Email: 322456 Autolearn: 0 AvgScore: 1.97 AvgScanTime: 2.01 sec Spam: 91037 Autolearn: 0 AvgScore: 12.69 AvgScanTime: 2.39 sec Ham: 231419 Autolearn: 0 AvgScore: -2.24 AvgScanTime: 1.85 sec Time Spent Running SA: 179.60 hours Time Spent Processing Spam: 60.37 hours Time Spent Processing Ham: 119.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84079 86.83 92.36 84.65 2 DKIM_SIGNED 74170 80.23 81.47 79.74 3 XM_DK_Pass 72849 79.01 80.02 78.61 4 DCC_CHECK 71723 57.24 78.78 48.76 5 XMListUnsubscribeExists 70816 62.88 77.79 57.01 6 DKIM_VALID 69272 75.61 76.09 75.43 7 DKIM_VALID_AU 58288 62.30 64.03 61.62 8 XM_H_QuotedFrom 50841 45.23 55.85 41.05 9 XM_DK_Undo_02 43179 27.90 47.43 20.21 10 BAYES_99 38401 25.26 42.18 18.60 11 HTML_FONT_LOW_CONTRAST 34355 35.89 37.74 35.17 12 BAYES_999 32655 22.26 35.87 16.91 13 BAYES_50 32068 43.53 35.23 46.80 14 MIME_HTML_ONLY 31640 25.64 34.76 22.05 15 LOC_TINY_FONT_1 31409 30.83 34.50 29.39 16 TR_DCC_Bayes_99 31341 16.85 34.43 9.94 17 FVGT_m_MULTI_ODD 23143 21.44 25.42 19.88 18 RELAYCOUNTRY_META 22433 10.08 24.64 4.35 19 XMSubLong 22342 24.01 24.54 23.80 20 DKIM_VALID_EF 18120 27.98 19.90 31.16 21 BOTNET 18053 7.21 19.83 2.24 22 DCC_CHECK_NEGATIVE 18041 41.61 19.82 50.18 23 XM_Body_Dirty_Words 17688 14.40 19.43 12.42 24 HTML_IMAGE_RATIO_02 17146 13.75 18.83 11.75 25 T_KAM_HTML_FONT_INVALID 15659 15.47 17.20 14.78 26 BOTNET_IPINHOSTNAME 15296 10.82 16.80 8.46 27 XM_Multi_Part_URI 15046 16.06 16.53 15.88 28 T_TM2_M_HEADER_IN_MSG 14877 21.54 16.34 23.58 29 UNTRUSTED_Relay 13925 5.26 15.30 1.31 30 MultiRelay 12577 14.86 13.82 15.27 31 XMSexyCombo_05 11535 7.19 12.67 5.03 32 XM_Evil_Numbers_Gen 11356 10.72 12.47 10.03 33 LOTS_OF_MONEY 11267 8.68 12.38 7.22 34 FSL_BULK_SIG 10127 8.73 11.12 7.79 35 XM_UncommonTLD01 9238 6.56 10.15 5.14 36 XM_salutation2 9077 4.99 9.97 3.03 37 XM_UB50 8935 3.28 9.81 0.71 38 XMSubMetaSx_00 8927 6.87 9.81 5.71 39 MPART_ALT_DIFF 8398 5.45 9.22 3.97 40 HTML_IMAGE_RATIO_04 7478 7.34 8.21 6.99 41 XM_H_Long_From01 7471 6.89 8.21 6.38 42 XM_B_Phish_Phrases 7103 7.01 7.80 6.70 43 T_XMDrugObfuBody_14 6951 7.51 7.64 7.46 44 TooManyTo_001 6630 6.56 7.28 6.28 45 FROM_EXCESS_BASE64 6012 5.96 6.60 5.71 46 HTML_IMAGE_RATIO_06 5745 4.39 6.31 3.64 47 BAYES_80 5641 4.54 6.20 3.89 48 LotsOfNums_01 5605 7.90 6.16 8.58 49 RELAYCOUNTRY_FR 5443 1.80 5.98 0.16 50 BAYES_60 4968 5.78 5.46 5.91 51 RCVD_IN_RP_SAFE 4946 13.39 5.43 16.52 52 DKIM_INVALID 4898 4.62 5.38 4.32 53 HTML_MIME_NO_HTML_TAG 4847 2.35 5.32 1.18 54 MIME_HTML_MOSTLY 4725 3.63 5.19 3.01 55 XMStrtUSub 4620 5.49 5.07 5.65 56 DKIM_ADSP_NXDOMAIN 4483 1.78 4.92 0.54 57 XM_DIRTYINTL 4256 2.58 4.68 1.76 58 RELAYCOUNTRY_CA 4168 2.48 4.58 1.66 59 RCVD_IN_RP_CERTIFIED 4056 12.07 4.46 15.06 60 MIME_HTML_ONLY_MULTI 3939 2.50 4.33 1.78 61 XMBdyGiftCard01 3762 2.83 4.13 2.32 62 BAYES_95 3696 3.16 4.06 2.81 63 INVALID_MSGID 3688 3.40 4.05 3.15 64 RCVD_IN_RP_RNBL 3341 1.05 3.67 0.03 65 RELAYCOUNTRY_GB 3004 1.26 3.30 0.45 66 XM_SPF_SoftFail 2977 2.40 3.27 2.06 67 XMNumbers 2788 3.41 3.06 3.55 68 XM_CamelCaseFrm001 2745 2.04 3.02 1.66 69 XM_OfRef6 2673 1.79 2.94 1.34 70 URI_HEX 2667 2.13 2.93 1.82 71 MIME_QP_LONG_LINE 2650 3.98 2.91 4.39 72 SpammyFromTLD_02 2637 0.98 2.90 0.23 73 TM2_M_URI_OPT_OUT 2621 2.20 2.88 1.94 74 XM_SendGrid 2585 5.53 2.84 6.59 75 MONEY_FRAUD_8 2569 0.80 2.82 0.00 76 XMSubMetaSxObfu_03 2502 1.05 2.75 0.38 77 XMBody_17 2476 1.29 2.72 0.73 78 HTML_IMAGE_RATIO_08 2407 2.15 2.64 1.96 79 BAYES_40 2380 3.38 2.61 3.68 80 TR_Mismatch_TLD_02 2363 0.78 2.60 0.07 81 T_XMDrugObfuBody_08 2351 1.64 2.58 1.27 82 SUBJ_ALL_CAPS 2300 1.81 2.53 1.53 83 DIET_1 2225 1.12 2.44 0.60 84 XMSubMetaI_00 2216 1.50 2.43 1.14 85 T_XMDrugObfuBody_00 2202 1.25 2.42 0.78 86 ADVANCE_FEE_5_NEW_MONEY 2186 0.68 2.40 0.00 87 BAYES_20 2159 2.61 2.37 2.71 88 T_TooManySym_01 2156 5.99 2.37 7.41 89 RCVD_IN_MSPIKE_H2 2153 4.17 2.36 4.87 90 MultiRelay_Combo 2145 0.75 2.36 0.11 91 MultiRelay_CC 2145 0.75 2.36 0.11 92 FROM_SUSPICIOUS_NTLD 2120 0.68 2.33 0.03 93 LongTLD 2003 0.75 2.20 0.19 94 MISSING_HEADERS 1983 0.77 2.18 0.22 95 XMStockSpam_06 1965 1.26 2.16 0.91 96 T_REMOTE_IMAGE 1961 2.56 2.15 2.72 97 RCVD_IN_BL_SPAMCOP_NET 1920 0.67 2.11 0.10 98 NO_DNS_FOR_FROM 1897 1.66 2.08 1.50 99 REPLYTO_WITHOUT_TO_CC 1880 0.61 2.07 0.04 100 RCVD_IN_PSBL 1832 0.60 2.01 0.04 101 FILL_THIS_FORM 1800 0.98 1.98 0.59 102 XM_B_REG_HTML 1753 1.02 1.93 0.67 103 XM_UB99 1753 0.58 1.93 0.05 104 XM_URI_RBL 1746 1.07 1.92 0.74 105 BOTNET_NORDNS 1742 0.55 1.91 0.01 106 FILL_THIS_FORM_LONG 1719 0.91 1.89 0.52 107 XMClaimOffer 1714 0.79 1.88 0.37 108 TR_LOTS_OF_MONEY1 1692 0.53 1.86 0.01 109 XM_ProductURIs 1599 1.57 1.76 1.49 110 RELAYCOUNTRY_DE 1523 0.73 1.67 0.36 111 XM_UB60 1521 0.52 1.67 0.07 112 MAILING_LIST_MULTI 1472 1.94 1.62 2.07 113 ALL_TRUSTED 1469 11.05 1.61 14.77 114 XM_UB999 1457 0.48 1.60 0.04 115 XMSexyCombo_01 1440 1.17 1.58 1.01 116 BOMB_MONEY 1438 0.45 1.58 0.00 117 XMDiploma_00 1438 1.38 1.58 1.30 118 SpammyFromTLD_01 1420 0.69 1.56 0.34 119 XM_H_PHPOS 1391 1.21 1.53 1.08 120 DKIM_ADSP_CUSTOM_MED 1390 1.13 1.53 0.97 121 RCVD_IN_IADB_LISTED 1379 3.02 1.51 3.61 122 NML_ADSP_CUSTOM_MED 1328 0.87 1.46 0.63 123 UNPARSEABLE_RELAY 1326 4.79 1.46 6.10 124 XMMoneyMeta_00 1312 0.61 1.44 0.29 125 FILL_THIS_FORM_LOAN 1291 0.75 1.42 0.49 126 TM2_M_VERY_LONG_WORD 1256 1.07 1.38 0.95 127 XMPhish11 1243 1.17 1.37 1.09 128 FORGED_GMAIL_RCVD 1226 0.69 1.35 0.44 129 DATE_IN_PAST_06_12 1220 0.40 1.34 0.03 130 XMPhish30 1187 0.79 1.30 0.58 131 XM_RXBody 1181 0.72 1.30 0.49 132 NUMERIC_HTTP_ADDR 1181 0.61 1.30 0.34 133 RCVD_IN_IADB_SPF 1179 2.69 1.30 3.24 134 T_XMHurry_00 1168 0.90 1.28 0.76 135 XMHTMLBadTable_001 1146 0.82 1.26 0.64 136 SHORT_URI_3 1121 0.49 1.23 0.20 137 URI_TRY_3LD 1107 1.39 1.22 1.45 138 T_MONEY_PERCENT 1102 0.67 1.21 0.46 139 TR_LOTS_OF_MONEY2 1102 0.67 1.21 0.46 140 RCVD_IN_IADB_SENDERID 1063 2.44 1.17 2.95 141 DATE_IN_PAST_03_06 1060 0.41 1.16 0.12 142 XM_H_Long_From02 1059 1.00 1.16 0.94 143 RCVD_IN_IADB_DK 1036 2.40 1.14 2.89 144 RELAYCOUNTRY_IN 1021 0.36 1.12 0.06 145 LONG_JUNK_URI 1003 0.37 1.10 0.08 146 DEAR_BENEFICIARY 987 0.31 1.08 0.00 147 URIBL_BLACK 985 0.36 1.08 0.07 148 NORMAL_HTTP_TO_IP 978 0.34 1.07 0.06 149 MIME_HEADER_CTYPE_ONLY 944 0.43 1.04 0.19 150 XM_H_PHPMailer 900 0.87 0.99 0.82 151 TR_Symld_Words 892 1.13 0.98 1.19 152 MPART_ALT_DIFF_COUNT 884 0.45 0.97 0.24 153 T_Symld_Words_02 882 0.47 0.97 0.28 154 RELAYCOUNTRY_CN 879 0.30 0.97 0.04 155 XMGenDplmaNmb 875 0.86 0.96 0.82 156 XMBody_78 870 0.69 0.96 0.58 157 T_HTML_TAG_BALANCE_CENTER 864 0.38 0.95 0.16 158 XMHTML_After_End 863 0.50 0.95 0.32 159 RELAYCOUNTRY_AT 850 0.43 0.93 0.23 160 SUBJ_DOLLARS 842 0.60 0.92 0.47 161 XMSubMetaI_01 841 0.41 0.92 0.21 162 XMSubMetaD_03 839 0.41 0.92 0.21 163 BAYES_05 808 1.46 0.89 1.69 164 XMSubMetaSSx_00 805 0.36 0.88 0.15 165 XM_Nigeria_01 800 0.28 0.88 0.05 166 TR_XM_RelayPhish 789 0.56 0.87 0.44 167 RCVD_IN_IADB_VOUCHED 787 1.64 0.86 1.95 168 XM_B_COPY_HTML 777 0.72 0.85 0.67 169 XM_UB80 756 0.26 0.83 0.03 170 TR_Caps_n_Bayes_99 746 0.30 0.82 0.10 171 TVD_APPROVED 742 0.26 0.82 0.04 172 BODY_ENHANCEMENT 741 0.24 0.81 0.02 173 XMSlimDrugH 734 0.45 0.81 0.31 174 THIS_AD 730 1.00 0.80 1.08 175 XM_OfRef7 724 0.39 0.80 0.23 176 BAYES_00 714 9.96 0.78 13.57 177 XM_DK_Undo_01 685 1.36 0.75 1.60 178 XM_Nigeria_02 670 0.21 0.74 0.00 179 XM_H_PHPOS_M 658 0.56 0.72 0.50 180 HTML_TAG_BALANCE_BODY 656 0.56 0.72 0.49 181 HK_RANDOM_REPLYTO 650 0.38 0.71 0.25 182 URIBL_DBL_SPAM 648 0.21 0.71 0.01 183 RELAYCOUNTRY_CL 639 0.20 0.70 0.00 184 XMBrknScrpt_02 625 0.82 0.69 0.87 185 T_TooManySym_02 624 2.05 0.69 2.59 186 HTML_IMAGE_ONLY_12 624 0.32 0.69 0.18 187 RDNS_DYNAMIC 618 0.60 0.68 0.57 188 HK_SCAM 615 0.21 0.68 0.02 189 URI_NOVOWEL 613 0.41 0.67 0.30 190 RCVD_IN_IADB_OPTIN 613 1.07 0.67 1.23 191 T_FILL_THIS_FORM_SHORT 608 0.56 0.67 0.51 192 XM_HighProb1 604 0.19 0.66 0.01 193 LONG_JUNK_URI3 586 0.21 0.64 0.04 194 HTML_FONT_FACE_BAD 580 0.56 0.64 0.53 195 XMSolicitRefs_0 578 0.36 0.63 0.25 196 XM_NotFromAmazon 562 0.22 0.62 0.06 197 RELAYCOUNTRY_NL 561 0.35 0.62 0.25 198 MONEY_FORM 553 0.17 0.61 0.00 199 HTML_FONT_SIZE_LARGE 527 0.25 0.58 0.12 200 SHORT_URI_2 520 0.24 0.57 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 195903 86.83 92.36 84.65 2 DKIM_SIGNED 184544 80.23 81.47 79.74 3 XM_DK_Pass 181918 79.01 80.02 78.61 4 DKIM_VALID 174548 75.61 76.09 75.43 5 DKIM_VALID_AU 142590 62.30 64.03 61.62 6 XMListUnsubscribeExists 131932 62.88 77.79 57.01 7 DCC_CHECK_NEGATIVE 116122 41.61 19.82 50.18 8 DCC_CHECK 112848 57.24 78.78 48.76 9 BAYES_50 108299 43.53 35.23 46.80 10 XM_H_QuotedFrom 94991 45.23 55.85 41.05 11 HTML_FONT_LOW_CONTRAST 81390 35.89 37.74 35.17 12 DKIM_VALID_EF 72105 27.98 19.90 31.16 13 LOC_TINY_FONT_1 68007 30.83 34.50 29.39 14 XMSubLong 55073 24.01 24.54 23.80 15 T_TM2_M_HEADER_IN_MSG 54580 21.54 16.34 23.58 16 MIME_HTML_ONLY 51024 25.64 34.76 22.05 17 XM_DK_Undo_02 46772 27.90 47.43 20.21 18 FVGT_m_MULTI_ODD 45999 21.44 25.42 19.88 19 BAYES_99 43037 25.26 42.18 18.60 20 BAYES_999 39135 22.26 35.87 16.91 21 XM_DKIMWhitelistDomains 38220 11.86 0.04 16.52 22 RCVD_IN_RP_SAFE 38219 13.39 5.43 16.52 23 XM_Multi_Part_URI 36751 16.06 16.53 15.88 24 MultiRelay 35328 14.86 13.82 15.27 25 RCVD_IN_RP_CERTIFIED 34853 12.07 4.46 15.06 26 T_KAM_HTML_FONT_INVALID 34215 15.47 17.20 14.78 27 ALL_TRUSTED 34173 11.05 1.61 14.77 28 BAYES_00 31399 9.96 0.78 13.57 29 XM_Body_Dirty_Words 28747 14.40 19.43 12.42 30 HTML_IMAGE_RATIO_02 27188 13.75 18.83 11.75 31 TR_XM_DK_Bayes 26526 8.36 0.46 11.46 32 TR_XM_DK_Bayes1 25390 7.98 0.37 10.97 33 TR_XM_DK_Bayes2 23655 7.43 0.33 10.22 34 XM_Evil_Numbers_Gen 23215 10.72 12.47 10.03 35 TR_DCC_Bayes_99 22994 16.85 34.43 9.94 36 LotsOfNums_01 19862 7.90 6.16 8.58 37 BOTNET_IPINHOSTNAME 19580 10.82 16.80 8.46 38 FSL_BULK_SIG 18035 8.73 11.12 7.79 39 T_XMDrugObfuBody_14 17254 7.51 7.64 7.46 40 T_TooManySym_01 17146 5.99 2.37 7.41 41 LOTS_OF_MONEY 16712 8.68 12.38 7.22 42 HTML_IMAGE_RATIO_04 16182 7.34 8.21 6.99 43 XM_B_Phish_Phrases 15508 7.01 7.80 6.70 44 XM_SendGrid 15244 5.53 2.84 6.59 45 TVD_RCVD_IP 15029 4.80 0.51 6.49 46 XM_H_Long_From01 14761 6.89 8.21 6.38 47 TooManyTo_001 14532 6.56 7.28 6.28 48 UNPARSEABLE_RELAY 14124 4.79 1.46 6.10 49 BAYES_60 13673 5.78 5.46 5.91 50 XMSubMetaSx_00 13215 6.87 9.81 5.71 51 FROM_EXCESS_BASE64 13215 5.96 6.60 5.71 52 XMStrtUSub 13076 5.49 5.07 5.65 53 TO_MALFORMED 12676 3.94 0.04 5.48 54 XM_UncommonTLD01 11902 6.56 10.15 5.14 55 XMSexyCombo_05 11646 7.19 12.67 5.03 56 RCVD_IN_MSPIKE_H2 11280 4.17 2.36 4.87 57 MIME_QP_LONG_LINE 10170 3.98 2.91 4.39 58 RELAYCOUNTRY_META 10076 10.08 24.64 4.35 59 DKIM_INVALID 9996 4.62 5.38 4.32 60 MPART_ALT_DIFF 9177 5.45 9.22 3.97 61 IN_ZIMBRA_NJ_WHITELIST 9101 2.83 0.01 3.93 62 BAYES_80 8995 4.54 6.20 3.89 63 BAYES_40 8521 3.38 2.61 3.68 64 HTML_IMAGE_RATIO_06 8424 4.39 6.31 3.64 65 RCVD_IN_IADB_LISTED 8353 3.02 1.51 3.61 66 XMNumbers 8223 3.41 3.06 3.55 67 RCVD_IN_IADB_SPF 7491 2.69 1.30 3.24 68 INVALID_MSGID 7285 3.40 4.05 3.15 69 RCVD_IN_MSPIKE_WL 7239 2.32 0.28 3.13 70 RCVD_IN_MSPIKE_H3 7239 2.32 0.28 3.13 71 XM_salutation2 7009 4.99 9.97 3.03 72 MIME_HTML_MOSTLY 6977 3.63 5.19 3.01 73 RCVD_IN_IADB_SENDERID 6819 2.44 1.17 2.95 74 RCVD_IN_IADB_DK 6695 2.40 1.14 2.89 75 BAYES_95 6501 3.16 4.06 2.81 76 T_REMOTE_IMAGE 6288 2.56 2.15 2.72 77 BAYES_20 6262 2.61 2.37 2.71 78 TR_MetaPhish_Combo_01 6059 1.99 0.38 2.62 79 T_TooManySym_02 5994 2.05 0.69 2.59 80 XMBdyGiftCard01 5369 2.83 4.13 2.32 81 BOTNET 5194 7.21 19.83 2.24 82 USER_IN_DEF_DKIM_WL 4887 1.55 0.14 2.11 83 IN_HORDE_ADDRESS_BOOK 4829 1.51 0.04 2.09 84 MAILING_LIST_MULTI 4795 1.94 1.62 2.07 85 XM_SPF_SoftFail 4768 2.40 3.27 2.06 86 XM_PDF 4753 1.59 0.41 2.05 87 HTML_IMAGE_RATIO_08 4540 2.15 2.64 1.96 88 RCVD_IN_IADB_VOUCHED 4503 1.64 0.86 1.95 89 TM2_M_URI_OPT_OUT 4481 2.20 2.88 1.94 90 URI_HEX 4217 2.13 2.93 1.82 91 MIME_HTML_ONLY_MULTI 4112 2.50 4.33 1.78 92 XM_DIRTYINTL 4078 2.58 4.68 1.76 93 BAYES_05 3905 1.46 0.89 1.69 94 BOUNCE_MESSAGE 3841 1.24 0.19 1.66 95 ANY_BOUNCE_MESSAGE 3841 1.24 0.19 1.66 96 RELAYCOUNTRY_CA 3840 2.48 4.58 1.66 97 XM_CamelCaseFrm001 3832 2.04 3.02 1.66 98 XM_DK_Undo_01 3697 1.36 0.75 1.60 99 SUBJ_ALL_CAPS 3536 1.81 2.53 1.53 100 NO_DNS_FOR_FROM 3471 1.66 2.08 1.50 101 XM_ProductURIs 3453 1.57 1.76 1.49 102 URI_TRY_3LD 3364 1.39 1.22 1.45 103 TooManyTo_002 3300 1.18 0.55 1.43 104 XM_GoogleGroups 3292 1.17 0.52 1.42 105 XM_OfRef6 3111 1.79 2.94 1.34 106 UNTRUSTED_Relay 3025 5.26 15.30 1.31 107 XMDiploma_00 3004 1.38 1.58 1.30 108 T_XMDrugObfuBody_08 2929 1.64 2.58 1.27 109 RCVD_IN_IADB_OPTIN 2841 1.07 0.67 1.23 110 TR_Symld_Words 2747 1.13 0.98 1.19 111 HTML_MIME_NO_HTML_TAG 2723 2.35 5.32 1.18 112 XMSubMetaI_00 2631 1.50 2.43 1.14 113 XMSubMetaSxObfu_02 2562 0.90 0.36 1.11 114 XM_shorewaves_Whitelist 2556 0.79 0.00 1.10 115 XMPhish11 2516 1.17 1.37 1.09 116 XM_H_PHPOS 2505 1.21 1.53 1.08 117 THIS_AD 2501 1.00 0.80 1.08 118 TooManyTo_003 2466 0.90 0.46 1.07 119 T_TooManySym_03 2448 0.82 0.22 1.06 120 XMSexyCombo_01 2335 1.17 1.58 1.01 121 XMBody_95 2321 0.73 0.05 1.00 122 DKIM_ADSP_CUSTOM_MED 2254 1.13 1.53 0.97 123 TM2_M_VERY_LONG_WORD 2198 1.07 1.38 0.95 124 XM_H_Long_From02 2166 1.00 1.16 0.94 125 USER_IN_WHITELIST 2163 0.67 0.00 0.93 126 XMStockSpam_06 2100 1.26 2.16 0.91 127 XMBrknScrpt_02 2024 0.82 0.69 0.87 128 TooManyTo_004 2017 0.74 0.40 0.87 129 XM_H_PHPMailer 1909 0.87 0.99 0.82 130 XMGenDplmaNmb 1897 0.86 0.96 0.82 131 T_XMDrugObfuBody_00 1813 1.25 2.42 0.78 132 T_XMHurry_00 1748 0.90 1.28 0.76 133 TooManyTo_005 1728 0.63 0.32 0.75 134 XM_URI_RBL 1708 1.07 1.92 0.74 135 XMBody_17 1694 1.29 2.72 0.73 136 XM_UB50 1632 3.28 9.81 0.71 137 TM2_M_A_HREF_HREF 1582 0.57 0.27 0.68 138 XM_B_COPY_HTML 1553 0.72 0.85 0.67 139 XM_B_REG_HTML 1547 1.02 1.93 0.67 140 XMHTMLBadTable_001 1489 0.82 1.26 0.64 141 NML_ADSP_CUSTOM_MED 1469 0.87 1.46 0.63 142 DIET_1 1398 1.12 2.44 0.60 143 FILL_THIS_FORM 1371 0.98 1.98 0.59 144 XMBody_78 1347 0.69 0.96 0.58 145 XMPhish30 1346 0.79 1.30 0.58 146 HELO_NODOT 1342 0.48 0.24 0.58 147 XMLngstWrd_00 1341 0.50 0.28 0.58 148 RDNS_DYNAMIC 1327 0.60 0.68 0.57 149 XMLngstWrd_01 1257 0.46 0.25 0.54 150 DKIM_ADSP_NXDOMAIN 1252 1.78 4.92 0.54 151 HELO_NO_DOMAIN 1249 0.45 0.24 0.54 152 XMPhish14 1243 0.50 0.40 0.54 153 HTML_FONT_FACE_BAD 1230 0.56 0.64 0.53 154 FILL_THIS_FORM_LONG 1204 0.91 1.89 0.52 155 T_FILL_THIS_FORM_SHORT 1185 0.56 0.67 0.51 156 XM_H_PHPOS_M 1149 0.56 0.72 0.50 157 XM_RXBody 1141 0.72 1.30 0.49 158 FILL_THIS_FORM_LOAN 1140 0.75 1.42 0.49 159 HTML_TAG_BALANCE_BODY 1137 0.56 0.72 0.49 160 SUBJ_DOLLARS 1087 0.60 0.92 0.47 161 XMCapTrack 1080 0.38 0.17 0.47 162 TR_LOTS_OF_MONEY2 1063 0.67 1.21 0.46 163 T_MONEY_PERCENT 1063 0.67 1.21 0.46 164 RELAYCOUNTRY_GB 1051 1.26 3.30 0.45 165 TR_XM_RelayPhish 1025 0.56 0.87 0.44 166 FORGED_GMAIL_RCVD 1010 0.69 1.35 0.44 167 T_TooManySym_04 994 0.31 0.02 0.43 168 XM_Walgreens_Forge 908 0.37 0.33 0.39 169 HTTPS_HTTP_MISMATCH 891 0.34 0.23 0.39 170 XMSubMetaSxObfu_03 883 1.05 2.75 0.38 171 XMClaimOffer 847 0.79 1.88 0.37 172 PLING_QUERY 846 0.42 0.56 0.37 173 RELAYCOUNTRY_DE 832 0.73 1.67 0.36 174 XMRcvdHeader_15 829 0.26 0.00 0.36 175 XM_D_tchamptons_WL 821 0.25 0.00 0.35 176 XM_Akamai 813 0.25 0.00 0.35 177 XMLngstWrd_02 801 0.31 0.23 0.35 178 NUMERIC_HTTP_ADDR 792 0.61 1.30 0.34 179 XM_ShortIntro_01 792 0.33 0.30 0.34 180 XMBSHREFv2 790 0.33 0.29 0.34 181 SpammyFromTLD_01 789 0.69 1.56 0.34 182 XMSubNoVowel 773 0.39 0.52 0.33 183 RELAYCOUNTRY_AU 759 0.33 0.34 0.33 184 XMNoVowels 743 0.29 0.20 0.32 185 LOW_PRICE 741 0.36 0.47 0.32 186 XMHTML_After_End 738 0.50 0.95 0.32 187 XMSUPPORT 729 0.23 0.00 0.32 188 XM_OverStock_LProb 727 0.23 0.02 0.31 189 XMSlimDrugH 720 0.45 0.81 0.31 190 XM_Body_Obfu01 719 0.31 0.30 0.31 191 XM_H_SpoofStaff4 717 0.23 0.04 0.31 192 XM_Superlative01 716 0.24 0.06 0.31 193 URI_NOVOWEL 704 0.41 0.67 0.30 194 TVD_SPACE_RATIO 673 0.25 0.15 0.29 195 XMDateMe_00 671 0.25 0.16 0.29 196 TM2_M_BODY_EMPTY 669 0.26 0.20 0.29 197 XMGappySubj_01 668 0.33 0.42 0.29 198 XMMoneyMeta_00 663 0.61 1.44 0.29 199 T_Symld_Words_02 639 0.47 0.97 0.28 200 BASE64_LENGTH_79_INF 634 0.27 0.26 0.27 ----------------------------------------------------------------------