CarolBD61 Posted April 24, 2017 ID:1119543 Share Posted April 24, 2017 Starting on 4/17/17, I began to get blocking notifications from Malwarebytes when previewing or opening an email from CVS. The email is retrieving images from img.ed4.net. I notice that Bed Bath and Beyond emails are also now having images blocked. These are reputable companies that I have requested to send me advertising emails. I have gotten hundreds of these blocks since last week. Both of them are using img.ed4.net as an image hosting site. I have done extensive scans on my PC and find no malware. Is this a false positive? If not, what is Malwarebytes finding objectionable on this site? Two log files are reproduced below. The first is a block generated by auto-preview of an email in Outlook, the second happened when I chose to view an email as a website, and was generated from Chrome: [begin first report] Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 4/17/17 Protection Event Time: 7:04 PM Logfile: Administrator: Yes -Software Information- Version: 3.0.6.1469 Components Version: 1.0.103 Update Package Version: 1.0.1750 License: Premium -System Information- OS: Windows 10 CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Domain: img.ed4.net IP Address: 23.216.55.8 Port: [50509] Type: Outbound File: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE (end) [begin second report] Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 4/22/17 Protection Event Time: 9:41 AM Logfile: Administrator: Yes -Software Information- Version: 3.0.6.1469 Components Version: 1.0.103 Update Package Version: 1.0.1784 License: Premium -System Information- OS: Windows 10 CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Domain: img.ed4.net IP Address: 23.205.120.146 Port: [57834] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (end) Link to post Share on other sites More sharing options...
Staff Zynthesist Posted April 24, 2017 Staff ID:1119545 Share Posted April 24, 2017 Hello, The domain is blocked for phishing. https://www.virustotal.com/en/url/7e22149f939d0c6c4c5c4364f657403bbf04b36bf22d91dca89ef5fa5d04bfae/analysis/1493050659/ Link to post Share on other sites More sharing options...
Recommended Posts