1

I use network monitoring to monitor my network activity, a few days ago I discovered strangeness, chrome tries to access a random address with port 80, see below,

chrome.exe - mecxajhjnq:80 error : Could not connect through proxy.
chrome.exe - vdjymqwsnk:80 error : Could not connect through proxy.
chrome.exe - brgzmduwqu:80 error : Could not connect through proxy.
chrome.exe - mecxajhjnq:80 error : Could not connect through proxy.
chrome.exe - vdjymqwsnk:80 error : Could not connect through proxy.
chrome.exe - brgzmduwqu:80 error : Could not connect through proxy.

my network monitoring rules successfully block this request, and chrome continue to run normally, but I am still curious, what would he do?

2
  • firstly I would check if there is an unwanted proxy setting, then, would check my routing tables. if it persists, run a malware scan. Apr 26, 2013 at 8:41
  • there is no unwanted proxy setting and routing tables is fine, i dont have problem with connection, just curious what is random address, and I also have doing a full scan on my system.
    – nyongrand
    Apr 26, 2013 at 8:53

2 Answers 2

2

Its most likely an extension misbehaving. Disable all extensions and i doubt you will continue to see this.

1
1

I just found the answer here: http://www.ghacks.net/2012/02/18/chrome-connecting-to-random-domains-on-start-here-is-why/

and here: https://mikewest.org/2012/02/chrome-connects-to-three-random-domains-at-startup/

... For most users, it is not clear why the browser is making those connections, and some have even assumed that they were either made to send information privately to Google, for tracking purposes, or even caused by malware running on the system.

Mike West analyzed the part of the browser's source code that was responsible for making the connections. He discovered that Chrome and Chromium are making those connections to help the browser's Omnibox figure out user intents correctly.

The issue that Google aims to fix with these connections is easily explained. Some Internet Service Providers have started to intercept requests that do not resolve properly. If you enter ghacks for instance in the address bar and tap on the return key afterwards, Chrome needs to figure out if you want to search for the term ghacks, or if you want to visit the site http://ghacks/. Since it cannot do that, it displays an infobar if the word would resolve to an existing domain name giving the user the chance to open the domain with another click.

When ISPs intercept the lookups to display their own error pages, usually filled with advertisement and search options, then it appears to the browser as if the word would resolve just fine. This in turn would mean that users would see the infobox in the browser even for words that do not resolve.

To prevent this, Google is making these three initial lookups on start up to see if ISPs intercept requests that cannot be resolved. It compares the IP addresses of the pages that are returned, and turns the infobox off if they are identical (as this suggests an ISP is intercepting the look ups).

1
  • Extremely interesting. Thanks for posting that. For everyone that doesn't read through it, it's for in address bar searching.
    – Will
    Apr 29, 2013 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .