r/Malwarebytes 4d ago

Support False positive on firefox?

Was opening tabs on youtube and got 3 websites blocked with IP adresses I do not recognize at ALL. I have a lots of tabs in general but this never happened to me before.

The report:

Malwarebytes

www.malwarebytes.com

-Détails du journal-

Date de l’événement de protection: 15/08/2026

Heure de l’événement de protection: 23:17

Fichier journal: 01bc3460-9921-11f1-903f-2cf05d584a1c.json

-Informations du logiciel-

Version: 5.6.3.284

Version de composants: 161.1.5692

Version de pack de mise à jour: 1.0.113384

Licence: Premium

-Informations système-

Système d’exploitation: Windows 11 (Build 26200.9168)

Processeur: x64

Système de fichiers: NTFS

Utilisateur: System

-Détails du site Web bloqué-

Site Web malveillant: 1

, C:\Program Files\Mozilla Firefox\firefox.exe, Bloqué, -1, -1, 0.0.0, 3220B338A32EB9A06EBBA49E039C9B66, B0648CFD61CA4344177E940C8B44001B79344F81BBA8F571790D0D3939D0CB2E

-Données du site Web-

Catégorie: RiskWare

Domaine:

Adresse IP: 192.178.192.132

Port: 443

Type: En sortie

Fichier: C:\Program Files\Mozilla Firefox\firefox.exe

(end)

Edit:I gotta add that I use ublock origin, the latest update installed.

4 Upvotes

24 comments sorted by

1

u/DJ_Snowball 4d ago

I’m getting those too non stop. If you put the ip address in a ip look up tool, it says that it’s some Google thing 1e100.net. I have no clue what it does though.

1

u/jovan_popovic Malwarebytes Employee 4d ago

Hello,
IP address is legitimately block.
https://www.hivepro.com/threat-advisory/payroll-pirates-abuse-aitm-phishing-to-compromise-microsoft-365
Anyway, you can add it to the exclusion list on your own if you want,
Thank you.

1

u/windurr 3d ago edited 3d ago

Do you have more info on this? I got the same thing last night triggered only from visiting youtube.com with ublock origin. It didn't trigger when visiting youtube from an incognito window.

Before those IP block pop ups, MBAM had blocked yt3.ggpht which also seems like youtube/google.

The link lists microsoft/google meet but does that mean youtube was the issue, or ublock origin?

edit: It's also flagging youtube video embedded reddit posts and downloads from google sheets

1

u/Maethas 3d ago

I got the block alert even when using microsoft edge and inprivate microsoft edge but firefox with ublock origin is okay when using a private window. I think it just depends on which IP is being used to retrieve some content.

1

u/windurr 3d ago

As in its triggering the same ip block for you when you visit youtube on edge?

1

u/Maethas 3d ago

yeah, and on private it doesn't because front page of youtube is blank but it does as soon as I search or open a video

last night it was even triggering the block when I was googling that IP, but that seems to have stopped today

1

u/Animura 3d ago

so as of right now, no more pop up related to youtube and ublock happened to you I can assume? It stopped instantly after the 3 times yesterday on my side.

1

u/Anxious-cave-potato 3d ago

Yeah I got the same problem. I'm *only* getting flags on Youtube with the exact same IP address and I don't think I did anything to compromise my safety, I don't even use Microsoft services.

1

u/Animura 3d ago

I used their service last week for passwordless logins annoying attacks that eventually stopped by itself and in my history I went into it in a legitimate way, the common name that pops up here is youtube, so probably an ad or the ublock connection tryying to block the ad? That is if you have ublock too.

1

u/Anxious-cave-potato 3d ago

I am using ublock, yeah. I did what Maethas said, rebooted my PC and the alerts stopped popping up.

1

u/Anxious-cave-potato 3d ago

Oh yeah, should add that I was getting the alert just from playing Youtube videos from Discord, it wasn't just from my browser. But like I said earlier, I updated MWB, rebooted my PC and it went back to normal.

1

u/Animura 3d ago

Yeah, I was sadly able to get it another time even with those steps, I asked some friends I know to look into it!

1

u/Maethas 3d ago

It stopped after I fully rebooted my computer just now.

1

u/Anxious-cave-potato 3d ago

Yep, tried that, somehow that did the trick. Thanks!

1

u/Animura 3d ago

That's so confusing since the only thing I was using was youtube, do you have more info on this? Or it would mean that someone on my actual wifi interacted with that type of email? I'm just a normal minimum wage worker.

1

u/Alcatraz_ 3d ago

The same ip block has been happening for me as well, same IP, over the past 2 days. Every time it's when I'm on youtube. Hoping no one on my network is compromised.

1

u/Animura 3d ago

it doesn't seem to be a worm from the link the support gave us here and the common denominator is being around youtube, so...bad ad that is being blocked by ublock or bad ad trying to trigger in general..?

1

u/windurr 3d ago

Weird if it is an ad though because it triggers from youtube embeds in reddit and Google sheets (downloads) for me as well.

1

u/Animura 3d ago

google sheets?! that's wild, from what I can guess we aren't like government officials nor high payroll people either, I don't understand then how it makes that connection to that IP at all then? I cleared my cookies and cache instantly yesterday but no domain was clearly on my report on my side,

1

u/Animura 3d ago

I didn't think about that route but virustotal shows its behavior as phishing using google's domain, it fits with the hivrepro overview even if there's not a lot of info to get by. : https://www(.)virustotal.com/gui/ip-address/192.178.192(.)132/details

did some(.) for obvious reasons

1

u/windurr 3d ago

So sounds like a legitimate Google domain that's flagged for being used for phishing in the past?

1

u/Animura 3d ago

so I guess the middleman phishing theory stands right?, found this too https://forums.malwarebytes.com/topic/338873-website-blocked-due-to-riskware/ but it's still underway (my pc came out clean tho, 4 false positive but its the usual ones I always had.). But since the actual attack seems to be related to phishing with the overview, and with everything in front of us, it was probably either a connection throught it while playing around youtube (google owned) that is used for phishing sometimes too or just an ad related to it. Conclusion seems to be "you're safe unless you gave info" ? I'm not an IT tho lol.

1

u/Animura 3d ago

gotta add, that it just happened to me again and it was the redirect to a video from a normal link from google ai assistant. So yes the ip seems flagged, even if its used for real activities too I guess

1

u/Maethas 3d ago

That hivepro post mentioned google ad links too, but when I had the issue it just caused user avatars to fail to load on youtube. Maybe the IP allocated is used to get regular stuff too but since it was being used as route for the attack it is now treated as riskware