Spam sent from forum

[ibeauty]

Hi,

I have vBulletin 3.8.2 and a problem with spam sent from my forum. Some one is sending spam and I can't find all places where it can be done. I had already blocked user groups from sending any e-mails to other users. But I still can't find any other places where someone can enter his own content and send email to many recipients.

Regards

[Trevor Hannant]

Can you post the header from one of these messages

[ibeauty]

I will cut the part where recipents addresses are.


> [ SpamCop V4.6.2.001 ]
> This message is brief for your comfort. Please use links below for details.
>
> Email from 86.111.245.65 / Mon, 14 May 2012 14:16:52 +0100
> http://www.spamcop.net/w3m?i=z576815...81dc1648ad972z
>
> [ Offending message ]
> Return-Path: <[email protected]>
> Delivered-To: x
> Received: from localhost (localhost.localdomain [127.0.0.1])
> by server.neiljw.net (Postfix) with ESMTP id 9301130B8905
> for <x>; Mon, 14 May 2012 14:16:54 +0100 (BST)
> X-Virus-Scanned: amavisd-new at neiljw.net
> X-Spam-Flag: NO
> X-Spam-Score: 2.059
> X-Spam-Level: **
> X-Spam-Status: No, score=2.059 tagged_above=2 required=6.31
> tests=[BAYES_00=-1.9, RCVD_IN_BRBL_LASTEXT=1.449,
> SUSPICIOUS_RECIPS=2.51] autolearn=no
> Received: from server.neiljw.net ([127.0.0.1])
> by localhost (server.neiljw.net [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id 1SNxsYod3g8a for <x>;
> Mon, 14 May 2012 14:16:53 +0100 (BST)
> Received: from ibeauty.provps.pl (r245-65.iq.pl [86.111.245.65])
> by server.neiljw.net (Postfix) with ESMTP id A3CE730B8540
> for <x>; Mon, 14 May 2012 14:16:52 +0100 (BST)
> Received: from localhost (localhost.localdomain [127.0.0.1])
> by ibeauty.provps.pl (WALUGA) with ESMTP id A253964E5B0;
> Mon, 14 May 2012 15:17:15 +0200 (CEST)
> Received: from ibeauty.provps.pl ([127.0.0.1])
> by localhost (ibeauty.provps.pl [127.0.0.1]) (amavisd-new, port 10024)
> with ESMTP id 1U+nNgwc5ng0; Mon, 14 May 2012 15:17:15 +0200 (CEST)
> Received: by ibeauty.provps.pl (WALUGA, from userid 1000)
> id EB6B764E4E3; Mon, 14 May 2012 15:17:08 +0200 (CEST)

> Subject: We will pay you $100 per hour if you write something for us ...
> From:
> =?ISO-8859-2?q?Forum_iBeauty=2Epl_-_uroda=2C_makija=BF=2C_w=B3osy=2C_piel=EAgnacja=2C_moda?=
> <[email protected]>
> Auto-Submitted: auto-generated
> Message-ID: <[email protected]>
> MIME-Version: 1.0
> Content-Type: text/plain; charset="ISO-8859-2"
> Content-Transfer-Encoding: 8bit
> X-Priority: 3
> X-Mailer: vBulletin Mail via PHP
> Date: Mon, 14 May 2012 15:17:08 +0200 (CEST)

[Hawkmoth]

@ Beauty

We had the same problem a month ago. Our server said there was some problem in the vb software.

X-Mailer: vBulletin Mail via PHP

(from your email header.

After we did an upgrade to 4.1.7 the problem seems to be finished.

https://www.vbulletin.com/forum/showthread.php/400727