Malwarebytes blocks the CDN

essi2 · January 3

Malewarebytes blocks the CDN used by ZOS for serving images, identifying it as Phishing.

Someone at ZOS should reach out to MB about this presumably false detection.

essi2 · January 3

Also can't see if that example embedded properly because of this :shrug:

RandomSilliness · January 3

The MB team has claimed this is a legit block, not a false positive, and this is now affecting a large number of online forums. Seems like the block could be smarter, IMO, if the only thing being read from the CDN is images.

https://forums.malwarebytes.com/topic/321106-usv-cdnnet-fp-check/

ZOS_Kevin · January 3

We are reaching out to Vanilla Forums, our forum provider, to investigate as well.

Kappachi · January 3

RandomSilliness wrote: »

The MB team has claimed this is a legit block, not a false positive, and this is now affecting a large number of online forums. Seems like the block could be smarter, IMO, if the only thing being read from the CDN is images.

https://forums.malwarebytes.com/topic/321106-usv-cdnnet-fp-check/

Did their service get hijacked somehow or something? It's just the content delivery network to show pictures & such isn't it?

TaSheen · January 3

It's a shared hosting network, with a LOT of trojan pdf files in other parts of the network, according to the info I got from MB's customer support this morning.

There's a concern that some of the trojans could propagate due to the shared nature of the server. Hopefully Vanilla has effective/efficient firewalling in place....

ZOS_Kevin · January 3

Our understanding of the current situation is that they are working with Malware Bytes on false positives that are being made. Seems like other Vanilla Forums users are being impacted as well. That is the latest update that we have at the moment. But they are working with Malware Bytes directly to resolve this issue.

TaSheen · January 3

ZOS_Kevin wrote: »

Our understanding of the current situation is that they are working with Malware Bytes on false positives that are being made. Seems like other Vanilla Forums users are being impacted as well. That is the latest update that we have at the moment. But they are working with Malware Bytes directly to resolve this issue.

Good to know, Kevin, thank you.

ZOS_Kevin · January 4

Quick update here. I’ve been told that this issue has been resolved. Please let us know if you get hit with anymore Malware Bytes pings and we can escalate. Thanks again for flagging this.

essi2 · January 4

ZOS_Kevin wrote: »

Quick update here. I’ve been told that this issue has been resolved. Please let us know if you get hit with anymore Malware Bytes pings and we can escalate. Thanks again for flagging this.

Still getting the same Phishing block when the forum tries to load any images. I've checked for MB updates and it says it is up to date.

TaSheen · January 4

I removed the IP block, restarted my machine, and not getting the error popups now. If the situation returns, I'll post back, thanks @ZOS_Kevin! Well, I guess thanks Vanilla too....

essi2 · January 6

@ZOS_Kevin It seems to be resolved now