# Plex Media Server Compromised? **URL:** \ **Category:** Remote Access\ **Tags:** server-windows\ **Created:** [February 11, 2025, 7:20am UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208 "2025-02-11T07:20:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bay40k](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bay40k](https://forums.plex.tv/u/bay40k)\ **Post date:** [February 11, 2025, 7:20am UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208/1 "2025-02-11T07:20:44Z")
Server Version#: 1.41.3.9314 (latest) (Windows 10) Hi so I’m running Plex and I got this notification from Bitdefender: ![image](https://global.discourse-cdn.com/plex/original/4X/a/0/2/a02cd165e7d85921962360f5e4e1ac27c20d2145.png) “The page \ has been detected with suspicious activity. It is not recommended to continue browsing this website. Accessed by: plex media server.exe” Has anyone seen this before? I’m not sure what to make of it because everything is up-to-date (Plex, Windows) and I just find it hard to believe that it’d be a 0day It doesn’t seem to be a false positive either? It’s some Chinese website Edit: I’m also doing a system scan and I have it disconnected from the internet for the time being ---
**Author:** ![OttoKerner](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/ottokerner/32/10079_2.png) [@OttoKerner](https://forums.plex.tv/u/OttoKerner)\ **Post date:** [February 11, 2025, 9:25am UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208/2 "2025-02-11T09:25:03Z")
Do you remember what exactly you did/looked at, that lead to this warning? The address is not something that occurs in Plex as such. So my suspicion would be that it was inserted into metadata, like an artist biography or similar. Have you experimented with Plex plug-ins? Is it possible that it is caused by some long-forgotten plugin that was installed and never removed? Better remove them all: [https://support.plex.tv/articles/201187656-how-do-i-manually-install-a-plugin/](https://support.plex.tv/articles/201187656-how-do-i-manually-install-a-plugin/) (If you remove one of the default plug-ins, you might have to start the installer for Plex Media Server again to restore them, but that’s no biggie.) ---
**Author:** ![bay40k](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bay40k](https://forums.plex.tv/u/bay40k)\ **Post date:** [February 11, 2025, 10:08am UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208/3 "2025-02-11T10:08:39Z")
I wasn’t doing anything, it was just sitting there lol I also don’t have any plugins installed and never have I think it being in metadata somewhere is the most reasonable explanation but I’m not sure, I couldn’t find anything about it in my logs ---
**Author:** ![dbirch](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@dbirch](https://forums.plex.tv/u/dbirch)\ **Post date:** [February 11, 2025, 12:51pm UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208/4 "2025-02-11T12:51:03Z")
Were you able to capture a copy of your logs shortly after this happened? perhaps we can narrow down what was happening in plex. ---
**Author:** ![mark\_v32](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@mark\_v32](https://forums.plex.tv/u/mark_v32)\ **Post date:** [March 25, 2025, 10:35am UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208/5 "2025-03-25T10:35:53Z")
Not sure if it is related but my Malwarebytes is regularly detecting ‘website blocked due to compromised’ and this is associated with Plex Media server.exe. This is inbound from a number of external IP addresses and started a few days ago. These IP addresses are all reported in the AbuseIPDB database. ---
**Author:** ![system](https://global.discourse-cdn.com/plex/original/3X/2/a/2acb9765406f63293d357b4ec509ec39aa28f2ad.png) [@system](https://forums.plex.tv/u/system)\ **Post date:** [June 23, 2025, 10:36am UTC](https://forums.plex.tv/t/plex-media-server-compromised/905208/6 "2025-06-23T10:36:14Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.