Re: Compromised mirror
| From: | Derick Rethans | Date: | Fri, 14 Dec 2007 14:54:06 +0000 |
| Subject: | Re: Compromised mirror | ||
| References: | 1 | Groups: | php.webmaster |
| Request: | Send a blank email to php-webmaster+get-675@lists.php.net to get a copy of this message | ||
Hello!
On Fri, 14 Dec 2007, Caciano Machado wrote:
> An examination of our logs reveal that one of our machines is sending
> suspicious traffic to the server 212.124.37.9 (de.php.net). This is an
> strong indication that this mirror might be compromised.
>
> Matchs of our rule:
> 12/13/07-16:54:33.011345 143.54.X.X:1074 -> 212.124.37.9:80
> 12/13/07-17:10:13.576240 143.54.X.X:1047 -> 212.124.37.9:80
We've contacted the respective mirror maintainer. But, I don't see why
it is strange that one of your machines connects to de.php.net. Couldn't
be that somebody is just using a client to request a manual page?
regards,
Derick
--
Derick Rethans
http://derickrethans.nl | http://ezcomponents.org | http://xdebug.org