12 replies to this topic

[jahloon]

Hi all,

We are getting an increasing number of HSBC phishing sites dropped onto the forum on a daily basis

It appears we may have a rogue member doing this.

We have no option but to start pruning members we don't know and we truly apologise if we have pruned the innocent.

Members may also want to change their passwords so they are not personally compromised.

I've already been asked to shut down the board, I don't want to do this, hence the above action.

Best,

J

[gazmungus]

So hang on, I get what's going on now maybe???

Someone's hacked the site, and stuffed the .html page on the unfretted server which is linked to from those bloody "log in" and sort out due payments emails - of which I get from paypal posers on an almost weekly basis....?

bastards.

May they have their members pruned in unfathomably horrible wayz...

[rob]

Are they dropping pages on the forum through posts? Or, are the pages being generated by the PHP?

I haven't seen any pages in the forums, so I'm confused.

[jahloon]

Are they dropping pages on the forum through posts? Or, are the pages being generated by the PHP?

I haven't seen any pages in the forums, so I'm confused.

No, you won't ever see them.

They are dropped onto either the upload folder or the skin-cache folders, so we never see them. But of course other people are directed to them.

I get e-mails telling me the site is hosting phishing pages.

I've got the ftp access bolted down tighter than a duck's arse, so its either a PHP pseudo member scam (90% favourite) or its server side with the provider.

---

Oh, Gazzer, its a rub down with a damp copy of the TV Times for you, dear boy.

[rob]

OK. This is similar to what happened on our sites. The initial hit was from FTP. But, after that, they were using PHP files that were put in place during the FTP attack. I went through all of our sites finding all of the php and getting rid of the 20 or 30 files that they had left behind that could be used to load their phishing attack. I had to shut off allowing PHP to write files to disk too. We haven't had a problem since then.

It sounds like clearing out the not used accounts is a good idea.

[jahloon]

Aha, so this is why I can't register. I only get the error msg "[#10123] The administrator is currently not accepting new membership registrations." We had a similar issue at the Mobius forum, http://www.circularl...rums/index.php. This turned out the admin had to ask people email him directly asking for being included as members.

Hi Per,

Just email me the user name, password and forum name that you want to use and we will sign you up. admin@unfretted.com

Has that purple HG arrived yet?

Jah

[Per Boysen]

Has that purple HG arrived yet?

Thanks, Jah. Oh I wish it had but it won't be here until early May.

[jahloon]

I emailed about getting an account, the registration is still locked. Never got a reply...

Hi Jaydn,

Sorry if I missed your email, I do try and enroll anyone that sends in a request, plus I always reply to let them know they are in.

Send me a login name, password and a forum name to admin@unfretted.com and I'll sort it as soon as possible.

Jah

[jahloon]

Thanks so much!

Not received an e-mail from you, unless its lost somewhere, waiting to here from you....

[jahloon]

Sorry guys, had to close down guest posting - Spam was a nightmare.

Tried opening member registration again - 18 Spam applications in one day, all answering the challenge question and Captcha security correctly!

So had to close registration again.

Still accepting e-mail registration via the contact on the Unfretted site.