sudo watch lsof -i and
sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox would show "Server not found") on https . Opened sockets for these connections belong to firefox. What could this mean?
Both these tools use rDNS to look up names from IP addresses. By convention forward and reverse DNS should match but in some cases (for example a server hosting many different websites) it may not make sense.
Consider a website somesite.contoso.com, to which you connect with Firefox or some other browser. It has an IP address 198.51.100.13, which has an rDNS entry pointing back to server57.example.net. You might not find an A record in the DNS for server57.example.net but you would find somesite.contoso.com and possibly even web.example.org both with a forward mapping to 198.51.100.13.