vBulletin Mods

The Official vBulletin Modifications Site
https://www.vbulletin.org/forum/showthread.php?t=328237

A phishing scam attack (phishing) on ​​your network
by efsaneclub00
20 Sep 2020 20:11

www.efsaneclub.com We have detected a phishing attack on your network:

hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8b solution

efsaneclub00 22 Sep 2020 07:05

no responders i guess vbulletin forums are now slowly being discontinued

In Omnibus 22 Sep 2020 12:39

You haven't given us enough information to know what you're talking about.

Who is the "we" who have detected a phishing attack on your network?

Does that file exist on your server? If so, delete it.

efsaneclub00 22 Sep 2020 18:46

Quote:

Originally Posted by In Omnibus (Post 2604011)
You haven't given us enough information to know what you're talking about.

Who is the "we" who have detected a phishing attack on your network?

Does that file exist on your server? If so, delete it.




Hosting company that received such a mail
How do I delete this phishing.

Hello,

We have detected a phishing attack on your network:
hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8bp0gklhiluhkjbvvghghjbud & lc = 1033 & id = 64835456135515 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.27]
hxxps: // legend [.] com / grt / Excel / Excel / index.php [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / wait.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813 emailboxLight99642_Product-email
hxxps: // legend [.] com / grt / Excel / remove.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / wait.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email]
hxxps: // legeneclub [.] com / grt / Excel / error.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / login.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / page.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / remove.php? email = &. rand = 13vqcr8bp0gklhiluhkjbvvghghjbud & lc = 1033 & id = 64835456135515 & mkt = en-us & cbcxt = mai & snsc = 1 '% 20% 3E [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / error.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / page.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]

Best regards

In Omnibus 22 Sep 2020 22:10

If it were me I would replace all of the files on my server with new ones.

You should also change your cPanel or Plesk password.

That could be from a modification or from a core security issue but there's no way of knowing.

There haven't been any reported vBulletin 4 security issues in quite some time so my guess is it's from a modification you either currently have or used to have.

efsaneclub00 23 Sep 2020 06:31

Quote:

Originally Posted by In Omnibus (Post 2604016)
If it were me I would replace all of the files on my server with new ones.

You should also change your cPanel or Plesk password.

That could be from a modification or from a core security issue but there's no way of knowing.

There haven't been any reported vBulletin 4 security issues in quite some time so my guess is it's from a modification you either currently have or used to have.



How can I change all the files on the server, dear teacher?

--------------- Added 23 Sep 2020 at 17:14 ---------------

Hi
Changing all the files on the server and making the forum from scratch is a lot better than closing it now that this happens. Thank you very much for your help.

efsaneclub00 01 Nov 2020 15:08

Will anyone solve this problem and clean and install this form in return for the fee?

yilmaz 02 Nov 2020 15:04

Quote:

Originally Posted by efsaneclub00 (Post 2604488)
Will anyone solve this problem and clean and install this form in return for the fee?

Solutions that come to my mind.

1. As it says phishing on login, it must be a malicious plugin associated with login.
2. The queue email sends 500 simultaneously, which most web hosts will perceive as an attack from your site.
3. I would delete all the products one by one with the files on FTP.
4. I would download the vBulletin compatible version and make an update.

Quote:

Aklıma gelen çözümler.

1. Girişte kimlik avı dediğine göre, giriş ile alakalı kötü amaçlı bir eklenti olmalı.
2. Kuyruk email aynı anda 500 gönderiri, bunu çoğu web host sağalyıcı sitenizden saldırı olarak algılar.
3. Tüm ürünlerii tek tek FTP'de olan dosyaları ile bereber silerdim.
4. vBulletin uyumlu sürümünü indirir bir güncelleme yapardım.


efsaneclub00 09 Nov 2020 18:05

I wonder if there is anyone who can do this problem without any problems in return for a fee.

yilmaz 09 Nov 2020 18:43

Quote:

Originally Posted by efsaneclub00 (Post 2604605)
I wonder if there is anyone who can do this problem without any problems in return for a fee.

I sent a private message.

Zighinno 17 Nov 2020 22:26

Quote:

Originally Posted by efsaneclub00 (Post 2604008)
www.efsaneclub.com We have detected a phishing attack on your network:

hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8b solution

Hi, I have the same problem as you, have you solved it? Thanks


All times are GMT. The time now is 11:36.

Powered by vBulletin® Version 3.8.14
Copyright © 2020, MH Sub I, LLC dba vBulletin. All Rights Reserved. vBulletin® is a registered trademark of MH Sub I, LLC
Copyright ©2001 - , vbulletin.org. All rights reserved.