Help tracking down a hacker .. where to view Cpanel login IP's?

[listenmirndt]

Hi guys,

A hacker recently logged into my Cpanel & stole some of my database's..

Anyhow, is there a way to view a list of recent Cpanel logins to my account? Also, is it possible to login to Cpanel using a proxy? (I mean, if I can find his IP - I would like to know if it is real or not).

I am the root owner of the server, but the hacker did not have root access, only access to one of my accounts, he got in with a stolen password,

thanks

 

[cPanelDavidG]

Hi guys,

A hacker recently logged into my Cpanel & stole some of my database's..

Anyhow, is there a way to view a list of recent Cpanel logins to my account? Also, is it possible to login to Cpanel using a proxy? (I mean, if I can find his IP - I would like to know if it is real or not).

I am the root owner of the server, but the hacker did not have root access, only access to one of my accounts, he got in with a stolen password,

thanks

Here are some log files you may find useful:

/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/login_log

Their names are fairly self-descriptive.

As for can you access cPanel via a Proxy - yes, there's a popular third party open source program called cPanel Proxy that allows users to access cPanel on port 80, but it could be used as a proxy for illegitimate purposes such as this.