archive.ph archive.today 94.140.114.194

[eirrak]

Archive.ph and archive.today (both are 94.140.114.194) started being blocked for trojan on Oct 5. See 1st attached report.

After numerous attempts, thinking it was a fluke, I ran a MWB Premium scan and 3 issues were found. See 2nd attached report. Issue with Windows Defender?

I've not had any issues with using those sites prior. Mostly want to know if it's safe to white list. The sudden change is strange. 

Let me know if you need other info.

Thanks

 

 

MWB REPORT TODAY 1st INCIDENT.txt MWB SCAN REPORT 10_05_22.txt

[thisisu]

Hello,

That IP address was added back in June. It wasn't a FP back then, being blocked as reported C2 for Trojan.IcedID.

We will review it to see if it still warrants being blocked. The domains you listed are not in our database (it's just this IP address)

Regards

[eirrak]

Could this be a vpn issue? Been using the same provider for quite some time. An update came out on the same day this started. 

I say this because after installing Win11 update, archive sites were working fine.

"Wow, it fixed it", I thought. 

Then realized I hadn't switched vpn to different locale. I have it set to auto connect but usually change it to a less busy server in another state. When I switched servers and tried, I got the block, again. Changed server back to 1st state and .today works fine again. 

Is it a block driven from .today to MWB in order to prevent some servers connecting? I've seen it do that before but never have seen MWB do the block. 

idk. Too much weirdness happening all at once. Might try seeing if vpn company has any ideas on the sudden change. However, the quarantined items by MWB is very unusual. 

 

 

[eirrak]

huggyface.co is an AI art generating site that also was MWB blocked, as you can see. Could be vpn related, too. shrug

[eirrak]

huggyface seems to be all MWB. I'm able to archive but can't visit straight through

[thisisu]

On 10/9/2022 at 2:32 AM, eirrak said:

huggyface.co is an AI art generating site that also was MWB blocked, as you can see. Could be vpn related, too. shrug

This is being blocked as RiskWare as well. It's contains a redirect that we block: https://www.virustotal.com/gui/url/f4453addf3ce05b822717269920c7c3ff293a333a7db9cbdcfb27ea1870f1092/details

After review, we will be unblocking 94.140.114.194. However, I do not suspect that this will help with the archive.today and archive.ph block. Those aren't blocked and aren't being reported as being on this IP. I've been unable to reproduce the blocks on those two domains.