Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I got an alert from Google Webmasters. They say the following file was present in my host:

example.com/~jhostgop/identity.php

I checked my files and it never existed at all.

I've experience this problem in two different host and domains but the file never existed in my file system.

It appears somebody out there is linking a random domain and it prefixes the link with /~jhostgop/identity.php. Now Google may have indexed them so now I get those false phishing alerts.

Anyone experienced this? Is it possible to prevent this?

share|improve this question
    
A file does not necessarily have to be physically on your file system for an external site (ie. Google) to identify it as a file. If your .htaccess file has been hacked, for instance. If "somebody out there" is linking to a non-existent file (and Google has crawled this link) then you should be seeing this in your 404 report? –  w3d Jan 8 '13 at 9:05
    
...So Google thinks you've been serving a phishing like attack from this URL?! –  w3d Jan 8 '13 at 9:12
    
@w3d actually I don't have htaccess file because I'm using Nginx (not Apcahe). It does appear in my error log. Yes Google thinks so. –  IMB Jan 8 '13 at 9:51
    
How sure are you about the "never" part? If I were trying to be a sneaky phisher, I'd only keep my pages up for a day or two before deleting every trace of them I could. –  Ilmari Karonen Jan 8 '13 at 20:41
add comment

1 Answer 1

Here is a list of things that I would do if I were you:

  1. Change all the login details to the server including but not limited to ftp, ssh, and login details to the CMS if you use any.

  2. Disallow example.com/~jhostgop/identity.php in your robots.txt.

  3. In google webmaster tools, submit a page removal request for example.com/~jhostgop/identity.php

These above steps should stop Google from displaying such messages in future. However, the ultimate solution to this would be to identify the security loop hole and fix it, which can only be done with a detailed examination of logs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.