tomoz Posted December 2, 2017 ID:1188301 Share Posted December 2, 2017 I have been receiving a newsletter from Windows Secrets for many years and usually prefer to read the letter online. Clicking the link in the letter causes MB to kick in with information that the domain aap.info.pentontech.com under IP address 209.167.231.27 on port 54170 has been blocked. While I can find some reference via google on spam from pentontech, using virustotal on the actual ip address comes up as clean. Accessing the relevant information via their forum/archived newsletters https://windowssecrets.com/newsletter/ask-winobs-how-much-privacy-control-do-i-have-in-cortana/ does not trigger any action by MB either . Would that be a FP? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2017 Root Admin ID:1188305 Share Posted December 2, 2017 Hello @tomoz I'm not getting an IP or Domain block and the page opens just fine for me. Please click on the update link or use the "Check for updates" link in the task tray and see if that corrects it or not and let me know. Thanks Ron Link to post Share on other sites More sharing options...
tomoz Posted December 2, 2017 Author ID:1188309 Share Posted December 2, 2017 Ron, sorry but I think you misunderstood. The link works fine for me too and does not cause any action by MB. I am getting the alert when trying to click on a link inside my email that goes to the article to be read online as opposed to within the email program. The actual offending link within the email is http://app.info.pentontech.com/e/er?s=1885539667&lid=28679&elqTrackId=ee03574368d6457c8af5c950de4367cc&elq=b4cc6c40b9a6461fbece23b312a549c8&elqaid=5797&elqat=1&utm_rid=CPNET000001627792&utm_campaign=5797&utm_medium=email&elq2=b4cc6c40b9a6461fbece23b312a549c8 This has not happened in the past. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2017 Root Admin ID:1188318 Share Posted December 2, 2017 You might try restarting the computer and see if that helps. It's possible some heuristic is catching something invalid. If that does not help we can do some scans too to see what's going on. Thanks Ron Link to post Share on other sites More sharing options...
Porthos Posted December 2, 2017 ID:1188320 Share Posted December 2, 2017 @AdvancedSetup Ron, I get the same block. Log attached for research. block log.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2017 Root Admin ID:1188323 Share Posted December 2, 2017 Thanks @Porthos I've submitted to our Research Team to see what's going on here. Was not blocking earlier for me, but is now. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2017 Root Admin ID:1188327 Share Posted December 2, 2017 (edited) Interesting.. It looks like they may not be around anymore. They were sold after a bankruptcy. https://windowssecrets.com/forums/showthread.php/178083-Opting-out-of-Penton-Media-emails https://en.wikipedia.org/wiki/Penton_(company) Edited December 2, 2017 by AdvancedSetup Link to post Share on other sites More sharing options...
tomoz Posted December 2, 2017 Author ID:1188342 Share Posted December 2, 2017 Ron, not sure about the bankruptcy and how this relates to the case. I have subscribed to the newsletter and this has been coming through normally. I also have not had any spam, so have no intention of asking them not to send me the email I received. The issue was only that for the first time today clicking on the link that was meant to open the newsletter online I am getting the MB alert. I will see if someone on the window secrets forum can shed any light on this. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2017 Root Admin ID:1188357 Share Posted December 2, 2017 I've not heard back from the Research Team yet. They say it's blocked due to Fraud in the internal online link. I hear you. I used to subscribe to one of their paid magazines. Not really sure what's up as I don't think the Windows Secrets depends on the Penton Media company. I'm heading out but hopefully something more is said by our Research Team over the weekend. Thanks Link to post Share on other sites More sharing options...
tomoz Posted December 2, 2017 Author ID:1188376 Share Posted December 2, 2017 Ron, just noticed that there is a thread already over at windows secrets forum - so hopefully this will be worked out https://windowssecrets.com/forums/showthread.php/191961-Malwarebytes-labels-Pentontech-as-malicious Link to post Share on other sites More sharing options...
MysteryFCM Posted December 2, 2017 ID:1188425 Share Posted December 2, 2017 It's being removed as I write this and will be unblocked on the next update. Sorry for the delay. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 3, 2017 Root Admin ID:1188530 Share Posted December 3, 2017 @tomoz Please confirm the block is gone for you. I just now used the link and I no longer get the block. Link to post Share on other sites More sharing options...
Recommended Posts