Support

If we are talking about database tables, the only table which stores anything called a referrer is the #__admintools_log which logs the blocked requests, i.e. what Admin Tools prevented reaching your site and why. It would stand to reason that since Admin Tools stops malicious requests the log will contain a trace of the malicious request which has been already stopped.

If you mean something different you will have to be more specific, especially since no other Admin Tools database table has anything called a referrer.

FOF is the framework used in our Joomla 3 components. Seeing that in the Admin Tools PHP File Change Scanner files (filescache and scanalerts) is normal. Seeing that in the akeeba_common and ak_profiles tables is also normal; the former tracks which extensions installed on your site use it, the latter is the Akeeba Backup profiles and I suspect you may have excluded this folder. The final entry in the _extensions table is also normal; the framework is a Library extension installed on your site and the 1 match means it's installed. So, nothing out of the ordinary in the first screenshot.

In the second screenshot... This is NOT the redirections table for Admin Tools. You sent me a screenshot of the core Joomla redirections table (#__redirect_links). Admin Tools table is #__admintools_redirects.

Joomla's URL redirections is a misleading feature.

When you enable Joomla's System - Redirection plugin it records all URLs which are not found (yes, URLs NOT found, 404s that is) in the #__redirect_links table with an empty new_url (as you can see it's NULL) and published set to 0. The idiotic idea Andrew Eddie had 12 years ago was that you'd collect the 404 errors and create redirections. I had warned against it as confusing but I was told I don't know what I'm saying.

Well, as I predicted 12 years ago, people like you who do not — and need not! — understand the inner workings of Joomla freak out because this table records every single bot scanning your site and told to take a hike because this URL is not meant to be directly accessible. Of course you see all those “evil Russians” in your database, in a table which is moronically called a redirect_links table (even though it does no redirections by default!), and think some evil Russian hacked you and has created hordes of malicious redirections on your site. Nope. This is just a record of URLs some stupid Russian teenager tried to access a few years ago (your records are from 2017 to 2020 as you can see) and failed.

Sigh. I did warn them... But I digress.

Here's what to do.

Go to System, Manage, Plugins. Find the “System - Redirect” plugin and unpublish it.

Empty the contents of the #__redirect_links table.

That's all there is to it.