Bitdefender blocking malicious host on iPads

Question

Hello,&nbsp;I have an Orbi RBR40 with 3 satellites. &nbsp;Netgear Armor with bit defender/VPN installed on iPads. &nbsp;In the last 2 weeks, I’ve started getting warnings that ‘malicious host blocked on iPad’ for some suspicious websites (that I have never accessed). &nbsp;It does not tell me the source for these attacks. &nbsp;I’ve cleared cache and website data, frequently, and even removed email accounts (aside from iCloud). &nbsp;The attacks seemed to stop for two days but started up again, with a different website blocked this time.&nbsp;How can I tell what is the source and finally put a stop to this? &nbsp;I don’t surf the internet, only go to reputable sites or use apps. &nbsp;Nothing is jailbroken.&nbsp;Any help would be appreciated.&nbsp;Thanks

StLFan · Answer

I have looked at that in bitdefender (nighthawk not available for my router), the sites listed are classified as malicious (one in the Netherlands the other Iceland). I actually had one alert pop up while I was using the iPad. I’m testing now by having no email and no safari cache/websites on one iPad. Curious if it’s a spam email undeleted from junk and trash folders that may have some JavaScript or something triggering the call to these websites. I’ve also turned off background app update for all but a few key apps.

StLFan · Answer

After tons of trial and error, I think I’ve finally been able to determine that these messages are coming from emails downloaded into my various email accounts (particularly the spam folders). It’s not app-related on my devices, at least not in my case, as I closed all as well as turned off background updates. In the end, I figured I’d disregard them as bitdefender was doing it’s job and there wasn’t anything I could do to be proactive for them.

plemans · Answer

If you're getting the reports daily, shut off your devices and only use 1. Watch for the notices. That'll help you narrow it to a specific device.&nbsp;
From there you can work on seeing if something on it is causing it. It could be something on a site you go to or even an app that does have something nefarious in it. Tough to know with the info you've given.&nbsp;

StLFan · Answer

I’ve done that. It seems it happens when either iPad is asleep and plugged in, usually within 10-25 mins. Infrequently, I get a message that ‘Page was blocked. The page you were trying to access was dangerous and was blocked for your protection.’ This is while the iPad was asleep and plugged in early this morning.

plemans · Answer

You can go into armor and see what sites are being blocked.&nbsp;
https://kb.netgear.com/000061032/NETGEAR-Armor-is-blocking-URLs-that-I-want-to-access-what-do-I-do
&nbsp;
It also has more info on why it was blocked.&nbsp;
It could be an app in the background updating its connection and that being an issue

Forum Discussion

Bitdefender blocking malicious host on iPads

9 Replies