Port scans COMING from my phpnuke site

New Member Joined: Jul 18, 2005 Posts: 15

I checked my firewall logs and noticed i'm getting port scans from:

admin.crypticconspiracies.com

My site is http://crypticconspiracies.com/

I've contacted my hosts in order to solve the problem. They can't find anything inserted into my databse that's not supposed to be there.

But they do agree it's something malicious.

anybody have any ideas?

Posted: Tue Aug 02, 2005 10:17 am

Just database entries?

If you're hosted on a Linux box, you may want to check a few things or get your host to do it.

1. Check etc/passwd for new accounts, especially anything with a UID or GID of 0

2, Your host will know which TCP/UDP ports are listening on your server & be able to spot anything odd. Check ARP entries too.

3. If you have access to your server logs you can do this, if not, get your host to scan the logs for excessive errors, rpc entries, unusual or excessive authentification failures, ect. Your host should know what to look for.

4. Do you allow anonymous ftp privileges? If so, you may want to check the 'Incoming' folder for unauthorised uploaded scripts or programs.

There are a lot of other things that could be reviewed, but I don't know your hosting setup. I would suggest talking to your host and asking for a deeper inspection of the server.