Suspicious process running under user

K

ksgalicia

Well-Known Member
Aug 4, 2016
71
5
58
Spain
cPanel Access Level
Root Administrator
Twitter
Hi!

I often receive emails with the subject "Suspicious process running under user..." whose IP addresses are from Google Cloud. I have them added to the CSF blacklist and cPHulk but I keep receiving the emails with the same addresses ... Is this normal?

Greetings
 
cPRex

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
15,280
2,433
363
cPanel Access Level
Root Administrator
Hey there! Those notifications are from the LFD tool, which is part of CSF. If you believe that tool may not be working properly, it would be best to reach out to their team at ConfigServer Technical Support to have them check that.

If you have blocked the IP in CSF I would not expect that IP to be able to make any connection to the server. My only other guess would be that it is an older process that has been running for an extended period of time.
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
Otávio Serra lfd - Suspicious process running under user nobody Security 5
eventtex LFD - Suspicious process running under user postgres Security 7
J lfd on server.com: Suspicious process running under user username Security 6
D Suspicious process running under user * Security 1
C LFD Suspicious process running under user Security 4
Similar threads
lfd - Suspicious process running under user nobody
LFD - Suspicious process running under user postgres
lfd on server.com: Suspicious process running under user username
Suspicious process running under user *
LFD Suspicious process running under user
Top Bottom