Hdraye

Registered
Aug 13, 2018
2
0
1
Saudi Arabia
cPanel Access Level
Website Owner
Hi
A hacker was adding forwarders to some accounts, so I disabled forwarding through feature list in whm/cpanel
Problem now is I can not see the forwarding list in cpanel, so I don't know if the hacker is still forwarding or not, I want to check it every now and then to make sure no forwarders are added, and to delete them if any.
So how can I still keep seeing the forward list without enabling it

thanx in advance
 

cPanelLauren

Forums Analyst II
Staff member
Nov 14, 2017
8,421
689
263
Houston
cPanel Access Level
DataCenter Provider
Hello

You can view all forwarders in /etc/valiases/domain.tld though I would also advise ensuring access to the compromise has been removed. This would entail a thorough investigation of all files and folders associated with the account/s in question, I'd also advise scanning the account with a malware scanner such as ClamAV, Linux Malware Detect or ImunifyAV - or some other such software.