Phishing Sites on Gnome

Several accounts have been reported on this server as having fraud sites (of banks, Paypal, etc) and the server has been put on probation by the data center for cancellation.

We encourage all our clients to manually check their accounts for suspicious files or scripts not belonging to their account. We do not want this server to be disconnected by the data center for repeated offense.

April 19th, 2009

Phishing Attack on Gnome

Today, the Data Center has shut down the Gnome server (72.232.186.26) for several hours after discovering two accounts from our clients hosting a phishing website for Bank of America and Wells Fargo.

We coordinated with the DC engineers to get the server back online so we could investigate and remove the phishing sites.

It turns out that the two accounts by clients have folders that were open and allowed culprits to upload a zipped file of the fake website and extract them. We have deleted the files and secured the folders. We’re still looking into other client accounts that may have similar cases.

We request all clients to regularly and actively check their accounts for open folders (CHMOD them to 644) and update any add-on scripts or web apps they have installed so to avoid similar incidents in the future.

April 5th, 2009

Phishing Site on Gnome

The Gnome server was temporarily shut down by the Data Center for a phishing site made by one of the new clients placed on this server. We were informed of the enforcement policy very late in the evening and was unable to act on it in two hours prompting the DC to disconnect the server so the site cannot do any damage.

We will be very vigilant to impose suspension on sites that could case a similar incident int he future. However, even if this problem was caused by a single client, it dragged along with it all other hundreds of clients in the server.

February 11th, 2009