Email: 108 Autolearn: 0 AvgScore: 2.58 AvgScanTime: 2.74 sec Spam: 25 Autolearn: 0 AvgScore: 13.08 AvgScanTime: 1.96 sec Ham: 83 Autolearn: 0 AvgScore: -0.58 AvgScanTime: 2.97 sec Time Spent Running SA: 0.08 hours Time Spent Processing Spam: 0.01 hours Time Spent Processing Ham: 0.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 23 84.26 92.00 81.93 2 RELAYCOUNTRY_US 21 85.19 84.00 85.54 3 T_SCC_BODY_TEXT_LINE 20 86.11 80.00 87.95 4 XM_DK_Pass 19 78.70 76.00 79.52 5 DKIM_VALID 19 78.70 76.00 79.52 6 DKIM_SIGNED 19 79.63 76.00 80.72 7 XM_B_Unicode 17 62.04 68.00 60.24 8 DKIM_VALID_AU 16 58.33 64.00 56.63 9 DCC_CHECK_NEGATIVE 15 74.07 60.00 78.31 10 DKIM_VALID_EF 13 46.30 52.00 44.58 11 RCVD_IN_MSPIKE_H2 12 39.81 48.00 37.35 12 XMListUnsubscribeExists 12 46.30 48.00 45.78 13 LOC_TINY_FONT_1 12 29.63 48.00 24.10 14 BAYES_50 10 58.33 40.00 63.86 15 DCC_CHECK 10 25.93 40.00 21.69 16 FVGT_m_MULTI_ODD 10 34.26 40.00 32.53 17 XMSubLong 10 28.70 40.00 25.30 18 XM_Multi_Part_URI 9 23.15 36.00 19.28 19 TR_XM_BayesUnsub 8 12.96 32.00 7.23 20 XM_B_Unsub 8 13.89 32.00 8.43 21 TR_XM_DK_Unsub 8 25.93 32.00 24.10 22 BAYES_99 8 7.41 32.00 0.00 23 XM_DK_Undo_02 8 8.33 32.00 1.20 24 HTML_FONT_LOW_CONTRAST 8 42.59 32.00 45.78 25 XM_B_Unicode3 7 23.15 28.00 21.69 26 MIME_HTML_ONLY 7 17.59 28.00 14.46 27 UNPARSEABLE_RELAY 7 33.33 28.00 34.94 28 RELAYCOUNTRY_META 7 9.26 28.00 3.61 29 BAYES_999 6 5.56 24.00 0.00 30 XM_B_SpammyWords 6 32.41 24.00 34.94 31 TR_XM_DKIM_Undo 5 4.63 20.00 0.00 32 T_TM2_M_HEADER_IN_MSG 5 25.93 20.00 27.71 33 XM_UncommonTLD01 5 8.33 20.00 4.82 34 XMNumbers 5 9.26 20.00 6.02 35 TR_XM_UnparsRelay 4 4.63 16.00 1.20 36 XM_Body_Dirty_Words 4 8.33 16.00 6.02 37 T_KAM_HTML_FONT_INVALID 4 12.04 16.00 10.84 38 XM_H_Long_From01 4 14.81 16.00 14.46 39 RCVD_IN_MSPIKE_WL 4 16.67 16.00 16.87 40 SUBJ_ALL_CAPS 4 10.19 16.00 8.43 41 XM_B_SpammyTLD 4 6.48 16.00 3.61 42 RCVD_IN_MSPIKE_H4 3 6.48 12.00 4.82 43 LOTS_OF_MONEY 3 4.63 12.00 2.41 44 BOTNET_IPINHOSTNAME 3 4.63 12.00 2.41 45 TM2_M_URI_OPT_OUT 3 5.56 12.00 3.61 46 XM_GoogleGroups 3 3.70 12.00 1.20 47 MIME_HTML_MOSTLY 3 2.78 12.00 0.00 48 T_TooManySym_01 3 5.56 12.00 3.61 49 MAILING_LIST_MULTI 3 4.63 12.00 2.41 50 FSL_BULK_SIG 3 6.48 12.00 4.82 51 XM_B_SpammyWords2 3 13.89 12.00 14.46 52 XM_DK_Undo_01 3 4.63 12.00 2.41 53 BAYES_95 3 5.56 12.00 3.61 54 HTML_IMAGE_RATIO_02 3 2.78 12.00 0.00 55 SpammyFromTLD_02 3 3.70 12.00 1.20 56 BOTNET 3 2.78 12.00 0.00 57 TR_XM_SpammyWords4 3 4.63 12.00 2.41 58 XMStockSpam_06 2 2.78 8.00 1.20 59 RELAYCOUNTRY_IE 2 1.85 8.00 0.00 60 PDS_RDNS_DYNAMIC_FP 2 1.85 8.00 0.00 61 TooManyTo_004 2 1.85 8.00 0.00 62 TR_XM_Undi_Recip6 2 1.85 8.00 0.00 63 TR_XM_NoHeaderRelay 2 1.85 8.00 0.00 64 BAYES_60 2 11.11 8.00 12.05 65 TooManyTo_001 2 3.70 8.00 2.41 66 XM_H_Undi_Recip 2 2.78 8.00 1.20 67 KHOP_HELO_FCRDNS 2 4.63 8.00 3.61 68 RELAYCOUNTRY_CA 2 1.85 8.00 0.00 69 TR_XM_MSPIKECOMBO 2 1.85 8.00 0.00 70 TR_MRelay_UG 2 1.85 8.00 0.00 71 TooManyTo_002 2 1.85 8.00 0.00 72 XM_SPF_SoftFail 2 2.78 8.00 1.20 73 TooManyTo_003 2 1.85 8.00 0.00 74 RDNS_DYNAMIC 2 1.85 8.00 0.00 75 RCVD_IN_MSPIKE_BL 2 1.85 8.00 0.00 76 TR_DCC_Bayes_99 2 1.85 8.00 0.00 77 TO_EQ_FM_DOM_HTML_ONLY 1 0.93 4.00 0.00 78 NUMERIC_HTTP_ADDR 1 2.78 4.00 2.41 79 TR_XM_SpammyWords2 1 0.93 4.00 0.00 80 PDS_OTHER_BAD_TLD 1 0.93 4.00 0.00 81 HELO_DYNAMIC_SPLIT_IP 1 0.93 4.00 0.00 82 XM_Evil_Numbers_Gen 1 8.33 4.00 9.64 83 T_TooManySym_02 1 3.70 4.00 3.61 84 RCVD_IN_RP_RNBL 1 0.93 4.00 0.00 85 TR_XM_PHPDW 1 0.93 4.00 0.00 86 T_XMDrugObfuBody_14 1 3.70 4.00 3.61 87 XM_CamelCaseFrm001 1 3.70 4.00 3.61 88 XM_DIRTYINTL 1 1.85 4.00 1.20 89 OBFU_TEXT_ATTACH 1 0.93 4.00 0.00 90 BOUNCE_MESSAGE 1 4.63 4.00 4.82 91 TR_XM_DK_Bayes1 1 9.26 4.00 10.84 92 RCVD_IN_PSBL 1 0.93 4.00 0.00 93 TR_XM_SEO 1 0.93 4.00 0.00 94 HTML_COMMENT_SAVED_URL 1 0.93 4.00 0.00 95 MISSING_HEADERS 1 0.93 4.00 0.00 96 TVD_RCVD_IP 1 0.93 4.00 0.00 97 TR_XM_SEO4 1 0.93 4.00 0.00 98 XMSubMetaSx_00 1 1.85 4.00 1.20 99 HTML_FONT_TINY_NORDNS 1 0.93 4.00 0.00 100 SCC_BODY_URI_ONLY 1 1.85 4.00 1.20 101 XMSexyCombo_05 1 1.85 4.00 1.20 102 XM_B_SpammyWords3 1 4.63 4.00 4.82 103 URI_PHP_REDIR 1 0.93 4.00 0.00 104 XMRcvdHeader_05 1 0.93 4.00 0.00 105 SpammyFromTLD_01 1 0.93 4.00 0.00 106 XMSexyCombo_01 1 0.93 4.00 0.00 107 RCVD_IN_MSPIKE_L3 1 0.93 4.00 0.00 108 T_XMHurry_00 1 2.78 4.00 2.41 109 XM_B_Investor 1 4.63 4.00 4.82 110 FROM_GOV_SPOOF 1 1.85 4.00 1.20 111 PLING_QUERY 1 2.78 4.00 2.41 112 SUBJ_DOLLARS 1 0.93 4.00 0.00 113 TR_XM_DK_Bayes 1 9.26 4.00 10.84 114 TooManyTo_005 1 0.93 4.00 0.00 115 ANY_BOUNCE_MESSAGE 1 4.63 4.00 4.82 116 RCVD_IN_VALIDITY_RPBL 1 0.93 4.00 0.00 117 TR_XM_DK_Bayes2 1 8.33 4.00 9.64 118 HTTP_EXCESSIVE_ESCAPES 1 0.93 4.00 0.00 119 LONGWORDS 1 0.93 4.00 0.00 120 TR_XM_MaxWHORU 1 0.93 4.00 0.00 121 XM_H_PHPOS 1 0.93 4.00 0.00 122 HTML_IMAGE_RATIO_08 1 0.93 4.00 0.00 123 TR_XM_SEO3 1 0.93 4.00 0.00 124 XMStrtUSub 1 5.56 4.00 6.02 125 TR_XM_PHPForged 1 0.93 4.00 0.00 126 RELAYCOUNTRY_CZ 1 0.93 4.00 0.00 127 XM_B_SEO 1 0.93 4.00 0.00 128 UNTRUSTED_Relay 1 1.85 4.00 1.20 129 TR_XM_SpammyWords5 1 3.70 4.00 3.61 130 BAYES_80 1 2.78 4.00 2.41 131 XMDateMe_00 1 0.93 4.00 0.00 132 RELAYCOUNTRY_AU 1 0.93 4.00 0.00 133 BAYES_00 1 10.19 4.00 12.05 134 RCVD_IN_MSPIKE_H5 1 2.78 4.00 2.41 135 RELAYCOUNTRY_JP 1 0.93 4.00 0.00 136 TR_XM_FormFill2 1 0.93 4.00 0.00 137 TR_Caps_n_Bayes_80 1 0.93 4.00 0.00 138 XMSubMetaSSx_00 1 0.93 4.00 0.00 139 XM_S_SEO 1 0.93 4.00 0.00 140 RCVD_IN_MSPIKE_L4 1 0.93 4.00 0.00 141 XMBody_07 1 0.93 4.00 0.00 142 TR_Mismatch_TLD_02 1 1.85 4.00 1.20 143 HTML_OBFUSCATE_10_20 1 0.93 4.00 0.00 144 TR_Symld_Words 1 1.85 4.00 1.20 145 XM_UB50 1 1.85 4.00 1.20 146 XM_B_DNDMA 1 0.93 4.00 0.00 147 TM2_M_BODY_EMPTY 1 0.93 4.00 0.00 148 RELAYCOUNTRY_TH 1 0.93 4.00 0.00 149 NO_DNS_FOR_FROM 1 0.93 4.00 0.00 150 BODY_EMPTY 1 0.93 4.00 0.00 151 T_REMOTE_IMAGE 1 7.41 4.00 8.43 152 URIBL_DBL_SPAM 1 0.93 4.00 0.00 153 SUSPICIOUS_RECIPS 1 0.93 4.00 0.00 154 XMEmptyBody_01 1 0.93 4.00 0.00 155 XM_B_SpammyTLD2 1 0.93 4.00 0.00 156 T_Symld_Words_02 1 0.93 4.00 0.00 157 XM_URI_RBL 1 0.93 4.00 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 73 86.11 80.00 87.95 2 RELAYCOUNTRY_US 71 85.19 84.00 85.54 3 HTML_MESSAGE 68 84.26 92.00 81.93 4 DKIM_SIGNED 67 79.63 76.00 80.72 5 DKIM_VALID 66 78.70 76.00 79.52 6 XM_DK_Pass 66 78.70 76.00 79.52 7 DCC_CHECK_NEGATIVE 65 74.07 60.00 78.31 8 BAYES_50 53 58.33 40.00 63.86 9 XM_B_Unicode 50 62.04 68.00 60.24 10 DKIM_VALID_AU 47 58.33 64.00 56.63 11 HTML_FONT_LOW_CONTRAST 38 42.59 32.00 45.78 12 XMListUnsubscribeExists 38 46.30 48.00 45.78 13 DKIM_VALID_EF 37 46.30 52.00 44.58 14 RCVD_IN_MSPIKE_H2 31 39.81 48.00 37.35 15 XM_B_SpammyWords 29 32.41 24.00 34.94 16 UNPARSEABLE_RELAY 29 33.33 28.00 34.94 17 FVGT_m_MULTI_ODD 27 34.26 40.00 32.53 18 T_TM2_M_HEADER_IN_MSG 23 25.93 20.00 27.71 19 XMSubLong 21 28.70 40.00 25.30 20 LOC_TINY_FONT_1 20 29.63 48.00 24.10 21 TR_XM_DK_Unsub 20 25.93 32.00 24.10 22 XM_B_Unicode3 18 23.15 28.00 21.69 23 DCC_CHECK 18 25.93 40.00 21.69 24 XM_Multi_Part_URI 16 23.15 36.00 19.28 25 RCVD_IN_MSPIKE_WL 14 16.67 16.00 16.87 26 XM_B_SpammyWords2 12 13.89 12.00 14.46 27 XM_H_Long_From01 12 14.81 16.00 14.46 28 MIME_HTML_ONLY 12 17.59 28.00 14.46 29 ALL_TRUSTED 11 10.19 0.00 13.25 30 BAYES_00 10 10.19 4.00 12.05 31 BAYES_60 10 11.11 8.00 12.05 32 T_KAM_HTML_FONT_INVALID 9 12.04 16.00 10.84 33 TR_XM_DK_Bayes 9 9.26 4.00 10.84 34 TR_XM_DK_Bayes1 9 9.26 4.00 10.84 35 TR_XM_DK_Bayes2 8 8.33 4.00 9.64 36 RCVD_IN_MSPIKE_H3 8 7.41 0.00 9.64 37 XM_Evil_Numbers_Gen 8 8.33 4.00 9.64 38 SHOPIFY_IMG_NOT_RCVD_SFY 8 7.41 0.00 9.64 39 T_REMOTE_IMAGE 7 7.41 4.00 8.43 40 SUBJ_ALL_CAPS 7 10.19 16.00 8.43 41 XM_B_Unsub 7 13.89 32.00 8.43 42 TR_XM_BayesUnsub 6 12.96 32.00 7.23 43 XMStrtUSub 5 5.56 4.00 6.02 44 IN_ZIMBRA_NJ_WHITELIST 5 4.63 0.00 6.02 45 XMNumbers 5 9.26 20.00 6.02 46 USER_IN_DEF_DKIM_WL 5 4.63 0.00 6.02 47 XM_Body_Dirty_Words 5 8.33 16.00 6.02 48 FSL_BULK_SIG 4 6.48 12.00 4.82 49 XM_UncommonTLD01 4 8.33 20.00 4.82 50 ANY_BOUNCE_MESSAGE 4 4.63 4.00 4.82 51 BOUNCE_MESSAGE 4 4.63 4.00 4.82 52 XM_B_Investor 4 4.63 4.00 4.82 53 XM_B_SpammyWords3 4 4.63 4.00 4.82 54 RCVD_IN_MSPIKE_H4 4 6.48 12.00 4.82 55 LotsOfNums_01 3 2.78 0.00 3.61 56 RCVD_IN_IADB_SPF 3 2.78 0.00 3.61 57 TR_XM_SpammyWords5 3 3.70 4.00 3.61 58 T_TooManySym_01 3 5.56 12.00 3.61 59 RCVD_IN_IADB_DK 3 2.78 0.00 3.61 60 RELAYCOUNTRY_META 3 9.26 28.00 3.61 61 TM2_M_URI_OPT_OUT 3 5.56 12.00 3.61 62 KHOP_HELO_FCRDNS 3 4.63 8.00 3.61 63 XM_B_SpammyTLD 3 6.48 16.00 3.61 64 RCVD_IN_IADB_OPTIN 3 2.78 0.00 3.61 65 BAYES_05 3 2.78 0.00 3.61 66 BAYES_95 3 5.56 12.00 3.61 67 TR_XM_DK_SendGrid 3 2.78 0.00 3.61 68 XM_CamelCaseFrm001 3 3.70 4.00 3.61 69 T_XMDrugObfuBody_14 3 3.70 4.00 3.61 70 RCVD_IN_IADB_OPTIN_GT50 3 2.78 0.00 3.61 71 T_TooManySym_02 3 3.70 4.00 3.61 72 XM_SendGrid 3 2.78 0.00 3.61 73 MIME_QP_LONG_LINE 3 2.78 0.00 3.61 74 RCVD_IN_IADB_LISTED 3 2.78 0.00 3.61 75 RCVD_IN_IADB_VOUCHED 3 2.78 0.00 3.61 76 RCVD_IN_IADB_SENDERID 3 2.78 0.00 3.61 77 RCVD_IN_MSPIKE_H5 2 2.78 4.00 2.41 78 MAILING_LIST_MULTI 2 4.63 12.00 2.41 79 XM_DK_Undo_01 2 4.63 12.00 2.41 80 BAYES_80 2 2.78 4.00 2.41 81 XMSubPhish11 2 1.85 0.00 2.41 82 TO_MALFORMED 2 1.85 0.00 2.41 83 TM2_M_VERY_LONG_WORD 2 1.85 0.00 2.41 84 BOTNET_IPINHOSTNAME 2 4.63 12.00 2.41 85 MONEY_BACK 2 1.85 0.00 2.41 86 TR_XM_SpammyWords4 2 4.63 12.00 2.41 87 HTML_TAG_BALANCE_BODY 2 1.85 0.00 2.41 88 INVALID_MSGID 2 1.85 0.00 2.41 89 BAYES_40 2 1.85 0.00 2.41 90 TM2_M_HAS_BSLASH_URI 2 1.85 0.00 2.41 91 TR_XM_SB_Phish 2 1.85 0.00 2.41 92 XMLngstWrd_00 2 1.85 0.00 2.41 93 TR_XM_PhishingBody 2 1.85 0.00 2.41 94 XMSubMetaI_00 2 1.85 0.00 2.41 95 NUMERIC_HTTP_ADDR 2 2.78 4.00 2.41 96 PLING_QUERY 2 2.78 4.00 2.41 97 LOTS_OF_MONEY 2 4.63 12.00 2.41 98 XM_B_Unsub2 2 1.85 0.00 2.41 99 TooManyTo_001 2 3.70 8.00 2.41 100 T_XMHurry_00 2 2.78 4.00 2.41 101 HTML_MIME_NO_HTML_TAG 2 1.85 0.00 2.41 102 HTML_IMAGE_RATIO_06 2 1.85 0.00 2.41 103 XM_DKIMWhitelistDomains 1 0.93 0.00 1.20 104 XMGappySubj_01 1 0.93 0.00 1.20 105 XM_GoogleGroups 1 3.70 12.00 1.20 106 UNTRUSTED_Relay 1 1.85 4.00 1.20 107 XMLngstWrd_04 1 0.93 0.00 1.20 108 XMSubMetaSxObfu_03 1 0.93 0.00 1.20 109 RELAYCOUNTRY_IN 1 0.93 0.00 1.20 110 TR_XM_SpammyRelay 1 0.93 0.00 1.20 111 T_XMDrugObfuBody_08 1 0.93 0.00 1.20 112 XM_Body_Dirty_Words_01 1 0.93 0.00 1.20 113 DKIM_INVALID 1 0.93 0.00 1.20 114 WEIRD_QUOTING 1 0.93 0.00 1.20 115 IN_HORDE_ADDRESS_BOOK 1 0.93 0.00 1.20 116 TO_NO_BRKTS_FROM_MSSP 1 0.93 0.00 1.20 117 HTML_IMAGE_ONLY_24 1 0.93 0.00 1.20 118 XM_UB50 1 1.85 4.00 1.20 119 XMLngstWrd_01 1 0.93 0.00 1.20 120 T_OBFU_PDF_ATTACH 1 0.93 0.00 1.20 121 TR_Mismatch_TLD_02 1 1.85 4.00 1.20 122 SpammyFromTLD_02 1 3.70 12.00 1.20 123 XM_SPF_SoftFail 1 2.78 8.00 1.20 124 TR_Symld_Words 1 1.85 4.00 1.20 125 T_DOC_ATTACH_NO_EXT 1 0.93 0.00 1.20 126 T_XMDrugObfuBody_00 1 0.93 0.00 1.20 127 XMLngstWrd_02 1 0.93 0.00 1.20 128 TR_XM_UnparsRelay 1 4.63 16.00 1.20 129 XM_H_Trusted_IP 1 0.93 0.00 1.20 130 XM_PDF 1 0.93 0.00 1.20 131 XM_Dr_From 1 0.93 0.00 1.20 132 XM_DIRTYINTL 1 1.85 4.00 1.20 133 XM_B_Phish66 1 0.93 0.00 1.20 134 XMHTMLBadTable_001 1 0.93 0.00 1.20 135 XMPhish14 1 0.93 0.00 1.20 136 XMSubNoVowel 1 0.93 0.00 1.20 137 XMStockSpam_06 1 2.78 8.00 1.20 138 URI_TRY_3LD 1 0.93 0.00 1.20 139 RELAYCOUNTRY_PL 1 0.93 0.00 1.20 140 TR_XM_SPAMCOP 1 0.93 0.00 1.20 141 MSGID_FROM_MTA_HEADER 1 0.93 0.00 1.20 142 USER_IN_WHITELIST 1 0.93 0.00 1.20 143 FROM_EXCESS_BASE64 1 0.93 0.00 1.20 144 MPART_ALT_DIFF 1 0.93 0.00 1.20 145 XM_DK_Undo_02 1 8.33 32.00 1.20 146 XM_BadFromFormat 1 0.93 0.00 1.20 147 XM_H_Undi_Recip 1 2.78 8.00 1.20 148 FROM_GOV_SPOOF 1 1.85 4.00 1.20 149 RELAYCOUNTRY_DE 1 0.93 0.00 1.20 150 RCVD_IN_BL_SPAMCOP_NET 1 0.93 0.00 1.20 151 XMLngstWrd_03 1 0.93 0.00 1.20 152 XM_B_Phish_Phrases 1 0.93 0.00 1.20 153 GMD_PDF_SQUARE 1 0.93 0.00 1.20 154 XMSexyCombo_05 1 1.85 4.00 1.20 155 TVD_SPACE_RATIO 1 0.93 0.00 1.20 156 SCC_BODY_URI_ONLY 1 1.85 4.00 1.20 157 XMSubMetaSx_00 1 1.85 4.00 1.20 158 USER_IN_WELCOMELIST 1 0.93 0.00 1.20 ----------------------------------------------------------------------