Brave contacting Amazon & google servers on startup

Browser Support Desktop Support
1

Hi there, this is my first post and I’m very tired as its 5 AM, so please go easy on me. I’m privacy conscious and have been freshly setting up brave on Linux, with pretty much everything off and have noticed it makes many connections to Amazon servers on every startup:

on launch:

mohasi@linux:~$ sudo netstat -atupen | grep ESTABLISHED
tcp        0      0 10.96.0.22:58898        54.148.122.24:443       ESTABLISHED 1000       91127      9661/brave --type=u ---- amazon
tcp        0      0 10.96.0.22:42744        54.218.48.21:443        ESTABLISHED 1000       91129      9661/brave --type=u ---- amazon
tcp        0      0 10.96.0.22:42738        54.218.48.21:443        ESTABLISHED 1000       98817      9661/brave --type=u ---- amazon
tcp        0      0 10.96.0.22:37996        35.163.181.38:443       ESTABLISHED 1000       98818      9661/brave --type=u ---- amazon
udp        0      0 192.168.1.16:68         192.168.1.1:67          ESTABLISHED 0          28589      1056/NetworkManager

on search.brave.com search:

tcp        0      0 10.96.0.22:59076        34.214.138.130:443      ESTABLISHED 1000       104878     10126/brave --type= 
tcp        0      0 10.96.0.22:48180        18.165.201.74:443       ESTABLISHED 1000       104031     10126/brave --type= 
tcp        0      0 10.96.0.22:53654        13.224.132.50:443       ESTABLISHED 1000       104972     10126/brave --type= 
tcp        0      0 10.96.0.22:36864        54.192.137.35:443       ESTABLISHED 1000       106724     10126/brave --type= 
tcp        0      0 10.96.0.22:54820        185.70.42.22:443        ESTABLISHED 1000       108622     10126/brave --type= 
tcp        0      0 10.96.0.22:39216        142.250.187.195:443     ESTABLISHED 1000       102907     10126/brave --type= 
tcp        0      0 10.96.0.22:36772        54.192.137.35:443       ESTABLISHED 1000       106713     10126/brave --type= 
tcp        0      0 10.96.0.22:54810        185.70.42.22:443        ESTABLISHED 1000       108620     10126/brave --type= 
tcp        0      0 10.96.0.22:42478        52.39.41.50:443         ESTABLISHED 1000       99894      10126/brave --type= 
udp        0      0 192.168.1.16:68         192.168.1.1:67          ESTABLISHED 0          28589      1056/NetworkManager 
udp        0      0 10.96.0.22:51107        13.224.132.50:443       ESTABLISHED 1000       108619     10126/brave --type= 
udp        0      0 10.96.0.22:37691        54.192.137.35:443       ESTABLISHED 1000       104030     10126/brave --type= 
udp        0      0 10.96.0.22:57884        54.192.137.35:443       ESTABLISHED 1000       105020     10126/brave --type=

on blank incognito window in guest profile:

tcp        0      0 10.96.0.22:48172        34.214.138.130:443      ESTABLISHED 1000       101083     10596/brave --type= 
tcp        0      0 10.96.0.22:40872        216.58.212.195:443      ESTABLISHED 1000       106285     10596/brave --type= ----- google!?
tcp        0      0 10.96.0.22:47890        52.39.41.50:443         ESTABLISHED 1000       103285     10596/brave --type= 
tcp        0      0 10.96.0.22:42682        54.149.188.201:443      ESTABLISHED 1000       101076     10596/brave --type= 
udp        0      0 192.168.1.16:68         192.168.1.1:67          ESTABLISHED 0          28589      1056/NetworkManager

Many times the server IPs change, but whois shows its amazon. I tried with sync on, sync off, I have turned off pretty much everything and it still happens. I am launching into a new blank tab, no homepage, no nothing. Why does a privacy focused browser such as brave contact Amazon on every launch, literally without any kind of page on screen. Why!? I would like to know.

It also contacted google: 216.58.212.195 this when typed in directly goes to google.com, again, could someone please explain to me why as this is quite worrying to me.

2

Answering my own question, it the Amazon and Google connections are related to the sync, update checks etc.

variations.brave.com
go-updater.brave.com
go-updater-1830831421.us-west-2.elb.amazonaws.com
brave-production-proxy-238320562.us-west-2.elb.amazonaws.com
sync-v2.brave.com
sync-alb-152764135.us-west-2.elb.amazonaws.com

These make up the majority of the AWS calls. The google call is to update.googleapis.com which I believe is triggered from chrome based browsers for some sort of settings related task, I read this on https://divestos.org/pages/network_connections

https://update.googleapis.com - Used for altering various browser settings and to check for newer internal databases and extensions served by Omaha. Includes CPU type, amount of RAM, and major OS version. These databases can be seen via the chrome://components page.

I am not 100% sure, but I think out of the different components, it may be the Widevine Content Decryption Module that goes to google to check its version.

3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.