Acabei cavando, na Internet, uma série de posts / relatórios de bugs sobre pedidos aleatórios de DNS, feitos pelo Chrome.
A conclusão é que as solicitações de DNS "aleatórias" não são geradas por malware nem por plug-ins / complementos.
Tais solicitações de DNS são feitas intencionalmente pelo próprio Chrome, para descobrir se ele pode lidar adequadamente com pesquisas de frases na barra de endereço.
Como ele coloca a melhor explicação que encontrei, neste link :
If you type in a single-word search query, chrome needs to send a DNS request to check if this might be a single-word host name: For example, "test" might be a search for "test" or a navigation to "http://test". If the query ends up being a host, chrome shows an infobar that asks "did you mean to go to 'test' instead". For performance reasons, the DNS query needs to be asynchronous.
Now some ISPs started showing ads for non-existent domain names ( http://en.wikipedia.org/wiki/DNS_hijacking ), meaning Chrome would always show that infobar for every single-word query. Since this is annoying, chrome now sends three random DNS requests at startup, and if they all resolve (to the same IP, I think), it now knows not to show the "did you mean" infobar for single-word queries that resolve to that IP.
(Como uma nota lateral, além do nível de ISP / DNS de malware seqüestrando a entrada da Wikipedia acima mencionada, alguns pontos de acesso sem fio pagos / portais cativos também seqüestram DNS.)
Também há sugestões para essas solicitações aleatórias em intervalos aparentemente aleatórios, e não apenas ao iniciar o Google Chrome. Pelo menos, eles acontecem toda vez que a interface de rede atual sobe / recebe um novo endereço IP.
Sobre outro link relacionado ao tema de @Gilles, Incomum HEAD solicitações para URLs sem sentido do Chrome - e, portanto, adicionar à pergunta a configuração do teste de proxy; você acaba vendo logs de proxy / squid porque quando um proxy é configurado em um navegador, as solicitações são feitas por meio do proxy e cabe ao proxy para resolver as solicitações de DNS.
A falta de detalhes mais sólidos on-line, fiz o download e examinei o código-fonte do Chromium no link com o comando:
git clone https://chromium.googlesource.com/chromium/src
De acordo com os comentários do código-fonte do Chromium:
Because this function can be called during startup, when kicking off a URL fetch can eat up 20 ms of time, we delay seven seconds, which is hopefully long enough to be after startup, but still get results back quickly.
This component sends requests to three randomly generated, and thus likely nonexistent, hostnames. If at least two redirect to the same hostname, this suggests the ISP is hijacking NXDOMAIN, and the omnibox should treat similar redirected navigations as 'failed' when deciding whether to prompt the user with a 'did you mean to navigate' infobar for certain search inputs.
trigger: "On startup and when IP address of the computer changes."
We generate a random hostname with between 7 and 15 characters.
Assim, a conclusão é que esses nomes aleatórios de solicitações de DNS não são uma manifestação do comportamento de malware ; eles são testes para o Chrome / Chromium para descobrir o que ele pode fazer em relação a pelo menos as pesquisas .
P.S. Eu fiz o download das fontes do Chromium, pois o Chromium é de código aberto; da minha investigação, a lógica que lida com essa funcionalidade pode ser encontrada em src/chrome/browser/intranet_redirect_detector.cc e src/chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.cc . (daí a citação anterior dos comentários)
Trechos de src/chrome/browser/intranet_redirect_detector.cc :
void IntranetRedirectDetector::FinishSleep() {
in_sleep_ = false;
// If another fetch operation is still running, cancel it.
fetchers_.clear();
resulting_origins_.clear();
const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
if (cmd_line->HasSwitch(switches::kDisableBackgroundNetworking))
return;
DCHECK(fetchers_.empty() && resulting_origins_.empty());
// Create traffic annotation tag.
net::NetworkTrafficAnnotationTag traffic_annotation =
net::DefineNetworkTrafficAnnotation("intranet_redirect_detector", R"(
semantics {
sender: "Intranet Redirect Detector"
description:
"This component sends requests to three randomly generated, and "
"thus likely nonexistent, hostnames. If at least two redirect to "
"the same hostname, this suggests the ISP is hijacking NXDOMAIN, "
"and the omnibox should treat similar redirected navigations as "
"'failed' when deciding whether to prompt the user with a 'did you "
"mean to navigate' infobar for certain search inputs."
trigger: "On startup and when IP address of the computer changes."
data: "None, this is just an empty request."
destination: OTHER
}
policy {
cookies_allowed: false
setting: "This feature cannot be disabled by settings."
policy_exception_justification:
"Not implemented, considered not useful."
})");
// Start three fetchers on random hostnames.
for (size_t i = 0; i < 3; ++i) {
std::string url_string("http://");
// We generate a random hostname with between 7 and 15 characters.
const int num_chars = base::RandInt(7, 15);
for (int j = 0; j < num_chars; ++j)
url_string += ('a' + base::RandInt(0, 'z' - 'a'));
GURL random_url(url_string + '/');
std::unique_ptr<net::URLFetcher> fetcher = net::URLFetcher::Create(
random_url, net::URLFetcher::HEAD, this, traffic_annotation);
// We don't want these fetches to affect existing state in the profile.
fetcher->SetLoadFlags(net::LOAD_DISABLE_CACHE |
net::LOAD_DO_NOT_SAVE_COOKIES |
net::LOAD_DO_NOT_SEND_COOKIES |
net::LOAD_DO_NOT_SEND_AUTH_DATA);
fetcher->SetRequestContext(g_browser_process->system_request_context());
fetcher->Start();
net::URLFetcher* fetcher_ptr = fetcher.get();
fetchers_[fetcher_ptr] = std::move(fetcher);
}
}
void IntranetRedirectDetector::OnURLFetchComplete(
const net::URLFetcher* source) {
// Delete the fetcher on this function's exit.
auto it = fetchers_.find(const_cast<net::URLFetcher*>(source));
DCHECK(it != fetchers_.end());
std::unique_ptr<net::URLFetcher> fetcher = std::move(it->second);
fetchers_.erase(it);
// If any two fetches result in the same domain/host, we set the redirect
// origin to that; otherwise we set it to nothing.
if (!source->GetStatus().is_success() || (source->GetResponseCode() != 200)) {
if ((resulting_origins_.empty()) ||
((resulting_origins_.size() == 1) &&
resulting_origins_.front().is_valid())) {
resulting_origins_.push_back(GURL());
return;
}
redirect_origin_ = GURL();
}
....
Trechos de src/chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.cc :
// Returns true if |final_url| doesn't represent an ISP hijack of
// |original_url|, based on the IntranetRedirectDetector's RedirectOrigin().
bool IsValidNavigation(const GURL& original_url, const GURL& final_url) {
....
void ChromeOmniboxNavigationObserver::NavigationEntryCommitted(
const content::LoadCommittedDetails& load_details) {
load_state_ = LOAD_COMMITTED;
if (ResponseCodeIndicatesSuccess(load_details.http_status_code) &&
IsValidNavigation(match_.destination_url,
load_details.entry->GetVirtualURL()))
OnSuccessfulNavigation();
if (!fetcher_ || (fetch_state_ != FETCH_NOT_COMPLETE))
OnAllLoadingFinished(); // deletes |this|!
}
...
void ChromeOmniboxNavigationObserver::OnURLFetchComplete(
const net::URLFetcher* source) {
DCHECK_EQ(fetcher_.get(), source);
const net::URLRequestStatus& status = source->GetStatus();
int response_code = source->GetResponseCode();
fetch_state_ =
(status.is_success() && ResponseCodeIndicatesSuccess(response_code)) ||
((status.status() == net::URLRequestStatus::CANCELED) &&
((response_code / 100) == 3) &&
IsValidNavigation(alternate_nav_match_.destination_url,
source->GetURL()))
? FETCH_SUCCEEDED
: FETCH_FAILED;
if (load_state_ == LOAD_COMMITTED)
OnAllLoadingFinished(); // deletes |this|!
}
Ligeiramente relacionado: Solicitações de DNS de caso misto - Malware na minha rede?