SOLVED IX charts & Trojan

[Martin Jones]

I recently upgrade from Core to Scale with no problems except when I opened the official IX Trucharts. Immediately a Malwarebytes Screen opened with a Trojan alert. This applies to WWW. Truenas.com through port 443 and an IP address of 204.94.90.1. Because I dont have an IP address in that range at first I ignored it as a false positive. I deleted google chrome thinking that it was the problem but then found the same issue with MS edge. This only occurs when I open "Available applications" . Thoughts?

 

[danb35]

I opened the official IX Trucharts.

There is no "official iX Tru[e]charts." Truecharts is a third-party app catalog for TrueNAS SCALE; it has no connection at all with iXSystems. So what exactly are you doing when you get that warning?

 

[truecharts]

This is not a Trojan warning, it's their webfilter.

It has nothing to do with Trojans, nor is anyone going to help you with just that screenshot because there is no information given on WHY your webfilter (not your anti virus!) is flagging the website/IP.

Most likely it's not ours, as all our icons (which get loaded on loading the available applications page) are served from cloudflare and all our apps (loaded when clicking the refresh button) are served from Github.

*Edit*
It's indeed not us, the IP is from protocol.ai
iX most likely uses their website for their IPFS App (we don't).

 

[stavros-k]

It's from the Official Chart IPFS. The Icon is loading from "ipfs.io"

Code:

$ nslookup ipfs.io
Server:         172.26.144.1
Address:        172.26.144.1#53

Non-authoritative answer:
Name:   ipfs.io
Address: 209.94.90.1
Name:   ipfs.io
Address: 2602:fea2:2::1

 

[Martin Jones]

Thanks for all of your assistance but now I?m really confused. I was under the assumption that there are two sets of Truecharts.
1. Offical, created by IX Systems
2. Trucharts created.

I have no idea what my "web filter" is! Or if I am even using one!

Is it from The official chart IPFS? whatever that is!

Now thats another learning experience, but what do I do? Just ignore the response, not trust Malwarebytes and treat it like a false positive? When I go online to check the IP 209.94.90.1 there are many reports of this IP being well known for malware etc. Or should I be talking to someone else?

 

[indivision]

It sounds like an icon that is loaded for one of the apps comes from an IP address that has been flagged for naughty behavior. So, your Malwarebytes web filter is warning you about it.

How cautious you need to be is ultimately up to you. To me, loading an icon doesn't seem very dangerous (but you never know!).

There is probably an option in Malwarebytes for you to "whitelist" that IP address and stop the warnings if thats what you want to do.

 

[danb35]

I was under the assumption that there are two sets of Truecharts.

There are (currently) two sets of charts: the iX official charts, and the much larger third-party set from Truecharts. There's no reason there can't be other sets, but I'm not aware of any.

But here's what's happening. iX have created an app (a chart) for IPFS, a "peer-to-peer hypermedia protocol designed to preserve and grow humanity's knowledge by making the web upgradeable, resilient, and more open." The card that shows up uses the icon from IPFS themselves, which comes from ipfs.io. And if you look up the IP address for ipfs.io, it's 209.94.90.1. So that's why your system is trying to reach that IP address.

Why does your browser complain? No idea there.

 

[Martin Jones]

DanB, thanks for your explanation, I see the IPFS app as you suggested, I searched for it and found both the IX official chart and the Truechart version. I will go back to Malwarebytes with this info and see what they say. Very helpful response.

 

[truecharts]

DanB, thanks for your explanation, I see the IPFS app as you suggested, I searched for it and found both the IX official chart and the Truechart version. I will go back to Malwarebytes with this info and see what they say. Very helpful response.

There is no reason to spend more time on this by going to malwarebytes. you already have trouble with some basic skills, which is totally okey, and a customer service representative is most-likely just going to confuse you even more than needed. (and not even have the authority to whitelist ip's anyway)
It's a warning and It's a false positive at that.

You decided (you installed it with malwarebytes) to install their webfiltering software with their firewall. Webfiltering software is known for false positives and this is one.
To be honest: You need to learn to deal with that... because there will be more...

 

[Martin Jones]

Great Answer, Thanks for the inofrmation.