Suspicious files in wfcache folder?

Some of the entries in your other post look normal, like the first 8 lines, but I don’t think I’ve seen the ones with long strings like the ones that include “d0b5d0b” before — normally the filenames include the directories you usually see within your site’s URLs (with some ~’s in between in some cases), and end with _wfcache.html or _wfcache.html_gzip.

It might be a sign of malicious activity, but could also be due to another plugin doing something unusual.

If you can use FTP to get a few of the files from those folders with the long, unusual names, I can take a quick look at the content.

Don’t open them in a web browser, just in case they do contain malicious content! My email address is mattr (at) wordfence.com

-Matt R

Ok, I checked out the files you have sent, and it’s nothing to worry about!

Since you have unicode characters (representing cyrillic letters) in your post titles and permalinks, they are “urlencoded” when used in URLs. Normally, urlencoded characters will have “%” symbols before each set of two roman letters/numbers like “%D0%BA”, but they are not included in the filenames in the cache, so we see “D0BA”.

So, the long strings of letters and numbers do represent your URLs, just in a different way because of language differences. It looks like everything should be ok, but let us know if you have any other questions on this!

-Matt R