On Wed, Oct 21, 2020 at 08:50:54AM -0700, Rich Wales wrote:
> My server IS NOT RUNNING THINKPHP OR WORDPRESS. Never has.
While the webserver is a good bet, before investing too much time
chasing ghosts, enumerate all the network listeners on your listem.
Something along the lines of (for Linux):
# netstat -anp --inet --tcp | grep LISTEN
# netstat -anp --inet6 --tcp | grep LISTEN
What LISTENERS do you see? Then check your iptables for any unexpected
source IP mappings.
# iptables -4 -t nat -n -L
These are hard to read, look carefully for anything that might NAT
remote IPs to 127.0.0.1.
But of course the web server is still a good bet.
--
Viktor.
