V1rus Private

Viewing: accounts_audit.sh

#!/bin/bash
# TG 2025
RESELLERS=$(cat /var/cpanel/resellers | cut -f 1 -d :)
SERVER=$(hostname)

echo "=== STANDARD USERS ==="
CPUSERS=$(grep OWNER=root /var/cpanel/users/* | cut -f 1 -d : | xargs -n 1 basename)
for CPUSER in $CPUSERS; do
        if grep -q -w $CPUSER /etc/passwd; then
                USED=$(whmapi1 --output=jsonpretty accountsummary user=$CPUSER | jq -r '.data.acct[].diskused' | sed 's/M//')
                USED_INT=${USED%.*}
                ACCOUNT_IP=$(grep ^IP /var/cpanel/users/$CPUSER  | cut -f 2 -d =)
                if [ "$USED_INT" -gt "50000" ]; then
                        echo "$SERVER;$ACCOUNT_IP;$CPUSER;$USED_INT"
                fi
        fi
done

echo "=== RESELLERS ==="
for RESELLER in $RESELLERS; do
        USED=$(whmapi1 --output=jsonpretty resellerstats user=$RESELLER | jq -r .data.reseller.diskused)
        USED_INT=${USED%.*}
        ACCOUNT_IP=$(grep ^IP /var/cpanel/users/$RESELLER  | cut -f 2 -d =)
        if [ "$USED_INT" -gt "150000" ]; then
                echo "$SERVER;$ACCOUNT_IP;$RESELLER;$USED_INT"
        fi
done

User / IP	: 216.73.217.26
Host / Server	: 103.138.189.202 / chaitanyalaw.com
System	: Linux s1325.sgp1.mysecurecloudhost.com 4.18.0-513.9.1.lve.el8.x86_64 #1 SMP Mon Dec 4 15:01:22 UTC 2023 x86_64