Today i had the unfortunate event of Witnessing one of the Reseller accounts on the Server Being Hacked into – it was a case of it being a Bad Password unfortunately.
What basically happened was this “Kiddy” This person is not worthy of being called Hacker because its not really hacking its just a bit of Kiddy Stuff trying to be Smart Aswell..but anyway
The Login using the Reseller account in WHM
Modified the Suspended Page with the usual “This page has been hacked along with the LOLZ, Dark Black Page, Animated Text and GIFs along with some awful taste of Music playing in the background” you know what i mean
Once this is modified they then went through this reseller account list and Suspended the accounts one by one!
Now when accounts are suspended they go to a custom Suspended Page which happened in this case! So when a user went to the Website they got the Suspended Page message which was infact the Page which this person created…got me for a while but i caught on in the End..so i went on the server hunt to track down what happened
First thing was to analyse who has access to WHM / Cpanel
From SSH go to
The file you want to open is called
I normally do a
pico access_log via SSH
and then it will open up the log file takes a minute or so of everything single action logged via WHM / Cpanel
Quite useful for tracking down who has logged on, their IP address, their Browser and what they have run
Now Funny thing about this was on his “Modified page” he was stupid enough to leave a Pakistani Flag on there
Around the time this happened from the logs i noticed an IP address logged in using the reseller account lurking around the suspended Page and editing this then going on the “Suspend account Spree”
doing an IP lookup normally i use http://www.whois.sc this IP address resolved back to Pakistan! so that gave it away
Suffice to say that ISP has now got a blanket ban on our server
Hacking Incident i think not – but for him gloating about it being a hacking incident when it was down to bad password is laughable!
Anyway We move on and learn new things alhumdulillah all working and back to normal