WEb protection, strange result....

[lock]

Hi,

I can trigger Web protection with :hxxps://109.98.161.218/  , however the same IP scanned on VirusTotal gives ZERO detections, including from Malwarebytes hpHosts

https://www.virustotal.com/en/url/78372102536c758095364b0926c53973882b80acc0962c6f9403b8689fa36458/analysis/1490558553/

Edited March 26, 2017 by lock

[Telos]

VT may have cached that page, but otherwise it is unavailable...

Lookup failed: 109.98.161.218 No data
109.98.161.218 is from Romania (RO) in region Eastern Europe

Ping 109.98.161.218
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out

Average time over 10 pings: 0.00 ms

[lock]

My question is why MBAM blocked the website (see attached) and VirusTotal has 0/64 detections, including Malwarebytes hpHosts????

Somehow, MBAM blocks websites based on a different criteria compared whit everybody else... this was valid also for v2 

[Porthos]

18 minutes ago, lock said:

Somehow, MBAM blocks websites based on a different criteria compared whit everybody else... this was valid also for v2 

This is true, That and if you think it is a false positive then you need to post the issue in the web false positive section below.

https://forums.malwarebytes.com/forum/123-website-blocking/

Also read and follow the in this post first.

 

[lock]

5 minutes ago, Porthos said:

This is true, That and if you think it is a false positive then you need to post the issue in the web false positive section below.

https://forums.malwarebytes.com/forum/123-website-blocking/

Also read and follow the in this post first.

 

99% of detections triggered by Web Protection of  MBAM, are not detected by any other antimalware (and I had NOD32 and Trend Micro) , so I do not know if it is a FP or different philosophy ....

I posted before about that and I was told that Web protection doesn't detect this or that , only this and that, so I gave up.

[Porthos]

1 minute ago, lock said:

I posted before about that and I was told that Web protection doesn't detect this or that , only this and that, so I gave up.

Looking at your 5 posts none are posted in the section I mentioned.

 

2 minutes ago, lock said:

different philosophy ....

This is the reason. On top of that it is a propriety design and method. If you really think it is a false block by all means report it with guidelines I posted.

[lock]

Regardless of the philosophy and the "proprietary" design, the result should be , more or less, in line with the rest of the players on the market.

When I check 1,2, 3,....10 Web detections of MBAM on VirusTotal and the result is 1/64 (the "one" being MBAM) , who has the time to report endless FP's????

 

[Porthos]

Malwarebytes targets things no other service might for its own reasons and @Dashke would be better at explaining this than me. and could get someone to move this post as it should not be here.

[lock]

5 minutes ago, Porthos said:

Malwarebytes targets things no other service might

Not on "Web protection"; this is done based on a database list: poorly implemented list will result in poor detection

 

6 minutes ago, Porthos said:

and could get someone to move this post as it should not be here.

yeah..... hide it and maybe nobody will notice it and you can still claim that MBAM 3 is "the next antivirus replacement"

[Porthos]

4 minutes ago, lock said:

hide it and maybe nobody will notice it and you can still claim that MBAM 3 is "the next antivirus replacement"

Wait a minute. No one will be hiding any thing. There are proper sections of the forum for certain types of issues.

[Telos]

While I don;t know why MB blacklists this site, they are not alone. This is a spam IP

:

But as @Porthos said, report it as a false positive if you believe it is safe.

Edited March 26, 2017 by Telos

[lock]

22 minutes ago, Telos said:

why MB blacklists this site, they are not alone

Well, on VirusTotal , detection is 0/64   , so ZERO antimalware would block this IP.

[Porthos]

1 minute ago, lock said:

Well, on VirusTotal , detection is 0/64   , so ZERO antimalware would block this IP.

Is not the end all of all blocked things.

[lock]

22 minutes ago, Porthos said:

Is not the end all of all blocked things

...but is the end of my patience with this whole "Web protection"  thing. 

[Telos]

3 hours ago, lock said:

...but is the end of my patience with this whole "Web protection"  thing. 

Web Protection isn't limited to malware. The nice thing about MBAM is that you can turn off Web Protection if you don't like it, or you have another program that provides a similar feature.That said, Web Protection blocks access to/from Internet addresses which are known or suspected of engaging in malicious activity. This feature does not treat different protocols differently. It does not distinguish between your favorite game being served on one port and a potential malware source being served on another. Should you choose to disable this feature, you could inadvertently compromise your computer's safety.