A phishing scam attack (phishing) on ​​your network
 

<a href="http://www.efsaneclub.com" target="_blank">www.efsaneclub.com</a> We have detected a phishing attack on your network:

hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8b solution

no responders i guess vbulletin forums are now slowly being discontinued

You haven't given us enough information to know what you're talking about.

Who is the "we" who have detected a phishing attack on your network?

Does that file exist on your server? If so, delete it.

Hosting company that received such a mail
How do I delete this phishing.

Hello,

We have detected a phishing attack on your network:
hxxps: // legend [.] com / grt / Excel / Excel / login.php? email = &. rand = 13vqcr8bp0gklhiluhkjbvvghghjbud & lc = 1033 & id = 64835456135515 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.27]
hxxps: // legend [.] com / grt / Excel / Excel / index.php [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / wait.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813 emailboxLight99642_Product-email
hxxps: // legend [.] com / grt / Excel / remove.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / wait.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email]
hxxps: // legeneclub [.] com / grt / Excel / error.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / login.php? l = _JeHFUq_VJOXK0QWHtoGYDw1774256418 & fid.13InboxLight.aspxn.1774256418 & fid.125289964252813InboxLight99642_Product-email [94t-email]
hxxps: // legend [.] com / grt / Excel / page.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / remove.php? email = &. rand = 13vqcr8bp0gklhiluhkjbvvghghjbud & lc = 1033 & id = 64835456135515 & mkt = en-us & cbcxt = mai & snsc = 1 '% 20% 3E [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / error.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]
hxxps: // legend [.] com / grt / Excel / Excel / page.php? email = &. rand = 13vqcr8bp0gud & lc = 1033 & id = 64855 & mkt = en-us & cbcxt = mai & snsc = 1 [94.199.200.27]

Best regards

If it were me I would replace all of the files on my server with new ones.

You should also change your cPanel or Plesk password.

That could be from a modification or from a core security issue but there's no way of knowing.

There haven't been any reported vBulletin 4 security issues in quite some time so my guess is it's from a modification you either currently have or used to have.

How can I change all the files on the server, dear teacher?

--------------- Added [DATE]1600877678[/DATE] at [TIME]1600877678[/TIME] ---------------

Hi
Changing all the files on the server and making the forum from scratch is a lot better than closing it now that this happens. Thank you very much for your help.

Will anyone solve this problem and clean and install this form in return for the fee?

Solutions that come to my mind.

1. As it says phishing on login, it must be a malicious plugin associated with login.
2. The queue email sends 500 simultaneously, which most web hosts will perceive as an attack from your site.
3. I would delete all the products one by one with the files on FTP.
4. I would download the vBulletin compatible version and make an update.

I wonder if there is anyone who can do this problem without any problems in return for a fee.

I sent a private message.