Noticed an interesting thing whilst debugging one of my websocket applications that Google Chrome will push out 3 http requests upon a network connection status changing;

Quite disconcerting and looks almost as if some malware is checking out to a random server.

I don't quite understand the why though since they all return a 502 or have no response code at all since the destination does not exist.

On Disconnect:

Reconnect:

I guess the main question is this normal and what the use is; howcome they wouldn't go for a dns lookup that actually exists?