# Email issues - Spam

**URL:** <https://community.modx.com/t/email-issues-spam/6844>\
**Category:** Extras\
**Tags:** formit, pdotools\
**Created:** [July 3, 2023, 6:41pm UTC](https://community.modx.com/t/email-issues-spam/6844 "2023-07-03T18:41:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rachelmarama1](https://community.modx.com/letter_avatar_proxy/v4/letter/r/6bbea6/32.png) [@rachelmarama1](https://community.modx.com/u/rachelmarama1)\
**Post date:** [July 3, 2023, 6:41pm UTC](https://community.modx.com/t/email-issues-spam/6844/1 "2023-07-03T18:41:42Z")

</div>

I have received the following from my Host, and would like any tips on moving forward!  
I have requested access to or copies of the mail log.

We found that the `astrabridal.co.nz` container was being used to send spam as can be seen from the mail logs found in `/container/logs/rsyslog/mail.log`. To protect our SMTP server’s IP reputation, we disabled SMTP on the container so it won’t be able to send any more spam emails.

We had a look at the Apache access logs and found a lot of POST requests similar to these ones coming from various IP addresses:

```auto
64.140.148.2 - - [04/Jul/2023:04:00:12 +1200] "POST /assets/components/pdotools/connector.php HTTP/1.1" 200 1731 "https://www.astrabridal.co.nz/ab16/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5.1 Mobile/15E148 Safari/604.1"

```

We suspect that this end-point was being exploited so we would recommend reviewing if any changes such as updates are needed to shore this up. Once you feel confident that you have addressed the vulnerability, please let us know and we can re-enable SMTP on the container for you.

Mod 2.8.5 (Just upgraded from 2.8.4 right now)

This is a site that’s been in development / upgrades over the last 12 years. I haven’t attempted an upgrade to Modx 3 as I am having upgrade issues on other sites.

---

<div class="post-metadata">

**Author:** ![halftrainedharry](https://community.modx.com/user_avatar/community.modx.com/halftrainedharry/32/1063_2.png) [@halftrainedharry](https://community.modx.com/u/halftrainedharry)\
**Post date:** [July 3, 2023, 6:57pm UTC](https://community.modx.com/t/email-issues-spam/6844/2 "2023-07-03T18:57:38Z")

</div>

The file `/assets/components/pdotools/connector.php` is from the _pdoTools_ extra. (I think it’s used for _pdoPage_ to load more data via AJAX.)  
Is that extra up-to-date?

---

<div class="post-metadata">

**Author:** ![rachelmarama1](https://community.modx.com/letter_avatar_proxy/v4/letter/r/6bbea6/32.png) [@rachelmarama1](https://community.modx.com/u/rachelmarama1)\
**Post date:** [July 3, 2023, 7:12pm UTC](https://community.modx.com/t/email-issues-spam/6844/3 "2023-07-03T19:12:43Z")

</div>

Thanks. It wasn’t - I have just updated it and 3 or 4 extras that also have updates.

---

<div class="post-metadata">

**Author:** ![rachelmarama1](https://community.modx.com/letter_avatar_proxy/v4/letter/r/6bbea6/32.png) [@rachelmarama1](https://community.modx.com/u/rachelmarama1)\
**Post date:** [July 4, 2023, 11:43pm UTC](https://community.modx.com/t/email-issues-spam/6844/4 "2023-07-04T23:43:17Z")

</div>

I managed to get into the logs, and it was a completely diferent issue, on another page. I had a send to a friend form with FormIt that was being accessed. Still not sure HOW, but have deleted the form as it was barely used, which has solved the issue for now.