diff --git a/lib/php-scanner.sh b/lib/php-scanner.sh
index 30bc459..0953f49 100755
--- a/lib/php-scanner.sh
+++ b/lib/php-scanner.sh
@@ -454,7 +454,7 @@ find_domain_owner() {
 
     case "${SYS_CONTROL_PANEL:-unknown}" in
         cpanel)
-            grep "^${domain}:" /etc/trueuserdomains 2>/dev/null | cut -d: -f2
+            grep "^${domain}:" /etc/trueuserdomains 2>/dev/null | cut -d: -f2 | tr -d ' '
             ;;
         plesk)
             if command_exists mysql && [ -f /etc/psa/.psa.shadow ]; then
@@ -482,17 +482,31 @@ find_domain_access_log() {
             local owner
             owner=$(find_domain_owner "$domain")
             if [ -n "$owner" ]; then
-                find "/home/${owner}/public_html" -maxdepth 2 -name "access_log*" -type f 2>/dev/null | head -1
+                # Try access-logs directory first (follows symlinks)
+                local log_file
+                log_file=$(find -L "/home/${owner}/access-logs" -type f -name "*${domain}*" 2>/dev/null | head -1)
+
+                # If not found, try Apache domlogs directory directly
+                if [ -z "$log_file" ] && [ -d "/etc/apache2/logs/domlogs" ]; then
+                    log_file=$(find "/etc/apache2/logs/domlogs" -type f -name "*${domain}*" 2>/dev/null | head -1)
+                fi
+
+                # If not found, try public_html
+                if [ -z "$log_file" ] && [ -d "/home/${owner}/public_html" ]; then
+                    log_file=$(find "/home/${owner}/public_html" -maxdepth 2 -type f -name "access_log*" 2>/dev/null | head -1)
+                fi
+
+                echo "$log_file"
             fi
             ;;
         plesk)
-            find "/var/www/vhosts/${domain}/statistics/logs" -name "access_log*" -type f 2>/dev/null | head -1
+            find "/var/www/vhosts/${domain}/statistics/logs" -type f -name "access_log*" 2>/dev/null | head -1
             ;;
         interworx)
-            find "/home/*/public_html/${domain}" -name "access_log*" -type f 2>/dev/null | head -1
+            find "/home/*/public_html/${domain}" -type f -name "access_log*" 2>/dev/null | head -1
             ;;
         *)
-            find /var/log -name "*${domain}*access*log*" -type f 2>/dev/null | head -1
+            find /var/log -type f -name "*${domain}*access*log*" 2>/dev/null | head -1
             ;;
     esac
 }