UBlock Origin - A NETWORK TROJAN - False Positive
Fobio last edited by
I've caught a false positive and maybe this will help others out. If there's a resource or list with these that I can use, please point me in the right direction.
I've posted the following to uBlock Origin:
Behind a pfsense router/firewall and I've been reviewing my firewall logs and 3 out of 4 PC's are running uBlock Origin and of the 3, 2 run it in Chrome. I've noticed that the 2 PC's that run uBlock in Chrome is triggering a NETWORK TROJAN warning, with a dest ip of 22.214.171.124 port 443. The 3rd PC runs a VPN and all traffic is routed through it, so it is bypassing the firewall. I've searched online and found that the trigger is that IP being associated with a botnet C&C server and triggering an alert.
I initially thought that I was infected with malware that is connecting to the botnet server and I didn't find much online. After some more digging, I've found that dest ip of 126.96.36.199 port 443 may be the location of a host file for uBlock. But I can not confirm this. I'd like to confirm whether this is the case so I can put my mind at ease and disable the rule in snort.
Chrome version: Version 54.0.2840.87 m (64-bit)
uBlock Origin version: uBlock Origin v1.9.16
Default filter list
No custom filters
To which I've gotten a speedy reply:
This IP belongs to the Peter Lowe’s Ad server list which you obviously have checked. The links for the lists can be found here. You should report this to the Snort developers - not a uBlock Origin issue.
Link for host file links: https://github.com/gorhill/uBlock/blob/master/assets/ublock/filter-lists.json#L233
I'm going to proceed and suppress the alert for this IP but I have a feeling there are others like this out there too.
Stewart last edited by
Posting here will help us but will likely not do much overall. Snort is owned by Cisco but they haven't changed the submission form here: http://blog.snort.org/2011/01/false-positive-submission-form.html to let them know they have a potential false-positive.
I would think that disabling the rule would be a bad long term solution since it would allow the other malicious sites blocked by the rule to be allowed. My question would be what was going on with the IP that it would be reported as bad. Maybe as an Ad server it was compromised?
u3c307 last edited by
I have ublock on all my pc but no alert in snort. You sure it's not adblock plus usually use yoyo?
Impatient last edited by
I also had that ip 188.8.131.52 flagged by snort but it was Not a false positive.
It is being handled though.
wifiuk last edited by
omg, i have been getting a similar trojan alert and its driving me mad trying to work out where it is coming from
i also have ublock origin, but my snort rule is only showing src as WAN. now how can i tell if this is a false positive if i cant find the local ip