Author Topic: Avast one web shield keep poping up with ssl invalid for nel.heroku.com  (Read 2164 times)

0 Members and 1 Guest are viewing this topic.

Offline Manu6

  • Newbie
  • *
  • Posts: 4
Hello folks!
Im dealling with this poput since some days.
It comes randomsly, saying that ssl are invalid for nel.heroku.com
I just disabled all extension in chrome and check my computer for malwares with MalwareBytes.
Anyways the computers is almost fresh, just installed everything two wees ago.
It would be of extreme help if the poput can show some more info about where this error is originated.
Which app is trying to navigate or do something.
I cant trace this connection.
I check in resmon for any app trying to open hxtps://nel.heroku.com but didnt find anything.
Any help? ideas? suggestions?
« Last Edit: October 05, 2023, 12:37:10 PM by Milos »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37619
  • Not a avast user
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #1 on: October 02, 2023, 11:22:45 PM »
Website is down  https://downforeveryoneorjustme.com/nel.heroku.com?proto=https


quote DavidR:
Clear your browser cache and cookies, restart your browser.
Does it still happen:
- If so try starting your browser with apps disabled.
Does it still happen:
If not, one of your add-ons would appear to be connecting to this site. 
Now it is a bit of a pain, disabling one app at a time to find it.
Start with any app recently added and or apps recently updated.






Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33937
  • malware fighter
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #2 on: October 02, 2023, 11:27:01 PM »
Hi Manu6,

It is one letter between the all green and suspicious or not able to be scanned - nel and net.etc.

But see the vulnerabilities given here for that IP: https://www.shodan.io/host/52.214.194.68

There were more glitches recently where Amazon AI seemed involved. Offensive security Resolver.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Manu6

  • Newbie
  • *
  • Posts: 4
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #3 on: October 02, 2023, 11:35:50 PM »
I did a misstyping, the url is

hxtps://nel.heroku.com

I searched in the net and there is any link or info about that url
« Last Edit: October 05, 2023, 12:37:19 PM by Milos »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89353
  • No support PMs thanks
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #4 on: October 03, 2023, 01:43:50 AM »
Trying to go directly to that URL comes up as a 404 error and that isn't an Avast Error/Alert. Attached Image 1.
Trying to check that domain via an IP checker resulted in two Avast alerts (as it is attempting to check it) Images 2&3.

After avast was done throwing up alerts on the IP checker trying to check, it then said it didn't have any info about the site. Image 4.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89353
  • No support PMs thanks
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #5 on: October 03, 2023, 01:50:25 AM »
Strange visiting just the heroku.com URL doesn't throw up an Avast Alert, see attached image.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Manu6

  • Newbie
  • *
  • Posts: 4
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #6 on: October 03, 2023, 04:08:04 AM »
this is the poput keeps comming :(

Any way to check what app or extension is generating that http request?

I have vscode for developing with extensions, nothing related with heroku anyways

It says Emisor: R3

What does that mean?
« Last Edit: October 03, 2023, 04:11:35 AM by Manu6 »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89353
  • No support PMs thanks
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #7 on: October 03, 2023, 12:07:56 PM »
As an Avast User I can't say what Emisor (presumably Error) R3 is. 
I have never come across this Error R3 (but I'm not using Avast One).
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33937
  • malware fighter
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #8 on: October 03, 2023, 03:01:53 PM »
Hi DavidR & Manu6,

This is a Spanish term - emisor = emittor, a sender (of a cookie for instance)
Example: Solamente serán legibles por el emisor. Only visible for the sender.

For error R3 -> https://kss-kavinda.medium.com/how-to-use-react-event-emitter-3-d8474665dcc  (emitter.js)

It is about how the hacker hid this attack code.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Manu6

  • Newbie
  • *
  • Posts: 4
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #9 on: October 05, 2023, 01:25:43 AM »
I need a litle more help, or i will need to change the antivirus, i can handle to many poputs all the time.

What i can try or do? to get rid off this alert or problem?

what is originating the message?

how i can trace the problem?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89353
  • No support PMs thanks
Re: Avast one web shield keep poping up with ssl invalid for nel.heroku.com
« Reply #10 on: October 05, 2023, 02:18:30 AM »
We ask questions, without information it is very hard to offer help.

Did you try what was suggested in Reply #1  ?
This is likely to be the origin of the attempts to connect to that site and cause of the alerts.

Changing AVs, if the browser is the reason the connection is made won't stop the connection.  If the other AV alerts or not I can't offer a guess on that.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security