I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my own VPS. Yay! Now I have no one to blame but myself for any problems relating to availability, performance, and security.
Regarding security, I was auditing 'netstat' output on this Linux-based VPS today and noticed that I had an established connection to port 443 (HTTPS) on a different server. I figured out what DNS name this IP address resolves to and hit the googles. This domain is only associated with monetary scams and fraud.
lsof -i and determined that one of the Apache processes on my server has established the connection to the secure server.
Other data points: I have searched through all my files and can't find any trace of this DNS name or its IP address; however, I know that's not conclusive evidence because I've seen JS-based malware that can obfuscate URLs pretty easily. Also, I have checked all of my computers which have been accessing my various sites and I can't find any trace of the cookie that the JS would be planting (which could just mean I hadn't hit the suspect Apache process yet).
Always the programmer, I wanted to try to reproduce the problem, so I rebooted the server and I haven't seen the connection get established again.
I have some ideas about mitigation or tracking (block connections to the bad server, either via firewall or the /etc/hosts file; redirect HTTPS requests to my own system with a spoofed cert just to investigate the network transaction if the same circumstances arise again). It seems really odd that the connection was left open (when it could just fetch the page once and be done), but maybe this was an errant condition and it wasn't supposed to remain open.
Sorry if this is a lot of detail, or if I'm overthinking something simple. I'm just being paranoid about taking care of my little slice of the internet. I was hoping to see if these details set off any familiarity alarms.