up vote 1 down vote favorite
share [g+] share [fb]

Last week a server has been compromised. I have since fixed the problem, however the attackers managed to get my IP blacklisted. I have contacted all the blacklists I could find that listed the IP to get it removed.

Could anyone advise me if there are any other steps I need to take or someone I need to contact, as the full URL still shows the Phishing warning in most browsers. Some of my clients and partners also say that when accessing the domain from their network the dangerous website warning appears when accessing the homepage.

Any help or advice you might have would be greatly appreciated.

link|improve this question
feedback

1 Answer

up vote 1 down vote accepted

I went to this URL in Firefox 3.6 and clicked 'Why was this site blocked?' which brought me here:

http://www.mozilla.com/en-US/firefox/phishing-protection/

There is a link about 'how do I remove this site...'

Also I noticed that your main page is not flagged, just the bad URL in question, so it may be a non-issue?

Also it's generally considered best-practice not to have SSH open on the front-end. My money is on brute-force/known-account attack over SSH.

link|improve this answer
You can have SSH available if you A) have a strong password, B) add a program like Denyhosts to auto-ban failed logins after two or three attempts, and C) move SSH to a different port to discourage automated attacks. Didn't anything show up in the logs? (I know they can be wiped, but did the OP see anything in the logs for attempts?) My first thought was that there was a bug in the website that allowed access, but he didn't say if he was running PHP or a database or something like that... – Bart Silverstrim May 26 '10 at 10:08
Agreed, Bart. I prefer just to block SSH at the firewall level and sleep better at night. I'm sure OP is looking into these logs (I hope! :)) – Kyle Smith May 26 '10 at 10:14
My money is on a vulnerability in the prototype application or its dependencies but.. sure, if the ssh login was easily brute-forced, why not ^^ – Oskar Duveborn May 26 '10 at 11:14
feedback

Your Answer

 
or
required, but never shown
discard