I have installed Malwarebytes on windows web server. I can see continuing popup blocking of outgoing request to somain.pw domain. I found that every time IP is same.
I don't know what is doing php application.
Please let me know if you have any information about that activity.
Below is the full log of blocking.
Malwarebytes
www.malwarebytes.com
-Log Details-
Protection Event Date: 10/18/17
Protection Event Time: 9:41 AM
Log File: 00049726-b40a-11e7-b805-0e47fd9b6890.json
Administrator: Yes
-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.212
Update Package Version: 1.0.3040
License: Trial
-System Information-
OS: Windows Server 2008 R2 Service Pack 1
CPU: x64
File System: NTFS
User: System
-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0
-Website Data-
Domain: 1afd00e88d3bc2053298e90d6c1a32e3.pw
IP Address: 141.8.226.58
Port: [58147]
Type: Outbound
File: C:\Program Files (x86)\PHP\v5.6\php-cgi.exe
(end)