crumblingcalcite

Hi @wfphil

I reached out to the hosting company and after a few hours I was able to explain what was going on. In case it helps someone else out in the future – in the end I literally had to show them what was happening. I had them watch some of the .mx files, then I deleted them, then I started a Wordfence scan (which made the files reappear) and then I had them confirm that the .mx files had reappeared. After that they decided to escalate the ticket.

A couple of days later we received an email followup:

“Thank you for contacting support. I’m responding to the ticket ######. I sincerely apologize for the delay in the response. Thank you for your understanding and cooperation. This ticket is raised since you r hosting account is generating .mx.########.mx files in the account. I do apologize to you if you experience any inconvenience due to this issue. I understand your concern related to the hosting account security. I’m glad to review your request and help you.

I have reviewed your ticket notes. I was able to replicate the issue reported in the ticket. I have investigated more about this issue, reviewing other cases with similar example. As per our internal tracker we did receive an ERT from WordFence directly stating that this is happening to several of their clients.

We are currently tracking accounts with similar issue to get more information about the cause for this issue. From our present research we are advised that these files are copy of php files that are scanned. These files are not malicious. So if you don’t want them, I request you to remove them manually from the account. Please note that we are currently aware of this issue and we are tracking the similar account with this issue to come to a conclusion.

I thank you for the opportunity to assist you today. If you have any concern related to the ticket or want to convey any message to us, you could reply back to this email with complete details. We are happy to review it and help you.”

They haven’t mentioned anything yet about the root cause or a fix, so I guess it’s now a waiting game.

Thanks again for the help.

Hi @wfphil

I just sent an email with the domain name.

Thank you for your help.

Hi @wfphil

Thank you very much for your quick reply and your thoughts on what’s going on.

The website is hosted with HostMonster.

I’ll reach out again to the hosting company and send them what you said. Hopefully they’ll be able to fix it. I’ll let you know what happens.

Thanks again.