Security Incident Report

A scan of 18 satellite lodge and brand sites found no comparable infections on other properties. However, abacolodge.com shares server IP 45.89.205.215 with bairslodge.com, piralodge.com, and thekautapengroup.com — all running the same WordPress stack (LiteSpeed, Elementor, AIOSEO, theme bairs) — so those sites should be audited and hardened proactively.

1. Spam Blog Posts (31 URLs)

All published under /author/marcos/. The fake author profile was created October 5, 2023; spam publishing aligns with client report of activity since December 2024.

2. Homepage / Navigation Link Injection

Gambling and spam domains injected into section headings on the homepage:

3. Injected External URLs

4. Technical Footprint

All URLs currently indexed in the sitemap. Delete these posts and request removal from Google Search Console.

• /open-the-mysteries-of-tarot-card-cards-with-free-readings/
• /the-magic-of-free-lotus-tarot-card-readings-introducing-the-mysteries-of-your-future/
• /opening-the-mysteries-of-7-card-tarot-analysis-a-comprehensive-guide/
• /call-numerology-calculator-by-date-of-birth/
• /numerology-report-a-comprehensive-overview/
• /unlocking-the-secrets-of-free-online-tarot-card-readings/
• /the-ultimate-overview-to-tarot-card-pull-online/
• /vedic-numerology-calculator-introducing-the-mysteries-of-figures/
• /numerology-calculator-by-date-of-birth/
• /opening-the-mysteries-of-free-tarot-analysis-online/
• /unlocking-the-mysteries-of-tarot-card-reading/
• /the-art-of-tarot-card-analysis/
• /the-amount-of-cards-in-a-tarot-card-deck-a-comprehensive-guide/
• /open-the-mysteries-of-tarot-card-analysis-completely-free/
• /discover-the-magic-of-free-daily-tarot-readings/
• /numerology-calculator-unlocking-the-secrets-of-numbers/
• /tarot-card-card-reading-free-whatever-you-required-to-know/
• /opening-the-mysteries-of-lotus-tarot-card-card-analysis/
• /tarot-card-online-free-opening-the-mysteries-of-the-cards/
• /tarot-free-online-your-ultimate-guide/
• /the-full-guide-to-all-tarot-card-cards/
• /the-ultimate-guide-to-tarot-spreads/
• /discovering-the-world-of-free-tarot-readings/
• /numerology-horoscope-by-date-of-birth/
• /opening-the-power-of-numerology-with-a-free-numerology-calculator/
• /numerology-birth-date-calculator-opening-the-secrets-of-your-life-path/
• /the-ultimate-tarot-card-guide-unlocking-the-mysteries-of-the-cards/
• /unlock-the-mysteries-with-free-lotus-tarot-card-analysis-select-6/
• /opening-the-power-of-indian-numerology-calculator/
• /the-power-of-7-card-tarot-card-reading-free/
• /numerology-generator-opening-the-power-of-numbers/

Scanned July 9, 2026 — homepage keyword scan, sitemap analysis, and suspicious author enumeration.

1. 1Take abacolodge.com offline or enable maintenance mode while cleaning
2. 2Rotate all passwords — WordPress admin, SFTP, database, hosting panel
3. 3Delete all 31 spam posts and the unauthorized marcos user (ID 8)
4. 4Remove injected gambling links from homepage and compromised pages/widgets
5. 5Scan for backdoors in wp-content/, theme files, mu-plugins, and uploads
6. 6Update WordPress core, all plugins, and PHP to latest versions
7. 7Install Wordfence or Sucuri and run a full security scan
8. 8Disable XML-RPC if not needed; block REST API user enumeration
9. 9Apply hardening to all 4 sites on shared server IP 45.89.205.215
10. 10Purge LiteSpeed cache after cleanup
11. 11Submit updated sitemap to Google Search Console; request removal of all 31 spam URLs
12. 12Re-run satellite site scan to verify all properties remain clean