Email: 197 Autolearn: 0 AvgScore: 1.66 AvgScanTime: 1.90 sec Spam: 33 Autolearn: 0 AvgScore: 14.09 AvgScanTime: 1.78 sec Ham: 164 Autolearn: 0 AvgScore: -0.84 AvgScanTime: 1.92 sec Time Spent Running SA: 0.10 hours Time Spent Processing Spam: 0.02 hours Time Spent Processing Ham: 0.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 30 87.31 90.91 86.59 2 T_SCC_BODY_TEXT_LINE 28 84.26 84.85 84.15 3 RELAYCOUNTRY_US 28 49.75 84.85 42.68 4 XM_B_Unicode 26 44.16 78.79 37.20 5 DKIM_SIGNED 26 46.70 78.79 40.24 6 XM_DK_Pass 26 46.19 78.79 39.63 7 DKIM_VALID 26 45.18 78.79 38.41 8 XM_B_SpammyWords 24 61.42 72.73 59.15 9 DKIM_VALID_AU 22 37.56 66.67 31.71 10 DCC_CHECK 18 25.89 54.55 20.12 11 DKIM_VALID_EF 18 26.90 54.55 21.34 12 XMListUnsubscribeExists 16 25.89 48.48 21.34 13 DCC_CHECK_NEGATIVE 15 74.11 45.45 79.88 14 T_KAM_HTML_FONT_INVALID 15 14.72 45.45 8.54 15 BAYES_50 15 45.18 45.45 45.12 16 XM_B_Unicode3 14 24.87 42.42 21.34 17 FVGT_m_MULTI_ODD 13 16.75 39.39 12.20 18 XM_DK_Undo_02 12 7.61 36.36 1.83 19 XM_B_Unsub 12 11.17 36.36 6.10 20 UNPARSEABLE_RELAY 12 9.64 36.36 4.27 21 TR_XM_BayesUnsub 12 10.66 36.36 5.49 22 BAYES_99 12 7.11 36.36 1.22 23 XM_B_SpammyWords2 11 11.68 33.33 7.32 24 RCVD_IN_MSPIKE_H2 10 11.17 30.30 7.32 25 TR_XM_UnparsRelay 9 5.58 27.27 1.22 26 LOC_TINY_FONT_1 9 11.17 27.27 7.93 27 TR_XM_DKIM_Undo 9 4.57 27.27 0.00 28 TR_XM_DK_Unsub 8 11.68 24.24 9.15 29 MIME_HTML_ONLY 8 16.24 24.24 14.63 30 XM_Multi_Part_URI 8 9.64 24.24 6.71 31 RCVD_IN_MSPIKE_WL 8 21.32 24.24 20.73 32 TR_DCC_Bayes_99 8 4.06 24.24 0.00 33 HTML_FONT_LOW_CONTRAST 7 15.74 21.21 14.63 34 BAYES_999 6 4.06 18.18 1.22 35 XM_Body_Dirty_Words 6 11.68 18.18 10.37 36 XM_B_SpammyTLD 6 5.08 18.18 2.44 37 PDS_OTHER_BAD_TLD 6 3.05 18.18 0.00 38 LOTS_OF_MONEY 6 10.15 18.18 8.54 39 FSL_BULK_SIG 6 12.69 18.18 11.59 40 T_TM2_M_HEADER_IN_MSG 6 11.68 18.18 10.37 41 TR_XM_SpammyWords4 5 3.05 15.15 0.61 42 TR_XM_Undi_Recip11 5 2.54 15.15 0.00 43 XM_H_Undi_Recip 5 2.54 15.15 0.00 44 XM_B_SpammyWords3 5 5.08 15.15 3.05 45 UNSUB_GOOG_FORM 5 2.54 15.15 0.00 46 XM_DK_Undo_01 5 3.05 15.15 0.61 47 BOTNET_IPINHOSTNAME 4 4.57 12.12 3.05 48 TR_MRelay_UG 4 2.03 12.12 0.00 49 XM_UncommonTLD01 4 11.68 12.12 11.59 50 XMSubLong 4 17.77 12.12 18.90 51 RDNS_DYNAMIC 4 3.05 12.12 1.22 52 RCVD_IN_MSPIKE_H3 4 9.64 12.12 9.15 53 XM_H_Long_From01 4 6.09 12.12 4.88 54 PDS_RDNS_DYNAMIC_FP 4 2.03 12.12 0.00 55 TR_XM_Undi_Recip6 4 2.03 12.12 0.00 56 RELAYCOUNTRY_META 4 4.06 12.12 2.44 57 KHOP_HELO_FCRDNS 4 3.55 12.12 1.83 58 BAYES_80 3 2.54 9.09 1.22 59 TR_LOTS_OF_MONEY2 3 1.52 9.09 0.00 60 HTML_IMAGE_RATIO_06 3 2.03 9.09 0.61 61 T_MONEY_PERCENT 3 1.52 9.09 0.00 62 XM_Body_Dirty_Words_01 3 1.52 9.09 0.00 63 TR_XM_SpammyWords2 3 1.52 9.09 0.00 64 RCVD_IN_MSPIKE_H5 3 9.14 9.09 9.15 65 UNTRUSTED_Relay 3 3.55 9.09 2.44 66 XM_SendGrid 3 3.05 9.09 1.83 67 XM_URI_RBL 2 1.02 6.06 0.00 68 T_FILL_THIS_FORM_SHORT 2 1.02 6.06 0.00 69 XM_B_SexDrugs2 2 1.02 6.06 0.00 70 XM_Body_Dirty_Words_03 2 1.02 6.06 0.00 71 TR_XM_PHPDW 2 1.52 6.06 0.61 72 XM_B_Investor 2 1.02 6.06 0.00 73 XM_Evil_Numbers_Gen 2 3.05 6.06 2.44 74 URIBL_DBL_SPAM 2 1.52 6.06 0.61 75 TVD_RCVD_IP 2 1.02 6.06 0.00 76 SpammyFromTLD_01 2 5.58 6.06 5.49 77 XM_B_Phish_Phrases 2 2.03 6.06 1.22 78 BODY_ENHANCEMENT2 2 1.02 6.06 0.00 79 XM_Body_Dirty_Words_02 2 1.02 6.06 0.00 80 XM_CamelCaseFrm001 2 1.02 6.06 0.00 81 XMStockSpam_06 2 1.02 6.06 0.00 82 XM_B_SexDrugs1 2 1.02 6.06 0.00 83 T_XMDrugObfuBody_00 2 1.02 6.06 0.00 84 TO_NO_BRKTS_HTML_IMG 2 1.52 6.06 0.61 85 XMNoVowels 2 1.52 6.06 0.61 86 TR_XM_FormFill2 2 1.52 6.06 0.61 87 HTML_MIME_NO_HTML_TAG 2 4.06 6.06 3.66 88 MIME_HTML_MOSTLY 2 3.05 6.06 2.44 89 XM_H_PHPOS 2 1.52 6.06 0.61 90 BAYES_60 2 6.09 6.06 6.10 91 TR_XM_NoHeaderRelay 2 1.02 6.06 0.00 92 TR_XM_PHPForged 2 1.52 6.06 0.61 93 XMStrtUSub 2 3.05 6.06 2.44 94 MPART_ALT_DIFF 2 2.54 6.06 1.83 95 MISSING_HEADERS 1 0.51 3.03 0.00 96 FROM_SUSPICIOUS_NTLD 1 0.51 3.03 0.00 97 XMNumbers 1 4.57 3.03 4.88 98 RCVD_IN_MSPIKE_H4 1 2.54 3.03 2.44 99 RCVD_IN_MSPIKE_L3 1 1.02 3.03 0.61 100 XM_OfRef6 1 0.51 3.03 0.00 101 TR_XM_SpammyRelay 1 0.51 3.03 0.00 102 XM_B_SpammyWords4 1 0.51 3.03 0.00 103 TooManyTo_001 1 6.09 3.03 6.71 104 XMIncMoney 1 0.51 3.03 0.00 105 XMSexyCombo_02 1 0.51 3.03 0.00 106 TooManyTo_004 1 1.02 3.03 0.61 107 XM_H_PHPMailer 1 0.51 3.03 0.00 108 XMSexyCombo_05 1 4.57 3.03 4.88 109 RCVD_IN_PSBL 1 0.51 3.03 0.00 110 XM_DIRTYINTL 1 0.51 3.03 0.00 111 RELAYCOUNTRY_CA 1 0.51 3.03 0.00 112 XM_UB50 1 2.54 3.03 2.44 113 XM_UB60 1 0.51 3.03 0.00 114 XMSexyCombo_01 1 0.51 3.03 0.00 115 URI_NOVOWEL 1 1.02 3.03 0.61 116 FROM_SUSPICIOUS_NTLD_FP 1 0.51 3.03 0.00 117 TM2_M_OBFU_COMMENT 1 0.51 3.03 0.00 118 REPLYTO_WITHOUT_TO_CC 1 0.51 3.03 0.00 119 XMLongAddy 1 0.51 3.03 0.00 120 BOTNET 1 1.02 3.03 0.61 121 XM_UB99 1 0.51 3.03 0.00 122 FROM_OFFERS 1 0.51 3.03 0.00 123 RELAYCOUNTRY_RU 1 0.51 3.03 0.00 124 SHOPIFY_IMG_NOT_RCVD_SFY 1 0.51 3.03 0.00 125 XM_Body_Obfu01 1 0.51 3.03 0.00 126 DYN_RDNS_AND_INLINE_IMAGE 1 0.51 3.03 0.00 127 HTML_IMAGE_ONLY_32 1 0.51 3.03 0.00 128 OBFU_TEXT_ATTACH 1 0.51 3.03 0.00 129 RCVD_IN_VALIDITY_SAFE 1 1.52 3.03 1.22 130 BAYES_95 1 2.03 3.03 1.83 131 FROM_EXCESS_BASE64 1 2.03 3.03 1.83 132 TooManyTo_003 1 1.02 3.03 0.61 133 TM2_M_URI_OPT_OUT 1 32.99 3.03 39.02 134 RELAYCOUNTRY_FR 1 2.03 3.03 1.83 135 RELAYCOUNTRY_AU 1 0.51 3.03 0.00 136 TooManyTo_002 1 1.02 3.03 0.61 137 TR_XM_MSPIKECOMBO 1 1.02 3.03 0.61 138 T_XMDrugObfuBody_01 1 0.51 3.03 0.00 139 XMSubMetaSx_00 1 2.03 3.03 1.83 140 XMSexyCombo_04 1 0.51 3.03 0.00 141 SpammyFromTLD_02 1 1.52 3.03 1.22 142 RCVD_IN_MSPIKE_BL 1 1.02 3.03 0.61 143 HTML_IMAGE_RATIO_02 1 3.55 3.03 3.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142 87.31 90.91 86.59 2 T_SCC_BODY_TEXT_LINE 138 84.26 84.85 84.15 3 DCC_CHECK_NEGATIVE 131 74.11 45.45 79.88 4 XM_B_SpammyWords 97 61.42 72.73 59.15 5 ALL_TRUSTED 90 45.69 0.00 54.88 6 BAYES_50 74 45.18 45.45 45.12 7 RELAYCOUNTRY_US 70 49.75 84.85 42.68 8 DKIM_SIGNED 66 46.70 78.79 40.24 9 XM_DK_Pass 65 46.19 78.79 39.63 10 TM2_M_URI_OPT_OUT 64 32.99 3.03 39.02 11 DKIM_VALID 63 45.18 78.79 38.41 12 MIME_QP_LONG_LINE 62 31.47 0.00 37.80 13 SHORT_URI_2 61 30.96 0.00 37.20 14 XMSubNoVowel 61 30.96 0.00 37.20 15 XMSubEmpty 61 30.96 0.00 37.20 16 XM_B_Unicode 61 44.16 78.79 37.20 17 DKIM_VALID_AU 52 37.56 66.67 31.71 18 BAYES_00 48 24.37 0.00 29.27 19 XM_B_Unicode3 35 24.87 42.42 21.34 20 DKIM_VALID_EF 35 26.90 54.55 21.34 21 XMListUnsubscribeExists 35 25.89 48.48 21.34 22 RCVD_IN_MSPIKE_WL 34 21.32 24.24 20.73 23 DCC_CHECK 33 25.89 54.55 20.12 24 XMSubLong 31 17.77 12.12 18.90 25 HTML_FONT_LOW_CONTRAST 24 15.74 21.21 14.63 26 MIME_HTML_ONLY 24 16.24 24.24 14.63 27 FVGT_m_MULTI_ODD 20 16.75 39.39 12.20 28 XM_UncommonTLD01 19 11.68 12.12 11.59 29 FSL_BULK_SIG 19 12.69 18.18 11.59 30 XM_Body_Dirty_Words 17 11.68 18.18 10.37 31 T_TM2_M_HEADER_IN_MSG 17 11.68 18.18 10.37 32 XM_DKIMWhitelistDomains 17 8.63 0.00 10.37 33 TR_XM_DK_Unsub 15 11.68 24.24 9.15 34 RCVD_IN_MSPIKE_H5 15 9.14 9.09 9.15 35 RCVD_IN_MSPIKE_H3 15 9.64 12.12 9.15 36 BAYES_05 14 7.11 0.00 8.54 37 LOTS_OF_MONEY 14 10.15 18.18 8.54 38 T_KAM_HTML_FONT_INVALID 14 14.72 45.45 8.54 39 LOC_TINY_FONT_1 13 11.17 27.27 7.93 40 T_TooManySym_01 12 6.09 0.00 7.32 41 LotsOfNums_01 12 6.09 0.00 7.32 42 RCVD_IN_MSPIKE_H2 12 11.17 30.30 7.32 43 XM_B_SpammyWords2 12 11.68 33.33 7.32 44 TooManyTo_001 11 6.09 3.03 6.71 45 XM_Multi_Part_URI 11 9.64 24.24 6.71 46 XM_B_Unsub 10 11.17 36.36 6.10 47 BAYES_60 10 6.09 6.06 6.10 48 TR_XM_DK_Bayes1 9 4.57 0.00 5.49 49 HTML_IMAGE_RATIO_04 9 4.57 0.00 5.49 50 T_TooManySym_02 9 4.57 0.00 5.49 51 SpammyFromTLD_01 9 5.58 6.06 5.49 52 TR_XM_DK_Bayes 9 4.57 0.00 5.49 53 TR_XM_DK_Bayes2 9 4.57 0.00 5.49 54 TR_XM_BayesUnsub 9 10.66 36.36 5.49 55 MSGID_FROM_MTA_HEADER 8 4.06 0.00 4.88 56 SHORT_URI_3 8 4.06 0.00 4.88 57 XMNumbers 8 4.57 3.03 4.88 58 XMSexyCombo_05 8 4.57 3.03 4.88 59 XM_H_Long_From01 8 6.09 12.12 4.88 60 SHORTENED_URL_HREF 8 4.06 0.00 4.88 61 BAYES_40 8 4.06 0.00 4.88 62 BOUNCE_MESSAGE 7 3.55 0.00 4.27 63 UNPARSEABLE_RELAY 7 9.64 36.36 4.27 64 IN_ZIMBRA_NJ_WHITELIST 7 3.55 0.00 4.27 65 ANY_BOUNCE_MESSAGE 7 3.55 0.00 4.27 66 INVALID_MSGID 6 3.05 0.00 3.66 67 HTML_IMAGE_RATIO_02 6 3.55 3.03 3.66 68 HTML_MIME_NO_HTML_TAG 6 4.06 6.06 3.66 69 SHORTENER_SHORT_SUBJ 6 3.05 0.00 3.66 70 USER_IN_DEF_DKIM_WL 6 3.05 0.00 3.66 71 XM_B_SpammyWords3 5 5.08 15.15 3.05 72 TO_MALFORMED 5 2.54 0.00 3.05 73 BOTNET_IPINHOSTNAME 5 4.57 12.12 3.05 74 RCVD_IN_MSPIKE_H4 4 2.54 3.03 2.44 75 MIME_HTML_MOSTLY 4 3.05 6.06 2.44 76 UNTRUSTED_Relay 4 3.55 9.09 2.44 77 XM_B_SpammyTLD 4 5.08 18.18 2.44 78 XM_UB50 4 2.54 3.03 2.44 79 XM_Evil_Numbers_Gen 4 3.05 6.06 2.44 80 XM_ZIP 4 2.03 0.00 2.44 81 XMStrtUSub 4 3.05 6.06 2.44 82 RELAYCOUNTRY_META 4 4.06 12.12 2.44 83 DKIM_INVALID 3 1.52 0.00 1.83 84 SCC_BODY_URI_ONLY 3 1.52 0.00 1.83 85 XMGappySubj_01 3 1.52 0.00 1.83 86 BAYES_20 3 1.52 0.00 1.83 87 KHOP_HELO_FCRDNS 3 3.55 12.12 1.83 88 TVD_SPACE_RATIO 3 1.52 0.00 1.83 89 HTML_FONT_FACE_BAD 3 1.52 0.00 1.83 90 MSGID_NOFQDN1 3 1.52 0.00 1.83 91 XM_DK_Undo_02 3 7.61 36.36 1.83 92 FROM_EXCESS_BASE64 3 2.03 3.03 1.83 93 BAYES_95 3 2.03 3.03 1.83 94 XM_SendGrid 3 3.05 9.09 1.83 95 RELAYCOUNTRY_FR 3 2.03 3.03 1.83 96 T_REMOTE_IMAGE 3 1.52 0.00 1.83 97 WEIRD_PORT 3 1.52 0.00 1.83 98 XM_B_Unsub2 3 1.52 0.00 1.83 99 MPART_ALT_DIFF 3 2.54 6.06 1.83 100 XMSubMetaSx_00 3 2.03 3.03 1.83 101 FROM_GOV_SPOOF 3 1.52 0.00 1.83 102 XM_B_Phish_Phrases 2 2.03 6.06 1.22 103 XM_Dr_From 2 1.02 0.00 1.22 104 TR_XM_SpoofPhishAttach 2 1.02 0.00 1.22 105 RDNS_DYNAMIC 2 3.05 12.12 1.22 106 XM_H_Long_From02 2 1.02 0.00 1.22 107 BAYES_999 2 4.06 18.18 1.22 108 XM_ZohoDesk1 2 1.02 0.00 1.22 109 BAYES_99 2 7.11 36.36 1.22 110 TR_XM_UnparsRelay 2 5.58 27.27 1.22 111 TR_XM_PSC1 2 1.02 0.00 1.22 112 XMSolicitRefs_0 2 1.02 0.00 1.22 113 RCVD_IN_VALIDITY_SAFE 2 1.52 3.03 1.22 114 T_XMDrugObfuBody_14 2 1.02 0.00 1.22 115 IN_HORDE_ADDRESS_BOOK 2 1.02 0.00 1.22 116 NUMERIC_HTTP_ADDR 2 1.02 0.00 1.22 117 XM_H_SpoofStaff4 2 1.02 0.00 1.22 118 RCVD_IN_RP_SAFE 2 1.02 0.00 1.22 119 XMLngstWrd_00 2 1.02 0.00 1.22 120 RCVD_IN_VALIDITY_CERTIFIED 2 1.02 0.00 1.22 121 BAYES_80 2 2.54 9.09 1.22 122 TR_XM_SpoofStaff 2 1.02 0.00 1.22 123 TM2_M_VERY_LONG_WORD 2 1.02 0.00 1.22 124 TR_XM_DK_SendGrid 2 1.02 0.00 1.22 125 HTML_SHORT_LINK_IMG_3 2 1.02 0.00 1.22 126 XMSpoofStaff2 2 1.02 0.00 1.22 127 SpammyFromTLD_02 2 1.52 3.03 1.22 128 RCVD_IN_RP_CERTIFIED 2 1.02 0.00 1.22 129 TR_XM_SpammyWords5 2 1.02 0.00 1.22 130 HTML_IMAGE_ONLY_16 2 1.02 0.00 1.22 131 TR_XM_PhishingBody 2 1.02 0.00 1.22 132 DKIM_ADSP_CUSTOM_MED 1 0.51 0.00 0.61 133 XM_PDF 1 0.51 0.00 0.61 134 XMPhish14 1 0.51 0.00 0.61 135 NO_DNS_FOR_FROM 1 0.51 0.00 0.61 136 NML_ADSP_CUSTOM_MED 1 0.51 0.00 0.61 137 XMLngstWrd_04 1 0.51 0.00 0.61 138 HTML_IMAGE_ONLY_20 1 0.51 0.00 0.61 139 RCVD_IN_MSPIKE_L3 1 1.02 3.03 0.61 140 MAILING_LIST_MULTI 1 0.51 0.00 0.61 141 XM_S_SubURI 1 0.51 0.00 0.61 142 DKIM_ADSP_NXDOMAIN 1 0.51 0.00 0.61 143 URI_HEX 1 0.51 0.00 0.61 144 TR_XM_SpammyWords4 1 3.05 15.15 0.61 145 HDRS_MISSP 1 0.51 0.00 0.61 146 TR_XM_PHPDW 1 1.52 6.06 0.61 147 RCVD_IN_IADB_SENDERID 1 0.51 0.00 0.61 148 RCVD_IN_IADB_OPTIN 1 0.51 0.00 0.61 149 USER_IN_WHITELIST 1 0.51 0.00 0.61 150 TR_XM_PHPForged 1 1.52 6.06 0.61 151 XM_B_Phish66 1 0.51 0.00 0.61 152 XM_DK_Undo_01 1 3.05 15.15 0.61 153 RCVD_IN_MSPIKE_BL 1 1.02 3.03 0.61 154 XMNoVowels 1 1.52 6.06 0.61 155 XM_H_CodeIgniter 1 0.51 0.00 0.61 156 T_TooManySym_03 1 0.51 0.00 0.61 157 RELAYCOUNTRY_DE 1 0.51 0.00 0.61 158 RCVD_DOTEDU_SHORT 1 0.51 0.00 0.61 159 XMLngstWrd_03 1 0.51 0.00 0.61 160 HTML_FONT_SIZE_LARGE 1 0.51 0.00 0.61 161 TR_XM_FormFill2 1 1.52 6.06 0.61 162 TooManyTo_005 1 0.51 0.00 0.61 163 XMHTML_After_End 1 0.51 0.00 0.61 164 XM_Ancestry_Forge 1 0.51 0.00 0.61 165 XMLngstWrd_02 1 0.51 0.00 0.61 166 XMSubMetaSxObfu_03 1 0.51 0.00 0.61 167 RCVD_IN_IADB_LISTED 1 0.51 0.00 0.61 168 XMFunnyHTTP 1 0.51 0.00 0.61 169 HTML_IMAGE_ONLY_24 1 0.51 0.00 0.61 170 XMLngstWrd_01 1 0.51 0.00 0.61 171 URI_NOVOWEL 1 1.02 3.03 0.61 172 XMHTMLBadTable_001 1 0.51 0.00 0.61 173 RCVD_IN_IADB_DK 1 0.51 0.00 0.61 174 TR_Symld_Words 1 0.51 0.00 0.61 175 XM_USANA_RCVD 1 0.51 0.00 0.61 176 URIBL_DBL_SPAM 1 1.52 6.06 0.61 177 RCVD_IN_IADB_VOUCHED 1 0.51 0.00 0.61 178 TooManyTo_004 1 1.02 3.03 0.61 179 HTML_IMAGE_RATIO_06 1 2.03 9.09 0.61 180 TooManyTo_003 1 1.02 3.03 0.61 181 RCVD_IN_IADB_SPF 1 0.51 0.00 0.61 182 XMBody_95 1 0.51 0.00 0.61 183 TR_XM_MSPIKECOMBO 1 1.02 3.03 0.61 184 TooManyTo_002 1 1.02 3.03 0.61 185 CTE_8BIT_MISMATCH 1 0.51 0.00 0.61 186 BOTNET 1 1.02 3.03 0.61 187 XMSubject_78 1 0.51 0.00 0.61 188 TO_NO_BRKTS_HTML_IMG 1 1.52 6.06 0.61 189 USER_IN_WELCOMELIST 1 0.51 0.00 0.61 190 XM_H_PHPOS 1 1.52 6.06 0.61 ----------------------------------------------------------------------