MicLima Posted November 8, 2019 ID:1343947 Share Posted November 8, 2019 Just started getting blocks to amazonaws domains. s3-us-west-2.amazonaws.com ubp-ubpextension-us-prod.s3-us-west-2.amazonaws.com Are these legit blocks? Happens just about every 10 minutes and I am not actively browsing Amazon at the time. Thanks. Link to post Share on other sites More sharing options...
Staff Dashke Posted November 8, 2019 Staff ID:1343949 Share Posted November 8, 2019 Thank you very much for reporting this to us! The domain got blocked for phishing page that was hosted there - Block was removed and the updated DB should be out soon. Link to post Share on other sites More sharing options...
flrebroker Posted November 8, 2019 ID:1343952 Share Posted November 8, 2019 I got one too, cyberpowersystems.com via aws. Here is my log file: Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 11/8/19 Protection Event Time: 10:04 AM Log File: ffb08832-0238-11ea-a48d-902b345ac610.json -Software Information- Version: 3.8.3.2965 Components Version: 1.0.629 Update Package Version: 1.0.13239 License: Premium -System Information- OS: Windows 10 (Build 18362.449) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Phishing Domain: cyber-power.s3-us-west-2.amazonaws.com IP Address: 52.218.201.249 Port: [59542] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (end) Link to post Share on other sites More sharing options...
MicLima Posted November 8, 2019 Author ID:1343953 Share Posted November 8, 2019 3 minutes ago, Dashke said: Thank you very much for reporting this to us! The domain got blocked for phishing page that was hosted there - Block was removed and the updated DB should be out soon. Great, thanks for speedy response! Link to post Share on other sites More sharing options...
SoCalGrl Posted November 8, 2019 ID:1343967 Share Posted November 8, 2019 Hello, I've been seeing this website blocked every few seconds from the time I logged in this morning. Here's the screenshot: I ran another Malwarebytes program ( to try to get rid of it but it didn't find anything so I'm not sure what to do about it. In my Browser Guard is shows this, not sure if it's related: www.googletagmanager.com Thanks for your help. Link to post Share on other sites More sharing options...
gelat Posted November 8, 2019 ID:1343971 Share Posted November 8, 2019 I am getting this also -is it a confirmed false positive? Link to post Share on other sites More sharing options...
Dombuggy Posted November 8, 2019 ID:1343975 Share Posted November 8, 2019 As am I....every few seconds on two machines. Link to post Share on other sites More sharing options...
thanks_for_your_help Posted November 8, 2019 ID:1343980 Share Posted November 8, 2019 Mines happen every 10 minutes as well and as soon as I open up chrome This is what my log says Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 11/8/19 Protection Event Time: 6:11 AM Log File: 65571062-0242-11ea-b766-309c23a33db1.json -Software Information- Version: 3.8.3.2965 Components Version: 1.0.629 Update Package Version: 1.0.13241 License: Premium -System Information- OS: Windows 10 (Build 18362.449) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Phishing Domain: ubp-ubpextension-us-prod.s3-us-west-2.amazonaws.com IP Address: 52.218.234.1 Port: [55376] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (end) That's one of them here's the other Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 11/8/19 Protection Event Time: 6:11 AM Log File: 6515c738-0242-11ea-9f6b-309c23a33db1.json -Software Information- Version: 3.8.3.2965 Components Version: 1.0.629 Update Package Version: 1.0.13241 License: Premium -System Information- OS: Windows 10 (Build 18362.449) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Phishing Domain: s3-us-west-2.amazonaws.com IP Address: 52.218.236.16 Port: [55373] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (end) I've tried to see if the IP addresses were similar to each other but they aren't. Here are some of them: 52.218.128.124 52.218.200.168 52.218.229.97 I've tried troubleshooting by closing all my chrome windows but it still pops up even while I'm typing this out on this website. Link to post Share on other sites More sharing options...
EricCassol Posted November 8, 2019 ID:1343984 Share Posted November 8, 2019 The domain s3-us-west-2.amazonaws.com, is an AWS endpoint used by a lot of legitimate companies for access to S3, Malwarebytes should have know blocking this domain would cause a lot of issues due to how it is used. To prevent this type of issue from happening they need to have the ability to block at the page level as well as the domain level. Link to post Share on other sites More sharing options...
notsop Posted November 8, 2019 ID:1343985 Share Posted November 8, 2019 It would also be helpful to be able for malwarebytes to let users suppress the pop up for a set time period. Link to post Share on other sites More sharing options...
EvilZoe Posted November 8, 2019 ID:1343987 Share Posted November 8, 2019 Yeah, it's popping up at least every minute for me so I hope it gets sorted quickly. Link to post Share on other sites More sharing options...
EricCassol Posted November 8, 2019 ID:1343988 Share Posted November 8, 2019 I am waiting to chat with support about this, for now we created an exclusion for s3-us-west-2.amazonaws.com, stopped the pop up alerts almost immediately. Link to post Share on other sites More sharing options...
EvilZoe Posted November 8, 2019 ID:1343989 Share Posted November 8, 2019 I just checked my Malwarebytes for updates and it said there was a new version to install. I installed it and haven't had a popup since. Just thought I'd put that out there. Link to post Share on other sites More sharing options...
Devilstowerwy Posted November 8, 2019 ID:1343990 Share Posted November 8, 2019 I will push the pc's for new updates, thanks. Link to post Share on other sites More sharing options...
Staff Solution Dashke Posted November 8, 2019 Staff Solution ID:1343991 Share Posted November 8, 2019 (edited) The block has been modified and notifications shouldn't occur any more. Thank you for reporting this to us. As said previously, the block was put because there was a phishing page on s3-us-west-2.amazonaws.com. Please keep in mind that if you are using Browser Guard, the phishing page will be blocked, but not the entire s3-us-west-2.amazonaws.com. Edited November 8, 2019 by Dashke Link to post Share on other sites More sharing options...
demonkez1987 Posted November 8, 2019 ID:1344003 Share Posted November 8, 2019 thank you for the fast response havent had a pop up for the last 15 minutes so its all good i think back to streaming i guess aha Link to post Share on other sites More sharing options...
SoCalGrl Posted November 8, 2019 ID:1344007 Share Posted November 8, 2019 I'm still getting the popups: During the time it shows no websites blocked (9:17 - 9:51), I was away from computer. I'm not sure if I have Browser Guard, I thought I had found it looking around for help within Malwarebytes. If I need to do something to stop all this, please let me know. I'm not tech. savvy. Thank you. Link to post Share on other sites More sharing options...
EvilZoe Posted November 8, 2019 ID:1344008 Share Posted November 8, 2019 5 minutes ago, SoCalGrl said: I'm still getting the popups: During the time it shows no websites blocked (9:17 - 9:51), I was away from computer. I'm not sure if I have Browser Guard, I thought I had found it looking around for help within Malwarebytes. If I need to do something to stop all this, please let me know. I'm not tech. savvy. Thank you. You're still showing the old build. Try updating to the new version and see if it doesn't make a difference. It did for me right away. Link to post Share on other sites More sharing options...
SoCalGrl Posted November 8, 2019 ID:1344082 Share Posted November 8, 2019 5 hours ago, EvilZoe said: You're still showing the old build. Try updating to the new version and see if it doesn't make a difference. It did for me right away. I saw there was a new version, 4.0, however when I went to my dashboard it said my system was up to date. Thanks for the info, I will install the later version. Thank you! Link to post Share on other sites More sharing options...
SoCalGrl Posted November 9, 2019 ID:1344100 Share Posted November 9, 2019 Thanks for the help. I installed the new version and so far no more popups. Thanks for the help! Link to post Share on other sites More sharing options...
Staff Zynthesist Posted November 9, 2019 Staff ID:1344165 Share Posted November 9, 2019 Glad we could help this get this addressed quickly. Link to post Share on other sites More sharing options...
Recommended Posts