I'm seeing funny URL requests in Charles with seemingly random characters (see below). All the requests fail but it looks a lot like a virus. How can I know which application sent them?
Let me guess; you are using Chrome right?
This is not a virus (note how they are all 10-letter “domains”), this is Chrome testing DNS servers to detect failure-redirection.
What happens is that some ISPs have changed their DNS servers so that when you try to navigate to a URL that does not exist, instead of providing you with a simple error page, instead the ISP provides you with an actual web page that has ads, search results, and other junk—presumably related to the URL/search term that you attempted to go to. (Chrome itself offers this as an option.)
Chrome combines the search bar and the address bar together into the Omnibar and also hides the protocol by default (you don’t have to specifically enter
So to avoid having the user frustratingly always see an ISPs error/ad page when they type such terms in the Omnibar, what Chrome does is to try connecting to a few random, nonsense URLs. If they all (magically) resolve, and to the same IP at that, then Chrome knows that the DNS server is redirecting to an error page, and so Chrome can react accordingly (e.g., treat the term as a search query, ask you for alternate, related terms; etc.)
Plus, it also helps to avoid DNS hijacking since in that scenario, most if not all (depending on the hijacking implementation) DNS queries will usually be resolved to the same IP for spying before being passed on (if at all) to the real IP.
A couple of things you can try: