FYI Installation issue - Malwarebytes reports Trojan

[krzykat]

OK - so years later, I'm finally doing my first install of 3CX. I've done a self install on Vultr, and downloaded the ISO, and am building from there.
After the initial Debian install, I select the option to use configuration tool from web browser.

After entering the requested url: http://<myip>:5015?v=2

Malwarebytes is reporting blocked this website because it may contain a trojan. Hmm... ??

 

[kenn10]

That's just because is is not a common site. Norton has no issues with it. You should be good to mark it safe in Malwarebytes. 3CX also pushes some cookies to you.

I have 3CX on Rack Nerds with no issues. Whatever they are doing for firewall protection is pretty darned good.

 

[billsimon]

I have seen this happen on DigitalOcean.

Someone previously used the IP address for malware/scam/etc. and got it flagged.

If you can change the IP you might want to do so.

 

[pbxinaflash]

I have seen this happen on DigitalOcean.

Someone previously used the IP address for malware/scam/etc. and got it flagged.

If you can change the IP you might want to do so.

That is most certainly the reason. Due to being low cost hosting providers they are commonly being used by threat actors. If you are unlucky you may get one of the ips flagged by A/V vendors.

 

[krzykat]

Thank you all - resolved.

 

[wardmundy]

@krzykat: Wondering if these are related...

https://www.voip-info.org/forum/threads/3cx-client-is-being-reported-as-having-backdoor-put-in-by-hackers.27036/