5

I received an email from Google that there may be phishing pages on my website. Below are example URLs on my site which may be part of a phishing attack: http://www.uooart.com/~impots/file/cdc61d45beba0a37b108040b9b35d257/redirection.php

http://www.uooart.com/~impots/file/cdc61d45beba0a37b108040b9b35d257/redirection.php?g4d3bdOsiuarHDdBl0bEP6dBVy_wP1WJ6XZDh7nemRp9bv2mHJ0HYZaZV6xWExsS

When opened using Chrome these page show phishing alert and when skipped they get redirected to www.uooart.com/cgi-sys/suspendedpage.cgi which further have links on this site fwdssp.com

Now I want to solve this problem but I can't delete those files because I can't find any "~impots" (www.uooart.com/~impots/) directory in my Cpanel File Manager. The directory www.uooart.com/cgi-sys do exist but it doesn't have the "suspendedpage.cgi" file.

I even tried a wildcard redirect of uooart.com/~impots to uooart.com but it doesn't work.

  • 1
    Are you on a shared host? I assume "impots" is not your username? "~impots" looks like the "virtual directory" for perhaps another user's account on the same server? However, it shouldn't be possible to access another user's account via your domain in this way - if this is the case? Unfortunately, there have been other questions that suggest that this does happen. – MrWhite Sep 27 '15 at 10:17
  • Yes, I am on a shared host. I contacted my hosting provider's support and they said that they can't do anything in this matter. – user221458 Sep 27 '15 at 15:36
  • 1
    Yes they can! They just don't want to. However, it is their responsibility to you and the Internet as a whole. If they continue to refuse to at least explore the problem thoroughly with you to find an answer, then switch hosts without apology or sorrow. – closetnoc Sep 27 '15 at 16:05
  • Ironically, I am using one of the best shared hosting provider i.e. Hostgator. I doubt they may have done this themselves to promote their other website security services. – user221458 Sep 28 '15 at 3:22
  • Unfortunately this is not uncommon on shared servers. It is this "feature" that allows you to access your site before your domain resolves ie. http://<server-ip>/~username (although accessing your site by IP can be blocked). However, as @closetnoc suggests, I'm sure there must something the host can do to prevent such cross-site access. There is also the other question of how Google actually managed to find these URLs - my guess is that your domain was specifically targeted. (?) – MrWhite Sep 28 '15 at 9:01
3

These files were never on your account, they were hosted on another account on the same (shared) server with username "impots".

On many shared Apache servers you can access your account's files by a URL of the form http://<server-IP>/~username (a feature known as "per-user web directories" handled by mod_userdir). This allows you to access your website before your domain resolves (although there are much better methods to do this). Unfortunately this also seems to allow you to access accounts from any domain on the shared server (the domain resolves to the server's IP address) - which is what's happening here. Whether this is an outright configuration error on the server I'm not sure, as I have experienced the same "setup" on several shared hosts. It is certainly a potential vulnerability; as you have found! However, the host certainly has it in their power to disable this feature on your account:

UserDir disabled <your-username>

Now I want to solve this problem but I can't delete those files...

The files have already been removed by the host. As you have found, when you bypass the warning in Chrome you get the account-suspension page.

When opened using Chrome these page show phishing alert...

This is a problem as it's Chrome's own "malicious site" protection that is displaying this alert. No external request to your server is even made, so there is no request that can be blocked or redirected.

Unfortunately I think only "time" will heal this error, as your site (or specifically, these URLs) are recrawled. Can you "mark as fixed" these errors in Google Search Console?

To prevent such URLs being crawled (and hopefully indexed) by the search bots, you could add a Disallow: /~ rule to your robots.txt file. However, this obviously won't prevent the content from being served.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.