Bakalakadaka

Thanks for the tips – I’m working through them over the weekend.

The attack seems to have stopped – I didn’t end up deleting the original admin account, but I did drop it’s admin permissions. This way I can easily monitor if it’s getting locked.