TOPIC:

Our District 9 director was phished. seems the email went out to members of the district..
She is asking me to look into how to avoid future phishing problems

She said other districts (7 that she knew of) had had the same problem.. And leaders she talked with suggested we update our website to 'hide' any emails.. and to add captcha to any forms..
I'm not sure how to actually "HIDE' an email.. nor have I ever added captcha to anything.. so I need some guidance as to go ahead from here to do what my District director wants me to do.
Thanks
Admin - District 9 website
tmd9.org
Darlene Marquardt

1) what email address was the email sent to?
2) any external emails that are forwarded have a link to block the sender, did they click the link and declare the sender as spam?
3) If you have posted the DD email on any web page that is public then you have made to email public to all spammers.
4) What forms are you referring to?

PLEASE BE SPECIFIC when reporting issues we cannot work with generalities.

1. The email was sent TO the members of district 9. I got one (which I immediately deleted because I recognized it as phishing. My husband got one and as far as I know, so did the other members of the district..
2. Should we be advising our members to mark emails like that as SPAM? I didn't think to do that, I just deleted mine.
3. That's what I was asking HOW to do.. if we post things and the DD needs folks to email her (or any other leader whose email we need to post).. HOW do we post the email so it is hidden and spammers CAN'T find it or see it but the folks who need to respond to the email CAN .???? That is what I am asking.. sorry I didn't make that clear.
4. I was unsure what forms I was referring to also.. I think the only forms we have are on the 'contact us' page or on any google forms we might possible have for signing up for events or surveys or what have you and technically those would be coming from google, not FTH, even though they are accessed on FTH.
I mentioned it because that was the suggestion for us to add the captcha..
Are we the only district that has come to support about this issue?
I apologize if you thought I was being too vague.. I was describing the problem as I understood it.
Thank you

1) Again specifics please what email address was it sent to and from. The full internet email header would be best.

2) DUH !

3) If you post it in public then they have to live with spam, it is part of being on the net.

4) You will need to be specific, again was it a contact form or contact email sent to the contact email address. the email header would help here.

1. header
from: Debra Kroon <This email address is being protected from spambots. You need JavaScript enabled to view it.>
to: "This email address is being protected from spambots. You need JavaScript enabled to view it." <This email address is being protected from spambots. You need JavaScript enabled to view it.>
date: Nov 13, 2020, 3:45 AM
subject: Toastmasters Club District #9
security: Standard encryption (TLS) Learn more
: Important according to Google magic

Hello Darlene
Are you available to assist? I am quite unavailable now and I've got credence in you to take care of this. I would have called your phone but I presently do not have access to my mobile phone.
Toastmasters Club District #9 needs some gift cards for donation to Veterans at Hospice and Palliative care units for preventive items from Corona Disease (COVID-19). I am liable for reimbursement. Need more info?

Debra Kroon, DTM
District Director #9
Toastmasters Club
www.tmd9.org

THIS WASN'T JUST SENT TO ME.. THIS IS THE HEADER AND BODY OF THE EMAIL THAT I GOT.. IT CAME FROM THE SAME EMAIL TO ALL THE MEMBERS OF THE DISTRICT.
2. and 3. no longer relevant to this request
4. we didn't have a problem with forms.. that was just what some other district leaders told Debra (our DD).. I was inquiring how to prevent any problems with ANY forms. in the future. not a SPECIFIC form...

That is not the full email header. for gmail to see the full email header look at this
www.lifewire.com/how-to-see-full-email-headers-in-gmail-1171960

Delivered-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Received: by 2002:a1c:b484:0:0:0:0:0 with SMTP id d126csp1532524wmf;
Fri, 13 Nov 2020 03:45:35 -0800 (PST)
X-Google-Smtp-Source: ABdhPJxWj2sOVxVkW4oGYjmaSy0+n8JzGg66NKx6mTZqZODsgH2ACDbdAvJLOBSVX0/CyHMNhxDa
X-Received: by 2002:a92:cd0a:: with SMTP id z10mr1552325iln.74.1605267935330;
Fri, 13 Nov 2020 03:45:35 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1605267935; cv=none;
d=google.com; s=arc-20160816;
b=DwH9INViRtNJoGx7HCM1EoOHUbq5o4WWWtb19WO7uPpuKxTcZoEr2sg/1MOxJgApwe
QGkotA0NnoM0YSWruAHmCK/tuI2n3i/fRGC/v98YIc48MpAx6/+OLJrYCf6OcWljV7ox
DGs4xadaJo/SJDD8x2FZYOFHxHJe7oW8Nr2uPLIgMo++uGhH/x5ag9f7MYHFLRs6bU6C
CekyfNw29b6yHKRdu87lmFll4bAm543bPDc6optWj7Buf6yJyekNixClUdJVq0lQpiz0
abInhrtef20dpacdr7zc90DoBEcoivO49PHlug3KLLnawgY+DdnFKA2KFabNP2YpNdpl
RofA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=importance:content-transfer-encoding:mime-version:subject
:message-id:to:from:date;
bh=8rb84zcMk74F0MjzzevKTS82N6VjPsHU9s9czTtDo7o=;
b=AviNvFkk8DUoxEpPxf/m01JC8q1+xTQfBiZnGx3xkhc2WDBZ+CxJqIiQuDCwqLjf7h
HnpjFf8dkpwXbaiZaydqTBLFUzJo2kPBLH8ER/9KRJNXCUVOFLOBqQoPAs5teZO78096
uc0XiAzWE+ZPSPGxxHonyyzDUK9+8my/46Jmc+NvKz5NABsWS5KcGpzvejdqQa1LZ4x4
F3iKr44D45pXd/ha5i+8KtueHM0B0kPYjegAzYxdrOe+tQFpLDeLYQUQSUjUr0wPtR9K
fBDK1ZOwo1/xyZe6vsdCEs0Glyve9JkSRlgr0u9r53C4thjd+1ooGhdbX9p1GIT25sLA
C6Jw==
ARC-Authentication-Results: i=1; mx.google.com;
spf=neutral (google.com: 74.208.4.197 is neither permitted nor denied by best guess record for domain of This email address is being protected from spambots. You need JavaScript enabled to view it.) smtp.mailfrom=director@adminalss.net
Return-Path: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Received: from mout.perfora.net (mout.perfora.net. [74.208.4.197])
by mx.google.com with ESMTPS id e66si5423390ill.155.2020.11.13.03.45.34
for <This email address is being protected from spambots. You need JavaScript enabled to view it.>
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Fri, 13 Nov 2020 03:45:35 -0800 (PST)
Received-SPF: neutral (google.com: 74.208.4.197 is neither permitted nor denied by best guess record for domain of This email address is being protected from spambots. You need JavaScript enabled to view it.) client-ip=74.208.4.197;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 74.208.4.197 is neither permitted nor denied by best guess record for domain of This email address is being protected from spambots. You need JavaScript enabled to view it.) smtp.mailfrom=director@adminalss.net
Received: from oxuslxaltgw11.schlund.de ([10.72.76.67]) by mrelay.perfora.net (mreueus002 [74.208.5.2]) with ESMTPSA (Nemesis) id 0MOxjF-1kgYJt1DWh-006NyS for <This email address is being protected from spambots. You need JavaScript enabled to view it.>; Fri, 13 Nov 2020 12:45:34 +0100
Date: Fri, 13 Nov 2020 06:45:33 -0500 (EST)
From: Debra Kroon <This email address is being protected from spambots. You need JavaScript enabled to view it.>
To: "This email address is being protected from spambots. You need JavaScript enabled to view it." <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Message-ID: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Subject: Toastmasters Club District #9
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Priority: 3
Importance: Normal
X-Mailer: Open-Xchange Mailer v7.10.3-Rev26
X-Originating-Client: open-xchange-appsuite
X-Provags-ID: V03:K1:HevDezhD9fYi2O9AvgPk9uG0hki5t5EKD8r66KySytaNffsLJK6 RVg3f/3oPmbiBBC/ZPBPDG/FGANgz2myVLSFzI9Yjpjj5ZhjXXz7TBTlqNL4qAg4109frmz 4RUG+kMF8V7xTPVdNKqEyV4wNXLhW/pZoeitzrXMULVOlPMlusoPyUWjMUCrp2Js0BQxRsY IKk7YsS7KZbubQjZqsOXQ==
X-Spam-Flag: NO
X-UI-Out-Filterresults: notjunk:1;V03:K0:OyFFkz2gDfg=:W7aFRe/LAq36N1FO7Sv0QB 4t+HVIZokZtjsdxiuKsuP+AfJKydosysQCezUKBHcQgMmN8aHzbTxYdSC0LKDMd5d8m4L97aV 7oyjSwl4VTkRdmywkVkL0G1JZCOW5+C1TKmlqp4oAT5zonvj8bqcJ/knis0CPHvdUtUEXgm94 /5oRplGegQrg9i+AO0mMAp+fKWhZlM6RNClZKhTZ79nyNXgMeVU4aqm5jCLLHSq8845sQhxrw XqfPyb8w7xNmvSqvb0tAbps0ohLNIoKojb1+dVUMPdzmoNsKYTJ39XHz/T853ZDUbGUVmuJdn HZUDjWjNqteQCAkYL9P19Iv18Xq0GmTThABVx82xS8Xv40VZDibpRUoxnPxg7fzoNDsOKpDPO f2XZJgl+v8TjtuqY5tN4il0VEHadnGX22OfIfcjUUBKjDva2RsP7U/WavSLqyPb9bvhmh+hPI CXxXdTJD7A==

<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div class="default-style">
<div class="default-style">
<div class="default-style">
Hello Darlene
<br>Are you available to assist? I am quite unavailable now and I've got credence in you to take care of this. I would have called your phone but I presently do not have access to my mobile phone.
<br>Toastmasters Club District #9 needs some gift cards for donation to Veterans at Hospice and Palliative care units for preventive items from Corona Disease (COVID-19). I am liable for reimbursement. Need more info?
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
<strong>Debra Kroon</strong>, DTM
<br><span style="color: #333399;">District Director #9</span>
<br><span style="color: #333399;">Toastmasters Club</span>
<br><span style="color: #333399;">www.tmd9.org
</div>
</div>
</div>
</body>
</html>

As you can see in the internet email header this email NEVER was touched by the FTH servers. You were spammed directly.