AbuseIPDB VS VMProtect

Origin server only shows Cloudflare IP's so I decided to add this UA to my WAF with a Managed Challenge. After roughly 30 minutes and almost 100 hits on it CSR was 0%. Looking at the CF logs for the specific WAF shows IP's and locations from everywhere(US, UK, India, China, Nigeria, etc) and when I check IP's at abuseipdb.com they're all clean but none of them seem to get through the managed challenge. I removed... Source: 8 months ago

Switched to Maspik Anti-Spam, with a manually curated list of keywords, and integration with abuseipdb.com and proxycheck.io. But both of those were also causing false positives, especially from my co-worker who uses a virtual machine, so upped the tolerance to 70 on both. Source: about 1 year ago

This install of Docker is only a few days old. Most of the IPs associated are showing "banned" on abuseipdb.com. Source: about 1 year ago

People build lists like OP is all the time, have you seen https://abuseipdb.com/? Source: about 1 year ago

To keep your Synology safe, regularly update list of blocked ip addresses. I'm using this script, which takes list of ip addresses from blocklist.de and abuseipdb.com and add them to my block list. I keep them blocked forever. Source: about 1 year ago

Well, the file probably is packed with VMProtect to prevent reverse engineering, so it is not a false alarm per se, but given that it is likely a legitimate file that has used the packer for legitimate reasons, it probably should not be detected. Source: almost 2 years ago