Hello,<\/p>\n
A few days ago, we discovered a minor compromise on one of our websites (at least, we think it was minor). We were already using AIOWPS, but increased our security measures after cleaning out the hack. However, I just took a backup of our DB, opened it, and noticed that the first approx. 1500 lines all looked like the following (xxxxxx substituted for our custom DB prefix):<\/p>\n
Most of the lines are a bit more “vulgar” in place of where it refers to the “\/tobizuev\/gmbar-ngenntot.html” file, but they all seem to indicate paths with .html files and they all come from the same IPs (about 10 different IPs in total). I went ahead and blacklisted the IP addresses, but am uncertain if these “events” are showing up in the DB due to a change I made the other day in the AIOWPS settings, or if this is a more serious issue that needs to be addressed (possibly by restoring a backup of our DB from an earlier date).<\/p>\n Could you tell me if this is something that we should be concerned about?<\/p>\n Thank you, https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/<\/p>\n","protected":false},"template":"","class_list":["post-6652763","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6652763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6652763\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=6652763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}INSERT INTO wp_xxxxxx_aiowps_events VALUES('1489', '404', '', '0', '2015-10-15 08:23:08', '100.43.90.13', '', '\/tobizuev\/gmbar-ngenntot.html', '');<\/code><\/p>\n
\nJP<\/p>\n