Phishing website block on VPS

CiprianoOscar

Hello,

I'm here to ask if anyone knows a method to block scam websites on KVM and OPENVZ vps.

I have currently solved the spam emails by blocking the SMTP ports.

deank

Disconnect it from the internet. It will solve all your issues.

It will create other issues tho.

yoursunny

sudo ufw deny 443
Very effective, all phishing websites are gone instantly.

comXyz

@yoursunny said:
sudo ufw deny 443
Very effective, all phishing websites are gone instantly.

ufw deny 80 also

bulbasaur

You could monitor phishtank, openphish and urlscan.io's feed and detect if they're using your VPS based on the results of a DNS resolution.

Proactively detecting phishing websites is not a game that you can win. Phishing gangs at the top of their game only allow traffic from residential ISPs, cloak their content such that it is served only when visited from a certain URL shortener (the URL shortener link is shared with the victim) and based on the user's Accept-Language headers.

CiprianoOscar

i think i will block port 80 and 443 and if the client need this port opened i will make an account verification

sanvit

@CiprianoOscar said: i will block port 80 and 443

hmmmm.....

rustelekom

@CiprianoOscar said:
i think i will block port 80 and 443 and if the client need this port opened i will make an account verification

Some posts above was just sarcasm. Of course you don't need block 80 and 443 ports (as well as 25 port BTW) because this make your VPS useless. You are already offered to use well known phishtank, openphish and so on. But you should understand you cannot win over phishers. Unfortunately they have enough money to register lot of domains, order lot of proxy services to get their phishing sites always online.

Take strict action against such person, require additional information, check all their data (ip's, phone, browser, payment method etc.) and this will decrease number of malicious users. If you will strict enough they will gone away. It's like with cockroaches - if you don't fight them, they will bother you again and again...

CiprianoOscar

@rustelekom said:

@CiprianoOscar said:
i think i will block port 80 and 443 and if the client need this port opened i will make an account verification

Some posts above was just sarcasm. Of course you don't need block 80 and 443 ports (as well as 25 port BTW) because this make your VPS useless. You are already offered to use well known phishtank, openphish and so on. But you should understand you cannot win over phishers. Unfortunately they have enough money to register lot of domains, order lot of proxy services to get their phishing sites always online.

Take strict action against such person, require additional information, check all their data (ip's, phone, browser, payment method etc.) and this will decrease number of malicious users. If you will strict enough they will gone away. It's like with cockroaches - if you don't fight them, they will bother you again and again...

Thanks a lot