On my mac when I run Google Chrome, it wants connect at unknown domain on port 80, at example some domain name are: cccpveut, fuflavlorxna, crqzzif, ecc. They appear all domain name of first level.....it seems very strange.... All domains pointing at same ip: 126.96.36.199 (querying the dns it has a ptr record with value amazonws).
I detect this connection with Little Snitch firewall, I tried to disable all extension installed (adblock, ecc), create a new profile, but every time that I run GoogleChrome, it wants connect at this ip.
Safari doesn't connect at this IP....
I run a scan on virustotal on this IP and it is not a malicious ip...
But, why Google Chrome wants connect it? I don't think that it is a legitimate connection.
I intercepted the request with proxy, and it sends a request HTTP with HEAD method. Probably is the check of Google for DNS Hijacking. This is the request:
HEAD / HTTP/1.1 Host: tqkoifdrughs User-Agent: Mozilla/5.0 .... Connection: close