ConfigServer Community Forum

The logs show a series of GET/POST attempts using the built-in contact page in Joomla which I would think is fairly secure, although the site was on 3.8.6, updated this morning to 3.8.8: 120.28.41.123 - - [01/Jun/2018:22:52:42 -0400] "GET /index.php/contact/5-steam-parent-leader HTTP/1.1" ...

I had a Joomla site hacked last night, they relayed some emails. Trying to figure out how they got in. Looks like they used sendmail. Here are the CSF notifications (without actual domain name or email addresses). The configuration.php file referred to as possible script is the Joomla file last upda...

I found that whitelisting the CSF Update IP 85.10.199.177 (CSF Firewall Quick Allow, green text box) did the trick. Hope this helps.