Automatic notifications for suspicious logins

Through usage monitoring and real-time analysis we can assess and stop all kinds of threats (spam sending, malicious code injection...), but there are other actions that would not involve abusive use of the service and could therefore go unnoticed. For example, an attacker who has the login details for an email account and connects via POP to download everything and gather information: there is no problematic action or usage that reveals the breach, other than the access log.

That access log would show the IP the user connects from and, therefore, their likely location.

To make use of this information, we have built an alert system that assesses whether the IP connecting to a service is likely to be suspicious. If, for example, a user usually connects to cPanel from a Spanish IP located in Madrid and suddenly a connection appears from an IP in Paris, France, they would receive an alert like the one below, showing the date and time of the event, IP, location, service and user. If it really is the user logging in, they can simply ignore the notice; if not, they should follow the steps in the manuals provided to secure their account.

The system monitors all logins for all services, including cPanel, FTP, POP, IMAP, SMTP, SSH and webmail.

Soon these logs will also be available in the client area so that each administrator can review and filter logins, which is especially useful in companies where the IT department needs precise control over each user's access.