E-mail Hijacked

[Nicholas Hadjiev]

Hey folks,

This is a first for us. Basically our e-mail got hijacked and our forum is spamming endlessly to random e-mails from around the world. We checked out the something is wrong page to contact support and there is this optional upgrade: " prevents spam from being sent via the email sharer and resolves an issue with forums being hidden "

Now I'm really hoping this event correlates to this patch but we've already exhausted our 150k sending limit for the month so this has really put a hindrance on our domain name.

How do we clear the cron or backlog of e-mails? Our forum is still trying to send e-mails every second, whoever hijacked this must have injected hundreds of thousands. This is a pretty serious issue for us so if anyone can help us out please advise.

[Eudemon]

check and make sure share via email is disabled, attackers use this and then modify the content and title

I got burned after spammer used this 'feature' to sent one million emails, I wish IPS is more open communicating potential loopholes with its customers, even the expired ones

 

with that said, you may try running sql to clear the backlog in your db

[Stuart Silvester]

8 hours ago, Eudemon said:

I wish IPS is more open communicating potential loopholes with its customers, even the expired ones

We currently have this message showing regardless of license status for communities that may be affected (it looks like the OP's screenshot was taken after the patch was applied, so it wasn't visible).. 

 

8 hours ago, Nicholas Hadjiev said:

How do we clear the cron or backlog of e-mails? Our forum is still trying to send e-mails every second, whoever hijacked this must have injected hundreds of thousands. This is a pretty serious issue for us so if anyone can help us out please advise.

This isn't a 'backlog' as such, it's an error log showing emails that have failed to send.. These emails will not be sent unless you manually click the resend button on the right. The error log records are pruned after a period of time (30 days by default). You can safely leave those record if you wish and they will remove themselves.