Email: 128 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 1.67 sec Spam: 23 Autolearn: 0 AvgScore: 12.83 AvgScanTime: 2.07 sec Ham: 105 Autolearn: 0 AvgScore: -4.08 AvgScanTime: 1.58 sec Time Spent Running SA: 0.06 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 23 82.81 100.00 79.05 2 XM_DK_Pass 21 78.91 91.30 76.19 3 DKIM_VALID 21 78.12 91.30 75.24 4 DKIM_SIGNED 21 82.81 91.30 80.95 5 DKIM_VALID_AU 20 60.94 86.96 55.24 6 XMListUnsubscribeExists 20 46.88 86.96 38.10 7 XM_B_Unicode 20 54.69 86.96 47.62 8 RELAYCOUNTRY_US 19 84.38 82.61 84.76 9 T_SCC_BODY_TEXT_LINE 16 76.56 69.57 78.10 10 XM_B_SpammyWords 15 38.28 65.22 32.38 11 T_KAM_HTML_FONT_INVALID 13 23.44 56.52 16.19 12 XM_B_Unicode3 12 38.28 52.17 35.24 13 FVGT_m_MULTI_ODD 12 24.22 52.17 18.10 14 DCC_CHECK 12 23.44 52.17 17.14 15 XM_Body_Dirty_Words 11 18.75 47.83 12.38 16 DCC_CHECK_NEGATIVE 11 76.56 47.83 82.86 17 XM_Multi_Part_URI 10 18.75 43.48 13.33 18 BAYES_50 10 57.81 43.48 60.95 19 XMSubLong 10 29.69 43.48 26.67 20 LOC_TINY_FONT_1 10 31.25 43.48 28.57 21 HTML_FONT_LOW_CONTRAST 9 25.00 39.13 21.90 22 XM_DK_Undo_02 8 7.81 34.78 1.90 23 XMSubMetaSx_00 7 7.03 30.43 1.90 24 DKIM_VALID_EF 7 35.94 30.43 37.14 25 MIME_HTML_ONLY 7 28.91 30.43 28.57 26 XM_B_SpammyWords2 7 17.19 30.43 14.29 27 BAYES_99 7 7.03 30.43 1.90 28 TR_XM_DKIM_Undo 7 6.25 30.43 0.95 29 HTML_IMAGE_RATIO_02 6 5.47 26.09 0.95 30 BAYES_999 6 5.47 26.09 0.95 31 TR_XM_DK_Unsub 6 12.50 26.09 9.52 32 RCVD_IN_MSPIKE_WL 5 21.88 21.74 21.90 33 T_TM2_M_HEADER_IN_MSG 5 27.34 21.74 28.57 34 XMDiploma_00 4 3.91 17.39 0.95 35 XMGenDplmaNmb 4 3.91 17.39 0.95 36 RELAYCOUNTRY_CA 4 3.12 17.39 0.00 37 RELAYCOUNTRY_META 4 8.59 17.39 6.67 38 RCVD_IN_MSPIKE_H5 4 13.28 17.39 12.38 39 BOTNET_IPINHOSTNAME 4 10.16 17.39 8.57 40 XM_B_SpammyWords3 4 7.03 17.39 4.76 41 RCVD_IN_MSPIKE_H2 4 17.97 17.39 18.10 42 XMNumbers 3 5.47 13.04 3.81 43 XMSexyCombo_05 3 7.81 13.04 6.67 44 XM_Body_Dirty_Words_01 3 3.12 13.04 0.95 45 RCVD_IN_PSBL 3 2.34 13.04 0.00 46 XM_B_SpammyWords4 3 2.34 13.04 0.00 47 BAYES_80 3 6.25 13.04 4.76 48 XMSexyCombo_01 3 2.34 13.04 0.00 49 TR_XM_SpammyWords2 3 3.12 13.04 0.95 50 TR_XM_PhishingBody 3 5.47 13.04 3.81 51 XM_DIRTYINTL 3 3.12 13.04 0.95 52 FIN_FREE 3 2.34 13.04 0.00 53 TR_XM_SpammyRelay 3 3.91 13.04 1.90 54 XM_DK_Undo_01 3 2.34 13.04 0.00 55 XMBody_78 2 1.56 8.70 0.00 56 XM_UncommonTLD01 2 8.59 8.70 8.57 57 TR_XM_BayesUnsub 2 3.91 8.70 2.86 58 UNPARSEABLE_RELAY 2 17.97 8.70 20.00 59 XM_H_Long_From02 2 3.91 8.70 2.86 60 TR_XM_MSPIKECOMBO 2 2.34 8.70 0.95 61 MPART_ALT_DIFF 2 7.81 8.70 7.62 62 RCVD_IN_MSPIKE_BL 2 2.34 8.70 0.95 63 XM_B_Unsub 2 3.91 8.70 2.86 64 XM_GoogleGroups2 2 1.56 8.70 0.00 65 XMStrtUSub 2 4.69 8.70 3.81 66 BAYES_60 2 7.81 8.70 7.62 67 RCVD_IN_BL_SPAMCOP_NET 2 1.56 8.70 0.00 68 XM_GoogleGroups 2 2.34 8.70 0.95 69 TooManyTo_001 2 7.03 8.70 6.67 70 XMSexyCombo_02 2 1.56 8.70 0.00 71 TR_DCC_Bayes_99 2 1.56 8.70 0.00 72 HTML_IMAGE_RATIO_04 2 11.72 8.70 12.38 73 INVALID_DATE 1 0.78 4.35 0.00 74 XMPhish30 1 0.78 4.35 0.00 75 RCVD_IN_MSPIKE_L4 1 0.78 4.35 0.00 76 FROM_LOCAL_DIGITS 1 0.78 4.35 0.00 77 XMGappySubj_02 1 0.78 4.35 0.00 78 MIME_QP_LONG_LINE 1 6.25 4.35 6.67 79 SORTED_RECIPS 1 0.78 4.35 0.00 80 TR_XM_SpammyWords5 1 2.34 4.35 1.90 81 TM2_M_HAS_BSLASH_URI 1 0.78 4.35 0.00 82 TR_XM_SpammyWords4 1 2.34 4.35 1.90 83 XMSubMetaD_03 1 0.78 4.35 0.00 84 TooManyTo_002 1 4.69 4.35 4.76 85 URI_HEX 1 0.78 4.35 0.00 86 SUSPICIOUS_RECIPS 1 0.78 4.35 0.00 87 FSL_BULK_SIG 1 7.03 4.35 7.62 88 TooManyTo_003 1 3.12 4.35 2.86 89 TR_XM_UnparsRelay 1 0.78 4.35 0.00 90 XM_B_Investor 1 0.78 4.35 0.00 91 UNTRUSTED_Relay 1 1.56 4.35 0.95 92 XMSubMetaI_00 1 1.56 4.35 0.95 93 XMGappySubj_01 1 1.56 4.35 0.95 94 LotsOfNums_01 1 4.69 4.35 4.76 95 LOTS_OF_MONEY 1 4.69 4.35 4.76 96 XMBody_17 1 0.78 4.35 0.00 97 BAYES_95 1 1.56 4.35 0.95 98 MIME_HTML_MOSTLY 1 2.34 4.35 1.90 99 XMSexyCombo_04 1 0.78 4.35 0.00 100 TooManyTo_005 1 0.78 4.35 0.00 101 HTML_FONT_TINY_NORDNS 1 0.78 4.35 0.00 102 RCVD_IN_MSPIKE_L3 1 1.56 4.35 0.95 103 BOGUS_MIME_VERSION 1 0.78 4.35 0.00 104 FROM_LOCAL_HEX 1 0.78 4.35 0.00 105 TVD_RCVD_IP 1 0.78 4.35 0.00 106 TR_XM_RelayPhish 1 0.78 4.35 0.00 107 XM_Nigeria_01 1 0.78 4.35 0.00 108 TR_XM_SEO4 1 1.56 4.35 0.95 109 HTML_EXTRA_CLOSE 1 0.78 4.35 0.00 110 XM_B_Phish66 1 3.91 4.35 3.81 111 FORGED_RELAY_MUA_TO_MX 1 0.78 4.35 0.00 112 RCVD_IN_MSPIKE_H3 1 6.25 4.35 6.67 113 XM_B_SEO 1 1.56 4.35 0.95 114 XM_UB60 1 0.78 4.35 0.00 115 TR_XM_NoHeaderRelay 1 0.78 4.35 0.00 116 XM_OfRef7 1 0.78 4.35 0.00 117 TooManyTo_004 1 0.78 4.35 0.00 118 XM_B_Phish_Phrases 1 1.56 4.35 0.95 119 XMSubPhish11 1 2.34 4.35 1.90 120 TR_XM_SB_Phish 1 2.34 4.35 1.90 121 XMSubMetaI_01 1 0.78 4.35 0.00 122 XMPhish11 1 0.78 4.35 0.00 123 XM_OfRef6 1 3.91 4.35 3.81 124 BOTNET 1 0.78 4.35 0.00 125 NORDNS_LOW_CONTRAST 1 0.78 4.35 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 89 84.38 82.61 84.76 2 DCC_CHECK_NEGATIVE 87 76.56 47.83 82.86 3 DKIM_SIGNED 85 82.81 91.30 80.95 4 HTML_MESSAGE 83 82.81 100.00 79.05 5 T_SCC_BODY_TEXT_LINE 82 76.56 69.57 78.10 6 XM_DK_Pass 80 78.91 91.30 76.19 7 DKIM_VALID 79 78.12 91.30 75.24 8 BAYES_50 64 57.81 43.48 60.95 9 DKIM_VALID_AU 58 60.94 86.96 55.24 10 XM_B_Unicode 50 54.69 86.96 47.62 11 XMListUnsubscribeExists 40 46.88 86.96 38.10 12 DKIM_VALID_EF 39 35.94 30.43 37.14 13 XM_B_Unicode3 37 38.28 52.17 35.24 14 XM_B_SpammyWords 34 38.28 65.22 32.38 15 MIME_HTML_ONLY 30 28.91 30.43 28.57 16 T_TM2_M_HEADER_IN_MSG 30 27.34 21.74 28.57 17 LOC_TINY_FONT_1 30 31.25 43.48 28.57 18 XMSubLong 28 29.69 43.48 26.67 19 HTML_FONT_LOW_CONTRAST 23 25.00 39.13 21.90 20 RCVD_IN_MSPIKE_WL 23 21.88 21.74 21.90 21 XM_DKIMWhitelistDomains 22 17.19 0.00 20.95 22 UNPARSEABLE_RELAY 21 17.97 8.70 20.00 23 RCVD_IN_MSPIKE_H2 19 17.97 17.39 18.10 24 FVGT_m_MULTI_ODD 19 24.22 52.17 18.10 25 DCC_CHECK 18 23.44 52.17 17.14 26 T_KAM_HTML_FONT_INVALID 17 23.44 56.52 16.19 27 XM_SendGrid 15 11.72 0.00 14.29 28 BAYES_00 15 11.72 0.00 14.29 29 XM_B_SpammyWords2 15 17.19 30.43 14.29 30 XM_Multi_Part_URI 14 18.75 43.48 13.33 31 XM_PDF 13 10.16 0.00 12.38 32 RCVD_IN_MSPIKE_H5 13 13.28 17.39 12.38 33 XM_Body_Dirty_Words 13 18.75 47.83 12.38 34 HTML_IMAGE_RATIO_04 13 11.72 8.70 12.38 35 IN_ZIMBRA_NJ_WHITELIST 13 10.16 0.00 12.38 36 TR_XM_DK_SendGrid 12 9.38 0.00 11.43 37 ALL_TRUSTED 12 9.38 0.00 11.43 38 XM_H_Long_From01 12 9.38 0.00 11.43 39 USER_IN_DEF_DKIM_WL 11 8.59 0.00 10.48 40 T_TooManySym_01 11 8.59 0.00 10.48 41 TR_XM_DK_Bayes1 11 8.59 0.00 10.48 42 TR_XM_DK_Bayes 11 8.59 0.00 10.48 43 TR_XM_DK_Unsub 10 12.50 26.09 9.52 44 XM_UncommonTLD01 9 8.59 8.70 8.57 45 TR_XM_DK_Bayes2 9 7.03 0.00 8.57 46 BAYES_40 9 7.03 0.00 8.57 47 BOTNET_IPINHOSTNAME 9 10.16 17.39 8.57 48 TR_XM_SpoofPhishAttach 8 6.25 0.00 7.62 49 BOUNCE_MESSAGE 8 6.25 0.00 7.62 50 BAYES_60 8 7.81 8.70 7.62 51 ANY_BOUNCE_MESSAGE 8 6.25 0.00 7.62 52 MPART_ALT_DIFF 8 7.81 8.70 7.62 53 FSL_BULK_SIG 8 7.03 4.35 7.62 54 RELAYCOUNTRY_META 7 8.59 17.39 6.67 55 XMSexyCombo_05 7 7.81 13.04 6.67 56 MIME_QP_LONG_LINE 7 6.25 4.35 6.67 57 RCVD_IN_MSPIKE_H3 7 6.25 4.35 6.67 58 AD_PREFS 7 5.47 0.00 6.67 59 RCVD_IN_IADB_SENDERID 7 5.47 0.00 6.67 60 RCVD_IN_IADB_SPF 7 5.47 0.00 6.67 61 RCVD_IN_IADB_LISTED 7 5.47 0.00 6.67 62 TooManyTo_001 7 7.03 8.70 6.67 63 RCVD_IN_IADB_DK 7 5.47 0.00 6.67 64 MIME_HTML_ONLY_MULTI 7 5.47 0.00 6.67 65 T_OBFU_PDF_ATTACH 7 5.47 0.00 6.67 66 XM_H_SpoofStaff4 6 4.69 0.00 5.71 67 TR_XM_PSC1 6 4.69 0.00 5.71 68 DKIM_INVALID 6 4.69 0.00 5.71 69 HTML_IMAGE_RATIO_06 6 4.69 0.00 5.71 70 XM_ZohoDesk1 6 4.69 0.00 5.71 71 TR_XM_SpoofStaff 6 4.69 0.00 5.71 72 T_TooManySym_02 6 4.69 0.00 5.71 73 XMSpoofStaff2 6 4.69 0.00 5.71 74 LOTS_OF_MONEY 5 4.69 4.35 4.76 75 RCVD_IN_IADB_OPTIN 5 3.91 0.00 4.76 76 INVALID_MSGID 5 3.91 0.00 4.76 77 BAYES_80 5 6.25 13.04 4.76 78 LotsOfNums_01 5 4.69 4.35 4.76 79 TO_MALFORMED 5 3.91 0.00 4.76 80 HTML_MIME_NO_HTML_TAG 5 3.91 0.00 4.76 81 TooManyTo_002 5 4.69 4.35 4.76 82 XM_B_SpammyWords3 5 7.03 17.39 4.76 83 RCVD_IN_IADB_VOUCHED 5 3.91 0.00 4.76 84 XMStrtUSub 4 4.69 8.70 3.81 85 XM_B_SpammyTLD 4 3.12 0.00 3.81 86 T_REMOTE_IMAGE 4 3.12 0.00 3.81 87 XM_OfRef6 4 3.91 4.35 3.81 88 TR_XM_PhishingBody 4 5.47 13.04 3.81 89 T_FILL_THIS_FORM_SHORT 4 3.12 0.00 3.81 90 MSGID_NOFQDN1 4 3.12 0.00 3.81 91 XMNumbers 4 5.47 13.04 3.81 92 GMD_PDF_HORIZ 4 3.12 0.00 3.81 93 XM_B_Phish66 4 3.91 4.35 3.81 94 XM_Evil_Numbers_Gen 3 2.34 0.00 2.86 95 XM_B_Unsub 3 3.91 8.70 2.86 96 RCVD_IN_MSPIKE_H4 3 2.34 0.00 2.86 97 XM_H_Long_From02 3 3.91 8.70 2.86 98 XM_H_Undi_Recip 3 2.34 0.00 2.86 99 RCVD_IN_IADB_OPTIN_GT50 3 2.34 0.00 2.86 100 XM_CamelCaseFrm001 3 2.34 0.00 2.86 101 RELAYCOUNTRY_IN 3 2.34 0.00 2.86 102 TooManyTo_003 3 3.12 4.35 2.86 103 TR_XM_BayesUnsub 3 3.91 8.70 2.86 104 KHOP_HELO_FCRDNS 3 2.34 0.00 2.86 105 HTML_SHORT_LINK_IMG_3 2 1.56 0.00 1.90 106 XMLngstWrd_00 2 1.56 0.00 1.90 107 MIME_HEADER_CTYPE_ONLY 2 1.56 0.00 1.90 108 XM_DK_Undo_02 2 7.81 34.78 1.90 109 FROM_GOV_SPOOF 2 1.56 0.00 1.90 110 XMSubMetaSx_00 2 7.03 30.43 1.90 111 HTML_IMAGE_ONLY_16 2 1.56 0.00 1.90 112 RDNS_DYNAMIC 2 1.56 0.00 1.90 113 TR_XM_SB_Phish 2 2.34 4.35 1.90 114 TR_Symld_Words 2 1.56 0.00 1.90 115 BAYES_99 2 7.03 30.43 1.90 116 DKIM_ADSP_CUSTOM_MED 2 1.56 0.00 1.90 117 NML_ADSP_CUSTOM_MED 2 1.56 0.00 1.90 118 MIME_HTML_MOSTLY 2 2.34 4.35 1.90 119 TR_XM_SpammyWords4 2 2.34 4.35 1.90 120 TR_XM_SpammyWords5 2 2.34 4.35 1.90 121 RELAYCOUNTRY_GB 2 1.56 0.00 1.90 122 XM_SPF_SoftFail 2 1.56 0.00 1.90 123 XMSubPhish11 2 2.34 4.35 1.90 124 TR_XM_SpammyRelay 2 3.91 13.04 1.90 125 PLING_QUERY 1 0.78 0.00 0.95 126 TVD_SPACE_RATIO 1 0.78 0.00 0.95 127 T_XMDrugObfuBody_00 1 0.78 0.00 0.95 128 TO_EQ_FM_DOM_HTML_ONLY 1 0.78 0.00 0.95 129 HTML_IMAGE_ONLY_24 1 0.78 0.00 0.95 130 XM_Body_Dirty_Words_01 1 3.12 13.04 0.95 131 RCVD_IN_MSPIKE_BL 1 2.34 8.70 0.95 132 XMGappySubj_01 1 1.56 4.35 0.95 133 TR_XM_MSPIKECOMBO 1 2.34 8.70 0.95 134 XM_Body_Obfu01 1 0.78 0.00 0.95 135 FROM_OFFERS 1 0.78 0.00 0.95 136 TR_MetaPhish_Combo_01 1 0.78 0.00 0.95 137 RELAYCOUNTRY_FR 1 0.78 0.00 0.95 138 XMBody_03 1 0.78 0.00 0.95 139 XMSubMetaSxObfu_03 1 0.78 0.00 0.95 140 XMDiploma_00 1 3.91 17.39 0.95 141 HTML_IMAGE_ONLY_20 1 0.78 0.00 0.95 142 WEIRD_PORT 1 0.78 0.00 0.95 143 XM_B_Phish_Phrases 1 1.56 4.35 0.95 144 USER_IN_WELCOMELIST 1 0.78 0.00 0.95 145 RCVD_IN_VALIDITY_CERTIFIED 1 0.78 0.00 0.95 146 SpammyFromTLD_02 1 0.78 0.00 0.95 147 HTML_IMAGE_RATIO_08 1 0.78 0.00 0.95 148 RCVD_IN_MSPIKE_L3 1 1.56 4.35 0.95 149 HTML_IMAGE_RATIO_02 1 5.47 26.09 0.95 150 TR_XM_SpammyWords2 1 3.12 13.04 0.95 151 XFER_LOTSA_MONEY 1 0.78 0.00 0.95 152 XM_DIRTYINTL 1 3.12 13.04 0.95 153 TR_XM_SEO4 1 1.56 4.35 0.95 154 T_DOC_ATTACH_NO_EXT 1 0.78 0.00 0.95 155 BAYES_95 1 1.56 4.35 0.95 156 RELAYCOUNTRY_AU 1 0.78 0.00 0.95 157 T_XMDrugObfuBody_08 1 0.78 0.00 0.95 158 XMLngstWrd_03 1 0.78 0.00 0.95 159 XM_UB50 1 0.78 0.00 0.95 160 XMLngstWrd_02 1 0.78 0.00 0.95 161 XMBody_95 1 0.78 0.00 0.95 162 GMD_PDF_SQUARE 1 0.78 0.00 0.95 163 UNTRUSTED_Relay 1 1.56 4.35 0.95 164 XMSubject_78 1 0.78 0.00 0.95 165 XMSubMetaI_00 1 1.56 4.35 0.95 166 LOADSA_MONEY_COMBO 1 0.78 0.00 0.95 167 XMGenDplmaNmb 1 3.91 17.39 0.95 168 TO_NO_BRKTS_HTML_ONLY 1 0.78 0.00 0.95 169 TR_Mismatch_TLD_01 1 0.78 0.00 0.95 170 SpammyFromTLD_01 1 0.78 0.00 0.95 171 USER_IN_WHITELIST 1 0.78 0.00 0.95 172 XM_B_Unsub2 1 0.78 0.00 0.95 173 XMLngstWrd_01 1 0.78 0.00 0.95 174 MAILING_LIST_MULTI 1 0.78 0.00 0.95 175 DATE_IN_PAST_12_24 1 0.78 0.00 0.95 176 TR_MetaPhish_Combo_01b 1 0.78 0.00 0.95 177 TR_XM_DKIM_Undo 1 6.25 30.43 0.95 178 T_XMDrugObfuBody_14 1 0.78 0.00 0.95 179 FORGED_GMAIL_RCVD 1 0.78 0.00 0.95 180 XMNoVowels 1 0.78 0.00 0.95 181 BAYES_999 1 5.47 26.09 0.95 182 TM2_M_VERY_LONG_WORD 1 0.78 0.00 0.95 183 XM_B_SEO 1 1.56 4.35 0.95 184 XM_Combo_Sbj 1 0.78 0.00 0.95 185 RCVD_IN_VALIDITY_SAFE 1 0.78 0.00 0.95 186 BAYES_20 1 0.78 0.00 0.95 187 DEAR_SOMETHING 1 0.78 0.00 0.95 188 XMLngstWrd_04 1 0.78 0.00 0.95 189 HTML_IMAGE_ONLY_32 1 0.78 0.00 0.95 190 XM_GoogleGroups 1 2.34 8.70 0.95 191 SUBJ_ALL_CAPS 1 0.78 0.00 0.95 ----------------------------------------------------------------------