Email: 507955 Autolearn: 0 AvgScore: 3.93 AvgScanTime: 1.30 sec Spam: 157526 Autolearn: 0 AvgScore: 13.16 AvgScanTime: 1.44 sec Ham: 350429 Autolearn: 0 AvgScore: -0.22 AvgScanTime: 1.24 sec Time Spent Running SA: 184.00 hours Time Spent Processing Spam: 63.00 hours Time Spent Processing Ham: 121.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149377 88.18 94.83 85.19 2 DKIM_SIGNED 144440 79.96 91.69 74.69 3 XM_DK_Pass 138933 77.90 88.20 73.27 4 DKIM_VALID 137530 76.96 87.31 72.30 5 XM_B_Unicode 132531 73.73 84.13 69.06 6 RELAYCOUNTRY_US 128564 81.19 81.61 81.00 7 T_SCC_BODY_TEXT_LINE 125737 82.18 79.82 83.25 8 XM_B_SpammyWords 113880 52.74 72.29 43.95 9 XMListUnsubscribeExists 113647 56.78 72.14 49.87 10 DCC_CHECK 111080 44.88 70.52 33.36 11 DKIM_VALID_AU 103929 60.43 65.98 57.94 12 XM_B_Unicode3 74917 42.62 47.56 40.40 13 XM_B_SpammyWords2 67634 25.51 42.94 17.67 14 XM_DK_Undo_02 66898 17.30 42.47 5.98 15 LOC_TINY_FONT_1 66267 30.41 42.07 25.18 16 BAYES_50 63312 53.54 40.19 59.53 17 HTML_FONT_LOW_CONTRAST 58216 30.89 36.96 28.16 18 FVGT_m_MULTI_ODD 52731 27.93 33.47 25.44 19 BAYES_99 51797 13.45 32.88 4.71 20 TR_XM_DKIM_Undo 51275 11.83 32.55 2.52 21 DKIM_VALID_EF 49625 29.15 31.50 28.09 22 MIME_HTML_ONLY 48862 22.88 31.02 19.22 23 T_KAM_HTML_FONT_INVALID 46530 23.58 29.54 20.90 24 DCC_CHECK_NEGATIVE 46423 55.08 29.47 66.60 25 BAYES_999 40002 10.42 25.39 3.69 26 RCVD_IN_MSPIKE_H2 39545 24.35 25.10 24.01 27 XMSubLong 37620 23.23 23.88 22.93 28 T_TM2_M_HEADER_IN_MSG 37554 27.00 23.84 28.42 29 TR_XM_DK_Unsub 36434 16.55 23.13 13.60 30 TR_DCC_Bayes_99 35977 7.96 22.84 1.27 31 XM_Multi_Part_URI 31536 15.71 20.02 13.77 32 RELAYCOUNTRY_META 29088 8.68 18.47 4.29 33 XM_B_Unsub 26885 10.77 17.07 7.93 34 TR_XM_BayesUnsub 25914 9.36 16.45 6.18 35 BOTNET_IPINHOSTNAME 23492 7.69 14.91 4.44 36 TR_XM_SpammyRelay 23362 6.12 14.83 2.20 37 UNPARSEABLE_RELAY 23151 11.47 14.70 10.02 38 LOTS_OF_MONEY 23096 9.10 14.66 6.60 39 TR_MAX_INTL_RELAY 22594 9.17 14.34 6.84 40 XM_B_SpammyWords3 22362 7.54 14.20 4.55 41 TR_XM_SpammyWords2 20743 4.39 13.17 0.44 42 TR_XM_SpammyWords4 20650 7.27 13.11 4.65 43 RCVD_IN_BL_SPAMCOP_NET 16809 3.98 10.67 0.98 44 XM_Body_Dirty_Words 16297 6.15 10.35 4.26 45 BOTNET 15451 3.96 9.81 1.33 46 RELAYCOUNTRY_CA 15027 3.72 9.54 1.11 47 XM_Evil_Numbers_Gen 14985 8.49 9.51 8.03 48 BAYES_80 13785 5.56 8.75 4.12 49 TR_XM_SPAMCOP 13238 2.80 8.40 0.28 50 FSL_BULK_SIG 12979 5.23 8.24 3.88 51 BAYES_60 12507 8.70 7.94 9.04 52 RCVD_IN_MSPIKE_WL 12376 6.60 7.86 6.04 53 RCVD_IN_MSPIKE_H3 12376 6.60 7.86 6.04 54 TR_XM_UnparsRelay 12076 3.50 7.67 1.63 55 HTML_IMAGE_RATIO_02 11764 5.60 7.47 4.76 56 LotsOfNums_01 11001 8.12 6.98 8.64 57 XM_UncommonTLD01 10944 4.86 6.95 3.92 58 XMSubMetaSx_00 10496 4.58 6.66 3.64 59 XMSexyCombo_05 10366 3.39 6.58 1.95 60 MPART_ALT_DIFF 10328 4.74 6.56 3.93 61 TooManyTo_001 9706 7.98 6.16 8.80 62 HTML_IMAGE_RATIO_04 9554 4.92 6.07 4.40 63 XMBody_17 9446 2.30 6.00 0.64 64 UNTRUSTED_Relay 9018 2.91 5.72 1.64 65 XMNumbers 8525 3.47 5.41 2.60 66 XM_H_Long_From01 8369 5.27 5.31 5.25 67 BAYES_95 8238 3.49 5.23 2.71 68 XM_SPF_SoftFail 8145 3.77 5.17 3.14 69 XM_B_Phish_Phrases 7906 3.92 5.02 3.43 70 XM_OfRef6 7180 2.20 4.56 1.14 71 DKIM_INVALID 6910 3.01 4.39 2.38 72 XM_H_GMP 6763 5.68 4.29 6.30 73 TR_XM_PhishingBody 6651 2.84 4.22 2.22 74 T_FILL_THIS_FORM_SHORT 6594 1.94 4.19 0.93 75 XM_B_Investor 6581 2.51 4.18 1.77 76 SpammyFromTLD_01 6256 1.89 3.97 0.95 77 HTML_IMAGE_RATIO_06 6201 3.08 3.94 2.69 78 TR_XM_SpammyWords5 6185 2.08 3.93 1.25 79 MIME_HTML_MOSTLY 6128 2.73 3.89 2.21 80 T_XMDrugObfuBody_08 6121 2.48 3.89 1.85 81 MIME_HTML_ONLY_MULTI 6020 2.66 3.82 2.14 82 TR_XM_PHPForged 5920 1.42 3.76 0.37 83 TR_XM_PHPDW 5872 1.41 3.73 0.36 84 T_XMDrugObfuBody_14 5800 2.41 3.68 1.83 85 TR_XM_FormFill2 5783 1.39 3.67 0.36 86 XM_H_PHPOS 5765 1.37 3.66 0.34 87 MIME_QP_LONG_LINE 5740 4.93 3.64 5.51 88 TM2_M_URI_OPT_OUT 5537 2.42 3.51 1.93 89 XM_B_SpammyTLD 5437 2.92 3.45 2.68 90 TM2_M_VERY_LONG_WORD 5349 1.87 3.40 1.18 91 TR_LOTS_OF_MONEY3 5219 1.31 3.31 0.41 92 XMStrtUSub 5107 3.93 3.24 4.25 93 FONT_INVIS_LONG_LINE 5018 1.04 3.19 0.08 94 HTML_IMAGE_RATIO_08 4755 2.40 3.02 2.13 95 RCVD_IN_VALIDITY_SAFE 4670 3.86 2.96 4.27 96 XM_CamelCaseFrm001 4615 2.46 2.93 2.24 97 XMDiploma_00 4458 2.03 2.83 1.67 98 XM_UB50 4413 1.60 2.80 1.06 99 XM_B_Unsub2 4369 1.97 2.77 1.60 100 TR_XM_FormFill 4148 0.82 2.63 0.01 101 TR_XM_BayesRelay 4145 0.82 2.63 0.00 102 XM_URI_RBL 3960 0.87 2.51 0.13 103 SCC_BODY_URI_ONLY 3901 2.52 2.48 2.54 104 RCVD_IN_VALIDITY_CERTIFIED 3651 3.31 2.32 3.75 105 TR_XM_NoHeaderRelay 3648 0.79 2.32 0.11 106 T_TooManySym_01 3612 4.43 2.29 5.39 107 RELAYCOUNTRY_AU 3591 1.21 2.28 0.73 108 URI_HEX 3515 1.57 2.23 1.27 109 XM_B_SpammyWords4 3352 1.11 2.13 0.66 110 SUBJ_ALL_CAPS 3344 1.64 2.12 1.43 111 ANY_BOUNCE_MESSAGE 3318 3.74 2.11 4.47 112 BOUNCE_MESSAGE 3317 3.74 2.11 4.47 113 XM_DK_Undo_01 3241 1.95 2.06 1.90 114 USER_IN_DEF_DKIM_WL 3190 8.66 2.03 11.65 115 TM2_M_BODY_EMPTY 3123 0.91 1.98 0.43 116 BAYES_40 3106 3.76 1.97 4.57 117 XMStockSpam_06 3060 1.41 1.94 1.18 118 XMEmptyBody_01 3009 0.67 1.91 0.11 119 T_XMHurry_00 2942 1.00 1.87 0.62 120 T_XMDrugObfuBody_00 2912 1.05 1.85 0.69 121 FROM_EXCESS_BASE64 2884 2.05 1.83 2.15 122 MAILING_LIST_MULTI 2826 2.71 1.79 3.13 123 XM_DIRTYINTL 2791 0.71 1.77 0.24 124 XM_H_Long_From02 2693 1.19 1.71 0.96 125 HTML_MIME_NO_HTML_TAG 2657 2.03 1.69 2.18 126 T_REMOTE_IMAGE 2638 2.90 1.67 3.45 127 SpammyFromTLD_02 2608 0.83 1.66 0.46 128 BAYES_20 2538 2.82 1.61 3.36 129 HTML_TAG_BALANCE_BODY 2466 0.84 1.57 0.51 130 HTTPS_HTTP_MISMATCH 2415 1.14 1.53 0.97 131 XMReplyNow 2394 0.65 1.52 0.26 132 URI_TRY_3LD 2372 0.96 1.51 0.71 133 RCVD_IN_IADB_LISTED 2372 3.75 1.51 4.75 134 XM_SendGrid 2360 1.40 1.50 1.35 135 XMBrknScrpt_02 2289 0.88 1.45 0.63 136 XMPhish30 2275 0.93 1.44 0.70 137 HK_RANDOM_REPLYTO 2272 0.50 1.44 0.08 138 RCVD_IN_VALIDITY_RPBL 2253 0.50 1.43 0.08 139 XMGenDplmaNmb 2241 1.02 1.42 0.83 140 BOTNET_NORDNS 2228 0.45 1.41 0.01 141 XM_HighProb1 2158 0.43 1.37 0.00 142 TR_XM_INV_DKIM 2141 0.48 1.36 0.08 143 RCVD_IN_IADB_SPF 2133 3.32 1.35 4.21 144 XMSubMetaSxObfu_03 2051 0.65 1.30 0.35 145 RCVD_IN_IADB_DK 2037 2.97 1.29 3.72 146 RCVD_IN_IADB_SENDERID 2031 3.02 1.29 3.79 147 AC_BR_BONANZA 2028 0.47 1.29 0.11 148 XMSexyCombo_01 2017 0.56 1.28 0.24 149 XM_B_Phish66 1961 0.66 1.24 0.39 150 URI_NOVOWEL 1934 1.56 1.23 1.71 151 XMBdyGiftCard01 1923 0.72 1.22 0.49 152 ALL_TRUSTED 1865 11.22 1.18 15.73 153 KHOP_HELO_FCRDNS 1819 1.14 1.15 1.13 154 TR_LOTS_OF_MONEY2 1703 0.47 1.08 0.19 155 T_MONEY_PERCENT 1703 0.47 1.08 0.19 156 TooManyTo_002 1658 2.10 1.05 2.57 157 XM_H_PHPMailer 1650 0.83 1.05 0.73 158 XMHTML_After_End 1642 0.82 1.04 0.73 159 PLING_QUERY 1638 0.55 1.04 0.34 160 RCVD_IN_PSBL 1590 0.54 1.01 0.33 161 TR_XM_InvalidRelay 1527 0.33 0.97 0.04 162 TR_XM_Base64_M1 1518 0.79 0.96 0.72 163 THIS_AD 1505 0.58 0.96 0.42 164 XM_H_Undi_Recip 1484 0.42 0.94 0.18 165 TR_Caps_n_Bayes_99 1480 0.30 0.94 0.01 166 DKIM_ADSP_CUSTOM_MED 1479 0.85 0.94 0.81 167 URIBL_DBL_SPAM 1471 0.29 0.93 0.00 168 TooManyTo_003 1461 1.21 0.93 1.34 169 TR_XM_DK_SendGrid 1443 0.90 0.92 0.89 170 T_Symld_Words_02 1439 0.67 0.91 0.56 171 RDNS_DYNAMIC 1433 0.51 0.91 0.33 172 PDS_OTHER_BAD_TLD 1422 0.36 0.90 0.11 173 XMBody_78 1418 0.54 0.90 0.38 174 RELAYCOUNTRY_FR 1400 0.44 0.89 0.23 175 XM_UB99 1399 0.28 0.89 0.00 176 XMPhish14 1393 0.78 0.88 0.73 177 SHOPIFY_IMG_NOT_RCVD_SFY 1391 0.44 0.88 0.25 178 TooManyTo_004 1379 0.94 0.88 0.97 179 TR_Symld_Words 1366 1.36 0.87 1.58 180 DKIM_ADSP_NXDOMAIN 1362 0.45 0.86 0.26 181 XM_RXBody 1345 0.67 0.85 0.58 182 XM_B_DNDMA 1345 0.42 0.85 0.23 183 XMSubMetaI_00 1341 0.58 0.85 0.46 184 TM2_M_A_HREF_HREF 1340 0.41 0.85 0.22 185 XM_B_COVIDMETA 1338 0.50 0.85 0.35 186 XM_UB60 1327 0.31 0.84 0.07 187 TooManyTo_005 1321 0.80 0.84 0.78 188 TR_Mismatch_TLD_02 1297 0.34 0.82 0.12 189 XM_B_SEO 1234 0.33 0.78 0.12 190 REMOVE_BEFORE_LINK 1232 0.42 0.78 0.26 191 XM_ProductURIs 1230 0.64 0.78 0.58 192 FORGED_GMAIL_RCVD 1226 0.58 0.78 0.49 193 XM_B_COPY_HTML 1213 0.65 0.77 0.60 194 DIET_1 1205 0.41 0.76 0.26 195 MPART_ALT_DIFF_COUNT 1196 0.65 0.76 0.60 196 TVD_RCVD_IP 1190 1.19 0.76 1.38 197 TR_MetaPhish_Combo_01 1186 0.79 0.75 0.80 198 T_TooManySym_02 1178 2.15 0.75 2.78 199 URIBL_BLACK 1155 0.25 0.73 0.03 200 BAYES_05 1150 1.99 0.73 2.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 298536 88.18 94.83 85.19 2 T_SCC_BODY_TEXT_LINE 291723 82.18 79.82 83.25 3 RELAYCOUNTRY_US 283853 81.19 81.61 81.00 4 DKIM_SIGNED 261725 79.96 91.69 74.69 5 XM_DK_Pass 256765 77.90 88.20 73.27 6 DKIM_VALID 253370 76.96 87.31 72.30 7 XM_B_Unicode 241996 73.73 84.13 69.06 8 DCC_CHECK_NEGATIVE 233373 55.08 29.47 66.60 9 BAYES_50 208626 53.54 40.19 59.53 10 DKIM_VALID_AU 203022 60.43 65.98 57.94 11 XMListUnsubscribeExists 174771 56.78 72.14 49.87 12 XM_B_SpammyWords 154017 52.74 72.29 43.95 13 XM_B_Unicode3 141564 42.62 47.56 40.40 14 DCC_CHECK 116904 44.88 70.52 33.36 15 T_TM2_M_HEADER_IN_MSG 99577 27.00 23.84 28.42 16 HTML_FONT_LOW_CONTRAST 98684 30.89 36.96 28.16 17 DKIM_VALID_EF 98439 29.15 31.50 28.09 18 FVGT_m_MULTI_ODD 89156 27.93 33.47 25.44 19 LOC_TINY_FONT_1 88227 30.41 42.07 25.18 20 RCVD_IN_MSPIKE_H2 84123 24.35 25.10 24.01 21 XMSubLong 80368 23.23 23.88 22.93 22 T_KAM_HTML_FONT_INVALID 73248 23.58 29.54 20.90 23 MIME_HTML_ONLY 67367 22.88 31.02 19.22 24 XM_B_SpammyWords2 61920 25.51 42.94 17.67 25 ALL_TRUSTED 55130 11.22 1.18 15.73 26 XM_Multi_Part_URI 48261 15.71 20.02 13.77 27 TR_XM_DK_Unsub 47657 16.55 23.13 13.60 28 USER_IN_DEF_DKIM_WL 40814 8.66 2.03 11.65 29 UNPARSEABLE_RELAY 35109 11.47 14.70 10.02 30 BAYES_00 32888 6.69 0.69 9.39 31 BAYES_60 31695 8.70 7.94 9.04 32 TooManyTo_001 30835 7.98 6.16 8.80 33 LotsOfNums_01 30260 8.12 6.98 8.64 34 XM_Evil_Numbers_Gen 28132 8.49 9.51 8.03 35 XM_B_Unsub 27804 10.77 17.07 7.93 36 XM_DKIMWhitelistDomains 26817 5.29 0.03 7.65 37 TR_MAX_INTL_RELAY 23973 9.17 14.34 6.84 38 IN_ZIMBRA_NJ_WHITELIST 23815 4.71 0.07 6.80 39 TR_XM_DK_Bayes 23175 4.73 0.55 6.61 40 LOTS_OF_MONEY 23121 9.10 14.66 6.60 41 TR_XM_DK_Bayes1 22837 4.67 0.55 6.52 42 XM_H_GMP 22073 5.68 4.29 6.30 43 TR_XM_BayesUnsub 21652 9.36 16.45 6.18 44 RCVD_IN_MSPIKE_H3 21161 6.60 7.86 6.04 45 RCVD_IN_MSPIKE_WL 21161 6.60 7.86 6.04 46 XM_DK_Undo_02 20965 17.30 42.47 5.98 47 TR_XM_DK_Bayes2 20083 4.10 0.47 5.73 48 MIME_QP_LONG_LINE 19312 4.93 3.64 5.51 49 T_TooManySym_01 18879 4.43 2.29 5.39 50 XM_H_Long_From01 18405 5.27 5.31 5.25 51 HTML_IMAGE_RATIO_02 16693 5.60 7.47 4.76 52 RCVD_IN_IADB_LISTED 16660 3.75 1.51 4.75 53 BAYES_99 16508 13.45 32.88 4.71 54 TR_XM_SpammyWords4 16282 7.27 13.11 4.65 55 BAYES_40 16011 3.76 1.97 4.57 56 XM_B_SpammyWords3 15961 7.54 14.20 4.55 57 ANY_BOUNCE_MESSAGE 15680 3.74 2.11 4.47 58 BOUNCE_MESSAGE 15679 3.74 2.11 4.47 59 BOTNET_IPINHOSTNAME 15552 7.69 14.91 4.44 60 HTML_IMAGE_RATIO_04 15423 4.92 6.07 4.40 61 XM_PDF 15386 3.19 0.53 4.39 62 RELAYCOUNTRY_META 15022 8.68 18.47 4.29 63 RCVD_IN_VALIDITY_SAFE 14962 3.86 2.96 4.27 64 XM_Body_Dirty_Words 14927 6.15 10.35 4.26 65 XMStrtUSub 14878 3.93 3.24 4.25 66 RCVD_IN_IADB_SPF 14745 3.32 1.35 4.21 67 BAYES_80 14453 5.56 8.75 4.12 68 MPART_ALT_DIFF 13755 4.74 6.56 3.93 69 XM_UncommonTLD01 13750 4.86 6.95 3.92 70 FSL_BULK_SIG 13603 5.23 8.24 3.88 71 RCVD_IN_IADB_SENDERID 13290 3.02 1.29 3.79 72 RCVD_IN_VALIDITY_CERTIFIED 13147 3.31 2.32 3.75 73 RCVD_IN_IADB_DK 13049 2.97 1.29 3.72 74 BAYES_999 12941 10.42 25.39 3.69 75 XMSubMetaSx_00 12772 4.58 6.66 3.64 76 T_REMOTE_IMAGE 12092 2.90 1.67 3.45 77 XM_B_Phish_Phrases 12029 3.92 5.02 3.43 78 BAYES_20 11767 2.82 1.61 3.36 79 XM_SPF_SoftFail 10988 3.77 5.17 3.14 80 MAILING_LIST_MULTI 10962 2.71 1.79 3.13 81 RCVD_IN_IADB_VOUCHED 9998 2.18 0.68 2.85 82 T_TooManySym_02 9753 2.15 0.75 2.78 83 BAYES_95 9504 3.49 5.23 2.71 84 HTML_IMAGE_RATIO_06 9420 3.08 3.94 2.69 85 XM_B_SpammyTLD 9383 2.92 3.45 2.68 86 XMNumbers 9115 3.47 5.41 2.60 87 TooManyTo_002 9016 2.10 1.05 2.57 88 BAYES_05 8972 1.99 0.73 2.56 89 SCC_BODY_URI_ONLY 8898 2.52 2.48 2.54 90 TR_XM_DKIM_Undo 8827 11.83 32.55 2.52 91 DKIM_INVALID 8355 3.01 4.39 2.38 92 XM_CamelCaseFrm001 7863 2.46 2.93 2.24 93 TR_XM_PhishingBody 7764 2.84 4.22 2.22 94 MIME_HTML_MOSTLY 7755 2.73 3.89 2.21 95 TR_XM_SpammyRelay 7719 6.12 14.83 2.20 96 HTML_MIME_NO_HTML_TAG 7643 2.03 1.69 2.18 97 FROM_EXCESS_BASE64 7521 2.05 1.83 2.15 98 MIME_HTML_ONLY_MULTI 7503 2.66 3.82 2.14 99 HTML_IMAGE_RATIO_08 7461 2.40 3.02 2.13 100 INVALID_MSGID 7131 1.45 0.16 2.03 101 XMSexyCombo_05 6844 3.39 6.58 1.95 102 TM2_M_URI_OPT_OUT 6759 2.42 3.51 1.93 103 XM_DK_Undo_01 6646 1.95 2.06 1.90 104 RCVD_IN_IADB_OPTIN 6599 1.42 0.40 1.88 105 T_XMDrugObfuBody_08 6467 2.48 3.89 1.85 106 TO_MALFORMED 6434 1.27 0.02 1.84 107 T_XMDrugObfuBody_14 6417 2.41 3.68 1.83 108 HELO_NODOT 6331 1.42 0.56 1.81 109 HELO_NO_DOMAIN 6324 1.42 0.56 1.80 110 XM_B_Investor 6186 2.51 4.18 1.77 111 URI_NOVOWEL 5983 1.56 1.23 1.71 112 XMDiploma_00 5862 2.03 2.83 1.67 113 UNTRUSTED_Relay 5750 2.91 5.72 1.64 114 TR_XM_UnparsRelay 5722 3.50 7.67 1.63 115 XMGappySubj_01 5688 1.16 0.12 1.62 116 XM_B_Unsub2 5624 1.97 2.77 1.60 117 TR_Symld_Words 5544 1.36 0.87 1.58 118 IN_HORDE_ADDRESS_BOOK 5247 1.05 0.07 1.50 119 SUBJ_ALL_CAPS 4996 1.64 2.12 1.43 120 TVD_RCVD_IP 4851 1.19 0.76 1.38 121 XM_SendGrid 4736 1.40 1.50 1.35 122 TooManyTo_003 4686 1.21 0.93 1.34 123 BOTNET 4673 3.96 9.81 1.33 124 URI_HEX 4460 1.57 2.23 1.27 125 TR_DCC_Bayes_99 4447 7.96 22.84 1.27 126 TR_XM_SpammyWords5 4372 2.08 3.93 1.25 127 XM_GoogleGroups 4302 1.01 0.53 1.23 128 TM2_M_VERY_LONG_WORD 4140 1.87 3.40 1.18 129 XMStockSpam_06 4125 1.41 1.94 1.18 130 XM_OfRef6 3989 2.20 4.56 1.14 131 TVD_SPACE_RATIO 3988 0.80 0.06 1.14 132 XMBSHREFv2 3982 0.88 0.31 1.14 133 KHOP_HELO_FCRDNS 3953 1.14 1.15 1.13 134 XMCapTrack 3911 0.91 0.45 1.12 135 RELAYCOUNTRY_CA 3879 3.72 9.54 1.11 136 T_TooManySym_03 3807 0.85 0.31 1.09 137 XMNoVowels 3793 0.90 0.48 1.08 138 XM_UB50 3728 1.60 2.80 1.06 139 XMBody_95 3652 0.77 0.17 1.04 140 RCVD_IN_BL_SPAMCOP_NET 3429 3.98 10.67 0.98 141 HTTPS_HTTP_MISMATCH 3399 1.14 1.53 0.97 142 TooManyTo_004 3390 0.94 0.88 0.97 143 XM_H_Long_From02 3368 1.19 1.71 0.96 144 SpammyFromTLD_01 3336 1.89 3.97 0.95 145 T_FILL_THIS_FORM_SHORT 3253 1.94 4.19 0.93 146 XMGappySubj_02 3153 0.64 0.05 0.90 147 TR_XM_DK_SendGrid 3117 0.90 0.92 0.89 148 FROM_GOV_DKIM_AU 2961 0.66 0.26 0.84 149 XMGenDplmaNmb 2918 1.02 1.42 0.83 150 RCVD_IN_RP_SAFE 2905 0.77 0.64 0.83 151 DKIM_ADSP_CUSTOM_MED 2842 0.85 0.94 0.81 152 TR_MetaPhish_Combo_01 2808 0.79 0.75 0.80 153 TooManyTo_005 2742 0.80 0.84 0.78 154 XMPhish14 2570 0.78 0.88 0.73 155 XM_H_PHPMailer 2553 0.83 1.05 0.73 156 RELAYCOUNTRY_AU 2553 1.21 2.28 0.73 157 XMHTML_After_End 2546 0.82 1.04 0.73 158 RCVD_IN_RP_CERTIFIED 2541 0.66 0.51 0.73 159 XM_H_Trusted_IP 2519 0.50 0.00 0.72 160 TR_XM_Base64_M1 2509 0.79 0.96 0.72 161 URI_TRY_3LD 2490 0.96 1.51 0.71 162 XMPhish30 2452 0.93 1.44 0.70 163 T_XMDrugObfuBody_00 2430 1.05 1.85 0.69 164 MSGID_NOFQDN1 2389 0.47 0.01 0.68 165 XM_ShortIntro_01 2322 0.60 0.47 0.66 166 XM_B_FormFill 2321 0.48 0.06 0.66 167 T_OBFU_PDF_ATTACH 2321 0.48 0.08 0.66 168 XM_B_SpammyWords4 2308 1.11 2.13 0.66 169 XMSubNoVowel 2272 0.55 0.33 0.65 170 XMBody_17 2250 2.30 6.00 0.64 171 FILL_THIS_FORM 2209 0.56 0.42 0.63 172 XMBrknScrpt_02 2204 0.88 1.45 0.63 173 T_XMHurry_00 2160 1.00 1.87 0.62 174 USER_IN_WHITELIST 2128 0.42 0.00 0.61 175 USER_IN_WELCOMELIST 2128 0.42 0.00 0.61 176 MPART_ALT_DIFF_COUNT 2118 0.65 0.76 0.60 177 XM_B_COPY_HTML 2114 0.65 0.77 0.60 178 XM_RXBody 2045 0.67 0.85 0.58 179 XM_ProductURIs 2042 0.64 0.78 0.58 180 T_Symld_Words_02 1969 0.67 0.91 0.56 181 NML_ADSP_CUSTOM_MED 1939 0.59 0.68 0.55 182 SHORT_HELO_AND_INLINE_IMAGE 1929 0.40 0.06 0.55 183 XMLngstWrd_00 1894 0.57 0.62 0.54 184 RELAYCOUNTRY_GB 1872 0.56 0.61 0.53 185 MY_SERVERS_FOUND 1800 0.39 0.11 0.51 186 HTML_TAG_BALANCE_BODY 1797 0.84 1.57 0.51 187 XMBdyGiftCard01 1729 0.72 1.22 0.49 188 FORGED_GMAIL_RCVD 1706 0.58 0.78 0.49 189 XMMoneyMeta_00 1697 0.53 0.64 0.48 190 XMSubMetaI_00 1629 0.58 0.85 0.46 191 SpammyFromTLD_02 1605 0.83 1.66 0.46 192 TR_XM_SpammyWords2 1547 4.39 13.17 0.44 193 HTML_IMAGE_ONLY_28 1541 0.40 0.30 0.44 194 HTML_IMAGE_ONLY_20 1530 0.44 0.44 0.44 195 TM2_M_BODY_EMPTY 1511 0.91 1.98 0.43 196 HTML_FONT_FACE_BAD 1485 0.48 0.60 0.42 197 THIS_AD 1458 0.58 0.96 0.42 198 TR_LOTS_OF_MONEY3 1421 1.31 3.31 0.41 199 T_TooManySym_04 1420 0.32 0.12 0.41 200 TO_NO_BRKTS_HTML_ONLY 1399 0.34 0.20 0.40 ----------------------------------------------------------------------