Thanks for helping out, here it is:
egrep '0493D207FDCB|TCgAAAEAAAANu3D19jzfhEhjnyttfmV6gBAAAAAA|4fffab' /var/log/maillog
Nov 12 15:40:20 hermod rspamd[12036]: <4fffab>; proxy; proxy_accept_socket: accepted milter connection from /var/run/rspamd/worker-proxy port 0
Nov 12 15:40:21 hermod postfix/smtpd[12486]: 0493D207FDCB: client=ns1.alinet.cu[190.92.127.32]
Nov 12 15:40:21 hermod rspamd[12036]: <4fffab>; milter; rspamd_milter_process_command: got connection from 190.92.127.32:2800
Nov 12 15:40:21 hermod postfix/cleanup[12254]: 0493D207FDCB: message-id=<!&!AAAAAAAAAAAYAAAAAAAAADeSeQUqOTRPjTljgGXKC/TCgAAAEAAAANu3D19jzfhEhjnyttfmV6gBAAAAAA==@confihar.alinet.cu>
Nov 12 15:42:38 hermod rspamd[12036]: <4fffab>; proxy; rspamd_message_parse: loaded message; id: <!&!AAAAAAAAAAAYAAAAAAAAADeSeQUqOTRPjTljgGXKC/TCgAAAEAAAANu3D19jzfhEhjnyttfmV6gBAAAAAA==@confihar.alinet.cu>; queue-id: <0493D207FDCB>; size: 2291163; checksum: <6a10bb1d899bdefb375c73ec88e716bf>
Nov 12 15:42:40 hermod rspamd[12036]: <4fffab>; proxy; rspamd_symcache_process_symbols: <!&!AAAAAAAAAAAYAAAAAAAAADeSeQUqOTRPjTljgGXKC/TCgAAAEAAAANu3D19jzfhEhjnyttfmV6gBAAAAAA==@confihar.alinet.cu> has already scored more than 19.99, so do not plan more checks
Nov 12 15:42:40 hermod rspamd[12036]: <4fffab>; lua; neural.lua:449: trained ANN rule RFANN, save spam vector, 147 bytes
Nov 12 15:42:40 hermod rspamd[12036]: <4fffab>; proxy; rspamd_task_write_log: id: <!&!AAAAAAAAAAAYAAAAAAAAADeSeQUqOTRPjTljgGXKC/TCgAAAEAAAANu3D19jzfhEhjnyttfmV6gBAAAAAA==@confihar.alinet.cu>, qid: <0493D207FDCB>, ip: 190.92.127.32, from: <andrea.mesa@confihar.alinet.cu>, (default: T (reject): [17.98/15.00] [RBL_SENDERSCORE(20.00){32.127.92.190.bl.score.senderscore.com;},IP_SCORE(-2.33){ip: (-0.06), ipnet: 190.92.112.0/20(-6.80), asn: 27725(-3.98), country: CU(-0.79);},BAYES_SPAM(0.32){70.85%;},MIME_GOOD(-0.10){multipart/mixed;multipart/related;multipart/alternative;text/plain;},RCVD_NO_TLS_LAST(0.10){},MX_GOOD(-0.01){cached: ns1.alinet.cu;},ASN(0.00){asn:27725, ipnet:190.92.112.0/20, country:CU;},DMARC_NA(0.00){alinet.cu;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_ATTACHMENT(0.00){},HAS_X_AS(0.00){},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:+;3:+;4:~;5:~;6:~;7:~;...;},PREVIOUSLY_DELIVERED(0.00){ogonzalez@durerocaribe.cu;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_THREE(0.00){3;},RCVD_VIA_SMTP_AUTH(0.00){},R_DKIM_NA(0.00){},R_SPF_NA(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 2291163, time: 1674.181ms real, 33.896ms virtual, dns req: 27, digest: <6a10bb1d899bdefb375c73ec88e716bf>, rcpts: <ogonzalez@durerocaribe.cu>, mime_rcpts: <ogonzalez@durerocaribe.cu>
Nov 12 15:42:40 hermod rspamd[12036]: <4fffab>; proxy; rspamd_protocol_http_reply: regexp statistics: 398 pcre regexps scanned, 2 regexps matched, 185 regexps total, 12 regexps cached, 50.80KiB scanned using pcre, 50.80KiB scanned total
Nov 12 15:42:40 hermod postfix/cleanup[12254]: 0493D207FDCB: milter-reject: END-OF-MESSAGE from ns1.alinet.cu[190.92.127.32]: 5.7.1 Spam message rejected; from=<andrea.mesa@confihar.alinet.cu> to=<ogonzalez@durerocaribe.cu> proto=ESMTP helo=<ns1.alinet.cu>