Email: 129 Autolearn: 0 AvgScore: 2.50 AvgScanTime: 1.70 sec Spam: 14 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.82 sec Ham: 115 Autolearn: 0 AvgScore: 1.13 AvgScanTime: 1.68 sec Time Spent Running SA: 0.06 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 12 81.40 85.71 80.87 2 HTML_MESSAGE 11 80.62 78.57 80.87 3 DCC_CHECK_NEGATIVE 9 68.99 64.29 69.57 4 XM_DK_Pass 9 72.87 64.29 73.91 5 DKIM_VALID 9 42.64 64.29 40.00 6 DKIM_SIGNED 9 74.42 64.29 75.65 7 RELAYCOUNTRY_US 8 81.40 57.14 84.35 8 RELAYCOUNTRY_META 8 9.30 57.14 3.48 9 BAYES_50 7 41.86 50.00 40.87 10 DKIM_VALID_AU 6 30.23 42.86 28.70 11 MIME_HTML_ONLY 6 22.48 42.86 20.00 12 XM_B_Unicode 6 68.22 42.86 71.30 13 DCC_CHECK 5 31.01 35.71 30.43 14 DKIM_VALID_EF 5 19.38 35.71 17.39 15 XMSubLong 5 47.29 35.71 48.70 16 HTML_FONT_LOW_CONTRAST 4 45.74 28.57 47.83 17 XM_B_SpammyWords 4 26.36 28.57 26.09 18 FVGT_m_MULTI_ODD 4 20.16 28.57 19.13 19 TooManyTo_001 4 6.98 28.57 4.35 20 LOC_TINY_FONT_1 4 43.41 28.57 45.22 21 XM_Body_Dirty_Words 4 6.20 28.57 3.48 22 XM_B_SpammyWords2 3 13.18 21.43 12.17 23 TooManyTo_004 3 4.65 21.43 2.61 24 TooManyTo_002 3 4.65 21.43 2.61 25 XM_B_Unicode3 3 53.49 21.43 57.39 26 XMCapTrack 3 4.65 21.43 2.61 27 RCVD_IN_MSPIKE_H2 3 12.40 21.43 11.30 28 RCVD_IN_MSPIKE_WL 3 13.95 21.43 13.04 29 BOTNET_IPINHOSTNAME 3 3.88 21.43 1.74 30 BOTNET 3 2.33 21.43 0.00 31 RCVD_IN_MSPIKE_H5 3 9.30 21.43 7.83 32 XMListUnsubscribeExists 3 50.39 21.43 53.91 33 XM_DIRTYINTL 3 2.33 21.43 0.00 34 XM_B_Unsub 3 5.43 21.43 3.48 35 UNTRUSTED_Relay 3 3.10 21.43 0.87 36 TooManyTo_003 3 4.65 21.43 2.61 37 XM_DK_Undo_02 3 2.33 21.43 0.00 38 TR_XM_BayesUnsub 2 3.88 14.29 2.61 39 TR_XM_SpammyWords5 2 1.55 14.29 0.00 40 T_TooManySym_01 2 8.53 14.29 7.83 41 BAYES_99 2 1.55 14.29 0.00 42 HTML_IMAGE_RATIO_02 2 2.33 14.29 0.87 43 NUMERIC_HTTP_ADDR 2 1.55 14.29 0.00 44 BAYES_999 2 1.55 14.29 0.00 45 TR_XM_MaxWHORU 2 1.55 14.29 0.00 46 NO_DNS_FOR_FROM 2 1.55 14.29 0.00 47 RCVD_IN_BL_SPAMCOP_NET 2 1.55 14.29 0.00 48 TR_XM_SpammyRelay 2 1.55 14.29 0.00 49 RELAYCOUNTRY_CN 2 1.55 14.29 0.00 50 RELAYCOUNTRY_IN 2 3.88 14.29 2.61 51 XM_Multi_Part_URI 2 40.31 14.29 43.48 52 TooManyTo_005 2 3.88 14.29 2.61 53 HTML_MIME_NO_HTML_TAG 2 6.98 14.29 6.09 54 LOTS_OF_MONEY 2 2.33 14.29 0.87 55 FSL_BULK_SIG 2 6.20 14.29 5.22 56 XMGappySubj_01 2 4.65 14.29 3.48 57 XM_UB50 2 1.55 14.29 0.00 58 TR_XM_DK_Unsub 2 7.75 14.29 6.96 59 TR_Symld_Words 2 3.88 14.29 2.61 60 T_KAM_HTML_FONT_INVALID 2 10.85 14.29 10.43 61 PDS_RDNS_DYNAMIC_FP 1 0.78 7.14 0.00 62 XM_B_SexDrugs1 1 0.78 7.14 0.00 63 INVALID_MSGID 1 5.43 7.14 5.22 64 LONG_JUNK_URI 1 0.78 7.14 0.00 65 BAYES_95 1 1.55 7.14 0.87 66 TR_XM_Undi_RecipCombo2 1 0.78 7.14 0.00 67 BITCOIN_SPAM_10 1 0.78 7.14 0.00 68 RCVD_IN_PSBL 1 0.78 7.14 0.00 69 TR_XM_DKIM_Undo 1 0.78 7.14 0.00 70 TR_Sbj_FN_Bdy 1 0.78 7.14 0.00 71 HTML_IMAGE_RATIO_04 1 3.88 7.14 3.48 72 RCVD_IN_MSPIKE_BL 1 0.78 7.14 0.00 73 HTML_IMAGE_ONLY_24 1 0.78 7.14 0.00 74 HDRS_MISSP 1 2.33 7.14 1.74 75 UNPARSEABLE_RELAY 1 8.53 7.14 8.70 76 MILLION_HUNDRED 1 0.78 7.14 0.00 77 MONEY_FORM_SHORT 1 0.78 7.14 0.00 78 FROM_GOV_SPOOF 1 3.88 7.14 3.48 79 TR_XM_Undi_Recip2 1 0.78 7.14 0.00 80 XMSexyCombo_05 1 0.78 7.14 0.00 81 RELAYCOUNTRY_AU 1 0.78 7.14 0.00 82 XMLngstWrd_01 1 0.78 7.14 0.00 83 TR_XM_NoHeaderRelay 1 0.78 7.14 0.00 84 WEIRD_PORT 1 1.55 7.14 0.87 85 MIME_HTML_MOSTLY 1 2.33 7.14 1.74 86 ALL_TRUSTED 1 13.95 7.14 14.78 87 MIME_CHARSET_FARAWAY 1 0.78 7.14 0.00 88 SUBJ_ALL_CAPS 1 1.55 7.14 0.87 89 TR_UG_Sexy_Spam 1 0.78 7.14 0.00 90 RCVD_IN_MSPIKE_L4 1 0.78 7.14 0.00 91 TR_XM_PhishingBody 1 1.55 7.14 0.87 92 XM_H_Undi_Recip 1 0.78 7.14 0.00 93 XM_UncommonTLD01 1 8.53 7.14 8.70 94 UNDISC_MONEY 1 0.78 7.14 0.00 95 URI_WP_HACKED 1 0.78 7.14 0.00 96 HTML_IMAGE_ONLY_04 1 0.78 7.14 0.00 97 RDNS_DYNAMIC 1 0.78 7.14 0.00 98 RELAYCOUNTRY_AT 1 0.78 7.14 0.00 99 T_XMDrugObfuBody_14 1 3.10 7.14 2.61 100 MSGID_FROM_MTA_HEADER 1 0.78 7.14 0.00 101 T_TM2_M_HEADER_IN_MSG 1 14.73 7.14 15.65 102 LOADSA_MONEY_COMBO 1 0.78 7.14 0.00 103 TO_NO_BRKTS_DYNIP 1 0.78 7.14 0.00 104 MPART_ALT_DIFF_COUNT 1 0.78 7.14 0.00 105 XM_Body_Dirty_Words_01 1 1.55 7.14 0.87 106 DKIM_ADSP_NXDOMAIN 1 0.78 7.14 0.00 107 XMLngstWrd_00 1 1.55 7.14 0.87 108 T_XMHurry_00 1 0.78 7.14 0.00 109 BAYES_80 1 2.33 7.14 1.74 110 XM_H_FedEx_Spoof 1 0.78 7.14 0.00 111 XM_Body_Obfu01 1 0.78 7.14 0.00 112 HTML_IMAGE_RATIO_06 1 1.55 7.14 0.87 113 TM2_M_VERY_LONG_WORD 1 1.55 7.14 0.87 114 SpammyFromTLD_01 1 1.55 7.14 0.87 115 T_FILL_THIS_FORM_SHORT 1 0.78 7.14 0.00 116 XM_H_Long_From01 1 2.33 7.14 1.74 117 TO_MALFORMED 1 5.43 7.14 5.22 118 PDS_BTC_ID 1 0.78 7.14 0.00 119 LONG_JUNK_URI2 1 0.78 7.14 0.00 120 RELAYCOUNTRY_FI 1 0.78 7.14 0.00 121 KHOP_HELO_FCRDNS 1 2.33 7.14 1.74 122 LONG_JUNK_URI3 1 0.78 7.14 0.00 123 BAYES_40 1 4.65 7.14 4.35 124 RCVD_IN_RP_RNBL 1 0.78 7.14 0.00 125 T_XMDrugObfuBody_01 1 0.78 7.14 0.00 126 BAYES_60 1 6.98 7.14 6.96 127 XM_B_Phish66 1 1.55 7.14 0.87 128 NORMAL_HTTP_TO_IP 1 0.78 7.14 0.00 129 OBFU_TEXT_ATTACH 1 0.78 7.14 0.00 130 BAYES_05 1 2.33 7.14 1.74 131 XM_Body_Dirty_Words_02 1 0.78 7.14 0.00 132 ADVANCE_FEE_5_NEW_MONEY 1 0.78 7.14 0.00 133 FROMSPACE 1 0.78 7.14 0.00 134 TR_XM_Undi_Recip11 1 0.78 7.14 0.00 135 XMStockSpam_06 1 1.55 7.14 0.87 136 TR_XM_Undi_Recip5 1 0.78 7.14 0.00 137 TR_XM_MSPIKECOMBO 1 0.78 7.14 0.00 138 TR_XM_SpammyWords4 1 1.55 7.14 0.87 139 MISSING_MIME_HB_SEP 1 0.78 7.14 0.00 140 TO_EQ_FM_DOM_HTML_ONLY 1 0.78 7.14 0.00 141 TR_XM_SpammyWords3 1 0.78 7.14 0.00 142 T_REMOTE_IMAGE 1 2.33 7.14 1.74 143 T_TooManySym_02 1 5.43 7.14 5.22 144 XFER_LOTSA_MONEY 1 0.78 7.14 0.00 145 FROM_EXCESS_BASE64 1 3.88 7.14 3.48 146 RELAYCOUNTRY_CA 1 0.78 7.14 0.00 147 XMNumbers 1 4.65 7.14 4.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 97 81.40 57.14 84.35 2 T_SCC_BODY_TEXT_LINE 93 81.40 85.71 80.87 3 HTML_MESSAGE 93 80.62 78.57 80.87 4 DKIM_SIGNED 87 74.42 64.29 75.65 5 XM_DK_Pass 85 72.87 64.29 73.91 6 XM_B_Unicode 82 68.22 42.86 71.30 7 DCC_CHECK_NEGATIVE 80 68.99 64.29 69.57 8 XM_B_Unicode3 66 53.49 21.43 57.39 9 XMListUnsubscribeExists 62 50.39 21.43 53.91 10 XMSubLong 56 47.29 35.71 48.70 11 HTML_FONT_LOW_CONTRAST 55 45.74 28.57 47.83 12 LOC_TINY_FONT_1 52 43.41 28.57 45.22 13 XM_Multi_Part_URI 50 40.31 14.29 43.48 14 BAYES_00 48 37.21 0.00 41.74 15 BAYES_50 47 41.86 50.00 40.87 16 DKIM_VALID 46 42.64 64.29 40.00 17 TR_XM_DK_Bayes 46 35.66 0.00 40.00 18 LotsOfNums_01 43 33.33 0.00 37.39 19 DKIM_INVALID 41 31.78 0.00 35.65 20 DCC_CHECK 35 31.01 35.71 30.43 21 DKIM_VALID_AU 33 30.23 42.86 28.70 22 XM_B_SpammyWords 30 26.36 28.57 26.09 23 XM_B_REG_HTML 24 18.60 0.00 20.87 24 MIME_HTML_ONLY 23 22.48 42.86 20.00 25 FVGT_m_MULTI_ODD 22 20.16 28.57 19.13 26 DKIM_VALID_EF 20 19.38 35.71 17.39 27 T_TM2_M_HEADER_IN_MSG 18 14.73 7.14 15.65 28 ALL_TRUSTED 17 13.95 7.14 14.78 29 RCVD_IN_MSPIKE_WL 15 13.95 21.43 13.04 30 XM_B_SpammyWords2 14 13.18 21.43 12.17 31 RCVD_IN_MSPIKE_H2 13 12.40 21.43 11.30 32 T_KAM_HTML_FONT_INVALID 12 10.85 14.29 10.43 33 UNPARSEABLE_RELAY 10 8.53 7.14 8.70 34 XM_UncommonTLD01 10 8.53 7.14 8.70 35 T_TooManySym_01 9 8.53 14.29 7.83 36 RCVD_IN_MSPIKE_H5 9 9.30 21.43 7.83 37 BAYES_60 8 6.98 7.14 6.96 38 TR_XM_DK_Unsub 8 7.75 14.29 6.96 39 UPGRADE_MAILBOX 7 5.43 0.00 6.09 40 HTML_MIME_NO_HTML_TAG 7 6.98 14.29 6.09 41 TR_XM_DK_Bayes1 7 5.43 0.00 6.09 42 BOUNCE_MESSAGE 6 4.65 0.00 5.22 43 INVALID_MSGID 6 5.43 7.14 5.22 44 ANY_BOUNCE_MESSAGE 6 4.65 0.00 5.22 45 FSL_BULK_SIG 6 6.20 14.29 5.22 46 TO_MALFORMED 6 5.43 7.14 5.22 47 MSGID_NOFQDN1 6 4.65 0.00 5.22 48 XM_SendGrid 6 4.65 0.00 5.22 49 T_TooManySym_02 6 5.43 7.14 5.22 50 RCVD_IN_MSPIKE_H3 5 3.88 0.00 4.35 51 TR_XM_DK_Bayes2 5 3.88 0.00 4.35 52 BAYES_40 5 4.65 7.14 4.35 53 TooManyTo_001 5 6.98 28.57 4.35 54 XM_B_Phish_Phrases 5 3.88 0.00 4.35 55 XM_Evil_Numbers_Gen 5 3.88 0.00 4.35 56 XMNumbers 5 4.65 7.14 4.35 57 IN_ZIMBRA_NJ_WHITELIST 4 3.10 0.00 3.48 58 HTML_IMAGE_RATIO_04 4 3.88 7.14 3.48 59 XM_DKIMWhitelistDomains 4 3.10 0.00 3.48 60 FROM_GOV_SPOOF 4 3.88 7.14 3.48 61 XMFunnyHTTP 4 3.10 0.00 3.48 62 XMGappySubj_01 4 4.65 14.29 3.48 63 RELAYCOUNTRY_META 4 9.30 57.14 3.48 64 XM_B_Unsub 4 5.43 21.43 3.48 65 XM_USANA_RCVD 4 3.10 0.00 3.48 66 FROM_EXCESS_BASE64 4 3.88 7.14 3.48 67 XM_Body_Dirty_Words 4 6.20 28.57 3.48 68 TR_XM_BayesUnsub 3 3.88 14.29 2.61 69 XMSubPhish11 3 2.33 0.00 2.61 70 TVD_SPACE_RATIO 3 2.33 0.00 2.61 71 TooManyTo_002 3 4.65 21.43 2.61 72 TooManyTo_004 3 4.65 21.43 2.61 73 XMCapTrack 3 4.65 21.43 2.61 74 TR_XM_SB_Phish 3 2.33 0.00 2.61 75 USER_IN_DEF_DKIM_WL 3 2.33 0.00 2.61 76 T_XMDrugObfuBody_14 3 3.10 7.14 2.61 77 RELAYCOUNTRY_IN 3 3.88 14.29 2.61 78 TooManyTo_005 3 3.88 14.29 2.61 79 SpammyFromTLD_02 3 2.33 0.00 2.61 80 MIME_QP_LONG_LINE 3 2.33 0.00 2.61 81 TR_Symld_Words 3 3.88 14.29 2.61 82 TooManyTo_003 3 4.65 21.43 2.61 83 TR_XM_DK_SendGrid 3 2.33 0.00 2.61 84 XM_DK_Undo_01 2 1.55 0.00 1.74 85 XM_B_DNDMA 2 1.55 0.00 1.74 86 HDRS_MISSP 2 2.33 7.14 1.74 87 XM_B_Unsub2 2 1.55 0.00 1.74 88 MIME_HTML_MOSTLY 2 2.33 7.14 1.74 89 BAYES_20 2 1.55 0.00 1.74 90 BOTNET_IPINHOSTNAME 2 3.88 21.43 1.74 91 HTML_IMAGE_ONLY_16 2 1.55 0.00 1.74 92 XM_B_SpammyWords3 2 1.55 0.00 1.74 93 T_TooManySym_03 2 1.55 0.00 1.74 94 BAYES_80 2 2.33 7.14 1.74 95 MIXED_FONT_CASE 2 1.55 0.00 1.74 96 XM_H_Long_From01 2 2.33 7.14 1.74 97 FVGT_m_MULTI_ODD_EMAIL 2 1.55 0.00 1.74 98 KHOP_HELO_FCRDNS 2 2.33 7.14 1.74 99 XMSubMetaSx_00 2 1.55 0.00 1.74 100 SCC_BODY_URI_ONLY 2 1.55 0.00 1.74 101 BAYES_05 2 2.33 7.14 1.74 102 XM_SPF_SoftFail 2 1.55 0.00 1.74 103 HTML_SHORT_LINK_IMG_3 2 1.55 0.00 1.74 104 BASE64_LENGTH_79_INF 2 1.55 0.00 1.74 105 T_REMOTE_IMAGE 2 2.33 7.14 1.74 106 HTML_IMAGE_RATIO_08 1 0.78 0.00 0.87 107 BAYES_95 1 1.55 7.14 0.87 108 XMSubNoVowel 1 0.78 0.00 0.87 109 XMSubject_72 1 0.78 0.00 0.87 110 HTML_IMAGE_RATIO_02 1 2.33 14.29 0.87 111 HTML_IMAGE_ONLY_28 1 0.78 0.00 0.87 112 RCVD_IN_IADB_DK 1 0.78 0.00 0.87 113 TM2_M_URI_OPT_OUT 1 0.78 0.00 0.87 114 TR_XM_UnparsRelay 1 0.78 0.00 0.87 115 XMBSHREFv2 1 0.78 0.00 0.87 116 XM_CamelCaseFrm001 1 0.78 0.00 0.87 117 RELAYCOUNTRY_FR 1 0.78 0.00 0.87 118 XMSubMetaI_00 1 0.78 0.00 0.87 119 WEIRD_PORT 1 1.55 7.14 0.87 120 SUBJ_ALL_CAPS 1 1.55 7.14 0.87 121 EXCLAMACION_ES 1 0.78 0.00 0.87 122 TR_XM_PhishingBody 1 1.55 7.14 0.87 123 XMSubMetaSxObfu_03 1 0.78 0.00 0.87 124 RCVD_IN_IADB_SPF 1 0.78 0.00 0.87 125 XM_H_Trusted_IP 1 0.78 0.00 0.87 126 XM_PDF 1 0.78 0.00 0.87 127 URI_NO_WWW_INFO_CGI 1 0.78 0.00 0.87 128 XM_Body_Dirty_Words_01 1 1.55 7.14 0.87 129 TR_Mismatch_TLD_01 1 0.78 0.00 0.87 130 DKIM_ADSP_CUSTOM_MED 1 0.78 0.00 0.87 131 XMSexyCombo_01 1 0.78 0.00 0.87 132 XMLngstWrd_00 1 1.55 7.14 0.87 133 RCVD_IN_IADB_SENDERID 1 0.78 0.00 0.87 134 HTML_IMAGE_ONLY_20 1 0.78 0.00 0.87 135 TR_XM_Base64_M1 1 0.78 0.00 0.87 136 SHOPIFY_IMG_NOT_RCVD_SFY 1 0.78 0.00 0.87 137 HTML_IMAGE_RATIO_06 1 1.55 7.14 0.87 138 XMSexyCombo_02 1 0.78 0.00 0.87 139 LOTS_OF_MONEY 1 2.33 14.29 0.87 140 TM2_M_VERY_LONG_WORD 1 1.55 7.14 0.87 141 SpammyFromTLD_01 1 1.55 7.14 0.87 142 XMBdyGiftCard01 1 0.78 0.00 0.87 143 T_OBFU_PDF_ATTACH 1 0.78 0.00 0.87 144 XM_UB80 1 0.78 0.00 0.87 145 XM_H_Long_From02 1 0.78 0.00 0.87 146 NML_ADSP_CUSTOM_MED 1 0.78 0.00 0.87 147 XM_B_Investor 1 0.78 0.00 0.87 148 DATE_IN_PAST_03_06 1 0.78 0.00 0.87 149 XM_B_Phish66 1 1.55 7.14 0.87 150 RCVD_IN_MSPIKE_H4 1 0.78 0.00 0.87 151 XM_B_SpammyTLD 1 0.78 0.00 0.87 152 HTML_IMAGE_ONLY_32 1 0.78 0.00 0.87 153 RCVD_IN_IADB_LISTED 1 0.78 0.00 0.87 154 TR_Mismatch_TLD_02 1 0.78 0.00 0.87 155 XMCapTrack2 1 0.78 0.00 0.87 156 XMStockSpam_06 1 1.55 7.14 0.87 157 XMSubject_78 1 0.78 0.00 0.87 158 TR_XM_SpammyWords4 1 1.55 7.14 0.87 159 UNTRUSTED_Relay 1 3.10 21.43 0.87 160 TVD_RCVD_IP 1 0.78 0.00 0.87 161 FORGED_GMAIL_RCVD 1 0.78 0.00 0.87 162 MPART_ALT_DIFF 1 0.78 0.00 0.87 163 T_PDS_PRO_TLD 1 0.78 0.00 0.87 164 URI_TRY_3LD 1 0.78 0.00 0.87 165 XM_Dr_From 1 0.78 0.00 0.87 166 TR_XMSubLong 1 0.78 0.00 0.87 167 XMStrtUSub 1 0.78 0.00 0.87 ----------------------------------------------------------------------