ComputerFlake Posted January 31, 2022 ID:1500034 Share Posted January 31, 2022 (edited) https://3145783142-my.sharepoint.com/ I need my Sharepoint UNBLOCKED! It's crippling my business! Edited January 31, 2022 by AdvancedSetup Disabled live hyperlink Link to post Share on other sites More sharing options...
Staff TeMerc Posted January 31, 2022 Staff ID:1500035 Share Posted January 31, 2022 (edited) 1 hour ago, ComputerFlake said: https://3145783142-my.sharepoint.com/ I need my Sharepoint UNBLOCKED! It's crippling my business! Hello- We do not show either the domain nor the IP which the domain resides on in our database, was this perhaps a Browser Guard block? Edited January 31, 2022 by AdvancedSetup Disabled live hyperlink Link to post Share on other sites More sharing options...
ComputerFlake Posted January 31, 2022 Author ID:1500036 Share Posted January 31, 2022 Malwarebytes is constantly coming up with "Blocked due to compromised" and won't allow access to my client's Sharepoint site or a login to OneDrive because of this. It's definitely blocked from Malwarebytes and I don't know what to do with this. I'm about to remove the software and demand a refund. Link to post Share on other sites More sharing options...
Porthos Posted January 31, 2022 ID:1500039 Share Posted January 31, 2022 29 minutes ago, ComputerFlake said: Malwarebytes is constantly coming up with "Blocked due to compromised" Do you have the log showing the block? Link to post Share on other sites More sharing options...
ComputerFlake Posted January 31, 2022 Author ID:1500040 Share Posted January 31, 2022 How do I retrieve it? I'll attach it here. Link to post Share on other sites More sharing options...
Porthos Posted January 31, 2022 ID:1500041 Share Posted January 31, 2022 Just now, ComputerFlake said: How do I retrieve it? I'll attach it here. What version of Malwarebytes? Link to post Share on other sites More sharing options...
ComputerFlake Posted January 31, 2022 Author ID:1500042 Share Posted January 31, 2022 Premium 4.5.3 Link to post Share on other sites More sharing options...
Porthos Posted January 31, 2022 ID:1500043 Share Posted January 31, 2022 Just now, ComputerFlake said: Premium 4.5.3 You can find Scan and Protection logs within the Malwarebytes 4 program in the following location RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged If you click on the View option you should get something similar to the following with other options available. Link to post Share on other sites More sharing options...
ComputerFlake Posted January 31, 2022 Author ID:1500044 Share Posted January 31, 2022 Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 1/31/22 Protection Event Time: 3:57 PM Log File: d3b82ee4-82e0-11ec-ad2c-c49dedec81a2.json -Software Information- Version: 4.5.3.162 Components Version: 1.0.1579 Update Package Version: 1.0.50541 License: Premium -System Information- OS: Windows 11 (Build 22000.469) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Compromised Domain: 3145783142-my.sharepoint.com IP Address: 37.57.137.208 Port: 443 Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (end) Link to post Share on other sites More sharing options...
Porthos Posted January 31, 2022 ID:1500046 Share Posted January 31, 2022 1 minute ago, ComputerFlake said: IP Address: 37.57.137.208 The IP that is blocked is listed doing port scanning as recent as yesterday.. https://www.abuseipdb.com/check/37.57.137.208 @TeMerc Link to post Share on other sites More sharing options...
ComputerFlake Posted January 31, 2022 Author ID:1500047 Share Posted January 31, 2022 (edited) Port scanning is not my issue. This is my issue: The webpage at https://3145783142-my.sharepoint.com/_layouts/15/MySite.aspx?MySiteRedirect=AllDocuments might be temporarily down or it may have moved permanently to a new web address. ERR_FAILED As soon as I try to open OneDrive via the web in Chrome, I get this message and the "Blocked due to compromised" error appears. This has to be unblocked somehow. Edited January 31, 2022 by AdvancedSetup Disabled live hyperlink Link to post Share on other sites More sharing options...
Porthos Posted January 31, 2022 ID:1500051 Share Posted January 31, 2022 1 minute ago, ComputerFlake said: Port scanning is not my issue. This is my issue: The IP was blocked due to it doing brute force port scanning. TeMerc will be back to comment. Link to post Share on other sites More sharing options...
ComputerFlake Posted January 31, 2022 Author ID:1500054 Share Posted January 31, 2022 I honestly don't care because port scanning, when I'm behind a firewall with no ports open inbound, won't harm me. I need this unblocked so my client can do some work. Thanks for chiming in and trying to help, though. Link to post Share on other sites More sharing options...
Porthos Posted February 1, 2022 ID:1500059 Share Posted February 1, 2022 2 hours ago, ComputerFlake said: I need this unblocked so my client can do some work. You can add the site to exclusions if you wish. Link to post Share on other sites More sharing options...
ComputerFlake Posted February 1, 2022 Author ID:1500182 Share Posted February 1, 2022 I did. It didn't work. Link to post Share on other sites More sharing options...
David H. Lipman Posted February 1, 2022 ID:1500187 Share Posted February 1, 2022 If you PING 3145783142-my.sharepoint.com what IP is returned ? Link to post Share on other sites More sharing options...
ComputerFlake Posted February 1, 2022 Author ID:1500189 Share Posted February 1, 2022 Currently 13.107.138.9 but it was different yesterday because Microsoft uses BGP and load balancing. IPs don't matter in this case. Link to post Share on other sites More sharing options...
David H. Lipman Posted February 1, 2022 ID:1500191 Share Posted February 1, 2022 (edited) That may be but sharepoint.com is a Microsoft owned and operated Domain on its own network and 37.57.137.208 is hosted in Ukraine and is unlikely to be a Microsoft Hosted IP. Edited February 1, 2022 by David H. Lipman Edited for content, clarity, spelling and/or grammar Link to post Share on other sites More sharing options...
Porthos Posted February 1, 2022 ID:1500201 Share Posted February 1, 2022 You should also right after each block, right click on the MB icon in the system tray and add an exclusion. Link to post Share on other sites More sharing options...
ComputerFlake Posted February 1, 2022 Author ID:1500222 Share Posted February 1, 2022 Well this was really strange. I got it fixed. Turns out the IT guy she had (she's in St Louis and I'm in Nashville so I wasn't onsite) put in a crummy router that was giving out DHCP and it was using itself as DNS. It was faulty so many different sites were not working properly. I gave her a static DNS and everything started working. I'm aware the IP address was from the Ukraine because I did a reverse lookup on it long before I came here. It was just bizarre that I ONLY got the MB popups when trying to access the OneDrive (Sharepoint) folders in office.com or via OneDrive app. It came up immediately and said site was accessing a compromised site and gave me the Ukrainian IP address. Once I decided to overlook that popup and try something else (such as removing MB entirely) did I notice it still didn't work. I'm glad it was a network issue because I've never seen MB do that before. What really makes no sense is that she is on a NAT'd internal network so there's an almost ZERO chance a Ukraine IP address could scan her individual computer behind two firewalls. Add the popup message to that scenario and you've got the perfect storm. I'll reinstall MB Premium now and see what happens. I'll probably disable the notifications entirely so it'll continue to work and not totally freak the lady out. She thought hax0rz had gotten to her! Thanks for the ideas, guys. I appreciate you walking me through the product. Link to post Share on other sites More sharing options...
Porthos Posted February 1, 2022 ID:1500225 Share Posted February 1, 2022 (edited) 14 minutes ago, ComputerFlake said: I'll probably disable the notifications entirely so it'll continue to work and not totally freak the lady out. She thought hax0rz had gotten to her! Be aware disabling notifications will disable all notifications not just web blocks. Sites will still be blocked though. She would not know about other blocks and think the computer is broken and you will still get a service call. Edited February 1, 2022 by Porthos Link to post Share on other sites More sharing options...
David H. Lipman Posted February 1, 2022 ID:1500226 Share Posted February 1, 2022 (edited) Thank you Please realize that many IP Reporting sites show Port Scans and nefarious activities emanating from the POV of the Ukranian hosted TRIOLAN IP as it was performing against remote sites. I was thinking of a DNS issue. There have been times where malware has changed the DNS Server entries on PCs to malicious DNS servers. Thus a Safe Site could be redirected to a malicious site. I, and others, have never thought DNS Forwarding on NAT Routers was a great idea. That is the Router gets DNS Servers from the ISP and delivers its Gateway address (such as 192.1681.1 or 10.0.0.1) to DHCP Clients as the DNS server. For one that introduces another Hop in the DNS query. If one is to use that on the LAN, then I have always suggested the Router DNS Server Table be statically set to one ISP provided DNS server and the rest being Public DNS Servers such as; Google [ IPv4; 8.8.8.8 ] CloudFlare [ IPv4; 1.1.1.1 ] Level 3 [ IPv4; 4.2.2.1 ] on the Router so that IFF the DHCP Client gets the Router Gateway IP address as the DNS Server, the DHCP Client will get good Resolution. You will find that, on this Forum, it is suggested to override the DHCP provided DNS Server(s) with statically set Google DNS Servers. Edited February 2, 2022 by David H. Lipman Edited for content, clarity, spelling and/or grammar 1 Link to post Share on other sites More sharing options...
leo3487 Posted February 2, 2022 ID:1500289 Share Posted February 2, 2022 16 hours ago, David H. Lipman said: I, and others, have never thought DNS Forwarding on NAT Routers was a great idea. That is the Router gets DNS Servers from the ISP and delivers its Gateway address (such as 192.1681.1 or 10.0.0.1) to DHCP Clients as the DNS server. For one that introduces another Hop in the DNS query. If one is to use that on the LAN, then I have always suggested the Router DNS Server Table be statically set to one ISP provided DNS server and the rest being Public DNS Servers such as; Google [ IPv4; 8.8.8.8 ] CloudFlare [ IPv4; 1.1.1.1 ] Level 3 [ IPv4; 4.2.2.1 ] I'd say BOTH primary and secundary DNS SHOULD BE configured with public DNS. Avoid errors, DNS hijack, and DNS block (believe me than some ISP do it) Link to post Share on other sites More sharing options...
David H. Lipman Posted February 2, 2022 ID:1500291 Share Posted February 2, 2022 The reason for 1 ISP DNS Server is that sometimes there are internal Internet Provider services that may require their own DNS Server to resolve and provide access for that service. Thus preventing problems with their network. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now