Incident on Samarthya

Rebuilding samarthya.me, part 1: The day the blog fell

Sun, 25 Oct 2026 12:00:00 -0400

On 10 October 2026 my blog stopped being mine. This series is the diary of getting it back, and of moving to something simpler: from shared hosting and WordPress to a static site on GitHub Pages behind Cloudflare.

What I found
#

The site had been running WordPress on shared hosting since 2019. When things started to look wrong, a closer look turned up the classic signs of a compromise:

A copy of the crime scene

Thu, 22 Oct 2026 20:00:00 -0400

Took the first full copy of the old site’s database today.

It was a strange thing to read. My own account was gone. Every post, all 207 of them, belonged to the attacker’s account, the one “registered” on 10 October 1970. 46 of my posts were sitting in drafts.

The blog went down

Sat, 10 Oct 2026 21:00:00 -0400

The old WordPress blog was compromised today. Someone got in, left files behind that had no business being there, and the site stopped being something I could trust.

First moves: take it offline, change every password that touched it, and keep a copy of everything for later. Six years of posts were in there. Tomorrow’s problem is what can be saved.

The defences went off

Fri, 09 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

Just after midnight (UTC), an administrator account “registered in 1970” logged in. A minute later, 20 plugins were switched off in the same second, including the one that blocks password guessing.

Casino posts under my name

Thu, 08 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

21 successful logins today, more than I’d make in a year. Early in the morning (UTC), the first spam post went up: casino and betting “reviews” in German, Spanish, Greek, Turkish, Finnish… Over the next two days there were 55 of them, published as if I’d written them.

The password worked

Wed, 07 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

Two successful logins today. The next day there would be 21.

Someone was knocking

Wed, 30 Sep 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

The login-protection plugin counted 165 failed logins today. Bots try passwords on every WordPress site, all year round, so a few a day is normal. This was the busiest single day in its records.

Incident on Samarthya

Rebuilding samarthya.me, part 1: The day the blog fell

What I found #

A copy of the crime scene

The blog went down

The defences went off

Casino posts under my name

The password worked

Someone was knocking

What I found
#