Two members reported receiving Spam emails from Club Email Address

Hello,

Member's receiving spam emails from club email address was FIRST reported to me on July 9 2019 from a member - Rachel Claire. She said "she blocked whoever was doing it". I learnt on Admin console that Rachel had black listed email address: pace@bargainorbit.icu
SECOND report came today July 30th from member Madelyn Fleagle that she received some spams from club email address as well.

I have changed the Admin password today. I am attaching BOTH the screen shots from Rachel & Maddy.
Look forward to your suggestions / help to resolve this.

Thanks,
Mayur Shah
Mayurshah@motorola.com
1-847-848-3850
Premier Toastmasters Club: libertymoto.toastmastersclubs.org/
Club Number: 918568

What email address was the email addresses to?
Madeline is your IPP and we don't stop email going to the officer email addresses.
She needs to click the link in the bottom of email to block the email as spam.

Hi Brian,

It was addressed to the alias "ipp-918568@toastmastersclubs.org"
For reference, I have attached ONLY a part of the latest screen shot from Maddy due to the picture content.

We use alias for ALL our club officers that way their emails are NOT visible out on the club web site, and there is little maintenance when officers change.

Thanks,
Mayur Shah.

Unfortunately, the support forums attachments are not working correctly at the moment, so we did not get that.

When you use one of the publicly accessible email addresses such as an officer email address or the contact email address, you must keep in mind that you may increase your spam. This is *not* the fault of FreeToastHost, this is just a side effect of increasing your public exposure with those email addresses.

We certainly want you to get benefit from using those email addresses or we would not have them. However, if you are going to use them, then you should increase your understanding of how to manage your club blacklist and how our email security features work in the case of public email addresses.

1. For public email addresses, the code will optionally insert an "Is this SPAM?" link in the bottom of the email to simplify adding the email sender to the club spam blacklist. You have this option enabled. As FreeToastHost is an email forwarder, it may appear that the email originated from the FTH server, but keep in mind that the FTH server just forwarded the email from the original sender. This can be confusing if you do not know how to determine the original sender's email address... just click "Reply" to get the To address, but do not actually send the Reply. The "Is this SPAM?" links have some smarts built into them to determine this actual senders email address for you.

2. Keep in mind that you can add entire domains to your email blacklist by just prefixing them with a @ sign in the blacklist box in the Email and Contact Forms module.

3. I see that you are using the Crowd-Sourced Blacklist to benefit from what other clubs have determined... Good! If your club ever uses things like social media websites (w/ notifications to your club) or Paypal, or similar, you may need to put notification email addresses from those on the Exceptions list so that they are not blocked.

Steve,

Thanks for the explanations.
It helps me to answer the questions I receive from club members who ask "Is our Toastmasters club email hacked?"

Please see my additional questions below to help confirm my understanding:

1) By publicly accessible email address, you are referring to the use of alias ("ipp-918568@toastmastersclubs.org", etc.) for our officer's emails. Correct?

2) By blacklisting the domain you mean adding @ragefair.icu to the blacklist if Maddy received an email from "building@ragefair.icu". Correct?

3) I did NOT follow what you meant by crowd-sourced blacklist and the suggestions for social media websites. Can you please clarify it a little more?

Thanks,
Mayur Shah.

Please read the documentation on the Email security settings.
support.toastmastersclubs.org/doc/item/email-and-contact-forms