Daily on Samarthya

Reading the malware

Mon, 26 Oct 2026 16:30:00 -0400

Compared two database dumps taken four days apart and finally decoded the snippet the attackers left behind: a hidden loader that fetched its orders from a blockchain (details in the 9 October entry).

The domain moved

Sun, 25 Oct 2026 21:00:00 -0400

The scariest step, done. DNS moved to Cloudflare without changing a single record, mail checked in both directions, and only then was the website pointed at GitHub Pages.

samarthya.me serves the new site over HTTPS. www redirects to it.
Every old /wps/… link lands on the right post.
Wrote it all up: Rebuilding samarthya.me, in four parts.

Rebuilt on Hugo

Sat, 24 Oct 2026 22:00:00 -0400

A long day, and a good one. The blog is now a static Hugo site: no database, no plugins, nothing to break into. It’s published straight from a git repository.

137 posts converted, and every old link redirects to its new address.
An old backup turned up 126 of the missing images. A handful are still gone for good.
A new homepage that says what this place is for, and topics that sort themselves.

Fall down, get up, build again.

Salvaging six years of posts

Fri, 23 Oct 2026 20:00:00 -0400

Exported every post from the old site and went through the export carefully. The text survived. Many of the images did not: the server was serving error pages where pictures used to be. Also found a couple of “posts” I never wrote. Those stay out.

A copy of the crime scene

Thu, 22 Oct 2026 20:00:00 -0400

Took the first full copy of the old site’s database today.

It was a strange thing to read. My own account was gone. Every post, all 207 of them, belonged to the attacker’s account, the one “registered” on 10 October 1970. 46 of my posts were sitting in drafts.

The blog went down

Sat, 10 Oct 2026 21:00:00 -0400

The old WordPress blog was compromised today. Someone got in, left files behind that had no business being there, and the site stopped being something I could trust.

First moves: take it offline, change every password that touched it, and keep a copy of everything for later. Six years of posts were in there. Tomorrow’s problem is what can be saved.

The defences went off

Fri, 09 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

Just after midnight (UTC), an administrator account “registered in 1970” logged in. A minute later, 20 plugins were switched off in the same second, including the one that blocks password guessing.

Casino posts under my name

Thu, 08 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

21 successful logins today, more than I’d make in a year. Early in the morning (UTC), the first spam post went up: casino and betting “reviews” in German, Spanish, Greek, Turkish, Finnish… Over the next two days there were 55 of them, published as if I’d written them.

The password worked

Wed, 07 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

Two successful logins today. The next day there would be 21.

Someone was knocking

Wed, 30 Sep 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

The login-protection plugin counted 165 failed logins today. Bots try passwords on every WordPress site, all year round, so a few a day is normal. This was the busiest single day in its records.