Compared two database dumps taken four days apart and finally decoded the snippet the attackers left behind: a hidden loader that fetched its orders from a blockchain (details in the 9 October entry).
The rest of the day was quieter work:
- Alt text for all 103 images that had none, written after looking at each one.
- Screenshots that showed personal details are redacted, and the whale photos are finally the right way up.
- A new series for anyone planning the same move: Moving to Hugo.
- This daily log now starts on the day the knocking began: 30 September.