Email: 86 Autolearn: 0 AvgScore: 2.22 AvgScanTime: 2.58 sec Spam: 23 Autolearn: 0 AvgScore: 14.39 AvgScanTime: 2.24 sec Ham: 63 Autolearn: 0 AvgScore: -2.22 AvgScanTime: 2.70 sec Time Spent Running SA: 0.06 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 22 81.40 95.65 76.19 2 DKIM_SIGNED 17 72.09 73.91 71.43 3 XM_DK_Pass 16 67.44 69.57 66.67 4 DKIM_VALID 16 66.28 69.57 65.08 5 HTML_MESSAGE 16 75.58 69.57 77.78 6 BAYES_50 15 62.79 65.22 61.90 7 XMListUnsubscribeExists 14 47.67 60.87 42.86 8 DCC_CHECK 12 26.74 52.17 17.46 9 DKIM_VALID_AU 12 53.49 52.17 53.97 10 DCC_CHECK_NEGATIVE 11 73.26 47.83 82.54 11 XM_UncommonTLD01 10 16.28 43.48 6.35 12 XM_Body_Dirty_Words 9 19.77 39.13 12.70 13 MIME_HTML_ONLY 9 30.23 39.13 26.98 14 XM_B_Unicode 9 58.14 39.13 65.08 15 RELAYCOUNTRY_META 8 15.12 34.78 7.94 16 XM_B_SpammyWords 8 36.05 34.78 36.51 17 RCVD_IN_MSPIKE_H2 7 13.95 30.43 7.94 18 FVGT_m_MULTI_ODD 7 26.74 30.43 25.40 19 MPART_ALT_DIFF 6 17.44 26.09 14.29 20 XMLngstWrd_03 5 8.14 21.74 3.17 21 BAYES_99 5 8.14 21.74 3.17 22 XM_B_Unicode3 5 34.88 21.74 39.68 23 RCVD_IN_MSPIKE_WL 5 27.91 21.74 30.16 24 XMLngstWrd_01 5 8.14 21.74 3.17 25 TM2_M_VERY_LONG_WORD 5 9.30 21.74 4.76 26 FSL_BULK_SIG 5 8.14 21.74 3.17 27 XMLngstWrd_04 5 8.14 21.74 3.17 28 HTML_MIME_NO_HTML_TAG 5 8.14 21.74 3.17 29 XMLngstWrd_00 5 9.30 21.74 4.76 30 XMLngstWrd_02 5 8.14 21.74 3.17 31 XM_B_SpammyWords2 5 15.12 21.74 12.70 32 HTML_TITLE_SUBJ_DIFF 5 8.14 21.74 3.17 33 XM_GoogleGroups 5 8.14 21.74 3.17 34 SpammyFromTLD_02 5 5.81 21.74 0.00 35 UPPERCASE_75_100 5 8.14 21.74 3.17 36 RCVD_IN_MSPIKE_H3 5 23.26 21.74 23.81 37 XM_Multi_Part_URI 5 18.60 21.74 17.46 38 MIME_HTML_ONLY_MULTI 5 13.95 21.74 11.11 39 BOTNET 4 4.65 17.39 0.00 40 LOTS_OF_MONEY 4 8.14 17.39 4.76 41 T_TM2_M_HEADER_IN_MSG 4 17.44 17.39 17.46 42 DKIM_VALID_EF 4 33.72 17.39 39.68 43 XM_DK_Undo_02 4 6.98 17.39 3.17 44 XMSexyCombo_05 4 5.81 17.39 1.59 45 XM_B_Investor 4 4.65 17.39 0.00 46 TR_Mismatch_TLD_02 3 3.49 13.04 0.00 47 TR_DCC_Bayes_99 3 3.49 13.04 0.00 48 BOTNET_IPINHOSTNAME 3 6.98 13.04 4.76 49 RELAYCOUNTRY_CA 3 3.49 13.04 0.00 50 HTML_FONT_LOW_CONTRAST 3 26.74 13.04 31.75 51 XMSubMetaSx_00 3 4.65 13.04 1.59 52 TR_XM_SpammyWords4 3 5.81 13.04 3.17 53 XM_DIRTYINTL 3 4.65 13.04 1.59 54 LOC_TINY_FONT_1 3 22.09 13.04 25.40 55 SpammyFromTLD_01 2 2.33 8.70 0.00 56 TR_XM_BayesUnsub 2 8.14 8.70 7.94 57 T_KAM_HTML_FONT_INVALID 2 15.12 8.70 17.46 58 XM_OfRef6 2 2.33 8.70 0.00 59 MONEY_NOHTML 2 2.33 8.70 0.00 60 TR_LOTS_OF_MONEY3 2 2.33 8.70 0.00 61 XM_H_Long_From02 2 2.33 8.70 0.00 62 XM_B_SpammyWords3 2 4.65 8.70 3.17 63 FROM_SUSPICIOUS_NTLD 2 2.33 8.70 0.00 64 TR_XM_DK_Unsub 2 13.95 8.70 15.87 65 XM_B_Unsub 2 10.47 8.70 11.11 66 RELAYCOUNTRY_UA 2 2.33 8.70 0.00 67 XMSubLong 2 17.44 8.70 20.63 68 BAYES_999 2 4.65 8.70 3.17 69 TooManyTo_001 2 9.30 8.70 9.52 70 LongTLD 2 2.33 8.70 0.00 71 XMHTML_After_End 2 3.49 8.70 1.59 72 T_FILL_THIS_FORM_SHORT 2 2.33 8.70 0.00 73 FROM_SUSPICIOUS_NTLD_FP 2 2.33 8.70 0.00 74 UNPARSEABLE_RELAY 2 8.14 8.70 7.94 75 XMSubMetaI_00 2 2.33 8.70 0.00 76 XM_Nigeria_01 2 2.33 8.70 0.00 77 TR_XM_SpammyWords2 1 2.33 4.35 1.59 78 XMGppyBdWords 1 1.16 4.35 0.00 79 LOADSA_MONEY_COMBO 1 1.16 4.35 0.00 80 ADVANCE_FEE_5_NEW_MONEY 1 1.16 4.35 0.00 81 XM_BayesBump_High 1 1.16 4.35 0.00 82 TooManyTo_002 1 3.49 4.35 3.17 83 KHOP_HELO_FCRDNS 1 2.33 4.35 1.59 84 TO_NO_BRKTS_DYNIP 1 1.16 4.35 0.00 85 SHORT_URI 1 1.16 4.35 0.00 86 RELAYCOUNTRY_CN 1 1.16 4.35 0.00 87 HTML_IMAGE_RATIO_08 1 5.81 4.35 6.35 88 MONEY_FORM_SHORT 1 1.16 4.35 0.00 89 FORM_FRAUD_5 1 1.16 4.35 0.00 90 RCVD_IN_IADB_LISTED 1 1.16 4.35 0.00 91 RCVD_IN_IADB_SENDERID 1 1.16 4.35 0.00 92 T_MONEY_PERCENT 1 1.16 4.35 0.00 93 TR_XM_Undi_Recip2 1 1.16 4.35 0.00 94 T_TooManySym_02 1 5.81 4.35 6.35 95 IMPOTENCE 1 1.16 4.35 0.00 96 XM_H_Undi_Recip 1 1.16 4.35 0.00 97 XMBSHREFv2 1 1.16 4.35 0.00 98 MIME_HTML_MOSTLY 1 4.65 4.35 4.76 99 TR_Sbj_FN_Bdy 1 1.16 4.35 0.00 100 BAYES_00 1 5.81 4.35 6.35 101 INVALID_MSGID 1 6.98 4.35 7.94 102 DKIM_INVALID 1 5.81 4.35 6.35 103 MONEY_FRAUD_8 1 1.16 4.35 0.00 104 XM_ShortIntro_01 1 2.33 4.35 1.59 105 T_XMDrugObfuBody_14 1 2.33 4.35 1.59 106 XM_B_Phish_Phrases 1 6.98 4.35 7.94 107 XM_Nigeria_02 1 1.16 4.35 0.00 108 UNTRUSTED_Relay 1 4.65 4.35 4.76 109 TR_XM_DK_Bayes 1 3.49 4.35 3.17 110 XMSexyCombo_01 1 1.16 4.35 0.00 111 RCVD_IN_RP_RNBL 1 1.16 4.35 0.00 112 BAYES_95 1 3.49 4.35 3.17 113 TVD_PH_SEC 1 1.16 4.35 0.00 114 SHORT_URI_3 1 1.16 4.35 0.00 115 TR_XM_SpammyRelay 1 3.49 4.35 3.17 116 T_XMHurry_00 1 1.16 4.35 0.00 117 FORGED_GMAIL_RCVD 1 2.33 4.35 1.59 118 XM_HighProb1 1 1.16 4.35 0.00 119 HTML_IMAGE_RATIO_02 1 4.65 4.35 4.76 120 T_TooManySym_01 1 5.81 4.35 6.35 121 XM_UB50 1 4.65 4.35 4.76 122 XM_SPF_SoftFail 1 1.16 4.35 0.00 123 XM_OfRef7 1 1.16 4.35 0.00 124 DKIM_ADSP_CUSTOM_MED 1 2.33 4.35 1.59 125 RELAYCOUNTRY_KR 1 1.16 4.35 0.00 126 XMNumbers 1 3.49 4.35 3.17 127 XM_H_Long_From01 1 3.49 4.35 3.17 128 FROM_EXCESS_BASE64 1 1.16 4.35 0.00 129 RELAYCOUNTRY_TR 1 1.16 4.35 0.00 130 INVESTMENT_ADVICE 1 1.16 4.35 0.00 131 TR_XM_UnparsRelay 1 3.49 4.35 3.17 132 RCVD_IN_PSBL 1 1.16 4.35 0.00 133 XM_URI_RBL 1 2.33 4.35 1.59 134 SHOPIFY_IMG_NOT_RCVD_SFY 1 1.16 4.35 0.00 135 XM_B_Unsub2 1 2.33 4.35 1.59 136 TR_XM_FormFill 1 1.16 4.35 0.00 137 TR_XM_Undi_Recip5 1 1.16 4.35 0.00 138 TooManyTo_003 1 3.49 4.35 3.17 139 OBFU_TEXT_ATTACH 1 1.16 4.35 0.00 140 RDNS_DYNAMIC 1 1.16 4.35 0.00 141 LotsOfNums_01 1 5.81 4.35 6.35 142 NML_ADSP_CUSTOM_MED 1 1.16 4.35 0.00 143 URI_NO_WWW_INFO_CGI 1 1.16 4.35 0.00 144 BAYES_80 1 5.81 4.35 6.35 145 TR_XM_DK_Bayes1 1 2.33 4.35 1.59 146 RCVD_IN_IADB_SPF 1 1.16 4.35 0.00 147 NO_PRESCRIPTION 1 1.16 4.35 0.00 148 DATE_IN_FUTURE_06_12 1 1.16 4.35 0.00 149 XMFrmHeader_28 1 1.16 4.35 0.00 150 TR_XM_DKIM_Undo 1 2.33 4.35 1.59 151 XFER_LOTSA_MONEY 1 1.16 4.35 0.00 152 XMSubEmpty 1 1.16 4.35 0.00 153 HK_SCAM 1 1.16 4.35 0.00 154 XMSubject_78 1 1.16 4.35 0.00 155 T_TooManySym_04 1 1.16 4.35 0.00 156 XMBrknScrpt_02 1 1.16 4.35 0.00 157 BOTNET_NORDNS 1 1.16 4.35 0.00 158 MILLION_HUNDRED 1 1.16 4.35 0.00 159 RCVD_IN_IADB_DK 1 1.16 4.35 0.00 160 XM_Evil_Numbers_Gen 1 2.33 4.35 1.59 161 TR_LOTS_OF_MONEY2 1 1.16 4.35 0.00 162 T_TooManySym_03 1 4.65 4.35 4.76 163 DATE_IN_PAST_12_24 1 1.16 4.35 0.00 164 T_Symld_Words_02 1 3.49 4.35 3.17 165 T_XMDrugObfuBody_08 1 1.16 4.35 0.00 166 SUBJ_ALL_CAPS 1 3.49 4.35 3.17 167 XM_SendGrid 1 4.65 4.35 4.76 168 XMSubNoVowel 1 2.33 4.35 1.59 169 XM_Nigeria_03 1 1.16 4.35 0.00 170 URG_BIZ 1 1.16 4.35 0.00 171 TR_XM_DK_Bayes2 1 2.33 4.35 1.59 172 TR_Mismatch_TLD_01 1 1.16 4.35 0.00 173 TooManyTo_004 1 3.49 4.35 3.17 174 DEAR_FRIEND 1 1.16 4.35 0.00 175 T_REMOTE_IMAGE 1 5.81 4.35 6.35 176 PDS_RDNS_DYNAMIC_FP 1 1.16 4.35 0.00 177 MIME_QP_LONG_LINE 1 5.81 4.35 6.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 52 73.26 47.83 82.54 2 HTML_MESSAGE 49 75.58 69.57 77.78 3 RELAYCOUNTRY_US 48 81.40 95.65 76.19 4 DKIM_SIGNED 45 72.09 73.91 71.43 5 XM_DK_Pass 42 67.44 69.57 66.67 6 DKIM_VALID 41 66.28 69.57 65.08 7 XM_B_Unicode 41 58.14 39.13 65.08 8 BAYES_50 39 62.79 65.22 61.90 9 DKIM_VALID_AU 34 53.49 52.17 53.97 10 XMListUnsubscribeExists 27 47.67 60.87 42.86 11 DKIM_VALID_EF 25 33.72 17.39 39.68 12 XM_B_Unicode3 25 34.88 21.74 39.68 13 XM_B_SpammyWords 23 36.05 34.78 36.51 14 HTML_FONT_LOW_CONTRAST 20 26.74 13.04 31.75 15 RCVD_IN_MSPIKE_WL 19 27.91 21.74 30.16 16 MIME_HTML_ONLY 17 30.23 39.13 26.98 17 LOC_TINY_FONT_1 16 22.09 13.04 25.40 18 FVGT_m_MULTI_ODD 16 26.74 30.43 25.40 19 RCVD_IN_MSPIKE_H3 15 23.26 21.74 23.81 20 XMSubLong 13 17.44 8.70 20.63 21 T_TM2_M_HEADER_IN_MSG 11 17.44 17.39 17.46 22 XM_Multi_Part_URI 11 18.60 21.74 17.46 23 DCC_CHECK 11 26.74 52.17 17.46 24 T_KAM_HTML_FONT_INVALID 11 15.12 8.70 17.46 25 TR_XM_DK_Unsub 10 13.95 8.70 15.87 26 MPART_ALT_DIFF 9 17.44 26.09 14.29 27 XM_B_SpammyWords2 8 15.12 21.74 12.70 28 XM_Body_Dirty_Words 8 19.77 39.13 12.70 29 ALL_TRUSTED 8 9.30 0.00 12.70 30 MIME_HTML_ONLY_MULTI 7 13.95 21.74 11.11 31 XM_B_Unsub 7 10.47 8.70 11.11 32 BAYES_60 7 8.14 0.00 11.11 33 TooManyTo_001 6 9.30 8.70 9.52 34 HTML_IMAGE_RATIO_06 6 6.98 0.00 9.52 35 XMStrtUSub 5 5.81 0.00 7.94 36 RELAYCOUNTRY_META 5 15.12 34.78 7.94 37 XM_B_Phish_Phrases 5 6.98 4.35 7.94 38 INVALID_MSGID 5 6.98 4.35 7.94 39 UNPARSEABLE_RELAY 5 8.14 8.70 7.94 40 USER_IN_DEF_DKIM_WL 5 5.81 0.00 7.94 41 XM_H_Trusted_IP 5 5.81 0.00 7.94 42 XM_CamelCaseFrm001 5 5.81 0.00 7.94 43 RCVD_IN_MSPIKE_H2 5 13.95 30.43 7.94 44 XM_DKIMWhitelistDomains 5 5.81 0.00 7.94 45 TR_XM_BayesUnsub 5 8.14 8.70 7.94 46 HTML_IMAGE_RATIO_04 4 4.65 0.00 6.35 47 T_REMOTE_IMAGE 4 5.81 4.35 6.35 48 MIME_QP_LONG_LINE 4 5.81 4.35 6.35 49 T_TooManySym_01 4 5.81 4.35 6.35 50 HTML_FONT_FACE_BAD 4 4.65 0.00 6.35 51 XM_UncommonTLD01 4 16.28 43.48 6.35 52 BAYES_00 4 5.81 4.35 6.35 53 DKIM_INVALID 4 5.81 4.35 6.35 54 T_TooManySym_02 4 5.81 4.35 6.35 55 IN_ZIMBRA_NJ_WHITELIST 4 4.65 0.00 6.35 56 BAYES_80 4 5.81 4.35 6.35 57 HTML_IMAGE_RATIO_08 4 5.81 4.35 6.35 58 LotsOfNums_01 4 5.81 4.35 6.35 59 MAILING_LIST_MULTI 4 4.65 0.00 6.35 60 HTML_IMAGE_RATIO_02 3 4.65 4.35 4.76 61 XM_UB50 3 4.65 4.35 4.76 62 UNTRUSTED_Relay 3 4.65 4.35 4.76 63 XM_SendGrid 3 4.65 4.35 4.76 64 TM2_M_VERY_LONG_WORD 3 9.30 21.74 4.76 65 TM2_M_HAS_BSLASH_URI 3 3.49 0.00 4.76 66 LOTS_OF_MONEY 3 8.14 17.39 4.76 67 T_TooManySym_03 3 4.65 4.35 4.76 68 TO_MALFORMED 3 3.49 0.00 4.76 69 MIME_HTML_MOSTLY 3 4.65 4.35 4.76 70 BOTNET_IPINHOSTNAME 3 6.98 13.04 4.76 71 MSGID_NOFQDN1 3 3.49 0.00 4.76 72 XMLngstWrd_00 3 9.30 21.74 4.76 73 XM_ProductURIs 3 3.49 0.00 4.76 74 TooManyTo_005 2 2.33 0.00 3.17 75 BAYES_40 2 2.33 0.00 3.17 76 TR_XM_SpammyRelay 2 3.49 4.35 3.17 77 TR_XM_SB_Phish 2 2.33 0.00 3.17 78 TooManyTo_004 2 3.49 4.35 3.17 79 BAYES_95 2 3.49 4.35 3.17 80 XMLngstWrd_04 2 8.14 21.74 3.17 81 TR_XM_DK_SendGrid 2 2.33 0.00 3.17 82 UPPERCASE_75_100 2 8.14 21.74 3.17 83 TR_XM_DK_Bayes 2 3.49 4.35 3.17 84 FSL_BULK_SIG 2 8.14 21.74 3.17 85 SUBJ_ALL_CAPS 2 3.49 4.35 3.17 86 T_Symld_Words_02 2 3.49 4.35 3.17 87 XM_DK_Undo_02 2 6.98 17.39 3.17 88 XM_B_SpammyWords3 2 4.65 8.70 3.17 89 XMLngstWrd_01 2 8.14 21.74 3.17 90 XMSubPhish11 2 2.33 0.00 3.17 91 XM_GoogleGroups 2 8.14 21.74 3.17 92 RCVD_IN_MSPIKE_H5 2 2.33 0.00 3.17 93 HTML_TITLE_SUBJ_DIFF 2 8.14 21.74 3.17 94 TR_XM_SpammyWords4 2 5.81 13.04 3.17 95 RCVD_IN_MSPIKE_H4 2 2.33 0.00 3.17 96 TR_MSPIKEBAYES00 2 2.33 0.00 3.17 97 BAYES_99 2 8.14 21.74 3.17 98 BAYES_999 2 4.65 8.70 3.17 99 XMLngstWrd_02 2 8.14 21.74 3.17 100 TooManyTo_003 2 3.49 4.35 3.17 101 TooManyTo_002 2 3.49 4.35 3.17 102 FVGT_m_MULTI_ODD_EMAIL 2 2.33 0.00 3.17 103 XMLngstWrd_03 2 8.14 21.74 3.17 104 BAYES_20 2 2.33 0.00 3.17 105 XM_H_Long_From01 2 3.49 4.35 3.17 106 HTML_MIME_NO_HTML_TAG 2 8.14 21.74 3.17 107 RELAYCOUNTRY_GB 2 2.33 0.00 3.17 108 TR_XM_UnparsRelay 2 3.49 4.35 3.17 109 TVD_SPACE_RATIO 2 2.33 0.00 3.17 110 XMNumbers 2 3.49 4.35 3.17 111 MIME_HEADER_CTYPE_ONLY 1 1.16 0.00 1.59 112 ANY_BOUNCE_MESSAGE 1 1.16 0.00 1.59 113 DKIM_ADSP_CUSTOM_MED 1 2.33 4.35 1.59 114 USER_IN_WELCOMELIST 1 1.16 0.00 1.59 115 TR_Symld_Words 1 1.16 0.00 1.59 116 XMBody_95 1 1.16 0.00 1.59 117 TR_XM_DK_Bayes2 1 2.33 4.35 1.59 118 FORGED_GMAIL_RCVD 1 2.33 4.35 1.59 119 RELAYCOUNTRY_IE 1 1.16 0.00 1.59 120 HTML_IMAGE_ONLY_20 1 1.16 0.00 1.59 121 XM_DIRTYINTL 1 4.65 13.04 1.59 122 XMSexyCombo_05 1 5.81 17.39 1.59 123 DATE_IN_PAST_06_12 1 1.16 0.00 1.59 124 BOUNCE_MESSAGE 1 1.16 0.00 1.59 125 XM_ShortIntro_01 1 2.33 4.35 1.59 126 T_XMDrugObfuBody_14 1 2.33 4.35 1.59 127 XMSubNoVowel 1 2.33 4.35 1.59 128 XM_Evil_Numbers_Gen 1 2.33 4.35 1.59 129 XMEmptyBody_01 1 1.16 0.00 1.59 130 HK_RANDOM_REPLYTO 1 1.16 0.00 1.59 131 FILL_THIS_FORM 1 1.16 0.00 1.59 132 TR_XM_PHPForged 1 1.16 0.00 1.59 133 RELAYCOUNTRY_TW 1 1.16 0.00 1.59 134 XMSlimDrugH 1 1.16 0.00 1.59 135 TM2_M_BODY_EMPTY 1 1.16 0.00 1.59 136 TR_XM_DKIM_Undo 1 2.33 4.35 1.59 137 XMHTML_After_End 1 3.49 8.70 1.59 138 TR_XM_DK_Bayes1 1 2.33 4.35 1.59 139 URI_NOVOWEL 1 1.16 0.00 1.59 140 XM_PDF 1 1.16 0.00 1.59 141 XM_Body_Obfu01 1 1.16 0.00 1.59 142 XM_H_PHPOS 1 1.16 0.00 1.59 143 TR_XM_FormFill2 1 1.16 0.00 1.59 144 TR_XM_PHPDW 1 1.16 0.00 1.59 145 KHOP_HELO_FCRDNS 1 2.33 4.35 1.59 146 XM_B_Unsub2 1 2.33 4.35 1.59 147 XMSubMetaSx_00 1 4.65 13.04 1.59 148 XM_ZIP 1 1.16 0.00 1.59 149 TM2_M_URI_OPT_OUT 1 1.16 0.00 1.59 150 T_FILL_THIS_FORM_FRAUD_PHISH 1 1.16 0.00 1.59 151 USER_IN_WHITELIST 1 1.16 0.00 1.59 152 XM_E_Blogspot 1 1.16 0.00 1.59 153 XM_URI_RBL 1 2.33 4.35 1.59 154 TR_XM_SpammyWords2 1 2.33 4.35 1.59 155 BAYES_05 1 1.16 0.00 1.59 156 RELAYCOUNTRY_AU 1 1.16 0.00 1.59 ----------------------------------------------------------------------