phishing attack

doodlebug · Jan 21, 2012

I got a message from [email protected] saying that my site greatlever.com is a suspected phishing site ?

It's not but what can I do about this ?
It's only happened since I launched a pop3 account Yesterday which is admin(at)greatlever.com

Could be related to one of my aff banners ?

Anyone shed some light please ?

Brassneck · Jan 21, 2012

Are you sure it is from Google? I've had messages saying I have been banned from Adsense but they were fake.

Hope it is a fake.

Stephen

Brassneck · Jan 21, 2012

PS. Your site is still indexed - I would assume Google would deindexed such sites pretty quickly if they were a real threat.

wb · Jan 21, 2012

Carefully check through all the files on your server to make sure you haven't been hacked and had phishing files uploaded (could be located in obscure directories to hide them, looking at modified dates should help).

doodlebug · Jan 21, 2012

Brassneck said:
PS. Your site is still indexed - I would assume Google would deindexed such sites pretty quickly if they were a real threat.

The sender address is from [email protected] and I hovered over the link and that's what it says

It does contain a link saying click here to the warning signs shown on Google but I got suspicious and didn't click it.

I checked SERPS and I am still happily ranking for certain terms, there is no warning sign against the results and no message in my Adsense account, in fact I am pretty sure that my G ads would have been removed from my site.

Looks dodgy and I'm inclined to ignore it for now, Google have my mobile phone number if it bothers them that much.

Thanks for your replies Stephen

doodlebug · Jan 21, 2012

wb said:
Carefully check through all the files on your server to make sure you haven't been hacked and had phishing files uploaded (could be located in obscure directories to hide them, looking at modified dates should help).

Going to look through my files but I use a site create and don't have full access to them so going to contact the site provider asap.

Thanks

Brassneck · Jan 21, 2012

doodlebug said:
The sender address is from [email protected] and I hovered over the link and that's what it says

It does contain a link saying click here to the warning signs shown on Google but I got suspicious and didn't click it.

I checked SERPS and I am still happily ranking for certain terms, there is no warning sign against the results and no message in my Adsense account, in fact I am pretty sure that my G ads would have been removed from my site.

Looks dodgy and I'm inclined to ignore it for now, Google have my mobile phone number if it bothers them that much.

Thanks for your replies Stephen

Check out the source code for the email - you might be able to work out where the email really came from.

wb · Jan 21, 2012

Also, check the website on Google Webmaster Tools as it should show a warning on there too if genuine.

Lovekraft · Jan 21, 2012

I usually find copying and pasting the exact wording of the email into google will bring up similar cases if it is a phishing attack.

doodlebug · Jan 21, 2012

Thanks for your replies, am waitin for a reply from my host but could be monday

I wont lose any sleep for now, bloody nightmare !

doodlebug · Jan 23, 2012

Update

I have checked against these and all say clean >

Google diagnostics
scumware
Norton safeweb
SURBL
Phish tank
Zeus tracker
web security guard

And also scanned for viruses in files and URL and all say clean so it looks safe to me

Thanks for all your replies

keano · Jan 24, 2012

If there is a link in the email purporting to be from Google but you don't (understandably in the situation) want to click it you may want to put the link through a server header checker tool so you can find where the URL actually goes to safely.

Something like http://www.seoconsultants.com/tools/check-server-headers-tool/ will do the job. You should then be able to see whether its a legit Google advisory or if the link redirects off to some dodgy place.