Assessment of network requests sent by web browsers at first launch

The results of the analysis of network activity while using browsers such as Firefox, Chrome, Safari, Edge, Opera, Brave, Yandex Browser, Ungoogled Chromium, Mulvad, Vivaldi, Librewolf, Arc, Tor Browser, Kagi Orion, Pale Moon, Floorp, Zen, Waterfox, and Thorium have been published. The aim of the study was to evaluate the traffic associated with browsers sending service network requests that do not relate to user content being processed. In addition to telemetry transmission, such requests are used to check for updates, download malware blocklists, filter ads, and generate the content of the start page.

Only requests sent by freshly installed instances of browsers, before any user activity, were considered during testing. The newest versions of the browsers available at the time of testing were checked. No service network activity immediately after start was recorded for Kagi Orion, Tor Browser, Pale Moon, and Ungoogled Chromium (see supplement). All other browsers established network connections with external hosts servers, which at least received information about the user's IP address.

It is noted that none of the browsers sending requests provided users with the option to opt out of initial data transmission — many browsers allow disabling telemetry transmission in settings, but these settings can only be changed after the data has already been sent at first launch.

Distribution of browsers by the number of hosts to which service requests were sent (with the 2021 statistics in parentheses):

• 82 Zen
• 48 (21) Edge
• 42 Floorp
• 31 (21) Opera
• 29 (15) Firefox
• 25 (9) Chrome
• 24 (3) Librewolf
• 24 (15) Yandex Browser
• 21 Waterfox
• 17 (7) Brave
• 16 (44) Arc
• 15 (0) Mulvad
• 11 (13) Vivaldi
• 10 Thorium
• 6 (6) Safari
• 3 0 (0) Ungoogled Chromium
• 0 (0) Kagi Orion
• 0 (0) Tor Browser
• 0 Pale Moon

Hosts with which Firefox established connections:

• prod.classify-client.prod.webservices.mozgcp.net TCP port 443
• prod.remote-settings.prod.webservices.mozgcp.net TCP port 443
• mc.prod.ads.prod.webservices.mozgcp.net TCP port 443
• prod.detectportal.prod.cloudops.mozgcp.net TCP port 80
• push.services.mozilla.com TCP port 443
• prod.balrog.prod.cloudops.mozgcp.net TCP port 443
• telemetry-incoming.r53-2.services.mozilla.com TCP port 443
• safebrowsing.googleapis.com TCP port 443
• firefox.settings.services.mozilla.com TCP port 443
• ads.mozilla.org TCP port 443
• aus5.mozilla.org TCP port 443
• services.addons.mozilla.org TCP port 443
• location.services.mozilla.com TCP port 443
• a1887.dscq.akamai.net TCP port 80
• detectportal.firefox.com TCP port 80
• incoming.telemetry.mozilla.org TCP port 443
• r10.o.lencr.org on TCP port 80
• prod.content-signature-chains.prod.webservices.mozgcp.net TCP port 443
• e3913.cd.akamaiedge.net TCP port 80
• content-signature-2.cdn.mozilla.net TCP port 443
• a19.dscg10.akamai.net TCP port 80
• edgedl.me.gvt1.com TCP port 443
• attachments.prod.remote-settings.prod.webservices.mozgcp.net TCP port 443
• addons.mozilla.org TCP port 443
• pki-goog.l.google.com TCP port 80
• ocsp.digicert.com TCP port 80

Activated:

• clients.l.google.com TCP port 443
• safebrowsingohttpgateway.googleapis.com on TCP port 443
• accounts.google.com on TCP port 443
• googlehosted.l.googleusercontent.com TCP port 443
• optimizationguide-pa.googleapis.com TCP port 443
• clients2.googleusercontent.com TCP port 443
• redirector.gvt1.com TCP port 80
• r3.sn-3pm7dned.gvt1.com on TCP port 80
• update.googleapis.com TCP port 443
• r1.sn-3pm7dne6.gvt1.com TCP port 80
• edgedl.me.gvt1.com TCP port 80
• clientservices.googleapis.com TCP port 443
• update.googleapis.com UDP port 443
• www.googleapis.com TCP port 443
• optimizationguide-pa.googleapis.com UDP port 443
• chromewebstore.googleapis.com TCP port 443
• www.google.com TCP port 443
• www.gstatic.com TCP port 443
• ogads-pa.clients6.google.com TCP port 443
• plus.l.google.com TCP port 443
• play.google.com TCP port 443
• chromewebstore.googleapis.com UDP port 443
• clientservices.googleapis.com UDP port 443

Safari:

• token.safebrowsing.apple TCP port 443
• www.apple.com TCP port 443
• securemetrics.apple.com TCP port 443
• securemvt.apple.com TCP port 443
• gateway.icloud.com TCP port 443
• api-glb-euc1b.smoot.apple.com TCP port 443

Ungoogled Chromium:

• clients.l.google.com TCP port 443
• raw.githubusercontent.com TCP port 443
• clients2.google.com TCP port 443

Vivaldi:

• clients.l.google.com TCP port 80
• vivaldi.map.fastly.net TCP port 443
• mimir2.vivaldi.com TCP port 443
• update.vivaldi.com TCP port 443
• weather.vivaldi.com TCP port 443
• downloads.vivaldi.com TCP port 443
• vivaldi.com TCP port 443
• update.googleapis.com TCP port 443
• player.vimeo.com.cdn.cloudflare.net TCP port 443

Yandex Browser:

• api.browser.yandex.com TCP port 443
• update.googleapis.com TCP port 443
• browser.yandex.com TCP port 443
• sba.yandex.net TCP port 443
• 300.ya.ru TCP port 443
• neuro.translate.yandex.ru TCP port 443
• s3.yandex.net TCP port 443
• edgedl.me.gvt1.com TCP port 80
• ya.ru TCP port 443
• yandex.ru TCP port 443
• browser.yandex.ru TCP port 443
• yastatic.net TCP port 443
• api.browser.yandex.ru TCP port 80
• edgedl.me.gvt1.com TCP port 443
• mail.yandex.ru TCP port 443
• dr.yandex.net TCP port 443
• brontp-pre.yandex.ru TCP port 443
• dr2.yandex.net TCP port 443
• cloud.cdn.yandex.net TCP port 443
• dzen.ru TCP port 443
• suggest.dzen.ru TCP port 443
• mc.yandex.ru TCP port 443
• suggest.sso.dzen.ru TCP port 443
• cloudcdn-ams19.cdn.yandex.net TCP port 443

Librewolf

• addons.mozilla.org TCP port 443
• push.services.mozilla.com TCP port 443
• services.addons.mozilla.org TCP port 443
• gitlab.com TCP port 443
• a1887.dscq.akamai.net TCP port 80
• firefox.settings.services.mozilla.com TCP port 443
• versioncheck-bg.addons.mozilla.org TCP port 443
• publicsuffix.org TCP port 443
• prod.remote-settings.prod.webservices.mozgcp.net TCP port 443
• ublockorigin.pages.dev TCP port 443
• prod.content-signature-chains.prod.webservices.mozgcp.net TCP port 443
• ublockorigin.pages.dev UDP port 443
• raw.githubusercontent.com TCP port 443
• malware-filter.gitlab.io TCP port 443
• 1278313086.rsc.cdn77.org TCP port 443
• prod.globalsign.map.fastly.net TCP port 80
• curbengh.github.io TCP port 443
• pgl.yoyo.org TCP port 443
• cdn.jsdelivr.net.cdn.cloudflare.net TCP port 443
• cdn.jsdelivr.net UDP port 443
• filters.adtidy.org TCP port 443
• dualstack.n.sni.global.fastly.net oTCP port 443
• cdn.statically.io UDP port 443
• ublockorigin.github.io TCP port 443

Thorium:

• accounts.google.com TCP port 443
• www.google.com TCP port 443
• www.gstatic.com TCP port 443
• ogads-pa.clients6.google.com TCP port 443
• plus.l.google.com TCP port 443
• play.google.com TCP port 443
• ogads-pa.clients6.google.com UDP port 443
• apis.google.com TCP port 443
• update.googleapis.com TCP port 443

Addendum: For Ungoogled Chromium, the testing results have been revised. The data regarding the installation of three connections was incorrect, as the author of the study inadvertently tested a version with additional extensions uBlock Origin Lite and Chromium Web Store installed, rather than a clean instance. The connections mentioned in the report to google.com and raw.githubusercontent.com were made by these extensions, which are not used by default in Ungoogled Chromium. After this mistake, the author retested all browsers, but no further differences were found.

Source: opennet.ru