1

I ran the netstat command and I got a program with PID/program description as 3061/host. The protocol was udp. The local address was 0.0.0.0:37089. The foreign address was 0.0.0.0:*

Is there some place I can get pid information on the web?

Can you provide some information about using netstat to detect hacking?

Edit: I just found out that I have random connections to other hosts with PID including 512, 32404, 32353, 31509, 31123. It lasts for a short time but it so far has never said that the connection state was established.

Here is an example:

udp        0      0 0.0.0.0:44848           0.0.0.0:*  20730/host               
3
  • whois.com/whois/0.0.0.0
    – mook765
    May 28, 2019 at 10:47
  • Hello. Is it a VPS or a regular instance? In case it is VPS, probably this service is related to your VPS provider envirnment and you should ask them for more details.
    – pa4080
    May 28, 2019 at 10:49
  • This was not done on a virtual server. May 28, 2019 at 18:34

1 Answer 1

0

You can use wireshark to monitor and analyze network traffic.

You likely have some sort of abuse going on. There are several posts out there about /usr/bin/hosts being abused via php like this one: https://serverfault.com/questions/705217/usr-bin-host-executed-by-hacked-php-script, several posts I came across talk about wordpress and a vulnerable plugin that was installed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.