Email: 97 Autolearn: 0 AvgScore: 3.40 AvgScanTime: 3.79 sec Spam: 23 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 3.40 sec Ham: 74 Autolearn: 0 AvgScore: 0.23 AvgScanTime: 3.92 sec Time Spent Running SA: 0.10 hours Time Spent Processing Spam: 0.02 hours Time Spent Processing Ham: 0.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 22 83.51 95.65 79.73 2 XM_B_Unicode 20 72.16 86.96 67.57 3 DKIM_SIGNED 19 79.38 82.61 78.38 4 DKIM_VALID 18 75.26 78.26 74.32 5 XM_DK_Pass 18 76.29 78.26 75.68 6 XMListUnsubscribeExists 18 63.92 78.26 59.46 7 XM_B_Unicode3 15 62.89 65.22 62.16 8 XM_B_SpammyWords 15 61.86 65.22 60.81 9 BAYES_50 14 46.39 60.87 41.89 10 DCC_CHECK_NEGATIVE 14 77.32 60.87 82.43 11 RELAYCOUNTRY_US 13 72.16 56.52 77.03 12 FVGT_m_MULTI_ODD 13 50.52 56.52 48.65 13 XM_B_SpammyWords2 12 42.27 52.17 39.19 14 RELAYCOUNTRY_META 11 15.46 47.83 5.41 15 DKIM_VALID_AU 11 41.24 47.83 39.19 16 XM_DK_Undo_02 10 35.05 43.48 32.43 17 DCC_CHECK 9 22.68 39.13 17.57 18 UNTRUSTED_Relay 9 11.34 39.13 2.70 19 HTML_FONT_LOW_CONTRAST 9 25.77 39.13 21.62 20 TR_XM_DKIM_Undo 8 31.96 34.78 31.08 21 UNPARSEABLE_RELAY 7 32.99 30.43 33.78 22 XMSubLong 7 18.56 30.43 14.86 23 XM_Multi_Part_URI 6 35.05 26.09 37.84 24 LOC_TINY_FONT_1 6 15.46 26.09 12.16 25 RCVD_IN_MSPIKE_H2 6 17.53 26.09 14.86 26 BOTNET 6 29.90 26.09 31.08 27 LotsOfNums_01 5 8.25 21.74 4.05 28 XM_UB50 5 7.22 21.74 2.70 29 T_KAM_HTML_FONT_INVALID 5 40.21 21.74 45.95 30 XM_UncommonTLD01 5 9.28 21.74 5.41 31 BOTNET_IPINHOSTNAME 4 27.84 17.39 31.08 32 RELAYCOUNTRY_FR 4 4.12 17.39 0.00 33 BAYES_60 4 9.28 17.39 6.76 34 TR_XM_SpammyRelay 4 5.15 17.39 1.35 35 DKIM_VALID_EF 4 25.77 17.39 28.38 36 MIME_HTML_ONLY 4 9.28 17.39 6.76 37 TooManyTo_001 4 8.25 17.39 5.41 38 MPART_ALT_DIFF_COUNT 3 3.09 13.04 0.00 39 TM2_M_URI_OPT_OUT 3 3.09 13.04 0.00 40 RCVD_IN_MSPIKE_BL 3 3.09 13.04 0.00 41 XMSubMetaSx_00 3 5.15 13.04 2.70 42 XM_B_Investor 3 5.15 13.04 2.70 43 TR_XM_UnparsRelay 3 3.09 13.04 0.00 44 RCVD_IN_BL_SPAMCOP_NET 3 3.09 13.04 0.00 45 TR_XM_SPAMCOP 3 3.09 13.04 0.00 46 TR_XM_PhishingBody 3 5.15 13.04 2.70 47 MAILING_LIST_MULTI 3 27.84 13.04 32.43 48 TR_XM_MSPIKECOMBO 3 3.09 13.04 0.00 49 TR_XM_DK_Unsub 2 16.49 8.70 18.92 50 TR_XM_SpammyWords4 2 4.12 8.70 2.70 51 XMPhish08 2 2.06 8.70 0.00 52 SpammyFromTLD_02 2 2.06 8.70 0.00 53 XMBody_78 2 2.06 8.70 0.00 54 FROM_LOCAL_HEX 2 2.06 8.70 0.00 55 RCVD_IN_MSPIKE_WL 2 37.11 8.70 45.95 56 BAYES_99 2 6.19 8.70 5.41 57 RCVD_IN_MSPIKE_H3 2 34.02 8.70 41.89 58 BAYES_999 2 6.19 8.70 5.41 59 HTML_IMAGE_RATIO_06 2 3.09 8.70 1.35 60 RELAYCOUNTRY_NL 2 3.09 8.70 1.35 61 XM_Evil_Numbers_Gen 2 5.15 8.70 4.05 62 FSL_BULK_SIG 2 3.09 8.70 1.35 63 XM_SendGrid 2 2.06 8.70 0.00 64 SUBJ_ALL_CAPS 2 2.06 8.70 0.00 65 RELAYCOUNTRY_CN 2 2.06 8.70 0.00 66 MSGID_NOFQDN1 2 3.09 8.70 1.35 67 XM_UB60 2 2.06 8.70 0.00 68 RCVD_IN_MSPIKE_L4 2 2.06 8.70 0.00 69 HTTPS_HTTP_MISMATCH 2 3.09 8.70 1.35 70 XM_H_Long_From02 2 25.77 8.70 31.08 71 LOTS_OF_MONEY 2 4.12 8.70 2.70 72 TR_XM_Spammywords 2 3.09 8.70 1.35 73 XM_S_SpammyWords 2 3.09 8.70 1.35 74 INVALID_MSGID 2 3.09 8.70 1.35 75 FROM_LOCAL_DIGITS 2 2.06 8.70 0.00 76 XM_B_SpammyWords3 2 5.15 8.70 4.05 77 HTML_FONT_TINY_NORDNS 2 2.06 8.70 0.00 78 XM_H_Long_From01 1 3.09 4.35 2.70 79 XM_Body_Dirty_Words 1 13.40 4.35 16.22 80 TR_XM_COVIDMETA4 1 1.03 4.35 0.00 81 TR_XM_DK_SendGrid 1 1.03 4.35 0.00 82 TR_Caps_n_Bayes_80 1 1.03 4.35 0.00 83 XMMoneyMeta_00 1 1.03 4.35 0.00 84 TR_Mismatch_TLD_02 1 1.03 4.35 0.00 85 RDNS_DYNAMIC 1 1.03 4.35 0.00 86 HELO_NODOT 1 1.03 4.35 0.00 87 XMBody_29 1 1.03 4.35 0.00 88 T_TM2_M_HEADER_IN_MSG 1 16.49 4.35 20.27 89 MIXED_ES 1 1.03 4.35 0.00 90 XMNumbers 1 5.15 4.35 5.41 91 XMBSHREFv2 1 1.03 4.35 0.00 92 HELO_DYNAMIC_SPLIT_IP 1 1.03 4.35 0.00 93 BAYES_00 1 24.74 4.35 31.08 94 RELAYCOUNTRY_BE 1 1.03 4.35 0.00 95 PDS_OTHER_BAD_TLD 1 1.03 4.35 0.00 96 NORDNS_LOW_CONTRAST 1 1.03 4.35 0.00 97 XMBody_95 1 1.03 4.35 0.00 98 TR_XM_DK_Bayes 1 24.74 4.35 31.08 99 T_XMHurry_00 1 3.09 4.35 2.70 100 HELO_NO_DOMAIN 1 1.03 4.35 0.00 101 XMSubLongNoVowel 1 1.03 4.35 0.00 102 SUBJ_DOLLARS 1 1.03 4.35 0.00 103 TVD_RCVD_IP 1 1.03 4.35 0.00 104 XM_B_Phish66 1 2.06 4.35 1.35 105 TR_BOTNET_NEGATE 1 15.46 4.35 18.92 106 TM2_M_VERY_LONG_WORD 1 7.22 4.35 8.11 107 MIME_CHARSET_FARAWAY 1 24.74 4.35 31.08 108 FROM_SUSPICIOUS_NTLD 1 1.03 4.35 0.00 109 XM_B_SpammyTLD 1 3.09 4.35 2.70 110 RELAYCOUNTRY_NG 1 1.03 4.35 0.00 111 TR_XM_SpammyWords5 1 1.03 4.35 0.00 112 FROM_SUSPICIOUS_NTLD_FP 1 1.03 4.35 0.00 113 DATE_IN_PAST_06_12 1 1.03 4.35 0.00 114 BAYES_80 1 3.09 4.35 2.70 115 XMSubNoVowel 1 1.03 4.35 0.00 116 TR_XM_InvalidRelay 1 1.03 4.35 0.00 117 TR_Symld_Words 1 1.03 4.35 0.00 118 UPPERCASE_50_75 1 1.03 4.35 0.00 119 SpammyFromTLD_01 1 1.03 4.35 0.00 120 FONT_INVIS_DIRECT 1 1.03 4.35 0.00 121 PDS_RDNS_DYNAMIC_FP 1 1.03 4.35 0.00 122 HTML_IMAGE_RATIO_08 1 2.06 4.35 1.35 123 TR_DCC_Bayes_99 1 1.03 4.35 0.00 124 RCVD_IN_VALIDITY_RPBL 1 1.03 4.35 0.00 125 DKIM_INVALID 1 4.12 4.35 4.05 126 XMMoneyMeta_01 1 1.03 4.35 0.00 127 NOT_SPAM 1 1.03 4.35 0.00 128 BAYES_95 1 1.03 4.35 0.00 129 TR_XM_SpammyWords3 1 1.03 4.35 0.00 130 XMSolicitRefs_0 1 1.03 4.35 0.00 131 XM_UB99 1 1.03 4.35 0.00 132 TR_XM_BayesUnsub 1 5.15 4.35 5.41 133 RCVD_IN_MSPIKE_L3 1 1.03 4.35 0.00 134 TR_XM_BayesRelay 1 1.03 4.35 0.00 135 TR_XM_DK_Bayes1 1 24.74 4.35 31.08 136 XM_RECPTID 1 1.03 4.35 0.00 137 RELAYCOUNTRY_AU 1 2.06 4.35 1.35 138 XMBrknScrpt_02 1 1.03 4.35 0.00 139 XM_S_SpammyWords2 1 1.03 4.35 0.00 140 XM_UB80 1 1.03 4.35 0.00 141 XM_UB999 1 1.03 4.35 0.00 142 HTML_IMAGE_RATIO_04 1 1.03 4.35 0.00 143 TO_MALFORMED 1 2.06 4.35 1.35 144 RELAYCOUNTRY_DE 1 2.06 4.35 1.35 145 HTML_IMAGE_RATIO_02 1 2.06 4.35 1.35 146 XMSexyCombo_05 1 1.03 4.35 0.00 147 FROM_GOV_DKIM_AU 1 1.03 4.35 0.00 148 XM_B_Unsub 1 5.15 4.35 5.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 61 77.32 60.87 82.43 2 HTML_MESSAGE 59 83.51 95.65 79.73 3 DKIM_SIGNED 58 79.38 82.61 78.38 4 RELAYCOUNTRY_US 57 72.16 56.52 77.03 5 XM_DK_Pass 56 76.29 78.26 75.68 6 DKIM_VALID 55 75.26 78.26 74.32 7 XM_B_Unicode 50 72.16 86.96 67.57 8 XM_B_Unicode3 46 62.89 65.22 62.16 9 XM_B_SpammyWords 45 61.86 65.22 60.81 10 XMListUnsubscribeExists 44 63.92 78.26 59.46 11 FVGT_m_MULTI_ODD 36 50.52 56.52 48.65 12 RCVD_IN_MSPIKE_WL 34 37.11 8.70 45.95 13 T_KAM_HTML_FONT_INVALID 34 40.21 21.74 45.95 14 BAYES_50 31 46.39 60.87 41.89 15 RCVD_IN_MSPIKE_H3 31 34.02 8.70 41.89 16 DKIM_VALID_AU 29 41.24 47.83 39.19 17 XM_B_SpammyWords2 29 42.27 52.17 39.19 18 XM_Multi_Part_URI 28 35.05 26.09 37.84 19 UNPARSEABLE_RELAY 25 32.99 30.43 33.78 20 MAILING_LIST_MULTI 24 27.84 13.04 32.43 21 XM_DK_Undo_02 24 35.05 43.48 32.43 22 XM_H_Long_From02 23 25.77 8.70 31.08 23 BOTNET 23 29.90 26.09 31.08 24 TR_XM_DKIM_Undo 23 31.96 34.78 31.08 25 TR_XM_DK_Bayes1 23 24.74 4.35 31.08 26 BOTNET_IPINHOSTNAME 23 27.84 17.39 31.08 27 MIME_CHARSET_FARAWAY 23 24.74 4.35 31.08 28 TR_XM_DK_Bayes 23 24.74 4.35 31.08 29 BAYES_00 23 24.74 4.35 31.08 30 DKIM_VALID_EF 21 25.77 17.39 28.38 31 HTML_FONT_LOW_CONTRAST 16 25.77 39.13 21.62 32 T_TM2_M_HEADER_IN_MSG 15 16.49 4.35 20.27 33 ALL_TRUSTED 14 14.43 0.00 18.92 34 TR_XM_DK_Unsub 14 16.49 8.70 18.92 35 TR_BOTNET_NEGATE 14 15.46 4.35 18.92 36 TR_MSPIKEBAYES00 13 13.40 0.00 17.57 37 DCC_CHECK 13 22.68 39.13 17.57 38 XM_Body_Dirty_Words 12 13.40 4.35 16.22 39 RCVD_IN_MSPIKE_H2 11 17.53 26.09 14.86 40 XMSubLong 11 18.56 30.43 14.86 41 LOC_TINY_FONT_1 9 15.46 26.09 12.16 42 T_TooManySym_01 7 7.22 0.00 9.46 43 T_TooManySym_02 7 7.22 0.00 9.46 44 XM_Dr_From 6 6.19 0.00 8.11 45 TM2_M_VERY_LONG_WORD 6 7.22 4.35 8.11 46 XMHTMLBadTable_001 5 5.15 0.00 6.76 47 ANY_BOUNCE_MESSAGE 5 5.15 0.00 6.76 48 MIME_HTML_ONLY 5 9.28 17.39 6.76 49 BOUNCE_MESSAGE 5 5.15 0.00 6.76 50 IN_HORDE_ADDRESS_BOOK 5 5.15 0.00 6.76 51 BAYES_60 5 9.28 17.39 6.76 52 XM_UncommonTLD01 4 9.28 21.74 5.41 53 IN_ZIMBRA_NJ_WHITELIST 4 4.12 0.00 5.41 54 XM_B_Unsub 4 5.15 4.35 5.41 55 TooManyTo_001 4 8.25 17.39 5.41 56 TR_XM_BayesUnsub 4 5.15 4.35 5.41 57 BAYES_99 4 6.19 8.70 5.41 58 RELAYCOUNTRY_META 4 15.46 47.83 5.41 59 BAYES_40 4 4.12 0.00 5.41 60 BAYES_999 4 6.19 8.70 5.41 61 XMNumbers 4 5.15 4.35 5.41 62 DKIM_INVALID 3 4.12 4.35 4.05 63 MIME_QP_LONG_LINE 3 3.09 0.00 4.05 64 BAYES_20 3 3.09 0.00 4.05 65 XM_B_SpammyWords3 3 5.15 8.70 4.05 66 TVD_SPACE_RATIO 3 3.09 0.00 4.05 67 LotsOfNums_01 3 8.25 21.74 4.05 68 XM_Evil_Numbers_Gen 3 5.15 8.70 4.05 69 LOTS_OF_MONEY 2 4.12 8.70 2.70 70 XMStrtUSub 2 2.06 0.00 2.70 71 XM_B_Investor 2 5.15 13.04 2.70 72 T_TooManySym_03 2 2.06 0.00 2.70 73 BAYES_80 2 3.09 4.35 2.70 74 XMSubMetaSx_00 2 5.15 13.04 2.70 75 BAYES_05 2 2.06 0.00 2.70 76 TRACKER_ID 2 2.06 0.00 2.70 77 TR_XM_PhishingBody 2 5.15 13.04 2.70 78 T_XMDrugObfuBody_08 2 2.06 0.00 2.70 79 CK_HELO_GENERIC 2 2.06 0.00 2.70 80 FVGT_m_MULTI_ODD_EMAIL 2 2.06 0.00 2.70 81 RCVD_IN_MSPIKE_H4 2 2.06 0.00 2.70 82 TR_XM_SpammyWords4 2 4.12 8.70 2.70 83 XM_H_Long_From01 2 3.09 4.35 2.70 84 XM_B_SpammyTLD 2 3.09 4.35 2.70 85 XM_DKIMWhitelistDomains 2 2.06 0.00 2.70 86 MIME_HTML_MOSTLY 2 2.06 0.00 2.70 87 XMSubMetaSxObfu_03 2 2.06 0.00 2.70 88 XM_UB50 2 7.22 21.74 2.70 89 T_XMHurry_00 2 3.09 4.35 2.70 90 UNTRUSTED_Relay 2 11.34 39.13 2.70 91 HTTPS_HTTP_MISMATCH 1 3.09 8.70 1.35 92 XM_PDF 1 1.03 0.00 1.35 93 RCVD_IN_IADB_DK 1 1.03 0.00 1.35 94 TR_XM_SpammyRelay 1 5.15 17.39 1.35 95 HTML_IMAGE_RATIO_08 1 2.06 4.35 1.35 96 MIME_HTML_ONLY_MULTI 1 1.03 0.00 1.35 97 XM_B_Unsub2 1 1.03 0.00 1.35 98 RCVD_IN_IADB_LISTED 1 1.03 0.00 1.35 99 XM_ShortIntro_01 1 1.03 0.00 1.35 100 MSGID_NOFQDN1 1 3.09 8.70 1.35 101 XM_B_SpammyWords4 1 1.03 0.00 1.35 102 THIS_AD 1 1.03 0.00 1.35 103 NUMERIC_HTTP_ADDR 1 1.03 0.00 1.35 104 XM_ProductURIs 1 1.03 0.00 1.35 105 HTML_IMAGE_RATIO_02 1 2.06 4.35 1.35 106 RELAYCOUNTRY_DE 1 2.06 4.35 1.35 107 LONG_JUNK_URI3 1 1.03 0.00 1.35 108 TO_MALFORMED 1 2.06 4.35 1.35 109 TM2_M_HAS_BSLASH_URI 1 1.03 0.00 1.35 110 XM_CamelCaseFrm001 1 1.03 0.00 1.35 111 RCVD_IN_IADB_SENDERID 1 1.03 0.00 1.35 112 RELAYCOUNTRY_ZA 1 1.03 0.00 1.35 113 RELAYCOUNTRY_AU 1 2.06 4.35 1.35 114 RCVD_IN_IADB_SPF 1 1.03 0.00 1.35 115 TooManyTo_002 1 1.03 0.00 1.35 116 INVALID_MSGID 1 3.09 8.70 1.35 117 XM_S_SpammyWords 1 3.09 8.70 1.35 118 RCVD_IN_RP_CERTIFIED 1 1.03 0.00 1.35 119 HTML_IMAGE_ONLY_20 1 1.03 0.00 1.35 120 TR_XM_Spammywords 1 3.09 8.70 1.35 121 NICE_REPLY_A 1 1.03 0.00 1.35 122 HTML_TAG_BALANCE_BODY 1 1.03 0.00 1.35 123 TVD_PH_BODY_ACCOUNTS_PRE 1 1.03 0.00 1.35 124 XMPhish30 1 1.03 0.00 1.35 125 USER_IN_DEF_DKIM_WL 1 1.03 0.00 1.35 126 KHOP_HELO_FCRDNS 1 1.03 0.00 1.35 127 RCVD_IN_RP_SAFE 1 1.03 0.00 1.35 128 LongTLD 1 1.03 0.00 1.35 129 XMGappySubj_01 1 1.03 0.00 1.35 130 TR_XM_DK_Bayes2 1 1.03 0.00 1.35 131 XM_DIRTYINTL 1 1.03 0.00 1.35 132 XMStockSpam_06 1 1.03 0.00 1.35 133 XMLngstWrd_00 1 1.03 0.00 1.35 134 XM_B_Phish66 1 2.06 4.35 1.35 135 FSL_BULK_SIG 1 3.09 8.70 1.35 136 T_REMOTE_IMAGE 1 1.03 0.00 1.35 137 MPART_ALT_DIFF 1 1.03 0.00 1.35 138 XM_SPF_SoftFail 1 1.03 0.00 1.35 139 RELAYCOUNTRY_NL 1 3.09 8.70 1.35 140 BAD_ENC_HEADER 1 1.03 0.00 1.35 141 HTML_IMAGE_RATIO_06 1 3.09 8.70 1.35 142 RCVD_IN_MSPIKE_H5 1 1.03 0.00 1.35 143 HTML_FONT_FACE_BAD 1 1.03 0.00 1.35 144 XMHTML_After_End 1 1.03 0.00 1.35 145 XM_H_Trusted_IP 1 1.03 0.00 1.35 146 XM_S_SketchInvoice 1 1.03 0.00 1.35 147 XMNoVowels 1 1.03 0.00 1.35 148 T_XMDrugObfuBody_14 1 1.03 0.00 1.35 ----------------------------------------------------------------------