Scripting • Router maybe is hacked. Please help

Hello,

I'm new. I have a MIKROTIK RB951U1-2nD router for 1 year. I access it with WinBox.

Behind it ( router) i have Windows, a xampp server on which I host Wordpress. A hacker attack started a month ago, and the hacker using the server's local IP 192.168.88.100.

Attacker real IP is not visible. I am asking for guidance on how to find out where the attack is coming from. The computer has Malwarebyts licensed.

Is mikrotik hacked or WinBox or something else.

Here is an example from the server access log:

192.168.88.100 - - [15/Mar/2024:14:14:57 +0200] "POST /wp-cron.php?doing_wp_cron=1710504897.6459970474243164062500 HTTP/1.1" 200 -
192.168.88.100 - - [15/Mar/2024:14:15:02 +0200] "POST /wp-admin/admin-ajax.php?action=wp_1_wc_privacy_cleanup&nonce=8e5dc83129 HTTP/1.1" 200 -

Please guide me.

PS Admins please excuse me if I haven't posted in the right place.

Statistics: Posted by vmax — Fri Mar 15, 2024 3:44 pm

---