Hey guys! I need help, my web server (nginx) default page is all messed up, with a very very weird message on it, anyone seen this before?
" Nothing there anymore! But the future’s ever changing, and something might appear there, someday! "
My log is filled with very odd stuff: http://lxp.fr/i3Mx0bbLG0
@Kooda Have you been exploited? I think those \x things in the log are unicode characters. Have you tried decoding them?
@ebarrett I can’t think of any thing else than an exploit yeah… :/
I haven’t tried decoding them, but I found one file in my file system that has this message, and its’s an nginx cache entry.
@Kooda Is it a static site?
@ebarrett It is yes, and this page doesn’t exist in the static files.
@Kooda That sounds very suspicious indeed. I'd tar up everything for post mortem.
@ebarrett A backup is running as we speak. But I don’t feel really qualified to find out what the problem is. :(
When I disable nginx’s cache, the message disapears.
@ebarrett I found the cause!!!! Oh my god it’s so silly!
This message is the index.xhtml of an other website I host! For some reason there is a cache collision and it appeared for every "GET /" on the server!
@Kooda Glad you were not compromised!
@ebarrett I’m glad too! It was quite a stressful experience! 😔
Server run by the main developers of the project It is not focused on any particular niche interest - everyone is welcome as long as you follow our code of conduct!