******* logging passwords? Just saw this thread over at TAZ

Status
Not open for further replies.
I am the kind of guy who likes addons, and I saw ******* had lots when I moved from vB to Xenforo, but I was told by a few people to keep away from their addons, and it was around the same time it all kicked off here with his call back codes.
So i feel lucky i never installed any of his addons, never registered on his site

However just last week I saw an addon i really wanted, so I thought i'd test the water by sending them a question via their contact form.
I basically asked about as they had been kicked out from here, how can they say that they don't do call backs anymore and how should someone think their addons are safe.
The reply was:
Our products are no longer existed on xenforo.com any more. However, everything in *******.com is still normal. You can stop by our site in the next time for shopping any products related to XenForo. The support service is still usual. You can leave us a ticket if there is anything happened with your product. You can suggest us any thing on our site *******.com.

With your concern about our trustable, You must to trust in your instinct. During last time, we do care about our customers, about you. We do not have any action which will hurt you or your finance. You can look back the history, especially the history of business with us. We have not lied to you. So what are you afraid of?

We do promise with you that with us “Customer is King”, as it always does. And as I explained in the recent blogpost, we just took your URL site to check, we have not used any private information for any purpose and we ARE NOT.

Thank you for being with us during last time. We still are here to support all of you and if you do believe us, we will get back to you.

Thank you!
Click to expand...

With that I contacted a coder from here I know to see if he could do a similar addon, which the coder did....
 
So what was deleted exactly? Maybe it can be compared to Google cache to see what the thread detailed? Searching https://theadminzone.com/search/639990/?q=*******&o=relevance&c[title_only]=1 still brings back 7 results as a guest and to respect hidden member only and certain rank usergroup forums, I won't say how many results while logged in.. But some really bad threads about them exist still.. I would think these would be deleted first. Not defending *******, but I do believe in innocent til proven guilty and something just isn't adding up here...
 
New Joe said:
The reply was:
Our products are no longer existed on xenforo.com any more. However, everything in *******.com is still normal.
.
Click to expand...
So does that mean the callback crap is still in their addons on the ******* site? either way, given the numerous scandals surrounding their name, I'd be surprised if anyone either (A) Carried on supporting them and (B) Still buys/uses their addons.
 
xenBoost Mike said:
So what was deleted exactly? Maybe it can be compared to Google cache to see what the thread detailed? Searching https://theadminzone.com/search/639990/?q=*******&o=relevance&c[title_only]=1 still brings back 7 results as a guest and to respect hidden member only and certain rank usergroup forums, I won't say how many results while logged in.. But some really bad threads about them exist still.. I would think these would be deleted first. Not defending *******, but I do believe in innocent til proven guilty and something just isn't adding up here...
Click to expand...
All threads that were deleted were soft deleted, so we were able to undelete them, which is why they're still there.

log1.webp
log2.webp
log3.webp


You'll see the same IP for all of them - which linked to the user account that had the v xf (full name is censored here) email address.

Erika was online at the time and saw the deletions, so went up behind them and undeleted them all. (I've blanked out her IP since she's not around for me to ask if it's okay to leave it showing).
undelete1.webp
undelete2.webp
undelete3.webp


As you can see, not all were ******* related but the majority were.
 
Sheldon said:
Strange. ...
Click to expand...
Very.

The IP linked to another account, which was logged in only minutes before the deletions started on Alfa's.
alfa.webp

And the alucar_x account also had an IP that matched another three accounts on another IP address:-

alucar.webp


Matt went through the server logs, there was some activity relating to LiveUpdate by the 192 IP address (I don't understand what any of it means) but nothing to suggest a brute force attempt - at least from what I could see. I don't know how deep Matt searched.
 
Lisa said:
All threads that were deleted were soft deleted
Click to expand...
lol Smart enough to rip code but to stupid to realize how fruitless soft deleting content is.. Not a ******* supporter but that doesn't make a lot of sense.. the whole thing seems very amateur hour-ish to me..
 
FredC said:
lol Smart enough to rip code but to stupid to realize how fruitless soft deleting content is.. Not a ******* supporter but that doesn't make a lot of sense.. the whole thing seems very amateur hour-ish to me..
Click to expand...
It does seem a little on the pointless side. Possibly, they just planned on soft-deleting as much as possible, but got caught quicker than anticipated. Who knows. Maybe he thought mods had the ability to hard-delete.
 
Lisa said:
You're going to see Rob Zombie? I love that guy. If he does Living Dead Girl, video it for me :p
Click to expand...

I ain't going in.. 50k ppl in this heat outdoors? no thanks.. there is a dog park right next store on a shaded hill.. can see the stages great and hear everything like your inside... bring some blankets and plenty of free space to just lounge out :D It's www.rockfestkc.com
 
Still can't fathom how they guessed the mod's password on the first try.

Almost seems it was hacked some other way.

Strange
 
SneakyDave said:
Still can't fathom how they guessed the mod's password on the first try.

Almost seems it was hacked some other way.

Strange
Click to expand...

Agree.. Seems it had to be keylogged or cookie grabbed from somewhere and going to *******'s site sets off no sort of firewall, malware or anti-virus alarms on my computer. Sounds to me like a keylogger was downloaded from somewhere..

You have now entered a new dimension in the xf zone.. *do do do do.. do do do do*
 
Status
Not open for further replies.
Top Bottom