opened connection when visit many sites. also opens when visit other site. virustotal report and other user comment is bothering. popular story is that it is only certificate help "pulling a certificate revocation list (CRL) to update it in case the certificate has been revoked for whatever reason" source https://forum.netgate.com/topic/110956/72-21-91-29 dont know if this sites are safe below but there is information. this is bad https://ip-46.com/72.21.91.29 ...................................................... more reports ...................................................... https://forums.majorgeeks.com/threads/i-have-obtained-a-hackers-ip-address-72-21-91-29.317972/ https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/72.21.91.29 https://forums.malwarebytes.com/topic/244111-connections-to-72219129/ https://otx.alienvault.com/indicator/ip/72.21.91.29

i dont know whats happening with all these reports but remove htttpseverywhere and the connection is gone