Q-Feeds flagging xxx.xxx.xxx.xxx as suspicious: likely false positive

[dinguz]

I've noticed xxx.xxx.xxx.xxx is flagged as suspicious in Q-Feeds.

On top of that, the OPNsense GUI doesn't currently offer a way to whitelist an IP address for either the firewall blocklist or the Unbound blocklist. Combined with the free tier's 24-hour update frequency, this leaves me with two unappealing options: run a manual override at the firewall rule or Unbound config level, or disable Q-Feeds altogether until the update has propagated to my system. Neither feels like the right tool for what should be a simple exception case.

Edit: redacted because this has been resolved through a report in the Q-Feeds portal.

[Patrick M. Hausen]

Even as a free tier user you probably have an account, so log in to their portal and use the False Positive Reports form:

https://tip.qfeeds.com/views/support/my_false_positives.php

The OPNsense forum is definitely not the place for that.

HTH,
Patrick

[vpx]

You could go to "Firewall: Diagnostics: Aliases", select "__qfeeds_malware_ip" from the drop-down list, search for the IP and delete it.

But this probably only lasts a day till the next Q-Feeds update.

[Patrick M. Hausen]

Or use the False Positives Report Form 🙄

[Q-Feeds]

Obviously sorry for the inconvenience. But the only way to get this solved in the future within an hour (and often sooner) is indeed to let us know via our false positive reporting in the TIP.