⚠️ Important note before reading:
The Green Candle and Hidden Candle apps do not handle real money and have no connection to subscribers' accounts on trading platforms. We do not receive or store any money.
And for anyone who wanted to hack the two apps, there are only two possibilities:
1- Stealing strategies
2- Destroying the website and the apps
---
⚠️ Important warning to all Green Candle and Hidden Candle subscribers — hacking attempt
Dear subscribers, I'm writing this post out of transparency and a sense of responsibility, because your money and data are entrusted to me.
On November 10 and 11, 2026, our app was targeted in an organized scanning and hacking attempt by a group of IPs that tried to probe the admin panel for vulnerabilities and access the owner's login page.
What exactly happened?
These IPs tried to scan paths such as:
`/admin/home`
`/admin/.env`
`/admin/config.php`
`/admin/.git/config`
`/admin/home/sitemap.xml`
After that, they tried to access the owner's login page.
Attack figures from the official monitoring report for November 10:
- 119 Honeypot vulnerability scanning attempts
- 15 new suspicious IPs
- 7 IPs were blocked
- The owner's login page was opened 70 times
- The system itself recorded: `unusual_activity=yes` - unusual activity
The IPs that attempted to hack us:
The most dangerous group — reached the owner's login page:
1. `101.32.15.141` - on November 11 at 19:00:02 UTC / 22:00:02 Riyadh time, after scanning `/admin/.git/config`
2. `128.1.44.38` - on November 10 at 22:00:01 UTC / 01:00:01 Riyadh time, repeated the attempt 7 times
3. `168.76.20.229` - on November 10 at 21:45:01 UTC, repeated the attempt 5 times
4. `124.156.204.51` - on November 10 at 21:35:01 UTC
5. `91.92.40.12`
6. `16.216.88.143`
7. `108.131.37.69`
8. `172.232.108.36`
9. `18.218.118.203`
10. `69.5.169.144`
11. `69.5.169.170`
Second group — scanned for vulnerabilities only and were blocked:
12. `45.138.12.51`
13. `185.191.236.38`
14. `187.17.224.223`
15. `34.38.220.175`
16. `69.5.169.254`
Was any subscriber's account compromised?
So far, according to the monitoring logs, no successful login as the owner has been recorded from any IP in the list above.
What happened was access to the login page only, not access to the account.
But I won't settle for just saying that. I have asked the developer for a complete, detailed report, IP by IP, showing from the logs whether any data was viewed or any subscription, price, or payment request was changed. I will share the results with you transparently as soon as I receive them.
What have we done to protect you?
1. The dangerous IPs have been blocked.
2. Security on the owner pages has been strengthened.
3. All further changes have been halted until the full report is received.
4. Everything has been documented with timestamps, dates, and logs to send to the development company.
An important warning for you:
1. Don't click any link you receive claiming to be from Green Candle or Hidden Candle unless it comes from our official channels.
2. Don't send your password or verification code to anyone. We will never ask you for them.
3. If you receive an email or message asking you to sign in through a suspicious link, ignore it and send it to me immediately.
4. If you notice any change to your subscription, price, or payment request that you didn't make, tell me immediately.
Your money is a trust, and I will not hide any danger that could affect you.
I will keep you informed of any developments on this matter.
Dr. Qannas
Green Candle - Hidden Candle
November 11, 2026