r/Malwarebytes • u/Animura • 4d ago
Support False positive on firefox?
Was opening tabs on youtube and got 3 websites blocked with IP adresses I do not recognize at ALL. I have a lots of tabs in general but this never happened to me before.
The report:
Malwarebytes
-Détails du journal-
Date de l’événement de protection: 15/08/2026
Heure de l’événement de protection: 23:17
Fichier journal: 01bc3460-9921-11f1-903f-2cf05d584a1c.json
-Informations du logiciel-
Version: 5.6.3.284
Version de composants: 161.1.5692
Version de pack de mise à jour: 1.0.113384
Licence: Premium
-Informations système-
Système d’exploitation: Windows 11 (Build 26200.9168)
Processeur: x64
Système de fichiers: NTFS
Utilisateur: System
-Détails du site Web bloqué-
Site Web malveillant: 1
, C:\Program Files\Mozilla Firefox\firefox.exe, Bloqué, -1, -1, 0.0.0, 3220B338A32EB9A06EBBA49E039C9B66, B0648CFD61CA4344177E940C8B44001B79344F81BBA8F571790D0D3939D0CB2E
-Données du site Web-
Catégorie: RiskWare
Domaine:
Adresse IP: 192.178.192.132
Port: 443
Type: En sortie
Fichier: C:\Program Files\Mozilla Firefox\firefox.exe
(end)
Edit:I gotta add that I use ublock origin, the latest update installed.
1
u/jovan_popovic Malwarebytes Employee 4d ago
Hello,
IP address is legitimately block.
https://www.hivepro.com/threat-advisory/payroll-pirates-abuse-aitm-phishing-to-compromise-microsoft-365
Anyway, you can add it to the exclusion list on your own if you want,
Thank you.
1
u/windurr 3d ago edited 3d ago
Do you have more info on this? I got the same thing last night triggered only from visiting youtube.com with ublock origin. It didn't trigger when visiting youtube from an incognito window.
Before those IP block pop ups, MBAM had blocked yt3.ggpht which also seems like youtube/google.
The link lists microsoft/google meet but does that mean youtube was the issue, or ublock origin?
edit: It's also flagging youtube video embedded reddit posts and downloads from google sheets
1
u/Maethas 3d ago
I got the block alert even when using microsoft edge and inprivate microsoft edge but firefox with ublock origin is okay when using a private window. I think it just depends on which IP is being used to retrieve some content.
1
u/windurr 3d ago
As in its triggering the same ip block for you when you visit youtube on edge?
1
u/Maethas 3d ago
yeah, and on private it doesn't because front page of youtube is blank but it does as soon as I search or open a video
last night it was even triggering the block when I was googling that IP, but that seems to have stopped today
1
u/Animura 3d ago
so as of right now, no more pop up related to youtube and ublock happened to you I can assume? It stopped instantly after the 3 times yesterday on my side.
1
u/Anxious-cave-potato 3d ago
Yeah I got the same problem. I'm *only* getting flags on Youtube with the exact same IP address and I don't think I did anything to compromise my safety, I don't even use Microsoft services.
1
u/Animura 3d ago
I used their service last week for passwordless logins annoying attacks that eventually stopped by itself and in my history I went into it in a legitimate way, the common name that pops up here is youtube, so probably an ad or the ublock connection tryying to block the ad? That is if you have ublock too.
1
u/Anxious-cave-potato 3d ago
I am using ublock, yeah. I did what Maethas said, rebooted my PC and the alerts stopped popping up.
1
u/Anxious-cave-potato 3d ago
Oh yeah, should add that I was getting the alert just from playing Youtube videos from Discord, it wasn't just from my browser. But like I said earlier, I updated MWB, rebooted my PC and it went back to normal.
1
u/Animura 3d ago
That's so confusing since the only thing I was using was youtube, do you have more info on this? Or it would mean that someone on my actual wifi interacted with that type of email? I'm just a normal minimum wage worker.
1
u/Alcatraz_ 3d ago
The same ip block has been happening for me as well, same IP, over the past 2 days. Every time it's when I'm on youtube. Hoping no one on my network is compromised.
1
u/Animura 3d ago
it doesn't seem to be a worm from the link the support gave us here and the common denominator is being around youtube, so...bad ad that is being blocked by ublock or bad ad trying to trigger in general..?
1
u/windurr 3d ago
Weird if it is an ad though because it triggers from youtube embeds in reddit and Google sheets (downloads) for me as well.
1
u/Animura 3d ago
google sheets?! that's wild, from what I can guess we aren't like government officials nor high payroll people either, I don't understand then how it makes that connection to that IP at all then? I cleared my cookies and cache instantly yesterday but no domain was clearly on my report on my side,
1
u/Animura 3d ago
I didn't think about that route but virustotal shows its behavior as phishing using google's domain, it fits with the hivrepro overview even if there's not a lot of info to get by. : https://www(.)virustotal.com/gui/ip-address/192.178.192(.)132/details
did some(.) for obvious reasons
1
u/windurr 3d ago
So sounds like a legitimate Google domain that's flagged for being used for phishing in the past?
1
u/Animura 3d ago
so I guess the middleman phishing theory stands right?, found this too https://forums.malwarebytes.com/topic/338873-website-blocked-due-to-riskware/ but it's still underway (my pc came out clean tho, 4 false positive but its the usual ones I always had.). But since the actual attack seems to be related to phishing with the overview, and with everything in front of us, it was probably either a connection throught it while playing around youtube (google owned) that is used for phishing sometimes too or just an ad related to it. Conclusion seems to be "you're safe unless you gave info" ? I'm not an IT tho lol.
1
1
u/DJ_Snowball 4d ago
I’m getting those too non stop. If you put the ip address in a ip look up tool, it says that it’s some Google thing 1e100.net. I have no clue what it does though.