Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Finding a shell file may reveal only the last stage of an incident. The useful question is when it appeared, which URL and HTTP method preceded it, whether panel/FTP/SSH accounts showed unusual access and what the WAF observed at the same time. This guide explains defensive log correlation in cPanel and Plesk.
Turkey (Turkish)
Germany (German)
Worldwide (English)
02:14:31 POST /admin/upload.php 200
02:14:32 public_html/uploads/supheli.php mtime
02:14:33 GET /uploads/supheli.php 200
02:14:45 POST /uploads/supheli.php 200Logs rotate and older records can disappear. Export raw access, error, ModSecurity, control-panel action and authentication records before modifying the environment.
Normalize time zones before correlation. A PHP file may use server local time while CDN or other logs use UTC.
cPanel documents Metrics → Raw Access as the interface for downloading Apache and NGINX access logs in compressed form. These records describe visitors and requested content.
Review source IP, timestamp, HTTP method, path, status, referrer and user agent. POST/PUT requests just before file creation and follow-up calls to a new PHP file are especially useful.
zgrep -Ei "POST|PUT|/upload|\.php" example.com-Aug-2026.gz | tail -200awk '$9 ~ /200|201|302/ {print}' access.log | tail -200cPanel’s official log-file reference lists default locations and notes that administrators can change them. Domain access, control-panel, SSH/FTP and service activity can live in different logs.
Confirm paths for your server version from official documentation, copy the logs, and analyze a narrow time window on the copy rather than editing production records.
If a file changed at 02:14:32, inspect a window such as 02:10–02:20 for upload/admin/API POST requests, successful responses and immediate GET/POST access to the new file.
File owner and permissions add context about which local account or process wrote the file. A sequence is stronger evidence than an isolated log line.
stat public_html/uploads/supheli.phpfind public_html -type f -newermt "2026-08-18 02:10" ! -newermt "2026-08-18 02:20" -lsgrep "18/Aug/2026:02:1" access.log | grep -E "POST|PUT|uploads|php"ModSecurity hits show rules triggered by requests, but a hit does not automatically prove successful exploitation. Correlate the WAF event with HTTP status, backend logs and filesystem impact.
Avoid enabling full transaction logging indefinitely; cPanel warns that it can consume disk and capture private data.
Plesk documents its domain log browser under Websites & Domains → domain → Logs. Manage Log Files can display or download tracked logs, and real-time updates can show new entries.
Review Apache/nginx access and error records and include rotated files around the incident window.
Plesk Action Log can show the action time, source IP, Plesk user and action-specific details. There are server-wide and site-filtered views.
This is valuable when a stolen Plesk account was used for file management, scheduled tasks or configuration changes that would not appear as a vulnerable upload request.
Current Plesk documentation places the detailed Linux ModSecurity audit log at /var/log/modsec_audit.log and a domain Apache error log under /var/www/vhosts/DOMAIN.TLD/logs/error_log.
On Windows, ModSecurity audit logs are domain-specific under the Plesk installation directory. Event IDs and rule IDs can be used to group one request’s audit sections.
grep -n "HOST: alanadi.com" /var/log/modsec_audit.log | tail -50grep -Ei 'ModSecurity|Access denied|id \"[0-9]+\"' /var/www/vhosts/alanadi.com/logs/error_log | tail -100A stolen FTP/SFTP/SSH or panel account can write files even when no vulnerable upload endpoint exists. In that case the web access log may not contain the initial file-write request.
Prioritize unexpected successful logins, source IPs, new SSH keys, unusual time/geography and bursts of activity under one account.
A web server behind a proxy may log the proxy address unless trusted-proxy configuration restores the client IP correctly. Blindly trusting client-supplied headers can also poison attribution.
Verify how your stack records trusted proxy headers. If historical logs did not preserve the client IP, it may be impossible to reconstruct it later.
An incident-related IP can be a VPN, residential proxy, Tor exit, botnet node or another compromised server.
Use cautious wording such as “source IP associated with the event”. Legal identity attribution requires additional evidence and, often, provider records through appropriate legal process.
File timestamps, web access/error logs, WAF events, cPanel/Plesk actions and available SSH/FTP records are normalized into one timeline. The objective is to connect entry, persistence and later actions rather than simply output a list of IPs.
The report records suspicious windows, URLs/methods/status codes, technical IP indicators, changed files, hardening actions and any evidence limitations caused by missing or rotated logs.
Paste log lines below. Processing stays in your browser and summarizes IPv4 addresses plus POST/PUT/PATCH lines; it is not a substitute for forensic analysis.
Standard cases are usually scheduled for a 24–72 hour analysis window after pre-assessment. Timing varies with file count, log access, malware spread and application architecture.
Important note: Only test systems you own or are explicitly authorized to assess.
Metrics → Raw Access; download the compressed access logs from there.
Websites & Domains → domain → Logs.
Plesk documentation states that action entries can include time, IP, user and details.
No. The source can change; close the entry point and persistence.
You can infer from files and application evidence, but timeline confidence is lower.
No. Correlate it with response status and actual application/filesystem impact.