About server monitoring as a way to detect malicious activities, a real case of a compromised domain and decoding backdoor payloads

I was testing a Wordpress template on a domain I own on one of my servers. The demo data failed to import so upon contacting the developer he asked to have access to FTP and MySQL. In the end I figured out the issue, removed the access of the developer and just let the domain a ...