I am not sure if this may indicate a compromised server or if I'm just being paranoid.
While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for its also new domain name), Apache suddenly refused to restart, with the following message:
(99)Cannot assign requested address: AH00072: make_sock: could not bind to address 18.104.22.168:80 no listening sockets available, shutting down AH00015: Unable to open logs Action 'start' failed. The Apache error log may have more information.
Lo and behold, Apache's ports.conf contained the following:
Listen 8080 Listen 22.214.171.124:80
Port 8080 was put there deliberately for testing, not very long before. The IP address followed by port 80 just appeared out of thin air. Upon investigation *.com.com resolves to this IP, which seems to be a host for malware.
On the other hand, it seems at least conceivable that some kind of script or automated process (maybe Webmin?) incorrectly resolved a hostname with an extra ".com" on the end and, for some bizarre reason, shoved it into ports.conf. Also, had this been maliciously inserted by an intruder, I have no idea what it would accomplish.
The only other program that should have messed with Apache's configuration was roundcube webmail, from an official repo. There is no one else with access to this server. The auth log shows a number of unsuccessful SSH log in attempts from various IPs, in the several hours that the server's been up, but no successful log ins other than my own.
I don't know if I should chalk this up to some strange configuration snafu or change all the passwords and start clean with a restrictive firewall.