What is the rest of the text on the URL:Mal alert, as it normally includes the process responsible for the connection attempt ?

This could give an idea of what might be the true cause.