Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> info: found message size announcement: 1.54 MByte
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> message proxied without processing - message size (1615056) is above 500000 (npSize).
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> Message-Score: added -10 (tlsValencePB) for SSL-TLS-connection-OK, total score for this message is now -10
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] [NoProcessing] 170.128.35.52 <[email protected]> to: [email protected] message proxied without processing (except checks enabled for noprocessing mails)
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> to: [email protected] Whitelisted sender address: [email protected] for recipient [email protected]
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> to: [email protected] DomainKey-Signature found
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> to: [email protected] info: found known good HELO 'gw1net.huntington-bank.com' - weight is -2
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> to: [email protected] Message-Score: added -40 for KnownGoodHelo, total score for this message is now -50
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> to: [email protected] [Plugin] calling plugin ASSP_AFC
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <[email protected]> to: [email protected] info: using user based attachment check
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <[email protected]> to: [email protected] SPAM FOUND bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus'
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <[email protected]> to: [email protected] SPAM FOUND replaced bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus' with 'securedoc_20170718T095806.txt'
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <[email protected]> to: [email protected] info: 1 attachment found for Level-1
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <[email protected]> to: [email protected] whitelisted (bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus')
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <[email protected]> to: [email protected] file path changed to  -> /usr/share/assp/discarded/10388--2972738.eml
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <[email protected]> to: [email protected] [spam found] bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus'  [Closing 7 19 2017] -> /usr/share/assp/discarded/10388--2972738.eml



*@huntington.com => good => txt|pdf|htm|html|png|jpg|gif|doc|docx , block => ad[ep]|asx|ba[st]|chm|cmd|com|cpl|crt|dbx|exe|exe\-bin|hlp|ht[ab]|in[fs]|isp|js|jse|lnk|md[abez]|mht|ms[cipt]|nch|pcd|pif|prf|ps1?|reg|sc[frt]|sh[bs]|vb|vb[es]|wms|ws[cfh]