investigating and i find a discrepancy.Curious what to do

dad · December 8th, 2007, 5:35 PM

i have been having some problems with my server as of late. this week one of my customers accounts got suspended as it was sending enormous amounts of email. i checked today and there was a lot in the mail queue and checking most of them was the same email.. one about money needed to get a share of a frozen account

Anyways.. i did some checking and found this discrepancy. in my "list accounts" all subdomains appear as an account. the site that got suspended and unsuspended has one that isnt there. However if i check "list subdomains" there is one there and when i click on it.. it goes to this page. http://www.dimenoc.com/antiphish/?

i check with the customer and they have no idea about that account... and i frankly dont know how it got there. i realize that i should just delete it but how do i prevent subdomains automatically from being created? i cant find a creation date.

(anyone seen my colo around there yet? i dont have a tracking # as i ordered it from the american side of tigerdirect and it wont integrate Canadian customers and American orders, it was shipped out on Dec 5)

**Mike** · December 8th, 2007, 5:54 PM

We redirect to dimenoc.com/antiphish when we receieve a report of a phishing site on our network. Chances are the account or subdomain has insecure software and permissions and was exploited.
Please check in with our abuse and security team and report these problems and we will take care of them for you.

**removed** · December 8th, 2007, 5:55 PM

I took action against the spammer and the phishing site you are talking about. The directory in question was created because of some insecure permissions on your customer's account. Our standard procedure is to secure the account and redirect the phishing site to http://www.dimenoc.com/antiphish/ in an attempt to educate visitors about the evils of phishing.

As for your server, please get in touch with TigerDirect and have them send you a tracking number. We'll keep an eye on it as soon as you send me the tracking number.

dad · December 8th, 2007, 6:20 PM

i thought that the issue had been fixed the other day as i saw the suspension was unsuspended by the time i got the notice. i thought that the/designer shoutbox had been the issue. ill leave that subdomain open until i hear back from abuse/security with the ticket i submitted.

(removed.. i got a tracking number no shipping number... ill phone and see if i can get the Canadian customer doesnt get a shipping number persecution thing fixed)

December 8th, 2007, 5:35 PM	#1 (permalink)
dad Registered User On a golden path... Joined in Jan 2004 Lives in orillia canada Hosted on solacehosting 408 posts Gave thanks: 3 Thanked 16 times	investigating and i find a discrepancy.Curious what to do i have been having some problems with my server as of late. this week one of my customers accounts got suspended as it was sending enormous amounts of email. i checked today and there was a lot in the mail queue and checking most of them was the same email.. one about money needed to get a share of a frozen account Anyways.. i did some checking and found this discrepancy. in my "list accounts" all subdomains appear as an account. the site that got suspended and unsuspended has one that isnt there. However if i check "list subdomains" there is one there and when i click on it.. it goes to this page. http://www.dimenoc.com/antiphish/? i check with the customer and they have no idea about that account... and i frankly dont know how it got there. i realize that i should just delete it but how do i prevent subdomains automatically from being created? i cant find a creation date. (anyone seen my colo around there yet? i dont have a tracking # as i ordered it from the american side of tigerdirect and it wont integrate Canadian customers and American orders, it was shipped out on Dec 5) __________________ "colocation" is a nice way to say im codependant on surpass www.solacehosting.com www.christopherforlife.com

December 8th, 2007, 5:54 PM	#2 (permalink)
Mike Surpass Staff Excelling Contributor Joined in Jun 2005 Lives in surpass headquarters 929 posts Gave thanks: 55 Thanked 90 times	We redirect to dimenoc.com/antiphish when we receieve a report of a phishing site on our network. Chances are the account or subdomain has insecure software and permissions and was exploited. Please check in with our abuse and security team and report these problems and we will take care of them for you. __________________ Surpass Special Operations

December 8th, 2007, 5:55 PM	#3 (permalink)
removed Surpass Abuse Admin Super #1 Joined in Mar 2005 Lives in Houston, TX 7,574 posts Gave thanks: 10 Thanked 263 times	I took action against the spammer and the phishing site you are talking about. The directory in question was created because of some insecure permissions on your customer's account. Our standard procedure is to secure the account and redirect the phishing site to http://www.dimenoc.com/antiphish/ in an attempt to educate visitors about the evils of phishing. As for your server, please get in touch with TigerDirect and have them send you a tracking number. We'll keep an eye on it as soon as you send me the tracking number. __________________ Surpass Abuse & Security unofficial IRC chat: #surpass irc.blessed.net (efnet)

December 8th, 2007, 6:20 PM	#4 (permalink)
dad Registered User On a golden path... Joined in Jan 2004 Lives in orillia canada Hosted on solacehosting 408 posts Gave thanks: 3 Thanked 16 times	i thought that the issue had been fixed the other day as i saw the suspension was unsuspended by the time i got the notice. i thought that the/designer shoutbox had been the issue. ill leave that subdomain open until i hear back from abuse/security with the ticket i submitted. (removed.. i got a tracking number no shipping number... ill phone and see if i can get the Canadian customer doesnt get a shipping number persecution thing fixed) __________________ "colocation" is a nice way to say im codependant on surpass www.solacehosting.com www.christopherforlife.com

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)