Hello all,
According to the Wireshark record my computer connects to various services often, including Amazon, Hetzner, 1337 Services GmbH, Evanzo GmbH and ThomasFamilyInvestments. The most often were the connections to mail.my-mail.rocks which is a part of Netcup GmbH. I have a somewhat minimal distro and the attached recordings were made when no app was open including no browser. I can send the other screenshots showing other connections too. I’m suspecting of malware since some time ago but can you help me clarify these connections please?
so am i running a relay in the background although tor browser is closed?
If it’s like a vpn interface, it’s still running as a deamon in the background even if the browsers are closed.
Like others have said you can check what application is using each open port. You can also check running processes (ps | grep keywords) and interfaces (ip a).