Email: 72 Autolearn: 0 AvgScore: -1.31 AvgScanTime: 1.54 sec Spam: 17 Autolearn: 0 AvgScore: 25.00 AvgScanTime: 1.24 sec Ham: 55 Autolearn: 0 AvgScore: -9.44 AvgScanTime: 1.63 sec Time Spent Running SA: 0.03 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.02 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 16 77.78 94.12 72.73 2 T_SCC_BODY_TEXT_LINE 15 83.33 88.24 81.82 3 XM_B_Unicode 13 62.50 76.47 58.18 4 BAYES_50 12 58.33 70.59 54.55 5 RELAYCOUNTRY_US 11 72.22 64.71 74.55 6 XM_DK_Pass 10 65.28 58.82 67.27 7 DKIM_SIGNED 10 68.06 58.82 70.91 8 MIME_HTML_ONLY 10 31.94 58.82 23.64 9 DKIM_VALID 10 65.28 58.82 67.27 10 DCC_CHECK 9 25.00 52.94 16.36 11 RCVD_IN_MSPIKE_H2 9 25.00 52.94 16.36 12 DKIM_VALID_EF 8 45.83 47.06 45.45 13 XM_B_SpammyWords 8 45.83 47.06 45.45 14 DCC_CHECK_NEGATIVE 8 75.00 47.06 83.64 15 DKIM_VALID_AU 7 52.78 41.18 56.36 16 XM_B_Unicode3 6 34.72 35.29 34.55 17 RELAYCOUNTRY_META 6 12.50 35.29 5.45 18 BOTNET 5 6.94 29.41 0.00 19 TR_XM_BayesUnsub 5 9.72 29.41 3.64 20 XM_Multi_Part_URI 5 22.22 29.41 20.00 21 XM_B_Unsub 5 9.72 29.41 3.64 22 XMListUnsubscribeExists 5 36.11 29.41 38.18 23 XMSubLong 4 23.61 23.53 23.64 24 TR_XM_SB_Phish 4 5.56 23.53 0.00 25 XMSubPhish8 4 5.56 23.53 0.00 26 TR_MetaPhish_Sub_02 4 5.56 23.53 0.00 27 XMSubPhish11 4 5.56 23.53 0.00 28 TR_XM_SpoofStaff 4 5.56 23.53 0.00 29 PDS_FRNOM_TODOM_NAKED_TO 4 5.56 23.53 0.00 30 TR_XM_SpoofStaff2 4 5.56 23.53 0.00 31 XM_H_SpoofStaff4 4 5.56 23.53 0.00 32 T_TM2_M_HEADER_IN_MSG 4 22.22 23.53 21.82 33 TO_NO_BRKTS_HTML_IMG 4 5.56 23.53 0.00 34 TR_XM_PSC1 4 5.56 23.53 0.00 35 UNTRUSTED_Relay 4 6.94 23.53 1.82 36 XMSpoofStaff2 4 5.56 23.53 0.00 37 FVGT_m_MULTI_ODD 4 29.17 23.53 30.91 38 RELAYCOUNTRY_NG 4 5.56 23.53 0.00 39 PDS_FROM_NAME_TO_DOMAIN 4 5.56 23.53 0.00 40 XM_NONUS_MSG 4 5.56 23.53 0.00 41 BAYES_99 4 6.94 23.53 1.82 42 UNPARSEABLE_RELAY 4 15.28 23.53 12.73 43 LOC_TINY_FONT_1 3 13.89 17.65 12.73 44 BOTNET_IPINHOSTNAME 3 5.56 17.65 1.82 45 TR_XM_InvalidRelay 3 4.17 17.65 0.00 46 XM_UB50 3 4.17 17.65 0.00 47 RCVD_IN_VALIDITY_RPBL 3 4.17 17.65 0.00 48 XM_Body_Dirty_Words 3 11.11 17.65 9.09 49 TR_XM_DK_Unsub 3 19.44 17.65 20.00 50 TR_XM_DK_SendGrid 3 9.72 17.65 7.27 51 HTML_FONT_LOW_CONTRAST 3 23.61 17.65 25.45 52 XM_DK_Undo_02 3 5.56 17.65 1.82 53 RCVD_IN_MSPIKE_BL 3 4.17 17.65 0.00 54 XM_SPF_SoftFail 3 4.17 17.65 0.00 55 URI_PHISH 3 4.17 17.65 0.00 56 TR_XM_MSPIKECOMBO 3 4.17 17.65 0.00 57 FSL_BULK_SIG 3 11.11 17.65 9.09 58 XM_SendGrid 3 12.50 17.65 10.91 59 HTML_IMAGE_RATIO_06 2 2.78 11.76 0.00 60 URIBL_DBL_ABUSE_SPAM 2 2.78 11.76 0.00 61 RELAYCOUNTRY_CA 2 4.17 11.76 1.82 62 XMStockSpam_06 2 4.17 11.76 1.82 63 TooManyTo_001 2 6.94 11.76 5.45 64 LotsOfNums_01 2 9.72 11.76 9.09 65 TR_XM_PhishingBody 2 5.56 11.76 3.64 66 XMPhish14 2 2.78 11.76 0.00 67 HTTP_ESCAPED_HOST 2 2.78 11.76 0.00 68 HTML_IMAGE_RATIO_02 2 4.17 11.76 1.82 69 TM2_M_OBFU_COMMENT 2 2.78 11.76 0.00 70 BOTNET_NORDNS 2 2.78 11.76 0.00 71 URI_WP_HACKED 2 2.78 11.76 0.00 72 XMClaimOffer 2 2.78 11.76 0.00 73 MIME_QP_LONG_LINE 2 5.56 11.76 3.64 74 TR_XM_SpammyWords3 2 2.78 11.76 0.00 75 TR_XM_PhishingBody3 2 2.78 11.76 0.00 76 BAYES_999 2 4.17 11.76 1.82 77 TR_XM_SpammyRelay 2 5.56 11.76 3.64 78 RELAYCOUNTRY_BR 2 2.78 11.76 0.00 79 RELAYCOUNTRY_JP 2 2.78 11.76 0.00 80 RCVD_IN_MSPIKE_L4 2 2.78 11.76 0.00 81 TR_DCC_Bayes_99 2 2.78 11.76 0.00 82 HTML_FONT_SIZE_LARGE 2 2.78 11.76 0.00 83 XM_Body_Dirty_Words_02 1 1.39 5.88 0.00 84 TR_XM_MSPIKECOMBO2 1 1.39 5.88 0.00 85 T_TooManySym_01 1 11.11 5.88 12.73 86 RCVD_IN_PSBL 1 2.78 5.88 1.82 87 RDNS_DYNAMIC 1 1.39 5.88 0.00 88 TooManyTo_002 1 2.78 5.88 1.82 89 RCVD_IN_RP_RNBL 1 1.39 5.88 0.00 90 HTML_MIME_NO_HTML_TAG 1 2.78 5.88 1.82 91 VFY_ACCT_NORDNS 1 1.39 5.88 0.00 92 URIBL_DBL_SPAM 1 1.39 5.88 0.00 93 XMSubMetaSx_00 1 4.17 5.88 3.64 94 TooManyTo_003 1 2.78 5.88 1.82 95 NO_DNS_FOR_FROM 1 1.39 5.88 0.00 96 XMStrtUSub 1 9.72 5.88 10.91 97 TR_XM_DKIM_Undo 1 1.39 5.88 0.00 98 TR_XM_MaxWHORU 1 1.39 5.88 0.00 99 T_TooManySym_02 1 9.72 5.88 10.91 100 XMSexyCombo_05 1 1.39 5.88 0.00 101 XM_Body_Dirty_Words_01 1 1.39 5.88 0.00 102 SUBJ_OBFU_PUNCT_FEW 1 1.39 5.88 0.00 103 TR_XM_NoHeaderRelay 1 1.39 5.88 0.00 104 MAILING_LIST_MULTI 1 2.78 5.88 1.82 105 SpammyFromTLD_01 1 1.39 5.88 0.00 106 KHOP_HELO_FCRDNS 1 1.39 5.88 0.00 107 TR_Symld_Words 1 2.78 5.88 1.82 108 T_KAM_HTML_FONT_INVALID 1 15.28 5.88 18.18 109 BAYES_40 1 5.56 5.88 5.45 110 PDS_RDNS_DYNAMIC_FP 1 1.39 5.88 0.00 111 MIME_HTML_MOSTLY 1 1.39 5.88 0.00 112 TR_XM_UnparsRelay 1 5.56 5.88 5.45 113 TO_EQ_FM_DOM_HTML_ONLY 1 1.39 5.88 0.00 114 RCVD_IN_MSPIKE_L3 1 1.39 5.88 0.00 115 TooManyTo_004 1 2.78 5.88 1.82 116 XMSexyCombo_02 1 1.39 5.88 0.00 117 XM_B_SexDrugs1 1 1.39 5.88 0.00 118 TR_XM_MaxSPIKE 1 1.39 5.88 0.00 119 TR_XM_SPAMCOP 1 1.39 5.88 0.00 120 XM_UncommonTLD01 1 9.72 5.88 10.91 121 RCVD_IN_BL_SPAMCOP_NET 1 1.39 5.88 0.00 122 OBFU_TEXT_ATTACH 1 1.39 5.88 0.00 123 FROM_GOV_SPOOF 1 2.78 5.88 1.82 124 XMSexyCombo_01 1 2.78 5.88 1.82 125 XM_DIRTYINTL 1 1.39 5.88 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 46 75.00 47.06 83.64 2 T_SCC_BODY_TEXT_LINE 45 83.33 88.24 81.82 3 RELAYCOUNTRY_US 41 72.22 64.71 74.55 4 HTML_MESSAGE 40 77.78 94.12 72.73 5 DKIM_SIGNED 39 68.06 58.82 70.91 6 DKIM_VALID 37 65.28 58.82 67.27 7 XM_DK_Pass 37 65.28 58.82 67.27 8 XM_B_Unicode 32 62.50 76.47 58.18 9 DKIM_VALID_AU 31 52.78 41.18 56.36 10 BAYES_50 30 58.33 70.59 54.55 11 XM_B_SpammyWords 25 45.83 47.06 45.45 12 DKIM_VALID_EF 25 45.83 47.06 45.45 13 XMListUnsubscribeExists 21 36.11 29.41 38.18 14 XM_B_Unicode3 19 34.72 35.29 34.55 15 RCVD_IN_MSPIKE_WL 18 25.00 0.00 32.73 16 FVGT_m_MULTI_ODD 17 29.17 23.53 30.91 17 HTML_FONT_LOW_CONTRAST 14 23.61 17.65 25.45 18 ALL_TRUSTED 13 18.06 0.00 23.64 19 RCVD_IN_MSPIKE_H5 13 18.06 0.00 23.64 20 MIME_HTML_ONLY 13 31.94 58.82 23.64 21 XMSubLong 13 23.61 23.53 23.64 22 T_TM2_M_HEADER_IN_MSG 12 22.22 23.53 21.82 23 BAYES_60 12 16.67 0.00 21.82 24 XM_B_SpammyWords2 11 15.28 0.00 20.00 25 TR_XM_DK_Unsub 11 19.44 17.65 20.00 26 XM_Multi_Part_URI 11 22.22 29.41 20.00 27 T_KAM_HTML_FONT_INVALID 10 15.28 5.88 18.18 28 RCVD_IN_MSPIKE_H2 9 25.00 52.94 16.36 29 XM_DKIMWhitelistDomains 9 12.50 0.00 16.36 30 DCC_CHECK 9 25.00 52.94 16.36 31 XM_H_Long_From01 8 11.11 0.00 14.55 32 TR_XM_FormFill2 8 11.11 0.00 14.55 33 TR_XM_PHPDW 8 11.11 0.00 14.55 34 XM_H_PHPOS 8 11.11 0.00 14.55 35 TR_XM_PHPForged 8 11.11 0.00 14.55 36 UNPARSEABLE_RELAY 7 15.28 23.53 12.73 37 T_TooManySym_01 7 11.11 5.88 12.73 38 LOC_TINY_FONT_1 7 13.89 17.65 12.73 39 XM_UncommonTLD01 6 9.72 5.88 10.91 40 XM_SendGrid 6 12.50 17.65 10.91 41 T_TooManySym_02 6 9.72 5.88 10.91 42 XMStrtUSub 6 9.72 5.88 10.91 43 T_XMDrugObfuBody_14 6 8.33 0.00 10.91 44 FSL_BULK_SIG 5 11.11 17.65 9.09 45 TO_MALFORMED 5 6.94 0.00 9.09 46 XM_Body_Dirty_Words 5 11.11 17.65 9.09 47 INVALID_MSGID 5 6.94 0.00 9.09 48 USER_IN_WELCOMELIST 5 6.94 0.00 9.09 49 LotsOfNums_01 5 9.72 11.76 9.09 50 USER_IN_WHITELIST 5 6.94 0.00 9.09 51 XM_Evil_Numbers_Gen 4 5.56 0.00 7.27 52 RCVD_IN_MSPIKE_H3 4 5.56 0.00 7.27 53 TR_XM_DK_SendGrid 4 9.72 17.65 7.27 54 RCVD_IN_IADB_SPF 3 4.17 0.00 5.45 55 RCVD_IN_IADB_DK 3 4.17 0.00 5.45 56 TVD_SPACE_RATIO 3 4.17 0.00 5.45 57 RCVD_IN_IADB_SENDERID 3 4.17 0.00 5.45 58 BAYES_00 3 4.17 0.00 5.45 59 BAYES_40 3 5.56 5.88 5.45 60 BAYES_95 3 4.17 0.00 5.45 61 TR_XM_UnparsRelay 3 5.56 5.88 5.45 62 LOTS_OF_MONEY 3 4.17 0.00 5.45 63 RELAYCOUNTRY_META 3 12.50 35.29 5.45 64 XMBody_95 3 4.17 0.00 5.45 65 XMNumbers 3 4.17 0.00 5.45 66 TR_XM_SpammyWords4 3 4.17 0.00 5.45 67 RCVD_IN_IADB_LISTED 3 4.17 0.00 5.45 68 TooManyTo_001 3 6.94 11.76 5.45 69 USER_IN_DEF_DKIM_WL 3 4.17 0.00 5.45 70 XMGenDplmaNmb 2 2.78 0.00 3.64 71 NORDNS_LOW_CONTRAST 2 2.78 0.00 3.64 72 TR_XM_SpammyRelay 2 5.56 11.76 3.64 73 XMDiploma_00 2 2.78 0.00 3.64 74 T_TooManySym_03 2 2.78 0.00 3.64 75 XM_B_Phish66 2 2.78 0.00 3.64 76 XMBSHREFv2 2 2.78 0.00 3.64 77 TR_XM_DK_Bayes 2 2.78 0.00 3.64 78 HTML_FONT_TINY_NORDNS 2 2.78 0.00 3.64 79 TR_XM_DK_Bayes2 2 2.78 0.00 3.64 80 ANY_BOUNCE_MESSAGE 2 2.78 0.00 3.64 81 TM2_M_VERY_LONG_WORD 2 2.78 0.00 3.64 82 MIME_QP_LONG_LINE 2 5.56 11.76 3.64 83 TR_XM_BayesUnsub 2 9.72 29.41 3.64 84 SCC_BODY_URI_ONLY 2 2.78 0.00 3.64 85 FVGT_m_MULTI_ODD_EMAIL 2 2.78 0.00 3.64 86 BOUNCE_MESSAGE 2 2.78 0.00 3.64 87 DKIM_INVALID 2 2.78 0.00 3.64 88 RCVD_IN_IADB_OPTIN 2 2.78 0.00 3.64 89 TR_XM_PhishingBody 2 5.56 11.76 3.64 90 XMSubMetaSx_00 2 4.17 5.88 3.64 91 XM_B_Unsub 2 9.72 29.41 3.64 92 TR_XM_DK_Bayes1 2 2.78 0.00 3.64 93 RELAYCOUNTRY_NL 1 1.39 0.00 1.82 94 XM_ShortIntro_01 1 1.39 0.00 1.82 95 RCVD_IN_RP_CERTIFIED 1 1.39 0.00 1.82 96 XMGappySubj_01 1 1.39 0.00 1.82 97 HDRS_MISSP 1 1.39 0.00 1.82 98 TooManyTo_004 1 2.78 5.88 1.82 99 XMSubMetaSxObfu_03 1 1.39 0.00 1.82 100 RCVD_IN_MSPIKE_H4 1 1.39 0.00 1.82 101 XM_Body_Obfu01 1 1.39 0.00 1.82 102 URI_NOVOWEL 1 1.39 0.00 1.82 103 T_XMHurry_00 1 1.39 0.00 1.82 104 BAYES_99 1 6.94 23.53 1.82 105 XMSexyCombo_01 1 2.78 5.88 1.82 106 URI_DOTEDU 1 1.39 0.00 1.82 107 FROM_GOV_SPOOF 1 2.78 5.88 1.82 108 XM_UB60 1 1.39 0.00 1.82 109 BAYES_80 1 1.39 0.00 1.82 110 BAYES_05 1 1.39 0.00 1.82 111 XM_DK_Undo_02 1 5.56 17.65 1.82 112 XMHTML_After_End 1 1.39 0.00 1.82 113 HELO_NO_DOMAIN 1 1.39 0.00 1.82 114 XM_TLDProd2 1 1.39 0.00 1.82 115 XMReplyNow 1 1.39 0.00 1.82 116 TR_Symld_Words 1 2.78 5.88 1.82 117 T_Symld_Words_02 1 1.39 0.00 1.82 118 T_XMDrugObfuBody_00 1 1.39 0.00 1.82 119 UNTRUSTED_Relay 1 6.94 23.53 1.82 120 HELO_NODOT 1 1.39 0.00 1.82 121 BAYES_20 1 1.39 0.00 1.82 122 TVD_RCVD_IP 1 1.39 0.00 1.82 123 XMSlimDrugH 1 1.39 0.00 1.82 124 MSGID_NOFQDN1 1 1.39 0.00 1.82 125 T_REMOTE_IMAGE 1 1.39 0.00 1.82 126 INVALID_DATE 1 1.39 0.00 1.82 127 TR_Mismatch_TLD_02 1 1.39 0.00 1.82 128 HTML_IMAGE_RATIO_02 1 4.17 11.76 1.82 129 RCVD_IN_RP_SAFE 1 1.39 0.00 1.82 130 XM_Dr_From 1 1.39 0.00 1.82 131 TR_Mismatch_TLD_01 1 1.39 0.00 1.82 132 BAYES_999 1 4.17 11.76 1.82 133 RCVD_IN_IADB_VOUCHED 1 1.39 0.00 1.82 134 IN_ZIMBRA_NJ_WHITELIST 1 1.39 0.00 1.82 135 MAS_INFORMACION_ES 1 1.39 0.00 1.82 136 MAILING_LIST_MULTI 1 2.78 5.88 1.82 137 XM_B_Investor 1 1.39 0.00 1.82 138 RELAYCOUNTRY_CA 1 4.17 11.76 1.82 139 RCVD_IN_PSBL 1 2.78 5.88 1.82 140 BOTNET_IPINHOSTNAME 1 5.56 17.65 1.82 141 XM_B_SpammyTLD 1 1.39 0.00 1.82 142 TM2_M_URI_OPT_OUT 1 1.39 0.00 1.82 143 DOS_OUTLOOK_TO_MX 1 1.39 0.00 1.82 144 HTML_IMAGE_RATIO_08 1 1.39 0.00 1.82 145 TooManyTo_003 1 2.78 5.88 1.82 146 XMStockSpam_06 1 4.17 11.76 1.82 147 HTML_MIME_NO_HTML_TAG 1 2.78 5.88 1.82 148 XMLngstWrd_00 1 1.39 0.00 1.82 149 RELAYCOUNTRY_DE 1 1.39 0.00 1.82 150 TooManyTo_002 1 2.78 5.88 1.82 151 RCVD_IN_VALIDITY_SAFE 1 1.39 0.00 1.82 ----------------------------------------------------------------------