Jump to content
Sign in to follow this  
roteague

CloudFlare and neterra.net

Recommended Posts

For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup.

Share this post


Link to post
Share on other sites

What sort of content is in the spam?

16 hours ago, roteague said:

For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup.

 

Share this post


Link to post
Share on other sites

They are various subjects, but always have the same formatting. In fact, the formatting is so standard, I'm able to use a filter to recognize it as spam - (envelope-from <carchex.coupon.offer-x=x.com@buysellkalispell.com>) the first x is my user name, followed by an equal sign, then my domain. Unfortunately, the domain that the email points to changes with every email. For example:

"Return-Path: <carchex.coupon.offer-x=x.com@buysellkalispell.com> Received: from mail.buysellkalispell.com (web157.ntrra.com [94.156.99.157]) by sm02.internetmailserver.net with SMTP; Mon, 27 Jun 2016 14:09:24 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=buysellkalispell.com; h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=carchex.coupon.offer@buysellkalispell.com; bh=yAIxGfdVs5VAhscdQxfJDhykhmE=; b=YcOtfzeJbla0egTLJwkPvR6lGpLUCttUMcuviXqLaj67fLAbKyOFZuQNdAdSPeIdBYbgmZuM4LRS jI4FCAk+kyBFEp9GwaGN1lgv7MCCszyZE/AypeenLU37VupQNFWjnjyNpbIuaM9eFJ4xmKMnFs3w QjRb0ZqPM+g/9vp4bGk= DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=buysellkalispell.com; b=zbK0ag1ILflqw5IBhkTRcJ6fJQmdva0d+przdGz/sEzUOiIcArsJNMyLphrdNyP+0ZcRKkVsEv7K xtqorNyldmluM8PZjA4meI7XmLJnd4f1HONV2zWjSZi51Z943W6LGh+OqGTt8GBmVyC6FOLVd4sj z8pybu0h5Xv3vkP7umo=; Received: by mail.buysellkalispell.com id he6b080001gb for <x@x.com>; Mon, 27 Jun 2016 16:06:06 -0500 (envelope-from <carchex.coupon.offer-x=x.com@buysellkalispell.com>) Date: Mon, 27 Jun 2016 16:06:06 -0500 From: "CARCHEX Coupon Offer" <carchex.coupon.offer@buysellkalispell.com> To: <roteague@visionlandscapes.com> Subject: Customers Get a Special Extended Auto Warranty Offer MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_295_1581507040.1467061561066" List-Unsubscribe: <http://www.buysellkalispell.com/many/a80.89LorP11mjVOKtWOFXvnvjiyKiNnMKkOn0MjhV1d> Message-ID: <0.0.0.32.1D1D0B7B89AF51A.5C77C5@mail.buysellkalispell.com> X-SmarterMail-spam: SPF_Neutral, ISpamAssassin 0 [raw: 0], SpamAssassin 13 [raw: 5], DK_Pass, DKIM_Pass X-SmarterMail-TotalSpamWeight: 11 ------=_Part_295_1581507040.1467061561066 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Customers Get a Special Extended Auto Warranty Offer

Share this post


Link to post
Share on other sites

roteague, unfortunately, what you gave is a "Report ID" that only you can see. the tracking URL looks similar but is at the top of the reporting screen

SpamCop v 4.8.4 © 2016 Cisco Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6250056514ze6acd50c90629cc27647bc52d4386f7cz

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×