Email: 142 Autolearn: 0 AvgScore: 3.65 AvgScanTime: 2.64 sec Spam: 30 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 2.59 sec Ham: 112 Autolearn: 0 AvgScore: 0.87 AvgScanTime: 2.65 sec Time Spent Running SA: 0.10 hours Time Spent Processing Spam: 0.02 hours Time Spent Processing Ham: 0.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 28 80.28 93.33 76.79 2 RELAYCOUNTRY_US 27 83.10 90.00 81.25 3 XM_DK_Pass 25 66.20 83.33 61.61 4 DKIM_SIGNED 25 67.61 83.33 63.39 5 DKIM_VALID 22 62.68 73.33 59.82 6 XM_B_Unicode 22 54.93 73.33 50.00 7 XMListUnsubscribeExists 19 40.85 63.33 34.82 8 XM_B_SpammyWords 18 38.73 60.00 33.04 9 DCC_CHECK_NEGATIVE 17 82.39 56.67 89.29 10 XM_B_Unicode3 15 34.51 50.00 30.36 11 DKIM_VALID_AU 15 46.48 50.00 45.54 12 DCC_CHECK 13 17.61 43.33 10.71 13 RCVD_IN_MSPIKE_H2 13 26.06 43.33 21.43 14 FVGT_m_MULTI_ODD 13 35.21 43.33 33.04 15 BAYES_99 12 17.61 40.00 11.61 16 LOC_TINY_FONT_1 12 21.13 40.00 16.07 17 XM_B_SpammyWords2 12 18.31 40.00 12.50 18 XM_DK_Undo_02 12 13.38 40.00 6.25 19 DKIM_VALID_EF 11 31.69 36.67 30.36 20 XMSubLong 11 24.65 36.67 21.43 21 HTML_FONT_LOW_CONTRAST 11 28.17 36.67 25.89 22 BAYES_999 10 14.79 33.33 9.82 23 XM_Multi_Part_URI 8 11.97 26.67 8.04 24 XM_B_Unsub 8 23.24 26.67 22.32 25 LotsOfNums_01 8 7.75 26.67 2.68 26 TR_XM_DKIM_Undo 8 6.34 26.67 0.89 27 TR_XM_BayesUnsub 8 21.13 26.67 19.64 28 T_KAM_HTML_FONT_INVALID 7 24.65 23.33 25.00 29 XM_B_SpammyWords3 6 7.04 20.00 3.57 30 TR_XM_DK_Unsub 6 15.49 20.00 14.29 31 RCVD_IN_MSPIKE_WL 6 30.99 20.00 33.93 32 MIME_HTML_ONLY 5 16.90 16.67 16.96 33 BAYES_50 5 42.25 16.67 49.11 34 FSL_BULK_SIG 5 4.93 16.67 1.79 35 UNPARSEABLE_RELAY 5 14.79 16.67 14.29 36 RCVD_IN_MSPIKE_H3 5 29.58 16.67 33.04 37 T_TM2_M_HEADER_IN_MSG 5 34.51 16.67 39.29 38 XM_H_Long_From01 4 6.34 13.33 4.46 39 XMSubMetaSx_00 4 4.93 13.33 2.68 40 TR_XM_UnparsRelay 4 3.52 13.33 0.89 41 TR_DCC_Bayes_99 4 2.82 13.33 0.00 42 RCVD_IN_BL_SPAMCOP_NET 4 2.82 13.33 0.00 43 XM_Body_Dirty_Words 4 11.97 13.33 11.61 44 LOTS_OF_MONEY 4 6.34 13.33 4.46 45 XM_UncommonTLD01 4 9.86 13.33 8.93 46 RELAYCOUNTRY_META 4 8.45 13.33 7.14 47 BAYES_80 4 6.34 13.33 4.46 48 RELAYCOUNTRY_CA 3 5.63 10.00 4.46 49 BAYES_60 3 9.15 10.00 8.93 50 BAYES_00 3 11.27 10.00 11.61 51 TR_XM_SPAMCOP 3 2.11 10.00 0.00 52 DKIM_INVALID 3 4.93 10.00 3.57 53 TM2_M_URI_OPT_OUT 3 2.11 10.00 0.00 54 XM_B_SpammyWords4 3 2.11 10.00 0.00 55 TR_XM_COVIDMETA4 3 2.11 10.00 0.00 56 XM_B_REG_HTML 3 2.11 10.00 0.00 57 TR_XM_DK_Bayes 3 8.45 10.00 8.04 58 HTML_IMAGE_RATIO_06 3 20.42 10.00 23.21 59 HTML_IMAGE_RATIO_04 3 6.34 10.00 5.36 60 TR_XM_SpammyRelay 3 4.23 10.00 2.68 61 BOTNET 3 4.23 10.00 2.68 62 XMSexyCombo_05 3 4.23 10.00 2.68 63 MIME_QP_LONG_LINE 2 2.82 6.67 1.79 64 BAYES_95 2 2.82 6.67 1.79 65 SpammyFromTLD_02 2 1.41 6.67 0.00 66 RCVD_IN_VALIDITY_RPBL 2 2.11 6.67 0.89 67 TR_MRelay_UG 2 1.41 6.67 0.00 68 XMBrknScrpt_02 2 1.41 6.67 0.00 69 XM_URI_RBL 2 1.41 6.67 0.00 70 MIME_CHARSET_FARAWAY 2 1.41 6.67 0.00 71 XM_DIRTYINTL 2 3.52 6.67 2.68 72 XM_B_Phish_Phrases 2 2.82 6.67 1.79 73 XMNumbers 2 7.04 6.67 7.14 74 XM_CamelCaseFrm001 2 3.52 6.67 2.68 75 TR_XM_BayesRelay 2 1.41 6.67 0.00 76 XM_Evil_Numbers_Gen 2 7.75 6.67 8.04 77 T_TooManySym_01 2 10.56 6.67 11.61 78 XM_SPF_SoftFail 2 2.82 6.67 1.79 79 XM_B_COVIDMETA 2 1.41 6.67 0.00 80 XM_DK_Undo_01 2 2.82 6.67 1.79 81 DIET_1 2 14.08 6.67 16.07 82 TR_XM_SpammyWords2 2 1.41 6.67 0.00 83 TR_XM_SpammyWords4 2 4.23 6.67 3.57 84 XM_B_Investor 2 2.82 6.67 1.79 85 TR_XM_Undi_Recip14 1 0.70 3.33 0.00 86 URI_PHP_REDIR 1 0.70 3.33 0.00 87 PDS_FRNOM_TODOM_DBL_URL 1 0.70 3.33 0.00 88 RELAYCOUNTRY_IT 1 0.70 3.33 0.00 89 BOTNET_NORDNS 1 0.70 3.33 0.00 90 XM_BadFromFormat 1 0.70 3.33 0.00 91 SpammyFromTLD_01 1 1.41 3.33 0.89 92 PDS_OTHER_BAD_TLD 1 0.70 3.33 0.00 93 GOOG_STO_EMAIL_PHISH 1 0.70 3.33 0.00 94 DEAR_SOMETHING 1 0.70 3.33 0.00 95 MIME_HTML_MOSTLY 1 2.82 3.33 2.68 96 XM_GoogleGroups 1 2.82 3.33 2.68 97 TR_XM_Undi_Recip6 1 0.70 3.33 0.00 98 XM_XX_Yahoo 1 0.70 3.33 0.00 99 TR_XM_SpammyWords5 1 0.70 3.33 0.00 100 ANY_BOUNCE_MESSAGE 1 2.11 3.33 1.79 101 HTML_IMAGE_RATIO_02 1 0.70 3.33 0.00 102 FROM_OFFERS 1 0.70 3.33 0.00 103 DATE_IN_FUTURE_06_12 1 0.70 3.33 0.00 104 TR_XMSubLong 1 0.70 3.33 0.00 105 XMSubMetaSx_01 1 0.70 3.33 0.00 106 XMBody_78 1 1.41 3.33 0.89 107 PRICES_ARE_AFFORDABLE 1 0.70 3.33 0.00 108 TM2_M_VERY_LONG_WORD 1 1.41 3.33 0.89 109 T_REMOTE_IMAGE 1 5.63 3.33 6.25 110 XMSlimDrugH 1 1.41 3.33 0.89 111 TR_LOTS_OF_MONEY2 1 0.70 3.33 0.00 112 NORDNS_LOW_CONTRAST 1 0.70 3.33 0.00 113 XMWghtMeta_00 1 0.70 3.33 0.00 114 FROM_SUSPICIOUS_NTLD 1 0.70 3.33 0.00 115 BOUNCE_MESSAGE 1 2.11 3.33 1.79 116 SUBJ_DOLLARS 1 0.70 3.33 0.00 117 PDS_FRNOM_TODOM_NAKED_TO 1 0.70 3.33 0.00 118 HTML_IMAGE_ONLY_24 1 1.41 3.33 0.89 119 XM_RXBody 1 0.70 3.33 0.00 120 DATE_IN_PAST_06_12 1 0.70 3.33 0.00 121 RCVD_IN_MSPIKE_H4 1 1.41 3.33 0.89 122 TO_NO_BRKTS_HTML_IMG 1 0.70 3.33 0.00 123 BAYES_40 1 6.34 3.33 7.14 124 XM_B_SpammyTLD 1 1.41 3.33 0.89 125 SUBJECT_DIET 1 0.70 3.33 0.00 126 XMSubMetaSxObfu_01 1 0.70 3.33 0.00 127 MAILING_LIST_MULTI 1 6.34 3.33 7.14 128 XM_B_SEO 1 0.70 3.33 0.00 129 XM_TLDProd2 1 0.70 3.33 0.00 130 TR_Mismatch_TLD_01 1 0.70 3.33 0.00 131 GOOG_STO_NOIMG_HTML 1 0.70 3.33 0.00 132 XMStrtUSub 1 3.52 3.33 3.57 133 RELAYCOUNTRY_RU 1 0.70 3.33 0.00 134 PDS_FROM_NAME_TO_DOMAIN 1 0.70 3.33 0.00 135 T_MONEY_PERCENT 1 0.70 3.33 0.00 136 UPGRADE_MAILBOX 1 0.70 3.33 0.00 137 BOTNET_IPINHOSTNAME 1 5.63 3.33 6.25 138 FROM_SUSPICIOUS_NTLD_FP 1 0.70 3.33 0.00 139 HTTP_EXCESSIVE_ESCAPES 1 0.70 3.33 0.00 140 XM_SendGrid 1 5.63 3.33 6.25 141 TR_XM_DK_SendGrid 1 3.52 3.33 3.57 142 XMSexyCombo_01 1 0.70 3.33 0.00 143 MPART_ALT_DIFF_COUNT 1 2.11 3.33 1.79 144 XM_H_Undi_Recip 1 0.70 3.33 0.00 145 CHARSET_FARAWAY_HEADER 1 0.70 3.33 0.00 146 ADVANCE_FEE_4_NEW_MONEY 1 0.70 3.33 0.00 147 TVD_RCVD_SPACE_BRACKET 1 0.70 3.33 0.00 148 TR_Sbj_FN_Bdy 1 0.70 3.33 0.00 149 TooManyTo_001 1 5.63 3.33 6.25 150 RCVD_IN_PSBL 1 2.11 3.33 1.79 151 XMBdyGiftCard01 1 0.70 3.33 0.00 152 XMBody_29 1 0.70 3.33 0.00 153 XMStockSpam_06 1 0.70 3.33 0.00 154 XMSubNoVowel 1 2.11 3.33 1.79 155 URI_TRY_3LD 1 0.70 3.33 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 100 82.39 56.67 89.29 2 RELAYCOUNTRY_US 91 83.10 90.00 81.25 3 HTML_MESSAGE 86 80.28 93.33 76.79 4 DKIM_SIGNED 71 67.61 83.33 63.39 5 XM_DK_Pass 69 66.20 83.33 61.61 6 DKIM_VALID 67 62.68 73.33 59.82 7 XM_B_Unicode 56 54.93 73.33 50.00 8 BAYES_50 55 42.25 16.67 49.11 9 DKIM_VALID_AU 51 46.48 50.00 45.54 10 T_TM2_M_HEADER_IN_MSG 44 34.51 16.67 39.29 11 XMListUnsubscribeExists 39 40.85 63.33 34.82 12 RCVD_IN_MSPIKE_WL 38 30.99 20.00 33.93 13 RCVD_IN_MSPIKE_H3 37 29.58 16.67 33.04 14 XM_B_SpammyWords 37 38.73 60.00 33.04 15 FVGT_m_MULTI_ODD 37 35.21 43.33 33.04 16 XM_B_Unicode3 34 34.51 50.00 30.36 17 DKIM_VALID_EF 34 31.69 36.67 30.36 18 HTML_FONT_LOW_CONTRAST 29 28.17 36.67 25.89 19 T_KAM_HTML_FONT_INVALID 28 24.65 23.33 25.00 20 HTML_IMAGE_RATIO_06 26 20.42 10.00 23.21 21 XM_B_Unsub 25 23.24 26.67 22.32 22 XMSubLong 24 24.65 36.67 21.43 23 RCVD_IN_MSPIKE_H2 24 26.06 43.33 21.43 24 TR_XM_BayesUnsub 22 21.13 26.67 19.64 25 MIME_HTML_ONLY 19 16.90 16.67 16.96 26 DIET_1 18 14.08 6.67 16.07 27 LOC_TINY_FONT_1 18 21.13 40.00 16.07 28 UNPARSEABLE_RELAY 16 14.79 16.67 14.29 29 TR_XM_DK_Unsub 16 15.49 20.00 14.29 30 ALL_TRUSTED 14 9.86 0.00 12.50 31 XM_B_SpammyWords2 14 18.31 40.00 12.50 32 XM_Body_Dirty_Words 13 11.97 13.33 11.61 33 BAYES_00 13 11.27 10.00 11.61 34 T_TooManySym_01 13 10.56 6.67 11.61 35 BAYES_99 13 17.61 40.00 11.61 36 DCC_CHECK 12 17.61 43.33 10.71 37 BAYES_999 11 14.79 33.33 9.82 38 T_TooManySym_02 10 7.04 0.00 8.93 39 BAYES_60 10 9.15 10.00 8.93 40 XM_UncommonTLD01 10 9.86 13.33 8.93 41 TR_XM_DK_Bayes1 9 6.34 0.00 8.04 42 XM_Multi_Part_URI 9 11.97 26.67 8.04 43 TR_XM_DK_Bayes 9 8.45 10.00 8.04 44 XM_Evil_Numbers_Gen 9 7.75 6.67 8.04 45 USER_IN_DEF_DKIM_WL 8 5.63 0.00 7.14 46 BAYES_40 8 6.34 3.33 7.14 47 TR_XM_DK_Bayes2 8 5.63 0.00 7.14 48 XMNumbers 8 7.04 6.67 7.14 49 MAILING_LIST_MULTI 8 6.34 3.33 7.14 50 RELAYCOUNTRY_META 8 8.45 13.33 7.14 51 T_REMOTE_IMAGE 7 5.63 3.33 6.25 52 TooManyTo_001 7 5.63 3.33 6.25 53 IN_ZIMBRA_NJ_WHITELIST 7 4.93 0.00 6.25 54 XM_DK_Undo_02 7 13.38 40.00 6.25 55 BOTNET_IPINHOSTNAME 7 5.63 3.33 6.25 56 INVALID_MSGID 7 4.93 0.00 6.25 57 XM_SendGrid 7 5.63 3.33 6.25 58 HTML_FONT_FACE_BAD 7 4.93 0.00 6.25 59 HTML_IMAGE_RATIO_04 6 6.34 10.00 5.36 60 XM_DKIMWhitelistDomains 6 4.23 0.00 5.36 61 XM_H_Long_From01 5 6.34 13.33 4.46 62 RELAYCOUNTRY_CA 5 5.63 10.00 4.46 63 MSGID_NOFQDN1 5 3.52 0.00 4.46 64 TO_MALFORMED 5 3.52 0.00 4.46 65 XM_PDF 5 3.52 0.00 4.46 66 XM_B_Phish66 5 3.52 0.00 4.46 67 BAYES_80 5 6.34 13.33 4.46 68 TR_XM_PhishingBody 5 3.52 0.00 4.46 69 LOTS_OF_MONEY 5 6.34 13.33 4.46 70 HTML_MIME_NO_HTML_TAG 5 3.52 0.00 4.46 71 RCVD_IN_VALIDITY_SAFE 4 2.82 0.00 3.57 72 TR_XM_SpammyWords4 4 4.23 6.67 3.57 73 TR_XM_DK_SendGrid 4 3.52 3.33 3.57 74 DKIM_INVALID 4 4.93 10.00 3.57 75 XM_B_SpammyWords3 4 7.04 20.00 3.57 76 XMSubject_78 4 2.82 0.00 3.57 77 XMStrtUSub 4 3.52 3.33 3.57 78 XM_DIRTYINTL 3 3.52 6.67 2.68 79 BAYES_05 3 2.11 0.00 2.68 80 MIME_HTML_MOSTLY 3 2.82 3.33 2.68 81 XMSubMetaSx_00 3 4.93 13.33 2.68 82 HTTPS_HTTP_MISMATCH 3 2.11 0.00 2.68 83 TooManyTo_002 3 2.11 0.00 2.68 84 XM_CamelCaseFrm001 3 3.52 6.67 2.68 85 LotsOfNums_01 3 7.75 26.67 2.68 86 RCVD_IN_VALIDITY_CERTIFIED 3 2.11 0.00 2.68 87 BAYES_20 3 2.11 0.00 2.68 88 T_TooManySym_03 3 2.11 0.00 2.68 89 T_XMDrugObfuBody_14 3 2.11 0.00 2.68 90 XM_GoogleGroups 3 2.82 3.33 2.68 91 TR_XM_SpammyRelay 3 4.23 10.00 2.68 92 BOTNET 3 4.23 10.00 2.68 93 XMSexyCombo_05 3 4.23 10.00 2.68 94 T_XMDrugObfuBody_08 3 2.11 0.00 2.68 95 XM_B_Phish_Phrases 2 2.82 6.67 1.79 96 XMSubPhish11 2 1.41 0.00 1.79 97 TR_XM_FormFill2 2 1.41 0.00 1.79 98 RCVD_IN_MSPIKE_L5 2 1.41 0.00 1.79 99 FVGT_m_MULTI_ODD_EMAIL 2 1.41 0.00 1.79 100 NO_DNS_FOR_FROM 2 1.41 0.00 1.79 101 XMSubLongNoVowel 2 1.41 0.00 1.79 102 TR_XM_PHPForged 2 1.41 0.00 1.79 103 FSL_BULK_SIG 2 4.93 16.67 1.79 104 XM_SPF_SoftFail 2 2.82 6.67 1.79 105 MPART_ALT_DIFF_COUNT 2 2.11 3.33 1.79 106 XM_B_Investor 2 2.82 6.67 1.79 107 TR_XM_PHPDW 2 1.41 0.00 1.79 108 TR_XM_MSPIKECOMBO 2 1.41 0.00 1.79 109 XM_DK_Undo_01 2 2.82 6.67 1.79 110 XMHTML_ManyTags1 2 1.41 0.00 1.79 111 TR_Symld_Words 2 1.41 0.00 1.79 112 HTML_TAG_BALANCE_BODY 2 1.41 0.00 1.79 113 XM_H_PHPOS 2 1.41 0.00 1.79 114 XM_ZIP 2 1.41 0.00 1.79 115 ANY_BOUNCE_MESSAGE 2 2.11 3.33 1.79 116 TR_BOTNET_NEGATE 2 1.41 0.00 1.79 117 BOUNCE_MESSAGE 2 2.11 3.33 1.79 118 XM_H_Long_From02 2 1.41 0.00 1.79 119 BAYES_95 2 2.82 6.67 1.79 120 MIME_QP_LONG_LINE 2 2.82 6.67 1.79 121 FROM_GOV_DKIM_AU 2 1.41 0.00 1.79 122 TVD_SPACE_RATIO 2 1.41 0.00 1.79 123 RCVD_IN_PSBL 2 2.11 3.33 1.79 124 RCVD_IN_MSPIKE_BL 2 1.41 0.00 1.79 125 XMSubNoVowel 2 2.11 3.33 1.79 126 UNTRUSTED_Relay 2 1.41 0.00 1.79 127 TR_XM_SB_Phish 2 1.41 0.00 1.79 128 NUMERIC_HTTP_ADDR 2 1.41 0.00 1.79 129 AC_HTML_NONSENSE_TAGS 2 1.41 0.00 1.79 130 TR_MSPIKEBAYES00 2 1.41 0.00 1.79 131 XM_UB50 2 1.41 0.00 1.79 132 XMBSHREFv2 2 1.41 0.00 1.79 133 DKIM_ADSP_NXDOMAIN 2 1.41 0.00 1.79 134 XMBody_78 1 1.41 3.33 0.89 135 XM_H_PHPOS_M 1 0.70 0.00 0.89 136 HTML_COMMENT_SAVED_URL 1 0.70 0.00 0.89 137 XM_Dr_From 1 0.70 0.00 0.89 138 HTML_IMAGE_ONLY_24 1 1.41 3.33 0.89 139 HDRS_MISSP 1 0.70 0.00 0.89 140 RELAYCOUNTRY_CN 1 0.70 0.00 0.89 141 RCVD_IN_VALIDITY_RPBL 1 2.11 6.67 0.89 142 XMSubMetaSxObfu_03 1 0.70 0.00 0.89 143 RELAYCOUNTRY_FR 1 0.70 0.00 0.89 144 URI_NO_WWW_INFO_CGI 1 0.70 0.00 0.89 145 XMSubMetaSxObfu_02 1 0.70 0.00 0.89 146 XMGappySubj_01 1 0.70 0.00 0.89 147 NICE_REPLY_A 1 0.70 0.00 0.89 148 TR_XM_DKIM_Undo 1 6.34 26.67 0.89 149 FROM_LOCAL_HEX 1 0.70 0.00 0.89 150 XM_B_SpammyTLD 1 1.41 3.33 0.89 151 TR_Legit_01 1 0.70 0.00 0.89 152 TVD_RCVD_IP 1 0.70 0.00 0.89 153 XMNoVowels 1 0.70 0.00 0.89 154 MPART_ALT_DIFF 1 0.70 0.00 0.89 155 XMSlimDrugH 1 1.41 3.33 0.89 156 TM2_M_VERY_LONG_WORD 1 1.41 3.33 0.89 157 FROM_GOV_SPOOF 1 0.70 0.00 0.89 158 XMSubGiftCard1 1 0.70 0.00 0.89 159 RELAYCOUNTRY_AU 1 0.70 0.00 0.89 160 RCVD_IN_MSPIKE_H4 1 1.41 3.33 0.89 161 AC_FROM_MANY_DOTS 1 0.70 0.00 0.89 162 THIS_AD 1 0.70 0.00 0.89 163 XMCapTrack 1 0.70 0.00 0.89 164 T_STY_INVIS_DIRECT 1 0.70 0.00 0.89 165 SpammyFromTLD_01 1 1.41 3.33 0.89 166 FROM_EXCESS_BASE64 1 0.70 0.00 0.89 167 TM2_M_A_HREF_HREF 1 0.70 0.00 0.89 168 HTML_IMAGE_RATIO_08 1 0.70 0.00 0.89 169 XMLngstWrd_00 1 0.70 0.00 0.89 170 TR_XM_UnparsRelay 1 3.52 13.33 0.89 171 XMHTMLBadTable_001 1 0.70 0.00 0.89 172 SHOPIFY_IMG_NOT_RCVD_SFY 1 0.70 0.00 0.89 173 T_TooManySym_04 1 0.70 0.00 0.89 174 TR_MetaPhish_Combo_01b 1 0.70 0.00 0.89 175 WEIRD_PORT 1 0.70 0.00 0.89 176 HTML_IMAGE_ONLY_28 1 0.70 0.00 0.89 177 XMSubGiftCard2 1 0.70 0.00 0.89 ----------------------------------------------------------------------