Return-Path: <root@srv.bolconline.co.uk>
Delivered-To: bolconlineco@srv.bolconline.co.uk
Received: from srv.bolconline.co.uk
by srv.bolconline.co.uk with LMTP
id cAS+DrLenGdmBQAAafYFpA
(envelope-from <root@srv.bolconline.co.uk>)
for <bolconlineco@srv.bolconline.co.uk>; Fri, 31 Jan 2025 19:31:14 +0500
Return-path: <root@srv.bolconline.co.uk>
Envelope-to: root@srv.bolconline.co.uk
Delivery-date: Fri, 31 Jan 2025 19:31:14 +0500
Received: from root by srv.bolconline.co.uk with local (Exim 4.96.2)
(envelope-from <root@srv.bolconline.co.uk>)
id 1tds37-0001FQ-37
for root@srv.bolconline.co.uk;
Fri, 31 Jan 2025 19:31:14 +0500
To: root@srv.bolconline.co.uk
Subject: lfd on srv.bolconline.co.uk: Suspicious process running under user nobody
From: <root@srv.bolconline.co.uk>
Message-Id: <E1tds37-0001FQ-37@srv.bolconline.co.uk>
Date: Fri, 31 Jan 2025 19:31:13 +0500
Time: Fri Jan 31 19:31:13 2025 +0500
PID: 3641 (Parent PID:3637)
Account: nobody
Uptime: 100 seconds
Executable:
/usr/local/lsws/bin/lshttpd.6.3.1
Command Line (often faked in exploits):
litespeed (lshttpd - #01)
Network connections by the process (if any):
tcp: 107.155.64.26:443 -> 141.101.96.49:15738
tcp: 107.155.64.26:80 -> 172.71.130.59:15078
tcp: 107.155.64.26:443 -> 213.123.36.7:52311
tcp: 107.155.64.26:80 -> 172.70.39.34:11424
tcp: 107.155.64.26:443 -> 185.93.230.39:60714
Files open by the process (if any):
/dev/null
/dev/null
/var/log/apache2/modsec_audit.log
/dev/urandom
anon_inode:[eventpoll]
anon_inode:[eventfd]
/var/log/apache2/error_log
/dev/shm/lsws/stats.shm
/dev/shm/lsws/stats.lock
/dev/shm/lsws/stats_clients.shm
/dev/shm/lsws/stats_clients.lock
/dev/shm/lsws/SSL.shm
/dev/shm/lsws/SSL.lock
/dev/shm/lsws/modsec_data.shm
/dev/shm/lsws/modsec_data.lock
/dev/shm/lsws/.quicshmdata.shm
/dev/shm/lsws/.quicshmdata.lock
/dev/shm/lsws/.quicshmmap.shm
/dev/shm/lsws/.quicshmmap.lock
/dev/shm/lsws/.cachemanidx.shm
/dev/shm/lsws/.cachemanidx.lock
/dev/shm/lsws/.store.0.shm
/dev/shm/lsws/.store.0.lock
/dev/shm/lsws/adns_cache.shm
/dev/shm/lsws/adns_cache.lock
anon_inode:[eventfd]
anon_inode:[eventfd]
anon_inode:[eventfd]
anon_inode:[eventfd]
anon_inode:[signalfd]
Memory maps by the process (if any):
00400000-010ea000 r-xp 00000000 00:00 0
010ea000-012ea000 ---p 00000000 00:00 0
012ea000-01327000 r--p 00000000 00:00 0
01327000-013db000 rw-p 00000000 00:00 0
0249b000-02521000 rw-p 00000000 00:00 0 [heap]
02521000-02d79000 rw-p 00000000 00:00 0 [heap]
02d79000-02ee5000 rw-p 00000000 00:00 0 [heap]
7f523c000000-7f523c0e2000 rw-p 00000000 00:00 0
7f523c0e2000-7f5240000000 ---p 00000000 00:00 0
7f5244000000-7f5244021000 rw-p 00000000 00:00 0
7f5244021000-7f5248000000 ---p 00000000 00:00 0
7f52499fb000-7f52499fc000 ---p 00000000 00:00 0
7f52499fc000-7f524a1fc000 rw-p 00000000 00:00 0
7f524a1fc000-7f524a1fd000 ---p 00000000 00:00 0
7f524a1fd000-7f524a9fd000 rw-p 00000000 00:00 0
7f524a9fd000-7f524a9fe000 ---p 00000000 00:00 0
7f524a9fe000-7f524b1fe000 rw-p 00000000 00:00 0
7f524b1fe000-7f524b1ff000 ---p 00000000 00:00 0
7f524b1ff000-7f524b9ff000 rw-p 00000000 00:00 0
7f524b9ff000-7f524ba00000 ---p 00000000 00:00 0
7f524ba00000-7f524c200000 rw-p 00000000 00:00 0
7f524c200000-7f524c204000 rw-s 00000000 00:13 449507694 /dev/shm/lsws/adns_cache.shm
7f524c204000-7f524c300000 ---s 00054000 00:04 457724077 /dev/zero (deleted)
7f524c397000-7f524c39e000 r--p 00000000 fd:00 52561841 /home/khi0tqe2ntyx/public_html/store/course_data/Certificate in Accounting & Finance.webp
7f524c39e000-7f524c3b0000 r--p 00000000 fd:00 45091529 /home/bolcportal/public_html/ce.jpg
7f524c3b0000-7f524c400000 rw-s 00000000 00:04 457706336 /dev/zero (deleted)
7f524c400000-7f524c40a000 rw-s 00000000 00:13 449507175 /dev/shm/lsws/.store.0.shm
7f524c40a000-7f524c500000 ---s 000ae000 00:04 457706323 /dev/zero (deleted)
7f524c500000-7f524c600000 rw-s 00000000 00:04 457706330 /dev/zero (deleted)
7f524c600000-7f524c60a000 rw-s 00000000 00:13 449507171 /dev/shm/lsws/.cachemanidx.shm
7f524c60a000-7f524c800000 ---s 0000a000 00:04 457706321 /dev/zero (deleted)
7f524c800000-7f524c804000 rw-s 00000000 00:13 449507165 /dev/shm/lsws/.quicshmmap.shm
7f524c804000-7f524ca00000 ---s 00004000 00:04 457706317 /dev/zero (deleted)
7f524ca00000-7f524ca68000 rw-s 00000000 00:13 449507162 /dev/shm/lsws/.quicshmdata.shm
7f524ca68000-7f524cc00000 ---s 00068000 00:04 457706316 /dev/zero (deleted)
7f524cc00000-7f524cc08000 rw-s 00000000 00:13 457706313 /dev/shm/lsws/modsec_data.shm
7f524cc08000-7f524ce00000 ---s 00008000 00:04 457706315 /dev/zero (deleted)
7f524ce00000-7f524ce02000 rw-s 00000000 00:13 449507149 /dev/shm/lsws/SSL.shm
7f524ce02000-7f524d000000 ---s 00002000 00:04 457706305 /dev/zero (deleted)
7f524d000000-7f524d128000 rw-s 00000000 00:13 449507146 /dev/shm/lsws/stats_clients.shm
7f524d128000-7f524d300000 ---s 00128000 00:04 457706304 /dev/zero (deleted)
7f524d300000-7f524d302000 rw-s 00000000 00:13 457706301 /dev/shm/lsws/stats.shm
7f524d302000-7f524d400000 ---s 000be000 00:04 457706303 /dev/zero (deleted)
7f524d406000-7f524d409000 r--p 00000000 fd:00 33821543 /var/www/html/cp_errordocument.shtml
7f524d40b000-7f524d40d000 r--p 00000000 fd:00 55586783 /home/oxfordhomestudy/public_html/images/subject/1710760204aiforaccounting.webp
7f524d40d000-7f524d40e000 r--p 00000000 fd:00 33817860 /var/www/html/404.shtml
7f524d41b000-7f524d41c000 ---p 00000000 00:00 0
7f524d41c000-7f524d423000 rw-p 00000000 00:00 0
7f524d423000-7f524d444000 rw-p 00000000 00:00 0
7f524d444000-7f524d494000 rw-s 00000000 00:04 457706298 /dev/zero (deleted)
7f524d494000-7f524d4a0000 r-xp 00000000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f524d4a0000-7f524d69f000 ---p 0000c000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f524d69f000-7f524d6a0000 r--p 0000b000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f524d6a0000-7f524d6a1000 rw-p 0000c000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f524d6a1000-7f524d6a7000 rw-p 00000000 00:00 0
7f524d6a7000-7f524d6a9000 r--p 00000000 fd:00 50338018 /home/oxfordhomestudy/public_html/images/loading.gif
7f524d6a9000-7f524d6ab000 rw-s 00000000 00:13 449507695 /dev/shm/lsws/adns_cache.lock
7f524d6ab000-7f524d6ad000 rw-s 00000000 00:04 457706329 /dev/zero (deleted)
7f524d6ad000-7f524d6af000 rw-s 00000000 00:13 449507176 /dev/shm/lsws/.store.0.lock
7f524d6af000-7f524d6b1000 rw-s 00000000 00:13 449507172 /dev/shm/lsws/.cachemanidx.lock
7f524d6b1000-7f524d6b3000 rw-s 00000000 00:13 449507166 /dev/shm/lsws/.quicshmmap.lock
7f524d6b3000-7f524d6b7000 rw-p 00000000 00:00 0
7f524d6b7000-7f524d6b9000 r-xp 00000000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f524d6b9000-7f524d8b8000 ---p 00002000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f524d8b8000-7f524d8b9000 r--p 00001000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f524d8b9000-7f524d8ba000 rw-p 00002000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f524d8ba000-7f524da7e000 r-xp 00000000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f524da7e000-7f524dc7d000 ---p 001c4000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f524dc7d000-7f524dc81000 r--p 001c3000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f524dc81000-7f524dc83000 rw-p 001c7000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f524dc83000-7f524dc89000 rw-p 00000000 00:00 0
7f524dc89000-7f524dd8a000 r-xp 00000000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f524dd8a000-7f524df89000 ---p 00101000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f524df89000-7f524df8a000 r--p 00100000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f524df8a000-7f524df8b000 rw-p 00101000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f524df8b000-7f524df93000 r-xp 00000000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f524df93000-7f524e192000 ---p 00008000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f524e192000-7f524e193000 r--p 00007000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f524e193000-7f524e194000 rw-p 00008000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f524e194000-7f524e1c2000 rw-p 00000000 00:00 0
7f524e1c2000-7f524e1c4000 r-xp 00000000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f524e1c4000-7f524e3c4000 ---p 00002000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f524e3c4000-7f524e3c5000 r--p 00002000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f524e3c5000-7f524e3c6000 rw-p 00003000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f524e3c6000-7f524e3c7000 rw-p 00000000 00:00 0
7f524e3c7000-7f524e3ce000 r-xp 00000000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f524e3ce000-7f524e5cd000 ---p 00007000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f524e5cd000-7f524e5ce000 r--p 00006000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f524e5ce000-7f524e5cf000 rw-p 00007000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f524e5cf000-7f524e5e6000 r-xp 00000000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f524e5e6000-7f524e7e5000 ---p 00017000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f524e7e5000-7f524e7e6000 r--p 00016000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f524e7e6000-7f524e7e7000 rw-p 00017000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f524e7e7000-7f524e7eb000 rw-p 00000000 00:00 0
7f524e7eb000-7f524e7ed000 rw-s 00000000 00:13 449507163 /dev/shm/lsws/.quicshmdata.lock
7f524e7ed000-7f524e7ef000 rw-s 00000000 00:13 457706314 /dev/shm/lsws/modsec_data.lock
7f524e7ef000-7f524e7f1000 rw-s 00000000 00:13 449507150 /dev/shm/lsws/SSL.lock
7f524e7f1000-7f524e7f3000 rw-s 00000000 00:13 449507147 /dev/shm/lsws/stats_clients.lock
7f524e7f3000-7f524e7f5000 rw-s 00000000 00:13 457706302 /dev/shm/lsws/stats.lock
7f524e7f5000-7f524e7f6000 rw-p 00000000 00:00 0
7f524e7f6000-7f524e7f7000 rw-p 00000000 00:00 0
7f524e7f7000-7f524e7f8000 rw-p 00000000 00:00 0
7f524e7f8000-7f524e81a000 r-xp 00000000 fd:00 27003827 /usr/lib64/ld-2.17.so
7f524e81a000-7f524ea19000 ---p 00000000 00:00 0
7f524ea19000-7f524ea1a000 r--p 00021000 fd:00 27003827 /usr/lib64/ld-2.17.so
7f524ea1a000-7f524ea1b000 rw-p 00022000 fd:00 27003827 /usr/lib64/ld-2.17.so
7f524ea1b000-7f524ea1c000 rw-p 00000000 00:00 0
7ffcb6b50000-7ffcb6d57000 rw-p 00000000 00:00 0 [stack]
7ffcb6d7a000-7ffcb6d7c000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
|