Malware sites trigger alerts in Chrome days later

[snowbound]

Using Windows7 x64 and Chrome Version 57.0.2987.133 (64-bit) as well as Opera and Firefox x64. Using Malwarebytes Anti-malware (MBAM) version 3 along with Eset NO32 Endpoint Antivirus 5.0 on multiple computers. If one visits a possible malware website via a Google search result and MBAM or NOD32 blocks access to the site as it should.

However a day later, MBAM or NOD32 will block an outgoing connection from Chrome.exe/Opera.exe (depending on which browser is being used) from reaching the possible malware site(s) that were blocked the prior day(s). This connection is not user initiated but rather browser does it on its own. Clearing browser cache and search history does not help and hours later another connection attempt may occur.

Scanning the computers with various scanners showed no infection. Scanning files within the user Chrome/Opera data directory for the malware site domain returned a hit on Privacy Badger's log file. Disabling the extension no further outbound connections have been made over a 24 hr period.

Does Privacy Badger perform a behind the scene outbound connection days later for previously encountered websites?

[ghostwords]

Yes, exactly, Privacy Badger issues checks for the EFF Do Not Track policy for domains you encountered while browsing at some point in the past. The reason you haven't noticed these checks earlier is that periodic (as opposed to as-you-surf) rechecking was broken until Badger version 2017.3.28.

Since that update, we've gotten feedback about CPU issues caused by DNT policy rechecking. We reviewed our approach, and decided we are going to remove periodic rechecking in the next update. So you won't be seeing these anymore once #1312 is released (should be this or the following week).