Across WordPress fleets and hosting: (1) egress/DNS to rank1cdn[.]com; (2) wp_options rows named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c; (3) admin users created since Oct 15; (4) PHP-executable .cache files, a fake WordPress core file, hidden PHP backdoors and a system cron marker (per Rank Math's IOC list); (5) plugin update logs showing 3.0.123 installed in the 20:02 UTC Oct 15 – 07:12 UTC Oct 16 window. Cleanup order matters: delete the whole rank-math-pro folder and the three option rows and block rank1cdn first, or the backdoor regenerates.