"Accidental" porn hits from social media sites?

[mainerdns]

Here is the situation. One of my kids has an iPhone used extensively on my home network. In stats I am consistently seeing porn sites that have been blocked, mostly with a consistent number. So 20 sites blocked 4 times each over the course of a week or so. I know from experimenting and observation that the sites are not specifically being 'visited' by the browser. And if they were you would expect a different pattern from the one I describe.

The question is this: if the accounts they follow, are friends with, have Liked, whatever on Facebook, instagram, snapchat, etc., if ANY of them have some porn images linked to them would that then show up in my network stats?

The good news is the sites and images were blocked. The issue is that I would not want to make accusations and take away accounts and devices if the kid is using social media 'innocently' and this is just an unwanted byproduct of whom they might be linked to.

I have access and have examined all the content in these different accounts. I have not found porn links per se, but I wonder if some of the people they might follow/like/etc., like rappers, media stars, some random loser, etc. might have those links on THEIR account would that be pinging my network with these porn site blocks.

thanks,

mainer

[danicheu]

Hello mainer!

If you have set up filtering to be performed at the network level for your account, then any device connecting via your network connection would be filtered based on your network filtering settings. This would include any of the friends that connect to your network to access the internet.

As you have already noted, many sites will request from numerous domains to draw content from multiple sources. This means that you may occasionally see blocked domains that you are filtering for show up in your reports, even if you haven't accessed those domains directly.

[rotblitz]

Most modern browsers have DNS prefetching enabled which causes that for *every* domain found at *every* URL reference on *every* visited webpage a DNS query is being performed, once for each domain name if DNS cache is enabled as well, without ever accessing them or loading content from them.

That said, under these circumstances and based on your DNS stats you can't even guess what web activity has been performed by humans and browsers, and not just automatically in the background, invisible to the users.  The only way to get more clear DNS stats is to disable DNS prefetching in the browsers, so that only domains appear where web content was actually loaded from.

Not sure if you were concerned about "any of the friends that connect to your network to access the internet", but I don't think so.

[mainerdns]

Thanks rotblitz - this makes sense. It seems 'automated' because of the consistency and numbers of domains and pings. I will try disabling prefetching on the browsers and see what happens.