1 2 Previous Next 13 Replies Latest reply on Oct 9, 2012 3:54 PM by Peter M

    IP Addresses owned by Amazon.com making an unauthorized communciation with my computer

      So far the following IP addresse owned by Amazon.com were blocked by McAfee with the recent blocked IP address on the top bullet.

       

      • 72.21.215.90
      • 72.21.214.144
      • 72.21.214.200

       

      The first two blocks happened when I launched Windows Live Messenger. The recent block happened when I logged out on Windows Live Messenger. This has been frustrating me. I have tried contacting Amazon.com already but they have yet to reply.

       

      Only happens on Windows Live Messenger. And my messenger ID is different from the email address I am using on my Amazon.com account.

       

      Anyone suggestions? Should I reformat my computer?

        • 1. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer
          Peacekeeper

          This is done by netguard a firewall setting and you can allow the connection BUT why is trusted source who supplies the netguard web ratings saying this is risky. Best to ask Chat see tech support in useful links tab above and I will point another mod here.

           

          72.21.215.90 IP address location & more:
          IP address72.21.215.90
          IP country code:US
          IP address country:United States
          IP address state:n/a
          IP address city:n/a
          IP address latitude:38.0000
          IP address longitude:-97.0000
          ISP of this IPAmazon.com
          Organization:Amazon.com
          Host of this IP:s3-1-w.amazonaws.com

           

          on 13/05/12 6:41:48 PM
          • 2. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer

            But what I am worried about why some of Amazon.com's IP addresses is communicating with my computer without my knowledge? If I did not have McAfee installed, then I would not have known about that outbound communication with Amazon.com. Good thing I have McAfee installed on my computer. I do not have any Amazon.com related applications installed on my computer, if that would help.

             

            Message was edited by: thomascgty on 5/13/12 11:16:39 AM CDT
            • 3. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer
              Peter M

              Advertising is carried by Windows Live I believe?   I don't use it anymore I'm afraid to know for sure but I would imagine those represent advertisements that have been blocked.   As it's Amazon it should be pretty harmless.

               

              That sort of advertising is now targetted - in other words it is adjusted to your location, hence it 'communicating'.

               

              Message was edited by: Ex_Brit on 13/05/12 2:30:02 EDT PM
              • 4. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer
                Hayton

                The first IP address is High-Risk according to TrustedSource (and SiteAdvisor). There's a new SA review for the IP :


                Rating: Adware, spyware, or viruses

                - Hosts found sending virus mails
                phishing-msrbl link - Hosts found sending phishing mails
                images-msrbls link - Hosts found sending mail contaning spam images
                msrbl link - All the msrbl lists combined

                Host names sharing IP with A records (10 items)

                *.it.s3.amazonaws.com
                *.skebby.it.s3.amazonaws.com
                cdnus.mokarina.com.s3.amazonaws.com
                com.s3.amazonaws.com
                fly.cdn.ac.s3.amazonaws.com
                music.static.jango.com
                production.s3.rubygems.org.s3.amazonaws.com
                skebby.it.s3.amazonaws.com
                static.skebby.it.s3.amazonaws.com
                universal-downloader.en.softonic.com

                Posted at 11/05/12-22:30:17 by bungiman, Reviewer

                 

                Suspect downloads reported from softonic.com and one (setup-converterlite-ic-1.3.0.exe) from converterlite.com

                 

                The second IP address is Amazon -

                72.21.214.144 IP address location & more:
                IP address [?]:72.21.214.144 [Whois] [Reverse IP]
                IP country code:US
                IP address country:ip address flagUnited States
                IP address state:n/a
                IP address city:n/a
                IP address latitude:38.0000
                IP address longitude:-97.0000
                ISP of this IP [?]:Amazon.com
                Organization:Amazon.com
                Host of this IP: [?]:s3-1-w.amazonaws.com [Whois] [Trace]

                Which has reports of suspect downloads (Win32/SoftonicDownloader.D) from softonic.com and two from Amazon - oi_KeyTweak_install.exe and oi_FreeDWGViewer.exe

                 

                This address is Green in TrustedSource but Red in SiteAdvisor; no SiteAdvisor reviews.

                 

                The third address is likewise Amazon

                72.21.214.200 IP address location & more:
                IP address [?]:72.21.214.200 [Whois] [Reverse IP]
                IP country code:US
                IP address country:ip address flagUnited States
                IP address state:n/a
                IP address city:n/a
                IP address latitude:38.0000
                IP address longitude:-97.0000
                ISP of this IP [?]:Amazon.com
                Organization:Amazon.com

                This address is Green in TrustedSource but Red in SiteAdvisor; no SiteAdvisor reviews.

                 

                Reports of suspect downloads from Softonic and Amazon (oi_TorrentSeek.exe, setup_MightyMagoo_v14.exe,  oi_Funhouse.exe)

                 

                 

                The owner of Softonic has posted in the site-owner's section of SiteAdvisor  (see http://www.siteadvisor.com/sites/softonic.com) to say that all their downloads are tested both when they are first made available and whenever they are updated.

                All software is scanned with two different anti-virus programs both when it is added and updated. Each program is scanned �manually� and thoroughly, including installation, operation and uninstall processes. If any software product comes up suspicious it is then tested with up to 40 additional engines.

                 

                NetGuard is being careful about allowing connections, which is good : but I don't know why the outgoing connection was attempted in the first place. The discrepancy between TrustedSource and SiteAdvisor in the second and third IP addresses may indicate that the problem, whatever it is, has been rectified (SiteAdvisor has a lag before it picks up TrustedSource rating changes). My guess is the flag was related to something on Softonic's website.

                • 5. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer

                  Thanks for the response. Not sure if the trigger was the advertisements from Amazon.com since almost always advertisement on there are non-Amazon.com.

                  • 6. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer

                    Will continue to observe since I don't go to softonic website so there shouldn't be any files from softonic.

                     

                    I am as puzzled as you are on the attempted outbound connection to Amazon.com IP addresses.

                     

                    I received an email from Amazon.com and they told someone will send me an email by 05/16/2012 regarding the attempted connections from those mentioned IP addresses.

                     

                    Will keep everyone posted on what happens in the email communication with Amazon.com.

                    • 7. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer
                      drekmonger

                      I have the same issue reported by thomascgty that affects my Lenovo T510 and W510, which both run W7 Professional 32-bit.  In each case, the machines attempted to contact Amazon.com IP addresses and the attempts were blocked by NetGuard.  The attempts were:

                       

                      T510 Net Guard Blocks: 

                      05/10/2012  8:59 AM  72.21.214.200 attempted by Lenovo ThinkVantage Toolbox

                       

                       

                      W510 Net Guard Blocks: 

                      05/12/2012  5:49 PM  72.21.214.200 attempted by Lenovo ThinkVantage Toolbox

                      05/12/2012  6:32 PM  72.21.214.144 attempted by Lenovo ThinkVantage Toolbox Updater

                      05/12/2012  6:32 PM  72.21.194.32 attempted by Lenovo ThinkVantage Toolbox

                      05/12/2012  6:32 PM  72.21.194.32 attempted by Lenovo ThinkVantage Toolbox

                      05/13/2012  7:40 AM  72.21.215.90 attempted by Internet Explorer

                      05/14/2012  6:18 AM  72.21.211.171 attempted by Lenovo ThinkVantage Toolbox

                      05/14/2012  6:18 AM  72.21.215.76 attempted by Lenovo ThinkVantage Toolbox Updater

                      05/14/2012  6:53 AM  72.21.214.200 attempted by Lenovo ThinkVantage Toolbox

                       

                      On both machines, ThinkVantage Toolbox (“TVT”) and ThinkVantage Toolbox Updater (“TVT Updater”) had firewall settings for Outgoing access only.  On only the W510, I did briefly disable NetGuard for TVT and TVT Updater on 05/12 but thought better of it after a few minutes and renabled it.  I’m not sure whether I initiated the TVT application while NetGuard was disabled for the application or not, but the next blocked notice I got involved Internet Explorer.  On only the W510 I also gave TVT and TVT Updater full access in the McAfee firewall, but thought better of that today and went back to Outgoing only.  When this was happening, I got a Windows notice that the TVT application had to shut down.  I have not received another such notice since.

                       

                      I installed 17 Windows updates on 05/10/2012 on the W510, mostly Security Updates for either Windows 7 or Microsoft Office or Microsoft .NET Framework 3.5.1 on Windows 7 SP1 x86.  I had installed those updates on the W510 on 05/09/2012.  The only other unusual thing I have noticed is using Eventvwr on the W510 I got Warnings on 05/05, 05/07, 05/12, 05/13 and 05/14 that “LMS Service has a problem in achieving network resources.”  Event ID: 1.  Log Name:  Application.  User:  SYSTEM.  The Warnings relate to Intel Active Management Technology Local version 6.0.30.1202.  I have received no such Warning on the T510. 

                       

                      When I initiate TVT on the W510 I seem to get a NetGuard block every time now.  I initiated TVT on the T510 today and got no new block.  I have run full McAfee scans on both machines that came up clean.  Also, I ran a full Microsoft Safety Scan on the T510 today and it came up clean too.  I would appreciate help.

                      • 8. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer

                        I'm having this issue was well.  I was getting the same ips from Amazon - my computer said Windows Gadget attempted the connection.  I then uninstalled the Windows Gadgets and now I'm getting that IE is attempting to access those Amazon IPs.  What is the issue or better - what is the solution?

                        • 9. Re: IP Addresses owned by Amazon.com making an unauthorized communciation with my computer
                          Peacekeeper

                          Ok i checked my netguard and yes I too have an Amazon Ip there. Uniblue app tried to access it. Strange.

                          it was

                          72.21.194.32

                          1 2 Previous Next