Suspicious process running under user

ksgalicia

Well-Known Member
Aug 4, 2016
70
5
58
Spain
cPanel Access Level
Root Administrator
Twitter
Hi!

I often receive emails with the subject "Suspicious process running under user..." whose IP addresses are from Google Cloud. I have them added to the CSF blacklist and cPHulk but I keep receiving the emails with the same addresses ... Is this normal?

Greetings
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,496
1,009
313
cPanel Access Level
Root Administrator
Hey there! Those notifications are from the LFD tool, which is part of CSF. If you believe that tool may not be working properly, it would be best to reach out to their team at ConfigServer Technical Support to have them check that.

If you have blocked the IP in CSF I would not expect that IP to be able to make any connection to the server. My only other guess would be that it is an older process that has been running for an extended period of time.