December 13, 2012

L2.APEWS.ORG False Positive #18

Here is the full email header for a newsletter that was found in the junk folder but that the recipient subscribed to;

Thu 2012-12-13 03:14:01: [7552:543] Accepting SMTP connection from [89.31.209.89]
Thu 2012-12-13 03:14:01: [7552:543] --> 220 xxx.xxx.xxx ESMTP MDaemon 6.7.9; Thu, 13 Dec 2012 03:14:01 -0100
Thu 2012-12-13 03:14:01: [7552:543] <-- HELO newsletter.gan.co.za
Thu 2012-12-13 03:14:01: [7552:543] --> 250 xxx.xxx.xxx Hello newsletter.gan.co.za, pleased to meet you
Thu 2012-12-13 03:14:01: [7552:543] <-- MAIL FROM:<bounce-00000000-00000000@ newsletter.gan.co.za>
Thu 2012-12-13 03:14:01: [7552:543] Spam Blocker A-record resolution of [89.209.31.89.L2.APEWS.ORG] in progress (DNS Server: 192.168.1.2)...
Thu 2012-12-13 03:14:01: [7552:543] Spam Blocker D=89.209.31.89.L2.APEWS.ORG TTL=(35) A=[127.0.0.2]
Thu 2012-12-13 03:14:01: [7552:543] L2.APEWS.ORG LISTED
Thu 2012-12-13 03:14:01: [7552:543] Message will be accepted and X-RBL-Warning: header will be inserted.
Thu 2012-12-13 03:14:01: [7552:543] --> 250 <bounce-00000000-00000000@ newsletter.gan.co.za>, Sender ok
Thu 2012-12-13 03:14:01: [7552:543] <-- RCPT TO:<xxx@ xxx.xxx>
Thu 2012-12-13 03:14:01: [7552:543] --> 250 <xxx@ xxx.xxx>, Recipient ok
Thu 2012-12-13 03:14:02: [7552:543] <-- DATA
Thu 2012-12-13 03:14:02: [7552:543] --> 354 Enter mail, end with <CRLF>.<CRLF>
Thu 2012-12-13 03:14:03: [7552:543] --> 250 Ok, message saved <Message-ID: SUPPORT-00000000-00000000-2012.12.13-00.00.00--xxx#xxx.xxx@ newsletter.gan.co.za>
Thu 2012-12-13 03:14:03: [7552:543] <-- RSET
Thu 2012-12-13 03:14:03: [7552:543] Shuffling message(s) into proper queue(s)
Thu 2012-12-13 03:14:03: [7552:543] Message received from newsletter.gan.co.za [89.31.209.89] <bounce-00000000-00000000@ newsletter.gan.co.za> with SMTP for <xxx@ xxx.xxx> [Size 55311] {j:\localq\0000231504.msg}
Thu 2012-12-13 03:14:03: [7552:543] SMTP session successful, 55322 bytes transferred.
Thu 2012-12-13 03:14:03: [7552:543] --> 250 RSET? Well, ok.
Thu 2012-12-13 03:14:08: [7552:543] <-- QUIT
Thu 2012-12-13 03:14:08: [7552:543] --> 221 See ya in cyberspace
Thu 2012-12-13 03:14:08: [7552:543] SMTP session successful, 55328 bytes transferred.