--- /dev/null
+Delivered-To: vstakhov@gmail.com\r
+Received: by 2002:a6b:e610:0:0:0:0:0 with SMTP id g16-v6csp2167100ioh;\r
+ Mon, 1 Oct 2018 07:01:38 -0700 (PDT)\r
+X-Google-Smtp-Source: ACcGV600DIuvoFwRUFUQRw3uefS2vbyPNMVmB4EVMRmpQN5W/q6VFysTqCZxRezyjaLn+UH6TEhI\r
+X-Received: by 2002:a1c:4887:: with SMTP id v129-v6mr8698698wma.139.1538402498770;\r
+ Mon, 01 Oct 2018 07:01:38 -0700 (PDT)\r
+ARC-Seal: i=1; a=rsa-sha256; t=1538402498; cv=none;\r
+ d=google.com; s=arc-20160816;\r
+ b=uKHnpS+DExFKAe2EsUhcF9Nx9aYDFuqxV8cUYpabBGOXa3cO33wzlwEINeoG0GqESe\r
+ nacEwvHeHYplUkAM2SQz+AdSTjzk5TSUzqdzyNox6KU3OripFgApCaFGXVn7rQqU0YYh\r
+ OcB/0aBpU61ix2buEETdAV+umKd+qKzos5V4WxJmulVWES9pWi44SdXJK9yb+/savl49\r
+ Gipc0kSdiAkB7r1qMt13tm5oZ+66sCQxCK9IfvOj0QIf5sALgwHsTCSq5yfyCZdtFwjn\r
+ CZPduL1EwfFIUx+6axy1MEyImDsLhJv4pDKpFfko4X59hoVFGi63YU89YmsO6guTWOZ0\r
+ jwmw==\r
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;\r
+ h=content-transfer-encoding:content-language:mime-version:user-agent\r
+ :date:message-id:autocrypt:openpgp:subject:from:to:dkim-signature;\r
+ bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=oGaANMvTT16cEY+U7T08L9TiRD7bE5KwtJa2Fl3p+2813bomvchlWQdCh65CMcxm3+\r
+ felXzope3YyDKJmf8waAEG/jMK6VnTz+2hTkUm/p08LLoOv6u6OoRWsI+h8cGgnS3ylG\r
+ xidRereLZxqaC6PC/U5OSSJ63UgOu6S//hL+o1WYdKhGoQyj2jOD3DxnCY7z/qq048Al\r
+ SNqycpynWXdoZjwrhB6HtydlO3VQSdPL5qaHNFLKCCTvaQ89Dlk5R/01rWeRKxnSM8bI\r
+ w4LBKGDUrpGYE/A3AvS+ByZu7ASGeg8cEL2GPfNlvnmy9sAQj0pU1Q/xmHyP1NPxUnra\r
+ xCpg==\r
+ARC-Authentication-Results: i=1; mx.google.com;\r
+ dkim=pass header.i=@highsecure.ru header.s=dkim header.b="oVxOH/NU";\r
+ spf=pass (google.com: domain of vsevolod@highsecure.ru designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@highsecure.ru\r
+Return-Path: <vsevolod@highsecure.ru>\r
+Received: from mail.highsecure.ru (mail.highsecure.ru. [88.99.142.95])\r
+ by mx.google.com with ESMTPS id z129-v6si8080952wmg.157.2018.10.01.07.01.38\r
+ for <vstakhov@gmail.com>\r
+ (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\r
+ Mon, 01 Oct 2018 07:01:38 -0700 (PDT)\r
+Received-SPF: pass (google.com: domain of vsevolod@highsecure.ru designates 88.99.142.95 as permitted sender) client-ip=88.99.142.95;\r
+Authentication-Results: mx.google.com;\r
+ dkim=pass header.i=@highsecure.ru header.s=dkim header.b="oVxOH/NU";\r
+ spf=pass (google.com: domain of vsevolod@highsecure.ru designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@highsecure.ru\r
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=highsecure.ru;\r
+ s=dkim; t=1538402490; h=from:from:sender:reply-to:subject:subject:date:date:\r
+ message-id:message-id:to:to:cc:mime-version:mime-version:\r
+ content-type:content-type:\r
+ content-transfer-encoding:content-transfer-encoding:in-reply-to:\r
+ references; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=oVxOH/NUK6jcI0tcG73U5qZr2kj4WWZqzOCi3n08KHHW3w/nDFs/V1GfJ5VJy8O0Si+Qtl\r
+ yx7E+loc2sAXpzlis3myUL8AdACQlyzuxujwY3kj4/7ZmdMaN7/x9mXfnxHfFy0MkbdINq\r
+ e6mVhumtfbbWA+rJBcMvxQBB+IDgDks=\r
+To: vstakhov@gmail.com\r
+From: Vsevolod Stakhov <vsevolod@highsecure.ru>\r
+Subject: test\r
+Message-ID: <5ab16dfe-f4e5-3b01-6ee2-9fccb68fc1fc@highsecure.ru>\r
+Date: Mon, 1 Oct 2018 15:01:29 +0100\r
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0)\r
+ Gecko/20100101 Thunderbird/52.9.1\r
+MIME-Version: 1.0\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Language: en-US\r
+Content-Transfer-Encoding: 7bit\r
+Authentication-Results: mail.highsecure.ru;\r
+ auth=pass smtp.auth=vsevolod@highsecure.ru smtp.mailfrom=vsevolod@highsecure.ru\r
+\r
+Malicious content.
\ No newline at end of file
--- /dev/null
+Delivered-To: vstakhov@gmail.com\r
+Received: by 2002:a6b:e610:0:0:0:0:0 with SMTP id g16-v6csp2201135ioh;\r
+ Mon, 1 Oct 2018 07:27:55 -0700 (PDT)\r
+X-Google-Smtp-Source: ACcGV6270qkcKzPIvBSxvaIpBZbNAdj6Qp7qqenTBQi6YaUXdBFD2+2ZYmZaw2WM/SxZP2kYTIz2\r
+X-Received: by 2002:adf:93e6:: with SMTP id 93-v6mr1901854wrp.81.1538404075350;\r
+ Mon, 01 Oct 2018 07:27:55 -0700 (PDT)\r
+ARC-Seal: i=1; a=rsa-sha256; t=1538404075; cv=none;\r
+ d=google.com; s=arc-20160816;\r
+ b=RaCtnaDmStierMmg+OOhEkzaXxQVAcFO/Rc/ey+6INIQJx+lKVO+dWT0qNA7cZcwUm\r
+ my6bQE0AZNf45s3bVmQeECtvfe2yS7zVSRx1HFTJJ+iiNR9iSvC8j5PUz1VShRez9Csm\r
+ 4tqy1ic5t0t9NoOL24f82ju5gTbpl0cc7aH9sMn8gr4DwBxnvuJu4+EdP1QcDKE9qTVa\r
+ QpjOOOpnkmA46PypufkX+ENaq+bfNDpgbAppKfz2rmutF49jouF8XkrB9Z2ZRWPHE4YA\r
+ gHJ78GT/4NPlFNo95Ik/nDdnUI6gHkTmiSS6aDJh1W5MiXbkuLT8DSa4Htc43nIr2/m6\r
+ uQ7g==\r
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;\r
+ h=content-transfer-encoding:content-language:mime-version:user-agent\r
+ :date:message-id:autocrypt:openpgp:to:subject:from:dkim-signature;\r
+ bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=utFz5J7XQOwR6hdXC0uF+PX17r57baD9GXm5v+3ztobSCFAI0ex+psgbX2gBo6izq3\r
+ Vo/QjJ9SeJEYhTsLR7jZ3o5meWXJZJqRH073eZlisUGOnDJkJQ5aN/4DY0L5btqLYhwI\r
+ mJ7c3g4Uh9zFNK8eSIDLdLAIPXNXWRT3SvoS4Ck9ok7fivfZzNfKIPUXbQFIql4+vIAj\r
+ t1v47QwIrTU+ojwBfaaDjtQEnOB2t8c7RNXys+LQFawG6QZGmG8PCrkVZTU+1v23qbUb\r
+ M7kDhvSISDchgSrHFwSIniXnnqZe6MRm24xlfW5yebFgmjzMCZQLiyA+WuMIUVxDJpKO\r
+ V/6g==\r
+ARC-Authentication-Results: i=1; mx.google.com;\r
+ dkim=pass header.i=@rspamd.com header.s=dkim header.b=iuniqXuF;\r
+ spf=pass (google.com: domain of vsevolod@rspamd.com designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@rspamd.com\r
+Return-Path: <vsevolod@rspamd.com>\r
+Received: from mail.highsecure.ru (mail.highsecure.ru. [88.99.142.95])\r
+ by mx.google.com with ESMTPS id u13-v6si8362844wmd.167.2018.10.01.07.27.54\r
+ for <vstakhov@gmail.com>\r
+ (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\r
+ Mon, 01 Oct 2018 07:27:55 -0700 (PDT)\r
+Received-SPF: pass (google.com: domain of vsevolod@rspamd.com designates 88.99.142.95 as permitted sender) client-ip=88.99.142.95;\r
+Authentication-Results: mx.google.com;\r
+ dkim=pass header.i=@rspamd.com header.s=dkim header.b=iuniqXuF;\r
+ spf=pass (google.com: domain of vsevolod@rspamd.com designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@rspamd.com\r
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rspamd.com; s=dkim;\r
+ t=1538404074; h=from:from:sender:reply-to:subject:subject:date:date:\r
+ message-id:message-id:to:to:cc:mime-version:mime-version:\r
+ content-type:content-type:\r
+ content-transfer-encoding:content-transfer-encoding:in-reply-to:\r
+ references; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=iuniqXuFCfL63FjU4vXZQEjBRMXkRMwF3kAv+5heeVbgsAvpd+t4I/6w6CU+GVX8xLmsuW\r
+ jz+Ycmobj0O7eaw+93gfJ3rYnWNA4/WV2J3vAPSpqgBloYpoktEUOQcNm0VsWiCt6WNAq2\r
+ Ad2CNaQOOmvDMC5lBfp+YVJITiMcYoU=\r
+From: Vsevolod Stakhov <vsevolod@rspamd.com>\r
+Subject: test\r
+To: vstakhov@gmail.com\r
+Message-ID: <6f4415bf-ff61-f0f5-b60c-ba71a56b9e48@rspamd.com>\r
+Date: Mon, 1 Oct 2018 15:27:53 +0100\r
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0)\r
+ Gecko/20100101 Thunderbird/52.9.1\r
+MIME-Version: 1.0\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Language: en-US\r
+Content-Transfer-Encoding: 7bit\r
+Authentication-Results: mail.highsecure.ru;\r
+ auth=pass smtp.auth=vsevolod@highsecure.ru smtp.mailfrom=vsevolod@rspamd.com\r
+\r
+Evil content
\ No newline at end of file
--- /dev/null
+Delivered-To: vstakhov@gmail.com\r
+Received: by 2002:a6b:e610:0:0:0:0:0 with SMTP id g16-v6csp2167100ioh;\r
+ Mon, 1 Oct 2018 07:01:38 -0700 (PDT)\r
+X-Google-Smtp-Source: ACcGV600DIuvoFwRUFUQRw3uefS2vbyPNMVmB4EVMRmpQN5W/q6VFysTqCZxRezyjaLn+UH6TEhI\r
+X-Received: by 2002:a1c:4887:: with SMTP id v129-v6mr8698698wma.139.1538402498770;\r
+ Mon, 01 Oct 2018 07:01:38 -0700 (PDT)\r
+ARC-Seal: i=1; a=rsa-sha256; t=1538402498; cv=none;\r
+ d=google.com; s=arc-20160816;\r
+ b=uKHnpS+DExFKAe2EsUhcF9Nx9aYDFuqxV8cUYpabBGOXa3cO33wzlwEINeoG0GqESe\r
+ nacEwvHeHYplUkAM2SQz+AdSTjzk5TSUzqdzyNox6KU3OripFgApCaFGXVn7rQqU0YYh\r
+ OcB/0aBpU61ix2buEETdAV+umKd+qKzos5V4WxJmulVWES9pWi44SdXJK9yb+/savl49\r
+ Gipc0kSdiAkB7r1qMt13tm5oZ+66sCQxCK9IfvOj0QIf5sALgwHsTCSq5yfyCZdtFwjn\r
+ CZPduL1EwfFIUx+6axy1MEyImDsLhJv4pDKpFfko4X59hoVFGi63YU89YmsO6guTWOZ0\r
+ jwmw==\r
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;\r
+ h=content-transfer-encoding:content-language:mime-version:user-agent\r
+ :date:message-id:autocrypt:openpgp:subject:from:to:dkim-signature;\r
+ bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=oGaANMvTT16cEY+U7T08L9TiRD7bE5KwtJa2Fl3p+2813bomvchlWQdCh65CMcxm3+\r
+ felXzope3YyDKJmf8waAEG/jMK6VnTz+2hTkUm/p08LLoOv6u6OoRWsI+h8cGgnS3ylG\r
+ xidRereLZxqaC6PC/U5OSSJ63UgOu6S//hL+o1WYdKhGoQyj2jOD3DxnCY7z/qq048Al\r
+ SNqycpynWXdoZjwrhB6HtydlO3VQSdPL5qaHNFLKCCTvaQ89Dlk5R/01rWeRKxnSM8bI\r
+ w4LBKGDUrpGYE/A3AvS+ByZu7ASGeg8cEL2GPfNlvnmy9sAQj0pU1Q/xmHyP1NPxUnra\r
+ xCpg==\r
+ARC-Authentication-Results: i=1; mx.google.com;\r
+ dkim=pass header.i=@highsecure.ru header.s=dkim header.b="oVxOH/NU";\r
+ spf=pass (google.com: domain of vsevolod@highsecure.ru designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@highsecure.ru\r
+Return-Path: <vsevolod@highsecure.ru>\r
+Received: from mail.highsecure.ru (mail.highsecure.ru. [88.99.142.95])\r
+ by mx.google.com with ESMTPS id z129-v6si8080952wmg.157.2018.10.01.07.01.38\r
+ for <vstakhov@gmail.com>\r
+ (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\r
+ Mon, 01 Oct 2018 07:01:38 -0700 (PDT)\r
+Received-SPF: pass (google.com: domain of vsevolod@highsecure.ru designates 88.99.142.95 as permitted sender) client-ip=88.99.142.95;\r
+Authentication-Results: mx.google.com;\r
+ dkim=pass header.i=@highsecure.ru header.s=dkim header.b="oVxOH/NU";\r
+ spf=pass (google.com: domain of vsevolod@highsecure.ru designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@highsecure.ru\r
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=highsecure.ru;\r
+ s=dkim; t=1538402490; h=from:from:sender:reply-to:subject:subject:date:date:\r
+ message-id:message-id:to:to:cc:mime-version:mime-version:\r
+ content-type:content-type:\r
+ content-transfer-encoding:content-transfer-encoding:in-reply-to:\r
+ references; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=oVxOH/NUK6jcI0tcG73U5qZr2kj4WWZqzOCi3n08KHHW3w/nDFs/V1GfJ5VJy8O0Si+Qtl\r
+ yx7E+loc2sAXpzlis3myUL8AdACQlyzuxujwY3kj4/7ZmdMaN7/x9mXfnxHfFy0MkbdINq\r
+ e6mVhumtfbbWA+rJBcMvxQBB+IDgDks=\r
+To: vstakhov@gmail.com\r
+From: Vsevolod Stakhov <vsevolod@highsecure.ru>\r
+Subject: test\r
+Message-ID: <5ab16dfe-f4e5-3b01-6ee2-9fccb68fc1fc@highsecure.ru>\r
+Date: Mon, 1 Oct 2018 15:01:29 +0100\r
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0)\r
+ Gecko/20100101 Thunderbird/52.9.1\r
+MIME-Version: 1.0\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Language: en-US\r
+Content-Transfer-Encoding: 7bit\r
+Authentication-Results: mail.highsecure.ru;\r
+ auth=pass smtp.auth=vsevolod@highsecure.ru smtp.mailfrom=vsevolod@highsecure.ru\r
+\r
--- /dev/null
+Delivered-To: vstakhov@gmail.com\r
+Received: by 2002:a6b:e610:0:0:0:0:0 with SMTP id g16-v6csp2201135ioh;\r
+ Mon, 1 Oct 2018 07:27:55 -0700 (PDT)\r
+X-Google-Smtp-Source: ACcGV6270qkcKzPIvBSxvaIpBZbNAdj6Qp7qqenTBQi6YaUXdBFD2+2ZYmZaw2WM/SxZP2kYTIz2\r
+X-Received: by 2002:adf:93e6:: with SMTP id 93-v6mr1901854wrp.81.1538404075350;\r
+ Mon, 01 Oct 2018 07:27:55 -0700 (PDT)\r
+ARC-Seal: i=1; a=rsa-sha256; t=1538404075; cv=none;\r
+ d=google.com; s=arc-20160816;\r
+ b=RaCtnaDmStierMmg+OOhEkzaXxQVAcFO/Rc/ey+6INIQJx+lKVO+dWT0qNA7cZcwUm\r
+ my6bQE0AZNf45s3bVmQeECtvfe2yS7zVSRx1HFTJJ+iiNR9iSvC8j5PUz1VShRez9Csm\r
+ 4tqy1ic5t0t9NoOL24f82ju5gTbpl0cc7aH9sMn8gr4DwBxnvuJu4+EdP1QcDKE9qTVa\r
+ QpjOOOpnkmA46PypufkX+ENaq+bfNDpgbAppKfz2rmutF49jouF8XkrB9Z2ZRWPHE4YA\r
+ gHJ78GT/4NPlFNo95Ik/nDdnUI6gHkTmiSS6aDJh1W5MiXbkuLT8DSa4Htc43nIr2/m6\r
+ uQ7g==\r
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;\r
+ h=content-transfer-encoding:content-language:mime-version:user-agent\r
+ :date:message-id:autocrypt:openpgp:to:subject:from:dkim-signature;\r
+ bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=utFz5J7XQOwR6hdXC0uF+PX17r57baD9GXm5v+3ztobSCFAI0ex+psgbX2gBo6izq3\r
+ Vo/QjJ9SeJEYhTsLR7jZ3o5meWXJZJqRH073eZlisUGOnDJkJQ5aN/4DY0L5btqLYhwI\r
+ mJ7c3g4Uh9zFNK8eSIDLdLAIPXNXWRT3SvoS4Ck9ok7fivfZzNfKIPUXbQFIql4+vIAj\r
+ t1v47QwIrTU+ojwBfaaDjtQEnOB2t8c7RNXys+LQFawG6QZGmG8PCrkVZTU+1v23qbUb\r
+ M7kDhvSISDchgSrHFwSIniXnnqZe6MRm24xlfW5yebFgmjzMCZQLiyA+WuMIUVxDJpKO\r
+ V/6g==\r
+ARC-Authentication-Results: i=1; mx.google.com;\r
+ dkim=pass header.i=@rspamd.com header.s=dkim header.b=iuniqXuF;\r
+ spf=pass (google.com: domain of vsevolod@rspamd.com designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@rspamd.com\r
+Return-Path: <vsevolod@rspamd.com>\r
+Received: from mail.highsecure.ru (mail.highsecure.ru. [88.99.142.95])\r
+ by mx.google.com with ESMTPS id u13-v6si8362844wmd.167.2018.10.01.07.27.54\r
+ for <vstakhov@gmail.com>\r
+ (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\r
+ Mon, 01 Oct 2018 07:27:55 -0700 (PDT)\r
+Received-SPF: pass (google.com: domain of vsevolod@rspamd.com designates 88.99.142.95 as permitted sender) client-ip=88.99.142.95;\r
+Authentication-Results: mx.google.com;\r
+ dkim=pass header.i=@rspamd.com header.s=dkim header.b=iuniqXuF;\r
+ spf=pass (google.com: domain of vsevolod@rspamd.com designates 88.99.142.95 as permitted sender) smtp.mailfrom=vsevolod@rspamd.com\r
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rspamd.com; s=dkim;\r
+ t=1538404074; h=from:from:sender:reply-to:subject:subject:date:date:\r
+ message-id:message-id:to:to:cc:mime-version:mime-version:\r
+ content-type:content-type:\r
+ content-transfer-encoding:content-transfer-encoding:in-reply-to:\r
+ references; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\r
+ b=iuniqXuFCfL63FjU4vXZQEjBRMXkRMwF3kAv+5heeVbgsAvpd+t4I/6w6CU+GVX8xLmsuW\r
+ jz+Ycmobj0O7eaw+93gfJ3rYnWNA4/WV2J3vAPSpqgBloYpoktEUOQcNm0VsWiCt6WNAq2\r
+ Ad2CNaQOOmvDMC5lBfp+YVJITiMcYoU=\r
+From: Vsevolod Stakhov <vsevolod@rspamd.com>\r
+Subject: test\r
+To: vstakhov@gmail.com\r
+Message-ID: <6f4415bf-ff61-f0f5-b60c-ba71a56b9e48@rspamd.com>\r
+Date: Mon, 1 Oct 2018 15:27:53 +0100\r
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0)\r
+ Gecko/20100101 Thunderbird/52.9.1\r
+MIME-Version: 1.0\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Language: en-US\r
+Content-Transfer-Encoding: 7bit\r
+Authentication-Results: mail.highsecure.ru;\r
+ auth=pass smtp.auth=vsevolod@highsecure.ru smtp.mailfrom=vsevolod@rspamd.com\r
+\r