Cleantalk Plugin Itself Creating SPAM

Resolved tosten
(@tosten)

10 months, 3 weeks ago

Cleantalk itself appears to be creating SPAM requests via some backdoor. You can see the link above as well as if you look at the records for haudenschildagency.com you will see all the requests. The plugin is up-to-date and it is not using our forms, but sending them some other way. Please look at our dashboard / cleantalk records for this domain. Unfortuanately, several otherr domains are also generating the same type of requests.

The page I need help with: [log in to see the link]

Viewing 6 replies - 1 through 6 (of 6 total)

Thread Starter tosten
(@tosten)

10 months, 3 weeks ago

Here are some records and how the IPs are requesting them:

98.225.46.130 – 23d9efe9e8b79616626cdeb73d2f624a [24/Jun/2025:17:16:27 +0000] “GET /wp-content/plugins/cleantalk-spam-protect/css/cleantalk-public.min.css?ver=6.58.1_1750425225 HTTP/1.1” 200 3789 “https://haudenschildagency.com/business/BotDetectCaptcha.ashx?get=sound&c=c_cmodule_cph_main_capver&t=6f7aa3ed643a448b8a82b03a6ed86306&s=pFarnmP69fuREE2x2cp//dR6gBz9dwjd0sQ2Jrip6weunV6zvoJyCYjirVfKEfWNeLwXDD3dlF8y1jV2iE2pjQ==” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36” 98.225.46.130 – 4e4003d2c34e074789af941bc16e49c4 [24/Jun/2025:17:16:27 +0000] “GET /wp-content/plugins/cleantalk-spam-protect/js/apbct-public-bundle_comm-func.min.js?ver=6.58.1_1750425225 HTTP/1.1” 200 71304 “https://haudenschildagency.com/business/BotDetectCaptcha.ashx?get=sound&c=c_cmodule_cph_main_capver&t=6f7aa3ed643a448b8a82b03a6ed86306&s=pFarnmP69fuREE2x2cp//dR6gBz9dwjd0sQ2Jrip6weunV6zvoJyCYjirVfKEfWNeLwXDD3dlF8y1jV2iE2pjQ==” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36”

SergeM
(@serge00)

10 months, 3 weeks ago

Hello @tosten,

Thank you for your feedback. We will analyze these requests and inform you of our findings as soon as possible. It may take up to 3 business days, please wait.

Plugin Support dimitrycleantalk
(@dimitrycleantalk)

10 months, 3 weeks ago

Hello @tosten,

Thank you for waiting.

Our developer checked these logs and they do not belong to us. Also, BotDetectCaptcha.ashx is an old CAPTCHA component from Captcha.com. We don’t own it. Also, the specified IP 98.225.46.130 does not belong to us. Our IPs are here: https://cleantalk.org/help/cleantalk-servers-ip-addresses

Most likely it’s just a bot that loads all the scripts on your site.

Did it help you?

Thread Starter tosten
(@tosten)

10 months, 3 weeks ago

Cleantalk is approving these sends. Is there a way to have your plugin see these and stop them? They’re clearly nonsense emails being sent but not from our forms, looks like maybe WordPress itself.

Thread Starter tosten
(@tosten)

10 months, 3 weeks ago

I think I’ve actually found it based on your help. Looks like there were some old theme files that were not deleted when we deleted the theme in WordPress. I’ve accesssed them though PHPMyAdmin and deleted them. I’ll reach back out if I need anything, but certainly appreciate your assistance. Especially since in the end it wasn’t your fault! Thank you!

Plugin Support eugenecleantalk
(@eugenecleantalk)

10 months, 3 weeks ago

Glad you found out the cause and the issue has been resolved.

We will be pleased if you share your opinion about our service on the WordPress forum: https://wordpress.org/support/plugin/cleantalk-spam-protect/reviews/

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Cleantalk Plugin Itself Creating SPAM’ is closed to new replies.