I'm a newbie webmaster. I've got a domain and a site... and no clue about the web (I'm OK with files and programs... ) I got a message from google that my site is a possible phishing site, with a link the the suspect page:


needless to say, I didn't put that up. Can someone point me to a good tutorial on what to do now? I'd like to figure out what happened so I can defend against it the next time around. How do I identify what kind of attach this is?

Also, what is the tilde doing in the URL path? I couldn't find any path like this on my hosting account, so I'm not entirely sure how to delete it.

2 Answers 2


If you do not recognize the username after the tilde, this is most likely an instance of a phisher exploiting a hosting provider's lax mod_userdir configuration (in conjunction with a reverse lookup of domains hosted on the server) - contact your hosting provider for assistance.

(You may want to mention mod_userdir by name - phishers have been using this trick on shared hosting for several years, so it's likely they'll already be familiar with it)

  • Hrmm... according to my research lax mod_userdir configuration is an information leak vulnerability. It allows hackers to test for usernames (and then from there try to crack the password through FTP, SSH, or some other method). How does an rDNS lookup help them get in? Commented Apr 16, 2012 at 13:34
  • @Lèsemajesté one compromised user account facilitates phishing attacks from every domain on the host. (The phishers themselves might pay - with a stolen credit card or PayPal account - for the hosting account to get access to all the domains on the host)
    – danlefree
    Commented Apr 17, 2012 at 4:35

Some of the answers to the following question might help you out: My website has been hacked/attacked, says "reported attack page"

Just to summarize some of the steps I posted there:

  • Change your FTP password, making sure you use a stronger one
  • Clean out any unfamiliar files
  • Verify any software (WordPress, Drupal, etc.) you have installed are up to date
  • Change hosts if your host was at fault

You might want to verify that it was your account, and not your host, that has been compromised. If you had a weak password or an out-of-date web application installed, then you should be able to simply work on your own security. If your host is insecure, there's very little you can do yourself to prevent your web site from becoming compromised as a result - get out, and get out fast!

  • Thanks. It looks like a problem at my web host, and they don't appear to be aggressive in fixing things. They certainly aren't informative. I've got an extremely simple page, with now software to update.
    – Suz
    Commented Apr 19, 2012 at 12:22
  • @Suz That's very worrying - if they're not taking a compromise like this seriously, I don't know if I'd trust them with my site. It might be time to research alternative hosts, I'm afraid. :(
    – Jacob Hume
    Commented Apr 19, 2012 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.