Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 20 Sep 2020, 20:11
efsaneclub00 efsaneclub00 is offline
 
Join Date: Oct 2018
A phishing scam attack (phishing) on ​​your network

www.efsaneclub.com We have detected a phishing attack on your network:

hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8b solution
Reply With Quote
  #2  
Old 22 Sep 2020, 07:05
efsaneclub00 efsaneclub00 is offline
 
Join Date: Oct 2018
no responders i guess vbulletin forums are now slowly being discontinued
Reply With Quote
  #3  
Old 22 Sep 2020, 12:39
In Omnibus's Avatar
In Omnibus In Omnibus is offline
 
Join Date: Apr 2010
Real name: Kris
You haven't given us enough information to know what you're talking about.

Who is the "we" who have detected a phishing attack on your network?

Does that file exist on your server? If so, delete it.
Reply With Quote
  #4  
Old 22 Sep 2020, 18:46
efsaneclub00 efsaneclub00 is offline
 
Join Date: Oct 2018
Originally Posted by In Omnibus View Post
You haven't given us enough information to know what you're talking about.

Who is the "we" who have detected a phishing attack on your network?

Does that file exist on your server? If so, delete it.



Hosting company that received such a mail
How do I delete this phishing.

Hello,

We have detected a phishing attack on your network:
hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8bp0gklhiluhkjbvvghghjbud & lc = 1033 & id = 64835456135515 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.27]
hxxps: // legend [.] com / grt / Excel / Excel / index.php [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / wait.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813 emailboxLight99642_Product-email
hxxps: // legend [.] com / grt / Excel / remove.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / wait.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email]
hxxps: // legeneclub [.] com / grt / Excel / error.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / login.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / page.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / remove.php? email = &. rand = 13vqcr8bp0gklhiluhkjbvvghghjbud & lc = 1033 & id = 64835456135515 & mkt = en-us & cbcxt = mai & snsc = 1 '% 20% 3E [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / error.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / page.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]

Best regards
Reply With Quote
  #5  
Old 22 Sep 2020, 22:10
In Omnibus's Avatar
In Omnibus In Omnibus is offline
 
Join Date: Apr 2010
Real name: Kris
If it were me I would replace all of the files on my server with new ones.

You should also change your cPanel or Plesk password.

That could be from a modification or from a core security issue but there's no way of knowing.

There haven't been any reported vBulletin 4 security issues in quite some time so my guess is it's from a modification you either currently have or used to have.
Reply With Quote
  #6  
Old 23 Sep 2020, 06:31
efsaneclub00 efsaneclub00 is offline
 
Join Date: Oct 2018
Originally Posted by In Omnibus View Post
If it were me I would replace all of the files on my server with new ones.

You should also change your cPanel or Plesk password.

That could be from a modification or from a core security issue but there's no way of knowing.

There haven't been any reported vBulletin 4 security issues in quite some time so my guess is it's from a modification you either currently have or used to have.


How can I change all the files on the server, dear teacher?

--------------- Added 23 Sep 2020 at 17:14 ---------------

Hi
Changing all the files on the server and making the forum from scratch is a lot better than closing it now that this happens. Thank you very much for your help.
Reply With Quote
  #7  
Old 01 Nov 2020, 15:08
efsaneclub00 efsaneclub00 is offline
 
Join Date: Oct 2018
Will anyone solve this problem and clean and install this form in return for the fee?
Reply With Quote
  #8  
Old 02 Nov 2020, 15:04
yilmaz's Avatar
yilmaz yilmaz is online now
 
Join Date: Sep 2004
Originally Posted by efsaneclub00 View Post
Will anyone solve this problem and clean and install this form in return for the fee?
Solutions that come to my mind.

1. As it says phishing on login, it must be a malicious plugin associated with login.
2. The queue email sends 500 simultaneously, which most web hosts will perceive as an attack from your site.
3. I would delete all the products one by one with the files on FTP.
4. I would download the vBulletin compatible version and make an update.

Aklıma gelen çözümler.

1. Girişte kimlik avı dediğine göre, giriş ile alakalı kötü amaçlı bir eklenti olmalı.
2. Kuyruk email aynı anda 500 gönderiri, bunu çoğu web host sağalyıcı sitenizden saldırı olarak algılar.
3. Tüm ürünlerii tek tek FTP'de olan dosyaları ile bereber silerdim.
4. vBulletin uyumlu sürümünü indirir bir güncelleme yapardım.
Reply With Quote
  #9  
Old 09 Nov 2020, 18:05
efsaneclub00 efsaneclub00 is offline
 
Join Date: Oct 2018
I wonder if there is anyone who can do this problem without any problems in return for a fee.
Reply With Quote
  #10  
Old 09 Nov 2020, 18:43
yilmaz's Avatar
yilmaz yilmaz is online now
 
Join Date: Sep 2004
Originally Posted by efsaneclub00 View Post
I wonder if there is anyone who can do this problem without any problems in return for a fee.
I sent a private message.
Reply With Quote
  #11  
Old 17 Nov 2020, 22:26
Zighinno Zighinno is offline
 
Join Date: Jun 2007
Originally Posted by efsaneclub00 View Post
www.efsaneclub.com We have detected a phishing attack on your network:

hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8b solution
Hi, I have the same problem as you, have you solved it? Thanks
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 2 (0 members and 2 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 11:57.

Layout Options | Width: Wide Color: