MananShastri Posted October 27, 2017 ID:1176516 Share Posted October 27, 2017 I have installed Malwarebytes on windows web server. I can see continuing popup blocking of outgoing request to somain.pw domain. I found that every time IP is same. I don't know what is doing php application. Please let me know if you have any information about that activity. Below is the full log of blocking. Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 10/18/17 Protection Event Time: 9:41 AM Log File: 00049726-b40a-11e7-b805-0e47fd9b6890.json Administrator: Yes -Software Information- Version: 3.2.2.2029 Components Version: 1.0.212 Update Package Version: 1.0.3040 License: Trial -System Information- OS: Windows Server 2008 R2 Service Pack 1 CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Domain: 1afd00e88d3bc2053298e90d6c1a32e3.pw IP Address: 141.8.226.58 Port: [58147] Type: Outbound File: C:\Program Files (x86)\PHP\v5.6\php-cgi.exe (end) Link to post Share on other sites More sharing options...
Staff Zynthesist Posted October 27, 2017 Staff ID:1176557 Share Posted October 27, 2017 Hello, This IP is blocked for Locky Ransomware. Link to post Share on other sites More sharing options...
Recommended Posts