A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-credit-card-skimmer/
Should this be detectable in web server logs? The bad guys redirected to legitimate checkout page after skimming, and since they controlled the main page, referring url could have looked normal there; but would any of malicious iframe request have been logged?
I would expect some log entry for
deskofhelp.com to show somewhere - assuming web logs are intact?