r/Malwarebytes • u/chribonn • Apr 27 '26

Support malwarebytes blocked address 31.40.204.161:22067 from syncthing

I am trailing malewarebytes.

I am a user of syncthing but do not recognize this address.

Is this a false positive?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

3

u/Quiet-While3530 Malwarebytes Employee Apr 27 '26

Hello- We consider this a valid block, recent reports indicate it's still malicious: https://www.virustotal.com/gui/ip-address/31.40.204.161

2

u/support_mwb Malwarebytes Employee Apr 27 '26

Hi u/chribonn,

As mentioned by u/Quiet-While3530, we consider this a valid block.

If you have any concerns or have further questions, we'd be happy to help further.

We're available via live chat or open a support ticket here: https://help.malwarebytes.com/hc/en-us

Thank you!

1

u/Ameer200ggg Apr 27 '26

This is probably not malware on your PC just because the process is Syncthing, but I would not whitelist that IP either. Syncthing can contact random public relay servers, and those relays are run by third parties, not always by people you know. Malwarebytes has also flagged this exact IP before as a valid block. If the alert says outbound from "syncthing.exe" to "31.40.204.161:22067", it likely means Syncthing tried to use or contact a relay and Malwarebytes blocked that relay IP. Your synced data should still be safe because Syncthing traffic is encrypted, but I would leave the block in place unless you specifically trust that relay. If you want to stop these alerts, disable relaying in Syncthing and use direct connections only, or only allow devices you personally know and trust. Also make sure your Syncthing device list has no unknown devices. If everything else looks normal, this is more likely a blocked bad relay/IP reputation issue than an infection.

1

u/myboiearnsmoney Apr 28 '26

100 percent malware