Email: 394501 Autolearn: 0 AvgScore: 2.96 AvgScanTime: 1.10 sec Spam: 99707 Autolearn: 0 AvgScore: 15.38 AvgScanTime: 0.90 sec Ham: 294794 Autolearn: 0 AvgScore: -1.24 AvgScanTime: 1.16 sec Time Spent Running SA: 120.08 hours Time Spent Processing Spam: 25.02 hours Time Spent Processing Ham: 95.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 95342 98.33 95.62 99.24 2 HTML_MESSAGE 93867 89.26 94.14 87.61 3 XM_B_SpammyWords 75006 58.84 75.23 53.29 4 XM_B_Unicode 62644 71.59 62.83 74.55 5 MIME_HTML_ONLY 57261 31.65 57.43 22.93 6 RCVD_IN_MSPIKE_H2 55319 35.22 55.48 28.37 7 RELAYCOUNTRY_US 53896 75.72 54.05 83.05 8 DKIM_SIGNED 48277 74.47 48.42 83.28 9 RELAYCOUNTRY_META 46198 15.50 46.33 5.07 10 XM_DK_Pass 46032 73.05 46.17 82.15 11 DKIM_VALID 44761 71.38 44.89 80.34 12 XMListUnsubscribeExists 41916 57.45 42.04 62.66 13 BAYES_99 41724 17.67 41.85 9.49 14 RCVD_IN_BL_SPAMCOP_NET 41086 11.71 41.21 1.73 15 RCVD_IN_PSBL 40458 10.29 40.58 0.05 16 HTML_MIME_NO_HTML_TAG 38459 11.08 38.57 1.78 17 XM_B_SpammyWords2 38251 28.98 38.36 25.81 18 XM_Multi_Part_URI 35307 20.98 35.41 16.10 19 DKIM_VALID_AU 32966 56.71 33.06 64.71 20 XM_DK_Undo_02 31877 17.99 31.97 13.26 21 BAYES_999 31526 13.74 31.62 7.69 22 XM_B_Unsub 27968 14.41 28.05 9.80 23 UNTRUSTED_Relay 27045 8.44 27.12 2.13 24 BAYES_50 25956 45.38 26.03 51.93 25 XMSubGiftCard1 22993 5.97 23.06 0.19 26 XM_B_Unicode3 21583 38.58 21.65 44.31 27 LOC_TINY_FONT_1 20613 28.70 20.67 31.42 28 DKIM_VALID_EF 19176 27.00 19.23 29.63 29 BOTNET 17724 6.35 17.78 2.48 30 HTML_FONT_LOW_CONTRAST 16532 28.78 16.58 32.90 31 XMSubLong 16250 19.72 16.30 20.88 32 FVGT_m_MULTI_ODD 15356 21.99 15.40 24.21 33 T_KAM_HTML_FONT_INVALID 15052 18.23 15.10 19.29 34 XM_UncommonTLD01 14540 6.54 14.58 3.82 35 T_TM2_M_HEADER_IN_MSG 13929 21.70 13.97 24.31 36 FROM_EXCESS_BASE64 13456 5.97 13.50 3.42 37 XM_Body_Dirty_Words 12714 14.58 12.75 15.20 38 XMSubGiftCard2 11640 2.96 11.67 0.02 39 XM_S_GiftBonus 11353 2.88 11.39 0.00 40 BAYES_80 10987 6.92 11.02 5.54 41 T_REMOTE_IMAGE 10579 5.28 10.61 3.48 42 LOCALPART_IN_SUBJECT 10537 2.70 10.57 0.03 43 HK_RANDOM_FROM 10205 2.66 10.23 0.09 44 HTML_IMAGE_RATIO_02 9589 9.70 9.62 9.73 45 RELAYCOUNTRY_CA 9398 4.11 9.43 2.31 46 BAYES_60 9255 8.28 9.28 7.94 47 BOTNET_IPINHOSTNAME 9110 7.55 9.14 7.02 48 LOTS_OF_MONEY 8648 8.00 8.67 7.77 49 KHOP_HELO_FCRDNS 8163 2.71 8.19 0.85 50 XMSexyCombo_05 8128 5.69 8.15 4.85 51 RELAYCOUNTRY_GB 8065 2.51 8.09 0.62 52 RCVD_IN_MSPIKE_BL 7905 3.16 7.93 1.55 53 XM_UB99 7858 2.00 7.88 0.01 54 XM_B_SpammyWords3 7675 8.65 7.70 8.97 55 HTML_IMAGE_ONLY_24 7559 2.11 7.58 0.26 56 XM_UB50 7503 2.64 7.53 0.98 57 BAYES_95 7362 4.49 7.38 3.51 58 XM_Combo_Sbj 7106 1.97 7.13 0.23 59 MPART_ALT_DIFF 6825 5.18 6.85 4.61 60 XMSubMetaSx_00 6687 5.13 6.71 4.59 61 SpammyFromTLD_02 6523 1.83 6.54 0.23 62 MIME_HTML_MOSTLY 6487 3.74 6.51 2.80 63 RCVD_IN_MSPIKE_WL 6313 24.88 6.33 31.15 64 XM_B_Phish_Phrases 6309 6.77 6.33 6.92 65 XM_Evil_Numbers_Gen 6000 8.91 6.02 9.89 66 HTML_IMAGE_RATIO_06 5990 3.91 6.01 3.19 67 RCVD_IN_RP_RNBL 5536 1.44 5.55 0.05 68 XM_UB999 5524 1.40 5.54 0.01 69 BOTNET_NORDNS 5343 1.36 5.36 0.01 70 RELAYCOUNTRY_IN 5167 1.37 5.18 0.08 71 URI_PHP_REDIR 5024 1.30 5.04 0.04 72 SpammyFromTLD_01 4979 1.79 4.99 0.71 73 LotsOfNums_01 4643 8.86 4.66 10.29 74 XM_DIRTYINTL 4610 1.67 4.62 0.67 75 SHORTENED_URL_HREF 4542 1.35 4.56 0.27 76 BODY_URI_ONLY 4365 1.14 4.38 0.04 77 HTML_IMAGE_RATIO_04 4332 5.41 4.34 5.77 78 FROM_LOCAL_NOVOWEL 4306 1.12 4.32 0.04 79 RCVD_IN_MSPIKE_L3 4302 1.95 4.31 1.15 80 SHORT_URI_3 4070 1.11 4.08 0.11 81 SHORT_SHORTNER 4056 1.05 4.07 0.03 82 XM_H_Long_From01 4044 5.67 4.06 6.21 83 XMBody_17 4040 2.28 4.05 1.67 84 HTML_IMAGE_ONLY_28 4038 1.18 4.05 0.20 85 UNPARSEABLE_RELAY 3917 8.07 3.93 9.47 86 HTML_SHORT_LINK_IMG_1 3910 1.01 3.92 0.02 87 HTML_IMAGE_ONLY_08 3885 1.05 3.90 0.09 88 SHORTENED_URL_SRC 3834 0.97 3.85 0.00 89 SHORTENER_SHORT_IMG 3822 0.97 3.83 0.00 90 XM_BadFromFormat 3673 1.06 3.68 0.18 91 RCVD_IN_MSPIKE_H3 3592 13.89 3.60 17.37 92 XM_UB80 3528 0.92 3.54 0.03 93 DKIM_INVALID 3516 3.09 3.53 2.94 94 XM_UB60 3441 0.96 3.45 0.11 95 RELAYCOUNTRY_FR 3412 1.03 3.42 0.23 96 TooManyTo_001 3410 5.78 3.42 6.58 97 XM_SPF_SoftFail 3404 1.76 3.41 1.20 98 XMStrtUSub 3403 4.45 3.41 4.80 99 XM_OfRef6 3358 1.69 3.37 1.12 100 FVGT_m_MULTI_ODD_EMAIL 3271 0.85 3.28 0.03 101 RCVD_IN_MSPIKE_L5 3208 1.05 3.22 0.32 102 HTML_FONT_TINY_NORDNS 3067 0.88 3.08 0.14 103 URIBL_SBL_A 2948 1.11 2.96 0.48 104 XM_B_SpammyTLD 2845 2.24 2.85 2.03 105 TR_Mismatch_TLD_01 2779 0.91 2.79 0.28 106 XMNumbers 2771 3.91 2.78 4.29 107 XM_CamelCaseFrm001 2758 2.52 2.77 2.43 108 T_XMDrugObfuBody_14 2752 2.24 2.76 2.07 109 XM_UB95 2744 0.71 2.75 0.02 110 TR_XM_PhishingBody 2666 2.67 2.67 2.67 111 TR_XM_UnparsRelay 2657 1.08 2.66 0.54 112 RCVD_IN_MSPIKE_H4 2591 9.57 2.60 11.93 113 XM_SendGrid 2578 6.70 2.59 8.10 114 LH_URI_DOM_IN_PATH 2438 1.97 2.45 1.81 115 TR_XM_MaxBayes 2426 0.67 2.43 0.07 116 DIET_1 2384 1.07 2.39 0.62 117 RELAYCOUNTRY_JP 2279 0.59 2.29 0.02 118 RELAYCOUNTRY_AE 2273 0.58 2.28 0.00 119 XMSexyCombo_01 2271 1.13 2.28 0.75 120 URI_HEX 2190 1.77 2.20 1.63 121 XM_B_COVIDMETA 2153 1.75 2.16 1.61 122 TR_XM_PHPDW 2054 0.82 2.06 0.40 123 TR_XM_PHPForged 2020 0.80 2.03 0.38 124 TR_XM_FormFill2 2004 0.79 2.01 0.38 125 XM_H_PHPOS 2002 0.79 2.01 0.37 126 RELAYCOUNTRY_IE 1999 0.61 2.00 0.14 127 RELAYCOUNTRY_KR 1971 0.50 1.98 0.01 128 RELAYCOUNTRY_HK 1868 0.49 1.87 0.03 129 XMSlimDrugH 1863 0.85 1.87 0.51 130 FROM_SUSPICIOUS_NTLD 1855 0.57 1.86 0.14 131 T_PDS_OTHER_BAD_TLD 1821 0.99 1.83 0.71 132 FROM_SUSPICIOUS_NTLD_FP 1818 0.56 1.82 0.13 133 TR_XM_MaxSPIKE 1785 0.56 1.79 0.14 134 RELAYCOUNTRY_AU 1755 0.63 1.76 0.25 135 TO_NAME_SUBJ_NO_RDNS 1716 0.43 1.72 0.00 136 T_XMDrugObfuBody_08 1711 1.82 1.72 1.86 137 XMBrknScrpt_02 1705 1.72 1.71 1.72 138 HK_RANDOM_REPLYTO 1677 0.68 1.68 0.34 139 TM2_M_URI_OPT_OUT 1599 3.47 1.60 4.10 140 XMHTML_After_End 1568 0.97 1.57 0.76 141 XMWghtMeta_00 1547 0.47 1.55 0.11 142 HTML_IMAGE_RATIO_08 1528 1.92 1.53 2.05 143 DATE_IN_PAST_03_06 1495 0.47 1.50 0.12 144 TR_XM_COVIDMETA4 1475 0.83 1.48 0.61 145 T_XMDrugObfuBody_00 1470 0.91 1.47 0.72 146 TR_XM_DK_SendGrid 1470 4.18 1.47 5.09 147 XM_B_Phish66 1462 1.23 1.47 1.14 148 DKIM_ADSP_CUSTOM_MED 1460 1.12 1.46 1.00 149 BAYES_40 1455 3.06 1.46 3.60 150 RELAYCOUNTRY_NL 1448 0.56 1.45 0.25 151 TM2_M_VERY_LONG_WORD 1437 1.52 1.44 1.55 152 TR_XM_INV_DKIM 1426 0.49 1.43 0.18 153 NML_ADSP_CUSTOM_MED 1423 0.83 1.43 0.63 154 RELAYCOUNTRY_SG 1411 0.41 1.42 0.08 155 BAYES_20 1409 2.44 1.41 2.78 156 XMSexyCombo_04 1346 0.51 1.35 0.23 157 FORGED_GMAIL_RCVD 1323 0.75 1.33 0.55 158 TR_XM_RelayPhish 1288 0.44 1.29 0.15 159 TR_XM_SB_Phish 1269 1.53 1.27 1.62 160 RCVD_IN_IADB_LISTED 1257 3.36 1.26 4.07 161 URI_TRY_3LD 1249 1.88 1.25 2.09 162 TR_Mismatch_TLD_02 1249 0.43 1.25 0.16 163 XMSubPhish11 1230 1.51 1.23 1.61 164 T_TooManySym_01 1212 4.66 1.22 5.83 165 MIME_CHARSET_FARAWAY 1176 0.36 1.18 0.08 166 XMDiploma_00 1174 1.57 1.18 1.70 167 XM_URI_RBL 1171 0.43 1.17 0.18 168 DKIM_ADSP_NXDOMAIN 1124 0.89 1.13 0.80 169 SUBJECT_DIET 1096 0.29 1.10 0.01 170 SUBJ_ALL_CAPS 1077 1.41 1.08 1.52 171 XMSubNoVowel 1068 0.41 1.07 0.18 172 RDNS_DYNAMIC 1051 0.83 1.05 0.76 173 XMGppyBdWords 1045 0.42 1.05 0.21 174 CHARSET_FARAWAY_HEADER 1042 0.28 1.05 0.02 175 XMStockSpam_06 1030 1.02 1.03 1.01 176 NO_DNS_FOR_FROM 1003 0.81 1.01 0.75 177 XM_B_Unsub2 1000 1.25 1.00 1.34 178 ALL_TRUSTED 987 9.54 0.99 12.44 179 RCVD_IN_IADB_SPF 972 2.88 0.97 3.53 180 MIME_HTML_ONLY_MULTI 971 2.25 0.97 2.68 181 TR_LOTS_OF_MONEY3 957 0.77 0.96 0.71 182 XM_B_SpammyWords4 937 0.77 0.94 0.71 183 RELAYCOUNTRY_DE 935 0.47 0.94 0.31 184 RCVD_IN_IADB_VOUCHED 933 2.06 0.94 2.44 185 INVESTMENT_ADVICE 927 0.34 0.93 0.14 186 XMGenDplmaNmb 915 0.95 0.92 0.97 187 LongTLD 895 0.33 0.90 0.13 188 T_FILL_THIS_FORM_SHORT 842 0.64 0.84 0.58 189 DATE_IN_PAST_06_12 834 0.27 0.84 0.08 190 BAYES_05 829 1.59 0.83 1.84 191 T_XMHurry_00 824 0.99 0.83 1.04 192 RCVD_IN_IADB_SENDERID 821 2.56 0.82 3.14 193 RCVD_IN_IADB_DK 801 2.49 0.80 3.06 194 XM_XX_Yahoo 784 0.31 0.79 0.15 195 DRUGS_ERECTILE 769 0.23 0.77 0.05 196 MIME_QP_LONG_LINE 738 3.49 0.74 4.42 197 MAILING_LIST_MULTI 737 1.63 0.74 1.93 198 SUBJ_BUY 729 0.23 0.73 0.07 199 BAYES_00 727 10.17 0.73 13.36 200 PDS_FROM_2_EMAILS 717 0.19 0.72 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 292561 98.33 95.62 99.24 2 HTML_MESSAGE 258274 89.26 94.14 87.61 3 DKIM_SIGNED 245505 74.47 48.42 83.28 4 RELAYCOUNTRY_US 244826 75.72 54.05 83.05 5 XM_DK_Pass 242160 73.05 46.17 82.15 6 DKIM_VALID 236832 71.38 44.89 80.34 7 XM_B_Unicode 219780 71.59 62.83 74.55 8 DKIM_VALID_AU 190758 56.71 33.06 64.71 9 XMListUnsubscribeExists 184708 57.45 42.04 62.66 10 XM_B_SpammyWords 157101 58.84 75.23 53.29 11 BAYES_50 153088 45.38 26.03 51.93 12 XM_B_Unicode3 130615 38.58 21.65 44.31 13 HTML_FONT_LOW_CONTRAST 96990 28.78 16.58 32.90 14 LOC_TINY_FONT_1 92615 28.70 20.67 31.42 15 RCVD_IN_MSPIKE_WL 91822 24.88 6.33 31.15 16 DKIM_VALID_EF 87352 27.00 19.23 29.63 17 RCVD_IN_MSPIKE_H2 83632 35.22 55.48 28.37 18 XM_B_SpammyWords2 76079 28.98 38.36 25.81 19 T_TM2_M_HEADER_IN_MSG 71678 21.70 13.97 24.31 20 FVGT_m_MULTI_ODD 71376 21.99 15.40 24.21 21 MIME_HTML_ONLY 67606 31.65 57.43 22.93 22 XMSubLong 61544 19.72 16.30 20.88 23 T_KAM_HTML_FONT_INVALID 56854 18.23 15.10 19.29 24 RCVD_IN_MSPIKE_H3 51220 13.89 3.60 17.37 25 XM_Multi_Part_URI 47455 20.98 35.41 16.10 26 XM_Body_Dirty_Words 44823 14.58 12.75 15.20 27 BAYES_00 39393 10.17 0.73 13.36 28 XM_DK_Undo_02 39097 17.99 31.97 13.26 29 ALL_TRUSTED 36659 9.54 0.99 12.44 30 RCVD_IN_MSPIKE_H4 35158 9.57 2.60 11.93 31 RCVD_IN_RP_SAFE 32332 8.32 0.48 10.97 32 RCVD_IN_RP_CERTIFIED 30948 7.92 0.30 10.50 33 LotsOfNums_01 30320 8.86 4.66 10.29 34 TR_XM_DK_Bayes 29667 7.55 0.14 10.06 35 XM_DKIMWhitelistDomains 29196 7.40 0.00 9.90 36 TR_XM_DK_Bayes1 29150 7.42 0.13 9.89 37 XM_Evil_Numbers_Gen 29141 8.91 6.02 9.89 38 XM_B_Unsub 28878 14.41 28.05 9.80 39 HTML_IMAGE_RATIO_02 28677 9.70 9.62 9.73 40 BAYES_99 27989 17.67 41.85 9.49 41 UNPARSEABLE_RELAY 27929 8.07 3.93 9.47 42 TR_XM_DK_Bayes2 27183 6.92 0.11 9.22 43 XM_B_SpammyWords3 26452 8.65 7.70 8.97 44 XM_SendGrid 23873 6.70 2.59 8.10 45 BAYES_60 23412 8.28 9.28 7.94 46 LOTS_OF_MONEY 22897 8.00 8.67 7.77 47 BAYES_999 22679 13.74 31.62 7.69 48 BOTNET_IPINHOSTNAME 20687 7.55 9.14 7.02 49 XM_B_Phish_Phrases 20398 6.77 6.33 6.92 50 TooManyTo_001 19398 5.78 3.42 6.58 51 XM_H_Long_From01 18316 5.67 4.06 6.21 52 T_TooManySym_01 17180 4.66 1.22 5.83 53 HTML_IMAGE_RATIO_04 17019 5.41 4.34 5.77 54 BAYES_80 16329 6.92 11.02 5.54 55 TR_XM_DK_SendGrid 15001 4.18 1.47 5.09 56 RELAYCOUNTRY_META 14945 15.50 46.33 5.07 57 XMSexyCombo_05 14311 5.69 8.15 4.85 58 XMStrtUSub 14154 4.45 3.41 4.80 59 MPART_ALT_DIFF 13591 5.18 6.85 4.61 60 XMSubMetaSx_00 13536 5.13 6.71 4.59 61 IN_ZIMBRA_NJ_WHITELIST 13096 3.33 0.03 4.44 62 MIME_QP_LONG_LINE 13020 3.49 0.74 4.42 63 XMNumbers 12645 3.91 2.78 4.29 64 TM2_M_URI_OPT_OUT 12095 3.47 1.60 4.10 65 RCVD_IN_IADB_LISTED 11993 3.36 1.26 4.07 66 XM_UncommonTLD01 11250 6.54 14.58 3.82 67 BAYES_40 10600 3.06 1.46 3.60 68 RCVD_IN_IADB_SPF 10395 2.88 0.97 3.53 69 BAYES_95 10358 4.49 7.38 3.51 70 T_REMOTE_IMAGE 10251 5.28 10.61 3.48 71 FROM_EXCESS_BASE64 10088 5.97 13.50 3.42 72 HTML_IMAGE_RATIO_06 9418 3.91 6.01 3.19 73 ANY_BOUNCE_MESSAGE 9392 2.45 0.28 3.19 74 BOUNCE_MESSAGE 9391 2.45 0.28 3.19 75 RCVD_IN_IADB_SENDERID 9267 2.56 0.82 3.14 76 T_TooManySym_02 9102 2.39 0.32 3.09 77 RCVD_IN_IADB_DK 9019 2.49 0.80 3.06 78 DKIM_INVALID 8673 3.09 3.53 2.94 79 MIME_HTML_MOSTLY 8252 3.74 6.51 2.80 80 BAYES_20 8198 2.44 1.41 2.78 81 TVD_RCVD_IP 8177 2.16 0.35 2.77 82 MIME_HTML_ONLY_MULTI 7907 2.25 0.97 2.68 83 TR_XM_PhishingBody 7870 2.67 2.67 2.67 84 BOTNET 7312 6.35 17.78 2.48 85 RCVD_IN_IADB_VOUCHED 7194 2.06 0.94 2.44 86 XM_CamelCaseFrm001 7176 2.52 2.77 2.43 87 INVALID_MSGID 7033 1.95 0.67 2.39 88 HELO_MISC_IP 7018 1.91 0.51 2.38 89 CK_HELO_DYNAMIC_SPLIT_IP 7017 1.92 0.56 2.38 90 RELAYCOUNTRY_CA 6824 4.11 9.43 2.31 91 XM_PDF 6342 1.70 0.36 2.15 92 UNTRUSTED_Relay 6269 8.44 27.12 2.13 93 URI_TRY_3LD 6165 1.88 1.25 2.09 94 TO_MALFORMED 6095 1.55 0.01 2.07 95 T_XMDrugObfuBody_14 6088 2.24 2.76 2.07 96 HTML_IMAGE_RATIO_08 6048 1.92 1.53 2.05 97 XM_B_SpammyTLD 5995 2.24 2.85 2.03 98 URI_NOVOWEL 5817 1.60 0.50 1.97 99 MAILING_LIST_MULTI 5703 1.63 0.74 1.93 100 TR_Symld_Words 5622 1.57 0.59 1.91 101 T_XMDrugObfuBody_08 5472 1.82 1.72 1.86 102 RCVD_IN_MSPIKE_H5 5444 1.41 0.13 1.85 103 BAYES_05 5425 1.59 0.83 1.84 104 LH_URI_DOM_IN_PATH 5324 1.97 2.45 1.81 105 HTML_MIME_NO_HTML_TAG 5236 11.08 38.57 1.78 106 RCVD_IN_BL_SPAMCOP_NET 5101 11.71 41.21 1.73 107 XMBrknScrpt_02 5081 1.72 1.71 1.72 108 XMDiploma_00 5009 1.57 1.18 1.70 109 XMBody_17 4936 2.28 4.05 1.67 110 XMGappySubj_01 4836 1.24 0.06 1.64 111 USER_IN_DEF_DKIM_WL 4827 1.22 0.01 1.64 112 URI_HEX 4802 1.77 2.20 1.63 113 TR_XM_SB_Phish 4785 1.53 1.27 1.62 114 RCVD_IN_IADB_OPTIN 4752 1.38 0.71 1.61 115 XMSubPhish11 4743 1.51 1.23 1.61 116 IN_HORDE_ADDRESS_BOOK 4741 1.23 0.13 1.61 117 XM_B_COVIDMETA 4740 1.75 2.16 1.61 118 XM_DK_Undo_01 4634 1.29 0.47 1.57 119 TM2_M_VERY_LONG_WORD 4564 1.52 1.44 1.55 120 RCVD_IN_MSPIKE_BL 4558 3.16 7.93 1.55 121 XMBdyGiftCard01 4500 1.26 0.47 1.53 122 SUBJ_ALL_CAPS 4494 1.41 1.08 1.52 123 XM_B_Unsub2 3945 1.25 1.00 1.34 124 T_TooManySym_03 3902 1.01 0.08 1.32 125 XM_SPF_SoftFail 3529 1.76 3.41 1.20 126 TR_MSPIKEBAYES00 3526 0.89 0.00 1.20 127 RCVD_IN_MSPIKE_L3 3403 1.95 4.31 1.15 128 XM_GoogleGroups 3376 0.91 0.23 1.15 129 XM_B_Phish66 3374 1.23 1.47 1.14 130 XM_H_Long_From02 3313 0.93 0.36 1.12 131 XM_OfRef6 3300 1.69 3.37 1.12 132 TooManyTo_002 3262 0.92 0.39 1.11 133 XMBody_95 3155 0.81 0.06 1.07 134 T_XMHurry_00 3069 0.99 0.83 1.04 135 XMStockSpam_06 2991 1.02 1.03 1.01 136 XM_ProductURIs 2948 0.86 0.43 1.00 137 DKIM_ADSP_CUSTOM_MED 2940 1.12 1.46 1.00 138 XM_UB50 2901 2.64 7.53 0.98 139 XMGenDplmaNmb 2848 0.95 0.92 0.97 140 SUBJ_DOLLARS 2839 0.84 0.48 0.96 141 KHOP_HELO_FCRDNS 2516 2.71 8.19 0.85 142 HTML_FONT_FACE_BAD 2499 0.69 0.24 0.85 143 T_TooManySym_04 2412 0.62 0.02 0.82 144 TooManyTo_003 2409 0.68 0.28 0.82 145 DKIM_ADSP_NXDOMAIN 2370 0.89 1.13 0.80 146 HTML_TAG_BALANCE_BODY 2353 0.71 0.43 0.80 147 XMHTMLBadTable_001 2346 0.67 0.29 0.80 148 XMHTML_After_End 2254 0.97 1.57 0.76 149 XM_S_SubURI 2234 0.57 0.03 0.76 150 RDNS_DYNAMIC 2233 0.83 1.05 0.76 151 XM_B_REG_HTML 2219 0.58 0.05 0.75 152 NO_DNS_FOR_FROM 2212 0.81 1.01 0.75 153 XMSexyCombo_01 2198 1.13 2.28 0.75 154 T_XMDrugObfuBody_00 2137 0.91 1.47 0.72 155 T_PDS_OTHER_BAD_TLD 2101 0.99 1.83 0.71 156 XM_B_SpammyWords4 2098 0.77 0.94 0.71 157 TR_LOTS_OF_MONEY3 2098 0.77 0.96 0.71 158 SpammyFromTLD_01 2086 1.79 4.99 0.71 159 PLING_QUERY 2086 0.67 0.57 0.71 160 TR_BOTNET_NEGATE 2064 0.65 0.50 0.70 161 USER_IN_WHITELIST 1989 0.50 0.00 0.67 162 USER_IN_WELCOMELIST 1989 0.50 0.00 0.67 163 XM_DIRTYINTL 1981 1.67 4.62 0.67 164 T_TooManySym_05 1905 0.48 0.01 0.65 165 XMPhish30 1861 0.61 0.53 0.63 166 T_Symld_Words_02 1860 0.62 0.58 0.63 167 TR_MetaPhish_Combo_01 1858 0.61 0.56 0.63 168 NML_ADSP_CUSTOM_MED 1857 0.83 1.43 0.63 169 RELAYCOUNTRY_GB 1834 2.51 8.09 0.62 170 DIET_1 1828 1.07 2.39 0.62 171 HTTPS_HTTP_MISMATCH 1822 0.53 0.27 0.62 172 TR_XM_COVIDMETA4 1802 0.83 1.48 0.61 173 TooManyTo_004 1794 0.52 0.25 0.61 174 XMSubMetaI_00 1744 0.57 0.49 0.59 175 T_FILL_THIS_FORM_SHORT 1697 0.64 0.84 0.58 176 NUMERIC_HTTP_ADDR 1668 0.53 0.43 0.57 177 XM_ShortIntro_01 1639 0.48 0.25 0.56 178 FORGED_GMAIL_RCVD 1626 0.75 1.33 0.55 179 XMBody_78 1626 0.55 0.53 0.55 180 XMPhish08 1612 0.51 0.41 0.55 181 HELO_NODOT 1594 0.53 0.51 0.54 182 HELO_NO_DOMAIN 1593 0.53 0.51 0.54 183 THIS_AD 1591 0.47 0.25 0.54 184 TR_XM_UnparsRelay 1589 1.08 2.66 0.54 185 TooManyTo_005 1557 0.45 0.22 0.53 186 XM_B_COPY_HTML 1542 0.51 0.46 0.52 187 XM_RXBody 1540 0.45 0.24 0.52 188 XMSlimDrugH 1505 0.85 1.87 0.51 189 MPART_ALT_DIFF_COUNT 1449 0.51 0.58 0.49 190 TM2_M_A_HREF_HREF 1435 0.51 0.60 0.49 191 XMSubMetaSxObfu_03 1427 0.52 0.61 0.48 192 URIBL_SBL_A 1425 1.11 2.96 0.48 193 XMSubMetaSxObfu_02 1391 0.48 0.50 0.47 194 XMSolicitRefs_0 1376 0.40 0.18 0.47 195 XMLngstWrd_00 1362 0.39 0.18 0.46 196 XM_H_PHPMailer 1310 0.51 0.71 0.44 197 XMMoneyMeta_00 1272 0.42 0.39 0.43 198 XM_D_tchamptons_WL 1267 0.32 0.00 0.43 199 BODY_ENHANCEMENT 1263 0.32 0.00 0.43 200 XMLngstWrd_01 1224 0.35 0.16 0.42 ----------------------------------------------------------------------