I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007.

We're on CentOS 6 + CPanel, and unfortunately we're still funding the organization from our own money. Since last year, we've noticed some strange subdomains, additional domains and parking domains created for phishing websites, we usually suspend or terminate them until we've noticed it was random and sometimes on trustworthy customers account or even ours (personal admin accounts).

2 months ago, we've rent a new and stronger server, reconfigured it from scratch and migrated the CPanel account, changed passwords, prevented root login without password ans changed our WHM access key, but the "strange" domains/subdomains are still appearing and BuyCpanel (our CPanel licence reseller) told us it seems to be a compromised server and we should investigate it.

We would like to investigate it ourselves but we don't know where to start or how to trace the origin of "compromise", we've checked root connections, FTP connections, WHM connections, we can't find a trace of a script creating the subdomains. Can you give us some advices?


  • Have you tried rootkit detectors? There are two I know of in Linux, chkrootkit and rkhunter.
    – MariusMatutiae
    Jun 8, 2014 at 5:43
  • you might want to look at this serverfault.com/questions/218005/… Jun 8, 2014 at 17:28
  • I have another issue related to my question: I also check if the server is compromised because we have a LOOOT of delivery complaints. Here is an example, I don't understand how but the original email is sent by SPAMMER from external server, for a domain I host (edit*.fr) received by phobos (our server). Does it mean that the SMTP passwords are compromised? Because I have loads of exact same emails, sent from many SPAMMER to all accounts on this domain (edit*.fr) :/
    – Max13
    Jun 14, 2014 at 20:45

2 Answers 2


All of the recommendations start by telling you to disconnect the server from the Internet, something that might not be possible here. The problem is, a determined attacker can get round any changes you make "live" faster than you can change things.

One of your biggest problems is your reliance on 3rd party software such as CPanel. This shows regular vulnerabilities that would allow attackers to gain remote access and elevated privileges. Unless you can move your DNS and domain management functions out of CPanel and disable them there, I'm not sure you are going to be able to totally fix the problem.

I'd perhaps recommend moving that part of the service to a secondary server that doesn't use CPanel and has an absolutely minimal server install. Make sure all accounts have long passwords and don't connect the two systems until you have fully hardened the new server. You need to ensure that you have IPTABLES configured correctly and have moved any remote access to non-standard ports (don't leave SSH on port 22 for example or you will never be able to spot real problems in your logs from the constant hacking attempts.).

You also need to make all of your users aware of the ongoing problem. Keep them informed.

Also, did you change all your account passwords and certificates after you updated after Heartbleed?

  • The problem with splitting the DNS part from the CPanel part is that it's CPanel itself which creates the subdomains, legitimate (by a user) or scripted (or manually by an external user) so even if I split, if CPanel is vulnerable, it will still create phishing subdomains. I assume it's CPanel fault (not WHM) because it doesn't affect every accounts and the subdomains are viewable in WHM. I'm checking for rootkits, I've changed out certificates and noticed our customers.
    – Max13
    Jun 9, 2014 at 1:47
  • Yes, I was afraid of that. I don't use CPanel any more but is there no way of disabling that part? At least temporarily? Are you able to customise anything? For example, can you change the port for SSH? Jun 9, 2014 at 16:34
  • Disabling CPanel creating subdomains/domains? I don't think it can be disabled, unless externalizing DNS (with CPanel DNS Only) and breaking the link between the services. The subdomains are created in a regular basis, around once every 2 or 3 months, so I can scan the whole server before having another creation, safely. I'm in Africa (poor internet connection), I'm waiting to come back to France to start. Next monday
    – Max13
    Jun 12, 2014 at 12:04

If you want to start then start by scanning the public_html folder of each account. If you have many domains then it will take a long time. Basically You want to look for word 'base64_encode' in all files. You can do it by compressing public_html and downloading it from cpanel. Once downloaded, you have to download another software called textcrawler(http://textcrawler.soft112.com/) which will make it easy for you to find certain word in folder.

On server side you can install firewall like CSF(http://configserver.com/cp/csf.html), mod security and to scan clamav.

Further you can check if the website contain malware or not by going on sitecheck3.sucuri.net.

  • Thanks for the advice. I currently have a really bad internet connection in africa, I'm coming back to france next monday. While here, i'd prefer scanning the directories by the server itself with a nice priority. I have to pay attention to base64_encode, as at least 5/10% of our websites is using it legitimately. I already have CSF (which cut my work as admin, a lot). I'll check
    – Max13
    Jun 12, 2014 at 12:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .