6yearuser Posted March 21, 2019 ID:1304860 Share Posted March 21, 2019 I'm a 6+ year MB user with a lifetime sub. MB is one of three programs I've advised friends and family to add to their systems because I felt it was a very good program ensuring safety. No matter the new device, MB is/was one of the first programs I would install. Recently I discovered a website, Kiwifarms, would no longer load though accessing the site just a few days ago was without issue. After struggling to figure out why, I discovered MB was the problem. After uninstalling MB, I gained immediate access. Upon re-instillation, the website was immediately blocked. Uninstalled again, immediately accessible. This is purely a political censorship no different than communist China's habit of blocking sites the government there disapproves of. I did not purchase this program to be subjected to Cultural Marxist or outright communist censorship practices. The blocking of this site is related to the incident at the mosque in New Zealand and the the New Zealand's government attempt to block internet users from gaining access to information on the incident. It isn't a cohencidence that the blocking began shortly after KiwiFarms refused to give New Zealand police the information the police there requested on KiwiFarms users and the New Zealand government began threatening the site owner and others throughout the world. Malware Bytes should inform its customers that it will prohibit access to sites over political concerns as well as over safety concerns. I am highly disappointed I gave money to people who wish to censor information and prohibit my exploration of topics I should be free to explore. If I had known MD was a Cultural Marxist organization, I would have never become a customer of theirs. I have removed everything MB from every system of mine, and I feel MB's communist style censorship has only left me vulnerable to the threats this program was supposed to handle. Link to post Share on other sites More sharing options...
exile360 Posted March 21, 2019 ID:1304861 Share Posted March 21, 2019 Greetings, The Web Protection feature in Malwarebytes uses databases of known malicious websites (domains/URLs) and servers (IP addresses) to block malicious content. There's nothing political in their motivations I assure you. If you believe a site being blocked is a false positive then please review the information posted here as well as here and then create a new topic in the Website Blocking false positives area by clicking here and one of the Malwarebytes Research team members will review the block and have it removed if it turns out to be a false positive or if the malicious content that was on the site/server has been removed. If there is anything else we might assist you with please let us know. Thanks Link to post Share on other sites More sharing options...
6yearuser Posted March 21, 2019 Author ID:1304865 Share Posted March 21, 2019 Listen Friendo, the site was accessible before the New Zealand governments threats, then the site wasn't accessible after the threats. Someone from MB put the site into the "block" category following the threats. The block wasn't put there for security concerns. I don't believe your assurances. There are no such things as coincidences anymore. Adios. Link to post Share on other sites More sharing options...
exile360 Posted March 21, 2019 ID:1304866 Share Posted March 21, 2019 Believe what you want; I don't know why the site was blocked, only that there are no political blocking categories for the Web Protection feature and if you don't report it as a false positive it can't get corrected, and if you do report it then you'll likely get an explanation as to why it was blocked in the first place. Either way if you want something done about it the best way to accomplish that is to report it to Research for review. Link to post Share on other sites More sharing options...
exile360 Posted March 21, 2019 ID:1304867 Share Posted March 21, 2019 By the way, I believe I just found out why the site was blocked, and no, it didn't have anything to do with politics (in fact, it didn't have anything to do with the website you mentioned; it was due to another malicious site that happens to share the same IP address/server as the site you mentioned meaning they should be able to filter out the site you referenced as an exclusion and keep the block on the malicious site if it gets reported). I looked up the site you mentioned on the HPHosts database which is a site maintained by Malwarebytes' Web Research team that will often reveal why many sites are blocked by Malwarebytes (though it isn't a 1 to 1 match as they are separate tools/databases, but they do often overlap) and you can see that info here. As you can see, it shows that the site in question is not in their database meaning they aren't targeting it, however when I clicked on the IP used by the site (104.27.12.102) I found this reference which as you can see, references a DIFFERENT site using the same IP address, meaning they share the same server and I would bet that the second site is the reason for the block. Link to post Share on other sites More sharing options...
exile360 Posted March 22, 2019 ID:1304891 Share Posted March 22, 2019 2 minutes ago, Amaroq_Starwind said: @6yearuser Besides databases, MalwareBytes will primarily use machine learning to determine whether or not something is hostile, including scanning websites. Actually Malwarebytes doesn't use AI/Machine Learning for the Web Protection component in Malwarebytes. It is a database maintained by a team of Researchers with years of experience maintaining the hpHosts block database/HOSTS file prior to becoming a part of Malwarebytes. Steven Burn (AKA MysteryFCM) is the lead Researcher and originator of the web blocking technology/database in Malwarebytes going all the way back to the Malwarebytes 1.x days when Web Protection was first integrated into Malwarebytes Premium (or Pro as it was known back then). But yes, it is true that Malwarebytes has no political motivations in their detections. They simply target malware, scams and PUPs (Potentially Unwanted Programs) and only criminal malicious content is targeted for blocking by the Web Protection component. I'm fairly certain that the shared server I discovered is the cause of this block as it is not uncommon for hosting providers to use the same IP address/server to host multiple websites from different owners and Malwarebytes simply needs to add an exception in the database to prevent the innocent site from being blocked while continuing to block the malicious content being hosted on the other website that shares the same server. Link to post Share on other sites More sharing options...
exile360 Posted March 22, 2019 ID:1304910 Share Posted March 22, 2019 @MysteryFCM, @Dashke, @Zynthesist could one of you take a look at this site please to determine if it can be excluded/should be blocked?: kiwifarms.net According to the info I posted in the links in this post it looks like it shares a server with the following malicious site: dw.convertfiles.com Apparently they share the IP 104.27.12.102 which is likely why kiwifarms.net is being blocked as well, at least according to the info on hosts-file.net (it looks like dw.convertfiles.com is being blocked for malware distribution according to hosts-file.net as it's classified under EMD (Engaged in Malware Distribution). Link to post Share on other sites More sharing options...
Solution MysteryFCM Posted March 22, 2019 Solution ID:1304911 Share Posted March 22, 2019 kiwifarms.net was unblocked in January. MWAC hasn't blocked it since. Link to post Share on other sites More sharing options...
exile360 Posted March 22, 2019 ID:1304975 Share Posted March 22, 2019 Thank you for confirming that Steven, much appreciated For the OP: if you are still seeing this site being blocked then please clear your network and browser cache as that may be the reason that the site is still unreachable, assuming you've updated Malwarebytes obviously. Link to post Share on other sites More sharing options...
Recommended Posts