1

Joomla 3.9.13

The past while i've been receiving a lot of emails with the subject line similar to;

Subject: Warning: message 1iTQ2k-00083X-8c delayed 24 hours

The email body contains the following, I have removed some of the details.

This message was created automatically by mail delivery software. A message that you sent has not yet been delivered to one or more of its recipients after more than 24 hours on the queue on smtp.hosts.co.uk.

The message identifier is: [removed]

The date of the message is: Sat, 09 Nov 2019 13:40:06 +0100

The subject of the message is: [removed]

The address to which the message has not yet been delivered is: [removed]

No action is required on your part. Delivery attempts will continue for some time, and this warning may be repeated at intervals if the message remains undelivered. Eventually the mail delivery software will give up, and when that happens, the message will be returned to you.

Return-path: Received: from ...

My web host has contacted me with an email along the lines of;

Dear Customer,

We have recently received the following Abuse Reports related to your domain name. Please note that we have no access to the original email that was sent from your domain name, only the basic headers supplied by the reporting ISPs.

The email continues to outline various headers etc. and that they need me to take action or else they risk having their IP blocked and all users will be affected on their shared hosting.

They have given me some actions, some relate to web hosting (change passwords, etc.), some to CMS installations (scan for viruses, enable recaptcha, etc.).

Is there any way I can tell if these emails are coming from my Joomla website?

I do have a contact form on my website, it doesn't have reCaptcha (only the standard captcha box) so my next step is to update this.

I know that bots can use my email address for spamming, but that could be unrelated to Joomla. Anyone that knows my email address could potentially replicate this.

I'm planning to try https://mysites.guru and see if there any vulnerabilities in my site, but apart from that I'm not sure what else to do?

Should I ask my web host to check anything or should I check logs somewhere?

Any advice is appreciated.

  • Have you tried turning off mail sending in the Global Configuration Mail Settings with the Send Mail and Disable Mass Mail options? You would really need to see the headers to see where the mail might be coming from. And years ago I had a spammer set up on a website I managed and it was just a bit of php hiding in a Joomla directory but it wasn't using the details from Joomla, so yes it could be your website, but nothing to do with Joomla. Take a back up of the site and/or folder(s), extract it on your pc/mac and run a AV/malware tool against it to see what it finds. – Irata Nov 21 '19 at 10:40
  • Thanks @Irata I have a contact form on my website so I need to keep the mail sending function enabled. I'll check the mass mail setting. So if I can get the mail headers I should be able to see exactly if it's coming from my Joomla website? Also I didn't realise I could simply download the website files and scan with an AV - is this basically what mysites.guru does? Thanks again – jonboy Nov 21 '19 at 11:01
  • mysite.guru probably does some sort of AV/malware scanning but it is only part of a range things it checks and it you have got access to it, then it is worth doing a full audit of your site as it will pick up other possibilities like an extra file in a directory where it shouldn't be or its vulnerability scan which looks for known issues with Joomla. – Irata Nov 21 '19 at 13:38
0

Check your "Contacts" component. If you have a contact in there and you're not using it, spambots could be filling the contact form. If you are using it, you can disable the form, or add captcha to that as well. I've found this to be the culprit a few times.

  • Welcome to JSE and thank you for contributing. Please take the tour and consider telling us a little about yourself in your profile. – mickmackusa Nov 22 '19 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.