44 79 XM_SPF_SoftFail 10277 2.61 3.13 2.36 80 HTML_FONT_SIZE_HUGE 10276 1.65 0.14 2.36 81 HTTP_ESCAPED_HOST 10175 1.61 0.06 2.34 82 MAILING_LIST_MULTI 9832 1.92 1.19 2.26 83 MIME_HTML_MOSTLY 9753 2.69 3.65 2.24 84 RCVD_IN_MSPIKE_H3 8853 1.47 0.28 2.03 85 RCVD_IN_MSPIKE_WL 8853 1.47 0.28 2.03 86 HTML_IMAGE_RATIO_08 8685 2.32 3.02 2.00 87 RCVD_IN_IADB_OPTIN 8632 1.50 0.46 1.98 88 BOTNET 8479 12.62 35.32 1.95 89 SUBJ_ALL_CAPS 8441 1.95 1.97 1.94 90 BAYES_05 8406 1.64 1.01 1.93 91 XM_DK_Undo_01 7992 1.45 0.63 1.84 92 T_TooManySym_02 7852 1.49 0.81 1.80 93 IN_HORDE_ADDRESS_BOOK 7829 1.23 0.03 1.80 94 XM_DIRTYINTL 7696 2.24 3.23 1.77 95 XM_CamelCaseFrm001 7693 2.04 2.63 1.77 96 TooManyTo_003 7514 1.42 0.76 1.73 97 TM2_M_URI_OPT_OUT 7375 2.08 2.91 1.69 98 HELO_NODOT 7367 1.40 0.78 1.69 99 HELO_NO_DOMAIN 7366 1.40 0.77 1.69 100 INVALID_MSGID 7122 1.19 0.24 1.64 101 XMCapTrack 7120 1.20 0.27 1.64 102 XMDiploma_00 7099 1.66 1.74 1.63 103 XM_OfRef6 6799 1.64 1.82 1.56 104 TR_Symld_Words 6766 1.50 1.39 1.55 105 TR_MetaPhish_Combo_01 6568 1.24 0.67 1.51 106 RELAYCOUNTRY_CA 6353 1.84 2.65 1.46 107 URI_HEX 6311 1.84 2.68 1.45 108 T_XMDrugObfuBody_08 6269 1.87 2.79 1.44 109 USER_IN_DEF_DKIM_WL 6103 0.96 0.01 1.40 110 MIME_HTML_ONLY_MULTI 6026 1.88 2.93 1.38 111 URI_TRY_3LD 5810 1.18 0.84 1.33 112 UNTRUSTED_Relay 5585 3.26 7.47 1.28 113 TooManyTo_004 5569 1.08 0.65 1.28 114 XM_GoogleGroups 5409 1.26 1.30 1.24 115 XMPhish11 5139 1.32 1.61 1.18 116 DKIM_ADSP_CUSTOM_MED 5041 0.95 0.52 1.16 117 XM_H_PHPOS 4942 1.09 1.01 1.14 118 NO_DNS_FOR_FROM 4778 1.31 1.75 1.10 119 RELAYCOUNTRY_GB 4653 0.99 0.83 1.07 120 TooManyTo_005 4627 0.91 0.59 1.06 121 T_FILL_THIS_FORM_SHORT 4437 0.91 0.68 1.02 122 XMGenDplmaNmb 4065 0.99 1.12 0.93 123 XMStockSpam_06 3803 1.35 2.37 0.87 124 XM_H_Long_From02 3764 1.15 1.74 0.86 125 TM2_M_VERY_LONG_WORD 3736 0.99 1.28 0.86 126 SpammyFromTLD_01 3484 1.02 1.48 0.80 127 T_OBFU_PDF_ATTACH 3423 0.57 0.13 0.79 128 NML_ADSP_CUSTOM_MED 3420 0.69 0.47 0.79 129 XM_UB50 3349 1.51 3.10 0.77 130 XMSubMetaI_00 3317 1.00 1.51 0.76 131 XMBody_95 3287 0.53 0.04 0.76 132 XMBdyGiftCard01 3223 1.30 2.50 0.74 133 XM_salutation2 3137 0.87 1.17 0.72 134 T_XMDrugObfuBody_00 3041 1.00 1.63 0.70 135 XMMoneyMeta_00 2998 0.62 0.47 0.69 136 XMBody_17 2896 0.82 1.15 0.67 137 XM_ShortIntro_01 2895 0.61 0.49 0.67 138 XM_ProductURIs 2805 0.84 1.27 0.64 139 XM_H_Undi_Recip 2765 0.53 0.29 0.64 140 XMLngstWrd_00 2744 0.50 0.23 0.63 141 XMBrknScrpt_02 2690 0.66 0.74 0.62 142 XM_H_PHPMailer 2688 0.61 0.59 0.62 143 DKIM_ADSP_NXDOMAIN 2683 1.09 2.10 0.62 144 TR_XM_RelayPhish 2656 0.80 1.21 0.61 145 XMNoVowels 2649 0.50 0.28 0.61 146 AC_DIV_BONANZA 2628 0.43 0.07 0.60 147 USER_IN_WHITELIST 2627 0.41 0.00 0.60 148 T_XMHurry_00 2603 0.69 0.88 0.60 149 T_TooManySym_03 2596 0.44 0.11 0.60 150 XMLngstWrd_01 2548 0.47 0.21 0.59 151 FORGED_GMAIL_RCVD 2543 0.53 0.43 0.58 152 HTTPS_HTTP_MISMATCH 2473 0.52 0.41 0.57 153 HTML_TAG_BALANCE_BODY 2366 0.51 0.45 0.54 154 XM_B_COPY_HTML 2343 0.51 0.44 0.54 155 XMGappySubj_01 2216 0.41 0.19 0.51 156 T_Symld_Words_02 2208 0.48 0.44 0.51 157 MISSING_HEADERS 2206 0.47 0.38 0.51 158 XM_URI_RBL 2198 1.36 3.18 0.50 159 XMSubMetaSxObfu_02 2166 0.40 0.19 0.50 160 XM_B_REG_HTML 2109 0.55 0.70 0.48 161 URI_NOVOWEL 2103 0.60 0.84 0.48 162 RELAYCOUNTRY_DE 2089 0.92 1.86 0.48 163 TM2_M_A_HREF_HREF 2058 0.46 0.42 0.47 164 FROM_GOV_SPOOF 2052 0.35 0.09 0.47 165 RDNS_DYNAMIC 2030 0.48 0.51 0.47 166 HTML_FONT_FACE_BAD 2020 0.54 0.69 0.46 167 SHORT_HELO_AND_INLINE_IMAGE 1940 0.34 0.11 0.45 168 TM2_M_BODY_EMPTY 1928 0.33 0.09 0.44 169 XMBody_78 1913 0.56 0.80 0.44 170 RELAYCOUNTRY_AU 1912 0.47 0.54 0.44 171 HTML_IMAGE_ONLY_32 1903 0.35 0.16 0.44 172 XMPhish14 1888 1.10 2.52 0.43 173 XMSubMetaSxObfu_03 1834 0.63 1.06 0.42 174 PLING_QUERY 1825 0.59 0.96 0.42 175 XMDateMe_00 1803 0.45 0.52 0.41 176 HTML_IMAGE_ONLY_28 1793 0.74 1.43 0.41 177 XMSolicitRefs_0 1791 0.40 0.38 0.41 178 TR_LOTS_OF_MONEY2 1787 0.57 0.92 0.41 179 T_MONEY_PERCENT 1787 0.57 0.92 0.41 180 XMHTMLBadTable_001 1785 0.49 0.67 0.41 181 REMOVE_BEFORE_LINK 1765 0.38 0.31 0.41 182 FILL_THIS_FORM 1719 0.55 0.89 0.39 183 RCVD_IN_SORBS_DUL 1718 0.36 0.29 0.39 184 XMHTML_After_End 1710 0.54 0.85 0.39 185 HTML_IMAGE_ONLY_24 1688 0.35 0.28 0.39 186 XM_RXBody 1683 0.84 1.82 0.39 187 XMSexyCombo_01 1669 1.12 2.68 0.38 188 TR_Caps_n_Bayes_99 1663 0.60 1.07 0.38 189 FROM_GOV_DKIM_AU 1657 0.29 0.10 0.38 190 DIET_1 1599 0.54 0.89 0.37 191 SUBJ_DOLLARS 1573 0.40 0.49 0.36 192 XMPhish30 1561 0.55 0.95 0.36 193 XM_H_PHPOS_M 1504 0.35 0.36 0.35 194 HTML_IMAGE_ONLY_20 1462 0.40 0.54 0.34 195 BASE64_LENGTH_79_INF 1460 0.29 0.19 0.34 196 XMSlimDrugH 1452 0.34 0.36 0.33 197 XMSubNoVowel 1438 0.38 0.48 0.33 198 TVD_SPACE_RATIO 1429 0.30 0.23 0.33 199 XMRcvdHeader_15 1425 0.22 0.00 0.33 200 XMLKML 1412 0.22 0.00 0.32 ----------------------------------------------------------------------