Compromised mirror
| From: | Caciano Machado | Date: | Fri, 14 Dec 2007 13:58:07 +0000 |
| Subject: | Compromised mirror | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-673@lists.php.net to get a copy of this message | ||
Dear Security Officer and/or Administrator,
An examination of our logs reveal that one of our machines is sending
suspicious traffic to the server 212.124.37.9 (de.php.net). This is an
strong indication that this mirror might be compromised.
Matchs of our rule:
12/13/07-16:54:33.011345 143.54.X.X:1074 -> 212.124.37.9:80
12/13/07-17:10:13.576240 143.54.X.X:1047 -> 212.124.37.9:80
Thank you in advance,
Caciano Machado,
IT Security Group (GSTI/UFRGS) - gsti@ufrgs.br