MyBB Community Forums

Malwarebytes has been popping up with a warning about outgoing traffic to coffeesotre.wha.la at IP 162.217.250.239. I think it might be one of my plugins but can't figure out which. All came from the Extended section of this site. Does anyone know anything about this coffeesotre.wha.la site or what is going on?

Not really. Sharing your board URL and listing your plugins would be welcome, also check ACP -> Tools & Maintenance -> File Verification.

Thanks for the response.

Form is http://forums.fanedit.org

The plugins installed:

Automention
Board Announcements Manager
MyBB Default Avatar Fix
Disposable Email Blacklist
Full PM
Google Analytics
Login Password Conversion
MyAlerts
MyLikes
MyCode: [spoiler]
Quick Advanced Editor
RSS Feed Poster
Tapatalk
View Unread Posts
Wordpress Connect

Inactive Plugins
PluginLibrary

This is what File Verification reports:

install/resources/upgrade35.php Changed
jscripts/sceditor/editor_themes/default.css Changed
search.php Changed
inc/class_parser.php Changed
inc/cachehandlers/eaccelerator.php Changed
inc/cachehandlers/memcache.php Changed
inc/cachehandlers/interface.php Changed
inc/cachehandlers/memcached.php Changed
inc/cachehandlers/xcache.php Changed
inc/cachehandlers/apc.php Changed
inc/functions_indicators.php Changed

I don't see anycoffeesotre.wha.la outgoing traffic on the index page, where exactly did Malwarebytes report that?

BTW, you are now denied support for the lack of MyBB copyright: https://www.mybb.com/support/eligibility-policy/ and you should update 1.8.7 files due to a change in the package: http://blog.mybb.com/2016/03/11/mybb-1-8...7-release/

I assume you're talking about the Powered by section. The guy we hired to help theme the site must have commented it out. I've put it back so that we comply. Credit where credit's due. If something more needs to be done to rectify this please PM me and let me know.

In answer to your question it appears on random threads.

"Random threads" doesn't help though, show an exemplary thread.

This post in particular has an image with that URL: http://forums.fanedit.org/showthread.php...#pid260358

You might be seeing a warning when you open this thread with this post. Maybe it was posted in other threads and other images from that website as well.

(2016-04-03, 03:12 AM)José F. Wrote: [ -> ]This post in particular has an image with that URL: http://forums.fanedit.org/showthread.php...#pid260358

You might be seeing a warning when you open this thread with this post. Maybe it was posted in other threads and other images from that website as well.

It was one of the images being linked to. Good call. And thank you to Destroy666 for assisting too.