Hi, I'm an independent cybersecurity researcher I have found multiple issues on your website. Vulnerability: Missing SPF I am just looking at your SPF records then found the following. SPF Records missing safe checks which can allow me to send mail and phish easily any victim. PoC: <?php $to = "[email protected]"; $subject = "Password Change"; $txt = "Change your password by visiting here - [VIRUS LINK HERE]l"; $headers = "From: https://www.alidropstore.com/"; mail($to,$subject,$txt,$headers); ?> paste your result here SPF record lookup and validation for: ourproject.org SPF records are published in DNS as TXT records. The TXT records found for your domain are: v=spf1 mx ip4:168.119.136.67/32 ip4:159.69.75.86/32 ip4:159.69.75.87/32 ip4: 168.119.136.88/32 ip4:168.119.136.79/32 ip4:80.81.122.32/27 a: snowden.comunes.org a:snowden-02.comunes.org a:howard.comunes.org a: ada.comunes.org a:stallman.comunes.org a:rms.comunes.org a: selver.comunes.org a:ci.comunes.org a:mailhost.ourproject.org ~all google-site-verification=5X82i4YusPOi9SFgcLejX0p5zr-RVkAeMjIcKD6-11E keybase-site-verification=6IadbJzgiOL0KIQiLqw_1e9vPEVXhXiOE1PrikgmhgY Checking to see if there is a valid SPF record. DNS: Truncated UDP Reply, SPF records should fit in a UDP packet, retrying TCP Found v=spf1 record for ourproject.org: v=spf1 mx ip4:168.119.136.67/32 ip4:159.69.75.86/32 ip4:159.69.75.87/32 ip4: 168.119.136.88/32 ip4:168.119.136.79/32 ip4:80.81.122.32/27 a: snowden.comunes.org a:snowden-02.comunes.org a:howard.comunes.org a: ada.comunes.org a:stallman.comunes.org a:rms.comunes.org a: selver.comunes.org a:ci.comunes.org a:mailhost.ourproject.org ~all evaluating... SPF record passed validation test with pySPF (Python SPF library)! Fix: paste your result here SPF record lookup and validation for: ourproject.org SPF records are published in DNS as TXT records. The TXT records found for your domain are: v=spf1 mx ip4:168.119.136.67/32 ip4:159.69.75.86/32 ip4:159.69.75.87/32 ip4: 168.119.136.88/32 ip4:168.119.136.79/32 ip4:80.81.122.32/27 a: snowden.comunes.org a:snowden-02.comunes.org a:howard.comunes.org a: ada.comunes.org a:stallman.comunes.org a:rms.comunes.org a: selver.comunes.org a:ci.comunes.org a:mailhost.ourproject.org -all google-site-verification=5X82i4YusPOi9SFgcLejX0p5zr-RVkAeMjIcKD6-11E keybase-site-verification=6IadbJzgiOL0KIQiLqw_1e9vPEVXhXiOE1PrikgmhgY Checking to see if there is a valid SPF record. DNS: Truncated UDP Reply, SPF records should fit in a UDP packet, retrying TCP Found v=spf1 record for ourproject.org: v=spf1 mx ip4:168.119.136.67/32 ip4:159.69.75.86/32 ip4:159.69.75.87/32 ip4: 168.119.136.88/32 ip4:168.119.136.79/32 ip4:80.81.122.32/27 a: snowden.comunes.org a:snowden-02.comunes.org a:howard.comunes.org a: ada.comunes.org a:stallman.comunes.org a:rms.comunes.org a: selver.comunes.org a:ci.comunes.org a:mailhost.ourproject.org -all evaluating... SPF record passed validation test with pySPF (Python SPF library)! You can refer this https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to... Let me know if any further info is required. Regards. Found More bugs on your website reply to me so that I may disclose them further and tell me the payout for these responsible vulnerability disclosures. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2> _______________________________________________ Bah-general mailing list [email protected] https://lists.ourproject.org/cgi-bin/mailman/listinfo/bah-general