Page 1 of 1

Serviio Backdoor or Calling Home?

PostPosted: Tue May 25, 2021 9:57 am
by mrmichaelrb
There are two unexplained lines in my netstat:

  Code:
# netstat -n -p
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        1      0 192.168.0.200:34222     52.202.215.126:443      CLOSE_WAIT  1169/java
tcp       25      0 192.168.0.200:38588     172.67.138.108:443      CLOSE_WAIT  1169/java


I've verified that process id 1169 (java) is my Serviio process. Why is Serviio contacting these addresses?

I've disabled external things like OpenSubtitles.org and Trakt.tv, so I don't understand why Serviio would be calling out to anywhere...

52.202.215.126 is associated with:
canyouseeme.org
checkip.org

172.67.138.108 is associated with:
yougetsignal.com
framearthouston.com
1477floribundaave.com

Re: Serviio Backdoor or Calling Home?

PostPosted: Tue May 25, 2021 4:47 pm
by atc98092
I could see CheckIP for MediaBrowser determining it's public IP address. But Zip is the only person that can really answer that question.

Re: Serviio Backdoor or Calling Home?

PostPosted: Fri Jun 04, 2021 3:07 pm
by zip
yep, these services check open ports and your public IP address. These are used for the data on Remote tab in the console and for the Alexa skill (for example). I think ServiiGo might also use these.

It's literally juast calling these APIs every few minutes to keep the data up-to-date.