My Ubuntu web server has been infected by a bot that is brute-force attacking Wordpress sites.

I can see the outgoing POST requests and their content, but I am not able to find the script, pid or user that are generating these requests. Of course my goal is to remove that malicious software.

Do you know any way to find where is that outgoing traffic being generated?

4

1 Answer

You can use nethogs, e.g.:

nethogs eth0

Should show you how much traffic is going from given process.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy