Email: 112 Autolearn: 0 AvgScore: 6.27 AvgScanTime: 2.23 sec Spam: 54 Autolearn: 0 AvgScore: 13.96 AvgScanTime: 1.84 sec Ham: 58 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 2.59 sec Time Spent Running SA: 0.07 hours Time Spent Processing Spam: 0.03 hours Time Spent Processing Ham: 0.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 54 85.71 100.00 72.41 2 XM_B_Unicode 52 72.32 96.30 50.00 3 DKIM_SIGNED 51 78.57 94.44 63.79 4 DCC_CHECK_NEGATIVE 50 93.75 92.59 94.83 5 RELAYCOUNTRY_US 48 76.79 88.89 65.52 6 T_SCC_BODY_TEXT_LINE 47 84.82 87.04 82.76 7 XM_B_SpammyWords 45 58.04 83.33 34.48 8 XMListUnsubscribeExists 44 58.04 81.48 36.21 9 RELAYCOUNTRY_META 39 41.07 72.22 12.07 10 XMSubLong 38 46.43 70.37 24.14 11 TR_XM_SpammyRelay 35 33.93 64.81 5.17 12 HTML_IMAGE_RATIO_02 35 32.14 64.81 1.72 13 FVGT_m_MULTI_ODD 35 41.96 64.81 20.69 14 DKIM_ADSP_CUSTOM_MED 34 31.25 62.96 1.72 15 FORGED_GMAIL_RCVD 34 31.25 62.96 1.72 16 DKIM_INVALID 33 31.25 61.11 3.45 17 TR_XM_SpammyWords5 33 29.46 61.11 0.00 18 NML_ADSP_CUSTOM_MED 33 29.46 61.11 0.00 19 MPART_ALT_DIFF_COUNT 32 28.57 59.26 0.00 20 TR_Sbj_FN_Bdy 32 28.57 59.26 0.00 21 SUBJ_ALL_CAPS 32 28.57 59.26 0.00 22 RELAYCOUNTRY_BE 32 28.57 59.26 0.00 23 HTML_IMAGE_ONLY_20 32 29.46 59.26 1.72 24 BAYES_50 28 58.93 51.85 65.52 25 URIBL_BLACK 22 19.64 40.74 0.00 26 DKIM_VALID 18 47.32 33.33 60.34 27 XM_DK_Pass 18 47.32 33.33 60.34 28 XM_B_Unicode3 17 32.14 31.48 32.76 29 HTML_FONT_LOW_CONTRAST 14 25.89 25.93 25.86 30 DKIM_VALID_AU 14 34.82 25.93 43.10 31 RCVD_IN_MSPIKE_H2 11 16.07 20.37 12.07 32 XM_B_SpammyWords2 11 16.96 20.37 13.79 33 LOC_TINY_FONT_1 11 23.21 20.37 25.86 34 MIME_HTML_ONLY 8 15.18 14.81 15.52 35 XM_DK_Undo_02 7 6.25 12.96 0.00 36 BAYES_80 7 9.82 12.96 6.90 37 XM_B_Unsub 7 9.82 12.96 6.90 38 TR_XM_BayesUnsub 7 9.82 12.96 6.90 39 LOTS_OF_MONEY 7 8.93 12.96 5.17 40 T_KAM_HTML_FONT_INVALID 7 17.86 12.96 22.41 41 BAYES_99 7 6.25 12.96 0.00 42 DKIM_VALID_EF 6 21.43 11.11 31.03 43 BAYES_60 6 10.71 11.11 10.34 44 T_TM2_M_HEADER_IN_MSG 6 23.21 11.11 34.48 45 TR_XM_SpammyWords4 6 8.04 11.11 5.17 46 TM2_M_URI_OPT_OUT 5 5.36 9.26 1.72 47 HTML_IMAGE_RATIO_06 5 5.36 9.26 1.72 48 XM_B_Investor 5 5.36 9.26 1.72 49 TR_Caps_n_Bayes_80 5 4.46 9.26 0.00 50 XM_Body_Dirty_Words 5 11.61 9.26 13.79 51 RCVD_IN_MSPIKE_WL 4 16.96 7.41 25.86 52 BAYES_95 4 5.36 7.41 3.45 53 DCC_CHECK 4 6.25 7.41 5.17 54 BAYES_999 4 3.57 7.41 0.00 55 TR_XM_UnparsRelay 3 3.57 5.56 1.72 56 TR_XM_DKIM_Undo 3 2.68 5.56 0.00 57 TR_XM_DK_Unsub 3 9.82 5.56 13.79 58 UNPARSEABLE_RELAY 3 9.82 5.56 13.79 59 RCVD_IN_MSPIKE_H3 3 6.25 5.56 6.90 60 XM_Multi_Part_URI 3 16.07 5.56 25.86 61 UNTRUSTED_Relay 3 3.57 5.56 1.72 62 XMSexyCombo_05 3 3.57 5.56 1.72 63 RELAYCOUNTRY_CA 2 1.79 3.70 0.00 64 BOTNET 2 1.79 3.70 0.00 65 TR_XM_NoHeaderRelay 2 2.68 3.70 1.72 66 XM_B_SpammyWords3 2 3.57 3.70 3.45 67 TR_DCC_Bayes_99 2 1.79 3.70 0.00 68 MIME_CHARSET_FARAWAY 2 6.25 3.70 8.62 69 XMNumbers 2 5.36 3.70 6.90 70 NUMERIC_HTTP_ADDR 2 1.79 3.70 0.00 71 TM2_M_OBFU_COMMENT 2 2.68 3.70 1.72 72 HTML_COMMENT_SAVED_URL 2 1.79 3.70 0.00 73 MIME_QP_LONG_LINE 2 8.04 3.70 12.07 74 RELAYCOUNTRY_AU 2 5.36 3.70 6.90 75 XM_UB50 2 2.68 3.70 1.72 76 TR_Caps_n_Bayes_95 2 1.79 3.70 0.00 77 XMStrtUSub 2 5.36 3.70 6.90 78 XM_H_Long_From01 2 4.46 3.70 5.17 79 RCVD_IN_MSPIKE_L3 1 0.89 1.85 0.00 80 XM_SPF_SoftFail 1 1.79 1.85 1.72 81 TR_XM_MSPIKECOMBO 1 0.89 1.85 0.00 82 XMSubPhish11 1 0.89 1.85 0.00 83 TM2_M_VERY_LONG_WORD 1 5.36 1.85 8.62 84 RELAYCOUNTRY_TW 1 0.89 1.85 0.00 85 TR_XM_SB_Phish 1 0.89 1.85 0.00 86 PDS_RDNS_DYNAMIC_FP 1 0.89 1.85 0.00 87 RCVD_IN_MSPIKE_H5 1 8.04 1.85 13.79 88 TR_XM_InvalidRelay 1 1.79 1.85 1.72 89 XMHTML_After_End 1 0.89 1.85 0.00 90 TooManyTo_001 1 5.36 1.85 8.62 91 HELO_DYNAMIC_SPLIT_IP 1 0.89 1.85 0.00 92 BOTNET_IPINHOSTNAME 1 1.79 1.85 1.72 93 BAYES_00 1 4.46 1.85 6.90 94 T_REMOTE_IMAGE 1 2.68 1.85 3.45 95 TR_XM_MaxSPIKE 1 0.89 1.85 0.00 96 TVD_RCVD_IP 1 0.89 1.85 0.00 97 HTML_TAG_BALANCE_BODY 1 1.79 1.85 1.72 98 XMSubLongNoVowel 1 0.89 1.85 0.00 99 TR_XM_MSPIKECOMBO2 1 0.89 1.85 0.00 100 XMHTMLBadTable_001 1 0.89 1.85 0.00 101 XMSubMetaSx_00 1 1.79 1.85 1.72 102 RCVD_IN_PSBL 1 0.89 1.85 0.00 103 T_XMHurry_00 1 0.89 1.85 0.00 104 LotsOfNums_01 1 2.68 1.85 3.45 105 NORDNS_LOW_CONTRAST 1 0.89 1.85 0.00 106 TR_XM_SpammyWords2 1 0.89 1.85 0.00 107 CHARSET_FARAWAY_HEADER 1 0.89 1.85 0.00 108 XMNoVowels 1 2.68 1.85 3.45 109 DEAR_FRIEND 1 1.79 1.85 1.72 110 RELAYCOUNTRY_CN 1 0.89 1.85 0.00 111 XM_H_Long_From02 1 0.89 1.85 0.00 112 T_TooManySym_01 1 6.25 1.85 10.34 113 HTML_IMAGE_RATIO_04 1 1.79 1.85 1.72 114 RCVD_IN_MSPIKE_BL 1 0.89 1.85 0.00 115 XMBSHREFv2 1 0.89 1.85 0.00 116 T_XMDrugObfuBody_14 1 4.46 1.85 6.90 117 XM_UncommonTLD01 1 5.36 1.85 8.62 118 XM_B_Unsub2 1 2.68 1.85 3.45 119 RDNS_DYNAMIC 1 0.89 1.85 0.00 120 CHARSET_FARAWAY 1 0.89 1.85 0.00 121 XMStockSpam_06 1 0.89 1.85 0.00 122 XMCapTrack 1 1.79 1.85 1.72 123 XM_DIRTYINTL 1 1.79 1.85 1.72 124 TR_Caps_n_Bayes_99 1 0.89 1.85 0.00 125 TR_XM_PhishingBody 1 2.68 1.85 3.45 126 HTML_FONT_TINY_NORDNS 1 0.89 1.85 0.00 127 XM_B_SpammyWords4 1 1.79 1.85 1.72 128 T_XMDrugObfuBody_08 1 0.89 1.85 0.00 129 XMPhish08 1 0.89 1.85 0.00 130 XM_RXBody 1 0.89 1.85 0.00 131 HTML_IMAGE_RATIO_08 1 1.79 1.85 1.72 132 TR_XM_SpammyWords3 1 0.89 1.85 0.00 133 XMSubGarbage 1 0.89 1.85 0.00 134 MIME_HTML_MOSTLY 1 0.89 1.85 0.00 135 RELAYCOUNTRY_RU 1 1.79 1.85 1.72 136 HTML_IMAGE_ONLY_08 1 0.89 1.85 0.00 137 BAYES_20 1 0.89 1.85 0.00 138 XM_CamelCaseFrm001 1 4.46 1.85 6.90 139 RCVD_IN_BL_SPAMCOP_NET 1 0.89 1.85 0.00 140 FSL_BULK_SIG 1 2.68 1.85 3.45 141 XMSubNoVowel 1 1.79 1.85 1.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 55 93.75 92.59 94.83 2 T_SCC_BODY_TEXT_LINE 48 84.82 87.04 82.76 3 HTML_MESSAGE 42 85.71 100.00 72.41 4 RELAYCOUNTRY_US 38 76.79 88.89 65.52 5 BAYES_50 38 58.93 51.85 65.52 6 DKIM_SIGNED 37 78.57 94.44 63.79 7 XM_DK_Pass 35 47.32 33.33 60.34 8 DKIM_VALID 35 47.32 33.33 60.34 9 XM_B_Unicode 29 72.32 96.30 50.00 10 DKIM_VALID_AU 25 34.82 25.93 43.10 11 XMListUnsubscribeExists 21 58.04 81.48 36.21 12 T_TM2_M_HEADER_IN_MSG 20 23.21 11.11 34.48 13 XM_B_SpammyWords 20 58.04 83.33 34.48 14 XM_B_Unicode3 19 32.14 31.48 32.76 15 DKIM_VALID_EF 18 21.43 11.11 31.03 16 ALL_TRUSTED 17 15.18 0.00 29.31 17 XM_Multi_Part_URI 15 16.07 5.56 25.86 18 LOC_TINY_FONT_1 15 23.21 20.37 25.86 19 RCVD_IN_MSPIKE_WL 15 16.96 7.41 25.86 20 HTML_FONT_LOW_CONTRAST 15 25.89 25.93 25.86 21 XMSubLong 14 46.43 70.37 24.14 22 T_KAM_HTML_FONT_INVALID 13 17.86 12.96 22.41 23 FVGT_m_MULTI_ODD 12 41.96 64.81 20.69 24 MIME_HTML_ONLY 9 15.18 14.81 15.52 25 XM_Body_Dirty_Words 8 11.61 9.26 13.79 26 RCVD_IN_MSPIKE_H5 8 8.04 1.85 13.79 27 UNPARSEABLE_RELAY 8 9.82 5.56 13.79 28 TR_XM_DK_Unsub 8 9.82 5.56 13.79 29 XM_B_SpammyWords2 8 16.96 20.37 13.79 30 MIME_QP_LONG_LINE 7 8.04 3.70 12.07 31 RCVD_IN_MSPIKE_H2 7 16.07 20.37 12.07 32 RELAYCOUNTRY_META 7 41.07 72.22 12.07 33 IN_ZIMBRA_NJ_WHITELIST 6 5.36 0.00 10.34 34 BAYES_60 6 10.71 11.11 10.34 35 T_TooManySym_02 6 5.36 0.00 10.34 36 T_TooManySym_01 6 6.25 1.85 10.34 37 XM_UncommonTLD01 5 5.36 1.85 8.62 38 XM_DKIMWhitelistDomains 5 4.46 0.00 8.62 39 TM2_M_VERY_LONG_WORD 5 5.36 1.85 8.62 40 TooManyTo_001 5 5.36 1.85 8.62 41 MIME_CHARSET_FARAWAY 5 6.25 3.70 8.62 42 T_XMDrugObfuBody_14 4 4.46 1.85 6.90 43 RELAYCOUNTRY_AU 4 5.36 3.70 6.90 44 XM_CamelCaseFrm001 4 4.46 1.85 6.90 45 XMStrtUSub 4 5.36 3.70 6.90 46 XM_Evil_Numbers_Gen 4 3.57 0.00 6.90 47 BAYES_80 4 9.82 12.96 6.90 48 BAYES_00 4 4.46 1.85 6.90 49 XMNumbers 4 5.36 3.70 6.90 50 XM_H_PHPMailer 4 3.57 0.00 6.90 51 TR_XM_BayesUnsub 4 9.82 12.96 6.90 52 XM_B_Unsub 4 9.82 12.96 6.90 53 RCVD_IN_MSPIKE_H3 4 6.25 5.56 6.90 54 BOUNCE_MESSAGE 3 2.68 0.00 5.17 55 BAYES_40 3 2.68 0.00 5.17 56 LOTS_OF_MONEY 3 8.93 12.96 5.17 57 DCC_CHECK 3 6.25 7.41 5.17 58 XM_H_Long_From01 3 4.46 3.70 5.17 59 RCVD_IN_MSPIKE_H4 3 2.68 0.00 5.17 60 TR_XM_SpammyWords4 3 8.04 11.11 5.17 61 ANY_BOUNCE_MESSAGE 3 2.68 0.00 5.17 62 TO_MALFORMED 3 2.68 0.00 5.17 63 TR_XM_SpammyRelay 3 33.93 64.81 5.17 64 XMGappySubj_01 3 2.68 0.00 5.17 65 INVALID_MSGID 3 2.68 0.00 5.17 66 XM_B_Unsub2 2 2.68 1.85 3.45 67 TR_XM_DK_Bayes 2 1.79 0.00 3.45 68 RCVD_IN_IADB_DK 2 1.79 0.00 3.45 69 TR_XM_PhishingBody 2 2.68 1.85 3.45 70 XM_ProductURIs 2 1.79 0.00 3.45 71 SCC_BODY_URI_ONLY 2 1.79 0.00 3.45 72 XM_B_Phish_Phrases 2 1.79 0.00 3.45 73 FSL_BULK_SIG 2 2.68 1.85 3.45 74 TVD_SPACE_RATIO 2 1.79 0.00 3.45 75 MISSING_HEADERS 2 1.79 0.00 3.45 76 DKIM_INVALID 2 31.25 61.11 3.45 77 XM_B_SpammyTLD 2 1.79 0.00 3.45 78 XM_B_SpammyWords3 2 3.57 3.70 3.45 79 XM_B_SEO 2 1.79 0.00 3.45 80 T_REMOTE_IMAGE 2 2.68 1.85 3.45 81 BAYES_95 2 5.36 7.41 3.45 82 XM_SendGrid 2 1.79 0.00 3.45 83 RCVD_IN_IADB_LISTED 2 1.79 0.00 3.45 84 RCVD_IN_IADB_SENDERID 2 1.79 0.00 3.45 85 XMNoVowels 2 2.68 1.85 3.45 86 RCVD_IN_IADB_SPF 2 1.79 0.00 3.45 87 LotsOfNums_01 2 2.68 1.85 3.45 88 XMLngstWrd_00 2 1.79 0.00 3.45 89 TR_XM_DK_Bayes1 2 1.79 0.00 3.45 90 USER_IN_DEF_DKIM_WL 2 1.79 0.00 3.45 91 MAILING_LIST_MULTI 1 0.89 0.00 1.72 92 MIME_BOUND_DIGITS_15 1 0.89 0.00 1.72 93 XMCapTrack 1 1.79 1.85 1.72 94 BAYES_05 1 0.89 0.00 1.72 95 XM_H_PHPOS 1 0.89 0.00 1.72 96 RCVD_IN_IADB_VOUCHED 1 0.89 0.00 1.72 97 UNTRUSTED_Relay 1 3.57 5.56 1.72 98 TR_XM_PHPForged 1 0.89 0.00 1.72 99 XM_S_SubURI 1 0.89 0.00 1.72 100 XM_B_SpammyWords4 1 1.79 1.85 1.72 101 XMDateMe_00 1 0.89 0.00 1.72 102 KHOP_HELO_FCRDNS 1 0.89 0.00 1.72 103 RELAYCOUNTRY_IT 1 0.89 0.00 1.72 104 DKIM_ADSP_CUSTOM_MED 1 31.25 62.96 1.72 105 XMSolicitRefs_0 1 0.89 0.00 1.72 106 XM_DIRTYINTL 1 1.79 1.85 1.72 107 TR_XM_FormFill2 1 0.89 0.00 1.72 108 XMLngstWrd_02 1 0.89 0.00 1.72 109 XMLngstWrd_03 1 0.89 0.00 1.72 110 TR_XM_DK_SendGrid 1 0.89 0.00 1.72 111 XMLngstWrd_04 1 0.89 0.00 1.72 112 XM_UB50 1 2.68 3.70 1.72 113 XMPhish14 1 0.89 0.00 1.72 114 RELAYCOUNTRY_RU 1 1.79 1.85 1.72 115 XMSexyCombo_05 1 3.57 5.56 1.72 116 HTML_IMAGE_RATIO_08 1 1.79 1.85 1.72 117 XMBody_95 1 0.89 0.00 1.72 118 FROM_GOV_DKIM_AU 1 0.89 0.00 1.72 119 HTML_IMAGE_ONLY_20 1 29.46 59.26 1.72 120 RELAYCOUNTRY_IE 1 0.89 0.00 1.72 121 XMSubNoVowel 1 1.79 1.85 1.72 122 XMLngstWrd_01 1 0.89 0.00 1.72 123 FORGED_GMAIL_RCVD 1 31.25 62.96 1.72 124 XMManySubDom_07 1 0.89 0.00 1.72 125 XM_H_Trusted_IP 1 0.89 0.00 1.72 126 XMManySubDom_06 1 0.89 0.00 1.72 127 TR_XM_PHPDW 1 0.89 0.00 1.72 128 HTML_MIME_NO_HTML_TAG 1 0.89 0.00 1.72 129 TooManyTo_002 1 0.89 0.00 1.72 130 TR_XM_DK_Bayes2 1 0.89 0.00 1.72 131 TR_XM_NoHeaderRelay 1 2.68 3.70 1.72 132 NAME_EMAIL_DIFF 1 0.89 0.00 1.72 133 T_OBFU_PDF_ATTACH 1 0.89 0.00 1.72 134 HK_RANDOM_ENVFROM 1 0.89 0.00 1.72 135 XM_H_PHPOS_M 1 0.89 0.00 1.72 136 TM2_M_URI_OPT_OUT 1 5.36 9.26 1.72 137 TR_XM_UnparsRelay 1 3.57 5.56 1.72 138 XM_SPF_SoftFail 1 1.79 1.85 1.72 139 HTML_IMAGE_RATIO_06 1 5.36 9.26 1.72 140 XM_Body_Obfu01 1 0.89 0.00 1.72 141 XM_DK_Undo_01 1 0.89 0.00 1.72 142 HTML_IMAGE_RATIO_02 1 32.14 64.81 1.72 143 XMSubGiftCard1 1 0.89 0.00 1.72 144 TR_Symld_Words 1 0.89 0.00 1.72 145 TR_XM_InvalidRelay 1 1.79 1.85 1.72 146 T_XMDrugObfuBody_00 1 0.89 0.00 1.72 147 XM_PDF 1 0.89 0.00 1.72 148 XM_B_Investor 1 5.36 9.26 1.72 149 HTML_TAG_BALANCE_BODY 1 1.79 1.85 1.72 150 PHP_SCRIPT 1 0.89 0.00 1.72 151 FROM_GOV_SPOOF 1 0.89 0.00 1.72 152 BOTNET_IPINHOSTNAME 1 1.79 1.85 1.72 153 T_TooManySym_03 1 0.89 0.00 1.72 154 RCVD_IN_RP_SAFE 1 0.89 0.00 1.72 155 HTML_IMAGE_RATIO_04 1 1.79 1.85 1.72 156 XMManySubDom_08 1 0.89 0.00 1.72 157 TR_Legit_01 1 0.89 0.00 1.72 158 DEAR_FRIEND 1 1.79 1.85 1.72 159 TM2_M_OBFU_COMMENT 1 2.68 3.70 1.72 160 XMBody_17 1 0.89 0.00 1.72 161 RCVD_IN_VALIDITY_SAFE 1 0.89 0.00 1.72 162 CTE_8BIT_MISMATCH 1 0.89 0.00 1.72 163 XM_Dr_From 1 0.89 0.00 1.72 164 XMSubMetaSx_00 1 1.79 1.85 1.72 165 XM_B_Phish66 1 0.89 0.00 1.72 ----------------------------------------------------------------------