ANSWERED Malwarebytes blocks ip 213.152.187.210

[Zack 0]

Hello
Sometimes I get message from malwarebytes that app X has tried to connect to ip 213.152.187.210 on port Y

The only info I can find about about this IP is that it seems to be on the same range as the AirVPN servers in Netherlands uses  and that this IP is blocked due to its related to an trojan:
https://www.malwarebytes.com/blog/detections/213-152-187-210

Anyone here has more info about this?

[Staff 10470]

@Zack

Hello!

The IP address you mention is assigned to AirVPN server Asellus in the Netherlands. Please mention explicitly port Y, we want and must verify what your app (mention the app too if possible) will find on that port, it's important.

Kind regards
 

[Zack 0]

5 hours ago, Staff said:

@Zack

Hello!

The IP address you mention is assigned to AirVPN server Asellus in the Netherlands. Please mention explicitly port Y, we want and must verify what your app (mention the app too if possible) will find on that port, it's important.

Kind regards
 

The program is tailscale and the port is 54037 in this case 🙂

I do have an Netherlands AirVpn server setup as an tailscale exit node, but this pc does not use any exit nodes.

[Staff 10470]

11 minutes ago, Zack said:

The program is tailscale and the port is 54037 in this case 🙂

I do have an Netherlands AirVpn server setup as an tailscale exit node, but this pc does not use any exit nodes.

Hello!

There's nothing listening to port 54037 on any AirVPN server. We can't see why Tailscale seeks a connection to it, anyway we are sure now that there's no malware there as there's nothing. Probably Malwarebytes behavior comes from some past event or it's yet another over-blocking case.

Kind regards
 

[Zack 0]

13 minutes ago, Staff said:

Hello!

There's nothing listening to port 54037 on any AirVPN server. We can't see why Tailscale seeks a connection to it, anyway we are sure now that there's no malware there as there's nothing. Probably Malwarebytes behavior comes from some past event or it's yet another over-blocking case.

Kind regards
 

According to the link in my first post, the entire range is flagged at Malwarebytes due to some adresses has been related to troians at one point.

But nice to know nothing listens on that port, makes little sense to me 

[Staff 10470]

4 minutes ago, Zack said:

the entire range is flagged at Malwarebytes

Hello!

The "range" is specified by mask /32, so it's this single unique address. Yes, it's plausible that some past event flagged the IP address.
 

5 minutes ago, Zack said:

nice to know nothing listens on that port, makes little sense to me 

We don't know the internals of Tailscale but definitely this behavior should be investigated. Why an attempted connection to this specific IP address and why this port?

Kind regards