http://localhost:8080/trac/ticket/656 <p> I'm getting several of thee day day: </p> <pre class="wiki">From: Mail Delivery System &lt;Mailer-Daemon@parrot.webarch.net&gt; Date: Sat, 14 Dec 2013 13:21:02 +0000 To: tc@parrot.webarch.net Subject: Mail delivery failed: returning message to sender This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: inxzkysnf@gmail.com SMTP error from remote mail server after RCPT TO:&lt;inxzkysnf@gmail.com&gt;: host gmail-smtp-in.l.google.com [173.194.78.26]: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 l11si2175565wjw.16 - gsmtp ------ This is a copy of the message, including all the headers. ------ Return-path: &lt;tc@parrot.webarch.net&gt; Received: from tc (uid=1011) by parrot.webarch.net with local (Exim 4.80) (envelope-from &lt;tc@parrot.webarch.net&gt;) id 1Vrp9L-0002BF-Kf for inxzkysnf@gmail.com; Sat, 14 Dec 2013 13:20:56 +0000 To: inxzkysnf@gmail.com Subject: Thanks for your message X-PHP-Originating-Script: 1011:lib_nonajax.php From: robjhopkins@gmail.com Reply-To: robjhopkins@gmail.com MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----MIME_BOUNDRY_main_message" Message-Id: &lt;E1Vrp9L-0002BF-Kf@parrot.webarch.net&gt; Date: Sat, 14 Dec 2013 13:20:55 +0000 This is a multi-part message in MIME format. ------MIME_BOUNDRY_main_message Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: quoted-printable Dear timberland france, Thank you for your message on the Transition Culture website - I will get back to you as soon as possible. ------MIME_BOUNDRY_main_message Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"&gt; &lt;HTML&gt;&lt;BODY&gt; &lt;div style=3D"font:normal 1em arial; margin-top:10px"&gt;&lt;p&gt;&lt;strong&gt;Dear timberland france,&lt;/strong&gt;&lt;/p&gt; &lt;p&gt;Thank you for your message on the Transition Culture website - I will get back to you as soon as possible. &lt;div style=3D"width:80%; background:#f4faff ; color:#aaa; font-size:11px; padding:10px; margin-top:20px"&gt;&lt;strong&gt;This is an automatic +confirmation message. 14 December, 2013.&lt;/strong&gt;&lt;/div&gt;&lt;/div&gt;&lt;/BODY&gt;&lt;/HTML&gt; </pre><p> It appears to be spam sent fro the Transition Culture <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> site to a Gnmail user who doesn't exist. </p> <p> It appears, from the email headers that this form is being used for the spamming <tt>/home/tc/sites/default/wp-content/plugins/contactforms/lib_nonajax.php</tt>. </p> <p> This needs some more investigation. </p> en-us /trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg http://localhost:8080/trac/ticket/656 Trac 0.12.5 chris Sat, 14 Dec 2013 14:48:42 GMT http://localhost:8080/trac/ticket/656#comment:1 http://localhost:8080/trac/ticket/656#comment:1 <ul> <li><strong>summary</strong> changed from <em>Spam being sent out vi Transition Culture</em> to <em>Spam being sent out via Transition Culture</em> </li> </ul> Ticket sam Mon, 10 Mar 2014 14:29:31 GMT http://localhost:8080/trac/ticket/656#comment:2 http://localhost:8080/trac/ticket/656#comment:2 <p> Hi Chris </p> <p> I'd stick <a class="ext-link" href="http://wordpress.org/plugins/wordfence/"><span class="icon">​</span>http://wordpress.org/plugins/wordfence/</a> on the site &amp; see if it detects any malware. </p> <p> Shall I do this? </p> <p> Thanks </p> <p> Sam </p> Ticket chris Mon, 10 Mar 2014 14:43:39 GMT http://localhost:8080/trac/ticket/656#comment:3 http://localhost:8080/trac/ticket/656#comment:3 <p> Sure, this is an ongoing issue, I get several bounced spam emails a day from the TC site, I have been leaving things like this on the back-burner in part to save the Transition Network money and in part because I'm not a <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> expert, I'm happy for you to take a lead on <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> issues. </p> Ticket sam Mon, 10 Mar 2014 15:48:17 GMT http://localhost:8080/trac/ticket/656#comment:4 http://localhost:8080/trac/ticket/656#comment:4 <p> Hi Chris. </p> <p> Not sure i'm a Wordpress expert either. I have been using it for a few years on various projects. I'm happy to take this on. </p> <p> Let's continue the conversation here: <a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/699"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/ticket/699</a> where i'll document what I do. </p> <p> Thanks </p> <p> Sam </p> Ticket sam Mon, 10 Mar 2014 16:16:29 GMT http://localhost:8080/trac/ticket/656#comment:5 http://localhost:8080/trac/ticket/656#comment:5 <p> Wrong thread. </p> Ticket chris Wed, 02 Apr 2014 10:36:13 GMT http://localhost:8080/trac/ticket/656#comment:6 http://localhost:8080/trac/ticket/656#comment:6 <ul> <li><strong>status</strong> changed from <em>new</em> to <em>closed</em> </li> <li><strong>resolution</strong> set to <em>fixed</em> </li> </ul> <p> This appears to be now resolved. </p> Ticket