Statistics file infected?

Hello P51Admin,
That IP does render a warning in Google Safe Browsing list. “Some pages on this website send visitors to dangerous websites.” If you want more information about it I would suggest you contact your host.

Since the file being referenced is a statistics file and as long as you know it will not be accessed by visitors or such by accident you can probably exclude it from scan.

@wfasa – Thank you very much for your extremely fast response. I will send an email to Netfirms support and see what they have to say.

I did search through the web page that displays my statistical results and that IP address was not a part of the information displayed.

I will not ignore the result for the moment until I get more conclusive information.

I will post an update with the response from Netfirms.

Thanks again for your extremely fast response !!!

P51 Admin

Hello Everyone;

@wfasa – I did get a message back from the Netfirms support group.

Here is that message;

*******************************

Hello,

I see that ‘Webalizer’ tool is chosen to display the account’s stats (via https://www.netfirms.com/controlpanel/VisitorStats.bml) and webalizer.current is one of the component files of webalizer tool that contains information about the website statistics. It seems that there was access from IP 69.89.31.141 to your website files and that’s how that IP appears in webalizer.current file. Also, I’ve scanned your account and didn’t find any malware contents in your account. Following are the scan results :
———– SCAN SUMMARY ———–
Scanned directories: 589
Scanned files: 4830
Infected files: 0
Data scanned: 318.58 MB
Data read: 184.62 MB (ratio 1.73:1)
Time: 126.954 sec (2 m 6 s)

You can give above mentioned information to Wordfence and then tell them to ignore the site.

If you have any further questions, please update the Support Console.

Sincerely,

Praful K
Technical Specialist

******************************

I will mark this as solved and chock it up to a False Positive, but I am concerned that because a malicious site tried to connect to my website and that access was logged in the statistics file that this error will repeat.

Is there ever going to be a concern that this file may be used for malicious intent?

Thanks again for all your attention.

P51 Admin

Hello P51Admin,
the only thing that is a bit out of the ordinary in your case is that the statistics files are located in a subfolder on your hosting account. Usually statistics are accessed via an administration panel that the web host provides. So this is why Wordfence is getting to your statistics files and scanning them.

There is nothing to worry about though and you can safely exclude the statistics files from scan. At the bottom of the Wordfence “Options” page there is a setting called “Exclude files from scan that match these wildcard patterns”. If you enter *.current in that space you should no longer be notified of nasty URLs in your statistics files.

It is not very likely that someone is going to be exploiting your site via those files. I am assuming they are behind a separate login?

@wfasa – You are right … those statistics are access through a NetFirms control panel. I had already adjusted WordFence to ignore that specific file until the “next change”. Thanks to your input I will now exclude those statistics files going forward.

Thanks again

P51Admin