Nihon Jimuki: the contact form of its service site was abused to send 483 spam emails

1. 2021-02-21

   In two bursts, early morning and evening, the contact form was abused to send 483 spam emails the company did not intend. It noticed because of a flood of form notifications containing suspicious URLs. [1]

2. 2021-03-18

   The company announced the case. It added reCAPTCHA and similar checks and changed the auto-reply so it no longer includes free-text fields. [1]

The form sent an auto-reply to the email address entered. The attacker put the URL to lure people into the surname field and an unrelated recipient into the email field. The recipients had no dealings with the company, and nearly 90% were on Russian domains. [1]

The lure was a shortened URL that was already down when the company investigated. It asked anyone who received an unfamiliar reply from its domain to delete it without opening the URL. [1]