Jump to content

IP Protection blocks safe web sites that share an IP with malware


Recommended Posts

The Malwarebytes IP Protection feature currently blocks perfectly safe web sites that share an IP address with malicious sites. This is causing a lot of confusion and needs to be stated clearly somewhere on this forum, quite apart from discussion of whether such sites should be blocked and who can do what about it. This happens because the big web hosts that serve small web sites (GoDaddy, Bluehost, etc. - "Cheap Web Hosting") use shared IP numbers. If any site using that IP number is deemed malicious, the IP (and all of the sites on it) are blocked. A single IP (such as can serve thousands of domain names, such as my own sites (stevemount.info, symmetryspace.org, etc.). In this case, mine and hundreds of other innocents at were blocked because of three malicious sites.

Those are the facts. It's also useful to summarize opinions.

Malwarebytes feels it is appropriate to block a shared IP address that contains malicious sites.

"Because GoDaddy have neither responded nor taken down the malicious sites, the decision was made to block it." MysteryFMC (on showtopic=23565) goes on to say, with respect to a specific site, "Again, the owner of the IP range has failed to respond to abuse reports, leaving me no choice, given they've also not taken down the malicious sites, other than blocking the IP."

Bluehost helpdesk (quoted on showtopic=23094):

"This is not something we're responsible [for]. We cannot and will not police all content that everybody uploads to their account. The way our user architecture is set up it's impossible for one user's site to effect anothers', cross-account. So even if there are other sites that are hacked, they won't effect yours. It's a poor way of reporting a hacked site on the part of Malwarebytes, as it purposely singles out Shared Hosts that operate the same way we do. We're not unique in this position; Just about every shared (Not slice/VPS) host has 1 IP per hundreds (or thousands) of domains per server, with the option to have your own IP at an additional cost."

As someone who is hosting a small web site on Bluehost, I chose to purchase a dedicated IP number. It cost me about $60 for about 18 months. Clearly the bigger sites should do that. Many others will not, and some are annoyed about the situation. The following is a quote from one such (not so small) web site (showtopic=22717):

"I am a member of Revo Uninstaller team. We would like to ask you to update your IP blocking module, because for us changing the hosting company is not the solution. It is not the right decision to block the whole range of 255 IP addresses, because of only 57 malicious IP addresses. Even if we change our hosting company, this will not be a guarantee that in the range of our new IP address will not be placed

Link to post
Share on other sites

We do understand the frustration, and do not block IP's or entire IP ranges (or subsets of such), without a damn good reason, and the first criteria of this, is a lack of response from the IP ranges owner.

With all due respect to BlueHost, they can police their network, indeed, if they wish to enforce their TOS/AUP, it is their job to police such. If they do not have the staff or infrastructure to do such, they need to hire more staff and redesign their network to allow for the policing of such. Ignoring abuse reports however, has nothing to do with policing their network. Aslong as they are ignoring such, they are not enforcing their TOS/AUP, which means it's a bad guys paradise - this then of course means, they will continue to be blocked.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.