Email: 84 Autolearn: 0 AvgScore: 1.01 AvgScanTime: 3.02 sec Spam: 14 Autolearn: 0 AvgScore: 16.43 AvgScanTime: 3.19 sec Ham: 70 Autolearn: 0 AvgScore: -2.07 AvgScanTime: 2.98 sec Time Spent Running SA: 0.07 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 13 75.00 92.86 71.43 2 HTML_MESSAGE 11 57.14 78.57 52.86 3 DCC_CHECK_NEGATIVE 11 80.95 78.57 81.43 4 XM_B_Unicode 8 42.86 57.14 40.00 5 RELAYCOUNTRY_US 8 54.76 57.14 54.29 6 RELAYCOUNTRY_META 7 10.71 50.00 2.86 7 MIME_HTML_ONLY 7 16.67 50.00 10.00 8 BAYES_50 6 55.95 42.86 58.57 9 LOC_TINY_FONT_1 5 16.67 35.71 12.86 10 BOTNET 5 5.95 35.71 0.00 11 DKIM_SIGNED 5 46.43 35.71 48.57 12 DKIM_VALID 5 44.05 35.71 45.71 13 XM_DK_Pass 5 44.05 35.71 45.71 14 BAYES_99 5 7.14 35.71 1.43 15 TR_XM_MaxWHORU 4 4.76 28.57 0.00 16 T_TM2_M_HEADER_IN_MSG 4 20.24 28.57 18.57 17 TR_XM_MSPIKECOMBO 4 4.76 28.57 0.00 18 XM_UncommonTLD01 4 14.29 28.57 11.43 19 TooManyTo_001 4 5.95 28.57 1.43 20 XMSubLong 4 15.48 28.57 12.86 21 UNTRUSTED_Relay 4 5.95 28.57 1.43 22 XM_Body_Dirty_Words 4 10.71 28.57 7.14 23 RCVD_IN_PSBL 4 4.76 28.57 0.00 24 RCVD_IN_MSPIKE_BL 4 4.76 28.57 0.00 25 XM_B_Unicode3 4 20.24 28.57 18.57 26 XMListUnsubscribeExists 4 19.05 28.57 17.14 27 NO_DNS_FOR_FROM 4 4.76 28.57 0.00 28 HTML_FONT_LOW_CONTRAST 4 16.67 28.57 14.29 29 BAYES_999 4 4.76 28.57 0.00 30 SpammyFromTLD_01 3 3.57 21.43 0.00 31 FVGT_m_MULTI_ODD 3 16.67 21.43 15.71 32 XM_DIRTYINTL 3 3.57 21.43 0.00 33 XM_B_SpammyWords 3 21.43 21.43 21.43 34 TR_XM_UnparsRelay 3 4.76 21.43 1.43 35 UNPARSEABLE_RELAY 3 7.14 21.43 4.29 36 DKIM_VALID_EF 3 29.76 21.43 31.43 37 DCC_CHECK 3 19.05 21.43 18.57 38 TR_XM_DK_Unsub 3 11.90 21.43 10.00 39 RCVD_IN_MSPIKE_L4 3 3.57 21.43 0.00 40 XM_DK_Undo_02 3 7.14 21.43 4.29 41 TooManyTo_003 2 2.38 14.29 0.00 42 TooManyTo_004 2 2.38 14.29 0.00 43 TO_MALFORMED 2 8.33 14.29 7.14 44 BAYES_60 2 9.52 14.29 8.57 45 HTML_FONT_TINY_NORDNS 2 2.38 14.29 0.00 46 T_REMOTE_IMAGE 2 5.95 14.29 4.29 47 DKIM_ADSP_NXDOMAIN 2 2.38 14.29 0.00 48 TooManyTo_002 2 2.38 14.29 0.00 49 XMStockSpam_06 2 2.38 14.29 0.00 50 HTML_IMAGE_RATIO_02 2 4.76 14.29 2.86 51 TR_DCC_Bayes_99 2 2.38 14.29 0.00 52 RCVD_IN_VALIDITY_RPBL 2 2.38 14.29 0.00 53 XM_Multi_Part_URI 2 22.62 14.29 24.29 54 RCVD_IN_MSPIKE_H2 2 13.10 14.29 12.86 55 RCVD_IN_MSPIKE_WL 2 25.00 14.29 27.14 56 TR_Symld_Words 2 2.38 14.29 0.00 57 BOTNET_IPINHOSTNAME 2 10.71 14.29 10.00 58 RCVD_IN_BL_SPAMCOP_NET 2 3.57 14.29 1.43 59 KHOP_HELO_FCRDNS 2 3.57 14.29 1.43 60 DKIM_VALID_AU 2 35.71 14.29 40.00 61 URI_WP_HACKED 1 1.19 7.14 0.00 62 RELAYCOUNTRY_AU 1 1.19 7.14 0.00 63 TR_XM_MSPIKECOMBO2 1 1.19 7.14 0.00 64 XM_B_SpammyTLD 1 4.76 7.14 4.29 65 XM_Superlative01 1 1.19 7.14 0.00 66 XMLngstWrd_00 1 1.19 7.14 0.00 67 TR_BOTNET_NEGATE 1 1.19 7.14 0.00 68 XM_SendGrid 1 2.38 7.14 1.43 69 XM_UB50 1 2.38 7.14 1.43 70 PDS_RDNS_DYNAMIC_FP 1 1.19 7.14 0.00 71 TR_XM_DKIM_Undo 1 3.57 7.14 2.86 72 HTML_TEXT_INVISIBLE_STYLE 1 1.19 7.14 0.00 73 TO_NO_BRKTS_DYNIP 1 1.19 7.14 0.00 74 XMLngstWrd_01 1 1.19 7.14 0.00 75 MISSING_MIME_HB_SEP 1 1.19 7.14 0.00 76 BAYES_80 1 3.57 7.14 2.86 77 XM_H_Long_From01 1 3.57 7.14 2.86 78 RELAYCOUNTRY_ES 1 1.19 7.14 0.00 79 XM_WhatsAppForged 1 1.19 7.14 0.00 80 TO_EQ_FM_DOM_HTML_ONLY 1 1.19 7.14 0.00 81 XM_H_PHPMailer 1 1.19 7.14 0.00 82 XM_H_AmazonPhish 1 1.19 7.14 0.00 83 XM_CamelCaseFrm001 1 3.57 7.14 2.86 84 XM_Body_Obfu01 1 1.19 7.14 0.00 85 XM_UB60 1 1.19 7.14 0.00 86 XMBSHREFv2 1 1.19 7.14 0.00 87 TM2_M_VERY_LONG_WORD 1 2.38 7.14 1.43 88 T_KAM_HTML_FONT_INVALID 1 4.76 7.14 4.29 89 XM_UB80 1 1.19 7.14 0.00 90 URIBL_CSS_A 1 1.19 7.14 0.00 91 XM_UB99 1 1.19 7.14 0.00 92 RCVD_IN_VALIDITY_CERTIFIED 1 1.19 7.14 0.00 93 URIBL_CSS 1 1.19 7.14 0.00 94 HTML_OBFUSCATE_10_20 1 1.19 7.14 0.00 95 RELAYCOUNTRY_CO 1 1.19 7.14 0.00 96 XM_B_Phish66 1 1.19 7.14 0.00 97 TooManyTo_005 1 1.19 7.14 0.00 98 HTML_IMAGE_ONLY_04 1 1.19 7.14 0.00 99 URI_PHP_REDIR 1 1.19 7.14 0.00 100 T_TooManySym_02 1 3.57 7.14 2.86 101 RELAYCOUNTRY_RU 1 1.19 7.14 0.00 102 RDNS_DYNAMIC 1 1.19 7.14 0.00 103 RELAYCOUNTRY_NL 1 1.19 7.14 0.00 104 MIME_QP_LONG_LINE 1 1.19 7.14 0.00 105 RCVD_IN_MSPIKE_H5 1 17.86 7.14 20.00 106 XM_UB999 1 1.19 7.14 0.00 107 FROM_GOV_SPOOF 1 4.76 7.14 4.29 108 MSGID_FROM_MTA_HEADER 1 1.19 7.14 0.00 109 RELAYCOUNTRY_BR 1 1.19 7.14 0.00 110 XMBrknScrpt_02 1 1.19 7.14 0.00 111 T_TooManySym_01 1 3.57 7.14 2.86 112 RCVD_IN_MSPIKE_L5 1 1.19 7.14 0.00 113 RELAYCOUNTRY_FR 1 1.19 7.14 0.00 114 XM_Combo_Sbj 1 1.19 7.14 0.00 115 RCVD_IN_RP_RNBL 1 1.19 7.14 0.00 116 LONG_JUNK_URI2 1 1.19 7.14 0.00 117 RELAYCOUNTRY_FI 1 1.19 7.14 0.00 118 FSL_BULK_SIG 1 14.29 7.14 15.71 119 XM_B_SpammyWords2 1 10.71 7.14 11.43 120 XM_H_NotFromAmazon 1 1.19 7.14 0.00 121 TR_XM_SpammyRelay 1 2.38 7.14 1.43 122 HTTP_EXCESSIVE_ESCAPES 1 1.19 7.14 0.00 123 HTML_MIME_NO_HTML_TAG 1 3.57 7.14 2.86 124 TR_XM_PhishingBody 1 2.38 7.14 1.43 125 TR_XM_SEO4 1 1.19 7.14 0.00 126 XMCapTrack 1 1.19 7.14 0.00 127 RELAYCOUNTRY_CN 1 1.19 7.14 0.00 128 RCVD_IN_VALIDITY_SAFE 1 1.19 7.14 0.00 129 XMHTMLBadTable_001 1 1.19 7.14 0.00 130 OBFU_TEXT_ATTACH 1 1.19 7.14 0.00 131 XM_B_SEO 1 1.19 7.14 0.00 132 LONG_JUNK_URI 1 1.19 7.14 0.00 133 TVD_VISIT_PHARMA 1 1.19 7.14 0.00 134 XM_SPF_SoftFail 1 1.19 7.14 0.00 135 LOTS_OF_MONEY 1 2.38 7.14 1.43 136 ALL_TRUSTED 1 36.90 7.14 42.86 137 RCVD_IN_MSPIKE_H3 1 7.14 7.14 7.14 138 XMSexyCombo_05 1 1.19 7.14 0.00 139 XM_Body_Dirty_Words_01 1 1.19 7.14 0.00 140 HDRS_MISSP 1 3.57 7.14 2.86 141 PDS_OTHER_BAD_TLD 1 1.19 7.14 0.00 142 MPART_ALT_DIFF_COUNT 1 1.19 7.14 0.00 143 NORDNS_LOW_CONTRAST 1 1.19 7.14 0.00 144 RELAYCOUNTRY_HK 1 1.19 7.14 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 57 80.95 78.57 81.43 2 T_SCC_BODY_TEXT_LINE 50 75.00 92.86 71.43 3 BAYES_50 41 55.95 42.86 58.57 4 RELAYCOUNTRY_US 38 54.76 57.14 54.29 5 HTML_MESSAGE 37 57.14 78.57 52.86 6 DKIM_SIGNED 34 46.43 35.71 48.57 7 XM_DK_Pass 32 44.05 35.71 45.71 8 DKIM_VALID 32 44.05 35.71 45.71 9 ALL_TRUSTED 30 36.90 7.14 42.86 10 DKIM_VALID_AU 28 35.71 14.29 40.00 11 XM_B_Unicode 28 42.86 57.14 40.00 12 ANY_BOUNCE_MESSAGE 26 30.95 0.00 37.14 13 BOUNCE_MESSAGE 26 30.95 0.00 37.14 14 TM2_M_URI_OPT_OUT 24 28.57 0.00 34.29 15 DKIM_VALID_EF 22 29.76 21.43 31.43 16 RCVD_IN_MSPIKE_WL 19 25.00 14.29 27.14 17 XM_Multi_Part_URI 17 22.62 14.29 24.29 18 XM_B_SpammyWords 15 21.43 21.43 21.43 19 RCVD_IN_MSPIKE_H5 14 17.86 7.14 20.00 20 XM_DKIMWhitelistDomains 14 16.67 0.00 20.00 21 XM_PDF 13 15.48 0.00 18.57 22 DCC_CHECK 13 19.05 21.43 18.57 23 XM_B_Unicode3 13 20.24 28.57 18.57 24 T_TM2_M_HEADER_IN_MSG 13 20.24 28.57 18.57 25 XMListUnsubscribeExists 12 19.05 28.57 17.14 26 HTML_IMAGE_RATIO_04 12 14.29 0.00 17.14 27 FSL_BULK_SIG 11 14.29 7.14 15.71 28 FVGT_m_MULTI_ODD 11 16.67 21.43 15.71 29 BAYES_05 11 13.10 0.00 15.71 30 HTML_FONT_LOW_CONTRAST 10 16.67 28.57 14.29 31 RCVD_IN_MSPIKE_H2 9 13.10 14.29 12.86 32 XMSubLong 9 15.48 28.57 12.86 33 LOC_TINY_FONT_1 9 16.67 35.71 12.86 34 XM_B_SpammyWords2 8 10.71 7.14 11.43 35 XM_UncommonTLD01 8 14.29 28.57 11.43 36 BOTNET_IPINHOSTNAME 7 10.71 14.29 10.00 37 TR_XM_DK_Unsub 7 11.90 21.43 10.00 38 MIME_HTML_ONLY 7 16.67 50.00 10.00 39 BAYES_60 6 9.52 14.29 8.57 40 RCVD_IN_MSPIKE_H3 5 7.14 7.14 7.14 41 INVALID_MSGID 5 5.95 0.00 7.14 42 MSGID_NOFQDN1 5 5.95 0.00 7.14 43 XM_Body_Dirty_Words 5 10.71 28.57 7.14 44 TO_MALFORMED 5 8.33 14.29 7.14 45 GMD_PDF_HORIZ 4 4.76 0.00 5.71 46 BAYES_00 4 4.76 0.00 5.71 47 IN_ZIMBRA_NJ_WHITELIST 3 3.57 0.00 4.29 48 XM_DK_Undo_02 3 7.14 21.43 4.29 49 UNPARSEABLE_RELAY 3 7.14 21.43 4.29 50 BAYES_40 3 3.57 0.00 4.29 51 FROM_GOV_SPOOF 3 4.76 7.14 4.29 52 T_KAM_HTML_FONT_INVALID 3 4.76 7.14 4.29 53 T_REMOTE_IMAGE 3 5.95 14.29 4.29 54 XM_B_SpammyTLD 3 4.76 7.14 4.29 55 HDRS_MISSP 2 3.57 7.14 2.86 56 FVGT_m_MULTI_ODD_EMAIL 2 2.38 0.00 2.86 57 SpammyFromTLD_02 2 2.38 0.00 2.86 58 XM_B_SpammyWords3 2 2.38 0.00 2.86 59 XMSubMetaI_00 2 2.38 0.00 2.86 60 TR_XM_SpoofStaff 2 2.38 0.00 2.86 61 TR_XM_PSC1 2 2.38 0.00 2.86 62 HTML_MIME_NO_HTML_TAG 2 3.57 7.14 2.86 63 XM_H_Trusted_IP 2 2.38 0.00 2.86 64 XM_Evil_Numbers_Gen 2 2.38 0.00 2.86 65 HTML_IMAGE_RATIO_02 2 4.76 14.29 2.86 66 T_TooManySym_03 2 2.38 0.00 2.86 67 T_TooManySym_01 2 3.57 7.14 2.86 68 XMSpoofStaff2 2 2.38 0.00 2.86 69 T_TooManySym_02 2 3.57 7.14 2.86 70 TVD_SPACE_RATIO 2 2.38 0.00 2.86 71 HTML_IMAGE_RATIO_06 2 2.38 0.00 2.86 72 DKIM_INVALID 2 2.38 0.00 2.86 73 XMNumbers 2 2.38 0.00 2.86 74 TR_XM_SpoofPhishAttach 2 2.38 0.00 2.86 75 BAYES_80 2 3.57 7.14 2.86 76 XM_H_Long_From01 2 3.57 7.14 2.86 77 XM_CamelCaseFrm001 2 3.57 7.14 2.86 78 XM_H_SpoofStaff4 2 2.38 0.00 2.86 79 XMSubNoVowel 2 2.38 0.00 2.86 80 XM_ZohoDesk1 2 2.38 0.00 2.86 81 TR_XM_DKIM_Undo 2 3.57 7.14 2.86 82 T_OBFU_PDF_ATTACH 2 2.38 0.00 2.86 83 RELAYCOUNTRY_META 2 10.71 50.00 2.86 84 KHOP_HELO_FCRDNS 1 3.57 14.29 1.43 85 MPART_ALT_DIFF 1 1.19 0.00 1.43 86 XMPhish14 1 1.19 0.00 1.43 87 TR_XM_BayesUnsub 1 1.19 0.00 1.43 88 BAYES_99 1 7.14 35.71 1.43 89 RCVD_IN_BL_SPAMCOP_NET 1 3.57 14.29 1.43 90 BAYES_20 1 1.19 0.00 1.43 91 TR_XM_DK_Bayes1 1 1.19 0.00 1.43 92 LOTS_OF_MONEY 1 2.38 7.14 1.43 93 FROM_EXCESS_BASE64 1 1.19 0.00 1.43 94 TR_XM_SpammyRelay 1 2.38 7.14 1.43 95 TR_XM_UnparsRelay 1 4.76 21.43 1.43 96 TR_XM_DK_SendGrid 1 1.19 0.00 1.43 97 HK_RANDOM_ENVFROM 1 1.19 0.00 1.43 98 SCC_BODY_URI_ONLY 1 1.19 0.00 1.43 99 TR_XM_PhishingBody 1 2.38 7.14 1.43 100 FROM_OFFERS 1 1.19 0.00 1.43 101 MIME_HTML_ONLY_MULTI 1 1.19 0.00 1.43 102 RELAYCOUNTRY_SE 1 1.19 0.00 1.43 103 MIXED_FONT_CASE 1 1.19 0.00 1.43 104 RELAYCOUNTRY_GB 1 1.19 0.00 1.43 105 USER_IN_DEF_DKIM_WL 1 1.19 0.00 1.43 106 TR_XM_DK_Bayes 1 1.19 0.00 1.43 107 URIBL_BLACK 1 1.19 0.00 1.43 108 UNTRUSTED_Relay 1 5.95 28.57 1.43 109 TR_XM_SpammyWords2 1 1.19 0.00 1.43 110 HTML_IMAGE_ONLY_12 1 1.19 0.00 1.43 111 XM_B_Unsub 1 1.19 0.00 1.43 112 SUBJ_ALL_CAPS 1 1.19 0.00 1.43 113 LotsOfNums_01 1 1.19 0.00 1.43 114 TR_Mismatch_TLD_01 1 1.19 0.00 1.43 115 HTTPS_HTTP_MISMATCH 1 1.19 0.00 1.43 116 FILL_THIS_FORM 1 1.19 0.00 1.43 117 HTML_IMAGE_ONLY_20 1 1.19 0.00 1.43 118 TVD_PH_BODY_ACCOUNTS_PRE 1 1.19 0.00 1.43 119 IN_HORDE_ADDRESS_BOOK 1 1.19 0.00 1.43 120 TM2_M_VERY_LONG_WORD 1 2.38 7.14 1.43 121 TooManyTo_001 1 5.95 28.57 1.43 122 HTML_FONT_FACE_BAD 1 1.19 0.00 1.43 123 HK_RANDOM_FROM 1 1.19 0.00 1.43 124 TR_XM_DK_Bayes2 1 1.19 0.00 1.43 125 BAYES_95 1 1.19 0.00 1.43 126 XMSubEmpty 1 1.19 0.00 1.43 127 XM_UB50 1 2.38 7.14 1.43 128 XM_SendGrid 1 2.38 7.14 1.43 ----------------------------------------------------------------------