LBates Posted September 10, 2015 ID:988761 Share Posted September 10, 2015 My company is receiving complaints from users who are seeing issues with search results and content being blocked by Malwarebytes Anti-Malware, specifically the Real-Time Protection module in the Premium edition: Detection, 9/10/2015 2:26 PM, SYSTEM, W8E209013, Protection, Malicious Website Protection, Domain, 54.230.140.57, csr.inspsearchapi.com, 26933, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, The IP addresses being blocked are part of the range used by our Amazon CloudFront CDN and so all of our hosted and partner sites that are being served content from the CDN are not returning results and/or have missing content and images. This can be reproduced by browsing to hxxp://search.pch.com and entering a search term (i.e. "Tigers"). The site appears to be blocked and no results are returned. Another example is hxxp://www.dogpile.com where images and content are not shown. Any assistance resolving this issue in a timely manner would be greatly appreciated. Thanks. Lawrence Bates | Sr. DevOps Engineer – InfoSpace LLClawrence.bates@infospace.com | +1.425.709.8122 Link to post Share on other sites More sharing options...
Snorky Posted September 10, 2015 ID:988769 Share Posted September 10, 2015 I too am receiving blocked notices (just appear out of the blue)-started yesterday- Detection, 9/10/2015 8:23 AM, SYSTEM, VALUEDCUSTOMER, Protection, Malicious Website Protection, Domain, 54.192.38.47, cdn4.inspsearchapi.com, 49556, Outbound, C:\Program Files (x86)\Mozilla Firefox\firefox.exe, see below: I do use Dogpile (which is Infospace I believe).What's going on? Link to post Share on other sites More sharing options...
Staff Zynthesist Posted September 10, 2015 Staff ID:988771 Share Posted September 10, 2015 I will check on this and update the thread shortly. Andres Link to post Share on other sites More sharing options...
Snorky Posted September 10, 2015 ID:988773 Share Posted September 10, 2015 Here are my screen shots: Link to post Share on other sites More sharing options...
Snorky Posted September 10, 2015 ID:988775 Share Posted September 10, 2015 Thanks Andres Link to post Share on other sites More sharing options...
icetiger Posted September 10, 2015 ID:988785 Share Posted September 10, 2015 snorkys screenshots mirror my own, and this just started this afternoon. the initial part varies between cdn1, cdn2, cdn3, and cdn4 and i also get it from using dogpile, which has been fine for over a decade and yes, thanks for looking into this, i will be keeping this page open to see if you update it Link to post Share on other sites More sharing options...
LBates Posted September 10, 2015 Author ID:988809 Share Posted September 10, 2015 To clarify, it's not the AWS CDN IP addresses themselves that aren't blocked, it's anything that references *.inspsearchapi.com, which is used to serve content to pages. Adding *.inspsearchapi.com to "Web Exclusions" in Malwarebytes Anti-Malware allows content and search results to be returned and displayed as expected. Lawrence Bates | Sr. DevOps Engineer – InfoSpace LLClawrence.bates@infospace.com | +1.425.709.8122 Link to post Share on other sites More sharing options...
LBates Posted September 10, 2015 Author ID:988812 Share Posted September 10, 2015 To clarify, it's not the AWS CDN IP addresses themselves that aren't blocked, it's anything that references *.inspsearchapi.com, which is used to serve content to pages. Adding *.inspsearchapi.com to "Web Exclusions" in Malwarebytes Anti-Malware allows content and search results to be returned and displayed as expected. Lawrence Bates | Sr. DevOps Engineer – InfoSpace LLClawrence.bates@infospace.com | +1.425.709.8122 Typo: that should read "it's not the AWS CDN IP addresses themselves that are blocked" Link to post Share on other sites More sharing options...
Snorky Posted September 10, 2015 ID:988817 Share Posted September 10, 2015 snorkys screenshots mirror my own, and this just started this afternoon. the initial part varies between cdn1, cdn2, cdn3, and cdn4 and i also get it from using dogpile, which has been fine for over a decade and yes, thanks for looking into this, i will be keeping this page open to see if you update itThanks icetiger-I too am seeing the multiple cdn #s. The pop-ups come rapid fire like 15-20 or so then stop. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted September 10, 2015 Staff ID:988820 Share Posted September 10, 2015 Hello all, The blocks will be removed on the next update. Andres Link to post Share on other sites More sharing options...
Snorky Posted September 10, 2015 ID:988822 Share Posted September 10, 2015 Hello all, The blocks will be removed on the next update. Andres So, (help me) is the a FP, hence that's why scans are clean? Link to post Share on other sites More sharing options...
Snorky Posted September 10, 2015 ID:988823 Share Posted September 10, 2015 So, (help me) is the a FP, hence that's why scans are clean?Is this a FP (I cannot edit my post-been away too long). Link to post Share on other sites More sharing options...
LBates Posted September 10, 2015 Author ID:988827 Share Posted September 10, 2015 Thanks Andre. Is there an ETA for the next update? Lawrence Bates | Sr. DevOps Engineer – InfoSpace LLClawrence.bates@infospace.com | +1.425.709.8122 Link to post Share on other sites More sharing options...
MysteryFCM Posted September 11, 2015 ID:988878 Share Posted September 11, 2015 Update should be out already. Link to post Share on other sites More sharing options...
Recommended Posts