• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Norton Core and Roku Premiere

Hi, I received 249 alerts within a very short period of time last night originating from my Roku Premiere according to Core. The IP listed for the alert was 52.85.117.25  Anyone experienced something similar? I have never seen anything near this alert level before.

Thanks

Replies

Kudos0

Re: Norton Core and Roku Premiere

What was the alert notifying you about?

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: Norton Core and Roku Premiere

all botnet alerts.   According to Core's date/time stamps, the alerts happened when I was using netflix. All I did during that netflix session was 1) search for a movie, 2) watch the movie 3) exit netlix

Kudos0

Re: Norton Core and Roku Premiere

that is, I was watching Netflix on the streaming player Roku Premier.

Some of the IP Lookup sites show the IP 52.85.117.25 to be one of Amazon Technologies, Inc.'s.  However, Core is reporting the that IP to be a botnet so maybe it is not Amazon at all.

Kudos0

Re: Norton Core and Roku Premiere

All: The IP address posted above traces to the following - https://www.ip-tracker.org/locator/ip-lookup.php?ip=52.85.117.25

It IS indeed Amazon.

Cheers

Retired military (Navy 1980-2002) "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.253 / NSBU 22.16.3.21 / Norton Core v.270 on Android
Kudos0

Re: Norton Core and Roku Premiere

How would i verify that 52.85.117.25 is a malicious botnet site rather than just routine Amazon traffic? In su[m, I've had over 400 52.85.117.25 botnets alerts in last month spread over three devices, and i would like to explore why that may be.
Kudos0

Re: Norton Core and Roku Premiere

Dolomite. You would need to contact Netflix with the constant stream of botnet alerts and give them the IP address you are seeing. I personally see botnets being blocked on Core from both mobile devices and PC's. Most come from the news sources through our news app on the Note 4's. Core is doing its job, Netflix needs to be notified in case their servers have somehow become compromised.

Cheers

Retired military (Navy 1980-2002) "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.253 / NSBU 22.16.3.21 / Norton Core v.270 on Android
Kudos0

Re: Norton Core and Roku Premiere

ok, i will contact netflix, and amazon as well. i submitted 52.85.117.25 to blue coat. They recategorized it to web hosting. That is all they said. Does that mean Core will no longer categorize 52.85.117.25 it as malicious?

Kudos0

Re: Norton Core and Roku Premiere

More than likely that IP will not set off further alerts after being recategorized. Watch your alerts and let us know if it reappears.

Cheers

Retired military (Navy 1980-2002) "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.253 / NSBU 22.16.3.21 / Norton Core v.270 on Android
Kudos0

Re: Norton Core and Roku Premiere

Also started getting many botnet alerts from 52.84.139.128 which also looked up as Amazon Technologies. Submitted that to Blue Coat for review sitereview.bluecoat.com and their reply was "...a Web Content Analyst has recategorized this URL as Content Servers."  I was watching Amazon Prime Movies on the Roku Premiere when the above botnet alerts started coming from Core.

Closing this one.

This thread is closed from further comment. Please visit the forum to start a new thread.