2

I think my MacBook Pro might be hacked. The reason I found out about the stackoverflow.com website is because I did a netstat search in Terminal. My browser was closed but nevertheless it showed this:

tcp4       0      0  macintosh.lan.50419    stackoverflow.co.http  LAST_ACK

among other things. I have never visited this website in my life.

Also netstat results show things that I think might be not right. Also I have been trying to figure this out for the past hours and recently (maybe 20 minutes ago) my screen went black for like a second or two and this never happens.

Anybody know whats wrong?

9
  • Have you tried Anti-Virus software (yes, there's software like that for Mac, too)?
    – andre_roesti
    Feb 5, 2011 at 16:53
  • thank you for your answer but the strange thing i have never visited this website in my life I am certain of that and it didnt show up on an earlier netstat search
    – user66222
    Feb 5, 2011 at 17:00
  • @Worried - your question was posted on Stack Overflow, here, and was migrated here because it was off-topic on SO. You might not have visited this site before, but you've visited a site in the network before.
    – DMA57361
    Feb 5, 2011 at 17:01
  • 1
    it doesn´t matter if it is truncated it now shows the same results in netstat with the .co
    – user66222
    Feb 5, 2011 at 17:16
  • 1
    @oKtosiTe, the truncated "fixed column width" is far more obvious when not seeing just a single line of the output.
    – Arjan
    Feb 5, 2011 at 18:01

3 Answers 3

6

LAST_ACK simply means that a connection to the specified server was recently closed. It's perfectly normal that it might remain for a few minutes after closing your browser.

5
  • 1
    Doesn't "The reason i found this website is because..." sounds like he had never heard about this website before? Feb 5, 2011 at 16:56
  • @oKtosiTe: Except that the output of netstat could be truncated. "stackoverflow.co" isn't a valid domain name. Feb 5, 2011 at 17:16
  • 1
    @Cody: It is, actually. .co is the top level domain for Colombia.
    – oKtosiTe
    Feb 5, 2011 at 17:20
  • @oKtosiTe: Oh, maybe it is. It looks like they're selling .co domains globally now. Who knew. Either way, it's unlikely the netstat output indicates anything other than stackoverflow.com. It looks like stackoverflow.co is just a squatter hoping Stack Overflow Internet Services will buy it from him. Feb 5, 2011 at 17:24
  • Indeed it does. @CodyGray
    – oKtosiTe
    Feb 5, 2011 at 17:27
6

How about link pre-fetching as an explanation?

1
  • Good thinking! (Though I'm not sure if that only applies to getting DNS records, or also really fetches content. The first won't show in the output of netstat, I think. The latter would indeed.)
    – Arjan
    Feb 5, 2011 at 18:26
4

The output of netstat shows you reversed DNS addresses: a name based on an IP address. However, multiple names might exist for the same IP address.

Like both superuser.com, gaming.stackexchange.com and stackoverflow.com refer to the same IP address: 64.34.119.12. But:

dig -x 64.34.119.12

...shows that this primarily maps to stackoverflow.com, even though

dig superuser.com

...shows the very same IP address.

So you probably visited one of the Stack Exchange sites?

Running netstat -n will show you IP addresses rather than (assumed) host names.

It might even be on the same server but that is not relevant here.

0

You must log in to answer this question.