Thanks for taking a look. I think I had finally discovered the culprit before you looked: a strange, convoluted .htaccess file in the themes folder. Its last line was “RewriteRule ^(.*)$ http://cloud-security.ru [L,R=302]” As soon as I disabled that .htaccess file everything cleared up.
I don’t see how it could be cached results. The site had been up and operational for months. And then SUDDENLY that demo image popped in there, viewing it from any number of browsers, including browsers that had never been to the site.
Did you log into the site? Do you still need the credentials?
I did not notice an email reply from you on June 1. What email address should I be looking for you to use when you reply?
The login information is below