Daily
Small wins, things I tried, and what I did at leisure.
Milestones
-
⚠ Someone was knocking
165 wrong passwords in one day. The busiest day for password guessing the old blog ever logged.
-
⚠ The password worked
The first successful logins of the break-in. My reused password had found its way to the wrong people.
-
⚠ The defences went off
A fake administrator, 20 plugins switched off in one second, and a hidden loader planted to stay.
-
⚠ The blog went down
The old WordPress site was compromised. Taking it offline was the first step.
-
Rebuilt on Hugo
137 posts moved to a static Hugo site, 126 images recovered from an old backup, old links kept alive.
-
The domain moved
DNS moved to Cloudflare, mail kept working, and samarthya.me now serves the new site over HTTPS.
October 2026
Reading the malware
Decoded what the attackers planted, wrote alt text for 103 images, and started a guide to moving to Hugo.
The domain moved
DNS moved to Cloudflare, mail kept working, and samarthya.me now serves the new site over HTTPS.
Rebuilt on Hugo
137 posts moved to a static Hugo site, 126 images recovered from an old backup, old links kept alive.
Salvaging six years of posts
Exported the content from the broken site and started sorting what could be recovered.
A copy of the crime scene
The first full database dump: every one of my posts now belonged to an account registered in 1970.
The blog went down
The old WordPress site was compromised. Taking it offline was the first step.
The defences went off
A fake administrator, 20 plugins switched off in one second, and a hidden loader planted to stay.
Casino posts under my name
21 successful logins, and the first of 55 spam posts published on my blog.
The password worked
The first successful logins of the break-in. My reused password had found its way to the wrong people.
September 2026
Someone was knocking
165 wrong passwords in one day. The busiest day for password guessing the old blog ever logged.