The list of malicious sites is probably the safebrowsing block list in Google chrome. gvt1.com is a Google site used to download various Chrome related assets.

The list of malicious sites is probably the safebrowsing block list in Google chrome. gvt1.com is a Google site used to download various Chrome related assets. Marktext uses Electron so it is automatically downloading these. EDIT: After decompressing http://r4---sn-8xgp1vo-xfgs.gvt1.com/edgedl/release2/chrome_component/AIn3zS2zP2W0T6dH89fdfUo_2020.11.29.1203/Vx5-bd3sH9glYb_6GC_ovw?cms_redirect=yes&mh=vQ&mip=<myPublicIPAddress>&mm=28&mn=sn-8xgp1vo-xfgs&ms=nvh&mt=1606761620&mv=m&mvi=4&pl=17&shardbypass=yes http://r4---sn-8xgp1vo-xfgs.gvt1.com/edgedl/release2/chrome_... (linked in the Github issue) and looking at the manifest.json, this is an extension called "Crowd Deny." Reading https://forum.vivaldi.net/topic/43831/crowd-deny-what-is-it/12 https://forum.vivaldi.net/topic/43831/crowd-deny-what-is-it/..., it seems to be used as a blacklist to stop push notification spam.