Password Reset Emails – Spam or Hack?

spam

Our editors just got several of these emails. The return address is [email protected], and there is an X-PHP-Script header: https://www.plus.org.au/news/wp-login.php for 88.99.89.225.

Since the links in the emails appear to be to our own site, it would seem that the aim is for a recipient to reply to the sender.

I wonder, however, how they got our email addresses and usernames.

I have received hundreds of these spam password reset emails the past two weeks. Just as @clareswindlehurst said, the subject line includes my site name, and the username in the email is mine, but the domain is not. This weekend alone I received 54 of these emails. Is there any way to stop this? Other members of my team are receiving them as well, and it’s really disruptive and cluttering up our inboxes.

Here are some of the domains listed in the emails (none of which I’ve heard of before now):

https://longrun.com/blog/
https://mybiznetsite.com/blog/
https://www.plus.org.au/blog/

The Wordfence security plugin: The option “Prevent discovery of usernames through ‘/?author=N’ scans, the oEmbed API, and the WordPress REST API” appears to have stopped them. https://docs.wordfence.com/en/Wordfence_options#Prevent_discovery_of_usernames_through_.27.3F.2Fauthor.3DN.27_scans

Thanks, I’ll give that a try!