Avast one web shield keep poping up with ssl invalid for nel.heroku.com

[Manu6]

Hello folks!
Im dealling with this poput since some days.
It comes randomsly, saying that ssl are invalid for nel.heroku.com
I just disabled all extension in chrome and check my computer for malwares with MalwareBytes.
Anyways the computers is almost fresh, just installed everything two wees ago.
It would be of extreme help if the poput can show some more info about where this error is originated.
Which app is trying to navigate or do something.
I cant trace this connection.
I check in resmon for any app trying to open hxtps://nel.heroku.com but didnt find anything.
Any help? ideas? suggestions?

[Pondus]

Website is down  https://downforeveryoneorjustme.com/nel.heroku.com?proto=https


quote DavidR:
Clear your browser cache and cookies, restart your browser.
Does it still happen:
- If so try starting your browser with apps disabled.
Does it still happen:
If not, one of your add-ons would appear to be connecting to this site. 
Now it is a bit of a pain, disabling one app at a time to find it.
Start with any app recently added and or apps recently updated.

[polonus]

Hi Manu6,

It is one letter between the all green and suspicious or not able to be scanned - nel and net.etc.

But see the vulnerabilities given here for that IP: https://www.shodan.io/host/52.214.194.68

There were more glitches recently where Amazon AI seemed involved. Offensive security Resolver.

polonus

[Manu6]

I did a misstyping, the url is

hxtps://nel.heroku.com

I searched in the net and there is any link or info about that url

[DavidR]

Trying to go directly to that URL comes up as a 404 error and that isn't an Avast Error/Alert. Attached Image 1.
Trying to check that domain via an IP checker resulted in two Avast alerts (as it is attempting to check it) Images 2&3.

After avast was done throwing up alerts on the IP checker trying to check, it then said it didn't have any info about the site. Image 4.

[DavidR]

Strange visiting just the heroku.com URL doesn't throw up an Avast Alert, see attached image.

[Manu6]

this is the poput keeps comming

Any way to check what app or extension is generating that http request?

I have vscode for developing with extensions, nothing related with heroku anyways

It says Emisor: R3

What does that mean?

[DavidR]

As an Avast User I can't say what Emisor (presumably Error) R3 is. 
I have never come across this Error R3 (but I'm not using Avast One).

[polonus]

Hi DavidR & Manu6,

This is a Spanish term - emisor = emittor, a sender (of a cookie for instance)
Example: Solamente serán legibles por el emisor. Only visible for the sender.

For error R3 -> https://kss-kavinda.medium.com/how-to-use-react-event-emitter-3-d8474665dcc  (emitter.js)

It is about how the hacker hid this attack code.

polonus

[Manu6]

I need a litle more help, or i will need to change the antivirus, i can handle to many poputs all the time.

What i can try or do? to get rid off this alert or problem?

what is originating the message?

how i can trace the problem?

[DavidR]

We ask questions, without information it is very hard to offer help.

Did you try what was suggested in Reply #1  ?
This is likely to be the origin of the attempts to connect to that site and cause of the alerts.

Changing AVs, if the browser is the reason the connection is made won't stop the connection.  If the other AV alerts or not I can't offer a guess on that.