joshuaall

Thank you. Please let me know if I can help in any way.

Downgrade to v6.5.5 resolved the issue. I did not try v6.5.6.

PS: even on v6.5.7, in the Plugin Dashboard version number 6.5.5 is shown.

Hey Kris,

thank you so much! Works like a charm ??

I have not found a way to solve it yet.

I have tried the “dontreplace” variant, however it doesn’t work as an URL argument and neither as a file. The image is still served as webp. I have updated the htaccess beforehand.

Thank you for your heplful reply, as I now know which script is loaded, I will try your proposed solution.

Kind Regards

@satollo
The last updates seem to have solved the spam problem. Since the 17th the spamers are blocked. Thank you very much!

AntiBot-Log:

17-02-2020 13:56:11 - INFO  - m: 20,0 MB, u: 0 - Array
(
    [action] => newsletter
    [na] => s
    [preview] => true
    [nlang] => 
    [np1] => pyat
    [nr] => widget
    [nl] => Array
        (
            [0] => 0
        )

    [nn] => Лажуева! Возьмите Ваш лотерейный билет - htt\0p\0:\0/\0/\059att\0.tk/649105_r Действительно До 18.02.2020!
    [ns] => pyat
    [ne] => [email protected]
    [nx] => m
    [ny] => on
    [nhr] => https://frei-von-angst-und-zwaengen.de//
    [ts] => 1581947770
    [n1] => 3
    [n2] => 7
    [n3] => 10
)

17-02-2020 13:56:11 - FATAL - m: 20,0 MB, u: 0 - [email protected] - 85.26.235.235 - Name with http: Лажуева! Возьмите Ваш лотерейный билет - https://59att.tk/649105_r Действительно До 18.02.2020! pyat

I am refering to the Form-Integrations on https://www.thenewsletterplugin.com/premium

Hello Stefano,

i edited my review to make it more clear that i mean the paid addon that allows to use other form plugins (and their spam preventioning features) for the subscription process.

Naturally i am glad if you are still trying to find a solution. As stated by me before, since i have a running system that is affected, i would gladly provide any information that is needed to find a solution if you ask for it.

Yes:
“915 [email protected] Заберите Ваш лотерейный билет – https://okybilycuwuf.cf/645093_T0xJ До 10.02.2020! pyat”

@satollo Hi, thanks, but i did that ofc. Also my reply from nearly 4 days ago implies that i did.

Joshua

• This reply was modified 4 years, 9 months ago by joshuaall.

Hallo @satollo,
i changed the password yesterday and there are still new spam registrations.
They are somehow able to circumevent the http-blocks, as the access logs above and this screenshot (wordfence plugin) show!

@satollo
There is no other site or script or plugin that has access to the database and/or stores subscriptions on my website ??

• This reply was modified 4 years, 9 months ago by joshuaall.

@satollo
that is an interesting find, i just tried it and http in Names are blocked (i was sent to an non existing site).

I just looked the newsletter logs: while my own tries are clearly blocked and logged in the antibot.txt there are no other cases of blocking as a result of “http” in the name.
However in the subscription.txt the spam-subscriptions are logged as “New Email Adress”.

In my access log i found following example of an spam-subscription (other spam hits are similar):

176.59.108.30 – – [06/Feb/2020:20:38:28 +0100] “POST /?na=s HTTP/1.0” 200 1966 “https://frei-von-angst-und-zwaengen.de/” “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36” frei-von-angst-und-zwaengen.de

176.59.108.30 – – [06/Feb/2020:20:38:31 +0100] “POST / HTTP/1.0” 302 – “https://frei-von-angst-und-zwaengen.de/?na=s” “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36” frei-von-angst-und-zwaengen.de

176.59.108.30 – – [06/Feb/2020:20:38:34 +0100] “GET /newsletter-2/?nm=confirmation&nk=893-13def7485ba4e51e579f2d821cca626a HTTP/1.0” 200 29135 “https://frei-von-angst-und-zwaengen.de/?na=s” “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36” frei-von-angst-und-zwaengen.de

Does this information help in any way? Please tell if i could do anything else or provide further information.

• This reply was modified 4 years, 9 months ago by joshuaall.

@satollo
Even with the latest update there sadly are many spam mails:
Post SMTP Log
Newsletter Abonnents list