Hi, This domain (xf.gdprvalidate.de) is used by malicious browser extensions as a covert backdoor channel. I advise you to check if you have any of the browser extensions installed named near the bottom of this article: https://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests/