November 12, 2013

L2.APEWS.ORG False Positive #25

Here is another false positive, definitely shouldn't be in the spam folder as it is from a whitelist operator, full email header follows;

Tue 2013-11-12 08:40:07: [816:5036] Accepting SMTP connection from [217.23.49.178]
Tue 2013-11-12 08:40:07: [816:5036] --> 220 xxx.xxx.xxx ESMTP MDaemon; Tue, 12 Nov 2013 08:40:07 -0500
Tue 2013-11-12 08:40:07: [816:5036] <-- EHLO webone.hostedserver.eu
Tue 2013-11-12 08:40:07: [816:5036] --> 250-xxx.xxx.xxx Hello webone.hostedserver.eu, pleased to meet you
Tue 2013-11-12 08:40:07: [816:5036] --> 250-ETRN
Tue 2013-11-12 08:40:07: [816:5036] --> 250-AUTH=LOGIN
Tue 2013-11-12 08:40:07: [816:5036] --> 250-AUTH LOGIN CRAM-MD5
Tue 2013-11-12 08:40:07: [816:5036] --> 250-8BITMIME
Tue 2013-11-12 08:40:07: [816:5036] --> 250 SIZE 0
Tue 2013-11-12 08:40:08: [816:5036] <-- MAIL FROM:<xxx @ xxx.xxx> SIZE=841
Tue 2013-11-12 08:40:08: [816:5036] Spam Blocker A-record resolution of [178.49.23.217.L2.APEWS.ORG] in progress (DNS Server: 192.168.1.2)...
Tue 2013-11-12 08:40:08: [816:5036] Spam Blocker D=178.49.23.217.L2.APEWS.ORG TTL=(35) A=[127.0.0.2]
Tue 2013-11-12 08:40:08: [816:5036] L2.APEWS.ORG LISTED
Tue 2013-11-12 08:40:08: [816:5036] Message will be accepted and X-RBL-Warning: header will be inserted.
Tue 2013-11-12 08:40:08: [816:5036] --> 250 <root @ webone.hostedserver.eu>, Sender ok
Tue 2013-11-12 08:40:08: [816:5036] <-- RCPT TO:<xxx @ xxx.xxx>
Tue 2013-11-12 08:40:08: [816:5036] --> 250 <xxx @ xxx.xxx>, Recipient ok
Tue 2013-11-12 08:40:08: [816:5036] <-- DATA
Tue 2013-11-12 08:40:08: [816:5036] --> 354 Enter mail, end with <CRLF>.<CRLF>
Tue 2013-11-12 08:40:09: [816:5036] --> 250 Ok, message saved <Message-ID: 20131112133949.7115C1B35CB1 @ webone.hostedserver.eu>
Tue 2013-11-12 08:40:09: [816:5036] <-- QUIT
Tue 2013-11-12 08:40:09: [816:5036] --> 221 See ya in cyberspace
Tue 2013-11-12 08:40:09: [816:5036] SMTP session successful, 850 bytes transferred.
Tue 2013-11-12 08:40:09: [816:5036] Shuffling message(s) into proper queue(s)
Tue 2013-11-12 08:40:09: [816:5036] Message received from webone.hostedserver.eu [217.23.49.178] <xxx @ xxx.xxx> with SMTP for <xxx @ xxx.xxx> [Size 839] {k:\localq\0000369111.msg}