Hello Guys i am opening this thread to let you know i was recently attacked by a phisher, and RSA ( The Security Division of EMC) sent me an email to investigate this matter.

He left a Folder which contains files to phishing attack against Nedbank Limited.
I checked my logs and i found this guy using OVH server IP is behind this:

Code: 
41.28.190.47 - - [14/Feb/2011:01:29:50 -0800] "GET /vbseo/images.php?act=cmd&d=%2Fhome%2Fadmin%2Fmysite.com%2Fvbseo%2F&cmd=unzip+neld.zip&cmd_txt=1&submit=Execute HTTP/1.1" 200 378
also from checking further logs this IP was accessing those files just after it were on my server : 91.121.75.82

my vbseo was world writeable so he was succeed in this. Anyway if someone have idea who it is dont forget to inform me, further i have notified to OVH to look in this matter.

Cheers
mRAza Reviewed by mRAza on . Phishing Attempt Hello Guys i am opening this thread to let you know i was recently attacked by a phisher, and RSA ( The Security Division of EMC) sent me an email to investigate this matter. He left a Folder which contains files to phishing attack against Nedbank Limited. I checked my logs and i found this guy using OVH server IP is behind this: 41.28.190.47 - - "GET /vbseo/images.php?act=cmd&d=%2Fhome%2Fadmin%2Fmysite.com%2Fvbseo%2F&cmd=unzip+neld.zip&cmd_txt=1&submit=Execute HTTP/1.1" 200 378 Rating: 5