Comment by everdrive

It uses these domains:

http://xtrapath1.izatcloud.net

http://xtrapath2.izatcloud.net

http://xtrapath3.izatcloud.net

I'm not sure what part of the OS is sending it, but it's definitely happening (and is block-able!)