I have a website in a shared hosting environment. Recently I found out that I can load other websites' contents using my own domain through URLs like
mysite.com/~othersite/. This has resulted in Google indexing a malicious phishing website through my domain and sent me warning emails about it.
Tech support say this is normal behavior and if it bothers me I should upgrade to a VPS. They confirmed that I cannot correct this in my own .htaccess file or by other means as this happens at a higher level.
My question: Is this the usual, best-practice configuration for shared hosting environments or is the hosting company incompetent (or deliberately creating inconvenience to motivate upgrading)?
Am I requesting something overly technically complicated when I say that content from website X should under no circumstances be returned when the request is addressed with the domain of website Y? Is this an unrealistic expectation in a shared environment?