Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> info: found message size announcement: 1.54 MByte
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> message proxied without processing - message size (1615056) is above 500000 (npSize).
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> Message-Score: added -10 (tlsValencePB) for SSL-TLS-connection-OK, total score for this message is now -10
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] [NoProcessing] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com message proxied without processing (except checks enabled for noprocessing mails)
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com Whitelisted sender address: Some.Guy@huntington.com for recipient username@hyperglobalmega.com
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com DomainKey-Signature found
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com info: found known good HELO 'gw1net.huntington-bank.com' - weight is -2
Jul-18-17 09:58:08 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com Message-Score: added -40 for KnownGoodHelo, total score for this message is now -50
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com [Plugin] calling plugin ASSP_AFC
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com info: using user based attachment check
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com SPAM FOUND bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus'
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com SPAM FOUND replaced bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus' with 'securedoc_20170718T095806.txt'
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com info: 1 attachment found for Level-1
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com whitelisted (bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus')
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com file path changed to  -> /usr/share/assp/discarded/10388--2972738.eml
Jul-18-17 09:58:09 m1-86288-10388 [Worker_1] [TLS-in] [Attachment] 170.128.35.52 <Some.Guy@huntington.com> to: username@hyperglobalmega.com [spam found] bad attachment 'securedoc_20170718T095806.html' cause: 'Java script - possibly locky (ransomware) virus'  [Closing 7 19 2017] -> /usr/share/assp/discarded/10388--2972738.eml



*@huntington.com => good => txt|pdf|htm|html|png|jpg|gif|doc|docx , block => ad[ep]|asx|ba[st]|chm|cmd|com|cpl|crt|dbx|exe|exe\-bin|hlp|ht[ab]|in[fs]|isp|js|jse|lnk|md[abez]|mht|ms[cipt]|nch|pcd|pif|prf|ps1?|reg|sc[frt]|sh[bs]|vb|vb[es]|wms|ws[cfh]