Варианты решения Ваших вопросов

Здравствуйте

на сайт была жалоба

мы вам сообщали о ней

On ** May **:**, soc@phishlabs.com wrote:
[PL-*******] Phishing attack(s) hosted on: muliebre.com

Formular-Daten
===============================================
Name: Jimmy
E-Mail: soc@phishlabs.com
Sprache: de
Datenweitergabe: BEWILLIGT
===============================================

Abuse-Daten
===============================================
Quelle: ***.***.***.**
Kategorie: Phising

Beschreibung:
------------------------------------
[PL-*******] Phishing attack(s) hosted on: muliebre.com

During an investigation of fraud, we discovered a compromised website (muliebre.com) that is being used to attack our client and their customers.

In addition to the website owner, we have addressed this report to the responsible authoritative providers who have the ability to disable the malicious content in question. Based on your relationship to the content in question, please see our specific request below.

This threat has been active for at least *.* hours.

****dek
*****
*****wel*.html
*****wel*.html

First detection of malicious activity: **-**-**** **:**:** UTC
Most recent observation of malicious activity: **-**-**** **:**:** UTC
Associated IP Addresses:
***.***.***.**

=== HOSTING PROVIDER ===
If you agree that this is malicious, we kindly request that you take steps to have the content removed as soon as possible. It is highly likely that the intruder who set up this phishing content has also left additional fraudulent material on this server such as illegitimate access points.

=== WEBSITE OWNER ===
We recommend taking the following actions to secure the web site and prevent the attackers from returning:
- Update your web applications including CMS, blog, ecommerce, and other applications (and all add-on **plugins).
- Search all of your web directories for suspicious files as attackers commonly leave backdoors.
- Scan the computer from which you login to your web hosting control panel or ftp server with anti-virus software.
- Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you must coordinate a resolution with them directly as PhishLabs has no control over this aspect.

If we have contacted you in error, or if there is a better way for us to report this incident, please let us know so that we may continue our investigation.

We are grateful for your assistance.

Kind regards,
Jimmy Parks
PhishLabs Security Operations
***********
Available **/*

Жалоба на фишинговую страницу.

Вам нужно удалить контент

****dek
*****
*****wel*.html
*****wel*.html

Предоставьте Ваш WAN IP для предоставления Вам доступа к сайту, что бы Вы очистили контент.

Ожидайте. пожалуйста...

Досутп по iP отткрыт

Вам необходимо сменить NS для домена на 

ns*.web-host.gen.in 
ns*.web-host.gen.in  

Пожалуйста, обработайте жалобу.

Вам предоставлен полный доступ.

Пожалуйста, обработайте жалобу.

мы проверили аккаунт на вирусы

отчет тут

/AI-BOLIT-REPORT-__-******-**-**-****_**-**.html

Сделайте пожалуйста трассировку к Вашему домену: пуск - выполнить - ввод cmd - в черном окне ввести tracert ВАШ ДОМЕН - после завершения кнопкой мыши выделить - нажить enter - скопировать сюда в тикет

Если Вы испытываете затруднение, просмотрите обучающее видео http://ded****tracert.htm

Вы можете авторизоваться через панель?

http://***.**.***.**:****/cpsess**********/**index.html?login=*&post_login=**************

Проверьте FTP сейчас.

Так же просканировали вессь Ваш аккаунт на вирусы.

Отчет в корне - AI-BOLIT-REPORT-__-******-**-**-****_**-**.html

Ожидайте, пожалуйста..

какого сайта? где был ваш сайт? это ваш акканут, других данных нет

веротяно ваш сайт был удален злоумышленником и загружены новые файлы

К сожалению мы имеем только * бекап

жалоба на вас пришла **-**-****

сайт был взломан еще ранее. следовательно в бекап уже ничего не попало

на вас снов ажалоба

From: PhishLabs Security Operations [mailto:soc@phishlabs.com]
Sent: Monday, May **, **** *:** PM
To: tech@zbscloud.com
Cc: abuse@infonet.hr; cert@cert.ee
Subject: [PL-*******] Phishing attack(s) hosted on: muliebre.com

During an investigation of fraud, we discovered a compromised website (muliebre.com) that is being used to attack our client and their customers.

In addition to the website owner, we have addressed this report to the responsible authoritative providers who have the ability to disable the malicious content in question. Based on your relationship to the content in question, please see our specific request below.

This threat has been active for at least *.* hours.

hXXp://****userID-*****/
hXXp://****userID-*****/?email=
hXXp://****userID-*****/wel*.html
hXXp://****userID-*****/wel*.html

First detection of malicious activity: **-**-**** **:**:** UTC Most recent observation of malicious activity: **-**-**** **:**:** UTC Associated IP Addresses:
***.**.***.**

=== HOSTING PROVIDER ===
If you agree that this is malicious, we kindly request that you take steps to have the content removed as soon as possible. It is highly likely that the intruder who set up this phishing content has also left additional fraudulent material on this server such as illegitimate access points.

=== WEBSITE OWNER ===
We recommend taking the following actions to secure the web site and prevent the attackers from returning:
- Update your web applications including CMS, blog, ecommerce, and other applications (and all add-on **plugins).
- Search all of your web directories for suspicious files as attackers commonly leave backdoors.
- Scan the computer from which you login to your web hosting control panel or ftp server with anti-virus software.
- Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you must coordinate a resolution with them directly as PhishLabs has no control over this aspect.

If we have contacted you in error, or if there is a better way for us to report this incident, please let us know so that we may continue our investigation.

We are grateful for your assistance.

Kind regards,
Scott Roman
PhishLabs Security Operations
***********
Available **/*

[PL-*******]

отпишите жалующейся стороне, решите вопрос с блоком

Там несколько email отошлите на все

C какого ящика Вы отправляли, сообщите, пожаулйста.

Ожидайте, пожалуйста.

" Технические подробности смотрите ниже."

чо там написано?

напишите им с другого ящика. ваш домен нужно убрать bp[ их списокв, на ваш сайт все равно никто не сможет зайти пока вы в них

Ожидайте, пожалуйста.

Здравствуйте.

Проверьте сейчас.

Проблема в этот раз непосредственно с поддоменом

unicredit.spa.banca.it.portale.titolari.mobile.muliebre.com.

Аккаунт полностью пересоздан

Пароль сменен и отправлен Вам на почту.

Спасибо за обращение в техническую поддержку.

сейчас снова была жалоба

Subject: Re: Issue *******: phishing attack at hxxp://www.unicredit.spa.banca.it.portale.titolari.mobile.muliebre[.]**ee****ba*d*d***ea***d**e*a***b**

Austatud hä*daam

Oleme avastanud phishing-rünnaku teie arvutivõrgust:

hxxp://www.unicredit.spa.banca.it.portale.titolari.mobile.muliebre[.]**
[***.**.***.**]

See rünnak on suunatud meie kliendi, UniCredit, vastu, veebiaadressil *. Kas te saaksite palun selle veebilehekülje internetist võimalikult kiiresti eemaldada?

Lisaks, palun kindlustage petturi kontrollitava veebilehe turvalisus, et meie klient ning seadusagentuurid saaksid seda intsidenti sügavamalt uurida, kui lehekülg on internetist maha võetud.

Parimate soovidega,

Netcraft

Phone: +**(*)**** ******
Fax: +**(*)**** ******

Netcraft Issue Number: *******

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This mail can be parsed with x-arf tools. Visit * for more information about x-arf.
-------------------
Dear Sir or Madam,

We have discovered a phishing attack located on your network:

hxxp://www.unicredit.spa.banca.it.portale.titolari.mobile.muliebre[.]** [***.**.***.**]

It is possible that this attack is being restricted so it is only visible from certain countries. Before deciding that the attack has been resolved please confirm it cannot be viewed from the following countries:
Italy
Austria
Bulgaria
Germany
Turkey
Bosnia & Herzegovina
Czechia
Croatia
Hungary
Luxembourg
Romania
Serbia
Russia
Slovenia
Slovakia

This attack targets our customer, UniCredit, website URL *.

Would it be possible to have the fraudulent content, and any other associated fraudulent content, taken down as soon as possible?

Additionally, please keep the fraudulent content safe so that our customer and law enforcement agencies can investigate this incident further once the site is offline.

For more information please see **d*d*bcdbb**

Many thanks,

Netcraft

Phone: +**(*)**** ******
Fax: +**(*)**** ******

Netcraft Issue Number: *******

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This mail can be parsed with x-arf tools. Visit * for more information about x-arf.

удалилось все, но видимонарушение очень серьезное раз шлют повторы, фишинг это преступление во всех странах

на каком движке был ваш сайт? вы давали кому либо доступы? пароли аккаунта были ли где тов файлах на аккаунте? у вас были простые пароли?

если на сайте были уязвимые расширения и сайт давно не обновлялся то возможен повторный взлом. но что скажете по паролям. у вас были аналогичные парлю аккаунта паролина сайте?

Спасибо за содействие