Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm a newbie webmaster. I've got a domain and a site... and no clue about the web (I'm OK with files and programs... ) I got a message from google that my site is a possible phishing site, with a link the the suspect page:

 http://www.mydomain.com/~phishers/Paypal/us/Confirm.php

needless to say, I didn't put that up. Can someone point me to a good tutorial on what to do now? I'd like to figure out what happened so I can defend against it the next time around. How do I identify what kind of attach this is?

Also, what is the tilde doing in the URL path? I couldn't find any path like this on my hosting account, so I'm not entirely sure how to delete it.

share|improve this question

2 Answers 2

If you do not recognize the username after the tilde, this is most likely an instance of a phisher exploiting a hosting provider's lax mod_userdir configuration (in conjunction with a reverse lookup of domains hosted on the server) - contact your hosting provider for assistance.

(You may want to mention mod_userdir by name - phishers have been using this trick on shared hosting for several years, so it's likely they'll already be familiar with it)

share|improve this answer
    
Hrmm... according to my research lax mod_userdir configuration is an information leak vulnerability. It allows hackers to test for usernames (and then from there try to crack the password through FTP, SSH, or some other method). How does an rDNS lookup help them get in? –  Lèse majesté Apr 16 '12 at 13:34
    
@Lèsemajesté one compromised user account facilitates phishing attacks from every domain on the host. (The phishers themselves might pay - with a stolen credit card or PayPal account - for the hosting account to get access to all the domains on the host) –  danlefree Apr 17 '12 at 4:35

Some of the answers to the following question might help you out: My website has been hacked/attacked, says "reported attack page"

Just to summarize some of the steps I posted there:

  • Change your FTP password, making sure you use a stronger one
  • Clean out any unfamiliar files
  • Verify any software (WordPress, Drupal, etc.) you have installed are up to date
  • Change hosts if your host was at fault

You might want to verify that it was your account, and not your host, that has been compromised. If you had a weak password or an out-of-date web application installed, then you should be able to simply work on your own security. If your host is insecure, there's very little you can do yourself to prevent your web site from becoming compromised as a result - get out, and get out fast!

share|improve this answer
    
Thanks. It looks like a problem at my web host, and they don't appear to be aggressive in fixing things. They certainly aren't informative. I've got an extremely simple page, with now software to update. –  Suz Apr 19 '12 at 12:22
    
@Suz That's very worrying - if they're not taking a compromise like this seriously, I don't know if I'd trust them with my site. It might be time to research alternative hosts, I'm afraid. :( –  Jacob Hume Apr 19 '12 at 15:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.