roteague Posted June 26, 2016 Share Posted June 26, 2016 For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup. Quote Link to comment Share on other sites More sharing options...
spinner Posted June 27, 2016 Share Posted June 27, 2016 What sort of content is in the spam? 16 hours ago, roteague said: For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup. Quote Link to comment Share on other sites More sharing options...
roteague Posted June 27, 2016 Author Share Posted June 27, 2016 They are various subjects, but always have the same formatting. In fact, the formatting is so standard, I'm able to use a filter to recognize it as spam - (envelope-from <carchex.coupon.offer-x=x.com@buysellkalispell.com>) the first x is my user name, followed by an equal sign, then my domain. Unfortunately, the domain that the email points to changes with every email. For example: "Return-Path: <carchex.coupon.offer-x=x.com@buysellkalispell.com> Received: from mail.buysellkalispell.com (web157.ntrra.com [94.156.99.157]) by sm02.internetmailserver.net with SMTP; Mon, 27 Jun 2016 14:09:24 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=buysellkalispell.com; h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=carchex.coupon.offer@buysellkalispell.com; bh=yAIxGfdVs5VAhscdQxfJDhykhmE=; b=YcOtfzeJbla0egTLJwkPvR6lGpLUCttUMcuviXqLaj67fLAbKyOFZuQNdAdSPeIdBYbgmZuM4LRS jI4FCAk+kyBFEp9GwaGN1lgv7MCCszyZE/AypeenLU37VupQNFWjnjyNpbIuaM9eFJ4xmKMnFs3w QjRb0ZqPM+g/9vp4bGk= DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=buysellkalispell.com; b=zbK0ag1ILflqw5IBhkTRcJ6fJQmdva0d+przdGz/sEzUOiIcArsJNMyLphrdNyP+0ZcRKkVsEv7K xtqorNyldmluM8PZjA4meI7XmLJnd4f1HONV2zWjSZi51Z943W6LGh+OqGTt8GBmVyC6FOLVd4sj z8pybu0h5Xv3vkP7umo=; Received: by mail.buysellkalispell.com id he6b080001gb for <x@x.com>; Mon, 27 Jun 2016 16:06:06 -0500 (envelope-from <carchex.coupon.offer-x=x.com@buysellkalispell.com>) Date: Mon, 27 Jun 2016 16:06:06 -0500 From: "CARCHEX Coupon Offer" <carchex.coupon.offer@buysellkalispell.com> To: <roteague@visionlandscapes.com> Subject: Customers Get a Special Extended Auto Warranty Offer MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_295_1581507040.1467061561066" List-Unsubscribe: <http://www.buysellkalispell.com/many/a80.89LorP11mjVOKtWOFXvnvjiyKiNnMKkOn0MjhV1d> Message-ID: <0.0.0.32.1D1D0B7B89AF51A.5C77C5@mail.buysellkalispell.com> X-SmarterMail-spam: SPF_Neutral, ISpamAssassin 0 [raw: 0], SpamAssassin 13 [raw: 5], DK_Pass, DKIM_Pass X-SmarterMail-TotalSpamWeight: 11 ------=_Part_295_1581507040.1467061561066 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Customers Get a Special Extended Auto Warranty Offer Quote Link to comment Share on other sites More sharing options...
lisati Posted June 28, 2016 Share Posted June 28, 2016 Do you have a tracking URL? Quote Link to comment Share on other sites More sharing options...
roteague Posted June 28, 2016 Author Share Posted June 28, 2016 Here is one: https://www.spamcop.net/mcgi?action=gettrack&reportid=6484002214 Quote Link to comment Share on other sites More sharing options...
Lking Posted June 28, 2016 Share Posted June 28, 2016 roteague, unfortunately, what you gave is a "Report ID" that only you can see. the tracking URL looks similar but is at the top of the reporting screen SpamCop v 4.8.4 © 2016 Cisco Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: https://www.spamcop.net/sc?id=z6250056514ze6acd50c90629cc27647bc52d4386f7cz Quote Link to comment Share on other sites More sharing options...
roteague Posted June 28, 2016 Author Share Posted June 28, 2016 Sorry, I copied the wrong link. Here it is:https://www.spamcop.net/sc?id=z6251643677z3015b3a4a13ece99e387ef62bd87b716z Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.