I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a reload it disappears from devtools).
NOT SURE WHAT HAPPENS IF YOU OPEN THE LINK
Here's a couple of examples
A whois on the domain reveals it's registered by http://privacyprotect.org which, from what I gather is a service meant to obfuscate real domain owners whois info. When I cURL the URL, it's a 1x1 image. There is a query parameter in the URL which I don't know what it contains (it doesn't look like a JWT and I haven't been able to identify the hash). There is no initiator for the request in dev tools.
If I run chrome with the disabled plugins/extensions, the request FAILS to be blocked (I haven't been able to "catch" it without request blockers (ublock etc)).Which might mean it's hidden because it's not being blocked. Anyway, very weird, I'm kind of lost as to where to continue or any idea what it might be or how I would remedy it, as it is obviously some sort of malware that hаs affected the machine. Also I'm running Ubuntu 18 LTS, latest updates etc. Ran linux anti-malware software (the few most popular options I found by googling), they came up empty.
Open to any ideas as to what it might be, or how I might proceed either with identifying the cause or how I would "fix" it (without wiping the machine of course)?