Your Site Has Been Hacked

[dannyx]

At the outset I will point out that I am guessing that this is a simple phishing attempt, the site is unlikely to be threatened by anything and many of you probably receive similar emails.

My questions regarding this:

1. how to get rid of such spam? Yes I know there are many solutions, however I use mail on cpanel and supposedly spam filters are enabled and I still receive emails like these, ads for ointments and medicines, food, supplements and many other unwanted messages.
Maybe authentication on the contact form page?

2. how do you think there are people who unfortunately actually fall for such scammers?




Message: We have hacked your website https://.. and extracted your databases.

How did this happen?

Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that you have indexed in the search engines will be de-indexed based off of blackhat techniques that we used in the past to de-index Our targets.

How do i stop this?

We are willing to refrain from destroying your site's reputation for a small fee. The current fee is $3000 in bitcoins (0.044 BTC).

Send the bitcoin to the following Bitcoin address (Make sure to copy and paste):

btc adress.....

Once you have paid we will automatically get informed that it was your payment. Please note that you have to make payment within 5 days after receiving this e-mail or the database leak, e-mails dispatched, and de-index of your site WiLL start!

How do i get Bitcoins?

You can easily buy bitcoins via several websites or even offline from a Bitcoin-ATM.

What if i don't pay?

We will start the attack at the indicated date and uphold it until you do, there's no counter measure to this, you will Only end up wasting more money trying to find a solution. We will completely destroy your reputation amongst google and your customers.

This is not a hoax, do not reply to this email, don't try to reason or negotiate, we will not read any replies. Once you have paid we will stop what we were doing and you will never hear from us again!

Please note that Bitcoin is anonymous and no one will find out that you have complied.

[TheBoyMitchell]

So far today (yes, today) I've had 359 of these emails all from the same source. It's quite annoying.

[baldidiot]

1. how to get rid of such spam? Yes I know there are many solutions, however I use mail on cpanel and supposedly spam filters are enabled and I still receive emails like these, ads for ointments and medicines, food, supplements and many other unwanted messages.
Maybe authentication on the contact form page?

Definitely add a captcha, it will eliminate a huge amount of that stuff. You can either use recaptcha if you want a google solution or hcaptcha if you don't want google involved.

I've heard adding an extra required field can throw off a lot of bots as well, but not really tested it much myself.

You can also set up your spam filters to catch it. If you're getting the same kinds of message then take a snippet of the text and use it to filter out spam messages.

Eg: "a vulnerability within your site"

Tbh you could also do it with specific words that are unlikely to be in a legit message to your site (eg: names of medicines or ointments if they are a common occurrence), but obviously the more common the work the higher the chance you'll get false positives.

[universal4]

#1 way to stop the spam (temporarily) is close the email account. This works until the replacement email address ends up on the right lists where it's starts up again. If it is an email registered at affiliate programs, banks etc, too time consuming.

Yes people do in fact still fall for such things.

Adding a captcha? IMO won't change anything, unless it is a web form that exposes the email without the captcha, and then that will only slow down the automation of adding the email to the lists. If an email is associated with a site url, the email is on thousands of lists of site owners and those are the most common lists purchased for such scam emails.

As badidiot suggested, if you are getting a ton of them, filters to dump them will stop having to look at them.


Rick
Universal4

[TheGooner]

You could add an email rule in your filter to remove messages that match a criteria ...

Say a rule like body contains "Bitcoin address" or extracted your database or destroy your reputation .
You could bounce it, delete it or just send it to a spam folder.

They would all be unlikely to appear in a real message right?? Put the rule in and you'll never know they were sent.
I've added a dozen rules blocking mass domains and or message subjects or body contains ...

Works like a charm.

EDIT : Yeah - just noticed that Baldie already said this up the thread ... sorry.

[dannyx]

Thanks for the all answers, will test in the near future.
I have also seen advice to block emails from Gmail. However, I am not yet convinced to do that.

[baldidiot]

Adding a captcha? IMO won't change anything, unless it is a web form that exposes the email without the captcha, and then that will only slow down the automation of adding the email to the lists. If an email is associated with a site url, the email is on thousands of lists of site owners and those are the most common lists purchased for such scam emails.

It sounded like they were using a contact form ("Maybe authentication on the contact form page?") hence the captcha suggestions, obviously that won't do anything for direct emails.

Personally we never send acknowledgement emails from a contact form either - that stops the address getting out there. Ie: If someone spams a contact form and you never reply, if they also don't get an acknowledgement from the site then they won't ever know the email so it won't get put on lists.

We actually don't get any direct spam to the emails we use for our contact form addresses this way.

[NoDepositCasinos]

At the outset I will point out that I am guessing that this is a simple phishing attempt, the site is unlikely to be threatened by anything and many of you probably receive similar emails.

My questions regarding this:

1. how to get rid of such spam? Yes I know there are many solutions, however I use mail on cpanel and supposedly spam filters are enabled and I still receive emails like these, ads for ointments and medicines, food, supplements and many other unwanted messages.
Maybe authentication on the contact form page?

2. how do you think there are people who unfortunately actually fall for such scammers?




Message: We have hacked your website https://.. and extracted your databases.

How did this happen?

Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that you have indexed in the search engines will be de-indexed based off of blackhat techniques that we used in the past to de-index Our targets.

How do i stop this?

We are willing to refrain from destroying your site's reputation for a small fee. The current fee is $3000 in bitcoins (0.044 BTC).

Send the bitcoin to the following Bitcoin address (Make sure to copy and paste):

btc adress.....

Once you have paid we will automatically get informed that it was your payment. Please note that you have to make payment within 5 days after receiving this e-mail or the database leak, e-mails dispatched, and de-index of your site WiLL start!

How do i get Bitcoins?

You can easily buy bitcoins via several websites or even offline from a Bitcoin-ATM.

What if i don't pay?

We will start the attack at the indicated date and uphold it until you do, there's no counter measure to this, you will Only end up wasting more money trying to find a solution. We will completely destroy your reputation amongst google and your customers.

This is not a hoax, do not reply to this email, don't try to reason or negotiate, we will not read any replies. Once you have paid we will stop what we were doing and you will never hear from us again!

Please note that Bitcoin is anonymous and no one will find out that you have complied.

Have you tried using the SpamAssassin tool and increasing the spam threshold?

If you've already tried it and it didn't work or you're still not satisfied, another option is to filter specific words (in my case, these messages were all practically identical, even if they were from different senders) and report the message for phishing. That's what I did, and now I only receive one or two messages of that type in months