eMyPeople as "riskware" - IP ranges 68.132.158.176/28 and 216.24.56.0/25

[NightOwl]

Good afternoon,

eMyPeople provides hosted email and enterprise grade deep-packet inspection device firewall. We recommend Malwarebytes to many of our customers and we are getting reports from our customers that many of them are receiving block notices saying there is a danger of riskware. I am a sysadmin eMyPeople. Please PM me if you need more information and I will provide you with my work email address.

Here is an example block...

One relation to the firewall proxy...

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 8/18/21
Protection Event Time: 8:32 AM
Log File: aace0520-0028-11ec-be0e-40167ea8dd58.json

-Software Information-
Version: 4.4.4.126
Components Version: 1.0.1413
Update Package Version: 1.0.44224
License: Premium

-System Information-
OS: Windows 10 (Build 19043.1165)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Program Files\Mozilla Firefox\firefox.exe, Blocked, -1, -1, 0.0.0, ,

-Website Data-
Category: Malware
Domain:
IP Address: 68.132.158.184
Port: 8000
Type: Outbound
File: C:\Program Files\Mozilla Firefox\firefox.exe

 

(end)

 

One in relation to the mail server...

 

Malwarebytes
www.malwarebytes.com
 
-Log Details-
Protection Event Date: 8/17/21
Protection Event Time: 7:57 PM
Log File: 37be10de-ffbf-11eb-bec3-40167ea8dd58.json
 
-Software Information-
Version: 4.4.4.126
Components Version: 1.0.1413
Update Package Version: 1.0.44210
License: Premium
 
-System Information-
OS: Windows 10 (Build 19043.1165)
CPU: x64
File System: NTFS
User: System
 
-Blocked Website Details-
Malicious Website: 1
, C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe, Blocked, -1, -1, 0.0.0, ,  
 
-Website Data-
Category: RiskWare
Domain: mail.emypeople.net
IP Address: 68.132.158.180
Port: 465
Type: Outbound
File: C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
 
 
 
(end)

 

Thanks for your help.

[Zynthesist]

Hello,

Domain block on emypeople[.]net will be removed.