Forums Hacked? Adult friend finder redirect...

[nomuken1]

Dear nomuken1,

Someone has tried to log into your account on Toymods Car Club with an incorrect password at least 5 times. This person has been prevented from attempting to login to your account for the next 15 minutes.

The person trying to log into your account had the following IP address: 88.150.136.178

All the best,
Toymods Car Club

[v6cosmo]

got the same message, someone has tried to login to to your account at least 5 times, using IP address 182.239.127.139

[trdee]

yeah there are a few things at the moment targeting forums everywhere. shit moves slowly in the world of toymods but it will get sorted soon hopefully

[trdee]

heads up the forums are about to go down whilst this problem is being worked on

[Lambolica]

OK All, the forums have been upgraded to the latest build of the software. in the short term the redirect part has been stopped, and the IT witchcraft people are locking down the backend based on the way the hack was inserted.

The people mentioning the password attempts is a related issue, there were things put in place that have been removed by accident, these will be reinstated.

Cheers
Simon

[cresslux]

good to hear, kinda awkward at work when i click a link, then it blocks the page and flags me for looking at adult content :\
i found right clicking and openeing the link manually worked fine.

[phwoar]

Dear nomuken1,

Someone has tried to log into your account on Toymods Car Club with an incorrect password at least 5 times. This person has been prevented from attempting to login to your account for the next 15 minutes.

The person trying to log into your account had the following IP address: 88.150.136.178

All the best,
Toymods Car Club

A quick "whois" query shows 88.150.136.178 belongs to:

IP Locator & IP Lookup Basic Tracking Info
IP Address: 88.150.136.178
Reverse DNS: 178.136.150.88.in-addr.arpa
Hostname: h88-150-136-178.host.redstation.co.uk
Nameservers:

ns1.redstation.com >> 77.245.79.70

ns2.redstation.com >> 77.245.75.26

IP Blacklist Check:
Suspicious, Comment Spammer
Level: 54
Activity: 1 days ago
[ Blacklist Check]

IP Lookup Location For IP Address: 88.150.136.178
Continent: Europe (EU)
Country: United Kingdom (GB)
Capital: London
State: Unknown
City Location: Unknown
ISP: Redstation Limited
Organization: Redstation Limited
AS Number: AS35662 Redstation Limited

Extra IP Lookup Finder Info for IP Address: 88.150.136.178
Continent Lat/Lon: 48.69083 / 9.1405
Country Lat/Lon: 54 / -4.5
City Lat/Lon: (51.5) / (-0.13)


I had a similar message from Toymods, this time the ip. address was 117.169.1.218

IP Locator & IP Lookup Basic Tracking Info
IP Address: 117.169.1.218
Reverse DNS: ** server can't find 218.1.169.117.in-addr.arpa: SERVFAIL
Hostname: 117.169.1.218

IP Blacklist Check:
Suspicious, Comment Spammer
Level: 29
Activity: 1 days ago
[ Blacklist Check]

IP Lookup Location For IP Address: 117.169.1.218
Continent: Asia (AS)
Country: China (CN)
Capital: Beijing
State: Jiangxi
City Location: Nanchang
ISP: China Mobile
Organization: Guangdong Mobile
AS Number: AS9808 Guangdong Mobile Communication Co.Ltd.

Time Zone: Asia/Shanghai
Local Time: 16:12:54
Timezone GMT offset: 28800
Sunrise / Sunset: 06:21 / 18:26

Extra IP Lookup Finder Info for IP Address: 117.169.1.218
Continent Lat/Lon: 29.8405 / 89.296
Country Lat/Lon: 35 / 105
City Lat/Lon: (28.55) / (115.9333)

It would seem that some ip. spoofing has been going on, I'm sure that two similar attacks would not happen from opposite ends of the world.
Don't use obvious passwords!

[madmont]

Adult friend finder still with us

[trdee]

this should be fixed now, thanks guys.

[Macka79]

Bad news fellas but Toymods is redirecting again

[Hiro]

Bad news fellas but Toymods is redirecting again

More details? Is it the just forums or the actual website (ie toymods.org.au)?

[Macka79]

The website bud.

[Hiro]

The website bud.

Yeah the website runs off a different software platform (Wordpress) to the forums (VBulletin), we think we've managed to fix the VBulletin part but the Wordpress section still throws up the occasional hack