So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, registered to some dude in China, that redirected to my server. I looked around and found that it's pretty common to have folks requesting stuff to check for vulnerabilities in your site etc.
Then I saw a GET request with my FTP username in it, not made by me and that's when I started getting worried my server had been compromised. I promptly started taking measures, making sure everything was up to date, changing passwords, username of my FTP, hosting account and pretty much anything I could think of. Now I see the same type of requests, with my changed FTP username, still not by me.
This is kind of freaking me out.
There's nothing terribly serious on my webserver, it's just a couple of basic sites I've been (mostly) playing with. No client data or anything sensitive like that. I just use it to host my online webpage/resumé for the moment.
Still, I don't have any experience in how to deal with this & I'm somewhat uneasy about what's going on. My site is very simple, so I could quite easily rebuild it from scratch.. What's the best course of action here? Burn everything & start over?
A million thanks to anyone taking the time to reply, I could really used some advice on this.