delete

[ttguy]

tt

[DavidR]

There won't be a folder called that as it is an internet URL not a folder location, something is connecting to that address. Since you mention this is a 'server' perhaps one of the networked systems/clients is accessing it.

What is your firewall ?
- It should be capable of blocking unauthorised outbound Internet Connections. - Which should be able to block this traffic.

Do you (or any other network clients) do any on-line banking with worldoffshorebanks.com ?

[ttguy]

Hello DavidR

worldoffshorebanks.com does not have any online service. It is a directory.

My hosting company did a clean sweep of the server and the found absolutely nothing.

[DavidR]

Well considering you say that "worldoffshorebanks.com does not have any online service" that link is live and I presume not hosted on your server, so won't be a directory.

So all I can suggest is that they check the server logs to see what initiated the connection to to the URL as I somehow doubt it just connected to your server.

[ttguy]

DavidR

Yes they checked but found nothing.

I got this info from another source.
They said:


I get URLs like that too, once in a while, on my site.

I'm too lazy to check, but there's probably some exploit out for some poorly secured PHP app. Some botnets are trying the name for the exploitable page on every server they hit, including yours, in the hope that you are running this application and they can use it to take over your server.

Nope, so long as that file doesn't sit on your server, the worst effect will be the increase in traffic from all those bogus requests. You could reduce that a bit by presenting a shorter 404 page, or a custom one just for that access. But it's mainly just an annoyance.

[CharleyO]

***

It is indeed not just a directory and does offer on-line services ... such as getting an off-shore account in 8 minutes.

I did not activate all of the page so you will see circled arrows in the image below. Click to enlarge.


***

[ttguy]

CharleyO

Yes but those are external link of advertisers.

How can they be the cause?
Is there a solution?

Lets say is Capital Conservator. Whar d i do. Take down their link.

How would i know if it is or is not them.

Thanks