Monday, September 13, 2010

Chrome (chromium) browser makes random 10 character HEAD requests on startup

I recently saw this in a proxy log:
http://yyvssjupua/ 192.168.20.1/- - HEAD - from squid.
http://mskwuzkkpu/ 192.168.20.1/- - HEAD - from squid.
http://dfoigxiyyl/ 192.168.20.1/- - HEAD - from squid.
What the? After talking to the user, who told me he was running chromium, I found out this was legit chromium behaviour. Apparently some ISPs will send you to a page with their advertising if you visit a url that has a DNS lookup failure. Bastards. To combat this, on startup chrome makes three requests to random domains that are guaranteed to generate lookup failures. If they get a HTML page back, chrome knows to disable the 'did you mean' functionality that asks if you meant to visit the host or perform a search query for the host so it doesn't keep pointing you to the ISP's ad page. Smart!

1 comment:

Austin said...

I just spotted these queries. At first I thought WTF, but having found this blog, makes sense now. Good Chrome.