Return-Path: <root@srv.bolconline.co.uk>
Delivered-To: bolconlineco@srv.bolconline.co.uk
Received: from srv.bolconline.co.uk
by srv.bolconline.co.uk with LMTP
id AOMGEWj6nGeXVAAAafYFpA
(envelope-from <root@srv.bolconline.co.uk>)
for <bolconlineco@srv.bolconline.co.uk>; Fri, 31 Jan 2025 21:29:28 +0500
Return-path: <root@srv.bolconline.co.uk>
Envelope-to: root@srv.bolconline.co.uk
Delivery-date: Fri, 31 Jan 2025 21:29:28 +0500
Received: from root by srv.bolconline.co.uk with local (Exim 4.96.2)
(envelope-from <root@srv.bolconline.co.uk>)
id 1tdttX-00067d-2r
for root@srv.bolconline.co.uk;
Fri, 31 Jan 2025 21:29:28 +0500
To: root@srv.bolconline.co.uk
Subject: lfd on srv.bolconline.co.uk: Suspicious process running under user nobody
From: <root@srv.bolconline.co.uk>
Message-Id: <E1tdttX-00067d-2r@srv.bolconline.co.uk>
Date: Fri, 31 Jan 2025 21:29:27 +0500
Time: Fri Jan 31 21:29:27 2025 +0500
PID: 22861 (Parent PID:22857)
Account: nobody
Uptime: 118 seconds
Executable:
/usr/local/lsws/bin/lshttpd.6.3.1
Command Line (often faked in exploits):
litespeed (lshttpd - #01)
Network connections by the process (if any):
tcp: 107.155.64.26:443 -> 162.158.190.72:26260
tcp: 107.155.64.26:443 -> 66.249.65.41:54435
tcp: 107.155.64.26:443 -> 185.93.230.39:34702
tcp: 107.155.64.26:80 -> 172.70.175.98:29516
Files open by the process (if any):
/dev/null
/dev/null
/var/log/apache2/modsec_audit.log
/dev/urandom
anon_inode:[eventpoll]
anon_inode:[eventfd]
/var/log/apache2/error_log
/dev/shm/lsws/stats.shm
/dev/shm/lsws/stats.lock
/dev/shm/lsws/stats_clients.shm
/dev/shm/lsws/stats_clients.lock
/dev/shm/lsws/SSL.shm
/dev/shm/lsws/SSL.lock
/dev/shm/lsws/modsec_data.shm
/dev/shm/lsws/modsec_data.lock
/dev/shm/lsws/.quicshmdata.shm
/dev/shm/lsws/.quicshmdata.lock
/dev/shm/lsws/.quicshmmap.shm
/dev/shm/lsws/.quicshmmap.lock
/dev/shm/lsws/.cachemanidx.shm
/dev/shm/lsws/.cachemanidx.lock
/dev/shm/lsws/.store.0.shm
/dev/shm/lsws/.store.0.lock
/dev/shm/lsws/adns_cache.shm
/dev/shm/lsws/adns_cache.lock
anon_inode:[eventfd]
anon_inode:[eventfd]
anon_inode:[eventfd]
anon_inode:[eventfd]
anon_inode:[signalfd]
Memory maps by the process (if any):
00400000-010ea000 r-xp 00000000 00:00 0
010ea000-012ea000 ---p 00000000 00:00 0
012ea000-01327000 r--p 00000000 00:00 0
01327000-013db000 rw-p 00000000 00:00 0
030c4000-0314a000 rw-p 00000000 00:00 0 [heap]
0314a000-039a7000 rw-p 00000000 00:00 0 [heap]
039a7000-03bfc000 rw-p 00000000 00:00 0 [heap]
7f9968000000-7f9968023000 rw-p 00000000 00:00 0
7f9968023000-7f996c000000 ---p 00000000 00:00 0
7f996c000000-7f996c028000 rw-p 00000000 00:00 0
7f996c028000-7f9970000000 ---p 00000000 00:00 0
7f9970000000-7f9970091000 rw-p 00000000 00:00 0
7f9970091000-7f9974000000 ---p 00000000 00:00 0
7f99777c7000-7f99777cb000 rw-p 00000000 00:00 0
7f99777cb000-7f99777cd000 r--p 00000000 fd:00 50341544 /home/oxfordhomestudy/public_html/images/nd/benefits/919871637603540unlocked-padlock.webp
7f99777cd000-7f99777cf000 r--p 00000000 fd:00 50341535 /home/oxfordhomestudy/public_html/images/nd/benefits/275261637603414resume-and-cv.webp
7f99777cf000-7f99777d1000 r--p 00000000 fd:00 50341543 /home/oxfordhomestudy/public_html/images/nd/benefits/864461637603481mortarboard.webp
7f99777d1000-7f99777d3000 r--p 00000000 fd:00 50337978 /home/oxfordhomestudy/public_html/images/endorsed-certificate.png
7f99777d3000-7f99777d5000 r--p 00000000 fd:00 50341540 /home/oxfordhomestudy/public_html/images/nd/benefits/37971637603739double-up-arrow.webp
7f99777d5000-7f99777d7000 r--p 00000000 fd:00 50341537 /home/oxfordhomestudy/public_html/images/nd/benefits/472411637602046test.webp
7f99777d7000-7f99777d9000 r--p 00000000 fd:00 50341538 /home/oxfordhomestudy/public_html/images/nd/benefits/654431637603809Pause-1.webp
7f99777d9000-7f99777df000 r--p 00000000 fd:00 50337909 /home/oxfordhomestudy/public_html/fonts/glyphicons-halflings-regular.woff
7f99777df000-7f99777e1000 r--p 00000000 fd:00 55236410 /home/oxfordhomestudy/public_html/images/subject/1709821030HotelManagementEndorsed1.webp
7f99777e1000-7f99777e3000 r--p 00000000 fd:00 55236417 /home/oxfordhomestudy/public_html/images/subject/1709821232HotelManagementEndorsed5.webp
7f99777e3000-7f99777e5000 r--p 00000000 fd:00 55236416 /home/oxfordhomestudy/public_html/images/subject/1709821209HotelManagementEndorsed7.webp
7f99777e5000-7f99777e7000 r--p 00000000 fd:00 55236415 /home/oxfordhomestudy/public_html/images/subject/1709821108HotelManagementEndorsed1A.webp
7f99777e7000-7f99777ea000 r--p 00000000 fd:00 55236414 /home/oxfordhomestudy/public_html/images/subject/1709821090HotelManagementEndorsed2.webp
7f99777ea000-7f99777ec000 r--p 00000000 fd:00 55236413 /home/oxfordhomestudy/public_html/images/subject/1709821072HotelManagementEndorsed4.webp
7f99777ec000-7f99777ff000 r--p 00000000 fd:00 13241857 /home/bolcco/public_html/css/nd/font-awesome-4.7.0/fonts/fontawesome-webfont.woff2
7f99777ff000-7f9977800000 ---p 00000000 00:00 0
7f9977800000-7f9978000000 rw-p 00000000 00:00 0
7f9978000000-7f9978039000 rw-p 00000000 00:00 0
7f9978039000-7f997c000000 ---p 00000000 00:00 0
7f997c000000-7f997c021000 rw-p 00000000 00:00 0
7f997c021000-7f9980000000 ---p 00000000 00:00 0
7f9980000000-7f9980021000 rw-p 00000000 00:00 0
7f9980021000-7f9984000000 ---p 00000000 00:00 0
7f9984000000-7f9984003000 r--p 00000000 fd:00 55236412 /home/oxfordhomestudy/public_html/images/subject/1709821059HotelManagementEndorsed3.webp
7f9984003000-7f9984006000 r--p 00000000 fd:00 55236411 /home/oxfordhomestudy/public_html/images/subject/1709821047HotelManagementEndorsed2.webp
7f9984006000-7f9984009000 r--p 00000000 fd:00 55236432 /home/oxfordhomestudy/public_html/images/subject/1709823035EventManagementEndorsed5.webp
7f9984009000-7f9984011000 r--p 00000000 fd:00 13241950 /home/bolcco/public_html/favicon.ico
7f9984011000-7f9984044000 r--p 00000000 fd:00 50339358 /home/oxfordhomestudy/public_html/images/blog/1645716390Depositphotos_34889545_l.jpg
7f9984044000-7f9984070000 r--p 00000000 fd:00 50338314 /home/oxfordhomestudy/public_html/admin/uploads/1645716331itphotos_11009080_m.jpg
7f9984070000-7f9984073000 r--p 00000000 fd:00 33821543 /var/www/html/cp_errordocument.shtml
7f9984074000-7f9984077000 r--p 00000000 fd:05 154 /tmp/lshttpd/swap/2/8/ba699be503913e2a1380d0fa85169c.lsb
7f9984077000-7f9984078000 r--p 00000000 fd:00 33817860 /var/www/html/404.shtml
7f9984078000-7f998408b000 r--p 00000000 fd:00 49592533 /home/bolconlineco/public_html/Assignment/1576269632ASSESSMENT 3.pdf
7f998408c000-7f998409f000 r--p 00000000 fd:00 50342170 /home/oxfordhomestudy/public_html/css/nd/font-awesome-4.7.0/fonts/fontawesome-webfont.woff2
7f998409f000-7f99840a4000 r--p 00000000 fd:00 50337899 /home/oxfordhomestudy/public_html/fonts/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
7f99840a4000-7f99840a6000 r--p 00000000 fd:00 52961404 /home/oxfordhomestudy/public_html/images/thesitelogo.webp
7f99840a6000-7f99840ae000 r--p 00000000 fd:00 53520025 /home/oxfordhomestudy/public_html/js/bootstrap.min.js
7f99840ae000-7f99840b6000 r--p 00000000 fd:05 78 /tmp/lshttpd/swap/b/b/29877ba19ef1826ffde735bf99cf83.lsb
7f99840b6000-7f99840cc000 r--p 00000000 fd:00 50341218 /home/oxfordhomestudy/public_html/js/nd/jquery-3.2.1.min.js
7f99840cc000-7f99840e7000 r--p 00000000 fd:00 50337890 /home/oxfordhomestudy/public_html/css/bootstrap.min.css
7f99840e7000-7f99840f8000 r--p 00000000 fd:00 52561609 /home/khi0tqe2ntyx/public_html/store/course_data/Diploma in Problem Solving. Skills.webp
7f99840f8000-7f99840f9000 ---p 00000000 00:00 0
7f99840f9000-7f99848f9000 rw-p 00000000 00:00 0
7f99848f9000-7f99848fa000 ---p 00000000 00:00 0
7f99848fa000-7f99850fa000 rw-p 00000000 00:00 0
7f99850fa000-7f99850fb000 ---p 00000000 00:00 0
7f99850fb000-7f99858fb000 rw-p 00000000 00:00 0
7f99858fb000-7f99858fc000 ---p 00000000 00:00 0
7f99858fc000-7f99860fc000 rw-p 00000000 00:00 0
7f99860fc000-7f99860fd000 ---p 00000000 00:00 0
7f99860fd000-7f99868fd000 rw-p 00000000 00:00 0
7f99868fd000-7f99868fe000 ---p 00000000 00:00 0
7f99868fe000-7f99870fe000 rw-p 00000000 00:00 0
7f99870fe000-7f99870ff000 ---p 00000000 00:00 0
7f99870ff000-7f99878ff000 rw-p 00000000 00:00 0
7f99878ff000-7f9987900000 ---p 00000000 00:00 0
7f9987900000-7f9988100000 rw-p 00000000 00:00 0
7f9988100000-7f9988104000 rw-s 00000000 00:13 449507694 /dev/shm/lsws/adns_cache.shm
7f9988104000-7f9988300000 ---s 00004000 00:04 458357663 /dev/zero (deleted)
7f9988300000-7f9988400000 rw-s 00000000 00:04 458350568 /dev/zero (deleted)
7f9988400000-7f998840a000 rw-s 00000000 00:13 449507175 /dev/shm/lsws/.store.0.shm
7f998840a000-7f9988600000 ---s 0000a000 00:04 458350561 /dev/zero (deleted)
7f9988600000-7f998860a000 rw-s 00000000 00:13 449507171 /dev/shm/lsws/.cachemanidx.shm
7f998860a000-7f9988800000 ---s 0000a000 00:04 458350559 /dev/zero (deleted)
7f9988800000-7f9988804000 rw-s 00000000 00:13 449507165 /dev/shm/lsws/.quicshmmap.shm
7f9988804000-7f9988a00000 ---s 00004000 00:04 458350555 /dev/zero (deleted)
7f9988a00000-7f9988a68000 rw-s 00000000 00:13 449507162 /dev/shm/lsws/.quicshmdata.shm
7f9988a68000-7f9988c00000 ---s 00068000 00:04 458350554 /dev/zero (deleted)
7f9988c00000-7f9988c08000 rw-s 00000000 00:13 458350551 /dev/shm/lsws/modsec_data.shm
7f9988c08000-7f9988e00000 ---s 00008000 00:04 458350553 /dev/zero (deleted)
7f9988e00000-7f9988e02000 rw-s 00000000 00:13 449507149 /dev/shm/lsws/SSL.shm
7f9988e02000-7f9989000000 ---s 00002000 00:04 458350543 /dev/zero (deleted)
7f9989000000-7f9989128000 rw-s 00000000 00:13 449507146 /dev/shm/lsws/stats_clients.shm
7f9989128000-7f9989300000 ---s 00128000 00:04 458350542 /dev/zero (deleted)
7f9989300000-7f9989302000 rw-s 00000000 00:13 458350539 /dev/shm/lsws/stats.shm
7f9989302000-7f9989400000 ---s 0003d000 00:04 458350541 /dev/zero (deleted)
7f9989400000-7f9989402000 r--p 00000000 fd:00 50338115 /home/oxfordhomestudy/public_html/jquery-modal-master/jquery.modal.min.js
7f9989402000-7f998940a000 r--p 00000000 fd:00 50342163 /home/oxfordhomestudy/public_html/css/nd/font-awesome-4.7.0/css/font-awesome.min.css
7f998940a000-7f998940f000 r--p 00000000 fd:05 59 /tmp/lshttpd/swap/6/7/90348ab025ac4237b334bc5d7583a4.lsb
7f998940f000-7f998941e000 r--p 00000000 fd:00 15864348 /home/interiordesigner/public_html/uploads/category_thumbnails/d120893663b774af4d62b115958a8064.jpg
7f998941f000-7f9989421000 r--p 00000000 fd:05 74 /tmp/lshttpd/swap/a/c/dde7303451f460196416ec53febae9.lsb
7f9989421000-7f9989426000 r--p 00000000 fd:00 50337891 /home/oxfordhomestudy/public_html/css/custom.css
7f9989426000-7f9989448000 r--p 00000000 fd:00 58764600 /home/bolconlineco/public_html/uploadAssignment/10970049Assessment-12---Office-Management--Supervision.pdf
7f9989448000-7f998944a000 r--p 00000000 fd:05 68 /tmp/lshttpd/swap/3/0/8f64c2c2492911a93edeaab9739b4c.lsb
7f998944a000-7f998944c000 r--p 00000000 fd:00 4460514 /home/oxfordhomestudy/public_html/css/fonts.googleapis.css
7f998944c000-7f998944d000 ---p 00000000 00:00 0
7f998944d000-7f9989454000 rw-p 00000000 00:00 0
7f9989454000-7f99894a4000 rw-s 00000000 00:04 458350574 /dev/zero (deleted)
7f99894a4000-7f99894c5000 rw-p 00000000 00:00 0
7f99894c5000-7f9989515000 rw-s 00000000 00:04 458350536 /dev/zero (deleted)
7f9989515000-7f9989521000 r-xp 00000000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f9989521000-7f9989720000 ---p 0000c000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f9989720000-7f9989721000 r--p 0000b000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f9989721000-7f9989722000 rw-p 0000c000 fd:00 27007099 /usr/lib64/libnss_files-2.17.so
7f9989722000-7f9989728000 rw-p 00000000 00:00 0
7f9989729000-7f998972a000 r--p 00000000 fd:00 49045809 /home/bolconlineco/public_html/404.shtml
7f998972a000-7f998972c000 rw-s 00000000 00:13 449507695 /dev/shm/lsws/adns_cache.lock
7f998972c000-7f998972e000 rw-s 00000000 00:04 458350567 /dev/zero (deleted)
7f998972e000-7f9989730000 rw-s 00000000 00:13 449507176 /dev/shm/lsws/.store.0.lock
7f9989730000-7f9989732000 rw-s 00000000 00:13 449507172 /dev/shm/lsws/.cachemanidx.lock
7f9989732000-7f9989734000 rw-s 00000000 00:13 449507166 /dev/shm/lsws/.quicshmmap.lock
7f9989734000-7f9989738000 rw-p 00000000 00:00 0
7f9989738000-7f998973a000 r-xp 00000000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f998973a000-7f9989939000 ---p 00002000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f9989939000-7f998993a000 r--p 00001000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f998993a000-7f998993b000 rw-p 00002000 fd:00 27006116 /usr/lib64/libfreebl3.so
7f998993b000-7f9989aff000 r-xp 00000000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f9989aff000-7f9989cfe000 ---p 001c4000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f9989cfe000-7f9989d02000 r--p 001c3000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f9989d02000-7f9989d04000 rw-p 001c7000 fd:00 27001465 /usr/lib64/libc-2.17.so
7f9989d04000-7f9989d0a000 rw-p 00000000 00:00 0
7f9989d0a000-7f9989e0b000 r-xp 00000000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f9989e0b000-7f998a00a000 ---p 00101000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f998a00a000-7f998a00b000 r--p 00100000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f998a00b000-7f998a00c000 rw-p 00101000 fd:00 27006655 /usr/lib64/libm-2.17.so
7f998a00c000-7f998a014000 r-xp 00000000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f998a014000-7f998a213000 ---p 00008000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f998a213000-7f998a214000 r--p 00007000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f998a214000-7f998a215000 rw-p 00008000 fd:00 27006440 /usr/lib64/libcrypt-2.17.so
7f998a215000-7f998a243000 rw-p 00000000 00:00 0
7f998a243000-7f998a245000 r-xp 00000000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f998a245000-7f998a445000 ---p 00002000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f998a445000-7f998a446000 r--p 00002000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f998a446000-7f998a447000 rw-p 00003000 fd:00 27006566 /usr/lib64/libdl-2.17.so
7f998a447000-7f998a448000 rw-p 00000000 00:00 0
7f998a448000-7f998a44f000 r-xp 00000000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f998a44f000-7f998a64e000 ---p 00007000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f998a64e000-7f998a64f000 r--p 00006000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f998a64f000-7f998a650000 rw-p 00007000 fd:00 27007148 /usr/lib64/librt-2.17.so
7f998a650000-7f998a667000 r-xp 00000000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f998a667000-7f998a866000 ---p 00017000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f998a866000-7f998a867000 r--p 00016000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f998a867000-7f998a868000 rw-p 00017000 fd:00 27001491 /usr/lib64/libpthread-2.17.so
7f998a868000-7f998a86c000 rw-p 00000000 00:00 0
7f998a86c000-7f998a86e000 rw-s 00000000 00:13 449507163 /dev/shm/lsws/.quicshmdata.lock
7f998a86e000-7f998a870000 rw-s 00000000 00:13 458350552 /dev/shm/lsws/modsec_data.lock
7f998a870000-7f998a872000 rw-s 00000000 00:13 449507150 /dev/shm/lsws/SSL.lock
7f998a872000-7f998a874000 rw-s 00000000 00:13 449507147 /dev/shm/lsws/stats_clients.lock
7f998a874000-7f998a876000 rw-s 00000000 00:13 458350540 /dev/shm/lsws/stats.lock
7f998a876000-7f998a877000 rw-p 00000000 00:00 0
7f998a877000-7f998a878000 rw-p 00000000 00:00 0
7f998a878000-7f998a879000 rw-p 00000000 00:00 0
7f998a879000-7f998a89b000 r-xp 00000000 fd:00 27003827 /usr/lib64/ld-2.17.so
7f998a89b000-7f998aa9a000 ---p 00000000 00:00 0
7f998aa9a000-7f998aa9b000 r--p 00021000 fd:00 27003827 /usr/lib64/ld-2.17.so
7f998aa9b000-7f998aa9c000 rw-p 00022000 fd:00 27003827 /usr/lib64/ld-2.17.so
7f998aa9c000-7f998aa9d000 rw-p 00000000 00:00 0
7ffe0a60d000-7ffe0a813000 rw-p 00000000 00:00 0 [stack]
7ffe0a815000-7ffe0a817000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
|