Message-ID: <690683d1@news.ausics.net>
From: not@telling.you.invalid (Computer Nerd Kev)
Subject: Re: Anyone know how this happens
Newsgroups: comp.os.linux.misc
References: <10e5o40$1gsnr$5@dont-email.me>
User-Agent: tin/2.6.5-20250707 ("Helmsdale") (Linux/2.4.31 (i586))
NNTP-Posting-Host: news.ausics.net
Date: 2 Nov 2025 08:04:02 +1000
Organization: Ausics - https://newsgroups.ausics.net
Lines: 82
X-Complaints: abuse@ausics.net
Path: csiph.com!news.bbs.nz!news.ausics.net!not-for-mail
Xref: csiph.com comp.os.linux.misc:76922

The Natural Philosopher <tnp@invalid.invalid> wrote:
> 
> Completely blank firefox - no sites loaded
> 
> netstat -an | grep tcp | grep 443
> 
> tcp        0      0 192.168.0.7:51446       34.107.243.93:443 
> ESTABLISHED

I get (Firefox 140.4.0esr):
tcp        0      0 192.168.1.100:51410     151.101.81.91:443       ESTABLISHED 
tcp        0      0 192.168.1.100:59912     34.160.144.191:443      ESTABLISHED 
tcp        0      0 192.168.1.100:51390     151.101.81.91:443       ESTABLISHED 

The "about:networking" page lists
"content-signature-2.cdn.mozilla.net" which resolves to
34.160.144.191. Also "firefox.settings.services.mozilla.com" and
"firefox-settings-attachments.cdn.mozilla.net" which are
151.101.81.91:

$ dig content-signature-2.cdn.mozilla.net

; <<>> DiG 9.18.25 <<>> content-signature-2.cdn.mozilla.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10399
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;content-signature-2.cdn.mozilla.net. IN        A

;; ANSWER SECTION:
content-signature-2.cdn.mozilla.net. 483 IN CNAME content-signature-chains.prod.autograph.services.mozaws.net.
content-signature-chains.prod.autograph.services.mozaws.net. 186 IN A 34.160.144.191

$ dig firefox.settings.services.mozilla.com

; <<>> DiG 9.18.25 <<>> firefox.settings.services.mozilla.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46401
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;firefox.settings.services.mozilla.com. IN A

;; ANSWER SECTION:
firefox.settings.services.mozilla.com. 28 IN CNAME mozilla.map.fastly.net.
mozilla.map.fastly.net. 31      IN      A       151.101.81.91

$ dig firefox-settings-attachments.cdn.mozilla.net

; <<>> DiG 9.18.25 <<>> firefox-settings-attachments.cdn.mozilla.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7059
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;firefox-settings-attachments.cdn.mozilla.net. IN A

;; ANSWER SECTION:
firefox-settings-attachments.cdn.mozilla.net. 42 IN CNAME mozilla.map.fastly.net.
mozilla.map.fastly.net. 54      IN      A       151.101.81.91


So Mozilla's using Google and Fastly as hosts for services Firefox
is connecting to automatically. However in the past I've tried to
block these mystery services from connecting, so thanks for the
tip. Also a connection to a government website that I haven't even
visited for weeks! I really which I could ditch FF and just use
Dillo.

-- 
__          __
#_ < |\| |< _#