I'm getting fed up with this.
The t35.com domain is blocked by google, and t35.me undoubtedly soon will be. Both are blacklisted in various public lists (e.g. Netcraft) used by the anti-phishing/anti-fraud tools in popular browsers such as Chrome, Firefox and Opera. Even if T35 get themselves off the blacklist this time, the core problem is going to continue and the reputation of T35 is forever going to be questioned and dissed online until the phishing is completely eliminated. These days the script kiddies are even sharing guides online how to create a phishing site specifically on hosts like T35, so they don't even need any expertise. The problem is getting worse, not better.
Alex, is it not time to bite the bullet and add "fopen" to php's disable_functions, as many other free hosting companies have already done?
I figure the free hosting users are in one of three categories.
- Those who never use php, and would be unaffected by this change. I suspect the majority of free hosting users are in this category since most of them probably don't have any php knowledge anyway. It is perfectly possible to create great websites without a single line of server-side php, and you can still link to third-party script-based components like statcounters, guestbooks, shoutboxes, etc.
- Those who use the principle functions of php to generate html on the fly, but who do not need to use disk specific functions, and would also be unaffected by this change. Of those who do use php, this probably accounts for the majority.
- Those who use php's disk functions (directly, or indirectly via directly-installed third-party components) and genuinely require fopen (for non-phishing purposes!).
I suspect a minority of the free users on T35 fall into the last category, and I know they won't like my suggestion, but something has to be done about this ongoing problem and to me the simple fact is that most free hosts disable fopen now. If you genuinely need it, switch to paid hosting. (Perhaps T35 might even be able to offer them a one-off $25 payment option upon request to move them to a different apache/server where they can use fopen, rather than forcing them into full paid hosting.)
Acknowledging there is a phishing problem and blocking fopen would probably go a long way to convincing the likes of Google that you are taking the problem seriously and have taken a definitive step to eliminate the problem and clean up T35.
