# go-IPFS detected as threat by Sophos AV

**URL:** <https://discuss.ipfs.tech/t/go-ipfs-detected-as-threat-by-sophos-av/3267>\
**Category:** Kubo\
**Created:** [June 25, 2018, 4:26pm UTC](https://discuss.ipfs.tech/t/go-ipfs-detected-as-threat-by-sophos-av/3267 "2018-06-25T16:26:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fwip](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ipfs.tech/fwip/32/2450_2.png) [@fwip](https://discuss.ipfs.tech/u/fwip)\
**Post date:** [June 25, 2018, 4:26pm UTC](https://discuss.ipfs.tech/t/go-ipfs-detected-as-threat-by-sophos-av/3267/1 "2018-06-25T16:26:04Z")

</div>

On my macbook running Sophos Anti-Virus (work-provided), this morning it began flagging go-ipfs as an “Active threat C2/Generic-A”, whatever that means.

 ![](https://us1.discourse-cdn.com/flex020/uploads/ipfs1/original/2X/8/8a6bfdb88c8307907ae2ea94ee8aff55f4cb2248.png)

I’m sure IPFS isn’t suddenly harboring a virus, but I wanted to bring this to y’all’s attention in case there’s anything that can be done to avoid false-positives. I know AV software often works in similar ways, so I wouldn’t be surprised if it happened in other AV clients as well.

---

<div class="post-metadata">

**Author:** ![postables](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ipfs.tech/postables/32/2729_2.png) [@postables](https://discuss.ipfs.tech/u/postables)\
**Post date:** [June 25, 2018, 8:43pm UTC](https://discuss.ipfs.tech/t/go-ipfs-detected-as-threat-by-sophos-av/3267/2 "2018-06-25T20:43:46Z")

</div>

False alarm, probably getting flagged due to it’s usage of P2P libraries

---

<div class="post-metadata">

**Author:** ![stebalien](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ipfs.tech/stebalien/32/156_2.png) [@stebalien](https://discuss.ipfs.tech/u/stebalien)\
**Post date:** [June 26, 2018, 1:38am UTC](https://discuss.ipfs.tech/t/go-ipfs-detected-as-threat-by-sophos-av/3267/3 "2018-06-26T01:38:12Z")

</div>

This is probably because the IPFS library mentions [ipfs.io](http://ipfs.io) and we run the IPFS gatway on [ipfs.io](http://ipfs.io). Someone, somewhere, is linking to some virus at `https://ipfs.io/ipfs/QmSomeBadFile`.

Please report the false positive.