RejZoR,
What happened? Avast is not an offline AV, it still provides quite a lot of functions with the help of our backends, and the list is getting bigger every day.
For example, ip-info.ff.avast.com provides the client with information about its wan IP address, such as ISP and ASN, and it’s used it several places, such as displaying ISP in Wifi-inspector scans network detail. No connection with any 3rd party (or 1st party) analytics here.
Avast uses v7.stats.avast.com when downloading a new VPS (afaik the only usage I know), v7event records the result of VPS update – success/failure/old-program, AFAIK you can not receive VPS updates without accessing these two - unless you would be downloading the updates manually.
“ipm-provider” is hosting parts of our UI, so again, no possibility to use the product without accessing this one.
And the last one - analytics - well, as the name suggests, its the source of all our data for all data analysis and AI, from detections to error reports. With cloud detections, there will for sure be several accesses to this guy, CyberCapture connects here and many other components. Again, the same domain is used for other products if the submits are on, but it is also essential for the core AV product.
RejzoR, sorry to have kept you waiting for a response. None of this is very new. It has been like this for many years, didn’t expect that someone so seasoned would be surprised and worried. While Avast works better when connected to our backends, fully offline setups are also possible, several of our enterprise customers are using Avast like that. You would have to resort to blocking *.avast.com on the firewall and then providing the AV with VPS updates manually.
One last thing, you mentioned that a couple of blacklists are blocking some or all of Avast core domains? Can you give me an example of such a list or a product that does that? We are facing complains (from time to time) from users about not getting the latest version of VPS, or mismatched versions of the UI and the scanning service - I’d like to know more. If anyone is deliberately blocking these - we might at least stop hunting for it as a bug and let the support team be aware.
Thanks a lot.
Lukas.