topic Re: Malware? in Access Points - Indoor and Outdoor

Malware?

sunkool — Sat, 23 Aug 2025 18:46:12 GMT

I have a ruckus r500 running Ruckus ZoneFlex Solo Access Point 110.0.0.0.675 firmware.

It appears that it is continuously (every 2 seconds) trying to reach btjbnmmjh.com. I have reset the access point and it continued, I re-flashed the firmware, It continued. Even with the wifi turned off, it continued. It is definitely coming from the access point. If I unplug it it stops.

" Its web server is located in Ukraine, with IP address 45.10.88.2. According to SiteAdvisor, btjbnmmjh.com is very risky to visit. "

Any Ideas?

Re: Malware?

sunkool — Sat, 23 Aug 2025 20:33:59 GMT

I flashed unleashed R500_200.7.10.202.121.bl7 to the ap and it is still trying to reach btjbnmmjh.com. It is now trying to reach captive.apple.com every 2 seconds. I found that that was a known bug that could be turned off but not in this version of firmware as there is not a internet-check option in config>system. I am confident that this access point will be smashed by a sledge hammer soon!

Re: Malware?

Vineet_nejwala — Tue, 26 Aug 2025 10:15:02 GMT

Hi Sunkool,

In 200.7 our APs were using captive.apple.com in order to determine internet reachability and this was resolved in Unleashed 200.13 though I don't see anything related to btjbnmmjh.com. Unfortunately since the R500 APs are EOL/EOS we can't work on a software fix for these models.

R500 went EOL in 2019.

Below is the R500 EOL/EOS policy :
https://support.ruckuswireless.com/documents/2455-ruckus-r500-ap-end-of-sales-eos-pre-announcement

Best Regards

Vineet