Today I tried to change something on my VPS and I noticed it was slow as hell. I saw a lot of apache2 processes so I started to investigate.. I found strange requests in my apache2 log: http://pastebin.com/vUg4hskZ
So I googled my IP... I was not happy with the results: http://bestblackhatforum.com/Thread-546-L1-L2-Proxies-15-Apr-2013 (My IP is in there).
How can I investigate how they got in? Apparantly my VPS has been compromised since the 27th of March: http://www.stopforumspam.com/ipcheck/37.247.51.11o (replace last character with a 0)
↧
My VPS has been compromised!
↧