Swinden Posted October 22, 2017 ID:1174967 Share Posted October 22, 2017 Strangely enough since some weeks there are pop-ups from Malwarebytes, blocking websites which do not seem particularly dangerous. They appear ad random, whether I'm browsing or not; they even appear just after booting my system. 91.214.44.139 and 91.214.44.133 - Avast.com 94.130.129.239 and 94.130.129.135 - your-server.de (organisation Hetzner Online GmbH) 54.209.95.155 - Amazonaws.com When I tried to find out more about these URLs in the little program ipscan25 these pop-ups appeared continuously after eachother. Finally I could learn more about them with https://centralops.net/co/DomainDossier.aspx Link to post Share on other sites More sharing options...
MysteryFCM Posted October 22, 2017 ID:1174968 Share Posted October 22, 2017 Can you post the protection log pertaining to these please? Link to post Share on other sites More sharing options...
Swinden Posted October 22, 2017 Author ID:1174976 Share Posted October 22, 2017 I found a logbook at C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs but the last .xml file is dated 2017-06-21. A bit confusing; I'm new here so if there's another log please let me know. Link to post Share on other sites More sharing options...
MysteryFCM Posted October 22, 2017 ID:1175000 Share Posted October 22, 2017 Are you still seeing the blocks? If so, you can find the relevant logs via; Link to post Share on other sites More sharing options...
Swinden Posted October 23, 2017 Author ID:1175105 Share Posted October 23, 2017 (edited) Thanks, MysteryFCM. Here are the log-files of the blocked website 91.214.44.139. The URL 91.214.44.133 points to the same domain name so I'll leave that alone, unless you want to see it : Malwarebytes www.malwarebytes.com -Logboekdetails- Datum beveiligingsgebeurtenis: 20-10-17 Tijd beveiligingsgebeurtenis: 13:37 Logbestand: 0169a4bc-b58b-11e7-9a93-fcaa1405ffb8.json Beheerder: Ja -Software-informatie- Versie: 3.2.2.2029 Versie componenten: 1.0.212 Update pakketversie: 1.0.3051 Licentie: Premium -Systeeminformatie- Besturingssysteem: Windows 10 (Build 15063.674) Processor: x64 Bestandssysteem: NTFS Gebruiker: System -Details van geblokkeerde website- Kwaadaardige website: 1 , , Geblokkeerd, [-1], [-1],0.0.0 -Websitegegevens- Domein: IP-adres: 91.214.44.139 Poort: [58631] Type: Uitgaand Bestand: (end) Here the log of IP-adres 54.209.95.155 Malwarebytes www.malwarebytes.com -Logboekdetails- Datum beveiligingsgebeurtenis: 06-10-17 Tijd beveiligingsgebeurtenis: 18:47 Logbestand: 06bd55d8-aab6-11e7-ab7c-fcaa1405ffb8.json Beheerder: Ja -Software-informatie- Versie: 3.2.2.2029 Versie componenten: 1.0.207 Update pakketversie: 1.0.2963 Licentie: Premium -Systeeminformatie- Besturingssysteem: Windows 10 (Build 15063.632) Processor: x64 Bestandssysteem: NTFS Gebruiker: System -Details van geblokkeerde website- Kwaadaardige website: 1 , , Geblokkeerd, [-1], [-1],0.0.0 -Websitegegevens- Domein: katie.tnctrx.com IP-adres: 54.209.95.155 Poort: [64716] Type: Uitgaand Bestand: C:\Program Files (x86)\Mozilla Firefox\firefox.exe (end) Here the log of 94.130.129.239, IP-adres 94.130.129.135 points to the same domain name so I'll leave that alone too for the time being: Malwarebytes www.malwarebytes.com -Logboekdetails- Datum beveiligingsgebeurtenis: 09-10-17 Tijd beveiligingsgebeurtenis: 18:50 Logbestand: 037bf74a-ad12-11e7-bdf2-fcaa1405ffb8.json Beheerder: Ja -Software-informatie- Versie: 3.2.2.2029 Versie componenten: 1.0.207 Update pakketversie: 1.0.2981 Licentie: Premium -Systeeminformatie- Besturingssysteem: Windows 10 (Build 15063.632) Processor: x64 Bestandssysteem: NTFS Gebruiker: System -Details van geblokkeerde website- Kwaadaardige website: 1 , , Geblokkeerd, [-1], [-1],0.0.0 -Websitegegevens- Domein: coinhive.com IP-adres: 94.130.129.239 Poort: [51685] Type: Uitgaand Bestand: C:\Program Files (x86)\Mozilla Firefox\firefox.exe (end) Edited October 23, 2017 by Swinden Link to post Share on other sites More sharing options...
Swinden Posted October 23, 2017 Author ID:1175122 Share Posted October 23, 2017 (edited) I found this about the domain coinhive.com: https://blog.malwarebytes.com/security-world/2017/10/why-is-malwarebytes-blocking-coinhive/ That explains a lot. For the domain katie.tnctrx.com are also a lot of warnings, I should have noticed all of this earlier. These blockings came in the same period as 91.214.44.139 and 91.214.44.133, which seem to point at Avast, moreover DomainDossier gave completely different domain namens of the other URLs, hence my confusion and questions. Edited October 23, 2017 by Swinden Link to post Share on other sites More sharing options...
4rendz Posted October 26, 2017 ID:1176349 Share Posted October 26, 2017 (edited) I have the same issue (with the same exact IP adress being blocked) and am also curious to what it is. OP are you sure its from avast? Edited October 26, 2017 by 4rendz Link to post Share on other sites More sharing options...
MysteryFCM Posted October 27, 2017 ID:1176356 Share Posted October 27, 2017 These aren't F/P's. These are legit blocks (not sure where you're seeing Avast.com however, as it resolves to IPs in the 77.234/16 range) Link to post Share on other sites More sharing options...
4rendz Posted October 27, 2017 ID:1176478 Share Posted October 27, 2017 8 hours ago, MysteryFCM said: These aren't F/P's. These are legit blocks (not sure where you're seeing Avast.com however, as it resolves to IPs in the 77.234/16 range) So what does this mean? Is my pc infected? Neither avast nor malware finds anything. https://centralops.net/co/domaindossier.aspx this website shows the ip in OPs title ends in avast.com Link to post Share on other sites More sharing options...
MysteryFCM Posted October 28, 2017 ID:1176955 Share Posted October 28, 2017 Apologies for the delay. I've re-checked them again and it does indeed appear as though Avast are now using 91.214.44.139 and 91.214.44.133. I'm removing the blocks on these IPs. The remaining IPs however, whilst owned by Hetzner and Amazon, aren't actually used by them, but by third parties. Link to post Share on other sites More sharing options...
Recommended Posts