Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Why Firefox connects to googleusercontet.com within 2 minutes of it reaching the internet?

  • 7 replies
  • 1 has this problem
  • 1663 views
  • Last reply by ledgeri

more options

HI!

My buddy highlighted an issue, then i re-checked myself and it is worrying to me.

To recreate (windows):

Get any (non-webistaller [not nececarry, to do it this way, but simpler to check]) firefox version (buddy got a fresh portable, i used my kinda privacy fortified one). Disconnect from the internet (plug the cable for fastest result). Make your version usable (install it) Start firefox, and open the Resource Monitor, with the network tab open expand the Network Activity portion (short alphabeticly, by name, check for F for firefox). Plug the cable in.

You soon will see FF will start looking for things, then an adress with a googleusercontet.com will pop up. Does not matter what is the Homepage's default browser, does no matters even if the Homepage is set to blank, this happens.

My best bet would be google safe browsing, but still, without any activity it is already connecting to that?

I know about the Google-FF/Mozilla relation, but this really made me think about why i still like firefox.

HI! My buddy highlighted an issue, then i re-checked myself and it is worrying to me. To recreate (windows): Get any (non-webistaller [not nececarry, to do it this way, but simpler to check]) firefox version (buddy got a fresh portable, i used my kinda privacy fortified one). Disconnect from the internet (plug the cable for fastest result). Make your version usable (install it) Start firefox, and open the Resource Monitor, with the network tab open expand the Network Activity portion (short alphabeticly, by name, check for F for firefox). Plug the cable in. You soon will see FF will start looking for things, then an adress with a googleusercontet.com will pop up. Does not matter what is the Homepage's default browser, does no matters even if the Homepage is set to blank, this happens. My best bet would be google safe browsing, but still, without any activity it is already connecting to that? I know about the Google-FF/Mozilla relation, but this really made me think about why i still like firefox.
Attached screenshots

Chosen solution

So lovely see someone who ... totally ignores the full masseges before

Sorry, given the odd phrasing and capitalization I thought "Homepage's default browser" was referring to some Windows "Homepage" service (I don't use Windows much). The next bit should have clued me in that you meant "browser's default homepage".

opening console on the bottom of the blank page

Now it's your turn to ignore what someone wrote. You're describing the "Web Developer Tools" console tab, which will only show activity related to that one web page (which is nothing for a blank page). I meant for you to check the thing called "Browser Console" in the menus which shows a separate window displaying the activity of the browser itself.

Anyway, I did that and noticed that we load "detectportal.firefox.com", which is an alias for "prod.detectportal.prod.cloudops.mozgcp.net." We use "*.mozgcp.net" as the domain for the content we store in Google Cloud Platform, similar to how we use "*.mozaws.net" for stuff we run on Amazon Web Services. It's not "Google", it's just rented server capacity. If I do a reverse lookup of the IP address it translates to 82.221.107.34.bc.googleusercontent.com which is one of the addresses you saw.

Looking at other things we load at startup according to the Browser Console I see "aus5.mozilla.org", which is currently pointed at prod.balrog.prod.cloudops.mozgcp.net, whose IP address maps to the other host you saw 201.181.244.35.bc.googleusercontent.com

aus5.mozilla.org is used for Firefox software update checks detectportal.firefox.com is used to detect [captive portals]

Read this answer in context 👍 1

All Replies (7)

more options
more options
more options

Can't tell from the screenshot of your tool. For one thing, that domain name is reconstructed from the IP address of whatever Firefox was requesting, but I can guaranteed nothing requested the two showing names.

It sounds like you're testing on a freshly installed Firefox, but is it using a profile you've used for a while? If it's an old profile then it's most likely something from your home page. On a fresh profile we'd populate a bunch of databases and safebrowsing would be part of that, but reverse lookup on safebrowsing IPs seems to resolve to domains like sfo07s13-in-f14.1e100.net, not *.googleusercontent.com. ("1 e100" in scientific notation is 1 "googol"; Google uses it as a kind of inside joke)

Try using blank as a home page and see if that stops it. If it does it's almost certainly the "Pocket Stories" part of our default home page, which can be turned off independently from the other sections of the page.

The other diagnostic I'd suggest is to open up the "Browser Console" inside Firefox. That will show the domain names as requested by Firefox which might provide more information. You could also expand the request in the console and there might be a "Referer:" or "Origin:" header that will indicate what part of Firefox was making the request.

more options

Extensions can use googleusercontent.com to host some of their data files.

Start Firefox in Troubleshoot Mode to check if one of the extensions ("3-bar" menu button or Tools -> Add-ons -> Extensions) or if hardware acceleration or userChrome.css is causing the problem.

  • switch to the DEFAULT theme: "3-bar" menu button or Tools -> Add-ons -> Themes
  • do NOT click the "Refresh Firefox" button on the Troubleshoot Mode start window
more options

dveditz said

Can't tell from the screenshot of your tool. For one thing, that domain name is reconstructed from the IP address of whatever Firefox was requesting, but I can guaranteed nothing requested the two showing names. It sounds like you're testing on a freshly installed Firefox, but is it using a profile you've used for a while? If it's an old profile then it's most likely something from your home page. On a fresh profile we'd populate a bunch of databases and safebrowsing would be part of that, but reverse lookup on safebrowsing IPs seems to resolve to domains like sfo07s13-in-f14.1e100.net, not *.googleusercontent.com. ("1 e100" in scientific notation is 1 "googol"; Google uses it as a kind of inside joke) Try using blank as a home page and see if that stops it. If it does it's almost certainly the "Pocket Stories" part of our default home page, which can be turned off independently from the other sections of the page. The other diagnostic I'd suggest is to open up the "Browser Console" inside Firefox. That will show the domain names as requested by Firefox which might provide more information. You could also expand the request in the console and there might be a "Referer:" or "Origin:" header that will indicate what part of Firefox was making the request.

So lovely see someone who is talking, writing in a serious manner, but totally ignores the full masseges before: I wrote in the initial message, it is happening when blank page is set up as the starter page, did not wrote but same in private browsing -not as it would change a lot... Also i get the same results if i i create a totally fresh profile, or use a "clear everithing when ff closes"-one, or my everyday used one. Through multiple instalment...

I have tried the mentioned console: Fresh profile, just homepage was set to blank, network cable out, full PC restart, starting FF, opening console on the bottom of the blank page, mentioned tool opening, network cable connected: same result, ff connects to the services shown in the picture, with lslightly changed IP adresses, While on any tab of the console there is no activity.

cor-el said

Extensions can use googleusercontent.com to host some of their data files. Start Firefox in Troubleshoot Mode to check if one of the extensions ("3-bar" menu button or Tools -> Add-ons -> Extensions) or if hardware acceleration or userChrome.css is causing the problem.
  • switch to the DEFAULT theme: "3-bar" menu button or Tools -> Add-ons -> Themes
  • do NOT click the "Refresh Firefox" button on the Troubleshoot Mode start window

Tried: same result. Also A little side question: How the heck would be able the hardware acceleration toggle force firefox to connect to a googleusercontent.com -kind of site?

more options

Chosen Solution

So lovely see someone who ... totally ignores the full masseges before

Sorry, given the odd phrasing and capitalization I thought "Homepage's default browser" was referring to some Windows "Homepage" service (I don't use Windows much). The next bit should have clued me in that you meant "browser's default homepage".

opening console on the bottom of the blank page

Now it's your turn to ignore what someone wrote. You're describing the "Web Developer Tools" console tab, which will only show activity related to that one web page (which is nothing for a blank page). I meant for you to check the thing called "Browser Console" in the menus which shows a separate window displaying the activity of the browser itself.

Anyway, I did that and noticed that we load "detectportal.firefox.com", which is an alias for "prod.detectportal.prod.cloudops.mozgcp.net." We use "*.mozgcp.net" as the domain for the content we store in Google Cloud Platform, similar to how we use "*.mozaws.net" for stuff we run on Amazon Web Services. It's not "Google", it's just rented server capacity. If I do a reverse lookup of the IP address it translates to 82.221.107.34.bc.googleusercontent.com which is one of the addresses you saw.

Looking at other things we load at startup according to the Browser Console I see "aus5.mozilla.org", which is currently pointed at prod.balrog.prod.cloudops.mozgcp.net, whose IP address maps to the other host you saw 201.181.244.35.bc.googleusercontent.com

aus5.mozilla.org is used for Firefox software update checks detectportal.firefox.com is used to detect [captive portals]

more options

dveditz said

So lovely see someone who ... totally ignores the full masseges before

Sorry, given the odd phrasing and capitalization I thought "Homepage's default browser" was referring to some Windows "Homepage" service (I don't use Windows much). The next bit should have clued me in that you meant "browser's default homepage".

opening console on the bottom of the blank page

Now it's your turn to ignore what someone wrote. You're describing the "Web Developer Tools" console tab, which will only show activity related to that one web page (which is nothing for a blank page). I meant for you to check the thing called "Browser Console" in the menus which shows a separate window displaying the activity of the browser itself.

Anyway, I did that and noticed that we load "detectportal.firefox.com", which is an alias for "prod.detectportal.prod.cloudops.mozgcp.net." We use "*.mozgcp.net" as the domain for the content we store in Google Cloud Platform, similar to how we use "*.mozaws.net" for stuff we run on Amazon Web Services. It's not "Google", it's just rented server capacity. If I do a reverse lookup of the IP address it translates to 82.221.107.34.bc.googleusercontent.com which is one of the addresses you saw.

Looking at other things we load at startup according to the Browser Console I see "aus5.mozilla.org", which is currently pointed at prod.balrog.prod.cloudops.mozgcp.net, whose IP address maps to the other host you saw 201.181.244.35.bc.googleusercontent.com

aus5.mozilla.org is used for Firefox software update checks detectportal.firefox.com is used to detect [captive portals]

I knew only from the Web Developer Tools' console, the Browser Console is a new thing to me. Even searching to the name, the first result starts mentioning the web-dev-tools.... i made a wronf turn there. Re-reading my post "Homepage's default browser" wanted to be "Homepage's default search engine"... meaning that thread od thought.... whatever...

When i connected with Browser Console enabled, i saw the mentioned adress, and your explanation fills my void.

Thank you for the provided information!