[2026-06-15 11:27:26] ANOMALIES (3 issue(s))
  - HTTP https://geo-gaming.com/ returned 0 (expected 200)
  - HTTP https://geo-gaming.com/choisir-aventure/ returned 0 (expected 200)
  - HTTP https://geo-gaming.com/wp-admin/install.php returned 0 (expected 403)
[2026-06-15 11:28:19] OK (0 issue(s))
[2026-06-15 23:05:17] ANOMALIES (2 issue(s))
  - Admin count = 6 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [13]maintenance, [14]adminlin, [15]admin_lin, [16]upgrades
  - New admin/editor in last 6h: [16] upgrades <backsuptrace@gmail.com> (2026-06-15 17:38:22)
[2026-06-16 15:45:32] ANOMALIES (2 issue(s))
  - Unexpected file(s) in wp-content/mu-plugins/: .cache.php
  - Admin count = 10 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [17]adminlin, [18]admin_lin, [17]adminlin, [18]admin_lin, [17]adminlin, [18]admin_lin, [17]adminlin, [18]admin_lin
[2026-06-16 17:02:21] OK (0 issue(s))
[2026-06-16 23:42:14] OK (0 issue(s))
[2026-06-17 10:30:04] ANOMALIES (2 issue(s))
  - Unexpected file(s) in wp-content/mu-plugins/: .cache.php
  - Admin count = 47 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [45]maintenance, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin, [25]adminlin, [26]admin_lin
[2026-06-17 16:31:11] ANOMALIES (1 issue(s))
  - Unexpected PHP in wp-content root: advanced-cache.php
[2026-06-17 16:33:21] OK (0 issue(s))
[2026-06-17 19:03:04] OK (0 issue(s))
[2026-06-19 09:46:16] ANOMALIES (12 issue(s))
  - Unexpected PHP file in www root: 3PJcpMFsD8B.php (81994 bytes)
  - www/index.php suspiciously large (6312 bytes; clean ~320). Possible re-injection.
  - Unexpected file(s) in wp-content/mu-plugins/: .htaccess
  - .htaccess root chmod = 666 (should be 444 — protection removed)
  - wp-admin/.htaccess no longer blocks install.php
  - wp-admin/.htaccess chmod = 644 (should be 444)
  - Admin count = 5 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [71]WebshellRS, [72]wp_admin, [73]maintenance
  - Unexpected file in wp-includes/php-compat/: .htaccess
  - Unexpected PHP in wp-content root: r.php
  - Malware signature match in: wp-content/r.php
  - Malware signature match in: wp-content/plugins/backup-module-614/r.php
  - Malware signature match in: wp-content/plugins/backup-module-614/backup-module-614.php
[2026-06-19 09:53:25] ANOMALIES (12 issue(s))
  - Unexpected PHP file in www root: 3PJcpMFsD8B.php (81994 bytes)
  - www/index.php suspiciously large (6312 bytes; clean ~320). Possible re-injection.
  - Unexpected file(s) in wp-content/mu-plugins/: .htaccess
  - .htaccess root chmod = 666 (should be 444 — protection removed)
  - wp-admin/.htaccess no longer blocks install.php
  - wp-admin/.htaccess chmod = 644 (should be 444)
  - Admin count = 5 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [71]WebshellRS, [72]wp_admin, [73]maintenance
  - Unexpected file in wp-includes/php-compat/: .htaccess
  - Unexpected PHP in wp-content root: r.php
  - Malware signature match in: wp-content/r.php
  - Malware signature match in: wp-content/plugins/backup-module-614/r.php
  - Malware signature match in: wp-content/plugins/backup-module-614/backup-module-614.php
[2026-06-19 10:02:03] ANOMALIES (4 issue(s))
  - www/index.php suspiciously large (6312 bytes; clean ~320). Possible re-injection.
  - wp-admin/.htaccess no longer blocks install.php
  - Malware signature in: wp-includes/load.php
  - Malware signature in: wp-includes/plugin.php
[2026-06-19 10:10:02] ANOMALIES (4 issue(s))
  - wp-admin/.htaccess no longer blocks install.php
  - Malware signature in: wp-content/themes/twentytwentyfive/assets/fonts/fonts/index.php
  - Malware signature in: wp-includes/load.php
  - Malware signature in: wp-includes/plugin.php
[2026-06-19 10:17:08] ANOMALIES (1 issue(s))
  - wp-admin/.htaccess no longer blocks install.php
[2026-06-19 12:49:01] ANOMALIES (2 issue(s))
  - Admin count = 3 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [74]upgrades
  - New admin/editor in last 6h: [74] upgrades <backsuptrace@gmail.com> (2026-06-19 08:43:11)
[2026-06-19 16:14:07] OK (0 issue(s))
[2026-06-19 16:33:52] ANOMALIES (7 issue(s))
  - Attacker permissive .htaccess: wp-content/plugins/google-listings-and-ads/js/js/.htaccess
  - Attacker permissive .htaccess: wp-content/plugins/woocommerce-gateway-stripe/assets/assets/.htaccess
  - Attacker permissive .htaccess: wp-includes/php-ai-client/src/Providers/Models/SpeechGeneration/SpeechGeneration/.htaccess
  - Attacker permissive .htaccess: wp-includes/php-ai-client/src/Messages/Enums/Enums/.htaccess
  - Attacker permissive .htaccess: wp-includes/SimplePie/src/src/src/.htaccess
  - Attacker permissive .htaccess: wp-includes/js/dist/dist/.htaccess
  - Attacker permissive .htaccess: wp-includes/js/tinymce/plugins/wpautoresize/wpautoresize/.htaccess
[2026-06-19 16:35:07] ANOMALIES (7 issue(s))
  - Attacker permissive .htaccess: wp-content/plugins/google-listings-and-ads/js/js/.htaccess
  - Attacker permissive .htaccess: wp-content/plugins/woocommerce-gateway-stripe/assets/assets/.htaccess
  - Attacker permissive .htaccess: wp-includes/php-ai-client/src/Providers/Models/SpeechGeneration/SpeechGeneration/.htaccess
  - Attacker permissive .htaccess: wp-includes/php-ai-client/src/Messages/Enums/Enums/.htaccess
  - Attacker permissive .htaccess: wp-includes/SimplePie/src/src/src/.htaccess
  - Attacker permissive .htaccess: wp-includes/js/dist/dist/.htaccess
  - Attacker permissive .htaccess: wp-includes/js/tinymce/plugins/wpautoresize/wpautoresize/.htaccess
[2026-06-19 16:40:16] OK (0 issue(s))
[2026-06-19 17:32:28] OK (0 issue(s))
[2026-06-20 22:36:10] ANOMALIES (1 issue(s))
  - Admin count = 3 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [75]VampXDs
[2026-06-21 17:54:13] ANOMALIES (1 issue(s))
  - Admin count = 3 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [77]wpadmin5647
[2026-06-21 17:57:46] ANOMALIES (1 issue(s))
  - Admin count = 3 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [77]wpadmin5647
[2026-06-21 18:03:42] OK (0 issue(s))
[2026-06-21 20:20:51] OK (0 issue(s))
[2026-06-22 09:07:31] ANOMALIES (1 issue(s))
  - Admin count = 3 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [78]wpadmin5949
[2026-06-22 10:49:41] ANOMALIES (23 issue(s))
  - Admin count = 3 (expected 2). Admins: [1]GeoGaming, [2]william.brassier@gmail.com, [79]wp_postadmin
  - Doubled-subdir backdoor pattern: wp-content/uploads/rsssl/rsssl
  - Doubled-subdir backdoor pattern: wp-content/plugins/ele-custom-skin/skins/skins
  - Doubled-subdir backdoor pattern: wp-includes/css/dist/widgets/widgets
  - Doubled-subdir backdoor pattern: wp-includes/blocks/query/query
  - Doubled-subdir backdoor pattern: wp-includes/blocks/latest-comments/latest-comments
  - Doubled-subdir backdoor pattern: wp-includes/blocks/preformatted/preformatted
  - Doubled-subdir backdoor pattern: wp-includes/blocks/preformatted/preformatted/preformatted
  - Doubled-subdir backdoor pattern: wp-includes/blocks/table/table
  - Doubled-subdir backdoor pattern: wp-includes/blocks/missing/missing
  - Doubled-subdir backdoor pattern: wp-includes/blocks/calendar/calendar
  - Doubled-subdir backdoor pattern: wp-includes/blocks/spacer/spacer
  - Doubled-subdir backdoor pattern: wp-includes/blocks/pullquote/pullquote
  - Doubled-subdir backdoor pattern: wp-includes/Requests/src/Transport/Transport
  - Doubled-subdir backdoor pattern: wp-includes/SimplePie/src/Cache/Cache
  - Doubled-subdir backdoor pattern: wp-includes/js/imgareaselect/imgareaselect
  - Doubled-subdir backdoor pattern: wp-includes/js/tinymce/themes/themes
  - Doubled-subdir backdoor pattern: wp-includes/js/swfupload/swfupload
  - Attacker permissive .htaccess: wp-content/uploads/rsssl/rsssl/.htaccess
  - Attacker permissive .htaccess: wp-content/plugins/ele-custom-skin/skins/skins/.htaccess
  - Attacker permissive .htaccess: wp-includes/blocks/preformatted/preformatted/preformatted/.htaccess
  - Attacker permissive .htaccess: wp-includes/js/imgareaselect/imgareaselect/.htaccess
  - Attacker permissive .htaccess: wp-includes/js/tinymce/themes/themes/.htaccess
[2026-06-22 10:53:44] OK (0 issue(s))
[2026-06-22 13:16:30] OK (0 issue(s))
[2026-06-23 17:21:15] OK (0 issue(s))
[2026-06-23 19:05:07] OK (0 issue(s))
[2026-06-25 07:57:16] OK (0 issue(s))
[2026-06-25 08:02:06] OK (0 issue(s))
[2026-06-25 14:31:02] OK (0 issue(s))
[2026-06-25 20:51:31] OK (0 issue(s))
[2026-06-29 16:40:20] OK (0 issue(s))