Jump to content

CloudFlare and neterra.net


roteague

Recommended Posts

Posted

For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup.

Posted

What sort of content is in the spam?

16 hours ago, roteague said:

For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup.

 

Posted

They are various subjects, but always have the same formatting. In fact, the formatting is so standard, I'm able to use a filter to recognize it as spam - (envelope-from <[email protected]>) the first x is my user name, followed by an equal sign, then my domain. Unfortunately, the domain that the email points to changes with every email. For example:

"Return-Path: <[email protected]> Received: from mail.buysellkalispell.com (web157.ntrra.com [94.156.99.157]) by sm02.internetmailserver.net with SMTP; Mon, 27 Jun 2016 14:09:24 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=buysellkalispell.com; h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; [email protected]; bh=yAIxGfdVs5VAhscdQxfJDhykhmE=; b=YcOtfzeJbla0egTLJwkPvR6lGpLUCttUMcuviXqLaj67fLAbKyOFZuQNdAdSPeIdBYbgmZuM4LRS jI4FCAk+kyBFEp9GwaGN1lgv7MCCszyZE/AypeenLU37VupQNFWjnjyNpbIuaM9eFJ4xmKMnFs3w QjRb0ZqPM+g/9vp4bGk= DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=buysellkalispell.com; b=zbK0ag1ILflqw5IBhkTRcJ6fJQmdva0d+przdGz/sEzUOiIcArsJNMyLphrdNyP+0ZcRKkVsEv7K xtqorNyldmluM8PZjA4meI7XmLJnd4f1HONV2zWjSZi51Z943W6LGh+OqGTt8GBmVyC6FOLVd4sj z8pybu0h5Xv3vkP7umo=; Received: by mail.buysellkalispell.com id he6b080001gb for <[email protected]>; Mon, 27 Jun 2016 16:06:06 -0500 (envelope-from <[email protected]>) Date: Mon, 27 Jun 2016 16:06:06 -0500 From: "CARCHEX Coupon Offer" <[email protected]> To: <[email protected]> Subject: Customers Get a Special Extended Auto Warranty Offer MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_295_1581507040.1467061561066" List-Unsubscribe: <http://www.buysellkalispell.com/many/a80.89LorP11mjVOKtWOFXvnvjiyKiNnMKkOn0MjhV1d> Message-ID: <[email protected]> X-SmarterMail-spam: SPF_Neutral, ISpamAssassin 0 [raw: 0], SpamAssassin 13 [raw: 5], DK_Pass, DKIM_Pass X-SmarterMail-TotalSpamWeight: 11 ------=_Part_295_1581507040.1467061561066 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Customers Get a Special Extended Auto Warranty Offer

Posted

roteague, unfortunately, what you gave is a "Report ID" that only you can see. the tracking URL looks similar but is at the top of the reporting screen

SpamCop v 4.8.4 © 2016 Cisco Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6250056514ze6acd50c90629cc27647bc52d4386f7cz

 

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...