Email: 655333 Autolearn: 0 AvgScore: 1.80 AvgScanTime: 1.93 sec Spam: 145974 Autolearn: 0 AvgScore: 12.00 AvgScanTime: 3.31 sec Ham: 509359 Autolearn: 0 AvgScore: -1.13 AvgScanTime: 1.53 sec Time Spent Running SA: 351.39 hours Time Spent Processing Spam: 134.39 hours Time Spent Processing Ham: 217.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138898 86.02 95.15 83.41 2 RELAYCOUNTRY_US 112713 77.15 77.21 77.14 3 DCC_CHECK 112666 45.93 77.18 36.97 4 DKIM_SIGNED 112622 72.81 77.15 71.57 5 XM_B_Unicode 110664 68.65 75.81 66.59 6 XM_DK_Pass 109265 71.30 74.85 70.29 7 DKIM_VALID 95030 66.44 65.10 66.82 8 XMListUnsubscribeExists 94040 52.81 64.42 49.48 9 BAYES_50 69296 49.61 47.47 50.22 10 DKIM_VALID_AU 68660 49.24 47.04 49.87 11 XM_B_Unicode3 67192 40.58 46.03 39.02 12 MIME_HTML_ONLY 56195 25.05 38.50 21.19 13 XM_DK_Undo_02 48116 12.76 32.96 6.96 14 HTML_FONT_LOW_CONTRAST 47901 26.93 32.81 25.24 15 LOC_TINY_FONT_1 47395 24.51 32.47 22.23 16 XMSubLong 37548 21.85 25.72 20.74 17 DKIM_VALID_EF 34825 25.17 23.86 25.54 18 FVGT_m_MULTI_ODD 34042 20.49 23.32 19.68 19 T_KAM_HTML_FONT_INVALID 32964 17.61 22.58 16.18 20 XM_Body_Dirty_Words 31480 14.29 21.57 12.21 21 DCC_CHECK_NEGATIVE 30547 52.23 20.93 61.20 22 BAYES_99 30216 7.36 20.70 3.53 23 RELAYCOUNTRY_META 29979 8.79 20.54 5.43 24 BOTNET 28750 6.36 19.70 2.54 25 T_TM2_M_HEADER_IN_MSG 25091 25.00 17.19 27.24 26 XM_Multi_Part_URI 24851 14.34 17.02 13.57 27 FSL_BULK_SIG 23012 8.27 15.76 6.13 28 BAYES_999 22178 5.71 15.19 2.99 29 TR_DCC_Bayes_99 22021 4.87 15.09 1.95 30 XM_B_Unsub 22017 10.66 15.08 9.39 31 LOTS_OF_MONEY 20728 10.29 14.20 9.17 32 UNTRUSTED_Relay 19902 4.29 13.63 1.61 33 HTML_IMAGE_RATIO_02 19885 8.70 13.62 7.29 34 XMSubMetaSx_00 19728 7.25 13.51 5.46 35 BOTNET_IPINHOSTNAME 18546 6.02 12.71 4.11 36 XMSexyCombo_05 17783 5.85 12.18 4.04 37 DKIM_INVALID 17592 6.37 12.05 4.75 38 XM_UncommonTLD01 17167 4.86 11.76 2.88 39 XM_Evil_Numbers_Gen 16461 8.83 11.28 8.13 40 T_REMOTE_IMAGE 14648 5.15 10.03 3.75 41 NO_DNS_FOR_FROM 14494 4.17 9.93 2.52 42 LotsOfNums_01 13974 7.90 9.57 7.41 43 RCVD_IN_MSPIKE_H2 13102 10.85 8.98 11.38 44 BAYES_80 12753 3.64 8.74 2.19 45 MPART_ALT_DIFF 12129 5.27 8.31 4.40 46 BAYES_60 12079 5.33 8.27 4.49 47 HTML_MIME_NO_HTML_TAG 12076 4.50 8.27 3.42 48 XM_UB50 10830 2.31 7.42 0.84 49 HTML_SHORT_LINK_IMG_1 10740 1.65 7.36 0.02 50 TooManyTo_001 10545 8.01 7.22 8.24 51 XM_B_Phish_Phrases 10291 6.35 7.05 6.15 52 BODY_URI_ONLY 9939 1.57 6.81 0.07 53 HTML_IMAGE_ONLY_08 9779 1.58 6.70 0.11 54 XM_BadFromFormat 9591 1.55 6.57 0.11 55 HDRS_LCASE_IMGONLY 9132 1.41 6.26 0.02 56 HTML_IMAGE_RATIO_04 9120 5.88 6.25 5.78 57 XM_H_Long_From01 8863 5.98 6.07 5.95 58 HTML_TAG_BALANCE_CENTER 8838 1.42 6.05 0.09 59 MIME_QP_LONG_LINE 8549 5.46 5.86 5.35 60 XM_SendGrid 8061 6.17 5.52 6.35 61 XMNumbers 8052 3.71 5.52 3.19 62 XM_SPF_SoftFail 7788 2.32 5.34 1.45 63 MIME_HTML_MOSTLY 7279 2.67 4.99 2.00 64 RCVD_IN_MSPIKE_BL 6959 2.11 4.77 1.34 65 XMSexyCombo_01 6871 1.66 4.71 0.78 66 KHOP_HELO_FCRDNS 6530 2.31 4.47 1.69 67 XM_CamelCaseFrm001 6517 2.72 4.46 2.22 68 BAYES_95 6338 1.96 4.34 1.28 69 TM2_M_URI_OPT_OUT 5942 6.69 4.07 7.44 70 MIME_HTML_ONLY_MULTI 5876 3.21 4.03 2.98 71 XM_B_Unsub2 5858 2.79 4.01 2.45 72 URIBL_CSS_A 5829 0.91 3.99 0.03 73 URIBL_CSS 5829 0.91 3.99 0.03 74 SpammyFromTLD_02 5752 1.14 3.94 0.34 75 RELAYCOUNTRY_FR 5720 1.08 3.92 0.27 76 HTML_IMAGE_RATIO_06 5652 3.96 3.87 3.98 77 ALL_TRUSTED 5488 15.88 3.76 19.35 78 RCVD_IN_BL_SPAMCOP_NET 5383 1.80 3.69 1.26 79 RELAYCOUNTRY_CA 4993 1.99 3.42 1.59 80 FROM_EXCESS_BASE64 4968 3.13 3.40 3.05 81 RDNS_DYNAMIC 4953 0.97 3.39 0.27 82 BAYES_40 4923 4.83 3.37 5.25 83 RCVD_IN_MSPIKE_H3 4916 8.66 3.37 10.18 84 RCVD_IN_MSPIKE_WL 4916 8.66 3.37 10.18 85 XMStrtUSub 4551 3.74 3.12 3.92 86 XM_B_SpammyTLD 4386 2.07 3.00 1.80 87 RELAYCOUNTRY_GB 4127 1.66 2.83 1.33 88 BAYES_00 4089 20.16 2.80 25.14 89 XM_DIRTYINTL 3952 1.00 2.71 0.51 90 XM_OfRef6 3899 1.63 2.67 1.34 91 BAYES_20 3793 3.95 2.60 4.33 92 XMDiploma_00 3704 1.82 2.54 1.61 93 RCVD_IN_MSPIKE_L3 3646 1.14 2.50 0.75 94 XM_URI_RBL 3540 0.69 2.43 0.19 95 PDS_OTHER_BAD_TLD 3538 0.88 2.42 0.44 96 RCVD_IN_IADB_LISTED 3513 4.69 2.41 5.34 97 FROM_MISSP_REPLYTO 3501 0.54 2.40 0.01 98 TR_Mismatch_TLD_02 3501 0.59 2.40 0.07 99 T_TooManySym_01 3448 4.57 2.36 5.20 100 URI_HEX 3414 1.68 2.34 1.49 101 T_XMDrugObfuBody_08 3408 1.50 2.33 1.26 102 FROM_MISSP_DYNIP 3363 0.51 2.30 0.00 103 TooManyTo_002 3348 2.21 2.29 2.19 104 RCVD_IN_IADB_SPF 3318 4.06 2.27 4.57 105 HTML_IMAGE_ONLY_12 3282 0.64 2.25 0.18 106 RCVD_IN_IADB_DK 3251 3.49 2.23 3.85 107 HTML_IMAGE_RATIO_08 3243 2.38 2.22 2.43 108 RCVD_IN_IADB_SENDERID 3240 3.58 2.22 3.97 109 SpammyFromTLD_01 3226 0.94 2.21 0.58 110 RCVD_IN_RP_SAFE 3171 7.50 2.17 9.03 111 URIBL_DBL_ABUSE_REDIR 3154 0.67 2.16 0.24 112 RELAYCOUNTRY_DE 3096 0.76 2.12 0.36 113 TR_XM_DK_SendGrid 3084 3.12 2.11 3.40 114 XM_UB60 3077 0.51 2.11 0.06 115 BOTNET_NORDNS 3010 0.51 2.06 0.06 116 TR_XM_DK_Bayes 3007 12.20 2.06 15.11 117 XMSexyCombo_04 2997 0.57 2.05 0.14 118 DIET_1 2993 0.79 2.05 0.43 119 T_XMDrugObfuBody_14 2969 1.68 2.03 1.58 120 TR_XM_INV_DKIM 2892 0.63 1.98 0.24 121 TM2_M_VERY_LONG_WORD 2858 1.44 1.96 1.30 122 SUBJ_ALL_CAPS 2839 1.83 1.94 1.80 123 TooManyTo_003 2816 1.58 1.93 1.48 124 DATE_IN_PAST_03_06 2798 0.53 1.92 0.13 125 TR_XM_PHPDW 2712 0.77 1.86 0.46 126 RCVD_IN_RP_RNBL 2693 0.47 1.84 0.08 127 RCVD_IN_RP_CERTIFIED 2680 6.89 1.84 8.34 128 REPLYTO_WITHOUT_TO_CC 2676 0.46 1.83 0.07 129 TR_XM_PHPForged 2660 0.75 1.82 0.44 130 TR_XM_FormFill2 2627 0.74 1.80 0.44 131 XM_H_PHPOS 2618 0.74 1.79 0.44 132 URI_TRY_3LD 2607 1.38 1.79 1.26 133 T_XMDrugObfuBody_00 2605 1.03 1.78 0.81 134 SUBJECT_NEEDS_ENCODING 2589 0.40 1.77 0.00 135 SUBJ_ILLEGAL_CHARS 2585 0.40 1.77 0.00 136 XMBdyGiftCard01 2578 1.28 1.77 1.14 137 T_Symld_Words_02 2493 0.80 1.71 0.54 138 XMSubMetaI_00 2468 1.12 1.69 0.96 139 XMBody_17 2459 0.90 1.68 0.68 140 TR_LOTS_OF_MONEY3 2422 0.70 1.66 0.42 141 XMGenDplmaNmb 2421 1.12 1.66 0.96 142 XMStockSpam_06 2389 0.92 1.64 0.72 143 XMHTML_After_End 2378 0.95 1.63 0.75 144 DKIM_ADSP_NXDOMAIN 2371 0.59 1.62 0.30 145 TR_Symld_Words 2292 1.53 1.57 1.51 146 TooManyTo_004 2236 1.15 1.53 1.04 147 BAYES_05 2180 3.03 1.49 3.47 148 FROM_SUSPICIOUS_NTLD 2177 0.35 1.49 0.03 149 DKIM_ADSP_CUSTOM_MED 2174 1.16 1.49 1.07 150 FROM_SUSPICIOUS_NTLD_FP 2155 0.35 1.48 0.02 151 T_XMHurry_00 2092 0.74 1.43 0.54 152 TM2_M_A_HREF_HREF 2067 0.82 1.42 0.66 153 XM_UB80 2061 0.33 1.41 0.02 154 XM_H_Long_From02 2049 1.07 1.40 0.98 155 MAILING_LIST_MULTI 2024 2.48 1.39 2.80 156 FORGED_GMAIL_RCVD 2002 0.70 1.37 0.50 157 RCVD_IN_MSPIKE_L5 1999 0.51 1.37 0.27 158 TR_LOTS_OF_MONEY2 1959 0.52 1.34 0.29 159 T_MONEY_PERCENT 1959 0.52 1.34 0.29 160 TR_XM_DK_Bayes1 1938 11.39 1.33 14.28 161 LongTLD 1917 0.39 1.31 0.13 162 NML_ADSP_CUSTOM_MED 1870 0.92 1.28 0.82 163 HTML_FONT_SIZE_LARGE 1778 0.35 1.22 0.10 164 TR_XM_DK_Bayes2 1762 10.07 1.21 12.61 165 XMSlimDrugH 1758 0.61 1.20 0.44 166 MIME_HEADER_CTYPE_ONLY 1688 0.44 1.16 0.23 167 HK_RANDOM_FROM 1681 0.35 1.15 0.11 168 XM_DK_Undo_01 1646 1.39 1.13 1.47 169 XMBrknScrpt_02 1619 0.67 1.11 0.54 170 XMBody_78 1599 0.44 1.10 0.25 171 TooManyTo_005 1590 0.88 1.09 0.82 172 XM_H_PHPOS_M 1587 0.40 1.09 0.20 173 XM_H_PHPMailer 1585 0.58 1.09 0.44 174 RELAYCOUNTRY_IN 1581 0.32 1.08 0.10 175 XM_ProductURIs 1541 0.77 1.06 0.69 176 XM_B_COPY_HTML 1535 0.52 1.05 0.36 177 TO_EQ_FM_DOM_HTML_IMG 1526 0.24 1.05 0.00 178 NO_FM_NAME_IP_HOSTN 1503 0.23 1.03 0.00 179 DATE_IN_PAST_06_12 1435 0.26 0.98 0.06 180 REMOVE_BEFORE_LINK 1424 0.47 0.98 0.32 181 XMMoneyMeta_00 1372 0.51 0.94 0.39 182 XMPhish08 1352 0.64 0.93 0.56 183 XM_H_MailChimp 1350 0.31 0.92 0.13 184 MPART_ALT_DIFF_COUNT 1347 0.45 0.92 0.32 185 UNPARSEABLE_RELAY 1329 1.83 0.91 2.09 186 RCVD_IN_MSPIKE_L4 1314 0.46 0.90 0.33 187 XM_UB99 1312 0.20 0.90 0.00 188 XM_SPF_Unknown 1290 0.60 0.88 0.51 189 TR_Mismatch_TLD_01 1245 0.38 0.85 0.24 190 XMSubject_48 1230 0.21 0.84 0.02 191 HK_RANDOM_ENVFROM 1197 0.26 0.82 0.10 192 TR_XM_RelayPhish 1172 0.29 0.80 0.15 193 RELAYCOUNTRY_JP 1157 0.19 0.79 0.02 194 T_TooManySym_02 1144 2.23 0.78 2.64 195 XMPhish30 1140 0.64 0.78 0.60 196 XM_Nigeria_01 1138 0.20 0.78 0.03 197 XMSubMetaSSx_00 1113 0.43 0.76 0.34 198 HTML_FONT_FACE_BAD 1088 1.08 0.75 1.18 199 MISSING_HEADERS 1085 0.53 0.74 0.47 200 XMHTMLBadTable_001 1058 0.53 0.72 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 424848 86.02 95.15 83.41 2 RELAYCOUNTRY_US 392909 77.15 77.21 77.14 3 DKIM_SIGNED 364556 72.81 77.15 71.57 4 XM_DK_Pass 358017 71.30 74.85 70.29 5 DKIM_VALID 340378 66.44 65.10 66.82 6 XM_B_Unicode 339206 68.65 75.81 66.59 7 DCC_CHECK_NEGATIVE 311704 52.23 20.93 61.20 8 BAYES_50 255784 49.61 47.47 50.22 9 DKIM_VALID_AU 254026 49.24 47.04 49.87 10 XMListUnsubscribeExists 252016 52.81 64.42 49.48 11 XM_B_Unicode3 198768 40.58 46.03 39.02 12 DCC_CHECK 188299 45.93 77.18 36.97 13 T_TM2_M_HEADER_IN_MSG 138764 25.00 17.19 27.24 14 DKIM_VALID_EF 130101 25.17 23.86 25.54 15 HTML_FONT_LOW_CONTRAST 128587 26.93 32.81 25.24 16 BAYES_00 128045 20.16 2.80 25.14 17 LOC_TINY_FONT_1 113229 24.51 32.47 22.23 18 MIME_HTML_ONLY 107957 25.05 38.50 21.19 19 XMSubLong 105658 21.85 25.72 20.74 20 FVGT_m_MULTI_ODD 100261 20.49 23.32 19.68 21 ALL_TRUSTED 98558 15.88 3.76 19.35 22 T_KAM_HTML_FONT_INVALID 82413 17.61 22.58 16.18 23 TR_XM_DK_Bayes 76969 12.20 2.06 15.11 24 TR_XM_DK_Bayes1 72719 11.39 1.33 14.28 25 XM_Multi_Part_URI 69132 14.34 17.02 13.57 26 TR_XM_DK_Bayes2 64232 10.07 1.21 12.61 27 XM_Body_Dirty_Words 62173 14.29 21.57 12.21 28 RCVD_IN_MSPIKE_H2 57981 10.85 8.98 11.38 29 RCVD_IN_MSPIKE_H3 51850 8.66 3.37 10.18 30 RCVD_IN_MSPIKE_WL 51850 8.66 3.37 10.18 31 XM_B_Unsub 47841 10.66 15.08 9.39 32 LOTS_OF_MONEY 46716 10.29 14.20 9.17 33 RCVD_IN_RP_SAFE 45978 7.50 2.17 9.03 34 RCVD_IN_RP_CERTIFIED 42457 6.89 1.84 8.34 35 TooManyTo_001 41974 8.01 7.22 8.24 36 XM_Evil_Numbers_Gen 41406 8.83 11.28 8.13 37 ANY_BOUNCE_MESSAGE 38851 6.02 0.41 7.63 38 BOUNCE_MESSAGE 38847 6.02 0.41 7.63 39 TM2_M_URI_OPT_OUT 37886 6.69 4.07 7.44 40 LotsOfNums_01 37765 7.90 9.57 7.41 41 HTML_IMAGE_RATIO_02 37140 8.70 13.62 7.29 42 XM_DK_Undo_02 35472 12.76 32.96 6.96 43 XM_DKIMWhitelistDomains 32784 5.01 0.02 6.44 44 XM_SendGrid 32358 6.17 5.52 6.35 45 XM_B_Phish_Phrases 31344 6.35 7.05 6.15 46 FSL_BULK_SIG 31207 8.27 15.76 6.13 47 XM_H_Long_From01 30297 5.98 6.07 5.95 48 HTML_IMAGE_RATIO_04 29427 5.88 6.25 5.78 49 XMSubMetaSx_00 27807 7.25 13.51 5.46 50 RELAYCOUNTRY_META 27651 8.79 20.54 5.43 51 MIME_QP_LONG_LINE 27231 5.46 5.86 5.35 52 RCVD_IN_IADB_LISTED 27206 4.69 2.41 5.34 53 BAYES_40 26730 4.83 3.37 5.25 54 T_TooManySym_01 26472 4.57 2.36 5.20 55 DKIM_INVALID 24178 6.37 12.05 4.75 56 RCVD_IN_IADB_SPF 23286 4.06 2.27 4.57 57 BAYES_60 22874 5.33 8.27 4.49 58 MPART_ALT_DIFF 22396 5.27 8.31 4.40 59 BAYES_20 22073 3.95 2.60 4.33 60 XM_PDF 21672 3.46 0.67 4.25 61 BOTNET_IPINHOSTNAME 20911 6.02 12.71 4.11 62 XMSexyCombo_05 20561 5.85 12.18 4.04 63 HTML_IMAGE_RATIO_06 20284 3.96 3.87 3.98 64 RCVD_IN_IADB_SENDERID 20240 3.58 2.22 3.97 65 XMStrtUSub 19989 3.74 3.12 3.92 66 RCVD_IN_IADB_DK 19597 3.49 2.23 3.85 67 T_REMOTE_IMAGE 19101 5.15 10.03 3.75 68 IN_ZIMBRA_NJ_WHITELIST 18854 2.88 0.01 3.70 69 RCVD_IN_IADB_VOUCHED 18836 2.98 0.49 3.70 70 BAYES_99 17984 7.36 20.70 3.53 71 BAYES_05 17656 3.03 1.49 3.47 72 HTML_MIME_NO_HTML_TAG 17424 4.50 8.27 3.42 73 TR_XM_DK_SendGrid 17335 3.12 2.11 3.40 74 XMNumbers 16232 3.71 5.52 3.19 75 FROM_EXCESS_BASE64 15518 3.13 3.40 3.05 76 BAYES_999 15233 5.71 15.19 2.99 77 MIME_HTML_ONLY_MULTI 15157 3.21 4.03 2.98 78 XM_UncommonTLD01 14657 4.86 11.76 2.88 79 XM_H_Trusted_IP 14464 2.21 0.00 2.84 80 MAILING_LIST_MULTI 14238 2.48 1.39 2.80 81 T_TooManySym_02 13449 2.23 0.78 2.64 82 BOTNET 12948 6.36 19.70 2.54 83 NO_DNS_FOR_FROM 12817 4.17 9.93 2.52 84 XM_B_Unsub2 12457 2.79 4.01 2.45 85 RCVD_IN_IADB_OPTIN 12422 1.97 0.34 2.44 86 HTML_IMAGE_RATIO_08 12378 2.38 2.22 2.43 87 XM_CamelCaseFrm001 11313 2.72 4.46 2.22 88 TooManyTo_002 11153 2.21 2.29 2.19 89 BAYES_80 11132 3.64 8.74 2.19 90 UNPARSEABLE_RELAY 10669 1.83 0.91 2.09 91 MIME_HTML_MOSTLY 10196 2.67 4.99 2.00 92 TR_DCC_Bayes_99 9912 4.87 15.09 1.95 93 XM_B_SpammyTLD 9185 2.07 3.00 1.80 94 SUBJ_ALL_CAPS 9156 1.83 1.94 1.80 95 KHOP_HELO_FCRDNS 8604 2.31 4.47 1.69 96 TVD_RCVD_IP 8314 1.34 0.32 1.63 97 XMDiploma_00 8193 1.82 2.54 1.61 98 UNTRUSTED_Relay 8191 4.29 13.63 1.61 99 RELAYCOUNTRY_CA 8074 1.99 3.42 1.59 100 T_XMDrugObfuBody_14 8061 1.68 2.03 1.58 101 TR_Symld_Words 7711 1.53 1.57 1.51 102 URI_HEX 7605 1.68 2.34 1.49 103 TooManyTo_003 7539 1.58 1.93 1.48 104 IN_HORDE_ADDRESS_BOOK 7525 1.16 0.04 1.48 105 XM_DK_Undo_01 7473 1.39 1.13 1.47 106 INVALID_MSGID 7446 1.19 0.22 1.46 107 XM_SPF_SoftFail 7393 2.32 5.34 1.45 108 XMGappySubj_01 7388 1.19 0.30 1.45 109 TO_MALFORMED 6879 1.05 0.02 1.35 110 RCVD_IN_MSPIKE_BL 6847 2.11 4.77 1.34 111 XM_OfRef6 6805 1.63 2.67 1.34 112 RELAYCOUNTRY_GB 6781 1.66 2.83 1.33 113 HELO_NODOT 6636 1.14 0.55 1.30 114 HELO_NO_DOMAIN 6629 1.13 0.53 1.30 115 CK_HELO_DYNAMIC_SPLIT_IP 6627 1.03 0.08 1.30 116 HELO_DYNAMIC_IPADDR2 6626 1.02 0.04 1.30 117 TM2_M_VERY_LONG_WORD 6599 1.44 1.96 1.30 118 BAYES_95 6529 1.96 4.34 1.28 119 T_XMDrugObfuBody_08 6437 1.50 2.33 1.26 120 URI_TRY_3LD 6425 1.38 1.79 1.26 121 RCVD_IN_BL_SPAMCOP_NET 6408 1.80 3.69 1.26 122 XMSubNoVowel 6388 1.08 0.45 1.25 123 HTML_FONT_FACE_BAD 5991 1.08 0.75 1.18 124 XMBdyGiftCard01 5828 1.28 1.77 1.14 125 TR_MSPIKEBAYES00 5692 0.89 0.08 1.12 126 DKIM_ADSP_CUSTOM_MED 5456 1.16 1.49 1.07 127 XMCapTrack 5440 0.92 0.39 1.07 128 XM_GoogleGroups 5329 0.90 0.41 1.05 129 TooManyTo_004 5274 1.15 1.53 1.04 130 XM_H_Long_From02 4993 1.07 1.40 0.98 131 XMGenDplmaNmb 4891 1.12 1.66 0.96 132 XMSubMetaI_00 4888 1.12 1.69 0.96 133 USER_IN_DEF_DKIM_WL 4877 0.76 0.08 0.96 134 T_FILL_THIS_FORM_SHORT 4368 0.82 0.67 0.86 135 XM_UB50 4302 2.31 7.42 0.84 136 TooManyTo_005 4193 0.88 1.09 0.82 137 NML_ADSP_CUSTOM_MED 4167 0.92 1.28 0.82 138 T_XMDrugObfuBody_00 4131 1.03 1.78 0.81 139 XMSexyCombo_01 3984 1.66 4.71 0.78 140 XMHTML_After_End 3833 0.95 1.63 0.75 141 RCVD_IN_MSPIKE_L3 3818 1.14 2.50 0.75 142 XMStockSpam_06 3659 0.92 1.64 0.72 143 XM_ProductURIs 3537 0.77 1.06 0.69 144 T_TooManySym_03 3486 0.58 0.22 0.68 145 XMBody_17 3445 0.90 1.68 0.68 146 TM2_M_A_HREF_HREF 3339 0.82 1.42 0.66 147 XMNoVowels 3310 0.66 0.69 0.65 148 HTML_IMAGE_ONLY_20 3124 0.62 0.63 0.61 149 TR_MetaPhish_Combo_01 3110 0.64 0.72 0.61 150 XMPhish30 3077 0.64 0.78 0.60 151 SpammyFromTLD_01 2960 0.94 2.21 0.58 152 FILL_THIS_FORM 2941 0.54 0.43 0.58 153 XMLKML 2941 0.45 0.00 0.58 154 PLING_QUERY 2930 0.58 0.59 0.58 155 FROM_GOV_DKIM_AU 2885 0.50 0.25 0.57 156 XMGappySubj_02 2859 0.45 0.07 0.56 157 XMPhish08 2847 0.64 0.93 0.56 158 T_OBFU_PDF_ATTACH 2831 0.47 0.18 0.56 159 T_Symld_Words_02 2774 0.80 1.71 0.54 160 XMBrknScrpt_02 2759 0.67 1.11 0.54 161 T_XMHurry_00 2754 0.74 1.43 0.54 162 XMBody_95 2701 0.43 0.10 0.53 163 USER_IN_WHITELIST 2659 0.41 0.00 0.52 164 XM_SPF_Unknown 2620 0.60 0.88 0.51 165 XM_DIRTYINTL 2610 1.00 2.71 0.51 166 THIS_AD 2599 0.55 0.68 0.51 167 FORGED_GMAIL_RCVD 2561 0.70 1.37 0.50 168 HTTPS_HTTP_MISMATCH 2554 0.53 0.61 0.50 169 XM_D_tchamptons_WL 2521 0.38 0.00 0.49 170 XM_B_REG_HTML 2428 0.53 0.70 0.48 171 MISSING_HEADERS 2416 0.53 0.74 0.47 172 XMHTMLBadTable_001 2387 0.53 0.72 0.47 173 XMOemUri 2348 0.42 0.26 0.46 174 FILL_THIS_FORM_LONG 2346 0.44 0.37 0.46 175 FROM_GOV_SPOOF 2343 0.40 0.19 0.46 176 TR_XM_PHPDW 2318 0.77 1.86 0.46 177 T_FILL_THIS_FORM_LOAN 2290 0.41 0.28 0.45 178 XMSubMetaSxObfu_03 2264 0.50 0.69 0.44 179 XMSlimDrugH 2256 0.61 1.20 0.44 180 TR_XM_PHPForged 2255 0.75 1.82 0.44 181 TR_XM_FormFill2 2252 0.74 1.80 0.44 182 XM_H_PHPMailer 2242 0.58 1.09 0.44 183 PDS_OTHER_BAD_TLD 2232 0.88 2.42 0.44 184 XM_H_PHPOS 2228 0.74 1.79 0.44 185 XMRcvdHeader_15 2210 0.34 0.00 0.43 186 DIET_1 2189 0.79 2.05 0.43 187 XMPhish14 2181 0.47 0.61 0.43 188 TR_LOTS_OF_MONEY3 2155 0.70 1.66 0.42 189 XM_ShortIntro_01 2136 0.38 0.25 0.42 190 RELAYCOUNTRY_AU 2134 0.40 0.34 0.42 191 HTML_TAG_BALANCE_BODY 2100 0.45 0.59 0.41 192 XMMoneyMeta_00 1996 0.51 0.94 0.39 193 TM2_M_BODY_EMPTY 1980 0.32 0.08 0.39 194 HTML_IMAGE_ONLY_32 1949 0.34 0.19 0.38 195 XMLngstWrd_00 1942 0.38 0.37 0.38 196 XMSubMetaSxObfu_02 1887 0.38 0.39 0.37 197 SUBJ_DOLLARS 1877 0.41 0.54 0.37 198 SHORT_HELO_AND_INLINE_IMAGE 1874 0.29 0.04 0.37 199 RELAYCOUNTRY_DE 1852 0.76 2.12 0.36 200 XM_B_COPY_HTML 1848 0.52 1.05 0.36 ----------------------------------------------------------------------