Domain Compromised
- Thread starter sravan
- Start date
uncutu
Elite Member
- Aug 6, 2010
- 3,506
- 3,376
how do you think the malicious actor got in?
usually they get in from weak passwords, or nulled themes/plugins.
change all your passwords including cpanel, ssh, wordpress admin, mysql users. setup 2fa authentication on whatever possible. audit all accounts to see if the threat actor made their own.
assuming this is a WP site, audit all your plugins/themes for malicious code, usually its encoded. or run files (plugin & theme directories) through free online scanners. you may even be able to run a wordpress malware scanner plugin. i would say they are easy to detect as its usually base64 encoded and theres no reason for encoded text to exist in these files.
usually you can email your server provider, explain you have a malicious actor inside that has compromised your site and need assistance. see what they will offer you. sometimes they can point to the explicit file that allowed them to backdoor and analyze if the threat actor setup any persistence.
last resort usually isn't too bad depending on the complexity of your site - wipe your whole operation and rebuild it.
to take care of the future, setup wordfence plugin & properly configure it. setup 2fa on anything you can. then think twice about using nulled themes/plugins (you can scan them using free tools online if you must use).
there was a similar thread few weeks back. the guy was just using a really shady hosting provider who backdoored him. so obviously use a trusted vendor like hostkoala, ovh, bluehost, etc..
usually they get in from weak passwords, or nulled themes/plugins.
change all your passwords including cpanel, ssh, wordpress admin, mysql users. setup 2fa authentication on whatever possible. audit all accounts to see if the threat actor made their own.
assuming this is a WP site, audit all your plugins/themes for malicious code, usually its encoded. or run files (plugin & theme directories) through free online scanners. you may even be able to run a wordpress malware scanner plugin. i would say they are easy to detect as its usually base64 encoded and theres no reason for encoded text to exist in these files.
usually you can email your server provider, explain you have a malicious actor inside that has compromised your site and need assistance. see what they will offer you. sometimes they can point to the explicit file that allowed them to backdoor and analyze if the threat actor setup any persistence.
last resort usually isn't too bad depending on the complexity of your site - wipe your whole operation and rebuild it.
to take care of the future, setup wordfence plugin & properly configure it. setup 2fa on anything you can. then think twice about using nulled themes/plugins (you can scan them using free tools online if you must use).
there was a similar thread few weeks back. the guy was just using a really shady hosting provider who backdoored him. so obviously use a trusted vendor like hostkoala, ovh, bluehost, etc..
D
Deleted member 183008
Guest
Remove all the content and submit a request in search console if you see a red page in your domain. Then change all the passwords and see the codes for any loopholes/bugs.