Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with WHM + CPanel and 5 of my costumer got infected with zbot.

This means that the domains they have are constantly receiving requests to certain destinations.

I tried to use mod_security but seems that it can't filter every requests... I don't really know why?

I still see in the access log the connection comming in and it's consuming a LOT of bandwidth and server load

Those accounts have already been clean so all of those requests go to error 404 (the ones catched on mod_security I am dropping the connection).

Is there anymore ways to defend against this requests?

share|improve this question

I would recommend you install a firewall on your server. I would go with CSF - ConfigServer Security and Firewall CSF Website. You can also try something like APF, but my personal basis is CSF. It has a nice web interface via WHM and supports more features then APF. Google CSF .vs APF for more history. But I digress.

For CSF, go ahead and install it using the instructions in the install.txt file from the CSF website. Make sure you disable cPanel's cPHulk Brute Force Protection via WHM Main >> Security Center >> cPHulk Brute Force Protection

Once installed, you can configure CSF to monitor bot requests and help prevent *bot requests. mod_security is a step in the right direction, but CSF will help further.

Note: Do spend the ~20 minutes reading the config file via WHM for CSF and setup the firewall.

share|improve this answer

If you already cleaned the accounts and you know for sure that most of the requests directed to the removed sites are botnet request just write a script (php,python, whatever) which fetch the IP address of the abusive client and blacklist it with iptables for N min.

Thought there is a chance that you can block some legitimate traffic.

share|improve this answer
it's hundreds of diferent ips – Killercode Sep 19 '12 at 12:24
Then make even more sense to write the script :) Or let's wait someone maybe has a better solution – golja Sep 19 '12 at 13:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.