False Positive | 188.114.97.2 (Phishing Army Blocklist Extended)

[aquarime]

What are the subjects of the false-positive (domains or URLS)?

188.114.97.2

Why do you believe this is a false-positive?

IP 188.114.97.2 in your https://raw.githubusercontent.com/mitchellkrogza/Ultimate.Hosts.Blacklist/master/ips/ips0.list, downloaded 2026-06-06 at GMT 08:07
I believe this is a false-positive because 188.114.97.2 is the IP of Phishing Army Blocklist Extended, a legitimate domain blocklist (https://phishing.army/download/phishing_army_blocklist_extended.txt).

I had to add 188.114.97.2 to DNSCrypt's IP whitelist to download successfully Phishing Army Blocklist Extended, a legitimate domain blocklist.
I daily update IP and Domain blocklists used here with DNSCrypt. This is the first time I encounter a blocklist (IP) blocking another blocklist (Domain). Quite ironical.

How did you discover this false-positive(s)?

I discovered this false-positive when I noticed that Phishing Army Blocklist Extended had not been updated, confirmed by DNSCrypt Blacklist log showing its IP 188.114.97.2. Searched for occurrences of this IP in newly updated IP blocklists and found it only in your Ultimate Hosts Blacklist (IPs).

Have you requested a review from other sources?

I have not requested a review from other sources.

Additional Information or Context

Does not apply

[smed79]

This IP address was added on April 12, 2023 because it was being used for malicious activities.

• https://www.abuseipdb.com/check/188.114.97.2
• https://www.virustotal.com/gui/ip-address/188.114.97.2/relations

[aquarime]

The reasons for adding 188.114.97.2 to the Ultimate Hosts Blacklist (IPs) are valid, they suggest that their is, was no fault on your side.
But AbuseIPDB » WHOIS 188.114.97.2 ties this IP to aruwaab9ja.com.ng when in my experience it was tied to phishing.army
Relevant, once again, that blocking IPs is far more risky than blocking domains. Personally I rely essentially on domain blocklists and consider IP blocklists with extreme caution. The mismatch detailed in this thread is a perfect example of required caution with IP blocklists.