Steam games accessing IP address blocked by Malwarebytes

[Crashed]

I have been getting block messages from Malwarebytes regarding IP address 147.75.193.63 when playing games on Steam.

According to https://forums.malwarebytes.com/topic/320315-steam-blocked-website/ Malwarebytes has so far decided not to unblock the IP address.

To any Valve employees reading, please get in touch with Malwarebytes ASAP.

[ペンギン]

Originally posted by davidb11:

What does that even mean?
Sorry, but I don't see why you are claiming goofy things about Malwarebytes to an extent no one has ever done about Kaspersky, which is saying something, since it's made by Russians. :P

I can't quote you, because your coding tag is bugging out the quoting process.

If you don't have any facts, why are you posting? I could also post something about Kaspersky, but you wouldn't believe it either, about MS Defender too, about G-Data about Avast and some more.

Edit:
Screenshot attached for the cautious people
https://steamcommunity.com/discussions/forum/1/591756872987503820/?ctp=3#c591757083455529908

I could also post a lot about the so-called cleaner programs. Of course, all with data examples. It's not like such behavior can't be proven. But it has already been done and anyone who wants to find something can find it.

[davidb11]

This is a discussion thread.
I am here to discuss things.
But it is fair if you don't want to do so.

Whatever, I apologize to Crashed for messing up the thread by replying to you.

[Crashed]

Here are the reports Malwarebytres is going by:
https://www.abuseipdb.com/check/147.75.193.63
https://www.abuseipdb.com/check/103.10.125.155
Most recent abuse logged was on the 6th of December.

[davidb11]

Originally posted by Crashed:

Here are the reports Malwarebytres is going by:
https://www.abuseipdb.com/check/147.75.193.63
https://www.abuseipdb.com/check/103.10.125.155
Most recent abuse logged was on the 6th of December.

Yeah. Which makes it mostly a valid reason for Malwarebytes to be this upset.
Hopefully everything does get resolved soon.
And the servers stop being attacked.

[Elucidator]

Originally posted by davidb11:

What does that even mean?
Sorry, but I don't see why you are claiming goofy things about Malwarebytes to an extent no one has ever done about Kaspersky, which is saying something, since it's made by Russians. :P

I can't quote you, because your coding tag is bugging out the quoting process.

He is correct though.

Malwarebytes, much like other software that started relying on standard frameworks that collect data and send this to services like amazon, google, etc.
This telemetry data is used to create profiles of your usage of your own PC.

This telemetry data stream, when blocked by for example adding the URL or IP involved to the hosts file, causes certain software, like MalwareBytes to pretend your system is infected with something or claim it will stop working.
This is complete nonsense, but this kind of practise has been on going ever since Microsoft started falsely claiming that the system got a virus when you add links to Hosts
and later completely prevent you from altering the Hosts file directly.
and then even later ensure certain links cannot be added to the Hosts file, because .... your data is just that much worth

(well even that last part can be circumvented, but the point is that it is very difficult now)

The guy is just trying to warn you that Malwarebytes is, whether intentionally or not, doing more than just protecting your system. And that more is something you're not made aware of and something you likely wouldn't like.

---
Just read his blog. He has been doing deeper analytics on what connections a program actually requires and what not for many years. They have a whole list of software.

You can verify it yourself if you're willing to put some effort into it. If not you can trust commentary given on false positives. This guy clearly knows more about Steam than I do lol.

[davidb11]

I've never seen him before this thread.
I don't know why or how he should be trusted over everyone else on Steam.
LOL wut.

Did he had another name.

Also, even on Windows 10, I know the hosts file can be edited.
Heck, I've done that.

So....

I'm skeptical of anyone claiming silly things about programs that used to be well respected.
Never heard of Microsoft talking about links like that.

[Elucidator]

@Penguin
Interesting site / blog. Never heard of it before.

Just wanted to mention that here:
https://gameindustry.eu/en/search/?suchbegriff=malwarebytes

The link to the review redirects to:
https://gameindustry.eu/blog/malwarebytes-luegt-und-aendert-hosts/

and this is a page that doesn't exist.
Apparently the correct URL if I understand your previous post is:
https://gameindustry.eu/blog/malwarebytes-luegt-und-aendert-hosts/en

Anyway cool.

Considering cleaners:
https://www.malwarebytes.com/blog/news/2015/06/digital-snake-oil
malwarebytes did their own blogpost about that by the way.

[davidb11]

I am skeptical without enough concrete evidence.
Again, I've edited the hosts file on Windows 10, it's actually not that hard.
Google makes that very simple.

And literally notepad with admin privileges is enough.

[Elucidator]

Originally posted by davidb11:

I am skeptical without enough concrete evidence.
Again, I've edited the hosts file on Windows 10, it's actually not that hard.
Google makes that very simple.

And literally notepad with admin privileges is enough.

Just saying

Malwarebytes is fine generally. It does what it advertises to do.
I use it myself, the official 'free edition'. Not the premium one, not a pirated one. I just run it, scan stuff, close it, that is how it use it and it works fine using it like this.

For most normal users the program will simply do what it should be doing, however-- malwarebytes does get greedy.
as in, more and more, you're being bothered to upgrade to premium or threatened that you're no longer protected properly when you don't have premium.
This implication that you're dependent on them and their premium stuff is complete nonsense.
and this has been brought up even on their own forums, so they're slowly damaging their own reputation.

but you're correct, you do not need to be afraid when using malwarebytes, but remain sceptical.

For example, it will detect some debugging software as Potentially Unwanted Software (specifically the stored memory table files for whatever reason), which makes no sense, and it might also by default immediately try to remove this without a clear justification.

so make sure you control Malwarebytes and not let malwarebytes just run loose basically.

Penguin just reminds you that Malwarebytes is a for profit company that will do sneaky stuff to get their pennies. Most of the problems penguin mentioned though seem related to the premium version; I have not detected Always Online issues for example with the free version.

-- I'll make a late edit here:
I disagree that malwarebytes is digital snake oil.
It seems pretty aggressive in its methods to protect its own financial interest (through their own official methods) but not in the indirect methods (through telemetry).
other than this it doesn't, so far I know, abuse its position of trust and it functions properly.
The implication of it editting 'user files' in itself is deceptive as, it makes people think of this being a large cluster of files, even though it is practically just the Hosts file and whatever it detects in its list.

[davidb11]

THat does make a lot of sense, yeah.

[Dura_Ace]

Originally posted by Crashed:

Originally posted by Satoru:

I love how this is a “steam” problem and not “malware bytes is trash”. Malware bytes is getting close to AVG territory if usless

They did cite the reason they blocked the IP addresses.

And for that reason alone the advice to whitelist a potential vector of attack is bordering on the ludicrous. Just so you can go back to gaming you are willing to potentially let an avenue of attack continue unabated?

No wonder kids are handing out their steam credentials like candy and then say....mez hackzors.

DCS, the game, has one single encrypted file in its library. People keep saying to whitelist it as it is the AV fault for flagging a false positive.

At which point i say you have no idea if that is a false positive or not, as the file is encrypted so how would you know?

It is most likely fine but nobody can say for certain that the file is not nefarious in nature.

People are way too quick to trust. Way too quick.

[Cinemax]

Originally posted by Floid:

Originally posted by Muppet among Puppets:

They did not tell a reason why you should not connect to the ip.

Malwarebytes did actually site why they have added the IP to their blocked list :

https://forums.malwarebytes.com/topic/320315-steam-blocked-website/

See the second post by Porthos
It's not a false positive - it's being blocked for good reason. The host / domain / IP is currently being brute forced, meaning that it's classed as a compromised IP.

If an IP such as this one that alot of games use, were to be successfully compromised, then all the games that make a connection to that IP could potentially be vehicles for facilitating port scanning, if I understand correctly.

And since this IP seems to be used by ALOT of games (Darktide , Borderlands 3 , Space Engineers , Stalker 2 , Counter Strike 2 , Outlast Trials ... the list goes on and on)
If the IP were jacked then potentially hundreds of thousands of steam players could end up having a real bad day ?

Targeted backend attacks such as these (Steam API IP's / Steamworks IPs / Hosting services) have apparently been going on for a while, because if one of them were to be successful one day then that would potentially grant access to steams 30 million average user base.

That is some limp ♥♥♥♥♥♥ reasoning. How many millions of machines access m365's domains?
If one of the domains were compromised (as m365 has been in the past just not a DNS hijack specifically) then OMGWTF?
BGP attacks attempting to redirect traffic I'm guessing. That isn't even on the entity currently controlling the IP address, it's on the ISPs to prevent malicious traffic reroutes to China and Korea.
Still if that does happen you could detect it with in seconds and block the traffic misrouting to the foreign adversary. The fact that they don't ♥♥♥♥♥♥♥ Okta, M$FT, iCloud etc etc etc etc etc who all are targeted with BGP attack attempts speaks volumes.

[davidb11]

What are you talking about?!?!
It's literally a big issue.
Why would you downplay it, Cinemax?

[Ettanin]

The listed IPv4 address is shared between multiple services. Valve uses the ports 27015 to 27060.

This IPv4 address also contains servers of Restream and Redhat Workshops.

[Crashed]

Originally posted by Elucidator:

@Penguin
Interesting site / blog. Never heard of it before.

Just wanted to mention that here:
https://gameindustry.eu/en/search/?suchbegriff=malwarebytes

The link to the review redirects to:
https://gameindustry.eu/blog/malwarebytes-luegt-und-aendert-hosts/

and this is a page that doesn't exist.
Apparently the correct URL if I understand your previous post is:
https://gameindustry.eu/blog/malwarebytes-luegt-und-aendert-hosts/en

Anyway cool.

Considering cleaners:
https://www.malwarebytes.com/blog/news/2015/06/digital-snake-oil
malwarebytes did their own blogpost about that by the way.

It makes perfect sense that Malwarebytes would block HOSTS file modifications that block it servers, because that is a strategy used by malware to interfere with attempts to install or update antivirus software to remove the infection.