Explanation required

[OpaGSim20]

Would the developer care to explain why "Idle Wizard" made an attempted outbound connection to an untrustworthy site? If a game I have run for literally thousands of hours starts trying to burn my PC down then I only feel it's fair play to do my best to burn the game as badly as I am capable.

[sandokanski]

What site?

[OpaGSim20]

Well it was a site blocked by Malwarebytes and I simply closed the warning but without recording the IP address numbers but here it is again: IP Address: 147.75.193.63 without any request by me to access an outside site. I can't tell you what the site is AND I don't care, I just want to know why a program I have run for years is suddenly deciding to act as malware? There is literally zero reason for the game to try and open a website when I can get all my news directly from Steam at the top of my Library page.

[sandokanski]

The program connects to servers. It apparently uploads crash reports (at least it says so in log files) and events (current one is Anniversary) do not work without network connection.

However mine connects to google and amazon cloud services.
The IP you provided is a little bit suspicious.

[Dravkwn]

Packet Host, Inc

[sandokanski]

So cloud service?

Apparently they offer their service to companies that spam people with e-mails.

That's the reason the IP address was marked as "malicious".

[OpaGSim20]

I don't care who the site is owned/run by, I care that a game I have run for 27000+ hours, with Malwarebytes never saying a word about it, suddenly attempting to access any site that is on the Malwarebytes warning page.

[sandokanski]

It was connected all this time to different servers. If you have the calendar with "week of ..." and the current event, then it's connected.

Good news. You can play without network access. Disable the game access to the internet in your firewall. But there will be no calendar events. Nor any of the promo codes will work.

[Kaos]

Originally posted by OpaGSim20:

a game I have run for 27000+ hours

My 7400 hours suddenly feels so inadequate.

It could have been a false flag.
I get them rarely from Kaspersky when a new update comes out.

[sandokanski]

Originally posted by Kaos:

My 7400 hours suddenly feels so inadequate. :lunar2019deadpanpig:

It could have been a false flag.
I get them rarely from Kaspersky when a new update comes out.

I only have about 11000h. And half of the were in a previous game. I did a hard reset at about 5000h. Although I do prefer playing offline if possible. Steam doesn't count that time.

Also it is not a false flag. The IP belongs to a cloud server and parts of it could be used by different company or individuals. One of them used it as a e-mail spam machine. Which is obviously malicious activity. The company that owns the server is Packet Host, Inc. They have 80,000 IP addresses and only few of them (5) are associated currently with some malicious activity. It looks like they proactively care about their reputation and they remove malicious agents from their hosting/cloud services.

[M F]

A program that doesn't respect privacy (by collecting personal information) tells you that Idle Wizard is bad? Does it even tell you why it thinks some ip address is bad? Ever hear about false positives (a frequent problem with so called protection software)? BTW, IP address blocking is a failed solution, it doesn't work reliably as bad guys can change addresses easily but they can also compromise trusted address blocks (which is usually much harder to do). In general, you shouldn't take IPv4 address block alerts very seriously. There's way too much sharing and reassigning because there's not enough to go around, for years now.

As for who's more trust worthy, Idle Wizard or Malwarebytes, I can almost guarantee that what malwarebytes has on you is far worse than anything sent by Idle Wizard. Don't take my word on it, read what Wikipedia has to say. Malwarebytes privacy [en.wikipedia.org]

That said, I trust very few games enough to allow network connections, including Idle Wizard. While the risk maybe pretty low, the reward is even lower, so I block most games.

PS edit: If you do a quick search of the IP, you'll find Malwarebytes is flagging many games as malware without much reason. DuckDuckGo search results [duckduckgo.com]

[sandokanski]

Quite funny indeed. One of the host names for this IP is sdr2-jfk1.valve.net.

So I think your question has to be answered by Steam. Idle Wizard is hosted by Steam, so Idle Wizard using Steam servers isn't suspicious enough, it's expected.

[davidb11]

Malwarebytes isn't known for being a bad program, lol wut.
However, yes, it does have false positives. Black Myth Wukong also had one.

THis is very obviously a false positive.
Why would this game try to connect to a random website?
I mean, except for maybe the official Idle Wizard site. THat would make sense.

Seriously, no company is going to suddenly burn themselves to dust now randomly.
Also, if it was a big thing, a lot of people would get it.

[M F]

Originally posted by davidb11:

Malwarebytes isn't known for being a bad program, lol wut.

At the moment, that may depend on how you feel about companies who report their rivals software as malware. Malwarebytes lawsuit[www.techspot.com] Or how you feel about them sharing your data for marketing purposes, even if "We require such service providers to agree not to disclose your personal information or use your personal information for any other purpose". Not for any other purpose than, marketing?

[davidb11]

Ugh.
Look, I never said it was perfect!
GAH.

[M F]

Originally posted by davidb11:

Look, I never said it was perfect!

No one said anything about perfect. The discussion was about who you should trust, Idle Wizard or Malwarebytes. If you don't think unreliable warnings isn't an indication of being a bad program, we will definitely have to agree to disagree on that point.