Announcement

Collapse
No announcement yet.

Phishing Sites

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Phishing Sites

    I have had emails from google saying that 3 of my domains are phishing websites. Which of course they are not. So I did a bit of investigating.

    The email from google said my page had been reported as a phishing page, even tho the page doesn't actually exist
    http://www.mydomain.co.uk/~purefant/...ion.com.uk/en/

    I have a custom 404 page which emails me what the page was they were looking for and who was looking. Yesterday I had 14 emails looking for this

    mydomain.co.uk/~purefant

    The info I got was this

    Tue Mar 16 2010 7:38:49 am UTC

    66.113.102.253 tried to load mydomain.co.uk/~purefant

    User Agent = Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/417.9 (KHTML, like Gecko) Safari/417.8
    then the following all from the same ip

    User Agent = Mozilla/5.0 (compatible; Fedora Core 4) FC4 KDE
    User Agent = Mozilla/5.0 (compatible; AOL-IDSol 4.1.1 Fedora Core 3) FC3 KDE
    User Agent = Mozilla/6.0 (compatible; MSIE 7.01; Windows NT)
    User Agent = JetBrains 3.1
    User Agent = JetBrains 5.0
    User Agent = Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)
    User Agent = Mozilla/6.0 (compatible; Amiga-AWeb)
    User Agent = Mozilla/6.0 (compatible; MSIE 7.01; Windows NT)
    User Agent = Mozilla/5.0 (Macintosh; U; PPC Mac OS X; fr-fr) AppleWebKit/312.5 (KHTML, like Gecko) Safari/312.3

    The ip address relates to these people Internet Identity - Home
    but I don't see why they would be searching for this specific string "~purefant" and then reporting my sites even though they don't have it.

    when I go to the page with opera I get redirected to opera:fraud-warning with a link to continue (which of course gets my 404 page) and this warning comes from Netcraft - Internet Research, Anti-Phishing and PCI Security Services

    I can't see a link between the 2 companies and don't think filling the net with INCORRECT information is really helpful. The reason I post here is the 3 domains affected are all with webhosting uk I have had none of these from my other host.

    If anyone can think of a way to stop this I would appreciate knowing or can webhosting uk block this IP from trawling their domains?

    TIA

  • #2
    Just received another

    Tue Mar 16 2010 8:50:47 am UTC
    66.113.102.253 tried to load mydomain.co.uk/~purefant
    User Agent = Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)

    Tempted to create that page and tell them to phish off

    Note: I have now
    Last edited by Foddski; 16-03-10, 09:31 AM.

    Comment


    • #3
      Right Google is going through a lot of changes. I think it might be a case of your competition trying to get your website in trouble or something. That is the only thing that I can think of off the top of my head.

      Comment

      Working...
      X