False Positive - 198.46.81.17

[InMotion]

Hello,

We have received reports that Malwarebytes is currently blocking access to the IP address 198.46.81.17. This is the main IP address of a shared server which hosts thousands of websites. This server has a team of systems administrators managing this server who promptly respond to abuse complaints, as well as active vulnerability and security scanning software.

Please remove the IP from your blocklist, or if you have any information that prevents the removal of this block, please let us know and we will look into the matter further. Our team responds to reports of abuse at abuse@inmotionhosting.com. You may find the protection log related to this block attached.

198-46-81-17-mwb-report.txt

[Porthos]

That ip has issues with abuse https://www.abuseipdb.com/check/198.46.81.17

[TeMerc]

Yes this is an issue and needs to be resolved before we can disable the block

[TeMerc]

Just now, TeMerc said:

Yes this is an issue and needs to be resolved before we can disable the block

More here: VirusTotal - Ip address - 198.46.81.17

[InMotion]

Hello,

Thank you for your response. We are aware the server has received abuse reports. As mentioned before, we have a team of administrators who swiftly deal with reports of abuse. Currently, we do not have any active abuse reports for this server. This is a shared hosting IP and there are thousands of customer websites behind this IP address. We have active security monitoring to address this before it starts and other measures for detection that are actively monitored by humans.

We believe "protecting" users from an IP address shared across many websites that are completely isolated from one another does more damage than good, as, again, we swiftly handle reports of abuse and any problematic websites in question.

[Porthos]

1 hour ago, InMotion said:

We believe "protecting" users from an IP address shared across many websites that are completely isolated from one another does more damage than good, as, again, we swiftly handle reports of abuse and any problematic websites in question.

I think it is more the type of activity coming from the IP.

[InMotion]

The activity listed above comes from websites that do not point to the IP address in question, as while this is the primary exit IP of the host, all of our customer websites use other IPs on the server. The ingress purpose of 198.46.81.17 is for customers to access their website management dashboard (cPanel). We have received reports from your users that they cannot access the dashboard while using Malwarebytes. Blocking the IP because of outbound requests to WordPress websites would make sense for a WordPress firewall product, but not for consumer antivirus as this activity does not target mobile and desktop users.

We handle reports made against servers with our customers' websites and resolve any and all valid complaints. Currently, we do not have any reports regarding this server which have not already been handled.

May I ask if the removal of the IP from the Malwarebytes blocklist is dependent on first addressing the listings here? https://www.virustotal.com/gui/ip-address/198.46.81.17/relations