Since 2 weeks or so Rapidweaver tries to contact scammy domains when I open my main project. I see a connection dialog in Little Snitch.
The website at www.mothsoftware.com and it's TotalCMS 1 blog continue to work fine. The other projects for the domains manual.mothsoftware.com and messages.mothsoftware.com do not show this issue.
I did some tests with the help of ChatGPT of greping the main RapidWeaver project file. There are no obvious obfuscated Javascripts.
Any ideas what might cause this? What else can I try?