Phishing Page on my PBN site

Walash

Regular Member
Joined
Dec 23, 2014
Messages
331
Reaction score
73
Hey guys,

So, I'm building a PBN and I have 14 domains doing well so far. I'm getting those cheap $10~15/year hostings from forums like Web Hosting Talk and others - doing exactly how explained here: different hosting providers, different registrars, some with WHOIS Protection others with fake WHOIS.

I ordered a new hosting package for $12/year from stallionhost.com and during the first few days everything seemed fine as they setup everything right. Their support was quite slow to answer, but that's expected with these cheap hosting companies.

A week later my website went down and StallionHost's website was down as well. Next thing my hosting account was suspended and when I opened a ticket to understand what happened, the support staff answered with this message:

You are hosting a spamvertised phishing site on your account. We received following complaint about your site.

************************************************We have received the following complaint for 107.150.35.50. Please investigate, take any necessary actions, and reply back to this email with full resolution details within 24 hours to avoid suspension and/or termination for TOS violation. In order to ensure all communication is received, please do not open a support ticket. Simply respond to this email and we will get back with you. Only open support ticket if you need a technician to suspend the server.

|----------------------------------------------------------------|

Below this line is an example of a complaint we have received:
Subject: [eBay:2ANID17JU435] URGENT: New eBay Phishing Site Report [107.150.35.50]
Body:
http://MYWEBSITE.COM/base/5/?eBayIS...yEbayBeta&MyEbay=&gbh=1&guest=1&pageType=3984

Dear DataShack,

We have just learned that your service is being used to display false or "spoofed" eBay.com pages, apparently in an effort to steal personal and financial information from consumers, including eBay users, in order to defraud them. Specifically, it appears that a DataShack user is sending unsolicited messages to consumers, misrepresenting itself as eBay, and making statements that encourage the recipient to go to a page hosted by you at

107.150.35.50 - http://MYWEBSITE.COMbase/5/?eBayISA...yEbayBeta&MyEbay=&gbh=1&guest=1&pageType=3984

MYWEBSITE.COM

to enter personal and account information. The deceptively gathered information is then sent to an email account and, based on our investigation of similar schemes, used to gain access to consumers personal accounts in order to commit fraudulent acts such as international credit card and wire fraud.

This matter is urgent - we believe that consumers have been falsely directed to this page and may be deceived into divulging personal information to a criminal if the page is not immediately disabled. We ask that you immediately disable the site at http://MYWEBSITE.COM/base/5/?eBayIS...bayBeta&MyEbay=&gbh=1&guest=1&pageType=3984as well as any associated email addresses, so that this fraudulent scheme can be stopped. We further request that you provide us with all contact information that you have for this user so that we may provide it to the proper law enforcement authorities.

We would also like to ask for you to assist us in educating consumers about phishing and how to protect themselves. To that end, we have set up an educational page at https://signin.ebay.com/ws/eBayISAP...bayBeta&MyEbay=&gbh=1&guest=1&pageType=3984to help prevent consumers from being victimized by phishing sites. We would greatly appreciate it, and think it would be enormously beneficial, if you would set up a redirect from the taken down fraudulent address to the educational page we have created, as default error messages such as "404 Not Found" dont educate the public about the dangers of phishing and fraud on the Internet.

We sincerely appreciate your immediate attention to this important matter. We would also appreciate if you would take steps to confirm the accuracy of any contact information that your user may have provided to you in establishing the account. Should you have any accurate information that could assist eBay and law enforcement in tracking this individual, we greatly appreciate your assistance, as we know that you do not condone the use of your services for such criminal purposes.

Thank you,

eBay Inc.
Trust & Safety

Now I'm a bit paranoid that my wordpress sites may be compromised by malware. I am not related to any phishing activities whatsoever. I already scanned my PC with several malware tools and all I got was negative for any kind of infection.

Could this be on the hosting company's end? As I mentioned, their website went down for around 2 or 3 days.
 
Last edited by a moderator:
Are you using any nulled themes or plugins?

Hey WILSON,

No, nothing. Just the regular 2016 wordpress theme.

The domain was actually newly bought and the website had no content yet. I never had this problem with any of the other 10+ hosting providers.
 
Last edited:
Hey WILSON,

No, nothing. Just the regular 2016 wordpress theme.

The domain was actually newly bought and the website had no content yet. I never had this problem with any of the other 10+ hosting providers.

I would contact the host and ask them to look into it, they should be able to tell you what happened.

Try scanning your other sites with these:
https://transparencyreport.google.com/safe-browsing/search
https://www.metadefender.com/#!/submit-ip
https://www.gravityscan.com/
https://sitecheck.sucuri.net/
https://www.virustotal.com/#/home/url
https://quttera.com/website-malware-scanner
https://app.webinspector.com
http://scanner.pcrisk.com/
http://www.urlvoid.com/
https://www.webconfs.com/google-malware-check.php
https://www.siteguarding.com/en/sitecheck

BTW You need to unlink the URLs you posted as they still link to the site.
 
I would contact the host and ask them to look into it, they should be able to tell you what happened.

Yeah, already did that but they keep closing my tickets without response. Do you think it could be on their end?


Thanks a lot for the list. I will do this.

BTW You need to unlink the URLs you posted as they still link to the site.

I can't edit the OP... :/ Shiet. Would any mods help me with this, please? @BassTrackerBoats @jazzc @Apricot

Thanks a lot, WILSON.
 
Last edited:
Yeah, already did that but they keep closing my tickets without response. Do you think it could be on their end?



Thanks a lot for the list. I will do this.



I can't edit the OP... :/ Shiet. Would any mods help me with this, please? @BassTrackerBoats @jazzc @Apricot

Thanks a lot, WILSON.


Report the post via the report button and a Mod will do it. I will report it too.
 
Yeah, already did that but they keep closing my tickets without response. Do you think it could be on their end?



Thanks a lot for the list. I will do this.



I can't edit the OP... :/ Shiet. Would any mods help me with this, please? @BassTrackerBoats @jazzc @Apricot

Thanks a lot, WILSON.
Report the post via the report button and a Mod will do it. I will report it too.
Sure, I unlinked every URL in your post. The forum automatically added a link to "mysite" rather than your actual website.
 
Hey Walash,
Did you got website back?
My site host on same IP too. Just know my website down today :(
I just waiting their answer.
 
Hey Walash,
Did you got website back?
My site host on same IP too. Just know my website down today :(
I just waiting their answer.

Yeah, I did. Moved to another provider and my virustotal URL scans are clean right now.

Lesson learned: be careful with these cheap hosting services. Choose the ones with a lot of background and choose to pay more to get something more reliable.

I suggest anyone to avoid using Stallion Host, they are not realiable and the infection came most likely from their servers. They are also VERY slow to answer tickets (over 72 hours).
 
Yeah, I did. Moved to another provider and my virustotal URL scans are clean right now.

Lesson learned: be careful with these cheap hosting services. Choose the ones with a lot of background and choose to pay more to get something more reliable.

I suggest anyone to avoid using Stallion Host, they are not realiable and the infection came most likely from their servers. They are also VERY slow to answer tickets (over 72 hours).

Ticket is open. but my website is up now and i can login to cpanel via client area. i can't login cpanel via their IP because security warning but i can login via their URL. everything is ok for now.
 
Will never touch them again.
Hosted 4 pbns there for a year and Noticed that they've accidentally deleted everything about 1 month after shit happened.
After that its been down like 4 times 4-5 days last 6 months and now everything is gone and their site has been marked as malware. So now I need to set up all sites on new hosting but seriously this has damaged my serp a bit thats why I started digging and even found out about it because no mail has gone out from their side either.

Never will I use chepa hosting again. Learned the hard, its more expensive to rebuild and just send mail with crappy responses and a week response time if you're lucky...
 
I just found this thread because I had a site hosted at StallionHost.com and it disappeared but I found it was because the domain expired. I raised a high priority support ticket 55 DAYS AGO and no reply?! I just emailed [email protected] (published on their site) and it immediately bounced, no such email at this address. Are they out of business? I have found loads of these cheap hosts have died recently but they are quite fu**ing happy to keep TAKING PAYMENTS! Anyone know more?
 
Back
Top