Well I had a security expert look at my whole server and it was actually several things.. the hackers WERE trying to exploit that OLD weakness from Dolphin 5.2.. you could tell from the logs they were trying to access /templates/tmpl_dfl ... I'm guessing that was the default template in 5.2? Someone needs to send the hackers a memo and tell them no one uses that anymore. He told me that they are using a spider to crawl all my sites and check EVERY file for a weakness :-( I think I have blocked all see more of the "Ripe Network" which seems to be where all the bad traffic was coming from ..