Mysterious AWL entries

[Thomas Bolioli <tp...@terranovum.com>]

I have this one test that shows up in email headers from time to time 
(all on subscribe.ru addresses) but I have no idea where it is coming 
from. It is saying the address is in the AWL ("From: address is in the 
auto white-list") but I am 99% positive it is not. I am using SQL and 
have navicat open at this moment. select * from `awl`  limit 0,1000 is 
returning 0 records. Any idea where this is happening?
Tom


Return-Path: <in...@spamtest.ru>
X-Original-To: tbadelphi@terranovum.com
Delivered-To: tbadelphi@terranovum.com
Received: from permemail06.alumniconnections.com 
(permemail06.alumniconnections.com [198.212.10.109])
    by smtp.terranovum.com (Postfix) with ESMTP id D825D3E68D7
    for <tb...@terranovum.com>; Thu, 17 Feb 2005 15:54:17 -0500 (EST)
Received: (from smmsp@localhost)
    by permemail06.alumniconnections.com (8.12.11/8.12.11) id j1HKsHMm024233
    for <tb...@terranovum.com>; Thu, 17 Feb 2005 15:54:17 -0500 (EST)
Received: from 200-161-114-78.dsl.telesp.net.br(200.161.114.78) by 
permemail06 via smap (V2.1)
    id xma_23746_1108673612; Thu, 17 Feb 05 15:53:32 -0500
Received: from [81.9.34.176] (port=25 helo=cat176.subscribe.ru)
 by mx20.mail.ru with esmtp
 id 1D0Uve-000AEU-00
 for nnnw@mail.ru; Mon, 14 Feb 2005 04:21:34 +0300
Received: id 6D55D22025A; Mon, 14 Feb 2005 04:20:49 +0300
X-Felis-Queue-Id: 20050214042037
Precedence: normal
List-Id: <tech.auto.greatimes.subscribe.ru>
List-Help: <http://subscribe.ru/catalog/tech.auto.greatimes>
List-Subscribe: <ma...@subscribe.ru>
List-Unsubscribe: <ma...@subscribe.ru>
List-Archive:  <http://subscribe.ru/archive/tech.auto.greatimes>
List-Owner: <ma...@subscribe.ru>
List-Post: NO
Message-Id: <20...@tech.auto.greatimes.subscribe>
Date: Mon, 14 Feb 2005 04:20:13 +0300
From: "Juliya Cvetkova" <na...@subscribe.ru>
To: "tech.auto.greatimes" <nn...@mail.ru>(5837856)
Subject: =?koi8-r?B?UmU6IPDPzMnH0sHGydE=?=
MIME-Version: 1.0
Content-Language: ru
Content-Type: multipart/related;
 boundary="----=_NextPart_000_0629_01C51544.F866C010";
 type="multipart/alternative"
Content-Transfer-Encoding: 8bit
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
nova.terranovum.com
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.8 required=4.0 tests=AWL,BAYES_99,HTML_90_100,
    HTML_IMAGE_ONLY_04,HTML_MESSAGE,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
    RCVD_IN_SORBS_DUL autolearn=no version=3.0.0
X-Spam-Report:
    *  1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
    *  0.0 HTML_MESSAGE BODY: HTML included in message
    *  0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
    *  1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
    *      [score: 1.0000]
    *  0.0 HTML_90_100 BODY: Message is 90% to 100% HTML
    *  3.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
    *  2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP 
address
    *      [200.161.114.78 listed in dnsbl.sorbs.net]
    * -1.5 AWL AWL: From: address is in the auto white-list