Entire vbulletin.org website is duplicated

[joelr]

Ironically, this was posted on the XF forums of all places.

This is not an anti-advertisement as it might seem. I simply can't post on the company's forum because a license is required. They don't respond to my emails, so I’m writing here.

I wrote to the vBulletin company administration, informing them that a group of Russian hackers is stealing entire forums and launching them on new domains. They didn’t respond to my emails. Yes, it’s hard to believe, and I can’t prove it because from the outside, it looks like a fully functioning forum with no errors, complete with messages dating back 10 years, and it's unclear who the owner is. Yes, vBulletin could always say that the vulnerability is somewhere else, like in the hosting or other software.

But recently, the situation changed. Russian hackers completely stole the forum of the vBulletin company itself – vbulletin.org – and re-uploaded it to a new address: vborg.vbsupport.ru

https://xenforo.com/community/threads/using-vbulletin-3-8-is-dangerous.224887/

 

[Darth Cognus]

I'd actually like to know how they do this not to steal someone's forum, but to make a backup of a site that has a completely absent owner and where the content could end up irreparably lost if the plug is just pulled without notice one day.

But the board I'm thinking of is 4.x so maybe it doesn't apply in the first place.

 

[joelr]

I'd actually like to know how they do this not to steal someone's forum, but to make a backup of a site that has a completely absent owner and where the content could end up irreparably lost if the plug is just pulled without notice one day.

But the board I'm thinking of is 4.x so maybe it doesn't apply in the first place.

Think of all the absent forums we could save!

 

[Ravenfreak]

I'd actually like to know how they do this not to steal someone's forum, but to make a backup of a site that has a completely absent owner and where the content could end up irreparably lost if the plug is just pulled without notice one day.

But the board I'm thinking of is 4.x so maybe it doesn't apply in the first place.

There's scrapers that can crawl a site and steal posts, themes, etc. I'm sure this is how these Russian hackers were able to copy/paste the vBulletin.org site. Though the site itself is dead now and all support is on their main forum which is on the forum.vbulletin.com domain name.

 

[Joeychgo]

There's scrapers that can crawl a site and steal posts, themes, etc. I'm sure this is how these Russian hackers were able to copy/paste the vBulletin.org site. Though the site itself is dead now and all support is on their main forum which is on the forum.vbulletin.com domain name.

except someone reported they were able to login to the russian site with their existing username and password. If true, wouldnt that mean the entire database was stolen instead off the site just being scraped?

 

[Ravenfreak]

except someone reported they were able to login to the russian site with their existing username and password. If true, wouldnt that mean the entire database was stolen instead off the site just being scraped?

They probably stole the database and the site's code. Either way it's sketchy but the site did use an outdated version of vBulletin. I know many people preferred that version of the software and it's probably why the site was online for so long.

 

[Smokey]

Same just happened to me.....

Example:
My site: https://www.revillution.net/threads/lunar-collection-remastered.2813/#post-14778

The culprit: https://evention.pk/threads/lunar-collection-remastered.47/#post-50


I've disabled my RSS Feed entirely using an add-on from AndyB, hoping that fixes the issue......really pathetic that this even needs to be done....

 

[joelr]

Same just happened to me.....

Example:
My site: https://www.revillution.net/threads/lunar-collection-remastered.2813/#post-14778

The culprit: https://evention.pk/threads/lunar-collection-remastered.47/#post-50


I've disabled my RSS Feed entirely using an add-on from AndyB, hoping that fixes the issue......really pathetic that this even needs to be done....

Wow, that was a word for word copy and the same video.

Was it just this one post or more?

 

[joelr]

except someone reported they were able to login to the russian site with their existing username and password. If true, wouldnt that mean the entire database was stolen instead off the site just being scraped?

Wasn't the (real) vbulletin org site taken down?

 

[Smokey]

Wow, that was a word for word copy and the same video.

Was it just this one post or more?

it was any post i made. I disabled RSS feeding and it stopped. I also blocked their server IP in cloudflare & on my server just in case.

 

[Ravenfreak]

Same just happened to me.....

Example:
My site: https://www.revillution.net/threads/lunar-collection-remastered.2813/#post-14778

The culprit: https://evention.pk/threads/lunar-collection-remastered.47/#post-50


I've disabled my RSS Feed entirely using an add-on from AndyB, hoping that fixes the issue......really pathetic that this even needs to be done....

I'm glad you were able to stop this from happening! If this is happening to two different forums, it's probably happening to a lot more and we're just not aware of it. How did you manage to figure this out, did you google your thread and notice this website?

 

[Smokey]

I'm glad you were able to stop this from happening! If this is happening to two different forums, it's probably happening to a lot more and we're just not aware of it. How did you manage to figure this out, did you google your thread and notice this website?

Someone PMed me on another forum and asked me if I had set up a 2nd forum and linked it...

Disabling RSS seems to have stopped them entirely, and to be safe i banned their server IP across my site & cloudflare.

 

[Shortie]

It's crazy that this is even possible and Xenforo are not concerned about it which is a shame. I can only imagine how many other forums are being duplicated that no one is aware of which in turn, will not help the actual forum.

I do hope something is done about this soon.

 

[Joeychgo]

Xenforo are not concerned about it which is a shame

What exactly would you have them do?

 

[Smokey]

What exactly would you have them do?

If a forum is leeching content in this manner, it's a safe assumption they don't pay for a legitimate XF license, so providing they aren't a licensed customer, taking the forum(s) down would be a solid start to deter people from doing this sort of thing.

 

[Ravenfreak]

If a forum is leeching content in this manner, it's a safe assumption they don't pay for a legitimate XF license, so providing they aren't a licensed customer, taking the forum(s) down would be a solid start to deter people from doing this sort of thing.

I definitely agree with you but it's very tough for companies to get websites like this taken down, and that includes sites using nulled scripts. These sites are usually hosted on offshore hosting, which means a company like Xenforo wouldn't be able to target the site and get it removed since it's rare that these hosting companies will budge and remove websites from paying customers due to other countries laws. They could try but it could cost them money they can't afford to lose, especially if it means nothing comes out of it.

 

[Joeychgo]

If a forum is leeching content in this manner, it's a safe assumption they don't pay for a legitimate XF license, so providing they aren't a licensed customer, taking the forum(s) down would be a solid start to deter people from doing this sort of thing.

I definitely agree with you but it's very tough for companies to get websites like this taken down, and that includes sites using nulled scripts. These sites are usually hosted on offshore hosting, which means a company like Xenforo wouldn't be able to target the site and get it removed since it's rare that these hosting companies will budge and remove websites from paying customers due to other countries laws. They could try but it could cost them money they can't afford to lose, especially if it means nothing comes out of it.

Exactly.

Lets not forget, the forum owner can fix the problem by turning off RSS... Perhaps they can solve the problem themselves?

 

[Heatman]

Wow, that was a word for word copy and the same video.

Was it just this one post or more?

I've witnessed something similar like that happened to either VRG some years ago. They even copied and pasted even contest that was going on exactly the way it was on VGR without changing anything.