The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Strange email with attachment from "cpanel"

Discussion in 'Security' started by johndoe, May 3, 2012.

  1. johndoe

    johndoe Active Member

    Joined:
    May 26, 2002
    Messages:
    36
    Likes Received:
    0
    Trophy Points:
    6
    Hello forum members -

    I've had a server leased from a reputable cPanel partner for almost 2 years now. For the first time ever, I received an email apparently from cPanel with the following identifying information in the header:

    <cpanel@host.servername.net>
    Backup complete on host.servername.net

    Received: from root by host.servername.net
    (envelope-from <root@host.servername..net>)
    for myname@sbcglobal.net; Wed, 02 May 2012 01:11:22 -0500

    To: myname@sbcglobal.net

    From: cpanel@host.servername.net

    Subject: [cpbackup] Backup complete on host.servername.net

    There was an attachment to the message: filenumber.log.txt

    The message seems legitimately from cPanel, but as I say, I've never had one before, and have not opened the attachment for security concerns.

    Should I be worried?

    Best wishes
     
  2. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Those are common. You should get them as often as your backup routine on the cPanel server is run. If you have backups scheduled to occur nightly, you'll receive those nightly right after the backup completes. They have the exact Subject line that you specified and say "Please see the attached log file." in the message body and contain a log with the filenaming convention that you describe.

    Easy enough to know if it's legit -- Just open it with a text editor like notepad (Win) or vi / nano (linux). It's not going to bite you as long as it has a .txt extension and you open it in a text editor.

    If you have never received those emails before, either backups weren't occurring before or the contact email address of yours listed in WHM didn't exist until recently.

    Mike
     
  3. johndoe

    johndoe Active Member

    Joined:
    May 26, 2002
    Messages:
    36
    Likes Received:
    0
    Trophy Points:
    6
    Thank you Mike. It's good to know the routine is common. I run backups daily on the server, and this message came on May 2 to the email address I have always had listed in WHM. I opened the .txt file, and it seems as "advertised" - a log file of the backup routine for that day.

    I'll check through all my settings at WHM to see if I can determine what happened in this case. I know that if there is an option in WHM for receiving log files of backups, I would have checked "no" on that option.

    Thank you for your response. You've brought some peace of mind for me.

    Best wishes --

    Harry
     
  4. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    You're welcome, Harry. Peace of mind is a good thing. I need to get me some of that !

    Mike
     
Loading...

Share This Page