maxhupdate

of course. I will replace the IP with hashtags.

10/Mar/22 09:50:21 #2631896 CRITICAL 2 ######### (<- IP of my own server) POST /wp-admin/admin-ajax.php - ASCII character 0x00 (NULL byte) - [POST:html = %1f%8b%08%00%00%00%00%00%00%03%ed}%d9r%db%c8%b2%e0%b3%fd%15e%fa%b6%96k%12%04%c0%9d%12%e5%e3%b6%dd}|O%fb%d8a%bb%bbg%da%f6(%8a@%91,%0b%04p%00P%94%daV%c4}%98?%98y%bf%f3%d0%11%13%f3%03%f3t%9e%ae%ffd%bed2%ab%b0%14Hp%11)%c9K%db%8b%04%d4%92[eee%d6%86%c3;%b6gE%e7>#%a3h%ec%1c%dd>%c4_%c4%a1%ee%b0W%b2Y%e5%d1%e3%12%f1%036%e0g%bd%927%ecB%a1%c8%0f%bb%d5%aa7%f4%b51%ab%ba%e1%dd%12%d6a%d4>%ba}%ebp%cc"J%ac%11%0dB%16%f5J?%bf%fa%a1%d2%86%ec[q%86K%c7%acW:%e5l%ea{AT"%96%e7F%cc%85%82SnG%a3%9e%cdN%b9%c5*%e2%a5L%b8%cb#N%9dJhQ%87%f5%0c%04s%e8p%f7%84%04%cc%e9%95%fc%c0%1bp%87%95%c8%08h%eb%95%12%aa%86c%7f%a8y%c1%b0z6p...] - www.domainofserverreplaced.de

I am as of now trying to figure this out with the help of my host’s support, since i am pretty sure this malware on the server. But still if you got any other idea, i’d appreciate it.

• This reply was modified 4 years, 2 months ago by maxhupdate.