Thank you for the awesome plugin!
I’m having a strange issue and I’m not sure if it’s related to Wordfence or not, but would love some suggestions if you have any. It’s a bit complex, but I’ll try and keep it short.
Wordfence Version 7.4.9 (1594219913)
Starting on July 12th, Wordfence found approximately 750 Unknown files (that start with .mx in the file name) on a site I manage for a client of mine.
The strange files are throughout the public_html folder, including WordPress Core, Plugin and Theme folders. Wordfence found/warns about approximately 750 files (with a Standard & High Sensitivity Scan), but a general search for .mx files within the public_html folder returns around 6-7 thousand files.
The strange files follow this naming format: .mx.########.mx where the #s are an 8 digit incremental number starting with 11. So for an example: .mx.11401215.mx
The files themselves appear to be direct copies of WordPress files – I’ve compared a few to a fresh download of WordPress and they’re exact matches.
After some testing, I found out that the timestamp on the files all correspond to the start time of a Wordfence scan. If I delete the files they don’t reappear until another scan is performed.
Nothing specific was changed on July 12th that I know of and it doesn’t directly correspond with the release date of Wordfence version 7.4.9 on July 8th, which makes me think the underlying issue may be with my hosting?
The hosting company wasn’t helpful, but did say there was a permission issue with the hosting account, which they supposedly fixed. I don’t know if they actually fixed it, since the strange file issue persists. I don’t know exactly how the Wordfence scan functions technically but could the unknown files be related to a permissions issue when scanning? I don’t see anything directly related in the error logs.
Thanks for any help!
- The topic ‘Unknown .mx files found by scan’ is closed to new replies.