Solved

A strange message from LogUploads@commvault.com

  • 29 June 2022
  • 4 replies
  • 194 views

Userlevel 4
Badge +11
  • Commvault Certified Expert
  • 83 replies

Hi guys,

The Customer received the following message a few days ago.

 


From: Commvault Log Upload Administrator <LogUploads@commvault.com>
Sent: Sunday, June 26, 2022 6:00 AM
To: XXXXX XXXXX  <
xxxxx.xxxxx@xxxx.pl>
Subject: Automated message from EFT administrator

 

,
The password for account: ‘The Customer’s CCID’ will expire in 4 days. Please change your password at your earliest convenience. Instructions for changing your password via FTP, SFTP, and HTTP/S are provided below for your convenience:
1. Please enter the following URL into your browser: https://transfer.commvault.com/manageaccount
2. Supply your current password when prompted
3. Enter your new password and confirm
4. If approved, exit the browser and login as normal


 

Is this is something that is known for you, guys?

I have never seen this sender before.

The link takes me to the following website:

 

Can you confirm that this website is trusted? If so, can you tell me what this website is for?

Rgds,

Kamil

icon

Best answer by J Dodson 30 June 2022, 00:28

View original

4 replies

Badge +2

We had several customers receive a similar email.  We are waiting for an explanation from Commvault support.  Andy

Userlevel 2
Badge +5

This is a valid email and it is legit. The link that it takes you to is a valid Commvault site. This is an account that is used for FTP transfers (Cloud uploads). From our conversation threads on the Enterprise Success Program team, this account is an AD account that has a password that expires after 1 year (365 days). Customers manage this account/password and this notification is legit.

 

There is still discussion ongoing as to future delivery of this notification as it is agreed that it comes off as suspect for phishing. 

 

Userlevel 2
Badge +5

Just after sending the above reply I found the following update from support today:

 

This is a legitimate email and expected behavior. Any users who have previously used our older ftp sites such as qnftp01.commvault.com or fasterftp.commvault.com these have been decommissioned and replaced with transfer.commvualt.com As an initial onboarding to the new site users received this email notifying them to reset their password so they can get setup on the new website. This site is used as a manual alternative for log upload when direct upload from the Commcell Console is not working or FTP upload is required for a restricted site for example.

 

And to clarify, this email addresses this particular account/password only and does not refer to any other account/password (ie ma.commvault.com, cloud.commvault.com, DR backups, or SQL DB). 

 

Hopefully this notification will be made clearer for future distributions.

Userlevel 4
Badge +11

Many thanks guys for all your replies.

Everything is clear now.

Rgds,

Kamil

Reply