Webserver Incident Reporting and Termination(TM) Squad
NOTE: Web servers have logs and in those logs is evidence of attempted hacking. For instance, one may notice an attack that calls such a script from a remote server "r57.php??". Its these kinds of attacks we're looking to investigate. For a concrete example, see these reports.
Please do not submit phish, spam, or malware to WsIRT. Only submit attack signatures from web server logs. As this project hasn't officially been publicly launched, we are still reclassifying the tool and its verbiage.
Paul: Attackers are attempting to inject this script into vulnerable remote web servers. Once it is successfully installed
illegally onto a web server, it attempts an fsockopen connection to one of the following destinations on port 8080:
The script attempts to be obfuscated. It is nefarious in nature and should be removed immediately. All evidence
surrounding the installation of the script should be preserved and sent to law enforcement referencing this ticket.
