Serves me right for running an out of date WordPress I guess. Exact same attack, exact same IP address … 87.118.100.81 … I have informed abuse@keyweb.de. I wish I’d read this yesterday, though! Off to restore from backup …