Spam mailers sending emails from my site but seem to bypass the actual mail form

[NDboots]

Lately I have been getting a lot of spam mail from my ZenCart ver v1.5.5e Send Mail, but the strange thing is, they seem to be bypassing the mail form itself. The reason I say this, is because all the bottom "Office Use Only:" information is not there when I get those emails, but all the top area of the spam mail is as it normally comes. When I check the emails header on the spam mail, the mail is for sure being sent from my webhost mail server.

When I send myself a test email from the ZenCart Send Mail Form, it looks like this when it arrives:
From: My name
Email: tba@*******.***

------------------------------------------------------

Testing mail form

------------------------------------------------------

Office Use Only:
From: My Name
Email: tba@*******.***
Login Name: Not logged in
Login Email: Not logged in
IP Address: 333333333 - 333333333 (example only)
Host Address: 333333333333333 (it's there)
Date and Time: Fri May 4 2018 11:16:44 EDT

But this is a copy from a spam mail today, and there is no bottom dash line with "Office Use Only:" following:

From: Kylie Thompson
Email: kylie6da5ythomp***@yah**.***

------------------------------------------------------

Have you seen this new way to use Amazon in 2018 to grow your business?

Just WOW - http://customerinsights.press/***/2018/ama***/

After seeing your website I thought this would help you out too.

Alexis

The Subject line has the subject normally from my ZenCart mail form. The subject and links in the email and return email address are all different in all the spam mail, but what they all have in common is they come without the ending row of dashes followed by the "Office Use Only:" and info list, so there is no IP address info either! Nor do I find any IP info of the sender in the emails header. So, it would appear they are using my ZenCart send mail, but are bypass using the actual ZenCart Send Mail form. I do not have my email address on the form page itself, just Business Name, address, and phone number.

Does anyone else have this problem? How can I stop it?

[NDboots]

I maybe should of mentioned, I'm using PHP mail transport setting in my ZenCart.

[dbltoe]

Could be through the Contact Us. If you use it, check out the fix at https://www.zen-cart.com/showthread....-spam-messages

[NDboots]

Thanks for reply. The trouble is they are not going through my shopping cart Contact Us. If they did, I should be getting all the "For Office Use" info including the IP address of the sender. They seem like they are going through my ZenCart PHP send mail, but must have some coding to ignore adding the "For Office Use". The emails I receive are just like my Contact Us emails, only the following info is missing. But not from my own tests or when my real customers contact me. Otherwise this info is missing from this scammers email so I can't place an IP to ban when I don't get an IP to ban in the first place:

------------------------------------------------------

Office Use Only:
From: My Name
Email: tba@*******.***
Login Name: Not logged in
Login Email: Not logged in
IP Address: 333333333 - 333333333 (example only)
Host Address: 333333333333333 (it's there)
Date and Time: Fri May 4 2018 11:16:44 EDT

[NDboots]

Can someone tell me what files in the shopping cart that the Contact Us mail form uses in the PHP type of send mail?

[DrByte]

Sounds like either you've been hacked, or something has altered the core functionality, or added a new page (maybe like "Ask A Question" or "Request a Quote" plugins) that sends messages.

The contact-us page uses:
- /includes/modules/pages/contact_us/header_php.php
- /includes/templates/YOUR_TEMPLATE/templates/tpl_contact_us_default.php
- /includes/languages/english/YOUR_TEMPLATE/contact_us.php

[NDboots]

Sounds like either you've been hacked, or something has altered the core functionality, or added a new page (maybe like "Ask A Question" or "Request a Quote" plugins) that sends messages.

The contact-us page uses:
- /includes/modules/pages/contact_us/header_php.php
- /includes/templates/YOUR_TEMPLATE/templates/tpl_contact_us_default.php
- /includes/languages/english/YOUR_TEMPLATE/contact_us.php

Thank you Dr. Btye! I believe a junk mailer has hacked my shopping cart PHP SMTP, as the various spam mail from different email addresses have similarities, and no IP info. I may try adding a image ID requirement to try to stop it, but don't know if I'm knowledgeable enough to get it done. But, can at least try.

[DrByte]

There's a ReCaptcha plugin that's easy to install, which handles that.