Suddenly getting phishing alerts from my Amazon Echo
Hello, I'm new here so not sure if this should be posted in "General" or somewhere else. I just wanted to alert Firewalla that my Gold device started suddenly alerting me every 16 minutes that my Amazon Echo device is performing "phishing activity" by trying to hit IP 104.236.116.147 over port 123 (NTP). This seems like a possible false positive? Since it's every 16 minutes, that seems like a possibly normal NTP polling interval. Additionally, this Reddit thread seems to have identified similar behavior with another Amazon device, an Eero, going to the same IP pool that is legitimate NTP traffic.
https://www.reddit.com/r/eero/comments/n6ab4x/error_accessing_phishing_site/
I'm going to mute this alert, but I thought perhaps the Firewalla folks may want to know since it just started happening in the last day or two, like something changed with definitions or signatures or something.
-
you can block or ignore this.
The reason you are getting is, your device is using NTP to sync time, and NTP is a such distributed system, that 'anyone' can volunteer their device to be an NTP server. and just happens one of them has a bad reputation.
You can block this access, NTP will switch to a different server
Please sign in to leave a comment.
Comments
1 comment