index.php is sending out a suspicious number of emails

Question

We got an email from Siteground about a suspicious number of outgoing emails from public_html/index.php. They've blocked the site from sending emails. Which we need to resolve.

There is no contact form on the homepage, but I would assume that index.php could also be other pages. Is this correct or a bad assumption?

Is the assumption that it is a contact from is also presumptuous. Could this be core?

I assume this could also be the template?

Aside from updating extensions and core. What's the best way to troubleshoot this so we can get the site sending emails again but without getting the domain blacklisted.

Answer 1

A few steps I take when troubleshooting these types of things for new clients when they’ve been hacked:

1. You can add your first site free to https:://mysites.guru which will then run an audit on your site and identify which files have potentially been hacked so you can remove malicious code and/or rogue files.

2. Reinstall Joomla via components > joomla update which will restore all of the core files to the latest version.

3. Check the index.php file for your templates to see if they have injected/unfamiliar code.

4. Check that your extensions are all up to date.

5. Check if any extensions you use are listed on the Vulnerable Extensions List

6. If you are having spam user registrations as part of the symptoms, disable new registrations in the user options if you don’t need that functionality.

If all of the above fails, ask me for other potential techniques to delve a bit further. From experience the issue is picked up by mysites.guru more often than not to give you a starting point to fix it.

Consider installing a firewall extension, too, like Akeeba Admin Tools or RS Firewall to keep intruders at bay.

Answer 2

To be clear. index.php RARELY ever sends mail. However a well written application like Joomla routes all requests through a single entry point, index.php

Webhosts don't care to understand the basics of web applications to know that simple fact.

99% of the recent spam cases I have investigate stem from the fact a Joomla Contact was published, leading to a form being available on the following url:

-- /index.php?option=com_contact&view=contact&id=1

This has been discussed here: https://github.com/joomla/joomla-cms/issues/20865 and many other places.

The quick fix is to unpublish your Joomla Contacts if not used, or to implement Google reCaptcha

Documentation on how to do that is here:

-- https://docs.joomla.org/J3.x:Google_ReCaptcha