Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While using internet (over Chrome), I noticed that

lsof -i

returned certain suspicious URL(s). A whois lookup suggested that all of those belonged to MarkMonitor. For example:

chrome  3224 jupiter   78u  IPv4 109065      0t0  TCP 192.168.200.2:45519->hx-de-f95.1e100.net:https (ESTABLISHED)

There were 4-5 more such URL(s) each mapped to MarkMonitor. Furthermore, they are disconnected after closing Chrome and are not connected until it is restarted. The same thing does not happen with Firefox.

I could find an answer over the internet (on Google forums). It is very short and does not get into details. Is MarkMonitor having a backdoor in Chrome and tracking me? I have disabled third cookies and history and cookies are always cleared after closing the browser.

share|improve this question

2 Answers 2

I think the confusion here lies in that 1e100.net appears to be owned by MarkMonitor. Actually, MarkMonitor have registered (and "protect") this domain for Google.

You can see here that Google own 1e100.net: What is 1e100.net?

So Google Chrome is phoning home but to Google's servers.

share|improve this answer
    
Hmm...But why does it connect even if no website is open? Just a window with base tab. (I've disabled auto-suggest for address bar) Firefox does not do any such thing until website is opened. –  check123 Jul 20 '12 at 15:23
1  
@check123 Even if no website is open, Chrome still may need to do a few things that require connecting to a Google server. For example: checking for Chrome updates, connecting to a signed-in Chrome account, sending usage statistics or crash reports. –  Mark Beadles Jul 20 '12 at 15:31
    
It's a test to see how you are connected to the web (network up and running, via a proxy or not, etc) –  Cyril N. Jul 20 '12 at 16:05

So my guess is that MarkMonitor is riding on top on Googles IP address range.

http://network-tools.com/default.asp?prog=express&host=74.125.228.110

I went ahead and used Windows firewall settings and disabled both of its ranges:

74.125.0.0/16 173.241.0.0/16

Funny after that, all sites accept the google domain work. :) But you eliminate the markmonitor connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.