Compromised mirror (fwd)

Hello, we received the following message, could you please investigate? regards, Derick -- Derick Rethans http://derickrethans.nl | http://ezcomponents.org | http://xdebug.org ---------- Forwarded message ---------- Date: Fri, 14 Dec 2007 11:58:07 -0200 From: Caciano Machado <caciano@cpd.ufrgs.br> To: webmaster@php.net Cc: Grupo de Seguranca em TI <gsti@ufrgs.br> X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.1.5 Subject: [PHP-WEBMASTER] Compromised mirror Dear Security Officer and/or Administrator, An examination of our logs reveal that one of our machines is sending suspicious traffic to the server 212.124.37.9 (de.php.net). This is an strong indication that this mirror might be compromised. Matchs of our rule: 12/13/07-16:54:33.011345 143.54.X.X:1074 -> 212.124.37.9:80 12/13/07-17:10:13.576240 143.54.X.X:1047 -> 212.124.37.9:80 Thank you in advance, Caciano Machado, IT Security Group (GSTI/UFRGS) - gsti@ufrgs.br -- PHP Webmaster List Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php