<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
any of you subscribed to techtarget or crm emails?<br>
<br>
seems on june 16th or 17th, something broke. and I am trying to
determine if its something we did or something they did.<br>
<br>
headers come in, received, received, then a BIG BLANK LIKE, then<br>
<br>
DATA DKIM<br>
<br>
(its almost like they shoved an extra DATA\r\n in there. or SA did..
or amavisd-new did)<br>
<br>
sometimes they are totally blank.<br>
<br>
headers (yes, it looks like spam, this one does) but we do have
people who subscribed to it. notice the blank line after the
received header?<br>
if you grep for 205.162.4[0-7]\.* you might see some like this.<br>
(and, no, this is not after microsoft mangles it.. maybe
amavisd/sa/dkim version 38 does, but I don't know)<br>
<br>
<br>
Received: from crnnetwork.com (crnnetwork.com [205.162.47.163])<br>
by mx2.slpowers.com.ionspam.net (Postfix) with ESMTP id
115F06FE15B<br>
for <a class="moz-txt-link-rfc2396E" href="mailto:user@domain.com"><user@domain.com></a>; Fri, 22 Jul 2011 10:08:50 -0400
(EDT)<br>
<br>
DATA<br>
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
t=1311343699; d=crnnetwork.com; s=dkim;
h=date:message-id:from:to:subject:mime-version:content-type:list-unsubscribe;
bh=WveFEzHxhYkhwXaVxeYtjjm8Q34bjdVex+sTxWOdwXg=;
b=lL4+c3ymOfW+NTTsa1liqJrB4TPeV5ANFPiFeTkow8XWD796wMJdsCUVh8iNyuThGzngShLI0AByxbZk5g6MmWMNbujzSKf2Tnpm59BcISmOxOsVvUpNSfYO07K2rrqvDlRyiu0SZ6LZz85XAcVJGFHYXYXr1Z+GG6QwByltY4M=;
<br>
Date: Fri, 22 Jul 2011 09:08:19 -0500 (CDT)<br>
Message-ID:
<a class="moz-txt-link-rfc2396E" href="mailto:4Oz1ccmceDmcBfmLekDNsxjec.mD.1311343694695@OMS05.crnnetwork.com"><4Oz1ccmceDmcBfmLekDNsxjec.mD.1311343694695@OMS05.crnnetwork.com></a><br>
From: CRN <a class="moz-txt-link-rfc2396E" href="mailto:CRNmagazine@crnnetwork.com"><CRNmagazine@crnnetwork.com></a><br>
Sender: CRN <a class="moz-txt-link-rfc2396E" href="mailto:CRNmagazine@crnnetwork.com"><CRNmagazine@crnnetwork.com></a><br>
Reply-To: CRN <a class="moz-txt-link-rfc2396E" href="mailto:CRNmagazine@crnnetwork.com"><CRNmagazine@crnnetwork.com></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:user@domain.com">user@domain.com</a><br>
Subject: Confirm Your Free Subscription to CRN Magazine Now<br>
MIME-Version: 1.0<br>
Content-Type: multipart/mixed;
boundary=----4Oz1ccmceDmcBfmLekDNsxjec.mD<br>
X-MailSessionID: 4Oz1ccmceDmcBfmLekDNsxjec.mD.1311343694695<br>
Referer: <a class="moz-txt-link-freetext" href="http://crnnetwork.com/portal/">http://crnnetwork.com/portal/</a><br>
<br>
------4Oz1ccmceDmcBfmLekDNsxjec.mD<br>
<br>
common factors seem to be their ESP<br>
<br>
NetRange: 205.162.40.0 - 205.162.47.255<br>
CIDR: 205.162.40.0/21<br>
OriginAS:<br>
NetName: SPRINTLINK<br>
NetHandle: NET-205-162-40-0-1<br>
Parent: NET-205-160-0-0-1<br>
NetType: Reassigned<br>
RegDate: 2003-11-12<br>
Updated: 2003-11-12<br>
Ref: <a class="moz-txt-link-freetext" href="http://whois.arin.net/rest/net/NET-205-162-40-0-1">http://whois.arin.net/rest/net/NET-205-162-40-0-1</a><br>
<br>
OrgName: Omeda Communications<br>
<br>
<br>
<br>
<div class="moz-signature">-- <br>
Michael Scheidell, CTO<br>
o: 561-999-5000<br>
d: 561-948-2259<br>
<font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
Network Security Corporation
<style type="text/css">
<!--
.unnamed1 {
margin: 1em;
padding: 1px;
} -->
</style>
<ul class="unnamed1">
<li>Best Mobile Solutions Product of 2011</li>
<li>Best Intrusion Prevention Product</li>
<li>Hot Company Finalist 2011</li>
<li>Best Email Security Product</li>
<li>Certified SNORT Integrator</li>
</ul>
</div>
<br>
<div id="disclaimer.secnap.com"><hr />
<p>This email has been scanned and certified safe by SpammerTrap®.
<br />For Information please see
<a href="http://www.secnap.com/products/spammertrap/">http://www.secnap.com/products/spammertrap/</a></p> <hr /></div>
<br>
</body>
</html>