# How to know that Syncthing isn't full of malware? (New install: immediate connect to hundreds of IPs and bogus telecom services)
**URL:** https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976
**Category:** Feature
**Created:** [August 2, 2026, 12:28pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976 "2026-08-02T12:28:51Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@zac](https://forum.syncthing.net/u/zac)
#### Post date: [August 2, 2026, 12:28pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/1 "2026-08-02T12:28:51Z")
Brand new install of Syncthing. As soon as I start it up, my firewall alerts me to Syncthing trying to connec to:
1. aebc .com
2. voipstunt .com
3. voipbuster .com
4. 1und1 .de
5. sipgate .net
6. miwifi .com
7. internetcalls .com
8. hitv .com
9. counterpath .com
10. … 67 bare IP addresses
All blocked, thankfully… At which point I instantly kill Syncthing and decided it likely had some malware in the build.
Some research later, yes, I see that all those connection attempts might have been because of relaying. It’s hard to say. I mean, all those VOIP sites, etc., do _not_ look legit to me.
Still deciding if I want to re-install Syncthing.
Here’s a suggestion, though: If these _are_ legitimate relays, perhaps make it more clear what the heck is going on inside Syncthing:
1. Maybe Relaying should be _off_ be default?
2. Once turned on, some kind of clear message displayed or query about which relays to connect to?
3. Possibly a switch: distinguish between my (private) relay and just “open up to anything on the internet?” (I’ll never do the latter).
---
### Author:  [@tomasz86](https://forum.syncthing.net/u/tomasz86)
#### Post date: [August 2, 2026, 1:05pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/2 "2026-08-02T13:05:56Z")
Please see [https://docs.syncthing.net/users/faq.html#why-does-syncthing-connect-to-this-unknown-suspicious-address](https://docs.syncthing.net/users/faq.html#why-does-syncthing-connect-to-this-unknown-suspicious-address). You can always disable relays completely, or run your own, or be selective and specify only those you want to connect to.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [August 2, 2026, 1:13pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/3 "2026-08-02T13:13:07Z")
> [@zac](#):
>
> 1. Maybe Relaying should be _off_ be default?
Relaying is an essential part of making the installation and connection establishment actually work out of the box for normal users. Not having it enabled by default would be a net loss in functionality, for no increase in security.
---
### Author:  [@mraneri](https://forum.syncthing.net/u/mraneri)
#### Post date: [August 2, 2026, 1:14pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/4 "2026-08-02T13:14:51Z")
As you figured out there was never any malware. (Assuming you used the official release. Maintainers can’t be sure what’s in other releases.)
The reaching out to those servers is safe and harmless. The vast majority of people don’t know it’s happening and shouldn’t necessarily care. They install syncthing and they want it to “just work.” Relaying is a feature that helps it just work for people behind NAT, which is probably most of them.
I don’t see any issue with relays being enabled by default.
What’s the issue?
---
### Author:  [@marbens](https://forum.syncthing.net/u/marbens)
#### Post date: [August 2, 2026, 1:43pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/5 "2026-08-02T13:43:17Z")
The 9 domains look like STUN servers. The 67 bare IP addresses are probably relays.
---
### Author:  [@zac](https://forum.syncthing.net/u/zac)
#### Post date: [August 2, 2026, 1:45pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/6 "2026-08-02T13:45:15Z")
You could take the approach of Synctrain iOS, and _ask during initial config_. Synctrain gives the user two choices, explaining exactly what each one is (relaying on vs. relaying off). One click on the iOS devices and you are nicely configured and well-informed.
---
### Author:  [@zac](https://forum.syncthing.net/u/zac)
#### Post date: [August 2, 2026, 1:45pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/7 "2026-08-02T13:45:51Z")
The issue is that it has _exactly_ the signature of malware, and there is no explanation up-front about what it’s going to do (and no confirmation beforehand).
---
### Author:  [@zac](https://forum.syncthing.net/u/zac)
#### Post date: [August 2, 2026, 1:47pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/8 "2026-08-02T13:47:00Z")
Well and good for someone that reads that FAQ ahead of time. For everyone else, it looks like malware. My point is that it’s not a good configuration “out of the box” combined with no up-front confirmation about what it’s about to do.
---
### Author:  [@mraneri](https://forum.syncthing.net/u/mraneri)
#### Post date: [August 2, 2026, 1:48pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/9 "2026-08-02T13:48:56Z")
Non of my malware detection flagged it as malware. Not sure what tools you are using.
---
### Author:  [@zac](https://forum.syncthing.net/u/zac)
#### Post date: [August 2, 2026, 1:51pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/10 "2026-08-02T13:51:53Z")
Little Snitch firewall. Immediately popped up with a long list of suspicious looking outgoing connection attempts (domains like voipstunt .com and voipbuster .com) as well as 67 random IP address (reverse DNS on a few, and didn’t like the look of them… so blocked everything and killed it).
---
### Author:  [@mraneri](https://forum.syncthing.net/u/mraneri)
#### Post date: [August 2, 2026, 2:43pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/11 "2026-08-02T14:43:11Z")
Okay so the little snitch just alerted you to traffic. It don’t make any judgment about whether the traffic was a sign of malware
you were the malware detector and detected a false positive.
that’s fine. It’s not necessarily a bad idea to monitor traffic and stop what you don’t like.
---
### Author:  [@tomasz86](https://forum.syncthing.net/u/tomasz86)
#### Post date: [August 2, 2026, 2:57pm UTC](https://forum.syncthing.net/t/how-to-know-that-syncthing-isnt-full-of-malware-new-install-immediate-connect-to-hundreds-of-ips-and-bogus-telecom-services/26976/12 "2026-08-02T14:57:54Z")
> [@zac](#):
>
> Well and good for someone that reads that FAQ ahead of time. For everyone else, it looks like malware. My point is that it’s not a good configuration “out of the box” combined with no up-front confirmation about what it’s about to do.
This has been discussed many times before, but the conclusion has always been that it’s better to make Syncthing work for the average user by default without having to fiddle with the configuration. For example, relays will be required when using Syncthing on a mobile network, which is one of the most common use cases.
If you’re on a more technical side, you can simply switch what you don’t like in the configuration off. The same cannot be said about someone who’s less tech-savvy and has no idea about what the technical terminology even means.