OPNsense Forum

English Forums => Q-Feeds (Threat intelligence) => Topic started by: meyergru on May 14, 2026, 05:55:03 PM

Title: False positives, probably because of a major Vodafone mishap...
Post by: meyergru on May 14, 2026, 05:55:03 PM
Background: I had a problem with a remote Plex access to my network earlier this month. This problem resurfaced today and now, I have found what eventually caused it.

The client was trying to access from a Deutsche Glasfaser account with IP 93.104.119.235 (nothing private to that, because it is CG-NAT).
As it turns out, at the time of writing, this IP is listed at Q-Feeds. It also was listed at Blocklist.de, because of IMAP attacks on 1st of May.

2026-05-14 17_50_04-IP 94.31.108.115 - Suchen nach IP 94.31.108.115 - Treffer_ 1; ; -- www.blocklist.png

Ironically, this was caused by a prolonged outage of Vodafone's IMAP services. It seems that they also notified some blacklisting services because of failed IMAP attempts that they caused themselves. I already reported this as a false positive, but the IP above is only one example, so in case you see problems, now you know... Q-Feeds should dismiss all reports on this IMAP problem.


Proof:

https://forum.vodafone.de/t5/MeinVodafone-E-Mail/Sammelthread-IMAP-Problem-mit-Vodafone-E-Mail-Konto/td-p/3329568


P.S.: There is no contradiction, as using a free e-mail account on one of Vodafone's domains but still having any other access provider is perfectly fine....
Title: Re: False positives, probably because of a major Vodafone mishap...
Post by: wirehire on May 15, 2026, 03:26:59 PM
indeed, many vodafone ips are on the blocklist now, with good reputation.
Title: Re: False positives, probably because of a major Vodafone mishap...
Post by: meyergru on May 15, 2026, 03:47:28 PM
And a lot more from other providers, still. Now 94.31.108.115 (also DG) is blocked.
Title: Re: False positives, probably because of a major Vodafone mishap...
Post by: Q-Feeds on May 16, 2026, 12:00:04 PM
We found a solution (for the majority) and it will be done within the next couple of hours. The IP you listed has been removed from the list already. thank you for letting us know!
Title: Re: False positives, probably because of a major Vodafone mishap...
Post by: Taunt9930 on May 16, 2026, 02:00:53 PM
Yeah, I have noticed massive battery drain on my mobile when connected via WiFi at home recently caused by the email client, and also unable to send emails. When I have checked Tip, exchange2019.ionos.co.uk is also on the list which is Ionos UK Exchange Server for all their customer emails.
Title: Re: False positives, probably because of a major Vodafone mishap...
Post by: wirehire on May 29, 2026, 06:31:21 PM
There are still a lot of Vodafone numbers on the list. can you share why?
Title: Re: False positives, probably because of a major Vodafone mishap...
Post by: Q-Feeds on June 02, 2026, 02:02:01 PM
Quote from: wirehire on May 29, 2026, 06:31:21 PMThere are still a lot of Vodafone numbers on the list. can you share why?

Well, can you specific 'a lot' for us? Obviously we're unable to whitelist everything residing from Vodafone and it's also hard to identify the specific ones since Vodafone does not communicate about it.