What is CPHulk and why is it blocking me from my server?

  Print

What is CPHulk and why is it blocking me from my server?


CPHulk is the inbuilt protection in cPanel to prevent a server falling victim to brute force login attempts. To understand why CPHulk can block you, you need to know what a brute force attack is.

Brute Force Attacks

Simply put a brute force is a password guessing technique that consists of trying to login with a user name and password over and over, changing either the username and/or the password if not successful.

Given enough time even a moderately secure, random character password can fall victim to this as some attackers will try every combination they can if given the chance.

CPHulk will detect and block these attacks by checking for failed login attempts. This can affect you if the failed logins are originating from your internet connection. The steps below will guide you on how to unblock yourself depending on the access you have.


Unblocking in WHM

If you still have access to WHM, you can unblock an IP address using the steps below.

  1. Login to WHM

    114df188698d38c622a188d342b30e87bfc04a17?t=f1552a97f65af688b09b46008ea37611


  2. Search for 'cphulk'

    d0fe8855529dd3d64a63dc44b58ad3bcdf746137?t=d3c5a9f97188fa56e5e422f2f99d5a2f
  3. Click on the 'History Reports' tab and then 'Remove Blocks and Clear Reports'.

    20062be58fdd8bfd12b6bfca86646f952c778b18?t=d88f2f5fbf56d4e63d65293c187c820c
You can also Whitelist your IP in the 'Whitelist Management' tab, by adding your 'IP' and clicking 'Add'.

2da295e3c656d66a77ff40292147d73e3f9fb888?t=c2ca63997a89892ed33cbb622b8435ae


Unblocking in Console

If you are blocked from WHM, you can unblock an IP address using the steps below.

  1. Login via SSH
  2. Run the following commands
    1. mysql -u root
    2. use cphulkd;
    3. SELECT * FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;
    4. DELETE FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;
    5. exit;




Related Articles