• 1

Read this first!

We do not monitor these forums. The forum is provided to exchange information and experience with other users ONLY. Forum responses are not guaranteed.

However, please submit a ticket if you have an active subscription and wish to receive support. Our ticketing system is the only way of getting in touch with RSJoomla! and receiving the official RSJoomla! Customer Support.

For more information, the Support Policy is located here.

Thank you!

TOPIC: Weird RSfirewall hack attempt email

Weird RSfirewall hack attempt email 11 years 6 months ago #25017

Hello, today I received a low alert by mail but instead of having my website name in the subject of the message, I received the alert as it was sent for a website I dont know, which is www.reliabletop.es. My site is not this one, but i received the alert as it was sent in order to protect the site above. I checked the logs of my server and actually the hack attept was made to my real site, so the emails should have contained my real site in subject and not reliabletop.es, here is Rsfirewall email:

Subject: [low] RSFirewall! for www.reliabletop.es/ #(!!! should be www.mysite.com)

Message body:
Website: www.reliabletop.es/
Page: /Navigation/Site?link=http://www.wildtangent.in/
Description: RSF_EVENT_LFI/directory traversal in REQUEST_URI
Alert level: low
Date of event: 28.09.2013 05:07:18
User IP: 185.10.104.130
User Id: 0
Username:

I checked my mysql tables for reliabletop text, no entries, I checked rsfirewall installation files for recent modifications, I found nothing.

Can you explain to me how this can be happening? Should I worry about this?

After this weird alert, I received other alerts with the correct website name in the Subject, so I really cant figure out what is happening... BTW I am on Joomla 1.5.26 and last version of Rs firewall 1.4.0 Rev 44
Last Edit: 11 years 6 months ago by lorenzofp. Reason: i had to put my joomla and rsfirewall version
The administrator has disabled public write access.
  • 1

Read this first!

We do not monitor these forums. The forum is provided to exchange information and experience with other users ONLY. Forum responses are not guaranteed.

However, please submit a ticket if you have an active subscription and wish to receive support. Our ticketing system is the only way of getting in touch with RSJoomla! and receiving the official RSJoomla! Customer Support.

For more information, the Support Policy is located here.

Thank you!