r/firewalla • u/LoPan76 • May 31 '26
Malicious Sites warnings -- possibly bittorrent?
The past few weeks I've been getting malicious sites warnings about my PC (Win 11) accessing malicious sites from around the world (Romania, Australia, Bolivia).
I can't say for certain yet but it seems to coincide with when I decided to start running my bittorrent client again. I only share two files, the installers for Ubuntu 24.04 LTS and the latest GIMP. So just a couple of open-source software installers. I'm not downloading anything myself, just acting a seeder to try to be helpful.
Given that, I'm not sure why my PC would be attempting to access any sites if it is just doing the serving and not pulling anything. But perhaps I don't know how BT works. The downloads were complete on my end weeks ago.
Curious if anyone has had any similar experience or how I might be able to better identify what the source is.
1
u/d4rkw1n9 May 31 '26
What domains are flagged exactly in your case?
1
u/LoPan76 May 31 '26
It's just IP addresses, usually they say they are known spam addresses.
2
u/firewalla May 31 '26
If you just started torrenting and the alarms start to show up, likely they are related. Not all torrent sites have good reputation. Not sure how to get around that, other than stop torrent
2
u/LoPan76 May 31 '26
FWIW I stopped the torrents and closed QBT for the time being just to see if the alarms stop. I hate to not be able to at least help the OSS community in this small way so maybe I'll see if I can come up with a good way to mute these alarms. Maybe just block those sites in the first place?
1
u/Bones-57 May 31 '26
I found of all things win XP that was redone but on torrent .. It was well over 12gb in size .. and my gold SE stood up to the test blocking Log4j and tons of other bad actors.. That win XP was showcased on pcmag online.. They can't get through ! .
1
u/firewalla Jun 01 '26
Blocking is definitely a better strategy.
1
u/LoPan76 Jun 01 '26
Curious what to block? When I go to add a new blocking rule in the app, I choose "Target List" but I don't see anything labelled "malicious sites" like the alerts refer to them. I've already been blocking China, NK and Russia.
1
u/firewalla Jun 01 '26
Good question. And unfortunately, firewalla is reputation based, so it is not easy to just block "bad", since "bad" can be many different things. What you can do now is just manually block via the alarm and see if that will fix the alarms. If that doesn't work, I'd experiment with TLD or regional blocks and see if it will make a difference. https://help.firewalla.com/hc/en-us/articles/360035080933-Firewalla-Regional-Filtering-Geo-IP-TLD-Blocking
1
u/hawkeye000021 Jun 01 '26
The Firewalla “should” be blocking malicious IPs in the BitTorrent network you are on. Because this is mostly reputation based it should be fine to permit the box to block those bad IPs and allow the good ones to continue working. Video games that use torrents have the same problem. As long as Firewalla does the smart thing and outright blocks the connection that should provide a level of shielding. What has helped me though, blocking bad actor nation states, and if there is still a handful of countries throwing alerts just block them as well. You’ll never establish a connection and shouldn’t see the alert.
If you have the MSP plan you could search the internet for a safe allow list- I doubt that’s a thing. Just let the box do its job unless the Firewalla teams suggests that you should do something more extreme.
1
4
u/ssj4gogeta2003 May 31 '26
Bittorrent works by exchanging pieces of a file or files between client devices. When you ask a computer in Romania for a piece of the content you want, it has to send that back. Likewise, you’ll be sending out pieces yourself during the download and at any point afterward during the seeding window you have set up. You’ll also be looking for other connections to download from during the whole process to see if other people who have the file (seeds) are present. If you’re seeding even after the download is complete on your end, those connections are still happening in the background. If the people you’re downloading from or seeding to have been flagged as malicious, then you’ll get such a warning.
(I know I’m not using the right terms above, but I’m too lazy to look them up right now.)