On Wed, 29 Jun 2016 17:20:17 +0000 (UTC), Jannah Jankowski wrote:

Why does Firefox not respect the HOSTS file in Windows?
http://i.cubeupload.com/P0jKaY.jpg

In my hosts file are entries to block sites that show up as connections
that Firefox makes, even when Firefox is in SAFE MODE.

How can that be possible?

1. I add an entry to the Windows hosts file and SAVE it.
2. I start Firefox in SAFE mode.
3. Firefox _still_ shows up as "ESTABLISHED" to that rogue site.


Here is a likely reason.

If you want to block Firefox from opening a connection, you need to
find which domain name Firefox used -- which may not be the same
as the domain name showing in Process Hacker.

i) The same server can have multiple domain names. For example,
"paint.net" and "ip-50-63-202-26.ip.secureserver.net" go to
the same server at IP address 50.63.202.26

ii) Process Hacker does not show which domain name Firefox used.
Process Hacker gets the IP address, (say) 50.63.202.26, and
does a reverse-DNS lookup to get one of the domain names.
That domain name may not be the same as the domain name which
Firefox used.

iii) Adding a domain name (say) "ip-50-63-202-26.ip.secureserver.net"
to your hosts file can only block Firefox when Firefox uses
that same domain name to open a connection. It will not block
Firefox when Firefox uses another one of the server's domain
names, (say) "paint.net", to open a connection.



How can that possibly be that Firefox doesn't respect the hosts file?

Where do these rogue connections come from anyway?
http://i.cubeupload.com/T274r0.jpg



------------------ Here are just the first six of amazonaws --------
127.0.0.1 ec2-52-25-189-162.us-west-2.compute.amazonaws.com # firefox
safemode
127.0.0.1 ec2-52-26-2-199.us-west-2.compute.amazonaws.com # firefox
safemode
127.0.0.1 ec2-54-148-80-75.us-west-2.compute.amazonaws.com # firefox
safemode
127.0.0.1 ec2-54-213-112-246.us-west-2.compute.amazonaws.com # firefox
safemode
127.0.0.1 ec2-54-213-123-171.us-west-2.compute.amazonaws.com # firefox
safemode
127.0.0.1 ec2-54-69-9-44.us-west-2.compute.amazonaws.com # firefox safemode
------------------ Here are just the first six of cloudfront --------
127.0.0.1 server-52-84-24-10.sea32.r.cloudfront.net # firefox safemode
127.0.0.1 server-52-84-24-129.sea32.r.cloudfront.net # firefox safemode
127.0.0.1 server-52-84-24-141.sea32.r.cloudfront.net # firefox safemode
127.0.0.1 server-52-84-24-205.sea32.r.cloudfront.net # firefox safemode
127.0.0.1 server-52-84-24-28.sea32.r.cloudfront.net # firefox safemode
127.0.0.1 server-52-84-24-7.sea32.r.cloudfront.net # firefox safemode
------------------


--
Kind regards
Ralph