ConfigServer Community Forum

I have the following crom job to help get support email into my gmail account:

/usr/bin/php -q /home/doory/public_html/account/pipe/pop.php /dev/null 2>&1

In my ignore file, I have tried both of these (1 at a time with a restart of ldf each time):
cmd:/usr/bin/php -q /home/doory/public_html/account/pipe/pop.php /dev/null 2>&1
/usr/bin/php -q /home/doory/public_html/account/pipe/pop.php

I still get a suspicious email alert from this cron job every 5 min (that is how often it runs).

This is that email:

Executable:

/home/virtfs/doory/usr/bin/php


Command Line (often faked in exploits):

/usr/bin/php -q /home/doory/public_html/account/pipe/pop.php


Network connections by the process (if any):

tcp: 72.14.182.143:57648 -> 173.194.64.108:995

Any ideas what I might be doing wrong?

You should use csf.pignore (process ignore) and add one of the following lines:
exe:/home/virtfs/doory/usr/bin/php
or
cmd:/usr/bin/php -q /home/doory/public_html/account/pipe/pop.php