Account's IP address changed for no apparent reason!!

[rpage]

Hello Everyone,
The strangest thing happened today. I have a client that has his DNS hosted somewhere else and it points to an IP address on one of my servers that is assigned to his website. He emails me and says his website is gone. So I go to his website and I get the default cPanel, Sorry page, http://www.domain.com/cgi-sys/defaultwebpage.cgi, and to check the ip address, server configuration, etc. I did a trace on his domain name and it indicated that the dns server was still routing to his ip address on my server. I then went into WHM and looked at the ip address usage and his domain name was no longer listed with his ip address, but listed under the shared ip address for the server. All I had to do was change his ip address back to what it's suppose to be, but I'm concerned as to how and why did it change? I do not allow ssh for any of my clients. No one has logged into WHM. So far I have not found anything in the logs that would indicate a change to the httpd.conf file, or dns records.

Has anyone experience this before or has some ideas into how to determine what happened?
Thanks for your assistance.
Rick

 

[vanessa]

I've never seen this happen without being initiated by someone - perhaps the owner of the account (the reseller) or another admin did this. Maybe check your bash history and WHM access logs.

 

[rpage]

Hi Vanessa,
Thanks for the info. I am the owner of the account (root) and there are no other admins. I will definitely take closer look at the logs to make sure something fishy isn't going on.
Rick

 

[cPanelMichael]

Hello

Yes, IP addresses will not change on their own. It's likely the account IP address was modified through Web Host Manager, or the initial change was completed manually and then reverted.

Thank you.