Server Spring Clean-up Continues -- and the source might have been discovered

1. Change all remaining passwords:

Pair hosting
FTP/SFTP
email
WordPress admins
database users
Google accounts

2. Enable 2FA everywhere possible:

Google
Pair
WordPress
Bitwarden

3. Verify Google Search Console:

• remove unknown owners
• remove rogue verification methods
• inspect sitemap submissions
• inspect indexed spam pages

4. Verify no rogue FTP users or cron jobs exist.
5. Delete:

.user.ini.pair.*
.tmb
old cache directories
plugins-off leftovers no longer needed

6. Keep only clean themes/plugins active.
7. Reinstall plugins/themes ONLY from official clean sources.
8. Replace wp-admin and wp-includes on every infected site.
9. Leave Wordfence active on all sites.
10. Run fresh Wordfence scans after each major cleanup step.
11. Make fresh CLEAN backups after scans pass.
12. Inspect:

.htaccess
.user.ini
wp-config.php

on every site.

13. Disable comments globally if not needed.
14. Remove unused plugins and themes permanently.
15. Reduce writable directories and avoid 777 permissions.
16. Clear old debug logs and monitor for NEW entries only.
17. Keep sites lightweight until stability is proven.
18. Search ALL sites and home directories for these strings:

KINGMAN
avatar-amp
seoikan
haxor
mahasuhu
sys_waf_bypass_fetch
_compileExecPayloadTask
_compileFetchCoreLite
_compilePushToDiskNode
MY LAST DANCE
Tennessee
Backup-Shell
logger.txt
watchdogd
defunct
base64 -d|bash
eval(
base64_decode
google-site-verification

19. Search for suspicious filenames:

485.php
48r.php
de.php
big.php
12.php
pipe.php
framework.php
pluginloader.php
archive.php
filestore.php
nui1.php
nui1-1.php
nui1-2.php
nui1-3.php
gej3.php
gej3-1.php
gej3-2.php
gej3-3.php
importer.php
.™.php

20. Search especially inside:

wp-content
uploads
cache
themes
plugins
cgi-bin
~/.config
~/