Incident Response & Hardening — Daily Report

Server Operations Summary

One working session on the DaamiHost shared hosting box: a mail-abuse incident escalated into a full security and performance pass across every site on the server, including discovery and cleanup of an active WordPress malware infection.

cp.daamihost.com · 157.173.111.253 · September 4, 2026

2Active compromises found & remediated

20Sites now page-cached

16Sites with object cache installed

10Subdomains brought online (DNS + SSL)

Timeline

Mail server flagged for outbound spam volume 03:20

DaamiHost's upstream network flagged unusually high SMTP traffic from this server's IP. Investigation traced it to one compromised mailbox — admin@gravityinfosys.com — being used by a botnet across dozens of rotating IPs to send pharma spam via authenticated SMTP.

Resolved

5,898 spam messages purged from queue Password rotated twice (2nd time generated server-side, never printed) Rate limit 200/hr → 30/hr

SSH hardened to key-only authentication 08:30

Root SSH accepted passwords despite an earlier attempt to disable it — a cloud-init default config was silently taking precedence due to file-load order. Added a priority override and verified with a fresh, isolated connection before considering it done.

Hardened

Server-wide performance pass 08:45 – 09:40

Discovered nearly every WordPress site was under active XML-RPC scanning (up to 70% of traffic on some sites) and that MariaDB had been running on its 128 MB compiled-default buffer pool the entire time — never actually configured.

InnoDB buffer pool: 128 MB → 1.5 GB
Legacy MySQL query cache disabled (write-lock contention on shared DB)
Opcache revalidate_freq: 2s → 60s
xmlrpc.php blocked outright on non-Jetpack sites; rate-limited on the one site that needs it
nginx page caching rolled out to 20 sites; persistent object cache (Docket Cache) installed on 16
WP-Cron switched from page-load triggers to real system cron on 11 active sites

Applied & verified

DNS and SSL brought online for 10 subdomains ~10:30

Ten *.daamihost.com project sites had never actually had live public DNS — the domain is delegated to Cloudflare, and HestiaCP's own local DNS zone (where records had been added previously) was never the authoritative source. Added correct records via the Cloudflare API and reissued Let's Encrypt certificates, which turned out to have been silently expired for months since renewal could never validate.

Resolved

Active malware discovered — educationloansolution.com ~11:15

Found while checking for a routine plugin conflict. A professional, multi-stage malware kit had been resident since August 6:

A backdoor admin account (wp_restore) disguised as a backup-utility user — the actual entry point
A plaintext credential harvester hidden in the theme, logging every login attempt to a file disguised as a .png — 329 attempts captured over a month, including the legitimate agency admin's real password
A fake "Auto Security Guard" plugin injecting malicious JavaScript into every visitor's page, with a Polygon-blockchain smart contract as a resilient fallback for finding its command server
A second dropper designed to redeploy a mu-plugins backdoor from a database-stored payload if ever removed

Critical — remediated

All 4 malicious components removed Backdoor admin deleted Both real admin passwords rotated WP secret keys regenerated — all sessions killed

Server-wide compromise sweep ~11:45

Scanned all 19 other WordPress sites on the box for the same indicators — the malicious C2 domain, the backdoor class signature, the credential-harvester key, and audited every administrator account for the same disguised-user pattern.

Clean — incident confirmed isolated

Site suspensions ~12:30

Ten *.daamihost.com dev/staging sites suspended per owner decision (confirmed individually). Separately, two long-standing broken sites unrelated to this session's work — manage.gravityinfosys.com and staging.wren.org.np, both throwing pre-existing 500 errors — were suspended rather than left erroring publicly.

Action taken

Current status

Check	Result
Mail queue	0 spam messages
Core services	MariaDB, PHP-FPM (8.2/8.3), nginx, Apache — all active
Sites touched this session	All returning 200 OK
Malware signatures, server-wide	None found outside the one remediated incident
Suspended sites (10 dev/staging + 2 broken)	Offline by design — reversible

Outstanding

Rotate the Cloudflare API token

It was pasted directly into chat during the DNS work. Treat it as exposed even though it was scoped to one zone — revoke and reissue.

Check password reuse for hello@ananta.info.np

Confirmed captured by the credential harvester. If that password is used anywhere else, it should be changed there too.

manage.gravityinfosys.com & staging.wren.org.np

Suspended, not fixed. Both have real underlying bugs (a missing required file; a broken PHP routing config) that predate this session and still need proper investigation when convenient.