Fresh install Firefox always connecting bc.googleusercontent.com
Hello.
90.0.2 (64-bit) on Ubuntu 20.04.
I noticed a lot of activity from my desktop computer to various ip's at bc.googleusercontent.com whenever I start, visit sites, or shut down firefox. I know this because I'm watching the tcp stream with tcpdump | grep 'googleusercontent'
This ONLY happens in Firefox not chrome or other browsers. Seeing this is a fresh install with no addons, tweaks, etc. I'd like to know WHY a fresh install of Firefox phones home to some googleusercontent user. See below snippet of logs:
11:33:42.093364 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [P.], seq 471329027:471329073, ack 2729502542, win 501, options [nop,nop,TS val 1305694051 ecr 3857902929], length 46 11:33:42.107201 IP xxx.xxx.xxx.xx.bc.googleusercontent.com.https > desktop-pc.57790: Flags [P.], seq 1:47, ack 46, win 269, options [nop,nop,TS val 3857961260 ecr 1305694051], length 46 11:33:42.107250 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [.], ack 47, win 501, options [nop,nop,TS val 1305694065 ecr 3857961260], length 0 11:33:52.560740 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [P.], seq 46:92, ack 47, win 501, options [nop,nop,TS val 1305704519 ecr 3857961260], length 46 11:33:52.561589 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [P.], seq 92:123, ack 47, win 501, options [nop,nop,TS val 1305704519 ecr 3857961260], length 31 11:33:52.561604 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [F.], seq 123, ack 47, win 501, options [nop,nop,TS val 1305704519 ecr 3857961260], length 0 11:33:52.610772 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [F.], seq 123, ack 47, win 501, options [nop,nop,TS val 1305704569 ecr 3857961260], length 0 11:33:52.627368 IP xxx.xxx.xxx.xx.bc.googleusercontent.com.https > desktop-pc.57790: Flags [.], ack 123, win 269, options [nop,nop,TS val 3857971780 ecr 1305704519], length 0 11:33:52.627377 IP xxx.xxx.xxx.xx.bc.googleusercontent.com.https > desktop-pc.57790: Flags [F.], seq 47, ack 123, win 269, options [nop,nop,TS val 3857971780 ecr 1305704519], length 0 11:33:52.627382 IP desktop-pc.57790 > xxx.xxx.xxx.xx.bc.googleusercontent.com.https: Flags [.], ack 48, win 501, options [nop,nop,TS val 1305704585 ecr 3857971780], length 0 11:33:52.627383 IP xxx.xxx.xxx.xx.bc.googleusercontent.com.https > desktop-pc.57790: Flags [.], ack 124, win 269, options [nop,nop,TS val 3857971780 ecr 1305704569], length 0 11:34:03.842933 IP desktop-pc.51722 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [S], seq 996339558, win 64240, options [mss 1460,sackOK,TS val 955624625 ecr 0,nop,wscale 7], length 0 11:34:03.858960 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51722: Flags [S.], seq 925690353, ack 996339559, win 65535, options [mss 1430,sackOK,TS val 2064824943 ecr 955624625,nop,wscale 8], length 0 11:34:03.858998 IP desktop-pc.51722 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 955624641 ecr 2064824943], length 0 11:34:03.859153 IP desktop-pc.51722 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [P.], seq 1:292, ack 1, win 502, options [nop,nop,TS val 955624641 ecr 2064824943], length 291: HTTP: GET /canonical.html HTTP/1.1 11:34:03.875183 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51722: Flags [.], ack 292, win 261, options [nop,nop,TS val 2064824959 ecr 955624641], length 0 11:34:03.875990 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51722: Flags [P.], seq 1:303, ack 292, win 261, options [nop,nop,TS val 2064824960 ecr 955624641], length 302: HTTP: HTTP/1.1 200 OK 11:34:03.876002 IP desktop-pc.51722 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [.], ack 303, win 501, options [nop,nop,TS val 955624658 ecr 2064824960], length 0 11:34:03.883688 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [S], seq 768896638, win 64240, options [mss 1460,sackOK,TS val 1626218123 ecr 0,nop,wscale 7], length 0 11:34:03.905544 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [S.], seq 1394470845, ack 768896639, win 65535, options [mss 1430,sackOK,TS val 1204742904 ecr 1626218123,nop,wscale 8], length 0 11:34:03.905578 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 1626218145 ecr 1204742904], length 0 11:34:03.907941 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [P.], seq 1:518, ack 1, win 502, options [nop,nop,TS val 1626218148 ecr 1204742904], length 517 11:34:03.912857 IP desktop-pc.51726 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [S], seq 2152459553, win 64240, options [mss 1460,sackOK,TS val 955624695 ecr 0,nop,wscale 7], length 0 11:34:03.924152 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51726: Flags [S.], seq 590793181, ack 2152459554, win 65535, options [mss 1430,sackOK,TS val 3149516165 ecr 955624695,nop,wscale 8], length 0 11:34:03.924192 IP desktop-pc.51726 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 955624706 ecr 3149516165], length 0 11:34:03.924277 IP desktop-pc.51726 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [P.], seq 1:294, ack 1, win 502, options [nop,nop,TS val 955624706 ecr 3149516165], length 293: HTTP: GET /success.txt?ipv4 HTTP/1.1 11:34:03.934710 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [.], ack 518, win 261, options [nop,nop,TS val 1204742936 ecr 1626218148], length 0 11:34:03.936093 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [.], seq 1:2837, ack 518, win 261, options [nop,nop,TS val 1204742937 ecr 1626218148], length 2836 11:34:03.936123 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 2837, win 492, options [nop,nop,TS val 1626218176 ecr 1204742937], length 0 11:34:03.936710 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 2837:4575, ack 518, win 261, options [nop,nop,TS val 1204742937 ecr 1626218148], length 1738 11:34:03.936731 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 4575, win 497, options [nop,nop,TS val 1626218176 ecr 1204742937], length 0 11:34:03.944581 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51726: Flags [.], ack 294, win 261, options [nop,nop,TS val 3149516186 ecr 955624706], length 0 11:34:03.944596 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51726: Flags [.], ack 294, win 261, options [nop,nop,TS val 3149516186 ecr 955624706], length 0 11:34:03.945221 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.http > desktop-pc.51726: Flags [P.], seq 1:221, ack 294, win 261, options [nop,nop,TS val 3149516186 ecr 955624706], length 220: HTTP: HTTP/1.1 200 OK 11:34:03.945232 IP desktop-pc.51726 > xvx.xxv.xvx.xx.bc.googleusercontent.com.http: Flags [.], ack 221, win 501, options [nop,nop,TS val 955624727 ecr 3149516186], length 0 11:34:03.980463 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [P.], seq 518:582, ack 4575, win 501, options [nop,nop,TS val 1626218220 ecr 1204742937], length 64 11:34:03.980767 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [P.], seq 582:752, ack 4575, win 501, options [nop,nop,TS val 1626218221 ecr 1204742937], length 170 11:34:03.980898 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [P.], seq 752:984, ack 4575, win 501, options [nop,nop,TS val 1626218221 ecr 1204742937], length 232 11:34:04.000850 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 4575:5155, ack 752, win 265, options [nop,nop,TS val 1204743002 ecr 1626218220], length 580 11:34:04.000894 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 5155, win 501, options [nop,nop,TS val 1626218241 ecr 1204743002], length 0 11:34:04.000897 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 5155:5186, ack 752, win 265, options [nop,nop,TS val 1204743002 ecr 1626218220], length 31 11:34:04.000902 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 5186, win 501, options [nop,nop,TS val 1626218241 ecr 1204743002], length 0 11:34:04.001167 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [P.], seq 984:1015, ack 5186, win 501, options [nop,nop,TS val 1626218241 ecr 1204743002], length 31 11:34:04.020369 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [.], ack 984, win 269, options [nop,nop,TS val 1204743021 ecr 1626218221], length 0 11:34:04.026854 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [.], ack 1015, win 269, options [nop,nop,TS val 1204743028 ecr 1626218241], length 0 11:34:04.085712 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 5186:5476, ack 1015, win 269, options [nop,nop,TS val 1204743086 ecr 1626218241], length 290 11:34:04.085735 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 5476, win 501, options [nop,nop,TS val 1626218325 ecr 1204743086], length 0 11:34:04.085740 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 5476:6347, ack 1015, win 269, options [nop,nop,TS val 1204743087 ecr 1626218241], length 871 11:34:04.085745 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 6347, win 499, options [nop,nop,TS val 1626218326 ecr 1204743087], length 0 11:34:04.085746 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 6347:6493, ack 1015, win 269, options [nop,nop,TS val 1204743087 ecr 1626218241], length 146 11:34:04.085749 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 6493, win 498, options [nop,nop,TS val 1626218326 ecr 1204743087], length 0 11:34:04.085750 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [P.], seq 6493:6532, ack 1015, win 269, options [nop,nop,TS val 1204743087 ecr 1626218241], length 39 11:34:04.085753 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [.], ack 6532, win 498, options [nop,nop,TS val 1626218326 ecr 1204743087], length 0 11:34:04.085923 IP desktop-pc.58270 > xvx.xxv.xvx.xx.bc.googleusercontent.com.https: Flags [P.], seq 1015:1054, ack 6532, win 501, options [nop,nop,TS val 1626218326 ecr 1204743087], length 39 11:34:04.110790 IP xvx.xxv.xvx.xx.bc.googleusercontent.com.https > desktop-pc.58270: Flags [.], ack 1054, win 269, options [nop,nop,TS val 1204743112 ecr 1626218326], length 0
Wšě wotmołwy (4)
Start Firefox using Troubleshoot(Safe) Mode {web link}
A small dialog should appear. Click Start In Troubleshoot(Safe) Mode (not Refresh). Is the problem still there?
Tried the solution. Still getting a steady stream of connections to bc.googleusercontent.com
I have data from the troubleshooting print out but it exceeds the limit of this posting.
Web search: https://www.bing.com/search?q=bc.googleusercontent.com
What is bc.googleusercontent.com
I called for more help.
Thanks @FredMcD.
I have researched bc.googleusercontent.com and know that they are not google.com but users on their cloud platform.
The mystery is why are they only active outbound from my machine when I open Firefox with no plugins or any outbound connections established on a fresh install with a blank landing page.
Thanks for any insights.