# Malware warning from Malwarebytes

**URL:** https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323
**Category:** Support
**Created:** [May 31, 2019, 5:38am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323 "2019-05-31T05:38:12Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Fredchams](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/f/c2a13f/32.png) [@Fredchams](https://forum.syncthing.net/u/Fredchams)
#### Post date: [May 31, 2019, 5:38am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323/1 "2019-05-31T05:38:12Z")

</div>

Hello everyone My first time here but Syncthing user for a few years. I got warnings from Malwarebytes software blocking outcoming phishing to an IP located in Ukrain ([https://www.ip-tracker.org/locator/ip-lookup.php?ip=217.12.223.8](https://www.ip-tracker.org/locator/ip-lookup.php?ip=217.12.223.8)) and using TCP/UDP port (49919). Since my devices are only in France, how is it possible?

Thank you for your advices.

Fred

If needed, here is under the Malwarebytes log: -Details of the blocked website - Malicious website: 1 , Blocked,[-1],[-1],[-1], 0.0.0.0

-Website data- Category: Phishing Domain: IP Address: 217.12.223.8 Port:[49919] Type: Output File: C:\Users[myusername]\AppData\Roaming\SyncTrayzor\syncthing.exe (end)

---

<div class="post-metadata">

### Author: ![AudriusButkevicius](https://forum.syncthing.net/user_avatar/forum.syncthing.net/audriusbutkevicius/32/277_2.png) [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [May 31, 2019, 8:16am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323/2 "2019-05-31T08:16:11Z")

</div>

There are plenty of threads explaining these seemingly random connections. Please search the forum or read up about relays.

---

<div class="post-metadata">

### Author: ![uok](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/u/e99b99/32.png) [@uok](https://forum.syncthing.net/u/uok)
#### Post date: [May 31, 2019, 9:54am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323/3 "2019-05-31T09:54:18Z")

</div>

This is probably from a relay - see complete list on [https://relays.syncthing.net/](https://relays.syncthing.net/)

---

<div class="post-metadata">

### Author: ![Fredchams](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/f/c2a13f/32.png) [@Fredchams](https://forum.syncthing.net/u/Fredchams)
#### Post date: [June 1, 2019, 7:21am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323/4 "2019-06-01T07:21:26Z")

</div>

Thank you Audrius. My bad, I was not aware of relays so I have not had the idea to look for this.

---

<div class="post-metadata">

### Author: ![Fredchams](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/f/c2a13f/32.png) [@Fredchams](https://forum.syncthing.net/u/Fredchams)
#### Post date: [June 1, 2019, 7:22am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323/5 "2019-06-01T07:22:06Z")

</div>

Thank you uok. I will have a look to the list

---

<div class="post-metadata">

### Author: ![system](https://forum-uploads.syncthingcdn.net/original/2X/0/0b50e0a202b22ae6a67190759e8c868805b8ed9f.png) [@system](https://forum.syncthing.net/u/system)
#### Post date: [July 1, 2019, 7:33am UTC](https://forum.syncthing.net/t/malware-warning-from-malwarebytes/13323/6 "2019-07-01T07:33:07Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
