I am afraid we can't be of much help. I checked the logs for that for that URL and we have:
php.net-access.log.10:72.52.91.14 - - [06/Mar/2017:06:37:50 -0800] "GET /manual/en/book.gnupg.php HTTP/1.1" 200 5488 php.net-access.log.10:72.52.91.14 - - [06/Mar/2017:07:58:10 -0800] "GET /manual/en/book.gnupg.php HTTP/1.1" 200 5500 php.net-access.log.10:72.52.91.14 - - [06/Mar/2017:13:00:25 -0800] "GET /manual/en/book.gnupg.php HTTP/1.1" 200 5486 php.net-access.log.10:72.52.91.14 - - [06/Mar/2017:15:30:33 -0800] "GET /manual/en/book.gnupg.php HTTP/1.1" 200 5366 php.net-access.log.9:72.52.91.14 - - [07/Mar/2017:17:32:15 -0800] "GET /manual/en/book.gnupg.php HTTP/1.1" 200 5487 php.net-access.log.9:72.52.91.14 - - [08/Mar/2017:05:33:38 -0800] "GET /manual/en/book.gnupg.php HTTP/1.1" 200 5366 But that 72.52.91.14 IP is a reverse proxy nginx server which sits in front of the web server. Because php.net is geographically distributed that frontend proxy redirects millions of requests to mirror servers around the world and as such our log retention on it is very short. 2 days so we no longer have the originating IP for the above requests. If you have anything from the past 2 days I can look those up. -Rasmus On Thu, Mar 16, 2017 at 10:01 AM, Squire, Gregory D < [email protected]> wrote: > Good Afternoon, > > > > My name is Greg Squire with the Department of Homeland Security here in > Boston, MA. We are reaching out for some assistance in connection with a > child exploitation investigation we are working on. Sorry this is out of > the blue and we are happy to chat over the phone but the basics of what we > are looking for help on is obtaining (depending on your retention times) > the IP(s) that connected to your site. Specifically the IPs that accessed: > http://php.net/manual/en/book.gnupg.php on 3/7/2016 3pm UTC +-6hours > > > > If you are able to assist we would be grateful and if you require a > subpoena for this we are happy to send one. > > > > Thanks in advance > > Greg > > 617-565-7400 <(617)%20565-7400> (main line) > > 617-565-8845 <(617)%20565-8845> (desk) > > 617-593-1990 <(617)%20593-1990> (cell) > > > > *Gregory D Squire* > > *Special Agent* > > *Department of Homeland Security* > > *Homeland Security Investigations* > > *10 Causeway St, Suite 722* > > *Boston, MA* > > >
