Email: 339454 Autolearn: 0 AvgScore: 2.83 AvgScanTime: 2.19 sec Spam: 93157 Autolearn: 0 AvgScore: 12.19 AvgScanTime: 2.73 sec Ham: 246297 Autolearn: 0 AvgScore: -0.71 AvgScanTime: 1.98 sec Time Spent Running SA: 206.30 hours Time Spent Processing Spam: 70.68 hours Time Spent Processing Ham: 135.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87878 87.20 94.33 84.50 2 DKIM_SIGNED 75802 81.06 81.37 80.95 3 XM_DK_Pass 74583 79.73 80.06 79.61 4 DKIM_VALID 72983 77.77 78.34 77.56 5 XMListUnsubscribeExists 71247 62.33 76.48 56.98 6 XM_B_Unicode 71181 72.19 76.41 70.60 7 DCC_CHECK 71129 56.35 76.35 48.78 8 DKIM_VALID_AU 58116 60.74 62.39 60.12 9 XM_DK_Undo_02 46806 26.73 50.24 17.84 10 BAYES_99 38838 22.87 41.69 15.75 11 HTML_FONT_LOW_CONTRAST 36514 34.66 39.20 32.94 12 LOC_TINY_FONT_1 32678 29.76 35.08 27.75 13 BAYES_999 32264 19.64 34.63 13.97 14 BAYES_50 31279 46.23 33.58 51.01 15 TR_DCC_Bayes_99 30471 14.28 32.71 7.31 16 MIME_HTML_ONLY 28454 24.99 30.54 22.90 17 FVGT_m_MULTI_ODD 26265 24.07 28.19 22.51 18 XMSubLong 23460 23.53 25.18 22.90 19 XM_Body_Dirty_Words 22286 16.47 23.92 13.65 20 DCC_CHECK_NEGATIVE 20772 42.46 22.30 50.09 21 DKIM_VALID_EF 19737 28.59 21.19 31.39 22 RELAYCOUNTRY_META 19579 8.66 21.02 3.99 23 T_KAM_HTML_FONT_INVALID 17303 17.22 18.57 16.71 24 BOTNET 17180 6.72 18.44 2.29 25 XM_Multi_Part_URI 16191 15.09 17.38 14.23 26 BOTNET_IPINHOSTNAME 16069 9.50 17.25 6.56 27 T_TM2_M_HEADER_IN_MSG 15613 21.80 16.76 23.70 28 MultiRelay 14939 16.91 16.04 17.25 29 HTML_IMAGE_RATIO_02 14474 12.17 15.54 10.89 30 UNTRUSTED_Relay 13174 4.81 14.14 1.28 31 RCVD_IN_MSPIKE_H2 12243 14.51 13.14 15.02 32 HTML_IMAGE_RATIO_04 12060 8.11 12.95 6.29 33 XM_Evil_Numbers_Gen 12051 10.34 12.94 9.36 34 XMSexyCombo_05 10286 6.22 11.04 4.40 35 LOTS_OF_MONEY 10233 11.52 10.98 11.72 36 FSL_BULK_SIG 10210 10.57 10.96 10.42 37 XM_UncommonTLD01 9249 6.82 9.93 5.64 38 MPART_ALT_DIFF 9147 5.23 9.82 3.50 39 T_XMDrugObfuBody_14 8074 8.36 8.67 8.25 40 XMSubMetaSx_00 8067 5.57 8.66 4.41 41 BAYES_80 7321 5.30 7.86 4.33 42 XM_H_Long_From01 6612 6.73 7.10 6.60 43 SpammyFromTLD_02 6256 1.95 6.72 0.15 44 XM_B_SpammyTLD 6226 5.39 6.68 4.89 45 MIME_HTML_MOSTLY 6123 3.61 6.57 2.49 46 XM_DIRTYINTL 6105 3.85 6.55 2.83 47 LotsOfNums_01 6030 7.61 6.47 8.04 48 XM_UB50 6007 2.31 6.45 0.75 49 BAYES_60 5836 6.45 6.26 6.52 50 TooManyTo_001 5816 6.40 6.24 6.46 51 XM_B_Phish_Phrases 5592 6.78 6.00 7.07 52 RELAYCOUNTRY_FR 5156 1.67 5.53 0.21 53 DKIM_ADSP_NXDOMAIN 5008 1.89 5.38 0.57 54 HTML_MIME_NO_HTML_TAG 4838 2.27 5.19 1.17 55 URI_HEX 4757 2.90 5.11 2.06 56 XMBdyGiftCard01 4701 2.30 5.05 1.25 57 XMNumbers 4490 3.63 4.82 3.18 58 HTML_IMAGE_RATIO_06 4368 3.90 4.69 3.61 59 MIME_HTML_ONLY_MULTI 4298 2.55 4.61 1.77 60 US_DOLLARS_3 4109 3.80 4.41 3.57 61 RCVD_IN_BL_SPAMCOP_NET 4067 1.85 4.37 0.90 62 BAYES_95 4065 3.50 4.36 3.17 63 RELAYCOUNTRY_CA 3898 2.24 4.18 1.50 64 FROM_EXCESS_BASE64 3839 3.92 4.12 3.85 65 RCVD_IN_RP_SAFE 3722 11.90 4.00 14.89 66 XMStrtUSub 3707 4.98 3.98 5.35 67 MIME_QP_LONG_LINE 3622 4.47 3.89 4.69 68 KHOP_HELO_FCRDNS 3555 1.85 3.82 1.10 69 URIBL_DBL_ABUSE_REDIR 3526 1.06 3.79 0.03 70 XM_SendGrid 3256 6.64 3.50 7.83 71 T_TooManySym_01 3235 5.86 3.47 6.76 72 NO_DNS_FOR_FROM 3083 1.74 3.31 1.15 73 XM_CamelCaseFrm001 3067 2.43 3.29 2.11 74 XMSexyCombo_01 3058 1.30 3.28 0.55 75 T_REMOTE_IMAGE 3039 3.68 3.26 3.84 76 XMBody_17 2865 1.49 3.08 0.89 77 XMDiploma_00 2825 1.89 3.03 1.46 78 DKIM_INVALID 2819 3.29 3.03 3.39 79 HTML_IMAGE_RATIO_08 2780 2.36 2.98 2.12 80 RCVD_IN_RP_CERTIFIED 2671 10.51 2.87 13.40 81 TM2_M_URI_OPT_OUT 2629 1.78 2.82 1.38 82 TR_Symld_Words 2626 2.48 2.82 2.35 83 XMSubMetaI_00 2618 1.19 2.81 0.58 84 RCVD_IN_RP_RNBL 2613 0.79 2.80 0.03 85 T_XMDrugObfuBody_08 2577 1.87 2.77 1.53 86 XM_SPF_SoftFail 2570 1.52 2.76 1.06 87 RCVD_IN_PSBL 2550 0.78 2.74 0.04 88 XM_URI_RBL 2426 1.02 2.60 0.42 89 BAYES_40 2401 3.35 2.58 3.64 90 DIET_1 2251 0.98 2.42 0.44 91 MultiRelay_CC 2245 0.78 2.41 0.16 92 MultiRelay_Combo 2245 0.78 2.41 0.16 93 TR_XM_PHPDW 2241 1.10 2.41 0.60 94 TR_XM_PHPForged 2186 1.07 2.35 0.58 95 TR_XM_FormFill2 2171 1.05 2.33 0.57 96 XM_H_PHPOS 2158 1.04 2.32 0.56 97 RELAYCOUNTRY_IN 2048 0.64 2.20 0.06 98 SUBJ_ALL_CAPS 2005 2.24 2.15 2.28 99 T_XMDrugObfuBody_00 1881 1.43 2.02 1.21 100 XM_OfRef6 1866 1.82 2.00 1.75 101 XM_UB99 1857 0.56 1.99 0.01 102 BAYES_20 1855 2.39 1.99 2.53 103 XMSlimDrugH 1823 0.88 1.96 0.47 104 XM_H_Long_From02 1752 1.27 1.88 1.05 105 ALL_TRUSTED 1749 11.37 1.88 14.96 106 RCVD_IN_IADB_LISTED 1733 3.88 1.86 4.65 107 TM2_M_VERY_LONG_WORD 1700 1.60 1.82 1.51 108 XMGenDplmaNmb 1693 1.04 1.82 0.75 109 TR_XM_RelayPhish 1617 1.25 1.74 1.07 110 TR_XM_DK_SendGrid 1600 3.46 1.72 4.12 111 SpammyFromTLD_01 1588 0.81 1.70 0.47 112 NUMERIC_HTTP_ADDR 1577 0.68 1.69 0.30 113 URIBL_BLACK 1487 0.51 1.60 0.11 114 TM2_M_A_HREF_HREF 1478 1.49 1.59 1.46 115 RCVD_IN_IADB_SPF 1467 3.30 1.57 3.95 116 NORDNS_LOW_CONTRAST 1423 0.42 1.53 0.00 117 URI_TRY_3LD 1422 1.73 1.53 1.81 118 XMStockSpam_06 1408 1.23 1.51 1.12 119 T_XMHurry_00 1405 0.89 1.51 0.66 120 UNPARSEABLE_RELAY 1403 3.52 1.51 4.28 121 RCVD_IN_IADB_DK 1377 2.78 1.48 3.28 122 RCVD_IN_IADB_SENDERID 1361 2.88 1.46 3.42 123 NORMAL_HTTP_TO_IP 1319 0.42 1.42 0.05 124 XM_H_PHPMailer 1315 0.81 1.41 0.58 125 XM_UB60 1314 0.43 1.41 0.07 126 XM_UB999 1311 0.39 1.41 0.01 127 SUBJ_DOLLARS 1304 1.01 1.40 0.86 128 FROM_SUSPICIOUS_NTLD 1293 0.40 1.39 0.03 129 XM_B_REG_HTML 1273 1.01 1.37 0.88 130 BOTNET_NORDNS 1272 0.39 1.37 0.02 131 FROM_SUSPICIOUS_NTLD_FP 1267 0.39 1.36 0.03 132 TR_LOTS_OF_MONEY3 1239 0.64 1.33 0.38 133 T_TooManySym_02 1222 1.87 1.31 2.08 134 XMPhish11 1187 1.12 1.27 1.06 135 BODY_URI_ONLY 1175 0.38 1.26 0.05 136 XMPhish30 1167 0.89 1.25 0.75 137 RELAYCOUNTRY_AT 1146 0.49 1.23 0.21 138 XM_H_PHPOS_M 1120 0.52 1.20 0.26 139 XM_ProductURIs 1105 0.97 1.19 0.89 140 MAILING_LIST_MULTI 1104 1.82 1.19 2.06 141 TR_Mismatch_TLD_02 1099 0.36 1.18 0.06 142 XMHTMLBadTable_001 1097 0.82 1.18 0.68 143 XM_Lotto 1086 0.35 1.17 0.05 144 HTML_IMAGE_ONLY_12 1074 0.44 1.15 0.18 145 XMGppyBdWords 1072 0.40 1.15 0.11 146 T_Symld_Words_02 986 0.64 1.06 0.48 147 FROM_DOMAIN_NOVOWEL 979 0.32 1.05 0.04 148 RDNS_DYNAMIC 975 0.73 1.05 0.60 149 RCVD_IN_MSPIKE_BL 956 0.46 1.03 0.25 150 RELAYCOUNTRY_GB 942 0.65 1.01 0.51 151 RCVD_IN_MSPIKE_L5 939 0.45 1.01 0.25 152 HTML_SHORT_LINK_IMG_1 931 0.30 1.00 0.04 153 XM_DK_Undo_01 929 1.59 1.00 1.82 154 XMSubMetaSSx_00 927 0.55 1.00 0.39 155 PLING_QUERY 920 0.80 0.99 0.73 156 TooManyTo_002 916 1.36 0.98 1.50 157 MPART_ALT_DIFF_COUNT 913 0.56 0.98 0.40 158 XM_UB80 901 0.28 0.97 0.02 159 XMSubject_09 874 0.33 0.94 0.11 160 XMSexyCombo_04 871 0.37 0.93 0.16 161 XMBrknScrpt_02 858 0.67 0.92 0.57 162 DATE_IN_PAST_03_06 824 0.30 0.88 0.08 163 THIS_AD 810 0.30 0.87 0.09 164 URIBL_CSS 798 0.25 0.86 0.02 165 URIBL_CSS_A 798 0.25 0.86 0.02 166 XMBody_78 796 0.68 0.85 0.62 167 DKIM_ADSP_CUSTOM_MED 795 0.89 0.85 0.90 168 RCVD_IN_MSPIKE_H3 792 3.44 0.85 4.42 169 RCVD_IN_MSPIKE_WL 792 3.44 0.85 4.42 170 HTML_TAG_BALANCE_BODY 788 0.79 0.85 0.77 171 RELAYCOUNTRY_DE 778 0.42 0.84 0.26 172 XMHTML_After_End 773 0.41 0.83 0.25 173 TR_LOTS_OF_MONEY2 763 0.41 0.82 0.26 174 T_MONEY_PERCENT 763 0.41 0.82 0.26 175 XMWghtMeta_00 748 0.25 0.80 0.04 176 T_FILL_THIS_FORM_SHORT 747 1.09 0.80 1.20 177 RCVD_IN_IADB_VOUCHED 741 2.60 0.80 3.29 178 FVGT_m_IMAGE_ONLY_SPAM 734 0.23 0.79 0.02 179 LongTLD 724 0.30 0.78 0.12 180 TooManyTo_003 719 0.89 0.77 0.94 181 XM_HighProb1 711 0.22 0.76 0.01 182 URI_NOVOWEL 708 0.57 0.76 0.50 183 XM_B_COPY_HTML 703 0.67 0.75 0.64 184 NML_ADSP_CUSTOM_MED 692 0.60 0.74 0.55 185 XMSubMetaSxObfu_02 678 0.80 0.73 0.82 186 MIME_HEADER_CTYPE_ONLY 677 0.32 0.73 0.16 187 XMSubMetaSx_01 667 0.40 0.72 0.28 188 BODY_ENHANCEMENT 664 0.21 0.71 0.02 189 XM_RXBody 659 0.42 0.71 0.31 190 PDS_TO_EQ_FROM_NAME 658 0.20 0.71 0.01 191 BAYES_00 658 8.31 0.71 11.19 192 BAYES_05 648 1.28 0.70 1.50 193 FORGED_GMAIL_RCVD 647 0.59 0.69 0.55 194 XMSubMetaSxObfu_03 639 0.48 0.69 0.41 195 TooManyTo_004 633 0.73 0.68 0.75 196 URIBL_DBL_SPAM 630 0.19 0.68 0.01 197 HTML_FONT_FACE_BAD 625 0.57 0.67 0.54 198 XM_UB95 611 0.19 0.66 0.02 199 DATE_IN_PAST_06_12 590 0.23 0.63 0.08 200 PRICES_ARE_AFFORDABLE 589 0.19 0.63 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 208113 87.20 94.33 84.50 2 DKIM_SIGNED 199372 81.06 81.37 80.95 3 XM_DK_Pass 196076 79.73 80.06 79.61 4 DKIM_VALID 191020 77.77 78.34 77.56 5 XM_B_Unicode 173877 72.19 76.41 70.60 6 DKIM_VALID_AU 148070 60.74 62.39 60.12 7 XMListUnsubscribeExists 140346 62.33 76.48 56.98 8 BAYES_50 125639 46.23 33.58 51.01 9 DCC_CHECK_NEGATIVE 123365 42.46 22.30 50.09 10 DCC_CHECK 120145 56.35 76.35 48.78 11 HTML_FONT_LOW_CONTRAST 81127 34.66 39.20 32.94 12 DKIM_VALID_EF 77312 28.59 21.19 31.39 13 LOC_TINY_FONT_1 68346 29.76 35.08 27.75 14 T_TM2_M_HEADER_IN_MSG 58371 21.80 16.76 23.70 15 XMSubLong 56408 23.53 25.18 22.90 16 MIME_HTML_ONLY 56390 24.99 30.54 22.90 17 FVGT_m_MULTI_ODD 55431 24.07 28.19 22.51 18 XM_DK_Undo_02 43928 26.73 50.24 17.84 19 MultiRelay 42476 16.91 16.04 17.25 20 T_KAM_HTML_FONT_INVALID 41155 17.22 18.57 16.71 21 BAYES_99 38790 22.87 41.69 15.75 22 RCVD_IN_MSPIKE_H2 37003 14.51 13.14 15.02 23 ALL_TRUSTED 36834 11.37 1.88 14.96 24 RCVD_IN_RP_SAFE 36684 11.90 4.00 14.89 25 XM_Multi_Part_URI 35037 15.09 17.38 14.23 26 BAYES_999 34400 19.64 34.63 13.97 27 XM_Body_Dirty_Words 33625 16.47 23.92 13.65 28 RCVD_IN_RP_CERTIFIED 33001 10.51 2.87 13.40 29 XM_DKIMWhitelistDomains 29469 8.74 0.20 11.96 30 LOTS_OF_MONEY 28862 11.52 10.98 11.72 31 BAYES_00 27562 8.31 0.71 11.19 32 HTML_IMAGE_RATIO_02 26824 12.17 15.54 10.89 33 FSL_BULK_SIG 25661 10.57 10.96 10.42 34 TR_XM_DK_Bayes 25165 7.52 0.40 10.22 35 TR_XM_DK_Bayes1 24647 7.37 0.39 10.01 36 XM_Evil_Numbers_Gen 23050 10.34 12.94 9.36 37 TR_XM_DK_Bayes2 21605 6.43 0.25 8.77 38 T_XMDrugObfuBody_14 20310 8.36 8.67 8.25 39 LotsOfNums_01 19805 7.61 6.47 8.04 40 XM_SendGrid 19273 6.64 3.50 7.83 41 TR_DCC_Bayes_99 18013 14.28 32.71 7.31 42 XM_B_Phish_Phrases 17421 6.78 6.00 7.07 43 TO_MALFORMED 17264 5.09 0.02 7.01 44 T_TooManySym_01 16661 5.86 3.47 6.76 45 XM_H_Long_From01 16249 6.73 7.10 6.60 46 BOTNET_IPINHOSTNAME 16163 9.50 17.25 6.56 47 BAYES_60 16056 6.45 6.26 6.52 48 TooManyTo_001 15912 6.40 6.24 6.46 49 HTML_IMAGE_RATIO_04 15483 8.11 12.95 6.29 50 XM_UncommonTLD01 13889 6.82 9.93 5.64 51 XMStrtUSub 13188 4.98 3.98 5.35 52 XM_B_SpammyTLD 12054 5.39 6.68 4.89 53 MIME_QP_LONG_LINE 11543 4.47 3.89 4.69 54 RCVD_IN_IADB_LISTED 11454 3.88 1.86 4.65 55 RCVD_IN_MSPIKE_H3 10897 3.44 0.85 4.42 56 RCVD_IN_MSPIKE_WL 10897 3.44 0.85 4.42 57 XMSubMetaSx_00 10853 5.57 8.66 4.41 58 XMSexyCombo_05 10838 6.22 11.04 4.40 59 BAYES_80 10666 5.30 7.86 4.33 60 INVALID_MSGID 10617 3.16 0.13 4.31 61 UNPARSEABLE_RELAY 10544 3.52 1.51 4.28 62 TR_XM_DK_SendGrid 10143 3.46 1.72 4.12 63 RELAYCOUNTRY_META 9824 8.66 21.02 3.99 64 RCVD_IN_IADB_SPF 9735 3.30 1.57 3.95 65 FROM_EXCESS_BASE64 9482 3.92 4.12 3.85 66 IN_ZIMBRA_NJ_WHITELIST 9474 2.79 0.01 3.85 67 T_REMOTE_IMAGE 9455 3.68 3.26 3.84 68 TVD_RCVD_IP 9097 2.85 0.62 3.69 69 BAYES_40 8955 3.35 2.58 3.64 70 HTML_IMAGE_RATIO_06 8886 3.90 4.69 3.61 71 US_DOLLARS_3 8791 3.80 4.41 3.57 72 MPART_ALT_DIFF 8616 5.23 9.82 3.50 73 RCVD_IN_IADB_SENDERID 8423 2.88 1.46 3.42 74 CK_HELO_DYNAMIC_SPLIT_IP 8386 2.64 0.62 3.40 75 HELO_DYNAMIC_IPADDR2 8384 2.55 0.30 3.40 76 DKIM_INVALID 8352 3.29 3.03 3.39 77 RCVD_IN_IADB_VOUCHED 8101 2.60 0.80 3.29 78 RCVD_IN_IADB_DK 8068 2.78 1.48 3.28 79 XMNumbers 7826 3.63 4.82 3.18 80 BAYES_95 7808 3.50 4.36 3.17 81 XM_DIRTYINTL 6963 3.85 6.55 2.83 82 BAYES_20 6241 2.39 1.99 2.53 83 MIME_HTML_MOSTLY 6133 3.61 6.57 2.49 84 TR_MetaPhish_Combo_01 6005 1.92 0.55 2.44 85 TR_Symld_Words 5791 2.48 2.82 2.35 86 BOTNET 5639 6.72 18.44 2.29 87 SUBJ_ALL_CAPS 5612 2.24 2.15 2.28 88 RCVD_IN_IADB_OPTIN 5371 1.72 0.50 2.18 89 HTML_IMAGE_RATIO_08 5218 2.36 2.98 2.12 90 XM_CamelCaseFrm001 5196 2.43 3.29 2.11 91 T_TooManySym_02 5114 1.87 1.31 2.08 92 URI_HEX 5074 2.90 5.11 2.06 93 MAILING_LIST_MULTI 5070 1.82 1.19 2.06 94 XM_PDF 4840 1.49 0.24 1.97 95 IN_HORDE_ADDRESS_BOOK 4752 1.41 0.05 1.93 96 XM_DK_Undo_01 4479 1.59 1.00 1.82 97 URI_TRY_3LD 4447 1.73 1.53 1.81 98 MIME_HTML_ONLY_MULTI 4361 2.55 4.61 1.77 99 XM_OfRef6 4304 1.82 2.00 1.75 100 USER_IN_DEF_DKIM_WL 4240 1.25 0.01 1.72 101 T_XMDrugObfuBody_08 3777 1.87 2.77 1.53 102 TM2_M_VERY_LONG_WORD 3718 1.60 1.82 1.51 103 BAYES_05 3701 1.28 0.70 1.50 104 RELAYCOUNTRY_CA 3695 2.24 4.18 1.50 105 TooManyTo_002 3688 1.36 0.98 1.50 106 TM2_M_A_HREF_HREF 3591 1.49 1.59 1.46 107 XMDiploma_00 3585 1.89 3.03 1.46 108 TM2_M_URI_OPT_OUT 3402 1.78 2.82 1.38 109 XM_GoogleGroups 3311 1.10 0.47 1.34 110 ANY_BOUNCE_MESSAGE 3222 1.00 0.20 1.31 111 BOUNCE_MESSAGE 3222 1.00 0.20 1.31 112 UNTRUSTED_Relay 3159 4.81 14.14 1.28 113 XMBdyGiftCard01 3090 2.30 5.05 1.25 114 XM_D_tchamptons_WL 3021 0.89 0.00 1.23 115 T_XMDrugObfuBody_00 2981 1.43 2.02 1.21 116 T_FILL_THIS_FORM_SHORT 2944 1.09 0.80 1.20 117 HTML_MIME_NO_HTML_TAG 2877 2.27 5.19 1.17 118 NO_DNS_FOR_FROM 2822 1.74 3.31 1.15 119 XMStockSpam_06 2761 1.23 1.51 1.12 120 KHOP_HELO_FCRDNS 2709 1.85 3.82 1.10 121 TR_XM_RelayPhish 2627 1.25 1.74 1.07 122 XMPhish11 2603 1.12 1.27 1.06 123 XM_SPF_SoftFail 2601 1.52 2.76 1.06 124 XM_H_Long_From02 2574 1.27 1.88 1.05 125 USER_IN_WHITELIST 2481 0.73 0.00 1.01 126 TooManyTo_003 2306 0.89 0.77 0.94 127 XMBody_95 2223 0.68 0.08 0.90 128 DKIM_ADSP_CUSTOM_MED 2213 0.89 0.85 0.90 129 RCVD_IN_BL_SPAMCOP_NET 2208 1.85 4.37 0.90 130 XM_ProductURIs 2187 0.97 1.19 0.89 131 XMBody_17 2181 1.49 3.08 0.89 132 XM_B_REG_HTML 2171 1.01 1.37 0.88 133 SUBJ_DOLLARS 2109 1.01 1.40 0.86 134 XMSubMetaSxObfu_02 2026 0.80 0.73 0.82 135 HTML_TAG_BALANCE_BODY 1888 0.79 0.85 0.77 136 XMGenDplmaNmb 1852 1.04 1.82 0.75 137 XMPhish30 1850 0.89 1.25 0.75 138 XM_UB50 1849 2.31 6.45 0.75 139 TooManyTo_004 1849 0.73 0.68 0.75 140 T_TooManySym_03 1835 0.63 0.33 0.75 141 PLING_QUERY 1807 0.80 0.99 0.73 142 XMHTMLBadTable_001 1670 0.82 1.18 0.68 143 FILL_THIS_FORM 1636 0.62 0.49 0.66 144 T_XMHurry_00 1624 0.89 1.51 0.66 145 XM_B_COPY_HTML 1575 0.67 0.75 0.64 146 TooManyTo_005 1553 0.62 0.59 0.63 147 XMBody_78 1525 0.68 0.85 0.62 148 RDNS_DYNAMIC 1490 0.73 1.05 0.60 149 TR_XM_PHPDW 1479 1.10 2.41 0.60 150 FILL_THIS_FORM_LONG 1471 0.52 0.30 0.60 151 FILL_THIS_FORM_LOAN 1449 0.50 0.28 0.59 152 XMSubMetaI_00 1437 1.19 2.81 0.58 153 TR_XM_PHPForged 1432 1.07 2.35 0.58 154 HELO_NODOT 1426 0.56 0.52 0.58 155 HELO_NO_DOMAIN 1425 0.56 0.50 0.58 156 XM_H_PHPMailer 1422 0.81 1.41 0.58 157 XMBrknScrpt_02 1412 0.67 0.92 0.57 158 DKIM_ADSP_NXDOMAIN 1400 1.89 5.38 0.57 159 TR_XM_FormFill2 1395 1.05 2.33 0.57 160 XM_H_PHPOS 1383 1.04 2.32 0.56 161 XMSexyCombo_01 1365 1.30 3.28 0.55 162 FORGED_GMAIL_RCVD 1356 0.59 0.69 0.55 163 NML_ADSP_CUSTOM_MED 1343 0.60 0.74 0.55 164 HTML_FONT_FACE_BAD 1323 0.57 0.67 0.54 165 XMGappySubj_01 1254 0.50 0.47 0.51 166 RELAYCOUNTRY_GB 1250 0.65 1.01 0.51 167 URI_NOVOWEL 1230 0.57 0.76 0.50 168 T_Symld_Words_02 1187 0.64 1.06 0.48 169 TR_Caps_n_Bayes_99 1183 0.51 0.59 0.48 170 XMPhish14 1175 0.49 0.53 0.48 171 SpammyFromTLD_01 1167 0.81 1.70 0.47 172 XMSlimDrugH 1148 0.88 1.96 0.47 173 XMCapTrack 1094 0.39 0.23 0.44 174 DIET_1 1087 0.98 2.42 0.44 175 T_OBFU_PDF_ATTACH 1072 0.33 0.07 0.44 176 XMBSHREFv2 1044 0.42 0.41 0.42 177 XM_URI_RBL 1033 1.02 2.60 0.42 178 XMSubMetaSxObfu_03 998 0.48 0.69 0.41 179 MPART_ALT_DIFF_COUNT 995 0.56 0.98 0.40 180 HTTPS_HTTP_MISMATCH 982 0.37 0.31 0.40 181 XMSubMetaSSx_00 949 0.55 1.00 0.39 182 TR_LOTS_OF_MONEY3 947 0.64 1.33 0.38 183 TM2_M_BODY_EMPTY 940 0.29 0.05 0.38 184 XMNoVowels 935 0.38 0.37 0.38 185 XM_Akamai 906 0.27 0.01 0.37 186 XMLngstWrd_00 903 0.36 0.35 0.37 187 RELAYCOUNTRY_AU 885 0.39 0.48 0.36 188 T_TooManySym_04 882 0.27 0.04 0.36 189 XMRcvdHeader_15 855 0.25 0.00 0.35 190 XMUrgent 850 0.34 0.34 0.35 191 XM_Ancestry_Forge 847 0.25 0.02 0.34 192 UPPERCASE_50_75 846 0.35 0.38 0.34 193 HTML_IMAGE_ONLY_24 830 0.28 0.14 0.34 194 XMOemUri 826 0.32 0.30 0.34 195 XM_ShortIntro_01 810 0.38 0.51 0.33 196 TR_MetaPhish_Combo_01b 804 0.30 0.23 0.33 197 XMLngstWrd_01 769 0.31 0.32 0.31 198 XM_RXBody 769 0.42 0.71 0.31 199 XM_Body_Obfu01 757 0.28 0.21 0.31 200 XMSUPPORT 755 0.22 0.00 0.31 ----------------------------------------------------------------------