This shows a real spam collected in a user quarantine. This shows the headers of the messages with the X-MailCleaner anti spam tags and filtering process

Received: by mailcleaner stage2 with id 1UJmP2-0004oI-Oj
for <john.doe@example.net>; Sun, 24 Mar 2013 16:00:08 +0100
Received: from [181.28.149.27] (helo=27-149-28-181.fibertel.com.ar)
by mailcleaner.example.net stage1 with esmtp
(Exim MailCleaner)
id 1UJmP1-0004mI-EC
for <john.doe@example.net>
from <4DB9729A1E71EBAE@collegecoochie.com>; Sun, 24 Mar 2013 16:00:08 +0100
X-MailCleaner-SPF: softfail
Message-ID: <20130324115956.01B1658C299E0381AAF5.18DE1@27-149-28-181.fibertel.com.ar>
Date: Sun, 24 Mar 2013 11:59:56 -0300
From: "Buy today" <4DB9729A1E71EBAE@collegecoochie.com>
To: <john.doe@example.net>
Subject: Huge 74% discount for john.doe
List-Unsubscribe: <mailto:unsubscribe-9BF39C9ACB1@vanpakinc.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-MailCleaner-RDNS: invalid reverse DNS for 181.28.149.27
X-Commtouch-ctIPd-RefID: tid=0001.0A0C0303.514F14FC.006B
X-Commtouch: is spam (ip: permfail)
X-MailCleaner-Information: Please contact support@example.net for more information
X-MailCleaner-ID: 1UJmP2-0004oI-Oj
X-MailCleaner: Found to be clean
X-MailCleaner-SpamCheck: spam, Commtouch (ip: permfail)

Hello john.doe, don't slow!!
Last day huge discount!

We have more than 10.000 pills online.

Today Bestsellers:

**** Propceia - 0.18$
**** Levirta - 1.65$
**** Ciails - 1.80$
**** Viarga - 0.56$

Order here http://UErgsk.doctorclie.ru/