Email: 335704 Autolearn: 0 AvgScore: 1.88 AvgScanTime: 2.06 sec Spam: 92170 Autolearn: 0 AvgScore: 12.65 AvgScanTime: 2.41 sec Ham: 243534 Autolearn: 0 AvgScore: -2.20 AvgScanTime: 1.92 sec Time Spent Running SA: 191.85 hours Time Spent Processing Spam: 61.72 hours Time Spent Processing Ham: 130.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87178 87.38 94.58 84.65 2 DKIM_SIGNED 77657 81.03 84.25 79.81 3 XM_DK_Pass 76002 79.72 82.46 78.68 4 XMListUnsubscribeExists 72763 62.18 78.94 55.84 5 DKIM_VALID 72622 76.52 78.79 75.66 6 DCC_CHECK 72268 54.84 78.41 45.91 7 DKIM_VALID_AU 61814 60.77 67.07 58.39 8 XM_DK_Undo_02 48812 28.62 52.96 19.41 9 XM_H_QuotedFrom 48541 42.77 52.66 39.02 10 BAYES_99 43107 25.92 46.77 18.02 11 BAYES_999 37329 22.73 40.50 16.00 12 HTML_FONT_LOW_CONTRAST 36322 34.26 39.41 32.31 13 TR_DCC_Bayes_99 35088 16.76 38.07 8.70 14 LOC_TINY_FONT_1 33826 29.53 36.70 26.81 15 MIME_HTML_ONLY 30588 25.75 33.19 22.94 16 BAYES_50 30110 43.40 32.67 47.47 17 FVGT_m_MULTI_ODD 25459 23.56 27.62 22.02 18 XMSubLong 23936 23.49 25.97 22.55 19 DKIM_VALID_EF 19858 28.48 21.54 31.10 20 XM_Body_Dirty_Words 19346 15.77 20.99 13.80 21 T_KAM_HTML_FONT_INVALID 19215 17.23 20.85 15.86 22 DCC_CHECK_NEGATIVE 18680 44.01 20.27 52.99 23 RELAYCOUNTRY_META 18633 8.47 20.22 4.03 24 T_TM2_M_HEADER_IN_MSG 16641 23.00 18.05 24.87 25 BOTNET 16514 6.42 17.92 2.07 26 BOTNET_IPINHOSTNAME 15797 10.27 17.14 7.67 27 HTML_IMAGE_RATIO_02 15550 11.86 16.87 9.96 28 XM_Multi_Part_URI 14582 16.61 15.82 16.91 29 XM_Evil_Numbers_Gen 12356 10.20 13.41 8.99 30 UNTRUSTED_Relay 11861 4.40 12.87 1.20 31 MultiRelay 11548 15.72 12.53 16.93 32 HTML_IMAGE_RATIO_04 9940 7.62 10.78 6.42 33 XMSexyCombo_05 9422 6.24 10.22 4.73 34 FSL_BULK_SIG 8910 8.63 9.67 8.24 35 TooManyTo_001 8744 6.60 9.49 5.51 36 LOTS_OF_MONEY 8340 9.83 9.05 10.13 37 XM_UB50 7338 2.74 7.96 0.77 38 MPART_ALT_DIFF 7265 4.90 7.88 3.77 39 XM_UncommonTLD01 7148 5.05 7.76 4.02 40 XM_B_Phish_Phrases 7141 7.47 7.75 7.36 41 XM_salutation2 7015 4.29 7.61 3.03 42 T_XMDrugObfuBody_14 6995 7.53 7.59 7.51 43 XMSubMetaSx_00 6421 5.65 6.97 5.15 44 XM_H_Long_From01 6221 6.43 6.75 6.31 45 BAYES_80 5771 4.68 6.26 4.08 46 FROM_EXCESS_BASE64 5565 5.50 6.04 5.30 47 BAYES_60 5405 6.08 5.86 6.17 48 HTML_MIME_NO_HTML_TAG 5354 2.64 5.81 1.44 49 LotsOfNums_01 5076 7.62 5.51 8.42 50 DKIM_INVALID 5035 4.51 5.46 4.15 51 HTML_IMAGE_RATIO_06 4868 3.71 5.28 3.11 52 MIME_HTML_MOSTLY 4847 3.43 5.26 2.73 53 RCVD_IN_RP_SAFE 4740 12.51 5.14 15.29 54 XM_DIRTYINTL 4603 3.40 4.99 2.79 55 RELAYCOUNTRY_CA 4583 2.50 4.97 1.56 56 RELAYCOUNTRY_FR 4532 1.48 4.92 0.19 57 XMStrtUSub 4515 5.26 4.90 5.40 58 DKIM_ADSP_NXDOMAIN 4429 1.69 4.81 0.51 59 SpammyFromTLD_02 4260 1.41 4.62 0.19 60 XMBdyGiftCard01 4090 2.18 4.44 1.32 61 MIME_HTML_ONLY_MULTI 3816 2.53 4.14 1.92 62 RCVD_IN_RP_CERTIFIED 3675 11.14 3.99 13.85 63 BAYES_95 3550 3.19 3.85 2.94 64 INVALID_MSGID 3541 3.20 3.84 2.95 65 XMNumbers 3277 3.09 3.56 2.91 66 XM_CamelCaseFrm001 3101 2.24 3.36 1.81 67 FROM_SUSPICIOUS_NTLD 2996 0.92 3.25 0.03 68 URI_HEX 2994 2.42 3.25 2.10 69 HTML_IMAGE_RATIO_08 2916 2.49 3.16 2.23 70 XM_SPF_SoftFail 2775 2.27 3.01 1.98 71 XM_OfRef6 2757 1.71 2.99 1.22 72 T_TooManySym_01 2711 6.23 2.94 7.47 73 T_REMOTE_IMAGE 2709 3.44 2.94 3.63 74 XM_SendGrid 2667 6.01 2.89 7.19 75 MIME_QP_LONG_LINE 2638 4.11 2.86 4.58 76 RCVD_IN_MSPIKE_H2 2612 4.43 2.83 5.03 77 RCVD_IN_RP_RNBL 2597 0.80 2.82 0.03 78 XMDiploma_00 2536 1.94 2.75 1.63 79 TM2_M_URI_OPT_OUT 2349 1.65 2.55 1.31 80 XM_H_TOP 2300 0.69 2.50 0.00 81 BOTNET_NORDNS 2267 0.68 2.46 0.01 82 TR_M_TOP_BAYES 2260 0.67 2.45 0.00 83 DATE_IN_PAST_06_12 2255 0.72 2.45 0.07 84 RCVD_IN_BL_SPAMCOP_NET 2091 0.76 2.27 0.18 85 XMGenDplmaNmb 2068 1.31 2.24 0.95 86 XMSubMetaI_00 2042 1.22 2.22 0.85 87 SUBJ_ALL_CAPS 1945 1.89 2.11 1.80 88 XMPhish11 1926 1.37 2.09 1.09 89 NO_DNS_FOR_FROM 1871 1.52 2.03 1.33 90 XMSexyCombo_01 1817 1.21 1.97 0.92 91 MultiRelay_CC 1793 0.62 1.95 0.12 92 MultiRelay_Combo 1793 0.62 1.95 0.12 93 XM_URI_RBL 1793 1.11 1.95 0.80 94 MAILING_LIST_MULTI 1646 1.88 1.79 1.92 95 XMSubMetaD_03 1630 0.56 1.77 0.10 96 XM_ProductURIs 1611 1.27 1.75 1.09 97 T_XMDrugObfuBody_08 1590 1.30 1.73 1.14 98 XM_H_Long_From02 1585 1.13 1.72 0.91 99 XM_UB60 1574 0.52 1.71 0.06 100 UNPARSEABLE_RELAY 1563 4.41 1.70 5.44 101 DIET_1 1492 0.85 1.62 0.56 102 XM_H_PHPOS 1490 1.26 1.62 1.12 103 XMBody_17 1489 1.03 1.62 0.80 104 ALL_TRUSTED 1470 11.06 1.59 14.64 105 URI_TRY_3LD 1453 1.71 1.58 1.75 106 SpammyFromTLD_01 1452 0.69 1.58 0.36 107 BAYES_40 1430 2.62 1.55 3.02 108 BODY_ENHANCEMENT 1417 0.45 1.54 0.04 109 XM_B_REG_HTML 1412 0.96 1.53 0.74 110 XMStockSpam_06 1403 1.18 1.52 1.04 111 XMGetyour 1394 0.43 1.51 0.02 112 TM2_M_VERY_LONG_WORD 1391 1.54 1.51 1.55 113 FILL_THIS_FORM 1383 0.73 1.50 0.44 114 XMPhish30 1323 0.82 1.44 0.59 115 TR_Mismatch_TLD_02 1314 0.46 1.43 0.09 116 RCVD_IN_IADB_LISTED 1281 4.08 1.39 5.09 117 PLING_QUERY 1276 0.70 1.38 0.44 118 XM_UB99 1252 0.38 1.36 0.02 119 FILL_THIS_FORM_LONG 1230 0.64 1.33 0.38 120 THIS_AD 1221 0.88 1.32 0.71 121 RELAYCOUNTRY_DE 1214 0.70 1.32 0.47 122 RELAYCOUNTRY_AT 1207 0.47 1.31 0.15 123 XM_H_PHPMailer 1206 0.99 1.31 0.87 124 BAYES_20 1202 2.01 1.30 2.27 125 LONG_JUNK_URI 1200 0.44 1.30 0.11 126 URIBL_BLACK 1195 0.41 1.30 0.08 127 RCVD_IN_PSBL 1191 0.38 1.29 0.03 128 TR_Symld_Words 1149 2.09 1.25 2.41 129 XMBody_78 1140 0.72 1.24 0.52 130 TR_XM_RelayPhish 1131 1.14 1.23 1.11 131 RCVD_IN_IADB_SPF 1128 3.58 1.22 4.47 132 T_XMHurry_00 1126 0.94 1.22 0.83 133 XMHTMLBadTable_001 1124 0.74 1.22 0.56 134 FILL_THIS_FORM_LOAN 1118 0.59 1.21 0.35 135 XM_RXBody 1081 0.65 1.17 0.45 136 DATE_IN_PAST_03_06 1078 0.43 1.17 0.16 137 TR_LOTS_OF_MONEY2 1067 0.63 1.16 0.43 138 T_MONEY_PERCENT 1067 0.63 1.16 0.43 139 SUBJ_DOLLARS 1020 1.02 1.11 0.99 140 XM_UB999 1019 0.31 1.11 0.01 141 RCVD_IN_IADB_SENDERID 1014 3.16 1.10 3.94 142 XMMoneyMeta_00 1002 0.52 1.09 0.30 143 RCVD_IN_IADB_DK 993 3.10 1.08 3.87 144 XMSubMetaSxObfu_03 991 0.54 1.08 0.34 145 XMUrgent 984 0.34 1.07 0.06 146 RELAYCOUNTRY_CN 974 0.31 1.06 0.02 147 NUMERIC_HTTP_ADDR 932 0.44 1.01 0.23 148 XMSubMetaI_01 932 0.30 1.01 0.03 149 MISSING_HEADERS 912 0.44 0.99 0.24 150 DKIM_ADSP_CUSTOM_MED 884 0.90 0.96 0.87 151 NML_ADSP_CUSTOM_MED 829 0.66 0.90 0.57 152 RCVD_IN_IADB_VOUCHED 829 2.61 0.90 3.26 153 URI_NOVOWEL 824 0.54 0.89 0.40 154 REPLYTO_WITHOUT_TO_CC 816 0.28 0.89 0.04 155 XMSubMetaSSx_00 813 0.41 0.88 0.23 156 XMHTML_After_End 811 0.49 0.88 0.34 157 XM_H_PHPOS_M 811 0.67 0.88 0.59 158 TR_LOTS_OF_MONEY3 808 0.46 0.88 0.30 159 TR_MetaPhish_Combo_01 804 2.09 0.87 2.55 160 T_FILL_THIS_FORM_SHORT 796 1.09 0.86 1.17 161 XM_B_COPY_HTML 788 0.85 0.85 0.85 162 HTML_FONT_FACE_BAD 778 0.66 0.84 0.58 163 T_TooManySym_02 769 1.95 0.83 2.37 164 TM2_M_A_HREF_HREF 754 1.15 0.82 1.27 165 BAYES_00 741 10.44 0.80 14.09 166 FORGED_GMAIL_RCVD 738 0.56 0.80 0.47 167 TVD_SPACE_RATIO_MINFP 726 0.24 0.79 0.03 168 MIME_HEADER_CTYPE_ONLY 708 0.33 0.77 0.16 169 HTML_SHORT_LINK_IMG_1 703 0.23 0.76 0.03 170 FSL_THIS_IS_ADV 694 0.38 0.75 0.24 171 LongTLD 694 0.31 0.75 0.15 172 SHORT_URI_3 692 0.32 0.75 0.16 173 NORMAL_HTTP_TO_IP 675 0.25 0.73 0.07 174 XM_OfRef7 670 0.27 0.73 0.10 175 XMSubMetaSx_01 660 0.29 0.72 0.13 176 RCVD_IN_IADB_OPTIN 657 1.72 0.71 2.10 177 XM_DK_Undo_01 656 1.35 0.71 1.59 178 MPART_ALT_DIFF_COUNT 655 0.40 0.71 0.28 179 XM_UB80 655 0.21 0.71 0.02 180 XMSubGiftCard1 653 0.32 0.71 0.18 181 RELAYCOUNTRY_GB 647 0.57 0.70 0.51 182 XM_BadFromFormat 646 0.28 0.70 0.12 183 BODY_URI_ONLY 645 0.23 0.70 0.05 184 BASE64_LENGTH_79_INF 634 0.47 0.69 0.39 185 BAYES_05 631 1.29 0.68 1.52 186 TR_Caps_n_Bayes_99 630 0.29 0.68 0.14 187 RDNS_DYNAMIC 630 0.63 0.68 0.61 188 HK_RANDOM_FROM 628 0.29 0.68 0.14 189 RELAYCOUNTRY_IN 626 0.23 0.68 0.06 190 T_Symld_Words_02 625 0.69 0.68 0.69 191 XM_H_Long_From03 607 0.23 0.66 0.07 192 HK_RANDOM_REPLYTO 605 0.32 0.66 0.19 193 XMSexyCombo_04 592 0.26 0.64 0.11 194 URIBL_DBL_SPAM 590 0.19 0.64 0.02 195 XMLongAddy 587 0.21 0.64 0.05 196 XMGppyBdWords 580 0.45 0.63 0.38 197 REMOVE_BEFORE_LINK 572 0.38 0.62 0.28 198 SHORT_URI_2 571 0.26 0.62 0.12 199 NORDNS_LOW_CONTRAST 570 0.17 0.62 0.00 200 MONEY_FORM 561 0.17 0.61 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 206149 87.38 94.58 84.65 2 DKIM_SIGNED 194361 81.03 84.25 79.81 3 XM_DK_Pass 191615 79.72 82.46 78.68 4 DKIM_VALID 184261 76.52 78.79 75.66 5 DKIM_VALID_AU 142201 60.77 67.07 58.39 6 XMListUnsubscribeExists 135988 62.18 78.94 55.84 7 DCC_CHECK_NEGATIVE 129060 44.01 20.27 52.99 8 BAYES_50 115600 43.40 32.67 47.47 9 DCC_CHECK 111817 54.84 78.41 45.91 10 XM_H_QuotedFrom 95024 42.77 52.66 39.02 11 HTML_FONT_LOW_CONTRAST 78674 34.26 39.41 32.31 12 DKIM_VALID_EF 75740 28.48 21.54 31.10 13 LOC_TINY_FONT_1 65298 29.53 36.70 26.81 14 T_TM2_M_HEADER_IN_MSG 60561 23.00 18.05 24.87 15 MIME_HTML_ONLY 55866 25.75 33.19 22.94 16 XMSubLong 54919 23.49 25.97 22.55 17 FVGT_m_MULTI_ODD 53621 23.56 27.62 22.02 18 XM_DK_Undo_02 47262 28.62 52.96 19.41 19 BAYES_99 43895 25.92 46.77 18.02 20 MultiRelay 41228 15.72 12.53 16.93 21 XM_Multi_Part_URI 41177 16.61 15.82 16.91 22 XM_DKIMWhitelistDomains 39975 11.92 0.03 16.41 23 BAYES_999 38969 22.73 40.50 16.00 24 T_KAM_HTML_FONT_INVALID 38621 17.23 20.85 15.86 25 RCVD_IN_RP_SAFE 37248 12.51 5.14 15.29 26 ALL_TRUSTED 35664 11.06 1.59 14.64 27 BAYES_00 34303 10.44 0.80 14.09 28 RCVD_IN_RP_CERTIFIED 33735 11.14 3.99 13.85 29 XM_Body_Dirty_Words 33607 15.77 20.99 13.80 30 TR_XM_DK_Bayes 29436 8.91 0.50 12.09 31 TR_XM_DK_Bayes1 28350 8.56 0.42 11.64 32 TR_XM_DK_Bayes2 25525 7.70 0.36 10.48 33 LOTS_OF_MONEY 24663 9.83 9.05 10.13 34 HTML_IMAGE_RATIO_02 24255 11.86 16.87 9.96 35 XM_Evil_Numbers_Gen 21893 10.20 13.41 8.99 36 TR_DCC_Bayes_99 21179 16.76 38.07 8.70 37 LotsOfNums_01 20497 7.62 5.51 8.42 38 FSL_BULK_SIG 20059 8.63 9.67 8.24 39 BOTNET_IPINHOSTNAME 18667 10.27 17.14 7.67 40 T_XMDrugObfuBody_14 18300 7.53 7.59 7.51 41 T_TooManySym_01 18197 6.23 2.94 7.47 42 XM_B_Phish_Phrases 17920 7.47 7.75 7.36 43 XM_SendGrid 17499 6.01 2.89 7.19 44 HTML_IMAGE_RATIO_04 15639 7.62 10.78 6.42 45 XM_H_Long_From01 15376 6.43 6.75 6.31 46 BAYES_60 15018 6.08 5.86 6.17 47 TVD_RCVD_IP 14492 4.44 0.44 5.95 48 TooManyTo_001 13414 6.60 9.49 5.51 49 UNPARSEABLE_RELAY 13246 4.41 1.70 5.44 50 XMStrtUSub 13150 5.26 4.90 5.40 51 FROM_EXCESS_BASE64 12906 5.50 6.04 5.30 52 TO_MALFORMED 12683 3.78 0.01 5.21 53 XMSubMetaSx_00 12547 5.65 6.97 5.15 54 RCVD_IN_IADB_LISTED 12408 4.08 1.39 5.09 55 RCVD_IN_MSPIKE_H2 12243 4.43 2.83 5.03 56 XMSexyCombo_05 11510 6.24 10.22 4.73 57 MIME_QP_LONG_LINE 11146 4.11 2.86 4.58 58 RCVD_IN_IADB_SPF 10888 3.58 1.22 4.47 59 DKIM_INVALID 10100 4.51 5.46 4.15 60 BAYES_80 9933 4.68 6.26 4.08 61 RELAYCOUNTRY_META 9808 8.47 20.22 4.03 62 XM_UncommonTLD01 9795 5.05 7.76 4.02 63 RCVD_IN_IADB_SENDERID 9597 3.16 1.10 3.94 64 IN_ZIMBRA_NJ_WHITELIST 9559 2.85 0.02 3.93 65 RCVD_IN_IADB_DK 9417 3.10 1.08 3.87 66 MPART_ALT_DIFF 9176 4.90 7.88 3.77 67 T_REMOTE_IMAGE 8831 3.44 2.94 3.63 68 RCVD_IN_MSPIKE_WL 8042 2.51 0.41 3.30 69 RCVD_IN_MSPIKE_H3 8042 2.51 0.41 3.30 70 RCVD_IN_IADB_VOUCHED 7945 2.61 0.90 3.26 71 HTML_IMAGE_RATIO_06 7583 3.71 5.28 3.11 72 XM_salutation2 7386 4.29 7.61 3.03 73 BAYES_40 7366 2.62 1.55 3.02 74 INVALID_MSGID 7187 3.20 3.84 2.95 75 BAYES_95 7165 3.19 3.85 2.94 76 XMNumbers 7089 3.09 3.56 2.91 77 XM_DIRTYINTL 6805 3.40 4.99 2.79 78 MIME_HTML_MOSTLY 6656 3.43 5.26 2.73 79 TR_MetaPhish_Combo_01 6219 2.09 0.87 2.55 80 TR_Symld_Words 5859 2.09 1.25 2.41 81 T_TooManySym_02 5775 1.95 0.83 2.37 82 BAYES_20 5536 2.01 1.30 2.27 83 ANY_BOUNCE_MESSAGE 5492 1.71 0.26 2.26 84 BOUNCE_MESSAGE 5491 1.71 0.26 2.25 85 HTML_IMAGE_RATIO_08 5429 2.49 3.16 2.23 86 URI_HEX 5122 2.42 3.25 2.10 87 RCVD_IN_IADB_OPTIN 5111 1.72 0.71 2.10 88 BOTNET 5039 6.42 17.92 2.07 89 IN_HORDE_ADDRESS_BOOK 4923 1.48 0.03 2.02 90 XM_SPF_SoftFail 4830 2.27 3.01 1.98 91 USER_IN_DEF_DKIM_WL 4786 1.43 0.02 1.97 92 MIME_HTML_ONLY_MULTI 4686 2.53 4.14 1.92 93 MAILING_LIST_MULTI 4666 1.88 1.79 1.92 94 XM_PDF 4530 1.44 0.32 1.86 95 XM_CamelCaseFrm001 4419 2.24 3.36 1.81 96 SUBJ_ALL_CAPS 4386 1.89 2.11 1.80 97 URI_TRY_3LD 4272 1.71 1.58 1.75 98 XMDiploma_00 3970 1.94 2.75 1.63 99 XM_DK_Undo_01 3872 1.35 0.71 1.59 100 RELAYCOUNTRY_CA 3807 2.50 4.97 1.56 101 TM2_M_VERY_LONG_WORD 3776 1.54 1.51 1.55 102 BAYES_05 3706 1.29 0.68 1.52 103 HTML_MIME_NO_HTML_TAG 3505 2.64 5.81 1.44 104 NO_DNS_FOR_FROM 3235 1.52 2.03 1.33 105 XMBdyGiftCard01 3214 2.18 4.44 1.32 106 TM2_M_URI_OPT_OUT 3192 1.65 2.55 1.31 107 XM_GoogleGroups 3190 1.09 0.49 1.31 108 TM2_M_A_HREF_HREF 3094 1.15 0.82 1.27 109 TooManyTo_002 3003 1.04 0.53 1.23 110 XM_OfRef6 2968 1.71 2.99 1.22 111 UNTRUSTED_Relay 2920 4.40 12.87 1.20 112 T_FILL_THIS_FORM_SHORT 2858 1.09 0.86 1.17 113 T_XMDrugObfuBody_08 2782 1.30 1.73 1.14 114 XM_H_PHPOS 2733 1.26 1.62 1.12 115 TR_XM_RelayPhish 2699 1.14 1.23 1.11 116 XMPhish11 2666 1.37 2.09 1.09 117 XM_ProductURIs 2653 1.27 1.75 1.09 118 XMStockSpam_06 2543 1.18 1.52 1.04 119 XMBody_95 2420 0.74 0.06 0.99 120 SUBJ_DOLLARS 2411 1.02 1.11 0.99 121 XM_shorewaves_Whitelist 2384 0.71 0.00 0.98 122 XMGenDplmaNmb 2318 1.31 2.24 0.95 123 XMSexyCombo_01 2251 1.21 1.97 0.92 124 USER_IN_WHITELIST 2232 0.66 0.00 0.92 125 XM_H_Long_From02 2210 1.13 1.72 0.91 126 XMSubMetaSxObfu_02 2159 0.71 0.25 0.89 127 DKIM_ADSP_CUSTOM_MED 2128 0.90 0.96 0.87 128 XM_H_PHPMailer 2119 0.99 1.31 0.87 129 TooManyTo_003 2105 0.74 0.42 0.86 130 XM_B_COPY_HTML 2072 0.85 0.85 0.85 131 XMSubMetaI_00 2068 1.22 2.22 0.85 132 XM_D_tchamptons_WL 2040 0.61 0.00 0.84 133 T_XMHurry_00 2018 0.94 1.22 0.83 134 T_TooManySym_03 1984 0.65 0.20 0.81 135 XMBody_17 1960 1.03 1.62 0.80 136 XM_URI_RBL 1943 1.11 1.95 0.80 137 T_XMDrugObfuBody_00 1881 0.70 0.51 0.77 138 XM_UB50 1866 2.74 7.96 0.77 139 XM_B_REG_HTML 1794 0.96 1.53 0.74 140 THIS_AD 1732 0.88 1.32 0.71 141 TooManyTo_004 1718 0.61 0.37 0.71 142 T_Symld_Words_02 1682 0.69 0.68 0.69 143 HELO_NODOT 1597 0.61 0.50 0.66 144 HELO_NO_DOMAIN 1596 0.61 0.50 0.66 145 XMBrknScrpt_02 1563 0.62 0.57 0.64 146 TooManyTo_005 1524 0.54 0.32 0.63 147 RDNS_DYNAMIC 1496 0.63 0.68 0.61 148 XMPhish14 1453 0.60 0.60 0.60 149 XM_H_PHPOS_M 1449 0.67 0.88 0.59 150 XMPhish30 1426 0.82 1.44 0.59 151 HTML_FONT_FACE_BAD 1421 0.66 0.84 0.58 152 NML_ADSP_CUSTOM_MED 1380 0.66 0.90 0.57 153 DIET_1 1364 0.85 1.62 0.56 154 XMHTMLBadTable_001 1359 0.74 1.22 0.56 155 XMBody_78 1265 0.72 1.24 0.52 156 DKIM_ADSP_NXDOMAIN 1252 1.69 4.81 0.51 157 RELAYCOUNTRY_GB 1251 0.57 0.70 0.51 158 HTTPS_HTTP_MISMATCH 1203 0.44 0.31 0.49 159 RELAYCOUNTRY_DE 1145 0.70 1.32 0.47 160 FORGED_GMAIL_RCVD 1138 0.56 0.80 0.47 161 XM_Sams_Club_Forge 1108 0.41 0.29 0.45 162 XM_RXBody 1106 0.65 1.17 0.45 163 T_TooManySym_04 1090 0.34 0.04 0.45 164 XMNoVowels 1078 0.42 0.36 0.44 165 FILL_THIS_FORM 1077 0.73 1.50 0.44 166 HTML_TAG_BALANCE_BODY 1076 0.48 0.58 0.44 167 PLING_QUERY 1069 0.70 1.38 0.44 168 T_MONEY_PERCENT 1042 0.63 1.16 0.43 169 TR_LOTS_OF_MONEY2 1042 0.63 1.16 0.43 170 XMLngstWrd_00 1004 0.36 0.22 0.41 171 XMCapTrack 998 0.35 0.19 0.41 172 URI_NOVOWEL 975 0.54 0.89 0.40 173 XMSolicitRefs_0 952 0.44 0.57 0.39 174 BASE64_LENGTH_79_INF 942 0.47 0.69 0.39 175 FILL_THIS_FORM_LONG 928 0.64 1.33 0.38 176 XMGppyBdWords 916 0.45 0.63 0.38 177 XMLngstWrd_01 881 0.31 0.19 0.36 178 XM_Akamai 877 0.26 0.01 0.36 179 SpammyFromTLD_01 873 0.69 1.58 0.36 180 FILL_THIS_FORM_LOAN 863 0.59 1.21 0.35 181 XM_Walgreens_Forge 854 0.32 0.23 0.35 182 XMHTML_After_End 835 0.49 0.88 0.34 183 XMSubMetaSxObfu_03 817 0.54 1.08 0.34 184 XMRcvdHeader_15 808 0.24 0.00 0.33 185 XM_ShortIntro_01 768 0.33 0.38 0.32 186 LOW_PRICE 765 0.35 0.45 0.31 187 XMBSHREFv2 753 0.25 0.08 0.31 188 XMClaimOffer 750 0.36 0.51 0.31 189 RELAYCOUNTRY_AU 742 0.34 0.42 0.30 190 XMMoneyMeta_00 739 0.52 1.09 0.30 191 TR_LOTS_OF_MONEY3 727 0.46 0.88 0.30 192 TR_MetaPhish_Combo_01b 718 0.23 0.05 0.29 193 XMSUPPORT 712 0.21 0.00 0.29 194 XM_S_JOY_D 711 0.27 0.20 0.29 195 XMSlimDrugH 696 0.33 0.45 0.29 196 XM_Body_Obfu01 695 0.29 0.32 0.29 197 REMOVE_BEFORE_LINK 691 0.38 0.62 0.28 198 XM_H_SpoofStaff4 690 0.22 0.04 0.28 199 XMGappySubj_01 689 0.25 0.17 0.28 200 MPART_ALT_DIFF_COUNT 685 0.40 0.71 0.28 ----------------------------------------------------------------------