Spam Website Enquiry

[Note: remember to include site URL, ZC version, list of plugins, PHP version, etc ... read the Posting Tips shown above for information to include in your post here. And, remove this comment before actually posting!]

ZC 1.5.6c
PHP version sorry I don't know. phpinfo.php doesn't work
Plugins: none. I've tried to keep it as original as I can

I received this spam email (below) from my zencart store (work in progress) bmamps.com/store. The thing is I don't have a website enquiry form or even a contact us page as that is all covered my the main site bmamps.com.
Is this a hack?
How is this possible?
Should I be concerned?
Any advice on next steps?

Thanks,
CS

Return-Path: [email protected]
Delivered-To: [email protected]
Received: from mocha9003.mochahost.com
by mocha9003.mochahost.com with LMTP
id MIWWLDzi31744SEAP3wolA
(envelope-from [email protected])
for [email protected]; Tue, 09 Jun 2020 14:25:48 -0500
Return-path: [email protected]
Envelope-to: [email protected]
Delivery-date: Tue, 09 Jun 2020 14:25:48 -0500
Received: from [204.93.193.216] (port=34330 helo=bmamps.com)
by mocha9003.mochahost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.92)
(envelope-from [email protected])
id 1jijsa-009ndq-Kr
for [email protected]; Tue, 09 Jun 2020 14:25:48 -0500
Date: Tue, 9 Jun 2020 14:25:48 -0500
To: Black Magic Amplifiers [email protected]
From: Williamtix [email protected]
Reply-To: Williamtix <oliakoroleva114551######################>
Subject: Website Inquiry from Black Magic Amplifiers
Message-ID: [email protected]
X-Mailer: PHPMailer for Zen Cart
Precedence: bulk
Auto-Submitted: auto-generated
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

From:=09Williamtix=0AEmail:=09oliakoroleva114551######################=0A=0A-----------=
-------------------------------------------=0A=0A=D0=97=D0=B4=D1=80=D0=
=B0=D0=B2=D1=81=D1=82=D0=B2=D1=83=D0=B9=D1=82=D0=B5=20
=D0=95=D0=B6=D0=B5=D0=B4=D0=BD=D0=B5=D0=B2=D0=BD=D0=BE =D0=BC=D0=B8=D0=
=BB=D0=BB=D0=B8=D0=BE=D0=BD=D1=8B =D0=BB=D1=8E=D0=B4=D0=B5=D0=B9 =D0=BF=
=D0=BE =D0=B2=D1=81=D0=B5=D0=BC=D1=83 =D0=BC=D0=B8=D1=80=D1=83 =D0=B4=D0=
=B5=D0=BB=D0=B0=D1=8E=D1=82 =D1=81=D1=82=D0=B0=D0=B2=D0=BA=D0=B8 =D0=B2 =
=D0=BE=D0=BD=D0=BB=D0=B0=D0=B9=D0=BD-=D0=BA=D0=B0=D0=B7=D0=B8=D0=BD=D0=
=BE =D0=B8 =D0=B1=D1=83=D0=BA=D0=BC=D0=B5=D0=BA=D0=B5=D1=80=D1=81=D0=BA=
=D0=B8=D1=85 =D0=BA=D0=BE=D0=BD=D1=82=D0=BE=D1=80=D0=B0=D1=85, =D0=B8=D1=
=81=D0=BF=D1=8B=D1=82=D1=8B=D0=B2=D0=B0=D1=8E=D1=82 =D1=83=D0=B4=D0=B0=
=D1=87=D1=83 =D0=B2 =D0=BB=D0=BE=D1=82=D0=B5=D1=80=D0=B5=D1=8F=D1=85. =
=D0=98=D0=BD=D1=82=D0=B5=D1=80=D0=BD=D0=B5=D1=82-=D0=BF=D0=BE=D0=BB=D1=
=8C=D0=B7=D0=BE=D0=B2=D0=B0=D1=82=D0=B5=D0=BB=D0=B8 =D0=B8=D1=89=D1=83=
=D1=82 =D0=B1=D0=B5=D0=B7=D0=BE=D0=BF=D0=B0=D1=81=D0=BD=D1=8B=D0=B5 =D1=
=81=D0=B0=D0=B9=D1=82=D1=8B =D1=81 =D1=81=D0=BB=D0=BE=D1=82=D0=B0=D0=BC=
=D0=B8 =D0=B8 =D1=81=D1=82=D0=B0=D0=B2=D0=BA=D0=B0=D0=BC=D0=B8 =D0=BD=D0=
=B0 =D1=81=D0=BF=D0=BE=D1=80=D1=82, =D0=BF=D1=8B=D1=82=D0=B0=D1=8E=D1=82=
=D1=81=D1=8F =D1=80=D0=B0=D0=B7=D0=BE=D0=B1=D1=80=D0=B0=D1=82=D1=8C=D1=
=81=D1=8F =D0=B2 =D0=BF=D1=80=D0=B0=D0=B2=D0=B8=D0=BB=D0=B0=D1=85 =D1=80=
=D0=B0=D0=B1=D0=BE=D1=82=D1=8B =D0=BE=D0=BD=D0=BB=D0=B0=D0=B9=D0=BD =D0=
=BA=D0=B0=D0=B7=D0=B8=D0=BD=D0=BE, =D0=B7=D0=B0=D0=B4=D0=B0=D1=8E=D1=82 =
=D0=B4=D1=80=D1=83=D0=B3 =D0=B4=D1=80=D1=83=D0=B3=D1=83 =D0=B2=D0=BE=D0=
=BF=D1=80=D0=BE=D1=81=D1=8B =D0=BE =D0=B0=D0=BA=D1=86=D0=B8=D1=8F=D1=85 =
=D0=B8 =D0=B4=D0=B5=D0=BB=D1=8F=D1=82=D1=81=D1=8F =D1=81=D0=BE=D0=B2=D0=
=B5=D1=82=D0=B0=D0=BC=D0=B8, =D0=BA=D0=B0=D0=BA =D1=81=D0=BE=D1=80=D0=B2=
=D0=B0=D1=82=D1=8C =D0=B1=D0=BE=D0=BB=D1=8C=D1=88=D0=BE=D0=B9 =D0=BA=D1=
=83=D1=88.=D0=98=D0=BD=D1=84=D0=BE=D1=80=D0=BC=D0=B0=D1=86=D0=B8=D0=BE=
=D0=BD=D0=BD=D0=BE-=D1=80=D0=B0=D0=B7=D0=B2=D0=BB=D0=B5=D0=BA=D0=B0=D1=
=82=D0=B5=D0=BB=D1=8C=D0=BD=D1=8B=D0=B9 =D0=BF=D0=BE=D1=80=D1=82=D0=B0=
=D0=BB proverkacasino.ru =D1=81=D0=BE=D0=B7=D0=B4=D0=B0=D0=BD =D0=B4=D0=
=BB=D1=8F =D0=BE=D0=B1=D1=8A=D0=B5=D0=B4=D0=B8=D0=BD=D0=B5=D0=BD=D0=B8=
=D1=8F =D0=BB=D1=8E=D0=B1=D0=B8=D1=82=D0=B5=D0=BB=D0=B5=D0=B9 =D0=B0=D0=
=B7=D0=B0=D1=80=D1=82=D0=BD=D1=8B=D1=85 =D0=B8=D0=B3=D1=80.=D0=9F=D0=BE=
=D0=BB=D1=8C=D0=B7=D0=BE=D0=B2=D0=B0=D1=82=D0=B5=D0=BB=D1=8F=D0=BC =D0=
=B4=D0=BE=D1=81=D1=82=D1=83=D0=BF=D0=BD=D1=8B =D1=81=D0=B2=D0=B5=D0=B4=
=D0=B5=D0=BD=D0=B8=D1=8F =D0=BE =D0=BB=D0=B8=D1=86=D0=B5=D0=BD=D0=B7=D0=
=B8=D1=8F=D1=85 =D0=B8 =D0=BA=D0=BB=D1=8E=D1=87=D0=B5=D0=B2=D1=8B=D1=85 =
=D0=BE=D1=81=D0=BE=D0=B1=D0=B5=D0=BD=D0=BD=D0=BE=D1=81=D1=82=D1=8F=D1=85, =
=D0=BE=D1=86=D0=B5=D0=BD=D0=BA=D0=B8 =D1=8D=D0=BA=D1=81=D0=BF=D0=B5=D1=
=80=D1=82=D0=BE=D0=B2 =D0=B8 =D0=BE=D1=82=D0=B7=D1=8B=D0=B2=D1=8B =D0=BB=
=D1=8E=D0=B1=D0=B8=D1=82=D0=B5=D0=BB=D0=B5=D0=B9 =D0=B8=D0=B3=D1=80=D0=
=BE=D0=B2=D1=8B=D1=85 =D0=B0=D0=B2=D1=82=D0=BE=D0=BC=D0=B0=D1=82=D0=BE=
=D0=B2.=20
=D0=92 =D0=BE=D0=BF=D0=B8=D1=81=D0=B0=D0=BD=D0=B8=D0=B5 =D0=BA=D0=B0=D0=
=B6=D0=B4=D0=BE=D0=B3=D0=BE =D0=BA=D0=B0=D0=B7=D0=B8=D0=BD=D0=BE =D1=80=
=D0=B5=D0=B3=D1=83=D0=BB=D1=8F=D1=80=D0=BD=D0=BE =D0=B2=D0=BD=D0=BE=D1=
=81=D1=8F=D1=82=D1=81=D1=8F =D1=81=D0=B2=D0=B5=D0=B4=D0=B5=D0=BD=D0=B8=
=D1=8F =D0=BE =D1=82=D0=B5=D0=BA=D1=83=D1=89=D0=B8=D1=85 =D0=B0=D0=BA=D1=
=86=D0=B8=D1=8F=D1=85, =D0=B1=D0=BE=D0=BD=D1=83=D1=81=D0=B0=D1=85, =D1=
=82=D1=83=D1=80=D0=BD=D0=B8=D1=80=D0=B0=D1=85. =D0=9D=D0=B0 =D0=BE=D1=81=
=D0=BD=D0=BE=D0=B2=D0=B5 =D0=BE=D0=B1=D1=8A=D0=B5=D0=BA=D1=82=D0=B8=D0=
=B2=D0=BD=D1=8B=D1=85 =D0=BE=D0=B1=D0=B7=D0=BE=D1=80=D0=BE=D0=B2 =D1=80=
=D0=B5=D0=B4=D0=B0=D0=BA=D1=86=D0=B8=D1=8F =D1=81=D0=BE=D0=B7=D0=B4=D0=
=B0=D0=B5=D1=82 =D1=87=D0=B5=D1=80=D0=BD=D1=8B=D0=B9 =D1=81=D0=BF=D0=B8=
=D1=81=D0=BE=D0=BA =D0=BC=D0=BE=D1=88=D0=B5=D0=BD=D0=BD=D0=B8=D1=87=D0=
=B5=D1=81=D0=BA=D0=B8=D1=85 =D1=81=D0=B0=D0=B9=D1=82=D0=BE=D0=B2, =D0=BA=
=D0=BE=D1=82=D0=BE=D1=80=D1=8B=D0=B5 =D0=BE=D0=B1=D0=BC=D0=B0=D0=BD=D1=
=8B=D0=B2=D0=B0=D1=8E=D1=82 =D1=81=D0=B2=D0=BE=D0=B8=D1=85 =D0=BF=D0=BE=
=D1=81=D0=B5=D1=82=D0=B8=D1=82=D0=B5=D0=BB=D0=B5=D0=B9 =D0=B8 =D1=80=D0=
=B5=D0=B9=D1=82=D0=B8=D0=BD=D0=B3 =D0=BB=D1=83=D1=87=D1=88=D0=B8=D1=85 =
=D0=BA=D0=B0=D0=B7=D0=B8=D0=BD=D0=BE.=20
=20
=D0=A0=D0=B5=D0=BA=D0=BE=D0=BC=D0=B5=D0=BD=D0=B4=D1=83=D0=B5=D0=BC =D1=
=82=D0=B0=D0=BA=D0=B6=D0=B5 =D0=BE=D0=B7=D0=BD=D0=B0=D0=BA=D0=BE=D0=BC=
=D0=B8=D1=82=D1=8C=D1=81=D1=8F c :=20
=20
https://zen.yandex.ru/media/id/5ed3c26da3248275781ac404/bonus-ot-onlain-kaz=
ino-mr-bit-5ed9197ce73b82160d42d982 =0A=0A-------------------------------=
-----------------------=0A=0AOffice Use Only:=09=0AFrom:=09Williamtix=0AEma=
il:=09oliakoroleva114551######################=0ALogin Name:=09Not logged in=0ALogin Em=
ail:=09Not logged in=0AIP Address:=0946.53.244.157 - 46.53.244.157=0AHost A=
ddress:=09cgn-pool-mni-46-53-244-157.telecom.by=0ADate and Time:=09Tue Jun =
9 2020 14:25:48 CDT=0A=0A=0A

The actual text

Здравствуйте
Ежедневно миллионы людей по всему миру делают ставки в онлайн-казино и букмекерских конторах, испытывают удачу в лотереях. Интернет-пользователи ищут безопасные сайты с слотами и ставками на спорт, пытаются разобраться в правилах работы онлайн казино, задают друг другу вопросы о акциях и делятся советами, как сорвать большой куш.Информационно-развлекательный портал proverkacasino.ru создан для объединения любителей азартных игр.Пользователям доступны сведения о лицензиях и ключевых особенностях, оценки экспертов и отзывы любителей игровых автоматов.
В описание каждого казино регулярно вносятся сведения о текущих акциях, бонусах, турнирах. На основе объективных обзоров редакция создает черный список мошеннических сайтов, которые обманывают своих посетителей и рейтинг лучших казино.

Рекомендуем также ознакомиться c :

https://zen.yandex.ru/media/id/5ed3c26da3248275781ac404/bonus-ot-onlain-kazino-mr-bit-5ed9197ce73b82160d42d982

Office Use Only:
From: Williamtix
Email: oliakoroleva114551######################
Login Name: Not logged in
Login Email: Not logged in
IP Address: 46.53.244.157 - 46.53.244.157
Host Address: cgn-pool-mni-46-53-244-157.telecom.by
Date and Time: Tue Jun 9 2020 14:25:48 CDT

Got another one today. I guess the php file that generates the enquiry is present so all they have to do is generate the correct url and auto fill the form. Therefore I need to hide the relevant php file I guess?
From: MiltonBar
Email: [email protected]

Давно не заходили к нам... https://www.instagram.com/hookahmagic_su/

кальян купить спб
У Вас уже скидка
https://twitter.com/hookahmagic1
КАЛЬЯНЫ
Строго 18+

Office Use Only:
From: MiltonBar
Email: [email protected]
Login Name: Not logged in
Login Email: Not logged in
IP Address: 78.37.184.28 - 78.37.184.28
Host Address: ppp78-37-184-28.pppoe.avangarddsl.ru
Date and Time: Tue Jun 9 2020 21:14:17 CDT

I've commented out contact_ups.php to see if that addresses the issue.

Commenting out contact_us.php didn't help. I've renamed header_php.php so it cant be found. I don't know if there will be unintended side effects.

I see the spammers just need to use the URL index.php?main_page=contact_us to bring up the contact us page, even if it's not enabled. This seems like a weakness that probably should be addressed.

"bring up the contact us page, even if it's not enabled"

What do you mean by "it's not enabled"? There's no "switch" to enable/disable the contact-us page.

The only way to "disable" any built-in page is to break the /includes/pages/PAGE_NAME folder by deleting it so that the "404 Page Not Found" is triggered.
Or you can rename the folder if you also rename the corresponding pattern in the associated template file and the corresponding language file.

You may also want to set the Missing Page Check configuration setting to trigger the Page Not Found response instead of redirecting to the home page.

Thx DRB,

I was under the mistaken impression that if the information sidebox was not displayed then the underlying functionaly to bring up those pages would be disabled. This, as you say, is not the case. Do you think having such an enable would be a useful anti-hack / anti-spam improvement?

I see something about captcha in the code but I realy don't understand how it all works, it's beyond my lowly level of php skills. Have I overlooked something that would enable a capcha?

What about my renaming of header_php.php? It seems efective but will I have broken something else?

-CS

Renaming the header_php.php file will "stop the spammers" because it will cause the PHP code to throw errors because the expected file is not found. This will cause debug log files to be generated in your /logs directory. This isn't usually what you want.

If you rename the contact_us folder then Zen Cart will know that an "invalid page name" has been visited and will take action accordingly. If you also set the Missing Page Check setting to "Page Not Found" then a proper 404 response will be sent which will tell automated bots that they should go away.

As for captcha, what's in the code is "hooks" for a plugin to link to if you wanted to use the ReCaptcha plugin. Those hooks allow the plugin to not require manual edits of your store's files; instead you can drop in the plugin's files to the directories it specifies and get the benefits it offers with relatively easy installation.

I'll do the folder rename.

Thank you for your time & suggestions.

-CS