"DirectAdmin Client Message" Email - Scam/Real?
- Thread starter pluk
- Start date
Arieh
Verified User
Also had 2 of them. Gmail flagged them as spam though, already deleted it.
LawsHosting
Verified User
I got that too, three times today! :/
I also got one of the copyright infringement emails. It was from a directadmin server (main domain had default DA html skel files). This is a little worrying... is it possible these are external directadmin clients servers that have been exploited?
turnersloane
Verified User
- Joined
- Sep 27, 2006
- Messages
- 52
I don't know about anyone else, but I rely on Evolution for email, with everything set to plain text. Sure, I may miss out on the pretty fonts and the pretty colors, and I may miss out on all the funky attachments, but email is a tool. Would you paint pretty flowers on your chainsaw? Nope. So even if you choose Gates or Jobs, set your email client to plain text. I always recommend to my clients to try to view untrusted emails in plain text, that way they can see the underlying text in a link and know that it doesn't go where it claims to go. Basically, educate yourself, then educate your clients. After all, your clients sign your paycheck, right?
Eureka
Verified User
I got 2 copyright infringement emails, but usual if I do not know the sender they get deleted.
LawsHosting
Verified User
Doubt it very much, but there's no way of knowing - I've just checked http://www.securityfocus.com/bid and saw nothing related to the current version, however, it could be so new no-one has reported it yet.
Then again, if it was that serious, as in a widespread serious issue, Mark or John would say so.
SeLLeRoNe
Super Moderator
Im receiving those emails too, on two different DA Account (one my own company one where i work).
Received 2 for each account so far.
Maybe just blacklist that sender should help, unless they dont change it...
Regards
Received 2 for each account so far.
Maybe just blacklist that sender should help, unless they dont change it...
Regards
I got both emails, "DirectAdmin Client Message" and "Cease and desist copyright infrigement!".
Regarding the "Cease and desist copyright infrigement!", attached is an screenshot of the page that sent out the messages and some of the interface is in romanian language.
At maximum 2 hours after my screenshot the area got protected with username and password.
Regarding the "Cease and desist copyright infrigement!", attached is an screenshot of the page that sent out the messages and some of the interface is in romanian language.
At maximum 2 hours after my screenshot the area got protected with username and password.
Attachments
- Joined
- Feb 27, 2003
- Messages
- 561
It would be extremely unethical to remain silent if we knew of a widespread security issue. Of course, I can completely understand that customers would have feelings of doubt. We never know if we're getting the full story.
To help alleviate doubt, please remember that:
- We were transparent about client info being compromised, right from the beginning. All customers received notification less than 24 hours from the incident.
- There are no reports of DA machines being compromised en masse.
- We haven't tried to force a DA version update as a disguised attempt to cover some security hole.
None of this makes up for the inconvenience to our customers. However, I wanted to make it clear that this incident does not indicate a universal security hole in DA machines.
Mark
Brute Force attempts
Since 5/27 I have seen a significant rise in the number of brute force attempts on sshd and dovecot on my server. I believe that there is a relation to the DA database breach. The attackers may be targeting DA servers. I would encourage everyone to make sure that you are running a firewall and something like APF with BFD to automatically block these login attempts.
Can anyone else confirm a significant rise in the amount of brute force attempts on their server?
Since 5/27 I have seen a significant rise in the number of brute force attempts on sshd and dovecot on my server. I believe that there is a relation to the DA database breach. The attackers may be targeting DA servers. I would encourage everyone to make sure that you are running a firewall and something like APF with BFD to automatically block these login attempts.
Can anyone else confirm a significant rise in the amount of brute force attempts on their server?
nobaloney
NoBaloney Internet Svcs - In Memoriam †
Does anyone have any information on whether or not the copyright violation notices are being received by anyone not on a server hosted with DirectAdmin? Are they only coming to your email addresses as registered with DirectAdmin?
Jeff
Jeff
SeLLeRoNe
Super Moderator
Ive received only on two account related to directadmin.
Regards
Regards
21secolo
Verified User
like that?
I have at least an attempt to "port scan" every day ... for me at the moment is a normal thing and always has been.
LawsHosting
Verified User
We use Portsentry and we haven't seen an major increase of larger host.deny files.
- Joined
- Feb 27, 2003
- Messages
- 8,437
Hello,
It's likely related. Obviously, don't click the link.
John
It's likely related. Obviously, don't click the link.
John
Phantium
Verified User
Yes, I just reported as spam to Google mail.