I understand there's been two recent threads about a nearly identical IP ending with 129 and one back in February for one that ends in 132 instead, but I wanted to report and ask about it just in case, (especially as I recently downloaded and nearly ran a suspicious .exe the other night and am feeling paranoid I might've accidentally ran it while trying to delete it, even though it went to the recycling bin and nothing else seems amiss).
I had only just gotten onto my computer when I had gotten the message, and did not have Steam open. However, it was likely running in the background and has automatic updates turned on. I've noticed there was an automatic update I recieved that had been completed just a minute after the protection event at 1:39 PM had occurred, as shown below:
Malwarebytes
www.malwarebytes.com
-Log Details-
Protection Event Date: 3/28/20
Protection Event Time: 1:39 PM
Log File: 8785b90e-7123-11ea-8dfd-f4390923b4ba.json
-Software Information-
Version: 4.1.0.56
Components Version: 1.0.859
Update Package Version: 1.0.21524
License: Trial
-System Information-
OS: Windows 10 (Build 18362.720)
CPU: x64
File System: NTFS
User: System
-Blocked Website Details-
Malicious Website: 1
, D:\Program Files (x86)\Steam\steam.exe, Blocked, -1, -1, 0.0.0
-Website Data-
Category: Trojan
Domain: steam.naeu.qtlglb.com.cdn20.com
IP Address: 157.185.145.131
Port: 80
Type: Outbound
File: D:\Program Files (x86)\Steam\steam.exe
(end)
