phpMyadmin is your friend (or at least it is mine!). If its all under one network install you can search under wp_*_comments for a particular word. I used to search cialis, viagra, etc and purge like that. Is that what you needed?
Can you send me an email you are getting so I can see what you receive? Also please confirm the version of WF you are running?
tim
Hi, the email is below. I’m using the free version of Wordfence 5.3.8 (I let my subscription lapse a couple months ago and am waiting for my department to approve a renewal).
I ended up querying through all the database tables one at a time as suggested but a more detailed message including the name/url of the sub-site or post would be appreciated in the future if possible.
Thanks — E
This email was sent from your website [network site name] by the Wordfence plugin.
Wordfence found the following new issues on [network site name].
Alert generated at Tuesday 24th of March 2015 at 04:46:26 AM
Critical Problems:
* Comment with author Amir wright contains a suspected malware URL.
[image of suspect URL]
NOTE: You are using the free version of Wordfence. Upgrading to the paid version of Wordfence gives you two factor authentication (sign-in via cellphone) and country blocking which are both effective methods to block attacks. A Premium Wordfence license also includes remote scanning with each scan of your site which can detect several additional website infections. Premium members can also schedule when website scans occur and can scan more than once per day.
As a Premium member you also get access to our priority support system located at http://support.wordfence.com/ and can file priority support tickets using our ticketing system.
Click here to sign-up for the Premium version of Wordfence now.
https://www.wordfence.com/wordfence-signup/
Did you look at the image we included? Attach that here with a free image host.
tim
(@ebellempire)
9 years, 1 month ago
I occasionally get alerts for suspected malware in comments. However, my installation is a network with hundreds of sites. Wordfence gives no indication of the site, post, URL, or even the date of the comment. It would be great if this were added to a future update.
In the meantime, does anyone have advice for tracking down a suspicious comment in a network installation? I do have MYSQL access if it helps.
https://wordpress.org/plugins/wordfence/