I started this blog in 2013 to document bread baking and some home automation projects (RIP to my Raspberry Pi light controller, which I’m now realizing I should also go check on). Then, the way these things go, life happened and I completely forgot about it. Forgot I still had hosting. Forgot the login. Eventually forgot where it was even hosted at all.

Today I was trying to sort out an old ecobee thermostat login – the address was ecobee3@jasonarends.com, which I always assumed forwarded through Google – and Google flatly told me the account doesn’t exist. That sent me down a DNS rabbit hole on this domain, which is how I discovered this blog had been quietly serving something considerably spicier than sourdough starter instructions for a while.

what I found

Somebody had turned my dusty little blog into a Spanish/German/Dutch online-casino spam farm. Of the 54,002 posts sitting in the database, 12 were mine. The other 53,990 had titles like “Wikibet Casino No Deposit Bonus 100 Free Spins” and “Automaty Točenie Zdarma 2026,” and most weren’t even posted through WordPress – they were inserted directly into the database, in batches, thousands of them sharing the exact same timestamp down to the second.

Digging further (with a lot of help, more on that below) turned up:

• a file manager webshell hidden in the uploads folder, disguised with an innocuous filename, giving whoever planted it full read/write access to every site on my hosting account, not just this one
• about 25 fake “plugins” with gibberish names, several of which were literal cloned copies of the real Akismet plugin, used as camouflage
• a plugin called “Newsletter Pro” that, despite the friendly description, was actually malware – it scanned every PHP file on the site every 5 minutes hunting for other malware’s backdoors and fake admin accounts, and deleted them. malware, defending its turf from other malware
• evidence of at least three separate break-ins, spread across October 2024, December 2025, and August 2026. this thing had been getting compromised repeatedly for almost two years and I never noticed, because I never looked

how I found (and fixed) it

I ran this whole investigation and cleanup with Claude Code, basically riding shotgun with me the entire way. I handed it a Cloudflare API token and a cPanel API token and let it work through the problem – it figured out my DNS was still pointed at an ancient Arvixe hosting account from a decade ago that I had completely forgotten existed, pulled apart the webshell it found to confirm exactly what it was, traced how the malware operated, and then, once I was actually home and could sit with it, we did the real cleanup one authorized step at a time. I made it explain each destructive action and ask permission before doing it – which, honestly, is exactly how I’d want to work with a very capable but very literal new hire who’s just been handed root access to my stuff.

By the end we had: neutralized the webshell, deleted the fake plugins and the malware-fighting-malware, wiped the 53,990 spam posts back down to my original 12, rotated WordPress’s security keys, reset my admin password, and cleaned up the robots.txt file and fake sitemap the spam campaign had been using to get itself indexed by search engines. Still working through the email side of things (turns out the free “G Suite for your domain” I set up back in the day got sunset by Google at some point and I never got the memo), but the site itself is clean now.

what you should go check on your own old stuff

If you have a WordPress site, blog, or anything else you set up years ago and haven’t logged into since – go look at it. Specifically:

1. check your plugin list for anything you don’t recognize, especially gibberish names, or anything with a suspiciously generic name like “Newsletter Pro” that you don’t remember installing
2. check your user list for accounts you didn’t create
3. look at your site’s actual DNS and hosting – if you don’t remember where something is hosted anymore, that’s a sign it’s gone unattended for way too long
4. check for huge error logs or unfamiliar files sitting in your uploads folder
5. if a domain is doing something you don’t recognize – a mystery sitemap, a weird robots.txt, content in languages you don’t speak – that’s not a glitch, that’s a compromise

The lesson here is boring but true: an old, forgotten, unpatched site is exactly what gets found and quietly reused this way, for years, precisely because nobody’s watching it. Set a calendar reminder if you have to. I clearly needed one.

the honest disclosure part

This post was written by Claude (an AI) at my request, based on the actual investigation we did together today, after it read through my old posts here to match the voice. I’m publishing it close to as-written because, honestly, it felt like a fitting way to close out today’s saga. I did the important human part – authorizing every single change made to my own site, step by step – and Claude did the digging, the fixing, and now the writing.

one more thing

Since apparently people still occasionally read this thing: I’m currently looking for work. If today’s little saga is any indication of how I approach a genuinely ugly infrastructure problem, or you just need someone who can dig into a mess like this and come out the other side with a fixed system (and an unreasonably detailed blog post about it), drop a comment below or track me down.

update, the next day

So, funny thing. In the middle of turning this cleanup into a whole series of posts about the projects I’ve built with Claude, we found jasonarends.github.io – a Jekyll site I’d set up back in 2022 and then completely forgot about, same as I’d forgotten about this WordPress install in the first place. One post on it, titled “hello world,” explaining that I’d gotten fed up trying to theme WordPress and switched to Jekyll instead. I never wrote a second post. I just quietly stopped, and this WordPress site kept right on existing, unwatched, for four more years, until today.

Given that this whole incident happened because a piece of unmonitored WordPress infrastructure got compromised three separate times without anyone noticing, moving off WordPress entirely stopped being a someday-maybe idea and became the obvious next move. So: we wiped a different old droplet down to nothing, put a plain static site on it (no PHP, no database, no plugins, no admin login – nothing left for a webshell to hide in), wired up GitHub Actions so pushing a post to the repo builds and deploys it automatically, and moved this blog and the whole new project series over there. jasonarends.com now points at that instead.

Which means, a little absurdly, most of today’s actual WordPress hardening – the rotated keys, the cleaned plugin list, the fixed robots.txt – is now moot, since that install isn’t what’s serving the domain anymore. I don’t think that makes today wasted, though. We wouldn’t have known this needed to happen at all without doing the investigation first, and everything genuinely dangerous about the old setup – a live webshell, a backdoor account, three compromise waves nobody caught – got found and dealt with regardless of what happened to the hosting afterward. Sometimes the fix for a broken thing is fixing it. Sometimes it’s finding out you don’t need it anymore. Today was both.

Who am I, what is this for, why does this site look this way?

• Hello, I’m always working on some kind of computer-related project. Usually I hear about some new thing, and try to implement it, and learn how to do it along the way. It fills a constant need for both creativity and learning.
• When I’m learning and launching something new to me, something almost always goes wrong along the way. Typically, missing or incomplete documentation results in searching and searching and piecing together info found across sites until I end up with a working config. To help reduce the time it takes for others to find this info in the future, or to document it for myself in case I need to rebuild a system, I wanted to have a place to explain the problems and solutions I’ve found.
• I recently really started liking the solarized color scheme - both light and dark. It is very easy on the eyes due to being low-contrast and there’s a well thought-out version of it created by Ethan Schoonover that I planned to put into a custom theme in WordPress. I was also looking for a very readable font to go along with it and found a theme using Computer Modern which apparently is the font created by Donald Knuth for TeX.

It turned out that theming WordPress was harder than I wanted to do, because it wouldn’t let me change the fonts very easily with their new “extremely customizable” theme.json system. So I started looking for other blog content management systems, ideally with ability to do syntax highlighting for code and I found this post where the author listed GitHub Pages, Jekyll, WordPress, and a few others that didn’t meet his needs - he ultimately selected WordPress, but I was tired with it so I started looking into Jekyll because I had never heard of it. THe GitHub Pages + Jekyll version seemed neat since I already use git. This led to a whole learning curve around Jekyll and Ruby Gems that I’ll document in another post.

Finally, why the weird title Project Review Letters? Well, when I was an undergrad doing research in Physics, we often looked up papers in journals like Physical Review Letters and the document processor LaTeX is also used to format research papers. I feel like my notes here are results of research on my projects, so the title fit.

1. the position of the sun
2. the weather
3. if the room is occupied

#3 is new and I just added it over the past weekend.  Here’s how it all works, since I know you’re curious.

First, every day after midnight, a script runs that uses a program called “sunwait” which calculates the sunrise and sunset times for your latitude and longitude. The author of the program wrote it to also be able to calculate when the various “twilight” times start and end, such as astronomical, civil, etc. These are all defined by how many degrees below the horizon the sun is. Well, instead of knowing how far below the horizon the sun is, I wanted to know how far above it was – since it is of course, darker in the house when the sun is low and behind trees and stuff. So I went into the code and changed a few things and I now calculate +5 and +10 degrees after sunrise and before sunset. The script records all these values into a database first thing each day.

Another very simple script (really just one line in my crontab) pulls down current weather data for a weather station near me from wunderground.com using their API. The weather data conveniently includes a text description of the current weather, something friendly like “Partly Cloudy” or “Heavy Fog” or “Tornado” and these are all defined on their site. I went through and categorized each of these conditions into where I thought they fit in 3 categories: “bright”, “dim”, and “dark.” I’d really like to get more accurate data – such as percent cloud cover but I haven’t found a source for that. Apparently airport METARs have that info but they only update hourly. I’m not sure if the wunderground data actually pulls from that but the rest of the data updates much more frequently. Another solution I might implement is just using a light-sensor that the pi can read. The point is, the current weather string is parsed and either “bright”, “dim”, or “dark” is recorded into a database with the current time.

The occupancy data is gathered from my ecobee 3 thermostat, which includes these nifty remote wireless sensors. Each sensor transmits the temperature and motion detection back to the thermostat, which it uses to determine which rooms are occupied and should be averaged into the current house temperature. With their most recent API update, you can now poll the “occupancy” status of each sensor. The occupancy is based on if there was any movement in the previous 30 minutes, so there’s always going to be a bit of a lag when the room is empty before it is deemed “unoccupied.” I record the data into a database as well, every 5 minutes.

With all this data being recorded, the final part is a script that reads the various pieces of information and determines what to do. The script is generally run every 2 minutes during parts of the day where I want light. For example, if it is “morning” (which I mean before sunrise) then all lights should be on if the room is occupied, but only 1 light if it is not. So if I run the script at 6:30a, the sun is not up, so it will turn one light on for when I wake up and then when it detects someone is there, the rest will also come on. If it is the middle of the day and it is “dim” then I would like 1 light on in the living room if it is occupied. However, if it is not occupied during the day, then no lights should be on, no matter how dark. As the sun sets, more lights are on for each of the 3 light levels, and finally after the sun sets, all lights are on.  When the sun is around 5 degrees from setting, or later, if nobody is home, 1 light will be on.

I uploaded my python scripts to github. They’re not entirely useful to anyone else because you don’t exactly have all the other pieces that fit into it, such as the weather and sun position scripts, but if you know how to input these things, the same automation can be done. My repo is here: https://github.com/jasonarends/x10-py-wx.

Oh – I forgot one crucial bit of info – the lights are controlled by these “ancient” home automation modules called SmartHome X10. They work by transmitting signals over the powerline and feature radio-signal remote controls. Luckily, they made a computer interface called a “firecracker” which plugged into a serial port and also could send these radio signals to the wall plugin module, which then transmitted the codes over the powerlines. With a USB-serial adapter, I hooked this up to my pi, and use a program called “heyu” to actually change the lights on and off. I wrote a wrapper for this called “pheyu.py” which records the last “known” status of each light in a database and then changes the status when requested. Unfortunately the firecracker is a one-way communication, so the pi never really knows the state of the lights, they might have been overridden by the hand-remote. Best it can do is just assume and remember what it tried to do, but it’s really in the dark.

BTW, I also hooked up one module to an electric cat food dispenser, so the cats are fed on a schedule by the pi.

So far the plants consist of: 3 varieties of tomato, 2 varieties of green bell pepper, red and white onions, strawberries, and parsley. I have potatoes that will be added into the middle of all the bales and I want to get more herbs to plant in the sides. I am also planning on getting one more tomato variety and there is one bale still unused – maybe garlic or something, I’ll have to make a trip to the greenhouse and see what they have. I might see about planting a vine plant or two in the ends – pumpkins and cucumbers?

Maybe I can insert a table to illustrate the layout:

We also moved our compost – it was in a circular bin near our deck, but I thought it would work well to just pile it in the gaps between the S pattern of the bales, so we did. If we still live at this house next year, we should have a pretty good amount of compost and could even make a regular raised-bed garden. The bales will have decomposed by the fall and can get stirred into the compost, along with old vegetable matter.

That’s it for now – hopefully potatoes (russet, red, and yellow) will be planted by EOD and maybe more herbs.

Went outside today to fertilize the bales and took a few pictures of some flowers (looked like bluebonnets but I don’t think they are, they appear to be on onion/garlic stalk-type-things) and a snail under a tree.  By the way, I measured the temperature of the straw bales Tuesday and it averaged 87 degrees.  It rained yesterday so I didn’t bother watering them.  I didn’t water them today since it’s supposed to rain as well.
 

Then I saw a morel mushroom.  I have never had one and haven’t been a huge fan of any mushrooms in general, but I picked it and Holly and Valentine helped me search around and we found one more.  Apparently there’s fake ones that are poisonous but according to the internet, these are genuine.

Yes, they look like tiny brains.  I have heard these are good and people hunt them so, I googled how to cook them, coated them in a little flour and fried them in some butter in a skillet.

I thought they were actually quite tasty, kind of like chicken or something.  Holly tried one and wasn’t a huge fan, but I will definitely search for more after a rain or if I’m ever wandering in a forest or something and have them again.

This is neither a conservative nor a liberal movement, it’s a non-profit that is trying to pass local Anti-Corruption Acts to keep bribery and big money out of government. Watch the videos, I think it’s a good idea, starting small where things can be changed to lead up to national influence in the long run.

Check it out, get involved locally.

The idea is to create fertilized straw bales that you plant your garden directly into, so the ground underneath does not matter at all – in fact, you can put your bales on pavement if you really want to.  So, we bought about a dozen bales last fall around Hallowe’en when they were easy to come by afford-ably, and  left them in our backyard.  They also came in handy to help insulate the house during the winter.

Since it is finally warm out and looks like it will stay that way, I started preparing the bales.  I suppose I should have really done that a few weeks ago so we could start planting now, but I think it will be ok.  You’re supposed to fertilize them every-other-day for about 10 days, and water them every day.  I bought some “cheap” lawn fertilizer with about 30% Nitrogen and put 2c on each bale, then watered it until all the little pellets went down into the bales.  I’m planning on taking the temperature inside the bales every day at the same time and graphing it – should see a spike and then level off, then it should be ready for planting.

We are planning on planting potatoes, tomatoes, cucumbers, pumpkins, onions, garlic, dill, oregano, peppers, and a few other herbs (it’s all written down on a paper I don’t have in front of me.) I read that you can actually plant potatoes deep down in the bales and then plant other things on top, so that should work out well.  Then you can either harvest new potatoes or wait until the other plants are done, kick the bales apart, and just pick up the full-sized potatoes in the fall.

• 1 c active sourdough starter
• 6.5 c bread flour
• 1 c spicy V8
• 1.25 c water
• 2 Tbsp olive oil
• 1 Tbsp garlic salt
• 3 Tbsp sugar
• 1 tsp pizza seasoning
• pepperoni and mozzarella cheese (optional)

make the bread in the exact same way as the white bread recipe referenced above.  when it comes time to roll up the dough into a loaf, first add pepperoni and cheese, then roll it.  i made one with the filling, one without.

during the first rise which should be 10-30 mins, i think i let it sit for about an hour.  i probably should have shortened it as something weird happened later.  after a proof of about 1.25 hours, which is shorter than usual for this bread, the un-filled loaf got all lumpy and holey.  i didn’t notice when this happened, but my guess is that it somehow got over-proofed and started to deflate.

when it came time to bake, the un-filled one took the regular 25-30 mins, but the filled one took much longer to get up to 190-195 degrees.  i probably baked it an additional 15-20 minutes – measuring the internal temperature about every 5 mins.

the finished product is more orange colored in the middle with a hint of pizza flavor, but not too much.  i think next time i’ll basically add more of the flavorings: pizza seasoning, tomato juice, filling.  i was thinking about trying pizza sauce instead of juice, but would probably need to add more water as well.

haven’t tried yet, but i’m guessing this would make a nice grilled cheese with mozzarella and pepperoni…

i got a fancy new digital scale for christmas, so you’ll see that featured in posts from now on.  it also means that my weight measurements will switch to grams, and since it has a tare function, the weight will be the ingredients alone, not including the container.

the recipe calls for instant yeast but i wanted to try it without, and it did work fine, just took a little longer… which kind of defeated the purpose of looking for a faster recipe.  total it took about 8 hours from mixing to baked bread, which is better than the 16 or more the other takes.

• 1 cup “fed” sourdough starter (227g)
• 1 1/2 cups lukewarm water
• 1 tablespoon sugar
• 2 1/2 teaspoons salt
• 600g bread flour

combine all the ingredients.  i started with the starter and added everything except the flour – adding that last so i could only add as much as necessary.  i added about 530g of flour before it came together, then used more during kneading to keep it from sticking.

after kneading, let the dough rise until ripe – the recipe says 90 mins, but that’s with instant yeast – mine took about 4.5 hours.

form the dough into two loaves.  the original recipe was for a “rustic” loaf but i decided to make one in a pan.  i used the same flatten-then-roll-up method i’ve used before for the pan loaf, and just made a generally loaf-shaped loaf for the other one and put it on some parchment paper to rise and make it easier to transfer to the oven.  i let it rise for at least 3 hours, til it was very fluffy, then sprayed the top of each loaf with water, cut some slashes into the top of each loaf, then baked each loaf for about 25-30 mins at 425.  for the rustic loaf, i placed the parchment paper on my pizza stone.

both loaves baked nicely and tasted very similar to the other bread i’ve made.  as you can see below, the rustic one didn’t last long as we ate about 4 slices while it was hot!