Client port 443 outgoing connection

[gnar1ta$]

Got this today from my firewall when I started client 0.4.0 on OS X:
"Bitcoin wants to connect to store.esellerate.net on TCP port 443 (https) IP 209.87.181.216"

Is this normal?  I haven't seen it before.

[1713978527]

1713978527

[1713978527]

1713978527

[Stephen Gornick]

I don't think there is any reason the Bitcoin client would attempt to make an outgoing connection on port 443 unless you are specifically telling it to do so through settings (rpcconnect, rpcssl) in your Bitcoin.conf

Are you using a stock Bitcoin.conf?

Where did you get that binary build from?

[Raoul Duke]

That domain belongs to Digital River, a company who, among other things, does third party software activations. Really strange.

[bulanula]

That domain belongs to Digital River, a company who, among other things, does third party software activations. Really strange.

Maybe Gavin used that to prevent piracy with the Oracle license ?

[Raoul Duke]

That domain belongs to Digital River, a company who, among other things, does third party software activations. Really strange.

Maybe Gavin used that to prevent piracy with the Oracle license ?

Well, I would freak out if my Bitcoin client was connecting to that domain, no matter the reason.

The real question here is: Where da f*** did the OP got the binary from?

[gnar1ta$]

It's the stock client from the Bitcoin.org website. Just downloaded and installed, no compiling or third party sources. If it's something malicious it may be happening to others without them noticing.  It isn't detected by the system firewall.  I use a network monitor/outgoing connection firewall that catches it.

[Raoul Duke]

Well, that makes things even more strange. That's an HTTP SSL connection, no reason whatsoever for the Bitcoin client to open it, even if that IP was a node, which would make the port and type of connection different.

[bulanula]

It's the stock client from the Bitcoin.org website. Just downloaded and installed, no compiling or third party sources. If it's something malicious it may be happening to others without them noticing.  It isn't detected by the system firewall.  I use a network monitor/outgoing connection firewall that catches it.

We are in deep trouble then. From official website ? Maybe it has backdoor !?

[Raoul Duke]

It's the stock client from the Bitcoin.org website. Just downloaded and installed, no compiling or third party sources. If it's something malicious it may be happening to others without them noticing.  It isn't detected by the system firewall.  I use a network monitor/outgoing connection firewall that catches it.

We are in deep trouble then. From official website ? Maybe it has backdoor !?

Too bad I don't have even a Mac VM or I would try it.
Will wireshark my 0.3.24 on linux and see if it does the same. Maybe I can use wireshark to monitor the 0.4.0 that I have installed on my windows machine.

[odysseus654]

If you have ProcessExplorer, maybe grab a stack trace and see where the request originated from?  Run Fiddler2 in MITM-attack mode and see what it's sending?

It's possible that it's not the official client technically making this connection anyhow, perhaps there is a DLL inside the process that is initiating this action.  Your anti-virus/anti-adware up to date?

[gnar1ta$]

If you have ProcessExplorer, maybe grab a stack trace and see where the request originated from?  Run Fiddler2 in MITM-attack mode and see what it's sending?

It's possible that it's not the official client technically making this connection anyhow, perhaps there is a DLL inside the process that is initiating this action.  Your anti-virus/anti-adware up to date?

It's a mac...don't have ati-virus/anti-adware.  Haven't needed it before, but after this and reviewing my sshd logs (didn't have deny hosts set up properly) I think I'll install Eset.

[paraipan]

could be the "dnsseed" ? stackexchange