• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.

Issue Which log files to check for a site that is attacking other servers

nuffsaid

New Pleskian
Hello

I have an issue with my server, I have been notified by my vps provider that my server is used to abuse other servers and they sent me a list with a log file that looks like this.

serveriphere - - [14/Oct/2020:16:00:13 +0200] "GET /wp-login.php HTTP/1.1" 200 5136 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
> serveriphere - - [14/Oct/2020:16:00:14 +0200] "POST /wp-login.php HTTP/1.1" 200 5425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
> serveriphere - - [14/Oct/2020:16:00:14 +0200] "POST /xmlrpc.php HTTP/1.1" 404 47227 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
> serveriphere - - [14/Oct/2020:16:17:53 +0200] "POST /wp-login.php HTTP/1.1" 200 5458 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

How can I find out which account on my server is being used on my Plesk server?

Which specific log files can I look at to find this account?
 
This is a difficult and time consuming task.

Here is a post that describes a method to achieve it:
and for a general "manual" how to analyze traffic

Depending on the number of websites on your server, it could be easier to go through the sites and look for strange files in their document root.
 
Back
Top