I started using Subsonic on my Linux server. Subsonic is working just fine but while using tcpdump I detected some suspicious requests being originated from the server:
- Code: Select all
15:43:01.572530 IP <HOSTNAME>.39211 > wordpress.blankdvdrw.com.http: Flags [P.], seq 1:137, ack 1, win 229, options [nop,nop,TS val 61927181 ecr 1589361007], length 136: HTTP: GET /backend/version.view?v=5.3 HTTP/1.1
the URL (/backend/version.view?v=5.3) clearly indicates that is related to Subsonic and anything like "blankdvdrw.com" looks fishy to me.
I was looking for some information on the host and I found few complaints related to it:
http://myip.ms/view/hosts/509316/blankdvdrw_com.html
http://myip.ms/info/search/1/stxt/wordp ... w_com.html
http://myip.ms/info/whois/198.71.81.108 ... bsonic.org
subsonic.org uses blankdvdrw.com as a top level host.
But as tcpdump showed me that GET request request was done from the server (while the server was running subsonic). Can anyone help me in understanding what is going on?