spam that looks like it's coming from my forum?

Get help with installation and running phpBB 3.3.x here. Please do not post bug reports, feature requests, or extension related questions here.
Post Reply
User avatar
devnulljp
Registered User
Posts: 71
Joined: Fri Aug 20, 2010 4:07 pm

spam that looks like it's coming from my forum?

Post by devnulljp »

Seeing a ton of errors in my mail logs that looks like spam coming *from* my address.
Not sure if it's just someone spoofing or where it's coming from. It's being rejected at the smtp server, so that's a good thing.
But combined with the fact that when I send a test email form the ACP the button changes to a weird looking email address* has me wondering ...
Anyone good with parsing error logs? It looks like spam coming from my mailbox.

Button change. Anyone else seen this?
WTHisthis.png
WTHisthis.png (4.9 KiB) Viewed 932 times
Sample error log
Connecting to mail49.extendcp.co.uk:587
LINE: 1204 <- 220 mta3.hi.local ESMTP Exim 4.94.2 Tue, 11 May 2021 06:49:00 +0100

# EHLO web37.extendcp.co.uk
LINE: 1551 <- 250-mta3.hi.local Hello web37.extendcp.co.uk [79.170.40.37]

LINE: 1551 <- 250-SIZE 52428800

LINE: 1551 <- 250-8BITMIME

LINE: 1551 <- 250-PIPELINING

LINE: 1551 <- 250-PIPE_CONNECT

LINE: 1551 <- 250-AUTH PLAIN LOGIN CRAM-MD5

LINE: 1551 <- 250-CHUNKING

LINE: 1551 <- 250-STARTTLS

LINE: 1551 <- 250 HELP

# STARTTLS
LINE: 1604 <- 220 TLS go ahead

# EHLO web37.extendcp.co.uk
LINE: 1551 <- 250-mta3.hi.local Hello web37.extendcp.co.uk [79.170.40.37]

LINE: 1551 <- 250-SIZE 52428800

LINE: 1551 <- 250-8BITMIME

LINE: 1551 <- 250-PIPELINING

LINE: 1551 <- 250-PIPE_CONNECT

LINE: 1551 <- 250-AUTH PLAIN LOGIN CRAM-MD5

LINE: 1551 <- 250-CHUNKING

LINE: 1551 <- 250 HELP

# AUTH CRAM-MD5
LINE: 1711 <- 334 PDg4MzYuMTYyMDcxMjE0MEBtdGEzLmhpLmxvY2FsPg==

# Omitting sensitive information
LINE: 1723 <- 235 Authentication succeeded

# MAIL FROM:<my_mailbox>
LINE: 1220 <- 250 OK

# RCPT TO:<my_mailbox>
LINE: 1240 <- 250 Accepted

# DATA
LINE: 1271 <- 354 Enter message, ending with "." on a line by itself

# Subject: =?UTF-8?B?Y2hubG92ZS5jb20gc2NhbQ==?=
# To: =?UTF-8?B?QWRtaW5pc3RyYXRvcg==?= <my_mailbox>
# From: <my_mailbox>
Reply-To: [email protected]
Return-Path: <my_mailbox>
Sender: <my_mailbox>
MIME-Version: 1.0
Message-ID: <384255a1fa6626d3e848e09b85c78134@my_address>
Date: Tue, 11 May 2021 06:49:00 +0100
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: phpBB3
X-MimeOLE: phpBB3
X-phpBB-Origin: phpbb://my_address/forum
X-AntiAbuse: Board servername - my_address
X-AntiAbuse: User IP - 199.167.138.22

# Hello Administrator,

The following is an e-mail sent to you through the administration contact
page

The message was sent from a guest who specified the following contact
information:
Name: Smithzba
E-mail address: [email protected]
IP Address: 199.167.138.22
User avatar
Brf
Support Team Member
Support Team Member
Posts: 53398
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: spam that looks like it's coming from my forum?

Post by Brf »

devnulljp wrote: Tue May 11, 2021 10:27 pm
# Hello Administrator,

The following is an e-mail sent to you through the administration contact
page

The message was sent from a guest who specified the following contact
information:
Name: Smithzba
E-mail address: [email protected]
IP Address: 199.167.138.22
That is a message from your board's Contact Admin page
User avatar
devnulljp
Registered User
Posts: 71
Joined: Fri Aug 20, 2010 4:07 pm

Re: spam that looks like it's coming from my forum?

Post by devnulljp »

Brf wrote: Wed May 12, 2021 1:24 pm That is a message from your board's Contact Admin page
So, it's just some spambot spamming me from the Contact Admin page but my smtp server is recognising it as spam and blocking it is all? Not some sneaky bot relating through my forum somehow?
Last edited by devnulljp on Wed May 12, 2021 2:41 pm, edited 1 time in total.
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26502
Joined: Fri Aug 29, 2008 9:49 am

Re: spam that looks like it's coming from my forum?

Post by Mick »

Please use the quote function only when it is needed to make your reply clear and only quote the parts necessary not the whole post every time. Excessive quoting (especially of long messages and/or multiple images) makes reading the post extremely difficult and tiresome, thanks.
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
User avatar
devnulljp
Registered User
Posts: 71
Joined: Fri Aug 20, 2010 4:07 pm

Re: spam that looks like it's coming from my forum?

Post by devnulljp »

Mick wrote: Wed May 12, 2021 2:38 pm Please use the quote function only when it is needed to make your reply clear and only quote the parts necessary not the whole post every time. Excessive quoting (especially of long messages and/or multiple images) makes reading the post extremely difficult and tiresome, thanks.
OK, edited
User avatar
KevC
Support Team Member
Support Team Member
Posts: 72339
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: spam that looks like it's coming from my forum?

Post by KevC »

-:|:- Support Request Template -:|:-
Image
"Step up to red alert. Sir, are you absolutely sure? It does mean changing the bulb"
Post Reply

Return to “[3.3.x] Support Forum”