Page 1 of 3

hkdata.crabdance.com or hkdata.fairuse.org not found

Posted: Fri Nov 08, 2019 5:23 pm
by ArnoldLayne
Running makemkv this morning, having recently updated my malwarebytes to the new version, it flagged an outbound connection to hkdata.fairuse.org as a phishing event.
I allowed Malwarebytes to block the connection, twice.
The recording went well except upon playback I noticed this is no audio track.

Is this expected, have others seen it?
Thanks!

Re: hkdata.fairuse.org

Posted: Fri Nov 08, 2019 6:22 pm
by Woodstock
Did it say what file it was trying to access on this host? hkdata.fairuse.org/svq/sdf.dat.gz seems to be the hash key file for MakeMKV, and the host name resolves to the same IP, (changed, see later message), as the most recent host used for the HK file.

Re: hkdata.fairuse.org

Posted: Fri Nov 08, 2019 11:07 pm
by mike admin
This is correct, this site hosts SDF/HK auto-updates for MakeMKV.

Re: hkdata.fairuse.org

Posted: Sat Nov 09, 2019 12:53 am
by ArnoldLayne
And if the access is blocked, the audio track is purposely not recorded?
Thanks

Re: hkdata.fairuse.org

Posted: Sat Nov 09, 2019 3:27 pm
by Woodstock
No, if access were blocked, then you wouldn't be able to remove encryption from any new UHD disks. The Hash Key doesn't affect pulling audio tracks.

Re: hkdata.fairuse.org

Posted: Fri Nov 29, 2019 3:15 pm
by nicolas
It also got blocked in here, beeing flagued as "Nudity and Risque"

Re: hkdata.fairuse.org

Posted: Fri Nov 29, 2019 3:39 pm
by d00zah
Got the 'blocked' notice last night. Knowing what the transaction was about, I added an exclusion. All's right with the world.

Observation: MBAM has been particularly aggressive w/ 'False Positives', of late. A scan flagged an old version of DaemonTools Lite (v4.49.1.0356), which has been on my system for ages with no apparent ill effects... seems to be the update check, as well. I'm comfortable with adding the exclusions. If you are not, report potential False Positives to MalwareBytes & they will make the determination.

Re: hkdata.fairuse.org

Posted: Fri Nov 29, 2019 3:52 pm
by Woodstock
I almost think the aggressive nature of the scans is to make up for the fact that a lot of AV programs aren't as good as they used to be. Well, really, that the bad actors are better at hiding than the AVs are at finding.

I've got programs that have been on my drives longer than the companies have been in existence (think DOS 3.3 era) that are flagged as "infected" with things that didn't exist the last time the file was modified.

It's hard to get scared by a report of a 30K file being infected with a trojan that is 5 times that size...

Re: hkdata.fairuse.org

Posted: Fri Nov 29, 2019 4:04 pm
by d00zah
It also has to do with domains like 'freeuse.org' which may have been used by less trustworthy entities (for updates, etc.) in the past. One bad apple... & they are all lumped in under the root domain. It's flagging the domain, not the file.

Also, the latest version of MBAM (v4.x) has just rolled out recently & there is 'fine-tuning' afoot...

Re: hkdata.fairuse.org

Posted: Mon Dec 30, 2019 9:18 pm
by Roger
MBAM flagged this site for me but I had no audio problems with ripping four movies.

Re: hkdata.fairuse.org

Posted: Mon Dec 30, 2019 9:32 pm
by Billycar11
Roger wrote:
Mon Dec 30, 2019 9:18 pm
MBAM flagged this site for me but I had no audio problems with ripping four movies.
it wouldn't cause audio problems it would cause disks you dont have the key for to not open

Re: hkdata.fairuse.org

Posted: Fri Sep 29, 2023 3:14 am
by ColdFUSI0N
Bitdefender flagged this:

Online Threat Prevention

We blocked this dangerous page for your protection:
https://hkdata.crabdance.com/
Accessed by: makemkvcon64.exe
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.

Re: hkdata.fairuse.org

Posted: Fri Sep 29, 2023 7:05 pm
by emagin
I got the same msg from BitDefender

WOT - Web Of Trust - also rates this domain pool
https://www.mywot.com/scorecard/crabdance.com

The reason for this is that they offer FreeDNS services, and a lot of malware parks their stuff there at crabdance. So other subdomains living on crabdance may be malicious and are flagging antivurus tools.

Re: hkdata.fairuse.org

Posted: Fri Sep 29, 2023 11:47 pm
by dawg_ripper
ColdFUSI0N wrote:
Fri Sep 29, 2023 3:14 am
Bitdefender flagged this:

Online Threat Prevention

We blocked this dangerous page for your protection:
https://hkdata.crabdance.com/
Accessed by: makemkvcon64.exe
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.
same for me. i added an exception but i'm still failing to download the latest file

Re: hkdata.fairuse.org

Posted: Sun Oct 01, 2023 1:44 am
by dawg_ripper
i'm still unable to download the latest file. it was working perfectly for years up until this week. not sure what happened. Anybody with bitdefender able to get thru?