PC attempted risky connection - to who? why?

Factual Questions
1

McAfee AV software put a pop-up on my monitor this morning that says “McAfee has blocked your PC from making a potentially risky connection. About this connection - IP address: 72.21.194.32”

So I googled that IP address. Found this site, which claims the IP address belongs to amazon.com. McAfee’s own website doesn’t seem to know who it belongs to, but they’re pretty sure it’s a dangerous place.

Questions:

-does this IP address really belong to amazon.com?
-is it in fact a “risky” ip address to connect to? If so, why?
-why is my PC trying to connect to that ip address in the first place?

2

Amazon runs Amazon Web Services, where companies and individuals can “rent” computers and IP addresses from them.

I’d answer:

  • Almost certainly
  • Not enough information to say for sure, since anybody can “rent” an Amazon IP
  • No clue, but it certainly could be completely legitimate
3

I’d guess that the IP is not the reason it was blocked, but because of suspicious activity. And it likely came from someone using Amazon’s cloud hosting. If McAfee does extensive logs of events like this, I’d probably copy it and send it to Amazon. They may know where it came from, and can determine whether they need to take any action against them.

4

The IP address belongs to Amazon but as noted it may be used by any number of websites that rent space from them. This site shows a list of known hosts that have used that IP and what virus/malware has been associated with them.

I don’t recommend visiting any of the listed sites directly, but the list may provide you with a clue as to specifically which site your machine is trying to access at that IP.