Description of the issue:
A lot of random outgoing ports to various IPs is happening when I’m opening Brave. I’m wondering if this would be a security concern or it’s normal. Aside from 80,443, and 53, I don’t really see why other ports would need to be outgoing. If it was using DNS I’d be less concerned. Would it have something to do with the SYNC or Wallet feature? I’ve counted over 20 different non-standard ports outgoing to over 20 different raw IPs.
How can this issue be reproduced?
Use a hostbased firewall that prompts for ingoing and outgoing connection approval. On Macosx I’m using Little Snitch for my firewall.
Expected result:
All traffic using 80,443, or 53 using DNS destinations. Brave Version( check About Brave):
1.52.117
80/443 = Web and 53 is DNS requests. Seems safe to be honest? Brave will check for browser
and component updates (on load, and randomly during usage). Restoring any pages session on load will also initiate ports being used.
Most of it is outgoing to port 4001 to vultrusercontent.com and contaboserver.net when doing reverse DNS lookups. I can’t find any trusted or confident sources that have anything about those sites.
On top of that, why are there outbound connections to the ports below? It’s a “Web” Browser. It should only be sending outgoing to 80,443, and maybe 53.
This starting to go into “Is Brave Browser really safe?” bucket.
“its a web browser” dude im saying this is drving me nuts… because I did have malware so identifying what is and what is not on my network has … been too much.
I’ve confirmed it’s the the “Snowflake” setting in the TOR section. I think it turns the browser into an Exit Node. Which is kind of beep thing to do without mentioning it.