This shows a real spam collected in a user quarantine. This shows the headers of the messages with the X-MailCleaner anti spam tags and filtering process

Received: by mailcleaner.example.net stage2 with id 1UZlLi-0006c1-D2
for <john.doe@example.net>; Tue, 07 May 2013 19:06:46 +0200
Received: from [178.123.104.61] (helo=178.123.104.61)
by mailcleaner.example.net stage1 with smtp
(Exim MailCleaner)
id 1UZlLg-0006be-Na
for <john.doe@example.net>
from <lumleyl42@cetuc.puc-rio.br>; Tue, 07 May 2013 19:06:46 +0200
X-MailCleaner-SPF: none
X-AntiVirus: Checked by Dr.Web [version: 7.0.4.09220, engine: 7.0.100.09170, virus records: 3665277, updated: 13.02.2013]
Received: from unknown (HELO localhost) (lumleyl42@cetuc.puc-rio.br@217.45.79.223)
by 178.123.104.61 with ESMTPA; Tue, 7 May 2013 20:10:11 +0400
Message-ID: <002001ce4b3c$bbb7f800$d92d4fdf@romka118539558>
From: "Tessa Nolan" <lumleyl42@cetuc.puc-rio.br>
To: <john.doe@example.net>
Subject: Update Letter
Date: Tue, 7 May 2013 19:58:22 +0400
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1250";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-MailCleaner-RDNS: invalid reverse DNS for 178.123.104.61
X-Commtouch-ctIPd-RefID: tid=0001.0A0C0301.5189347C.0043
X-Commtouch: is spam (ip: permfail)
X-MailCleaner-Information: Please contact support@example.net for more information
X-MailCleaner-ID: 1UZlLi-0006c1-D2
X-MailCleaner: Found to be clean
X-MailCleaner-SpamCheck: spam, Commtouch (ip: permfail)

G T R_L did me twice my capital now! G T R_L climbed up 2 cents and its
soaring to 14 cent immediately. We warned you it would soar to 15 cent now!
Purchase G T R_L now.