HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net

[xraiderv18]

contact avast and report the false positive..I has no idea where the contact form wandered off to, if someone could post?

[xraiderv18]

I have been experiencing this same problem for a couple of days. Seems to affect different browsers including: Chrome, Firefox and Opera. Is this an Avast problem? Will they fix it soon? It is frustrating to not be able to access Amazon although I have some work arounds. Anyone know if Avast will correct this problem? Thanks!

found the form https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

[Muad'Dib]

I'm also getting the same cloudfront URL (hXXps://d3ag4hukkh62yn.cloudfront.net) warning when accessing a link on Amazon.com. It's inconsistent (sometimes I can get through, sometimes Amazon is blocked by Avast), but it happens most frequently when I'm on the page hXXps://wXw.amazon.com/gp/css/homepage.html and then hover the cursor over the "Hello (Username)" near the upper right corner of the page (to the left of the "Returns & Orders" link and to the right of the language flag icon). For me, this just started this evening (June 20th) US time. I had accessed the same page and links without a warning today late in the afternoon. I've already submitted a suspected false positive report and hopefully others will do so too.

FYI, you can get the warning every time by entering the above-mentioned cloudfront URL directly. Also, if you type in the URL into a Google search window, there are several hits for this identical URL going back at least a couple of years (one from a MalwareBytes forum from Feb 9, 2020). Also if you enter the cloudfront URL into VirusTotal.com, it reports it as being clean (previous to my uploading, the same URL was posted yesterday on VirusTotal). Interestingly (to me at least), Avast is not listed among the various engines evaluating the URL.

As others have noted, this does not seem to be browser-specific (I get Avast warnings for this URL from every browser I've tried).

Update: Entering the cloudfront URL from Tor does NOT generate an Avast warning - instead it takes me to what looks like the Amazon.com homepage (though the URL in the address bar still says cloudfront). To quote Alice: "Curiouser and curiouser"

[Muad'Dib]

Email response from Avast this morning:

Hello,

Thank you for reporting this false positive.

Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

For future reference you might also find the following article to be useful:  <Link: https://support.avast.com/en-us/article/228/> Avast Clean Guidelines.


Best regards,

Avast Customer Care

However, Avast is still flagging Amazon, even though I tried to update the definitions (it said it was already up to date: v210621-2). I guess I'll just whitelist that specific cloudfront.net URL for awhile and then test it later today or tomorrow with the whitelist removed.

Also, while VirusTotal.com showed no flags when I entered the cloudfront URL late last night, a few hours later the same website showed that Comodo Valkyrie Verdict was flagging the URL as malware (maybe their employees read this forum? ).

[codewalkerDan]

I'm also getting the same cloudfront URL (hxxps://d3ag4hukkh62yn.cloudfront.net) warning when accessing a link on Amazon.com. It's inconsistent (sometimes I can get through, sometimes Amazon is blocked by Avast), but it happens most frequently when I'm on the page https://wxx.amazon.com/gp/css/homepage.html and then hover the cursor over the "Hello (Username)" near the upper right corner of the page (to the left of the "Returns & Orders" link and to the right of the language flag icon). For me, this just started this evening (June 20th) US time. I had accessed the same page and links without a warning today late in the afternoon. I've already submitted a suspected false positive report and hopefully others will do so too.

I used that cloudfront url in here and Apparently there is a malware reported on one site

[DavidR]

@  codewalkerDan
Please change the quoted text in your post to prevent accidental exposure.
Change the URL from http to hXXps and www to wXw (as I have done in the quoted post), to break the link and avoid accidental exposure to suspect sites, thanks.

I'm also getting the same cloudfront URL (hXXps://d3ag4hukkh62yn.cloudfront.net) warning when accessing a link on Amazon.com. It's inconsistent (sometimes I can get through, sometimes Amazon is blocked by Avast), but it happens most frequently when I'm on the page hXXps://wXw.amazon.com/gp/css/homepage.html and then hover the cursor over the "Hello (Username)" near the upper right corner of the page (to the left of the "Returns & Orders" link and to the right of the language flag icon). For me, this just started this evening (June 20th) US time. I had accessed the same page and links without a warning today late in the afternoon. I've already submitted a suspected false positive report and hopefully others will do so too.

@  Muad'Dib
Likewise to you, please change your post as indicated above to prevent accidental exposure, not to mention effectively promoting that site because of search engine web crawlers collecting urls.