Email: 649887 Autolearn: 0 AvgScore: 3.35 AvgScanTime: 1.48 sec Spam: 196789 Autolearn: 0 AvgScore: 13.27 AvgScanTime: 1.65 sec Ham: 453098 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.40 sec Time Spent Running SA: 266.89 hours Time Spent Processing Spam: 90.22 hours Time Spent Processing Ham: 176.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 188840 79.14 95.96 71.84 2 DKIM_SIGNED 172584 69.14 87.70 61.09 3 XM_DK_Pass 169416 67.58 86.09 59.53 4 DKIM_VALID 167367 66.71 85.05 58.74 5 RELAYCOUNTRY_US 156166 69.81 79.36 65.66 6 XM_B_Unicode 144139 63.17 73.25 58.79 7 DKIM_VALID_AU 131372 52.60 66.76 46.46 8 DCC_CHECK 130546 40.19 66.34 28.84 9 XMListUnsubscribeExists 128930 47.48 65.52 39.64 10 XM_B_SpammyWords 126312 45.85 64.19 37.89 11 BAYES_50 86276 52.59 43.84 56.39 12 RCVD_IN_MSPIKE_H2 84608 35.20 42.99 31.82 13 XM_DK_Undo_02 77050 15.69 39.15 5.50 14 XM_B_Unicode3 77026 35.31 39.14 33.64 15 XM_B_SpammyWords2 75679 22.88 38.46 16.11 16 LOC_TINY_FONT_1 66882 24.58 33.99 20.49 17 DCC_CHECK_NEGATIVE 66212 59.77 33.65 71.11 18 FVGT_m_MULTI_ODD 64833 24.73 32.95 21.16 19 TR_XM_DKIM_Undo 62854 12.24 31.94 3.68 20 HTML_FONT_LOW_CONTRAST 60378 25.52 30.68 23.28 21 DKIM_VALID_EF 58988 25.13 29.98 23.03 22 BAYES_99 57268 11.73 29.10 4.19 23 MIME_HTML_ONLY 56894 19.76 28.91 15.79 24 T_KAM_HTML_FONT_INVALID 55303 19.51 28.10 15.78 25 T_TM2_M_HEADER_IN_MSG 53793 25.73 27.34 25.03 26 LOTS_OF_MONEY 45388 10.90 23.06 5.62 27 BAYES_999 44616 9.13 22.67 3.25 28 TR_DCC_Bayes_99 42416 7.80 21.55 1.82 29 RELAYCOUNTRY_META 39806 8.18 20.23 2.94 30 XMSubLong 39045 18.85 19.84 18.41 31 XM_Body_Dirty_Words 38655 12.24 19.64 9.02 32 XM_Multi_Part_URI 33360 12.88 16.95 11.10 33 RCVD_IN_MSPIKE_WL 30331 14.82 15.41 14.56 34 URIBL_DBL_SPAM 28421 4.44 14.44 0.10 35 TR_XM_SpammyRelay 25976 4.94 13.20 1.35 36 XM_B_Unsub 25889 8.85 13.16 6.98 37 RCVD_IN_MSPIKE_H3 25280 10.35 12.85 9.26 38 TR_XM_BayesUnsub 25077 7.88 12.74 5.77 39 BOTNET_IPINHOSTNAME 24901 6.61 12.65 3.99 40 XM_B_SpammyWords3 24578 6.84 12.49 4.39 41 XM_B_Crypto 23637 4.14 12.01 0.72 42 TR_XM_SpammyWords4 22198 5.70 11.28 3.27 43 BAYES_60 22128 8.78 11.24 7.71 44 TR_XM_SpammyWords2 21054 3.85 10.70 0.88 45 UNPARSEABLE_RELAY 20061 8.23 10.19 7.38 46 RCVD_IN_BL_SPAMCOP_NET 17632 3.01 8.96 0.43 47 XMSexyCombo_05 17536 4.37 8.91 2.40 48 BOTNET 17518 3.68 8.90 1.42 49 RELAYCOUNTRY_CA 16859 3.17 8.57 0.83 50 XM_Evil_Numbers_Gen 16796 7.28 8.54 6.73 51 FSL_BULK_SIG 16438 4.84 8.35 3.31 52 UNTRUSTED_Relay 16319 3.31 8.29 1.15 53 MPART_ALT_DIFF 16267 5.28 8.27 3.98 54 BAYES_80 15624 4.94 7.94 3.63 55 MIME_HEADER_CTYPE_ONLY 15214 2.70 7.73 0.51 56 XM_UncommonTLD01 15085 4.39 7.67 2.97 57 LotsOfNums_01 13765 7.04 6.99 7.06 58 TR_XM_PhishingBody 13172 3.95 6.69 2.76 59 TR_XM_UnparsRelay 12582 3.01 6.39 1.54 60 TR_XM_SPAMCOP 12519 2.10 6.36 0.24 61 MY_SERVERS_FOUND 12057 2.09 6.13 0.34 62 HTML_IMAGE_RATIO_02 12022 5.48 6.11 5.21 63 XM_B_Phish_Phrases 11474 4.11 5.83 3.36 64 XM_SendGrid 11319 5.11 5.75 4.84 65 MIME_HTML_ONLY_MULTI 10760 3.25 5.47 2.29 66 XMSubMetaSx_00 10292 3.51 5.23 2.76 67 TM2_M_VERY_LONG_WORD 10198 2.24 5.18 0.96 68 XM_UB50 9954 2.07 5.06 0.77 69 XM_H_Long_From01 9805 4.79 4.98 4.70 70 XM_B_SpammyTLD 9312 2.72 4.73 1.85 71 XM_SPF_SoftFail 9027 3.09 4.59 2.45 72 BAYES_95 9005 3.09 4.58 2.44 73 XM_B_Investor 8902 2.27 4.52 1.29 74 XM_B_Phish66 8392 2.40 4.26 1.59 75 ANY_BOUNCE_MESSAGE 7999 14.51 4.06 19.04 76 BOUNCE_MESSAGE 7999 14.51 4.06 19.04 77 HTML_IMAGE_RATIO_04 7958 4.13 4.04 4.16 78 HTML_MIME_NO_HTML_TAG 7892 2.34 4.01 1.62 79 RCVD_IN_MSPIKE_BL 7886 1.53 4.01 0.46 80 MIME_HTML_MOSTLY 7866 2.52 4.00 1.88 81 TR_XM_DK_SendGrid 7737 3.46 3.93 3.25 82 TR_XM_NoHeaderRelay 7623 1.29 3.87 0.17 83 TooManyTo_001 7588 5.81 3.86 6.66 84 TR_XM_MSPIKECOMBO 7560 1.47 3.84 0.44 85 T_XMDrugObfuBody_08 7511 1.98 3.82 1.19 86 XMBody_17 7443 1.45 3.78 0.43 87 XMNumbers 7321 3.33 3.72 3.15 88 TR_XM_SpammyWords5 7263 1.81 3.69 0.99 89 XMLngstWrd_00 7094 1.44 3.60 0.50 90 XMLngstWrd_01 7041 1.39 3.58 0.45 91 XM_DIRTYINTL 6664 1.18 3.39 0.23 92 SpammyFromTLD_02 6568 1.26 3.34 0.36 93 XM_GoogleGroups 6533 1.68 3.32 0.96 94 T_FILL_THIS_FORM_SHORT 6477 1.52 3.29 0.75 95 TR_XM_SpammyWords3 6439 1.17 3.27 0.26 96 HTML_IMAGE_RATIO_06 6424 3.48 3.26 3.58 97 XM_OfRef6 6324 1.59 3.21 0.88 98 RCVD_IN_VALIDITY_SAFE 6290 3.52 3.20 3.66 99 ALL_TRUSTED 6096 23.23 3.10 31.98 100 XMLngstWrd_02 5968 1.15 3.03 0.34 101 XMLngstWrd_03 5891 1.08 2.99 0.25 102 MIME_QP_LONG_LINE 5771 3.77 2.93 4.13 103 XMStrtUSub 5746 3.96 2.92 4.41 104 HK_RANDOM_REPLYTO 5725 0.94 2.91 0.08 105 RCVD_IN_VALIDITY_CERTIFIED 5662 3.13 2.88 3.24 106 T_XMDrugObfuBody_14 5636 1.70 2.86 1.20 107 XMLngstWrd_04 5632 1.00 2.86 0.19 108 HTML_TITLE_SUBJ_DIFF 5568 0.87 2.83 0.02 109 UPPERCASE_75_100 5488 0.86 2.79 0.02 110 TM2_M_URI_OPT_OUT 5266 13.76 2.68 18.57 111 XM_B_SpammyWords4 5263 1.64 2.67 1.19 112 DKIM_INVALID 5217 2.44 2.65 2.35 113 HELO_NODOT 5131 1.86 2.61 1.53 114 HELO_NO_DOMAIN 5124 1.86 2.60 1.53 115 XM_DK_Undo_01 5104 1.60 2.59 1.17 116 HTML_IMAGE_RATIO_08 4861 2.07 2.47 1.90 117 FROM_EXCESS_BASE64 4848 2.16 2.46 2.03 118 URI_NOVOWEL 4838 1.96 2.46 1.74 119 SpammyFromTLD_01 4833 1.24 2.46 0.71 120 RCVD_IN_MSPIKE_H4 4629 3.72 2.35 4.32 121 MISSING_HEADERS 4569 1.07 2.32 0.53 122 USER_IN_DEF_DKIM_WL 4521 8.26 2.30 10.85 123 TR_XM_Crypto2 4456 0.75 2.26 0.09 124 XM_B_Unsub2 4234 1.68 2.15 1.48 125 TR_LOTS_OF_MONEY1 4190 0.72 2.13 0.11 126 RELAYCOUNTRY_CZ 4171 0.71 2.12 0.10 127 T_REMOTE_IMAGE 4142 2.75 2.10 3.03 128 XMDiploma_00 4035 1.42 2.05 1.15 129 FONT_INVIS_LONG_LINE 4019 0.66 2.04 0.05 130 TR_LOTS_OF_MONEY3 3930 0.87 2.00 0.38 131 TR_XM_FormFill 3845 0.60 1.95 0.01 132 URI_PHP_REDIR 3837 0.59 1.95 0.00 133 XMStockSpam_06 3834 1.33 1.95 1.06 134 PDS_OTHER_BAD_TLD 3772 0.69 1.92 0.16 135 RCVD_IN_MSPIKE_L3 3637 0.82 1.85 0.37 136 RCVD_IN_IADB_LISTED 3636 3.37 1.85 4.04 137 T_TooManySym_01 3592 4.19 1.83 5.22 138 T_XMHurry_00 3578 2.07 1.82 2.17 139 XM_CamelCaseFrm001 3541 1.68 1.80 1.63 140 BOTNET_NORDNS 3522 0.55 1.79 0.01 141 SUBJ_ALL_CAPS 3490 1.42 1.77 1.27 142 XM_ProductURIs 3456 0.85 1.76 0.46 143 TR_XM_SB_Phish 3368 1.71 1.71 1.71 144 XM_B_COVIDMETA 3221 0.85 1.64 0.51 145 XMSexyCombo_01 3221 0.72 1.64 0.32 146 XMSubPhish11 3213 1.67 1.63 1.69 147 RCVD_IN_IADB_SPF 3204 3.00 1.63 3.59 148 LongTLD 3175 0.65 1.61 0.23 149 RCVD_IN_MSPIKE_L5 3021 0.48 1.54 0.03 150 RCVD_IN_IADB_SENDERID 3002 2.71 1.53 3.23 151 RCVD_IN_IADB_DK 2999 2.66 1.52 3.16 152 KHOP_HELO_FCRDNS 2985 1.37 1.52 1.30 153 FROM_SUSPICIOUS_NTLD 2919 0.48 1.48 0.04 154 URI_HEX 2884 1.18 1.47 1.05 155 TR_XM_BayesRelay 2839 0.44 1.44 0.00 156 XM_URI_RBL 2836 0.50 1.44 0.10 157 TR_XM_PHPDW 2823 0.90 1.43 0.67 158 XMBdyGiftCard01 2785 1.00 1.42 0.82 159 MAILING_LIST_MULTI 2781 1.87 1.41 2.07 160 TR_Mismatch_TLD_02 2762 0.47 1.40 0.06 161 TR_XM_PHPForged 2742 0.86 1.39 0.63 162 TR_XM_FormFill2 2701 0.85 1.37 0.63 163 XM_H_PHPOS 2688 0.84 1.37 0.62 164 RELAYCOUNTRY_IN 2686 0.45 1.36 0.05 165 RCVD_IN_VALIDITY_RPBL 2647 0.43 1.35 0.04 166 T_XMDrugObfuBody_00 2637 0.81 1.34 0.58 167 HTTPS_HTTP_MISMATCH 2625 0.85 1.33 0.64 168 FROM_SUSPICIOUS_NTLD_FP 2616 0.43 1.33 0.04 169 TR_XM_COVIDMETA4 2561 0.47 1.30 0.11 170 RELAYCOUNTRY_AU 2511 0.55 1.28 0.24 171 BAYES_40 2490 3.21 1.27 4.05 172 XM_H_Undi_Recip 2417 0.48 1.23 0.16 173 XMReplyNow 2337 0.50 1.19 0.20 174 URI_TRY_3LD 2321 0.68 1.18 0.46 175 XMHTML_After_End 2314 0.86 1.18 0.72 176 TR_XM_Base64_M1 2192 0.85 1.11 0.74 177 HTML_TAG_BALANCE_BODY 2169 0.72 1.10 0.55 178 HK_RANDOM_FROM 2106 0.44 1.07 0.16 179 XM_UB99 2087 0.32 1.06 0.00 180 XMBrknScrpt_02 2074 0.70 1.05 0.55 181 URIBL_BLACK 2067 0.34 1.05 0.04 182 TR_XM_InvalidRelay 2055 0.33 1.04 0.01 183 RCVD_IN_PSBL 2048 0.54 1.04 0.33 184 XMPhish30 1990 0.62 1.01 0.44 185 TR_XM_COVIDMETA1 1978 0.39 1.01 0.12 186 XMGenDplmaNmb 1951 0.73 0.99 0.62 187 XM_Body_Dirty_Words_01 1933 0.40 0.98 0.15 188 TR_XM_Base64_L1 1927 0.54 0.98 0.35 189 DIET_1 1911 0.50 0.97 0.29 190 TR_XM_MSPIKECOMBO2 1864 0.30 0.95 0.02 191 HTML_FONT_TINY_NORDNS 1837 0.34 0.93 0.08 192 TR_Symld_Words 1831 1.27 0.93 1.42 193 TR_XM_Undi_Recip11 1812 0.30 0.92 0.03 194 XM_B_SEO 1777 0.40 0.90 0.18 195 T_MONEY_PERCENT 1748 0.36 0.89 0.13 196 TR_LOTS_OF_MONEY2 1748 0.36 0.89 0.13 197 BAYES_20 1746 2.75 0.89 3.56 198 XM_Combo_Sbj 1717 0.42 0.87 0.22 199 RELAYCOUNTRY_FR 1683 0.41 0.86 0.22 200 XM_UB60 1673 0.31 0.85 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 325490 79.14 95.96 71.84 2 DCC_CHECK_NEGATIVE 322213 59.77 33.65 71.11 3 RELAYCOUNTRY_US 297491 69.81 79.36 65.66 4 DKIM_SIGNED 276778 69.14 87.70 61.09 5 XM_DK_Pass 269750 67.58 86.09 59.53 6 XM_B_Unicode 266397 63.17 73.25 58.79 7 DKIM_VALID 266148 66.71 85.05 58.74 8 BAYES_50 255502 52.59 43.84 56.39 9 DKIM_VALID_AU 210497 52.60 66.76 46.46 10 XMListUnsubscribeExists 179606 47.48 65.52 39.64 11 XM_B_SpammyWords 171692 45.85 64.19 37.89 12 XM_B_Unicode3 152442 35.31 39.14 33.64 13 ALL_TRUSTED 144880 23.23 3.10 31.98 14 RCVD_IN_MSPIKE_H2 144157 35.20 42.99 31.82 15 DCC_CHECK 130659 40.19 66.34 28.84 16 T_TM2_M_HEADER_IN_MSG 113410 25.73 27.34 25.03 17 HTML_FONT_LOW_CONTRAST 105470 25.52 30.68 23.28 18 DKIM_VALID_EF 104327 25.13 29.98 23.03 19 FVGT_m_MULTI_ODD 95865 24.73 32.95 21.16 20 LOC_TINY_FONT_1 92840 24.58 33.99 20.49 21 ANY_BOUNCE_MESSAGE 86275 14.51 4.06 19.04 22 BOUNCE_MESSAGE 86275 14.51 4.06 19.04 23 TM2_M_URI_OPT_OUT 84127 13.76 2.68 18.57 24 XMSubLong 83428 18.85 19.84 18.41 25 XM_B_SpammyWords2 72989 22.88 38.46 16.11 26 BAYES_00 71637 11.21 0.63 15.81 27 MIME_HTML_ONLY 71555 19.76 28.91 15.79 28 T_KAM_HTML_FONT_INVALID 71512 19.51 28.10 15.78 29 RCVD_IN_MSPIKE_WL 65951 14.82 15.41 14.56 30 XM_Multi_Part_URI 50316 12.88 16.95 11.10 31 USER_IN_DEF_DKIM_WL 49147 8.26 2.30 10.85 32 RCVD_IN_MSPIKE_H3 41971 10.35 12.85 9.26 33 XM_Body_Dirty_Words 40878 12.24 19.64 9.02 34 XM_DKIMWhitelistDomains 35676 5.53 0.13 7.87 35 BAYES_60 34950 8.78 11.24 7.71 36 UNPARSEABLE_RELAY 33453 8.23 10.19 7.38 37 LotsOfNums_01 31982 7.04 6.99 7.06 38 XM_B_Unsub 31611 8.85 13.16 6.98 39 XM_Evil_Numbers_Gen 30486 7.28 8.54 6.73 40 TooManyTo_001 30161 5.81 3.86 6.66 41 TR_XM_BayesUnsub 26143 7.88 12.74 5.77 42 LOTS_OF_MONEY 25473 10.90 23.06 5.62 43 XM_DK_Undo_02 24928 15.69 39.15 5.50 44 T_TooManySym_01 23652 4.19 1.83 5.22 45 HTML_IMAGE_RATIO_02 23588 5.48 6.11 5.21 46 IN_ZIMBRA_NJ_WHITELIST 23399 3.63 0.10 5.16 47 TR_XM_DK_Bayes 22706 3.63 0.44 5.01 48 TR_XM_DK_Bayes1 22325 3.57 0.44 4.93 49 XM_SendGrid 21916 5.11 5.75 4.84 50 XM_H_Long_From01 21293 4.79 4.98 4.70 51 XMStrtUSub 19994 3.96 2.92 4.41 52 XM_B_SpammyWords3 19880 6.84 12.49 4.39 53 TR_XM_DK_Bayes2 19844 3.17 0.40 4.38 54 RCVD_IN_MSPIKE_H4 19569 3.72 2.35 4.32 55 BAYES_99 18981 11.73 29.10 4.19 56 HTML_IMAGE_RATIO_04 18854 4.13 4.04 4.16 57 MIME_QP_LONG_LINE 18709 3.77 2.93 4.13 58 BAYES_40 18368 3.21 1.27 4.05 59 RCVD_IN_IADB_LISTED 18297 3.37 1.85 4.04 60 BOTNET_IPINHOSTNAME 18072 6.61 12.65 3.99 61 MPART_ALT_DIFF 18037 5.28 8.27 3.98 62 XM_PDF 17639 2.87 0.52 3.89 63 TR_XM_DKIM_Undo 16666 12.24 31.94 3.68 64 RCVD_IN_VALIDITY_SAFE 16593 3.52 3.20 3.66 65 BAYES_80 16454 4.94 7.94 3.63 66 RCVD_IN_IADB_SPF 16274 3.00 1.63 3.59 67 HTML_IMAGE_RATIO_06 16201 3.48 3.26 3.58 68 BAYES_20 16120 2.75 0.89 3.56 69 XM_B_Phish_Phrases 15205 4.11 5.83 3.36 70 FSL_BULK_SIG 15007 4.84 8.35 3.31 71 TR_XM_SpammyWords4 14816 5.70 11.28 3.27 72 BAYES_999 14729 9.13 22.67 3.25 73 TR_XM_DK_SendGrid 14720 3.46 3.93 3.25 74 RCVD_IN_VALIDITY_CERTIFIED 14658 3.13 2.88 3.24 75 RCVD_IN_IADB_SENDERID 14630 2.71 1.53 3.23 76 RCVD_IN_IADB_DK 14298 2.66 1.52 3.16 77 XMNumbers 14295 3.33 3.72 3.15 78 T_TooManySym_02 14063 2.34 0.57 3.10 79 T_REMOTE_IMAGE 13750 2.75 2.10 3.03 80 XM_UncommonTLD01 13472 4.39 7.67 2.97 81 RELAYCOUNTRY_META 13325 8.18 20.23 2.94 82 XMSubMetaSx_00 12499 3.51 5.23 2.76 83 TR_XM_PhishingBody 12495 3.95 6.69 2.76 84 XM_SPF_SoftFail 11080 3.09 4.59 2.45 85 BAYES_95 11046 3.09 4.58 2.44 86 RCVD_IN_IADB_VOUCHED 11042 1.95 0.83 2.44 87 XMSexyCombo_05 10892 4.37 8.91 2.40 88 DKIM_INVALID 10630 2.44 2.65 2.35 89 MIME_HTML_ONLY_MULTI 10392 3.25 5.47 2.29 90 BAYES_05 10039 1.70 0.51 2.22 91 T_XMHurry_00 9853 2.07 1.82 2.17 92 MAILING_LIST_MULTI 9393 1.87 1.41 2.07 93 FROM_EXCESS_BASE64 9220 2.16 2.46 2.03 94 HTML_IMAGE_RATIO_08 8604 2.07 2.47 1.90 95 MIME_HTML_MOSTLY 8516 2.52 4.00 1.88 96 XM_B_SpammyTLD 8390 2.72 4.73 1.85 97 TR_DCC_Bayes_99 8261 7.80 21.55 1.82 98 URI_NOVOWEL 7882 1.96 2.46 1.74 99 TooManyTo_002 7873 1.37 0.53 1.74 100 TR_XM_SB_Phish 7753 1.71 1.71 1.71 101 XMSubPhish11 7666 1.67 1.63 1.69 102 HTML_NONELEMENT_30_40 7409 1.14 0.01 1.64 103 XM_CamelCaseFrm001 7406 1.68 1.80 1.63 104 HTML_MIME_NO_HTML_TAG 7325 2.34 4.01 1.62 105 TVD_RCVD_IP 7290 1.20 0.24 1.61 106 RCVD_IN_IADB_OPTIN 7234 1.26 0.47 1.60 107 XM_B_Phish66 7205 2.40 4.26 1.59 108 XM_H_Trusted_IP 7148 1.10 0.00 1.58 109 TR_XM_UnparsRelay 6978 3.01 6.39 1.54 110 HELO_NODOT 6938 1.86 2.61 1.53 111 HELO_NO_DOMAIN 6935 1.86 2.60 1.53 112 IN_HORDE_ADDRESS_BOOK 6880 1.09 0.09 1.52 113 INVALID_MSGID 6732 1.07 0.13 1.49 114 XM_B_Unsub2 6709 1.68 2.15 1.48 115 TR_Symld_Words 6434 1.27 0.93 1.42 116 BOTNET 6424 3.68 8.90 1.42 117 MSGID_NOFQDN1 6161 0.95 0.01 1.36 118 TR_XM_SpammyRelay 6138 4.94 13.20 1.35 119 TO_MALFORMED 5955 0.92 0.02 1.31 120 KHOP_HELO_FCRDNS 5891 1.37 1.52 1.30 121 XM_B_Investor 5850 2.27 4.52 1.29 122 SUBJ_ALL_CAPS 5760 1.42 1.77 1.27 123 T_TooManySym_03 5612 0.93 0.23 1.24 124 T_XMDrugObfuBody_14 5436 1.70 2.86 1.20 125 XM_B_SpammyWords4 5414 1.64 2.67 1.19 126 T_XMDrugObfuBody_08 5373 1.98 3.82 1.19 127 XM_DK_Undo_01 5308 1.60 2.59 1.17 128 TooManyTo_003 5266 0.94 0.44 1.16 129 TVD_SPACE_RATIO 5224 0.83 0.08 1.15 130 UNTRUSTED_Relay 5205 3.31 8.29 1.15 131 XMDiploma_00 5192 1.42 2.05 1.15 132 XM_H_Long_From02 5062 1.00 0.74 1.12 133 XMStockSpam_06 4797 1.33 1.95 1.06 134 URI_HEX 4767 1.18 1.47 1.05 135 XMBSHREFv2 4627 0.80 0.31 1.02 136 XMGappySubj_01 4571 0.77 0.21 1.01 137 HTML_FONT_FACE_BAD 4528 0.89 0.62 1.00 138 TR_XM_SpammyWords5 4501 1.81 3.69 0.99 139 RCVD_IN_MSPIKE_H5 4411 0.74 0.21 0.97 140 XM_GoogleGroups 4358 1.68 3.32 0.96 141 TM2_M_VERY_LONG_WORD 4331 2.24 5.18 0.96 142 XMCapTrack 4190 0.76 0.39 0.92 143 XM_OfRef6 3995 1.59 3.21 0.88 144 TR_XM_SpammyWords2 3990 3.85 10.70 0.88 145 TooManyTo_004 3885 0.72 0.40 0.86 146 RELAYCOUNTRY_CA 3743 3.17 8.57 0.83 147 XMBdyGiftCard01 3701 1.00 1.42 0.82 148 XMSubMetaI_00 3680 0.80 0.76 0.81 149 FROM_GOV_DKIM_AU 3572 0.58 0.09 0.79 150 XM_UB50 3497 2.07 5.06 0.77 151 DKIM_ADSP_CUSTOM_MED 3475 0.75 0.70 0.77 152 XMBody_95 3423 0.67 0.47 0.76 153 T_FILL_THIS_FORM_SHORT 3420 1.52 3.29 0.75 154 TR_XM_Base64_M1 3359 0.85 1.11 0.74 155 RCVD_IN_RP_SAFE 3305 0.70 0.64 0.73 156 XM_B_Crypto 3259 4.14 12.01 0.72 157 XMHTML_After_End 3248 0.86 1.18 0.72 158 SpammyFromTLD_01 3209 1.24 2.46 0.71 159 TooManyTo_005 3140 0.59 0.36 0.69 160 XMSubNoVowel 3091 0.62 0.48 0.68 161 TR_XM_PHPDW 3037 0.90 1.43 0.67 162 RCVD_IN_RP_CERTIFIED 2965 0.63 0.57 0.65 163 FVGT_m_MULTI_ODD_EMAIL 2947 0.49 0.12 0.65 164 HTTPS_HTTP_MISMATCH 2897 0.85 1.33 0.64 165 TR_XM_PHPForged 2836 0.86 1.39 0.63 166 TR_XM_FormFill2 2832 0.85 1.37 0.63 167 T_OBFU_PDF_ATTACH 2828 0.46 0.08 0.62 168 XMGenDplmaNmb 2823 0.73 0.99 0.62 169 XM_H_PHPOS 2803 0.84 1.37 0.62 170 TR_MetaPhish_Combo_01 2696 0.63 0.70 0.60 171 T_XMDrugObfuBody_00 2626 0.81 1.34 0.58 172 XMBrknScrpt_02 2494 0.70 1.05 0.55 173 HTML_TAG_BALANCE_BODY 2480 0.72 1.10 0.55 174 XMMoneyMeta_00 2472 0.56 0.61 0.55 175 XM_H_PHPMailer 2450 0.58 0.68 0.54 176 NML_ADSP_CUSTOM_MED 2440 0.53 0.51 0.54 177 MISSING_HEADERS 2384 1.07 2.32 0.53 178 MIME_HEADER_CTYPE_ONLY 2313 2.70 7.73 0.51 179 XM_B_COVIDMETA 2308 0.85 1.64 0.51 180 XMLngstWrd_00 2282 1.44 3.60 0.50 181 XMNoVowels 2231 0.45 0.36 0.49 182 XM_B_COPY_HTML 2222 0.54 0.67 0.49 183 XM_ShortIntro_01 2114 0.46 0.44 0.47 184 FORGED_GMAIL_RCVD 2104 0.50 0.59 0.46 185 RCVD_IN_MSPIKE_BL 2079 1.53 4.01 0.46 186 XM_ProductURIs 2078 0.85 1.76 0.46 187 URI_TRY_3LD 2077 0.68 1.18 0.46 188 XMLngstWrd_01 2019 1.39 3.58 0.45 189 RELAYCOUNTRY_GB 2016 0.53 0.73 0.44 190 XMPhish30 2009 0.62 1.01 0.44 191 TR_XM_MSPIKECOMBO 2008 1.47 3.84 0.44 192 XMPhish14 1996 0.49 0.61 0.44 193 XMBody_17 1967 1.45 3.78 0.43 194 RCVD_IN_BL_SPAMCOP_NET 1948 3.01 8.96 0.43 195 HTML_IMAGE_ONLY_20 1946 0.39 0.30 0.43 196 SHORT_HELO_AND_INLINE_IMAGE 1899 0.31 0.06 0.42 197 TO_NO_BRKTS_HTML_ONLY 1824 0.32 0.13 0.40 198 HTML_IMAGE_ONLY_28 1813 0.39 0.36 0.40 199 XMHTMLBadTable_001 1810 0.47 0.65 0.40 200 MPART_ALT_DIFF_COUNT 1779 0.52 0.82 0.39 ----------------------------------------------------------------------