How can I exclude an entire domain?

[jayman1000]

How do I exclude an entire domain?
For example I try to add for example somesite.com to exclusion but then mbam still blocks for example page1.somesite.com. So I try to exclude also that but then later page2.somesite.com is also blocked.
So how can I exclude the entire domain somesite.com??

Edited February 24, 2018 by jayman1000

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings

Unfortunately, since Malwarebytes does not currently support wildcards for exclusions there is no way to exclude all sub-domains/all prefixes, however as long as all of the sub-domains reside on the same IP address then you can get the IP of the server where the site's hosted and exclude that instead and that will accomplish the same thing.

[proj964]

this is just plain stupid. companies move domains around all the time. the ip address is mostly useless. it's the 21st century and malwarebytes can't handle <name>.com, for example, in the exclude or allow lists? I think even a junior programmer could handle this small bit of code. or even add a regex engine for sophisticated matching. this is a bug and should be fixed; yes, it is NOT a feature, as is.

[Porthos]

36 minutes ago, proj964 said:

this is just plain stupid. companies move domains around all the time. the ip address is mostly useless. it's the 21st century and malwarebytes can't handle <name>.com, for example, in the exclude or allow lists? I think even a junior programmer could handle this small bit of code. or even add a regex engine for sophisticated matching. this is a bug and should be fixed; yes, it is NOT a feature, as is.

If you believe a domain is a false positive you can submit it for review here. https://forums.malwarebytes.com/forum/123-website-blocking/

[exile360]

Greetings,

Details of exclusion creation in Malwarebytes 4 is documented in this support article.

That said, it's generally quite expensive to switch servers/IPs, and generally far more difficult than say, acquiring additional domains on the same IP/server (a common tactic of malware; one reason IP based blocking is basically like heuristics for malicious site blocking, since the bad guys will rotate through tons of random domain names and sub-domains on the same IP or IP block) since each IP is a separate physical address while a domain is not.

I will however pass your feedback on to the Product team for consideration.

If you come across a site which you believe to be a false positive, please report it here and the Malwarebytes Research team will review the block and whitelist the site if appropriate (this also means that if a site is blocked that shouldn't be, all sub-domains will also be whitelisted/removed from the block list).

I hope this helps, and if there is anything else we might help with please let us know.

Thanks

[exile360]

Just for some additional information, please refer to IPv4 address exhaustion on Wikipedia; we will run out of IPv4 IP addresses long before we run out of domain names (since a domain name can basically be anything, including numerous suffixes/prefixes and sub-domains as discussed in this thread) while the number of physical/numerical IP addresses is finite (an issue IPv6 should resolve for the foreseeable future once it is widely adopted).  The article on Virtual hosting provides related info as well.

[hexaae]

On 5/5/2020 at 5:50 PM, proj964 said:

this is just plain stupid. companies move domains around all the time. the ip address is mostly useless. it's the 21st century and malwarebytes can't handle <name>.com, for example, in the exclude or allow lists? I think even a junior programmer could handle this small bit of code. or even add a regex engine for sophisticated matching. this is a bug and should be fixed; yes, it is NOT a feature, as is.

I agree. I'm still waiting for this feature since a long time ago... Just for example, today MWB started to block GOG CDN that use different servers with the same domain base name "gogcdn.net".

PLEASE UPDATE WEB EXCLUSION FEATURE allowing wildcards ASAP.

[hexaae]

Moreover... this seriously requires a "Name" or "Note" field to quickly remember what the block was for, because you know that things may change on the Internet...

[exile360]

You don't need wildcards; just exclude GoG's main executable from Web Protection and it will be allowed to connect to any site or IP address that it needs to.  Instructions on doing so can be found under the Allow an application to connect to the Internet section of this support article.

[hexaae]

 

1 hour ago, exile360 said:

You don't need wildcards; just exclude GoG's main executable from Web Protection and it will be allowed to connect to any site or IP address that it needs to.  Instructions on doing so can be found under the Allow an application to connect to the Internet section of this support article.

Please, add wildcards to site domain, and a name/note field.

[exile360]

It's not up to me, however I have suggested it to the Product team already.  Did you try excluding the executable from Web Protection as described in the link I posted?  If so, did it work?

[don_dolarson]

I support other users, and me myself, to give us the ability of wildcard domain blocking! It's such a simple task to listen to what users want, not you, isn't it? Is this software for you or a commercial product, huh? Nobody will come to you and beg for unblocking a certain IP address or domain or ask you for checking anything, we want and will do it on our own, whenever we want it to. And since even a simple email answer from you sometimes can take upon 2 weeks for your answer, it's pointless to report anything as nothing gonna be done. I've seen up to 3 years old threads about it and still, nothing has been done. Malwarebytes still limits its users with the simplest functions of their software. It's starting to be ridiculous...

[exile360]

Greetings,

You can make feature requests and suggestions here on the forums by posting in this area for the main Malwarebytes product; email is only if you need to contact Malwarebytes Support directly for assistance, though we can assist with most technical product issues here on the forums to save time (generally only issues with licensing/billing require contacting Malwarebytes Support directly).

However, just because a few users request a feature, that does not necessarily mean that the feature will be implemented.  It is up to the Product team and Developers to determine what features to implement and in what order they should be implemented based on how they prioritize them.  I cannot speak for the Product team so I do not know the current status of this particular feature request, however given how long ago it was requested, I suspect that it is either a low priority or they have chosen not to implement it for some reason.

With that said, I will pass your feedback on to the Product team for consideration, and perhaps they will reconsider implementing this feature.

If there is anything else we might assist you with please let us know.

Thanks

Edited December 27, 2020 by exile360

[hexaae]

Ok, I just created new topic 

REQUEST: add wildcards support to websites whitelist - Malwarebytes for Windows - Malwarebytes Forums