Serra

1. Community
2. Security
3. Email accounts exploited on a schedule

It seems to me that after ruling out all devices, humans and software configs the only point left is the email server.\ Technically, it was on one server, after the second exploit we moved it to o...

• View comment
• Serra
• July 10, 2018 16:47
• 0 votes

1. Community
2. Security
3. Email accounts exploited on a schedule

What about an App on the phone that has elevated privileges? Since most Apps have contact permissions a rogue App may be used to trigger the botnet, since there are passwords installed on the phone...

• View comment
• Serra
• July 10, 2018 16:37
• 0 votes

1. Community
2. Security
3. Email accounts exploited on a schedule

If you have WHM Root access try this: 1. Run Security Advisor it has a warning that will show if your email server is exposed improperly to the public. In the warning it will say something like ''...

• View comment
• Serra
• July 10, 2018 16:26
• 0 votes

1. Community
2. Security
3. Email accounts exploited on a schedule

This is definitely an interesting situation. What do the emails look like? Do you have the headers available? If you do and you post them please remove any identifying information. Here is the he...

• View comment
• Serra
• July 10, 2018 16:12
• 0 votes

1. Community
2. Security
3. Email accounts exploited on a schedule

@Serra If you go to the official Microsoft website search for the Fiddler download. I have used this on XP and Windows 7 Basic. What it does is shows you live raw traffic info coming and going out...

• View comment
• Serra
• July 10, 2018 12:12
• 0 votes

1. Community
2. Security
3. Email accounts exploited on a schedule

To confirm all machines that are running outlook have been confirmed to be clean? Also have you checked their crontab to ensure a cronjob wasn't present on the account before it was moved as well ...

• View comment
• Serra
• July 10, 2018 12:08
• 0 votes

1. Community
2. File Management
3. Ftp Stopped working, no directory listing.

Hello, Is it possible that IP address was associated with this cPanel server at some point in time? If not, can you verify if this cPanel installation was setup via an image or custom script as op...

• View comment
• Serra
• March 19, 2018 16:36
• 0 votes

1. Community
2. Security
3. ModSecuirty "/var/cpanel/secdatadir/ip"

Thanks, I didn't even know about that!

• View comment
• Serra
• February 28, 2018 18:57
• 0 votes

1. Community
2. Security
3. ModSecuirty "/var/cpanel/secdatadir/ip"

Please refer to this thread:

• View comment
• Serra
• February 28, 2018 02:28
• 0 votes