How to handle a phishing abuse report for your server

If you receive a phishing abuse report for a site on your Hostking server, remove the phishing content first, then find and close the way it got in. This article explains the steps for cPanel and DirectAdmin accounts.

What a phishing abuse report means

A phishing abuse report asks the host to remove a fake page or login form from its server. The report usually lists the web address (URL) of the page and the evidence. It also gives the reporter's contact details so you can reply.

The report concerns the content, not your whole account. Visitors may still see browser or search warnings after the page is removed. Those warnings are cleared separately, as described in the final steps below.

Steps to handle the report

1. Log in to the client area at https://my.hostking.host and find your login details in your welcome email.
2. Find the page named in the report and confirm whether it is on your account.
3. Take the phishing page offline. Remove public access to it straight away.
4. Copy the suspicious files and folders into a separate folder outside the public web root. Keep this copy as evidence.
5. Note the date and time you took the page offline.
6. Delete the phishing files and folders. Do not rename them, because renamed files can still be reached.
7. Check for other unknown files, such as hidden scripts or extra admin pages, and delete them.
8. Change every password that could give access to the site.
9. Remove any admin users you do not recognise.
10. Update your site software, including the CMS core, themes and plugins.
11. Check that your site works and that the phishing page no longer loads.
12. Reply to the reporter, saying that the content has been removed and what you changed.
13. Request a review of your site in Google Search Console and Microsoft SmartScreen, if warnings still show.

Find the cause of the attack

Most phishing pages are placed through out-of-date software. A plugin, theme or CMS that has not been updated is the most common entry point.

If you remove the files but leave the entry point open, the phishing page can return. Check which plugins and themes are installed and whether each one is current.

cPanel

1. Log in to cPanel.
2. Go to Security > Manage API Tokens.
3. Revoke any API token you do not recognise. Click Revoke, then confirm with Yes, Revoke The Token.
4. Change your cPanel password.

DirectAdmin

1. Log in to DirectAdmin with your account details.
2. Change the password for the DirectAdmin login.
3. Change the password for any email account that may have been used.

Stop spam sent from your email accounts

If the phishing emails were sent from your server, an email account may have a compromised password. On DirectAdmin, the server can block SMTP authentication after suspicious activity. A standard password change unblocks the account.

If the account is blocked and you cannot unblock it, contact support. Check the mail log for details of the activity.

Troubleshooting

• The phishing page came back. The entry point is still open. Check every plugin, theme and CMS version, and remove any you do not use.
• Visitors still see a warning. Browser and search warnings can take time to clear. Request a review after the site is clean.
• You cannot find the files. Check the copy you saved, and ask support if you need help locating files on your account.
• Your email account is blocked. Change the email password. If the block remains, contact support.

If you are still stuck, contact support using live chat on the website or a support ticket from the client area at https://my.hostking.host.