windscribe Posted January 31, 2022 ID:1499997 Share Posted January 31, 2022 (edited) This has been reported by several uses and is a false positive. Binary: windscribe.com/install/desktop/windows Edited January 31, 2022 by TeMerc Disabled link Link to post Share on other sites More sharing options...
Staff TeMerc Posted January 31, 2022 Staff ID:1500013 Share Posted January 31, 2022 1 hour ago, windscribe said: This has been reported by several uses and is a false positive. Binary: windscribe.com/install/desktop/windows Hello- this is an IP block, not an FP by any stretch: 165.73.248.91 | Psychz Networks ZA | AbuseIPDB This IP address has been reported a total of 55 times from 24 distinct sources. 165.73.248.91 was first reported on December 16th 2020, and the most recent report was 2 hours ago. Link to post Share on other sites More sharing options...
windscribe Posted January 31, 2022 Author ID:1500015 Share Posted January 31, 2022 This is a VPN server IP. Our apps ping check all VPN servers in our network, and therefore make network connection. The fact that one of our VPN servers was allegedly used to brute force random Wordpress blogs (this happens with all VPMNs) poses zero security risk to any other end user. The IP simply has a "bad reputation". This does not make our VPN application "compromised" as incorrectly stated in your interface. Nothing is compromised, some people are just a-holes and use VPNs for bad things. Link to post Share on other sites More sharing options...
Staff BjelakovicL Posted February 1, 2022 Staff ID:1500099 Share Posted February 1, 2022 We're not detecting this file as malware, but rather the IP that it's trying to connect. Link to post Share on other sites More sharing options...
windscribe Posted February 1, 2022 Author ID:1500150 Share Posted February 1, 2022 @BjelakovicL As mentioned earlier, this IP is one of our servers in South Africa. Our app initiates connections to ALL servers to perform latency checks, as well as when a user actively attempts to connect to the address. If you look at the actual reports, you will notice that this VPN server is used by some unsavory characters to login into unsecured Wordpress blogs. As we're a no logging VPN, we cannot detect or prevent this type of activity (due to HTTPS being used). Nor is it our job to secure 3rd party Wordpress blogs who are too lazy to secure them. That being said, this has absolutely no impact on anyone else connecting to this particular VPN server. All this says is the IP reputation is "bad", which is not indicative of any compromise like your software states. Link to post Share on other sites More sharing options...
windscribe Posted February 1, 2022 Author ID:1500152 Share Posted February 1, 2022 I should add that multiple customers reported this, and several resolved their issue by removing Malwarebytes due to this false positive, and many other ones that happened previously. This also includes a current issue, where Malwarebytes breaks our split tunneling features, which is still an ongoing issue that our customers say you're ignoring Link to post Share on other sites More sharing options...
Staff BjelakovicL Posted February 1, 2022 Staff ID:1500171 Share Posted February 1, 2022 The IP block will be fixed in the next database update. 1 Link to post Share on other sites More sharing options...
windscribe Posted February 2, 2022 Author ID:1500262 Share Posted February 2, 2022 Thanks @Bjelak Would be real great to fix the split routing issue mentioned above too. It affects many people, and our suggested solution is currently "Disable or remove Malwarebytes". To replicate: 1. Download the app https://windscribe.com/install/desktop/windows 2. Make a free account and login 3. Enable split routing in Preferences -> Connection -> Split Routing and exclude your browser 4. Connect. Browser traffic should no longer be routed to the tunnel. Your IP should remain the same from the perspective of that browser, and be a VPN IP in other browsers. Thanks Link to post Share on other sites More sharing options...
Porthos Posted February 2, 2022 ID:1500263 Share Posted February 2, 2022 12 minutes ago, windscribe said: It affects many people, and our suggested solution is currently "Disable or remove Malwarebytes". No issue for me because I use Malwarebytes VPN We have seen the PIA VPN have the same issue as you routing thru compromised IP's as well. More and more websites and services are blocking well known VPN IP' as well. Link to post Share on other sites More sharing options...
windscribe Posted March 15, 2022 Author ID:1507014 Share Posted March 15, 2022 @BjelakovicLThe issue is still occurring. Link to post Share on other sites More sharing options...
Staff BjelakovicL Posted March 15, 2022 Staff ID:1507015 Share Posted March 15, 2022 @windscribe It will be fixed in the next database update. Sorry for the inconvenience. Link to post Share on other sites More sharing options...
windscribe Posted March 15, 2022 Author ID:1507016 Share Posted March 15, 2022 @BjelakovicL Can our process be whitelisted, as this is a common occurrence and is rather tedious. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now