Email: 91 Autolearn: 0 AvgScore: 4.69 AvgScanTime: 3.50 sec Spam: 23 Autolearn: 0 AvgScore: 13.52 AvgScanTime: 3.35 sec Ham: 68 Autolearn: 0 AvgScore: 1.71 AvgScanTime: 3.55 sec Time Spent Running SA: 0.09 hours Time Spent Processing Spam: 0.02 hours Time Spent Processing Ham: 0.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 21 68.13 91.30 60.29 2 RELAYCOUNTRY_US 17 70.33 73.91 69.12 3 DCC_CHECK_NEGATIVE 16 82.42 69.57 86.76 4 DKIM_VALID 16 59.34 69.57 55.88 5 DKIM_SIGNED 16 62.64 69.57 60.29 6 XM_DK_Pass 16 60.44 69.57 57.35 7 XM_B_SpammyWords 15 51.65 65.22 47.06 8 XM_B_Unicode 13 53.85 56.52 52.94 9 DKIM_VALID_AU 11 45.05 47.83 44.12 10 DKIM_VALID_EF 10 34.07 43.48 30.88 11 XMListUnsubscribeExists 10 39.56 43.48 38.24 12 XM_B_Unicode3 10 28.57 43.48 23.53 13 HTML_FONT_LOW_CONTRAST 8 28.57 34.78 26.47 14 XM_Body_Dirty_Words 8 17.58 34.78 11.76 15 FVGT_m_MULTI_ODD 8 27.47 34.78 25.00 16 MIME_HTML_ONLY 7 16.48 30.43 11.76 17 DCC_CHECK 7 17.58 30.43 13.24 18 RELAYCOUNTRY_META 6 7.69 26.09 1.47 19 KHOP_HELO_FCRDNS 6 7.69 26.09 1.47 20 XMSubLong 6 28.57 26.09 29.41 21 T_TM2_M_HEADER_IN_MSG 6 21.98 26.09 20.59 22 BAYES_50 6 47.25 26.09 54.41 23 XM_B_SpammyWords2 6 17.58 26.09 14.71 24 XM_DK_Undo_02 6 10.99 26.09 5.88 25 XM_B_Unsub 5 13.19 21.74 10.29 26 TR_XM_DKIM_Undo 5 8.79 21.74 4.41 27 TR_XM_DK_Unsub 5 18.68 21.74 17.65 28 XM_Multi_Part_URI 5 17.58 21.74 16.18 29 BOTNET 5 8.79 21.74 4.41 30 BOTNET_IPINHOSTNAME 5 9.89 21.74 5.88 31 BAYES_999 5 6.59 21.74 1.47 32 TR_XM_BayesUnsub 5 12.09 21.74 8.82 33 T_KAM_HTML_FONT_INVALID 5 15.38 21.74 13.24 34 RCVD_IN_MSPIKE_H2 5 12.09 21.74 8.82 35 UNPARSEABLE_RELAY 5 12.09 21.74 8.82 36 HTML_MIME_NO_HTML_TAG 5 7.69 21.74 2.94 37 BAYES_99 5 7.69 21.74 2.94 38 PDS_RDNS_DYNAMIC_FP 5 5.49 21.74 0.00 39 RDNS_DYNAMIC 5 5.49 21.74 0.00 40 TR_XM_UnparsRelay 4 5.49 17.39 1.47 41 TR_XM_SpammyWords5 4 4.40 17.39 0.00 42 XM_SPF_SoftFail 4 5.49 17.39 1.47 43 BAYES_40 4 7.69 17.39 4.41 44 TR_Symld_Words 4 7.69 17.39 4.41 45 XMNumbers 4 10.99 17.39 8.82 46 XM_PDF 4 7.69 17.39 4.41 47 TVD_RCVD_IP 4 4.40 17.39 0.00 48 T_OBFU_PDF_ATTACH 4 4.40 17.39 0.00 49 T_XMDrugObfuBody_14 4 6.59 17.39 2.94 50 TM2_M_VERY_LONG_WORD 4 6.59 17.39 2.94 51 LOC_TINY_FONT_1 4 18.68 17.39 19.12 52 BAYES_80 3 4.40 13.04 1.47 53 TR_XM_SpammyWords4 3 6.59 13.04 4.41 54 TR_XM_PhishingBody 3 4.40 13.04 1.47 55 UNTRUSTED_Relay 3 4.40 13.04 1.47 56 BAYES_60 3 16.48 13.04 17.65 57 XMSlimDrugH 3 3.30 13.04 0.00 58 XM_DIRTYINTL 3 3.30 13.04 0.00 59 T_XMHurry_00 3 3.30 13.04 0.00 60 TR_DCC_Bayes_99 3 4.40 13.04 1.47 61 LOTS_OF_MONEY 3 6.59 13.04 4.41 62 XMSexyCombo_05 3 3.30 13.04 0.00 63 RCVD_IN_MSPIKE_H3 3 12.09 13.04 11.76 64 RCVD_IN_MSPIKE_WL 3 16.48 13.04 17.65 65 XM_Evil_Numbers_Gen 2 7.69 8.70 7.35 66 XMWhlSbjSex 2 2.20 8.70 0.00 67 TR_XM_SpammyRelay 2 2.20 8.70 0.00 68 RELAYCOUNTRY_BG 2 2.20 8.70 0.00 69 XMSubMetaSx_00 2 3.30 8.70 1.47 70 TR_XM_NoHeaderRelay 2 2.20 8.70 0.00 71 XM_B_Phish66 2 3.30 8.70 1.47 72 BAYES_95 2 5.49 8.70 4.41 73 XM_B_SpammyWords3 2 2.20 8.70 0.00 74 XM_B_SpammyTLD 2 6.59 8.70 5.88 75 TR_XM_COVIDMETA1 2 2.20 8.70 0.00 76 HTML_IMAGE_RATIO_02 2 9.89 8.70 10.29 77 XMMoneyMeta_00 2 3.30 8.70 1.47 78 TR_XM_SpammyWords2 1 1.10 4.35 0.00 79 XM_SendGrid 1 1.10 4.35 0.00 80 XM_UB999 1 1.10 4.35 0.00 81 XMLngstWrd_00 1 2.20 4.35 1.47 82 RCVD_IN_BL_SPAMCOP_NET 1 1.10 4.35 0.00 83 XM_Body_Obfu01 1 1.10 4.35 0.00 84 TR_XM_FormFill2 1 1.10 4.35 0.00 85 XM_UB60 1 1.10 4.35 0.00 86 XM_UB99 1 1.10 4.35 0.00 87 XM_B_Investor 1 1.10 4.35 0.00 88 HTML_IMAGE_RATIO_08 1 2.20 4.35 1.47 89 ANY_BOUNCE_MESSAGE 1 3.30 4.35 2.94 90 MIME_HEADER_CTYPE_ONLY 1 1.10 4.35 0.00 91 ALL_TRUSTED 1 23.08 4.35 29.41 92 XMPhish08 1 1.10 4.35 0.00 93 SpammyFromTLD_02 1 2.20 4.35 1.47 94 XMStockSpam_06 1 1.10 4.35 0.00 95 RELAYCOUNTRY_VN 1 1.10 4.35 0.00 96 NOT_SPAM 1 1.10 4.35 0.00 97 XM_GoogleGroups 1 1.10 4.35 0.00 98 RELAYCOUNTRY_CA 1 1.10 4.35 0.00 99 MPART_ALT_DIFF_COUNT 1 3.30 4.35 2.94 100 MIME_QP_LONG_LINE 1 2.20 4.35 1.47 101 XMBounce_01 1 1.10 4.35 0.00 102 TR_XM_PHPForged 1 1.10 4.35 0.00 103 OBFU_TEXT_ATTACH 1 1.10 4.35 0.00 104 XM_H_PHPOS 1 1.10 4.35 0.00 105 TR_XM_DK_SendGrid 1 1.10 4.35 0.00 106 BOUNCE_MESSAGE 1 3.30 4.35 2.94 107 RELAYCOUNTRY_AU 1 1.10 4.35 0.00 108 MIME_HTML_MOSTLY 1 5.49 4.35 5.88 109 TR_XM_BayesRelay 1 1.10 4.35 0.00 110 RELAYCOUNTRY_RO 1 1.10 4.35 0.00 111 TooManyTo_001 1 7.69 4.35 8.82 112 XMLngstWrd_02 1 1.10 4.35 0.00 113 XM_UB95 1 1.10 4.35 0.00 114 XMLngstWrd_03 1 1.10 4.35 0.00 115 MIME_HTML_ONLY_MULTI 1 1.10 4.35 0.00 116 TR_XM_PHPDW 1 2.20 4.35 1.47 117 TooManyTo_004 1 2.20 4.35 1.47 118 UPPERCASE_75_100 1 1.10 4.35 0.00 119 TR_Mismatch_TLD_01 1 2.20 4.35 1.47 120 MISSING_HEADERS 1 1.10 4.35 0.00 121 XM_B_SexDrugs1 1 1.10 4.35 0.00 122 XM_UncommonTLD01 1 9.89 4.35 11.76 123 RCVD_IN_PSBL 1 1.10 4.35 0.00 124 XMSubMetaSSx_00 1 1.10 4.35 0.00 125 TooManyTo_003 1 4.40 4.35 4.41 126 TooManyTo_002 1 4.40 4.35 4.41 127 XM_Body_Dirty_Words_02 1 1.10 4.35 0.00 128 XMLngstWrd_01 1 1.10 4.35 0.00 129 XMSexyCombo_01 1 1.10 4.35 0.00 130 HTML_TITLE_SUBJ_DIFF 1 1.10 4.35 0.00 131 RELAYCOUNTRY_SG 1 1.10 4.35 0.00 132 HTML_IMAGE_ONLY_20 1 2.20 4.35 1.47 133 XM_Body_Dirty_Words_01 1 3.30 4.35 2.94 134 REPLYTO_WITHOUT_TO_CC 1 1.10 4.35 0.00 135 XMLngstWrd_04 1 1.10 4.35 0.00 136 MPART_ALT_DIFF 1 1.10 4.35 0.00 137 XMStrtUSub 1 4.40 4.35 4.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 59 82.42 69.57 86.76 2 RELAYCOUNTRY_US 47 70.33 73.91 69.12 3 HTML_MESSAGE 41 68.13 91.30 60.29 4 DKIM_SIGNED 41 62.64 69.57 60.29 5 XM_DK_Pass 39 60.44 69.57 57.35 6 DKIM_VALID 38 59.34 69.57 55.88 7 BAYES_50 37 47.25 26.09 54.41 8 XM_B_Unicode 36 53.85 56.52 52.94 9 XM_B_SpammyWords 32 51.65 65.22 47.06 10 DKIM_VALID_AU 30 45.05 47.83 44.12 11 XMListUnsubscribeExists 26 39.56 43.48 38.24 12 DKIM_VALID_EF 21 34.07 43.48 30.88 13 XMSubLong 20 28.57 26.09 29.41 14 ALL_TRUSTED 20 23.08 4.35 29.41 15 HTML_FONT_LOW_CONTRAST 18 28.57 34.78 26.47 16 FVGT_m_MULTI_ODD 17 27.47 34.78 25.00 17 XM_B_Unicode3 16 28.57 43.48 23.53 18 T_TM2_M_HEADER_IN_MSG 14 21.98 26.09 20.59 19 LOC_TINY_FONT_1 13 18.68 17.39 19.12 20 RCVD_IN_MSPIKE_WL 12 16.48 13.04 17.65 21 BAYES_60 12 16.48 13.04 17.65 22 TR_XM_DK_Unsub 12 18.68 21.74 17.65 23 XM_Multi_Part_URI 11 17.58 21.74 16.18 24 T_TooManySym_01 11 12.09 0.00 16.18 25 T_TooManySym_02 10 10.99 0.00 14.71 26 XM_B_SpammyWords2 10 17.58 26.09 14.71 27 T_KAM_HTML_FONT_INVALID 9 15.38 21.74 13.24 28 DCC_CHECK 9 17.58 30.43 13.24 29 RCVD_IN_MSPIKE_H3 8 12.09 13.04 11.76 30 XM_UncommonTLD01 8 9.89 4.35 11.76 31 BAYES_00 8 8.79 0.00 11.76 32 MIME_HTML_ONLY 8 16.48 30.43 11.76 33 XM_Body_Dirty_Words 8 17.58 34.78 11.76 34 XM_H_PHPMailer 7 7.69 0.00 10.29 35 HTML_IMAGE_RATIO_02 7 9.89 8.70 10.29 36 XM_B_Unsub 7 13.19 21.74 10.29 37 INVALID_MSGID 6 6.59 0.00 8.82 38 XM_H_Long_From01 6 6.59 0.00 8.82 39 RCVD_IN_MSPIKE_H2 6 12.09 21.74 8.82 40 TR_XM_DK_Bayes 6 6.59 0.00 8.82 41 TooManyTo_001 6 7.69 4.35 8.82 42 TR_XM_DK_Bayes1 6 6.59 0.00 8.82 43 UNPARSEABLE_RELAY 6 12.09 21.74 8.82 44 XMNumbers 6 10.99 17.39 8.82 45 SHORT_SHORTNER 6 6.59 0.00 8.82 46 TR_XM_BayesUnsub 6 12.09 21.74 8.82 47 TR_XM_DK_Bayes2 6 6.59 0.00 8.82 48 SHORT_URI_2 6 6.59 0.00 8.82 49 HTML_IMAGE_RATIO_04 5 5.49 0.00 7.35 50 MSGID_NOFQDN1 5 5.49 0.00 7.35 51 XM_Evil_Numbers_Gen 5 7.69 8.70 7.35 52 TO_MALFORMED 5 5.49 0.00 7.35 53 XM_B_SpammyTLD 4 6.59 8.70 5.88 54 XM_DK_Undo_02 4 10.99 26.09 5.88 55 XM_CamelCaseFrm001 4 4.40 0.00 5.88 56 MIME_HTML_MOSTLY 4 5.49 4.35 5.88 57 BOTNET_IPINHOSTNAME 4 9.89 21.74 5.88 58 FROM_OFFERS 3 3.30 0.00 4.41 59 LOTS_OF_MONEY 3 6.59 13.04 4.41 60 XM_DKIMWhitelistDomains 3 3.30 0.00 4.41 61 XMStrtUSub 3 4.40 4.35 4.41 62 TooManyTo_002 3 4.40 4.35 4.41 63 IN_ZIMBRA_NJ_WHITELIST 3 3.30 0.00 4.41 64 TooManyTo_003 3 4.40 4.35 4.41 65 TVD_SPACE_RATIO 3 3.30 0.00 4.41 66 SUBJ_BUY 3 3.30 0.00 4.41 67 DKIM_INVALID 3 3.30 0.00 4.41 68 RCVD_IN_MSPIKE_H5 3 3.30 0.00 4.41 69 LotsOfNums_01 3 3.30 0.00 4.41 70 TR_XM_DKIM_Undo 3 8.79 21.74 4.41 71 TR_XM_SpammyWords4 3 6.59 13.04 4.41 72 TM2_M_URI_OPT_OUT 3 3.30 0.00 4.41 73 XM_PDF 3 7.69 17.39 4.41 74 BAYES_95 3 5.49 8.70 4.41 75 USER_IN_DEF_DKIM_WL 3 3.30 0.00 4.41 76 T_FILL_THIS_FORM_SHORT 3 3.30 0.00 4.41 77 T_TooManySym_03 3 3.30 0.00 4.41 78 BAYES_40 3 7.69 17.39 4.41 79 XM_B_Crypto 3 3.30 0.00 4.41 80 TR_Symld_Words 3 7.69 17.39 4.41 81 BOTNET 3 8.79 21.74 4.41 82 T_XMDrugObfuBody_14 2 6.59 17.39 2.94 83 HTML_IMAGE_RATIO_06 2 2.20 0.00 2.94 84 TM2_M_VERY_LONG_WORD 2 6.59 17.39 2.94 85 XMGappySubj_01 2 2.20 0.00 2.94 86 BAYES_99 2 7.69 21.74 2.94 87 XM_Body_Dirty_Words_01 2 3.30 4.35 2.94 88 HTML_MIME_NO_HTML_TAG 2 7.69 21.74 2.94 89 ANY_BOUNCE_MESSAGE 2 3.30 4.35 2.94 90 XM_B_Phish_Phrases 2 2.20 0.00 2.94 91 HTTPS_HTTP_MISMATCH 2 2.20 0.00 2.94 92 T_XMDrugObfuBody_08 2 2.20 0.00 2.94 93 FSL_BULK_SIG 2 2.20 0.00 2.94 94 BOUNCE_MESSAGE 2 3.30 4.35 2.94 95 XMSubject_78 2 2.20 0.00 2.94 96 MPART_ALT_DIFF_COUNT 2 3.30 4.35 2.94 97 FVGT_m_MULTI_ODD_EMAIL 2 2.20 0.00 2.94 98 TR_Mismatch_TLD_01 1 2.20 4.35 1.47 99 TooManyTo_004 1 2.20 4.35 1.47 100 NO_DNS_FOR_FROM 1 1.10 0.00 1.47 101 XM_DK_Undo_01 1 1.10 0.00 1.47 102 T_TooManySym_04 1 1.10 0.00 1.47 103 RCVD_IN_IADB_LISTED 1 1.10 0.00 1.47 104 XM_H_Long_From02 1 1.10 0.00 1.47 105 TR_DCC_Bayes_99 1 4.40 13.04 1.47 106 HTML_SHORT_LINK_IMG_3 1 1.10 0.00 1.47 107 TR_Mismatch_TLD_02 1 1.10 0.00 1.47 108 TR_XM_PHPDW 1 2.20 4.35 1.47 109 RCVD_IN_IADB_VOUCHED 1 1.10 0.00 1.47 110 GMD_PDF_HORIZ 1 1.10 0.00 1.47 111 KHOP_HELO_FCRDNS 1 7.69 26.09 1.47 112 HTML_IMAGE_ONLY_32 1 1.10 0.00 1.47 113 RCVD_IN_MSPIKE_H4 1 1.10 0.00 1.47 114 DATE_IN_PAST_06_12 1 1.10 0.00 1.47 115 RCVD_IN_VALIDITY_RPBL 1 1.10 0.00 1.47 116 XM_UB50 1 1.10 0.00 1.47 117 XM_TLDProd2 1 1.10 0.00 1.47 118 HTML_IMAGE_ONLY_20 1 2.20 4.35 1.47 119 TooManyTo_005 1 1.10 0.00 1.47 120 XMMoneyMeta_00 1 3.30 8.70 1.47 121 RCVD_IN_IADB_SENDERID 1 1.10 0.00 1.47 122 MAILING_LIST_MULTI 1 1.10 0.00 1.47 123 XMSubMetaSxObfu_03 1 1.10 0.00 1.47 124 XMBody_95 1 1.10 0.00 1.47 125 RCVD_IN_IADB_OPTIN 1 1.10 0.00 1.47 126 RCVD_IN_IADB_DK 1 1.10 0.00 1.47 127 XM_B_DNDMA 1 1.10 0.00 1.47 128 XMSubNoVowel 1 1.10 0.00 1.47 129 UNTRUSTED_Relay 1 4.40 13.04 1.47 130 SpammyFromTLD_02 1 2.20 4.35 1.47 131 RELAYCOUNTRY_META 1 7.69 26.09 1.47 132 FROM_GOV_SPOOF 1 1.10 0.00 1.47 133 HTML_IMAGE_RATIO_08 1 2.20 4.35 1.47 134 SpammyFromTLD_01 1 1.10 0.00 1.47 135 RCVD_IN_IADB_SPF 1 1.10 0.00 1.47 136 TR_XM_PhishingBody 1 4.40 13.04 1.47 137 XM_SPF_SoftFail 1 5.49 17.39 1.47 138 TR_XM_UnparsRelay 1 5.49 17.39 1.47 139 BAYES_20 1 1.10 0.00 1.47 140 FROM_GOV_DKIM_AU 1 1.10 0.00 1.47 141 TR_MSPIKEBAYES00 1 1.10 0.00 1.47 142 XMLngstWrd_00 1 2.20 4.35 1.47 143 BAYES_05 1 1.10 0.00 1.47 144 BAYES_80 1 4.40 13.04 1.47 145 XM_B_Phish66 1 3.30 8.70 1.47 146 URI_HEX 1 1.10 0.00 1.47 147 TO_EQ_FM_DOM_HTML_ONLY 1 1.10 0.00 1.47 148 PLING_QUERY 1 1.10 0.00 1.47 149 XMNoVowels 1 1.10 0.00 1.47 150 BAYES_999 1 6.59 21.74 1.47 151 FROM_EXCESS_BASE64 1 1.10 0.00 1.47 152 TR_BOTNET_NEGATE 1 1.10 0.00 1.47 153 RELAYCOUNTRY_NL 1 1.10 0.00 1.47 154 XMSubMetaSx_00 1 3.30 8.70 1.47 155 MIME_QP_LONG_LINE 1 2.20 4.35 1.47 ----------------------------------------------------------------------