What is the rest of the text on the URL:Mal alert, as it normally includes the process responsible for the connection attempt ?
This could give an idea of what might be the true cause.