Forum Replies Created

Viewing 4 replies - 1 through 4 (of 4 total)
  • thanks a lot, i have already done this … works perfectly. the requests still hit my server but no more spam mails in the queue … unfortunately i can’t do a tcpdump because i do not have the permission at my server … otherwise i could look into the network traffic to see what the guys are posting.
    Actually there are mostly 4 hits per IP-address:

    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.228.131.135 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.228.131.135 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.247.85 - - [05/Nov/2016:13:35:16 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.247.85 - - [05/Nov/2016:13:35:16 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    

    read your Message at the other thread … yes, i have already included a Captcha …
    The problem ist, that i can’t do a tcpdump because of missing permissions …
    Otherwise i could check the content of the requests …

    Mostly there are 4 Hits from one IP-Address … I still get about 100 – 200 hits per minute …

    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.168.28 - - [05/Nov/2016:13:35:10 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.171.165 - - [05/Nov/2016:13:35:14 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.228.131.135 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.228.131.135 - - [05/Nov/2016:13:35:15 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.184.13.47 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.213.251.246 - - [05/Nov/2016:13:35:15 +0100] "GET /informationen/karte/?shared=email&msg=fail HTTP/1.1" 200 34209 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.247.85 - - [05/Nov/2016:13:35:16 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.247.85 - - [05/Nov/2016:13:35:16 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 302 336 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"

    i have the same problem … posted it here:
    https://wordpress.org/support/topic/jetpack-hacked/#post-8398136

    sorry

    Sorry to post to this „old“ thread but i have some similar problems i guess. My Mailqueue has hundreds of mails, trying to send to domains like @qq.om or @pp.cm. did malware-scans, research for infections, run iThemes Security and Wordfence tests. After a long time of frickeling around i had a look into my access.log of the web server (haven’t done this earlier because i thought it was a mail problem) and found nearly 300 loggings in 2 minutes of this:

    103.214.169.108 - - [04/Nov/2016:23:59:58 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 200 31895 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    103.214.169.108 - - [04/Nov/2016:23:59:58 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 200 31895 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.247.85 - - [04/Nov/2016:23:59:58 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 200 31895 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.247.85 - - [04/Nov/2016:23:59:58 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 200 31895 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.180.73 - - [04/Nov/2016:23:59:58 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 200 31895 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    118.193.180.73 - - [04/Nov/2016:23:59:58 +0100] "POST /informationen/karte/?share=email&nb=1 HTTP/1.1" 200 31895 "http://www.fuenfseenland.de/informationen/karte/?share=email&nb=1" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
    
    

    which brought me to the idea to disable Jetpack-Plugin and from this minute, the loggings and the spam-sending from my server stops.

    sounds similar?

    i have to try to reactivate the plugin these days and see if spam-sending starts again …
    anyone an idea?
    thanks for any help or questions …

Viewing 4 replies - 1 through 4 (of 4 total)