Joomla 3.9.13
The past while i've been receiving a lot of emails with the subject line similar to;
Subject: Warning: message 1iTQ2k-00083X-8c delayed 24 hours
The email body contains the following, I have removed some of the details.
This message was created automatically by mail delivery software. A message that you sent has not yet been delivered to one or more of its recipients after more than 24 hours on the queue on smtp.hosts.co.uk.
The message identifier is: [removed]
The date of the message is: Sat, 09 Nov 2019 13:40:06 +0100
The subject of the message is: [removed]
The address to which the message has not yet been delivered is: [removed]
No action is required on your part. Delivery attempts will continue for some time, and this warning may be repeated at intervals if the message remains undelivered. Eventually the mail delivery software will give up, and when that happens, the message will be returned to you.
Return-path: Received: from ...
My web host has contacted me with an email along the lines of;
Dear Customer,
We have recently received the following Abuse Reports related to your domain name. Please note that we have no access to the original email that was sent from your domain name, only the basic headers supplied by the reporting ISPs.
The email continues to outline various headers etc. and that they need me to take action or else they risk having their IP blocked and all users will be affected on their shared hosting.
They have given me some actions, some relate to web hosting (change passwords, etc.), some to CMS installations (scan for viruses, enable recaptcha, etc.).
Is there any way I can tell if these emails are coming from my Joomla website?
I do have a contact form on my website, it doesn't have reCaptcha (only the standard captcha box) so my next step is to update this.
I know that bots can use my email address for spamming, but that could be unrelated to Joomla. Anyone that knows my email address could potentially replicate this.
I'm planning to try https://mysites.guru and see if there any vulnerabilities in my site, but apart from that I'm not sure what else to do?
Should I ask my web host to check anything or should I check logs somewhere?
Any advice is appreciated.
