Funabashi City: the auto-reply of its contact form was abused to send about 120,000 spam emails

1. 2020-05-21 02:42

   From about this time, the city site began sending large numbers of unintended emails. [2]

2. 2020-05-21 08:50

   The contractor running the site's content system alerted the city. Sending mostly stopped around 9:30 a.m. but continued on and off until 6 p.m. The city issued a warning and blocked the source IP addresses. [1] [2]

The form was used from five Russian IP addresses, and 121,067 emails were sent. Their shortened URL, in Russian, promised a compensation payout. No data leak was found. Because the city was flagged as a spam source, some of its genuine emails were filtered as spam. [2]

The name field was removed from replies, and the auto-reply was then turned off. [2]