xr1s

Hi,

Thanks for the info.

Well, couldn’t say I didn’t do “anything”. After initial panic, I looked if there where any updates to perform. Installed Wordfence to scan. Did not flag any malware or critical errors.
Did show some edited files compared to initial install. Checked them for malicious content, but did not find any, mostly extra whitespaces, newlines, etc.
Scanned DB and did manual search too. Nothing.
Looked in theme header and footer.
Looked for eval and encoded 64 strings. nothing.
Finally decided to block that link in htaccess and also a new rule in WF.

Looked at my initial backup if there where any differences. Nothing.

Kind of stumped, but at least a little more assured now that it seems to have been a false flag/error.

I am getting quite a few requests (GET) for the link form ips hosted on east 2 aws servers though. Wonder if malware/phishing scanners are still trying to see if the content is up.

Wonder if unblocking will cut down on hits, since they are getting 503 and not 403 atm.
I wonder if removing the

Hi!

No, I had to submit a request for review.

Took about 2 days.

Hi,

Also, since setting up Wordfence WAF, I also created a block rule for the link.

Getting quite a few hits. Many from amazon compute.amazonaws.com addresses…

Wonder if the link was embedded in an email at some point.

Will have to keep a lookout.

Google revised the site and link and has cleared it.

Not sure where to go from here, except keep vigilant.

Hi,

Thanks for the tip.

Used the search console. It does not find any link (403)…

I can only hazard a guess that there might of been a link/file briefly and was removed, but I can’t find any evidence.

Very confusing.

Of course, I’m no expert, there might be something I’m missing. Can’t think what though.

Any further info/tips most appreciated. Thanks.