Jump to content

CloudFlare and neterra.net


roteague
 Share

Recommended Posts

What sort of content is in the spam?

16 hours ago, roteague said:

For months now, I have been receiving multiple emails, all from neterra.net and hosted by Cloudflare. I feel like I'm wasting my time reporting it; seems like a bullet proof setup.

 

Link to comment
Share on other sites

They are various subjects, but always have the same formatting. In fact, the formatting is so standard, I'm able to use a filter to recognize it as spam - (envelope-from <carchex.coupon.offer-x=x.com@buysellkalispell.com>) the first x is my user name, followed by an equal sign, then my domain. Unfortunately, the domain that the email points to changes with every email. For example:

"Return-Path: <carchex.coupon.offer-x=x.com@buysellkalispell.com> Received: from mail.buysellkalispell.com (web157.ntrra.com [94.156.99.157]) by sm02.internetmailserver.net with SMTP; Mon, 27 Jun 2016 14:09:24 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=buysellkalispell.com; h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=carchex.coupon.offer@buysellkalispell.com; bh=yAIxGfdVs5VAhscdQxfJDhykhmE=; b=YcOtfzeJbla0egTLJwkPvR6lGpLUCttUMcuviXqLaj67fLAbKyOFZuQNdAdSPeIdBYbgmZuM4LRS jI4FCAk+kyBFEp9GwaGN1lgv7MCCszyZE/AypeenLU37VupQNFWjnjyNpbIuaM9eFJ4xmKMnFs3w QjRb0ZqPM+g/9vp4bGk= DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=buysellkalispell.com; b=zbK0ag1ILflqw5IBhkTRcJ6fJQmdva0d+przdGz/sEzUOiIcArsJNMyLphrdNyP+0ZcRKkVsEv7K xtqorNyldmluM8PZjA4meI7XmLJnd4f1HONV2zWjSZi51Z943W6LGh+OqGTt8GBmVyC6FOLVd4sj z8pybu0h5Xv3vkP7umo=; Received: by mail.buysellkalispell.com id he6b080001gb for <x@x.com>; Mon, 27 Jun 2016 16:06:06 -0500 (envelope-from <carchex.coupon.offer-x=x.com@buysellkalispell.com>) Date: Mon, 27 Jun 2016 16:06:06 -0500 From: "CARCHEX Coupon Offer" <carchex.coupon.offer@buysellkalispell.com> To: <roteague@visionlandscapes.com> Subject: Customers Get a Special Extended Auto Warranty Offer MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_295_1581507040.1467061561066" List-Unsubscribe: <http://www.buysellkalispell.com/many/a80.89LorP11mjVOKtWOFXvnvjiyKiNnMKkOn0MjhV1d> Message-ID: <0.0.0.32.1D1D0B7B89AF51A.5C77C5@mail.buysellkalispell.com> X-SmarterMail-spam: SPF_Neutral, ISpamAssassin 0 [raw: 0], SpamAssassin 13 [raw: 5], DK_Pass, DKIM_Pass X-SmarterMail-TotalSpamWeight: 11 ------=_Part_295_1581507040.1467061561066 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Customers Get a Special Extended Auto Warranty Offer

Link to comment
Share on other sites

roteague, unfortunately, what you gave is a "Report ID" that only you can see. the tracking URL looks similar but is at the top of the reporting screen

SpamCop v 4.8.4 © 2016 Cisco Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6250056514ze6acd50c90629cc27647bc52d4386f7cz

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...