IP 81.169.145.71

[daledoc1]

Hello:

Updated a popular and stable FF add-on yesterday (through standard procedures, from within FF, not typing any URL into browser address bar).

As per routine, I restarted FF after the update.

As per routine (with many FF add-ons) the add-on's/dev's landing page attempted to open in a new tab alongside my home page tab.

Here is the URL for his web site:

http://www.soerenrinne.de/GoogleShortcuts/update.html (This is the page that should have loaded.)

However, when it happened, the page did not load and I got a malicious IP block alert for 81.169.145.71.

(There was also something buggy with the update and I ended up having to uninstall it and create a new FF profile.)

I emailed the dev and he replied that:

>>The landing page is hosted at a webservice called

>>Strato (http://strato.de) and should not be malicious...

I wrote him back to explain that his site might be "good", but that other sites hosted at that IP range might be "bad".

I assume this is the case?

Thanks!

Daledoc1

PS Have scanned with MBAM, SAS and McAfee -- clean

[daledoc1]

Any word on this IP range?

I just updated the add-on in FF on my other computer.

Although the update installed properly, MBAM is still blocking this IP range.

FP or a genuinely bad IP?

Thanks!

daledoc1

[MysteryFCM]

Apologies for taking so long. This range is blocked due to a plethora of malware and exploits residing across various IP's here (the last one was recorded in my database on March 7th, so I'll re-run through them to see if they've been cleaned/deleted yet)

[daledoc1]

Hi, Steven:

Yes, that's what I expected.

I'll pass this along to the add-on developer, so that he can take whatever action he feels might be needed about his website hosting.

Thanks to you and to MBAM for keeping us safe!

daledoc1

[MysteryFCM]

My pleasure