Email: 108 Autolearn: 0 AvgScore: 1.43 AvgScanTime: 1.29 sec Spam: 18 Autolearn: 0 AvgScore: 14.06 AvgScanTime: 1.82 sec Ham: 90 Autolearn: 0 AvgScore: -1.10 AvgScanTime: 1.18 sec Time Spent Running SA: 0.04 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 17 58.33 94.44 51.11 2 DKIM_SIGNED 15 74.07 83.33 72.22 3 XM_DK_Pass 14 71.30 77.78 70.00 4 DKIM_VALID 14 71.30 77.78 70.00 5 XM_B_Unicode 12 45.37 66.67 41.11 6 RELAYCOUNTRY_US 12 76.85 66.67 78.89 7 DKIM_VALID_AU 10 58.33 55.56 58.89 8 DCC_CHECK_NEGATIVE 10 87.04 55.56 93.33 9 XM_B_SpammyWords 10 27.78 55.56 22.22 10 XMListUnsubscribeExists 9 21.30 50.00 15.56 11 DKIM_VALID_EF 9 48.15 50.00 47.78 12 FVGT_m_MULTI_ODD 8 23.15 44.44 18.89 13 DCC_CHECK 8 12.96 44.44 6.67 14 BAYES_99 8 8.33 44.44 1.11 15 BAYES_999 7 7.41 38.89 1.11 16 MIME_HTML_ONLY 7 14.81 38.89 10.00 17 XM_B_SpammyWords2 7 12.96 38.89 7.78 18 XM_DK_Undo_02 6 6.48 33.33 1.11 19 LOC_TINY_FONT_1 6 9.26 33.33 4.44 20 XM_B_Unsub 5 11.11 27.78 7.78 21 RELAYCOUNTRY_META 5 10.19 27.78 6.67 22 TR_XM_DK_Unsub 5 6.48 27.78 2.22 23 XM_Multi_Part_URI 5 8.33 27.78 4.44 24 BAYES_50 5 75.00 27.78 84.44 25 RCVD_IN_MSPIKE_H2 5 21.30 27.78 20.00 26 TR_XM_BayesUnsub 5 11.11 27.78 7.78 27 UNTRUSTED_Relay 5 4.63 27.78 0.00 28 T_KAM_HTML_FONT_INVALID 4 12.96 22.22 11.11 29 RCVD_IN_MSPIKE_WL 4 40.74 22.22 44.44 30 XM_Body_Dirty_Words 4 9.26 22.22 6.67 31 T_TM2_M_HEADER_IN_MSG 4 22.22 22.22 22.22 32 XM_B_Unicode3 3 26.85 16.67 28.89 33 HTML_FONT_LOW_CONTRAST 3 13.89 16.67 13.33 34 HTML_TITLE_SUBJ_DIFF 3 2.78 16.67 0.00 35 TR_XM_DKIM_Undo 3 3.70 16.67 1.11 36 TR_XM_SpammyRelay 3 6.48 16.67 4.44 37 PDS_OTHER_BAD_TLD 3 2.78 16.67 0.00 38 XM_UB50 3 2.78 16.67 0.00 39 BOTNET 3 2.78 16.67 0.00 40 XM_B_SpammyTLD 3 3.70 16.67 1.11 41 BOTNET_IPINHOSTNAME 3 3.70 16.67 1.11 42 RCVD_IN_MSPIKE_H3 3 38.89 16.67 43.33 43 HTML_MIME_NO_HTML_TAG 3 6.48 16.67 4.44 44 UNPARSEABLE_RELAY 3 9.26 16.67 7.78 45 XM_B_SpammyWords3 3 6.48 16.67 4.44 46 RELAYCOUNTRY_IT 2 1.85 11.11 0.00 47 XM_DIRTYINTL 2 1.85 11.11 0.00 48 XM_UncommonTLD01 2 3.70 11.11 2.22 49 BAYES_95 2 1.85 11.11 0.00 50 FSL_BULK_SIG 2 3.70 11.11 2.22 51 XMBounce_02 2 1.85 11.11 0.00 52 XMSexyCombo_05 2 1.85 11.11 0.00 53 XM_Evil_Numbers_Gen 2 4.63 11.11 3.33 54 XM_H_PHPMailer 2 1.85 11.11 0.00 55 HTML_IMAGE_RATIO_04 2 2.78 11.11 1.11 56 XMSubLong 2 46.30 11.11 53.33 57 XM_H_Undi_Recip 2 1.85 11.11 0.00 58 RCVD_IN_VALIDITY_RPBL 2 1.85 11.11 0.00 59 TO_NO_BRKTS_HTML_ONLY 2 1.85 11.11 0.00 60 BOUNCE_MESSAGE 2 35.19 11.11 40.00 61 XM_DK_Undo_01 2 3.70 11.11 2.22 62 ANY_BOUNCE_MESSAGE 2 35.19 11.11 40.00 63 XMBounce_01 2 1.85 11.11 0.00 64 SpammyFromTLD_01 2 1.85 11.11 0.00 65 RELAYCOUNTRY_IN 1 0.93 5.56 0.00 66 XM_SendGrid 1 2.78 5.56 2.22 67 XMLngstWrd_04 1 0.93 5.56 0.00 68 FROM_SUSPICIOUS_NTLD_FP 1 0.93 5.56 0.00 69 XM_UB999 1 0.93 5.56 0.00 70 MIME_HTML_MOSTLY 1 2.78 5.56 2.22 71 XMSubLongNoVowel 1 0.93 5.56 0.00 72 DEAR_SOMETHING 1 1.85 5.56 1.11 73 HTML_TAG_BALANCE_BODY 1 0.93 5.56 0.00 74 DKIM_ADSP_NXDOMAIN 1 0.93 5.56 0.00 75 HTML_IMAGE_ONLY_32 1 0.93 5.56 0.00 76 XM_H_TOP 1 0.93 5.56 0.00 77 TR_XM_SpammyWords5 1 1.85 5.56 1.11 78 TR_XM_MaxWHORU 1 0.93 5.56 0.00 79 MIXED_ES 1 0.93 5.56 0.00 80 XM_UB99 1 0.93 5.56 0.00 81 BOTNET_NORDNS 1 0.93 5.56 0.00 82 BAYES_60 1 5.56 5.56 5.56 83 RELAYCOUNTRY_DE 1 0.93 5.56 0.00 84 T_TVD_MIME_NO_HEADERS 1 0.93 5.56 0.00 85 MPART_ALT_DIFF 1 3.70 5.56 3.33 86 XMLngstWrd_01 1 0.93 5.56 0.00 87 XM_UB60 1 0.93 5.56 0.00 88 NML_ADSP_CUSTOM_MED 1 0.93 5.56 0.00 89 SpammyFromTLD_02 1 0.93 5.56 0.00 90 TR_XM_NoHeaderRelay 1 0.93 5.56 0.00 91 TR_MetaPhish_Combo_01 1 0.93 5.56 0.00 92 XMSubNoVowel 1 1.85 5.56 1.11 93 TR_XM_InvalidRelay 1 0.93 5.56 0.00 94 XMSubGiftCard1 1 0.93 5.56 0.00 95 USER_IN_DEF_DKIM_WL 1 2.78 5.56 2.22 96 XM_Walgreens_Forge 1 0.93 5.56 0.00 97 XMSexyCombo_01 1 2.78 5.56 2.22 98 TR_Caps_n_Bayes_99 1 0.93 5.56 0.00 99 BAYES_80 1 0.93 5.56 0.00 100 XMSubMetaSx_00 1 3.70 5.56 3.33 101 XMSubGarbage 1 0.93 5.56 0.00 102 DKIM_INVALID 1 2.78 5.56 2.22 103 RELAYCOUNTRY_CN 1 1.85 5.56 1.11 104 XM_B_DynamicLink 1 0.93 5.56 0.00 105 TR_XM_UnparsRelay 1 0.93 5.56 0.00 106 XM_H_Long_From01 1 4.63 5.56 4.44 107 DKIM_ADSP_CUSTOM_MED 1 0.93 5.56 0.00 108 SHORT_SHORTNER 1 0.93 5.56 0.00 109 TR_XM_DK_SendGrid 1 2.78 5.56 2.22 110 URI_NOVOWEL 1 1.85 5.56 1.11 111 XMLngstWrd_00 1 1.85 5.56 1.11 112 XMBody_17 1 0.93 5.56 0.00 113 BAYES_40 1 1.85 5.56 1.11 114 LOTS_OF_MONEY 1 2.78 5.56 2.22 115 XMLngstWrd_03 1 0.93 5.56 0.00 116 NO_DNS_FOR_FROM 1 0.93 5.56 0.00 117 XM_SPF_SoftFail 1 1.85 5.56 1.11 118 TR_XM_SB_Phish 1 0.93 5.56 0.00 119 FORGED_GMAIL_RCVD 1 0.93 5.56 0.00 120 TR_DCC_Bayes_99 1 0.93 5.56 0.00 121 MIME_HEADER_CTYPE_ONLY 1 0.93 5.56 0.00 122 MAILING_LIST_MULTI 1 1.85 5.56 1.11 123 RCVD_IN_MSPIKE_H4 1 0.93 5.56 0.00 124 XMLngstWrd_02 1 0.93 5.56 0.00 125 XMSubPhish11 1 0.93 5.56 0.00 126 HTML_IMAGE_RATIO_02 1 0.93 5.56 0.00 127 TR_Mismatch_TLD_02 1 0.93 5.56 0.00 128 TR_XM_SpammyWords2 1 1.85 5.56 1.11 129 HTTPS_HTTP_MISMATCH 1 0.93 5.56 0.00 130 PLING_QUERY 1 0.93 5.56 0.00 131 T_XMDrugObfuBody_14 1 6.48 5.56 6.67 132 FROM_SUSPICIOUS_NTLD 1 0.93 5.56 0.00 133 SUBJ_ALL_CAPS 1 3.70 5.56 3.33 134 ALL_TRUSTED 1 13.89 5.56 15.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 84 87.04 55.56 93.33 2 BAYES_50 76 75.00 27.78 84.44 3 RELAYCOUNTRY_US 71 76.85 66.67 78.89 4 DKIM_SIGNED 65 74.07 83.33 72.22 5 XM_DK_Pass 63 71.30 77.78 70.00 6 DKIM_VALID 63 71.30 77.78 70.00 7 DKIM_VALID_AU 53 58.33 55.56 58.89 8 XMSubLong 48 46.30 11.11 53.33 9 HTML_MESSAGE 46 58.33 94.44 51.11 10 DKIM_VALID_EF 43 48.15 50.00 47.78 11 RCVD_IN_MSPIKE_WL 40 40.74 22.22 44.44 12 T_TooManySym_01 40 37.04 0.00 44.44 13 RCVD_IN_MSPIKE_H3 39 38.89 16.67 43.33 14 XM_B_Unicode 37 45.37 66.67 41.11 15 ANY_BOUNCE_MESSAGE 36 35.19 11.11 40.00 16 BOUNCE_MESSAGE 36 35.19 11.11 40.00 17 XM_B_Unicode3 26 26.85 16.67 28.89 18 T_TooManySym_02 24 22.22 0.00 26.67 19 T_TM2_M_HEADER_IN_MSG 20 22.22 22.22 22.22 20 XM_B_SpammyWords 20 27.78 55.56 22.22 21 T_TooManySym_03 19 17.59 0.00 21.11 22 RCVD_IN_MSPIKE_H2 18 21.30 27.78 20.00 23 XMGappySubj_01 18 16.67 0.00 20.00 24 FVGT_m_MULTI_ODD 17 23.15 44.44 18.89 25 XM_S_SubURI 17 15.74 0.00 18.89 26 XMListUnsubscribeExists 14 21.30 50.00 15.56 27 ALL_TRUSTED 14 13.89 5.56 15.56 28 HTML_FONT_LOW_CONTRAST 12 13.89 16.67 13.33 29 XMWhlSbjSex 10 9.26 0.00 11.11 30 T_KAM_HTML_FONT_INVALID 10 12.96 22.22 11.11 31 MIME_HTML_ONLY 9 14.81 38.89 10.00 32 HTML_IMAGE_RATIO_06 7 6.48 0.00 7.78 33 XM_B_Unsub 7 11.11 27.78 7.78 34 TR_XM_BayesUnsub 7 11.11 27.78 7.78 35 XM_B_SpammyWords2 7 12.96 38.89 7.78 36 UNPARSEABLE_RELAY 7 9.26 16.67 7.78 37 TooManyTo_001 6 5.56 0.00 6.67 38 RELAYCOUNTRY_META 6 10.19 27.78 6.67 39 XM_Body_Dirty_Words 6 9.26 22.22 6.67 40 DCC_CHECK 6 12.96 44.44 6.67 41 T_XMDrugObfuBody_14 6 6.48 5.56 6.67 42 BAYES_60 5 5.56 5.56 5.56 43 HTML_FONT_FACE_BAD 5 4.63 0.00 5.56 44 XM_H_Trusted_IP 5 4.63 0.00 5.56 45 XM_DKIMWhitelistDomains 4 3.70 0.00 4.44 46 BAYES_20 4 3.70 0.00 4.44 47 TR_XM_SpammyRelay 4 6.48 16.67 4.44 48 XMNumbers 4 3.70 0.00 4.44 49 XM_Multi_Part_URI 4 8.33 27.78 4.44 50 TVD_SPACE_RATIO 4 3.70 0.00 4.44 51 IN_ZIMBRA_NJ_WHITELIST 4 3.70 0.00 4.44 52 RELAYCOUNTRY_CA 4 3.70 0.00 4.44 53 XM_H_Long_From01 4 4.63 5.56 4.44 54 LOC_TINY_FONT_1 4 9.26 33.33 4.44 55 XM_B_SpammyWords3 4 6.48 16.67 4.44 56 HTML_MIME_NO_HTML_TAG 4 6.48 16.67 4.44 57 BAYES_00 3 2.78 0.00 3.33 58 T_REMOTE_IMAGE 3 2.78 0.00 3.33 59 T_TooManySym_05 3 2.78 0.00 3.33 60 MPART_ALT_DIFF 3 3.70 5.56 3.33 61 XM_Evil_Numbers_Gen 3 4.63 11.11 3.33 62 XMSubMetaSx_00 3 3.70 5.56 3.33 63 T_TooManySym_04 3 2.78 0.00 3.33 64 SUBJ_ALL_CAPS 3 3.70 5.56 3.33 65 HTML_IMAGE_RATIO_08 3 2.78 0.00 3.33 66 XM_UncommonTLD01 2 3.70 11.11 2.22 67 XMStrtUSub 2 1.85 0.00 2.22 68 FSL_BULK_SIG 2 3.70 11.11 2.22 69 FVGT_m_MULTI_ODD_EMAIL 2 1.85 0.00 2.22 70 XM_ZohoDesk1 2 1.85 0.00 2.22 71 KHOP_HELO_FCRDNS 2 1.85 0.00 2.22 72 XM_SendGrid 2 2.78 5.56 2.22 73 RCVD_IN_IADB_SENDERID 2 1.85 0.00 2.22 74 MIME_HTML_MOSTLY 2 2.78 5.56 2.22 75 LotsOfNums_01 2 1.85 0.00 2.22 76 TO_MALFORMED 2 1.85 0.00 2.22 77 TR_XM_DK_Unsub 2 6.48 27.78 2.22 78 USER_IN_DEF_DKIM_WL 2 2.78 5.56 2.22 79 RCVD_IN_IADB_LISTED 2 1.85 0.00 2.22 80 MSGID_NOFQDN1 2 1.85 0.00 2.22 81 MIME_CHARSET_FARAWAY 2 1.85 0.00 2.22 82 RCVD_IN_IADB_DK 2 1.85 0.00 2.22 83 XM_ZIP 2 1.85 0.00 2.22 84 CHARSET_FARAWAY_HEADER 2 1.85 0.00 2.22 85 XM_DK_Undo_01 2 3.70 11.11 2.22 86 LOTS_OF_MONEY 2 2.78 5.56 2.22 87 XMSexyCombo_01 2 2.78 5.56 2.22 88 XM_H_SpoofStaff4 2 1.85 0.00 2.22 89 TR_XM_SpoofPhishAttach 2 1.85 0.00 2.22 90 DKIM_INVALID 2 2.78 5.56 2.22 91 TR_XM_SpoofStaff 2 1.85 0.00 2.22 92 TR_XM_PSC1 2 1.85 0.00 2.22 93 TR_XM_DK_SendGrid 2 2.78 5.56 2.22 94 XMSpoofStaff2 2 1.85 0.00 2.22 95 IN_HORDE_ADDRESS_BOOK 2 1.85 0.00 2.22 96 INVALID_MSGID 2 1.85 0.00 2.22 97 RCVD_IN_IADB_SPF 2 1.85 0.00 2.22 98 DEAR_SOMETHING 1 1.85 5.56 1.11 99 MIME_HTML_ONLY_MULTI 1 0.93 0.00 1.11 100 TR_XM_SpammyWords5 1 1.85 5.56 1.11 101 XM_DK_Undo_02 1 6.48 33.33 1.11 102 TR_XM_PhishingBody 1 0.93 0.00 1.11 103 T_STY_INVIS_DIRECT 1 0.93 0.00 1.11 104 TR_XM_DKIM_Undo 1 3.70 16.67 1.11 105 TR_XM_SpammyWords4 1 0.93 0.00 1.11 106 HDRS_MISSP 1 0.93 0.00 1.11 107 BAYES_999 1 7.41 38.89 1.11 108 XM_PDF 1 0.93 0.00 1.11 109 TVD_RCVD_IP 1 0.93 0.00 1.11 110 BAYES_99 1 8.33 44.44 1.11 111 TR_Legit_01 1 0.93 0.00 1.11 112 HTML_IMAGE_ONLY_20 1 0.93 0.00 1.11 113 RCVD_IN_MSPIKE_H5 1 0.93 0.00 1.11 114 TR_Symld_Words 1 0.93 0.00 1.11 115 TR_XM_DK_Bayes2 1 0.93 0.00 1.11 116 FROM_GOV_SPOOF 1 0.93 0.00 1.11 117 RELAYCOUNTRY_HK 1 0.93 0.00 1.11 118 MSGID_FROM_MTA_HEADER 1 0.93 0.00 1.11 119 XM_TLDProd2 1 0.93 0.00 1.11 120 HTML_IMAGE_RATIO_04 1 2.78 11.11 1.11 121 XMHTML_After_End 1 0.93 0.00 1.11 122 XMSubNoVowel 1 1.85 5.56 1.11 123 URI_NOVOWEL 1 1.85 5.56 1.11 124 XMLngstWrd_00 1 1.85 5.56 1.11 125 BAYES_40 1 1.85 5.56 1.11 126 RELAYCOUNTRY_GB 1 0.93 0.00 1.11 127 XM_SPF_SoftFail 1 1.85 5.56 1.11 128 MISSING_HEADERS 1 0.93 0.00 1.11 129 XM_GoogleGroups 1 0.93 0.00 1.11 130 TR_XM_DK_Bayes1 1 0.93 0.00 1.11 131 TM2_M_VERY_LONG_WORD 1 0.93 0.00 1.11 132 RCVD_IN_IADB_VOUCHED 1 0.93 0.00 1.11 133 HTML_EXTRA_CLOSE 1 0.93 0.00 1.11 134 RELAYCOUNTRY_CN 1 1.85 5.56 1.11 135 RCVD_IN_IADB_OPTIN 1 0.93 0.00 1.11 136 XMGappySubj_02 1 0.93 0.00 1.11 137 XMDiploma_00 1 0.93 0.00 1.11 138 XM_B_Phish66 1 0.93 0.00 1.11 139 TR_XM_SpoofStaff3 1 0.93 0.00 1.11 140 HTML_IMAGE_ONLY_24 1 0.93 0.00 1.11 141 TR_Mismatch_TLD_01 1 0.93 0.00 1.11 142 TooManyTo_002 1 0.93 0.00 1.11 143 TR_XM_SpammyWords2 1 1.85 5.56 1.11 144 CTE_8BIT_MISMATCH 1 0.93 0.00 1.11 145 XMSubMetaD_00 1 0.93 0.00 1.11 146 TR_XM_DK_Bayes 1 0.93 0.00 1.11 147 MAILING_LIST_MULTI 1 1.85 5.56 1.11 148 XM_B_SpammyTLD 1 3.70 16.67 1.11 149 BOTNET_IPINHOSTNAME 1 3.70 16.67 1.11 150 XM_B_Phish_Phrases 1 0.93 0.00 1.11 151 XM_B_Unsub2 1 0.93 0.00 1.11 152 HTML_IMAGE_ONLY_08 1 0.93 0.00 1.11 153 XM_CamelCaseFrm001 1 0.93 0.00 1.11 154 XMSubject_78 1 0.93 0.00 1.11 ----------------------------------------------------------------------