L2.APEWS.ORG False Positive #13

Typical eh, spoke too soon! Got a user claiming the following shouldn't have been in his junk folder and on further checking we find the IP address to be that of a website offering a newsletter. CIDR seems OK too, here is the email header;

Sat 2012-03-17 03:26:37: [7708:766] Accepting SMTP connection from [71.19.224.98]
Sat 2012-03-17 03:26:37: [7708:766] Looking up PTR record for 71.19.224.98 (98.224.19.71.IN-ADDR.ARPA)
Sat 2012-03-17 03:26:37: [7708:766] D=98.224.19.71.IN-ADDR.ARPA TTL=(59) PTR=[www3.tiltedpixel.com]
Sat 2012-03-17 03:26:37: [7708:766] Gathering A-records for PTR hosts
Sat 2012-03-17 03:26:38: [7708:766] D=www3.tiltedpixel.com TTL=(240) A=[71.19.224.98]
Sat 2012-03-17 03:26:38: [7708:766] --> 220 xxx.xxx.xxx ESMTP MDaemon 6.7.9; Sat, 16 Mar 2012 13:06:38 -0500
Sat 2012-03-17 03:26:38: [7708:766] <-- EHLO www3.tiltedpixel.com
Sat 2012-03-17 03:26:38: [7708:766] Performing reverse lookup on www3.tiltedpixel.com (looking for 71.19.224.98)
Sat 2012-03-17 03:26:38: [7708:766] D=www3.tiltedpixel.com TTL=(240) A=[71.19.224.98]
Sat 2012-03-17 03:26:38: [7708:766] --> 250-xxx.xxx.xxx Hello www3.tiltedpixel.com, pleased to meet you
Sat 2012-03-17 03:26:38: [7708:766] --> 250-ETRN
Sat 2012-03-17 03:26:38: [7708:766] --> 250-AUTH=LOGIN
Sat 2012-03-17 03:26:38: [7708:766] --> 250-AUTH LOGIN CRAM-MD5
Sat 2012-03-17 03:26:38: [7708:766] --> 250-8BITMIME
Sat 2012-03-17 03:26:38: [7708:766] --> 250 SIZE 0
Sat 2012-03-17 03:26:38: [7708:766] <-- MAIL FROM: SIZE=1656
Sat 2012-03-17 03:26:38: [7708:766] Performing reverse lookup on www3.tiltedpixel.com (looking for 71.19.224.98)
Sat 2012-03-17 03:26:38: [7708:766] D=www3.tiltedpixel.com TTL=(239) A=[71.19.224.98]
Sat 2012-03-17 03:26:38: [7708:766] Spam Blocker A-record resolution of [98.224.19.71.L2.APEWS.ORG] in progress (DNS Server: 192.168.1.2)...
Sat 2012-03-17 03:26:38: [7708:766] Spam Blocker D=98.224.19.71.L2.APEWS.ORG TTL=(35) A=[127.0.0.2]
Sat 2012-03-17 03:26:38: [7708:766] L2.APEWS.ORG LISTED
Sat 2012-03-17 03:26:38: [7708:766] Message will be accepted and X-RBL-Warning: header will be inserted.
Sat 2012-03-17 03:26:38: [7708:766] --> 250 , Sender ok
Sat 2012-03-17 03:26:38: [7708:766] <-- RCPT TO:
Sat 2012-03-17 03:26:38: [7708:766] --> 250 , Recipient ok
Sat 2012-03-17 03:26:38: [7708:766] <-- DATA
Sat 2012-03-17 03:26:38: [7708:766] --> 354 Enter mail, end with .
Sat 2012-03-17 03:26:38: [7708:766] --> 250 Ok, message saved
Sat 2012-03-17 03:26:38: [7708:766] <-- QUIT
Sat 2012-03-17 03:26:38: [7708:766] --> 221 See ya in cyberspace
Sat 2012-03-17 03:26:38: [7708:766] SMTP session successful, 959 bytes transferred.
Sat 2012-03-17 03:26:38: [7708:766] Shuffling message(s) into proper queue(s)
Sat 2012-03-17 03:26:38: [7708:766] Message received from www3.tiltedpixel.com [71.19.224.98] with SMTP for [Size 948] {j:\localq\md000000.msg}

Hopefully this one will get resolved shortly too.