2

While using internet (over Chrome), I noticed that 

lsof -i

returned certain suspicious URL(s). A whois lookup suggested that all of those belonged to MarkMonitor. For example:

chrome  3224 jupiter   78u  IPv4 109065      0t0  TCP 192.168.200.2:45519->hx-de-f95.1e100.net:https (ESTABLISHED)

There were 4-5 more such URL(s) each mapped to MarkMonitor. Furthermore, they are disconnected after closing Chrome and are not connected until it is restarted. The same thing does not happen with Firefox.

I could find an answer over the internet (on Google forums). It is very short and does not get into details. Is MarkMonitor having a backdoor in Chrome and tracking me? I have disabled third cookies and history and cookies are always cleared after closing the browser.

Improve this question
0

2 Answers 2

Reset to default
5

I think the confusion here lies in that 1e100.net appears to be owned by MarkMonitor. Actually, MarkMonitor have registered (and "protect") this domain for Google.

You can see here that Google own 1e100.net: What is 1e100.net?

So Google Chrome is phoning home but to Google's servers.

Improve this answer
3
  • Hmm...But why does it connect even if no website is open? Just a window with base tab. (I've disabled auto-suggest for address bar) Firefox does not do any such thing until website is opened.
    – check123
    Commented Jul 20, 2012 at 15:23
  • 1
    @check123 Even if no website is open, Chrome still may need to do a few things that require connecting to a Google server. For example: checking for Chrome updates, connecting to a signed-in Chrome account, sending usage statistics or crash reports.
    – Mark Beadles
    Commented Jul 20, 2012 at 15:31
  • It's a test to see how you are connected to the web (network up and running, via a proxy or not, etc)
    – Cyril N.
    Commented Jul 20, 2012 at 16:05
0

So my guess is that MarkMonitor is riding on top on Googles IP address range.

http://network-tools.com/default.asp?prog=express&host=74.125.228.110

I went ahead and used Windows firewall settings and disabled both of its ranges:

74.125.0.0/16 173.241.0.0/16

Funny after that, all sites except the Google domain work. :) But you eliminate the markmonitor connections.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .