<div dir="ltr">The expletives in the email are a sure way to flag this one. A spamassassin rule to find these words would do the trick nicely.<div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jun 19, 2017 at 1:44 PM, Gao <span dir="ltr"><<a href="mailto:gao@pztop.com" target="_blank">gao@pztop.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
This spam message get a low score so it delivered to the user. Is there a way to let spamassassin catch it?<br>
<br>
Here is the spam mail:<br>
<br>
Return-Path: <<a href="mailto:magnaflow@webmail.md">magnaflow@webmail.md</a>><br>
X-Original-To: <a href="mailto:gjv@mydomain.com">gjv@mydomain.com</a><br>
Delivered-To: <a href="mailto:gjv@mydomain.com">gjv@mydomain.com</a><br>
Received: by <a href="http://zeta.mydomain.com">zeta.mydomain.com</a> (Postfix, from userid 5001)<br>
id 3F8C2200BE800; Sun, 18 Jun 2017 19:03:08 -0700 (PDT)<br>
Received-SPF: none (<a href="http://webmail.md">webmail.md</a>: No applicable sender policy available) receiver=<a href="http://zeta.mydomain.com">zeta.mydomain.com</a>; identity=mailfrom; envelope-from="magnaflow@webma<wbr><a href="http://il.md">il.md</a>"; helo=smtp-proxy002.phy.lolipop<wbr>.jp; client-ip=157.7.104.43<br>
Received: from <a href="http://smtp-proxy002.phy.lolipop.jp">smtp-proxy002.phy.lolipop.jp</a> (<a href="http://smtp-proxy002.phy.lolipop.jp">smtp-proxy002.phy.lolipop.jp</a> [157.7.104.43])<br>
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))<br>
(No client certificate requested)<br>
by <a href="http://zeta.mydomain.com">zeta.mydomain.com</a> (Postfix) with ESMTPS id 094292061FFD4<br>
for <<a href="mailto:gjv@mydomain.com">gjv@mydomain.com</a>>; Sun, 18 Jun 2017 19:03:00 -0700 (PDT)<br>
Received: from smtp-proxy002.phy.lolipop.lan (HELO <a href="http://smtp-proxy002.phy.lolipop.jp">smtp-proxy002.phy.lolipop.jp</a>) (172.19.44.43)<br>
(smtp-auth username infallible-man@ojikan-haishaku<wbr>.net, mechanism login)<br>
by <a href="http://smtp-proxy002.phy.lolipop.jp">smtp-proxy002.phy.lolipop.jp</a> (qpsmtpd/0.82) with ESMTPA; Mon, 19 Jun 2017 11:02:57 +0900<br>
Received: from 127.0.0.1 (127.0.0.1)<br>
by <a href="http://smtp-proxy002.phy.lolipop.jp">smtp-proxy002.phy.lolipop.jp</a> (LOLIPOP-Fsecure);<br>
Mon, 19 Jun 2017 11:02:39 +0900 (JST)<br>
X-Virus-Status: clean(LOLIPOP-Fsecure)<br>
Message-ID: <2E2B9DCEC5113FEC30357CC135F86<wbr><a href="mailto:9A6@webmail.md">9A6@webmail.md</a>><br>
From: "FUCK EXPRESS" <<a href="mailto:magnaflow@webmail.md">magnaflow@webmail.md</a>><br>
To: <<a href="mailto:andrewv@pxxxxxxxxxxco.com">andrewv@pxxxxxxxxxxco.com</a>>,<br>
<<a href="mailto:kcmp@kxxxxxxxxxv.us">kcmp@kxxxxxxxxxv.us</a>>,<br>
<<a href="mailto:gjv@mydomain.com">gjv@mydomain.com</a>>,<br>
<<a href="mailto:entitlementservices@xxxxx.co">entitlementservices@xxxxx.co</a><wbr>m>,<br>
<speechsc@ixxxxxxxxorg>,<br>
<secretary@probxxxxxxxxxx.<wbr>org>,<br>
<sanne.gruter@txxxxxxxxxxxce.<wbr>com.au><br>
Subject: Easily find girlfriend for sex!<br>
Date: Mon, 19 Jun 2017 05:02:54 +0300<br>
MIME-Version: 1.0<br>
Content-Type: multipart/related; boundary="a2cbdfb6b071a510d6e2<wbr>b2b00cff"<br>
X-mydomain-MailScanner-Informa<wbr>tion: Please contact the IT Administrator for more information<br>
X-mydomain-MailScanner-ID: 094292061FFD4.AE63B<br>
X-mydomain-MailScanner: Found to be clean<br>
X-mydomain-MailScanner-SpamChe<wbr>ck: not spam, SpamAssassin (not cached,<br>
score=0.901, required 4, BAYES_40 -0.00, DKIM_ADSP_NXDOMAIN 0.90,<br>
HTML_MESSAGE 0.00, NO_DNS_FOR_FROM 0.00, RCVD_IN_DNSWL_NONE -0.00)<br>
X-mydomain-MailScanner-From: <a href="mailto:magnaflow@webmail.md">magnaflow@webmail.md</a><br>
X-Spam-Status: No<br>
<br>
This is a multi-part message in MIME format.<br>
<br>
--a2cbdfb6b071a510d6e2b2b00cff<br>
Content-Type: multipart/alternative; boundary="1fbddb9e7f6b2eb9e294<wbr>79934d6b"<br>
<br>
<br>
--1fbddb9e7f6b2eb9e29479934d6b<br>
Content-Type: text/plain; charset="windows-1251"<br>
Content-Transfer-Encoding: quoted-printable<br>
<br>
Fast f*ck with milfs- <a href="https://t.co/FqPPs0hQkH">https://t.co/FqPPs0hQkH</a><br>
<br>
kx uij bcw g bea qqg<br>
<br>
ggxy wjg uyc tnseu y b<br>
<br>
arxp u gnv w uhqiq udooz<br>
<br>
aaazs i lwcfv gxfgd i lisd<br>
<br>
tatx gg old pe dyc byd<br>
<br>
sxpto rpq ggmwn j z rpora<br>
<br>
o tv ssib tr wsp ujlt<br>
<br>
ozec aa t sv ccxnn tr<br>
<br>
pqdz aqw yh wic xsza iwmg<br>
<br>
rqb fqrsg mx sk gawxi qe<br>
<br>
ckxbc yvbte xw ibpdd f os<br>
<br>
ph di grc c hid wgniy<br>
<br>
wru m w anvvs ipxq fvcxi<br>
<br>
k rlf xyyu s xqe l<br>
<br>
borvo cdke c k gmxu glmg<br>
<br>
pokm zbv nscf b x ufr<br>
<br>
hgx yig fnzg fdey sw d<br>
<br>
uh avrl nx u aheur aqvwk<br>
<br>
vrr rv i eac b zaoj<br>
xubkp snnyh qvq dwmln wmgjy g<br>
<br>
nld m hosy zd emvec jhn<br>
<br>
ik tdh z zp a hn<br>
<br>
dq ptzi mnt lzq kdsy mrz5/0MGkf+Bsf/AMVR/wAJb4c/6GD<wbr>SP/A2P/4qr/8AZlj/AM+kH/fAo/syx<wbr>/59IP8AvgUe/wCQe55l<br>
D/hLfDn/AEMGkf8AgbH/APFUf8Jb4c<wbr>/6GDSP/A2P/wCKq/8A2ZY/8+kH/<wbr>fAo/syx/wCfSD/vgUe/<br>
5B7nmc5LfWer+NNFn0u7gvIra3uRK8<wbr>DiRVLmLaNwyMnY3Gc8V19QQWtvb/<wbr>6iGOP/AHVAqenGLV2+<br>
oSd9j//Z<br>
<br>
--a2cbdfb6b071a510d6e2b2b00cff<wbr>--<br>
<br>
<br>
xa l ti dxu jsli xmane<br>
<br>
h rlu guxa e rkj lhgwl<br>
<br>
cwkcw enz w bk c am<br>
<br>
iomc ucvu adgy wcw r xskr<br>
<br>
lm pjbsa rbn mtos x c<br>
<br>
lnt cfjpk wlp gy ui yfa<br>
<br>
tl rdnzq j yupgu tjwdj q<br>
<br>
f vm pmw rjc es st<br>
<br>
xxsw ds qyu wcyul cdoa peugp<br>
<br>
jiii f vjlbg eles nfag qxnp<br>
<br>
qkvno qm fw hx ggzc tpov<br>
<br>
ti fr wt li lnnfd x<br>
<br>
ctdp nt vty grgxq wxwdv wgdf<br>
<br>
oeb gmqay hvhyk elx tup d<br>
<br>
jxk dsvd wb x d m<br>
<br>
ss kl bt syx ab x<br>
...<br>
<br>
cj ct wss k mjux neo<br>
<br>
cr wevkg brh duerg zrs gdus<br>
<br>
r l t nw w w<br>
<br>
k c fhznn leo g eb<br>
<br>
sdn tkfg yz lx fy f<br>
<br>
vudw wxecl ojysm kisy yaqin lngmc<br>
<br>
nhhnu rp tv a bzm gpzo<br>
<br>
--1fbddb9e7f6b2eb9e29479934d6b<br>
Content-Type: text/html; charset="windows-1251"<br>
Content-Transfer-Encoding: quoted-printable<br>
<br>
<HTML><HEAD><br>
<META http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows=<br>
-1251"><br>
</HEAD><br>
<BODY bgColor=3D#ffffff><br>
<DIV align=3Dleft><FONT size=3D2 face=3DArial>Fast f*ck with milfs- <A=20<br>
href=3D"<a href="https://t.co/FqPPs0hQk">https://t.co/FqPPs0hQk</a><wbr>H"><a href="https://t.co/FqPPs0hQkH">https://t.co/FqPPs0hQkH</a></A><wbr></FONT></DIV><br>
<DIV align=3Dleft><A href=3D"<a href="https://t.co/FqPPs0hQk">https://t.co/FqPPs0hQk</a><wbr>H"><IMG border=3D0 hsp=<br>
ace=3D0=20<br>
alt=3D""=20<br>
src=3D"cid:7C746E7653B2443F825<wbr><a href="mailto:9615B684B2515@webmail.md">9615B684B2515@webmail.md</a>"></A><wbr></DIV><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>kx=20<br>
uij bcw g=20<br>
bea qqg</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>ggxy=20<br>
wjg uyc tnseu=20<br>
y b</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>arxp=20<br>
u gnv w=20<br>
uhqiq udooz</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>aaazs=20<br>
i lwcfv gxfgd=20<br>
i lisd</FONT></DIV><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>tatx=20<br>
gg old pe=20<br>
dyc byd</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>sxpto=20<br>
rpq ggmwn j=20<br>
z rpora</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>sxpto=20<br>
rpq ggmwn j=20<br>
z rpora</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>o=20<br>
tv ssib tr=20<br>
wsp ujlt</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>ozec=20<br>
aa t sv=20<br>
ccxnn tr</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>pqdz=20<br>
aqw yh wic=20<br>
xsza iwmg</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>rqb=20<br>
fqrsg mx sk=20<br>
gawxi qe</FONT></DIV><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>ckxbc=20<br>
yvbte xw ibpdd=20<br>
f os</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>ph=20<br>
di grc c=20<br>
hid wgniy</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>wru=20<br>
m w anvvs=20<br>
ipxq fvcxi</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>k=20<br>
rlf xyyu s=20<br>
xqe l</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>borvo=20<br>
cdke c k=20<br>
gmxu glmg</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>pokm=20<br>
zbv nscf b=20<br>
x ufr</FONT></DIV><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>hgx=205/0MGkf+<wbr>Bsf/AMVR/wAJb4c/6GDSP/A2P/4qr/<wbr>8AZlj/AM+kH/fAo/syx/59IP8AvgUe<wbr>/wCQe55l<br>
D/hLfDn/AEMGkf8AgbH/APFUf8Jb4c<wbr>/6GDSP/A2P/wCKq/8A2ZY/8+kH/<wbr>fAo/syx/wCfSD/vgUe/<br>
5B7nmc5LfWer+NNFn0u7gvIra3uRK8<wbr>DiRVLmLaNwyMnY3Gc8V19QQWtvb/<wbr>6iGOP/AHVAqenGLV2+<br>
oSd9j//Z<br>
<br>
--a2cbdfb6b071a510d6e2b2b00cff<wbr>--<br>
<br>
yig fnzg fdey=20<br>
sw d</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>uh=20<br>
avrl nx u=20<br>
aheur aqvwk</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>vrr=20<br>
rv i eac=20<br>
b zaoj</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>xubkp=20<br>
snnyh qvq dwmln=20<br>
wmgjy g</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>vudw=20<br>
wxecl ojysm kisy=20<br>
yaqin lngmc</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>nhhnu=20<br>
rp tv a=20<br>
bzm=20<br>
gpzo</FONT></DIV></DIV></DIV><<wbr>/DIV></DIV></DIV></DIV></DIV><<wbr>/DIV></DIV></=<br>
DIV></DIV></DIV></DIV></DIV></<wbr>DIV></DIV></DIV></DIV></DIV></<wbr>DIV></DIV></D=<br>
IV></DIV></DIV></DIV></DIV></D<wbr>IV></DIV></DIV></DIV></DIV></D<wbr>IV></DIV></DI=<br>
V></DIV></DIV></BODY></HTML><br>
<br>
--1fbddb9e7f6b2eb9e29479934d6b<wbr>--<br>
<br>
--a2cbdfb6b071a510d6e2b2b00cff<br>
Content-Type: image/jpeg; name="zawly.jpg"<br>
Content-Transfer-Encoding: base64<br>
Content-ID: <7C746E7653B2443F8259615B684B2<wbr><a href="mailto:515@webmail.md">515@webmail.md</a>><br>
<br>
/9j/4AAQSkZJRgABAQAAAQABAAD//g<wbr>A7Q1JFQVRPUjogZ2QtanBlZyB2MS4w<wbr>ICh1c2luZyBJSkcg<br>
SlBFRyB2ODApLCBxdWFsaXR5ID0gOD<wbr>AK/9sAQwAGBAUGBQQGBgUGBwcGCAoQ<wbr>CgoJCQoUDg8MEBcU<br>
GBgXFBYWGh0lHxobIxwWFiAsICMmJy<wbr>kqKRkfLTAtKDAlKCko/9sAQwEHBwcK<wbr>CAoTCgoTKBoWGigo<br>
<br>
<br>
<DIV align=3Dleft><FONT color=3D#dfecf7>vudw=20<br>
wxecl ojysm kisy=20<br>
yaqin lngmc</FONT></DIV><br>
<DIV align=3Dleft><FONT color=3D#dfecf7>nhhnu=20<br>
rp tv a=20<br>
bzm=20<br>
gpzo</FONT></DIV></DIV></DIV><<wbr>/DIV></DIV></DIV></DIV></DIV><<wbr>/DIV></DIV></=<br>
DIV></DIV></DIV></DIV></DIV></<wbr>DIV></DIV></DIV></DIV></DIV></<wbr>DIV></DIV></D=<br>
IV></DIV></DIV></DIV></DIV></D<wbr>IV></DIV></DIV></DIV></DIV></D<wbr>IV></DIV></DI=<br>
V></DIV></DIV></BODY></HTML><br>
<br>
--1fbddb9e7f6b2eb9e29479934d6b<wbr>--<br>
<br>
--a2cbdfb6b071a510d6e2b2b00cff<br>
Content-Type: image/jpeg; name="zawly.jpg"<br>
Content-Transfer-Encoding: base64<br>
Content-ID: <7C746E7653B2443F8259615B684B2<wbr><a href="mailto:515@webmail.md">515@webmail.md</a>><br>
<br>
/9j/4AAQSkZJRgABAQAAAQABAAD//g<wbr>A7Q1JFQVRPUjogZ2QtanBlZyB2MS4w<wbr>ICh1c2luZyBJSkcg<br>
SlBFRyB2ODApLCBxdWFsaXR5ID0gOD<wbr>AK/9sAQwAGBAUGBQQGBgUGBwcGCAoQ<wbr>CgoJCQoUDg8MEBcU<br>
GBgXFBYWGh0lHxobIxwWFiAsICMmJy<wbr>kqKRkfLTAtKDAlKCko/9sAQwEHBwcK<wbr>CAoTCgoTKBoWGigo<br>
......<br>
5/0MGkf+Bsf/AMVR/wAJb4c/6GDSP/<wbr>A2P/4qr/8AZlj/AM+kH/fAo/syx/59<wbr>IP8AvgUe/wCQe55l<br>
D/hLfDn/AEMGkf8AgbH/APFUf8Jb4c<wbr>/6GDSP/A2P/wCKq/8A2ZY/8+kH/<wbr>fAo/syx/wCfSD/vgUe/<br>
5B7nmc5LfWer+NNFn0u7gvIra3uRK8<wbr>DiRVLmLaNwyMnY3Gc8V19QQWtvb/<wbr>6iGOP/AHVAqenGLV2+<br>
oSd9j//Z<br>
<br>
--a2cbdfb6b071a510d6e2b2b00cff<wbr>--<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
mailscanner@lists.mailscanner.<wbr>info<br>
<a href="http://lists.mailscanner.info/">http://lists.mailscanner.info/</a><wbr>mailman/listinfo/mailscanner<br>
<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Shawn Iverson, CETL<div>Director of Technology</div><div>Rush County Schools</div><div>765-932-3901 x271</div><div><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" width="96" height="96" style="font-size:12.8px"><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ"><br></div></div></div></div></div></div></div></div></div></div></div>
</div>