Google Phishing Notice

  • Answered
I received the following from Google and have no idea what they're talking about. I've never created such a page:

Dear site owner or webmaster of,
We recently discovered that some pages on your site look like a possible phishing attack, in which users are encouraged to give up sensitive information such as login credentials or banking information. We have removed the suspicious URLs from search results and have begun showing a warning page to users who visit these URLs in certain browsers that receive anti-phishing data from Google.

Below are one or more example URLs on your site which may be part of a phishing attack:

http://www.thehrdifference .com/~needas5/Paypal/webapps/home/

Here is a link to a sample warning page:
We strongly encourage you to investigate this immediately to protect users who are being directed to a suspected phishing attack being hosted on your web site. Although some sites intentionally host such attacks, in many cases the webmaster is unaware because:

1) the site was compromised
2) the site doesn't monitor for malicious user-contributed content
If your site was compromised, it's important to not only remove the content involved in the phishing attack, but to also identify and fix the vulnerability that enabled such content to be placed on your site. We suggest contacting your hosting provider if you are unsure of how to proceed.

Once you've secured your site, and removed the content involved in the suspected phishing attack, or if you believe we have made an error and this is not actually a phishing attack, you can request that the warning be removed by visiting
and reporting an "incorrect forgery alert." We will review this request and take the appropriate actions.
Thank you for your question BobMendonsa!

We do apologize for the phishing notice you are getting. Another customer on our server needas5 had a hack in their files that cause the phishing notice. Because you share the same server IP address, Google has falsely flagged your domain as pphinshing. The issue with the compromised account needas5 was address already and not pohishing files are on the server. You can disregard the false warning to that url from Google. Sorry for the trouble

James R