Creating Sub Domains in WHM with domains owned by someone else

Last week I got a msn message from a customer asking desperately for help. She began to tell me about a domain name she purchased in April and showed me the website she had built using the domain name. Then she showed me 90 sub domain pages indexed in Yahoo using the same domain she had purchased in April. She started to explain that the 90 pages in Yahoo were not built by her and didn't remember creating a sub domain. I asked her was the domain "she purchased in April" hosted on a cpanel reseller account and she replied "Yes". I knew what was going... so I started telling her how this same thing happened to me 3 years earlier.

3 years earlier I purchased a cpanel reseller account from a well known hosting company. The first month I purchased 40 domains and added them into the cpanel reseller account's WHM area and built a website and did some seo for each domain. The 3rd month I started checking Google to see if the new domains /sites were indexed and ranked for search terms and what I found was Totally Unexpected! I found one of my domains was indexed for 1000 pages but previously during the 1st month I only made 3-4 pages for each of the 40 domains I had purchased. I was really confused because the 1000 pages were all different in content with ppc ads. Then I realized the "1000 pages indexed in Google" were all sub.domains but I had never created any sub domains with the 40 domains I had purchased. My first reaction was that someone hacked into the cpanel "of the domain with 1000 pages indexed in Google" and created a sub domain so I logged into cpanel and no sub domains had been created. At that point I was very confused so I started researching how cpanel worked and below is what I discovered.

1. Creating Sub Domains in WHM - Using a domain that you already have created an account for in WHM, you can create a new account with this domain but as a sub domain. This enables the sub domain to have complete dns Zone File entries which allows email @sub.domain, ftp access and its own cpanel.
​

2. Using Domains Owned by Someone Else to create Sub Domains - A reseller account is 1 of many resellers accounts on the same server. You could create sub.domains in your WHM reseller account using domains owned by other reseller accounts on the same server.​

3. Finding domains on the same server - I found a tool "Reverse IP" were I could enter one of my domains listed in my reseller account. The results from this tool showed a list of domains hosted on other reseller accounts on the same server as my reseller account . So I picked adomain.com from the list and logged into my WHM reseller account, created a new account using this adomain.com called subdomain.adomain.com. I open my browser and went to subdomain.adomain.com and there was a 'index of'. Next I entered subdomain.adomain.com/cpanel in my browser and without any problem I logged into subdomain.adomain.com/cpanel. Just to make note! This was only a test and immediately deleted the account 'subdomain.adomain.com' in my WHM reseller account! I think all hosting companies using Cpanel software should disable resellers from creating accounts / adding domains that are already created by another reseller accounts on the same server.
​

My Advice to anyone using Cpanel servers

1. Before buying a Cpanel reseller account or dedicated server, ask the hosting company "can other resellers create sub domains using the domains created in your reseller account".
2. If you own a dedicated server running Cpanel, contact your data center and ask them to disable your server from allowing resellers to create accounts / adding domains that are already created by another reseller accounts.

Disclaimer:
This thread is not a tutorial on how to created sub domains with domains owned by others. My main reason is for posting this thread is to educate people using cpanel servers on how to disable resellers from creating sub domains with domains owned by others. I have enjoyed using cpanel for 5 year and believe Cpanel is the best software for hosting websites. Cpanel is always updating whm/cpanel security to stay ahead of new cpanel hacking techniques which stop hackers trying to exploit WHM/Cpanel's security.

 

I read this with interest..

tested this on one of my dedicated servers

e.g reseller account 1. got a domain name e.g xyz.com

went to reseller account 2

created an account test.xyz.com

LOL I couldnt believe it.. it was live in 2 mins

pete

 

Interesting . what if someone else made a subdomain but u later setup the same subdomain in your cpanel ? cpanel wouldnt let you to create the subdomain coz its already exists ?

 

Wow, Very interesting article, l wish l am with the most popular websites server and l wish l would use, games.yahoo.com or seo.yahoo.com or something like that, games.microsoft.com would be cool or keygen.msn.com

 

Hmm Good Question!

Im not sure, it would guess it whm wouldn't let you create the same sub.domain.com