[SOLVED] This is a bit of an emergency issue re spam via prestashop

[puffdade]

Guys  im getting hit with around 8 emails a minute and they seem to be coming from my presta site

 

The reason I beleive this is the case is if I change the password from within the email setup in the backoffice to a password that is incorrect the emails stop.

 

I have changed all the email passwords at server level and have run scan after scan on my system, I first thought this maybe comming from the send to a freind module  I have turned that module off and they still continue.

 

Can anyone throw any light on this  as my host keeps shutting my emails off as im going over 500 emails an hour 

 

I have added a screenshot to show you the extent of the emails and the message within

 

Paul

 

and here is a list of the warnings from my host

 

Time:  Wed Jul 27 21:56:21 2016 +0100

Type:  LOCALHOSTRELAY, Remote IP - 109.203.109.221 (GB/United Kingdom/server.puffdade.com)

Count: 101 emails relayed

Blocked: No

 

Sample of the first 10 emails:

 

2016-07-27 21:43:21 1bSVfl-00027G-Ji <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47922 P=esmtpa A=dovecot_plain:[email protected] S=21163 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:43:31 1bSVfv-00028K-GS <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47925 P=esmtpa A=dovecot_plain:[email protected] S=21236 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:43:36 1bSVg0-00028r-DG <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47927 P=esmtpa A=dovecot_plain:[email protected] S=21171 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:43:36 1bSVg0-0002[spam-filter]Ko <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47928 P=esmtpa A=dovecot_plain:[email protected] S=20984 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:43:48 1bSVgC-00029w-Ql <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47932 P=esmtpa A=dovecot_plain:[email protected] S=21174 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:43:48 1bSVgC-0002A0-Tv <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47933 P=esmtpa A=dovecot_plain:[email protected] S=21298 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:43:59 1bSVgN-0002An-Be <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47936 P=esmtpa A=dovecot_plain:[email protected] S=21248 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:44:09 1bSVgX-0002Bc-1E <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47938 P=esmtpa A=dovecot_plain:[email protected] S=21150 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:44:13 1bSVgb-0002CA-Br <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47940 P=esmtpa A=dovecot_plain:[email protected] S=21166 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

2016-07-27 21:44:14 1bSVgc-0002CL-Fw <= [email protected] H=server.puffdade.com (www.puffdade.com) [109.203.109.221]:47942 P=esmtpa A=dovecot_plain:[email protected] S=21168 [email protected] T="[Puff Dad E Vaping Supplies] A friend sent you a link to UD \n Multy Pocket Vape Bag" for [email protected]

Edited July 28, 2016 by puffdade (see edit history)

[bellini13]

Disable and delete the "send to a friend" module, it is defective

[PrestaHeroes USA]

also mdekker has secure send to friend

 

https://github.com/firstred/mpsendtoafriend/releases

 

you can contact community member 

https://www.prestashop.com/forums/user/784244-mdekker/

[puffdade]

Thanks Guys  

[puffdade]

Looks like business has resumed back to normal,  I did notice the spammers had the same email  randomnumber@ qq.com  as the chinese spam posts i see here quite regularly

do they have a boner for Prestashop.

 

23 thousand emails deleted that was a mission

 

Really apreciate the help guys