Strange Occurance

[hostcp3]

A few months ago we removed a reseller for spamming, he persistanly spammed three times and eventually had one of our servers blocked by SpamCop for a few hours.

He had around 12 websites setup on our server which restricted him to 2 gig space and 15 gig bandwidth, he had been with us for a year or more.

I had noticed from time to time he setup one of his own accounts/packages in a peculiar fashion.

We asked he change those settings which he did, but then a month or so later he would change it back.

At this time this particular server was practically using its full allowance of bandwidth, even though the amounts didn't match with Cpanel we assumed it was just the way WHM measured usage.

When we asked him to leave he became most upset and threatened to charge back forever and a day.

Thankyou to the great support at 2checkout this was not allowed to happen.

but here is the crunch, since his accounts were removed bandwidth on that server has halved!

Around 75 gigs less has been used consistantly for the past two months since he has gone.

Reason for the post

How did he do this?

and a warning to Server admins, check how your clients have their packages setup.

cPanel.net Support Ticket Number:

[Faldran]

It is pretty easy really, just use http:://serverIP/~username/

Non of the bandwidth gets added to your account!

Of course this is why we monitor the accesslog and anyone still using it after 2 weeks, we remove thier access /~username

cPanel.net Support Ticket Number:

[hostcp3]

we turned /~ off on all servers months ago, and just add the username to apache.conf for a short time to excempt new clients. thanks for the tip though, might help others.

cPanel.net Support Ticket Number:

[rpmws]

if you say he was a spammer? he could have been spitting out mail as nobody@yourbox.com ... doesn't show as his user name.

cPanel.net Support Ticket Number:

[Faldran]

Well sites are gone now.. been nice to go through and see what he had setup on there.

Like rpmws, could of been sending spam out of box as nobody and it not getting tracked that way.

Also seen where Mailing lists do this also! If he had a busy mail list, it could do it as well.

cPanel.net Support Ticket Number:

[hostcp3]

Wasn't through mail,

the mail stats per month for the whole server didn't even reach 75 gigs!

I think it was some method he used in WHM, I don't want to show the way he had it done here in public.

But just a warning, check your resellers and if you see anything strange in their package setups look harder.

cPanel.net Support Ticket Number: