ipify.org domain blocked due to being reported as malware related

[chrisma]

First off, thanks for providing this service!

Unfortunately it seems that Bitdefender anti-virus has listed the domain ipify.org as serving malware.
This may be because some malware authors have used the ipify.org service in their executable, see: https://malwr.com/analysis/NDY2YWRkOGU3MTAzNGVkNDgwNmVmMzQwZGI5ODVkNTE/
This occurs with the lastest version of Bitdefender (1.0.21.1099).

[rdegges]

Thanks for the report! That's really annoying :( I'm trying to get in contact with them now. I couldn't see any easy way, so I tweeted them. Will update this issue as I hear back =)

[chrisma]

Hi,
thanks for the fast reply!
Unfortunately it seems that Bitdefender is not the root of the problem.
The domain api.ipify.org has made it onto the Malware Domain Blocklist (which is e.g. used per default by µBlock)

[rdegges]

Just talked to bitdefender -- I submitted the URL to them. They're reviewing it and will remove it soon I hope. I'll also try to contact the malware domain blocklist.

[rdegges]

Here's bitdefender's email:

I also just emailed the malware guys about getting it removed from there -- will update when I hear back.

[rdegges]

Haven't heard anything back, but since this stuff is out of my control anyhow: closing the issue.

[chrisma]

It seems your efforts were not in vain though :)
The current Malware Domain Blocklist does not seem to list api.ipify.org anymore

[rdegges]

yey!

[tagallow]

hpHosts by Malwarebytes still lists api.ipify.org in their malware list (EMD)

https://hosts-file.net/emd.txt

List classifications: https://hosts-file.net/?s=classifications

EMD - Sites engaged in malware distribution
This classification is assigned to website's engaged in the distribution of malware (e.g. adware, spyware, trojans and viruses etc).
Sites with this classification typically either contain files (e.g. cracks, keygens, adware, spyware, trojans, viruses et al) or lead to such via (for example) "fake scanners" or other social engineering and misleading tactics. This includes the activities of rogue Internet Service Providers (ISPs) that host other sites to which the EMD classification applies.

I know this is closed, but just wanted to let you know!

[rdegges]

Bummer! It's so annoying that providers falsely misclassiffy a generic API service as malware. Really goes to show ya how poor these malware lists are =/

[rdegges]

I just tweeted @Malwarebytes: https://twitter.com/rdegges/status/933394889387077633

It's pretty much impossible to get a hold of them any other way that I can see, so hopefully they respond and take care of it >.>