This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Random redirects to unknown IP with fresh OS

  • 16
  • 11
  • 2 views
  • Nzaghachi ikpeazụ nke FredMcD

more options

When i try to open new tab in Mozilla i got an avast alarm saying that Mozilla is trying to acess URL:MAL with this IP https://54.200.231.121 . The problem that this is a clean install of OS (got this problem before and than reinstalled win7). And no strange addons included. I disabled mozilla updates and any kind of reports (may be it's them, but still no luck) This problem occurs RANDOMLY, so not the all time i open a new tab this avast error opens. I'll contact avast support too, but there are no problems with Chrome.

When i try to open new tab in Mozilla i got an avast alarm saying that Mozilla is trying to acess URL:MAL with this IP https://54.200.231.121 . The problem that this is a clean install of OS (got this problem before and than reinstalled win7). And no strange addons included. I disabled mozilla updates and any kind of reports (may be it's them, but still no luck) This problem occurs RANDOMLY, so not the all time i open a new tab this avast error opens. I'll contact avast support too, but there are no problems with Chrome.

Asịsa ahọpụtara

Ok, I've finally got a response from avast's support. The answer is "Now this IP is not bloking, update your virus databases and the program using the update button" So this was false positive, and now it's OK.

Gụọ azịza a na nghọta 👍 0

All Replies (16)

more options

You're right...no malware add-ons. Tell you what: check your homepage (How to Check Your Homepage) and tell me what it is. Also, when you open up a New Tab, does the normal New Tab page appear, is it a website, is it blank, or is it blank with a cog icon in the top right? Do you get the same alert from Avast when you're doing something other than using Firefox? And what programs are installed on your computer?

more options

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.

You can try these free programs to scan for malware, which work with your existing antivirus software:

Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one.

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us!

more options

I have the default new-Tiles page. You suggest that mozilla connects to some IP, that in this Tiles? I used virustotal to scan this ip - that's what i got - https://www.virustotal.com/ru/url/93e0241f05ec4b666d2b2441d0c3d5cf93f68f05d16f7775fec750a370dde1e0/analysis/1415820773/ And already 3 "bad" opinions.. Never tried with "blank new tab page" The problem with experimenting is that I can't force this error... I don't get the same alert, while using mozilla. This is a clean install. Only drivers and skype. +Telegram. Even no flashplayer, no steam, no games or anything.

more options

Well i used MalwareBytes' Anti-Malware Anti-Rootkit Utility - TDSSKiller And nothing found. I think that's not the malware, or it is greatly hidden... And I wrote to avast support as a probable false-alarm/compitability issue

Edeziri site na sbdd

more options

Oh. I was asking about what the new tab page and homepage were like because sometimes malware changes them, and malware may have changed them to a malicious website which Avast kept blocking. And it IS possible that Firefox connects to some I.P. when you use the New Tab page because they have some new Enhanced feature which connects to Firefox servers to gather info about websites. Now, what's your homepage and programs, please?

more options

I got the default mozilla's homepage. Double checked that. You mean to list all installed programs? The blocking is only the avast message, i have no problems with accessing new tab, and it displayed correctly.

more options

please open the command line prompt by pressing windows-key + R and opening "cmd". in the window that opens, type:

tiles.services.mozilla.com see below

...and see if the resolved IP resembles the one in the warning message that you have received. if so, this is likely a false positive & since it is hosted on amazons cdn it might have been used for other purposes in the past.

Edeziri site na philipp

more options

I followed your instructions, but i got nothing, seems this is not a win-command. May this command should be used in some mozilla's console?

Edeziri site na sbdd

more options

i'm very sorry, the proper command should have been:

ping tiles.services.mozilla.com
more options

Didn't know about that trick. Kinda cool. That's what i get. Ip adress is different, but it's changing from time to time (different Ip's in screenshot, while ping'in the same adress). May be sometimes this ip can match (when the error will occur) But the first numbers are the same : 54.

p.s Sorry for my English, but i trying my best)

Edeziri site na sbdd

more options

i now got the exact ip you've referenced, so i think we can be rather sure that this is a false positive generated by your av software. the tiles server is a legitimate part of mozilla and won't serve malicious content.

more options

Yeah. It's Mozilla servers. (Probably the "Enhanced" New Tab page change.)

Edeziri site na You

more options

Glad your problem is kind of solved, though! I guess we'll have to report it to Avast!.

Edeziri site na You

more options

Thanks all for help. I've posted this problem to avast, and as soon as i get a response from them i'll post it here.

more options

Asịsa Ahọpụtara

Ok, I've finally got a response from avast's support. The answer is "Now this IP is not bloking, update your virus databases and the program using the update button" So this was false positive, and now it's OK.

more options

This is good to hear.

Please flag your last post as Solved Problem so other will know.

But first; A post was flagged as Solved Problem. Please remove that flag.