176.74.176.179

[MrCharlie]

Is this definitely a bad IP: 176.74.176.179

I just checked with VirusTotal and it seems the site is clean:

https://www.virustotal.com/en/url/a8f63b98b0bd6e2e7b25931b28bda6247b5cc2228134ba5837920eea9b8b11f2/analysis/1392934543/

Also here:

http://www.ipillion.com/ip/176.74.176.179

https://forums.malwarebytes.org/index.php?showtopic=142364 <---2 computers blocking it

https://forums.malwarebytes.org/index.php?showtopic=142350&p=791640 <--another one

Thanks...MrC

[MysteryFCM]

It is, yes, it's one of a number being used (as a C&C) by DarkComet infected machines.

[MrCharlie]

OK..Thanks.

MrC

[Juliet]

well it hit me and I have no idea why.

I was in a private teaching forum at WTT

 

here is yesterday

2014/02/20 16:04:58 -0600 JNE-PC JNE IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 53219, Process: firefox.exe)

2014/02/20 16:04:58 -0600 JNE-PC JNE IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 53220, Process: firefox.exe)

here is today

2014/02/21 08:00:00 -0600 JNE-PC JNE IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 50208, Process: firefox.exe)

2014/02/21 08:00:00 -0600 JNE-PC JNE IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 50209, Process: firefox.exe)

[MrCharlie]

Read from here on, he figured it out:

https://forums.malwarebytes.org/index.php?showtopic=142364&p=794565

MrC

[Juliet]

 

Don't assume you have the same issue unless you can determine what URL your machine is trying to use that resolves to that address.  If you do figure that out you might want to try putting in a hosts entry for that domain and point it to something local like "localhost" or someother internal workstation address, or even www.google.com.    Not sure if that will work, but it might.  That is what I will try once I get back home.

 

When it says it blocked BLOCK 176.74.176.179,  I have no idea what  URL was trying to use that.

from the MBAm log,  thats all that shows.

[tashi]

My own reports:

 

2014/02/19 15:48:55 -0700  IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 59537, Process: firefox.exe)
2014/02/19 15:48:55 -0700  IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 59538, Process: firefox.exe)


2014/02/20 11:44:39 -0700  IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 50558, Process: firefox.exe)
2014/02/20 11:44:39 -0700  IP-BLOCK 176.74.176.179 (Type: outgoing, Port: 50559, Process: firefox.exe)
 

 

 

[MysteryFCM]

Please follow the instructions at;

 

https://forums.malwarebytes.org/index.php?showtopic=9573

 

You can use Wireshark to see which is the offending URL.

[MysteryFCM]

To clarify folks, the IP is due to be unblocked on the next update.

[Juliet]

To clarify folks, the IP is due to be unblocked on the next update.

 

Can I ask a stupid question,  why will it be unblocked?

[MysteryFCM]

Malicious content appears to be gone.

[Juliet]

lol

thank you.