How to stop Firefox connecting to these IPs?

[Csky]

If I saw the browser making a connection to some random domain like cksks.soie.net, then I would have no idea what it was, but I would be pretty sure it was nothing to do with NoScript.

Did you read the OP? It was noscript and another addon.

So after updating firefox is making connections to Google, Amazon, Edgecast and GoDaddy even in safe mode with no tabs loaded. How do I stop this?

173.194.219.100 Google Inc.
54.192.219.139 Amazon Technologies Inc.
72.21.91.29 EdgeCast Networks, Inc.
54.152.180.212 Amazon Technologies Inc.
205.178.187.13 Network Solutions, LLC
74.125.21.138 Google Inc.
72.167.18.239 GoDaddy.com, LLC

[barbaz]

^ Can't possibly be NoScript related, so I'll split it off of viewtopic.php?f=7&t=20790 to a new thread in Security.
EDIT Feel free to pick a better topic title if you want.

The connections to Google are probably still safebrowsing related?

Have you tried reverse DNS lookup on thise IPs? Please do that and post the results.

Create a new profile, import your settings (quit Fx & copy prefs.js and user.js (if exists) to the new profile), install HTTPFox, set it to sutomatically start watching connections on browser startup, and see what it catches. (May or may not get everything.)

[barbaz]

Oh, and what version did you update from? Some of the changes to Firefox have added more things that could be connecting.

[barbaz]

I should also ask, how have you been determining what's connecting?

FWIW, these are the connections my SeaMonkey 2.39 (like Firefox 42.0) makes on startup:
- My WAN IP (NoScript doing this)
- My home page
- These:

Code: Select all

referer | method | destination
(none) GET https://secure.informaction.com/ipecho/
(none) POST http://ocsp.comodoca.com/
(none) POST http://safebrowsing.clients.google.com/safebrowsing/downloads?client=api&apikey=ABQIAAAALT_LuARPWqUj7bX2mqWTJRQt2QEr-yGktcva5ZhZnWk7HItT7w&appver=2.39&pver=2.2
(none) POST https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=2.39&pver=2.2
(none) POST http://ocsp.digicert.com/

Later on, the only non-browsing-related requests I'm seeing are one for another extension and a few safebrowsing related POST requests.

Do any of these match any of your unknown connections?