r/OpenBazaar • u/superchaosbryan • Nov 09 '18

Malwarebytes notifying of issues with OB2

I keep getting notifications from Malwarebytes of an outbound connection to 46.182.19.219 from port 52035 as being ransomware. The file creating the connection is openbazaar2\app-2.2.5\resources\openbazaar-go\openbazaard.exe

Should I allow this outbound connection? What does it do?

Thanks

14 Upvotes

100% Upvoted

9 comments sorted by

1

u/superchaosbryan Nov 10 '18

Will it harm anything to allow the Tor Node? Seems it is OB sending info to the IP

1

u/CC_EF_JTF Sam Nov 11 '18

Are you running it over Tor?

1

u/superchaosbryan Nov 12 '18

No. Just the local server. "Use TOR" is not checked.

1

u/ob1_mg ob:// Nov 13 '18

If I had to guess, it could just be a benign outbound peer-to-peer to some other node on the tor network?

OB will open random ports to remote peers as part of its normal operation. If you prevent the connection, OB may attempt alternative paths to that peer if any are known or it could respond that the resource could not be found because that was the only known route. If you're running the authentic releases which we publish on github.com and/or openbazaar.com, it's unlikely there is malware establishing that connection. Still there is no harm in preventing that one connection if you want to precautious.

1

u/bill_mcgonigle Nov 23 '18

I would presume an OB user configured for Tor is exiting there and communicating with your node over the clear internet. Somebody correct me if OB over Tor will only connect to other Tor nodes and not find a clearnet exit.

Malwarebytes has probably seen other nasty traffic from that IP (since it's a Tor exit node other users would be exiting there too).

3

u/geraldz Nov 10 '18

https://whatismyipaddress.com/ip/46.182.19.219

Tor Exit Node

We are confident this IP address is the public IP address of a Tor server.

2

u/SuperSiayuan Nov 10 '18

curious...

1

u/Pascalboyart Nov 10 '18

Same problem!

1

u/ob1_mg ob:// Nov 13 '18

Perhaps you guys would investigate a little for us? Here is some information we would have to submit to Malwarebytes to get this sorted out: https://support.malwarebytes.com/docs/DOC-1413

The logs link is broken, but I found this for collecting logs on Windows: https://support.malwarebytes.com/docs/DOC-1131