Mailheader from ham mail:
Return-Path: <xxx@gmail.com>
Delivered-To: <ph@xxx.eu>
Received: from amail.xxx.org
by amail.xxx.org (Dovecot) with LMTP id 1Pp6EKueB1jOCQAA2KyavA
for <ph@xxx.eu>; Wed, 19 Oct 2016 18:26:19 +0200
Received: from amail.xxx.org (localhost [127.0.0.1])
by amail.xxx.org (Postfix) with ESMTP id 3AFF0C1139
for <ph@xxx.eu>; Wed, 19 Oct 2016 18:26:19 +0200 (CEST)
X-Virus-Scanned: Debian by xxx at amail.xxx.org
Received: from amail.xxx.org ([127.0.0.1])
by amail.xxx.org (amail.xxx.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 4H0hMDqgFpIa for <ph@xxx.eu>;
Wed, 19 Oct 2016 18:26:18 +0200 (CEST)
Received: from mail-lf0-f65.google.com (mail-lf0-f65.google.com [209.85.215.65])
by amail.xxx.org (Postfix) with ESMTPS id D16D0C110C
for <ph@xxx.eu>; Wed, 19 Oct 2016 18:26:17 +0200 (CEST)
Received: by mail-lf0-f65.google.com with SMTP id x79so2869656lff.2
for <ph@xxx.eu>; Wed, 19 Oct 2016 09:28:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:from:date:message-id:subject:to;
bh=Bvl0RXVcBfaX5H7R70AyaerhsmmLemhcrRRDrVgfKAU=;
b=mV/5oGdUg8s1kNwnPyOWZedIpS3HHtnVju43Qajh44Bv/mQWPgNyq+DydJVfKej+Sp
8yPBPyyOO0wshqhHp05qnxghqDf5llvChz9cwyPw15dstWlP7v4uLk0KQK2OzPZPzOiM
E55y7uk4rWkZglnWyhOATlK2o3D3UYUK8LKkDrZNe4hiFV4zVCmStWuZYHceZtl24t9U
m7vcCNMfAGUY51sxTWHBy5RLINt94xHb7wywKaTiddp27Xjaq8sYeAPGxAYuIEmSyVFU
ABoCo72Sx/+aaiG0yei+8BiK3MdBWRoI1eX0d0SSgdk1aLoyxhSc9CWOh0pwGqr8B1Pi
Qgzw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=Bvl0RXVcBfaX5H7R70AyaerhsmmLemhcrRRDrVgfKAU=;
b=kyISfAmqz0nBuGV/1nn5lzF4kCvnyCfPDckuhAYpdD4ZZfh8XOJGtbFMvEY5Thd3P+
vg0XqKpr/ysMDxFF05GGmSiNy2V7bJG2n6I6UArWs3W66uQAWdRHrxIhFDytbYfCpBQj
xF+Axyz5C0+1gQWgEamZq/F7CpIjgmoMHCr2MFJptf1GRQpJ79gQOTui2fsfTuTz6aiI
QV+iSszHLlVhsa6bjOLultWwuH8rKMpfow8kicofIFcOI2fofHmAEcdMbPPIRYOTa1wE
wswGTIe+GAJuqtmdU9toyJfUFWYuirQfnHAS7wrA/Rj2wx3IQttzGFm/miKKLpeDhVsK
fihA==
X-Gm-Message-State: AA6/9Rke1f2FXHim3BjS1O0xn5z85dqqaWu5vMa/7R4Mcd80ZGN5AZHdEAohSz2L4ni1k7bLWj0JkSjKFPwWkg==
X-Received: by 10.25.74.9 with SMTP id x9mr6383463lfa.176.1476894500296; Wed,
19 Oct 2016 09:28:20 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.25.20.90 with HTTP; Wed, 19 Oct 2016 09:28:19 -0700 (PDT)
From: Jakobo <xxx@gmail.com>
Date: Wed, 19 Oct 2016 18:28:19 +0200
Message-ID: <CAF9YmxcvBQH+n1_PpYsR34HAbOK4kOF3PVK6g_Bf5uhSB6xthw@mail.gmail.com>
Subject: testmail
To: ph@xxx.eu
Content-Type: multipart/alternative; boundary=94eb2c1a1bd60fa0ca053f3a4cf1
Nachrichten-Body
hello
Output from mail.log - ham mail:
Oct 19 18:26:11 amail postfix/postscreen[3567]: CONNECT from [209.85.215.65]:35085 to [188.68.35.13]:25
Oct 19 18:26:17 amail postfix/postscreen[3567]: PASS NEW [209.85.215.65]:35085
Oct 19 18:26:17 amail postfix/smtpd[3570]: connect from mail-lf0-f65.google.com[209.85.215.65]
Oct 19 18:26:17 amail postfix/smtpd[3570]: Anonymous TLS connection established from mail-lf0-f65.google.com[209.85.215.65]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Oct 19 18:26:17 amail postfix/smtpd[3570]: D16D0C110C: client=mail-lf0-f65.google.com[209.85.215.65]
Oct 19 18:26:17 amail postfix/cleanup[3578]: D16D0C110C: message-id=<CAF9YmxcvBQH+n1_PpYsR34HAbOK4kOF3PVK6g_Bf5uhSB6xthw@mail.gmail.com>
Oct 19 18:26:17 amail postfix/qmgr[1445]: D16D0C110C: from=<xxx@gmail.com>, size=2419, nrcpt=1 (queue active)
Oct 19 18:26:18 amail postfix/smtpd[3570]: disconnect from mail-lf0-f65.google.com[209.85.215.65]
Oct 19 18:26:19 amail postfix/smtpd[3589]: connect from localhost[127.0.0.1]
Oct 19 18:26:19 amail postfix/smtpd[3589]: 3AFF0C1139: client=localhost[127.0.0.1]
Oct 19 18:26:19 amail postfix/cleanup[3578]: 3AFF0C1139: message-id=<CAF9YmxcvBQH+n1_PpYsR34HAbOK4kOF3PVK6g_Bf5uhSB6xthw@mail.gmail.com>
Oct 19 18:26:19 amail postfix/qmgr[1445]: 3AFF0C1139: from=<xxx@gmail.com>, size=2866, nrcpt=1 (queue active)
Oct 19 18:26:19 amail postfix/smtpd[3589]: disconnect from localhost[127.0.0.1]
Oct 19 18:26:19 amail amavis[3310]: (03310-01) Passed CLEAN {RelayedOpenRelay}, [209.85.215.65]:35085 [209.85.215.65] <xxx@gmail.com> -> <ph@xxx.eu>, Queue-ID: D16D0C110C, Message-ID: <CAF9YmxcvBQH+n1_PpYsR34HAbOK4kOF3PVK6g_Bf5uhSB6xthw@mail.gmail.com>, mail_id: 4H0hMDqgFpIa, Hits: 1.182, size: 2419, queued_as: 3AFF0C1139, dkim_sd=20120113:gmail.com, 1282 ms, Tests: [BAYES_50=0.8,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,FREEMAIL_FROM=0.001,HTML_MESSAGE=0.001,RCVD_IN_MSPIKE_H3=-0.01,RCVD_IN_MSPIKE_WL=-0.01,RCVD_IN_SORBS_SPAM=0.5,SPF_PASS=-0.001,TVD_SPACE_RATIO=0.001]
Oct 19 18:26:19 amail postfix/smtp[3583]: D16D0C110C: to=<ph@xxx.eu>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.5, delays=0.13/0.02/0.03/1.3, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 3AFF0C1139)
Oct 19 18:26:19 amail postfix/qmgr[1445]: D16D0C110C: removed
Oct 19 18:26:19 amail postfix/lmtp[3590]: 3AFF0C1139: to=<ph@xxx.eu>, relay=amail.xxx.org[private/dovecot-lmtp], delay=0.1, delays=0.01/0.03/0/0.06, dsn=2.0.0, status=sent (250 2.0.0 <ph@xxx.eu> 1Pp6EKueB1jOCQAA2KyavA Saved)
Oct 19 18:26:19 amail postfix/qmgr[1445]: 3AFF0C1139: removed
Mailheader spam mail:
Return-Path: <xxx@gmail.com>
Delivered-To: <ph@xxx.eu>
Received: from amail.xxx.org
by amail.xxx.org (Dovecot) with LMTP id xEJFDNieB1gHDgAA2KyavA
for <ph@xxx.eu>; Wed, 19 Oct 2016 18:27:04 +0200
Received: from amail.xxx.org (localhost [127.0.0.1])
by amail.xxx.org (Postfix) with ESMTP id 2EB13C1173
for <ph@xxx.eu>; Wed, 19 Oct 2016 18:27:04 +0200 (CEST)
X-Virus-Scanned: Debian by xxx at amail.xxx.org
Received: from amail.xxx.org ([127.0.0.1])
by amail.xxx.org (amail.xxx.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id sLiltIsMeKb6 for <ph@xxx.eu>;
Wed, 19 Oct 2016 18:27:03 +0200 (CEST)
Received: from mail-lf0-f46.google.com (mail-lf0-f46.google.com [209.85.215.46])
by amail.xxx.org (Postfix) with ESMTPS id 20DEDC1139
for <ph@xxx.eu>; Wed, 19 Oct 2016 18:27:03 +0200 (CEST)
Received: by mail-lf0-f46.google.com with SMTP id b75so30965272lfg.3
for <ph@xxx.eu>; Wed, 19 Oct 2016 09:29:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:from:date:message-id:subject:to;
bh=tUgT4bLDV4qIrzuV7pj9rpgXn2TnuBHoUpHxsuHyRBk=;
b=0iBy/IM5v4qnT1ygNyQtx7t9yw9NGeC7kLRF0vTtPhSR276kSFzl/1P1k1Oq9puvXM
X6Mn0g8XiQS7hbEpL6LrOwfwCRwmldfHf37SqzE8Q5na7wMNVM8KLXVLGs61AZZXh2ay
7Xmi7UEUFz0YzxVc5wIUV1WITlrmwaiAvzc5+wAA1LzDI1hX44x0OPVVenrmGjxUKD4Z
Zo+I7Xf9tNRyZ8/eUzLvIotgPV8bN218LujT7CMsOPwY82bYwgLSzfKvRwyyVbbgsKDd
bGCC5YaOufpEmv9lvP0ey2U83VslPUwOHPOFHoSihrgaSn1CyYV+5zWzfzdvGjGtbh+f
6lTA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=tUgT4bLDV4qIrzuV7pj9rpgXn2TnuBHoUpHxsuHyRBk=;
b=hGAXDa50AMA6xjOLGGXiUjS3Ih74Ik/vW+bys98rJBYx7x9hj4+ZjnsK4eLysH2kCE
qvSmKs2eXR/yle0CXsUc4d/Y+J5g0KeGxXLLluZN8zUftiCTvLaFldNM22cmu/zruKlR
W0XENaubjRDtyH5FxRjwFStWIlzKZN4tvIoMMgce59igeCmUDEGiOFuutCGir8FBL0l+
vSq7S7pNlWDv4k6jTftXI+apDjvytQgQpavBeQGMpCdqHFt92s9w4AHczJTkzcGLqqsS
A4ClzGBxE6GKhxFBq5ICgpvSQwdPCbatTRB3ZeopCO3/KRrsHgX4D+0c8yh0Bw3sqVyy
oryg==
X-Gm-Message-State: AA6/9Rl4xizVSykIKwpOrbAQUqe64v2Yb/NDhHtQuj3gjfMwfDSczuMUxVzzS7LEH9cqnl66Nl5lhFb6TE68BA==
X-Received: by 10.25.15.220 with SMTP id 89mr6533482lfp.101.1476894545371;
Wed, 19 Oct 2016 09:29:05 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.25.20.90 with HTTP; Wed, 19 Oct 2016 09:29:05 -0700 (PDT)
From: Jakobo <xxx@gmail.com>
Date: Wed, 19 Oct 2016 18:29:05 +0200
Message-ID: <CAF9Ymxd0uJ_+mkaSuuW=bYOyfaNSEUB6TvGwCnxCjkMN+P45sQ@mail.gmail.com>
Subject: test spam
To: ph@xxx.eu
Content-Type: multipart/alternative; boundary=001a113f9102bf6db7053f3a4ee7
Output from mail.log - spam mail:
PASS NEW [209.85.215.46]:36600
Oct 19 18:27:02 amail postfix/smtpd[3570]: connect from mail-lf0-f46.google.com[209.85.215.46]
Oct 19 18:27:03 amail postfix/smtpd[3570]: Anonymous TLS connection established from mail-lf0-f46.google.com[209.85.215.46]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Oct 19 18:27:03 amail postfix/smtpd[3570]: 20DEDC1139: client=mail-lf0-f46.google.com[209.85.215.46]
Oct 19 18:27:03 amail postfix/cleanup[3578]: 20DEDC1139: message-id=<CAF9Ymxd0uJ_+mkaSuuW=bYOyfaNSEUB6TvGwCnxCjkMN+P45sQ@mail.gmail.com>
Oct 19 18:27:03 amail postfix/qmgr[1445]: 20DEDC1139: from=<xxx@gmail.com>, size=2556, nrcpt=1 (queue active)
Oct 19 18:27:03 amail postfix/smtpd[3570]: disconnect from mail-lf0-f46.google.com[209.85.215.46]
Oct 19 18:27:04 amail postfix/smtpd[3589]: connect from localhost[127.0.0.1]
Oct 19 18:27:04 amail postfix/smtpd[3589]: 2EB13C1173: client=localhost[127.0.0.1]
Oct 19 18:27:04 amail postfix/cleanup[3578]: 2EB13C1173: message-id=<CAF9Ymxd0uJ_+mkaSuuW=bYOyfaNSEUB6TvGwCnxCjkMN+P45sQ@mail.gmail.com>
Oct 19 18:27:04 amail postfix/qmgr[1445]: 2EB13C1173: from=<xxx@gmail.com>, size=3003, nrcpt=1 (queue active)
Oct 19 18:27:04 amail postfix/smtpd[3589]: disconnect from localhost[127.0.0.1]
Oct 19 18:27:04 amail postfix/lmtp[3590]: 2EB13C1173: to=<ph@xxx.eu>, relay=amail.xxx.org[private/dovecot-lmtp], delay=0.04, delays=0.01/0/0/0.03, dsn=2.0.0, status=sent (250 2.0.0 <ph@xxx.eu> xEJFDNieB1gHDgAA2KyavA Saved)
Oct 19 18:27:04 amail postfix/qmgr[1445]: 2EB13C1173: removed
Oct 19 18:27:04 amail amavis[3309]: (03309-01) Passed SPAM {RelayedOpenRelay}, [209.85.215.46]:36600 [209.85.215.46] <xxx@gmail.com> -> <ph@xxx.eu>, Queue-ID: 20DEDC1139, Message-ID: <CAF9Ymxd0uJ_+mkaSuuW=bYOyfaNSEUB6TvGwCnxCjkMN+P45sQ@mail.gmail.com>, mail_id: sLiltIsMeKb6, Hits: 1001.181, size: 2556, queued_as: 2EB13C1173, dkim_sd=20120113:gmail.com, 978 ms, Tests: [BAYES_50=0.8,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,FREEMAIL_FROM=0.001,GTUBE=1000,HTML_MESSAGE=0.001,RCVD_IN_MSPIKE_H3=-0.01,RCVD_IN_MSPIKE_WL=-0.01,RCVD_IN_SORBS_SPAM=0.5,SPF_PASS=-0.001]
Oct 19 18:27:04 amail postfix/smtp[3583]: 20DEDC1139: to=<ph@xxx.eu>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.1, delays=0.13/0/0.03/0.99, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 2EB13C1173)
Oct 19 18:27:04 amail postfix/qmgr[1445]: 20DEDC1139: removed
