49.12.198.69 false positive

[avocado123]

Dear Malwarebytes staff,

I've seen that the IP 49.12.198.69 has been abused in the past (

https://www.vmray.com/analyses/058ff1d64435/report/ioc.html

However, now it's being used by

https://www.edudip.com

and Malwarebytes still blocks it which cuts off my audio.

I've attached the log.

log.txt

Kind regards

Edited November 3, 2021 by AdvancedSetup
disabled live hyperlink

[TeMerc]

1 hour ago, avocado123 said:

Dear Malwarebytes staff,

I've seen that the IP 49.12.198.69 has been abused in the past (

https://www.vmray.com/analyses/058ff1d64435/report/ioc.html

). However, now it's being used by

https://www.edudip.com

and Malwarebytes still blocks it which cuts off my audio.

I've attached the log.

log.txt 689 B · 2 downloads

Kind regards

Hello- Fresh scan results as of minutes ago: VirusTotal - URL - 939026337707d071ca39de16708a494e7f27e2df6f7bfe587e11ed029a67dd68

Edited November 3, 2021 by AdvancedSetup
disabled live hyperlink

[avocado123]

13 minutes ago, TeMerc said:

Hello- Fresh scan results as of minutes ago: VirusTotal - URL - 939026337707d071ca39de16708a494e7f27e2df6f7bfe587e11ed029a67dd68

Thanks for your fast response.

Could the scans of those anti-virus products also be outdated? Your linked vt scan on the /865 endpoint does not give a response to HTTP GET requests anymore.

I'm 100% sure that its being actively used by edudip.com. If that means that their server is infected I could write them an email.

[avocado123]

The http header referenced in the vt scan also has this date from early September

date Mon, 06 Sep 2021 13:29:58 GMT

connection keep-alive

transfer-encoding chunked

content-type text/html; charset=UTF-8

vary Accept-Encoding

server nginx

[TeMerc]

17 hours ago, avocado123 said:

Thanks for your fast response.

Could the scans of those anti-virus products also be outdated? Your linked vt scan on the /865 endpoint does not give a response to HTTP GET requests anymore.

I'm 100% sure that its being actively used by edudip.com. If that means that their server is infected I could write them an email.

Hi- A fresh scan is a scan just done by VirusTotal, so it was done 18 hours ago.