Greenagritainment.com

greenagritainment.com e' un sito WordPress del sistema ISI-CNV, legato ai progetti europei (Agritainment).

Identita'

• Tipo: sito WordPress
• Tema attivo: agronix
• URL: https://greenagritainment.com
• Progetto: European Projects / Agritainment

Accessi

• Hosting: HostGator, IP 50.6.109.204, utente cPanel bsgvwjte
• SSH dalla VM: ssh -i ~/.ssh/hostgator bsgvwjte@50.6.109.204
• ATTENZIONE: due installazioni WordPress sullo stesso account.
  • ~/public_html/ — altro sito, admin marco
  • ~/greenagritainment.com/ — QUESTO sito, admin ad-agri e marco-agri
• wp-cli disponibile: /usr/local/bin/wp
• Database: bsgvwjte_green, prefisso wp_
• Credenziali: in memoria CC, cercare "greenagritainment" o "hostgator"

Stato

Verificato il 17/08/2026 dopo un'infezione malware:

• Core WordPress: verifica contro i checksum ufficiali
• Plugin: 28 su 31 verificati contro i checksum. I 3 saltati sono premium del tema (bdevs-element, bdevs-toolkit) e Hello Dolly: non hanno checksum pubblici, non e' un'anomalia
• Tema agronix: functions.php pulito, zero pattern di malware (eval, base64_decode, gzinflate, str_rot13)
• Nessun file PHP sospetto in wp-content/uploads/
• Wordfence: attivo. Non ha un sottocomando wp wordfence scan: la scansione va lanciata dal pannello
• contact-form-7 6.1.7 risulta "version higher than expected" da wp-cli, ma verifica contro i checksum: e' regolare, non e' un plugin manomesso

Cronologia dell'incidente

• 07/08/2026 — attivo un ruba-password; le credenziali di ad-agri e marco-agri vanno considerate compromesse da questa data
• 16/08/2026 — diversi plugin aggiornati (probabile punto d'ingresso: un plugin vulnerabile)
• 17/08/2026 03:24 — malware rimosso, chiavi di sicurezza cambiate (tutti gli utenti loggati devono rifare il login)
• 17/08/2026 — password di ad-agri e marco-agri ruotate via wp-cli, tutte le sessioni distrutte, integrita' verificata

TODO

• Lanciare una scansione Wordfence completa dal pannello (non esiste il comando CLI)
• Valutare un reinstallo pulito del tema agronix, per prudenza a lungo termine
• Le nuove password sono state generate e comunicate a Marco via mail: da conservare nel gestore

History

• 17/08/2026 — pagina compilata dopo l'intervento sul malware. Prima esisteva solo il riferimento nel registro proprieta', senza pagina: nessuna chat poteva trovare queste informazioni e finiva per chiederle a Marco.

Dalle conversazioni Claude (export 2026-08)

Fatti estratti automaticamente dai riassunti delle conversazioni Claude che citano questa proprieta'. Da verificare prima di considerarli canonici.

• [2026-08-14] Recuperare credenziali Agritainment — The conversation was a long, intensive working session covering nearly every technical and operational aspect of the greenagritainment.com WordPress site and the broader project deliverables, with Claude operating as the hands-on technical executor throughout. Claude built a complete five-module quiz system (greenagritainment.com/quiz-final.html) with Italian, Bulgarian, and Greek translations pre-selected by module, 70% pass threshold verified at the exact boundary (6/10 fails, 7/10 passes), certificates with both official logos and Erasmus+ disclaimer, and a PHP backend (quiz-api.php) saving results to CSV with Excel export, working around the hosting WAF by sending data as GET requests wi
• [2026-06-23] agritainment.com — **Conversation Overview**

Marco is managing the digital infrastructure for an Erasmus+ project called Green Agritainment (greenagritainment.com), which develops VET training methodologies combining agritourism, environmental education, and experiential learning. Claude independently verified the domain is legitimately tied to Marco's HostGator account (bsgvwjte), scanned both docroots (greenagritainment.com and agritainment.com/public_html, totaling ~36,000 files), queried the WordPress databases, and inspected the live rendered pages. Key people: Mario Dezzi (ad-agri, WordPress admin on greenagritainment.com).

• [2026-05-15] Pubblicare post agritainment da Ester — The articles are for greenagritainment.com, an Erasmus+ project site (code 2024-1-IE01-KA220-VET-000254134), with publication dates of May 15, 17, 18, 22, and 28, 2026 at 09:00 CEST. **Tool Knowledge**

The greenagritainment.com infrastructure has a critical structural trap: the cPanel account (user `bsgvwjte`, IP 50.6.109.204:2082, token `39STS31FKJYESD0CTHIOCMLPPOVGOO54`) has `bsg.vwj.temporary.site` as the main domain pointing to `/home1/bsgvwjte/public_html/`, while `greenagritainment.com` is an addon domain pointing to `/home1/bsgvwjte/greenagritainment.com/`. For binary file uploads to the correct path, use cPanel UAPI `Fileman/upload_files` as multipart with `dir=/home1/bsgvwjte/green

• [2026-05-01] Accesso shell Google account da qui — Multiple new integrations were added to the CC-isicnv: Stripe for three accounts (BIA at `acct_1HjRG8AjsWeFGWYx`, UE at `acct_181v7fAf24r1Tx38`, IPCA at `acct_1IWfzqBJplFqfgbM`) with an aggregated `/stripe/balance-all` route; ThriveCart with token `24RA4N7S-APP7VBGL-T1WFIBO5-QUGK5HJP` for 238 products; Google Workspace BIA for unibalkan.com (19 users); and Greenagritainment.com via cPanel (PHP changed from ea-php85 to ea-php83, ModSecurity bypassed with browser User-Agent, mu-plugin and db-proxy installed).
• [2026-04-16] Sostituzione video bulgari su Agritainment — **Conversation Overview**

Marco is working on the Green Agritainment project (greenagritainment.com), an Erasmus+ initiative with a multilingual video course managed through WordPress with Presto Player. **Tool Knowledge**

For WordPress video replacement with Presto Player on greenagritainment.com (DB prefix wp_, cPanel user bsgvwjte), three tables must always be updated together: wp_presto_player_videos (columns external_id and title), wp_posts.post_content for the published pages, and wp_posts.post_content for the corresponding pp_video_block reusable posts.