Email: 93 Autolearn: 0 AvgScore: 4.01 AvgScanTime: 2.03 sec Spam: 34 Autolearn: 0 AvgScore: 12.74 AvgScanTime: 2.71 sec Ham: 59 Autolearn: 0 AvgScore: -1.02 AvgScanTime: 1.63 sec Time Spent Running SA: 0.05 hours Time Spent Processing Spam: 0.03 hours Time Spent Processing Ham: 0.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 31 79.57 91.18 72.88 2 DKIM_SIGNED 28 74.19 82.35 69.49 3 XM_DK_Pass 27 70.97 79.41 66.10 4 DKIM_VALID 26 69.89 76.47 66.10 5 RELAYCOUNTRY_US 25 73.12 73.53 72.88 6 XMListUnsubscribeExists 25 52.69 73.53 40.68 7 BAYES_50 23 66.67 67.65 66.10 8 DCC_CHECK_NEGATIVE 23 80.65 67.65 88.14 9 MIME_HTML_ONLY 20 30.11 58.82 13.56 10 DKIM_VALID_AU 20 53.76 58.82 50.85 11 XM_B_Unicode 19 58.06 55.88 59.32 12 RCVD_IN_MSPIKE_H2 16 29.03 47.06 18.64 13 FVGT_m_MULTI_ODD 16 30.11 47.06 20.34 14 XM_B_SpammyWords 15 45.16 44.12 45.76 15 XM_UncommonTLD01 15 18.28 44.12 3.39 16 XM_B_Unicode3 12 29.03 35.29 25.42 17 RELAYCOUNTRY_META 11 18.28 32.35 10.17 18 DCC_CHECK 11 19.35 32.35 11.86 19 HTML_MIME_NO_HTML_TAG 11 13.98 32.35 3.39 20 XMLngstWrd_00 9 10.75 26.47 1.69 21 HTML_TITLE_SUBJ_DIFF 9 9.68 26.47 0.00 22 XMLngstWrd_02 9 9.68 26.47 0.00 23 XM_GoogleGroups 9 10.75 26.47 1.69 24 TM2_M_VERY_LONG_WORD 9 10.75 26.47 1.69 25 MPART_ALT_DIFF 9 10.75 26.47 1.69 26 XMLngstWrd_04 9 9.68 26.47 0.00 27 UPPERCASE_75_100 9 9.68 26.47 0.00 28 XMLngstWrd_01 9 9.68 26.47 0.00 29 MIME_HTML_ONLY_MULTI 9 10.75 26.47 1.69 30 XMLngstWrd_03 9 9.68 26.47 0.00 31 DKIM_VALID_EF 9 31.18 26.47 33.90 32 BAYES_99 8 9.68 23.53 1.69 33 XM_Body_Dirty_Words 8 19.35 23.53 16.95 34 RCVD_IN_MSPIKE_WL 8 29.03 23.53 32.20 35 UNTRUSTED_Relay 8 10.75 23.53 3.39 36 LOC_TINY_FONT_1 7 17.20 20.59 15.25 37 XM_DK_Undo_02 7 8.60 20.59 1.69 38 RCVD_IN_MSPIKE_H3 7 22.58 20.59 23.73 39 BOTNET_IPINHOSTNAME 7 16.13 20.59 13.56 40 SpammyFromTLD_01 6 6.45 17.65 0.00 41 T_KAM_HTML_FONT_INVALID 6 21.51 17.65 23.73 42 XM_UB50 6 7.53 17.65 1.69 43 XM_B_SpammyWords2 6 16.13 17.65 15.25 44 BAYES_999 6 6.45 17.65 0.00 45 UNPARSEABLE_RELAY 6 18.28 17.65 18.64 46 T_XMHurry_00 5 8.60 14.71 5.08 47 XM_B_SpammyWords3 5 8.60 14.71 5.08 48 TR_XM_SpammyWords4 5 10.75 14.71 8.47 49 TR_XM_SpammyRelay 5 9.68 14.71 6.78 50 TR_XM_BayesUnsub 5 12.90 14.71 11.86 51 XM_Multi_Part_URI 5 15.05 14.71 15.25 52 LOTS_OF_MONEY 5 10.75 14.71 8.47 53 SpammyFromTLD_02 5 5.38 14.71 0.00 54 XM_B_Unsub 5 13.98 14.71 13.56 55 HTML_FONT_LOW_CONTRAST 5 12.90 14.71 11.86 56 TR_XM_UnparsRelay 4 8.60 11.76 6.78 57 TR_XM_DKIM_Undo 4 4.30 11.76 0.00 58 XMSexyCombo_05 4 5.38 11.76 1.69 59 XM_SendGrid 4 9.68 11.76 8.47 60 FSL_BULK_SIG 3 4.30 8.82 1.69 61 TR_XM_DK_Unsub 3 11.83 8.82 13.56 62 XM_SPF_SoftFail 3 3.23 8.82 0.00 63 TooManyTo_001 3 5.38 8.82 3.39 64 HTML_IMAGE_RATIO_02 3 8.60 8.82 8.47 65 XM_B_Phish_Phrases 3 3.23 8.82 0.00 66 TR_XM_InvalidRelay 3 3.23 8.82 0.00 67 XM_BadFromFormat 2 2.15 5.88 0.00 68 RCVD_IN_MSPIKE_BL 2 3.23 5.88 1.69 69 XM_UB99 2 2.15 5.88 0.00 70 TR_XM_SpammyWords2 2 2.15 5.88 0.00 71 BOTNET 2 3.23 5.88 1.69 72 RCVD_IN_MSPIKE_L3 2 3.23 5.88 1.69 73 RELAYCOUNTRY_BE 2 2.15 5.88 0.00 74 DKIM_INVALID 2 4.30 5.88 3.39 75 KHOP_HELO_FCRDNS 2 3.23 5.88 1.69 76 RELAYCOUNTRY_TR 2 2.15 5.88 0.00 77 RELAYCOUNTRY_GB 2 3.23 5.88 1.69 78 TR_DCC_Bayes_99 2 2.15 5.88 0.00 79 HTML_TAG_BALANCE_BODY 2 5.38 5.88 5.08 80 PDS_FRNOM_TODOM_NAKED_TO 2 2.15 5.88 0.00 81 TR_XM_MSPIKECOMBO 2 3.23 5.88 1.69 82 LOADSA_MONEY_COMBO 2 2.15 5.88 0.00 83 T_TM2_M_HEADER_IN_MSG 2 19.35 5.88 27.12 84 XM_Evil_Numbers_Gen 2 6.45 5.88 6.78 85 PDS_FROM_NAME_TO_DOMAIN 2 2.15 5.88 0.00 86 XM_B_Investor 1 2.15 2.94 1.69 87 XMDateMe_00 1 1.08 2.94 0.00 88 RELAYCOUNTRY_LT 1 1.08 2.94 0.00 89 T_XMDrugObfuBody_14 1 2.15 2.94 1.69 90 OBFU_TEXT_ATTACH 1 1.08 2.94 0.00 91 TR_XM_Undi_Recip11 1 1.08 2.94 0.00 92 TR_Mismatch_TLD_02 1 1.08 2.94 0.00 93 XM_B_SpammyWords4 1 1.08 2.94 0.00 94 MONEY_FRAUD_3 1 1.08 2.94 0.00 95 TR_BOTNET_NEGATE 1 1.08 2.94 0.00 96 XM_B_Unsub2 1 2.15 2.94 1.69 97 XMSolicitRefs_0 1 1.08 2.94 0.00 98 LongTLD 1 1.08 2.94 0.00 99 TO_NO_BRKTS_DYNIP 1 1.08 2.94 0.00 100 XM_UB999 1 1.08 2.94 0.00 101 DEAR_FRIEND 1 1.08 2.94 0.00 102 RCVD_IN_VALIDITY_SAFE 1 1.08 2.94 0.00 103 RCVD_IN_VALIDITY_CERTIFIED 1 1.08 2.94 0.00 104 XMPhish30 1 1.08 2.94 0.00 105 RCVD_IN_VALIDITY_RPBL 1 1.08 2.94 0.00 106 XM_H_Long_From01 1 3.23 2.94 3.39 107 RELAYCOUNTRY_AU 1 2.15 2.94 1.69 108 RCVD_IN_BL_SPAMCOP_NET 1 1.08 2.94 0.00 109 RELAYCOUNTRY_ES 1 1.08 2.94 0.00 110 RELAYCOUNTRY_FR 1 2.15 2.94 1.69 111 T_Symld_Words_02 1 1.08 2.94 0.00 112 RELAYCOUNTRY_TH 1 1.08 2.94 0.00 113 XFER_LOTSA_MONEY 1 1.08 2.94 0.00 114 TooManyTo_002 1 1.08 2.94 0.00 115 XMSubject_63 1 1.08 2.94 0.00 116 T_REMOTE_IMAGE 1 2.15 2.94 1.69 117 URI_NO_WWW_INFO_CGI 1 1.08 2.94 0.00 118 LONG_JUNK_URI 1 1.08 2.94 0.00 119 XMBody_29 1 1.08 2.94 0.00 120 HTML_IMAGE_RATIO_04 1 5.38 2.94 6.78 121 XM_DIRTYINTL 1 3.23 2.94 3.39 122 UNDISC_MONEY 1 1.08 2.94 0.00 123 SUBJ_DOLLARS 1 4.30 2.94 5.08 124 RELAYCOUNTRY_RU 1 1.08 2.94 0.00 125 ADVANCE_FEE_2_NEW_MONEY 1 1.08 2.94 0.00 126 XMStrtUSub 1 6.45 2.94 8.47 127 BAYES_95 1 5.38 2.94 6.78 128 T_XMDrugObfuBody_08 1 2.15 2.94 1.69 129 XM_H_Undi_Recip 1 1.08 2.94 0.00 130 HK_SCAM 1 1.08 2.94 0.00 131 BAYES_60 1 9.68 2.94 13.56 132 RDNS_DYNAMIC 1 1.08 2.94 0.00 133 TR_XM_PhishingBody 1 2.15 2.94 1.69 134 XM_Body_Dirty_Words_01 1 1.08 2.94 0.00 135 TooManyTo_004 1 1.08 2.94 0.00 136 TR_XM_Undi_Recip5 1 1.08 2.94 0.00 137 PDS_RDNS_DYNAMIC_FP 1 1.08 2.94 0.00 138 TR_XM_Undi_Recip12 1 1.08 2.94 0.00 139 IMPOTENCE 1 1.08 2.94 0.00 140 TR_XM_Undi_RecipCombo2 1 1.08 2.94 0.00 141 XMSubLong 1 18.28 2.94 27.12 142 XMHTML_After_End 1 1.08 2.94 0.00 143 XMStockSpam_06 1 1.08 2.94 0.00 144 XM_B_SpammyTLD 1 1.08 2.94 0.00 145 TooManyTo_003 1 1.08 2.94 0.00 146 TR_XM_SpammyWords5 1 1.08 2.94 0.00 147 DEAR_SOMETHING 1 1.08 2.94 0.00 148 TM2_M_URI_OPT_OUT 1 2.15 2.94 1.69 149 XM_HighProb1 1 1.08 2.94 0.00 150 TM2_M_A_HREF_HREF 1 1.08 2.94 0.00 151 XM_URI_RBL 1 1.08 2.94 0.00 152 BAYES_80 1 1.08 2.94 0.00 153 RCVD_IN_MSPIKE_H4 1 5.38 2.94 6.78 154 TR_XM_NoHeaderRelay 1 2.15 2.94 1.69 155 XMFrmHeader_28 1 1.08 2.94 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 52 80.65 67.65 88.14 2 HTML_MESSAGE 43 79.57 91.18 72.88 3 RELAYCOUNTRY_US 43 73.12 73.53 72.88 4 DKIM_SIGNED 41 74.19 82.35 69.49 5 BAYES_50 39 66.67 67.65 66.10 6 XM_DK_Pass 39 70.97 79.41 66.10 7 DKIM_VALID 39 69.89 76.47 66.10 8 XM_B_Unicode 35 58.06 55.88 59.32 9 DKIM_VALID_AU 30 53.76 58.82 50.85 10 XM_B_SpammyWords 27 45.16 44.12 45.76 11 XMListUnsubscribeExists 24 52.69 73.53 40.68 12 DKIM_VALID_EF 20 31.18 26.47 33.90 13 RCVD_IN_MSPIKE_WL 19 29.03 23.53 32.20 14 XMSubLong 16 18.28 2.94 27.12 15 T_TM2_M_HEADER_IN_MSG 16 19.35 5.88 27.12 16 XM_B_Unicode3 15 29.03 35.29 25.42 17 RCVD_IN_MSPIKE_H3 14 22.58 20.59 23.73 18 T_KAM_HTML_FONT_INVALID 14 21.51 17.65 23.73 19 FVGT_m_MULTI_ODD 12 30.11 47.06 20.34 20 T_TooManySym_01 11 11.83 0.00 18.64 21 UNPARSEABLE_RELAY 11 18.28 17.65 18.64 22 RCVD_IN_MSPIKE_H2 11 29.03 47.06 18.64 23 ALL_TRUSTED 10 10.75 0.00 16.95 24 XM_Body_Dirty_Words 10 19.35 23.53 16.95 25 XM_B_SpammyWords2 9 16.13 17.65 15.25 26 LOC_TINY_FONT_1 9 17.20 20.59 15.25 27 XM_Multi_Part_URI 9 15.05 14.71 15.25 28 BAYES_60 8 9.68 2.94 13.56 29 MIME_HTML_ONLY 8 30.11 58.82 13.56 30 XM_B_Unsub 8 13.98 14.71 13.56 31 BOTNET_IPINHOSTNAME 8 16.13 20.59 13.56 32 XM_DKIMWhitelistDomains 8 8.60 0.00 13.56 33 TR_XM_DK_Unsub 8 11.83 8.82 13.56 34 HTML_FONT_LOW_CONTRAST 7 12.90 14.71 11.86 35 DCC_CHECK 7 19.35 32.35 11.86 36 TR_XM_BayesUnsub 7 12.90 14.71 11.86 37 T_TooManySym_02 7 7.53 0.00 11.86 38 HTML_FONT_FACE_BAD 6 6.45 0.00 10.17 39 RELAYCOUNTRY_META 6 18.28 32.35 10.17 40 IN_ZIMBRA_NJ_WHITELIST 5 5.38 0.00 8.47 41 XMStrtUSub 5 6.45 2.94 8.47 42 LOTS_OF_MONEY 5 10.75 14.71 8.47 43 XM_SendGrid 5 9.68 11.76 8.47 44 HTML_IMAGE_RATIO_02 5 8.60 8.82 8.47 45 TR_XM_SpammyWords4 5 10.75 14.71 8.47 46 BAYES_95 4 5.38 2.94 6.78 47 XMNumbers 4 4.30 0.00 6.78 48 LotsOfNums_01 4 4.30 0.00 6.78 49 XM_Evil_Numbers_Gen 4 6.45 5.88 6.78 50 BAYES_00 4 4.30 0.00 6.78 51 RCVD_IN_MSPIKE_H4 4 5.38 2.94 6.78 52 BOUNCE_MESSAGE 4 4.30 0.00 6.78 53 TR_XM_UnparsRelay 4 8.60 11.76 6.78 54 ANY_BOUNCE_MESSAGE 4 4.30 0.00 6.78 55 TR_XM_SpammyRelay 4 9.68 14.71 6.78 56 HTML_IMAGE_RATIO_04 4 5.38 2.94 6.78 57 XM_ZIP 4 4.30 0.00 6.78 58 HTML_TAG_BALANCE_BODY 3 5.38 5.88 5.08 59 HTML_IMAGE_RATIO_06 3 3.23 0.00 5.08 60 XM_DK_Undo_01 3 3.23 0.00 5.08 61 MIME_HTML_MOSTLY 3 3.23 0.00 5.08 62 INVALID_MSGID 3 3.23 0.00 5.08 63 TVD_SPACE_RATIO 3 3.23 0.00 5.08 64 T_XMHurry_00 3 8.60 14.71 5.08 65 XM_B_SpammyWords3 3 8.60 14.71 5.08 66 MAILING_LIST_MULTI 3 3.23 0.00 5.08 67 SUBJ_DOLLARS 3 4.30 2.94 5.08 68 FVGT_m_MULTI_ODD_EMAIL 2 2.15 0.00 3.39 69 TR_XM_SpoofPhishAttach 2 2.15 0.00 3.39 70 HTML_MIME_NO_HTML_TAG 2 13.98 32.35 3.39 71 USER_IN_DEF_DKIM_WL 2 2.15 0.00 3.39 72 RELAYCOUNTRY_CA 2 2.15 0.00 3.39 73 TR_XM_PSC1 2 2.15 0.00 3.39 74 REPLYTO_WITHOUT_TO_CC 2 2.15 0.00 3.39 75 TO_MALFORMED 2 2.15 0.00 3.39 76 TooManyTo_001 2 5.38 8.82 3.39 77 UNTRUSTED_Relay 2 10.75 23.53 3.39 78 XM_ZohoDesk1 2 2.15 0.00 3.39 79 TR_XM_SpoofStaff 2 2.15 0.00 3.39 80 XMSpoofStaff2 2 2.15 0.00 3.39 81 XM_UncommonTLD01 2 18.28 44.12 3.39 82 XM_PDF 2 2.15 0.00 3.39 83 MIME_QP_LONG_LINE 2 2.15 0.00 3.39 84 XMGappySubj_01 2 2.15 0.00 3.39 85 MISSING_HEADERS 2 2.15 0.00 3.39 86 XM_H_Trusted_IP 2 2.15 0.00 3.39 87 XM_H_SpoofStaff4 2 2.15 0.00 3.39 88 TR_XM_DK_SendGrid 2 2.15 0.00 3.39 89 BAYES_40 2 2.15 0.00 3.39 90 MSGID_NOFQDN1 2 2.15 0.00 3.39 91 T_TooManySym_03 2 2.15 0.00 3.39 92 XM_H_Long_From01 2 3.23 2.94 3.39 93 DKIM_INVALID 2 4.30 5.88 3.39 94 XM_DIRTYINTL 2 3.23 2.94 3.39 95 XM_CamelCaseFrm001 2 2.15 0.00 3.39 96 FILL_THIS_FORM 1 1.08 0.00 1.69 97 TVD_RCVD_IP 1 1.08 0.00 1.69 98 FROM_EXCESS_BASE64 1 1.08 0.00 1.69 99 TM2_M_VERY_LONG_WORD 1 10.75 26.47 1.69 100 T_XMDrugObfuBody_08 1 2.15 2.94 1.69 101 XMSubPhish11 1 1.08 0.00 1.69 102 XMSubject_78 1 1.08 0.00 1.69 103 XMSubMetaSx_00 1 1.08 0.00 1.69 104 XMPhish11 1 1.08 0.00 1.69 105 MPART_ALT_DIFF 1 10.75 26.47 1.69 106 TR_XM_MSPIKECOMBO 1 3.23 5.88 1.69 107 XMBrknScrpt_02 1 1.08 0.00 1.69 108 XMSexyCombo_05 1 5.38 11.76 1.69 109 TR_XM_PhishingBody 1 2.15 2.94 1.69 110 IN_HORDE_ADDRESS_BOOK 1 1.08 0.00 1.69 111 XMSubMetaI_00 1 1.08 0.00 1.69 112 RCVD_IN_MSPIKE_H5 1 1.08 0.00 1.69 113 HTML_IMAGE_ONLY_16 1 1.08 0.00 1.69 114 HK_RANDOM_REPLYTO 1 1.08 0.00 1.69 115 T_OBFU_PDF_ATTACH 1 1.08 0.00 1.69 116 TR_Mismatch_TLD_01 1 1.08 0.00 1.69 117 TR_XM_Base64_M1 1 1.08 0.00 1.69 118 XMBSHREFv2 1 1.08 0.00 1.69 119 XMBody_17 1 1.08 0.00 1.69 120 MIME_HTML_ONLY_MULTI 1 10.75 26.47 1.69 121 HTML_IMAGE_ONLY_08 1 1.08 0.00 1.69 122 XMDiploma_00 1 1.08 0.00 1.69 123 TM2_M_URI_OPT_OUT 1 2.15 2.94 1.69 124 TR_XM_NoHeaderRelay 1 2.15 2.94 1.69 125 MY_SERVERS_FOUND 1 1.08 0.00 1.69 126 TR_XM_SB_Phish 1 1.08 0.00 1.69 127 XMMoneyMeta_00 1 1.08 0.00 1.69 128 XM_B_Investor 1 2.15 2.94 1.69 129 XMSubMetaSxObfu_03 1 1.08 0.00 1.69 130 FSL_BULK_SIG 1 4.30 8.82 1.69 131 T_XMDrugObfuBody_14 1 2.15 2.94 1.69 132 RCVD_IN_MSPIKE_BL 1 3.23 5.88 1.69 133 XMBody_95 1 1.08 0.00 1.69 134 XM_B_Unsub2 1 2.15 2.94 1.69 135 XMLngstWrd_00 1 10.75 26.47 1.69 136 NO_DNS_FOR_FROM 1 1.08 0.00 1.69 137 BOTNET 1 3.23 5.88 1.69 138 RCVD_IN_MSPIKE_L3 1 3.23 5.88 1.69 139 DKIM_ADSP_NXDOMAIN 1 1.08 0.00 1.69 140 RELAYCOUNTRY_AU 1 2.15 2.94 1.69 141 KHOP_HELO_FCRDNS 1 3.23 5.88 1.69 142 RELAYCOUNTRY_FR 1 2.15 2.94 1.69 143 BAYES_99 1 9.68 23.53 1.69 144 TR_XM_Base64_M2 1 1.08 0.00 1.69 145 RELAYCOUNTRY_CN 1 1.08 0.00 1.69 146 XM_DK_Undo_02 1 8.60 20.59 1.69 147 XM_GoogleGroups 1 10.75 26.47 1.69 148 T_REMOTE_IMAGE 1 2.15 2.94 1.69 149 BAYES_05 1 1.08 0.00 1.69 150 RCVD_IN_PSBL 1 1.08 0.00 1.69 151 TVD_PH_BODY_ACCOUNTS_PRE 1 1.08 0.00 1.69 152 XM_UB50 1 7.53 17.65 1.69 153 RELAYCOUNTRY_GB 1 3.23 5.88 1.69 154 TR_XM_SpoofStaff3 1 1.08 0.00 1.69 155 URI_HEX 1 1.08 0.00 1.69 ----------------------------------------------------------------------