Email: 97 Autolearn: 0 AvgScore: 3.29 AvgScanTime: 1.68 sec Spam: 27 Autolearn: 0 AvgScore: 13.74 AvgScanTime: 2.53 sec Ham: 70 Autolearn: 0 AvgScore: -0.74 AvgScanTime: 1.35 sec Time Spent Running SA: 0.05 hours Time Spent Processing Spam: 0.02 hours Time Spent Processing Ham: 0.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 24 93.81 88.89 95.71 2 DKIM_SIGNED 22 74.23 81.48 71.43 3 HTML_MESSAGE 22 75.26 81.48 72.86 4 XM_DK_Pass 21 71.13 77.78 68.57 5 DKIM_VALID 21 71.13 77.78 68.57 6 XM_B_SpammyWords 20 47.42 74.07 37.14 7 XM_B_Unicode 17 59.79 62.96 58.57 8 DKIM_VALID_AU 15 53.61 55.56 52.86 9 XMListUnsubscribeExists 15 41.24 55.56 35.71 10 RCVD_IN_MSPIKE_H2 14 39.18 51.85 34.29 11 RELAYCOUNTRY_US 14 63.92 51.85 68.57 12 XM_B_Unicode3 13 39.18 48.15 35.71 13 BAYES_50 12 53.61 44.44 57.14 14 BAYES_99 12 14.43 44.44 2.86 15 RELAYCOUNTRY_META 11 17.53 40.74 8.57 16 XM_B_SpammyWords2 11 23.71 40.74 17.14 17 XM_DK_Undo_02 10 11.34 37.04 1.43 18 BAYES_999 10 12.37 37.04 2.86 19 HTML_FONT_LOW_CONTRAST 10 22.68 37.04 17.14 20 TR_XM_SpammyRelay 9 13.40 33.33 5.71 21 XM_B_SpammyWords3 8 11.34 29.63 4.29 22 TR_XM_DKIM_Undo 8 9.28 29.63 1.43 23 T_KAM_HTML_FONT_INVALID 8 15.46 29.63 10.00 24 DKIM_VALID_EF 8 30.93 29.63 31.43 25 XM_Body_Dirty_Words 8 17.53 29.63 12.86 26 LOC_TINY_FONT_1 8 16.49 29.63 11.43 27 UNTRUSTED_Relay 7 9.28 25.93 2.86 28 XM_Multi_Part_URI 7 15.46 25.93 11.43 29 MIME_HTML_MOSTLY 6 8.25 22.22 2.86 30 FVGT_m_MULTI_ODD 6 13.40 22.22 10.00 31 MIME_HTML_ONLY 6 22.68 22.22 22.86 32 XM_B_Unsub 6 13.40 22.22 10.00 33 T_XMDrugObfuBody_08 5 8.25 18.52 4.29 34 XM_Body_Dirty_Words_01 5 6.19 18.52 1.43 35 TR_XM_BayesUnsub 5 9.28 18.52 5.71 36 T_TM2_M_HEADER_IN_MSG 5 19.59 18.52 20.00 37 T_XMDrugObfuBody_14 5 8.25 18.52 4.29 38 XM_B_SpammyWords4 5 6.19 18.52 1.43 39 XM_DIRTYINTL 4 6.19 14.81 2.86 40 RELAYCOUNTRY_CA 4 7.22 14.81 4.29 41 XM_SendGrid 4 9.28 14.81 7.14 42 XM_UB50 4 6.19 14.81 2.86 43 LOTS_OF_MONEY 4 6.19 14.81 2.86 44 UNPARSEABLE_RELAY 4 12.37 14.81 11.43 45 RCVD_IN_MSPIKE_WL 4 13.40 14.81 12.86 46 TR_XM_UnparsRelay 4 6.19 14.81 2.86 47 TR_XM_InvalidRelay 4 4.12 14.81 0.00 48 XM_SPF_SoftFail 3 5.15 11.11 2.86 49 DCC_CHECK 3 6.19 11.11 4.29 50 TR_XM_SpammyWords4 3 3.09 11.11 0.00 51 TR_XM_FormFill2 3 4.12 11.11 1.43 52 XMSubLong 3 20.62 11.11 24.29 53 TR_XM_MSPIKECOMBO 3 4.12 11.11 1.43 54 RELAYCOUNTRY_FR 3 4.12 11.11 1.43 55 BOTNET 3 3.09 11.11 0.00 56 TR_XM_PHPDW 3 4.12 11.11 1.43 57 TR_XM_SpammyWords3 3 3.09 11.11 0.00 58 RCVD_IN_MSPIKE_H3 3 9.28 11.11 8.57 59 RCVD_IN_MSPIKE_BL 3 4.12 11.11 1.43 60 TR_XM_PHPForged 3 4.12 11.11 1.43 61 RCVD_IN_MSPIKE_L3 3 3.09 11.11 0.00 62 FROM_EXCESS_BASE64 3 3.09 11.11 0.00 63 XMDateMe_00 3 3.09 11.11 0.00 64 XM_H_PHPOS 3 4.12 11.11 1.43 65 RELAYCOUNTRY_RU 2 3.09 7.41 1.43 66 HTML_IMAGE_ONLY_20 2 4.12 7.41 2.86 67 RELAYCOUNTRY_ES 2 2.06 7.41 0.00 68 HTML_IMAGE_RATIO_04 2 4.12 7.41 2.86 69 RCVD_IN_PSBL 2 2.06 7.41 0.00 70 TR_XM_Undi_Recip11 2 2.06 7.41 0.00 71 XM_B_Investor 2 3.09 7.41 1.43 72 T_FILL_THIS_FORM_SHORT 2 3.09 7.41 1.43 73 XM_H_Undi_Recip 2 2.06 7.41 0.00 74 HTML_SHORT_LINK_IMG_3 2 2.06 7.41 0.00 75 DKIM_ADSP_CUSTOM_MED 2 2.06 7.41 0.00 76 XMSubNoVowel 2 4.12 7.41 2.86 77 NML_ADSP_CUSTOM_MED 2 2.06 7.41 0.00 78 TR_XM_NoHeaderRelay 2 2.06 7.41 0.00 79 YOU_INHERIT 2 2.06 7.41 0.00 80 XM_Evil_Numbers_Gen 2 12.37 7.41 14.29 81 MONEY_FRAUD_5 2 2.06 7.41 0.00 82 CK_HELO_GENERIC 2 2.06 7.41 0.00 83 FORGED_GMAIL_RCVD 2 2.06 7.41 0.00 84 T_HTML_TAG_BALANCE_CENTER 2 2.06 7.41 0.00 85 XMSubLongNoVowel 2 2.06 7.41 0.00 86 XM_Combo_Sbj 2 2.06 7.41 0.00 87 MAILING_LIST_MULTI 2 4.12 7.41 2.86 88 ALL_TRUSTED 2 18.56 7.41 22.86 89 RCVD_IN_SORBS_DUL 2 2.06 7.41 0.00 90 TR_XM_Undi_Recip6 2 2.06 7.41 0.00 91 HTML_IMAGE_RATIO_02 2 3.09 7.41 1.43 92 ADVANCE_FEE_2_NEW_MONEY 2 2.06 7.41 0.00 93 XM_OfRef6 2 2.06 7.41 0.00 94 TR_XM_Undi_Recip5 2 2.06 7.41 0.00 95 TR_XM_Undi_RecipCombo2 2 2.06 7.41 0.00 96 UNDISC_MONEY 2 2.06 7.41 0.00 97 RCVD_IN_BL_SPAMCOP_NET 2 2.06 7.41 0.00 98 XM_UB99 1 1.03 3.70 0.00 99 XM_H_Long_From01 1 5.15 3.70 5.71 100 XM_B_REG_HTML 1 1.03 3.70 0.00 101 SUBJ_ILLEGAL_CHARS 1 1.03 3.70 0.00 102 XM_UncommonTLD01 1 10.31 3.70 12.86 103 HELO_NODOT 1 2.06 3.70 1.43 104 ANY_BOUNCE_MESSAGE 1 3.09 3.70 2.86 105 XM_UB999 1 1.03 3.70 0.00 106 BAYES_20 1 2.06 3.70 1.43 107 XM_H_PHPOS_M 1 1.03 3.70 0.00 108 NO_DNS_FOR_FROM 1 1.03 3.70 0.00 109 MIME_QP_LONG_LINE 1 4.12 3.70 4.29 110 T_XMHurry_00 1 1.03 3.70 0.00 111 T_TooManySym_01 1 10.31 3.70 12.86 112 URI_TRY_3LD 1 1.03 3.70 0.00 113 XMClaimOffer 1 1.03 3.70 0.00 114 RCVD_IN_RP_CERTIFIED 1 2.06 3.70 1.43 115 BAYES_60 1 9.28 3.70 11.43 116 URI_OPTOUT_3LD 1 1.03 3.70 0.00 117 SpammyFromTLD_01 1 1.03 3.70 0.00 118 XM_TLDProd2 1 1.03 3.70 0.00 119 DKIM_ADSP_NXDOMAIN 1 1.03 3.70 0.00 120 XMGenDplmaNmb 1 1.03 3.70 0.00 121 RCVD_IN_IADB_LISTED 1 1.03 3.70 0.00 122 XM_UB80 1 1.03 3.70 0.00 123 BAYES_80 1 1.03 3.70 0.00 124 BOTNET_IPINHOSTNAME 1 1.03 3.70 0.00 125 LONG_HEX_URI 1 1.03 3.70 0.00 126 HELO_NO_DOMAIN 1 2.06 3.70 1.43 127 XM_Lotto 1 1.03 3.70 0.00 128 DRUGS_ERECTILE 1 1.03 3.70 0.00 129 TR_XM_INV_DKIM 1 1.03 3.70 0.00 130 RCVD_IN_MSPIKE_H4 1 4.12 3.70 4.29 131 XM_H_PHPMailer 1 1.03 3.70 0.00 132 BOUNCE_MESSAGE 1 3.09 3.70 2.86 133 BOTNET_NORDNS 1 1.03 3.70 0.00 134 RCVD_IN_IADB_VOUCHED 1 1.03 3.70 0.00 135 LotsOfNums_01 1 4.12 3.70 4.29 136 XMBrknScrpt_02 1 3.09 3.70 2.86 137 DRUGS_ANXIETY 1 1.03 3.70 0.00 138 XM_B_Crypto 1 1.03 3.70 0.00 139 IMPOTENCE 1 1.03 3.70 0.00 140 FSL_HELO_NON_FQDN_1 1 1.03 3.70 0.00 141 XMSubPhish11 1 4.12 3.70 4.29 142 XMSolicitRefs_0 1 1.03 3.70 0.00 143 TR_XM_MaxWHORU 1 1.03 3.70 0.00 144 DKIM_INVALID 1 3.09 3.70 2.86 145 SUBJECT_NEEDS_ENCODING 1 1.03 3.70 0.00 146 XM_B_Phish_Phrases 1 6.19 3.70 7.14 147 T_XMDrugObfuBody_00 1 1.03 3.70 0.00 148 TR_LOTS_OF_MONEY2 1 1.03 3.70 0.00 149 TR_XM_COVIDMETA4 1 1.03 3.70 0.00 150 PP_MIME_FAKE_ASCII_TEXT 1 1.03 3.70 0.00 151 TR_XM_Base64_L1 1 1.03 3.70 0.00 152 XM_B_SpammyTLD 1 2.06 3.70 1.43 153 XM_B_COVIDMETA 1 1.03 3.70 0.00 154 RCVD_IN_RP_SAFE 1 2.06 3.70 1.43 155 TR_Sbj_FN_Bdy 1 1.03 3.70 0.00 156 XM_DK_Undo_01 1 1.03 3.70 0.00 157 URI_NOVOWEL 1 1.03 3.70 0.00 158 TR_DCC_Bayes_99 1 2.06 3.70 1.43 159 T_MONEY_PERCENT 1 1.03 3.70 0.00 160 T_REMOTE_IMAGE 1 5.15 3.70 5.71 161 XMDiploma_00 1 1.03 3.70 0.00 162 TR_XM_SB_Phish 1 4.12 3.70 4.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 67 93.81 88.89 95.71 2 HTML_MESSAGE 51 75.26 81.48 72.86 3 DKIM_SIGNED 50 74.23 81.48 71.43 4 XM_DK_Pass 48 71.13 77.78 68.57 5 RELAYCOUNTRY_US 48 63.92 51.85 68.57 6 DKIM_VALID 48 71.13 77.78 68.57 7 XM_B_Unicode 41 59.79 62.96 58.57 8 BAYES_50 40 53.61 44.44 57.14 9 DKIM_VALID_AU 37 53.61 55.56 52.86 10 XM_B_SpammyWords 26 47.42 74.07 37.14 11 XM_B_Unicode3 25 39.18 48.15 35.71 12 XMListUnsubscribeExists 25 41.24 55.56 35.71 13 RCVD_IN_MSPIKE_H2 24 39.18 51.85 34.29 14 DKIM_VALID_EF 22 30.93 29.63 31.43 15 XMSubLong 17 20.62 11.11 24.29 16 ALL_TRUSTED 16 18.56 7.41 22.86 17 MIME_HTML_ONLY 16 22.68 22.22 22.86 18 T_TM2_M_HEADER_IN_MSG 14 19.59 18.52 20.00 19 HTML_FONT_LOW_CONTRAST 12 22.68 37.04 17.14 20 XM_B_SpammyWords2 12 23.71 40.74 17.14 21 TR_XM_DK_Bayes 11 11.34 0.00 15.71 22 BAYES_00 11 11.34 0.00 15.71 23 TR_XM_DK_Bayes1 11 11.34 0.00 15.71 24 TR_XM_DK_Bayes2 10 10.31 0.00 14.29 25 XM_Evil_Numbers_Gen 10 12.37 7.41 14.29 26 XM_UncommonTLD01 9 10.31 3.70 12.86 27 RCVD_IN_MSPIKE_WL 9 13.40 14.81 12.86 28 XM_Body_Dirty_Words 9 17.53 29.63 12.86 29 T_TooManySym_01 9 10.31 3.70 12.86 30 BAYES_60 8 9.28 3.70 11.43 31 XM_Multi_Part_URI 8 15.46 25.93 11.43 32 LOC_TINY_FONT_1 8 16.49 29.63 11.43 33 UNPARSEABLE_RELAY 8 12.37 14.81 11.43 34 T_TooManySym_02 7 7.22 0.00 10.00 35 T_KAM_HTML_FONT_INVALID 7 15.46 29.63 10.00 36 XM_B_Unsub 7 13.40 22.22 10.00 37 FVGT_m_MULTI_ODD 7 13.40 22.22 10.00 38 IN_ZIMBRA_NJ_WHITELIST 6 6.19 0.00 8.57 39 RELAYCOUNTRY_META 6 17.53 40.74 8.57 40 XMNumbers 6 6.19 0.00 8.57 41 RCVD_IN_MSPIKE_H3 6 9.28 11.11 8.57 42 MSGID_NOFQDN1 5 5.15 0.00 7.14 43 XM_SendGrid 5 9.28 14.81 7.14 44 TO_MALFORMED 5 5.15 0.00 7.14 45 INVALID_MSGID 5 5.15 0.00 7.14 46 TooManyTo_001 5 5.15 0.00 7.14 47 XMSexyCombo_05 5 5.15 0.00 7.14 48 XM_B_Phish_Phrases 5 6.19 3.70 7.14 49 T_REMOTE_IMAGE 4 5.15 3.70 5.71 50 TR_XM_SpammyRelay 4 13.40 33.33 5.71 51 TR_XM_BayesUnsub 4 9.28 18.52 5.71 52 HTML_IMAGE_RATIO_06 4 4.12 0.00 5.71 53 XM_H_Long_From01 4 5.15 3.70 5.71 54 XM_DKIMWhitelistDomains 4 4.12 0.00 5.71 55 RCVD_IN_MSPIKE_H4 3 4.12 3.70 4.29 56 XM_B_SpammyWords3 3 11.34 29.63 4.29 57 BAYES_40 3 3.09 0.00 4.29 58 MIME_QP_LONG_LINE 3 4.12 3.70 4.29 59 RELAYCOUNTRY_CA 3 7.22 14.81 4.29 60 RCVD_IN_VALIDITY_CERTIFIED 3 3.09 0.00 4.29 61 RCVD_IN_VALIDITY_SAFE 3 3.09 0.00 4.29 62 XMSubPhish11 3 4.12 3.70 4.29 63 TVD_SPACE_RATIO 3 3.09 0.00 4.29 64 T_TooManySym_03 3 3.09 0.00 4.29 65 TM2_M_URI_OPT_OUT 3 3.09 0.00 4.29 66 XMSubMetaSx_00 3 3.09 0.00 4.29 67 T_XMDrugObfuBody_08 3 8.25 18.52 4.29 68 BAYES_95 3 3.09 0.00 4.29 69 DCC_CHECK 3 6.19 11.11 4.29 70 TR_XM_SB_Phish 3 4.12 3.70 4.29 71 T_XMDrugObfuBody_14 3 8.25 18.52 4.29 72 XMStrtUSub 3 3.09 0.00 4.29 73 LotsOfNums_01 3 4.12 3.70 4.29 74 TR_Symld_Words 2 2.06 0.00 2.86 75 XM_H_SpoofStaff4 2 2.06 0.00 2.86 76 XMSubNoVowel 2 4.12 7.41 2.86 77 BOUNCE_MESSAGE 2 3.09 3.70 2.86 78 XMNoVowels 2 2.06 0.00 2.86 79 BAYES_99 2 14.43 44.44 2.86 80 ANY_BOUNCE_MESSAGE 2 3.09 3.70 2.86 81 HTML_IMAGE_ONLY_20 2 4.12 7.41 2.86 82 WEIRD_QUOTING 2 2.06 0.00 2.86 83 XM_ZIP 2 2.06 0.00 2.86 84 XM_H_Trusted_IP 2 2.06 0.00 2.86 85 XM_B_DynamicLink 2 2.06 0.00 2.86 86 XMGappySubj_01 2 2.06 0.00 2.86 87 XM_SPF_SoftFail 2 5.15 11.11 2.86 88 XM_DIRTYINTL 2 6.19 14.81 2.86 89 FVGT_m_MULTI_ODD_EMAIL 2 2.06 0.00 2.86 90 TR_XM_PSC1 2 2.06 0.00 2.86 91 MAILING_LIST_MULTI 2 4.12 7.41 2.86 92 XMBrknScrpt_02 2 3.09 3.70 2.86 93 TR_XM_DK_SendGrid 2 2.06 0.00 2.86 94 TR_XM_SpoofStaff 2 2.06 0.00 2.86 95 XMBody_95 2 2.06 0.00 2.86 96 MIME_HTML_MOSTLY 2 8.25 22.22 2.86 97 XM_B_Unsub2 2 2.06 0.00 2.86 98 HELO_STATIC_HOST 2 2.06 0.00 2.86 99 XMSubMetaI_00 2 2.06 0.00 2.86 100 BAYES_999 2 12.37 37.04 2.86 101 BAYES_05 2 2.06 0.00 2.86 102 XMCapTrack 2 2.06 0.00 2.86 103 XMSpoofStaff2 2 2.06 0.00 2.86 104 HTML_IMAGE_RATIO_04 2 4.12 7.41 2.86 105 TR_XM_UnparsRelay 2 6.19 14.81 2.86 106 TooManyTo_002 2 2.06 0.00 2.86 107 UNTRUSTED_Relay 2 9.28 25.93 2.86 108 XM_UB50 2 6.19 14.81 2.86 109 TR_XM_SpoofPhishAttach 2 2.06 0.00 2.86 110 DKIM_INVALID 2 3.09 3.70 2.86 111 LOTS_OF_MONEY 2 6.19 14.81 2.86 112 XM_PDF 2 2.06 0.00 2.86 113 URI_HEX 2 2.06 0.00 2.86 114 XM_ZohoDesk1 2 2.06 0.00 2.86 115 MIME_HEADER_CTYPE_ONLY 1 1.03 0.00 1.43 116 TR_XM_DKIM_Undo 1 9.28 29.63 1.43 117 XM_B_Investor 1 3.09 7.41 1.43 118 RCVD_IN_RP_CERTIFIED 1 2.06 3.70 1.43 119 LongTLD 1 1.03 0.00 1.43 120 TR_XM_MSPIKECOMBO 1 4.12 11.11 1.43 121 REMOVE_BEFORE_LINK 1 1.03 0.00 1.43 122 RELAYCOUNTRY_FR 1 4.12 11.11 1.43 123 HELO_NO_DOMAIN 1 2.06 3.70 1.43 124 XMLngstWrd_04 1 1.03 0.00 1.43 125 BAYES_20 1 2.06 3.70 1.43 126 TR_XM_FormFill2 1 4.12 11.11 1.43 127 XMLngstWrd_02 1 1.03 0.00 1.43 128 XM_DK_Undo_02 1 11.34 37.04 1.43 129 SUBJ_ALL_CAPS 1 1.03 0.00 1.43 130 TR_XM_PhishingBody 1 1.03 0.00 1.43 131 XM_B_SpammyTLD 1 2.06 3.70 1.43 132 RCVD_IN_RP_SAFE 1 2.06 3.70 1.43 133 GMD_PDF_SQUARE 1 1.03 0.00 1.43 134 XMStockSpam_06 1 1.03 0.00 1.43 135 TR_DCC_Bayes_99 1 2.06 3.70 1.43 136 XM_H_PHPOS 1 4.12 11.11 1.43 137 XMLngstWrd_03 1 1.03 0.00 1.43 138 HTML_IMAGE_RATIO_02 1 3.09 7.41 1.43 139 XMLngstWrd_01 1 1.03 0.00 1.43 140 XM_S_SubURI 1 1.03 0.00 1.43 141 SpammyFromTLD_02 1 1.03 0.00 1.43 142 FROM_GOV_DKIM_AU 1 1.03 0.00 1.43 143 RCVD_IN_MSPIKE_BL 1 4.12 11.11 1.43 144 TR_XM_PHPForged 1 4.12 11.11 1.43 145 XMCapTrack2 1 1.03 0.00 1.43 146 CTE_8BIT_MISMATCH 1 1.03 0.00 1.43 147 TR_XM_PHPDW 1 4.12 11.11 1.43 148 XMHTML_After_End 1 1.03 0.00 1.43 149 XMLngstWrd_00 1 1.03 0.00 1.43 150 RELAYCOUNTRY_AU 1 1.03 0.00 1.43 151 TR_XM_SpammyWords5 1 1.03 0.00 1.43 152 XMBody_78 1 1.03 0.00 1.43 153 T_FILL_THIS_FORM_SHORT 1 3.09 7.41 1.43 154 T_STY_INVIS_DIRECT 1 1.03 0.00 1.43 155 XM_Body_Dirty_Words_01 1 6.19 18.52 1.43 156 TooManyTo_005 1 1.03 0.00 1.43 157 MISSING_MIMEOLE 1 1.03 0.00 1.43 158 TooManyTo_003 1 1.03 0.00 1.43 159 TR_Caps_n_Bayes_99 1 1.03 0.00 1.43 160 XMBdyGiftCard01 1 1.03 0.00 1.43 161 HTML_IMAGE_ONLY_32 1 1.03 0.00 1.43 162 XM_URI_RBL 1 1.03 0.00 1.43 163 HTML_TAG_BALANCE_BODY 1 1.03 0.00 1.43 164 RELAYCOUNTRY_RU 1 3.09 7.41 1.43 165 HELO_NODOT 1 2.06 3.70 1.43 166 XM_B_Phish66 1 1.03 0.00 1.43 167 RCVD_IN_MSPIKE_L5 1 1.03 0.00 1.43 168 XM_B_SpammyWords4 1 6.19 18.52 1.43 169 MPART_ALT_DIFF 1 1.03 0.00 1.43 170 IN_HORDE_ADDRESS_BOOK 1 1.03 0.00 1.43 171 TooManyTo_004 1 1.03 0.00 1.43 172 T_XMDrugObfuBody_06 1 1.03 0.00 1.43 173 HTML_IMAGE_RATIO_08 1 1.03 0.00 1.43 ----------------------------------------------------------------------