Malicious Outgoing Connection to another server

thewm

Registered
Jan 15, 2019
1
0
1
India
cPanel Access Level
Root Administrator
Hi,
There was a malicious outgoing connection from my Cpanel server to an another server's FTP port. My server has about 200 shared hosting accounts of my clients. How can I check which user/account sent this outgoing FTP request.

Please suggest.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,296
1,271
313
Houston
Hello @thewm

FTP related logs should be present in
Code:
/var/log/messages
If you're in communication with the other server they should be able to tell you the time/date/user of the connection which you can then use to correlate to ftp transactions at the same time on your server. You might want to enlist the assistance of a qualified system administrator for this. If you don't have one you might find one here: System Administration Services | cPanel Forums

Thanks!