barip15..Firefox connecting to dodgy site.

[harryray2]

Does anyone have any idea what the site barip15.com is? On my virus checker network connections it shows Firefox as connecting to this site.
I have it blocked in my Host file and also on Ublock so it's not causing any problems, but I can't seem to get rid of the connection.

I've done a Google search, but the only references to it seem to be from various blocking lists.

[therube]

I'll assume that if you were to use Edge, Chrome, or whatever, the same does not occur?


Disable all extensions (or run FF in Safe Mode for a while) & see if the hits continue?
(I.e., it might be a [malicious] extension trying to reach out & touch [someone ].)

[harryray2]

Yes, thanks, I thought of restarting in safe mode..I'll give it a try later on. I'll also start Tor to see if I have the same problem.

It hasn't caused me problems so fas asI have it blocked in the host file, but Tor ignores the host file. Actually, do you have any idea how to get Tor to use the host file, or is that not possible?

If it is an extension, I guess I'll have to start a process of elimination to track down the extension responsible.

[harryray2]

I restarted FF in safe mode and, much to my surprise, it still seems to be connecting to barip15....I don't know if it makes a difference, but I'm using FF portable.

[raccoon]

It's listed on a number of "malicious domains" host file lists. So you have some sort of malware installed that you should get removed. Best practice always is to nuke the system and start fresh.

[harryray2]

The connection is coming from Firefox, but as I've blocked the domain it appears to not sending or receiving any data.

I really need to track down what's causing it, as I'm using FF portable which I back up regularly, and which has a lot of info on which I can't duplicate.

[therube]

As a test, create a new, clean Profile & see if you still see the connection.

[harryray2]

I tried doing this but got the same result.

I use the portableapps.com version of Firefox, I'm beginning to wonder if it's a problem with the portableapps version.

[therube]

(AFAIK, the Portable Apps version is exactly the same as FF itself - with exception of the PA loader & associated parts.)

Look at things, external.
Antivirus or similar?
Rogue program that may be injecting itself (hence barip15.com) into the FF process?