Publigo Posted April 12, 2017 ID:1116896 Share Posted April 12, 2017 IP address : 91.121.58.158 Excerpt of the protection log : see attached file Hostname/URL : hxxps://www.caves-bossetti.fr Thanks to remove this IP. Olivier Link to post Share on other sites More sharing options...
Staff Zynthesist Posted April 12, 2017 Staff ID:1116898 Share Posted April 12, 2017 This IP falls within a /24 range that we are blocking for Cerber Ransomware C2. You can add it to exclusions if you choose to do so via the MBAM settings/Exclusions/Add exclusion/Exclude a website and enter the domain or IP you wish to exclude. Link to post Share on other sites More sharing options...
Publigo Posted April 13, 2017 Author ID:1117087 Share Posted April 13, 2017 Hi, Thanks for your answer. We are the webmaster of the server which use this IP. The problem is that all the websites on this IP are blacklisted by Malwarebytes because of the blacklist of this IP. This is a big problem for us. How could we delete this IP on your list ? Thanks. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted April 13, 2017 Staff ID:1117109 Share Posted April 13, 2017 Hello, Please see the behavioural information section, which list all the IPs being communicated with by the malicious Cerber sample via UDP: https://www.virustotal.com/en/file/f6c517cfea5d8ac01d92f789845146ef78cf246134bfebeee48964500b1b0a15/analysis/ Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now