Our Company Website is Being Blocked

[MoonWizard]

URL: fantasygrounds.com

Our company website has started being blocked by MalwareBytes internet filtering as of some time last week. Our application contacts our web site to perform content updates, as well as to assist in fostering connections between clients. I posted a request via the Contact form on your website, but have not received an answer.

We haven't changed anything with our product during the last week, so we're not sure what changed on the MalwareBytes side to begin blocking. We've had at least a dozen reports or more of people unable to update their software using our updater, and unable to connect with other users.  Even whitelisting the application directory does not seem to clear up the issue, though we have heard that whitelisting both the application and data directories may allow bypass (but that's not obvious to most users).

How can we get our application and/or website removed from being blocked?

Thanks,
JPG

[Greshkaal]

I have this issue, and disabling Web Protection lets Fantasy Grounds work fine, but I really rather not have to do that.  Hopefully, the MBAM team gets this fixed soon! ?

[Dashke]

Thanks for reporting this! Can you please attach the protection log here so we can take a look?

[Greshkaal]

All the guides to get them that I can find are for the old version of MBAM, where are they in the newer UI?

[leo3487]

@MoonWizard

[leo3487]

As you are from the developer company @MoonWizard, what IPs or URLs use the updater to get the updates?

 

It may help, if cant find malwarebytes log

[Dashke]

14 hours ago, Greshkaal said:

All the guides to get them that I can find are for the old version of MBAM, where are they in the newer UI?

You can find them if you open MB3 and go to Reports.

Please see the attached screenshot -

[MoonWizard]

I don't use MalwareBytes. I am a developer at SmiteWorks, who makes the Fantasy Grounds application.  So, I don't have any protection logs.

Our updater goes to patch.fantasygrounds.com; and our connection assistance links go to server.fantasygrounds.com.  They are both running on the same machine as our www subdomain server.  However, we use CloudFlare as a content delivery network (CDN) for www subdomain.

If I run ping from my personal machine in Seattle, I get the following IP addresses:
www.fantasygrounds.com = 104.20.130.20
patch.fantasygrounds.com = 70.35.199.236
server.fantasygrounds.com = 70.35.199.236

Let me know what else you need.

Regards,
JPG

[dcollins]

I've been able to reproduce this and it's not a block from Malwarebytes, but rather an issue with our Web Protection software. I've let our engineers know so they can look at what it will take to fix it .