FP IP 98.124.199.1?

[daledoc1]

Hi:

MBAM Pro 1.46 successfully blocked IP 98.124.199.1 (www.texasflu.gov) just now while I was researching for a presentation. I clicked on a hyperlink on the Texas DSHS site and *boom*....

I did have several FF tabs open at the time, but for sites such as http://www.who.int/, http://www.dshs.state.tx.us/, http://www.pandemicflu.gov/, and other credible & legitimate sites.

But I am pretty sure it was the "texasflu.gov" that prompted the block, since FF errored out with "page not found" and I got the MBAM IP block balloon as soon as I tried that link.

There's no commercial advertising at the site and there shouldn't be any malicious content, so....

I hope this is a just a FP, but I am about to scan with MBAM, SAS and McAfee to be sure.

TYIA,

daledoc1

[daledoc1]

Hi:

MBAM Pro 1.46 successfully blocked IP 98.124.199.1 (www.texasflu.gov) just now while I was researching for a presentation. I clicked on a hyperlink on the Texas DSHS site and *boom*....

I did have several FF tabs open at the time, but for sites such as http://www.who.int/, http://www.dshs.state.tx.us/, http://www.pandemicflu.gov/, and other credible & legitimate sites.

But I am pretty sure it was the "texasflu.gov" that prompted the block, since FF errored out with "page not found" and I got the MBAM IP block balloon as soon as I tried that link.

There's no commercial advertising at the site and there shouldn't be any malicious content, so....

I hope this is a just a FP, but I am about to scan with MBAM, SAS and McAfee to be sure.

TYIA,

daledoc1

PS EDIT: should be www.texasflu.org, but the IP block is the same. I see this range has been bad off and on for some time. Can it be unblocked, or is it still bad?

And SORRY for the replicated posts earlier -- seems to be a server hiccup at forums.malwarebytes.org. Still happening, but I know now not to click the radio buttons more than once, until it is fixed.

[MysteryFCM]

Apologies for the delay. This is one of a number of eNom IPs that contains or leads to, malicious content, so can't be unblocked at present I'm afraid.

[daledoc1]

Hi, MysteryFCM:

No apologies needed -- your reply has surely been fast!

Too bad about that IP.

I'm sure the folks at the TX DSHS are unaware that they are hosting their site someplace nasty.

(A bit ironic, I suppose, since one's computer could become INFECTED when visiting the state's FLU website <LOL>!)

I will try to contact their webmaster with a link to this thread.

In the interim, I'll have to do without whatever information might be at that www.texasflu.org site, since it's not worth the risk.

Thanks very much for your prompt reply and, again, apologies for the duplicate postings earlier due to apparent server glitch!

Best,

daledoc1

[MysteryFCM]

Just as an update, I've re-checked those I've got recorded for this IP, and there's no longer enough still live, to warrant the continued blocking of it (though annoyingly, some of those from last year, are still very much alive). Because of this, I've just published an update that unblocks this one (it will be unblocked as of the next def update).

[daledoc1]

Thanks!

I emailed the webmaster yesterday, but don't expect to hear back for several days.

And I hope this reply posts uneventfully, as I am still having intermittent and unpredictable issues with "...waiting for forums.malwarebytes.org" even when the posts apparently have gone through. It appears to be a server issue at your end, though I haven't had time to investigate much at this end (e.g. trying a new FF profile or FF safe mode or FF with NoScript add-on disabled).

Thanks again, and crossing fingers,

daledoc1