false alert? Kasa smart switch accessing malware site in Seattle (Amazon)

Follow

Chris Milkosky

• September 26, 2025 15:01

Hi all!  

Firewalla recently started alerting me that my Kasa smart switches are accessing a malware site (52.22.177.76 - Amazon, Seattle).  I checked the Security Info Lookup tools (all of them) on that IP and can't see anything flagging it as malicious.  Any way I can find out why it is doing this?  I don't know if I should be concerned or if it was somehow incorrectly added to some blacklist on the firewalla (not me).  

 

Thanks in advance for any help you can provide!

0

• 

  Firewalla

  • September 26, 2025 16:33

  If you find this site marking is worng, the best way is to 

  1. tap the alarm

  2. tap the top right (...) 

  3. Provide feedback

  We will have someone check it over

  0

  Comment actions Permalink
• 

  Chris Milkosky

  • September 26, 2025 17:35

  Sure - I will do that. 

  Is there a way for me to see, more specifically, what triggered that alarm?  I'm curious if it was on a blacklist and was flagged because of that, or if it was a bad reputation score on one of the tools, or something else entirely.  I don't know if it is malicious or not, although I'd suspect not, but who knows...

  0

  Comment actions Permalink
• 

  Firewalla

  • September 27, 2025 17:45

  most common problem is related to NTP, tap the alarm and see if the port is 123

  0

  Comment actions Permalink
• 

  Chris Milkosky

  • September 27, 2025 18:44

  Nope - destination port is HTTPS (443)

  0

  Comment actions Permalink
• 

  Firewalla

  • September 27, 2025 22:09

  okay, once we receive the feedback, will look 

  0

  Comment actions Permalink
• 

  Chris Milkosky

  • September 28, 2025 17:49
  • Edited

  I did send it on 9/26/2025.  Is there a way to find out what triggered that alert (ex. a specific blacklist, a rule, etc.)

  0

  Comment actions Permalink

Please sign in to leave a comment.