remote_ip 20.11.0.1 expect RCVD_IN_DNSWL_LOW RBL_SENDERSCORE_REPUT_0 Subject: test test remote_ip 20.11.0.2 expect RBL_SENDERSCORE_REPUT_0 RBL_SEM RBL_SPAMHAUS_SBL RBL_BARRACUDA RBL_BLOCKLISTDE RBL_VIRUSFREE_BOTNET RBL_SPAMCOP RCVD_IN_DNSWL_MED Subject: test test remote_ip 20.11.0.14 expect RBL_SENDERSCORE_REPUT_1 RWL_MAILSPIKE_NEUTRAL RECEIVED_SPAMHAUS_SBL RECEIVED_SPAMHAUS_XBL RECEIVED_BLOCKLISTDE RCVD_IN_DNSWL_MED Received: from Agni (localhost [20.11.0.5]) (TLS: TLSv1/SSLv3, 168bits,DES-CBC3-SHA) by agni.forevermore.net with esmtp; Mon, 28 Oct 2002 14:48:52 -0800 Received: from [20.11.0.14] (79.sub-174-252-72.myvzw.com [20.11.0.8]) by mx.google.com with ESMTPS id m16sm345129qck.28.2011.06.15.07.42.02 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 15 Jun 2011 07:42:08 -0700 (PDT) Received: from user (20.11.0.2) by DB6PR07MB3384.eurprd07.prod.outlook.com ([20.11.0.2]) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1143.11; Thu, 13 Sep 2018 14:47:44 +0000 Subject: test test envelope_from user@surbl-abuse.com expect URIBL_GREY ABUSE_SURBL DBL_MALWARE SEM_URIBL_FRESH15 SEM_URIBL From: user@uribl-grey.com Subject: check my website sh-malware.com/login.php My e-mail is spammer@sem-uribl.com And my website is https://sem-fresh15.com/offers.html Try cheating with a trusted domain user@dkimtrusted.org expect DBL_MALWARE From: user@example.net Subject: test Write to us at P.O.Box 25050, or call us during office hours. The attached report.zip and clip.mov cover the rest, and surbl-abuse.com is only named in passing rather than linked. Our actual website is https://sh-malware.com/login.php dkim.result pass dkim.domains dkimtrusted.org expect DWL_DNSWL_HI From: user@dkimtrusted.org Subject: test test expect MSBL_EBL MSBL_EBL_GREY From: spammer1@spamcorp.net Reply-To: User Subject: test test expect SURBL_HASHBL_ABUSE SURBL_HASHBL_MALWARE SURBL_HASHBL_PHISH URL_ONLY REDIRECTOR_URL From: spammer@spamcorp.net Reply-To: User Subject: test Content-Type: text/html; charset="utf-8" test https://cf-ipfs.com/other/path?query=true