Oh, I just thought of something. If you have another site or non public (on another domain) version of the site for testing updates; check to see if alienvault is checking possible locations of uploaded infected files. It may give the ultimate answer as to whether it is all random or not. I don't have any projects up at the moment or I would check myself. Anyways, good night once again.