Nameserver IP’s Missing in WHM?

Some time’s it happens that when you try to access the name-server IP’s from  WHM >> Main >> DNS Functions >> Nameserver IPs it either shows no IP’s or show incorrect information.

To fix the issue you need to correct the entries for the name-server’s IP in the below two files ::




2 >



Firstly, check the entries in the /etc/nameserverips file and it should show the below output ::


[email protected] [~]# cat /etc/nameserverips

And if the entries in the above files are correct then check the next file it should show the below output ::


[email protected] [~]# cat /var/cpanel/nameserverips.yaml
"": 1
count: '1'
"": 1
count: '1'

If the above entries are missing in the above file then add those as shown in the example.

That’s all.


Shell Script to list IP’s for domains

Many times it happens that when auditing  a server  you need to  check  which  domain is resolving from  the server in  that case you can  use  the below simple shell script  which  will  list all the domains with  their respective IP’s.

For this all you need to do is to copy all the domains hosted on the server in a  text file.

For cPanel  you can copy all domains in a .txt file  using the below command :: 


[email protected][#] cat  /etc/userdomains | awk '{print $1}' | tr -d ':|*' > domainlist.txt

For Plesk you can copy all domains in a .txt file  using the below command ::


[email protected][#] cd /var/qmail/mailnames ;  ls -l  awk '{print $9}' > domainlist.txt

And for  Plain server you can copy all  the domains in a domainlist.txt file


Now, that we have all the domain names copied in  the domainlist.txt file  we  just need to  execute the below script from shell  as a root user 


[email protected][#] for i in `cat domainlist.txt`; do host $i | grep 'not found|has IP address';  done


The above command will list the results as :: has address has address

That’s all.






Script to replace the hacked index page server wide

Many times it happens that the hacked index.htm  pages are uploaded by hackers under 
all account's hosted on the server and one has to either remove or rename those hacked
index.htm pages and it becomes very difficult to  rename all  hacked index.htm pages one
by one if there are many accounts hosted on  the affected server.  

So, if you come accross the same situation then don't panic just  use the below 
command to rename all  hacked index.htm pages to index.htm-hacked

[email protected][#]  for i in `find -mindepth 1 -maxdepth 3 -name index.htm`; do  mv $i $i-hacked ;  done

Note :: You can replace index.htm with whatever file name that is affected, for ex : index.php, index.html etc and make sure you are executing the above command in /home directory.

That’s all you are done,  easy isn’t it.