What are these uploads to non-existent www addresses?

New user, just getting started here. I have an Umbrel on a pi 4, with the default settings (Tor on, etc). It has been fully sync’d for a week. I haven’t opened any channels yet, nor transferred any BTC to the wallet. I installed Mempool, RTL, and ThunderHub.

I periodically get alerts from my firewall that the pi running Umbrel has uploaded data. The destination is something like www.cz4mktqfn.com or www.7kbpvn.com (not exactly those names). None of these names seem to exist when I try whois or ping.

The amounts uploaded have varied from about 1MB to 80MB.

This only started after the node was fully sync’d, so I don’t think this is normal sync traffic.

Anyone have an explanation of what is going on here?

Thank you.