Email: 128 Autolearn: 0 AvgScore: 3.23 AvgScanTime: 2.70 sec Spam: 41 Autolearn: 0 AvgScore: 10.88 AvgScanTime: 3.10 sec Ham: 87 Autolearn: 0 AvgScore: -0.38 AvgScanTime: 2.51 sec Time Spent Running SA: 0.10 hours Time Spent Processing Spam: 0.04 hours Time Spent Processing Ham: 0.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 40 94.53 97.56 93.10 2 DKIM_VALID 39 78.12 95.12 70.11 3 XM_DK_Pass 39 79.69 95.12 72.41 4 DKIM_SIGNED 39 80.47 95.12 73.56 5 HTML_MESSAGE 38 78.91 92.68 72.41 6 XM_B_Unicode 38 67.19 92.68 55.17 7 RELAYCOUNTRY_US 36 82.81 87.80 80.46 8 DKIM_VALID_AU 32 60.94 78.05 52.87 9 XMListUnsubscribeExists 30 44.53 73.17 31.03 10 XM_B_Unicode3 28 43.75 68.29 32.18 11 XMSubLong 26 40.62 63.41 29.89 12 DKIM_VALID_EF 26 48.44 63.41 41.38 13 XM_DK_Undo_02 24 21.88 58.54 4.60 14 FVGT_m_MULTI_ODD 23 28.12 56.10 14.94 15 XM_DK_Undo_01 20 20.31 48.78 6.90 16 BAYES_99 20 17.97 48.78 3.45 17 TR_XM_DK_Unsub 19 22.66 46.34 11.49 18 XMNumbers 19 21.09 46.34 9.20 19 XM_GoogleGroups 18 16.41 43.90 3.45 20 XM_H_Undi_Recip 18 21.09 43.90 10.34 21 MAILING_LIST_MULTI 18 16.41 43.90 3.45 22 TR_MRelay_UG 18 14.06 43.90 0.00 23 BAYES_999 18 15.62 43.90 2.30 24 TR_XM_Undi_Recip6 17 13.28 41.46 0.00 25 RCVD_IN_MSPIKE_H2 14 25.78 34.15 21.84 26 LOC_TINY_FONT_1 13 18.75 31.71 12.64 27 XM_B_SpammyWords 13 27.34 31.71 25.29 28 BAYES_50 12 43.75 29.27 50.57 29 XM_B_Unsub 9 13.28 21.95 9.20 30 HTML_FONT_LOW_CONTRAST 9 22.66 21.95 22.99 31 TR_XM_BayesUnsub 9 13.28 21.95 9.20 32 XM_Multi_Part_URI 9 13.28 21.95 9.20 33 TM2_M_URI_OPT_OUT 8 10.16 19.51 5.75 34 RCVD_IN_MSPIKE_H3 8 11.72 19.51 8.05 35 RCVD_IN_MSPIKE_WL 8 11.72 19.51 8.05 36 XM_H_Long_From01 7 8.59 17.07 4.60 37 RELAYCOUNTRY_META 6 10.16 14.63 8.05 38 BOTNET_IPINHOSTNAME 6 6.25 14.63 2.30 39 XM_Body_Dirty_Words 6 8.59 14.63 5.75 40 BAYES_95 5 10.16 12.20 9.20 41 UNPARSEABLE_RELAY 5 10.94 12.20 10.34 42 T_KAM_HTML_FONT_INVALID 5 13.28 12.20 13.79 43 TR_XM_DKIM_Undo 4 3.12 9.76 0.00 44 TR_XM_UnparsRelay 4 3.91 9.76 1.15 45 HTML_IMAGE_RATIO_02 4 7.81 9.76 6.90 46 UNTRUSTED_Relay 4 4.69 9.76 2.30 47 LOTS_OF_MONEY 4 3.91 9.76 1.15 48 XM_B_SpammyWords2 4 5.47 9.76 3.45 49 T_TM2_M_HEADER_IN_MSG 4 21.09 9.76 26.44 50 MIME_HTML_MOSTLY 4 7.81 9.76 6.90 51 TR_LOTS_OF_MONEY2 3 2.34 7.32 0.00 52 BOTNET 3 3.91 7.32 2.30 53 XM_B_SpammyTLD 3 3.12 7.32 1.15 54 T_MONEY_PERCENT 3 2.34 7.32 0.00 55 XM_UB50 3 3.12 7.32 1.15 56 BAYES_80 3 3.12 7.32 1.15 57 XM_SPF_SoftFail 3 6.25 7.32 5.75 58 XM_ProductURIs 3 2.34 7.32 0.00 59 RELAYCOUNTRY_IE 3 3.91 7.32 2.30 60 TR_XM_Undi_Recip14 3 2.34 7.32 0.00 61 T_TooManySym_01 3 9.38 7.32 10.34 62 XM_Evil_Numbers_Gen 3 8.59 7.32 9.20 63 SpammyFromTLD_02 2 1.56 4.88 0.00 64 XM_H_PHPOS 2 2.34 4.88 1.15 65 TR_XM_FormFill2 2 2.34 4.88 1.15 66 MIME_HTML_ONLY 2 14.06 4.88 18.39 67 RCVD_IN_BL_SPAMCOP_NET 2 1.56 4.88 0.00 68 TR_XM_PHPDW 2 2.34 4.88 1.15 69 TR_XM_PHPForged 2 2.34 4.88 1.15 70 XM_UncommonTLD01 2 7.81 4.88 9.20 71 XM_B_Investor 2 3.12 4.88 2.30 72 XM_DIRTYINTL 2 1.56 4.88 0.00 73 TR_XM_SPAMCOP 2 1.56 4.88 0.00 74 RCVD_IN_IADB_SPF 1 3.91 2.44 4.60 75 MIME_QP_LONG_LINE 1 0.78 2.44 0.00 76 XMDateMe_00 1 0.78 2.44 0.00 77 TR_XM_SpammyWords4 1 0.78 2.44 0.00 78 URI_DOTEDU 1 0.78 2.44 0.00 79 PDS_RDNS_DYNAMIC_FP 1 0.78 2.44 0.00 80 DCC_CHECK 1 5.47 2.44 6.90 81 TR_MetaPhish_Combo_01 1 1.56 2.44 1.15 82 TooManyTo_001 1 6.25 2.44 8.05 83 T_XMDrugObfuBody_14 1 2.34 2.44 2.30 84 RDNS_DYNAMIC 1 0.78 2.44 0.00 85 XMSubject_70 1 0.78 2.44 0.00 86 FSL_HELO_NON_FQDN_1 1 0.78 2.44 0.00 87 T_XMDrugObfuBody_08 1 3.91 2.44 4.60 88 TooManyTo_003 1 1.56 2.44 1.15 89 RELAYCOUNTRY_RU 1 1.56 2.44 1.15 90 HTML_IMAGE_RATIO_04 1 2.34 2.44 2.30 91 BOTNET_NORDNS 1 0.78 2.44 0.00 92 XMWrdJen 1 0.78 2.44 0.00 93 SHOPIFY_IMG_NOT_RCVD_SFY 1 0.78 2.44 0.00 94 XM_UB99 1 0.78 2.44 0.00 95 MPART_ALT_DIFF 1 6.25 2.44 8.05 96 XM_H_PHPMailer 1 1.56 2.44 1.15 97 KHOP_HELO_FCRDNS 1 1.56 2.44 1.15 98 TR_XM_DK_SendGrid 1 1.56 2.44 1.15 99 TR_XM_SpammyWords5 1 0.78 2.44 0.00 100 XM_Body_Dirty_Words_01 1 1.56 2.44 1.15 101 TooManyTo_004 1 0.78 2.44 0.00 102 ANY_BOUNCE_MESSAGE 1 7.81 2.44 10.34 103 RELAYCOUNTRY_AT 1 0.78 2.44 0.00 104 XM_UB999 1 0.78 2.44 0.00 105 OBFU_TEXT_ATTACH 1 0.78 2.44 0.00 106 TooManyTo_002 1 1.56 2.44 1.15 107 XMStrtUSub 1 2.34 2.44 2.30 108 AD_PREFS 1 0.78 2.44 0.00 109 TM2_M_VERY_LONG_WORD 1 3.12 2.44 3.45 110 HELO_NO_DOMAIN 1 0.78 2.44 0.00 111 XM_OfRef6 1 0.78 2.44 0.00 112 TR_XM_SpammyRelay 1 1.56 2.44 1.15 113 IMPOTENCE 1 0.78 2.44 0.00 114 RCVD_IN_IADB_DK 1 1.56 2.44 1.15 115 XM_Dr_From 1 0.78 2.44 0.00 116 RCVD_IN_IADB_SENDERID 1 2.34 2.44 2.30 117 RCVD_IN_IADB_LISTED 1 3.91 2.44 4.60 118 RELAYCOUNTRY_AU 1 0.78 2.44 0.00 119 LotsOfNums_01 1 2.34 2.44 2.30 120 XMSexyCombo_05 1 0.78 2.44 0.00 121 XM_H_PHPOS_M 1 1.56 2.44 1.15 122 BAYES_60 1 11.72 2.44 16.09 123 XM_SendGrid 1 1.56 2.44 1.15 124 TR_UG_Sexy_Spam 1 1.56 2.44 1.15 125 HELO_NODOT 1 0.78 2.44 0.00 126 URIBL_BLACK 1 0.78 2.44 0.00 127 BOUNCE_MESSAGE 1 7.81 2.44 10.34 128 XM_Body_Obfu01 1 0.78 2.44 0.00 129 T_TooManySym_02 1 4.69 2.44 5.75 130 XM_B_SpammyWords3 1 1.56 2.44 1.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 81 94.53 97.56 93.10 2 RELAYCOUNTRY_US 70 82.81 87.80 80.46 3 DKIM_SIGNED 64 80.47 95.12 73.56 4 HTML_MESSAGE 63 78.91 92.68 72.41 5 XM_DK_Pass 63 79.69 95.12 72.41 6 DKIM_VALID 61 78.12 95.12 70.11 7 XM_B_Unicode 48 67.19 92.68 55.17 8 DKIM_VALID_AU 46 60.94 78.05 52.87 9 BAYES_50 44 43.75 29.27 50.57 10 DKIM_VALID_EF 36 48.44 63.41 41.38 11 XM_B_Unicode3 28 43.75 68.29 32.18 12 XMListUnsubscribeExists 27 44.53 73.17 31.03 13 XMSubLong 26 40.62 63.41 29.89 14 T_TM2_M_HEADER_IN_MSG 23 21.09 9.76 26.44 15 XM_B_SpammyWords 22 27.34 31.71 25.29 16 HTML_FONT_LOW_CONTRAST 20 22.66 21.95 22.99 17 RCVD_IN_MSPIKE_H2 19 25.78 34.15 21.84 18 MIME_HTML_ONLY 16 14.06 4.88 18.39 19 BAYES_60 14 11.72 2.44 16.09 20 ALL_TRUSTED 14 10.94 0.00 16.09 21 FVGT_m_MULTI_ODD 13 28.12 56.10 14.94 22 T_KAM_HTML_FONT_INVALID 12 13.28 12.20 13.79 23 LOC_TINY_FONT_1 11 18.75 31.71 12.64 24 TR_XM_DK_Unsub 10 22.66 46.34 11.49 25 XM_H_Undi_Recip 9 21.09 43.90 10.34 26 ANY_BOUNCE_MESSAGE 9 7.81 2.44 10.34 27 BOUNCE_MESSAGE 9 7.81 2.44 10.34 28 UNPARSEABLE_RELAY 9 10.94 12.20 10.34 29 T_TooManySym_01 9 9.38 7.32 10.34 30 XM_B_Unsub 8 13.28 21.95 9.20 31 BAYES_95 8 10.16 12.20 9.20 32 TR_XM_BayesUnsub 8 13.28 21.95 9.20 33 XM_UncommonTLD01 8 7.81 4.88 9.20 34 XM_Multi_Part_URI 8 13.28 21.95 9.20 35 XM_Evil_Numbers_Gen 8 8.59 7.32 9.20 36 XM_DKIMWhitelistDomains 8 6.25 0.00 9.20 37 BAYES_40 8 6.25 0.00 9.20 38 XMNumbers 8 21.09 46.34 9.20 39 RCVD_IN_MSPIKE_H3 7 11.72 19.51 8.05 40 RCVD_IN_MSPIKE_WL 7 11.72 19.51 8.05 41 TooManyTo_001 7 6.25 2.44 8.05 42 RELAYCOUNTRY_META 7 10.16 14.63 8.05 43 MPART_ALT_DIFF 7 6.25 2.44 8.05 44 DCC_CHECK 6 5.47 2.44 6.90 45 HTML_IMAGE_RATIO_02 6 7.81 9.76 6.90 46 HTML_MIME_NO_HTML_TAG 6 4.69 0.00 6.90 47 XM_DK_Undo_01 6 20.31 48.78 6.90 48 MIME_HTML_MOSTLY 6 7.81 9.76 6.90 49 XM_CamelCaseFrm001 5 3.91 0.00 5.75 50 TM2_M_URI_OPT_OUT 5 10.16 19.51 5.75 51 XM_H_Long_From02 5 3.91 0.00 5.75 52 T_TooManySym_02 5 4.69 2.44 5.75 53 XM_SPF_SoftFail 5 6.25 7.32 5.75 54 FROM_EXCESS_BASE64 5 3.91 0.00 5.75 55 INVALID_MSGID 5 3.91 0.00 5.75 56 XM_Body_Dirty_Words 5 8.59 14.63 5.75 57 XM_H_Long_From01 4 8.59 17.07 4.60 58 USER_IN_DEF_DKIM_WL 4 3.12 0.00 4.60 59 BAYES_00 4 3.12 0.00 4.60 60 URI_NOVOWEL 4 3.12 0.00 4.60 61 RCVD_IN_IADB_SPF 4 3.91 2.44 4.60 62 RCVD_IN_IADB_VOUCHED 4 3.12 0.00 4.60 63 T_XMDrugObfuBody_08 4 3.91 2.44 4.60 64 RCVD_IN_IADB_OPTIN 4 3.12 0.00 4.60 65 XM_DK_Undo_02 4 21.88 58.54 4.60 66 TO_MALFORMED 4 3.12 0.00 4.60 67 RCVD_IN_IADB_LISTED 4 3.91 2.44 4.60 68 IN_ZIMBRA_NJ_WHITELIST 4 3.12 0.00 4.60 69 T_REMOTE_IMAGE 3 2.34 0.00 3.45 70 TR_Sbj_FN_Bdy 3 2.34 0.00 3.45 71 BAYES_20 3 2.34 0.00 3.45 72 XM_PDF 3 2.34 0.00 3.45 73 XM_B_SpammyWords2 3 5.47 9.76 3.45 74 TM2_M_VERY_LONG_WORD 3 3.12 2.44 3.45 75 SUBJ_ALL_CAPS 3 2.34 0.00 3.45 76 TR_XM_DK_Bayes 3 2.34 0.00 3.45 77 TR_XM_DK_Bayes1 3 2.34 0.00 3.45 78 XM_GoogleGroups 3 16.41 43.90 3.45 79 XMGappySubj_02 3 2.34 0.00 3.45 80 MAILING_LIST_MULTI 3 16.41 43.90 3.45 81 XMGappySubj_01 3 2.34 0.00 3.45 82 TR_XM_DK_Bayes2 3 2.34 0.00 3.45 83 DKIM_INVALID 3 2.34 0.00 3.45 84 BAYES_99 3 17.97 48.78 3.45 85 BOTNET 2 3.91 7.32 2.30 86 HK_RANDOM_ENVFROM 2 1.56 0.00 2.30 87 HTML_IMAGE_RATIO_06 2 1.56 0.00 2.30 88 BAYES_05 2 1.56 0.00 2.30 89 MIME_BOUND_DIGITS_15 2 1.56 0.00 2.30 90 TR_XM_PhishingBody 2 1.56 0.00 2.30 91 FSL_BULK_SIG 2 1.56 0.00 2.30 92 RELAYCOUNTRY_IE 2 3.91 7.32 2.30 93 XMSubMetaI_00 2 1.56 0.00 2.30 94 BAYES_999 2 15.62 43.90 2.30 95 RCVD_IN_IADB_SENDERID 2 2.34 2.44 2.30 96 BOTNET_IPINHOSTNAME 2 6.25 14.63 2.30 97 XM_B_Investor 2 3.12 4.88 2.30 98 T_OBFU_PDF_ATTACH 2 1.56 0.00 2.30 99 XM_B_Unsub2 2 1.56 0.00 2.30 100 TR_XM_NoHeaderRelay 2 1.56 0.00 2.30 101 WEIRD_PORT 2 1.56 0.00 2.30 102 MPART_ALT_DIFF_COUNT 2 1.56 0.00 2.30 103 TR_XM_Undi_Recip11 2 1.56 0.00 2.30 104 XMSubPhish11 2 1.56 0.00 2.30 105 RELAYCOUNTRY_IT 2 1.56 0.00 2.30 106 T_XMDrugObfuBody_14 2 2.34 2.44 2.30 107 HTML_IMAGE_RATIO_04 2 2.34 2.44 2.30 108 UNTRUSTED_Relay 2 4.69 9.76 2.30 109 TR_XM_SB_Phish 2 1.56 0.00 2.30 110 XMStrtUSub 2 2.34 2.44 2.30 111 NO_DNS_FOR_FROM 2 1.56 0.00 2.30 112 LotsOfNums_01 2 2.34 2.44 2.30 113 XMSubMetaSx_00 1 0.78 0.00 1.15 114 RCVD_IN_VALIDITY_SAFE 1 0.78 0.00 1.15 115 XMSolicitRefs_0 1 0.78 0.00 1.15 116 TR_DCC_Bayes_99 1 0.78 0.00 1.15 117 RELAYCOUNTRY_CA 1 0.78 0.00 1.15 118 NML_ADSP_CUSTOM_MED 1 0.78 0.00 1.15 119 USER_IN_WELCOMELIST 1 0.78 0.00 1.15 120 XMBSHREFv2 1 0.78 0.00 1.15 121 XM_B_Phish66 1 0.78 0.00 1.15 122 NUMERIC_HTTP_ADDR 1 0.78 0.00 1.15 123 MSGID_NOFQDN1 1 0.78 0.00 1.15 124 TR_XM_UnparsRelay 1 3.91 9.76 1.15 125 TR_XM_DK_SendGrid 1 1.56 2.44 1.15 126 KHOP_HELO_FCRDNS 1 1.56 2.44 1.15 127 LOTS_OF_MONEY 1 3.91 9.76 1.15 128 TooManyTo_002 1 1.56 2.44 1.15 129 TVD_SPACE_RATIO 1 0.78 0.00 1.15 130 T_XMHurry_00 1 0.78 0.00 1.15 131 XM_B_DynamicLink 1 0.78 0.00 1.15 132 XMBody_78 1 0.78 0.00 1.15 133 RCVD_IN_IADB_DK 1 1.56 2.44 1.15 134 HTML_TAG_BALANCE_BODY 1 0.78 0.00 1.15 135 RCVD_IN_VALIDITY_CERTIFIED 1 0.78 0.00 1.15 136 USER_IN_WHITELIST 1 0.78 0.00 1.15 137 XM_B_SpammyWords4 1 0.78 0.00 1.15 138 TR_UG_Sexy_Spam 1 1.56 2.44 1.15 139 SHORT_URI_4 1 0.78 0.00 1.15 140 SpammyFromTLD_01 1 0.78 0.00 1.15 141 RELAYCOUNTRY_BE 1 0.78 0.00 1.15 142 XMBody_17 1 0.78 0.00 1.15 143 TR_BOTNET_NEGATE 1 0.78 0.00 1.15 144 TR_XM_Undi_Recip15 1 0.78 0.00 1.15 145 TR_Symld_Words 1 0.78 0.00 1.15 146 IN_HORDE_ADDRESS_BOOK 1 0.78 0.00 1.15 147 FONT_INVIS_NORDNS 1 0.78 0.00 1.15 148 XM_H_PHPOS 1 2.34 4.88 1.15 149 TR_XM_FormFill2 1 2.34 4.88 1.15 150 XM_UB60 1 0.78 0.00 1.15 151 FROM_GOV_SPOOF 1 0.78 0.00 1.15 152 SUBJ_OBFU_PUNCT_FEW 1 0.78 0.00 1.15 153 XMGppyBdWords 1 0.78 0.00 1.15 154 XM_B_SpammyTLD 1 3.12 7.32 1.15 155 TR_MetaPhish_Combo_01 1 1.56 2.44 1.15 156 XMCapTrack 1 0.78 0.00 1.15 157 XM_UB50 1 3.12 7.32 1.15 158 RELAYCOUNTRY_RU 1 1.56 2.44 1.15 159 TO_EQ_FM_DOM_HTML_ONLY 1 0.78 0.00 1.15 160 TooManyTo_003 1 1.56 2.44 1.15 161 XM_Combo_Fr 1 0.78 0.00 1.15 162 BAYES_80 1 3.12 7.32 1.15 163 DKIM_ADSP_NXDOMAIN 1 0.78 0.00 1.15 164 XM_H_PHPMailer 1 1.56 2.44 1.15 165 XM_Body_Dirty_Words_01 1 1.56 2.44 1.15 166 TR_XM_PHPDW 1 2.34 4.88 1.15 167 DKIM_ADSP_CUSTOM_MED 1 0.78 0.00 1.15 168 XMSubject_78 1 0.78 0.00 1.15 169 TR_XM_SpammyRelay 1 1.56 2.44 1.15 170 XM_H_PHPOS_M 1 1.56 2.44 1.15 171 TR_XM_PHPForged 1 2.34 4.88 1.15 172 XMSubMetaSxObfu_03 1 0.78 0.00 1.15 173 XM_SendGrid 1 1.56 2.44 1.15 174 XMPhish14 1 0.78 0.00 1.15 175 NICE_REPLY_A 1 0.78 0.00 1.15 176 T_FILL_THIS_FORM_SHORT 1 0.78 0.00 1.15 177 HTML_IMAGE_ONLY_20 1 0.78 0.00 1.15 178 FROM_GOV_DKIM_AU 1 0.78 0.00 1.15 179 XMLngstWrd_00 1 0.78 0.00 1.15 180 XM_B_SpammyWords3 1 1.56 2.44 1.15 ----------------------------------------------------------------------