Some VPN servers are classified as malware IPs

[gajanq1 0]

While connecting to some servers such as SG-Hydra (it will be stuck at checking route IPv4), Malwarebytes pops up a window stating that it is a compromised IP.

Does that mean that the VPN IP is used to perform malware related activities? Do we need to take any extra precaution? Thanks!

[Staff 9972]

Hello!

You connect to entry-IP addresses. Such addresses never sends out clients packets to the Internet, so they will never be seen by any destination service. Your outgoing packets are sent out by exit-IP addresses. Therefore it's just the very usual MB nonsense; they tend to include entire IP addresses ranges when one single IP address in the range is reported by someone as a source of malicious activity. For example in 2012 MB blocked hundreds and hundreds of web sites in a Luxembourg datacenter (including our web site) because in the /21 range of those web servers ONE web site was suspected to host a virus. So they blocked 2048 addresses because of ONE single dubious address.. Enough said...

Kind regards

 

[fishbasketballaries 17]

I haven't used Malwarebytes in years, but I always kept the site blocker switched off due to the fact that it often detected more false positives than actual threats. Perhaps consider checking out AirVPN's DNS blocking instead?

[gajanq1 0]

On 7/28/2022 at 7:14 AM, fishbasketballaries said:

I haven't used Malwarebytes in years, but I always kept the site blocker switched off due to the fact that it often detected more false positives than actual threats. Perhaps consider checking out AirVPN's DNS blocking instead?

Will AirVPN's DNS block clash with adblocking browser extensions?

[fishbasketballaries 17]

7 hours ago, gajanq1 said:

Will AirVPN's DNS block clash with adblocking browser extensions?

It shouldn't, since DNS blocking would make advertising hosts unreachable, there is nothing less for your adblocker to block.
Edit: This isn't to say a browser adblocker isn't still useful. I imagine some more complex sites like YouTube and Twitch would still need their ads to be blocked locally. Your adblocker will block anything that wasn't caught by AirVPN's DNS lists. Edited ... by fishbasketballaries

[De Facto Pantalones 12]

I use MBAM real-time protection (grandfathered in to a lifetime membership -so I still use it).  I too see these IP flags all the time, just today I see 185.177.94.108 was blocked while I was away from machine.  Quickest fix is right-click on MBAM tray icon and "add exclusion", b/c MBAM tray-icon menu always lists most recent flag.  I will double-check IP for eg., to be cautious, but as usually the case Eddie is connecting to a new server when IP flag happens.  Right click on tray icon is much faster then opening the App to add exclusion (even on fastest machines opening MBAM takes forever).   

[uids1dm0-ew2 1]

On 8/17/2022 at 1:00 PM, De Facto Pantalones said:

I use MBAM real-time protection (grandfathered in to a lifetime membership -so I still use it).  I too see these IP flags all the time, just today I see 185.177.94.108 was blocked while I was away from machine.  Quickest fix is right-click on MBAM tray icon and "add exclusion", b/c MBAM tray-icon menu always lists most recent flag.  I will double-check IP for eg., to be cautious, but as usually the case Eddie is connecting to a new server when IP flag happens.  Right click on tray icon is much faster then opening the App to add exclusion (even on fastest machines opening MBAM takes forever).   

Just a quick thank you for this information and in particular the tip on Quickest fix