I got an alert from Google Webmasters. They say the following file was present in my host:


I checked my files and it never existed at all.

I've experience this problem in two different host and domains but the file never existed in my file system.

It appears somebody out there is linking a random domain and it prefixes the link with /~jhostgop/identity.php. Now Google may have indexed them so now I get those false phishing alerts.

Anyone experienced this? Is it possible to prevent this?

  • A file does not necessarily have to be physically on your file system for an external site (ie. Google) to identify it as a file. If your .htaccess file has been hacked, for instance. If "somebody out there" is linking to a non-existent file (and Google has crawled this link) then you should be seeing this in your 404 report? – MrWhite Jan 8 '13 at 9:05
  • ...So Google thinks you've been serving a phishing like attack from this URL?! – MrWhite Jan 8 '13 at 9:12
  • @w3d actually I don't have htaccess file because I'm using Nginx (not Apcahe). It does appear in my error log. Yes Google thinks so. – IMB Jan 8 '13 at 9:51
  • How sure are you about the "never" part? If I were trying to be a sneaky phisher, I'd only keep my pages up for a day or two before deleting every trace of them I could. – Ilmari Karonen Jan 8 '13 at 20:41

They malware might have infected the .htaccess on your site to redirect, identity.php to something else without ever touching the file system. Or it could be a hack into the PHP code to capture calls to identity.php and do something wit it.

I would recommend your best course of action is to download the whole site codebase & do a search for identity.php or perhaps even base64_encode or base64_encode since much malware is obscured from pure text searches because of base64 encoding.

Forensics like this is tedious, but if it’s happened to you more than once you need to dedicate some time to go through all your code to find the infection.


Here is a list of things that I would do if I were you:

  1. Change all the login details to the server including but not limited to FTP, SSH and login details to the CMS if you use any.

  2. Disallow example.com/~jhostgop/identity.php in your robots.txt.

  3. In Google Webmaster Tools, submit a page removal request for example.com/~jhostgop/identity.php

These above steps should stop Google from displaying such messages in future. However, the ultimate solution to this would be to identify the security loop hole and fix it, which can only be done with a detailed examination of logs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.