CraigS Posted September 12, 2012 ID:596250 Share Posted September 12, 2012 For the 1st time ever I got an "MBAM Blocked This Poentially Malicious Website" pop-up whenever I [1-Left-Clk ] Hi-lighted the AlaGasCo email in the Inbox stating my home's (gas) eBill was avaialble for viewing. A few Googles of the IP 109.163.231.168 revealed Russian and/or Budapest sources.In these cases is the email almost surely a PHISH email from Another source that just looks like the Gas Co's email?I haven't gotten Another Gas Co email about the eBill as I should, so I'm wondering, as well, HOW the "Pop-up from just Hi-lighting the email" can become part of acompany's genuine email.Any thoughts? Link to post Share on other sites More sharing options...
daledoc1 Posted September 12, 2012 ID:596281 Share Posted September 12, 2012 Hi, CraigS:It sounds as if it could have been a false positive, OR it could have been a browser redirect or phishing email directing you to a spoof web site.The MBAM engineers can help to sort this out for you.Please follow the requested steps in this sticky topic: IP Blocking False PositivesAnd then please post the requested info in the False Positives section.The MBAM engineers will research it and determine if it could have been a FP, or not.(In the interim, you can also research the IP in question at a site, such as ip-lookup.net.)HTH,daledoc1 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 12, 2012 Root Admin ID:596430 Share Posted September 12, 2012 Please do as requested but here is the information shown on that IPIP address: 109.163.231.168Host name: lh19738.voxility.net109.163.231.168 is from Romania(RO) in region Eastern EuropeBut I believe that GoDaddy who is the registrar was also recently having issues too so that might potentially be part of it. Link to post Share on other sites More sharing options...
CraigS Posted September 12, 2012 Author ID:596523 Share Posted September 12, 2012 Really appreciate the Replies. I unfortunately panicked at the constant repeat of the pop-ups and Deleted the email B4 I could think to capture the Message Source Data. If it occurs again I'll capture it and complete the FP section as you've suggested.All the best! Link to post Share on other sites More sharing options...
daledoc1 Posted September 12, 2012 ID:596532 Share Posted September 12, 2012 OK -- be careful with links in emails, even if they appear to be legit. The bad guys are very good at spoofing the emails, links and websites these days.(I generally avoid clicking on any links in ANY emails, no matter how legit they might be -- if I need to contact the gas company (or bank or PayPal or anyone!) after getting this sort of email, for example, I either call them directly or navigate to their official website from a saved bookmark.)Cheers!daledoc1 Link to post Share on other sites More sharing options...
CraigS Posted September 13, 2012 Author ID:596729 Share Posted September 13, 2012 OK -- be careful with links in emails, even if they appear to be legit. The bad guys are very good at spoofing the emails, links and websites these days.(I generally avoid clicking on any links in ANY emails, no matter how legit they might be -- if I need to contact the gas company (or bank or PayPal or anyone!) after getting this sort of email, for example, I either call them directly or navigate to their official website from a saved bookmark.)Cheers!daledoc1Duly noted. Remember that I actually was Getting the Pop-up JUST by 1-Clk Hi-lighting the Email to see it in Read Pane. I'm racking my brain trying to remember IF I Clk'd a Link to see the eBill but I'll definitely access it in the future from the company Bookmark vs. email link.They weren't staffed to talk to me in the IT Dept but I'm already hiding in the bushes waiting for next month's email. Will post with Good data if same occurs. Thanks again to all. Link to post Share on other sites More sharing options...
Firefox Posted September 13, 2012 ID:596731 Share Posted September 13, 2012 If you have the preview pain, and you highlight an email, since you are viewing it in the preview pain, its the same as double clicking on it to open it. It is technically open. There could have been some code in the email that was trying to download something or there could have been an image that was hosted in a website that is on Malwarebytes block list. Link to post Share on other sites More sharing options...
CraigS Posted September 14, 2012 Author ID:597218 Share Posted September 14, 2012 If you have the preview pain, and you highlight an email, since you are viewing it in the preview pain, its the same as double clicking on it to open it. It is technically open. There could have been some code in the email that was trying to download something or there could have been an image that was hosted in a website that is on Malwarebytes block list.Thanks for the clarification and education -- I've disabled my Preview Pane as result. Link to post Share on other sites More sharing options...
Firefox Posted September 14, 2012 ID:597230 Share Posted September 14, 2012 No problem.... should you have further questions or comments don't hesitate to ask. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now