I am very late with an reaction to this case. I had (or still have) the same reaction on my system. I tried to get an explanation from Avira as well. Because I can't understand, why Avira is not logging this attempts. If there would be an entrance in a log-file than I had a better feeling believing your explanation. So I have doubt where you are fishing this information from the webguard from Avira. Can you give such an information? Avira is not able (and not willing) to give an explanation in such mixed installations.