TOPIC:

Seeing some recent new spam and phishing attacks. Probably no coincidence that it coincides w/ the start of the new officer year, when people are just getting up to speed in their new roles.

Please tell your club members/district leaders to be careful about unexpected emails, even those from people that they know. Be a bit suspicious--if you are uncertain, a reply can wait.

Some of what we are seeing is involving forging member email addresses and names into spam and phishing emails which has fooled our email security logic, in some cases. Some of them are sophisticated enough that in the past they have thwarted the logic that determines what email address that clicking the "Is this SPAM?" links add to club black lists. I have made updates to that logic, but the spammers are smart, too... Every time I make an update, they try a different approach to try to fool users of the FreeToastHost system and the code logic.

If you are uncertain about a particular email, please contact us via the forums. We will likely want to see the raw email w/ the "email headers"--don't worry if you don't know how to get that. We can coach you through it. When you provide this, it also helps us know when we need to improve our email security logic. (It helps us, also, which benefits all other users of the system.)

Valencia's president got this spam email on July 8, before the one that started this thread. Header attached. It is a company selling SEO services. Our domain doesn't expire until '24.

Which club are you reporting this problem for?

First word: Valencia

Are you referring to the email she received on July 8, 2017 from This email address is being protected from spambots. You need JavaScript enabled to view it.

we need to see if there is any way to trap the email.

Until then use your clubs black list to block the email address.

This is not philshing although it is spam. It is a valid email and this is an actual company. They get the information from the domain registration.

The only way stop this is to use private domain registration where the email and Registrants name and contact information is hidden. Of course this costs money.

Your President will receive all these sorts of emails because the presidents email is on the domain registration.

Domain:               valenciatoastmasters.com
Registrant EMail:     This email address is being protected from spambots. You need JavaScript enabled to view it.
Expiration:           22.07.2017

Marc,

What I recommend that you do is to set up a free email account and enter that into the admin console as your club archive account.

This account can then also be used for these sorts of external registrations. If you get an account that supports rules (like gmail), then you can selectively forward emails that you actually want forwarded to your club president or whoever. (like emails coming from your domain registrar) Otherwise, the emails like this just land in the archive account.

This is what our domain shows now: whois.icann.org/en/lookup?name=valenciatoastmasters.com.

The VPM of Quest 4643 received a scam email on 7/26 and just now got the header to me. I've also got a screenshot of what she got (obscured by what she thought I meant by header).

Sender: in the raw email and the Reply-To are the same address ... blacklist that address.

Will do. Is it This email address is being protected from spambots. You need JavaScript enabled to view it.?

P. S. I got an email from this forum that said, "There should be an Is this SPAM link in that email (scroll down). Just tell your VPM to click that link and it will be handled.." But that is not in this thread! AND I didn't get the blacklist post. They have the same post #. Did you edit what you posted, hence the discrepancy?

marc33 wrote:

Will do. Is it This email address is being protected from spambots. You need JavaScript enabled to view it.?

P. S. I got an email from this forum that said, "There should be an Is this SPAM link in that email (scroll down). Just tell your VPM to click that link and it will be handled.." But that is not in this thread! AND I didn't get the blacklist post. They have the same post #. Did you edit what you posted, hence the discrepancy?

yes and yes I edited.