By m73mitchell
I noticed my test Rails app calling some strange routes
" Started GET “/w00tw00t.at.blackhats.romanian.anti-sec:)”.
and also running php my admin scripts even though I never installed it. Also in the logs, there’s a record of connections from strange ip addresses (such as 203.199.209.145 ) that google results reveal to be associated with suspicious behaviour
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
hey, <br> <br>those idiots scan the whole internet, I see that GET request every day at work. <br> <br>Just because you see a GET or POST to your webserver does not mean you have been hacked. <br> <br>If you have people actually connecting via ssh to your server (or whatever other management tools/ports) you have enabled and successfully logging in then be concerned or you seeing files in your web server that you did not put there (apache flaws, php exploits aka web server hacked etc) <br> <br>You saying you are running php my admin even though you did not install it worries me though… you sure it didnt come with your droplet? Can you see who has connected to your server? Who is logged on from what IP? <br> <br>If you have no clue kill the box and walk away slowly :)
I recommend disabling nginx/unicorn and killing all processes that are related to your rails app until you find the infected files. <br> <br>As Pablo said, if you have a snapshot/backup of your droplet you can restore it from there.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.