Acccounts Accessed by Unknown IP Address Issue

abnet

• March 20, 2019 00:50

So I just found that a server seems to have been compromised. Still looking into what/how. I've found the same foreign IP in the /home/account/.lastlogin of a couple accounts. I searched through access_logs and found the same IP had logged into all accounts all 2 seconds apart... like every two seconds logged into a different account. How is this possible? Has to be automated... but how without Root? Now, I'm not 100% that Root has been compromised yet... any suggestions on finding out? Can this automated login even be possible without Root?

• 

  abnet

  • March 20, 2019 16:59

  cPanel... you take time to change my thread title, but not provide any kind of response? How could dozens of accounts be logged into programmatically and not see a Root login in logs????

  0
• 

  Infopro

  • March 20, 2019 19:11

  I can't answer that for you. But I did change the title to better reflect the issue you're faced with.

  0
• 

  cPanelLauren

  • March 21, 2019 18:44

  Hi @abnet While this isn't necessarily something that cPanel will be able to assist with, in an effort to provide some direction and assistance please feel free to open a ticket using the link in my signature. Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved. Thanks!

  0

Please sign in to leave a comment.