# Strange Port tracked

**URL:** <https://www.ruby-forum.com/t/strange-port-tracked/203423>\
**Category:** NGINX\
**Created:** [February 19, 2011, 4:47pm UTC](https://www.ruby-forum.com/t/strange-port-tracked/203423 "2011-02-19T16:47:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [February 19, 2011, 4:47pm UTC](https://www.ruby-forum.com/t/strange-port-tracked/203423/1 "2011-02-19T16:47:59Z")

</div>

hi,

It’s quite new for me to use nginx as the webserver, nginx 0.7.65 + php  
/fpm on freebsd, which was installed on Apr 28th, 2010. I configured  
the server to listen on Port 80 as seen below.

```
server {
    listen 80;

```

My php script will create a folder by domain name each time it detect a  
different domain. I saw a strange xxxxx:4511 folder created on Jan 13th,  
2011. Also owner of all php files and folders are changed to 1005 . I  
double checked /etc/passwd and the max user id there is 1003.

Is it possible that my nginx/phpfpm server is hacked? Please advice!

cheers  
Tim

Posted at Nginx Forum:

> **[Strange Port tracked](https://forum.nginx.org/read.php?2,176772,176772#msg-176772)**
>
> hi, It's quite new for me to use nginx as the webserver, nginx 0.7.65 + php /fpm on freebsd, which was installed on Apr 28th, 2010. I configured the server to listen on Port 80 as seen below. server { listen 80; My php script will

---

<div class="post-metadata">

**Author:** ![timknip](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e68b1a/32.png) [@timknip](https://www.ruby-forum.com/u/timknip)\
**Post date:** [February 19, 2011, 4:58pm UTC](https://www.ruby-forum.com/t/strange-port-tracked/203423/2 "2011-02-19T16:58:37Z")

</div>

On 2/19/11 10:45 AM, timknip wrote:

> different domain. I saw a strange xxxxx:4511 folder created on Jan 13th,  
> 2011. Also owner of all php files and folders are changed to 1005 . I  
> double checked /etc/passwd and the max user id there is 1003.
> 
> Is it possible that my nginx/phpfpm server is hacked? Please advice!

Yes.

> cheers  
> Tim
> 
> Posted at Nginx Forum:  
> [http://forum.nginx.org/read.php?2,176772,176772#msg-176772](http://forum.nginx.org/read.php?2,176772,176772#msg-176772)

–  
Jim O.

---

<div class="post-metadata">

**Author:** ![timknip](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e68b1a/32.png) [@timknip](https://www.ruby-forum.com/u/timknip)\
**Post date:** [February 19, 2011, 5:11pm UTC](https://www.ruby-forum.com/t/strange-port-tracked/203423/3 "2011-02-19T17:11:46Z")

</div>

On 19 Fev 2011 15h45 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> detect a different domain. I saw a strange xxxxx:4511 folder created  
> on Jan 13th,  
> 2011. Also owner of all php files and folders are changed to 1005 . I  
> double checked /etc/passwd and the max user id there is 1003.
> 
> Is it possible that my nginx/phpfpm server is hacked? Please  
> advice!

Yes it is. It depends on a lot of stuff:

1. Your app and how PHP is configured
2. Your server setup (SSH and such)

You should consider running an IDS and also a log checking tool.

— appa