Endpoint Protection

 View Only
Expand all | Collapse all

Alexa Tracking and Amazonaws (Amazon Web Services) : [SID: 21631]

  • 1.  Alexa Tracking and Amazonaws (Amazon Web Services) : [SID: 21631]

    Posted Sep 03, 2009 12:03 PM
    Is anyone else experiencing this?

    Alert:
    [SID: 21631] Alexa User Info Tracking detected. Traffic has been blocked from this application: C:\Program Files\Internet Explorer\iexplore.exe

    We get a lot of these alerts. When I check the users history, I see that the user has been car shopping. It seems to always pop-up on car dealer websites(not sure why). When I search Symantec for "Alexa", I generally just get the "Users receive these pop-ups and events when they install Alexa Toolbar". These users aren't trying to install a toolbar (as suggested in Document ID: 2008042807531948).

    This seems like a lot : )
    "Found more than 1 security events. Actual number of security events found was 711 in 10 minutes. "

    I am not going to set this in the "Exceptions" list. I am glad tracking cookies are being blocked, but are these "false positives"?

    The alert shows multiple IP's from this range, but one example is - 75.101.154.43

    amazonaws.com (Amazon Web Services)
    NetRange:   75.101.128.0 - 75.101.255.255
    CIDR:       75.101.128.0/17

    Only IE seems to make this alert (Firefox and Safari did not create alert).

    Website example:  This is one website that popped up the alert
    http://www.crestcadillactx.com/contact-form.htm

    Here is some information on Amazon Web Services and Alexa:
    http://aws.amazon.com/awis/

    We ended up blocking the Alexa.com IP's, but we couldn't block the whole amazonaws.com range:

    canonical name alexa.com.
    aliases  
    addresses 75.101.130.133
    75.101.133.118
    75.101.142.37

     



  • 2.  RE: Alexa Tracking and Amazonaws (Amazon Web Services) : [SID: 21631]

    Posted Sep 03, 2009 01:15 PM
    I am using firefox... When i checked the site it created the alert.... I think its not a false alert.

    I got some info from Google..
    _______________________________________________________
    Tracking info is used by ads to check how many times the page is loaded or how many users have clicked their ads. This is common to banner ads. This is nothing to worry about. The problem with banner ads are those which download malware or sometimes redirect to a site which hosts malware. If you see any antivirus alerts other than the one you are using it is probably antivirus xp or its derivatives. These are fake anti virus which is trying to install in your pc.
    _______________________________________________________

    May be becoz of ads in the site Symantec is giving alert.


  • 3.  RE: Alexa Tracking and Amazonaws (Amazon Web Services) : [SID: 21631]

    Posted Sep 03, 2009 01:57 PM

    My test showed that Firefox was not getting the alert.