Brave (linux) makes constant UDP :443 connections to Google

Thanks so much for all your help, I am probably going to be awhile before I get to try out all your suggestions as I am super bogged down with backlogged work at the moment.

I’ll do a bit of digging on my end in the meantime to see if there are any other similar reports.

Thanks, people seem to be seeing similar things based on this forum alone. Again though, as you have suggested it may not be Brave, their could be some clever root kit or other malware that just does a good job of pretending to be Brave that is circulating.

For related posts on this very forum see:

1. Strange Network Traffic out to UDP port 137 from Brave ← Again appears to be phoning Google with UDP (Windows)

2. Why does Brave Constantly Phones Back to Google on UDP 443 ← Especially interesting as it is phoning Google with UDP and the exact same ports as in my instance. (Windows)

3. Unkown UDP Connection Via Brave Helper <-Again appears to be phoning Google with UDP (OS X)

I think there were other examples even off this forum, but I am having trouble finding them at the moment, especially as I am in a hurry to get back to the giant pile of work that I am supper behind on.

Let me be the first to admit I am super clueless when it comes to networking, but my extremely limited and possibly incorrect understanding is that Brave should only be opening TCP connection as that is what webpages run on, so opening UDP connections was automatically a bit suspect, and so many of them all to google (or cloud flare, or AWS) just made it more so.

Of course, this may just be something that likes to pretend to be Brave, and that may just be someone paying for hosting at Google to route their malware through.