I was staging an isolated production environment and accessing it's remote PHP script from my local mac on
http://example.com/XbAM7Kt7SJj3M8ytJfEQZbwcBLzg0gNWGfyCHL2b0f0
I saw my click in the log as follows:
{
"id":"XbAM7Kt7SJj3M8ytJfEQZbwcBLzg0gNWGfyCHL2b0f0",
"timestamp":1535672410,
"ip_address":"MY.IP.AD.DR",
"user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36",
"referer":null,
"parameter":"XXX"
}
And I couldn't believe my eyes when I saw the following in the next line of the log:
{
"id":"XbAM7Kt7SJj3M8ytJfEQZbwcBLzg0gNWGfyCHL2b0f0",
"timestamp":1535672411,
"ip_address":"159.203.81.ADDR",
"user_agent":"Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko\/20100101 Firefox\/33.0",
"referer":"83.222.249.ADDR",
"parameter":"XXX"
}
Just one second later (see "timestamp"), there was a Click from a Digital Ocean IP "159.203.81.ADDR" using a fake user agent and fake referer, with the same exact GET parameter ("XXX"). There is no way on earth that they could have known about the ID "XbAM7Kt7SJj3M8ytJfEQZbwcBLzg0gNWGfyCHL2b0f0" which my local machine generated randomly just a few minutes earlier.
I assume that this means that my local network is somehow compromised? My network activity is being sniffed by Malware and since the request was non-HTTPS the malware was able to replicate it in order to spy for sensitive information?
I have scanned my local mac for Malware using ClamAV and Malwarebytes, both didn't find a single thing. How can I get to the bottom of this? Could it be that my home router is infected with malware?
I'm not sure if this is relevant, but as of recently I have experienced wired things on my mac and mobile devices. For example when surfing random websites, I sometimes suddenly get redirected to a scam ad website ("Congratulations you have won, please enter your information..."). I took a screenshot of one of those on my mobile device: https://i.stack.imgur.com/WaRn8.jpg