Suddenly - over the past week, that is - users of our website (https://usncva.org) have been receiving messages such as this:
"There was a new sign-in with the account: [username]
Device: Windows
Browser: Edge
IP Address: 208.104.148.17 NOTE: This email was automatically generated from US Naval Cryptologic Veterans Association (https://usncva.org). "
1. In this particular case, the alleged login attributed to my username; I am the Super User and Akeeba AdminTools is configured to disallow front-end logins by Super Users. Further, I made no such attempt.
2. The email header clearly shows the originating IP as that of our website, hosted by Rochen.
3. Other users, not Super Users, are now receiving such notices.
4. The IP address listed points back to 'ipinfo.io', not to ip-lookup.net.
5. Community Builder is not configured to send emails notifying users that they have logged in to the front-end.
6. AdminTools is configured to notify me, the Super User, of every login attempt to the admin backend of our website.
Rochen insists that their server (Linux) is properly configured and that no malware has been found on it.
Any suggestions will be keenly appreciated.
Sincerely,
Don White
"There was a new sign-in with the account: [username]
Device: Windows
Browser: Edge
IP Address: 208.104.148.17 NOTE: This email was automatically generated from US Naval Cryptologic Veterans Association (https://usncva.org). "
1. In this particular case, the alleged login attributed to my username; I am the Super User and Akeeba AdminTools is configured to disallow front-end logins by Super Users. Further, I made no such attempt.
2. The email header clearly shows the originating IP as that of our website, hosted by Rochen.
3. Other users, not Super Users, are now receiving such notices.
4. The IP address listed points back to 'ipinfo.io', not to ip-lookup.net.
5. Community Builder is not configured to send emails notifying users that they have logged in to the front-end.
6. AdminTools is configured to notify me, the Super User, of every login attempt to the admin backend of our website.
Rochen insists that their server (Linux) is properly configured and that no malware has been found on it.
Any suggestions will be keenly appreciated.
Sincerely,
Don White
Don White
