Case studies

Real incidents. Anonymised.

What we found, how we cleaned it and what stopped it coming back. Identifying details removed; example hosts and IPs are fictional.

Agency hosting · Linux VPS · WordPress

Root compromise clean-up: stopping a server that re-infected itself every 60 seconds

A Linux server hosting dozens of WordPress sites kept re-infecting minutes after every clean-up. Here is what was really going on.

Read the case study

Re-infectionEvery 60 sNone

Persistence mechanisms3 active0

Webshell kitsALFA · KINGSMANQuarantined

Sites verified onlineIntermittentAll

More case studies are being prepared. Read our guides in the meantime.

Get protected with unlimited malware removal, 24/7 monitoring and hardening, or get emergency help right now.

Get protected