igor51 Posted January 16, 2013 ID:635180 Share Posted January 16, 2013 Hello,Malwarebytes blocks access to security-x.fr ( 213.186.33.2). Why does it block access to this website ?Regards Link to post Share on other sites More sharing options...
MysteryFCM Posted January 16, 2013 ID:635209 Share Posted January 16, 2013 I'm looking into this, thank you. Link to post Share on other sites More sharing options...
MysteryFCM Posted January 16, 2013 ID:635259 Share Posted January 16, 2013 It's not the site itself that is the issue, it's the IP. This is one of 4-5 IPs blocked on the /24, due to over 600 cases. Yet another email was sent to OVH (previously, there were only 2 IPs at issue) yesterday, but there's been no reply so far. Link to post Share on other sites More sharing options...
igor51 Posted January 16, 2013 Author ID:635269 Share Posted January 16, 2013 I know that the site is safe because I am one of the Admins.You are blocking an IP of shared hosting. Link to post Share on other sites More sharing options...
MysteryFCM Posted January 16, 2013 ID:635276 Share Posted January 16, 2013 The site is indeed safe, yes, and had it been an isolated incident, the IP would not have been blocked. However, there are currently 47 outstanding issues on this IP alone. Link to post Share on other sites More sharing options...
DamienK Posted January 16, 2013 ID:635279 Share Posted January 16, 2013 This seems to be affecting SUMo too. Now i understandard that SUMo was probably not your target has it is a wide shared hosting IP...Do you confirm that SUMo will be recovered too ? Link to post Share on other sites More sharing options...
DamienK Posted January 16, 2013 ID:635280 Share Posted January 16, 2013 (i meant "soon" not "too") Link to post Share on other sites More sharing options...
MysteryFCM Posted January 16, 2013 ID:635284 Share Posted January 16, 2013 This seems to be affecting SUMo too. Now i understandard that SUMo was probably not your target has it is a wide shared hosting IP...Do you confirm that SUMo will be recovered too ?SuMo would be well advised to move elsewhere, but yes, once the incidents are resolved, the block will be removed.Contrary to popular belief, I actually hate having to block IPs that belong to compromised or otherwise mis-used sites, more-so when they're shared. Link to post Share on other sites More sharing options...
chantal11 Posted January 16, 2013 ID:635285 Share Posted January 16, 2013 Hello,My blog chantal11.com/ hosted by OVH and is also blocked by MalwarebytesIP 213.186.33.19thank you for solving the problem quickly@+ Link to post Share on other sites More sharing options...
coover Posted January 17, 2013 ID:635352 Share Posted January 17, 2013 I, too, have been blocked from using SUMo,. In fact, the KCSoftware website is blocked, and the KCSoftware Forum site has been blocked. The only way I was able to contact them was through email, and so far have not yet gotten a reply.Going through your help file, I was able to find a way to allow the website to be ignored by your blocker, but I do not like doing that as I may encounter one of the dangerous sites hosted at this IP. I realize that you feel you must block this IP, but wonder if there is a way you can block only the dangerous sites at this IP, not the KCSoftware sites? Link to post Share on other sites More sharing options...
MysteryFCM Posted January 17, 2013 ID:635353 Share Posted January 17, 2013 Such options may be available in future, but at present, only IP blocks are supported. Link to post Share on other sites More sharing options...
Emjysoft Posted January 17, 2013 ID:635479 Share Posted January 17, 2013 You're the only editor to block the IP of a shared hosting No. 1 in France ... 500 000 website FR ! Link to post Share on other sites More sharing options...
MysteryFCM Posted January 17, 2013 ID:635482 Share Posted January 17, 2013 You're the only editor to block the IP of a shared hosting No. 1 in France ... 500 000 website FR !There's not even close to 500,000 sites on the IP, and again with all due respect, how many sites are on their IP range, are irrelevant. If there's a signficant number of incidents on the IP and they're not responsive, the IP will be blocked as I must put the protection of our users first. Link to post Share on other sites More sharing options...
Emjysoft Posted January 17, 2013 ID:635484 Share Posted January 17, 2013 No just 7 670 000 result fron BING with commande IP:http://www.bing.com/search?q=ip%3A213.186.33.2You agree not abused 7 670 000 search results for French users. BING is saying that.Given the number of complaints rec users can no longer access our sites, you should not have much real customer in France. However, if it is to fear in order to sell your software, it is contrary to French law. Link to post Share on other sites More sharing options...
MysteryFCM Posted January 17, 2013 ID:635486 Share Posted January 17, 2013 There's not even a tenth of that on the IP in question. And it has nothing to do with selling the software, but everything to do with protecting our users against the threats on the IP.OVH were sent yet another email regarding this, 72 hours ago, and again, 2 hours ago, and at the time of writing this, there has been no reply. Link to post Share on other sites More sharing options...
Emjysoft Posted January 17, 2013 ID:635488 Share Posted January 17, 2013 To prevent some sites (47), while an IP block you thousands of site?If these sites were U.S. you would probably not even practice.This type of protection seems very basic. Why your competitors or even Google does not block the IP, but only bad site in question?You can whitelist http://www.emjysoft.com/ our site?Perhaps your software does not allow advanced protection ... ? Link to post Share on other sites More sharing options...
chantal11 Posted January 17, 2013 ID:635492 Share Posted January 17, 2013 Hello,I understand your position, but my blog (IP 213.186.33.19 blocked) is clean, and security-X (IP 213.186.33.2 blocked) alsoWe recommend our members to acquire a license malwarebytes pro and our sites are now blocked.Can you refine your block ?Thanks Link to post Share on other sites More sharing options...
igor51 Posted January 17, 2013 Author ID:635636 Share Posted January 17, 2013 Hi,There's not even close to 500,000 sites on the IP, and again with all due respect, how many sites are on their IP range, are irrelevant. If there's a signficant number of incidents on the IP and they're not responsive, the IP will be blocked as I must put the protection of our users first.It is a shared hosting. You cannot apply it for all websites hosted on the same IP.Your way to block websites (or to protect users) is not reliable. A vast majority of websites are hosted on a shared hosting. You cannot block all these websites because one of them is malicious.Use the domain name instead of IP blocking with the IP. Link to post Share on other sites More sharing options...
ejulien Posted January 17, 2013 ID:635655 Share Posted January 17, 2013 My 5 sites are running on this server and these ones are clean ...If some sites are really infected, tell the webmaster or OVH !!!It can happen when you run many adress (and perfectly normal)Please run again your own scripts urgently so that you can see the sites with problems and the ones with no problems...Thanks,Julien Link to post Share on other sites More sharing options...
DarkSnakeKobra Posted January 17, 2013 ID:635716 Share Posted January 17, 2013 Hi,It is a shared hosting. You cannot apply it for all websites hosted on the same IP.Your way to block websites (or to protect users) is not reliable. A vast majority of websites are hosted on a shared hosting. You cannot block all these websites because one of them is malicious.Use the domain name instead of IP blocking with the IP.Until Steven gets back let me correct a few things on your post.The ip protection Malwarebytes' is very reliable. Blocking by IP is much better then blocking by domain names as malware authors/supporters are constantly changing the domain names, but staying on the same ip. By blocking the ip's Malwarebytes' can make it much more challenging as they would then have to switch ip's or move their sites elsewhere. That's not correct. Malwarebytes' ip blocker does not block an entire range if only one ip is infected. As Steven said there has been many cases on this range that have not be resolved.If these sites were U.S. you would probably not even practice.That's not correct. They block tons of U.S sites as well. Link to post Share on other sites More sharing options...
DamienK Posted January 18, 2013 ID:636163 Share Posted January 18, 2013 Any news on this FP ? Link to post Share on other sites More sharing options...
MysteryFCM Posted January 18, 2013 ID:636170 Share Posted January 18, 2013 It's not an F/P.Ref: http://forums.malwarebytes.org/index.php?showtopic=121128&view=findpost&p=636168 Link to post Share on other sites More sharing options...
chantal11 Posted January 19, 2013 ID:636356 Share Posted January 19, 2013 Hello,Yet OVH has also been contacted by us, individually.They have not contacted the team Malwarebytes ?OVH technician says that if a malicious site has been detected on shared hosting, it was blocked by their staff and the owner is notified.Other sites are safe and for these sites, blocking is a FP. Link to post Share on other sites More sharing options...
Leweez Posted January 19, 2013 ID:636380 Share Posted January 19, 2013 We are also having this alert from Malwarebytes for IP 213.186.33.2 and 213.186.33.19 on a discussion forum for which all our members are deserting now because of this.Please, can this be corrected as soon as possible before we loose everyone?Thanks! Link to post Share on other sites More sharing options...
Egwene Posted January 19, 2013 ID:636394 Share Posted January 19, 2013 It's not an F/P.It is definitely because you're blocking legitimate sites, in my concern security-x.fr.I used to recommand MBAM around me, including the commercial version of MBAM, but I'm afraid I will stop recommanding your product.Preventing people from accessing legitimate web sites is neither "security" nor "protection", it is filtering.Please reconsider your positions and do something for all legimate web sites you are blocking on this IP.Thank you. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now