The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Strange Occurance

Discussion in 'General Discussion' started by hostcp3, Jun 23, 2003.

  1. hostcp3

    hostcp3 Well-Known Member

    Joined:
    Jun 18, 2002
    Messages:
    156
    Likes Received:
    0
    Trophy Points:
    16
    A few months ago we removed a reseller for spamming, he persistanly spammed three times and eventually had one of our servers blocked by SpamCop for a few hours.

    He had around 12 websites setup on our server which restricted him to 2 gig space and 15 gig bandwidth, he had been with us for a year or more.

    I had noticed from time to time he setup one of his own accounts/packages in a peculiar fashion.

    We asked he change those settings which he did, but then a month or so later he would change it back.

    At this time this particular server was practically using its full allowance of bandwidth, even though the amounts didn't match with Cpanel we assumed it was just the way WHM measured usage.

    When we asked him to leave he became most upset and threatened to charge back forever and a day.

    Thankyou to the great support at 2checkout this was not allowed to happen.

    but here is the crunch, since his accounts were removed bandwidth on that server has halved!

    Around 75 gigs less has been used consistantly for the past two months since he has gone.

    Reason for the post

    How did he do this?

    and a warning to Server admins, check how your clients have their packages setup.

    cPanel.net Support Ticket Number:
     
  2. Faldran

    Faldran Well-Known Member

    Joined:
    May 28, 2002
    Messages:
    136
    Likes Received:
    0
    Trophy Points:
    16
    It is pretty easy really, just use http:://serverIP/~username/

    Non of the bandwidth gets added to your account!

    Of course this is why we monitor the accesslog and anyone still using it after 2 weeks, we remove thier access /~username

    cPanel.net Support Ticket Number:
     
  3. hostcp3

    hostcp3 Well-Known Member

    Joined:
    Jun 18, 2002
    Messages:
    156
    Likes Received:
    0
    Trophy Points:
    16
    we turned /~ off on all servers months ago, and just add the username to apache.conf for a short time to excempt new clients. thanks for the tip though, might help others.

    cPanel.net Support Ticket Number:
     
  4. rpmws

    rpmws Well-Known Member

    Joined:
    Aug 14, 2001
    Messages:
    1,824
    Likes Received:
    5
    Trophy Points:
    38
    Location:
    back woods of NC, USA
    if you say he was a spammer? he could have been spitting out mail as nobody@yourbox.com ... doesn't show as his user name.

    cPanel.net Support Ticket Number:
     
  5. Faldran

    Faldran Well-Known Member

    Joined:
    May 28, 2002
    Messages:
    136
    Likes Received:
    0
    Trophy Points:
    16
    Well sites are gone now.. been nice to go through and see what he had setup on there.

    Like rpmws, could of been sending spam out of box as nobody and it not getting tracked that way.

    Also seen where Mailing lists do this also! If he had a busy mail list, it could do it as well.

    cPanel.net Support Ticket Number:
     
  6. hostcp3

    hostcp3 Well-Known Member

    Joined:
    Jun 18, 2002
    Messages:
    156
    Likes Received:
    0
    Trophy Points:
    16
    Wasn't through mail,

    the mail stats per month for the whole server didn't even reach 75 gigs!

    I think it was some method he used in WHM, I don't want to show the way he had it done here in public.

    But just a warning, check your resellers and if you see anything strange in their package setups look harder.

    cPanel.net Support Ticket Number:
     
Loading...

Share This Page