I’m an admin to that website, I’m just trying to see whats going on, I don’t even know where that box is running and don’t have ssh access.
Meanwhile, I see something strange, somebody logged in as “system”, created a “Test” account and deleted immediately
I asked the admin guys did anyone logged in as system account and created Test account, yet to get reply from them. If they say nobody logged in as system at that time, then it looks like that box is compromised.
In this case, can anyone create user account through db bypassing email verification? can we see their activity in db logs?