I’ve received complaints that sites hosted are getting blocked or coming up with omnious messages about malware, trojans, and viruses:
[INDENT]McAfee Site Advisor:
This link might be dangerous. We tested it and found security risks. Beware.
[/INDENT]
Going through their checks they report the server Web15.MyHsphere.biz ( 173.0.129.56 ) is on the CBL black list (just to be clear, the site the list is NOT mine or under my reseller account):
[INDENT]
IP Address 173.0.129.56 is listed in the CBL. It shows signs of being infected with a spam sending trojan, malicious link or some other form of botnet.
It was last detected at 2016-02-23 20:00 GMT (+/- 30 minutes), approximately 1 hours ago.
StealRat Infection
We have detected that this IP is NATting for, or is infected itself, with the “StealRat” malware. StealRat is usually found on UNIX or xxxBSD web servers running the Drupal, Wordpress or Joomla Content Management Systems (CMS).
In short, you have to:
Secure the computer against further reinfection - which means making sure that all CMS installations on the computer are up-to-date and kept up to date. Almost all Stealrat infections are via security holes in stale CMS software.
Find the StealRat infection and remove it.
The stealrat infection appears to be affiliated with the hostname phillytowing.com. If this domain is hosted on this IP address, this is the virtual host that is infected, and this information will help guide mitigate the security breach. If this domain isn’t familiar to you, it is co-hosted on the same IP address, and only your administrator can fix it.[/INDENT]
I see I can request a “de-list” but it’s pretty clear that without cleaning the problems eventually we won’t be able to de-list automatically.
Is this something I just submit via a ticket? It seems to be a server level issue, not an account issues, so I don’t want to confuse things by requesting this since it’s not literally on my account.
