{"id":3889,"date":"2018-01-29T15:34:31","date_gmt":"2018-01-29T22:34:31","guid":{"rendered":"https:\/\/www.whitefirdesign.com\/blog\/?p=3889"},"modified":"2018-01-29T15:34:31","modified_gmt":"2018-01-29T22:34:31","slug":"bluehost-still-trying-to-sell-unneeded-sitelock-security-services-based-on-phishing-emails","status":"publish","type":"post","link":"https:\/\/www.whitefirdesign.com\/blog\/2018\/01\/29\/bluehost-still-trying-to-sell-unneeded-sitelock-security-services-based-on-phishing-emails\/","title":{"rendered":"Bluehost Still Trying To Sell Unneeded SiteLock Security Services Based on Phishing Emails"},"content":{"rendered":"

Back in August we discussed a situation where the web host Bluehost had tried to sell one of their customers a $1,200 a year SiteLock security service based on the customer having received a phishing email<\/a> that was supposed to have come from Bluehost. It obviously didn’t paint too good a picture of Bluehost, as despite it seeming that these phishing emails were rather common, they didn’t even do any basic checking on the claimed situation in the phishing email before trying to sell someone on an expensive security service that didn’t even have seem to have a connection to the issue mentioned in the email.<\/p>\n

Fast forward to this month and it is still happening. We recently had someone contact us a looking for advice after having gotten an email they thought was from Bluehost about malware on their website and then when they contacted the real Bluehost, it was recommended that they spend $49 a month on a SiteLock service that was supposed to fix that. Before we even looked at the email that was supposed to have come from Bluehost, things seemed off since the person that contacted us said that the whole account had been disabled, but in our experience Bluehost only shuts off access to the websites, not other forms of access to the account. That seems like something a Bluehost employee should have also been aware of.<\/p>\n

Looking at the email (shown below) we could see it was a phishing email as one of the links in it was to the website my.bluehost.com.f33ba15effa5c10e873bf3842afb46a6.co19331.tmweb.ru instead of my.bluehost.com.<\/p>\n

Your account has been temporarily deactivated due to the detection
\nof malware. The infected files need to be cleaned or replaced with clean
\ncopies from your backups before your account can be reactivated.<\/p>\n

Examples:<\/p>\n

\/domain\/[redacted]\/public_html\/config.php.suspected
\n\/home1\/[redacted]\/public_html\/post.php.suspected<\/p>\n

\/home1\/[redacted]\/public_html\/administrator\/components\/com_weblinks\/tables\/s
\nession.php<\/p>\n

To activate your account, please visit our BlueHost account reactivation center. Use the link below:
\nhttp:\/\/my.bluehost.com.f33ba15effa5c10e873bf3842afb46a6.co19331.tmweb.ru\/server\/1012\/reactivation.html<\/p>\n

To thoroughly secure your account, please review the following:
\n* Remove unfamiliar or unused files, and repair files that have been
\nmodified.
\n* Update all scripts, programs, plugins, and themes to the latest
\nversion.
\n* Research the scripts, programs, plugins, and themes you are using
\nand remove any with known, unresolved security vulnerabilities.
\n* Remove all cron jobs.
\n* Secure the PHP configuration settings in your php.ini file.
\n* Update the file permissions of your files and folders to prevent
\nunauthorized changes.
\n* Secure your home computer by using an up-to-date anti-virus program.
\nIf you are already using one, try another program that scans for
\ndifferent issues.
\nYou may want to consider a security service, such as SiteLock, to scan
\nyour website files and alert you if malicious content is found. Some
\npackages will also monitor your account for file changes and actively
\nremove malware if detected. Click here to see the packages we offer:
\nhttps:\/\/my.bluehost.com\/cgi\/sitelock<\/p>\n

Please remove all malware and thoroughly secure your account before
\ncontacting the Terms of Service Department to reactivate your account.
\nYou may be asked to find a new hosting provider if your account is
\ndeactivated three times within a 60-day period.<\/p>\n

Thank you,<\/p>\n

Bluehost Support<\/p>\n

http:\/\/www.bluehost.com
\nFor support, go to http:\/\/my.bluehost.com\/cgi\/help<\/p><\/blockquote>\n

That all seems like a good reason to not use Bluehost. As for SiteLock it isn’t like they are an innocent victim in this, as the majority owners of SiteLock also run the Endurance International Group (EIG), which is the parent company of Bluehost and numerous other web hosts<\/a>. SiteLock also pays a majority of the their inflated prices to web hosts<\/a>, which certainly could create an incentive to sell unneeded services.<\/p>\n

This is also a good example of why anyone contacted by\u00a0SiteLock or one of their web hosting partners about supposed malware issue or other type of hack of their website should get a second opinion from another security company (something we provide for free and we hope that other companies would as well), since we were able to quickly identify what was going on and let this person know as well and saved them a lot money.<\/p>\n","protected":false},"excerpt":{"rendered":"

Back in August we discussed a situation where the web host Bluehost had tried to sell one of their customers a $1,200 a year SiteLock security service based on the customer having received a phishing email that was supposed to have come from Bluehost. It obviously didn’t paint too good a picture of Bluehost, as … Continue reading “Bluehost Still Trying To Sell Unneeded SiteLock Security Services Based on Phishing Emails”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[77,151,39],"class_list":["post-3889","post","type-post","status-publish","format-standard","hentry","category-bad-security","tag-bluehost","tag-phishing","tag-sitelock"],"_links":{"self":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/comments?post=3889"}],"version-history":[{"count":3,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3889\/revisions"}],"predecessor-version":[{"id":3895,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3889\/revisions\/3895"}],"wp:attachment":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/media?parent=3889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/categories?post=3889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/tags?post=3889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}