Email: 121 Autolearn: 0 AvgScore: -1.14 AvgScanTime: 4.02 sec Spam: 18 Autolearn: 0 AvgScore: 13.22 AvgScanTime: 3.82 sec Ham: 103 Autolearn: 0 AvgScore: -3.65 AvgScanTime: 4.05 sec Time Spent Running SA: 0.14 hours Time Spent Processing Spam: 0.02 hours Time Spent Processing Ham: 0.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 17 52.89 94.44 45.63 2 T_SCC_BODY_TEXT_LINE 15 82.64 83.33 82.52 3 RELAYCOUNTRY_US 14 54.55 77.78 50.49 4 XM_B_Unicode 14 50.41 77.78 45.63 5 DCC_CHECK_NEGATIVE 13 67.77 72.22 66.99 6 XM_DK_Pass 12 47.93 66.67 44.66 7 DKIM_SIGNED 12 51.24 66.67 48.54 8 DKIM_VALID 11 46.28 61.11 43.69 9 BAYES_50 10 48.76 55.56 47.57 10 XM_B_SpammyWords 8 27.27 44.44 24.27 11 DKIM_VALID_AU 8 36.36 44.44 34.95 12 T_KAM_HTML_FONT_INVALID 7 20.66 38.89 17.48 13 XMListUnsubscribeExists 7 32.23 38.89 31.07 14 XM_B_Unicode3 7 29.75 38.89 28.16 15 RCVD_IN_MSPIKE_H2 6 21.49 33.33 19.42 16 RELAYCOUNTRY_META 6 6.61 33.33 1.94 17 XM_B_Unsub 5 8.26 27.78 4.85 18 XMSubLong 5 17.36 27.78 15.53 19 MIME_HTML_ONLY 5 10.74 27.78 7.77 20 XM_Body_Dirty_Words 5 9.92 27.78 6.80 21 BAYES_99 5 4.96 27.78 0.97 22 DCC_CHECK 5 32.23 27.78 33.01 23 XM_B_SpammyWords2 5 9.09 27.78 5.83 24 XM_Multi_Part_URI 5 27.27 27.78 27.18 25 DKIM_VALID_EF 4 27.27 22.22 28.16 26 LOC_TINY_FONT_1 4 19.01 22.22 18.45 27 TR_XM_DKIM_Undo 4 4.13 22.22 0.97 28 UNTRUSTED_Relay 4 4.13 22.22 0.97 29 UNPARSEABLE_RELAY 4 18.18 22.22 17.48 30 XM_DK_Undo_02 4 5.79 22.22 2.91 31 TR_XM_BayesUnsub 4 6.61 22.22 3.88 32 BAYES_999 4 4.13 22.22 0.97 33 RCVD_IN_MSPIKE_WL 3 9.92 16.67 8.74 34 TR_XM_PhishingBody 3 5.79 16.67 3.88 35 TooManyTo_001 3 6.61 16.67 4.85 36 BOTNET 3 3.31 16.67 0.97 37 XM_UncommonTLD01 3 11.57 16.67 10.68 38 RCVD_IN_MSPIKE_H5 3 7.44 16.67 5.83 39 FVGT_m_MULTI_ODD 3 19.01 16.67 19.42 40 HTML_FONT_LOW_CONTRAST 3 20.66 16.67 21.36 41 XM_B_SpammyWords3 3 2.48 16.67 0.00 42 RCVD_IN_VALIDITY_RPBL 2 1.65 11.11 0.00 43 XMSubMetaSx_00 2 13.22 11.11 13.59 44 XM_Evil_Numbers_Gen 2 2.48 11.11 0.97 45 TooManyTo_004 2 1.65 11.11 0.00 46 T_XMHurry_00 2 2.48 11.11 0.97 47 TM2_M_VERY_LONG_WORD 2 4.13 11.11 2.91 48 RCVD_IN_PSBL 2 1.65 11.11 0.00 49 T_TooManySym_02 2 6.61 11.11 5.83 50 XMCapTrack 2 1.65 11.11 0.00 51 T_TooManySym_01 2 6.61 11.11 5.83 52 TooManyTo_002 2 3.31 11.11 1.94 53 TR_XM_DK_SendGrid 2 9.09 11.11 8.74 54 XM_B_SpammyTLD 2 4.13 11.11 2.91 55 BOUNCE_MESSAGE 2 25.62 11.11 28.16 56 XM_DIRTYINTL 2 2.48 11.11 0.97 57 XMBounce_01 2 1.65 11.11 0.00 58 TR_XM_SB_Phish 2 3.31 11.11 1.94 59 BOTNET_NORDNS 2 1.65 11.11 0.00 60 XM_SendGrid 2 10.74 11.11 10.68 61 XMSubPhish11 2 3.31 11.11 1.94 62 XM_Body_Dirty_Words_01 2 1.65 11.11 0.00 63 TooManyTo_003 2 3.31 11.11 1.94 64 XM_UB50 2 1.65 11.11 0.00 65 BAYES_60 2 9.09 11.11 8.74 66 T_XMDrugObfuBody_00 2 1.65 11.11 0.00 67 ANY_BOUNCE_MESSAGE 2 25.62 11.11 28.16 68 HTML_FONT_TINY_NORDNS 2 1.65 11.11 0.00 69 XMSexyCombo_01 2 4.13 11.11 2.91 70 XMPhish11 2 1.65 11.11 0.00 71 XMStockSpam_06 2 1.65 11.11 0.00 72 TR_XM_SpammyWords2 2 1.65 11.11 0.00 73 PDS_RDNS_DYNAMIC_FP 1 0.83 5.56 0.00 74 LONG_JUNK_URI2 1 0.83 5.56 0.00 75 TO_EQ_FM_DOM_HTML_ONLY 1 0.83 5.56 0.00 76 TR_XM_FormFill 1 0.83 5.56 0.00 77 SORTED_RECIPS 1 0.83 5.56 0.00 78 TR_XM_MaxWHORU 1 0.83 5.56 0.00 79 NO_DNS_FOR_FROM 1 0.83 5.56 0.00 80 TR_Symld_Words 1 4.13 5.56 3.88 81 DATE_IN_PAST_03_06 1 0.83 5.56 0.00 82 RELAYCOUNTRY_CA 1 0.83 5.56 0.00 83 RCVD_IN_IADB_DK 1 0.83 5.56 0.00 84 LotsOfNums_01 1 5.79 5.56 5.83 85 TM2_M_OBFU_COMMENT 1 0.83 5.56 0.00 86 RCVD_IN_IADB_SPF 1 0.83 5.56 0.00 87 SpammyFromTLD_02 1 4.13 5.56 3.88 88 MIME_QP_LONG_LINE 1 4.96 5.56 4.85 89 RELAYCOUNTRY_VN 1 0.83 5.56 0.00 90 OBFU_TEXT_ATTACH 1 0.83 5.56 0.00 91 TR_DCC_Bayes_99 1 1.65 5.56 0.97 92 SpammyFromTLD_01 1 1.65 5.56 0.97 93 XM_UB60 1 0.83 5.56 0.00 94 XMLngstWrd_01 1 0.83 5.56 0.00 95 BAYES_40 1 7.44 5.56 7.77 96 RELAYCOUNTRY_BR 1 0.83 5.56 0.00 97 URIBL_DBL_SPAM 1 0.83 5.56 0.00 98 MPART_ALT_DIFF_COUNT 1 0.83 5.56 0.00 99 XMLngstWrd_00 1 1.65 5.56 0.97 100 XMClaimOffer 1 0.83 5.56 0.00 101 LONG_JUNK_URI 1 0.83 5.56 0.00 102 XM_UB999 1 0.83 5.56 0.00 103 HTML_MIME_NO_HTML_TAG 1 2.48 5.56 1.94 104 XMStrtUSub 1 0.83 5.56 0.00 105 XM_B_Investor 1 1.65 5.56 0.97 106 TO_NO_BRKTS_DYNIP 1 0.83 5.56 0.00 107 RELAYCOUNTRY_JP 1 0.83 5.56 0.00 108 XM_UB99 1 0.83 5.56 0.00 109 TR_XM_SpammyRelay 1 2.48 5.56 1.94 110 TR_XM_NoHeaderRelay 1 0.83 5.56 0.00 111 HTML_IMAGE_RATIO_02 1 3.31 5.56 2.91 112 TR_Mismatch_TLD_02 1 1.65 5.56 0.97 113 HTML_IMAGE_ONLY_04 1 0.83 5.56 0.00 114 XM_CamelCaseFrm001 1 0.83 5.56 0.00 115 XMSexyCombo_02 1 0.83 5.56 0.00 116 XMSubGarbage 1 0.83 5.56 0.00 117 RCVD_IN_IADB_SENDERID 1 0.83 5.56 0.00 118 TR_XM_MSPIKECOMBO 1 0.83 5.56 0.00 119 T_REMOTE_IMAGE 1 2.48 5.56 1.94 120 RELAYCOUNTRY_FI 1 0.83 5.56 0.00 121 XM_B_Unsub2 1 1.65 5.56 0.97 122 RELAYCOUNTRY_TW 1 0.83 5.56 0.00 123 FROM_GOV_SPOOF 1 0.83 5.56 0.00 124 HDRS_MISSP 1 0.83 5.56 0.00 125 NORDNS_LOW_CONTRAST 1 0.83 5.56 0.00 126 MISSING_MIME_HB_SEP 1 0.83 5.56 0.00 127 HTML_IMAGE_RATIO_06 1 3.31 5.56 2.91 128 DKIM_INVALID 1 4.96 5.56 4.85 129 XMMailDelErr 1 0.83 5.56 0.00 130 KHOP_HELO_FCRDNS 1 4.96 5.56 4.85 131 XMNumbers 1 3.31 5.56 2.91 132 XMPhish08 1 0.83 5.56 0.00 133 RCVD_IN_MSPIKE_L5 1 0.83 5.56 0.00 134 TR_XM_DK_Unsub 1 18.18 5.56 20.39 135 HELO_NODOT 1 0.83 5.56 0.00 136 RCVD_IN_MSPIKE_BL 1 0.83 5.56 0.00 137 MSGID_FROM_MTA_HEADER 1 0.83 5.56 0.00 138 XMSubNoVowel 1 0.83 5.56 0.00 139 RELAYCOUNTRY_CN 1 0.83 5.56 0.00 140 RDNS_DYNAMIC 1 0.83 5.56 0.00 141 HELO_LOCALHOST 1 0.83 5.56 0.00 142 TO_MALFORMED 1 5.79 5.56 5.83 143 RCVD_IN_IADB_LISTED 1 0.83 5.56 0.00 144 T_FILL_THIS_FORM_SHORT 1 0.83 5.56 0.00 145 NOT_SPAM 1 0.83 5.56 0.00 146 TR_XM_INV_DKIM 1 0.83 5.56 0.00 147 TooManyTo_005 1 0.83 5.56 0.00 148 BOTNET_IPINHOSTNAME 1 1.65 5.56 0.97 149 TR_XM_UnparsRelay 1 2.48 5.56 1.94 150 MAILING_LIST_MULTI 1 1.65 5.56 0.97 151 FSL_HELO_NON_FQDN_1 1 0.83 5.56 0.00 152 HTML_TAG_BALANCE_BODY 1 0.83 5.56 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 85 82.64 83.33 82.52 2 DCC_CHECK_NEGATIVE 69 67.77 72.22 66.99 3 RELAYCOUNTRY_US 52 54.55 77.78 50.49 4 DKIM_SIGNED 50 51.24 66.67 48.54 5 BAYES_50 49 48.76 55.56 47.57 6 ALL_TRUSTED 48 39.67 0.00 46.60 7 XM_B_Unicode 47 50.41 77.78 45.63 8 HTML_MESSAGE 47 52.89 94.44 45.63 9 XM_DK_Pass 46 47.93 66.67 44.66 10 DKIM_VALID 45 46.28 61.11 43.69 11 DKIM_VALID_AU 36 36.36 44.44 34.95 12 DCC_CHECK 34 32.23 27.78 33.01 13 XMListUnsubscribeExists 32 32.23 38.89 31.07 14 DKIM_VALID_EF 29 27.27 22.22 28.16 15 BOUNCE_MESSAGE 29 25.62 11.11 28.16 16 ANY_BOUNCE_MESSAGE 29 25.62 11.11 28.16 17 XM_B_Unicode3 29 29.75 38.89 28.16 18 XM_Multi_Part_URI 28 27.27 27.78 27.18 19 XM_B_SpammyWords 25 27.27 44.44 24.27 20 TM2_M_URI_OPT_OUT 24 19.83 0.00 23.30 21 HTML_FONT_LOW_CONTRAST 22 20.66 16.67 21.36 22 TR_XM_DK_Unsub 21 18.18 5.56 20.39 23 T_TM2_M_HEADER_IN_MSG 21 17.36 0.00 20.39 24 FVGT_m_MULTI_ODD 20 19.01 16.67 19.42 25 RCVD_IN_MSPIKE_H2 20 21.49 33.33 19.42 26 FSL_BULK_SIG 19 15.70 0.00 18.45 27 LOC_TINY_FONT_1 19 19.01 22.22 18.45 28 T_KAM_HTML_FONT_INVALID 18 20.66 38.89 17.48 29 UNPARSEABLE_RELAY 18 18.18 22.22 17.48 30 XMSubLong 16 17.36 27.78 15.53 31 XMSubMetaSx_00 14 13.22 11.11 13.59 32 BAYES_05 14 11.57 0.00 13.59 33 XM_UncommonTLD01 11 11.57 16.67 10.68 34 XM_SendGrid 11 10.74 11.11 10.68 35 RCVD_IN_MSPIKE_WL 9 9.92 16.67 8.74 36 BAYES_00 9 7.44 0.00 8.74 37 TR_XM_DK_SendGrid 9 9.09 11.11 8.74 38 BAYES_60 9 9.09 11.11 8.74 39 XM_H_PHPMailer 9 7.44 0.00 8.74 40 SCC_BODY_URI_ONLY 8 6.61 0.00 7.77 41 BAYES_20 8 6.61 0.00 7.77 42 BAYES_40 8 7.44 5.56 7.77 43 MIME_HTML_ONLY 8 10.74 27.78 7.77 44 IN_ZIMBRA_NJ_WHITELIST 8 6.61 0.00 7.77 45 SHORT_SHORTNER 8 6.61 0.00 7.77 46 MSGID_NOFQDN1 7 5.79 0.00 6.80 47 XM_Body_Dirty_Words 7 9.92 27.78 6.80 48 INVALID_MSGID 7 5.79 0.00 6.80 49 LotsOfNums_01 6 5.79 5.56 5.83 50 T_TooManySym_02 6 6.61 11.11 5.83 51 T_TooManySym_01 6 6.61 11.11 5.83 52 XM_SPF_SoftFail 6 4.96 0.00 5.83 53 RCVD_IN_MSPIKE_H5 6 7.44 16.67 5.83 54 XM_B_SpammyWords2 6 9.09 27.78 5.83 55 TO_MALFORMED 6 5.79 5.56 5.83 56 TooManyTo_001 5 6.61 16.67 4.85 57 TVD_RCVD_IP 5 4.13 0.00 4.85 58 MIME_QP_LONG_LINE 5 4.96 5.56 4.85 59 XM_shorewaves_Whitelist 5 4.13 0.00 4.85 60 XM_B_Unsub 5 8.26 27.78 4.85 61 KHOP_HELO_FCRDNS 5 4.96 5.56 4.85 62 DKIM_INVALID 5 4.96 5.56 4.85 63 SpammyFromTLD_02 4 4.13 5.56 3.88 64 TR_XM_PhishingBody 4 5.79 16.67 3.88 65 TR_Symld_Words 4 4.13 5.56 3.88 66 TR_XM_SpammyWords4 4 3.31 0.00 3.88 67 LOTS_OF_MONEY 4 3.31 0.00 3.88 68 TR_XM_DK_Bayes 4 3.31 0.00 3.88 69 USER_IN_DEF_DKIM_WL 4 3.31 0.00 3.88 70 HTML_IMAGE_RATIO_04 4 3.31 0.00 3.88 71 TR_XM_DK_Bayes2 4 3.31 0.00 3.88 72 TR_XM_DK_Bayes1 4 3.31 0.00 3.88 73 TR_XM_BayesUnsub 4 6.61 22.22 3.88 74 BAYES_80 3 2.48 0.00 2.91 75 TM2_M_VERY_LONG_WORD 3 4.13 11.11 2.91 76 XM_B_SpammyTLD 3 4.13 11.11 2.91 77 HTML_IMAGE_RATIO_02 3 3.31 5.56 2.91 78 XMBody_17 3 2.48 0.00 2.91 79 XMNumbers 3 3.31 5.56 2.91 80 HTML_IMAGE_RATIO_06 3 3.31 5.56 2.91 81 XMSexyCombo_01 3 4.13 11.11 2.91 82 TVD_SPACE_RATIO 3 2.48 0.00 2.91 83 XM_DK_Undo_02 3 5.79 22.22 2.91 84 TR_XMSubLong 2 1.65 0.00 1.94 85 INVESTMENT_ADVICE 2 1.65 0.00 1.94 86 XMPhish30 2 1.65 0.00 1.94 87 TR_XM_SpoofPhishAttach 2 1.65 0.00 1.94 88 HTML_MIME_NO_HTML_TAG 2 2.48 5.56 1.94 89 TooManyTo_002 2 3.31 11.11 1.94 90 T_TooManySym_03 2 1.65 0.00 1.94 91 T_XMDrugObfuBody_14 2 1.65 0.00 1.94 92 XM_B_Phish66 2 1.65 0.00 1.94 93 TR_XM_SpammyRelay 2 2.48 5.56 1.94 94 XM_H_SpoofStaff4 2 1.65 0.00 1.94 95 XM_DK_Undo_01 2 1.65 0.00 1.94 96 TR_XM_PSC1 2 1.65 0.00 1.94 97 T_REMOTE_IMAGE 2 2.48 5.56 1.94 98 MIME_HTML_MOSTLY 2 1.65 0.00 1.94 99 XM_PDF 2 1.65 0.00 1.94 100 TR_XM_SB_Phish 2 3.31 11.11 1.94 101 XM_ZohoDesk1 2 1.65 0.00 1.94 102 XM_GoogleGroups 2 1.65 0.00 1.94 103 TR_XM_SpoofStaff 2 1.65 0.00 1.94 104 FVGT_m_MULTI_ODD_EMAIL 2 1.65 0.00 1.94 105 TooManyTo_003 2 3.31 11.11 1.94 106 TM2_M_A_HREF_HREF 2 1.65 0.00 1.94 107 XMSubPhish11 2 3.31 11.11 1.94 108 BAYES_95 2 1.65 0.00 1.94 109 T_OBFU_PDF_ATTACH 2 1.65 0.00 1.94 110 RCVD_IN_MSPIKE_H3 2 1.65 0.00 1.94 111 RELAYCOUNTRY_META 2 6.61 33.33 1.94 112 TR_XM_UnparsRelay 2 2.48 5.56 1.94 113 XMSpoofStaff2 2 1.65 0.00 1.94 114 XM_DKIMWhitelistDomains 2 1.65 0.00 1.94 115 XMMoneyMeta_00 1 0.83 0.00 0.97 116 RCVD_IN_MSPIKE_H4 1 0.83 0.00 0.97 117 NML_ADSP_CUSTOM_MED 1 0.83 0.00 0.97 118 XM_Evil_Numbers_Gen 1 2.48 11.11 0.97 119 SpammyFromTLD_01 1 1.65 5.56 0.97 120 TR_DCC_Bayes_99 1 1.65 5.56 0.97 121 T_XMHurry_00 1 2.48 11.11 0.97 122 XM_B_Investor 1 1.65 5.56 0.97 123 UPPERCASE_50_75 1 0.83 0.00 0.97 124 HTML_IMAGE_ONLY_16 1 0.83 0.00 0.97 125 XMLngstWrd_00 1 1.65 5.56 0.97 126 BOTNET 1 3.31 16.67 0.97 127 RCVD_IN_BL_SPAMCOP_NET 1 0.83 0.00 0.97 128 TR_Mismatch_TLD_02 1 1.65 5.56 0.97 129 XMSubMetaD_00 1 0.83 0.00 0.97 130 URI_NOVOWEL 1 0.83 0.00 0.97 131 XM_DIRTYINTL 1 2.48 11.11 0.97 132 FORGED_GMAIL_RCVD 1 0.83 0.00 0.97 133 XM_Body_Obfu01 1 0.83 0.00 0.97 134 XMDateMe_00 1 0.83 0.00 0.97 135 XM_B_Unsub2 1 1.65 5.56 0.97 136 DATE_IN_PAST_12_24 1 0.83 0.00 0.97 137 DKIM_ADSP_CUSTOM_MED 1 0.83 0.00 0.97 138 XMNoVowels 1 0.83 0.00 0.97 139 HTML_IMAGE_ONLY_32 1 0.83 0.00 0.97 140 BAYES_99 1 4.96 27.78 0.97 141 UNTRUSTED_Relay 1 4.13 22.22 0.97 142 RELAYCOUNTRY_AU 1 0.83 0.00 0.97 143 TR_XM_PHPForged 1 0.83 0.00 0.97 144 XMGappySubj_01 1 0.83 0.00 0.97 145 TR_XM_DKIM_Undo 1 4.13 22.22 0.97 146 PLING_QUERY 1 0.83 0.00 0.97 147 IN_HORDE_ADDRESS_BOOK 1 0.83 0.00 0.97 148 HTML_IMAGE_RATIO_08 1 0.83 0.00 0.97 149 HTML_IMAGE_ONLY_12 1 0.83 0.00 0.97 150 MPART_ALT_DIFF 1 0.83 0.00 0.97 151 XMSubMetaSxObfu_03 1 0.83 0.00 0.97 152 FORGED_HOTMAIL_RCVD2 1 0.83 0.00 0.97 153 MAILING_LIST_MULTI 1 1.65 5.56 0.97 154 BOTNET_IPINHOSTNAME 1 1.65 5.56 0.97 155 BAYES_999 1 4.13 22.22 0.97 156 RELAYCOUNTRY_GB 1 0.83 0.00 0.97 ----------------------------------------------------------------------