can we remove the "cprapid" thing ?

rscalover

• June 14, 2021 13:28

Hello, I get allot of attackng attempts on 127.0.0.1.cprapid.com where 127.0.0. 1 is obviously my server ip can we remove that "cprapid" thing ? there is no dns zone for cprapid however under ssl storage manager in whm i do find some old stuff that contains "cprapid" it is very annoying

• 

  quietFinn

  • June 15, 2021 04:49

  That is an Automatically Issued Hostname.

  0
• 

  cPRex Jurassic Moderator

  • June 15, 2021 17:26

  Thanks for the link, @quietFinn !

  0
• 

  Greg Williams

  • February 05, 2025 14:23

  I know this is old but I just discovered the cprapid host in of of my users account. I discovered it when he went over his quota, and for whatever reason, there is a full installation of Wordpress in his cprapid directory taking up 2GB, which I assume is a clone. As far as I've read, cprapid is automatically issued for access to WHM, but none of my clients use WHM. They only use cPanel. Can I delete all of those useless cprapid directories on my server?

  Thanks,
  Greg

  0
• 

  cPRex Jurassic Moderator

  • February 05, 2025 15:36

  Greg Williams - can you share a screenshot or list of these directories and also where you found them on the server?  I'd like to have some more information before I confirm if they can be removed or not.

  0
• 

  Greg Williams

  • February 07, 2025 00:55

  Hi cPRex,

  Did you get my reply to your request regarding this a couple of days ago? I was allegedly being held for approval after I posted it, maybe because it had some sensitive info in it.

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 01:17

  I don't currently see anything in the approval queue at this time, so everything there is in this thread is already public.  So I'll go with "no"

  0
• 

  Greg Williams

  • February 07, 2025 02:55

  Ok, I'll try again. My previous post mention that there are hundreds of examples of cprapid.com in many of the home directories and they all look like this:

  /home/[user]/wpt-[random characters].[host IP].cprapid.com/[web site files]

  Note, all of the entries were from sites I migrated from a deprecated server to a new server. The IP in the domain name is the IP of the old server. The weird thing is most of these directories have cloned copies of the web site's Wordpress installation, so they are taking up a lot of disk space allotment for these users.

  There are also a few random entries like this:

  /home/[user]/.cpanel/ea-php-cli/wpt-75wc.[host IP].cprapid.com
  /home/[user]/.cpanel/ea-php-cli/wpt-75wc.[host IP].cprapid.com/.ea-php-cli.cache
  /home/[user]/logs/wpt-75wc.[host IP].cprapid.com.[domain]-Apr-2023.gz
  /home/[user]/logs/wpt-75wc.[host IP].cprapid.com.[domain]-ssl_log-Apr-2023.gz
  /home/[user]/tmp/awstats/awstats.wpt-[host IP].cprapid.com.[domain].conf

  I'd like to clean this up by removing all of this but I want to make sure it won't cause any damage first. It would also be nice to know how to prevent this mess in the future.

  Thanks,
  Greg

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 21:41

  Thanks for the additional details.  I asked around and we haven't seen anything quite like that before, although the name of the file would indicate a WP Toolkit issue of some sort.

  Could you create a ticket so this can be investigated?

  0
• 

  Greg Williams

  • February 08, 2025 23:01

  Since I purchased my cPanel license through my data center I am unfortunately forced to submit cPanel support tickets through them, which isn't ideal, so I'll need to pass. I know that I won't get proper resolution if I do so.

  Greg

  0
• 

  Mario Figge

  • February 22, 2025 22:35

  I detected the same problem. 

  Yesterday I got notified for a domain added to account, and space problem after that, in a site long time hosted.

  I found a folder wpt-yoff.#my-server-ip#.cprapid.com with a complete copy of public_html wordpress installation.

  After that I searched my emails for similar messages and found several others on 3 different servers. All the same case, a complete copy of the public_html wordpress files. 
  I just deleted it as it does not resolve, but could be a security threat anyway, and obviously, it takes space.

  I am in the same position as Greg, licences purchased through data center, so I cannot open a direct ticket. But it seems to be a bug or something, so I will follow this thread.

  0
• 

  cPRex Jurassic Moderator

  • February 23, 2025 19:31

  Greg Williams and Mario Figge - we still aren't able to reproduce this on our side.  If your host isn't able to resolve the issue they would escalate the ticket to us and we'll handle it.  If that isn't happening, please send a message to cs@cpanel.net to let us know about your experience with that host.

  0

Please sign in to leave a comment.