So it appears to be a WP-VCD malware attack. Can someone else confirm?
Yeah, for some stupid reason that actually worked, although it seems like something ripe for exploit…
I have literally the exact same thing happening. My server started crashing a few days ago and I’ve been trying to trace back to a root cause and came across this:
Seemingly this happens every 5-10 seconds.
127.0.0.1 – – [07/Nov/2019:17:53:55 +0000] “GET /code.php HTTP/1.0” 301 – “-” “-”
127.0.0.1 – – [07/Nov/2019:17:59:01 +0000] “GET /code.php HTTP/1.0” 301 – “-” “-”
127.0.0.1 – – [07/Nov/2019:17:55:18 +0000] “GET /code.php HTTP/1.0” 301 – “-” “-”
127.0.0.1 – – [07/Nov/2019:18:02:47 +0000] “GET /code.php HTTP/1.0” 301 – “-” “-“
-
This reply was modified 6 years, 7 months ago by envitro.
