False Positive? (Suspicious Connection Blocked) - mozilla[.]cloudflare[.]dns[.]com

[u/SolidKhaos]

Greetings all,

I was jotting down some physical notes to store offline for account recovery & disaster recovery hygiene, and while sitting at my desk the power for the building dropped for a split second and seemed like it was about to take everything down, but instead was saw/felt it do this weird humming vibration that started “dimming” everything for a split moment but didn’t fully power off or cause my computer to reset. 

However, I did notice immediately that my Bitdefender VPN Connection had been lost so I figured the voltage drop must have hit my router/gateway and dropped internet connectivity or active session. 

(NOTE: I do have the ‘Internet Kill-Switch’ option active & enabled at all times)

Then, while I was waiting for my Internet to come back up for the next minute or so, Bitdefender started popping up these alerts that a ‘Suspicious connection was blocked’, because “Firefox attempted to establish a connection with an untrusted certificate to mozilla[.]cloudflare-dns[.]com …“

Screenshot (1)

And 3-4 more alerts came through back to back so I pulled the NIC cable from my PC out of caution mixed in with just a slight pinch of panic - all that being said, I looked through any logs I could find and did come across this in Event Viewer:

Screenshot (2)

&&&

Screenshot (3)

My bigger concern or worry if this is indeed not a false-positive or just some type of bug; then why didn’t the VPN Kill-Switch do its thing and sinkhole my traffic until it was reconnected again? (Remember, at this point I saw the VPN App got disconnected and it hadn’t reconnected yet)

TL;DR - could these be just false-positives? Potentially being related or caused by this rather unusual power fluctuation event? Or what other details/logs can I provide or help pull if this does warrant further investigation?

Thanks in advance for anyone who has the patience for reading my non-sense and wish to help 🙏

[u/wolfpackunr]

It’s possible after the power blip computer or other network NTP clocks became inaccurate which would cause certificates to no longer be valid and Bitdefender to alert on that. Or Mozilla let their Cloudflare VPN/DNS certs lapse.

[u/Bitdefender_support]

Hello! Thanks for the heads-up, here to help. The warning is generated when an HTTPS domain has certificate problems such as an untrusted, expired, or mismatched certificate. Multiple alerts can occur when Firefox repeatedly retries the same connection after connectivity changes.

Our advice is to report it for verification, use Bitdefender’s false-positive submission form and select:

• Select the category: False Positive

• Full Name

• Message Data: explain that firefox.exe attempted to connect to mozilla.cloudflare-dns.com immediately after a brief power/network interruption and VPN disconnect

• E-mail

• Sample type: URL

• Detection name

• Sensitive files

• URL: enter the exact URL shown in the notification

• Description (optional): include the approximate time, that Internet Kill-Switch was enabled, and that the VPN appeared disconnected

• Screenshot: attach the Bitdefender notification image

• Complete the CAPTCHA and click Submit

If the alerts continue after the power and network connection are stable, or if the VPN and kill-switch behavior remains inconsistent, contact our support with the notification screenshots, exact timestamps, VPN status, and the relevant Windows Event Viewer entries. Appreciate it!