Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way with CSF, CXS or LFD (or any other method) to automatically alert via sms or email of any new scripts, files or directory names with "paypal.com"?

I've been notified by PayPal regarding phishing attempts

Sample form

Examples

http://paypal.com.us.login.information.mpp-cms.account.webapps.3dscour3583585d0a13c0d.djvxhu85d863215868fid.subdomain.customerdomain.com/cms.php

This is a Centos / CloudLinux / Cpanel box with suPHP enabled, apache 2.2, PHP 5.4, MySQL 5.5 and CSF/LFD and CXS enabled.

These scripts are not actual subdomains, but created directory/files under /home/user/public_html/

Have mod security enabled with atomicorps rules too

share|improve this question
add comment

1 Answer

There wouldn't be any even remotely decent prepackaged way to do this. What you need to address instead is why random scripts are appearing on your server, or why you have so many customers who are criminals if you intend for users to be allowed to upload and execute arbitrary scripts.

If you need a solution for this, you'll likely have to write one yourself (at the very least, there will be scripting). The inotify APIs in linux allow you to monitor a file for changes, so you could potentially do this for a directory, but really only a single one (non-recursively). inotifywait -m /some/path comes to mind. This can spit out each file in a directory, which you could pass into grep, and use the return status of grep to determine whether to call sendmail.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.