I was surprised to see that the firewall blocked 5 firefox requests today. I did not see any alerts. Could they have happened when I was away from the machine? I’ve attached a png file with the IP and port info. I looked up the destination IPs and they were for PSI Net which seems to be a place to avoid.
These 5 requests all happened in a 6 second period. I can’t recall what I was doing at that time.
I’m wondering what I should think about these blocked requests?
Why would they happen?
Should I be concerned?
I took a look at my browsing history for today and could not see any unusual sites I visited.
–Larry (who has never seen a firewall event before!)
These could just be some intrusion attempts and Comodo is just doing its job. There is nothing to worry. It does not seem to have anything with the browser. Firewall is just protecting you, just ignore them.
So the question becomes what firefox extensions you have installed?
Do any Ebay or auction stuff?
Yes you should be worried if non of the above rings any memory bells
as that would mean Firefox is demonically possessed and is going to auction
your belongings while you’re not around. >:-D
Or malware of some sort, but then why contact Auctiva
Bad Froger, you gave me a laugh! And you jogged my memory that I was on eBay looking for something about that time. As an experiment I just visited eBay again and now I know that many listings use Auctiva to show the supersized images and the firewall then blocks requests. However, I do see the images I want to see. So I don’t know what is being blocked.
As I interpret the info about the blocked requests, the source is my PC (which is behind a router). I have firefox set to Browser in the security rules.
Is it possible to know what the requests are for? And why they are blocked?
Also, when I do a WhoIs lookup at DNS Stuff, it comes up with PSI Net, not Auctiva. How’d you find Auctiva?
To resolve the IP to Auctiva
I ran a tracroute with reverse lookup to resolve the routers hostname.
PSI Net is Auctiva’s domain registrar.
That is correct they were outgoing blocks.
I can’t say for sure what the traffic was about, but I would guess due to the nature of their business, they would
have hit counters or other script type stuff running on their pages for feedback/market research type stuff.
Or more ads.
Why the fire wall blocked it I can’t say off the top. The requests must have been somehow outside the norm of
browser behaviour. As defined by CIS’s security rules. Your settings.
You can control scripts on pages with NoScript extension for FF. You would be amazed at how many connections
viewing one page can try to make. I only allow as much as I have to to get what I want from any page.