Community archive

Ask something
Discussion Locked

Webmasters Phishing Protection

0 helpful
8 replies

by ron351

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am hosted on Ipowerweb servers and my site was suspended due to phishing from my site.
Now, 3 months later it is suspended again they say for phishing.
Is there a way to know when someone is using your site to phish?
Is there a way to protect your pages so they can not be used for phishing?
I find so many softwares to detect phishing, but nothing to prevent it.
Any professional programmers out there or coders that can help with my question is greatly appreciated.
Ron

8 replies

by dr dij

hacked in and actually changed your site, there is a service / software that runs, I think is an ASP. It scans your pages at intervals you specify. If anything has changed in places you specify, it re-uploads the pages (and notifys you). This was a couple years ago, I don't remember its name.

and current issue of informationweek.com lists new anti-phishing orgs that will provide website owners with notification they are being phished (at another site probably, and maybe the owner of phishing site too if they're not involved)

If they didn't actually change your page, then you were 'framed' i.e. they sent out emails listing your web address on phishing link but links don't work; but your site would be useless for their phishing purposes so is unlikely they did that. I'd change your password, and put longer one in place also.

by ron351

Ipowerweb did not give me details of the phishing, only that my site was suspended and they have to delete everything in the public_html directory.
I did change my passwords and rebuilt the site entirely in late december and thru january.
My site was not hacked that I noticed or were there any changes to the pages that I had seen.
I assume that if the phisher did use the view/source and copied and pasted the source code to wordpad or notebook and saved it as a html page, that would duplicate my site, and if they added a form to that page they produced and sent it out to gather credit card info or whatever and the form sent the info back to them, I would have no idea this is being done.

My server dont have ASP that I know of.

I am just so afraid to rebuild again and in a couple of months loose it all again.

It seems a loss to try without a way to keep phishers from grabbing source code and reproducing the info for bad intent.

I will look into your suggestions though.
Thanks,
Ron

by dr dij

they shouldn't have disabled your account if the phishing action was taking place on another website that copied your site.

they don't disable citibank website if phishers copy the site to somewhere else.

The only way to prevent copying your source is to have it hidden by executing queries, etc on the server. you can also put stuff in java apps, etc, that can't be viewed easily even tho they execute on the pc end.

They could be disassembled tho, which is doable for hackers but beyond the common person.

Were they accessing a database on your site from the copy site somewhere else? again, you'd have to put the query code on server to prevent someone from accessing your databases from other than your user interface via web pages.

I have people sending out spam in my domains name. They didn't hack me. They simply fake the email return address. Only one list was stupid enuf to block email from my domain. I mentioned that they were faked to him but he didn't investigate carefully the headers. I don't really care as I don't send out email from my domain name.

here's the new anti-phishing orgs link:
http://blogs.zdnet.com/Spyware/

Good luck!

by ron351

I wouldnt know how to put querry strings in the server.
Bad thing is, I am paid for hosting the domain until august, paid for a year, and dont want to waste that and move on to a different domain name.
It seems to me like someone is following my domain and copying the source code of the page and re using it to do this garbage.
If it was easy, I could change the domain name, but doing so will force you to re buy again.
Thats why I am looking for solutions to hiding the source of the web pages or some way that no one can pretend to me my domain.
All anyone has to do is look at the status bar and see where the link is taking them to, but I am not that lucky, evidently someone may of clicked the link or whatever and reported it.

I agree with you about citibank, also paypal and ebay, I get spoofed sites in my email almost daily from them and they are all out to philsh people.
I forward every one to paypal and ebay spoof, and it dont seem to stop them.

My site was nothing big, just stuff about the campground we go to and a games section basically. I have no idea why they would want to use my site to do these things.
Ron

by dr dij

what is happening?

If it is someone else's site why do you care?
And why would an ISP be kicking you off?

You'd have to put the sql queries on the server side, but most database access sites do this.

If they copied your site that might be copyright violation but certainly is not phishing. If the other site installs spyware, still nasty but not your problem..

by ron351

I don't care about their site, but I have to care since it shut mine down.
I dont think it is as much as copywriting, as much as what phishing is, is where if someone copied some of my site, and added a link to log in and reconfirm credit card info or other account info.
That would indeed be phishing.
I have no idea what or where this was done because ignorant ipowerweb never sent me proof of anything.
So I am out of my site and got it back now with nothing in it, I now have to rebuild it from the floor up once again, and I just got done building it from Decembers shut down.
Took 2 months to rebuild.
I think it was wrong to delete all my site, but they have the controls.

by dr dij

you should try and figure out totally what they did. possibly goto police if they defrauded someone. so you're selling something and some spoofed your site sounds like?

of course you know, some things the police aren't too knowlegable about, and likely will not go after them unless is huge site and banks, things like that. If you sign up with another site, explain to them what happened, that it was not you but some phisher, and get them to agree not to shut you down if something similar happens again.

It takes a good deal of planning to do a secure site. If the phishers were actually placing orders on your site from their fake site then you have serious problems.

Good e-commerce sites have all the query stuff hidden I think, otherwise people can do 'sql injection' hacks into your site. They can change the sql in the web page if they can see it, and get info out of or change your database. If this happened, you need to totally redo your site to prevent things like this.

by kalealcrooks

icouldnt figure out how to contact either of you two directly but i found my self in a similiar situation in may 2006...

i was accused of sending bank of america emails, and my site was suspended, and i had to go through a whole mess of problems to get it back up.

this month, june 2006, i was accused again and this time my account was suspended for good (my host is canaca.com) i still have 6 months paid for with this host and domain, but now i am stuck.

The only thing they allowed me to do was download my stuff, and in the process i have found folders for wells fargo, bank of america, and halifax... my site however has a policy in which i am responsible for all content on the site, despite the fact that, i knew nothing about phishing what so eveer prior to these two incidents.

Now I am considering moving to a new host, because they apparently do not help you defend your site, will not help you find vulnerabilities in your scripts, and only have a 2 strike rule, on top of the fact that they outsource so their phone support doesnt speak good english.

Can anyone suggest what i can do to prevent this from happening? I run a music based site with a phpbb forum, streaming and downloadable audio and video, and over a GIG of content. redoing this is becoming a real inconvenience, and it has also hindered my email capabilities among other things.

This is a very bad situation to be in because for 2 years we had no down time, and users who see "account suspended" have doubts about your reliability.

Any Help would be appreciated.

This discussion is closed to new replies.