OS trying to access a potentially unsafe site????

Today Malwarebytes threw up a strange pop-up "Microsoft Windows OS (app) tried to access a potentially risky site" - blocked. How do I know which is the potentially unsafe site which the OS tried to access?

Dunno. Not much info there.

Have you asked about this over at the Malwarebytes Forums?

That /24 address block is owned by a private entity in Singapore, with hidden registration.

Google search reveals that "14.102.231.0 - 14.102.231.255 is an IP address range owned by Edgevana, Inc. and located in Singapore"

Malwarebyte blog Malwarebytes Threat Alert | 14.102.231.201 says

Short bio: The IP address 14.102.231.201 was blocked by Malwarebytes because it is associated with riskware.​

Malicious behavior: Server(s) at this IP address were found to host malware and act as a Command & Control server.​

Protection: Malwarebytes blocks the IP address 14.102.231.201 because it is associated with riskware.​

My question: Why should Windows OS svchost.exe try to access that website all of a sudden?

Very likely some malware got on your computer and used svchosts.exe to execute.
svchosts.exe is a Window utility used to run any number execuatable files, including DLLs. What file is actually executed is very difficult to tell because that's passed to svchosts.exe as command line arguments. Assuming this "app" is persistent and is running in the background, you can open Task Manager and check if you can spot any strange or unfamiliar file type or file name. You would be looking for something that doesn't belong to Windows or Microsoft.

In the Malwarebytes dialog box there is an IP address : 14.102.231.208, on port 80. You can use various websites to check what site the IP address belongs to, but you're likely to get conflicting information. I checked a few site for the IP address and it seems to be a crypto server farm in Singapore. It also seems that the site uses various IP addresses in the range of 14.102.231.0 to 14.102.231.255. These addresses seem to be associated with edgevana.com.

The port 80 is for http (not the secure https), so what ever this is sending is not encrypted.

Anyway, if you can't find more precise info in Malwarebytes it would be very difficult to find the actual file or registry hook for this.
Did you download and/or install something shady recently?
You can use the Windows firewall to block the entire IP address range. Also use the hosts file (in C:\Windows\System32\drivers\etc) to block the URL for edgevana.com.

Sorry if you're not familiar with any of these suggestions - you're going to have to learn new stuff.

jumanji said:

My question: Why should Windows OS svchost.exe try to access that website all of a sudden?

Click to expand...

Because Malwarebytes triggered it?

SumpterX said:

............Did you download and/or install something shady recently? ''''''

Click to expand...

No, I haven't installed any application recently and I am not a gamer.. In fact I am uninstalling the most genuine applications which I have been using for long since I no longer use or need those. My PC is always clean and I do not visit any shady websites. All the reasons why I am surprised with this pop up .

TCPView from Sysinternals (now Microsoft) is a more friendly utility, it shows the executable which initiates IP request.
TCPView for Windows - Sysinternals

@jumanji you can use Process Explorer to check all process digital signature also scan processes for malware infection.

This guide explains how to use Process Explorer, to spot malicious software running on a computer.

Delete temporary internet files.

@Slavic

"When you start TCPView it will enumerate all active TCP and UDP endpoints,"
As I understand from the above , TCP view will enumerate all active TCP and UDP endpoints. Will it show an event that happened about four hours ago unexpectedly and that which was blocked?

A good suggestion in any case which I will keep in mind and use when necessary,

jumanji said:

Will it show an event that happened about four hours ago unexpectedly and that which was blocked?

Click to expand...

No, TCPView shows only the active sessions or those which were started recently and are not closed yet. As for past events, they may be found in Event Viewer, but not all events are stored there. Past TCP/IP sessions definitely are not, but blocking event from Malwarebytes may be shown there or in its own logfile.

P.S. To see in realtime who attempts to start that session, need to unblock it, in other words, temporarily disable antimalware protection. And this may be potentially risky. Usually such tests are performed in virtual environment (virtual machines). I wouldn't suggest to do this on real PC. You can disconnect PC from network to avoid this risk, but session will not be established. TCPView still will show the local processes and ports, but not the remote addresses.

@FreeBooter , Thanks for chipping in.

There is no malware on my PC - 100%..
Malwarebytes clearly indicates that it is Windows that has initiated the connection and Malwarebytes has blocked it since it is a risky website. We also know the destination is "14.102.231.0 - 14.102.231.255 is an IP address range owned by Edgevana, Inc. and located in Singapore" "Server(s) at this IP address were found to host malware and act as a Command & Control server." Crypto Currency ????. Please see my post #4



Malwarebytes says that the connection was initiated by Windows OS.. How can it be and what triggered Windows to connect to the risky website? That is the point under discussion - not hunting for malware which does not exist on my PC.. Just to make sure I did a Full scan with Malwarebytes and it did not find any malware.

I never think there is malware but using Process Explorer you can view which service or process causing the connection there we can determine cause of action from properties of each svchost.exe you can view network connections.

Each svchost.exe host multiple services and processes.

Run a Rootkit scan, if you haven't already done so.

Third-party services can use Svchost.exe, don't blame Microsoft!

In your screenshot did you click on 'learn more'?

Just accept the warning! Click on 'Got it' and move on.

As a backup download Microsoft Safety Scanner and run a full scan.
It runs as a standalone app and does not install anything on your pc.
Don't be alarmed if initially you see some alerts/warning as some files have similar signatures to malware wait until the scan finishes and then take action if needed.

FreeBooter said:

........ Process Explorer you can view which service or process causing the connection there we can determine cause of action from properties of each svchost.exe you can view network connections. .........

Click to expand...

That event had come and gone. Does Process Explorer show past history?

kelper said:

Third-party services can use Svchost.exe, don't blame Microsoft!

In your screenshot did you click on 'learn more'?

Just accept the warning! Click on 'Got it' and move on.

Click to expand...

Hmmm.... I am not blaming Microsoft . Rather it is Malwarebytes that says the application that triggered the popup is "App: Microsoft Windows Operating System svchost.exe". I am only curious to know which third party service triggered the popup. I have not installed any new application and the applications I had installed on this PC have been there and running for years without any event. And yes, I accepted the warning and moved on but that does not answer my curiosity.
Learn more??? I will do that for sure if that popup appears again.

EB2XR6 said:

As a backup download Microsoft Safety Scanner and run a full scan.

Microsoft Safety Scanner Download - Microsoft Defender for Endpoint

Get the Microsoft Safety Scanner tool to find and remove malware from Windows computers.

learn.microsoft.com

It runs as a standalone app and does not install anything on your pc.
Don't be alarmed if initially you see some alerts/warning as some files have similar signatures to malware wait until the scan finishes and then take action if needed.

Click to expand...

Thanks for the suggestion.. That propels me to try ESET online scanner which I had used once long back on my wife's PC.

pepanee said:

Run a Rootkit scan, if you haven't already done so.

Click to expand...

As said earlier I am more inclined to use ESET online Scanner. Will do it when I am a little free.

jumanji said:

That event had come and gone. Does Process Explorer show past history?

Click to expand...

Process Explorer is advanced version of Task Manager no it will not show past history events.

jumanji said:

As said earlier I am more inclined to use ESET online Scanner. Will do it when I am a little free.

Click to expand...

Maybe ESET has changed their policy, a very long time ago when I used ESET online Scanner, it installed some Adware.

EB2XR6 said:

Maybe ESET has changed their policy, a very long time ago when I used ESET online Scanner, it installed some Adware.

Click to expand...

I checked with AI Overview and ChatGpt and both confirm that ESET does not install any adware.
ChatGPT was more elaborate than AI Overview.
"A few things can make it feel like it installs extra stuff:
It may create a desktop shortcut during setup.
It can offer a recurring “Periodic Scan” feature after the scan finishes.
If you don’t check “Delete application data on closing,” some scanner components remain installed for future scans.
But these are part of the scanner’s normal functionality, not bundled adware or unwanted third-party software."

Thanks for sharing your concern from which I have got some additional information "If you don’t check “Delete application data on closing,” some scanner components remain installed for future scans."