How One Compromised Reseller Account Let an Attacker Hit Dozens…

Incident Analysis · June 2026

An Indonesian gambling-spam campaign called LEMON212 planted doorway pages across multiple unrelated customer sites on our server — not by breaching them individually, but by taking over a single reseller account and walking its customer list.

By Tremhost Infrastructure Security ·

Earlier this month we discovered a coordinated parasite-SEO attack on one of our managed cPanel/WHM servers. Dozens of customer websites — a hospital here, a school there, completely unrelated businesses — had been silently filled with Indonesian online-gambling content.

The attacker wasn’t targeting any of those businesses individually. They had taken over the account of a reseller who managed all of those sites, and used that single login to walk straight into every site the reseller owned.

We’re publishing what we found because the propagation mechanism is underappreciated, the detection lessons are non-obvious, and the mitigations are straightforward once you understand the attack surface.

We have published the full report here. Or full link: https://tremhost.com/how-one-compromised-reseller-account-let-an-attacker-hit-dozens-of-websites-at-once/

Impact

The compromise allowed unauthorized content injection across multiple unrelated websites, potentially damaging the reputation of affected businesses and exposing their visitors to malicious or unwanted content. The attack exploited the reseller account's broad access, enabling a single point of failure to impact many sites simultaneously. There is no indication of direct data theft or further exploitation beyond content injection in the provided information.

Defensive guidance

Mitigation focuses on securing reseller accounts through strong authentication measures such as multi-factor authentication, regular credential audits, and monitoring for unusual reseller activity. Hosting providers should educate resellers on security best practices and consider limiting reseller privileges to reduce attack surface. Since this is not a software vulnerability, patch status is not applicable.

Summary

An attacker compromised a reseller account managing multiple customer websites on a cPanel/WHM server. Using the reseller's single login, the attacker deployed doorway pages promoting Indonesian gambling content across dozens of unrelated sites, including hospitals and schools. The attack leveraged the reseller account's broad access to multiple sites, enabling widespread content injection without individual site breaches. The incident underscores the importance of securing reseller credentials and monitoring reseller account activities to prevent large-scale propagation of malicious content.

How One Compromised Reseller Account Let an Attacker Hit Dozens of Websites at Once

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 24 Jun 2026, 08:54 UTC

Technical details

References

Community reviews

Related threats