Welcome to RCF - WHF

fishead · Feb 09, 2005

Someone is phishing my banner on my os store, it is not published, not using it, but they did it. IX wrote me last week so I deleted the catalog and thought it was solved but wasn't. I saw it was still up and couldn't delete it this morning, it comes right back. I went into cp and deleted the two sql dbases for os store, one being catalog, but still couldn't delete the catalog from directory so went into webshell and was able to delete contents of the catalog but not the folder itself now the image folder but images were all deleted ok. Anyway, it was the IRS and ...... man I should have kept a closer on this, I thought it was fixed but wasn't. I think it is all deleted now. I got an email from IRS this morning wanting all the files and asked me to delete the catalog and files. Thats how is being compromized.

fishead · Feb 09, 2005

I guess thats my server being compromized:

" One of your servers has been compromised and is being used to host an Internal Revenue Service phishing site, the site is located at
removed
Please take immediate action to remove this content from your site. If at all possible could you please zip or tar up all files associated with this scam and email them to me? If you have any questions or comments please feel free to contact me."

rb2d2 · Sep 25, 2004

Wait a minute Dave!! Who is sending you that email??? DON'T be sending anything to anybody until you are sure of what you're doing or until you call IX and talk to them. I think those files would give someone access to your entire site.

Shocked

mojo · Feb 03, 2007

that sounds fishy.

rb2d2 · Sep 25, 2004

I don't think the IRS sends people emails.......

dontknow

fishead · Feb 09, 2005

removed

fishead · Feb 09, 2005

Thats what the scammer was doing rb, sending boguss emails to people and they were getting their personal account info and doing this in my name.

The irs guy wasn't the first to write, IX was. At first I didn't send him anything but after checking it out he is for real. We have been communicating. If I hadn't done anything I would have been in trouble. I heard about this scam going on but had no idea.....

fishead · Feb 09, 2005

David,
Some definitely hacked into your site I am not sure exactly how they did it since I have not tested your website but they got in somehow. The real issue here is if you don't find how they got in they will most likely come back and do it again. I would definitely start with changing all your passwords and making sure everything is up to date. You should probably also see about getting someone to test your site for vulnerabilities to ensure there is no way they can get back in.

-----------------------

removed

rb2d2 · Sep 25, 2004

That's down right scary!

Shocked

Nightrider · Sep 25, 2004

So did you get this problem resolved???

dontknow