I have the following setup Nginx + php-fpm, Nginx is running on port 80 and 443.
Recently I noticed that connections were made from this servers port 80 to a remote machine on port 580x. [ src port is 80 (Nginx) and dst port is 580x]
Has someone seen such an exploit before ? I have checked the Nginx logs, nestat connections, current sessions, secure, messages and audit logs but found nothing interesting.
What I find weird is my Nginx initiating a connection to port 580x on a remote server.
Thanks, Termcap