Ways to add a forwarder?

pcburakq

• October 19, 2021 02:09

Hello, Our Server SSH and WHM panel are completely locked to office IP, no one but our office is able to login to cPanel or WHM. However i can see someone added unwanted forwarders to forward mails to theirselves. [root@server archive]# cat /etc/valiases/* > forwarders [root@server archive]# cat forwarders |grep ABC123 xxx@domain.com: ABC123@yandex.com yyy@domain.com: ABC123@yandex.com zzz@domain.com: ABC123@yandex.com
I'm checking access logs and archieved logs, My logs go all way back to 2019, but i'm unable to see; /paper_lantern/mail/addfwd.html All i'm seeing is me, deleting the forwarders. /paper_lantern/mail/dodelfwd.html Is there a way someone can add a forwarder whitout using SSH or cPanel? PS: Webmail clients are disabled too :/ Edit: I can see webmail.domain.com works, webmail client is disabled but a forwarder can be added in here. However my access logs still does not list how this forwarder was added.

• 

  andrew.n

  • October 19, 2021 14:32

  Maybe AnonymousFox vulnerability?

  0
• 

  cPanelAnthony

  • October 19, 2021 14:52

  Hey there! The advice proposed by @andrew.n is likely accurate. These forwarders can't normally be added without some type of cPanel or SSH access. If you use the acctinfo script on your domain, it may give you a list of infected files as it can detect the AnonymousFox infection.

  0

Please sign in to leave a comment.