You may be having difficulties with spam coming from non-static IP addresses, like emails sent from a cellular phone. Relying on sender reputation score is not always effective, since a device could continue sending spam with a clean reputation score simply by rejoining the network and obtaining another IP address. Additionally, an innocent device could be accidentally blacklisted.
To combat this issue, you can control spam from SMTP clients with dynamic addresses by using endpoint reputation. This recipe guides you through the process of configuring endpoint reputation in FortiMail.
Endpoint reputation does not use the usual IP address identifier. Instead it uses subscriber ID, login ID, MSISDN, or a SIM card on a cell phone to identify the sender.