Spy IPs Blocking Legitimate Services

[Adamm00]

Hey there,

I source your windows 10 spy list in a project of mine and a few users complained about it breaking select Microsoft services. Here's my findings so far;

157.55.109.226 - Breaks OneDrive
65.55.252.0-65.55.252.255 - Breaks XBox Live Chat
40.114.149.220 - Breaks Azure
134.170.179.87 - Breaks XBox Live

I also had some reports of Office360 not working correctly but wasn't able to get the exact IP(s) causing the issue yet.

[Adamm00]

111.221.29.0-111.221.29.255 Also breaks Windows Store from downloading apps.

[derWeihnachtsmann]

Personally, Im fine with Blockinger that Services. But maybe comments for each IP are good, so people who need onedrive can easily know and remove those IPs then :)

[Adamm00]

My understanding is these IP's should be listed under (extra), as this list is only for actual telemetry.

data//winX/spy.txt : Block Windows Spy / Telemetry
data//winX/update.txt : Block Windows Update
data//winX/extra.txt : Block third party applications

[Adamm00]

157.55.109.224
157.55.109.228
157.55.109.230

Some more IP's preventing OneDrive from working.

[Atavic]

IPs aren't fixed in their use, for some countries do telemetry, for others allow OneDrive. Moreover, not only location but OS Version change the IPs and their use.

MS Services are dynamic, when a big update is rolling, IPs reserved to other means are reallocated for the update.

[crazy-max]

@Adamm00, the latest version of WSB brings a lot of changes in the analysis of IP addresses collected during traffic capture. I'll analyze the ones you gave me and keep you in touch.

As @Atavic says, some addresses are specific to the issuing countries and also to the version of the OS. In this way I will extend the analysis domain and set up virtual machines in distinct geographical areas. This will all be related to #46.

[crazy-max]

@Adamm00 After analysis,

• 65.55.252.* : microsoft translator, msn search but some telemetry services. I have to isolate some of them.
• 40.114.149.220 : cloud app, skype data, aria pipe. I'm going to dig to get some info.
• 134.170.179.87 : not linked to probed service anymore, will be removed.
• 157.55.109.* : linked to users storage so i will move this to extra.

[crazy-max]

Must be solved in the latest release