Suspicious file alert

jeffschips

• July 26, 2025 03:14

I am also receiving a "suspicious file alert" and backtracing the "similar posts" here are dead ends, removed, no longer available.  I recognize this is an LFD alert but could use some sage advice on really what's going on if any one can figure it out:

Subject: lfd on xxxxxx.com: Suspicious File Alert
Time:   Fri Jul 25 22:31:36 2025 -0400
File:   /tmp/.spamassassin2778527bt9nNOtmp/.spamassassin
Reason: Suspicious directory
Owner:  nobody:nobody (99:99)
Action: No action taken

• 

  cPRex Jurassic Moderator

  • July 28, 2025 14:04

  Hey there!  It seems that it can be normal to have files owned by nobody:nobody in that directory, as that is the same thing that happened to users in this thread:

  https://support.cpanel.net/hc/en-us/community/posts/25862336548503-Suspicious-tmp-Spam-Assassin-Directories-Files

  so I wouldn't worry about this issue at all.

  0

Please sign in to leave a comment.