Normally I just lurk hoping to pick up a thing or two but today I'd like
to comment. Way back when I ran across a script called "COPS" that runs
daily. It was/is a collection of scripts, one of which is:
find / | sum > thisrun
diff thisrun lastrun | report
mv thisrun lastrun
run = daily, weekly, hourly... your pick. If any files get changed
you're told.
Also my htaccess contains a lot of "deny from a.b.c.d" (and several
n.0.0.0/8).
Chuck
You could start by seeing if any of the files have been changed
recently (OS-specific; are you running Linux?) or something has been
uploaded (if it is still there).