We encourage all our clients to manually check their accounts for suspicious files or scripts not belonging to their account. We do not want this server to be disconnected by the data center for repeated offense.

Update 1: File and folder permissions of accounts are fine as well as ownership. Memory limits in PHP.ini have been adjusted.

Update 2: Running cPanel Update and updating all Perl Modules. (Will run EasyApache next). Still running cPanel update….

Update 3: Recompiling PHP thru EasyApache.

We coordinated with the DC engineers to get the server back online so we could investigate and remove the phishing sites.

It turns out that the two accounts by clients have folders that were open and allowed culprits to upload a zipped file of the fake website and extract them. We have deleted the files and secured the folders. We’re still looking into other client accounts that may have similar cases.

We request all clients to regularly and actively check their accounts for open folders (CHMOD them to 644) and update any add-on scripts or web apps they have installed so to avoid similar incidents in the future.

We are working on partially disabling Clam AV but this might also affect the performance of the system to detect and remove virus infected emails in all accounts. We’ve already tried to temporarily disabled it by it turns out that once it’s been pre-installed in the server, there’s no easy way to just switch it off. The system needs to be recompiled to remove Clam AV.

Despite being among the easiest of vulnerabilities to understand, injection vulnerabilities are also among the most common. For most users, they will simply manifest themselves as an error when select characters are used, but a sufficiently adept user may be able to take that error and exploit it to their advantage.

Check more about it here.

We will be very vigilant to impose suspension on sites that could case a similar incident int he future. However, even if this problem was caused by a single client, it dragged along with it all other hundreds of clients in the server.

What we do when we discover that this happens is to flush the IP block lists. Since the firewall does all the automated addition of IPs in its block list, we cannot monitor if a client IP has been blocked. We encourage you to let us know about it by submitted a support ticket at the Client Center so we can investigate immediately.

The firewall detects malicious activity and blocks the IPs of those activities:

- multiple failed attempts to login to cPanel and FTP
- brute force attacks
- port attacks

We have instances when a legit client has been blocked by our firewall just because of repeated failed attempts at using the wrong password in their cPanel.

These hard drives started working from the day they were deployed to us by our Data Center. As such, the older the server gets, the higher the probability that they might fail. We have servers with hard drives lasting for 5 years without any problem. However, it was unfortunate that one of our newer servers had a hard drive failure on the main drive which caused a couple of days of down time.

When this problem happens, we cannot avoid them the same way the HDD manufacturers (we use Seagate and Western Digital HDD) cannot guarantee us 100% reliable drives. The best we can do is make sure we have backups we can use to restore accounts and move on.